--- /dev/null
+From 1a22115ad7e591a3b72b2f07de57d8d10284c046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 11:49:09 -0500
+Subject: ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit d50313a5a0d803bcf55121a2b82086633060d05e ]
+
+Mirror PCI ids used for SOF.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200617164909.18225-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 41a03c61a74b3..11ec5c56c80e9 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2470,6 +2470,9 @@ static const struct pci_device_id azx_ids[] = {
+ /* Icelake */
+ { PCI_DEVICE(0x8086, 0x34c8),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++ /* Icelake-H */
++ { PCI_DEVICE(0x8086, 0x3dc8),
++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ /* Jasperlake */
+ { PCI_DEVICE(0x8086, 0x38c8),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+@@ -2478,9 +2481,14 @@ static const struct pci_device_id azx_ids[] = {
+ /* Tigerlake */
+ { PCI_DEVICE(0x8086, 0xa0c8),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++ /* Tigerlake-H */
++ { PCI_DEVICE(0x8086, 0x43c8),
++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ /* Elkhart Lake */
+ { PCI_DEVICE(0x8086, 0x4b55),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++ { PCI_DEVICE(0x8086, 0x4b58),
++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ /* Broxton-P(Apollolake) */
+ { PCI_DEVICE(0x8086, 0x5a98),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },
+--
+2.25.1
+
--- /dev/null
+From a55168dbd70dc8996e4768b9d7c3fdc77344fb45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 17:18:56 -0700
+Subject: ARM: dts: omap4-droid4: Fix spi configuration and increase rate
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 0df12a01f4857495816b05f048c4c31439446e35 ]
+
+We can currently sometimes get "RXS timed out" errors and "EOT timed out"
+errors with spi transfers.
+
+These errors can be made easy to reproduce by reading the cpcap iio
+values in a loop while keeping the CPUs busy by also reading /dev/urandom.
+
+The "RXS timed out" errors we can fix by adding spi-cpol and spi-cpha
+in addition to the spi-cs-high property we already have.
+
+The "EOT timed out" errors we can fix by increasing the spi clock rate
+to 9.6 MHz. Looks similar MC13783 PMIC says it works at spi clock rates
+up to 20 MHz, so let's assume we can pick any rate up to 20 MHz also
+for cpcap.
+
+Cc: maemo-leste@lists.dyne.org
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+index e39eee628afd6..08a7d3ce383f2 100644
+--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi
+@@ -13,8 +13,10 @@
+ #interrupt-cells = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+- spi-max-frequency = <3000000>;
++ spi-max-frequency = <9600000>;
+ spi-cs-high;
++ spi-cpol;
++ spi-cpha;
+
+ cpcap_adc: adc {
+ compatible = "motorola,mapphone-cpcap-adc";
+--
+2.25.1
+
--- /dev/null
+From 27d2d98e0b6475127d964d3cc7f87129e5556e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jun 2020 20:54:49 +0800
+Subject: ARM: imx6: add missing put_device() call in imx6q_suspend_init()
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit 4845446036fc9c13f43b54a65c9b757c14f5141b ]
+
+if of_find_device_by_node() succeed, imx6q_suspend_init() doesn't have a
+corresponding put_device(). Thus add a jump target to fix the exception
+handling for this function implementation.
+
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/pm-imx6.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
+index dd34dff137626..40c74b4c4d730 100644
+--- a/arch/arm/mach-imx/pm-imx6.c
++++ b/arch/arm/mach-imx/pm-imx6.c
+@@ -493,14 +493,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ if (!ocram_pool) {
+ pr_warn("%s: ocram pool unavailable!\n", __func__);
+ ret = -ENODEV;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_base = gen_pool_alloc(ocram_pool, MX6Q_SUSPEND_OCRAM_SIZE);
+ if (!ocram_base) {
+ pr_warn("%s: unable to alloc ocram!\n", __func__);
+ ret = -ENOMEM;
+- goto put_node;
++ goto put_device;
+ }
+
+ ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base);
+@@ -523,7 +523,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ ret = imx6_pm_get_base(&pm_info->mmdc_base, socdata->mmdc_compat);
+ if (ret) {
+ pr_warn("%s: failed to get mmdc base %d!\n", __func__, ret);
+- goto put_node;
++ goto put_device;
+ }
+
+ ret = imx6_pm_get_base(&pm_info->src_base, socdata->src_compat);
+@@ -570,7 +570,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata)
+ &imx6_suspend,
+ MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info));
+
+- goto put_node;
++ goto put_device;
+
+ pl310_cache_map_failed:
+ iounmap(pm_info->gpc_base.vbase);
+@@ -580,6 +580,8 @@ iomuxc_map_failed:
+ iounmap(pm_info->src_base.vbase);
+ src_map_failed:
+ iounmap(pm_info->mmdc_base.vbase);
++put_device:
++ put_device(&pdev->dev);
+ put_node:
+ of_node_put(node);
+
+--
+2.25.1
+
--- /dev/null
+From f621222cb0413dfb19ed6cccdd783778dd482bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 16:01:23 +0530
+Subject: arm64: Add KRYO{3,4}XX silver CPU cores to SSB safelist
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit 108447fd0d1a34b0929cd26dc637c917a734ebab ]
+
+QCOM KRYO{3,4}XX silver/LITTLE CPU cores are based on
+Cortex-A55 and are SSB safe, hence add them to SSB
+safelist -> arm64_ssb_cpus[].
+
+Reported-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200625103123.7240-1-saiprakash.ranjan@codeaurora.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpu_errata.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index df56d2295d165..0f37045fafab3 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -460,6 +460,8 @@ static const struct midr_range arm64_ssb_cpus[] = {
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
+ MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53),
++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_3XX_SILVER),
++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_SILVER),
+ {},
+ };
+
+--
+2.25.1
+
--- /dev/null
+From d7cdefad042d431ff4f58954eb5643cf558d8d77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 18:04:06 +0530
+Subject: arm64: kpti: Add KRYO{3, 4}XX silver CPU cores to kpti safelist
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit f4617be35b4b547e82d30993f56d631dfc2d5f88 ]
+
+QCOM KRYO{3,4}XX silver/LITTLE CPU cores are based on Cortex-A55
+and are meltdown safe, hence add them to kpti_safe_list[].
+
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Link: https://lore.kernel.org/r/20200624123406.3472-1-saiprakash.ranjan@codeaurora.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpufeature.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index 9fac745aa7bb2..b0fb1d5bf2235 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -1059,6 +1059,8 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
+ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110),
+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_CARMEL),
++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_3XX_SILVER),
++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_SILVER),
+ { /* sentinel */ }
+ };
+ char const *str = "kpti command line option";
+--
+2.25.1
+
--- /dev/null
+From 5e1999e997b43c4e9e3b9bb2d2e326692ef8449c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 11:41:44 -0500
+Subject: ASoC: hdac_hda: fix memleak with regmap not freed on remove
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit a94eaccefea1186947c5c5451fcae2245dd7e714 ]
+
+kmemleak throws error reports on module load/unload tests, add
+snd_hdac_regmap_exit() in .remove().
+
+While we are at it, also fix the error handling flow in .probe() to
+use snd_hdac_regmap_exit() if needed.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Daniel Baluta <daniel.baluta@gmail.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20200617164144.17859-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hda.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
+index de003acb1951f..473efe9ef998a 100644
+--- a/sound/soc/codecs/hdac_hda.c
++++ b/sound/soc/codecs/hdac_hda.c
+@@ -441,13 +441,13 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
+ ret = snd_hda_codec_set_name(hcodec, hcodec->preset->name);
+ if (ret < 0) {
+ dev_err(&hdev->dev, "name failed %s\n", hcodec->preset->name);
+- goto error;
++ goto error_pm;
+ }
+
+ ret = snd_hdac_regmap_init(&hcodec->core);
+ if (ret < 0) {
+ dev_err(&hdev->dev, "regmap init failed\n");
+- goto error;
++ goto error_pm;
+ }
+
+ patch = (hda_codec_patch_t)hcodec->preset->driver_data;
+@@ -455,7 +455,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
+ ret = patch(hcodec);
+ if (ret < 0) {
+ dev_err(&hdev->dev, "patch failed %d\n", ret);
+- goto error;
++ goto error_regmap;
+ }
+ } else {
+ dev_dbg(&hdev->dev, "no patch file found\n");
+@@ -467,7 +467,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
+ ret = snd_hda_codec_parse_pcms(hcodec);
+ if (ret < 0) {
+ dev_err(&hdev->dev, "unable to map pcms to dai %d\n", ret);
+- goto error;
++ goto error_regmap;
+ }
+
+ /* HDMI controls need to be created in machine drivers */
+@@ -476,7 +476,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
+ if (ret < 0) {
+ dev_err(&hdev->dev, "unable to create controls %d\n",
+ ret);
+- goto error;
++ goto error_regmap;
+ }
+ }
+
+@@ -496,7 +496,9 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)
+
+ return 0;
+
+-error:
++error_regmap:
++ snd_hdac_regmap_exit(hdev);
++error_pm:
+ pm_runtime_put(&hdev->dev);
+ error_no_pm:
+ snd_hdac_ext_bus_link_put(hdev->bus, hlink);
+@@ -518,6 +520,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
+
+ pm_runtime_disable(&hdev->dev);
+ snd_hdac_ext_bus_link_put(hdev->bus, hlink);
++
++ snd_hdac_regmap_exit(hdev);
+ }
+
+ static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
+--
+2.25.1
+
--- /dev/null
+From e221cdf9c5e80e7167ab3bec65c3efc2df1995ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 11:47:54 -0500
+Subject: ASoC: SOF: Intel: add PCI ID for CometLake-S
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 258fb4f4c34a0db9d3834aba6784d7b322176bb9 ]
+
+Mirror ID added for legacy HDaudio
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200617164755.18104-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/sof-pci-dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
+index cec631a1389b5..7b1846aeadd59 100644
+--- a/sound/soc/sof/sof-pci-dev.c
++++ b/sound/soc/sof/sof-pci-dev.c
+@@ -427,6 +427,8 @@ static const struct pci_device_id sof_pci_ids[] = {
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_COMETLAKE_H)
+ { PCI_DEVICE(0x8086, 0x06c8),
+ .driver_data = (unsigned long)&cml_desc},
++ { PCI_DEVICE(0x8086, 0xa3f0), /* CML-S */
++ .driver_data = (unsigned long)&cml_desc},
+ #endif
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_TIGERLAKE)
+ { PCI_DEVICE(0x8086, 0xa0c8),
+--
+2.25.1
+
--- /dev/null
+From dd7416b8667f7e5e773e0892fd3658d70abff06e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 18:21:39 +0800
+Subject: block: release bip in a right way in error path
+
+From: Chengguang Xu <cgxu519@mykernel.net>
+
+[ Upstream commit 0b8eb629a700c0ef15a437758db8255f8444e76c ]
+
+Release bip using kfree() in error path when that was allocated
+by kmalloc().
+
+Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio-integrity.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index ae07dd78e9518..c9dc2b17ce251 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -24,6 +24,18 @@ void blk_flush_integrity(void)
+ flush_workqueue(kintegrityd_wq);
+ }
+
++void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip)
++{
++ if (bs && mempool_initialized(&bs->bio_integrity_pool)) {
++ if (bip->bip_vec)
++ bvec_free(&bs->bvec_integrity_pool, bip->bip_vec,
++ bip->bip_slab);
++ mempool_free(bip, &bs->bio_integrity_pool);
++ } else {
++ kfree(bip);
++ }
++}
++
+ /**
+ * bio_integrity_alloc - Allocate integrity payload and attach it to bio
+ * @bio: bio to attach integrity metadata to
+@@ -75,7 +87,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
+
+ return bip;
+ err:
+- mempool_free(bip, &bs->bio_integrity_pool);
++ __bio_integrity_free(bs, bip);
+ return ERR_PTR(-ENOMEM);
+ }
+ EXPORT_SYMBOL(bio_integrity_alloc);
+@@ -96,14 +108,7 @@ void bio_integrity_free(struct bio *bio)
+ kfree(page_address(bip->bip_vec->bv_page) +
+ bip->bip_vec->bv_offset);
+
+- if (bs && mempool_initialized(&bs->bio_integrity_pool)) {
+- bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, bip->bip_slab);
+-
+- mempool_free(bip, &bs->bio_integrity_pool);
+- } else {
+- kfree(bip);
+- }
+-
++ __bio_integrity_free(bs, bip);
+ bio->bi_integrity = NULL;
+ bio->bi_opf &= ~REQ_INTEGRITY;
+ }
+--
+2.25.1
+
--- /dev/null
+From 852e517313a1deb45f30dd9ed166837543b13321 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 22:51:29 -0400
+Subject: cifs: update ctime and mtime during truncate
+
+From: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+
+[ Upstream commit 5618303d8516f8ac5ecfe53ee8e8bc9a40eaf066 ]
+
+As the man description of the truncate, if the size changed,
+then the st_ctime and st_mtime fields should be updated. But
+in cifs, we doesn't do it.
+
+It lead the xfstests generic/313 failed.
+
+So, add the ATTR_MTIME|ATTR_CTIME flags on attrs when change
+the file size
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5@huawei.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/inode.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 430b0b1256547..44a57b65915bf 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -2350,6 +2350,15 @@ set_size_out:
+ if (rc == 0) {
+ cifsInode->server_eof = attrs->ia_size;
+ cifs_setsize(inode, attrs->ia_size);
++
++ /*
++ * The man page of truncate says if the size changed,
++ * then the st_ctime and st_mtime fields for the file
++ * are updated.
++ */
++ attrs->ia_ctime = attrs->ia_mtime = current_time(inode);
++ attrs->ia_valid |= ATTR_CTIME | ATTR_MTIME;
++
+ cifs_truncate_page(inode->i_mapping, inode->i_size);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 621357d6dbdb0e9794be5fc9f504650dda96c8f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jun 2020 00:30:26 +0200
+Subject: drm: mcde: Fix display initialization problem
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit b984b6d8b52372b98cce0a6ff6c2787f50665b87 ]
+
+The following bug appeared in the MCDE driver/display
+initialization during the recent merge window.
+
+First the place we call drm_fbdev_generic_setup() in the
+wrong place: this needs to be called AFTER calling
+drm_dev_register() else we get this splat:
+
+ ------------[ cut here ]------------
+WARNING: CPU: 0 PID: 1 at ../drivers/gpu/drm/drm_fb_helper.c:2198 drm_fbdev_generic_setup+0x164/0x1a8
+mcde a0350000.mcde: Device has not been registered.
+Modules linked in:
+Hardware name: ST-Ericsson Ux5x0 platform (Device Tree Support)
+[<c010e704>] (unwind_backtrace) from [<c010a86c>] (show_stack+0x10/0x14)
+[<c010a86c>] (show_stack) from [<c0414f38>] (dump_stack+0x9c/0xb0)
+[<c0414f38>] (dump_stack) from [<c0121c8c>] (__warn+0xb8/0xd0)
+[<c0121c8c>] (__warn) from [<c0121d18>] (warn_slowpath_fmt+0x74/0xb8)
+[<c0121d18>] (warn_slowpath_fmt) from [<c04b154c>] (drm_fbdev_generic_setup+0x164/0x1a8)
+[<c04b154c>] (drm_fbdev_generic_setup) from [<c04ed278>] (mcde_drm_bind+0xc4/0x160)
+[<c04ed278>] (mcde_drm_bind) from [<c04f06b8>] (try_to_bring_up_master+0x15c/0x1a4)
+(...)
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200613223027.4189309-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mcde/mcde_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c
+index f28cb7a576ba4..1e7c5aa4d5e62 100644
+--- a/drivers/gpu/drm/mcde/mcde_drv.c
++++ b/drivers/gpu/drm/mcde/mcde_drv.c
+@@ -208,7 +208,6 @@ static int mcde_modeset_init(struct drm_device *drm)
+
+ drm_mode_config_reset(drm);
+ drm_kms_helper_poll_init(drm);
+- drm_fbdev_generic_setup(drm, 32);
+
+ return 0;
+
+@@ -275,6 +274,8 @@ static int mcde_drm_bind(struct device *dev)
+ if (ret < 0)
+ goto unbind;
+
++ drm_fbdev_generic_setup(drm, 32);
++
+ return 0;
+
+ unbind:
+--
+2.25.1
+
--- /dev/null
+From 1ad4f85150020750598bb44b2621ba60fe310c7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 11:30:24 +0200
+Subject: drm: panel-orientation-quirks: Add quirk for Asus T101HA panel
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 6c22bc18a3b93a38018844636557ad02e588e055 ]
+
+Like the Asus T100HA the Asus T101HA also uses a panel which has been
+mounted 90 degrees rotated, albeit in the opposite direction.
+Add a quirk for this.
+
+Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index ffd95bfeaa94c..d11d83703931e 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+ },
+ .driver_data = (void *)&asus_t100ha,
++ }, { /* Asus T101HA */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
++ },
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* GPD MicroPC (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+--
+2.25.1
+
--- /dev/null
+From d5ebde6b80387672088c4cc56f2b5b9e68d79426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 11:30:25 +0200
+Subject: drm: panel-orientation-quirks: Use generic orientation-data for Acer
+ S1003
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a05caf9e62a85d12da27e814ac13195f4683f21c ]
+
+The Acer S1003 has proper DMI strings for sys-vendor and product-name,
+so we do not need to match by BIOS-date.
+
+This means that the Acer S1003 can use the generic lcd800x1280_rightside_up
+drm_dmi_panel_orientation_data struct which is also used by other quirks.
+
+Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index d11d83703931e..d00ea384dcbfe 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
+-static const struct drm_dmi_panel_orientation_data acer_s1003 = {
+- .width = 800,
+- .height = 1280,
+- .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+-};
+-
+ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .width = 800,
+ .height = 1280,
+@@ -114,7 +108,7 @@ static const struct dmi_system_id orientation_data[] = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
+ },
+- .driver_data = (void *)&acer_s1003,
++ .driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+--
+2.25.1
+
--- /dev/null
+From 82a87aa81e6d34b1ad892f827cd937b04a2944ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 May 2020 16:07:24 +0200
+Subject: drm/sun4i: mixer: Call of_dma_configure if there's an IOMMU
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 842ec61f4006a6477a9deaedd69131e9f46e4cb5 ]
+
+The main DRM device is actually a virtual device so it doesn't have the
+iommus property, which is instead on the DMA masters, in this case the
+mixers.
+
+Add a call to of_dma_configure with the mixers DT node but on the DRM
+virtual device to configure it in the same way than the mixers.
+
+Reviewed-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/9a4daf438dd3f2fe07afb23688bfb793a0613d7d.1589378833.git-series.maxime@cerno.tech
+(cherry picked from commit b718102dbdfd0285ad559687a30e27cc9124e592)
+[Maxime: Applied to -fixes since it missed the merge window and display is
+ broken without it]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_mixer.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+index 4a64f7ae437a8..19b3b41847046 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c
+@@ -452,6 +452,19 @@ static int sun8i_mixer_bind(struct device *dev, struct device *master,
+ mixer->engine.ops = &sun8i_engine_ops;
+ mixer->engine.node = dev->of_node;
+
++ if (of_find_property(dev->of_node, "iommus", NULL)) {
++ /*
++ * This assume we have the same DMA constraints for
++ * all our the mixers in our pipeline. This sounds
++ * bad, but it has always been the case for us, and
++ * DRM doesn't do per-device allocation either, so we
++ * would need to fix DRM first...
++ */
++ ret = of_dma_configure(drm->dev, dev->of_node, true);
++ if (ret)
++ return ret;
++ }
++
+ /*
+ * While this function can fail, we shouldn't do anything
+ * if this happens. Some early DE2 DT entries don't provide
+--
+2.25.1
+
--- /dev/null
+From 31a23e8d192bf9df138d37446db204909e959d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 May 2020 02:03:01 -0700
+Subject: drm/tegra: hub: Do not enable orphaned window group
+
+From: Nicolin Chen <nicoleotsuka@gmail.com>
+
+[ Upstream commit ef4e417eb3ec7fe657928f10ac1d2154d8a5fb38 ]
+
+Though the unconditional enable/disable code is not a final solution,
+we don't want to run into a NULL pointer situation when window group
+doesn't link to its DC parent if the DC is disabled in Device Tree.
+
+So this patch simply adds a check to make sure that window group has
+a valid parent before running into tegra_windowgroup_enable/disable.
+
+Signed-off-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hub.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
+index 8183e617bf6b8..a2ef8f218d4ec 100644
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -149,7 +149,9 @@ int tegra_display_hub_prepare(struct tegra_display_hub *hub)
+ for (i = 0; i < hub->soc->num_wgrps; i++) {
+ struct tegra_windowgroup *wgrp = &hub->wgrps[i];
+
+- tegra_windowgroup_enable(wgrp);
++ /* Skip orphaned window group whose parent DC is disabled */
++ if (wgrp->parent)
++ tegra_windowgroup_enable(wgrp);
+ }
+
+ return 0;
+@@ -166,7 +168,9 @@ void tegra_display_hub_cleanup(struct tegra_display_hub *hub)
+ for (i = 0; i < hub->soc->num_wgrps; i++) {
+ struct tegra_windowgroup *wgrp = &hub->wgrps[i];
+
+- tegra_windowgroup_disable(wgrp);
++ /* Skip orphaned window group whose parent DC is disabled */
++ if (wgrp->parent)
++ tegra_windowgroup_disable(wgrp);
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 3ae84d73b1e386e4e50a02679cb5838b6571c6a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:28:38 +0800
+Subject: drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit 37cc4b95d13f311c04aa8e9daacca3905ad45ca7 ]
+
+ttm_bo_vm_fault_reserved() invokes dma_fence_get(), which returns a
+reference of the specified dma_fence object to "moving" with increased
+refcnt.
+
+When ttm_bo_vm_fault_reserved() returns, local variable "moving" becomes
+invalid, so the refcount should be decreased to keep refcount balanced.
+
+The reference counting issue happens in several exception handling paths
+of ttm_bo_vm_fault_reserved(). When those error scenarios occur such as
+"err" equals to -EBUSY, the function forgets to decrease the refcnt
+increased by dma_fence_get(), causing a refcnt leak.
+
+Fix this issue by calling dma_fence_put() when no_wait_gpu flag is
+equals to true.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/370219/
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo_vm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 0ad30b1129821..72100b84c7a90 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -300,8 +300,10 @@ vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf,
+ break;
+ case -EBUSY:
+ case -ERESTARTSYS:
++ dma_fence_put(moving);
+ return VM_FAULT_NOPAGE;
+ default:
++ dma_fence_put(moving);
+ return VM_FAULT_SIGBUS;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 317e68dc36073f373a6dd2a95b72d19202c3f97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 20:30:25 +0800
+Subject: drm/ttm: Fix dma_fence refcnt leak when adding move fence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit 11425c4519e2c974a100fc984867046d905b9380 ]
+
+ttm_bo_add_move_fence() invokes dma_fence_get(), which returns a
+reference of the specified dma_fence object to "fence" with increased
+refcnt.
+
+When ttm_bo_add_move_fence() returns, local variable "fence" becomes
+invalid, so the refcount should be decreased to keep refcount balanced.
+
+The reference counting issue happens in one exception handling path of
+ttm_bo_add_move_fence(). When no_wait_gpu flag is equals to true, the
+function forgets to decrease the refcnt increased by dma_fence_get(),
+causing a refcnt leak.
+
+Fix this issue by calling dma_fence_put() when no_wait_gpu flag is
+equals to true.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/370221/
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 9e07c3f75156b..ef5bc00c73e23 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -881,8 +881,10 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo,
+ if (!fence)
+ return 0;
+
+- if (no_wait_gpu)
++ if (no_wait_gpu) {
++ dma_fence_put(fence);
+ return -EBUSY;
++ }
+
+ dma_resv_add_shared_fence(bo->base.resv, fence);
+
+--
+2.25.1
+
--- /dev/null
+From eb8cd7ec8fd29c05cc565a39c4bac92ea9c4a48b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Apr 2020 21:16:30 +0200
+Subject: gpu: host1x: Clean up debugfs in error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 109be8b23fb2ec8e2d309325ee3b7a49eab63961 ]
+
+host1x_debug_init() must be reverted in an error handling path.
+
+This is already fixed in the remove function since commit 44156eee91ba
+("gpu: host1x: Clean up debugfs on removal")
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/dev.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
+index d24344e919227..3c0f151847bae 100644
+--- a/drivers/gpu/host1x/dev.c
++++ b/drivers/gpu/host1x/dev.c
+@@ -468,11 +468,12 @@ static int host1x_probe(struct platform_device *pdev)
+
+ err = host1x_register(host);
+ if (err < 0)
+- goto deinit_intr;
++ goto deinit_debugfs;
+
+ return 0;
+
+-deinit_intr:
++deinit_debugfs:
++ host1x_debug_deinit(host);
+ host1x_intr_deinit(host);
+ deinit_syncpt:
+ host1x_syncpt_deinit(host);
+--
+2.25.1
+
--- /dev/null
+From 5730b6145b35cee47cae2cf5b654e50c5195fd6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Apr 2020 19:38:02 +0200
+Subject: gpu: host1x: Detach driver on unregister
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit d9a0a05bf8c76e6dc79230669a8b5d685b168c30 ]
+
+Currently when a host1x device driver is unregistered, it is not
+detached from the host1x controller, which means that the device
+will stay around and when the driver is registered again, it may
+bind to the old, stale device rather than the new one that was
+created from scratch upon driver registration. This in turn can
+cause various weird crashes within the driver core because it is
+confronted with a device that was already deleted.
+
+Fix this by detaching the driver from the host1x controller when
+it is unregistered. This ensures that the deleted device also is
+no longer present in the device list that drivers will bind to.
+
+Reported-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/bus.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c
+index 6a995db51d6d8..e201f62d62c0c 100644
+--- a/drivers/gpu/host1x/bus.c
++++ b/drivers/gpu/host1x/bus.c
+@@ -686,8 +686,17 @@ EXPORT_SYMBOL(host1x_driver_register_full);
+ */
+ void host1x_driver_unregister(struct host1x_driver *driver)
+ {
++ struct host1x *host1x;
++
+ driver_unregister(&driver->driver);
+
++ mutex_lock(&devices_lock);
++
++ list_for_each_entry(host1x, &devices, list)
++ host1x_detach_driver(host1x, driver);
++
++ mutex_unlock(&devices_lock);
++
+ mutex_lock(&drivers_lock);
+ list_del_init(&driver->list);
+ mutex_unlock(&drivers_lock);
+--
+2.25.1
+
--- /dev/null
+From 5977d30803884c9d4081189172ff0610f4d9561f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 13:19:44 +0000
+Subject: i40e: protect ring accesses with READ- and WRITE_ONCE
+
+From: Ciara Loftus <ciara.loftus@intel.com>
+
+[ Upstream commit d59e267912cd90b0adf33b4659050d831e746317 ]
+
+READ_ONCE should be used when reading rings prior to accessing the
+statistics pointer. Introduce this as well as the corresponding WRITE_ONCE
+usage when allocating and freeing the rings, to ensure protected access.
+
+Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 29 ++++++++++++++-------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 2a037ec244b94..80dc5fcb82db7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -439,11 +439,15 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev,
+ i40e_get_netdev_stats_struct_tx(ring, stats);
+
+ if (i40e_enabled_xdp_vsi(vsi)) {
+- ring++;
++ ring = READ_ONCE(vsi->xdp_rings[i]);
++ if (!ring)
++ continue;
+ i40e_get_netdev_stats_struct_tx(ring, stats);
+ }
+
+- ring++;
++ ring = READ_ONCE(vsi->rx_rings[i]);
++ if (!ring)
++ continue;
+ do {
+ start = u64_stats_fetch_begin_irq(&ring->syncp);
+ packets = ring->stats.packets;
+@@ -787,6 +791,8 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
+ for (q = 0; q < vsi->num_queue_pairs; q++) {
+ /* locate Tx ring */
+ p = READ_ONCE(vsi->tx_rings[q]);
++ if (!p)
++ continue;
+
+ do {
+ start = u64_stats_fetch_begin_irq(&p->syncp);
+@@ -800,8 +806,11 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi)
+ tx_linearize += p->tx_stats.tx_linearize;
+ tx_force_wb += p->tx_stats.tx_force_wb;
+
+- /* Rx queue is part of the same block as Tx queue */
+- p = &p[1];
++ /* locate Rx ring */
++ p = READ_ONCE(vsi->rx_rings[q]);
++ if (!p)
++ continue;
++
+ do {
+ start = u64_stats_fetch_begin_irq(&p->syncp);
+ packets = p->stats.packets;
+@@ -10816,10 +10825,10 @@ static void i40e_vsi_clear_rings(struct i40e_vsi *vsi)
+ if (vsi->tx_rings && vsi->tx_rings[0]) {
+ for (i = 0; i < vsi->alloc_queue_pairs; i++) {
+ kfree_rcu(vsi->tx_rings[i], rcu);
+- vsi->tx_rings[i] = NULL;
+- vsi->rx_rings[i] = NULL;
++ WRITE_ONCE(vsi->tx_rings[i], NULL);
++ WRITE_ONCE(vsi->rx_rings[i], NULL);
+ if (vsi->xdp_rings)
+- vsi->xdp_rings[i] = NULL;
++ WRITE_ONCE(vsi->xdp_rings[i], NULL);
+ }
+ }
+ }
+@@ -10853,7 +10862,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
+ if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE)
+ ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
+ ring->itr_setting = pf->tx_itr_default;
+- vsi->tx_rings[i] = ring++;
++ WRITE_ONCE(vsi->tx_rings[i], ring++);
+
+ if (!i40e_enabled_xdp_vsi(vsi))
+ goto setup_rx;
+@@ -10871,7 +10880,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi)
+ ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;
+ set_ring_xdp(ring);
+ ring->itr_setting = pf->tx_itr_default;
+- vsi->xdp_rings[i] = ring++;
++ WRITE_ONCE(vsi->xdp_rings[i], ring++);
+
+ setup_rx:
+ ring->queue_index = i;
+@@ -10884,7 +10893,7 @@ setup_rx:
+ ring->size = 0;
+ ring->dcb_tc = 0;
+ ring->itr_setting = pf->rx_itr_default;
+- vsi->rx_rings[i] = ring;
++ WRITE_ONCE(vsi->rx_rings[i], ring);
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From e857e651a508bceb4b8a618c0638c1e2601d2b83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 15:24:13 -0400
+Subject: ibmvnic: continue to init in CRQ reset returns H_CLOSED
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit 8b40eb73509f5704a0e8cd25de0163876299f1a7 ]
+
+Continue the reset path when partner adapter is not ready or H_CLOSED is
+returned from reset crq. This patch allows the CRQ init to proceed to
+establish a valid CRQ for traffic to flow after reset.
+
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2baf7b3ff4cbf..0fd7eae25fe9d 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1971,13 +1971,18 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ release_sub_crqs(adapter, 1);
+ } else {
+ rc = ibmvnic_reset_crq(adapter);
+- if (!rc)
++ if (rc == H_CLOSED || rc == H_SUCCESS) {
+ rc = vio_enable_interrupts(adapter->vdev);
++ if (rc)
++ netdev_err(adapter->netdev,
++ "Reset failed to enable interrupts. rc=%d\n",
++ rc);
++ }
+ }
+
+ if (rc) {
+ netdev_err(adapter->netdev,
+- "Couldn't initialize crq. rc=%d\n", rc);
++ "Reset couldn't initialize crq. rc=%d\n", rc);
+ goto out;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a73b0e5543be4b400610a401c6c66538160a3e7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 13:19:45 +0000
+Subject: ice: protect ring accesses with WRITE_ONCE
+
+From: Ciara Loftus <ciara.loftus@intel.com>
+
+[ Upstream commit b1d95cc2391ffac0c5b27256a4fb0d2cfb021a29 ]
+
+The READ_ONCE macro is used when reading rings prior to accessing the
+statistics pointer. The corresponding WRITE_ONCE usage when allocating and
+freeing the rings to ensure protected access was not in place. Introduce
+this.
+
+Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 8 ++++----
+ drivers/net/ethernet/intel/ice/ice_main.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index 2f256bf45efcf..6dd839b325259 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -1063,7 +1063,7 @@ static void ice_vsi_clear_rings(struct ice_vsi *vsi)
+ for (i = 0; i < vsi->alloc_txq; i++) {
+ if (vsi->tx_rings[i]) {
+ kfree_rcu(vsi->tx_rings[i], rcu);
+- vsi->tx_rings[i] = NULL;
++ WRITE_ONCE(vsi->tx_rings[i], NULL);
+ }
+ }
+ }
+@@ -1071,7 +1071,7 @@ static void ice_vsi_clear_rings(struct ice_vsi *vsi)
+ for (i = 0; i < vsi->alloc_rxq; i++) {
+ if (vsi->rx_rings[i]) {
+ kfree_rcu(vsi->rx_rings[i], rcu);
+- vsi->rx_rings[i] = NULL;
++ WRITE_ONCE(vsi->rx_rings[i], NULL);
+ }
+ }
+ }
+@@ -1104,7 +1104,7 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi)
+ ring->vsi = vsi;
+ ring->dev = dev;
+ ring->count = vsi->num_tx_desc;
+- vsi->tx_rings[i] = ring;
++ WRITE_ONCE(vsi->tx_rings[i], ring);
+ }
+
+ /* Allocate Rx rings */
+@@ -1123,7 +1123,7 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi)
+ ring->netdev = vsi->netdev;
+ ring->dev = dev;
+ ring->count = vsi->num_rx_desc;
+- vsi->rx_rings[i] = ring;
++ WRITE_ONCE(vsi->rx_rings[i], ring);
+ }
+
+ return 0;
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 69e50331e08e9..7fd2ec63f128e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -1701,7 +1701,7 @@ static int ice_xdp_alloc_setup_rings(struct ice_vsi *vsi)
+ xdp_ring->netdev = NULL;
+ xdp_ring->dev = dev;
+ xdp_ring->count = vsi->num_tx_desc;
+- vsi->xdp_rings[i] = xdp_ring;
++ WRITE_ONCE(vsi->xdp_rings[i], xdp_ring);
+ if (ice_setup_tx_ring(xdp_ring))
+ goto free_xdp_rings;
+ ice_set_ring_xdp(xdp_ring);
+--
+2.25.1
+
--- /dev/null
+From 71ee591af579d88caa48fb682df5bb9e6f5fc3af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 07:13:42 +0800
+Subject: iommu/vt-d: Don't apply gfx quirks to untrusted devices
+
+From: Rajat Jain <rajatja@google.com>
+
+[ Upstream commit 67e8a5b18d41af9298db5c17193f671f235cce01 ]
+
+Currently, an external malicious PCI device can masquerade the VID:PID
+of faulty gfx devices, and thus apply iommu quirks to effectively
+disable the IOMMU restrictions for itself.
+
+Thus we need to ensure that the device we are applying quirks to, is
+indeed an internal trusted device.
+
+Signed-off-by: Rajat Jain <rajatja@google.com>
+Reviewed-by: Ashok Raj <ashok.raj@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20200622231345.29722-4-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 34b2ed91cf4d9..2acf2842c3bd2 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -6206,6 +6206,23 @@ intel_iommu_domain_set_attr(struct iommu_domain *domain,
+ return ret;
+ }
+
++/*
++ * Check that the device does not live on an external facing PCI port that is
++ * marked as untrusted. Such devices should not be able to apply quirks and
++ * thus not be able to bypass the IOMMU restrictions.
++ */
++static bool risky_device(struct pci_dev *pdev)
++{
++ if (pdev->untrusted) {
++ pci_info(pdev,
++ "Skipping IOMMU quirk for dev [%04X:%04X] on untrusted PCI link\n",
++ pdev->vendor, pdev->device);
++ pci_info(pdev, "Please check with your BIOS/Platform vendor about this\n");
++ return true;
++ }
++ return false;
++}
++
+ const struct iommu_ops intel_iommu_ops = {
+ .capable = intel_iommu_capable,
+ .domain_alloc = intel_iommu_domain_alloc,
+@@ -6235,6 +6252,9 @@ const struct iommu_ops intel_iommu_ops = {
+
+ static void quirk_iommu_igfx(struct pci_dev *dev)
+ {
++ if (risky_device(dev))
++ return;
++
+ pci_info(dev, "Disabling IOMMU for graphics on this chipset\n");
+ dmar_map_gfx = 0;
+ }
+@@ -6276,6 +6296,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx);
+
+ static void quirk_iommu_rwbf(struct pci_dev *dev)
+ {
++ if (risky_device(dev))
++ return;
++
+ /*
+ * Mobile 4 Series Chipset neglects to set RWBF capability,
+ * but needs it. Same seems to hold for the desktop versions.
+@@ -6306,6 +6329,9 @@ static void quirk_calpella_no_shadow_gtt(struct pci_dev *dev)
+ {
+ unsigned short ggc;
+
++ if (risky_device(dev))
++ return;
++
+ if (pci_read_config_word(dev, GGC, &ggc))
+ return;
+
+@@ -6339,6 +6365,12 @@ static void __init check_tylersburg_isoch(void)
+ pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x3a3e, NULL);
+ if (!pdev)
+ return;
++
++ if (risky_device(pdev)) {
++ pci_dev_put(pdev);
++ return;
++ }
++
+ pci_dev_put(pdev);
+
+ /* System Management Registers. Might be hidden, in which case
+@@ -6348,6 +6380,11 @@ static void __init check_tylersburg_isoch(void)
+ if (!pdev)
+ return;
+
++ if (risky_device(pdev)) {
++ pci_dev_put(pdev);
++ return;
++ }
++
+ if (pci_read_config_dword(pdev, 0x188, &vtisochctrl)) {
+ pci_dev_put(pdev);
+ return;
+--
+2.25.1
+
--- /dev/null
+From 4c97aaffde03827dcfdaec57a830d74eda87ac0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 13:19:43 +0000
+Subject: ixgbe: protect ring accesses with READ- and WRITE_ONCE
+
+From: Ciara Loftus <ciara.loftus@intel.com>
+
+[ Upstream commit f140ad9fe2ae16f385f8fe4dc9cf67bb4c51d794 ]
+
+READ_ONCE should be used when reading rings prior to accessing the
+statistics pointer. Introduce this as well as the corresponding WRITE_ONCE
+usage when allocating and freeing the rings, to ensure protected access.
+
+Signed-off-by: Ciara Loftus <ciara.loftus@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 12 ++++++------
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 +++++++++++---
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+index fd9f5d41b5942..2e35c5706cf10 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c
+@@ -921,7 +921,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ ring->queue_index = txr_idx;
+
+ /* assign ring to adapter */
+- adapter->tx_ring[txr_idx] = ring;
++ WRITE_ONCE(adapter->tx_ring[txr_idx], ring);
+
+ /* update count and index */
+ txr_count--;
+@@ -948,7 +948,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ set_ring_xdp(ring);
+
+ /* assign ring to adapter */
+- adapter->xdp_ring[xdp_idx] = ring;
++ WRITE_ONCE(adapter->xdp_ring[xdp_idx], ring);
+
+ /* update count and index */
+ xdp_count--;
+@@ -991,7 +991,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter,
+ ring->queue_index = rxr_idx;
+
+ /* assign ring to adapter */
+- adapter->rx_ring[rxr_idx] = ring;
++ WRITE_ONCE(adapter->rx_ring[rxr_idx], ring);
+
+ /* update count and index */
+ rxr_count--;
+@@ -1020,13 +1020,13 @@ static void ixgbe_free_q_vector(struct ixgbe_adapter *adapter, int v_idx)
+
+ ixgbe_for_each_ring(ring, q_vector->tx) {
+ if (ring_is_xdp(ring))
+- adapter->xdp_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->xdp_ring[ring->queue_index], NULL);
+ else
+- adapter->tx_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->tx_ring[ring->queue_index], NULL);
+ }
+
+ ixgbe_for_each_ring(ring, q_vector->rx)
+- adapter->rx_ring[ring->queue_index] = NULL;
++ WRITE_ONCE(adapter->rx_ring[ring->queue_index], NULL);
+
+ adapter->q_vector[v_idx] = NULL;
+ napi_hash_del(&q_vector->napi);
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index ea6834bae04c0..a32a072761aa2 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -7065,7 +7065,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
+ }
+
+ for (i = 0; i < adapter->num_rx_queues; i++) {
+- struct ixgbe_ring *rx_ring = adapter->rx_ring[i];
++ struct ixgbe_ring *rx_ring = READ_ONCE(adapter->rx_ring[i]);
++
++ if (!rx_ring)
++ continue;
+ non_eop_descs += rx_ring->rx_stats.non_eop_descs;
+ alloc_rx_page += rx_ring->rx_stats.alloc_rx_page;
+ alloc_rx_page_failed += rx_ring->rx_stats.alloc_rx_page_failed;
+@@ -7086,15 +7089,20 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter)
+ packets = 0;
+ /* gather some stats to the adapter struct that are per queue */
+ for (i = 0; i < adapter->num_tx_queues; i++) {
+- struct ixgbe_ring *tx_ring = adapter->tx_ring[i];
++ struct ixgbe_ring *tx_ring = READ_ONCE(adapter->tx_ring[i]);
++
++ if (!tx_ring)
++ continue;
+ restart_queue += tx_ring->tx_stats.restart_queue;
+ tx_busy += tx_ring->tx_stats.tx_busy;
+ bytes += tx_ring->stats.bytes;
+ packets += tx_ring->stats.packets;
+ }
+ for (i = 0; i < adapter->num_xdp_queues; i++) {
+- struct ixgbe_ring *xdp_ring = adapter->xdp_ring[i];
++ struct ixgbe_ring *xdp_ring = READ_ONCE(adapter->xdp_ring[i]);
+
++ if (!xdp_ring)
++ continue;
+ restart_queue += xdp_ring->tx_stats.restart_queue;
+ tx_busy += xdp_ring->tx_stats.tx_busy;
+ bytes += xdp_ring->stats.bytes;
+--
+2.25.1
+
--- /dev/null
+From 7b58bb64e92e62152695b59b3a91875c92ba5393 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 10:31:40 +0200
+Subject: net: ethernet: mvneta: Add 2500BaseX support for SoCs without comphy
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 1a642ca7f38992b086101fe204a1ae3c90ed8016 ]
+
+The older SoCs like Armada XP support a 2500BaseX mode in the datasheets
+referred to as DR-SGMII (Double rated SGMII) or HS-SGMII (High Speed
+SGMII). This is an upclocked 1000BaseX mode, thus
+PHY_INTERFACE_MODE_2500BASEX is the appropriate mode define for it.
+adding support for it merely means writing the correct magic value into
+the MVNETA_SERDES_CFG register.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 401eeeca89660..af578a5813bd2 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -110,6 +110,7 @@
+ #define MVNETA_SERDES_CFG 0x24A0
+ #define MVNETA_SGMII_SERDES_PROTO 0x0cc7
+ #define MVNETA_QSGMII_SERDES_PROTO 0x0667
++#define MVNETA_HSGMII_SERDES_PROTO 0x1107
+ #define MVNETA_TYPE_PRIO 0x24bc
+ #define MVNETA_FORCE_UNI BIT(21)
+ #define MVNETA_TXQ_CMD_1 0x24e4
+@@ -3558,6 +3559,11 @@ static int mvneta_config_interface(struct mvneta_port *pp,
+ mvreg_write(pp, MVNETA_SERDES_CFG,
+ MVNETA_SGMII_SERDES_PROTO);
+ break;
++
++ case PHY_INTERFACE_MODE_2500BASEX:
++ mvreg_write(pp, MVNETA_SERDES_CFG,
++ MVNETA_HSGMII_SERDES_PROTO);
++ break;
+ default:
+ return -EINVAL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 63a972fd09c791a5197139b7792f3fbddfda5bd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 10:31:39 +0200
+Subject: net: ethernet: mvneta: Fix Serdes configuration for SoCs without
+ comphy
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit b4748553f53f2971e07d2619f13d461daac0f3bb ]
+
+The MVNETA_SERDES_CFG register is only available on older SoCs like the
+Armada XP. On newer SoCs like the Armada 38x the fields are moved to
+comphy. This patch moves the writes to this register next to the comphy
+initialization, so that depending on the SoC either comphy or
+MVNETA_SERDES_CFG is configured.
+With this we no longer write to the MVNETA_SERDES_CFG on SoCs where it
+doesn't exist.
+
+Suggested-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 80 +++++++++++++++------------
+ 1 file changed, 44 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index 43b44a1e8f69e..401eeeca89660 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -106,6 +106,7 @@
+ #define MVNETA_TX_IN_PRGRS BIT(1)
+ #define MVNETA_TX_FIFO_EMPTY BIT(8)
+ #define MVNETA_RX_MIN_FRAME_SIZE 0x247c
++/* Only exists on Armada XP and Armada 370 */
+ #define MVNETA_SERDES_CFG 0x24A0
+ #define MVNETA_SGMII_SERDES_PROTO 0x0cc7
+ #define MVNETA_QSGMII_SERDES_PROTO 0x0667
+@@ -3523,26 +3524,55 @@ static int mvneta_setup_txqs(struct mvneta_port *pp)
+ return 0;
+ }
+
+-static int mvneta_comphy_init(struct mvneta_port *pp)
++static int mvneta_comphy_init(struct mvneta_port *pp, phy_interface_t interface)
+ {
+ int ret;
+
+- if (!pp->comphy)
+- return 0;
+-
+- ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET,
+- pp->phy_interface);
++ ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET, interface);
+ if (ret)
+ return ret;
+
+ return phy_power_on(pp->comphy);
+ }
+
++static int mvneta_config_interface(struct mvneta_port *pp,
++ phy_interface_t interface)
++{
++ int ret = 0;
++
++ if (pp->comphy) {
++ if (interface == PHY_INTERFACE_MODE_SGMII ||
++ interface == PHY_INTERFACE_MODE_1000BASEX ||
++ interface == PHY_INTERFACE_MODE_2500BASEX) {
++ ret = mvneta_comphy_init(pp, interface);
++ }
++ } else {
++ switch (interface) {
++ case PHY_INTERFACE_MODE_QSGMII:
++ mvreg_write(pp, MVNETA_SERDES_CFG,
++ MVNETA_QSGMII_SERDES_PROTO);
++ break;
++
++ case PHY_INTERFACE_MODE_SGMII:
++ case PHY_INTERFACE_MODE_1000BASEX:
++ mvreg_write(pp, MVNETA_SERDES_CFG,
++ MVNETA_SGMII_SERDES_PROTO);
++ break;
++ default:
++ return -EINVAL;
++ }
++ }
++
++ pp->phy_interface = interface;
++
++ return ret;
++}
++
+ static void mvneta_start_dev(struct mvneta_port *pp)
+ {
+ int cpu;
+
+- WARN_ON(mvneta_comphy_init(pp));
++ WARN_ON(mvneta_config_interface(pp, pp->phy_interface));
+
+ mvneta_max_rx_size_set(pp, pp->pkt_size);
+ mvneta_txq_max_tx_size_set(pp, pp->pkt_size);
+@@ -3920,14 +3950,10 @@ static void mvneta_mac_config(struct phylink_config *config, unsigned int mode,
+ if (state->speed == SPEED_2500)
+ new_ctrl4 |= MVNETA_GMAC4_SHORT_PREAMBLE_ENABLE;
+
+- if (pp->comphy && pp->phy_interface != state->interface &&
+- (state->interface == PHY_INTERFACE_MODE_SGMII ||
+- state->interface == PHY_INTERFACE_MODE_1000BASEX ||
+- state->interface == PHY_INTERFACE_MODE_2500BASEX)) {
+- pp->phy_interface = state->interface;
+-
+- WARN_ON(phy_power_off(pp->comphy));
+- WARN_ON(mvneta_comphy_init(pp));
++ if (pp->phy_interface != state->interface) {
++ if (pp->comphy)
++ WARN_ON(phy_power_off(pp->comphy));
++ WARN_ON(mvneta_config_interface(pp, state->interface));
+ }
+
+ if (new_ctrl0 != gmac_ctrl0)
+@@ -4971,20 +4997,10 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp,
+ }
+
+ /* Power up the port */
+-static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
++static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode)
+ {
+ /* MAC Cause register should be cleared */
+ mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0);
+-
+- if (phy_mode == PHY_INTERFACE_MODE_QSGMII)
+- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_QSGMII_SERDES_PROTO);
+- else if (phy_mode == PHY_INTERFACE_MODE_SGMII ||
+- phy_interface_mode_is_8023z(phy_mode))
+- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO);
+- else if (!phy_interface_mode_is_rgmii(phy_mode))
+- return -EINVAL;
+-
+- return 0;
+ }
+
+ /* Device initialization routine */
+@@ -5170,11 +5186,7 @@ static int mvneta_probe(struct platform_device *pdev)
+ if (err < 0)
+ goto err_netdev;
+
+- err = mvneta_port_power_up(pp, phy_mode);
+- if (err < 0) {
+- dev_err(&pdev->dev, "can't power up port\n");
+- goto err_netdev;
+- }
++ mvneta_port_power_up(pp, phy_mode);
+
+ /* Armada3700 network controller does not support per-cpu
+ * operation, so only single NAPI should be initialized.
+@@ -5328,11 +5340,7 @@ static int mvneta_resume(struct device *device)
+ }
+ }
+ mvneta_defaults_set(pp);
+- err = mvneta_port_power_up(pp, pp->phy_interface);
+- if (err < 0) {
+- dev_err(device, "can't power up port\n");
+- return err;
+- }
++ mvneta_port_power_up(pp, pp->phy_interface);
+
+ netif_device_attach(dev);
+
+--
+2.25.1
+
--- /dev/null
+From 0ff3626bda78ca9d190e9dff43e48a4b1bb40256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 15:45:49 -0700
+Subject: nfs: Fix memory leak of export_path
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 4659ed7cc8514369043053463514408ca16ad6f3 ]
+
+The try_location function is called within a loop by nfs_follow_referral.
+try_location calls nfs4_pathname_string to created the export_path.
+nfs4_pathname_string allocates the memory. export_path is stored in the
+nfs_fs_context/fs_context structure similarly as hostname and source.
+But whereas the ctx hostname and source are freed before assignment,
+export_path is not. So if there are multiple loops, the new export_path
+will overwrite the old without the old being freed.
+
+So call kfree for export_path.
+
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4namespace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
+index a3ab6e219061b..873342308dc0d 100644
+--- a/fs/nfs/nfs4namespace.c
++++ b/fs/nfs/nfs4namespace.c
+@@ -308,6 +308,7 @@ static int try_location(struct fs_context *fc,
+ if (IS_ERR(export_path))
+ return PTR_ERR(export_path);
+
++ kfree(ctx->nfs_server.export_path);
+ ctx->nfs_server.export_path = export_path;
+
+ source = kmalloc(len + 1 + ctx->nfs_server.export_path_len + 1,
+--
+2.25.1
+
--- /dev/null
+From 0819da5efb3a8c960b6a8bc76db166e54a686e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 17:55:25 +0300
+Subject: nvme-rdma: assign completion vector correctly
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit 032a9966a22a3596addf81dacf0c1736dfedc32a ]
+
+The completion vector index that is given during CQ creation can't
+exceed the number of support vectors by the underlying RDMA device. This
+violation currently can accure, for example, in case one will try to
+connect with N regular read/write queues and M poll queues and the sum
+of N + M > num_supported_vectors. This will lead to failure in establish
+a connection to remote target. Instead, in that case, share a completion
+vector between queues.
+
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index cac8a930396a0..1f9a45145d0d3 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -443,7 +443,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ * Spread I/O queues completion vectors according their queue index.
+ * Admin queues can always go on completion vector 0.
+ */
+- comp_vector = idx == 0 ? idx : idx - 1;
++ comp_vector = (idx == 0 ? idx : idx - 1) % ibdev->num_comp_vectors;
+
+ /* Polling queues need direct cq polling context */
+ if (nvme_rdma_poll_queue(queue))
+--
+2.25.1
+
--- /dev/null
+From e43cba66b3a6948a8e2112ba4ad7cd6c8469e5fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 13:16:14 -0700
+Subject: perf/x86/rapl: Fix RAPL config variable bug
+
+From: Stephane Eranian <eranian@google.com>
+
+[ Upstream commit 16accae3d97f97d7f61c4ee5d0002bccdef59088 ]
+
+This patch fixes a bug introduced by:
+
+ fd3ae1e1587d6 ("perf/x86/rapl: Move RAPL support to common x86 code")
+
+The Kconfig variable name was wrong. It was missing the CONFIG_ prefix.
+
+Signed-off-by: Stephane Eranian <eraniangoogle.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Kim Phillips <kim.phillips@amd.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20200528201614.250182-1-eranian@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile
+index b418ef6878796..726e83c0a31a1 100644
+--- a/arch/x86/events/Makefile
++++ b/arch/x86/events/Makefile
+@@ -1,6 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-y += core.o probe.o
+-obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o
++obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += rapl.o
+ obj-y += amd/
+ obj-$(CONFIG_X86_LOCAL_APIC) += msr.o
+ obj-$(CONFIG_CPU_SUP_INTEL) += intel/
+--
+2.25.1
+
--- /dev/null
+From 353535e51950d9a9ae679cd3606884345c91d92d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 15:46:55 -0700
+Subject: perf/x86/rapl: Move RAPL support to common x86 code
+
+From: Stephane Eranian <eranian@google.com>
+
+[ Upstream commit fd3ae1e1587d64ef8cc8e361903d33625458073e ]
+
+To prepare for support of both Intel and AMD RAPL.
+
+As per the AMD PPR, Fam17h support Package RAPL counters to monitor power usage.
+The RAPL counter operates as with Intel RAPL, and as such it is beneficial
+to share the code.
+
+No change in functionality.
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200527224659.206129-2-eranian@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/Kconfig | 6 +++---
+ arch/x86/events/Makefile | 1 +
+ arch/x86/events/intel/Makefile | 2 --
+ arch/x86/events/{intel => }/rapl.c | 9 ++++++---
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+ rename arch/x86/events/{intel => }/rapl.c (98%)
+
+diff --git a/arch/x86/events/Kconfig b/arch/x86/events/Kconfig
+index 9a7a1446cb3a0..4a809c6cbd2f5 100644
+--- a/arch/x86/events/Kconfig
++++ b/arch/x86/events/Kconfig
+@@ -10,11 +10,11 @@ config PERF_EVENTS_INTEL_UNCORE
+ available on NehalemEX and more modern processors.
+
+ config PERF_EVENTS_INTEL_RAPL
+- tristate "Intel rapl performance events"
+- depends on PERF_EVENTS && CPU_SUP_INTEL && PCI
++ tristate "Intel/AMD rapl performance events"
++ depends on PERF_EVENTS && (CPU_SUP_INTEL || CPU_SUP_AMD) && PCI
+ default y
+ ---help---
+- Include support for Intel rapl performance events for power
++ Include support for Intel and AMD rapl performance events for power
+ monitoring on modern processors.
+
+ config PERF_EVENTS_INTEL_CSTATE
+diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile
+index 9e07f554333fb..b418ef6878796 100644
+--- a/arch/x86/events/Makefile
++++ b/arch/x86/events/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-y += core.o probe.o
++obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o
+ obj-y += amd/
+ obj-$(CONFIG_X86_LOCAL_APIC) += msr.o
+ obj-$(CONFIG_CPU_SUP_INTEL) += intel/
+diff --git a/arch/x86/events/intel/Makefile b/arch/x86/events/intel/Makefile
+index 3468b0c1dc7c9..e67a5886336c1 100644
+--- a/arch/x86/events/intel/Makefile
++++ b/arch/x86/events/intel/Makefile
+@@ -2,8 +2,6 @@
+ obj-$(CONFIG_CPU_SUP_INTEL) += core.o bts.o
+ obj-$(CONFIG_CPU_SUP_INTEL) += ds.o knc.o
+ obj-$(CONFIG_CPU_SUP_INTEL) += lbr.o p4.o p6.o pt.o
+-obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += intel-rapl-perf.o
+-intel-rapl-perf-objs := rapl.o
+ obj-$(CONFIG_PERF_EVENTS_INTEL_UNCORE) += intel-uncore.o
+ intel-uncore-objs := uncore.o uncore_nhmex.o uncore_snb.o uncore_snbep.o
+ obj-$(CONFIG_PERF_EVENTS_INTEL_CSTATE) += intel-cstate.o
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/rapl.c
+similarity index 98%
+rename from arch/x86/events/intel/rapl.c
+rename to arch/x86/events/rapl.c
+index a5dbd25852cb7..ece043fb7b494 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -1,11 +1,14 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Support Intel RAPL energy consumption counters
++ * Support Intel/AMD RAPL energy consumption counters
+ * Copyright (C) 2013 Google, Inc., Stephane Eranian
+ *
+ * Intel RAPL interface is specified in the IA-32 Manual Vol3b
+ * section 14.7.1 (September 2013)
+ *
++ * AMD RAPL interface for Fam17h is described in the public PPR:
++ * https://bugzilla.kernel.org/show_bug.cgi?id=206537
++ *
+ * RAPL provides more controls than just reporting energy consumption
+ * however here we only expose the 3 energy consumption free running
+ * counters (pp0, pkg, dram).
+@@ -58,8 +61,8 @@
+ #include <linux/nospec.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+-#include "../perf_event.h"
+-#include "../probe.h"
++#include "perf_event.h"
++#include "probe.h"
+
+ MODULE_LICENSE("GPL");
+
+--
+2.25.1
+
--- /dev/null
+From eed83aaf8b34dbe4d943840ca9c08a492df8c537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jun 2020 17:31:59 +0530
+Subject: powerpc/kvm/book3s64: Fix kernel crash with nested kvm &
+ DEBUG_VIRTUAL
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit c1ed1754f271f6b7acb1bfdc8cfb62220fbed423 ]
+
+With CONFIG_DEBUG_VIRTUAL=y, __pa() checks for addr value and if it's
+less than PAGE_OFFSET it leads to a BUG().
+
+ #define __pa(x)
+ ({
+ VIRTUAL_BUG_ON((unsigned long)(x) < PAGE_OFFSET);
+ (unsigned long)(x) & 0x0fffffffffffffffUL;
+ })
+
+ kernel BUG at arch/powerpc/kvm/book3s_64_mmu_radix.c:43!
+ cpu 0x70: Vector: 700 (Program Check) at [c0000018a2187360]
+ pc: c000000000161b30: __kvmhv_copy_tofrom_guest_radix+0x130/0x1f0
+ lr: c000000000161d5c: kvmhv_copy_from_guest_radix+0x3c/0x80
+ ...
+ kvmhv_copy_from_guest_radix+0x3c/0x80
+ kvmhv_load_from_eaddr+0x48/0xc0
+ kvmppc_ld+0x98/0x1e0
+ kvmppc_load_last_inst+0x50/0x90
+ kvmppc_hv_emulate_mmio+0x288/0x2b0
+ kvmppc_book3s_radix_page_fault+0xd8/0x2b0
+ kvmppc_book3s_hv_page_fault+0x37c/0x1050
+ kvmppc_vcpu_run_hv+0xbb8/0x1080
+ kvmppc_vcpu_run+0x34/0x50
+ kvm_arch_vcpu_ioctl_run+0x2fc/0x410
+ kvm_vcpu_ioctl+0x2b4/0x8f0
+ ksys_ioctl+0xf4/0x150
+ sys_ioctl+0x28/0x80
+ system_call_exception+0x104/0x1d0
+ system_call_common+0xe8/0x214
+
+kvmhv_copy_tofrom_guest_radix() uses a NULL value for to/from to
+indicate direction of copy.
+
+Avoid calling __pa() if the value is NULL to avoid the BUG().
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+[mpe: Massage change log a bit to mention CONFIG_DEBUG_VIRTUAL]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200611120159.680284-1-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_mmu_radix.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+index d4e532a63f08e..2f27faf24b2cb 100644
+--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
+@@ -40,7 +40,8 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid,
+ /* Can't access quadrants 1 or 2 in non-HV mode, call the HV to do it */
+ if (kvmhv_on_pseries())
+ return plpar_hcall_norets(H_COPY_TOFROM_GUEST, lpid, pid, eaddr,
+- __pa(to), __pa(from), n);
++ (to != NULL) ? __pa(to): 0,
++ (from != NULL) ? __pa(from): 0, n);
+
+ quadrant = 1;
+ if (!pid)
+--
+2.25.1
+
--- /dev/null
+From ae855cece48015642a094766ab90664a7578d8a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 May 2020 11:53:00 +0200
+Subject: regmap: fix alignment issue
+
+From: Jens Thoms Toerring <jt@toerring.de>
+
+[ Upstream commit 53d860952c8215cf9ae1ea33409c8cb71ad6ad3d ]
+
+The assembly and disassembly of data to be sent to or received from
+a device invoke functions regmap_format_XX() and regmap_parse_XX()
+that extract or insert data items from or into a buffer, using
+assignments. In some cases the functions are called with a buffer
+pointer with an odd address. On architectures with strict alignment
+requirements this can result in a kernel crash. The assignments
+have been replaced by functions that take alignment into account.
+
+Signed-off-by: Jens Thoms Toerring <jt@toerring.de>
+Link: https://lore.kernel.org/r/20200531095300.GA27570@toerring.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 100 ++++++++++++++++-------------------
+ 1 file changed, 46 insertions(+), 54 deletions(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 508bbd6ea4396..320d23de02c29 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -17,6 +17,7 @@
+ #include <linux/delay.h>
+ #include <linux/log2.h>
+ #include <linux/hwspinlock.h>
++#include <asm/unaligned.h>
+
+ #define CREATE_TRACE_POINTS
+ #include "trace.h"
+@@ -249,22 +250,20 @@ static void regmap_format_8(void *buf, unsigned int val, unsigned int shift)
+
+ static void regmap_format_16_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be16 *b = buf;
+-
+- b[0] = cpu_to_be16(val << shift);
++ put_unaligned_be16(val << shift, buf);
+ }
+
+ static void regmap_format_16_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le16 *b = buf;
+-
+- b[0] = cpu_to_le16(val << shift);
++ put_unaligned_le16(val << shift, buf);
+ }
+
+ static void regmap_format_16_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u16 *)buf = val << shift;
++ u16 v = val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift)
+@@ -280,43 +279,39 @@ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift)
+
+ static void regmap_format_32_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be32 *b = buf;
+-
+- b[0] = cpu_to_be32(val << shift);
++ put_unaligned_be32(val << shift, buf);
+ }
+
+ static void regmap_format_32_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le32 *b = buf;
+-
+- b[0] = cpu_to_le32(val << shift);
++ put_unaligned_le32(val << shift, buf);
+ }
+
+ static void regmap_format_32_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u32 *)buf = val << shift;
++ u32 v = val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ #ifdef CONFIG_64BIT
+ static void regmap_format_64_be(void *buf, unsigned int val, unsigned int shift)
+ {
+- __be64 *b = buf;
+-
+- b[0] = cpu_to_be64((u64)val << shift);
++ put_unaligned_be64((u64) val << shift, buf);
+ }
+
+ static void regmap_format_64_le(void *buf, unsigned int val, unsigned int shift)
+ {
+- __le64 *b = buf;
+-
+- b[0] = cpu_to_le64((u64)val << shift);
++ put_unaligned_le64((u64) val << shift, buf);
+ }
+
+ static void regmap_format_64_native(void *buf, unsigned int val,
+ unsigned int shift)
+ {
+- *(u64 *)buf = (u64)val << shift;
++ u64 v = (u64) val << shift;
++
++ memcpy(buf, &v, sizeof(v));
+ }
+ #endif
+
+@@ -333,35 +328,34 @@ static unsigned int regmap_parse_8(const void *buf)
+
+ static unsigned int regmap_parse_16_be(const void *buf)
+ {
+- const __be16 *b = buf;
+-
+- return be16_to_cpu(b[0]);
++ return get_unaligned_be16(buf);
+ }
+
+ static unsigned int regmap_parse_16_le(const void *buf)
+ {
+- const __le16 *b = buf;
+-
+- return le16_to_cpu(b[0]);
++ return get_unaligned_le16(buf);
+ }
+
+ static void regmap_parse_16_be_inplace(void *buf)
+ {
+- __be16 *b = buf;
++ u16 v = get_unaligned_be16(buf);
+
+- b[0] = be16_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_16_le_inplace(void *buf)
+ {
+- __le16 *b = buf;
++ u16 v = get_unaligned_le16(buf);
+
+- b[0] = le16_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_16_native(const void *buf)
+ {
+- return *(u16 *)buf;
++ u16 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+
+ static unsigned int regmap_parse_24(const void *buf)
+@@ -376,69 +370,67 @@ static unsigned int regmap_parse_24(const void *buf)
+
+ static unsigned int regmap_parse_32_be(const void *buf)
+ {
+- const __be32 *b = buf;
+-
+- return be32_to_cpu(b[0]);
++ return get_unaligned_be32(buf);
+ }
+
+ static unsigned int regmap_parse_32_le(const void *buf)
+ {
+- const __le32 *b = buf;
+-
+- return le32_to_cpu(b[0]);
++ return get_unaligned_le32(buf);
+ }
+
+ static void regmap_parse_32_be_inplace(void *buf)
+ {
+- __be32 *b = buf;
++ u32 v = get_unaligned_be32(buf);
+
+- b[0] = be32_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_32_le_inplace(void *buf)
+ {
+- __le32 *b = buf;
++ u32 v = get_unaligned_le32(buf);
+
+- b[0] = le32_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_32_native(const void *buf)
+ {
+- return *(u32 *)buf;
++ u32 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+
+ #ifdef CONFIG_64BIT
+ static unsigned int regmap_parse_64_be(const void *buf)
+ {
+- const __be64 *b = buf;
+-
+- return be64_to_cpu(b[0]);
++ return get_unaligned_be64(buf);
+ }
+
+ static unsigned int regmap_parse_64_le(const void *buf)
+ {
+- const __le64 *b = buf;
+-
+- return le64_to_cpu(b[0]);
++ return get_unaligned_le64(buf);
+ }
+
+ static void regmap_parse_64_be_inplace(void *buf)
+ {
+- __be64 *b = buf;
++ u64 v = get_unaligned_be64(buf);
+
+- b[0] = be64_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static void regmap_parse_64_le_inplace(void *buf)
+ {
+- __le64 *b = buf;
++ u64 v = get_unaligned_le64(buf);
+
+- b[0] = le64_to_cpu(b[0]);
++ memcpy(buf, &v, sizeof(v));
+ }
+
+ static unsigned int regmap_parse_64_native(const void *buf)
+ {
+- return *(u64 *)buf;
++ u64 v;
++
++ memcpy(&v, buf, sizeof(v));
++ return v;
+ }
+ #endif
+
+--
+2.25.1
+
--- /dev/null
+From 00fd5028e7db12c6537070d7db39f4b13de526f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:05:49 +0200
+Subject: s390/kasan: fix early pgm check handler execution
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 998f5bbe3dbdab81c1cfb1aef7c3892f5d24f6c7 ]
+
+Currently if early_pgm_check_handler is called it ends up in pgm check
+loop. The problem is that early_pgm_check_handler is instrumented by
+KASAN but executed without DAT flag enabled which leads to addressing
+exception when KASAN checks try to access shadow memory.
+
+Fix that by executing early handlers with DAT flag on under KASAN as
+expected.
+
+Reported-and-tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/early.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index cd241ee66eff4..0782772318580 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -170,6 +170,8 @@ static noinline __init void setup_lowcore_early(void)
+ psw_t psw;
+
+ psw.mask = PSW_MASK_BASE | PSW_DEFAULT_KEY | PSW_MASK_EA | PSW_MASK_BA;
++ if (IS_ENABLED(CONFIG_KASAN))
++ psw.mask |= PSW_MASK_DAT;
+ psw.addr = (unsigned long) s390_base_ext_handler;
+ S390_lowcore.external_new_psw = psw;
+ psw.addr = (unsigned long) s390_base_pgm_handler;
+--
+2.25.1
+
--- /dev/null
+From 0a249c0d13583c70eaad763721c5365375a59b6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 14:17:42 +0200
+Subject: sched/core: Check cpus_mask, not cpus_ptr in
+ __set_cpus_allowed_ptr(), to fix mask corruption
+
+From: Scott Wood <swood@redhat.com>
+
+[ Upstream commit fd844ba9ae59b51e34e77105d79f8eca780b3bd6 ]
+
+This function is concerned with the long-term CPU mask, not the
+transitory mask the task might have while migrate disabled. Before
+this patch, if a task was migrate-disabled at the time
+__set_cpus_allowed_ptr() was called, and the new mask happened to be
+equal to the CPU that the task was running on, then the mask update
+would be lost.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20200617121742.cpxppyi7twxmpin7@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index f2618ade80479..8034434b10400 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1637,7 +1637,7 @@ static int __set_cpus_allowed_ptr(struct task_struct *p,
+ goto out;
+ }
+
+- if (cpumask_equal(p->cpus_ptr, new_mask))
++ if (cpumask_equal(&p->cpus_mask, new_mask))
+ goto out;
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 202155da0b565826488459184ee83c50caddb3ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 17:04:46 +0200
+Subject: scsi: mptscsih: Fix read sense data size
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ]
+
+The sense data buffer in sense_buf_pool is allocated with size of
+MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96)
+is used when reading the data. That may lead to a read from unallocated
+area, sometimes from another (unallocated) page. To fix this, limit the
+read size to MPT_SENSE_BUFFER_ALLOC.
+
+Link: https://lore.kernel.org/r/20200616150446.4840-1-thenzl@redhat.com
+Co-developed-by: Stanislav Saner <ssaner@redhat.com>
+Signed-off-by: Stanislav Saner <ssaner@redhat.com>
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/message/fusion/mptscsih.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
+index f0737c57ed5fc..1491561d2e5c9 100644
+--- a/drivers/message/fusion/mptscsih.c
++++ b/drivers/message/fusion/mptscsih.c
+@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);
+ int mptscsih_resume(struct pci_dev *pdev);
+ #endif
+
+-#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE
+-
+
+ /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+ /*
+@@ -2422,7 +2420,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
+ /* Copy the sense received into the scsi command block. */
+ req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx);
+ sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC));
+- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc));
++ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC);
+
+ /* Log SMART data (asc = 0x5D, non-IM case only) if required.
+ */
+--
+2.25.1
+
--- /dev/null
+From 093ad2733e5bfb2e0dace389d67d7705151083f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2020 03:40:13 -0700
+Subject: scsi: qla2xxx: Fix MPI failure AEN (8200) handling
+
+From: Arun Easi <aeasi@marvell.com>
+
+[ Upstream commit cbb01c2f2f630f1497f703c51ff21538ae2d86b8 ]
+
+Today, upon an MPI failure AEN, on top of collecting an MPI dump, a regular
+firmware dump is also taken and then chip reset. This is disruptive to IOs
+and not required. Make the firmware dump collection, followed by chip
+reset, optional (not done by default).
+
+Firmware dump buffer and MPI dump buffer are independent of each
+other with this change and each can have dump that was taken at two
+different times for two different issues. The MPI dump is saved in a
+separate buffer and is retrieved differently from firmware dump.
+
+To collect full dump on MPI failure AEN, a module parameter is
+introduced:
+ ql2xfulldump_on_mpifail (default: 0)
+
+Link: https://lore.kernel.org/r/20200331104015.24868-2-njavali@marvell.com
+Reported-by: kbuild test robot <lkp@intel.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 30 +++++++-
+ drivers/scsi/qla2xxx/qla_def.h | 13 +++-
+ drivers/scsi/qla2xxx/qla_gbl.h | 3 +
+ drivers/scsi/qla2xxx/qla_init.c | 2 +
+ drivers/scsi/qla2xxx/qla_isr.c | 54 +++++++++-----
+ drivers/scsi/qla2xxx/qla_os.c | 6 ++
+ drivers/scsi/qla2xxx/qla_tmpl.c | 121 ++++++++++++++++++++++++++------
+ 7 files changed, 186 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 2c9e5ac24692d..c4917f441b10a 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -26,7 +26,8 @@ qla2x00_sysfs_read_fw_dump(struct file *filp, struct kobject *kobj,
+ struct qla_hw_data *ha = vha->hw;
+ int rval = 0;
+
+- if (!(ha->fw_dump_reading || ha->mctp_dump_reading))
++ if (!(ha->fw_dump_reading || ha->mctp_dump_reading ||
++ ha->mpi_fw_dump_reading))
+ return 0;
+
+ mutex_lock(&ha->optrom_mutex);
+@@ -42,6 +43,10 @@ qla2x00_sysfs_read_fw_dump(struct file *filp, struct kobject *kobj,
+ } else if (ha->mctp_dumped && ha->mctp_dump_reading) {
+ rval = memory_read_from_buffer(buf, count, &off, ha->mctp_dump,
+ MCTP_DUMP_SIZE);
++ } else if (ha->mpi_fw_dumped && ha->mpi_fw_dump_reading) {
++ rval = memory_read_from_buffer(buf, count, &off,
++ ha->mpi_fw_dump,
++ ha->mpi_fw_dump_len);
+ } else if (ha->fw_dump_reading) {
+ rval = memory_read_from_buffer(buf, count, &off, ha->fw_dump,
+ ha->fw_dump_len);
+@@ -103,7 +108,6 @@ qla2x00_sysfs_write_fw_dump(struct file *filp, struct kobject *kobj,
+ qla82xx_set_reset_owner(vha);
+ qla8044_idc_unlock(ha);
+ } else {
+- ha->fw_dump_mpi = 1;
+ qla2x00_system_error(vha);
+ }
+ break;
+@@ -137,6 +141,22 @@ qla2x00_sysfs_write_fw_dump(struct file *filp, struct kobject *kobj,
+ vha->host_no);
+ }
+ break;
++ case 8:
++ if (!ha->mpi_fw_dump_reading)
++ break;
++ ql_log(ql_log_info, vha, 0x70e7,
++ "MPI firmware dump cleared on (%ld).\n", vha->host_no);
++ ha->mpi_fw_dump_reading = 0;
++ ha->mpi_fw_dumped = 0;
++ break;
++ case 9:
++ if (ha->mpi_fw_dumped && !ha->mpi_fw_dump_reading) {
++ ha->mpi_fw_dump_reading = 1;
++ ql_log(ql_log_info, vha, 0x70e8,
++ "Raw MPI firmware dump ready for read on (%ld).\n",
++ vha->host_no);
++ }
++ break;
+ }
+ return count;
+ }
+@@ -706,7 +726,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ scsi_unblock_requests(vha->host);
+ break;
+ case 0x2025d:
+- if (!IS_QLA81XX(ha) && !IS_QLA83XX(ha))
++ if (!IS_QLA81XX(ha) && !IS_QLA83XX(ha) &&
++ !IS_QLA27XX(ha) && !IS_QLA28XX(ha))
+ return -EPERM;
+
+ ql_log(ql_log_info, vha, 0x706f,
+@@ -724,6 +745,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ qla83xx_idc_audit(vha, IDC_AUDIT_TIMESTAMP);
+ qla83xx_idc_unlock(vha, 0);
+ break;
++ } else if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) {
++ qla27xx_reset_mpi(vha);
+ } else {
+ /* Make sure FC side is not in reset */
+ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) !=
+@@ -737,6 +760,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ scsi_unblock_requests(vha->host);
+ break;
+ }
++ break;
+ case 0x2025e:
+ if (!IS_P3P_TYPE(ha) || vha != base_vha) {
+ ql_log(ql_log_info, vha, 0x7071,
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 47c7a56438b54..daa9e936887bb 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -3223,6 +3223,7 @@ struct isp_operations {
+ uint32_t);
+
+ void (*fw_dump) (struct scsi_qla_host *, int);
++ void (*mpi_fw_dump)(struct scsi_qla_host *, int);
+
+ int (*beacon_on) (struct scsi_qla_host *);
+ int (*beacon_off) (struct scsi_qla_host *);
+@@ -3748,6 +3749,11 @@ struct qlt_hw_data {
+
+ #define LEAK_EXCHG_THRESH_HOLD_PERCENT 75 /* 75 percent */
+
++struct qla_hw_data_stat {
++ u32 num_fw_dump;
++ u32 num_mpi_reset;
++};
++
+ /*
+ * Qlogic host adapter specific data structure.
+ */
+@@ -4230,7 +4236,6 @@ struct qla_hw_data {
+ uint32_t fw_dump_len;
+ u32 fw_dump_alloc_len;
+ bool fw_dumped;
+- bool fw_dump_mpi;
+ unsigned long fw_dump_cap_flags;
+ #define RISC_PAUSE_CMPL 0
+ #define DMA_SHUTDOWN_CMPL 1
+@@ -4241,6 +4246,10 @@ struct qla_hw_data {
+ #define ISP_MBX_RDY 6
+ #define ISP_SOFT_RESET_CMPL 7
+ int fw_dump_reading;
++ void *mpi_fw_dump;
++ u32 mpi_fw_dump_len;
++ int mpi_fw_dump_reading:1;
++ int mpi_fw_dumped:1;
+ int prev_minidump_failed;
+ dma_addr_t eft_dma;
+ void *eft;
+@@ -4454,6 +4463,8 @@ struct qla_hw_data {
+ uint16_t last_zio_threshold;
+
+ #define DEFAULT_ZIO_THRESHOLD 5
++
++ struct qla_hw_data_stat stat;
+ };
+
+ struct active_regions {
+diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
+index 1b93f5b4d77d9..b20c5fa122fb2 100644
+--- a/drivers/scsi/qla2xxx/qla_gbl.h
++++ b/drivers/scsi/qla2xxx/qla_gbl.h
+@@ -173,6 +173,7 @@ extern int ql2xenablemsix;
+ extern int qla2xuseresexchforels;
+ extern int ql2xexlogins;
+ extern int ql2xdifbundlinginternalbuffers;
++extern int ql2xfulldump_on_mpifail;
+
+ extern int qla2x00_loop_reset(scsi_qla_host_t *);
+ extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int);
+@@ -645,6 +646,7 @@ extern void qla82xx_fw_dump(scsi_qla_host_t *, int);
+ extern void qla8044_fw_dump(scsi_qla_host_t *, int);
+
+ extern void qla27xx_fwdump(scsi_qla_host_t *, int);
++extern void qla27xx_mpi_fwdump(scsi_qla_host_t *, int);
+ extern ulong qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *, void *);
+ extern int qla27xx_fwdt_template_valid(void *);
+ extern ulong qla27xx_fwdt_template_size(void *);
+@@ -933,5 +935,6 @@ extern void qla24xx_process_purex_list(struct purex_list *);
+
+ /* nvme.c */
+ void qla_nvme_unregister_remote_port(struct fc_port *fcport);
++void qla27xx_reset_mpi(scsi_qla_host_t *vha);
+ void qla_handle_els_plogi_done(scsi_qla_host_t *vha, struct event_arg *ea);
+ #endif /* _QLA_GBL_H */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index cfbb4294fb8bb..53686246f5664 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -3339,6 +3339,8 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
+ dump_size / 1024);
+
+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) {
++ ha->mpi_fw_dump = (char *)fw_dump +
++ ha->fwdt[1].dump_size;
+ mutex_unlock(&ha->optrom_mutex);
+ return;
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 8a78d395bbc8f..4d9ec7ee59cc7 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -756,6 +756,39 @@ qla2x00_find_fcport_by_nportid(scsi_qla_host_t *vha, port_id_t *id,
+ return NULL;
+ }
+
++/* Shall be called only on supported adapters. */
++static void
++qla27xx_handle_8200_aen(scsi_qla_host_t *vha, uint16_t *mb)
++{
++ struct qla_hw_data *ha = vha->hw;
++ bool reset_isp_needed = 0;
++
++ ql_log(ql_log_warn, vha, 0x02f0,
++ "MPI Heartbeat stop. MPI reset is%s needed. "
++ "MB0[%xh] MB1[%xh] MB2[%xh] MB3[%xh]\n",
++ mb[0] & BIT_8 ? "" : " not",
++ mb[0], mb[1], mb[2], mb[3]);
++
++ if ((mb[1] & BIT_8) == 0)
++ return;
++
++ ql_log(ql_log_warn, vha, 0x02f1,
++ "MPI Heartbeat stop. FW dump needed\n");
++
++ if (ql2xfulldump_on_mpifail) {
++ ha->isp_ops->fw_dump(vha, 1);
++ reset_isp_needed = 1;
++ }
++
++ ha->isp_ops->mpi_fw_dump(vha, 1);
++
++ if (reset_isp_needed) {
++ vha->hw->flags.fw_init_done = 0;
++ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
++ qla2xxx_wake_dpc(vha);
++ }
++}
++
+ /**
+ * qla2x00_async_event() - Process aynchronous events.
+ * @vha: SCSI driver HA context
+@@ -871,9 +904,9 @@ skip_rio:
+ "ISP System Error - mbx1=%xh mbx2=%xh mbx3=%xh.\n ",
+ mb[1], mb[2], mb[3]);
+
+- ha->fw_dump_mpi =
+- (IS_QLA27XX(ha) || IS_QLA28XX(ha)) &&
+- RD_REG_WORD(®24->mailbox7) & BIT_8;
++ if ((IS_QLA27XX(ha) || IS_QLA28XX(ha)) &&
++ RD_REG_WORD(®24->mailbox7) & BIT_8)
++ ha->isp_ops->mpi_fw_dump(vha, 1);
+ ha->isp_ops->fw_dump(vha, 1);
+ ha->flags.fw_init_done = 0;
+ QLA_FW_STOPPED(ha);
+@@ -1374,20 +1407,7 @@ global_port_update:
+
+ case MBA_IDC_AEN:
+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) {
+- ha->flags.fw_init_done = 0;
+- ql_log(ql_log_warn, vha, 0xffff,
+- "MPI Heartbeat stop. Chip reset needed. MB0[%xh] MB1[%xh] MB2[%xh] MB3[%xh]\n",
+- mb[0], mb[1], mb[2], mb[3]);
+-
+- if ((mb[1] & BIT_8) ||
+- (mb[2] & BIT_8)) {
+- ql_log(ql_log_warn, vha, 0xd013,
+- "MPI Heartbeat stop. FW dump needed\n");
+- ha->fw_dump_mpi = 1;
+- ha->isp_ops->fw_dump(vha, 1);
+- }
+- set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+- qla2xxx_wake_dpc(vha);
++ qla27xx_handle_8200_aen(vha, mb);
+ } else if (IS_QLA83XX(ha)) {
+ mb[4] = RD_REG_WORD(®24->mailbox4);
+ mb[5] = RD_REG_WORD(®24->mailbox5);
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 9179bb4caed84..1120d133204c2 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -35,6 +35,11 @@ static int apidev_major;
+ */
+ struct kmem_cache *srb_cachep;
+
++int ql2xfulldump_on_mpifail;
++module_param(ql2xfulldump_on_mpifail, int, S_IRUGO | S_IWUSR);
++MODULE_PARM_DESC(ql2xfulldump_on_mpifail,
++ "Set this to take full dump on MPI hang.");
++
+ /*
+ * CT6 CTX allocation cache
+ */
+@@ -2518,6 +2523,7 @@ static struct isp_operations qla27xx_isp_ops = {
+ .read_nvram = NULL,
+ .write_nvram = NULL,
+ .fw_dump = qla27xx_fwdump,
++ .mpi_fw_dump = qla27xx_mpi_fwdump,
+ .beacon_on = qla24xx_beacon_on,
+ .beacon_off = qla24xx_beacon_off,
+ .beacon_blink = qla83xx_beacon_blink,
+diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
+index 6aeb1c3fb7a87..3423638624344 100644
+--- a/drivers/scsi/qla2xxx/qla_tmpl.c
++++ b/drivers/scsi/qla2xxx/qla_tmpl.c
+@@ -12,6 +12,33 @@
+ #define IOBASE(vha) IOBAR(ISPREG(vha))
+ #define INVALID_ENTRY ((struct qla27xx_fwdt_entry *)0xffffffffffffffffUL)
+
++/* hardware_lock assumed held. */
++static void
++qla27xx_write_remote_reg(struct scsi_qla_host *vha,
++ u32 addr, u32 data)
++{
++ char *reg = (char *)ISPREG(vha);
++
++ ql_dbg(ql_dbg_misc, vha, 0xd300,
++ "%s: addr/data = %xh/%xh\n", __func__, addr, data);
++
++ WRT_REG_DWORD(reg + IOBASE(vha), 0x40);
++ WRT_REG_DWORD(reg + 0xc4, data);
++ WRT_REG_DWORD(reg + 0xc0, addr);
++}
++
++void
++qla27xx_reset_mpi(scsi_qla_host_t *vha)
++{
++ ql_dbg(ql_dbg_misc + ql_dbg_verbose, vha, 0xd301,
++ "Entered %s.\n", __func__);
++
++ qla27xx_write_remote_reg(vha, 0x104050, 0x40004);
++ qla27xx_write_remote_reg(vha, 0x10405c, 0x4);
++
++ vha->hw->stat.num_mpi_reset++;
++}
++
+ static inline void
+ qla27xx_insert16(uint16_t value, void *buf, ulong *len)
+ {
+@@ -997,6 +1024,62 @@ qla27xx_fwdt_template_valid(void *p)
+ return true;
+ }
+
++void
++qla27xx_mpi_fwdump(scsi_qla_host_t *vha, int hardware_locked)
++{
++ ulong flags = 0;
++ bool need_mpi_reset = 1;
++
++#ifndef __CHECKER__
++ if (!hardware_locked)
++ spin_lock_irqsave(&vha->hw->hardware_lock, flags);
++#endif
++ if (!vha->hw->mpi_fw_dump) {
++ ql_log(ql_log_warn, vha, 0x02f3, "-> mpi_fwdump no buffer\n");
++ } else if (vha->hw->mpi_fw_dumped) {
++ ql_log(ql_log_warn, vha, 0x02f4,
++ "-> MPI firmware already dumped (%p) -- ignoring request\n",
++ vha->hw->mpi_fw_dump);
++ } else {
++ struct fwdt *fwdt = &vha->hw->fwdt[1];
++ ulong len;
++ void *buf = vha->hw->mpi_fw_dump;
++
++ ql_log(ql_log_warn, vha, 0x02f5, "-> fwdt1 running...\n");
++ if (!fwdt->template) {
++ ql_log(ql_log_warn, vha, 0x02f6,
++ "-> fwdt1 no template\n");
++ goto bailout;
++ }
++ len = qla27xx_execute_fwdt_template(vha, fwdt->template, buf);
++ if (len == 0) {
++ goto bailout;
++ } else if (len != fwdt->dump_size) {
++ ql_log(ql_log_warn, vha, 0x02f7,
++ "-> fwdt1 fwdump residual=%+ld\n",
++ fwdt->dump_size - len);
++ } else {
++ need_mpi_reset = 0;
++ }
++
++ vha->hw->mpi_fw_dump_len = len;
++ vha->hw->mpi_fw_dumped = 1;
++
++ ql_log(ql_log_warn, vha, 0x02f8,
++ "-> MPI firmware dump saved to buffer (%lu/%p)\n",
++ vha->host_no, vha->hw->mpi_fw_dump);
++ qla2x00_post_uevent_work(vha, QLA_UEVENT_CODE_FW_DUMP);
++ }
++
++bailout:
++ if (need_mpi_reset)
++ qla27xx_reset_mpi(vha);
++#ifndef __CHECKER__
++ if (!hardware_locked)
++ spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
++#endif
++}
++
+ void
+ qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked)
+ {
+@@ -1015,30 +1098,25 @@ qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked)
+ vha->hw->fw_dump);
+ } else {
+ struct fwdt *fwdt = vha->hw->fwdt;
+- uint j;
+ ulong len;
+ void *buf = vha->hw->fw_dump;
+- uint count = vha->hw->fw_dump_mpi ? 2 : 1;
+-
+- for (j = 0; j < count; j++, fwdt++, buf += len) {
+- ql_log(ql_log_warn, vha, 0xd011,
+- "-> fwdt%u running...\n", j);
+- if (!fwdt->template) {
+- ql_log(ql_log_warn, vha, 0xd012,
+- "-> fwdt%u no template\n", j);
+- break;
+- }
+- len = qla27xx_execute_fwdt_template(vha,
+- fwdt->template, buf);
+- if (len == 0) {
+- goto bailout;
+- } else if (len != fwdt->dump_size) {
+- ql_log(ql_log_warn, vha, 0xd013,
+- "-> fwdt%u fwdump residual=%+ld\n",
+- j, fwdt->dump_size - len);
+- }
++
++ ql_log(ql_log_warn, vha, 0xd011, "-> fwdt0 running...\n");
++ if (!fwdt->template) {
++ ql_log(ql_log_warn, vha, 0xd012,
++ "-> fwdt0 no template\n");
++ goto bailout;
+ }
+- vha->hw->fw_dump_len = buf - (void *)vha->hw->fw_dump;
++ len = qla27xx_execute_fwdt_template(vha, fwdt->template, buf);
++ if (len == 0) {
++ goto bailout;
++ } else if (len != fwdt->dump_size) {
++ ql_log(ql_log_warn, vha, 0xd013,
++ "-> fwdt0 fwdump residual=%+ld\n",
++ fwdt->dump_size - len);
++ }
++
++ vha->hw->fw_dump_len = len;
+ vha->hw->fw_dumped = 1;
+
+ ql_log(ql_log_warn, vha, 0xd015,
+@@ -1048,7 +1126,6 @@ qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked)
+ }
+
+ bailout:
+- vha->hw->fw_dump_mpi = 0;
+ #ifndef __CHECKER__
+ if (!hardware_locked)
+ spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+--
+2.25.1
+
kvm-s390-reduce-number-of-io-pins-to-1.patch
spi-spi-fsl-dspi-adding-shutdown-hook.patch
spi-spi-fsl-dspi-fix-lockup-if-device-is-removed-dur.patch
+regmap-fix-alignment-issue.patch
+perf-x86-rapl-move-rapl-support-to-common-x86-code.patch
+perf-x86-rapl-fix-rapl-config-variable-bug.patch
+arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch
+drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch
+drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch
+gpu-host1x-clean-up-debugfs-in-error-handling-path.patch
+drm-tegra-hub-do-not-enable-orphaned-window-group.patch
+gpu-host1x-detach-driver-on-unregister.patch
+staging-wfx-fix-coherency-of-hif_scan-prototype.patch
+drm-mcde-fix-display-initialization-problem.patch
+asoc-sof-intel-add-pci-id-for-cometlake-s.patch
+asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch
+alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch
+spi-spidev-fix-a-race-between-spidev_release-and-spi.patch
+spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch
+net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch
+net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch
+ixgbe-protect-ring-accesses-with-read-and-write_once.patch
+i40e-protect-ring-accesses-with-read-and-write_once.patch
+ice-protect-ring-accesses-with-write_once.patch
+ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch
+powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch
+xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch
+iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch
+drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch
+drm-panel-orientation-quirks-use-generic-orientation.patch
+s390-kasan-fix-early-pgm-check-handler-execution.patch
+drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch
+cifs-update-ctime-and-mtime-during-truncate.patch
+arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch
+scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch
+scsi-mptscsih-fix-read-sense-data-size.patch
+usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch
+arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch
+block-release-bip-in-a-right-way-in-error-path.patch
+nvme-rdma-assign-completion-vector-correctly.patch
+x86-entry-increase-entry_stack-size-to-a-full-page.patch
+arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch
+nfs-fix-memory-leak-of-export_path.patch
+sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch
--- /dev/null
+From e7fe7430e984179bf5ca9d0b527ba36425d84f46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 11:21:25 +0800
+Subject: spi: spidev: fix a potential use-after-free in spidev_release()
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ]
+
+If an spi device is unbounded from the driver before the release
+process, there will be an NULL pointer reference when it's
+referenced in spi_slave_abort().
+
+Fix it by checking it's already freed before reference.
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Link: https://lore.kernel.org/r/20200618032125.4650-2-zhenzhong.duan@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 82e6481fdf950..012a89123067c 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -608,15 +608,20 @@ err_find_dev:
+ static int spidev_release(struct inode *inode, struct file *filp)
+ {
+ struct spidev_data *spidev;
++ int dofree;
+
+ mutex_lock(&device_list_lock);
+ spidev = filp->private_data;
+ filp->private_data = NULL;
+
++ spin_lock_irq(&spidev->spi_lock);
++ /* ... after we unbound from the underlying device? */
++ dofree = (spidev->spi == NULL);
++ spin_unlock_irq(&spidev->spi_lock);
++
+ /* last close? */
+ spidev->users--;
+ if (!spidev->users) {
+- int dofree;
+
+ kfree(spidev->tx_buffer);
+ spidev->tx_buffer = NULL;
+@@ -624,19 +629,14 @@ static int spidev_release(struct inode *inode, struct file *filp)
+ kfree(spidev->rx_buffer);
+ spidev->rx_buffer = NULL;
+
+- spin_lock_irq(&spidev->spi_lock);
+- if (spidev->spi)
+- spidev->speed_hz = spidev->spi->max_speed_hz;
+-
+- /* ... after we unbound from the underlying device? */
+- dofree = (spidev->spi == NULL);
+- spin_unlock_irq(&spidev->spi_lock);
+-
+ if (dofree)
+ kfree(spidev);
++ else
++ spidev->speed_hz = spidev->spi->max_speed_hz;
+ }
+ #ifdef CONFIG_SPI_SLAVE
+- spi_slave_abort(spidev->spi);
++ if (!dofree)
++ spi_slave_abort(spidev->spi);
+ #endif
+ mutex_unlock(&device_list_lock);
+
+--
+2.25.1
+
--- /dev/null
+From 5eec445efb3788c77b634fd885548f86689a95d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 11:21:24 +0800
+Subject: spi: spidev: fix a race between spidev_release and spidev_remove
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ]
+
+Imagine below scene, spidev is referenced after it's freed.
+
+spidev_release() spidev_remove()
+...
+ spin_lock_irq(&spidev->spi_lock);
+ spidev->spi = NULL;
+ spin_unlock_irq(&spidev->spi_lock);
+mutex_lock(&device_list_lock);
+dofree = (spidev->spi == NULL);
+if (dofree)
+ kfree(spidev);
+mutex_unlock(&device_list_lock);
+ mutex_lock(&device_list_lock);
+ list_del(&spidev->device_entry);
+ device_destroy(spidev_class, spidev->devt);
+ clear_bit(MINOR(spidev->devt), minors);
+ if (spidev->users == 0)
+ kfree(spidev);
+ mutex_unlock(&device_list_lock);
+
+Fix it by resetting spidev->spi in device_list_lock's protection.
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spidev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 80dd1025b9530..82e6481fdf950 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -786,13 +786,13 @@ static int spidev_remove(struct spi_device *spi)
+ {
+ struct spidev_data *spidev = spi_get_drvdata(spi);
+
++ /* prevent new opens */
++ mutex_lock(&device_list_lock);
+ /* make sure ops on existing fds can abort cleanly */
+ spin_lock_irq(&spidev->spi_lock);
+ spidev->spi = NULL;
+ spin_unlock_irq(&spidev->spi_lock);
+
+- /* prevent new opens */
+- mutex_lock(&device_list_lock);
+ list_del(&spidev->device_entry);
+ device_destroy(spidev_class, spidev->devt);
+ clear_bit(MINOR(spidev->devt), minors);
+--
+2.25.1
+
--- /dev/null
+From 38a7dcbd768ce5de89dc5600ba076d8442ef3495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 May 2020 14:12:56 +0200
+Subject: staging: wfx: fix coherency of hif_scan() prototype
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Pouiller <jerome.pouiller@silabs.com>
+
+[ Upstream commit 29de523a6270a308d12d21f4fecf52dac491e226 ]
+
+The function hif_scan() return the timeout for the completion of the
+scan request. It is the only function from hif_tx.c that return another
+thing than just an error code. This behavior is not coherent with the
+rest of file. Worse, if value returned is positive, the caller can't
+make say if it is a timeout or the value returned by the hardware.
+
+Uniformize API with other HIF functions, only return the error code and
+pass timeout with parameters.
+
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Link: https://lore.kernel.org/r/20200529121256.1045521-1-Jerome.Pouiller@silabs.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/wfx/hif_tx.c | 6 ++++--
+ drivers/staging/wfx/hif_tx.h | 2 +-
+ drivers/staging/wfx/scan.c | 6 +++---
+ 3 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/wfx/hif_tx.c b/drivers/staging/wfx/hif_tx.c
+index 20b3045d76674..15ff60a584668 100644
+--- a/drivers/staging/wfx/hif_tx.c
++++ b/drivers/staging/wfx/hif_tx.c
+@@ -222,7 +222,7 @@ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val,
+ }
+
+ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
+- int chan_start_idx, int chan_num)
++ int chan_start_idx, int chan_num, int *timeout)
+ {
+ int ret, i;
+ struct hif_msg *hif;
+@@ -269,11 +269,13 @@ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req,
+ tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay;
+ tmo_chan_fg *= body->num_of_probe_requests;
+ tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU;
++ if (timeout)
++ *timeout = usecs_to_jiffies(tmo);
+
+ wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len);
+ ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false);
+ kfree(hif);
+- return ret ? ret : usecs_to_jiffies(tmo);
++ return ret;
+ }
+
+ int hif_stop_scan(struct wfx_vif *wvif)
+diff --git a/drivers/staging/wfx/hif_tx.h b/drivers/staging/wfx/hif_tx.h
+index f8520a14c14cd..7a21338470eeb 100644
+--- a/drivers/staging/wfx/hif_tx.h
++++ b/drivers/staging/wfx/hif_tx.h
+@@ -43,7 +43,7 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
+ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id,
+ void *buf, size_t buf_size);
+ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211,
+- int chan_start, int chan_num);
++ int chan_start, int chan_num, int *timeout);
+ int hif_stop_scan(struct wfx_vif *wvif);
+ int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf,
+ struct ieee80211_channel *channel, const u8 *ssid, int ssidlen);
+diff --git a/drivers/staging/wfx/scan.c b/drivers/staging/wfx/scan.c
+index 9aa14331affd6..d47b8a3ba403c 100644
+--- a/drivers/staging/wfx/scan.c
++++ b/drivers/staging/wfx/scan.c
+@@ -56,10 +56,10 @@ static int send_scan_req(struct wfx_vif *wvif,
+ wfx_tx_lock_flush(wvif->wdev);
+ wvif->scan_abort = false;
+ reinit_completion(&wvif->scan_complete);
+- timeout = hif_scan(wvif, req, start_idx, i - start_idx);
+- if (timeout < 0) {
++ ret = hif_scan(wvif, req, start_idx, i - start_idx, &timeout);
++ if (ret) {
+ wfx_tx_unlock(wvif->wdev);
+- return timeout;
++ return -EIO;
+ }
+ ret = wait_for_completion_timeout(&wvif->scan_complete, timeout);
+ if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower)
+--
+2.25.1
+
--- /dev/null
+From f0464bcf45b17d700ec03adf01c307edc5482eda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jun 2020 22:15:25 -0500
+Subject: usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 2655971ad4b34e97dd921df16bb0b08db9449df7 ]
+
+dwc3_pci_resume_work() calls pm_runtime_get_sync() that increments
+the reference counter. In case of failure, decrement the reference
+before returning.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index b67372737dc9b..96c05b121fac8 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -206,8 +206,10 @@ static void dwc3_pci_resume_work(struct work_struct *work)
+ int ret;
+
+ ret = pm_runtime_get_sync(&dwc3->dev);
+- if (ret)
++ if (ret) {
++ pm_runtime_put_sync_autosuspend(&dwc3->dev);
+ return;
++ }
+
+ pm_runtime_mark_last_busy(&dwc3->dev);
+ pm_runtime_put_sync_autosuspend(&dwc3->dev);
+--
+2.25.1
+
--- /dev/null
+From 43d0e399a442128876094cfaaaf7c02679a7e446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 18:25:57 +0200
+Subject: x86/entry: Increase entry_stack size to a full page
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit c7aadc09321d8f9a1d3bd1e6d8a47222ecddf6c5 ]
+
+Marco crashed in bad_iret with a Clang11/KCSAN build due to
+overflowing the stack. Now that we run C code on it, expand it to a
+full page.
+
+Suggested-by: Andy Lutomirski <luto@amacapital.net>
+Reported-by: Marco Elver <elver@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Tested-by: Marco Elver <elver@google.com>
+Link: https://lkml.kernel.org/r/20200618144801.819246178@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/processor.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index c4e8fd709cf67..e38befea287fc 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -370,7 +370,7 @@ struct x86_hw_tss {
+ #define IO_BITMAP_OFFSET_INVALID (__KERNEL_TSS_LIMIT + 1)
+
+ struct entry_stack {
+- unsigned long words[64];
++ char stack[PAGE_SIZE];
+ };
+
+ struct entry_stack_page {
+--
+2.25.1
+
--- /dev/null
+From c5a9edefaf60b29888b8b9ca6f699b40fc61286b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 09:20:52 -0400
+Subject: xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 2acc5cae292355f5f18ad377a2a966e7f03c8fec ]
+
+r_xprt->rx_ep is known to be good while the transport's send lock is
+held. Otherwise additional references on rx_ep must be held when it
+is used outside of that lock's critical sections.
+
+For now, bump the rx_ep reference count once whenever there is at
+least one outstanding Receive WR. This avoids the memory bandwidth
+overhead of taking and releasing the reference count for every
+ib_post_recv() and Receive completion.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/verbs.c | 33 +++++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 05c4d3a9cda27..db0259c6467ef 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -84,7 +84,8 @@ static void rpcrdma_rep_destroy(struct rpcrdma_rep *rep);
+ static void rpcrdma_reps_unmap(struct rpcrdma_xprt *r_xprt);
+ static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt);
+ static void rpcrdma_mrs_destroy(struct rpcrdma_xprt *r_xprt);
+-static int rpcrdma_ep_destroy(struct rpcrdma_ep *ep);
++static void rpcrdma_ep_get(struct rpcrdma_ep *ep);
++static int rpcrdma_ep_put(struct rpcrdma_ep *ep);
+ static struct rpcrdma_regbuf *
+ rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction,
+ gfp_t flags);
+@@ -97,7 +98,8 @@ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb);
+ */
+ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
+ {
+- struct rdma_cm_id *id = r_xprt->rx_ep->re_id;
++ struct rpcrdma_ep *ep = r_xprt->rx_ep;
++ struct rdma_cm_id *id = ep->re_id;
+
+ /* Flush Receives, then wait for deferred Reply work
+ * to complete.
+@@ -108,6 +110,8 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt)
+ * local invalidations.
+ */
+ ib_drain_sq(id->qp);
++
++ rpcrdma_ep_put(ep);
+ }
+
+ /**
+@@ -267,7 +271,7 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
+ xprt_force_disconnect(xprt);
+ goto disconnected;
+ case RDMA_CM_EVENT_ESTABLISHED:
+- kref_get(&ep->re_kref);
++ rpcrdma_ep_get(ep);
+ ep->re_connect_status = 1;
+ rpcrdma_update_cm_private(ep, &event->param.conn);
+ trace_xprtrdma_inline_thresh(ep);
+@@ -290,7 +294,7 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
+ ep->re_connect_status = -ECONNABORTED;
+ disconnected:
+ xprt_force_disconnect(xprt);
+- return rpcrdma_ep_destroy(ep);
++ return rpcrdma_ep_put(ep);
+ default:
+ break;
+ }
+@@ -346,7 +350,7 @@ out:
+ return ERR_PTR(rc);
+ }
+
+-static void rpcrdma_ep_put(struct kref *kref)
++static void rpcrdma_ep_destroy(struct kref *kref)
+ {
+ struct rpcrdma_ep *ep = container_of(kref, struct rpcrdma_ep, re_kref);
+
+@@ -370,13 +374,18 @@ static void rpcrdma_ep_put(struct kref *kref)
+ module_put(THIS_MODULE);
+ }
+
++static noinline void rpcrdma_ep_get(struct rpcrdma_ep *ep)
++{
++ kref_get(&ep->re_kref);
++}
++
+ /* Returns:
+ * %0 if @ep still has a positive kref count, or
+ * %1 if @ep was destroyed successfully.
+ */
+-static int rpcrdma_ep_destroy(struct rpcrdma_ep *ep)
++static noinline int rpcrdma_ep_put(struct rpcrdma_ep *ep)
+ {
+- return kref_put(&ep->re_kref, rpcrdma_ep_put);
++ return kref_put(&ep->re_kref, rpcrdma_ep_destroy);
+ }
+
+ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
+@@ -493,7 +502,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
+ return 0;
+
+ out_destroy:
+- rpcrdma_ep_destroy(ep);
++ rpcrdma_ep_put(ep);
+ rdma_destroy_id(id);
+ out_free:
+ kfree(ep);
+@@ -522,8 +531,12 @@ retry:
+
+ ep->re_connect_status = 0;
+ xprt_clear_connected(xprt);
+-
+ rpcrdma_reset_cwnd(r_xprt);
++
++ /* Bump the ep's reference count while there are
++ * outstanding Receives.
++ */
++ rpcrdma_ep_get(ep);
+ rpcrdma_post_recvs(r_xprt, true);
+
+ rc = rpcrdma_sendctxs_create(r_xprt);
+@@ -588,7 +601,7 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt)
+ rpcrdma_mrs_destroy(r_xprt);
+ rpcrdma_sendctxs_destroy(r_xprt);
+
+- if (rpcrdma_ep_destroy(ep))
++ if (rpcrdma_ep_put(ep))
+ rdma_destroy_id(id);
+
+ r_xprt->rx_ep = NULL;
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
