--- /dev/null
+From dd1f6308b28edf0452dd5dc7877992903ec61e69 Mon Sep 17 00:00:00 2001
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Date: Tue, 18 Feb 2020 16:49:06 +0000
+Subject: arm64: lse: Fix LSE atomics with LLVM
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+commit dd1f6308b28edf0452dd5dc7877992903ec61e69 upstream.
+
+Commit e0d5896bd356 ("arm64: lse: fix LSE atomics with LLVM's integrated
+assembler") broke the build when clang is used in connjunction with the
+binutils assembler ("-no-integrated-as"). This happens because
+__LSE_PREAMBLE is defined as ".arch armv8-a+lse", which overrides the
+version of the CPU architecture passed via the "-march" paramter to gas:
+
+$ aarch64-none-linux-gnu-as -EL -I ./arch/arm64/include
+ -I ./arch/arm64/include/generated
+ -I ./include -I ./include
+ -I ./arch/arm64/include/uapi
+ -I ./arch/arm64/include/generated/uapi
+ -I ./include/uapi -I ./include/generated/uapi
+ -I ./init -I ./init
+ -march=armv8.3-a -o init/do_mounts.o
+ /tmp/do_mounts-d7992a.s
+/tmp/do_mounts-d7992a.s: Assembler messages:
+/tmp/do_mounts-d7992a.s:1959: Error: selected processor does not support `autiasp'
+/tmp/do_mounts-d7992a.s:2021: Error: selected processor does not support `paciasp'
+/tmp/do_mounts-d7992a.s:2157: Error: selected processor does not support `autiasp'
+/tmp/do_mounts-d7992a.s:2175: Error: selected processor does not support `paciasp'
+/tmp/do_mounts-d7992a.s:2494: Error: selected processor does not support `autiasp'
+
+Fix the issue by replacing ".arch armv8-a+lse" with ".arch_extension lse".
+Sami confirms that the clang integrated assembler does now support the
+'.arch_extension' directive, so this change will be fine even for LTO
+builds in future.
+
+Fixes: e0d5896bd356cd ("arm64: lse: fix LSE atomics with LLVM's integrated assembler")
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Reported-by: Amit Kachhap <Amit.Kachhap@arm.com>
+Tested-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/lse.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/lse.h
++++ b/arch/arm64/include/asm/lse.h
+@@ -6,7 +6,7 @@
+
+ #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
+
+-#define __LSE_PREAMBLE ".arch armv8-a+lse\n"
++#define __LSE_PREAMBLE ".arch_extension lse\n"
+
+ #include <linux/compiler_types.h>
+ #include <linux/export.h>
--- /dev/null
+From 9437bfda00f3b26eb5f475737ddaaf4dc07fee4f Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 30 Jan 2020 15:05:45 +0200
+Subject: ASoC: atmel: fix atmel_ssc_set_audio link failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 9437bfda00f3b26eb5f475737ddaaf4dc07fee4f upstream.
+
+The ssc audio driver can call into both pdc and dma backends. With the
+latest rework, the logic to do this in a safe way avoiding link errors
+was removed, bringing back link errors that were fixed long ago in commit
+061981ff8cc8 ("ASoC: atmel: properly select dma driver state") such as
+
+sound/soc/atmel/atmel_ssc_dai.o: In function `atmel_ssc_set_audio':
+atmel_ssc_dai.c:(.text+0xac): undefined reference to `atmel_pcm_pdc_platform_register'
+
+Fix it this time using Makefile hacks and a comment to prevent this
+from accidentally getting removed again rather than Kconfig hacks.
+
+Fixes: 18291410557f ("ASoC: atmel: enable SOC_SSC_PDC and SOC_SSC_DMA in Kconfig")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Link: https://lore.kernel.org/r/20200130130545.31148-1-codrin.ciubotariu@microchip.com
+Reviewed-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/atmel/Kconfig | 4 ++--
+ sound/soc/atmel/Makefile | 10 ++++++++--
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -10,11 +10,11 @@ config SND_ATMEL_SOC
+ if SND_ATMEL_SOC
+
+ config SND_ATMEL_SOC_PDC
+- tristate
++ bool
+ depends on HAS_DMA
+
+ config SND_ATMEL_SOC_DMA
+- tristate
++ bool
+ select SND_SOC_GENERIC_DMAENGINE_PCM
+
+ config SND_ATMEL_SOC_SSC
+--- a/sound/soc/atmel/Makefile
++++ b/sound/soc/atmel/Makefile
+@@ -6,8 +6,14 @@ snd-soc-atmel_ssc_dai-objs := atmel_ssc_
+ snd-soc-atmel-i2s-objs := atmel-i2s.o
+ snd-soc-mchp-i2s-mcc-objs := mchp-i2s-mcc.o
+
+-obj-$(CONFIG_SND_ATMEL_SOC_PDC) += snd-soc-atmel-pcm-pdc.o
+-obj-$(CONFIG_SND_ATMEL_SOC_DMA) += snd-soc-atmel-pcm-dma.o
++# pdc and dma need to both be built-in if any user of
++# ssc is built-in.
++ifdef CONFIG_SND_ATMEL_SOC_PDC
++obj-$(CONFIG_SND_ATMEL_SOC_SSC) += snd-soc-atmel-pcm-pdc.o
++endif
++ifdef CONFIG_SND_ATMEL_SOC_DMA
++obj-$(CONFIG_SND_ATMEL_SOC_SSC) += snd-soc-atmel-pcm-dma.o
++endif
+ obj-$(CONFIG_SND_ATMEL_SOC_SSC) += snd-soc-atmel_ssc_dai.o
+ obj-$(CONFIG_SND_ATMEL_SOC_I2S) += snd-soc-atmel-i2s.o
+ obj-$(CONFIG_SND_MCHP_SOC_I2S_MCC) += snd-soc-mchp-i2s-mcc.o
--- /dev/null
+From d1520889782dff58610c0b6b54d4cf3211ceb690 Mon Sep 17 00:00:00 2001
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Date: Wed, 5 Feb 2020 18:04:36 +0200
+Subject: ASoC: fsl_sai: Fix exiting path on probing failure
+
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+
+commit d1520889782dff58610c0b6b54d4cf3211ceb690 upstream.
+
+If the imx-sdma driver is built as a module, the fsl-sai device doesn't
+disable on probing failure, which causes the warning in the next probing:
+
+==================================================================
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+fsl-sai 308a0000.sai: Unbalanced pm_runtime_enable!
+==================================================================
+
+Disabling the device properly fixes the issue.
+
+Fixes: 812ad463e089 ("ASoC: fsl_sai: Add support for runtime pm")
+Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Link: https://lore.kernel.org/r/20200205160436.3813642-1-oleksandr.suvorov@toradex.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/fsl_sai.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/sound/soc/fsl/fsl_sai.c
++++ b/sound/soc/fsl/fsl_sai.c
+@@ -1019,12 +1019,24 @@ static int fsl_sai_probe(struct platform
+ ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component,
+ &fsl_sai_dai, 1);
+ if (ret)
+- return ret;
++ goto err_pm_disable;
+
+- if (sai->soc_data->use_imx_pcm)
+- return imx_pcm_dma_init(pdev, IMX_SAI_DMABUF_SIZE);
+- else
+- return devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
++ if (sai->soc_data->use_imx_pcm) {
++ ret = imx_pcm_dma_init(pdev, IMX_SAI_DMABUF_SIZE);
++ if (ret)
++ goto err_pm_disable;
++ } else {
++ ret = devm_snd_dmaengine_pcm_register(&pdev->dev, NULL, 0);
++ if (ret)
++ goto err_pm_disable;
++ }
++
++ return ret;
++
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
++
++ return ret;
+ }
+
+ static int fsl_sai_remove(struct platform_device *pdev)
--- /dev/null
+From e20d3a055a457a10a4c748ce5b7c2ed3173a1324 Mon Sep 17 00:00:00 2001
+From: Johannes Krude <johannes@krude.de>
+Date: Wed, 12 Feb 2020 20:32:27 +0100
+Subject: bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill
+
+From: Johannes Krude <johannes@krude.de>
+
+commit e20d3a055a457a10a4c748ce5b7c2ed3173a1324 upstream.
+
+This if guards whether user-space wants a copy of the offload-jited
+bytecode and whether this bytecode exists. By erroneously doing a bitwise
+AND instead of a logical AND on user- and kernel-space buffer-size can lead
+to no data being copied to user-space especially when user-space size is a
+power of two and bigger then the kernel-space buffer.
+
+Fixes: fcfb126defda ("bpf: add new jited info fields in bpf_dev_offload and bpf_prog_info")
+Signed-off-by: Johannes Krude <johannes@krude.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://lore.kernel.org/bpf/20200212193227.GA3769@phlox.h.transitiv.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/bpf/offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/bpf/offload.c
++++ b/kernel/bpf/offload.c
+@@ -321,7 +321,7 @@ int bpf_prog_offload_info_fill(struct bp
+
+ ulen = info->jited_prog_len;
+ info->jited_prog_len = aux->offload->jited_len;
+- if (info->jited_prog_len & ulen) {
++ if (info->jited_prog_len && ulen) {
+ uinsns = u64_to_user_ptr(info->jited_prog_insns);
+ ulen = min_t(u32, info->jited_prog_len, ulen);
+ if (copy_to_user(uinsns, aux->offload->jited_image, ulen)) {
--- /dev/null
+From 6a30e1b1dcad0ba94fae757f797812d7d8dcb72c Mon Sep 17 00:00:00 2001
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Date: Mon, 10 Feb 2020 20:44:39 +0800
+Subject: crypto: rename sm3-256 to sm3 in hash_algo_name
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+commit 6a30e1b1dcad0ba94fae757f797812d7d8dcb72c upstream.
+
+The name sm3-256 is defined in hash_algo_name in hash_info, but the
+algorithm name implemented in sm3_generic.c is sm3, which will cause
+the sm3-256 algorithm to be not found in some application scenarios of
+the hash algorithm, and an ENOENT error will occur. For example,
+IMA, keys, and other subsystems that reference hash_algo_name all use
+the hash algorithm of sm3.
+
+Fixes: 5ca4c20cfd37 ("keys, trusted: select hash algorithm for TPM2 chips")
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Reviewed-by: Pascal van Leeuwen <pvanleeuwen@rambus.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/hash_info.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/crypto/hash_info.c
++++ b/crypto/hash_info.c
+@@ -26,7 +26,7 @@ const char *const hash_algo_name[HASH_AL
+ [HASH_ALGO_TGR_128] = "tgr128",
+ [HASH_ALGO_TGR_160] = "tgr160",
+ [HASH_ALGO_TGR_192] = "tgr192",
+- [HASH_ALGO_SM3_256] = "sm3-256",
++ [HASH_ALGO_SM3_256] = "sm3",
+ [HASH_ALGO_STREEBOG_256] = "streebog256",
+ [HASH_ALGO_STREEBOG_512] = "streebog512",
+ };
--- /dev/null
+From c6f8c440441029d5621ee5153676243234a4b76e Mon Sep 17 00:00:00 2001
+From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Date: Fri, 7 Feb 2020 10:41:20 -0500
+Subject: drm/amd/display: fix dtm unloading
+
+From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+
+commit c6f8c440441029d5621ee5153676243234a4b76e upstream.
+
+there was a type in the terminate command.
+
+We should be calling psp_dtm_unload() instead of psp_hdcp_unload()
+
+Fixes: 143f23053333 ("drm/amdgpu: psp DTM init")
+Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1112,6 +1112,30 @@ static void psp_prep_dtm_ta_invoke_cmd_b
+ /* Note: cmd_invoke_cmd.buf is not used for now */
+ }
+
++static int psp_dtm_unload(struct psp_context *psp)
++{
++ int ret;
++ struct psp_gfx_cmd_resp *cmd;
++
++ /*
++ * TODO: bypass the unloading in sriov for now
++ */
++ if (amdgpu_sriov_vf(psp->adev))
++ return 0;
++
++ cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
++ if (!cmd)
++ return -ENOMEM;
++
++ psp_prep_ta_unload_cmd_buf(cmd, psp->dtm_context.session_id);
++
++ ret = psp_cmd_submit_buf(psp, NULL, cmd, psp->fence_buf_mc_addr);
++
++ kfree(cmd);
++
++ return ret;
++}
++
+ int psp_dtm_invoke(struct psp_context *psp, uint32_t ta_cmd_id)
+ {
+ int ret;
+@@ -1150,7 +1174,7 @@ static int psp_dtm_terminate(struct psp_
+ if (!psp->dtm_context.dtm_initialized)
+ return 0;
+
+- ret = psp_hdcp_unload(psp);
++ ret = psp_dtm_unload(psp);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 8a6483ac634acda3f599f50082c652d2d37199c7 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Mon, 9 Dec 2019 10:27:07 +0200
+Subject: drm/bridge: tc358767: fix poll timeouts
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+commit 8a6483ac634acda3f599f50082c652d2d37199c7 upstream.
+
+Link training fails with:
+
+ Link training timeout waiting for LT_LOOPDONE!
+ main link enable error: -110
+
+This is caused by too tight timeouts, which were changed recently in
+aa92213f388b ("drm/bridge: tc358767: Simplify polling in tc_link_training()").
+
+With a quick glance, the commit does not change the timeouts. However,
+the method of delaying/sleeping is different, and as the timeout in the
+previous implementation was not explicit, the new version in practice
+has much tighter timeout.
+
+The same change was made to other parts in the driver, but the link
+training timeout is the only one I have seen causing issues.
+Nevertheless, 1 us sleep is not very sane, and the timeouts look pretty
+tight, so lets fix all the timeouts.
+
+One exception was the aux busy poll, where the poll sleep was much
+longer than necessary (or optimal).
+
+I measured the times on my setup, and now the sleep times are set to
+such values that they result in multiple loops, but not too many (say,
+5-10 loops). The timeouts were all increased to 100ms, which should be
+more than enough for all of these, but in case of bad errors, shouldn't
+stop the driver as multi-second timeouts could do.
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Fixes: aa92213f388b ("drm/bridge: tc358767: Simplify polling in tc_link_training()")
+Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191209082707.24531-1-tomi.valkeinen@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/bridge/tc358767.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -297,7 +297,7 @@ static inline int tc_poll_timeout(struct
+
+ static int tc_aux_wait_busy(struct tc_data *tc)
+ {
+- return tc_poll_timeout(tc, DP0_AUXSTATUS, AUX_BUSY, 0, 1000, 100000);
++ return tc_poll_timeout(tc, DP0_AUXSTATUS, AUX_BUSY, 0, 100, 100000);
+ }
+
+ static int tc_aux_write_data(struct tc_data *tc, const void *data,
+@@ -640,7 +640,7 @@ static int tc_aux_link_setup(struct tc_d
+ if (ret)
+ goto err;
+
+- ret = tc_poll_timeout(tc, DP_PHY_CTRL, PHY_RDY, PHY_RDY, 1, 1000);
++ ret = tc_poll_timeout(tc, DP_PHY_CTRL, PHY_RDY, PHY_RDY, 100, 100000);
+ if (ret == -ETIMEDOUT) {
+ dev_err(tc->dev, "Timeout waiting for PHY to become ready");
+ return ret;
+@@ -876,7 +876,7 @@ static int tc_wait_link_training(struct
+ int ret;
+
+ ret = tc_poll_timeout(tc, DP0_LTSTAT, LT_LOOPDONE,
+- LT_LOOPDONE, 1, 1000);
++ LT_LOOPDONE, 500, 100000);
+ if (ret) {
+ dev_err(tc->dev, "Link training timeout waiting for LT_LOOPDONE!\n");
+ return ret;
+@@ -949,7 +949,7 @@ static int tc_main_link_enable(struct tc
+ dp_phy_ctrl &= ~(DP_PHY_RST | PHY_M1_RST | PHY_M0_RST);
+ ret = regmap_write(tc->regmap, DP_PHY_CTRL, dp_phy_ctrl);
+
+- ret = tc_poll_timeout(tc, DP_PHY_CTRL, PHY_RDY, PHY_RDY, 1, 1000);
++ ret = tc_poll_timeout(tc, DP_PHY_CTRL, PHY_RDY, PHY_RDY, 500, 100000);
+ if (ret) {
+ dev_err(dev, "timeout waiting for phy become ready");
+ return ret;
--- /dev/null
+From 58e9121c32a245fab47f29ab4ad29dd62470a7e8 Mon Sep 17 00:00:00 2001
+From: Matt Roper <matthew.d.roper@intel.com>
+Date: Thu, 6 Feb 2020 16:14:16 -0800
+Subject: drm/i915/ehl: Update port clock voltage level requirements
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matt Roper <matthew.d.roper@intel.com>
+
+commit 58e9121c32a245fab47f29ab4ad29dd62470a7e8 upstream.
+
+Voltage level depends not only on the cdclk, but also on the DDI clock.
+Last time the bspec voltage level table for EHL was updated, we only
+updated the cdclk requirements, but forgot to account for the new port
+clock criteria.
+
+Bspec: 21809
+Fixes: d147483884ed ("drm/i915/ehl: Update voltage level checks")
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200207001417.1229251-1-matthew.d.roper@intel.com
+Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
+(cherry picked from commit 9d5fd37ed7e26efdbe90f492d7eb8b53dcdb61d6)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_ddi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_ddi.c
++++ b/drivers/gpu/drm/i915/display/intel_ddi.c
+@@ -4227,7 +4227,9 @@ static bool intel_ddi_is_audio_enabled(s
+ void intel_ddi_compute_min_voltage_level(struct drm_i915_private *dev_priv,
+ struct intel_crtc_state *crtc_state)
+ {
+- if (INTEL_GEN(dev_priv) >= 11 && crtc_state->port_clock > 594000)
++ if (IS_ELKHARTLAKE(dev_priv) && crtc_state->port_clock > 594000)
++ crtc_state->min_voltage_level = 3;
++ else if (INTEL_GEN(dev_priv) >= 11 && crtc_state->port_clock > 594000)
+ crtc_state->min_voltage_level = 1;
+ else if (IS_CANNONLAKE(dev_priv) && crtc_state->port_clock > 594000)
+ crtc_state->min_voltage_level = 2;
--- /dev/null
+From dea8d5ce46d7e7f7270b9804df7d1174f88bfd99 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 30 Jan 2020 16:45:53 +0000
+Subject: drm/i915/gem: Require per-engine reset support for non-persistent contexts
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit dea8d5ce46d7e7f7270b9804df7d1174f88bfd99 upstream.
+
+To enable non-persistent contexts, we require a means of cancelling any
+inflight work from that context. This is first done "gracefully" by
+using preemption to kick the active context off the engine, and then
+forcefully by resetting the engine if it is active. If we are unable to
+reset the engine to remove hostile userspace, we should not allow
+userspace to opt into using non-persistent contexts.
+
+If the per-engine reset fails, we still do a full GPU reset, but that is
+rare and usually indicative of much deeper issues. The damage is already
+done. However, the goal of the interface to allow long running compute
+jobs without causing collateral damage elsewhere, and if we are unable
+to support that we should make that known by not providing the
+interface (and falsely pretending we can).
+
+Fixes: a0e047156cde ("drm/i915/gem: Make context persistence optional")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Jon Bloomfield <jon.bloomfield@intel.com>
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200130164553.1937718-1-chris@chris-wilson.co.uk
+(cherry picked from commit d1b9b5f127bc3797fc274cfa4f363e039f045c3a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gem/i915_gem_context.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
+@@ -484,6 +484,22 @@ static int __context_set_persistence(str
+ if (!(ctx->i915->caps.scheduler & I915_SCHEDULER_CAP_PREEMPTION))
+ return -ENODEV;
+
++ /*
++ * If the cancel fails, we then need to reset, cleanly!
++ *
++ * If the per-engine reset fails, all hope is lost! We resort
++ * to a full GPU reset in that unlikely case, but realistically
++ * if the engine could not reset, the full reset does not fare
++ * much better. The damage has been done.
++ *
++ * However, if we cannot reset an engine by itself, we cannot
++ * cleanup a hanging persistent context without causing
++ * colateral damage, and we should not pretend we can by
++ * exposing the interface.
++ */
++ if (!intel_has_reset_engine(&ctx->i915->gt))
++ return -ENODEV;
++
+ i915_gem_context_clear_persistence(ctx);
+ }
+
--- /dev/null
+From 19b5f3b419a61808ff2713f1f30b8a88fe14ac9b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 6 Feb 2020 20:49:13 +0000
+Subject: drm/i915/gt: Protect defer_request() from new waiters
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 19b5f3b419a61808ff2713f1f30b8a88fe14ac9b upstream.
+
+Mika spotted
+
+<4>[17436.705441] general protection fault: 0000 [#1] PREEMPT SMP PTI
+<4>[17436.705447] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.5.0+ #1
+<4>[17436.705449] Hardware name: System manufacturer System Product Name/Z170M-PLUS, BIOS 3805 05/16/2018
+<4>[17436.705512] RIP: 0010:__execlists_submission_tasklet+0xc4d/0x16e0 [i915]
+<4>[17436.705516] Code: c5 4c 8d 60 e0 75 17 e9 8c 07 00 00 49 8b 44 24 20 49 39 c5 4c 8d 60 e0 0f 84 7a 07 00 00 49 8b 5c 24 08 49 8b 87 80 00 00 00 <48> 39 83 d8 fe ff ff 75 d9 48 8b 83 88 fe ff ff a8 01 0f 84 b6 05
+<4>[17436.705518] RSP: 0018:ffffc9000012ce80 EFLAGS: 00010083
+<4>[17436.705521] RAX: ffff88822ae42000 RBX: 5a5a5a5a5a5a5a5a RCX: dead000000000122
+<4>[17436.705523] RDX: ffff88822ae42588 RSI: ffff8881e32a7908 RDI: ffff8881c429fd48
+<4>[17436.705525] RBP: ffffc9000012cf00 R08: ffff88822ae42588 R09: 00000000fffffffe
+<4>[17436.705527] R10: ffff8881c429fb80 R11: 00000000a677cf08 R12: ffff8881c42a0aa8
+<4>[17436.705529] R13: ffff8881c429fd38 R14: ffff88822ae42588 R15: ffff8881c429fb80
+<4>[17436.705532] FS: 0000000000000000(0000) GS:ffff88822ed00000(0000) knlGS:0000000000000000
+<4>[17436.705534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+<4>[17436.705536] CR2: 00007f858c76d000 CR3: 0000000005610003 CR4: 00000000003606e0
+<4>[17436.705538] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+<4>[17436.705540] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+<4>[17436.705542] Call Trace:
+<4>[17436.705545] <IRQ>
+<4>[17436.705603] execlists_submission_tasklet+0xc0/0x130 [i915]
+
+which is us consuming a partially initialised new waiter in
+defer_requests(). We can prevent this by initialising the i915_dependency
+prior to making it visible, and since we are using a concurrent
+list_add/iterator mark them up to the compiler.
+
+Fixes: 8ee36e048c98 ("drm/i915/execlists: Minimalistic timeslicing")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200206204915.2636606-2-chris@chris-wilson.co.uk
+(cherry picked from commit f14f27b1663269a81ed62d3961fe70250a1a0623)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/intel_lrc.c | 7 ++++++-
+ drivers/gpu/drm/i915/i915_scheduler.c | 6 ++++--
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
+@@ -1433,6 +1433,11 @@ last_active(const struct intel_engine_ex
+ return *last;
+ }
+
++#define for_each_waiter(p__, rq__) \
++ list_for_each_entry_lockless(p__, \
++ &(rq__)->sched.waiters_list, \
++ wait_link)
++
+ static void defer_request(struct i915_request *rq, struct list_head * const pl)
+ {
+ LIST_HEAD(list);
+@@ -1450,7 +1455,7 @@ static void defer_request(struct i915_re
+ GEM_BUG_ON(i915_request_is_active(rq));
+ list_move_tail(&rq->sched.link, pl);
+
+- list_for_each_entry(p, &rq->sched.waiters_list, wait_link) {
++ for_each_waiter(p, rq) {
+ struct i915_request *w =
+ container_of(p->waiter, typeof(*w), sched);
+
+--- a/drivers/gpu/drm/i915/i915_scheduler.c
++++ b/drivers/gpu/drm/i915/i915_scheduler.c
+@@ -415,8 +415,6 @@ bool __i915_sched_node_add_dependency(st
+
+ if (!node_signaled(signal)) {
+ INIT_LIST_HEAD(&dep->dfs_link);
+- list_add(&dep->wait_link, &signal->waiters_list);
+- list_add(&dep->signal_link, &node->signalers_list);
+ dep->signaler = signal;
+ dep->waiter = node;
+ dep->flags = flags;
+@@ -426,6 +424,10 @@ bool __i915_sched_node_add_dependency(st
+ !node_started(signal))
+ node->flags |= I915_SCHED_HAS_SEMAPHORE_CHAIN;
+
++ /* All set, now publish. Beware the lockless walkers. */
++ list_add(&dep->signal_link, &node->signalers_list);
++ list_add_rcu(&dep->wait_link, &signal->waiters_list);
++
+ /*
+ * As we do not allow WAIT to preempt inflight requests,
+ * once we have executed a request, along with triggering
--- /dev/null
+From 0e9d7bb293f3f9c3ee376b126141407efb265f31 Mon Sep 17 00:00:00 2001
+From: Igor Druzhinin <igor.druzhinin@citrix.com>
+Date: Mon, 3 Feb 2020 15:07:01 +0000
+Subject: drm/i915/gvt: more locking for ppgtt mm LRU list
+
+From: Igor Druzhinin <igor.druzhinin@citrix.com>
+
+commit 0e9d7bb293f3f9c3ee376b126141407efb265f31 upstream.
+
+When the lock was introduced in commit 72aabfb862e40 ("drm/i915/gvt: Add mutual
+lock for ppgtt mm LRU list") one place got lost.
+
+Fixes: 72aabfb862e4 ("drm/i915/gvt: Add mutual lock for ppgtt mm LRU list")
+Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1580742421-25194-1-git-send-email-igor.druzhinin@citrix.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gvt/gtt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/gvt/gtt.c
++++ b/drivers/gpu/drm/i915/gvt/gtt.c
+@@ -1956,7 +1956,11 @@ void _intel_vgpu_mm_release(struct kref
+
+ if (mm->type == INTEL_GVT_MM_PPGTT) {
+ list_del(&mm->ppgtt_mm.list);
++
++ mutex_lock(&mm->vgpu->gvt->gtt.ppgtt_mm_lock);
+ list_del(&mm->ppgtt_mm.lru_list);
++ mutex_unlock(&mm->vgpu->gvt->gtt.ppgtt_mm_lock);
++
+ invalidate_ppgtt_mm(mm);
+ } else {
+ vfree(mm->ggtt_mm.virtual_ggtt);
--- /dev/null
+From 1fdea0cb0dba0d42ffcfb619b349c1a2afa2492e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 14 Jan 2020 16:00:30 +0000
+Subject: drm/i915/selftests: Add a mock i915_vma to the mock_ring
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 1fdea0cb0dba0d42ffcfb619b349c1a2afa2492e upstream.
+
+Add a i915_vma to the mock_engine/mock_ring so that the core code can
+always assume the presence of ring->vma.
+
+Fixes: 8ccfc20a7d56 ("drm/i915/gt: Mark ring->vma as active while pinned")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200114160030.2468927-1-chris@chris-wilson.co.uk
+(cherry picked from commit b63b4feaef7363d2cf46dd76bb6e87e060b2b0de)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/mock_engine.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gt/mock_engine.c
++++ b/drivers/gpu/drm/i915/gt/mock_engine.c
+@@ -59,11 +59,26 @@ static struct intel_ring *mock_ring(stru
+ ring->vaddr = (void *)(ring + 1);
+ atomic_set(&ring->pin_count, 1);
+
++ ring->vma = i915_vma_alloc();
++ if (!ring->vma) {
++ kfree(ring);
++ return NULL;
++ }
++ i915_active_init(&ring->vma->active, NULL, NULL);
++
+ intel_ring_update_space(ring);
+
+ return ring;
+ }
+
++static void mock_ring_free(struct intel_ring *ring)
++{
++ i915_active_fini(&ring->vma->active);
++ i915_vma_free(ring->vma);
++
++ kfree(ring);
++}
++
+ static struct i915_request *first_request(struct mock_engine *engine)
+ {
+ return list_first_entry_or_null(&engine->hw_queue,
+@@ -121,7 +136,7 @@ static void mock_context_destroy(struct
+ GEM_BUG_ON(intel_context_is_pinned(ce));
+
+ if (test_bit(CONTEXT_ALLOC_BIT, &ce->flags)) {
+- kfree(ce->ring);
++ mock_ring_free(ce->ring);
+ mock_timeline_unpin(ce->timeline);
+ }
+
--- /dev/null
+From 8fc7036ee652207ca992fbb9abb64090c355a9e0 Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@chromium.org>
+Date: Thu, 13 Feb 2020 12:01:35 -0800
+Subject: drm/msm/dpu: fix BGR565 vs RGB565 confusion
+
+From: Rob Clark <robdclark@chromium.org>
+
+commit 8fc7036ee652207ca992fbb9abb64090c355a9e0 upstream.
+
+The component order between the two was swapped, resulting in incorrect
+color when games with 565 visual hit the overlay path instead of GPU
+composition.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_formats.c
+@@ -255,13 +255,13 @@ static const struct dpu_format dpu_forma
+
+ INTERLEAVED_RGB_FMT(RGB565,
+ 0, COLOR_5BIT, COLOR_6BIT, COLOR_5BIT,
+- C2_R_Cr, C0_G_Y, C1_B_Cb, 0, 3,
++ C1_B_Cb, C0_G_Y, C2_R_Cr, 0, 3,
+ false, 2, 0,
+ DPU_FETCH_LINEAR, 1),
+
+ INTERLEAVED_RGB_FMT(BGR565,
+ 0, COLOR_5BIT, COLOR_6BIT, COLOR_5BIT,
+- C1_B_Cb, C0_G_Y, C2_R_Cr, 0, 3,
++ C2_R_Cr, C0_G_Y, C1_B_Cb, 0, 3,
+ false, 2, 0,
+ DPU_FETCH_LINEAR, 1),
+
--- /dev/null
+From 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72 Mon Sep 17 00:00:00 2001
+From: Aditya Pakki <pakki001@umn.edu>
+Date: Fri, 14 Feb 2020 12:21:01 -0600
+Subject: ecryptfs: replace BUG_ON with error handling code
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+commit 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72 upstream.
+
+In crypt_scatterlist, if the crypt_stat argument is not set up
+correctly, the kernel crashes. Instead, by returning an error code
+upstream, the error is handled safely.
+
+The issue is detected via a static analysis tool written by us.
+
+Fixes: 237fead619984 (ecryptfs: fs/Makefile and fs/Kconfig)
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Tyler Hicks <code@tyhicks.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ecryptfs/crypto.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -311,8 +311,10 @@ static int crypt_scatterlist(struct ecry
+ struct extent_crypt_result ecr;
+ int rc = 0;
+
+- BUG_ON(!crypt_stat || !crypt_stat->tfm
+- || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
++ if (!crypt_stat || !crypt_stat->tfm
++ || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
++ return -EINVAL;
++
+ if (unlikely(ecryptfs_verbosity > 0)) {
+ ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
+ crypt_stat->key_size);
--- /dev/null
+From cba6437a1854fde5934098ec3bd0ee83af3129f5 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 12 Feb 2020 12:19:41 +0100
+Subject: genirq/proc: Reject invalid affinity masks (again)
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit cba6437a1854fde5934098ec3bd0ee83af3129f5 upstream.
+
+Qian Cai reported that the WARN_ON() in the x86/msi affinity setting code,
+which catches cases where the affinity setting is not done on the CPU which
+is the current target of the interrupt, triggers during CPU hotplug stress
+testing.
+
+It turns out that the warning which was added with the commit addressing
+the MSI affinity race unearthed yet another long standing bug.
+
+If user space writes a bogus affinity mask, i.e. it contains no online CPUs,
+then it calls irq_select_affinity_usr(). This was introduced for ALPHA in
+
+ eee45269b0f5 ("[PATCH] Alpha: convert to generic irq framework (generic part)")
+
+and subsequently made available for all architectures in
+
+ 18404756765c ("genirq: Expose default irq affinity mask (take 3)")
+
+which introduced the circumvention of the affinity setting restrictions for
+interrupt which cannot be moved in process context.
+
+The whole exercise is bogus in various aspects:
+
+ 1) If the interrupt is already started up then there is absolutely
+ no point to honour a bogus interrupt affinity setting from user
+ space. The interrupt is already assigned to an online CPU and it
+ does not make any sense to reassign it to some other randomly
+ chosen online CPU.
+
+ 2) If the interupt is not yet started up then there is no point
+ either. A subsequent startup of the interrupt will invoke
+ irq_setup_affinity() anyway which will chose a valid target CPU.
+
+So the only correct solution is to just return -EINVAL in case user space
+wrote an affinity mask which does not contain any online CPUs, except for
+ALPHA which has it's own magic sauce for this.
+
+Fixes: 18404756765c ("genirq: Expose default irq affinity mask (take 3)")
+Reported-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Qian Cai <cai@lca.pw>
+Link: https://lkml.kernel.org/r/878sl8xdbm.fsf@nanos.tec.linutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/internals.h | 2 --
+ kernel/irq/manage.c | 18 ++----------------
+ kernel/irq/proc.c | 22 ++++++++++++++++++++++
+ 3 files changed, 24 insertions(+), 18 deletions(-)
+
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -128,8 +128,6 @@ static inline void unregister_handler_pr
+
+ extern bool irq_can_set_affinity_usr(unsigned int irq);
+
+-extern int irq_select_affinity_usr(unsigned int irq);
+-
+ extern void irq_set_thread_affinity(struct irq_desc *desc);
+
+ extern int irq_do_set_affinity(struct irq_data *data,
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -442,23 +442,9 @@ int irq_setup_affinity(struct irq_desc *
+ {
+ return irq_select_affinity(irq_desc_get_irq(desc));
+ }
+-#endif
++#endif /* CONFIG_AUTO_IRQ_AFFINITY */
++#endif /* CONFIG_SMP */
+
+-/*
+- * Called when a bogus affinity is set via /proc/irq
+- */
+-int irq_select_affinity_usr(unsigned int irq)
+-{
+- struct irq_desc *desc = irq_to_desc(irq);
+- unsigned long flags;
+- int ret;
+-
+- raw_spin_lock_irqsave(&desc->lock, flags);
+- ret = irq_setup_affinity(desc);
+- raw_spin_unlock_irqrestore(&desc->lock, flags);
+- return ret;
+-}
+-#endif
+
+ /**
+ * irq_set_vcpu_affinity - Set vcpu affinity for the interrupt
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -111,6 +111,28 @@ static int irq_affinity_list_proc_show(s
+ return show_irq_affinity(AFFINITY_LIST, m);
+ }
+
++#ifndef CONFIG_AUTO_IRQ_AFFINITY
++static inline int irq_select_affinity_usr(unsigned int irq)
++{
++ /*
++ * If the interrupt is started up already then this fails. The
++ * interrupt is assigned to an online CPU already. There is no
++ * point to move it around randomly. Tell user space that the
++ * selected mask is bogus.
++ *
++ * If not then any change to the affinity is pointless because the
++ * startup code invokes irq_setup_affinity() which will select
++ * a online CPU anyway.
++ */
++ return -EINVAL;
++}
++#else
++/* ALPHA magic affinity auto selector. Keep it for historical reasons. */
++static inline int irq_select_affinity_usr(unsigned int irq)
++{
++ return irq_select_affinity(irq);
++}
++#endif
+
+ static ssize_t write_irq_affinity(int type, struct file *file,
+ const char __user *buffer, size_t count, loff_t *pos)
--- /dev/null
+From 0a6ea04e3bbd20833d2b49296e5adc1c5bb86386 Mon Sep 17 00:00:00 2001
+From: Tony Nguyen <anthony.l.nguyen@intel.com>
+Date: Thu, 6 Feb 2020 01:20:08 -0800
+Subject: ice: Remove possible null dereference
+
+From: Tony Nguyen <anthony.l.nguyen@intel.com>
+
+commit 0a6ea04e3bbd20833d2b49296e5adc1c5bb86386 upstream.
+
+Commit 1f45ebe0d8fb ("ice: add extra check for null Rx descriptor") moved
+the call to ice_construct_skb() under a null check as Coverity reported a
+possible use of null skb. However, the original call was not deleted, do so
+now.
+
+Fixes: 1f45ebe0d8fb ("ice: add extra check for null Rx descriptor")
+Reported-by: Bruce Allan <bruce.w.allan@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/ice/ice_txrx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1078,8 +1078,6 @@ construct_skb:
+ skb = ice_build_skb(rx_ring, rx_buf, &xdp);
+ else
+ skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
+- } else {
+- skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
+ }
+ /* exit if we failed to retrieve a buffer */
+ if (!skb) {
--- /dev/null
+From c7849be9cc2dd2754c48ddbaca27c2de6d80a95d Mon Sep 17 00:00:00 2001
+From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
+Date: Sat, 22 Feb 2020 14:46:05 +0800
+Subject: io_uring: fix __io_iopoll_check deadlock in io_sq_thread
+
+From: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
+
+commit c7849be9cc2dd2754c48ddbaca27c2de6d80a95d upstream.
+
+Since commit a3a0e43fd770 ("io_uring: don't enter poll loop if we have
+CQEs pending"), if we already events pending, we won't enter poll loop.
+In case SETUP_IOPOLL and SETUP_SQPOLL are both enabled, if app has
+been terminated and don't reap pending events which are already in cq
+ring, and there are some reqs in poll_list, io_sq_thread will enter
+__io_iopoll_check(), and find pending events, then return, this loop
+will never have a chance to exit.
+
+I have seen this issue in fio stress tests, to fix this issue, let
+io_sq_thread call io_iopoll_getevents() with argument 'min' being zero,
+and remove __io_iopoll_check().
+
+Fixes: a3a0e43fd770 ("io_uring: don't enter poll loop if we have CQEs pending")
+Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 27 +++++++++------------------
+ 1 file changed, 9 insertions(+), 18 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1286,11 +1286,17 @@ static void io_iopoll_reap_events(struct
+ mutex_unlock(&ctx->uring_lock);
+ }
+
+-static int __io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+- long min)
++static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
++ long min)
+ {
+ int iters = 0, ret = 0;
+
++ /*
++ * We disallow the app entering submit/complete with polling, but we
++ * still need to lock the ring to prevent racing with polled issue
++ * that got punted to a workqueue.
++ */
++ mutex_lock(&ctx->uring_lock);
+ do {
+ int tmin = 0;
+
+@@ -1326,21 +1332,6 @@ static int __io_iopoll_check(struct io_r
+ ret = 0;
+ } while (min && !*nr_events && !need_resched());
+
+- return ret;
+-}
+-
+-static int io_iopoll_check(struct io_ring_ctx *ctx, unsigned *nr_events,
+- long min)
+-{
+- int ret;
+-
+- /*
+- * We disallow the app entering submit/complete with polling, but we
+- * still need to lock the ring to prevent racing with polled issue
+- * that got punted to a workqueue.
+- */
+- mutex_lock(&ctx->uring_lock);
+- ret = __io_iopoll_check(ctx, nr_events, min);
+ mutex_unlock(&ctx->uring_lock);
+ return ret;
+ }
+@@ -3884,7 +3875,7 @@ static int io_sq_thread(void *data)
+ */
+ mutex_lock(&ctx->uring_lock);
+ if (!list_empty(&ctx->poll_list))
+- __io_iopoll_check(ctx, &nr_events, 0);
++ io_iopoll_getevents(ctx, &nr_events, 0);
+ else
+ inflight = 0;
+ mutex_unlock(&ctx->uring_lock);
--- /dev/null
+From 7143b5ac5750f404ff3a594b34fdf3fc2f99f828 Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 21 Feb 2020 16:42:16 +0100
+Subject: io_uring: prevent sq_thread from spinning when it should stop
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+commit 7143b5ac5750f404ff3a594b34fdf3fc2f99f828 upstream.
+
+This patch drops 'cur_mm' before calling cond_resched(), to prevent
+the sq_thread from spinning even when the user process is finished.
+
+Before this patch, if the user process ended without closing the
+io_uring fd, the sq_thread continues to spin until the
+'sq_thread_idle' timeout ends.
+
+In the worst case where the 'sq_thread_idle' parameter is bigger than
+INT_MAX, the sq_thread will spin forever.
+
+Fixes: 6c271ce2f1d5 ("io_uring: add submission polling")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3909,6 +3909,18 @@ static int io_sq_thread(void *data)
+ */
+ if (!to_submit || ret == -EBUSY) {
+ /*
++ * Drop cur_mm before scheduling, we can't hold it for
++ * long periods (or over schedule()). Do this before
++ * adding ourselves to the waitqueue, as the unuse/drop
++ * may sleep.
++ */
++ if (cur_mm) {
++ unuse_mm(cur_mm);
++ mmput(cur_mm);
++ cur_mm = NULL;
++ }
++
++ /*
+ * We're polling. If we're within the defined idle
+ * period, then let us spin without work before going
+ * to sleep. The exception is if we got EBUSY doing
+@@ -3922,18 +3934,6 @@ static int io_sq_thread(void *data)
+ continue;
+ }
+
+- /*
+- * Drop cur_mm before scheduling, we can't hold it for
+- * long periods (or over schedule()). Do this before
+- * adding ourselves to the waitqueue, as the unuse/drop
+- * may sleep.
+- */
+- if (cur_mm) {
+- unuse_mm(cur_mm);
+- mmput(cur_mm);
+- cur_mm = NULL;
+- }
+-
+ prepare_to_wait(&ctx->sqo_wait, &wait,
+ TASK_INTERRUPTIBLE);
+
--- /dev/null
+From e7598fac323aad0e502415edeffd567315994dd6 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Mon, 10 Feb 2020 10:36:56 +0100
+Subject: iommu/vt-d: Fix compile warning from intel-svm.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Joerg Roedel <jroedel@suse.de>
+
+commit e7598fac323aad0e502415edeffd567315994dd6 upstream.
+
+The intel_svm_is_pasid_valid() needs to be marked inline, otherwise it
+causes the compile warning below:
+
+ CC [M] drivers/dma/idxd/cdev.o
+In file included from drivers/dma/idxd/cdev.c:9:0:
+./include/linux/intel-svm.h:125:12: warning: ‘intel_svm_is_pasid_valid’ defined but not used [-Wunused-function]
+ static int intel_svm_is_pasid_valid(struct device *dev, int pasid)
+ ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Reported-by: Borislav Petkov <bp@alien8.de>
+Fixes: 15060aba71711 ('iommu/vt-d: Helper function to query if a pasid has any active users')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/intel-svm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/intel-svm.h
++++ b/include/linux/intel-svm.h
+@@ -122,7 +122,7 @@ static inline int intel_svm_unbind_mm(st
+ BUG();
+ }
+
+-static int intel_svm_is_pasid_valid(struct device *dev, int pasid)
++static inline int intel_svm_is_pasid_valid(struct device *dev, int pasid)
+ {
+ return -EINVAL;
+ }
--- /dev/null
+From 495d2bbb11d2842917951961abb06e6ba45af6ae Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 27 Feb 2020 10:45:54 +0100
+Subject: Revert "dmaengine: imx-sdma: Fix memory leak"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit 7ac78dd1e0992fd6d2ae375cc0dd6456c632f605 which is
+commit 02939cd167095f16328a1bd5cab5a90b550606df upstream.
+
+Andreas writes:
+ This patch breaks our imx6 board with the attached trace.
+ Reverting the patch makes it boot again.
+
+Reported-by: Andreas Tobler <andreas.tobler@onway.ch>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Robin Gong <yibin.gong@nxp.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/imx-sdma.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -760,8 +760,12 @@ static void sdma_start_desc(struct sdma_
+ return;
+ }
+ sdmac->desc = desc = to_sdma_desc(&vd->tx);
+-
+- list_del(&vd->node);
++ /*
++ * Do not delete the node in desc_issued list in cyclic mode, otherwise
++ * the desc allocated will never be freed in vchan_dma_desc_free_list
++ */
++ if (!(sdmac->flags & IMX_DMA_SG_LOOP))
++ list_del(&vd->node);
+
+ sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1067,6 +1071,7 @@ static void sdma_channel_terminate_work(
+
+ spin_lock_irqsave(&sdmac->vc.lock, flags);
+ vchan_get_all_descriptors(&sdmac->vc, &head);
++ sdmac->desc = NULL;
+ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ vchan_dma_desc_free_list(&sdmac->vc, &head);
+ sdmac->context_loaded = false;
+@@ -1075,19 +1080,11 @@ static void sdma_channel_terminate_work(
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
+- unsigned long flags;
+-
+- spin_lock_irqsave(&sdmac->vc.lock, flags);
+
+ sdma_disable_channel(chan);
+
+- if (sdmac->desc) {
+- vchan_terminate_vdesc(&sdmac->desc->vd);
+- sdmac->desc = NULL;
++ if (sdmac->desc)
+ schedule_work(&sdmac->terminate_worker);
+- }
+-
+- spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+
+ return 0;
+ }
--- /dev/null
+From 0ef82fcefb99300ede6f4d38a8100845b2dc8e30 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 20 Feb 2020 20:04:12 -0800
+Subject: scripts/get_maintainer.pl: deprioritize old Fixes: addresses
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit 0ef82fcefb99300ede6f4d38a8100845b2dc8e30 upstream.
+
+Recently, I found that get_maintainer was causing me to send emails to
+the old addresses for maintainers. Since I usually just trust the
+output of get_maintainer to know the right email address, I didn't even
+look carefully and fired off two patch series that went to the wrong
+place. Oops.
+
+The problem was introduced recently when trying to add signatures from
+Fixes. The problem was that these email addresses were added too early
+in the process of compiling our list of places to send. Things added to
+the list earlier are considered more canonical and when we later added
+maintainer entries we ended up deduplicating to the old address.
+
+Here are two examples using mainline commits (to make it easier to
+replicate) for the two maintainers that I messed up recently:
+
+ $ git format-patch d8549bcd0529~..d8549bcd0529
+ $ ./scripts/get_maintainer.pl 0001-clk-Add-clk_hw*.patch | grep Boyd
+ Stephen Boyd <sboyd@codeaurora.org>...
+
+ $ git format-patch 6d1238aa3395~..6d1238aa3395
+ $ ./scripts/get_maintainer.pl 0001-arm64-dts-qcom-qcs404*.patch | grep Andy
+ Andy Gross <andy.gross@linaro.org>
+
+Let's move the adding of addresses from Fixes: to the end since the
+email addresses from these are much more likely to be older.
+
+After this patch the above examples get the right addresses for the two
+examples.
+
+Link: http://lkml.kernel.org/r/20200127095001.1.I41fba9f33590bfd92cd01960161d8384268c6569@changeid
+Fixes: 2f5bd343694e ("scripts/get_maintainer.pl: add signatures from Fixes: <badcommit> lines in commit message")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Joe Perches <joe@perches.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Andy Gross <agross@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/get_maintainer.pl | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/scripts/get_maintainer.pl
++++ b/scripts/get_maintainer.pl
+@@ -932,10 +932,6 @@ sub get_maintainers {
+ }
+ }
+
+- foreach my $fix (@fixes) {
+- vcs_add_commit_signers($fix, "blamed_fixes");
+- }
+-
+ foreach my $email (@email_to, @list_to) {
+ $email->[0] = deduplicate_email($email->[0]);
+ }
+@@ -974,6 +970,10 @@ sub get_maintainers {
+ }
+ }
+
++ foreach my $fix (@fixes) {
++ vcs_add_commit_signers($fix, "blamed_fixes");
++ }
++
+ my @to = ();
+ if ($email || $email_list) {
+ if ($email) {
--- /dev/null
+From 76261ada16dcc3be610396a46d35acc3efbda682 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 12 Feb 2020 21:08:59 -0800
+Subject: scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout"
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 76261ada16dcc3be610396a46d35acc3efbda682 upstream.
+
+Since commit 04060db41178 introduces soft lockups when toggling network
+interfaces, revert it.
+
+Link: https://marc.info/?l=target-devel&m=158157054906196
+Cc: Rahul Kundu <rahul.kundu@chelsio.com>
+Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Cc: Sagi Grimberg <sagi@grimberg.me>
+Reported-by: Dakshaja Uppalapati <dakshaja@chelsio.com>
+Fixes: 04060db41178 ("scsi: RDMA/isert: Fix a recently introduced regression related to logout")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 12 ++++++++++++
+ drivers/target/iscsi/iscsi_target.c | 6 +++---
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -2575,6 +2575,17 @@ isert_wait4logout(struct isert_conn *ise
+ }
+ }
+
++static void
++isert_wait4cmds(struct iscsi_conn *conn)
++{
++ isert_info("iscsi_conn %p\n", conn);
++
++ if (conn->sess) {
++ target_sess_cmd_list_set_waiting(conn->sess->se_sess);
++ target_wait_for_sess_cmds(conn->sess->se_sess);
++ }
++}
++
+ /**
+ * isert_put_unsol_pending_cmds() - Drop commands waiting for
+ * unsolicitate dataout
+@@ -2622,6 +2633,7 @@ static void isert_wait_conn(struct iscsi
+
+ ib_drain_qp(isert_conn->qp);
+ isert_put_unsol_pending_cmds(conn);
++ isert_wait4cmds(conn);
+ isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4149,6 +4149,9 @@ int iscsit_close_connection(
+ iscsit_stop_nopin_response_timer(conn);
+ iscsit_stop_nopin_timer(conn);
+
++ if (conn->conn_transport->iscsit_wait_conn)
++ conn->conn_transport->iscsit_wait_conn(conn);
++
+ /*
+ * During Connection recovery drop unacknowledged out of order
+ * commands for this connection, and prepare the other commands
+@@ -4234,9 +4237,6 @@ int iscsit_close_connection(
+ target_sess_cmd_list_set_waiting(sess->se_sess);
+ target_wait_for_sess_cmds(sess->se_sess);
+
+- if (conn->conn_transport->iscsit_wait_conn)
+- conn->conn_transport->iscsit_wait_conn(conn);
+-
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+ struct crypto_ahash *tfm;
--- /dev/null
+From 807b9515b7d044cf77df31f1af9d842a76ecd5cb Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 12 Feb 2020 21:09:00 -0800
+Subject: scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 807b9515b7d044cf77df31f1af9d842a76ecd5cb upstream.
+
+Since commit e9d3009cb936 introduced a regression and since the fix for
+that regression was not perfect, revert this commit.
+
+Link: https://marc.info/?l=target-devel&m=158157054906195
+Cc: Rahul Kundu <rahul.kundu@chelsio.com>
+Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Cc: Sagi Grimberg <sagi@grimberg.me>
+Reported-by: Dakshaja Uppalapati <dakshaja@chelsio.com>
+Fixes: e9d3009cb936 ("scsi: target: iscsi: Wait for all commands to finish before freeing a session")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 10 ++--------
+ include/scsi/iscsi_proto.h | 1 -
+ 2 files changed, 2 insertions(+), 9 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1165,9 +1165,7 @@ int iscsit_setup_scsi_cmd(struct iscsi_c
+ hdr->cmdsn, be32_to_cpu(hdr->data_length), payload_length,
+ conn->cid);
+
+- if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+- return iscsit_add_reject_cmd(cmd,
+- ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+
+ cmd->sense_reason = transport_lookup_cmd_lun(&cmd->se_cmd,
+ scsilun_to_int(&hdr->lun));
+@@ -2004,9 +2002,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_
+ conn->sess->se_sess, 0, DMA_NONE,
+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2);
+
+- if (target_get_sess_cmd(&cmd->se_cmd, true) < 0)
+- return iscsit_add_reject_cmd(cmd,
+- ISCSI_REASON_WAITING_FOR_LOGOUT, buf);
++ target_get_sess_cmd(&cmd->se_cmd, true);
+
+ /*
+ * TASK_REASSIGN for ERL=2 / connection stays inside of
+@@ -4234,8 +4230,6 @@ int iscsit_close_connection(
+ * must wait until they have completed.
+ */
+ iscsit_check_conn_usage_count(conn);
+- target_sess_cmd_list_set_waiting(sess->se_sess);
+- target_wait_for_sess_cmds(sess->se_sess);
+
+ ahash_request_free(conn->conn_tx_hash);
+ if (conn->conn_rx_hash) {
+--- a/include/scsi/iscsi_proto.h
++++ b/include/scsi/iscsi_proto.h
+@@ -627,7 +627,6 @@ struct iscsi_reject {
+ #define ISCSI_REASON_BOOKMARK_INVALID 9
+ #define ISCSI_REASON_BOOKMARK_NO_RESOURCES 10
+ #define ISCSI_REASON_NEGOTIATION_RESET 11
+-#define ISCSI_REASON_WAITING_FOR_LOGOUT 12
+
+ /* Max. number of Key=Value pairs in a text message */
+ #define MAX_KEY_VALUE_PAIRS 8192
btrfs-do-not-check-delayed-items-are-empty-for-single-transaction-cleanup.patch
btrfs-fix-btrfs_wait_ordered_range-so-that-it-waits-for-all-ordered-extents.patch
btrfs-fix-deadlock-during-fast-fsync-when-logging-prealloc-extents-beyond-eof.patch
+revert-dmaengine-imx-sdma-fix-memory-leak.patch
+drm-i915-selftests-add-a-mock-i915_vma-to-the-mock_ring.patch
+drm-i915-gvt-more-locking-for-ppgtt-mm-lru-list.patch
+ice-remove-possible-null-dereference.patch
+drm-bridge-tc358767-fix-poll-timeouts.patch
+drm-i915-gem-require-per-engine-reset-support-for-non-persistent-contexts.patch
+drm-i915-gt-protect-defer_request-from-new-waiters.patch
+drm-i915-ehl-update-port-clock-voltage-level-requirements.patch
+drm-amd-display-fix-dtm-unloading.patch
+drm-msm-dpu-fix-bgr565-vs-rgb565-confusion.patch
+scsi-revert-rdma-isert-fix-a-recently-introduced-regression-related-to-logout.patch
+scsi-revert-target-iscsi-wait-for-all-commands-to-finish-before-freeing-a-session.patch
+usb-gadget-composite-fix-bmaxpower-for-superspeedplus.patch
+usb-dwc2-fix-in-isoc-request-length-checking.patch
+staging-rtl8723bs-fix-copy-of-overlapping-memory.patch
+staging-greybus-use-after-free-in-gb_audio_manager_remove_all.patch
+asoc-atmel-fix-atmel_ssc_set_audio-link-failure.patch
+asoc-fsl_sai-fix-exiting-path-on-probing-failure.patch
+ecryptfs-replace-bug_on-with-error-handling-code.patch
+iommu-vt-d-fix-compile-warning-from-intel-svm.h.patch
+crypto-rename-sm3-256-to-sm3-in-hash_algo_name.patch
+genirq-proc-reject-invalid-affinity-masks-again.patch
+bpf-offload-replace-bitwise-and-by-logical-and-in-bpf_prog_offload_info_fill.patch
+arm64-lse-fix-lse-atomics-with-llvm.patch
+scripts-get_maintainer.pl-deprioritize-old-fixes-addresses.patch
+io_uring-prevent-sq_thread-from-spinning-when-it-should-stop.patch
+io_uring-fix-__io_iopoll_check-deadlock-in-io_sq_thread.patch
--- /dev/null
+From b7db58105b80fa9232719c8329b995b3addfab55 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 5 Feb 2020 15:32:17 +0300
+Subject: staging: greybus: use after free in gb_audio_manager_remove_all()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit b7db58105b80fa9232719c8329b995b3addfab55 upstream.
+
+When we call kobject_put() and it's the last reference to the kobject
+then it calls gb_audio_module_release() and frees module. We dereference
+"module" on the next line which is a use after free.
+
+Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
+Link: https://lore.kernel.org/r/20200205123217.jreendkyxulqsool@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/audio_manager.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/greybus/audio_manager.c
++++ b/drivers/staging/greybus/audio_manager.c
+@@ -92,8 +92,8 @@ void gb_audio_manager_remove_all(void)
+
+ list_for_each_entry_safe(module, next, &modules_list, list) {
+ list_del(&module->list);
+- kobject_put(&module->kobj);
+ ida_simple_remove(&module_id, module->id);
++ kobject_put(&module->kobj);
+ }
+
+ is_empty = list_empty(&modules_list);
--- /dev/null
+From 8ae9a588ca35eb9c32dc03299c5e1f4a1e9a9617 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Sun, 26 Jan 2020 22:05:49 +0000
+Subject: staging: rtl8723bs: fix copy of overlapping memory
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 8ae9a588ca35eb9c32dc03299c5e1f4a1e9a9617 upstream.
+
+Currently the rtw_sprintf prints the contents of thread_name
+onto thread_name and this can lead to a potential copy of a
+string over itself. Avoid this by printing the literal string RTWHALXT
+instread of the contents of thread_name.
+
+Addresses-Coverity: ("copy of overlapping memory")
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20200126220549.9849-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c
++++ b/drivers/staging/rtl8723bs/hal/rtl8723bs_xmit.c
+@@ -476,14 +476,13 @@ int rtl8723bs_xmit_thread(void *context)
+ s32 ret;
+ struct adapter *padapter;
+ struct xmit_priv *pxmitpriv;
+- u8 thread_name[20] = "RTWHALXT";
+-
++ u8 thread_name[20];
+
+ ret = _SUCCESS;
+ padapter = context;
+ pxmitpriv = &padapter->xmitpriv;
+
+- rtw_sprintf(thread_name, 20, "%s-"ADPT_FMT, thread_name, ADPT_ARG(padapter));
++ rtw_sprintf(thread_name, 20, "RTWHALXT-" ADPT_FMT, ADPT_ARG(padapter));
+ thread_enter(thread_name);
+
+ DBG_871X("start "FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
--- /dev/null
+From 860ef6cd3f90b84a1832f8a6485c90c34d3b588b Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Tue, 21 Jan 2020 14:24:04 +0400
+Subject: usb: dwc2: Fix in ISOC request length checking
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+commit 860ef6cd3f90b84a1832f8a6485c90c34d3b588b upstream.
+
+Moved ISOC request length checking from dwc2_hsotg_start_req() function to
+dwc2_hsotg_ep_queue().
+
+Fixes: 4fca54aa58293 ("usb: gadget: s3c-hsotg: add multi count support")
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/gadget.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -1083,11 +1083,6 @@ static void dwc2_hsotg_start_req(struct
+ else
+ packets = 1; /* send one packet if length is zero. */
+
+- if (hs_ep->isochronous && length > (hs_ep->mc * hs_ep->ep.maxpacket)) {
+- dev_err(hsotg->dev, "req length > maxpacket*mc\n");
+- return;
+- }
+-
+ if (dir_in && index != 0)
+ if (hs_ep->isochronous)
+ epsize = DXEPTSIZ_MC(packets);
+@@ -1391,6 +1386,13 @@ static int dwc2_hsotg_ep_queue(struct us
+ req->actual = 0;
+ req->status = -EINPROGRESS;
+
++ /* Don't queue ISOC request if length greater than mps*mc */
++ if (hs_ep->isochronous &&
++ req->length > (hs_ep->mc * hs_ep->ep.maxpacket)) {
++ dev_err(hs->dev, "req length > maxpacket*mc\n");
++ return -EINVAL;
++ }
++
+ /* In DDMA mode for ISOC's don't queue request if length greater
+ * than descriptor limits.
+ */
--- /dev/null
+From c724417baf162bd3e035659e22cdf990cfb0d917 Mon Sep 17 00:00:00 2001
+From: Jack Pham <jackp@codeaurora.org>
+Date: Thu, 30 Jan 2020 19:10:35 -0800
+Subject: usb: gadget: composite: Fix bMaxPower for SuperSpeedPlus
+
+From: Jack Pham <jackp@codeaurora.org>
+
+commit c724417baf162bd3e035659e22cdf990cfb0d917 upstream.
+
+SuperSpeedPlus peripherals must report their bMaxPower of the
+configuration descriptor in units of 8mA as per the USB 3.2
+specification. The current switch statement in encode_bMaxPower()
+only checks for USB_SPEED_SUPER but not USB_SPEED_SUPER_PLUS so
+the latter falls back to USB 2.0 encoding which uses 2mA units.
+Replace the switch with a simple if/else.
+
+Fixes: eae5820b852f ("usb: gadget: composite: Write SuperSpeedPlus config descriptors")
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/composite.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -437,12 +437,10 @@ static u8 encode_bMaxPower(enum usb_devi
+ val = CONFIG_USB_GADGET_VBUS_DRAW;
+ if (!val)
+ return 0;
+- switch (speed) {
+- case USB_SPEED_SUPER:
+- return DIV_ROUND_UP(val, 8);
+- default:
++ if (speed < USB_SPEED_SUPER)
+ return DIV_ROUND_UP(val, 2);
+- }
++ else
++ return DIV_ROUND_UP(val, 8);
+ }
+
+ static int config_buf(struct usb_configuration *config,
projects / thirdparty / kernel / stable-queue.git / commitdiff
