--- /dev/null
+From 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 10 Mar 2021 12:28:08 +0100
+Subject: ALSA: hda: Avoid spurious unsol event handling during S3/S4
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5ff9dde42e8c72ed8102eb8cb62e03f9dc2103ab upstream.
+
+When HD-audio bus receives unsolicited events during its system
+suspend/resume (S3 and S4) phase, the controller driver may still try
+to process events although the codec chips are already (or yet)
+powered down. This might screw up the codec communication, resulting
+in CORB/RIRB errors. Such events should be rather skipped, as the
+codec chip status such as the jack status will be fully refreshed at
+the system resume time.
+
+Since we're tracking the system suspend/resume state in codec
+power.power_state field, let's add the check in the common unsol event
+handler entry point to filter out such events.
+
+BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377
+Tested-by: Abhishek Sahu <abhsahu@nvidia.com>
+Cc: <stable@vger.kernel.org> # 183ab39eb0ea: ALSA: hda: Initialize power_state
+Link: https://lore.kernel.org/r/20210310112809.9215-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_bind.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/hda_bind.c
++++ b/sound/pci/hda/hda_bind.c
+@@ -47,6 +47,10 @@ static void hda_codec_unsol_event(struct
+ if (codec->bus->shutdown)
+ return;
+
++ /* ignore unsol events during system suspend/resume */
++ if (codec->core.dev.power.power_state.event != PM_EVENT_ON)
++ return;
++
+ if (codec->patch_ops.unsol_event)
+ codec->patch_ops.unsol_event(codec, ev);
+ }
--- /dev/null
+From f15c5c11abfbf8909eb30598315ecbec2311cfdc Mon Sep 17 00:00:00 2001
+From: Simeon Simeonoff <sim.simeonoff@gmail.com>
+Date: Mon, 8 Mar 2021 20:48:35 +0200
+Subject: ALSA: hda/ca0132: Add Sound BlasterX AE-5 Plus support
+
+From: Simeon Simeonoff <sim.simeonoff@gmail.com>
+
+commit f15c5c11abfbf8909eb30598315ecbec2311cfdc upstream.
+
+The new AE-5 Plus model has a different Subsystem ID compared to the
+non-plus model. Adding the new id to the list of quirks.
+
+Signed-off-by: Simeon Simeonoff <sim.simeonoff@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/998cafbe10b648f724ee33570553f2d780a38963.camel@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_ca0132.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1275,6 +1275,7 @@ static const struct snd_pci_quirk ca0132
+ SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
+ SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D),
+ SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5),
++ SND_PCI_QUIRK(0x1102, 0x0191, "Sound Blaster AE-5 Plus", QUIRK_AE5),
+ SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7),
+ {}
+ };
--- /dev/null
+From 56b26497bb4b7ff970612dc25a8a008c34463f7b Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 6 Mar 2021 10:50:18 +0100
+Subject: ALSA: hda/conexant: Add quirk for mute LED control on HP ZBook G5
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 56b26497bb4b7ff970612dc25a8a008c34463f7b upstream.
+
+The mute and mic-mute LEDs on HP ZBook Studio G5 are controlled via
+GPIO bits 0x10 and 0x20, respectively, and we need the extra setup for
+those.
+
+As the similar code is already present for other HP models but with
+different GPIO pins, this patch factors out the common helper code and
+applies those GPIO values for each model.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211893
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210306095018.11746-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_conexant.c | 62 +++++++++++++++++++++++++++++------------
+ 1 file changed, 45 insertions(+), 17 deletions(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -149,6 +149,21 @@ static int cx_auto_vmaster_mute_led(stru
+ return 0;
+ }
+
++static void cxt_init_gpio_led(struct hda_codec *codec)
++{
++ struct conexant_spec *spec = codec->spec;
++ unsigned int mask = spec->gpio_mute_led_mask | spec->gpio_mic_led_mask;
++
++ if (mask) {
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_MASK,
++ mask);
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DIRECTION,
++ mask);
++ snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
++ spec->gpio_led);
++ }
++}
++
+ static int cx_auto_init(struct hda_codec *codec)
+ {
+ struct conexant_spec *spec = codec->spec;
+@@ -156,6 +171,7 @@ static int cx_auto_init(struct hda_codec
+ if (!spec->dynamic_eapd)
+ cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, true);
+
++ cxt_init_gpio_led(codec);
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+ return 0;
+@@ -215,6 +231,7 @@ enum {
+ CXT_FIXUP_HP_SPECTRE,
+ CXT_FIXUP_HP_GATE_MIC,
+ CXT_FIXUP_MUTE_LED_GPIO,
++ CXT_FIXUP_HP_ZBOOK_MUTE_LED,
+ CXT_FIXUP_HEADSET_MIC,
+ CXT_FIXUP_HP_MIC_NO_PRESENCE,
+ };
+@@ -654,31 +671,36 @@ static int cxt_gpio_micmute_update(struc
+ return 0;
+ }
+
+-
+-static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
+- const struct hda_fixup *fix, int action)
++static void cxt_setup_mute_led(struct hda_codec *codec,
++ unsigned int mute, unsigned int mic_mute)
+ {
+ struct conexant_spec *spec = codec->spec;
+- static const struct hda_verb gpio_init[] = {
+- { 0x01, AC_VERB_SET_GPIO_MASK, 0x03 },
+- { 0x01, AC_VERB_SET_GPIO_DIRECTION, 0x03 },
+- {}
+- };
+
+- if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++ spec->gpio_led = 0;
++ spec->mute_led_polarity = 0;
++ if (mute) {
+ snd_hda_gen_add_mute_led_cdev(codec, cxt_gpio_mute_update);
+- spec->gpio_led = 0;
+- spec->mute_led_polarity = 0;
+- spec->gpio_mute_led_mask = 0x01;
+- spec->gpio_mic_led_mask = 0x02;
++ spec->gpio_mute_led_mask = mute;
++ }
++ if (mic_mute) {
+ snd_hda_gen_add_micmute_led_cdev(codec, cxt_gpio_micmute_update);
++ spec->gpio_mic_led_mask = mic_mute;
+ }
+- snd_hda_add_verbs(codec, gpio_init);
+- if (spec->gpio_led)
+- snd_hda_codec_write(codec, 0x01, 0, AC_VERB_SET_GPIO_DATA,
+- spec->gpio_led);
+ }
+
++static void cxt_fixup_mute_led_gpio(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ cxt_setup_mute_led(codec, 0x01, 0x02);
++}
++
++static void cxt_fixup_hp_zbook_mute_led(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ cxt_setup_mute_led(codec, 0x10, 0x20);
++}
+
+ /* ThinkPad X200 & co with cxt5051 */
+ static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = {
+@@ -839,6 +861,10 @@ static const struct hda_fixup cxt_fixups
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt_fixup_mute_led_gpio,
+ },
++ [CXT_FIXUP_HP_ZBOOK_MUTE_LED] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cxt_fixup_hp_zbook_mute_led,
++ },
+ [CXT_FIXUP_HEADSET_MIC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cxt_fixup_headset_mic,
+@@ -917,6 +943,7 @@ static const struct snd_pci_quirk cxt506
+ SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
++ SND_PCI_QUIRK(0x103c, 0x8427, "HP ZBook Studio G5", CXT_FIXUP_HP_ZBOOK_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8456, "HP Z2 G4 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
+@@ -956,6 +983,7 @@ static const struct hda_model_fixup cxt5
+ { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" },
+ { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
+ { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" },
++ { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" },
+ { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" },
+ {}
+ };
--- /dev/null
+From 28e96c1693ec1cdc963807611f8b5ad400431e82 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 8 Mar 2021 17:07:26 +0100
+Subject: ALSA: hda: Drop the BATCH workaround for AMD controllers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 28e96c1693ec1cdc963807611f8b5ad400431e82 upstream.
+
+The commit c02f77d32d2c ("ALSA: hda - Workaround for crackled sound on
+AMD controller (1022:1457)") introduced a few workarounds for the
+recent AMD HD-audio controller, and one of them is the forced BATCH
+PCM mode so that PulseAudio avoids the timer-based scheduling. This
+was thought to cover for some badly working applications, but this
+actually worsens for more others. In total, this wasn't a good idea
+to enforce it.
+
+This is a partial revert of the commit above for dropping the PCM
+BATCH enforcement part to recover from the regression again.
+
+Fixes: c02f77d32d2c ("ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195303
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210308160726.22930-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_controller.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -609,13 +609,6 @@ static int azx_pcm_open(struct snd_pcm_s
+ 20,
+ 178000000);
+
+- /* by some reason, the playback stream stalls on PulseAudio with
+- * tsched=1 when a capture stream triggers. Until we figure out the
+- * real cause, disable tsched mode by telling the PCM info flag.
+- */
+- if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
+- runtime->hw.info |= SNDRV_PCM_INFO_BATCH;
+-
+ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
--- /dev/null
+From 13661fc48461282e43fe8f76bf5bf449b3d40687 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 10 Mar 2021 12:28:07 +0100
+Subject: ALSA: hda: Flush pending unsolicited events before suspend
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 13661fc48461282e43fe8f76bf5bf449b3d40687 upstream.
+
+The HD-audio controller driver processes the unsolicited events via
+its work asynchronously, and this might be pending when the system
+goes to suspend. When a lengthy event handling like ELD byte reads is
+running, this might trigger unexpected accesses among suspend/resume
+procedure, typically seen with Nvidia driver that still requires the
+handling via unsolicited event verbs for ELD updates.
+
+This patch adds the flush of unsol_work to assure that pending events
+are processed before going into suspend.
+
+Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1182377
+Reported-and-tested-by: Abhishek Sahu <abhsahu@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210310112809.9215-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1026,6 +1026,8 @@ static int azx_prepare(struct device *de
+ chip = card->private_data;
+ chip->pm_prepared = 1;
+
++ flush_work(&azx_bus(chip)->unsol_work);
++
+ /* HDA controller always requires different WAKEEN for runtime suspend
+ * and system suspend, so don't use direct-complete here.
+ */
--- /dev/null
+From eea46a0879bcca23e15071f9968c0f6e6596e470 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 10 Mar 2021 12:28:09 +0100
+Subject: ALSA: hda/hdmi: Cancel pending works before suspend
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit eea46a0879bcca23e15071f9968c0f6e6596e470 upstream.
+
+The per_pin->work might be still floating at the suspend, and this may
+hit the access to the hardware at an unexpected timing. Cancel the
+work properly at the suspend callback for avoiding the buggy access.
+
+Note that the bug doesn't trigger easily in the recent kernels since
+the work is queued only when the repoll count is set, and usually it's
+only at the resume callback, but it's still possible to hit in
+theory.
+
+BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182377
+Reported-and-tested-by: Abhishek Sahu <abhsahu@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210310112809.9215-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_hdmi.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2475,6 +2475,18 @@ static void generic_hdmi_free(struct hda
+ }
+
+ #ifdef CONFIG_PM
++static int generic_hdmi_suspend(struct hda_codec *codec)
++{
++ struct hdmi_spec *spec = codec->spec;
++ int pin_idx;
++
++ for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
++ struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
++ cancel_delayed_work_sync(&per_pin->work);
++ }
++ return 0;
++}
++
+ static int generic_hdmi_resume(struct hda_codec *codec)
+ {
+ struct hdmi_spec *spec = codec->spec;
+@@ -2498,6 +2510,7 @@ static const struct hda_codec_ops generi
+ .build_controls = generic_hdmi_build_controls,
+ .unsol_event = hdmi_unsol_event,
+ #ifdef CONFIG_PM
++ .suspend = generic_hdmi_suspend,
+ .resume = generic_hdmi_resume,
+ #endif
+ };
--- /dev/null
+From fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 Mon Sep 17 00:00:00 2001
+From: John Ernberg <john.ernberg@actia.se>
+Date: Wed, 3 Mar 2021 18:14:39 +0000
+Subject: ALSA: usb: Add Plantronics C320-M USB ctrl msg delay quirk
+
+From: John Ernberg <john.ernberg@actia.se>
+
+commit fc7c5c208eb7bc2df3a9f4234f14eca250001cb6 upstream.
+
+The microphone in the Plantronics C320-M headset will randomly
+fail to initialize properly, at least when using Microsoft Teams.
+Introducing a 20ms delay on the control messages appears to
+resolve the issue.
+
+Link: https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/1065
+Tested-by: Andreas Kempe <kempe@lysator.liu.se>
+Signed-off-by: John Ernberg <john.ernberg@actia.se>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210303181405.39835-1-john.ernberg@actia.se
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1672,6 +1672,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
++ /*
++ * Plantronics C320-M needs a delay to avoid random
++ * microhpone failures.
++ */
++ if (chip->usb_id == USB_ID(0x047f, 0xc025) &&
++ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
++ msleep(20);
++
+ /* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950),
+ * Jabra 550a, Kingston HyperX needs a tiny delay here,
+ * otherwise requests like get/set frequency return
--- /dev/null
+From 06abcb18b3a021ba1a3f2020cbefb3ed04e59e72 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Mar 2021 09:50:09 +0100
+Subject: ALSA: usb-audio: Apply the control quirk to Plantronics headsets
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 06abcb18b3a021ba1a3f2020cbefb3ed04e59e72 upstream.
+
+Other Plantronics headset models seem requiring the same workaround as
+C320-M to add the 20ms delay for the control messages, too. Apply the
+workaround generically for devices with the vendor ID 0x047f.
+
+Note that the problem didn't surface before 5.11 just with luck.
+Since 5.11 got a big code rewrite about the stream handling, the
+parameter setup procedure has changed, and this seemed triggering the
+problem more often.
+
+BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1182552
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210304085009.4770-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1674,10 +1674,10 @@ void snd_usb_ctl_msg_quirk(struct usb_de
+ msleep(20);
+
+ /*
+- * Plantronics C320-M needs a delay to avoid random
+- * microhpone failures.
++ * Plantronics headsets (C320, C320-M, etc) need a delay to avoid
++ * random microhpone failures.
+ */
+- if (chip->usb_id == USB_ID(0x047f, 0xc025) &&
++ if (USB_ID_VENDOR(chip->usb_id) == 0x047f &&
+ (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
+ msleep(20);
+
--- /dev/null
+From 9799110825dba087c2bdce886977cf84dada2005 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 4 Mar 2021 12:34:16 +0800
+Subject: ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 9799110825dba087c2bdce886977cf84dada2005 upstream.
+
+Rear audio on Lenovo ThinkStation P620 stops working after commit
+1965c4364bdd ("ALSA: usb-audio: Disable autosuspend for Lenovo
+ThinkStation P620"):
+[ 6.013526] usbcore: registered new interface driver snd-usb-audio
+[ 6.023064] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.023083] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+[ 6.023090] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.023098] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+[ 6.023103] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.023110] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+[ 6.045846] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.045866] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+[ 6.045877] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.045886] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+[ 6.045894] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x0, type = 1
+[ 6.045908] usb 3-6: cannot get ctl value: req = 0x81, wValue = 0x202, wIndex = 0x0, type = 4
+
+I overlooked the issue because when I was working on the said commit,
+only the front audio is tested. Apology for that.
+
+Changing supports_autosuspend in driver is too late for disabling
+autosuspend, because it was already used by USB probe routine, so it can
+break the balance on the following code that depends on
+supports_autosuspend.
+
+Fix it by using usb_disable_autosuspend() helper, and balance the
+suspend count in disconnect callback.
+
+Fixes: 1965c4364bdd ("ALSA: usb-audio: Disable autosuspend for Lenovo ThinkStation P620")
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210304043419.287191-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.c | 5 +++++
+ sound/usb/quirks.c | 2 +-
+ sound/usb/usbaudio.h | 1 +
+ 3 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -830,6 +830,8 @@ static int usb_audio_probe(struct usb_in
+ snd_media_device_create(chip, intf);
+ }
+
++ chip->quirk_type = quirk->type;
++
+ usb_chip[chip->index] = chip;
+ chip->intf[chip->num_interfaces] = intf;
+ chip->num_interfaces++;
+@@ -912,6 +914,9 @@ static void usb_audio_disconnect(struct
+ } else {
+ mutex_unlock(®ister_mutex);
+ }
++
++ if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND)
++ usb_enable_autosuspend(interface_to_usbdev(intf));
+ }
+
+ /* lock the shutdown (disconnect) task and autoresume */
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -523,7 +523,7 @@ static int setup_disable_autosuspend(str
+ struct usb_driver *driver,
+ const struct snd_usb_audio_quirk *quirk)
+ {
+- driver->supports_autosuspend = 0;
++ usb_disable_autosuspend(interface_to_usbdev(iface));
+ return 1; /* Continue with creating streams and mixer */
+ }
+
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -27,6 +27,7 @@ struct snd_usb_audio {
+ struct snd_card *card;
+ struct usb_interface *intf[MAX_CARD_INTERFACES];
+ u32 usb_id;
++ uint16_t quirk_type;
+ struct mutex mutex;
+ unsigned int system_suspend;
+ atomic_t active;
--- /dev/null
+From fec60c3bc5d1713db2727cdffc638d48f9c07dc3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Mar 2021 09:30:21 +0100
+Subject: ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fec60c3bc5d1713db2727cdffc638d48f9c07dc3 upstream.
+
+Dell AE515 sound bar (413c:a506) spews the error messages when the
+driver tries to read the current sample frequency, hence it needs to
+be on the list in snd_usb_get_sample_rate_quirk().
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211551
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210304083021.2152-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1520,6 +1520,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
+ case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
+ case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
++ case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
+ return true;
+ }
+
--- /dev/null
+From 30dea07180de3aa0ad613af88431ef4e34b5ef68 Mon Sep 17 00:00:00 2001
+From: Pavel Skripkin <paskripkin@gmail.com>
+Date: Tue, 9 Mar 2021 01:30:36 +0300
+Subject: ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+commit 30dea07180de3aa0ad613af88431ef4e34b5ef68 upstream.
+
+syzbot reported null pointer dereference in usb_audio_probe.
+The problem was in case, when quirk == NULL. It's not an
+error condition, so quirk must be checked before dereferencing.
+
+Call Trace:
+ usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396
+ really_probe+0x291/0xe60 drivers/base/dd.c:554
+ driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:740
+ __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:846
+ bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
+ __device_attach+0x228/0x4a0 drivers/base/dd.c:914
+ bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
+ device_add+0xbdb/0x1db0 drivers/base/core.c:3242
+ usb_set_configuration+0x113f/0x1910 drivers/usb/core/message.c:2164
+ usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238
+ usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293
+ really_probe+0x291/0xe60 drivers/base/dd.c:554
+ driver_probe_device+0x26b/0x3d0 drivers/base/dd.c:740
+ __device_attach_driver+0x1d1/0x290 drivers/base/dd.c:846
+ bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:431
+ __device_attach+0x228/0x4a0 drivers/base/dd.c:914
+ bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491
+ device_add+0xbdb/0x1db0 drivers/base/core.c:3242
+ usb_new_device.cold+0x721/0x1058 drivers/usb/core/hub.c:2555
+ hub_port_connect drivers/usb/core/hub.c:5223 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]
+ port_event drivers/usb/core/hub.c:5509 [inline]
+ hub_event+0x2357/0x4320 drivers/usb/core/hub.c:5591
+ process_one_work+0x98d/0x1600 kernel/workqueue.c:2275
+ worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
+ kthread+0x3b1/0x4a0 kernel/kthread.c:292
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
+
+Reported-by: syzbot+719da9b149a931f5143f@syzkaller.appspotmail.com
+Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/f1ebad6e721412843bd1b12584444c0a63c6b2fb.1615242183.git.paskripkin@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -830,7 +830,8 @@ static int usb_audio_probe(struct usb_in
+ snd_media_device_create(chip, intf);
+ }
+
+- chip->quirk_type = quirk->type;
++ if (quirk)
++ chip->quirk_type = quirk->type;
+
+ usb_chip[chip->index] = chip;
+ chip->intf[chip->num_interfaces] = intf;
--- /dev/null
+From c5aa956eaeb05fe87e33433d7fd9f5e4d23c7416 Mon Sep 17 00:00:00 2001
+From: Pavel Skripkin <paskripkin@gmail.com>
+Date: Tue, 9 Mar 2021 01:30:57 +0300
+Subject: ALSA: usb-audio: fix use after free in usb_audio_disconnect
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+commit c5aa956eaeb05fe87e33433d7fd9f5e4d23c7416 upstream.
+
+The problem was in wrong "if" placement. chip->quirk_type is freed
+in snd_card_free_when_closed(), but inside if statement it's accesed.
+
+Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/16da19126ff461e5e64a9aec648cce28fb8ed73e.1615242183.git.paskripkin@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -907,6 +907,9 @@ static void usb_audio_disconnect(struct
+ }
+ }
+
++ if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND)
++ usb_enable_autosuspend(interface_to_usbdev(intf));
++
+ chip->num_interfaces--;
+ if (chip->num_interfaces <= 0) {
+ usb_chip[chip->index] = NULL;
+@@ -915,9 +918,6 @@ static void usb_audio_disconnect(struct
+ } else {
+ mutex_unlock(®ister_mutex);
+ }
+-
+- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND)
+- usb_enable_autosuspend(interface_to_usbdev(intf));
+ }
+
+ /* lock the shutdown (disconnect) task and autoresume */
--- /dev/null
+From 86c83365ab76e4b43cedd3ce07a07d32a4dc79ba Mon Sep 17 00:00:00 2001
+From: Andrey Konovalov <andreyknvl@google.com>
+Date: Mon, 8 Mar 2021 17:10:23 +0100
+Subject: arm64: kasan: fix page_alloc tagging with DEBUG_VIRTUAL
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+commit 86c83365ab76e4b43cedd3ce07a07d32a4dc79ba upstream.
+
+When CONFIG_DEBUG_VIRTUAL is enabled, the default page_to_virt() macro
+implementation from include/linux/mm.h is used. That definition doesn't
+account for KASAN tags, which leads to no tags on page_alloc allocations.
+
+Provide an arm64-specific definition for page_to_virt() when
+CONFIG_DEBUG_VIRTUAL is enabled that takes care of KASAN tags.
+
+Fixes: 2813b9c02962 ("kasan, mm, arm64: tag non slab memory allocated via pagealloc")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Link: https://lore.kernel.org/r/4b55b35202706223d3118230701c6a59749d9b72.1615219501.git.andreyknvl@google.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/memory.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/include/asm/memory.h
++++ b/arch/arm64/include/asm/memory.h
+@@ -306,6 +306,11 @@ static inline void *phys_to_virt(phys_ad
+ #define ARCH_PFN_OFFSET ((unsigned long)PHYS_PFN_OFFSET)
+
+ #if !defined(CONFIG_SPARSEMEM_VMEMMAP) || defined(CONFIG_DEBUG_VIRTUAL)
++#define page_to_virt(x) ({ \
++ __typeof__(x) __page = x; \
++ void *__addr = __va(page_to_phys(__page)); \
++ (void *)__tag_set((const void *)__addr, page_kasan_tag(__page));\
++})
+ #define virt_to_page(x) pfn_to_page(virt_to_pfn(x))
+ #else
+ #define page_to_virt(x) ({ \
--- /dev/null
+From d15dfd31384ba3cb93150e5f87661a76fa419f74 Mon Sep 17 00:00:00 2001
+From: Catalin Marinas <catalin.marinas@arm.com>
+Date: Tue, 9 Mar 2021 12:26:01 +0000
+Subject: arm64: mte: Map hotplugged memory as Normal Tagged
+
+From: Catalin Marinas <catalin.marinas@arm.com>
+
+commit d15dfd31384ba3cb93150e5f87661a76fa419f74 upstream.
+
+In a system supporting MTE, the linear map must allow reading/writing
+allocation tags by setting the memory type as Normal Tagged. Currently,
+this is only handled for memory present at boot. Hotplugged memory uses
+Normal non-Tagged memory.
+
+Introduce pgprot_mhp() for hotplugged memory and use it in
+add_memory_resource(). The arm64 code maps pgprot_mhp() to
+pgprot_tagged().
+
+Note that ZONE_DEVICE memory should not be mapped as Tagged and
+therefore setting the memory type in arch_add_memory() is not feasible.
+
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Fixes: 0178dc761368 ("arm64: mte: Use Normal Tagged attributes for the linear map")
+Reported-by: Patrick Daly <pdaly@codeaurora.org>
+Tested-by: Patrick Daly <pdaly@codeaurora.org>
+Link: https://lore.kernel.org/r/1614745263-27827-1-git-send-email-pdaly@codeaurora.org
+Cc: <stable@vger.kernel.org> # 5.10.x
+Cc: Will Deacon <will@kernel.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: David Hildenbrand <david@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Link: https://lore.kernel.org/r/20210309122601.5543-1-catalin.marinas@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/pgtable-prot.h | 1 -
+ arch/arm64/include/asm/pgtable.h | 3 +++
+ arch/arm64/mm/mmu.c | 3 ++-
+ include/linux/pgtable.h | 4 ++++
+ mm/memory_hotplug.c | 2 +-
+ 5 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/include/asm/pgtable-prot.h
++++ b/arch/arm64/include/asm/pgtable-prot.h
+@@ -66,7 +66,6 @@ extern bool arm64_use_ng_mappings;
+ #define _PAGE_DEFAULT (_PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL))
+
+ #define PAGE_KERNEL __pgprot(PROT_NORMAL)
+-#define PAGE_KERNEL_TAGGED __pgprot(PROT_NORMAL_TAGGED)
+ #define PAGE_KERNEL_RO __pgprot((PROT_NORMAL & ~PTE_WRITE) | PTE_RDONLY)
+ #define PAGE_KERNEL_ROX __pgprot((PROT_NORMAL & ~(PTE_WRITE | PTE_PXN)) | PTE_RDONLY)
+ #define PAGE_KERNEL_EXEC __pgprot(PROT_NORMAL & ~PTE_PXN)
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -484,6 +484,9 @@ static inline pmd_t pmd_mkdevmap(pmd_t p
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_NC) | PTE_PXN | PTE_UXN)
+ #define pgprot_device(prot) \
+ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_DEVICE_nGnRE) | PTE_PXN | PTE_UXN)
++#define pgprot_tagged(prot) \
++ __pgprot_modify(prot, PTE_ATTRINDX_MASK, PTE_ATTRINDX(MT_NORMAL_TAGGED))
++#define pgprot_mhp pgprot_tagged
+ /*
+ * DMA allocations for non-coherent devices use what the Arm architecture calls
+ * "Normal non-cacheable" memory, which permits speculation, unaligned accesses
+--- a/arch/arm64/mm/mmu.c
++++ b/arch/arm64/mm/mmu.c
+@@ -502,7 +502,8 @@ static void __init map_mem(pgd_t *pgdp)
+ * if MTE is present. Otherwise, it has the same attributes as
+ * PAGE_KERNEL.
+ */
+- __map_memblock(pgdp, start, end, PAGE_KERNEL_TAGGED, flags);
++ __map_memblock(pgdp, start, end, pgprot_tagged(PAGE_KERNEL),
++ flags);
+ }
+
+ /*
+--- a/include/linux/pgtable.h
++++ b/include/linux/pgtable.h
+@@ -857,6 +857,10 @@ static inline void ptep_modify_prot_comm
+ #define pgprot_device pgprot_noncached
+ #endif
+
++#ifndef pgprot_mhp
++#define pgprot_mhp(prot) (prot)
++#endif
++
+ #ifdef CONFIG_MMU
+ #ifndef pgprot_modify
+ #define pgprot_modify pgprot_modify
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -1020,7 +1020,7 @@ static int online_memory_block(struct me
+ */
+ int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags)
+ {
+- struct mhp_params params = { .pgprot = PAGE_KERNEL };
++ struct mhp_params params = { .pgprot = pgprot_mhp(PAGE_KERNEL) };
+ u64 start, size;
+ bool new_node = false;
+ int ret;
--- /dev/null
+From 7bb8bc6eb550116c504fb25af8678b9d7ca2abc5 Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Tue, 9 Mar 2021 17:44:12 -0700
+Subject: arm64: perf: Fix 64-bit event counter read truncation
+
+From: Rob Herring <robh@kernel.org>
+
+commit 7bb8bc6eb550116c504fb25af8678b9d7ca2abc5 upstream.
+
+Commit 0fdf1bb75953 ("arm64: perf: Avoid PMXEV* indirection") changed
+armv8pmu_read_evcntr() to return a u32 instead of u64. The result is
+silent truncation of the event counter when using 64-bit counters. Given
+the offending commit appears to have passed thru several folks, it seems
+likely this was a bad rebase after v8.5 PMU 64-bit counters landed.
+
+Cc: Alexandru Elisei <alexandru.elisei@arm.com>
+Cc: Julien Thierry <julien.thierry.kdev@gmail.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: <stable@vger.kernel.org>
+Fixes: 0fdf1bb75953 ("arm64: perf: Avoid PMXEV* indirection")
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Link: https://lore.kernel.org/r/20210310004412.1450128-1-robh@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/perf_event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -460,7 +460,7 @@ static inline int armv8pmu_counter_has_o
+ return pmnc & BIT(ARMV8_IDX_TO_COUNTER(idx));
+ }
+
+-static inline u32 armv8pmu_read_evcntr(int idx)
++static inline u64 armv8pmu_read_evcntr(int idx)
+ {
+ u32 counter = ARMV8_IDX_TO_COUNTER(idx);
+
--- /dev/null
+From e5113505904ea1c1c0e1f92c1cfa91fbf4da1694 Mon Sep 17 00:00:00 2001
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Date: Thu, 11 Mar 2021 16:25:46 +0900
+Subject: block: Discard page cache of zone reset target range
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+commit e5113505904ea1c1c0e1f92c1cfa91fbf4da1694 upstream.
+
+When zone reset ioctl and data read race for a same zone on zoned block
+devices, the data read leaves stale page cache even though the zone
+reset ioctl zero clears all the zone data on the device. To avoid
+non-zero data read from the stale page cache after zone reset, discard
+page cache of reset target zones in blkdev_zone_mgmt_ioctl(). Introduce
+the helper function blkdev_truncate_zone_range() to discard the page
+cache. Ensure the page cache discarded by calling the helper function
+before and after zone reset in same manner as fallocate does.
+
+This patch can be applied back to the stable kernel version v5.10.y.
+Rework is needed for older stable kernels.
+
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls")
+Cc: <stable@vger.kernel.org> # 5.10+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/20210311072546.678999-1-shinichiro.kawasaki@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-zoned.c | 38 ++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 36 insertions(+), 2 deletions(-)
+
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -318,6 +318,22 @@ int blkdev_report_zones_ioctl(struct blo
+ return 0;
+ }
+
++static int blkdev_truncate_zone_range(struct block_device *bdev, fmode_t mode,
++ const struct blk_zone_range *zrange)
++{
++ loff_t start, end;
++
++ if (zrange->sector + zrange->nr_sectors <= zrange->sector ||
++ zrange->sector + zrange->nr_sectors > get_capacity(bdev->bd_disk))
++ /* Out of range */
++ return -EINVAL;
++
++ start = zrange->sector << SECTOR_SHIFT;
++ end = ((zrange->sector + zrange->nr_sectors) << SECTOR_SHIFT) - 1;
++
++ return truncate_bdev_range(bdev, mode, start, end);
++}
++
+ /*
+ * BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE ioctl processing.
+ * Called from blkdev_ioctl.
+@@ -329,6 +345,7 @@ int blkdev_zone_mgmt_ioctl(struct block_
+ struct request_queue *q;
+ struct blk_zone_range zrange;
+ enum req_opf op;
++ int ret;
+
+ if (!argp)
+ return -EINVAL;
+@@ -352,6 +369,11 @@ int blkdev_zone_mgmt_ioctl(struct block_
+ switch (cmd) {
+ case BLKRESETZONE:
+ op = REQ_OP_ZONE_RESET;
++
++ /* Invalidate the page cache, including dirty pages. */
++ ret = blkdev_truncate_zone_range(bdev, mode, &zrange);
++ if (ret)
++ return ret;
+ break;
+ case BLKOPENZONE:
+ op = REQ_OP_ZONE_OPEN;
+@@ -366,8 +388,20 @@ int blkdev_zone_mgmt_ioctl(struct block_
+ return -ENOTTY;
+ }
+
+- return blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors,
+- GFP_KERNEL);
++ ret = blkdev_zone_mgmt(bdev, op, zrange.sector, zrange.nr_sectors,
++ GFP_KERNEL);
++
++ /*
++ * Invalidate the page cache again for zone reset: writes can only be
++ * direct for zoned devices so concurrent writes would not add any page
++ * to the page cache after/during reset. The page cache may be filled
++ * again due to concurrent reads though and dropping the pages for
++ * these is fine.
++ */
++ if (!ret && cmd == BLKRESETZONE)
++ ret = blkdev_truncate_zone_range(bdev, mode, &zrange);
++
++ return ret;
+ }
+
+ static inline unsigned long *blk_alloc_zone_bitmap(int node,
--- /dev/null
+From 56887cffe946bb0a90c74429fa94d6110a73119d Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 22 Feb 2021 10:48:09 +0100
+Subject: block: Try to handle busy underlying device on discard
+
+From: Jan Kara <jack@suse.cz>
+
+commit 56887cffe946bb0a90c74429fa94d6110a73119d upstream.
+
+Commit 384d87ef2c95 ("block: Do not discard buffers under a mounted
+filesystem") made paths issuing discard or zeroout requests to the
+underlying device try to grab block device in exclusive mode. If that
+failed we returned EBUSY to userspace. This however caused unexpected
+fallout in userspace where e.g. FUSE filesystems issue discard requests
+from userspace daemons although the device is open exclusively by the
+kernel. Also shrinking of logical volume by LVM issues discard requests
+to a device which may be claimed exclusively because there's another LV
+on the same PV. So to avoid these userspace regressions, fall back to
+invalidate_inode_pages2_range() instead of returning EBUSY to userspace
+and return EBUSY only of that call fails as well (meaning that there's
+indeed someone using the particular device range we are trying to
+discard).
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=211167
+Fixes: 384d87ef2c95 ("block: Do not discard buffers under a mounted filesystem")
+CC: stable@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/block_dev.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -123,12 +123,21 @@ int truncate_bdev_range(struct block_dev
+ err = bd_prepare_to_claim(bdev, claimed_bdev,
+ truncate_bdev_range);
+ if (err)
+- return err;
++ goto invalidate;
+ }
+ truncate_inode_pages_range(bdev->bd_inode->i_mapping, lstart, lend);
+ if (claimed_bdev)
+ bd_abort_claiming(bdev, claimed_bdev, truncate_bdev_range);
+ return 0;
++
++invalidate:
++ /*
++ * Someone else has handle exclusively open. Try invalidating instead.
++ * The 'end' argument is inclusive so the rounding is safe.
++ */
++ return invalidate_inode_pages2_range(bdev->bd_inode->i_mapping,
++ lstart >> PAGE_SHIFT,
++ lend >> PAGE_SHIFT);
+ }
+ EXPORT_SYMBOL(truncate_bdev_range);
+
--- /dev/null
+From 04ad69c342fc4de5bd23be9ef15ea7574fb1a87e Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@cjr.nz>
+Date: Mon, 8 Mar 2021 12:00:50 -0300
+Subject: cifs: do not send close in compound create+close requests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+commit 04ad69c342fc4de5bd23be9ef15ea7574fb1a87e upstream.
+
+In case of interrupted syscalls, prevent sending CLOSE commands for
+compound CREATE+CLOSE requests by introducing an
+CIFS_CP_CREATE_CLOSE_OP flag to indicate lower layers that it should
+not send a CLOSE command to the MIDs corresponding the compound
+CREATE+CLOSE request.
+
+A simple reproducer:
+
+ #!/bin/bash
+
+ mount //server/share /mnt -o username=foo,password=***
+ tc qdisc add dev eth0 root netem delay 450ms
+ stat -f /mnt &>/dev/null & pid=$!
+ sleep 0.01
+ kill $pid
+ tc qdisc del dev eth0 root
+ umount /mnt
+
+Before patch:
+
+ ...
+ 6 0.256893470 192.168.122.2 → 192.168.122.15 SMB2 402 Create Request File: ;GetInfo Request FS_INFO/FileFsFullSizeInformation;Close Request
+ 7 0.257144491 192.168.122.15 → 192.168.122.2 SMB2 498 Create Response File: ;GetInfo Response;Close Response
+ 9 0.260798209 192.168.122.2 → 192.168.122.15 SMB2 146 Close Request File:
+ 10 0.260841089 192.168.122.15 → 192.168.122.2 SMB2 130 Close Response, Error: STATUS_FILE_CLOSED
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/cifsglob.h | 11 ++++++-----
+ fs/cifs/smb2inode.c | 1 +
+ fs/cifs/smb2misc.c | 8 ++++----
+ fs/cifs/smb2ops.c | 10 +++++-----
+ fs/cifs/smb2proto.h | 3 +--
+ fs/cifs/transport.c | 2 +-
+ 6 files changed, 18 insertions(+), 17 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -256,7 +256,7 @@ struct smb_version_operations {
+ /* verify the message */
+ int (*check_message)(char *, unsigned int, struct TCP_Server_Info *);
+ bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
+- int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *);
++ int (*handle_cancelled_mid)(struct mid_q_entry *, struct TCP_Server_Info *);
+ void (*downgrade_oplock)(struct TCP_Server_Info *server,
+ struct cifsInodeInfo *cinode, __u32 oplock,
+ unsigned int epoch, bool *purge_cache);
+@@ -1785,10 +1785,11 @@ static inline bool is_retryable_error(in
+ #define CIFS_NO_RSP_BUF 0x040 /* no response buffer required */
+
+ /* Type of request operation */
+-#define CIFS_ECHO_OP 0x080 /* echo request */
+-#define CIFS_OBREAK_OP 0x0100 /* oplock break request */
+-#define CIFS_NEG_OP 0x0200 /* negotiate request */
+-#define CIFS_OP_MASK 0x0380 /* mask request type */
++#define CIFS_ECHO_OP 0x080 /* echo request */
++#define CIFS_OBREAK_OP 0x0100 /* oplock break request */
++#define CIFS_NEG_OP 0x0200 /* negotiate request */
++#define CIFS_CP_CREATE_CLOSE_OP 0x0400 /* compound create+close request */
++#define CIFS_OP_MASK 0x0780 /* mask request type */
+
+ #define CIFS_HAS_CREDITS 0x0400 /* already has credits */
+ #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */
+--- a/fs/cifs/smb2inode.c
++++ b/fs/cifs/smb2inode.c
+@@ -358,6 +358,7 @@ smb2_compound_op(const unsigned int xid,
+ if (cfile)
+ goto after_close;
+ /* Close */
++ flags |= CIFS_CP_CREATE_CLOSE_OP;
+ rqst[num_rqst].rq_iov = &vars->close_iov[0];
+ rqst[num_rqst].rq_nvec = 1;
+ rc = SMB2_close_init(tcon, server,
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -835,14 +835,14 @@ smb2_handle_cancelled_close(struct cifs_
+ }
+
+ int
+-smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server)
++smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server)
+ {
+- struct smb2_sync_hdr *sync_hdr = (struct smb2_sync_hdr *)buffer;
+- struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer;
++ struct smb2_sync_hdr *sync_hdr = mid->resp_buf;
++ struct smb2_create_rsp *rsp = mid->resp_buf;
+ struct cifs_tcon *tcon;
+ int rc;
+
+- if (sync_hdr->Command != SMB2_CREATE ||
++ if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || sync_hdr->Command != SMB2_CREATE ||
+ sync_hdr->Status != STATUS_SUCCESS)
+ return 0;
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1137,7 +1137,7 @@ smb2_set_ea(const unsigned int xid, stru
+ struct TCP_Server_Info *server = cifs_pick_channel(ses);
+ __le16 *utf16_path = NULL;
+ int ea_name_len = strlen(ea_name);
+- int flags = 0;
++ int flags = CIFS_CP_CREATE_CLOSE_OP;
+ int len;
+ struct smb_rqst rqst[3];
+ int resp_buftype[3];
+@@ -1515,7 +1515,7 @@ smb2_ioctl_query_info(const unsigned int
+ struct smb_query_info qi;
+ struct smb_query_info __user *pqi;
+ int rc = 0;
+- int flags = 0;
++ int flags = CIFS_CP_CREATE_CLOSE_OP;
+ struct smb2_query_info_rsp *qi_rsp = NULL;
+ struct smb2_ioctl_rsp *io_rsp = NULL;
+ void *buffer = NULL;
+@@ -2482,7 +2482,7 @@ smb2_query_info_compound(const unsigned
+ {
+ struct cifs_ses *ses = tcon->ses;
+ struct TCP_Server_Info *server = cifs_pick_channel(ses);
+- int flags = 0;
++ int flags = CIFS_CP_CREATE_CLOSE_OP;
+ struct smb_rqst rqst[3];
+ int resp_buftype[3];
+ struct kvec rsp_iov[3];
+@@ -2880,7 +2880,7 @@ smb2_query_symlink(const unsigned int xi
+ unsigned int sub_offset;
+ unsigned int print_len;
+ unsigned int print_offset;
+- int flags = 0;
++ int flags = CIFS_CP_CREATE_CLOSE_OP;
+ struct smb_rqst rqst[3];
+ int resp_buftype[3];
+ struct kvec rsp_iov[3];
+@@ -3062,7 +3062,7 @@ smb2_query_reparse_tag(const unsigned in
+ struct cifs_open_parms oparms;
+ struct cifs_fid fid;
+ struct TCP_Server_Info *server = cifs_pick_channel(tcon->ses);
+- int flags = 0;
++ int flags = CIFS_CP_CREATE_CLOSE_OP;
+ struct smb_rqst rqst[3];
+ int resp_buftype[3];
+ struct kvec rsp_iov[3];
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -246,8 +246,7 @@ extern int SMB2_oplock_break(const unsig
+ extern int smb2_handle_cancelled_close(struct cifs_tcon *tcon,
+ __u64 persistent_fid,
+ __u64 volatile_fid);
+-extern int smb2_handle_cancelled_mid(char *buffer,
+- struct TCP_Server_Info *server);
++extern int smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server);
+ void smb2_cancelled_close_fid(struct work_struct *work);
+ extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
+ u64 persistent_file_id, u64 volatile_file_id,
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -101,7 +101,7 @@ static void _cifs_mid_q_entry_release(st
+ if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
+ midEntry->mid_state == MID_RESPONSE_RECEIVED &&
+ server->ops->handle_cancelled_mid)
+- server->ops->handle_cancelled_mid(midEntry->resp_buf, server);
++ server->ops->handle_cancelled_mid(midEntry, server);
+
+ midEntry->mid_state = MID_FREE;
+ atomic_dec(&midCount);
--- /dev/null
+From 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Wed, 3 Mar 2021 11:26:14 +0200
+Subject: mmc: core: Fix partition switch time for eMMC
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 66fbacccbab91e6e55d9c8f1fc0910a8eb6c81f7 upstream.
+
+Avoid the following warning by always defining partition switch time:
+
+ [ 3.209874] mmc1: unspecified timeout for CMD6 - use generic
+ [ 3.222780] ------------[ cut here ]------------
+ [ 3.233363] WARNING: CPU: 1 PID: 111 at drivers/mmc/core/mmc_ops.c:575 __mmc_switch+0x200/0x204
+
+Reported-by: Paul Fertser <fercerpav@gmail.com>
+Fixes: 1c447116d017 ("mmc: mmc: Fix partition switch timeout for some eMMCs")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/168bbfd6-0c5b-5ace-ab41-402e7937c46e@intel.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/mmc.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -423,10 +423,6 @@ static int mmc_decode_ext_csd(struct mmc
+
+ /* EXT_CSD value is in units of 10ms, but we store in ms */
+ card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME];
+- /* Some eMMC set the value too low so set a minimum */
+- if (card->ext_csd.part_time &&
+- card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
+- card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
+
+ /* Sleep / awake timeout in 100ns units */
+ if (sa_shift > 0 && sa_shift <= 0x17)
+@@ -616,6 +612,17 @@ static int mmc_decode_ext_csd(struct mmc
+ card->ext_csd.data_sector_size = 512;
+ }
+
++ /*
++ * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined
++ * when accessing a specific field", so use it here if there is no
++ * PARTITION_SWITCH_TIME.
++ */
++ if (!card->ext_csd.part_time)
++ card->ext_csd.part_time = card->ext_csd.generic_cmd6_time;
++ /* Some eMMC set the value too low so set a minimum */
++ if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
++
+ /* eMMC v5 or later */
+ if (card->ext_csd.rev >= 7) {
+ memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION],
--- /dev/null
+From f06391c45e83f9a731045deb23df7cc3814fd795 Mon Sep 17 00:00:00 2001
+From: Frank Li <lznuaa@gmail.com>
+Date: Wed, 3 Mar 2021 11:42:48 -0600
+Subject: mmc: cqhci: Fix random crash when remove mmc module/card
+
+From: Frank Li <lznuaa@gmail.com>
+
+commit f06391c45e83f9a731045deb23df7cc3814fd795 upstream.
+
+[ 6684.493350] Unable to handle kernel paging request at virtual address ffff800011c5b0f0
+[ 6684.498531] mmc0: card 0001 removed
+[ 6684.501556] Mem abort info:
+[ 6684.509681] ESR = 0x96000047
+[ 6684.512786] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 6684.518394] SET = 0, FnV = 0
+[ 6684.521707] EA = 0, S1PTW = 0
+[ 6684.524998] Data abort info:
+[ 6684.528236] ISV = 0, ISS = 0x00000047
+[ 6684.532986] CM = 0, WnR = 1
+[ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081b22000
+[ 6684.543923] [ffff800011c5b0f0] pgd=00000000bffff003, p4d=00000000bffff003, pud=00000000bfffe003, pmd=00000000900e1003, pte=0000000000000000
+[ 6684.557915] Internal error: Oops: 96000047 [#1] PREEMPT SMP
+[ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
+[ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 5.10.9-01410-g3ba33182767b-dirty #10
+[ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
+[ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
+
+[ 6684.606094] pstate: 40000005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
+[ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
+^GMessage from syslogd@ at Thu Jan 1 01:51:24 1970 ...[ 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
+[ 6684.626734] sp : ffff80001243b9f0
+[ 6684.630049] x29: ffff80001243b9f0 x28: ffff00002c3dd000
+[ 6684.635367] x27: 0000000000000001 x26: 0000000000000001
+[ 6684.640690] x25: ffff00002c451000 x24: 000000000000000f
+[ 6684.646007] x23: ffff000017e71c80 x22: ffff00002c451000
+[ 6684.651326] x21: ffff00002c0f3550 x20: ffff00002c0f3550
+[ 6684.656651] x19: ffff000017d46880 x18: ffff00002cea1500
+[ 6684.661977] x17: 0000000000000000 x16: 0000000000000000
+[ 6684.667294] x15: 000001ee628e3ed1 x14: 0000000000000278
+[ 6684.672610] x13: 0000000000000001 x12: 0000000000000001
+[ 6684.677927] x11: 0000000000000000 x10: 0000000000000000
+[ 6684.683243] x9 : 000000000000002b x8 : 0000000000001000
+[ 6684.688560] x7 : 0000000000000010 x6 : ffff00002c0f3678
+[ 6684.693886] x5 : 000000000000000f x4 : ffff800011c5b000
+[ 6684.699211] x3 : 000000000002d988 x2 : 0000000000000008
+[ 6684.704537] x1 : 00000000000000f0 x0 : 0002d9880008102f
+[ 6684.709854] Call trace:
+[ 6684.712313] cqhci_request+0x148/0x4e8 [cqhci]
+[ 6684.716803] mmc_cqe_start_req+0x58/0x68 [mmc_core]
+[ 6684.721698] mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
+[ 6684.727018] mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
+
+The problem occurs when cqhci_request() get called after cqhci_disable() as
+it leads to access of allocated memory that has already been freed. Let's
+fix the problem by calling cqhci_disable() a bit later in the remove path.
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Diagnosed-by: Adrian Hunter <adrian.hunter@intel.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20210303174248.542175-1-Frank.Li@nxp.com
+Fixes: f690f4409ddd ("mmc: mmc: Enable CQE's")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/core/bus.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/mmc/core/bus.c
++++ b/drivers/mmc/core/bus.c
+@@ -399,11 +399,6 @@ void mmc_remove_card(struct mmc_card *ca
+ mmc_remove_card_debugfs(card);
+ #endif
+
+- if (host->cqe_enabled) {
+- host->cqe_ops->cqe_disable(host);
+- host->cqe_enabled = false;
+- }
+-
+ if (mmc_card_present(card)) {
+ if (mmc_host_is_spi(card->host)) {
+ pr_info("%s: SPI card removed\n",
+@@ -416,6 +411,10 @@ void mmc_remove_card(struct mmc_card *ca
+ of_node_put(card->dev.of_node);
+ }
+
++ if (host->cqe_enabled) {
++ host->cqe_ops->cqe_disable(host);
++ host->cqe_enabled = false;
++ }
++
+ put_device(&card->dev);
+ }
+-
--- /dev/null
+From 774514bf977377c9137640a0310bd64eed0f7323 Mon Sep 17 00:00:00 2001
+From: Yann Gautier <yann.gautier@foss.st.com>
+Date: Thu, 25 Feb 2021 15:54:54 +0100
+Subject: mmc: mmci: Add MMC_CAP_NEED_RSP_BUSY for the stm32 variants
+
+From: Yann Gautier <yann.gautier@foss.st.com>
+
+commit 774514bf977377c9137640a0310bd64eed0f7323 upstream.
+
+An issue has been observed on STM32MP157C-EV1 board, with an erase command
+with secure erase argument, ending up waiting for ~4 hours before timeout.
+
+The requested busy timeout from the mmc core ends up with 14784000ms (~4
+hours), but the supported host->max_busy_timeout is 86767ms, which leads to
+that the core switch to use an R1 response in favor of the R1B and polls
+for busy with the host->card_busy() ops. In this case the polling doesn't
+work as expected, as we never detects that the card stops signaling busy,
+which leads to the following message:
+
+ mmc1: Card stuck being busy! __mmc_poll_for_busy
+
+The problem boils done to that the stm32 variants can't use R1 responses in
+favor of R1B responses, as it leads to an internal state machine in the
+controller to get stuck. To continue to process requests, it would need to
+be reset.
+
+To fix this problem, let's set MMC_CAP_NEED_RSP_BUSY for the stm32 variant,
+which prevent the mmc core from switching to R1 responses. Additionally,
+let's cap the cmd->busy_timeout to the host->max_busy_timeout, thus rely on
+86767ms to be sufficient (~66 seconds was need for this test case).
+
+Fixes: 94fe2580a2f3 ("mmc: core: Enable erase/discard/trim support for all mmc hosts")
+Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
+Link: https://lore.kernel.org/r/20210225145454.12780-1-yann.gautier@foss.st.com
+Cc: stable@vger.kernel.org
+[Ulf: Simplified the code and extended the commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/mmc/host/mmci.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1241,7 +1241,11 @@ mmci_start_command(struct mmci_host *hos
+ if (!cmd->busy_timeout)
+ cmd->busy_timeout = 10 * MSEC_PER_SEC;
+
+- clks = (unsigned long long)cmd->busy_timeout * host->cclk;
++ if (cmd->busy_timeout > host->mmc->max_busy_timeout)
++ clks = (unsigned long long)host->mmc->max_busy_timeout * host->cclk;
++ else
++ clks = (unsigned long long)cmd->busy_timeout * host->cclk;
++
+ do_div(clks, MSEC_PER_SEC);
+ writel_relaxed(clks, host->base + MMCIDATATIMER);
+ }
+@@ -2091,6 +2095,10 @@ static int mmci_probe(struct amba_device
+ mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
+ }
+
++ /* Variants with mandatory busy timeout in HW needs R1B responses. */
++ if (variant->busy_timeout)
++ mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
++
+ /* Prepare a CMD12 - needed to clear the DPSM on some variants. */
+ host->stop_abort.opcode = MMC_STOP_TRANSMISSION;
+ host->stop_abort.arg = 0;
+++ /dev/null
-From 2055a99da8a253a357bdfd359b3338ef3375a26c Mon Sep 17 00:00:00 2001
-From: Jia-Ju Bai <baijiaju1990@gmail.com>
-Date: Sun, 7 Mar 2021 19:11:02 -0800
-Subject: net: bonding: fix error return code of bond_neigh_init()
-
-From: Jia-Ju Bai <baijiaju1990@gmail.com>
-
-commit 2055a99da8a253a357bdfd359b3338ef3375a26c upstream.
-
-When slave is NULL or slave_ops->ndo_neigh_setup is NULL, no error
-return code of bond_neigh_init() is assigned.
-To fix this bug, ret is assigned with -EINVAL in these cases.
-
-Fixes: 9e99bfefdbce ("bonding: fix bond_neigh_init()")
-Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
-Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/net/bonding/bond_main.c | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -3918,11 +3918,15 @@ static int bond_neigh_init(struct neighb
-
- rcu_read_lock();
- slave = bond_first_slave_rcu(bond);
-- if (!slave)
-+ if (!slave) {
-+ ret = -EINVAL;
- goto out;
-+ }
- slave_ops = slave->dev->netdev_ops;
-- if (!slave_ops->ndo_neigh_setup)
-+ if (!slave_ops->ndo_neigh_setup) {
-+ ret = -EINVAL;
- goto out;
-+ }
-
- /* TODO: find another way [1] to implement this.
- * Passing a zeroed structure is fragile,
--- /dev/null
+From 3b0c2d3eaa83da259d7726192cf55a137769012f Mon Sep 17 00:00:00 2001
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Fri, 12 Mar 2021 15:07:09 -0600
+Subject: Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream.
+
+It turns out that there are in fact userspace implementations that
+care and this recent change caused a regression.
+
+https://github.com/containers/buildah/issues/3071
+
+As the motivation for the original change was future development,
+and the impact is existing real world code just revert this change
+and allow the ambiguity in v3 file caps.
+
+Cc: stable@vger.kernel.org
+Fixes: 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/commoncap.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -500,8 +500,7 @@ int cap_convert_nscap(struct dentry *den
+ __u32 magic, nsmagic;
+ struct inode *inode = d_backing_inode(dentry);
+ struct user_namespace *task_ns = current_user_ns(),
+- *fs_ns = inode->i_sb->s_user_ns,
+- *ancestor;
++ *fs_ns = inode->i_sb->s_user_ns;
+ kuid_t rootid;
+ size_t newsize;
+
+@@ -524,15 +523,6 @@ int cap_convert_nscap(struct dentry *den
+ if (nsrootid == -1)
+ return -EINVAL;
+
+- /*
+- * Do not allow allow adding a v3 filesystem capability xattr
+- * if the rootid field is ambiguous.
+- */
+- for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
+- if (from_kuid(ancestor, rootid) == 0)
+- return -EINVAL;
+- }
+-
+ newsize = sizeof(struct vfs_ns_cap_data);
+ nscap = kmalloc(newsize, GFP_ATOMIC);
+ if (!nscap)
--- /dev/null
+From 7d365bd0bff3c0310c39ebaffc9a8458e036d666 Mon Sep 17 00:00:00 2001
+From: Stefan Haberland <sth@linux.ibm.com>
+Date: Fri, 5 Mar 2021 13:54:38 +0100
+Subject: s390/dasd: fix hanging DASD driver unbind
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+commit 7d365bd0bff3c0310c39ebaffc9a8458e036d666 upstream.
+
+In case of an unbind of the DASD device driver the function
+dasd_generic_remove() is called which shuts down the device.
+Among others this functions removes the int_handler from the cdev.
+During shutdown the device cancels all outstanding IO requests and waits
+for completion of the clear request.
+Unfortunately the clear interrupt will never be received when there is no
+interrupt handler connected.
+
+Fix by moving the int_handler removal after the call to the state machine
+where no request or interrupt is outstanding.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Tested-by: Bjoern Walk <bwalk@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -3522,8 +3522,6 @@ void dasd_generic_remove(struct ccw_devi
+ struct dasd_device *device;
+ struct dasd_block *block;
+
+- cdev->handler = NULL;
+-
+ device = dasd_device_from_cdev(cdev);
+ if (IS_ERR(device)) {
+ dasd_remove_sysfs_files(cdev);
+@@ -3542,6 +3540,7 @@ void dasd_generic_remove(struct ccw_devi
+ * no quite down yet.
+ */
+ dasd_set_target_state(device, DASD_STATE_NEW);
++ cdev->handler = NULL;
+ /* dasd_delete_device destroys the device reference. */
+ block = device->block;
+ dasd_delete_device(device);
--- /dev/null
+From 66f669a272898feb1c69b770e1504aa2ec7723d1 Mon Sep 17 00:00:00 2001
+From: Stefan Haberland <sth@linux.ibm.com>
+Date: Fri, 5 Mar 2021 13:54:39 +0100
+Subject: s390/dasd: fix hanging IO request during DASD driver unbind
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+commit 66f669a272898feb1c69b770e1504aa2ec7723d1 upstream.
+
+Prevent that an IO request is build during device shutdown initiated by
+a driver unbind. This request will never be able to be processed or
+canceled and will hang forever. This will lead also to a hanging unbind.
+
+Fix by checking not only if the device is in READY state but also check
+that there is no device offline initiated before building a new IO request.
+
+Fixes: e443343e509a ("s390/dasd: blk-mq conversion")
+
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Tested-by: Bjoern Walk <bwalk@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/block/dasd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -3087,7 +3087,8 @@ static blk_status_t do_dasd_request(stru
+
+ basedev = block->base;
+ spin_lock_irq(&dq->lock);
+- if (basedev->state < DASD_STATE_READY) {
++ if (basedev->state < DASD_STATE_READY ||
++ test_bit(DASD_FLAG_OFFLINE, &basedev->flags)) {
+ DBF_DEV_EVENT(DBF_ERR, basedev,
+ "device not ready for request %p", req);
+ rc = BLK_STS_IOERR;
net-davicom-fix-regulator-not-turned-off-on-failed-probe.patch
net-davicom-fix-regulator-not-turned-off-on-driver-removal.patch
net-enetc-allow-hardware-timestamping-on-tx-queues-with-tc-etf-enabled.patch
-net-bonding-fix-error-return-code-of-bond_neigh_init.patch
net-qrtr-fix-error-return-code-of-qrtr_sendmsg.patch
s390-qeth-fix-memory-leak-after-failed-tx-buffer-allocation.patch
r8169-fix-r8168fp_adjust_ocp_cmd-function.patch
arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch
arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch
arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch
+alsa-usb-add-plantronics-c320-m-usb-ctrl-msg-delay-quirk.patch
+alsa-hda-hdmi-cancel-pending-works-before-suspend.patch
+alsa-hda-conexant-add-quirk-for-mute-led-control-on-hp-zbook-g5.patch
+alsa-hda-ca0132-add-sound-blasterx-ae-5-plus-support.patch
+alsa-hda-drop-the-batch-workaround-for-amd-controllers.patch
+alsa-hda-flush-pending-unsolicited-events-before-suspend.patch
+alsa-hda-avoid-spurious-unsol-event-handling-during-s3-s4.patch
+alsa-usb-audio-fix-cannot-get-freq-eq-errors-on-dell-ae515-sound-bar.patch
+alsa-usb-audio-apply-the-control-quirk-to-plantronics-headsets.patch
+alsa-usb-audio-disable-usb-autosuspend-properly-in-setup_disable_autosuspend.patch
+alsa-usb-audio-fix-null-ptr-dereference-in-usb_audio_probe.patch
+alsa-usb-audio-fix-use-after-free-in-usb_audio_disconnect.patch
+revert-95ebabde382c-capabilities-don-t-allow-writing-ambiguous-v3-file-capabilities.patch
+block-discard-page-cache-of-zone-reset-target-range.patch
+block-try-to-handle-busy-underlying-device-on-discard.patch
+arm64-kasan-fix-page_alloc-tagging-with-debug_virtual.patch
+arm64-mte-map-hotplugged-memory-as-normal-tagged.patch
+arm64-perf-fix-64-bit-event-counter-read-truncation.patch
+s390-dasd-fix-hanging-dasd-driver-unbind.patch
+s390-dasd-fix-hanging-io-request-during-dasd-driver-unbind.patch
+software-node-fix-node-registration.patch
+xen-events-reset-affinity-of-2-level-event-when-tearing-it-down.patch
+mmc-mmci-add-mmc_cap_need_rsp_busy-for-the-stm32-variants.patch
+mmc-core-fix-partition-switch-time-for-emmc.patch
+mmc-cqhci-fix-random-crash-when-remove-mmc-module-card.patch
+cifs-do-not-send-close-in-compound-create-close-requests.patch
--- /dev/null
+From 8891123f9cbb9c1ee531e5a87fa116f0af685c48 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Mon, 1 Mar 2021 17:30:11 +0300
+Subject: software node: Fix node registration
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 8891123f9cbb9c1ee531e5a87fa116f0af685c48 upstream.
+
+Software node can not be registered before its parent.
+
+Fixes: 80488a6b1d3c ("software node: Add support for static node descriptors")
+Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/swnode.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -786,6 +786,9 @@ int software_node_register(const struct
+ if (software_node_to_swnode(node))
+ return -EEXIST;
+
++ if (node->parent && !parent)
++ return -EINVAL;
++
+ return PTR_ERR_OR_ZERO(swnode_register(node, parent, 0));
+ }
+ EXPORT_SYMBOL_GPL(software_node_register);
--- /dev/null
+From 9e77d96b8e2724ed00380189f7b0ded61113b39f Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Sat, 6 Mar 2021 17:18:31 +0100
+Subject: xen/events: reset affinity of 2-level event when tearing it down
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 9e77d96b8e2724ed00380189f7b0ded61113b39f upstream.
+
+When creating a new event channel with 2-level events the affinity
+needs to be reset initially in order to avoid using an old affinity
+from earlier usage of the event channel port. So when tearing an event
+channel down reset all affinity bits.
+
+The same applies to the affinity when onlining a vcpu: all old
+affinity settings for this vcpu must be reset. As percpu events get
+initialized before the percpu event channel hook is called,
+resetting of the affinities happens after offlining a vcpu (this is
+working, as initial percpu memory is zeroed out).
+
+Cc: stable@vger.kernel.org
+Reported-by: Julien Grall <julien@xen.org>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+Link: https://lore.kernel.org/r/20210306161833.4552-2-jgross@suse.com
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/xen/events/events_2l.c | 15 +++++++++++++++
+ drivers/xen/events/events_base.c | 1 +
+ drivers/xen/events/events_internal.h | 8 ++++++++
+ 3 files changed, 24 insertions(+)
+
+--- a/drivers/xen/events/events_2l.c
++++ b/drivers/xen/events/events_2l.c
+@@ -47,6 +47,11 @@ static unsigned evtchn_2l_max_channels(v
+ return EVTCHN_2L_NR_CHANNELS;
+ }
+
++static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu)
++{
++ clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu)));
++}
++
+ static void evtchn_2l_bind_to_cpu(evtchn_port_t evtchn, unsigned int cpu,
+ unsigned int old_cpu)
+ {
+@@ -355,9 +360,18 @@ static void evtchn_2l_resume(void)
+ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
+ }
+
++static int evtchn_2l_percpu_deinit(unsigned int cpu)
++{
++ memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) *
++ EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
++
++ return 0;
++}
++
+ static const struct evtchn_ops evtchn_ops_2l = {
+ .max_channels = evtchn_2l_max_channels,
+ .nr_channels = evtchn_2l_max_channels,
++ .remove = evtchn_2l_remove,
+ .bind_to_cpu = evtchn_2l_bind_to_cpu,
+ .clear_pending = evtchn_2l_clear_pending,
+ .set_pending = evtchn_2l_set_pending,
+@@ -367,6 +381,7 @@ static const struct evtchn_ops evtchn_op
+ .unmask = evtchn_2l_unmask,
+ .handle_events = evtchn_2l_handle_events,
+ .resume = evtchn_2l_resume,
++ .percpu_deinit = evtchn_2l_percpu_deinit,
+ };
+
+ void __init xen_evtchn_2l_init(void)
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -338,6 +338,7 @@ static int xen_irq_info_pirq_setup(unsig
+ static void xen_irq_info_cleanup(struct irq_info *info)
+ {
+ set_evtchn_to_irq(info->evtchn, -1);
++ xen_evtchn_port_remove(info->evtchn, info->cpu);
+ info->evtchn = 0;
+ }
+
+--- a/drivers/xen/events/events_internal.h
++++ b/drivers/xen/events/events_internal.h
+@@ -14,6 +14,7 @@ struct evtchn_ops {
+ unsigned (*nr_channels)(void);
+
+ int (*setup)(evtchn_port_t port);
++ void (*remove)(evtchn_port_t port, unsigned int cpu);
+ void (*bind_to_cpu)(evtchn_port_t evtchn, unsigned int cpu,
+ unsigned int old_cpu);
+
+@@ -54,6 +55,13 @@ static inline int xen_evtchn_port_setup(
+ return 0;
+ }
+
++static inline void xen_evtchn_port_remove(evtchn_port_t evtchn,
++ unsigned int cpu)
++{
++ if (evtchn_ops->remove)
++ evtchn_ops->remove(evtchn, cpu);
++}
++
+ static inline void xen_evtchn_port_bind_to_cpu(evtchn_port_t evtchn,
+ unsigned int cpu,
+ unsigned int old_cpu)
projects / thirdparty / kernel / stable-queue.git / commitdiff
