--- /dev/null
+From 9826449999c24463a629a39a49c987e9c9bf712a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 10:03:20 +0100
+Subject: ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 5638159f6d93b99ec9743ac7f65563fca3cf413d ]
+
+This reverts commit c17e9377aa81664d94b4f2102559fcf2a01ec8e7.
+
+The lpc32xx clock driver is not able to actually change the PLL rate as
+this would require reparenting ARM_CLK, DDRAM_CLK, PERIPH_CLK to SYSCLK,
+then stop the PLL, update the register, restart the PLL and wait for the
+PLL to lock and finally reparent ARM_CLK, DDRAM_CLK, PERIPH_CLK to HCLK
+PLL.
+
+Currently, the HCLK driver simply updates the registers but this has no
+real effect and all the clock rate calculation end up being wrong. This is
+especially annoying for the peripheral (e.g. UARTs, I2C, SPI).
+
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Link: https://lore.kernel.org/r/20210203090320.GA3760268@piout.net'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 7b7ec7b1217b8..824393e1bcfb7 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -329,9 +329,6 @@
+
+ clocks = <&xtal_32k>, <&xtal>;
+ clock-names = "xtal_32k", "xtal";
+-
+- assigned-clocks = <&clk LPC32XX_CLK_HCLK_PLL>;
+- assigned-clock-rates = <208000000>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 6d4917d9133bd704aad5554ea28745b8f3a6222f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 10:19:07 +0000
+Subject: ARM: ensure the signal page contains defined contents
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 9c698bff66ab4914bb3d71da7dc6112519bde23e ]
+
+Ensure that the signal page contains our poison instruction to increase
+the protection against ROP attacks and also contains well defined
+contents.
+
+Acked-by: Will Deacon <will@kernel.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/signal.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index ab2568996ddb0..c01f76cd02422 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -694,18 +694,20 @@ struct page *get_signal_page(void)
+
+ addr = page_address(page);
+
++ /* Poison the entire page */
++ memset32(addr, __opcode_to_mem_arm(0xe7fddef1),
++ PAGE_SIZE / sizeof(u32));
++
+ /* Give the signal return code some randomness */
+ offset = 0x200 + (get_random_int() & 0x7fc);
+ signal_return_offset = offset;
+
+- /*
+- * Copy signal return handlers into the vector page, and
+- * set sigreturn to be a pointer to these.
+- */
++ /* Copy signal return handlers into the page */
+ memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
+
+- ptr = (unsigned long)addr + offset;
+- flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
++ /* Flush out all instructions in this page */
++ ptr = (unsigned long)addr;
++ flush_icache_range(ptr, ptr + PAGE_SIZE);
+
+ return page;
+ }
+--
+2.27.0
+
--- /dev/null
+From fb55291abf9561cb40136bf681ceccc9e573db58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 19:40:01 +0000
+Subject: ARM: kexec: fix oops after TLB are invalidated
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4d62e81b60d4025e2dfcd5ea531cc1394ce9226f ]
+
+Giancarlo Ferrari reports the following oops while trying to use kexec:
+
+ Unable to handle kernel paging request at virtual address 80112f38
+ pgd = fd7ef03e
+ [80112f38] *pgd=0001141e(bad)
+ Internal error: Oops: 80d [#1] PREEMPT SMP ARM
+ ...
+
+This is caused by machine_kexec() trying to set the kernel text to be
+read/write, so it can poke values into the relocation code before
+copying it - and an interrupt occuring which changes the page tables.
+The subsequent writes then hit read-only sections that trigger a
+data abort resulting in the above oops.
+
+Fix this by copying the relocation code, and then writing the variables
+into the destination, thereby avoiding the need to make the kernel text
+read/write.
+
+Reported-by: Giancarlo Ferrari <giancarlo.ferrari89@gmail.com>
+Tested-by: Giancarlo Ferrari <giancarlo.ferrari89@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/kexec-internal.h | 12 +++++++++
+ arch/arm/kernel/asm-offsets.c | 5 ++++
+ arch/arm/kernel/machine_kexec.c | 20 ++++++--------
+ arch/arm/kernel/relocate_kernel.S | 38 ++++++++-------------------
+ 4 files changed, 36 insertions(+), 39 deletions(-)
+ create mode 100644 arch/arm/include/asm/kexec-internal.h
+
+diff --git a/arch/arm/include/asm/kexec-internal.h b/arch/arm/include/asm/kexec-internal.h
+new file mode 100644
+index 0000000000000..ecc2322db7aa1
+--- /dev/null
++++ b/arch/arm/include/asm/kexec-internal.h
+@@ -0,0 +1,12 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ARM_KEXEC_INTERNAL_H
++#define _ARM_KEXEC_INTERNAL_H
++
++struct kexec_relocate_data {
++ unsigned long kexec_start_address;
++ unsigned long kexec_indirection_page;
++ unsigned long kexec_mach_type;
++ unsigned long kexec_r2;
++};
++
++#endif
+diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
+index c773b829ee8ee..bfb05c93494db 100644
+--- a/arch/arm/kernel/asm-offsets.c
++++ b/arch/arm/kernel/asm-offsets.c
+@@ -15,6 +15,7 @@
+ #include <linux/kvm_host.h>
+ #endif
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/glue-df.h>
+ #include <asm/glue-pf.h>
+ #include <asm/mach/arch.h>
+@@ -190,5 +191,9 @@ int main(void)
+ DEFINE(MPU_RGN_PRBAR, offsetof(struct mpu_rgn, prbar));
+ DEFINE(MPU_RGN_PRLAR, offsetof(struct mpu_rgn, prlar));
+ #endif
++ DEFINE(KEXEC_START_ADDR, offsetof(struct kexec_relocate_data, kexec_start_address));
++ DEFINE(KEXEC_INDIR_PAGE, offsetof(struct kexec_relocate_data, kexec_indirection_page));
++ DEFINE(KEXEC_MACH_TYPE, offsetof(struct kexec_relocate_data, kexec_mach_type));
++ DEFINE(KEXEC_R2, offsetof(struct kexec_relocate_data, kexec_r2));
+ return 0;
+ }
+diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
+index 76300f3813e89..734adeb42df87 100644
+--- a/arch/arm/kernel/machine_kexec.c
++++ b/arch/arm/kernel/machine_kexec.c
+@@ -15,6 +15,7 @@
+ #include <asm/pgalloc.h>
+ #include <asm/mmu_context.h>
+ #include <asm/cacheflush.h>
++#include <asm/kexec-internal.h>
+ #include <asm/fncpy.h>
+ #include <asm/mach-types.h>
+ #include <asm/smp_plat.h>
+@@ -24,11 +25,6 @@
+ extern void relocate_new_kernel(void);
+ extern const unsigned int relocate_new_kernel_size;
+
+-extern unsigned long kexec_start_address;
+-extern unsigned long kexec_indirection_page;
+-extern unsigned long kexec_mach_type;
+-extern unsigned long kexec_boot_atags;
+-
+ static atomic_t waiting_for_crash_ipi;
+
+ /*
+@@ -161,6 +157,7 @@ void (*kexec_reinit)(void);
+ void machine_kexec(struct kimage *image)
+ {
+ unsigned long page_list, reboot_entry_phys;
++ struct kexec_relocate_data *data;
+ void (*reboot_entry)(void);
+ void *reboot_code_buffer;
+
+@@ -176,18 +173,17 @@ void machine_kexec(struct kimage *image)
+
+ reboot_code_buffer = page_address(image->control_code_page);
+
+- /* Prepare parameters for reboot_code_buffer*/
+- set_kernel_text_rw();
+- kexec_start_address = image->start;
+- kexec_indirection_page = page_list;
+- kexec_mach_type = machine_arch_type;
+- kexec_boot_atags = image->arch.kernel_r2;
+-
+ /* copy our kernel relocation code to the control code page */
+ reboot_entry = fncpy(reboot_code_buffer,
+ &relocate_new_kernel,
+ relocate_new_kernel_size);
+
++ data = reboot_code_buffer + relocate_new_kernel_size;
++ data->kexec_start_address = image->start;
++ data->kexec_indirection_page = page_list;
++ data->kexec_mach_type = machine_arch_type;
++ data->kexec_r2 = image->arch.kernel_r2;
++
+ /* get the identity mapping physical address for the reboot code */
+ reboot_entry_phys = virt_to_idmap(reboot_entry);
+
+diff --git a/arch/arm/kernel/relocate_kernel.S b/arch/arm/kernel/relocate_kernel.S
+index 7eaa2ae7aff58..5e15b5912cb05 100644
+--- a/arch/arm/kernel/relocate_kernel.S
++++ b/arch/arm/kernel/relocate_kernel.S
+@@ -5,14 +5,16 @@
+
+ #include <linux/linkage.h>
+ #include <asm/assembler.h>
++#include <asm/asm-offsets.h>
+ #include <asm/kexec.h>
+
+ .align 3 /* not needed for this code, but keeps fncpy() happy */
+
+ ENTRY(relocate_new_kernel)
+
+- ldr r0,kexec_indirection_page
+- ldr r1,kexec_start_address
++ adr r7, relocate_new_kernel_end
++ ldr r0, [r7, #KEXEC_INDIR_PAGE]
++ ldr r1, [r7, #KEXEC_START_ADDR]
+
+ /*
+ * If there is no indirection page (we are doing crashdumps)
+@@ -57,34 +59,16 @@ ENTRY(relocate_new_kernel)
+
+ 2:
+ /* Jump to relocated kernel */
+- mov lr,r1
+- mov r0,#0
+- ldr r1,kexec_mach_type
+- ldr r2,kexec_boot_atags
+- ARM( ret lr )
+- THUMB( bx lr )
+-
+- .align
+-
+- .globl kexec_start_address
+-kexec_start_address:
+- .long 0x0
+-
+- .globl kexec_indirection_page
+-kexec_indirection_page:
+- .long 0x0
+-
+- .globl kexec_mach_type
+-kexec_mach_type:
+- .long 0x0
+-
+- /* phy addr of the atags for the new kernel */
+- .globl kexec_boot_atags
+-kexec_boot_atags:
+- .long 0x0
++ mov lr, r1
++ mov r0, #0
++ ldr r1, [r7, #KEXEC_MACH_TYPE]
++ ldr r2, [r7, #KEXEC_R2]
++ ARM( ret lr )
++ THUMB( bx lr )
+
+ ENDPROC(relocate_new_kernel)
+
++ .align 3
+ relocate_new_kernel_end:
+
+ .globl relocate_new_kernel_size
+--
+2.27.0
+
--- /dev/null
+From fc22069b1a19016784590b1156d39a78f3bdd2ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 21:09:11 +0200
+Subject: ARM: OMAP2+: Fix suspcious RCU usage splats for
+ omap_enter_idle_coupled
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 06862d789ddde8a99c1e579e934ca17c15a84755 ]
+
+We get suspcious RCU usage splats with cpuidle in several places in
+omap_enter_idle_coupled() with the kernel debug options enabled:
+
+RCU used illegally from extended quiescent state!
+...
+(_raw_spin_lock_irqsave)
+(omap_enter_idle_coupled+0x17c/0x2d8)
+(omap_enter_idle_coupled)
+(cpuidle_enter_state)
+(cpuidle_enter_state_coupled)
+(cpuidle_enter)
+
+Let's use RCU_NONIDLE to suppress these splats. Things got changed around
+with commit 1098582a0f6c ("sched,idle,rcu: Push rcu_idle deeper into the
+idle path") that started triggering these warnings.
+
+For the tick_broadcast related calls, ideally we'd just switch over to
+using CPUIDLE_FLAG_TIMER_STOP for omap_enter_idle_coupled() to have the
+generic cpuidle code handle the tick_broadcast related calls for us and
+then just drop the tick_broadcast calls here.
+
+But we're currently missing the call in the common cpuidle code for
+tick_broadcast_enable() that CPU1 hotplug needs as described in earlier
+commit 50d6b3cf9403 ("ARM: OMAP2+: fix lack of timer interrupts on CPU1
+after hotplug").
+
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Russell King <rmk+kernel@armlinux.org.uk>
+Acked-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/cpuidle44xx.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
+index c8d317fafe2ea..de37027ad7587 100644
+--- a/arch/arm/mach-omap2/cpuidle44xx.c
++++ b/arch/arm/mach-omap2/cpuidle44xx.c
+@@ -151,10 +151,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ (cx->mpu_logic_state == PWRDM_POWER_OFF);
+
+ /* Enter broadcast mode for periodic timers */
+- tick_broadcast_enable();
++ RCU_NONIDLE(tick_broadcast_enable());
+
+ /* Enter broadcast mode for one-shot timers */
+- tick_broadcast_enter();
++ RCU_NONIDLE(tick_broadcast_enter());
+
+ /*
+ * Call idle CPU PM enter notifier chain so that
+@@ -166,7 +166,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+
+ if (dev->cpu == 0) {
+ pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state);
+- omap_set_pwrdm_state(mpu_pd, cx->mpu_state);
++ RCU_NONIDLE(omap_set_pwrdm_state(mpu_pd, cx->mpu_state));
+
+ /*
+ * Call idle CPU cluster PM enter notifier chain
+@@ -178,7 +178,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ index = 0;
+ cx = state_ptr + index;
+ pwrdm_set_logic_retst(mpu_pd, cx->mpu_logic_state);
+- omap_set_pwrdm_state(mpu_pd, cx->mpu_state);
++ RCU_NONIDLE(omap_set_pwrdm_state(mpu_pd, cx->mpu_state));
+ mpuss_can_lose_context = 0;
+ }
+ }
+@@ -194,9 +194,9 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ mpuss_can_lose_context)
+ gic_dist_disable();
+
+- clkdm_deny_idle(cpu_clkdm[1]);
+- omap_set_pwrdm_state(cpu_pd[1], PWRDM_POWER_ON);
+- clkdm_allow_idle(cpu_clkdm[1]);
++ RCU_NONIDLE(clkdm_deny_idle(cpu_clkdm[1]));
++ RCU_NONIDLE(omap_set_pwrdm_state(cpu_pd[1], PWRDM_POWER_ON));
++ RCU_NONIDLE(clkdm_allow_idle(cpu_clkdm[1]));
+
+ if (IS_PM44XX_ERRATUM(PM_OMAP4_ROM_SMP_BOOT_ERRATUM_GICD) &&
+ mpuss_can_lose_context) {
+@@ -222,7 +222,7 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev,
+ cpu_pm_exit();
+
+ cpu_pm_out:
+- tick_broadcast_exit();
++ RCU_NONIDLE(tick_broadcast_exit());
+
+ fail:
+ cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
+--
+2.27.0
+
--- /dev/null
+From f8f1165dda9be1b14eb7e408ad41bc053afa0ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 16:11:03 -0800
+Subject: arm64: dts: qcom: sdm845: Reserve LPASS clocks in gcc
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 93f2a11580a9732c1d90f9e01a7e9facc825658f ]
+
+The GCC_LPASS_Q6_AXI_CLK and GCC_LPASS_SWAY_CLK clocks may not be
+touched on a typical UEFI based SDM845 device, but when the kernel is
+built with CONFIG_SDM_LPASSCC_845 this happens, unless they are marked
+as protected-clocks in the DT.
+
+This was done for the MTP and the Pocophone, but not for DB845c and the
+Lenovo Yoga C630 - causing these to fail to boot if the LPASS clock
+controller is enabled (which it typically isn't).
+
+Tested-by: Vinod Koul <vkoul@kernel.org> #on db845c
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20201222001103.3112306-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 4 +++-
+ arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index 751651a6cd819..bf4fde88011c8 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -337,7 +337,9 @@
+ &gcc {
+ protected-clocks = <GCC_QSPI_CORE_CLK>,
+ <GCC_QSPI_CORE_CLK_SRC>,
+- <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
++ <GCC_QSPI_CNOC_PERIPH_AHB_CLK>,
++ <GCC_LPASS_Q6_AXI_CLK>,
++ <GCC_LPASS_SWAY_CLK>;
+ };
+
+ &pm8998_gpio {
+diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+index e638f216dbfb3..840d6b9bbb598 100644
+--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts
+@@ -232,7 +232,9 @@
+ &gcc {
+ protected-clocks = <GCC_QSPI_CORE_CLK>,
+ <GCC_QSPI_CORE_CLK_SRC>,
+- <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
++ <GCC_QSPI_CNOC_PERIPH_AHB_CLK>,
++ <GCC_LPASS_Q6_AXI_CLK>,
++ <GCC_LPASS_SWAY_CLK>;
+ };
+
+ &i2c1 {
+--
+2.27.0
+
--- /dev/null
+From dee602ea7a40b4c2000a84507b1cba4cdaed2ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Aug 2020 13:51:12 +0100
+Subject: arm64: dts: rockchip: Fix PCIe DT properties on rk3399
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 43f20b1c6140896916f4e91aacc166830a7ba849 ]
+
+It recently became apparent that the lack of a 'device_type = "pci"'
+in the PCIe root complex node for rk3399 is a violation of the PCI
+binding, as documented in IEEE Std 1275-1994. Changes to the kernel's
+parsing of the DT made such violation fatal, as drivers cannot
+probe the controller anymore.
+
+Add the missing property makes the PCIe node compliant. While we
+are at it, drop the pointless linux,pci-domain property, which only
+makes sense when there are multiple host bridges.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20200815125112.462652-3-maz@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index bb7d0aac6b9db..9d6ed8cda2c86 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -232,6 +232,7 @@
+ reg = <0x0 0xf8000000 0x0 0x2000000>,
+ <0x0 0xfd000000 0x0 0x1000000>;
+ reg-names = "axi-base", "apb-base";
++ device_type = "pci";
+ #address-cells = <3>;
+ #size-cells = <2>;
+ #interrupt-cells = <1>;
+@@ -250,7 +251,6 @@
+ <0 0 0 2 &pcie0_intc 1>,
+ <0 0 0 3 &pcie0_intc 2>,
+ <0 0 0 4 &pcie0_intc 3>;
+- linux,pci-domain = <0>;
+ max-link-speed = <1>;
+ msi-map = <0x0 &its 0x0 0x1000>;
+ phys = <&pcie_phy 0>, <&pcie_phy 1>,
+--
+2.27.0
+
--- /dev/null
+From c4b9283315133ba2b40cbdeb7c96d435bb501b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 07:18:23 -0700
+Subject: bfq-iosched: Revert "bfq: Fix computation of shallow depth"
+
+From: Lin Feng <linf@wangsu.com>
+
+[ Upstream commit 388c705b95f23f317fa43e6abf9ff07b583b721a ]
+
+This reverts commit 6d4d273588378c65915acaf7b2ee74e9dd9c130a.
+
+bfq.limit_depth passes word_depths[] as shallow_depth down to sbitmap core
+sbitmap_get_shallow, which uses just the number to limit the scan depth of
+each bitmap word, formula:
+scan_percentage_for_each_word = shallow_depth / (1 << sbimap->shift) * 100%
+
+That means the comments's percentiles 50%, 75%, 18%, 37% of bfq are correct.
+But after commit patch 'bfq: Fix computation of shallow depth', we use
+sbitmap.depth instead, as a example in following case:
+
+sbitmap.depth = 256, map_nr = 4, shift = 6; sbitmap_word.depth = 64.
+The resulsts of computed bfqd->word_depths[] are {128, 192, 48, 96}, and
+three of the numbers exceed core dirver's 'sbitmap_word.depth=64' limit
+nothing.
+
+Signed-off-by: Lin Feng <linf@wangsu.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 7d19aae015aeb..ba32adaeefdd0 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6320,13 +6320,13 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * limit 'something'.
+ */
+ /* no more than 50% of tags for async I/O */
+- bfqd->word_depths[0][0] = max(bt->sb.depth >> 1, 1U);
++ bfqd->word_depths[0][0] = max((1U << bt->sb.shift) >> 1, 1U);
+ /*
+ * no more than 75% of tags for sync writes (25% extra tags
+ * w.r.t. async I/O, to prevent async I/O from starving sync
+ * writes)
+ */
+- bfqd->word_depths[0][1] = max((bt->sb.depth * 3) >> 2, 1U);
++ bfqd->word_depths[0][1] = max(((1U << bt->sb.shift) * 3) >> 2, 1U);
+
+ /*
+ * In-word depths in case some bfq_queue is being weight-
+@@ -6336,9 +6336,9 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * shortage.
+ */
+ /* no more than ~18% of tags for async I/O */
+- bfqd->word_depths[1][0] = max((bt->sb.depth * 3) >> 4, 1U);
++ bfqd->word_depths[1][0] = max(((1U << bt->sb.shift) * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+- bfqd->word_depths[1][1] = max((bt->sb.depth * 6) >> 4, 1U);
++ bfqd->word_depths[1][1] = max(((1U << bt->sb.shift) * 6) >> 4, 1U);
+
+ for (i = 0; i < 2; i++)
+ for (j = 0; j < 2; j++)
+--
+2.27.0
+
--- /dev/null
+From 447f9a823415bb38ed9f88280c7c4f2b4a121ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 10:22:48 +0100
+Subject: cap: fix conversions on getxattr
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit f2b00be488730522d0fb7a8a5de663febdcefe0a ]
+
+If a capability is stored on disk in v2 format cap_inode_getsecurity() will
+currently return in v2 format unconditionally.
+
+This is wrong: v2 cap should be equivalent to a v3 cap with zero rootid,
+and so the same conversions performed on it.
+
+If the rootid cannot be mapped, v3 is returned unconverted. Fix this so
+that both v2 and v3 return -EOVERFLOW if the rootid (or the owner of the fs
+user namespace in case of v2) cannot be mapped into the current user
+namespace.
+
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 67 ++++++++++++++++++++++++++++----------------
+ 1 file changed, 43 insertions(+), 24 deletions(-)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 0ca31c8bc0b13..28a6939bcc4e5 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -371,10 +371,11 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ {
+ int size, ret;
+ kuid_t kroot;
++ u32 nsmagic, magic;
+ uid_t root, mappedroot;
+ char *tmpbuf = NULL;
+ struct vfs_cap_data *cap;
+- struct vfs_ns_cap_data *nscap;
++ struct vfs_ns_cap_data *nscap = NULL;
+ struct dentry *dentry;
+ struct user_namespace *fs_ns;
+
+@@ -396,46 +397,61 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ fs_ns = inode->i_sb->s_user_ns;
+ cap = (struct vfs_cap_data *) tmpbuf;
+ if (is_v2header((size_t) ret, cap)) {
+- /* If this is sizeof(vfs_cap_data) then we're ok with the
+- * on-disk value, so return that. */
+- if (alloc)
+- *buffer = tmpbuf;
+- else
+- kfree(tmpbuf);
+- return ret;
+- } else if (!is_v3header((size_t) ret, cap)) {
+- kfree(tmpbuf);
+- return -EINVAL;
++ root = 0;
++ } else if (is_v3header((size_t) ret, cap)) {
++ nscap = (struct vfs_ns_cap_data *) tmpbuf;
++ root = le32_to_cpu(nscap->rootid);
++ } else {
++ size = -EINVAL;
++ goto out_free;
+ }
+
+- nscap = (struct vfs_ns_cap_data *) tmpbuf;
+- root = le32_to_cpu(nscap->rootid);
+ kroot = make_kuid(fs_ns, root);
+
+ /* If the root kuid maps to a valid uid in current ns, then return
+ * this as a nscap. */
+ mappedroot = from_kuid(current_user_ns(), kroot);
+ if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
++ size = sizeof(struct vfs_ns_cap_data);
+ if (alloc) {
+- *buffer = tmpbuf;
++ if (!nscap) {
++ /* v2 -> v3 conversion */
++ nscap = kzalloc(size, GFP_ATOMIC);
++ if (!nscap) {
++ size = -ENOMEM;
++ goto out_free;
++ }
++ nsmagic = VFS_CAP_REVISION_3;
++ magic = le32_to_cpu(cap->magic_etc);
++ if (magic & VFS_CAP_FLAGS_EFFECTIVE)
++ nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
++ memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
++ nscap->magic_etc = cpu_to_le32(nsmagic);
++ } else {
++ /* use allocated v3 buffer */
++ tmpbuf = NULL;
++ }
+ nscap->rootid = cpu_to_le32(mappedroot);
+- } else
+- kfree(tmpbuf);
+- return size;
++ *buffer = nscap;
++ }
++ goto out_free;
+ }
+
+ if (!rootid_owns_currentns(kroot)) {
+- kfree(tmpbuf);
+- return -EOPNOTSUPP;
++ size = -EOVERFLOW;
++ goto out_free;
+ }
+
+ /* This comes from a parent namespace. Return as a v2 capability */
+ size = sizeof(struct vfs_cap_data);
+ if (alloc) {
+- *buffer = kmalloc(size, GFP_ATOMIC);
+- if (*buffer) {
+- struct vfs_cap_data *cap = *buffer;
+- __le32 nsmagic, magic;
++ if (nscap) {
++ /* v3 -> v2 conversion */
++ cap = kzalloc(size, GFP_ATOMIC);
++ if (!cap) {
++ size = -ENOMEM;
++ goto out_free;
++ }
+ magic = VFS_CAP_REVISION_2;
+ nsmagic = le32_to_cpu(nscap->magic_etc);
+ if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
+@@ -443,9 +459,12 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+ cap->magic_etc = cpu_to_le32(magic);
+ } else {
+- size = -ENOMEM;
++ /* use unconverted v2 */
++ tmpbuf = NULL;
+ }
++ *buffer = cap;
+ }
++out_free:
+ kfree(tmpbuf);
+ return size;
+ }
+--
+2.27.0
+
--- /dev/null
+From 81aa77c9c4bdcf029b73be3cb90ec9540998215d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:53:15 -0500
+Subject: drm/amd/display: Add more Clock Sources to DCN2.1
+
+From: Sung Lee <sung.lee@amd.com>
+
+[ Upstream commit 1622711beebe887e4f0f8237fea1f09bb48e9a51 ]
+
+[WHY]
+When enabling HDMI on ComboPHY, there are not
+enough clock sources to complete display detection.
+
+[HOW]
+Initialize more clock sources.
+
+Signed-off-by: Sung Lee <sung.lee@amd.com>
+Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index a6d5beada6634..f63cbbee7b337 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -826,6 +826,8 @@ enum dcn20_clk_src_array_id {
+ DCN20_CLK_SRC_PLL0,
+ DCN20_CLK_SRC_PLL1,
+ DCN20_CLK_SRC_PLL2,
++ DCN20_CLK_SRC_PLL3,
++ DCN20_CLK_SRC_PLL4,
+ DCN20_CLK_SRC_TOTAL_DCN21
+ };
+
+@@ -1498,6 +1500,14 @@ static bool construct(
+ dcn21_clock_source_create(ctx, ctx->dc_bios,
+ CLOCK_SOURCE_COMBO_PHY_PLL2,
+ &clk_src_regs[2], false);
++ pool->base.clock_sources[DCN20_CLK_SRC_PLL3] =
++ dcn21_clock_source_create(ctx, ctx->dc_bios,
++ CLOCK_SOURCE_COMBO_PHY_PLL3,
++ &clk_src_regs[3], false);
++ pool->base.clock_sources[DCN20_CLK_SRC_PLL4] =
++ dcn21_clock_source_create(ctx, ctx->dc_bios,
++ CLOCK_SOURCE_COMBO_PHY_PLL4,
++ &clk_src_regs[4], false);
+
+ pool->base.clk_src_count = DCN20_CLK_SRC_TOTAL_DCN21;
+
+--
+2.27.0
+
--- /dev/null
+From 9fe2d98b5d6f1155b5bfb3ced85d23e8e30e0584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:02:48 -0500
+Subject: drm/amd/display: Decrement refcount of dc_sink before reassignment
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 8e92bb0fa75bca9a57e4aba2e36f67d8016a3053 ]
+
+[why]
+An old dc_sink state is causing a memory leak because it is missing a
+dc_sink_release before a new dc_sink is assigned back to
+aconnector->dc_sink.
+
+[how]
+Decrement the dc_sink refcount before reassigning it to a new dc_sink.
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index b4da8d1e4fb87..fbbe611d4873f 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1417,8 +1417,10 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector)
+ * TODO: check if we still need the S3 mode update workaround.
+ * If yes, put it here.
+ */
+- if (aconnector->dc_sink)
++ if (aconnector->dc_sink) {
+ amdgpu_dm_update_freesync_caps(connector, NULL);
++ dc_sink_release(aconnector->dc_sink);
++ }
+
+ aconnector->dc_sink = sink;
+ dc_sink_retain(aconnector->dc_sink);
+--
+2.27.0
+
--- /dev/null
+From 29a5fab9f7189187dbfae86eb947474a0b34db14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 22:24:14 -0500
+Subject: drm/amd/display: Fix dc_sink kref count in emulated_link_detect
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 3ddc818d9bb877c64f5c649beab97af86c403702 ]
+
+[why]
+prev_sink is not used anywhere else in the function and the reference to
+it from dc_link is replaced with a new dc_sink.
+
+[how]
+Change dc_sink_retain(prev_sink) to dc_sink_release(prev_sink).
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index de06ee7d2ad46..3671b3e8f69d8 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1093,8 +1093,8 @@ static void emulated_link_detect(struct dc_link *link)
+ link->type = dc_connection_none;
+ prev_sink = link->local_sink;
+
+- if (prev_sink != NULL)
+- dc_sink_retain(prev_sink);
++ if (prev_sink)
++ dc_sink_release(prev_sink);
+
+ switch (link->connector_signal) {
+ case SIGNAL_TYPE_HDMI_TYPE_A: {
+--
+2.27.0
+
--- /dev/null
+From aa3dcc178256ffc7d0ef67d2147daf44cd5772d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 16:27:07 -0500
+Subject: drm/amd/display: Free atomic state after drm_atomic_commit
+
+From: Victor Lu <victorchengchi.lu@amd.com>
+
+[ Upstream commit 2abaa323d744011982b20b8f3886184d56d23946 ]
+
+[why]
+drm_atomic_commit was changed so that the caller must free their
+drm_atomic_state reference on successes.
+
+[how]
+Add drm_atomic_commit_put after drm_atomic_commit call in
+dm_force_atomic_commit.
+
+Signed-off-by: Victor Lu <victorchengchi.lu@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Acked-by: Anson Jacob <Anson.Jacob@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 3671b3e8f69d8..b4da8d1e4fb87 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6463,14 +6463,14 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+
+ ret = PTR_ERR_OR_ZERO(conn_state);
+ if (ret)
+- goto err;
++ goto out;
+
+ /* Attach crtc to drm_atomic_state*/
+ crtc_state = drm_atomic_get_crtc_state(state, &disconnected_acrtc->base);
+
+ ret = PTR_ERR_OR_ZERO(crtc_state);
+ if (ret)
+- goto err;
++ goto out;
+
+ /* force a restore */
+ crtc_state->mode_changed = true;
+@@ -6480,17 +6480,15 @@ static int dm_force_atomic_commit(struct drm_connector *connector)
+
+ ret = PTR_ERR_OR_ZERO(plane_state);
+ if (ret)
+- goto err;
+-
++ goto out;
+
+ /* Call commit internally with the state we just constructed */
+ ret = drm_atomic_commit(state);
+- if (!ret)
+- return 0;
+
+-err:
+- DRM_ERROR("Restoring old state failed with %i\n", ret);
++out:
+ drm_atomic_state_put(state);
++ if (ret)
++ DRM_ERROR("Restoring old state failed with %i\n", ret);
+
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 8f478c9c9ed7ba3468ac91dbd58daa2acfb5979e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 22:08:22 +0100
+Subject: nvme-pci: ignore the subsysem NQN on Phison E16
+
+From: Claus Stovgaard <claus.stovgaard@gmail.com>
+
+[ Upstream commit c9e95c39280530200cdd0bbd2670e6334a81970b ]
+
+Tested both with Corsairs firmware 11.3 and 13.0 for the Corsairs MP600
+and both have the issue as reported by the kernel.
+
+nvme nvme0: missing or invalid SUBNQN field.
+
+Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 434d3f21f0e13..19e375b59f407 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3147,6 +3147,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */
+ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
+ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++ { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */
++ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ { PCI_DEVICE(0x1d1d, 0x1f1f), /* LighNVM qemu device */
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */
+--
+2.27.0
+
--- /dev/null
+From 383c271f0eef6933e27f75869a6ee8fecc1efeda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 10:22:48 +0100
+Subject: ovl: perform vfs_getxattr() with mounter creds
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 554677b97257b0b69378bd74e521edb7e94769ff ]
+
+The vfs_getxattr() in ovl_xattr_set() is used to check whether an xattr
+exist on a lower layer file that is to be removed. If the xattr does not
+exist, then no need to copy up the file.
+
+This call of vfs_getxattr() wasn't wrapped in credential override, and this
+is probably okay. But for consitency wrap this instance as well.
+
+Reported-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index bb980721502dd..56b55397a7a00 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -337,7 +337,9 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
+ goto out;
+
+ if (!value && !upperdentry) {
++ old_cred = ovl_override_creds(dentry->d_sb);
+ err = vfs_getxattr(realdentry, name, NULL, 0);
++ revert_creds(old_cred);
+ if (err < 0)
+ goto out_drop_write;
+ }
+--
+2.27.0
+
--- /dev/null
+From deab0e2e55a942134759fac3efb3e03800a424fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Dec 2020 12:16:08 +0200
+Subject: ovl: skip getxattr of security labels
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 03fedf93593c82538b18476d8c4f0e8f8435ea70 ]
+
+When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr
+calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will
+intercept in inode_getxattr hooks.
+
+When selinux LSM is installed but not initialized, it will list the
+security.selinux xattr in inode_listsecurity, but will not intercept it
+in inode_getxattr. This results in -ENODATA for a getxattr call for an
+xattr returned by listxattr.
+
+This situation was manifested as overlayfs failure to copy up lower
+files from squashfs when selinux is built-in but not initialized,
+because ovl_copy_xattr() iterates the lower inode xattrs by
+vfs_listxattr() and vfs_getxattr().
+
+ovl_copy_xattr() skips copy up of security labels that are indentified by
+inode_copy_up_xattr LSM hooks, but it does that after vfs_getxattr().
+Since we are not going to copy them, skip vfs_getxattr() of the security
+labels.
+
+Reported-by: Michael Labriola <michael.d.labriola@gmail.com>
+Tested-by: Michael Labriola <michael.d.labriola@gmail.com>
+Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/copy_up.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index ec5eca5a96f41..7b758d623b5bd 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -76,6 +76,14 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
+
+ if (ovl_is_private_xattr(name))
+ continue;
++
++ error = security_inode_copy_up_xattr(name);
++ if (error < 0 && error != -EOPNOTSUPP)
++ break;
++ if (error == 1) {
++ error = 0;
++ continue; /* Discard */
++ }
+ retry:
+ size = vfs_getxattr(old, name, value, value_size);
+ if (size == -ERANGE)
+@@ -99,13 +107,6 @@ retry:
+ goto retry;
+ }
+
+- error = security_inode_copy_up_xattr(name);
+- if (error < 0 && error != -EOPNOTSUPP)
+- break;
+- if (error == 1) {
+- error = 0;
+- continue; /* Discard */
+- }
+ error = vfs_setxattr(new, name, value, size, 0);
+ if (error)
+ break;
+--
+2.27.0
+
--- /dev/null
+From ab54c7f8458fc89809c1114fbb999df269b0a10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 13:49:41 +0100
+Subject: platform/x86: hp-wmi: Disable tablet-mode reporting by default
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 67fbe02a5cebc3c653610f12e3c0424e58450153 ]
+
+Recently userspace has started making more use of SW_TABLET_MODE
+(when an input-dev reports this).
+
+Specifically recent GNOME3 versions will:
+
+1. When SW_TABLET_MODE is reported and is reporting 0:
+1.1 Disable accelerometer-based screen auto-rotation
+1.2 Disable automatically showing the on-screen keyboard when a
+ text-input field is focussed
+
+2. When SW_TABLET_MODE is reported and is reporting 1:
+2.1 Ignore input-events from the builtin keyboard and touchpad
+ (this is for 360° hinges style 2-in-1s where the keyboard and
+ touchpads are accessible on the back of the tablet when folded
+ into tablet-mode)
+
+This means that claiming to support SW_TABLET_MODE when it does not
+actually work / reports correct values has bad side-effects.
+
+The check in the hp-wmi code which is used to decide if the input-dev
+should claim SW_TABLET_MODE support, only checks if the
+HPWMI_HARDWARE_QUERY is supported. It does *not* check if the hardware
+actually is capable of reporting SW_TABLET_MODE.
+
+This leads to the hp-wmi input-dev claiming SW_TABLET_MODE support,
+while in reality it will always report 0 as SW_TABLET_MODE value.
+This has been seen on a "HP ENVY x360 Convertible 15-cp0xxx" and
+this likely is the case on a whole lot of other HP models.
+
+This problem causes both auto-rotation and on-screen keyboard
+support to not work on affected x360 models.
+
+There is no easy fix for this, but since userspace expects
+SW_TABLET_MODE reporting to be reliable when advertised it is
+better to not claim/report SW_TABLET_MODE support at all, then
+to claim to support it while it does not work.
+
+To avoid the mentioned problems, add a new enable_tablet_mode_sw
+module-parameter which defaults to false.
+
+Note I've made this an int using the standard -1=auto, 0=off, 1=on
+triplett, with the hope that in the future we can come up with a
+better way to detect SW_TABLET_MODE support. ATM the default
+auto option just does the same as off.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1918255
+Cc: Stefan Brüns <stefan.bruens@rwth-aachen.de>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mark Gross <mgross@linux.intel.com>
+Link: https://lore.kernel.org/r/20210120124941.73409-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/hp-wmi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
+index a44a2ec332872..63a530a3d9feb 100644
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -32,6 +32,10 @@ MODULE_LICENSE("GPL");
+ MODULE_ALIAS("wmi:95F24279-4D7B-4334-9387-ACCDC67EF61C");
+ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE91-3D44E2C707E4");
+
++static int enable_tablet_mode_sw = -1;
++module_param(enable_tablet_mode_sw, int, 0444);
++MODULE_PARM_DESC(enable_tablet_mode_sw, "Enable SW_TABLET_MODE reporting (-1=auto, 0=no, 1=yes)");
++
+ #define HPWMI_EVENT_GUID "95F24279-4D7B-4334-9387-ACCDC67EF61C"
+ #define HPWMI_BIOS_GUID "5FB7F034-2C63-45e9-BE91-3D44E2C707E4"
+
+@@ -654,10 +658,12 @@ static int __init hp_wmi_input_setup(void)
+ }
+
+ /* Tablet mode */
+- val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
+- if (!(val < 0)) {
+- __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
+- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++ if (enable_tablet_mode_sw > 0) {
++ val = hp_wmi_hw_state(HPWMI_TABLET_MASK);
++ if (val >= 0) {
++ __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit);
++ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val);
++ }
+ }
+
+ err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL);
+--
+2.27.0
+
--- /dev/null
+From 643393054c0c360f8e6750f56c64549fcfc225e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 12:31:05 -0500
+Subject: riscv: virt_addr_valid must check the address belongs to linear
+ mapping
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit 2ab543823322b564f205cb15d0f0302803c87d11 ]
+
+virt_addr_valid macro checks that a virtual address is valid, ie that
+the address belongs to the linear mapping and that the corresponding
+ physical page exists.
+
+Add the missing check that ensures the virtual address belongs to the
+linear mapping, otherwise __virt_to_phys, when compiled with
+CONFIG_DEBUG_VIRTUAL enabled, raises a WARN that is interpreted as a
+kernel bug by syzbot.
+
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Reviewed-by: Atish Patra <atish.patra@wdc.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/page.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/page.h b/arch/riscv/include/asm/page.h
+index 3db261c4810fc..6a30794aa1eea 100644
+--- a/arch/riscv/include/asm/page.h
++++ b/arch/riscv/include/asm/page.h
+@@ -119,7 +119,10 @@ extern unsigned long min_low_pfn;
+
+ #endif /* __ASSEMBLY__ */
+
+-#define virt_addr_valid(vaddr) (pfn_valid(virt_to_pfn(vaddr)))
++#define virt_addr_valid(vaddr) ({ \
++ unsigned long _addr = (unsigned long)vaddr; \
++ (unsigned long)(_addr) >= PAGE_OFFSET && pfn_valid(virt_to_pfn(_addr)); \
++})
+
+ #define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | \
+ VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+--
+2.27.0
+
tracing-check-length-before-giving-out-the-filter-buffer.patch
arm-xen-don-t-probe-xenbus-as-part-of-an-early-initcall.patch
cgroup-fix-psi-monitor-for-root-cgroup.patch
+arm64-dts-rockchip-fix-pcie-dt-properties-on-rk3399.patch
+arm64-dts-qcom-sdm845-reserve-lpass-clocks-in-gcc.patch
+arm-omap2-fix-suspcious-rcu-usage-splats-for-omap_en.patch
+platform-x86-hp-wmi-disable-tablet-mode-reporting-by.patch
+ovl-perform-vfs_getxattr-with-mounter-creds.patch
+cap-fix-conversions-on-getxattr.patch
+ovl-skip-getxattr-of-security-labels.patch
+nvme-pci-ignore-the-subsysem-nqn-on-phison-e16.patch
+drm-amd-display-add-more-clock-sources-to-dcn2.1.patch
+drm-amd-display-fix-dc_sink-kref-count-in-emulated_l.patch
+drm-amd-display-free-atomic-state-after-drm_atomic_c.patch
+drm-amd-display-decrement-refcount-of-dc_sink-before.patch
+riscv-virt_addr_valid-must-check-the-address-belongs.patch
+bfq-iosched-revert-bfq-fix-computation-of-shallow-de.patch
+arm-dts-lpc32xx-revert-set-default-clock-rate-of-hcl.patch
+arm-ensure-the-signal-page-contains-defined-contents.patch
+arm-kexec-fix-oops-after-tlb-are-invalidated.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
