--- /dev/null
+From 6edb53c7f829e5510d14d0dcbc2df022129b1342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Sep 2021 11:10:42 +0900
+Subject: ALSA: oxfw: fix transmission method for Loud models based on OXFW971
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit 64794d6db49730d22f440aef0cf4da98a56a4ea3 ]
+
+Loud Technologies Mackie Onyx 1640i (former model) is identified as
+the model which uses OXFW971. The analysis of packet dump shows that
+it transfers events in blocking method of IEC 61883-6, however the
+default behaviour of ALSA oxfw driver is for non-blocking method.
+
+This commit adds code to detect it assuming that all of loud models
+based on OXFW971 have such quirk. It brings no functional change
+except for alignment rule of PCM buffer.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210913021042.10085-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/firewire/oxfw/oxfw.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index cb5b5e3a481b..daf731364695 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -184,13 +184,16 @@ static int detect_quirks(struct snd_oxfw *oxfw, const struct ieee1394_device_id
+ model = val;
+ }
+
+- /*
+- * Mackie Onyx Satellite with base station has a quirk to report a wrong
+- * value in 'dbs' field of CIP header against its format information.
+- */
+- if (vendor == VENDOR_LOUD && model == MODEL_SATELLITE)
++ if (vendor == VENDOR_LOUD) {
++ // Mackie Onyx Satellite with base station has a quirk to report a wrong
++ // value in 'dbs' field of CIP header against its format information.
+ oxfw->quirks |= SND_OXFW_QUIRK_WRONG_DBS;
+
++ // OXFW971-based models may transfer events by blocking method.
++ if (!(oxfw->quirks & SND_OXFW_QUIRK_JUMBO_PAYLOAD))
++ oxfw->quirks |= SND_OXFW_QUIRK_BLOCKING_TRANSMISSION;
++ }
++
+ return 0;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 8a50c0c22d618f905c5cd512085869748d239ceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 12:51:55 +0200
+Subject: ALSA: usb-audio: Unify mixer resume and reset_resume procedure
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7b9cf9036609428e845dc300aec13822ba2c4ab3 ]
+
+USB-audio driver assumes that the normal resume would preserve the
+device configuration while reset_resume wouldn't, and tries to restore
+the mixer elements only at reset_resume callback. However, this seems
+too naive, and some devices do behave differently, resetting the
+volume at the normal resume; this resulted in the inconsistent volume
+that surprised users.
+
+This patch changes the mixer resume code to handle both the normal and
+reset resume in the same way, always restoring the original mixer
+element values. This allows us to unify the both callbacks as well as
+dropping the no longer used reset_resume field, which ends up with a
+good code reduction.
+
+A slight behavior change by this patch is that now we assign
+restore_mixer_value() as the default resume callback, and the function
+is no longer called at reset-resume when the resume callback is
+overridden by the quirk function. That is, if needed, the quirk
+resume function would have to handle similarly as
+restore_mixer_value() by itself.
+
+Reported-by: En-Shuo Hsu <enshuo@chromium.org>
+Cc: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Link: https://lore.kernel.org/r/CADDZ45UPsbpAAqP6=ZkTT8BE-yLii4Y7xSDnjK550G2DhQsMew@mail.gmail.com
+Link: https://lore.kernel.org/r/20210910105155.12862-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 18 ++++--------------
+ sound/usb/mixer.c | 26 ++++----------------------
+ sound/usb/mixer.h | 3 +--
+ sound/usb/mixer_quirks.c | 2 +-
+ 4 files changed, 10 insertions(+), 39 deletions(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 6abfc9d079e7..fa75b7e72ad1 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -1020,7 +1020,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message)
+ return 0;
+ }
+
+-static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
++static int usb_audio_resume(struct usb_interface *intf)
+ {
+ struct snd_usb_audio *chip = usb_get_intfdata(intf);
+ struct snd_usb_stream *as;
+@@ -1046,7 +1046,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume)
+ * we just notify and restart the mixers
+ */
+ list_for_each_entry(mixer, &chip->mixer_list, list) {
+- err = snd_usb_mixer_resume(mixer, reset_resume);
++ err = snd_usb_mixer_resume(mixer);
+ if (err < 0)
+ goto err_out;
+ }
+@@ -1066,20 +1066,10 @@ err_out:
+ atomic_dec(&chip->active); /* allow autopm after this point */
+ return err;
+ }
+-
+-static int usb_audio_resume(struct usb_interface *intf)
+-{
+- return __usb_audio_resume(intf, false);
+-}
+-
+-static int usb_audio_reset_resume(struct usb_interface *intf)
+-{
+- return __usb_audio_resume(intf, true);
+-}
+ #else
+ #define usb_audio_suspend NULL
+ #define usb_audio_resume NULL
+-#define usb_audio_reset_resume NULL
++#define usb_audio_resume NULL
+ #endif /* CONFIG_PM */
+
+ static const struct usb_device_id usb_audio_ids [] = {
+@@ -1101,7 +1091,7 @@ static struct usb_driver usb_audio_driver = {
+ .disconnect = usb_audio_disconnect,
+ .suspend = usb_audio_suspend,
+ .resume = usb_audio_resume,
+- .reset_resume = usb_audio_reset_resume,
++ .reset_resume = usb_audio_resume,
+ .id_table = usb_audio_ids,
+ .supports_autosuspend = 1,
+ };
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 9b713b4a5ec4..fa7cf982d39e 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3655,33 +3655,16 @@ static int restore_mixer_value(struct usb_mixer_elem_list *list)
+ return 0;
+ }
+
+-static int default_mixer_reset_resume(struct usb_mixer_elem_list *list)
+-{
+- int err;
+-
+- if (list->resume) {
+- err = list->resume(list);
+- if (err < 0)
+- return err;
+- }
+- return restore_mixer_value(list);
+-}
+-
+-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume)
++int snd_usb_mixer_resume(struct usb_mixer_interface *mixer)
+ {
+ struct usb_mixer_elem_list *list;
+- usb_mixer_elem_resume_func_t f;
+ int id, err;
+
+ /* restore cached mixer values */
+ for (id = 0; id < MAX_ID_ELEMS; id++) {
+ for_each_mixer_elem(list, mixer, id) {
+- if (reset_resume)
+- f = list->reset_resume;
+- else
+- f = list->resume;
+- if (f) {
+- err = f(list);
++ if (list->resume) {
++ err = list->resume(list);
+ if (err < 0)
+ return err;
+ }
+@@ -3702,7 +3685,6 @@ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list,
+ list->id = unitid;
+ list->dump = snd_usb_mixer_dump_cval;
+ #ifdef CONFIG_PM
+- list->resume = NULL;
+- list->reset_resume = default_mixer_reset_resume;
++ list->resume = restore_mixer_value;
+ #endif
+ }
+diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
+index ea41e7a1f7bf..16567912b998 100644
+--- a/sound/usb/mixer.h
++++ b/sound/usb/mixer.h
+@@ -70,7 +70,6 @@ struct usb_mixer_elem_list {
+ bool is_std_info;
+ usb_mixer_elem_dump_func_t dump;
+ usb_mixer_elem_resume_func_t resume;
+- usb_mixer_elem_resume_func_t reset_resume;
+ };
+
+ /* iterate over mixer element list of the given unit id */
+@@ -122,7 +121,7 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag,
+
+ #ifdef CONFIG_PM
+ int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer);
+-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume);
++int snd_usb_mixer_resume(struct usb_mixer_interface *mixer);
+ #endif
+
+ int snd_usb_set_cur_mix_value(struct usb_mixer_elem_info *cval, int channel,
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 0a3cb8fd7d00..4a4d3361ac04 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -151,7 +151,7 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer,
+ *listp = list;
+ list->mixer = mixer;
+ list->id = id;
+- list->reset_resume = resume;
++ list->resume = resume;
+ kctl = snd_ctl_new1(knew, list);
+ if (!kctl) {
+ kfree(list);
+--
+2.33.0
+
--- /dev/null
+From 3573cb0bd849d05fb58e477b60412a4a8abf1b52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 13:44:36 -0500
+Subject: ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 58eafe1ff52ee1ce255759fc15729519af180cbb ]
+
+The SoundWire BEs make use of 'stream' functions for .prepare and
+.trigger. These functions will in turn force a Bank Switch, which
+implies a wait operation.
+
+Mark SoundWire BEs as nonatomic for consistency, but keep all other
+types of BEs as is. The initialization of .nonatomic is done outside
+of the create_sdw_dailink helper to avoid adding more parameters to
+deal with a single exception to the rule that BEs are atomic.
+
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <bard.liao@intel.com>
+Link: https://lore.kernel.org/r/20210907184436.33152-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 1a867c73a48e..cb3afc4519cf 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -860,6 +860,11 @@ static int create_sdw_dailink(struct device *dev, int *be_index,
+ cpus + *cpu_id, cpu_dai_num,
+ codecs, codec_num,
+ NULL, &sdw_ops);
++ /*
++ * SoundWire DAILINKs use 'stream' functions and Bank Switch operations
++ * based on wait_for_completion(), tag them as 'nonatomic'.
++ */
++ dai_links[*be_index].nonatomic = true;
+
+ ret = set_codec_init_func(link, dai_links + (*be_index)++,
+ playback, group_id);
+--
+2.33.0
+
--- /dev/null
+From 05ce614e253f5bfaaaaeea40f26b96c8ef9fb7e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 11:50:08 +0300
+Subject: ASoC: SOF: loader: release_firmware() on load failure to avoid
+ batching
+
+From: Marc Herbert <marc.herbert@intel.com>
+
+[ Upstream commit 8a8e1813ffc35111fc0b6db49968ceb0e1615ced ]
+
+Invoke release_firmware() when the firmware fails to boot in
+sof_probe_continue().
+
+The request_firmware() framework must be informed of failures in
+sof_probe_continue() otherwise its internal "batching"
+feature (different from caching) cached the firmware image
+forever. Attempts to correct the file in /lib/firmware/ were then
+silently and confusingly ignored until the next reboot. Unloading the
+drivers did not help because from their disconnected perspective the
+firmware had failed so there was nothing to release.
+
+Also leverage the new snd_sof_fw_unload() function to simplify the
+snd_sof_device_remove() function.
+
+Signed-off-by: Marc Herbert <marc.herbert@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Link: https://lore.kernel.org/r/20210916085008.28929-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/core.c | 4 +---
+ sound/soc/sof/loader.c | 2 ++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c
+index 3e4dd4a86363..59d0d7b2b55c 100644
+--- a/sound/soc/sof/core.c
++++ b/sound/soc/sof/core.c
+@@ -371,7 +371,6 @@ int snd_sof_device_remove(struct device *dev)
+ dev_warn(dev, "error: %d failed to prepare DSP for device removal",
+ ret);
+
+- snd_sof_fw_unload(sdev);
+ snd_sof_ipc_free(sdev);
+ snd_sof_free_debug(sdev);
+ snd_sof_free_trace(sdev);
+@@ -394,8 +393,7 @@ int snd_sof_device_remove(struct device *dev)
+ snd_sof_remove(sdev);
+
+ /* release firmware */
+- release_firmware(pdata->fw);
+- pdata->fw = NULL;
++ snd_sof_fw_unload(sdev);
+
+ return 0;
+ }
+diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c
+index 2b38a77cd594..9c3f251a0dd0 100644
+--- a/sound/soc/sof/loader.c
++++ b/sound/soc/sof/loader.c
+@@ -880,5 +880,7 @@ EXPORT_SYMBOL(snd_sof_run_firmware);
+ void snd_sof_fw_unload(struct snd_sof_dev *sdev)
+ {
+ /* TODO: support module unloading at runtime */
++ release_firmware(sdev->pdata->fw);
++ sdev->pdata->fw = NULL;
+ }
+ EXPORT_SYMBOL(snd_sof_fw_unload);
+--
+2.33.0
+
--- /dev/null
+From 261f765e12b62393e3b0e0c6a8dd5d7875d7a689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 16:05:31 +0800
+Subject: drm/amdgpu: fix gart.bo pin_count leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Leslie Shi <Yuliang.Shi@amd.com>
+
+[ Upstream commit 66805763a97f8f7bdf742fc0851d85c02ed9411f ]
+
+gmc_v{9,10}_0_gart_disable() isn't called matched with
+correspoding gart_enbale function in SRIOV case. This will
+lead to gart.bo pin_count leak on driver unload.
+
+Cc: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Leslie Shi <Yuliang.Shi@amd.com>
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 ++-
+ drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+index 4523df2785d6..5b6317bf9751 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+@@ -1094,6 +1094,8 @@ static int gmc_v10_0_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
++ gmc_v10_0_gart_disable(adev);
++
+ if (amdgpu_sriov_vf(adev)) {
+ /* full access mode, so don't touch any GMC register */
+ DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
+@@ -1102,7 +1104,6 @@ static int gmc_v10_0_hw_fini(void *handle)
+
+ amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
+ amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
+- gmc_v10_0_gart_disable(adev);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+index 7eb70d69f760..f3cd2b3fb4cc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+@@ -1764,6 +1764,8 @@ static int gmc_v9_0_hw_fini(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
++ gmc_v9_0_gart_disable(adev);
++
+ if (amdgpu_sriov_vf(adev)) {
+ /* full access mode, so don't touch any GMC register */
+ DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
+@@ -1772,7 +1774,6 @@ static int gmc_v9_0_hw_fini(void *handle)
+
+ amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
+ amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
+- gmc_v9_0_gart_disable(adev);
+
+ return 0;
+ }
+--
+2.33.0
+
--- /dev/null
+From 9eba8ca230527124cda5aa61cf7f457b15616b30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 20:20:21 +0800
+Subject: ext4: check and update i_disksize properly
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 4df031ff5876d94b48dd9ee486ba5522382a06b2 ]
+
+After commit 3da40c7b0898 ("ext4: only call ext4_truncate when size <=
+isize"), i_disksize could always be updated to i_size in ext4_setattr(),
+and we could sure that i_disksize <= i_size since holding inode lock and
+if i_disksize < i_size there are delalloc writes pending in the range
+upto i_size. If the end of the current write is <= i_size, there's no
+need to touch i_disksize since writeback will push i_disksize upto
+i_size eventually. So we can switch to check i_size instead of
+i_disksize in ext4_da_write_end() when write to the end of the file.
+we also could remove ext4_mark_inode_dirty() together because we defer
+inode dirtying to generic_write_end() or ext4_da_write_inline_data_end().
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/20210716122024.1105856-2-yi.zhang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 73daf9443e5e..a47ff8ce289b 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3089,35 +3089,37 @@ static int ext4_da_write_end(struct file *file,
+ end = start + copied - 1;
+
+ /*
+- * generic_write_end() will run mark_inode_dirty() if i_size
+- * changes. So let's piggyback the i_disksize mark_inode_dirty
+- * into that.
++ * Since we are holding inode lock, we are sure i_disksize <=
++ * i_size. We also know that if i_disksize < i_size, there are
++ * delalloc writes pending in the range upto i_size. If the end of
++ * the current write is <= i_size, there's no need to touch
++ * i_disksize since writeback will push i_disksize upto i_size
++ * eventually. If the end of the current write is > i_size and
++ * inside an allocated block (ext4_da_should_update_i_disksize()
++ * check), we need to update i_disksize here as neither
++ * ext4_writepage() nor certain ext4_writepages() paths not
++ * allocating blocks update i_disksize.
++ *
++ * Note that we defer inode dirtying to generic_write_end() /
++ * ext4_da_write_inline_data_end().
+ */
+ new_i_size = pos + copied;
+- if (copied && new_i_size > EXT4_I(inode)->i_disksize) {
++ if (copied && new_i_size > inode->i_size) {
+ if (ext4_has_inline_data(inode) ||
+- ext4_da_should_update_i_disksize(page, end)) {
++ ext4_da_should_update_i_disksize(page, end))
+ ext4_update_i_disksize(inode, new_i_size);
+- /* We need to mark inode dirty even if
+- * new_i_size is less that inode->i_size
+- * bu greater than i_disksize.(hint delalloc)
+- */
+- ret = ext4_mark_inode_dirty(handle, inode);
+- }
+ }
+
+ if (write_mode != CONVERT_INLINE_DATA &&
+ ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) &&
+ ext4_has_inline_data(inode))
+- ret2 = ext4_da_write_inline_data_end(inode, pos, len, copied,
++ ret = ext4_da_write_inline_data_end(inode, pos, len, copied,
+ page);
+ else
+- ret2 = generic_write_end(file, mapping, pos, len, copied,
++ ret = generic_write_end(file, mapping, pos, len, copied,
+ page, fsdata);
+
+- copied = ret2;
+- if (ret2 < 0)
+- ret = ret2;
++ copied = ret;
+ ret2 = ext4_journal_stop(handle);
+ if (unlikely(ret2 && !ret))
+ ret = ret2;
+--
+2.33.0
+
--- /dev/null
+From 9b9078aef67cd09854fca9de0749a7680087d3f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 20:20:22 +0800
+Subject: ext4: correct the error path of ext4_write_inline_data_end()
+
+From: Zhang Yi <yi.zhang@huawei.com>
+
+[ Upstream commit 55ce2f649b9e88111270333a8127e23f4f8f42d7 ]
+
+Current error path of ext4_write_inline_data_end() is not correct.
+
+Firstly, it should pass out the error value if ext4_get_inode_loc()
+return fail, or else it could trigger infinite loop if we inject error
+here. And then it's better to add inode to orphan list if it return fail
+in ext4_journal_stop(), otherwise we could not restore inline xattr
+entry after power failure. Finally, we need to reset the 'ret' value if
+ext4_write_inline_data_end() return success in ext4_write_end() and
+ext4_journalled_write_end(), otherwise we could not get the error return
+value of ext4_journal_stop().
+
+Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/20210716122024.1105856-3-yi.zhang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 15 +++++----------
+ fs/ext4/inode.c | 7 +++++--
+ 2 files changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 24e994e75f5c..8049448476a6 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -733,18 +733,13 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
+ void *kaddr;
+ struct ext4_iloc iloc;
+
+- if (unlikely(copied < len)) {
+- if (!PageUptodate(page)) {
+- copied = 0;
+- goto out;
+- }
+- }
++ if (unlikely(copied < len) && !PageUptodate(page))
++ return 0;
+
+ ret = ext4_get_inode_loc(inode, &iloc);
+ if (ret) {
+ ext4_std_error(inode->i_sb, ret);
+- copied = 0;
+- goto out;
++ return ret;
+ }
+
+ ext4_write_lock_xattr(inode, &no_expand);
+@@ -757,7 +752,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
+ (void) ext4_find_inline_data_nolock(inode);
+
+ kaddr = kmap_atomic(page);
+- ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
++ ext4_write_inline_data(inode, &iloc, kaddr, pos, copied);
+ kunmap_atomic(kaddr);
+ SetPageUptodate(page);
+ /* clear page dirty so that writepages wouldn't work for us. */
+@@ -766,7 +761,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
+ ext4_write_unlock_xattr(inode, &no_expand);
+ brelse(iloc.bh);
+ mark_inode_dirty(inode);
+-out:
++
+ return copied;
+ }
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index a47ff8ce289b..fc6ea56de77c 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1295,6 +1295,7 @@ static int ext4_write_end(struct file *file,
+ goto errout;
+ }
+ copied = ret;
++ ret = 0;
+ } else
+ copied = block_write_end(file, mapping, pos,
+ len, copied, page, fsdata);
+@@ -1321,13 +1322,14 @@ static int ext4_write_end(struct file *file,
+ if (i_size_changed || inline_data)
+ ret = ext4_mark_inode_dirty(handle, inode);
+
++errout:
+ if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))
+ /* if we have allocated more blocks and copied
+ * less. We will have blocks allocated outside
+ * inode->i_size. So truncate them
+ */
+ ext4_orphan_add(handle, inode);
+-errout:
++
+ ret2 = ext4_journal_stop(handle);
+ if (!ret)
+ ret = ret2;
+@@ -1410,6 +1412,7 @@ static int ext4_journalled_write_end(struct file *file,
+ goto errout;
+ }
+ copied = ret;
++ ret = 0;
+ } else if (unlikely(copied < len) && !PageUptodate(page)) {
+ copied = 0;
+ ext4_journalled_zero_new_buffers(handle, page, from, to);
+@@ -1439,6 +1442,7 @@ static int ext4_journalled_write_end(struct file *file,
+ ret = ret2;
+ }
+
++errout:
+ if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))
+ /* if we have allocated more blocks and copied
+ * less. We will have blocks allocated outside
+@@ -1446,7 +1450,6 @@ static int ext4_journalled_write_end(struct file *file,
+ */
+ ext4_orphan_add(handle, inode);
+
+-errout:
+ ret2 = ext4_journal_stop(handle);
+ if (!ret)
+ ret = ret2;
+--
+2.33.0
+
--- /dev/null
+From b2838e02c515366e8452370fcda5baa2dcc8be68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 10:49:27 -0400
+Subject: ext4: enforce buffer head state assertion in ext4_da_map_blocks
+
+From: Eric Whitney <enwlinux@gmail.com>
+
+[ Upstream commit 948ca5f30e1df0c11eb5b0f410b9ceb97fa77ad9 ]
+
+Remove the code that re-initializes a buffer head with an invalid block
+number and BH_New and BH_Delay bits when a matching delayed and
+unwritten block has been found in the extent status cache. Replace it
+with assertions that verify the buffer head already has this state
+correctly set. The current code masked an inline data truncation bug
+that left stale entries in the extent status cache. With this change,
+generic/130 can be used to reproduce and detect that bug.
+
+Signed-off-by: Eric Whitney <enwlinux@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/20210819144927.25163-3-enwlinux@gmail.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index fc6ea56de77c..d204688b32a3 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1726,13 +1726,16 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock,
+ }
+
+ /*
+- * Delayed extent could be allocated by fallocate.
+- * So we need to check it.
++ * the buffer head associated with a delayed and not unwritten
++ * block found in the extent status cache must contain an
++ * invalid block number and have its BH_New and BH_Delay bits
++ * set, reflecting the state assigned when the block was
++ * initially delayed allocated
+ */
+- if (ext4_es_is_delayed(&es) && !ext4_es_is_unwritten(&es)) {
+- map_bh(bh, inode->i_sb, invalid_block);
+- set_buffer_new(bh);
+- set_buffer_delay(bh);
++ if (ext4_es_is_delonly(&es)) {
++ BUG_ON(bh->b_blocknr != invalid_block);
++ BUG_ON(!buffer_new(bh));
++ BUG_ON(!buffer_delay(bh));
+ return 0;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 79ba7e46338fcf72f6894398ef28d3185f2e5743 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 20:03:25 +0900
+Subject: HID: apple: Fix logical maximum and usage maximum of Magic Keyboard
+ JIS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mizuho Mori <morimolymoly@gmail.com>
+
+[ Upstream commit 67fd71ba16a37c663d139f5ba5296f344d80d072 ]
+
+Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong.
+
+Below is a report descriptor.
+
+0x05, 0x01, /* Usage Page (Desktop), */
+0x09, 0x06, /* Usage (Keyboard), */
+0xA1, 0x01, /* Collection (Application), */
+0x85, 0x01, /* Report ID (1), */
+0x05, 0x07, /* Usage Page (Keyboard), */
+0x15, 0x00, /* Logical Minimum (0), */
+0x25, 0x01, /* Logical Maximum (1), */
+0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */
+0x29, 0xE7, /* Usage Maximum (KB Right GUI), */
+0x75, 0x01, /* Report Size (1), */
+0x95, 0x08, /* Report Count (8), */
+0x81, 0x02, /* Input (Variable), */
+0x95, 0x05, /* Report Count (5), */
+0x75, 0x01, /* Report Size (1), */
+0x05, 0x08, /* Usage Page (LED), */
+0x19, 0x01, /* Usage Minimum (01h), */
+0x29, 0x05, /* Usage Maximum (05h), */
+0x91, 0x02, /* Output (Variable), */
+0x95, 0x01, /* Report Count (1), */
+0x75, 0x03, /* Report Size (3), */
+0x91, 0x03, /* Output (Constant, Variable), */
+0x95, 0x08, /* Report Count (8), */
+0x75, 0x01, /* Report Size (1), */
+0x15, 0x00, /* Logical Minimum (0), */
+0x25, 0x01, /* Logical Maximum (1), */
+
+here is a report descriptor which is parsed one in kernel.
+see sys/kernel/debug/hid/<dev>/rdesc
+
+05 01 09 06 a1 01 85 01 05 07
+15 00 25 01 19 e0 29 e7 75 01
+95 08 81 02 95 05 75 01 05 08
+19 01 29 05 91 02 95 01 75 03
+91 03 95 08 75 01 15 00 25 01
+06 00 ff 09 03 81 03 95 06 75
+08 15 00 25 [65] 05 07 19 00 29
+[65] 81 00 95 01 75 01 15 00 25
+01 05 0c 09 b8 81 02 95 01 75
+01 06 01 ff 09 03 81 02 95 01
+75 06 81 03 06 02 ff 09 55 85
+55 15 00 26 ff 00 75 08 95 40
+b1 a2 c0 06 00 ff 09 14 a1 01
+85 90 05 84 75 01 95 03 15 00
+25 01 09 61 05 85 09 44 09 46
+81 02 95 05 81 01 75 08 95 01
+15 00 26 ff 00 09 65 81 02 c0
+00
+
+Position 64(Logical Maximum) and 70(Usage Maximum) are 101.
+Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support.
+position 117 is also 101 but not related(it is Usage 65h).
+
+There are no difference of product id between JIS and ANSI.
+They are same 0x0267.
+
+Signed-off-by: Mizuho Mori <morimolymoly@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index dc6bd4299c54..87edcd4ce07c 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -322,12 +322,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field,
+
+ /*
+ * MacBook JIS keyboard has wrong logical maximum
++ * Magic Keyboard JIS has wrong logical maximum
+ */
+ static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+ struct apple_sc *asc = hid_get_drvdata(hdev);
+
++ if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) {
++ hid_info(hdev,
++ "fixing up Magic Keyboard JIS report descriptor\n");
++ rdesc[64] = rdesc[70] = 0xe7;
++ }
++
+ if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 &&
+ rdesc[53] == 0x65 && rdesc[59] == 0x65) {
+ hid_info(hdev,
+--
+2.33.0
+
--- /dev/null
+From 40489da2a3a637c546fa1010a4780531be2a2981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 13:28:25 -0400
+Subject: HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs
+
+From: Joshua-Dickens <Joshua@Joshua-Dickens.com>
+
+[ Upstream commit 0c8fbaa553077630e8eae45bd9676cfc01836aeb ]
+
+Add the new PIDs to wacom_wac.c to support the new models in the Intuos series.
+
+[jkosina@suse.cz: fix changelog]
+Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
+Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/wacom_wac.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 81ba642adcb7..528d94ccd76f 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -4720,6 +4720,12 @@ static const struct wacom_features wacom_features_0x393 =
+ { "Wacom Intuos Pro S", 31920, 19950, 8191, 63,
+ INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7,
+ .touch_max = 10 };
++static const struct wacom_features wacom_features_0x3c6 =
++ { "Wacom Intuos BT S", 15200, 9500, 4095, 63,
++ INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
++static const struct wacom_features wacom_features_0x3c8 =
++ { "Wacom Intuos BT M", 21600, 13500, 4095, 63,
++ INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
+
+ static const struct wacom_features wacom_features_HID_ANY_ID =
+ { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
+@@ -4893,6 +4899,8 @@ const struct hid_device_id wacom_ids[] = {
+ { USB_DEVICE_WACOM(0x37A) },
+ { USB_DEVICE_WACOM(0x37B) },
+ { BT_DEVICE_WACOM(0x393) },
++ { BT_DEVICE_WACOM(0x3c6) },
++ { BT_DEVICE_WACOM(0x3c8) },
+ { USB_DEVICE_WACOM(0x4001) },
+ { USB_DEVICE_WACOM(0x4004) },
+ { USB_DEVICE_WACOM(0x5000) },
+--
+2.33.0
+
--- /dev/null
+From 6567f320895c3219946e412b5dc6a030b94ee344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 22:11:13 +0200
+Subject: hwmon: (ltc2947) Properly handle errors when looking for the external
+ clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 6f7d70467121f790b36af2d84bc02b5c236bf5e6 ]
+
+The return value of devm_clk_get should in general be propagated to
+upper layer. In this case the clk is optional, use the appropriate
+wrapper instead of interpreting all errors as "The optional clk is not
+available".
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20210923201113.398932-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/ltc2947-core.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/ltc2947-core.c b/drivers/hwmon/ltc2947-core.c
+index bb3f7749a0b0..5423466de697 100644
+--- a/drivers/hwmon/ltc2947-core.c
++++ b/drivers/hwmon/ltc2947-core.c
+@@ -989,8 +989,12 @@ static int ltc2947_setup(struct ltc2947_data *st)
+ return ret;
+
+ /* check external clock presence */
+- extclk = devm_clk_get(st->dev, NULL);
+- if (!IS_ERR(extclk)) {
++ extclk = devm_clk_get_optional(st->dev, NULL);
++ if (IS_ERR(extclk))
++ return dev_err_probe(st->dev, PTR_ERR(extclk),
++ "Failed to get external clock\n");
++
++ if (extclk) {
+ unsigned long rate_hz;
+ u8 pre = 0, div, tbctl;
+ u64 aux;
+--
+2.33.0
+
--- /dev/null
+From cac57709f71f4ca95cad333546a0f8b944faff63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Sep 2021 20:50:51 +0000
+Subject: hwmon: (pmbus/ibm-cffps) max_power_out swap changes
+
+From: Brandon Wyman <bjwyman@gmail.com>
+
+[ Upstream commit f067d5585cda2de1e47dde914a8a4f151659e0ad ]
+
+The bytes for max_power_out from the ibm-cffps devices differ in byte
+order for some power supplies.
+
+The Witherspoon power supply returns the bytes in MSB/LSB order.
+
+The Rainier power supply returns the bytes in LSB/MSB order.
+
+The Witherspoon power supply uses version cffps1. The Rainier power
+supply should use version cffps2. If version is cffps1, swap the bytes
+before output to max_power_out.
+
+Tested:
+ Witherspoon before: 3148. Witherspoon after: 3148.
+ Rainier before: 53255. Rainier after: 2000.
+
+Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210928205051.1222815-1-bjwyman@gmail.com
+[groeck: Replaced yoda programming]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ibm-cffps.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
+index df712ce4b164..53f7d1418bc9 100644
+--- a/drivers/hwmon/pmbus/ibm-cffps.c
++++ b/drivers/hwmon/pmbus/ibm-cffps.c
+@@ -171,8 +171,14 @@ static ssize_t ibm_cffps_debugfs_read(struct file *file, char __user *buf,
+ cmd = CFFPS_SN_CMD;
+ break;
+ case CFFPS_DEBUGFS_MAX_POWER_OUT:
+- rc = i2c_smbus_read_word_swapped(psu->client,
+- CFFPS_MAX_POWER_OUT_CMD);
++ if (psu->version == cffps1) {
++ rc = i2c_smbus_read_word_swapped(psu->client,
++ CFFPS_MAX_POWER_OUT_CMD);
++ } else {
++ rc = i2c_smbus_read_word_data(psu->client,
++ CFFPS_MAX_POWER_OUT_CMD);
++ }
++
+ if (rc < 0)
+ return rc;
+
+--
+2.33.0
+
--- /dev/null
+From 46b7837933b0ed99d10be58b48ffc159a4614aaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Sep 2021 15:49:55 +0300
+Subject: interconnect: qcom: sdm660: Add missing a2noc qos clocks
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 13404ac8882f5225af07545215f4975a564c3740 ]
+
+It adds the missing a2noc clocks required for QoS registers programming
+per downstream kernel[1]. Otherwise, qcom_icc_noc_set_qos_priority()
+call on mas_ufs or mas_usb_hs node will simply result in a hardware hang
+on SDM660 SoC.
+
+[1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/arch/arm/boot/dts/qcom/sdm660-bus.dtsi?h=LA.UM.8.2.r1-04800-sdm660.0#n43
+
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210824043435.23190-3-shawn.guo@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sdm660.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/interconnect/qcom/sdm660.c b/drivers/interconnect/qcom/sdm660.c
+index 99eef7e2d326..fb23a5b780a4 100644
+--- a/drivers/interconnect/qcom/sdm660.c
++++ b/drivers/interconnect/qcom/sdm660.c
+@@ -173,6 +173,16 @@ static const struct clk_bulk_data bus_mm_clocks[] = {
+ { .id = "iface" },
+ };
+
++static const struct clk_bulk_data bus_a2noc_clocks[] = {
++ { .id = "bus" },
++ { .id = "bus_a" },
++ { .id = "ipa" },
++ { .id = "ufs_axi" },
++ { .id = "aggre2_ufs_axi" },
++ { .id = "aggre2_usb3_axi" },
++ { .id = "cfg_noc_usb2_axi" },
++};
++
+ /**
+ * struct qcom_icc_provider - Qualcomm specific interconnect provider
+ * @provider: generic interconnect provider
+@@ -809,6 +819,10 @@ static int qnoc_probe(struct platform_device *pdev)
+ qp->bus_clks = devm_kmemdup(dev, bus_mm_clocks,
+ sizeof(bus_mm_clocks), GFP_KERNEL);
+ qp->num_clks = ARRAY_SIZE(bus_mm_clocks);
++ } else if (of_device_is_compatible(dev->of_node, "qcom,sdm660-a2noc")) {
++ qp->bus_clks = devm_kmemdup(dev, bus_a2noc_clocks,
++ sizeof(bus_a2noc_clocks), GFP_KERNEL);
++ qp->num_clks = ARRAY_SIZE(bus_a2noc_clocks);
+ } else {
+ if (of_device_is_compatible(dev->of_node, "qcom,sdm660-bimc"))
+ qp->is_bimc_node = true;
+--
+2.33.0
+
--- /dev/null
+From afc14c8d7826b1c45a27eb386bb732c582811bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Oct 2021 10:39:33 +0100
+Subject: io_uring: kill fasync
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 3f008385d46d3cea4a097d2615cd485f2184ba26 ]
+
+We have never supported fasync properly, it would only fire when there
+is something polling io_uring making it useless. The original support came
+in through the initial io_uring merge for 5.1. Since it's broken and
+nobody has reported it, get rid of the fasync bits.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/2f7ca3d344d406d34fa6713824198915c41cea86.1633080236.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 675216f7022d..2f79586c1a7c 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -419,7 +419,6 @@ struct io_ring_ctx {
+ struct wait_queue_head cq_wait;
+ unsigned cq_extra;
+ atomic_t cq_timeouts;
+- struct fasync_struct *cq_fasync;
+ unsigned cq_last_tm_flush;
+ } ____cacheline_aligned_in_smp;
+
+@@ -1448,10 +1447,8 @@ static void io_cqring_ev_posted(struct io_ring_ctx *ctx)
+ wake_up(&ctx->sq_data->wait);
+ if (io_should_trigger_evfd(ctx))
+ eventfd_signal(ctx->cq_ev_fd, 1);
+- if (waitqueue_active(&ctx->poll_wait)) {
++ if (waitqueue_active(&ctx->poll_wait))
+ wake_up_interruptible(&ctx->poll_wait);
+- kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
+- }
+ }
+
+ static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx)
+@@ -1465,10 +1462,8 @@ static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx)
+ }
+ if (io_should_trigger_evfd(ctx))
+ eventfd_signal(ctx->cq_ev_fd, 1);
+- if (waitqueue_active(&ctx->poll_wait)) {
++ if (waitqueue_active(&ctx->poll_wait))
+ wake_up_interruptible(&ctx->poll_wait);
+- kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN);
+- }
+ }
+
+ /* Returns true if there are no backlogged entries after the flush */
+@@ -8779,13 +8774,6 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait)
+ return mask;
+ }
+
+-static int io_uring_fasync(int fd, struct file *file, int on)
+-{
+- struct io_ring_ctx *ctx = file->private_data;
+-
+- return fasync_helper(fd, file, on, &ctx->cq_fasync);
+-}
+-
+ static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id)
+ {
+ const struct cred *creds;
+@@ -9571,7 +9559,6 @@ static const struct file_operations io_uring_fops = {
+ .mmap_capabilities = io_uring_nommu_mmap_capabilities,
+ #endif
+ .poll = io_uring_poll,
+- .fasync = io_uring_fasync,
+ #ifdef CONFIG_PROC_FS
+ .show_fdinfo = io_uring_show_fdinfo,
+ #endif
+--
+2.33.0
+
--- /dev/null
+From ca4527b9e146af36e76e77a6c736362df02ad711 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 13:21:37 +0800
+Subject: KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit a49b50a3c1c3226d26e1dd11e8b763f27e477623 ]
+
+Add FORCE so that if_changed can detect the command line change.
+
+We'll otherwise see a compilation warning since commit e1f86d7b4b2a
+("kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and
+filechk").
+
+arch/arm64/kvm/hyp/nvhe/Makefile:58: FORCE prerequisite is missing
+
+Cc: David Brazdil <dbrazdil@google.com>
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210907052137.1059-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/hyp/nvhe/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kvm/hyp/nvhe/Makefile b/arch/arm64/kvm/hyp/nvhe/Makefile
+index 5df6193fc430..8d741f71377f 100644
+--- a/arch/arm64/kvm/hyp/nvhe/Makefile
++++ b/arch/arm64/kvm/hyp/nvhe/Makefile
+@@ -54,7 +54,7 @@ $(obj)/kvm_nvhe.tmp.o: $(obj)/hyp.lds $(addprefix $(obj)/,$(hyp-obj)) FORCE
+ # runtime. Because the hypervisor is part of the kernel binary, relocations
+ # produce a kernel VA. We enumerate relocations targeting hyp at build time
+ # and convert the kernel VAs at those positions to hyp VAs.
+-$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel
++$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel FORCE
+ $(call if_changed,hyprel)
+
+ # 5) Compile hyp-reloc.S and link it into the existing partially linked object.
+--
+2.33.0
+
--- /dev/null
+From 2ba3770f6424b206acd69712e1cf37489a31472e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 17:19:00 +0000
+Subject: m68k: Handle arrivals of multiple signals correctly
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 4bb0bd81ce5e97092dfda6a106d414b703ec0ee8 ]
+
+When we have several pending signals, have entered with the kernel
+with large exception frame *and* have already built at least one
+sigframe, regs->stkadj is going to be non-zero and regs->format/sr/pc
+are going to be junk - the real values are in shifted exception stack
+frame we'd built when putting together the first sigframe.
+
+If that happens, subsequent sigframes are going to be garbage.
+Not hard to fix - just need to find the "adjusted" frame first
+and look for format/vector/sr/pc in it.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Tested-by: Michael Schmitz <schmitzmic@gmail.com>
+Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
+Tested-by: Finn Thain <fthain@linux-m68k.org>
+Link: https://lore.kernel.org/r/YP2dBIAPTaVvHiZ6@zeniv-ca.linux.org.uk
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/kernel/signal.c | 88 +++++++++++++++++++--------------------
+ 1 file changed, 42 insertions(+), 46 deletions(-)
+
+diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
+index 8f215e79e70e..cd11eb101eac 100644
+--- a/arch/m68k/kernel/signal.c
++++ b/arch/m68k/kernel/signal.c
+@@ -447,7 +447,7 @@ static inline void save_fpu_state(struct sigcontext *sc, struct pt_regs *regs)
+
+ if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) {
+ fpu_version = sc->sc_fpstate[0];
+- if (CPU_IS_020_OR_030 &&
++ if (CPU_IS_020_OR_030 && !regs->stkadj &&
+ regs->vector >= (VEC_FPBRUC * 4) &&
+ regs->vector <= (VEC_FPNAN * 4)) {
+ /* Clear pending exception in 68882 idle frame */
+@@ -510,7 +510,7 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs *
+ if (!(CPU_IS_060 || CPU_IS_COLDFIRE))
+ context_size = fpstate[1];
+ fpu_version = fpstate[0];
+- if (CPU_IS_020_OR_030 &&
++ if (CPU_IS_020_OR_030 && !regs->stkadj &&
+ regs->vector >= (VEC_FPBRUC * 4) &&
+ regs->vector <= (VEC_FPNAN * 4)) {
+ /* Clear pending exception in 68882 idle frame */
+@@ -832,18 +832,24 @@ badframe:
+ return 0;
+ }
+
++static inline struct pt_regs *rte_regs(struct pt_regs *regs)
++{
++ return (void *)regs + regs->stkadj;
++}
++
+ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
+ unsigned long mask)
+ {
++ struct pt_regs *tregs = rte_regs(regs);
+ sc->sc_mask = mask;
+ sc->sc_usp = rdusp();
+ sc->sc_d0 = regs->d0;
+ sc->sc_d1 = regs->d1;
+ sc->sc_a0 = regs->a0;
+ sc->sc_a1 = regs->a1;
+- sc->sc_sr = regs->sr;
+- sc->sc_pc = regs->pc;
+- sc->sc_formatvec = regs->format << 12 | regs->vector;
++ sc->sc_sr = tregs->sr;
++ sc->sc_pc = tregs->pc;
++ sc->sc_formatvec = tregs->format << 12 | tregs->vector;
+ save_a5_state(sc, regs);
+ save_fpu_state(sc, regs);
+ }
+@@ -851,6 +857,7 @@ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
+ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs)
+ {
+ struct switch_stack *sw = (struct switch_stack *)regs - 1;
++ struct pt_regs *tregs = rte_regs(regs);
+ greg_t __user *gregs = uc->uc_mcontext.gregs;
+ int err = 0;
+
+@@ -871,9 +878,9 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *
+ err |= __put_user(sw->a5, &gregs[13]);
+ err |= __put_user(sw->a6, &gregs[14]);
+ err |= __put_user(rdusp(), &gregs[15]);
+- err |= __put_user(regs->pc, &gregs[16]);
+- err |= __put_user(regs->sr, &gregs[17]);
+- err |= __put_user((regs->format << 12) | regs->vector, &uc->uc_formatvec);
++ err |= __put_user(tregs->pc, &gregs[16]);
++ err |= __put_user(tregs->sr, &gregs[17]);
++ err |= __put_user((tregs->format << 12) | tregs->vector, &uc->uc_formatvec);
+ err |= rt_save_fpu_state(uc, regs);
+ return err;
+ }
+@@ -890,13 +897,14 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+ struct pt_regs *regs)
+ {
+ struct sigframe __user *frame;
+- int fsize = frame_extra_sizes(regs->format);
++ struct pt_regs *tregs = rte_regs(regs);
++ int fsize = frame_extra_sizes(tregs->format);
+ struct sigcontext context;
+ int err = 0, sig = ksig->sig;
+
+ if (fsize < 0) {
+ pr_debug("setup_frame: Unknown frame format %#x\n",
+- regs->format);
++ tregs->format);
+ return -EFAULT;
+ }
+
+@@ -907,7 +915,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+
+ err |= __put_user(sig, &frame->sig);
+
+- err |= __put_user(regs->vector, &frame->code);
++ err |= __put_user(tregs->vector, &frame->code);
+ err |= __put_user(&frame->sc, &frame->psc);
+
+ if (_NSIG_WORDS > 1)
+@@ -933,34 +941,28 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
+
+ push_cache ((unsigned long) &frame->retcode);
+
+- /*
+- * Set up registers for signal handler. All the state we are about
+- * to destroy is successfully copied to sigframe.
+- */
+- wrusp ((unsigned long) frame);
+- regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+- adjustformat(regs);
+-
+ /*
+ * This is subtle; if we build more than one sigframe, all but the
+ * first one will see frame format 0 and have fsize == 0, so we won't
+ * screw stkadj.
+ */
+- if (fsize)
++ if (fsize) {
+ regs->stkadj = fsize;
+-
+- /* Prepare to skip over the extra stuff in the exception frame. */
+- if (regs->stkadj) {
+- struct pt_regs *tregs =
+- (struct pt_regs *)((ulong)regs + regs->stkadj);
++ tregs = rte_regs(regs);
+ pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
+- /* This must be copied with decreasing addresses to
+- handle overlaps. */
+ tregs->vector = 0;
+ tregs->format = 0;
+- tregs->pc = regs->pc;
+ tregs->sr = regs->sr;
+ }
++
++ /*
++ * Set up registers for signal handler. All the state we are about
++ * to destroy is successfully copied to sigframe.
++ */
++ wrusp ((unsigned long) frame);
++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
++ adjustformat(regs);
++
+ return 0;
+ }
+
+@@ -968,7 +970,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ struct pt_regs *regs)
+ {
+ struct rt_sigframe __user *frame;
+- int fsize = frame_extra_sizes(regs->format);
++ struct pt_regs *tregs = rte_regs(regs);
++ int fsize = frame_extra_sizes(tregs->format);
+ int err = 0, sig = ksig->sig;
+
+ if (fsize < 0) {
+@@ -1018,34 +1021,27 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+
+ push_cache ((unsigned long) &frame->retcode);
+
+- /*
+- * Set up registers for signal handler. All the state we are about
+- * to destroy is successfully copied to sigframe.
+- */
+- wrusp ((unsigned long) frame);
+- regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+- adjustformat(regs);
+-
+ /*
+ * This is subtle; if we build more than one sigframe, all but the
+ * first one will see frame format 0 and have fsize == 0, so we won't
+ * screw stkadj.
+ */
+- if (fsize)
++ if (fsize) {
+ regs->stkadj = fsize;
+-
+- /* Prepare to skip over the extra stuff in the exception frame. */
+- if (regs->stkadj) {
+- struct pt_regs *tregs =
+- (struct pt_regs *)((ulong)regs + regs->stkadj);
++ tregs = rte_regs(regs);
+ pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
+- /* This must be copied with decreasing addresses to
+- handle overlaps. */
+ tregs->vector = 0;
+ tregs->format = 0;
+- tregs->pc = regs->pc;
+ tregs->sr = regs->sr;
+ }
++
++ /*
++ * Set up registers for signal handler. All the state we are about
++ * to destroy is successfully copied to sigframe.
++ */
++ wrusp ((unsigned long) frame);
++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
++ adjustformat(regs);
+ return 0;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 6c0353af9164400deb9168407fb607a1436cd9cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 03:34:57 +0000
+Subject: mac80211: check return value of rhashtable_init
+
+From: MichelleJin <shjy180909@gmail.com>
+
+[ Upstream commit 111461d573741c17eafad029ac93474fa9adcce0 ]
+
+When rhashtable_init() fails, it returns -EINVAL.
+However, since error return value of rhashtable_init is not checked,
+it can cause use of uninitialized pointers.
+So, fix unhandled errors of rhashtable_init.
+
+Signed-off-by: MichelleJin <shjy180909@gmail.com>
+Link: https://lore.kernel.org/r/20210927033457.1020967-4-shjy180909@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_pathtbl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index efbefcbac3ac..7cab1cf09bf1 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -60,7 +60,10 @@ static struct mesh_table *mesh_table_alloc(void)
+ atomic_set(&newtbl->entries, 0);
+ spin_lock_init(&newtbl->gates_lock);
+ spin_lock_init(&newtbl->walk_lock);
+- rhashtable_init(&newtbl->rhead, &mesh_rht_params);
++ if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) {
++ kfree(newtbl);
++ return NULL;
++ }
+
+ return newtbl;
+ }
+--
+2.33.0
+
--- /dev/null
+From 441a952c55baf19f06e718e48ac832c5b892aeee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 22:42:30 +0800
+Subject: mac80211: Drop frames from invalid MAC address in ad-hoc mode
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit a6555f844549cd190eb060daef595f94d3de1582 ]
+
+WARNING: CPU: 1 PID: 9 at net/mac80211/sta_info.c:554
+sta_info_insert_rcu+0x121/0x12a0
+Modules linked in:
+CPU: 1 PID: 9 Comm: kworker/u8:1 Not tainted 5.14.0-rc7+ #253
+Workqueue: phy3 ieee80211_iface_work
+RIP: 0010:sta_info_insert_rcu+0x121/0x12a0
+...
+Call Trace:
+ ieee80211_ibss_finish_sta+0xbc/0x170
+ ieee80211_ibss_work+0x13f/0x7d0
+ ieee80211_iface_work+0x37a/0x500
+ process_one_work+0x357/0x850
+ worker_thread+0x41/0x4d0
+
+If an Ad-Hoc node receives packets with invalid source MAC address,
+it hits a WARN_ON in sta_info_insert_check(), this can spam the log.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20210827144230.39944-1-yuehaibing@huawei.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 2563473b5cf1..e023e307c0c3 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -4053,7 +4053,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
+ if (!bssid)
+ return false;
+ if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+- ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
++ !is_valid_ether_addr(hdr->addr2))
+ return false;
+ if (ieee80211_is_beacon(hdr->frame_control))
+ return true;
+--
+2.33.0
+
--- /dev/null
+From c66305f38dbe40a746fdc56c8983462adf9d5252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Sep 2021 11:36:27 +0000
+Subject: net: bgmac-platform: handle mac-address deferral
+
+From: Matthew Hagan <mnhagan88@gmail.com>
+
+[ Upstream commit 763716a55cb1f480ffe1a9702e6b5d9ea1a80a24 ]
+
+This patch is a replication of Christian Lamparter's "net: bgmac-bcma:
+handle deferred probe error due to mac-address" patch for the
+bgmac-platform driver [1].
+
+As is the case with the bgmac-bcma driver, this change is to cover the
+scenario where the MAC address cannot yet be discovered due to reliance
+on an nvmem provider which is yet to be instantiated, resulting in a
+random address being assigned that has to be manually overridden.
+
+[1] https://lore.kernel.org/netdev/20210919115725.29064-1-chunkeey@gmail.com
+
+Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bgmac-platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c
+index 4ab5bf64d353..df8ff839cc62 100644
+--- a/drivers/net/ethernet/broadcom/bgmac-platform.c
++++ b/drivers/net/ethernet/broadcom/bgmac-platform.c
+@@ -192,6 +192,9 @@ static int bgmac_probe(struct platform_device *pdev)
+ bgmac->dma_dev = &pdev->dev;
+
+ ret = of_get_mac_address(np, bgmac->net_dev->dev_addr);
++ if (ret == -EPROBE_DEFER)
++ return ret;
++
+ if (ret)
+ dev_warn(&pdev->dev,
+ "MAC address not present in device tree\n");
+--
+2.33.0
+
--- /dev/null
+From 88c9c0d29e391765497cf688085b70da4f63a868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 10:35:58 +0800
+Subject: net: prevent user from passing illegal stab size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: 王贇 <yun.wang@linux.alibaba.com>
+
+[ Upstream commit b193e15ac69d56f35e1d8e2b5d16cbd47764d053 ]
+
+We observed below report when playing with netlink sock:
+
+ UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10
+ shift exponent 249 is too large for 32-bit type
+ CPU: 0 PID: 685 Comm: a.out Not tainted
+ Call Trace:
+ dump_stack_lvl+0x8d/0xcf
+ ubsan_epilogue+0xa/0x4e
+ __ubsan_handle_shift_out_of_bounds+0x161/0x182
+ __qdisc_calculate_pkt_len+0xf0/0x190
+ __dev_queue_xmit+0x2ed/0x15b0
+
+it seems like kernel won't check the stab log value passing from
+user, and will use the insane value later to calculate pkt_len.
+
+This patch just add a check on the size/cell_log to avoid insane
+calculation.
+
+Reported-by: Abaci <abaci@linux.alibaba.com>
+Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/pkt_sched.h | 1 +
+ net/sched/sch_api.c | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
+index 6d7b12cba015..bf79f3a890af 100644
+--- a/include/net/pkt_sched.h
++++ b/include/net/pkt_sched.h
+@@ -11,6 +11,7 @@
+ #include <uapi/linux/pkt_sched.h>
+
+ #define DEFAULT_TX_QUEUE_LEN 1000
++#define STAB_SIZE_LOG_MAX 30
+
+ struct qdisc_walker {
+ int stop;
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index f87d07736a14..148edd0e71e3 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -513,6 +513,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt,
+ return stab;
+ }
+
++ if (s->size_log > STAB_SIZE_LOG_MAX ||
++ s->cell_log > STAB_SIZE_LOG_MAX) {
++ NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table");
++ return ERR_PTR(-EINVAL);
++ }
++
+ stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
+ if (!stab)
+ return ERR_PTR(-ENOMEM);
+--
+2.33.0
+
--- /dev/null
+From 2b23f29df47439ca2d27862afa2f80f6d1721591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 14:48:23 -0700
+Subject: net: sun: SUNVNET_COMMON should depend on INET
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 103bde372f084206c6972be543ecc247ebbff9f3 ]
+
+When CONFIG_INET is not set, there are failing references to IPv4
+functions, so make this driver depend on INET.
+
+Fixes these build errors:
+
+sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_start_xmit_common':
+sunvnet_common.c:(.text+0x1a68): undefined reference to `__icmp_send'
+sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_poll_common':
+sunvnet_common.c:(.text+0x358c): undefined reference to `ip_send_check'
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Aaron Young <aaron.young@oracle.com>
+Cc: Rashmi Narasimhan <rashmi.narasimhan@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/sun/Kconfig b/drivers/net/ethernet/sun/Kconfig
+index 309de38a7530..b0d3f9a2950c 100644
+--- a/drivers/net/ethernet/sun/Kconfig
++++ b/drivers/net/ethernet/sun/Kconfig
+@@ -73,6 +73,7 @@ config CASSINI
+ config SUNVNET_COMMON
+ tristate "Common routines to support Sun Virtual Networking"
+ depends on SUN_LDOMS
++ depends on INET
+ default m
+
+ config SUNVNET
+--
+2.33.0
+
--- /dev/null
+From 992e007b33e03118a605917e8f78d699b4b9141a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Sep 2021 22:24:33 +0100
+Subject: netfilter: ip6_tables: zero-initialize fragment offset
+
+From: Jeremy Sowden <jeremy@azazel.net>
+
+[ Upstream commit 310e2d43c3ad429c1fba4b175806cf1f55ed73a6 ]
+
+ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
+specified (`-p tcp`, for example). However, if the flag is not set,
+`ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
+case the fragment offset is left uninitialized and a garbage value is
+passed to each matcher.
+
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/netfilter/ip6_tables.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index de2cf3943b91..a579ea14a69b 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -273,6 +273,7 @@ ip6t_do_table(struct sk_buff *skb,
+ * things we don't know, ie. tcp syn flag or ports). If the
+ * rule is also a fragment-specific rule, non-fragments won't
+ * match it. */
++ acpar.fragoff = 0;
+ acpar.hotdrop = false;
+ acpar.state = state;
+
+--
+2.33.0
+
--- /dev/null
+From e27e176259108c0c9f64de5cf7a05eb9128edfef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 16:46:39 +0200
+Subject: netfilter: nf_nat_masquerade: defer conntrack walk to work queue
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 7970a19b71044bf4dc2c1becc200275bdf1884d4 ]
+
+The ipv4 and device notifiers are called with RTNL mutex held.
+The table walk can take some time, better not block other RTNL users.
+
+'ip a' has been reported to block for up to 20 seconds when conntrack table
+has many entries and device down events are frequent (e.g., PPP).
+
+Reported-and-tested-by: Martin Zaharinov <micron10@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_masquerade.c | 50 +++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
+index 415919a6ac1a..acd73f717a08 100644
+--- a/net/netfilter/nf_nat_masquerade.c
++++ b/net/netfilter/nf_nat_masquerade.c
+@@ -131,13 +131,14 @@ static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr,
+ put_net(net);
+ }
+
+-static int device_cmp(struct nf_conn *i, void *ifindex)
++static int device_cmp(struct nf_conn *i, void *arg)
+ {
+ const struct nf_conn_nat *nat = nfct_nat(i);
++ const struct masq_dev_work *w = arg;
+
+ if (!nat)
+ return 0;
+- return nat->masq_index == (int)(long)ifindex;
++ return nat->masq_index == w->ifindex;
+ }
+
+ static int masq_device_event(struct notifier_block *this,
+@@ -153,8 +154,8 @@ static int masq_device_event(struct notifier_block *this,
+ * and forget them.
+ */
+
+- nf_ct_iterate_cleanup_net(net, device_cmp,
+- (void *)(long)dev->ifindex, 0, 0);
++ nf_nat_masq_schedule(net, NULL, dev->ifindex,
++ device_cmp, GFP_KERNEL);
+ }
+
+ return NOTIFY_DONE;
+@@ -162,35 +163,45 @@ static int masq_device_event(struct notifier_block *this,
+
+ static int inet_cmp(struct nf_conn *ct, void *ptr)
+ {
+- struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
+- struct net_device *dev = ifa->ifa_dev->dev;
+ struct nf_conntrack_tuple *tuple;
++ struct masq_dev_work *w = ptr;
+
+- if (!device_cmp(ct, (void *)(long)dev->ifindex))
++ if (!device_cmp(ct, ptr))
+ return 0;
+
+ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+- return ifa->ifa_address == tuple->dst.u3.ip;
++ return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
+ }
+
+ static int masq_inet_event(struct notifier_block *this,
+ unsigned long event,
+ void *ptr)
+ {
+- struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+- struct net *net = dev_net(idev->dev);
++ const struct in_ifaddr *ifa = ptr;
++ const struct in_device *idev;
++ const struct net_device *dev;
++ union nf_inet_addr addr;
++
++ if (event != NETDEV_DOWN)
++ return NOTIFY_DONE;
+
+ /* The masq_dev_notifier will catch the case of the device going
+ * down. So if the inetdev is dead and being destroyed we have
+ * no work to do. Otherwise this is an individual address removal
+ * and we have to perform the flush.
+ */
++ idev = ifa->ifa_dev;
+ if (idev->dead)
+ return NOTIFY_DONE;
+
+- if (event == NETDEV_DOWN)
+- nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);
++ memset(&addr, 0, sizeof(addr));
++
++ addr.ip = ifa->ifa_address;
++
++ dev = idev->dev;
++ nf_nat_masq_schedule(dev_net(idev->dev), &addr, dev->ifindex,
++ inet_cmp, GFP_KERNEL);
+
+ return NOTIFY_DONE;
+ }
+@@ -253,19 +264,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);
+
+-static int inet6_cmp(struct nf_conn *ct, void *work)
+-{
+- struct masq_dev_work *w = (struct masq_dev_work *)work;
+- struct nf_conntrack_tuple *tuple;
+-
+- if (!device_cmp(ct, (void *)(long)w->ifindex))
+- return 0;
+-
+- tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+-
+- return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
+-}
+-
+ /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).
+ *
+ * Defer it to the system workqueue.
+@@ -289,7 +287,7 @@ static int masq_inet6_event(struct notifier_block *this,
+
+ addr.in6 = ifa->addr;
+
+- nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp,
++ nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet_cmp,
+ GFP_ATOMIC);
+ return NOTIFY_DONE;
+ }
+--
+2.33.0
+
--- /dev/null
+From ace8a12c3a341a4ab34cc9bfe6565355558ad1b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 16:46:38 +0200
+Subject: netfilter: nf_nat_masquerade: make async masq_inet6_event handling
+ generic
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 30db406923b9285a9bac06a6af5e74bd6d0f1d06 ]
+
+masq_inet6_event is called asynchronously from system work queue,
+because the inet6 notifier is atomic and nf_iterate_cleanup can sleep.
+
+The ipv4 and device notifiers call nf_iterate_cleanup directly.
+
+This is legal, but these notifiers are called with RTNL mutex held.
+A large conntrack table with many devices coming and going will have severe
+impact on the system usability, with 'ip a' blocking for several seconds.
+
+This change places the defer code into a helper and makes it more
+generic so ipv4 and ifdown notifiers can be converted to defer the
+cleanup walk as well in a follow patch.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_masquerade.c | 122 ++++++++++++++++++------------
+ 1 file changed, 75 insertions(+), 47 deletions(-)
+
+diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
+index 8e8a65d46345..415919a6ac1a 100644
+--- a/net/netfilter/nf_nat_masquerade.c
++++ b/net/netfilter/nf_nat_masquerade.c
+@@ -9,8 +9,19 @@
+
+ #include <net/netfilter/nf_nat_masquerade.h>
+
++struct masq_dev_work {
++ struct work_struct work;
++ struct net *net;
++ union nf_inet_addr addr;
++ int ifindex;
++ int (*iter)(struct nf_conn *i, void *data);
++};
++
++#define MAX_MASQ_WORKER_COUNT 16
++
+ static DEFINE_MUTEX(masq_mutex);
+ static unsigned int masq_refcnt __read_mostly;
++static atomic_t masq_worker_count __read_mostly;
+
+ unsigned int
+ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
+@@ -63,6 +74,63 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
+
++static void iterate_cleanup_work(struct work_struct *work)
++{
++ struct masq_dev_work *w;
++
++ w = container_of(work, struct masq_dev_work, work);
++
++ nf_ct_iterate_cleanup_net(w->net, w->iter, (void *)w, 0, 0);
++
++ put_net(w->net);
++ kfree(w);
++ atomic_dec(&masq_worker_count);
++ module_put(THIS_MODULE);
++}
++
++/* Iterate conntrack table in the background and remove conntrack entries
++ * that use the device/address being removed.
++ *
++ * In case too many work items have been queued already or memory allocation
++ * fails iteration is skipped, conntrack entries will time out eventually.
++ */
++static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr,
++ int ifindex,
++ int (*iter)(struct nf_conn *i, void *data),
++ gfp_t gfp_flags)
++{
++ struct masq_dev_work *w;
++
++ if (atomic_read(&masq_worker_count) > MAX_MASQ_WORKER_COUNT)
++ return;
++
++ net = maybe_get_net(net);
++ if (!net)
++ return;
++
++ if (!try_module_get(THIS_MODULE))
++ goto err_module;
++
++ w = kzalloc(sizeof(*w), gfp_flags);
++ if (w) {
++ /* We can overshoot MAX_MASQ_WORKER_COUNT, no big deal */
++ atomic_inc(&masq_worker_count);
++
++ INIT_WORK(&w->work, iterate_cleanup_work);
++ w->ifindex = ifindex;
++ w->net = net;
++ w->iter = iter;
++ if (addr)
++ w->addr = *addr;
++ schedule_work(&w->work);
++ return;
++ }
++
++ module_put(THIS_MODULE);
++ err_module:
++ put_net(net);
++}
++
+ static int device_cmp(struct nf_conn *i, void *ifindex)
+ {
+ const struct nf_conn_nat *nat = nfct_nat(i);
+@@ -136,8 +204,6 @@ static struct notifier_block masq_inet_notifier = {
+ };
+
+ #if IS_ENABLED(CONFIG_IPV6)
+-static atomic_t v6_worker_count __read_mostly;
+-
+ static int
+ nat_ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
+ const struct in6_addr *daddr, unsigned int srcprefs,
+@@ -187,13 +253,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
+ }
+ EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);
+
+-struct masq_dev_work {
+- struct work_struct work;
+- struct net *net;
+- struct in6_addr addr;
+- int ifindex;
+-};
+-
+ static int inet6_cmp(struct nf_conn *ct, void *work)
+ {
+ struct masq_dev_work *w = (struct masq_dev_work *)work;
+@@ -204,21 +263,7 @@ static int inet6_cmp(struct nf_conn *ct, void *work)
+
+ tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+- return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
+-}
+-
+-static void iterate_cleanup_work(struct work_struct *work)
+-{
+- struct masq_dev_work *w;
+-
+- w = container_of(work, struct masq_dev_work, work);
+-
+- nf_ct_iterate_cleanup_net(w->net, inet6_cmp, (void *)w, 0, 0);
+-
+- put_net(w->net);
+- kfree(w);
+- atomic_dec(&v6_worker_count);
+- module_put(THIS_MODULE);
++ return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
+ }
+
+ /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).
+@@ -233,36 +278,19 @@ static int masq_inet6_event(struct notifier_block *this,
+ {
+ struct inet6_ifaddr *ifa = ptr;
+ const struct net_device *dev;
+- struct masq_dev_work *w;
+- struct net *net;
++ union nf_inet_addr addr;
+
+- if (event != NETDEV_DOWN || atomic_read(&v6_worker_count) >= 16)
++ if (event != NETDEV_DOWN)
+ return NOTIFY_DONE;
+
+ dev = ifa->idev->dev;
+- net = maybe_get_net(dev_net(dev));
+- if (!net)
+- return NOTIFY_DONE;
+
+- if (!try_module_get(THIS_MODULE))
+- goto err_module;
++ memset(&addr, 0, sizeof(addr));
+
+- w = kmalloc(sizeof(*w), GFP_ATOMIC);
+- if (w) {
+- atomic_inc(&v6_worker_count);
++ addr.in6 = ifa->addr;
+
+- INIT_WORK(&w->work, iterate_cleanup_work);
+- w->ifindex = dev->ifindex;
+- w->net = net;
+- w->addr = ifa->addr;
+- schedule_work(&w->work);
+-
+- return NOTIFY_DONE;
+- }
+-
+- module_put(THIS_MODULE);
+- err_module:
+- put_net(net);
++ nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp,
++ GFP_ATOMIC);
+ return NOTIFY_DONE;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From f2ef4bb0105cb3bec2a8c3ea4f774fb636bd40ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Sep 2021 12:43:13 -0700
+Subject: perf/core: fix userpage->time_enabled of inactive events
+
+From: Song Liu <songliubraving@fb.com>
+
+[ Upstream commit f792565326825ed806626da50c6f9a928f1079c1 ]
+
+Users of rdpmc rely on the mmapped user page to calculate accurate
+time_enabled. Currently, userpage->time_enabled is only updated when the
+event is added to the pmu. As a result, inactive event (due to counter
+multiplexing) does not have accurate userpage->time_enabled. This can
+be reproduced with something like:
+
+ /* open 20 task perf_event "cycles", to create multiplexing */
+
+ fd = perf_event_open(); /* open task perf_event "cycles" */
+ userpage = mmap(fd); /* use mmap and rdmpc */
+
+ while (true) {
+ time_enabled_mmap = xxx; /* use logic in perf_event_mmap_page */
+ time_enabled_read = read(fd).time_enabled;
+ if (time_enabled_mmap > time_enabled_read)
+ BUG();
+ }
+
+Fix this by updating userpage for inactive events in merge_sched_in.
+
+Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reported-and-tested-by: Lucian Grijincu <lucian@fb.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210929194313.2398474-1-songliubraving@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/perf_event.h | 4 +++-
+ kernel/events/core.c | 34 ++++++++++++++++++++++++++++++----
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
+index 2d510ad750ed..4aa52f7a48c1 100644
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -683,7 +683,9 @@ struct perf_event {
+ /*
+ * timestamp shadows the actual context timing but it can
+ * be safely used in NMI interrupt context. It reflects the
+- * context time as it was when the event was last scheduled in.
++ * context time as it was when the event was last scheduled in,
++ * or when ctx_sched_in failed to schedule the event because we
++ * run out of PMC.
+ *
+ * ctx_time already accounts for ctx->timestamp. Therefore to
+ * compute ctx_time for a sample, simply add perf_clock().
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index e5c4aca620c5..22c5b1622c22 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3707,6 +3707,29 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx,
+ return 0;
+ }
+
++static inline bool event_update_userpage(struct perf_event *event)
++{
++ if (likely(!atomic_read(&event->mmap_count)))
++ return false;
++
++ perf_event_update_time(event);
++ perf_set_shadow_time(event, event->ctx);
++ perf_event_update_userpage(event);
++
++ return true;
++}
++
++static inline void group_update_userpage(struct perf_event *group_event)
++{
++ struct perf_event *event;
++
++ if (!event_update_userpage(group_event))
++ return;
++
++ for_each_sibling_event(event, group_event)
++ event_update_userpage(event);
++}
++
+ static int merge_sched_in(struct perf_event *event, void *data)
+ {
+ struct perf_event_context *ctx = event->ctx;
+@@ -3725,14 +3748,15 @@ static int merge_sched_in(struct perf_event *event, void *data)
+ }
+
+ if (event->state == PERF_EVENT_STATE_INACTIVE) {
++ *can_add_hw = 0;
+ if (event->attr.pinned) {
+ perf_cgroup_event_disable(event, ctx);
+ perf_event_set_state(event, PERF_EVENT_STATE_ERROR);
++ } else {
++ ctx->rotate_necessary = 1;
++ perf_mux_hrtimer_restart(cpuctx);
++ group_update_userpage(event);
+ }
+-
+- *can_add_hw = 0;
+- ctx->rotate_necessary = 1;
+- perf_mux_hrtimer_restart(cpuctx);
+ }
+
+ return 0;
+@@ -6311,6 +6335,8 @@ accounting:
+
+ ring_buffer_attach(event, rb);
+
++ perf_event_update_time(event);
++ perf_set_shadow_time(event, event->ctx);
+ perf_event_init_userpage(event);
+ perf_event_update_userpage(event);
+ } else {
+--
+2.33.0
+
--- /dev/null
+From 3c3bc1343a321cf489f65ab2445ec7fa26f09140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 15:01:27 +0530
+Subject: pinctrl: qcom: sc7280: Add PM suspend callbacks
+
+From: Rajendra Nayak <rnayak@codeaurora.org>
+
+[ Upstream commit 28406a21999152ff7faa30b194f734565bdd8e0d ]
+
+Use PM suspend callbacks from msm core, without this the hog_sleep
+pins don't change state in suspend.
+
+Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/1632389487-11283-1-git-send-email-rnayak@codeaurora.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-sc7280.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-sc7280.c b/drivers/pinctrl/qcom/pinctrl-sc7280.c
+index afddf6d60dbe..9017ede409c9 100644
+--- a/drivers/pinctrl/qcom/pinctrl-sc7280.c
++++ b/drivers/pinctrl/qcom/pinctrl-sc7280.c
+@@ -1496,6 +1496,7 @@ static const struct of_device_id sc7280_pinctrl_of_match[] = {
+ static struct platform_driver sc7280_pinctrl_driver = {
+ .driver = {
+ .name = "sc7280-pinctrl",
++ .pm = &msm_pinctrl_dev_pm_ops,
+ .of_match_table = sc7280_pinctrl_of_match,
+ },
+ .probe = sc7280_pinctrl_probe,
+--
+2.33.0
+
--- /dev/null
+From 69ad67f64bdbd016d80365f8a4e958fe7710df88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 15:31:11 +0200
+Subject: sched: Always inline is_percpu_thread()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 83d40a61046f73103b4e5d8f1310261487ff63b0 ]
+
+ vmlinux.o: warning: objtool: check_preemption_disabled()+0x81: call to is_percpu_thread() leaves .noinstr.text section
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210928084218.063371959@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index f6935787e7e8..8e10c7accdbc 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1633,7 +1633,7 @@ extern struct pid *cad_pid;
+ #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
+ #define used_math() tsk_used_math(current)
+
+-static inline bool is_percpu_thread(void)
++static __always_inline bool is_percpu_thread(void)
+ {
+ #ifdef CONFIG_SMP
+ return (current->flags & PF_NO_SETAFFINITY) &&
+--
+2.33.0
+
--- /dev/null
+From 39be5f12bc406c2e7344ae06cba2df43d5cf3d54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 20:51:54 -0700
+Subject: scsi: qla2xxx: Fix excessive messages during device logout
+
+From: Arun Easi <aeasi@marvell.com>
+
+[ Upstream commit 8e2d81c6b5be0d7629fb50b6f678fc07a4c58fae ]
+
+Disable default logging of some I/O path messages. If desired, the messages
+can be turned back on by setting ql2xextended_error_logging.
+
+Link: https://lore.kernel.org/r/20210925035154.29815-1-njavali@marvell.com
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 2aa8f519aae6..5f1092195d1f 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -2399,7 +2399,7 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req,
+ }
+
+ if (unlikely(logit))
+- ql_log(ql_log_warn, fcport->vha, 0x5060,
++ ql_log(ql_dbg_io, fcport->vha, 0x5060,
+ "NVME-%s ERR Handling - hdl=%x status(%x) tr_len:%x resid=%x ox_id=%x\n",
+ sp->name, sp->handle, comp_status,
+ fd->transferred_length, le32_to_cpu(sts->residual_len),
+@@ -3246,7 +3246,7 @@ check_scsi_status:
+
+ out:
+ if (logit)
+- ql_log(ql_log_warn, fcport->vha, 0x3022,
++ ql_log(ql_dbg_io, fcport->vha, 0x3022,
+ "FCP command status: 0x%x-0x%x (0x%x) nexus=%ld:%d:%llu portid=%02x%02x%02x oxid=0x%x cdb=%10phN len=0x%x rsp_info=0x%x resid=0x%x fw_resid=0x%x sp=%p cp=%p.\n",
+ comp_status, scsi_status, res, vha->host_no,
+ cp->device->id, cp->device->lun, fcport->d_id.b.domain,
+--
+2.33.0
+
--- /dev/null
+From ab625fb09a666cd053bf1fc0c98b800dabfacbf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 17:51:53 +0800
+Subject: scsi: ses: Fix unsigned comparison with less than zero
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit dd689ed5aa905daf4ba4c99319a52aad6ea0a796 ]
+
+Fix the following coccicheck warning:
+
+./drivers/scsi/ses.c:137:10-16: WARNING: Unsigned expression compared
+with zero: result > 0.
+
+Link: https://lore.kernel.org/r/1632477113-90378-1-git-send-email-jiapeng.chong@linux.alibaba.com
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ses.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index 43e682297fd5..0a1734f34587 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -118,7 +118,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ static int ses_send_diag(struct scsi_device *sdev, int page_code,
+ void *buf, int bufflen)
+ {
+- u32 result;
++ int result;
+
+ unsigned char cmd[] = {
+ SEND_DIAGNOSTIC,
+--
+2.33.0
+
--- /dev/null
+From 9c150107e6f2ecbf92a4ef1d95b32df1ec7e069c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Sep 2021 00:03:30 +0100
+Subject: scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported"
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cced4c0ec7c06f5230a2958907a409c849762293 ]
+
+There are a couple of spelling mistakes in pr_info and pr_err messages.
+Fix them.
+
+Link: https://lore.kernel.org/r/20210924230330.143785-1-colin.king@canonical.com
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/virtio_scsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
+index b0deaf4af5a3..13f55f41a902 100644
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -300,7 +300,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi,
+ }
+ break;
+ default:
+- pr_info("Unsupport virtio scsi event reason %x\n", event->reason);
++ pr_info("Unsupported virtio scsi event reason %x\n", event->reason);
+ }
+ }
+
+@@ -392,7 +392,7 @@ static void virtscsi_handle_event(struct work_struct *work)
+ virtscsi_handle_param_change(vscsi, event);
+ break;
+ default:
+- pr_err("Unsupport virtio scsi event %x\n", event->event);
++ pr_err("Unsupported virtio scsi event %x\n", event->event);
+ }
+ virtscsi_kick_event(vscsi, event_node);
+ }
+--
+2.33.0
+
+ext4-check-and-update-i_disksize-properly.patch
+ext4-correct-the-error-path-of-ext4_write_inline_dat.patch
+asoc-intel-sof_sdw-tag-soundwire-bes-as-non-atomic.patch
+ext4-enforce-buffer-head-state-assertion-in-ext4_da_.patch
+alsa-oxfw-fix-transmission-method-for-loud-models-ba.patch
+interconnect-qcom-sdm660-add-missing-a2noc-qos-clock.patch
+alsa-usb-audio-unify-mixer-resume-and-reset_resume-p.patch
+hid-apple-fix-logical-maximum-and-usage-maximum-of-m.patch
+netfilter-ip6_tables-zero-initialize-fragment-offset.patch
+hid-wacom-add-new-intuos-bt-ctl-4100wl-ctl-6100wl-de.patch
+asoc-sof-loader-release_firmware-on-load-failure-to-.patch
+kvm-arm64-nvhe-fix-missing-force-for-hyp-reloc.s-bui.patch
+netfilter-nf_nat_masquerade-make-async-masq_inet6_ev.patch
+netfilter-nf_nat_masquerade-defer-conntrack-walk-to-.patch
+mac80211-drop-frames-from-invalid-mac-address-in-ad-.patch
+pinctrl-qcom-sc7280-add-pm-suspend-callbacks.patch
+m68k-handle-arrivals-of-multiple-signals-correctly.patch
+hwmon-ltc2947-properly-handle-errors-when-looking-fo.patch
+net-prevent-user-from-passing-illegal-stab-size.patch
+mac80211-check-return-value-of-rhashtable_init.patch
+net-bgmac-platform-handle-mac-address-deferral.patch
+vboxfs-fix-broken-legacy-mount-signature-checking.patch
+net-sun-sunvnet_common-should-depend-on-inet.patch
+drm-amdgpu-fix-gart.bo-pin_count-leak.patch
+scsi-ses-fix-unsigned-comparison-with-less-than-zero.patch
+scsi-virtio_scsi-fix-spelling-mistake-unsupport-unsu.patch
+scsi-qla2xxx-fix-excessive-messages-during-device-lo.patch
+perf-core-fix-userpage-time_enabled-of-inactive-even.patch
+sched-always-inline-is_percpu_thread.patch
+io_uring-kill-fasync.patch
+hwmon-pmbus-ibm-cffps-max_power_out-swap-changes.patch
--- /dev/null
+From 6f3ecb2444ff6af16c05d5c49f8d8de47c21561c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Sep 2021 11:26:21 -0700
+Subject: vboxfs: fix broken legacy mount signature checking
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 9b3b353ef330e20bc2d99bf3165cc044cff26a09 ]
+
+Commit 9d682ea6bcc7 ("vboxsf: Fix the check for the old binary
+mount-arguments struct") was meant to fix a build error due to sign
+mismatch in 'char' and the use of character constants, but it just moved
+the error elsewhere, in that on some architectures characters and signed
+and on others they are unsigned, and that's just how the C standard
+works.
+
+The proper fix is a simple "don't do that then". The code was just
+being silly and odd, and it should never have cared about signed vs
+unsigned characters in the first place, since what it is testing is not
+four "characters", but four bytes.
+
+And the way to compare four bytes is by using "memcmp()".
+
+Which compilers will know to just turn into a single 32-bit compare with
+a constant, as long as you don't have crazy debug options enabled.
+
+Link: https://lore.kernel.org/lkml/20210927094123.576521-1-arnd@kernel.org/
+Cc: Arnd Bergmann <arnd@kernel.org>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/vboxsf/super.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c
+index 4f5e59f06284..37dd3fe5b1e9 100644
+--- a/fs/vboxsf/super.c
++++ b/fs/vboxsf/super.c
+@@ -21,10 +21,7 @@
+
+ #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
+
+-#define VBSF_MOUNT_SIGNATURE_BYTE_0 ('\000')
+-#define VBSF_MOUNT_SIGNATURE_BYTE_1 ('\377')
+-#define VBSF_MOUNT_SIGNATURE_BYTE_2 ('\376')
+-#define VBSF_MOUNT_SIGNATURE_BYTE_3 ('\375')
++static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
+
+ static int follow_symlinks;
+ module_param(follow_symlinks, int, 0444);
+@@ -386,12 +383,7 @@ fail_nomem:
+
+ static int vboxsf_parse_monolithic(struct fs_context *fc, void *data)
+ {
+- unsigned char *options = data;
+-
+- if (options && options[0] == VBSF_MOUNT_SIGNATURE_BYTE_0 &&
+- options[1] == VBSF_MOUNT_SIGNATURE_BYTE_1 &&
+- options[2] == VBSF_MOUNT_SIGNATURE_BYTE_2 &&
+- options[3] == VBSF_MOUNT_SIGNATURE_BYTE_3) {
++ if (data && !memcmp(data, VBSF_MOUNT_SIGNATURE, 4)) {
+ vbg_err("vboxsf: Old binary mount data not supported, remove obsolete mount.vboxsf and/or update your VBoxService.\n");
+ return -EINVAL;
+ }
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
