This is the 5.4.214 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmMplc4ACgkQONu9yGCS
 aT7JAw//SoS3KufL4ygl35P1YXSX5ozYk1YxU2i5cft6ewzB62OFDxjJqc6mFzY/
 GzOLmXAST6huuX22PMbdoHljdXiSPIpT8WBs5GxGZCXxBTxLznJnV4SNYHo4f3OL
 SzXMlqV7FgVB6kc4R0YBXOHx6kU2HcRY3c46YDYHDRlWyn9p3QE3EugVCal/LzHR
 eTEqCIfa7qsN2CcavhOiUzGpV3wQ6fo/E5h5p6KdweR0JS/wgqbAVGAuc2WkgKZC
 c8oAu3Yl2Xmf30+uVTR3/Njx2z1Dfo3RrR0HwjtLXlBGFrsji82ClXDrRI4QSHs4
 CQYASpQx7lr39AZg93ElrZ9k+LRoY6f9m+exDfJmuoJNKzPIUuXtbvORnAAi7UJt
 HzN1YbIqsedjaA4x1FEOBodinYZEdwhL6SBrA03sg1VLDM6CZH2PKo00A1YuYdSF
 XMK/eUDdvmK7NtW0B9B0lMFx5xR1UO/cj86W1lq+SldB216K0WBzqH0xydRLBbUW
 57n/oshrFZUsjk/FBcO6neJuK+9XQTIjEw4UE8F1yxUdUm9WAeO9A2UKEdseVC8D
 bdW7FtgjBOAL+q8KGDbW1zYQJ4Hn4c/d/nIs86R1I2uqCI9+keAFa8eu9adZ6riw
 uuc5C5uKB1pj2h6fLQqzdyT0/JmkbHBqIJ+SDqcgGg0hGks5124=
 =4Rji
 -----END PGP SIGNATURE-----

Merge 5.4.214 into android11-5.4-lts

Changes in 5.4.214
	drm/msm/rd: Fix FIFO-full deadlock
	HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
	hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
	tg3: Disable tg3 device on system reboot to avoid triggering AER
	ieee802154: cc2520: add rc code in cc2520_tx()
	Input: iforce - add support for Boeder Force Feedback Wheel
	nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
	perf/arm_pmu_platform: fix tests for platform_get_irq() failure
	platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
	usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
	mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
	net: dp83822: disable rx error interrupt
	soc: fsl: select FSL_GUTS driver for DPIO
	tracefs: Only clobber mode/uid/gid on remount if asked
	Linux 5.4.214

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I034f32293503012d4c66b6c2b2f2eb2bea8d2b8b

Documentation/input/joydev/joystick.rst

@@ -517,6 +517,7 @@ All I-Force devices are supported by the iforce module. This includes:
 * AVB Mag Turbo Force
 * AVB Top Shot Pegasus
 * AVB Top Shot Force Feedback Racing Wheel
+* Boeder Force Feedback Wheel
 * Logitech WingMan Force
 * Logitech WingMan Force Wheel
 * Guillemot Race Leader Force Feedback

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 213
+SUBLEVEL = 214
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 

drivers/gpu/drm/msm/msm_rd.c

@@ -191,6 +191,9 @@ static int rd_open(struct inode *inode, struct file *file)
 	file->private_data = rd;
 	rd->open = true;
 
+	/* Reset fifo to clear any previously unread data: */
+	rd->fifo.head = rd->fifo.tail = 0;
+
 	/* the parsing tools need to know gpu-id to know which
 	 * register database to load.
 	 */

drivers/hid/intel-ish-hid/ishtp-hid.h

@@ -110,7 +110,7 @@ struct report_list {
  * @multi_packet_cnt:	Count of fragmented packet count
  *
  * This structure is used to store completion flags and per client data like
- * like report description, number of HID devices etc.
+ * report description, number of HID devices etc.
  */
 struct ishtp_cl_data {
 	/* completion flags */

drivers/hid/intel-ish-hid/ishtp/client.c

@@ -626,13 +626,14 @@ static void ishtp_cl_read_complete(struct ishtp_cl_rb *rb)
 }
 
 /**
- * ipc_tx_callback() - IPC tx callback function
+ * ipc_tx_send() - IPC tx send function
  * @prm: Pointer to client device instance
  *
- * Send message over IPC either first time or on callback on previous message
+ * Send message over IPC. Message will be split into fragments
- * completion
+ * if message size is bigger than IPC FIFO size, and all
+ * fragments will be sent one by one.
  */
-static void ipc_tx_callback(void *prm)
+static void ipc_tx_send(void *prm)
 {
 	struct ishtp_cl	*cl = prm;
 	struct ishtp_cl_tx_ring	*cl_msg;
@@ -677,32 +678,41 @@ static void ipc_tx_callback(void *prm)
 			    list);
 	rem = cl_msg->send_buf.size - cl->tx_offs;
 
-	ishtp_hdr.host_addr = cl->host_client_id;
+	while (rem > 0) {
-	ishtp_hdr.fw_addr = cl->fw_client_id;
+		ishtp_hdr.host_addr = cl->host_client_id;
-	ishtp_hdr.reserved = 0;
+		ishtp_hdr.fw_addr = cl->fw_client_id;
-	pmsg = cl_msg->send_buf.data + cl->tx_offs;
+		ishtp_hdr.reserved = 0;
+		pmsg = cl_msg->send_buf.data + cl->tx_offs;
 
-	if (rem <= dev->mtu) {
+		if (rem <= dev->mtu) {
-		ishtp_hdr.length = rem;
+			/* Last fragment or only one packet */
-		ishtp_hdr.msg_complete = 1;
+			ishtp_hdr.length = rem;
-		cl->sending = 0;
+			ishtp_hdr.msg_complete = 1;
-		list_del_init(&cl_msg->list);	/* Must be before write */
+			/* Submit to IPC queue with no callback */
-		spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
+			ishtp_write_message(dev, &ishtp_hdr, pmsg);
-		/* Submit to IPC queue with no callback */
+			cl->tx_offs = 0;
-		ishtp_write_message(dev, &ishtp_hdr, pmsg);
+			cl->sending = 0;
-		spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
+
-		list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
+			break;
-		++cl->tx_ring_free_size;
+		} else {
-		spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
+			/* Send ipc fragment */
-			tx_free_flags);
+			ishtp_hdr.length = dev->mtu;
-	} else {
+			ishtp_hdr.msg_complete = 0;
-		/* Send IPC fragment */
+			/* All fregments submitted to IPC queue with no callback */
-		spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
+			ishtp_write_message(dev, &ishtp_hdr, pmsg);
-		cl->tx_offs += dev->mtu;
+			cl->tx_offs += dev->mtu;
-		ishtp_hdr.length = dev->mtu;
+			rem = cl_msg->send_buf.size - cl->tx_offs;
-		ishtp_hdr.msg_complete = 0;
+		}
-		ishtp_send_msg(dev, &ishtp_hdr, pmsg, ipc_tx_callback, cl);
 	}
+
+	list_del_init(&cl_msg->list);
+	spin_unlock_irqrestore(&cl->tx_list_spinlock, tx_flags);
+
+	spin_lock_irqsave(&cl->tx_free_list_spinlock, tx_free_flags);
+	list_add_tail(&cl_msg->list, &cl->tx_free_list.list);
+	++cl->tx_ring_free_size;
+	spin_unlock_irqrestore(&cl->tx_free_list_spinlock,
+		tx_free_flags);
 }
 
 /**
@@ -720,7 +730,7 @@ static void ishtp_cl_send_msg_ipc(struct ishtp_device *dev,
 		return;
 
 	cl->tx_offs = 0;
-	ipc_tx_callback(cl);
+	ipc_tx_send(cl);
 	++cl->send_msg_cnt_ipc;
 }
 

drivers/input/joystick/iforce/iforce-main.c

@@ -50,6 +50,7 @@ static struct iforce_device iforce_device[] = {
 	{ 0x046d, 0xc291, "Logitech WingMan Formula Force",		btn_wheel, abs_wheel, ff_iforce },
 	{ 0x05ef, 0x020a, "AVB Top Shot Pegasus",			btn_joystick_avb, abs_avb_pegasus, ff_iforce },
 	{ 0x05ef, 0x8884, "AVB Mag Turbo Force",			btn_wheel, abs_wheel, ff_iforce },
+	{ 0x05ef, 0x8886, "Boeder Force Feedback Wheel",		btn_wheel, abs_wheel, ff_iforce },
 	{ 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel",	btn_wheel, abs_wheel, ff_iforce }, //?
 	{ 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
 	{ 0x061c, 0xc084, "ACT LABS Force RS",				btn_wheel, abs_wheel, ff_iforce },

drivers/net/ethernet/broadcom/tg3.c

@@ -18154,16 +18154,20 @@ static void tg3_shutdown(struct pci_dev *pdev)
 	struct net_device *dev = pci_get_drvdata(pdev);
 	struct tg3 *tp = netdev_priv(dev);
 
+	tg3_reset_task_cancel(tp);
+
 	rtnl_lock();
+
 	netif_device_detach(dev);
 
 	if (netif_running(dev))
 		dev_close(dev);
 
-	if (system_state == SYSTEM_POWER_OFF)
+	tg3_power_down(tp);
-		tg3_power_down(tp);
 
 	rtnl_unlock();
+
+	pci_disable_device(pdev);
 }
 
 /**

drivers/net/ieee802154/cc2520.c

@@ -507,6 +507,7 @@ cc2520_tx(struct ieee802154_hw *hw, struct sk_buff *skb)
 		goto err_tx;
 
 	if (status & CC2520_STATUS_TX_UNDERFLOW) {
+		rc = -EINVAL;
 		dev_err(&priv->spi->dev, "cc2520 tx underflow exception\n");
 		goto err_tx;
 	}

drivers/net/phy/dp83822.c

@@ -197,8 +197,7 @@ static int dp83822_config_intr(struct phy_device *phydev)
 		if (misr_status < 0)
 			return misr_status;
 
-		misr_status |= (DP83822_RX_ERR_HF_INT_EN |
+		misr_status |= (DP83822_ANEG_COMPLETE_INT_EN |
-				DP83822_ANEG_COMPLETE_INT_EN |
 				DP83822_DUP_MODE_CHANGE_INT_EN |
 				DP83822_SPEED_CHANGED_INT_EN |
 				DP83822_LINK_STAT_INT_EN |

drivers/nvme/target/tcp.c

@@ -1416,6 +1416,9 @@ static void nvmet_tcp_state_change(struct sock *sk)
 		goto done;
 
 	switch (sk->sk_state) {
+	case TCP_FIN_WAIT2:
+	case TCP_LAST_ACK:
+		break;
 	case TCP_FIN_WAIT1:
 	case TCP_CLOSE_WAIT:
 	case TCP_CLOSE:

drivers/perf/arm_pmu_platform.c

@@ -118,7 +118,7 @@ static int pmu_parse_irqs(struct arm_pmu *pmu)
 
 	if (num_irqs == 1) {
 		int irq = platform_get_irq(pdev, 0);
-		if (irq && irq_is_percpu_devid(irq))
+		if ((irq > 0) && irq_is_percpu_devid(irq))
 			return pmu_parse_percpu_irq(pmu, irq);
 	}
 

drivers/platform/x86/acer-wmi.c

@@ -93,6 +93,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
 	{KE_KEY, 0x22, {KEY_PROG2} },    /* Arcade */
 	{KE_KEY, 0x23, {KEY_PROG3} },    /* P_Key */
 	{KE_KEY, 0x24, {KEY_PROG4} },    /* Social networking_Key */
+	{KE_KEY, 0x27, {KEY_HELP} },
 	{KE_KEY, 0x29, {KEY_PROG3} },    /* P_Key for TM8372 */
 	{KE_IGNORE, 0x41, {KEY_MUTE} },
 	{KE_IGNORE, 0x42, {KEY_PREVIOUSSONG} },
@@ -106,7 +107,13 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
 	{KE_IGNORE, 0x48, {KEY_VOLUMEUP} },
 	{KE_IGNORE, 0x49, {KEY_VOLUMEDOWN} },
 	{KE_IGNORE, 0x4a, {KEY_VOLUMEDOWN} },
-	{KE_IGNORE, 0x61, {KEY_SWITCHVIDEOMODE} },
+	/*
+	 * 0x61 is KEY_SWITCHVIDEOMODE. Usually this is a duplicate input event
+	 * with the "Video Bus" input device events. But sometimes it is not
+	 * a dup. Map it to KEY_UNKNOWN instead of using KE_IGNORE so that
+	 * udev/hwdb can override it on systems where it is not a dup.
+	 */
+	{KE_KEY, 0x61, {KEY_UNKNOWN} },
 	{KE_IGNORE, 0x62, {KEY_BRIGHTNESSUP} },
 	{KE_IGNORE, 0x63, {KEY_BRIGHTNESSDOWN} },
 	{KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} },	/* Display Switch */

drivers/soc/fsl/Kconfig

@@ -24,6 +24,7 @@ config FSL_MC_DPIO
         tristate "QorIQ DPAA2 DPIO driver"
         depends on FSL_MC_BUS
         select SOC_BUS
+        select FSL_GUTS
         help
 	  Driver for the DPAA2 DPIO object.  A DPIO provides queue and
 	  buffer management facilities for software to interact with

drivers/usb/storage/unusual_uas.h

@@ -62,6 +62,13 @@ UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128,
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_IGNORE_UAS),
 
+/* Reported-by: Tom Hu <huxiaoying@kylinos.cn> */
+UNUSUAL_DEV(0x0b05, 0x1932, 0x0000, 0x9999,
+		"ASUS",
+		"External HDD",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_IGNORE_UAS),
+
 /* Reported-by: David Webb <djw@noc.ac.uk> */
 UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
 		"Seagate",

fs/tracefs/inode.c

@@ -139,6 +139,8 @@ struct tracefs_mount_opts {
 	kuid_t uid;
 	kgid_t gid;
 	umode_t mode;
+	/* Opt_* bitfield. */
+	unsigned int opts;
 };
 
 enum {
@@ -239,6 +241,7 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
 	kgid_t gid;
 	char *p;
 
+	opts->opts = 0;
 	opts->mode = TRACEFS_DEFAULT_MODE;
 
 	while ((p = strsep(&data, ",")) != NULL) {
@@ -273,24 +276,36 @@ static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts)
 		 * but traditionally tracefs has ignored all mount options
 		 */
 		}
+
+		opts->opts |= BIT(token);
 	}
 
 	return 0;
 }
 
-static int tracefs_apply_options(struct super_block *sb)
+static int tracefs_apply_options(struct super_block *sb, bool remount)
 {
 	struct tracefs_fs_info *fsi = sb->s_fs_info;
 	struct inode *inode = sb->s_root->d_inode;
 	struct tracefs_mount_opts *opts = &fsi->mount_opts;
 
-	inode->i_mode &= ~S_IALLUGO;
+	/*
-	inode->i_mode |= opts->mode;
+	 * On remount, only reset mode/uid/gid if they were provided as mount
+	 * options.
+	 */
 
-	inode->i_uid = opts->uid;
+	if (!remount || opts->opts & BIT(Opt_mode)) {
+		inode->i_mode &= ~S_IALLUGO;
+		inode->i_mode |= opts->mode;
+	}
 
-	/* Set all the group ids to the mount option */
+	if (!remount || opts->opts & BIT(Opt_uid))
-	set_gid(sb->s_root, opts->gid);
+		inode->i_uid = opts->uid;
+
+	if (!remount || opts->opts & BIT(Opt_gid)) {
+		/* Set all the group ids to the mount option */
+		set_gid(sb->s_root, opts->gid);
+	}
 
 	return 0;
 }
@@ -305,7 +320,7 @@ static int tracefs_remount(struct super_block *sb, int *flags, char *data)
 	if (err)
 		goto fail;
 
-	tracefs_apply_options(sb);
+	tracefs_apply_options(sb, true);
 
 fail:
 	return err;
@@ -357,7 +372,7 @@ static int trace_fill_super(struct super_block *sb, void *data, int silent)
 
 	sb->s_op = &tracefs_super_operations;
 
-	tracefs_apply_options(sb);
+	tracefs_apply_options(sb, false);
 
 	return 0;
 

mm/mmap.c

@@ -2614,6 +2614,7 @@ static void unmap_region(struct mm_struct *mm,
 {
 	struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
 	struct mmu_gather tlb;
+	struct vm_area_struct *cur_vma;
 
 	lru_add_drain();
 	tlb_gather_mmu(&tlb, mm, start, end);
@@ -2628,8 +2629,12 @@ static void unmap_region(struct mm_struct *mm,
 	 * concurrent flush in this region has to be coming through the rmap,
 	 * and we synchronize against that using the rmap lock.
 	 */
-	if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0)
+	for (cur_vma = vma; cur_vma; cur_vma = cur_vma->vm_next) {
-		tlb_flush_mmu(&tlb);
+		if ((cur_vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) {
+			tlb_flush_mmu(&tlb);
+			break;
+		}
+	}
 
 	free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
 				 next ? next->vm_start : USER_PGTABLES_CEILING);