--- /dev/null
+From 7a6146f1435a975cd99a6ca7d9b59d44607d399e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 20:36:43 +0200
+Subject: batman-adv: Avoid uninitialized chaddr when handling DHCP
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ]
+
+The gateway client code can try to optimize the delivery of DHCP packets to
+avoid broadcasting them through the whole mesh. But also transmissions to
+the client can be optimized by looking up the destination via the chaddr of
+the DHCP packet.
+
+But the chaddr is currently only done when chaddr is fully inside the
+non-paged area of the skbuff. Otherwise it will not be initialized and the
+unoptimized path should have been taken.
+
+But the implementation didn't handle this correctly. It didn't retrieve the
+correct chaddr but still tried to perform the TT lookup with this
+uninitialized memory.
+
+Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com
+Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Acked-by: Antonio Quartulli <a@unstable.cc>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/gateway_client.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index 3bd7ed6b6b3e1..9727afc030d8c 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -673,8 +673,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
+
+ chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
+ /* store the client address if the message is going to a client */
+- if (ret == BATADV_DHCP_TO_CLIENT &&
+- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
++ if (ret == BATADV_DHCP_TO_CLIENT) {
++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
++ return BATADV_DHCP_NO;
++
+ /* check if the DHCP packet carries an Ethernet DHCP */
+ p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
+ if (*p != BATADV_DHCP_HTYPE_ETHERNET)
+--
+2.25.1
+
--- /dev/null
+From a502bee11d148c742c269a41768a6446188a5ea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 17:46:10 +0300
+Subject: batman-adv: bla: use netif_rx_ni when not in interrupt context
+
+From: Jussi Kivilinna <jussi.kivilinna@haltian.com>
+
+[ Upstream commit 279e89b2281af3b1a9f04906e157992c19c9f163 ]
+
+batadv_bla_send_claim() gets called from worker thread context through
+batadv_bla_periodic_work(), thus netif_rx_ni needs to be used in that
+case. This fixes "NOHZ: local_softirq_pending 08" log messages seen
+when batman-adv is enabled.
+
+Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
+Signed-off-by: Jussi Kivilinna <jussi.kivilinna@haltian.com>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/bridge_loop_avoidance.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 00123064eb26d..e545b42ab0b98 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -451,7 +451,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac,
+ skb->len + ETH_HLEN);
+ soft_iface->last_rx = jiffies;
+
+- netif_rx(skb);
++ if (in_interrupt())
++ netif_rx(skb);
++ else
++ netif_rx_ni(skb);
+ out:
+ if (primary_if)
+ batadv_hardif_put(primary_if);
+--
+2.25.1
+
--- /dev/null
+From 287315f1a9b05a55c6eb39e146bc41845f412b36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 01:08:33 -0400
+Subject: bnxt_en: Check for zero dir entries in NVRAM.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit dbbfa96ad920c50d58bcaefa57f5f33ceef9d00e ]
+
+If firmware goes into unstable state, HWRM_NVM_GET_DIR_INFO firmware
+command may return zero dir entries. Return error in such case to
+avoid zero length dma buffer request.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 427d4dbc97354..ac03bba10e4fd 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1457,6 +1457,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data)
+ if (rc != 0)
+ return rc;
+
++ if (!dir_entries || !entry_length)
++ return -EIO;
++
+ /* Insert 2 bytes of directory info (count and size of entries) */
+ if (len < 2)
+ return -EINVAL;
+--
+2.25.1
+
--- /dev/null
+From 6894edc3f90b2cfbabfe4effd59748301aaf1e24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 01:08:35 -0400
+Subject: bnxt_en: Fix PCI AER error recovery flow
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit df3875ec550396974b1d8a518bd120d034738236 ]
+
+When a PCI error is detected the PCI state could be corrupt, save
+the PCI state after initialization and restore it after the slot
+reset.
+
+Fixes: 6316ea6db93d ("bnxt_en: Enable AER support.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 421cbba9a3bc8..f451be63ab7e6 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7085,6 +7085,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ bnxt_parse_log_pcie_link(bp);
+
++ pci_save_state(pdev);
+ return 0;
+
+ init_err:
+@@ -7158,6 +7159,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev)
+ "Cannot re-enable PCI device after reset.\n");
+ } else {
+ pci_set_master(pdev);
++ pci_restore_state(pdev);
++ pci_save_state(pdev);
+
+ if (netif_running(netdev))
+ err = bnxt_open(netdev);
+--
+2.25.1
+
--- /dev/null
+From 3cee79ad3fc0daf775f80937f450f5cb0c57d792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 19:57:26 +0800
+Subject: dmaengine: at_hdmac: check return value of of_find_device_by_node()
+ in at_dma_xlate()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 0cef8e2c5a07d482ec907249dbd6687e8697677f ]
+
+The reurn value of of_find_device_by_node() is not checked, thus null
+pointer dereference will be triggered if of_find_device_by_node()
+failed.
+
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20200817115728.1706719-2-yukuai3@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_hdmac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index a32cd71f94bbe..cb72b8c915c73 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1810,6 +1810,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ dmac_pdev = of_find_device_by_node(dma_spec->np);
++ if (!dmac_pdev)
++ return NULL;
+
+ dma_cap_zero(mask);
+ dma_cap_set(DMA_SLAVE, mask);
+--
+2.25.1
+
--- /dev/null
+From 33962db1def279b7695260b9d6693667e7910485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 13:49:28 +0300
+Subject: dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 5b2aa9f918f6837ae943557f8cec02c34fcf80e7 ]
+
+of_dma_xlate callback can return ERR_PTR as well NULL in case of failure.
+
+If error code is returned (not NULL) then the route should be released and
+the router should not be registered for the channel.
+
+Fixes: 56f13c0d9524c ("dmaengine: of_dma: Support for DMA routers")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20200806104928.25975-1-peter.ujfalusi@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/of-dma.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c
+index faae0bfe1109e..757cf48c1c5ed 100644
+--- a/drivers/dma/of-dma.c
++++ b/drivers/dma/of-dma.c
+@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec,
+ return NULL;
+
+ chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target);
+- if (chan) {
+- chan->router = ofdma->dma_router;
+- chan->route_data = route_data;
+- } else {
++ if (IS_ERR_OR_NULL(chan)) {
+ ofdma->dma_router->route_free(ofdma->dma_router->dev,
+ route_data);
++ } else {
++ chan->router = ofdma->dma_router;
++ chan->route_data = route_data;
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From a5c400ace07dd4b17ac1fc7705f3e2eb354f4a8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 08:46:17 +0200
+Subject: dmaengine: pl330: Fix burst length if burst size is smaller than bus
+ width
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 0661cef675d37e2c4b66a996389ebeae8568e49e ]
+
+Move the burst len fixup after setting the generic value for it. This
+finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine:
+pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was
+overwritten by the generic value.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20200825064617.16193-1-m.szyprowski@samsung.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pl330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 57b375d0de292..16c08846ea0e1 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2677,6 +2677,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ while (burst != (1 << desc->rqcfg.brst_size))
+ desc->rqcfg.brst_size++;
+
++ desc->rqcfg.brst_len = get_burst_len(desc, len);
+ /*
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+@@ -2684,7 +2685,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+- desc->rqcfg.brst_len = get_burst_len(desc, len);
+ desc->bytes_requested = len;
+
+ desc->txd.flags = flags;
+--
+2.25.1
+
--- /dev/null
+From 6069c5e1f428b413dde1c4753bf30a77f4992638 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 01:33:48 +0800
+Subject: drm/radeon: Prefer lower feedback dividers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit fc8c70526bd30733ea8667adb8b8ffebea30a8ed ]
+
+Commit 2e26ccb119bd ("drm/radeon: prefer lower reference dividers")
+fixed screen flicker for HP Compaq nx9420 but breaks other laptops like
+Asus X50SL.
+
+Turns out we also need to favor lower feedback dividers.
+
+Users confirmed this change fixes the regression and doesn't regress the
+original fix.
+
+Fixes: 2e26ccb119bd ("drm/radeon: prefer lower reference dividers")
+BugLink: https://bugs.launchpad.net/bugs/1791312
+BugLink: https://bugs.launchpad.net/bugs/1861554
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 99e23800cadc7..3fcccd0b99aff 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -940,7 +940,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div,
+
+ /* get matching reference and feedback divider */
+ *ref_div = min(max(den/post_div, 1u), ref_div_max);
+- *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);
++ *fb_div = max(nom * *ref_div * post_div / den, 1u);
+
+ /* limit fb divider to its maximum */
+ if (*fb_div > fb_div_max) {
+--
+2.25.1
+
--- /dev/null
+From f585f76a1358b5976e05fc5cf68365821ee606e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 11:30:48 -0400
+Subject: fix regression in "epoll: Keep a reference on files added to the
+ check list"
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ]
+
+epoll_loop_check_proc() can run into a file already committed to destruction;
+we can't grab a reference on those and don't need to add them to the set for
+reverse path check anyway.
+
+Tested-by: Marc Zyngier <maz@kernel.org>
+Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list")
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/eventpoll.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index aad52e1858363..8c40d6652a9a9 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -1748,9 +1748,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ * during ep_insert().
+ */
+ if (list_empty(&epi->ffd.file->f_tfile_llink)) {
+- get_file(epi->ffd.file);
+- list_add(&epi->ffd.file->f_tfile_llink,
+- &tfile_check_list);
++ if (get_file_rcu(epi->ffd.file))
++ list_add(&epi->ffd.file->f_tfile_llink,
++ &tfile_check_list);
+ }
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 12da5c153faef3b072e3a57f7d304257d4945b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 16:36:19 -0700
+Subject: include/linux/log2.h: add missing () around n in roundup_pow_of_two()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 428fc0aff4e59399ec719ffcc1f7a5d29a4ee476 ]
+
+Otherwise gcc generates warnings if the expression is complicated.
+
+Fixes: 312a0c170945 ("[PATCH] LOG2: Alter roundup_pow_of_two() so that it can use a ilog2() on a constant")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Link: https://lkml.kernel.org/r/0-v1-8a2697e3c003+41165-log_brackets_jgg@nvidia.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/log2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/log2.h b/include/linux/log2.h
+index c373295f359fa..cca606609e1bc 100644
+--- a/include/linux/log2.h
++++ b/include/linux/log2.h
+@@ -159,7 +159,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
+ #define roundup_pow_of_two(n) \
+ ( \
+ __builtin_constant_p(n) ? ( \
+- (n == 1) ? 1 : \
++ ((n) == 1) ? 1 : \
+ (1UL << (ilog2((n) - 1) + 1)) \
+ ) : \
+ __roundup_pow_of_two(n) \
+--
+2.25.1
+
--- /dev/null
+From 1e99fcf2187c775a35d79db37468d2a30a96c42d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 08:06:15 +0800
+Subject: iommu/vt-d: Serialize IOMMU GCMD register modifications
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 6e4e9ec65078093165463c13d4eb92b3e8d7b2e8 ]
+
+The VT-d spec requires (10.4.4 Global Command Register, GCMD_REG General
+Description) that:
+
+If multiple control fields in this register need to be modified, software
+must serialize the modifications through multiple writes to this register.
+
+However, in irq_remapping.c, modifications of IRE and CFI are done in one
+write. We need to do two separate writes with STS checking after each. It
+also checks the status register before writing command register to avoid
+unnecessary register write.
+
+Fixes: af8d102f999a4 ("x86/intel/irq_remapping: Clean up x2apic opt-out security warning mess")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Link: https://lore.kernel.org/r/20200828000615.8281-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel_irq_remapping.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
+index ac596928f6b40..ce125ec23d2a5 100644
+--- a/drivers/iommu/intel_irq_remapping.c
++++ b/drivers/iommu/intel_irq_remapping.c
+@@ -486,12 +486,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu)
+
+ /* Enable interrupt-remapping */
+ iommu->gcmd |= DMA_GCMD_IRE;
+- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */
+ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
+-
+ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
+ readl, (sts & DMA_GSTS_IRES), sts);
+
++ /* Block compatibility-format MSIs */
++ if (sts & DMA_GSTS_CFIS) {
++ iommu->gcmd &= ~DMA_GCMD_CFI;
++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
++ readl, !(sts & DMA_GSTS_CFIS), sts);
++ }
++
+ /*
+ * With CFI clear in the Global Command register, we should be
+ * protected from dangerous (i.e. compatibility) interrupts
+--
+2.25.1
+
--- /dev/null
+From a1b044c252d8a0a0b7966530d51abb482896d476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 11:26:45 -0700
+Subject: MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit e14f633b66902615cf7faa5d032b45ab8b6fb158 ]
+
+The initialization done by bmips_cpu_setup() typically affects both
+threads of a given core, on 7435 which supports 2 cores and 2 threads,
+logical CPU number 2 and 3 would not run this initialization.
+
+Fixes: 738a3f79027b ("MIPS: BMIPS: Add early CPU initialization code")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/smp-bmips.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 416d53f587e7c..6e36717527754 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -236,6 +236,8 @@ static void bmips_boot_secondary(int cpu, struct task_struct *idle)
+ */
+ static void bmips_init_secondary(void)
+ {
++ bmips_cpu_setup();
++
+ switch (current_cpu_type()) {
+ case CPU_BMIPS4350:
+ case CPU_BMIPS4380:
+--
+2.25.1
+
--- /dev/null
+From b3ab26c3bb29f264e9975c88e9ad4650dec15fbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 11:26:44 -0700
+Subject: MIPS: mm: BMIPS5000 has inclusive physical caches
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit dbfc95f98f0158958d1f1e6bf06d74be38dbd821 ]
+
+When the BMIPS generic cpu-feature-overrides.h file was introduced,
+cpu_has_inclusive_caches/MIPS_CPU_INCLUSIVE_CACHES was not set for
+BMIPS5000 CPUs. Correct this when we have initialized the MIPS secondary
+cache successfully.
+
+Fixes: f337967d6d87 ("MIPS: BMIPS: Add cpu-feature-overrides.h")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/c-r4k.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 0ff379f0cc4a7..cb877f86f5fc9 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1746,7 +1746,11 @@ static void setup_scache(void)
+ printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n",
+ scache_size >> 10,
+ way_string[c->scache.ways], c->scache.linesz);
++
++ if (current_cpu_type() == CPU_BMIPS5000)
++ c->options |= MIPS_CPU_INCLUSIVE_CACHES;
+ }
++
+ #else
+ if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT))
+ panic("Dunno how to handle MIPS32 / MIPS64 second level cache");
+--
+2.25.1
+
--- /dev/null
+From 33ef0ae5b6bdbed4629000abcc4dceb120ea3f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 16:56:47 +0800
+Subject: net: arc_emac: Fix memleak in arc_mdio_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit e2d79cd8875fa8c3cc7defa98a8cc99a1ed0c62f ]
+
+When devm_gpiod_get_optional() fails, bus should be
+freed just like when of_mdiobus_register() fails.
+
+Fixes: 1bddd96cba03d ("net: arc_emac: support the phy reset for emac driver")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/arc/emac_mdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c
+index a22403c688c95..337cfce78aef2 100644
+--- a/drivers/net/ethernet/arc/emac_mdio.c
++++ b/drivers/net/ethernet/arc/emac_mdio.c
+@@ -152,6 +152,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv)
+ if (IS_ERR(data->reset_gpio)) {
+ error = PTR_ERR(data->reset_gpio);
+ dev_err(priv->dev, "Failed to request gpio: %d\n", error);
++ mdiobus_free(bus);
+ return error;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From d15192e5152c4a7cae7c948a06dfc4b065be707c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 13:44:42 +0800
+Subject: net: hns: Fix memleak in hns_nic_dev_probe
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 100e3345c6e719d2291e1efd5de311cc24bb9c0b ]
+
+hns_nic_dev_probe allocates ndev, but not free it on
+two error handling paths, which may lead to memleak.
+
+Fixes: 63434888aaf1b ("net: hns: net: hns: enet adds support of acpi")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 24a815997ec57..796f81106b432 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1990,8 +1990,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->enet_ver = AE_VERSION_1;
+ else if (acpi_dev_found(hns_enet_acpi_match[1].id))
+ priv->enet_ver = AE_VERSION_2;
+- else
+- return -ENXIO;
++ else {
++ ret = -ENXIO;
++ goto out_read_prop_fail;
++ }
+
+ /* try to find port-idx-in-ae first */
+ ret = acpi_node_get_property_reference(dev->fwnode,
+@@ -2003,7 +2005,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev)
+ priv->fwnode = acpi_fwnode_handle(args.adev);
+ } else {
+ dev_err(dev, "cannot read cfg data from OF or acpi\n");
+- return -ENXIO;
++ ret = -ENXIO;
++ goto out_read_prop_fail;
+ }
+
+ ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id);
+--
+2.25.1
+
--- /dev/null
+From 400daa80e37fcc35eb5a6bcc00b12ab550103b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 14:12:54 +0200
+Subject: netfilter: nf_tables: add NFTA_SET_USERDATA if not null
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 6f03bf43ee05b31d3822def2a80f11b3591c55b3 ]
+
+Kernel sends an empty NFTA_SET_USERDATA attribute with no value if
+userspace adds a set with no NFTA_SET_USERDATA attribute.
+
+Fixes: e6d8ecac9e68 ("netfilter: nf_tables: Add new attributes into nft_set to store user data.")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2fa1c4f2e94e0..ec460aedfc617 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2592,7 +2592,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ goto nla_put_failure;
+ }
+
+- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
++ if (set->udata &&
++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata))
+ goto nla_put_failure;
+
+ desc = nla_nest_start(skb, NFTA_SET_DESC);
+--
+2.25.1
+
--- /dev/null
+From b062aae7c5092f3f0d5df762e3f666b5b3147904 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 21:05:50 +0200
+Subject: netfilter: nf_tables: fix destination register zeroing
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ]
+
+Following bug was reported via irc:
+nft list ruleset
+ set knock_candidates_ipv4 {
+ type ipv4_addr . inet_service
+ size 65535
+ elements = { 127.0.0.1 . 123,
+ 127.0.0.1 . 123 }
+ }
+ ..
+ udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 }
+ udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport }
+
+It should not have been possible to add a duplicate set entry.
+
+After some debugging it turned out that the problem is the immediate
+value (123) in the second-to-last rule.
+
+Concatenations use 32bit registers, i.e. the elements are 8 bytes each,
+not 6 and it turns out the kernel inserted
+
+inet firewall @knock_candidates_ipv4
+ element 0100007f ffff7b00 : 0 [end]
+ element 0100007f 00007b00 : 0 [end]
+
+Note the non-zero upper bits of the first element. It turns out that
+nft_immediate doesn't zero the destination register, but this is needed
+when the length isn't a multiple of 4.
+
+Furthermore, the zeroing in nft_payload is broken. We can't use
+[len / 4] = 0 -- if len is a multiple of 4, index is off by one.
+
+Skip zeroing in this case and use a conditional instead of (len -1) / 4.
+
+Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tables.h | 2 ++
+ net/netfilter/nft_payload.c | 4 +++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
+index 7ba9a624090fb..91e395fd0a65c 100644
+--- a/include/net/netfilter/nf_tables.h
++++ b/include/net/netfilter/nf_tables.h
+@@ -119,6 +119,8 @@ static inline u8 nft_reg_load8(u32 *sreg)
+ static inline void nft_data_copy(u32 *dst, const struct nft_data *src,
+ unsigned int len)
+ {
++ if (len % NFT_REG32_SIZE)
++ dst[len / NFT_REG32_SIZE] = 0;
+ memcpy(dst, src, len);
+ }
+
+diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
+index b2f88617611aa..f73d47b3ffb72 100644
+--- a/net/netfilter/nft_payload.c
++++ b/net/netfilter/nft_payload.c
+@@ -74,7 +74,9 @@ static void nft_payload_eval(const struct nft_expr *expr,
+ u32 *dest = ®s->data[priv->dreg];
+ int offset;
+
+- dest[priv->len / NFT_REG32_SIZE] = 0;
++ if (priv->len % NFT_REG32_SIZE)
++ dest[priv->len / NFT_REG32_SIZE] = 0;
++
+ switch (priv->base) {
+ case NFT_PAYLOAD_LL_HEADER:
+ if (!skb_mac_header_was_set(skb))
+--
+2.25.1
+
--- /dev/null
+From 645115fdd4f5451ebdfe41a4653a7617c14354ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 14:12:55 +0200
+Subject: netfilter: nf_tables: incorrect enum nft_list_attributes definition
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit da9125df854ea48a6240c66e8a67be06e2c12c03 ]
+
+This should be NFTA_LIST_UNSPEC instead of NFTA_LIST_UNPEC, all other
+similar attribute definitions are postfixed with _UNSPEC.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter/nf_tables.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
+index c6c4477c136b9..d121c22bf9284 100644
+--- a/include/uapi/linux/netfilter/nf_tables.h
++++ b/include/uapi/linux/netfilter/nf_tables.h
+@@ -114,7 +114,7 @@ enum nf_tables_msg_types {
+ * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+ */
+ enum nft_list_attributes {
+- NFTA_LIST_UNPEC,
++ NFTA_LIST_UNSPEC,
+ NFTA_LIST_ELEM,
+ __NFTA_LIST_MAX
+ };
+--
+2.25.1
+
--- /dev/null
+From 896e84d069d33133555fe09dc84a367788ab7c6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 18:43:07 +0900
+Subject: ravb: Fixed to be able to unload modules
+
+From: Yuusuke Ashizuka <ashiduka@fujitsu.com>
+
+[ Upstream commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc ]
+
+When this driver is built as a module, I cannot rmmod it after insmoding
+it.
+This is because that this driver calls ravb_mdio_init() at the time of
+probe, and module->refcnt is incremented by alloc_mdio_bitbang() called
+after that.
+Therefore, even if ifup is not performed, the driver is in use and rmmod
+cannot be performed.
+
+$ lsmod
+Module Size Used by
+ravb 40960 1
+$ rmmod ravb
+rmmod: ERROR: Module ravb is in use
+
+Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby
+rmmod is possible in the ifdown state.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Yuusuke Ashizuka <ashiduka@fujitsu.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------
+ 1 file changed, 55 insertions(+), 55 deletions(-)
+
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 93d3152752ff4..a5de56bcbac08 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1336,6 +1336,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ return error;
+ }
+
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++ struct platform_device *pdev = priv->pdev;
++ struct device *dev = &pdev->dev;
++ int error;
++
++ /* Bitbang init */
++ priv->mdiobb.ops = &bb_ops;
++
++ /* MII controller setting */
++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++ if (!priv->mii_bus)
++ return -ENOMEM;
++
++ /* Hook up MII support for ethtool */
++ priv->mii_bus->name = "ravb_mii";
++ priv->mii_bus->parent = dev;
++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++ pdev->name, pdev->id);
++
++ /* Register MDIO bus */
++ error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++ if (error)
++ goto out_free_bus;
++
++ return 0;
++
++out_free_bus:
++ free_mdio_bitbang(priv->mii_bus);
++ return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++ /* Unregister mdio bus */
++ mdiobus_unregister(priv->mii_bus);
++
++ /* Free bitbang info */
++ free_mdio_bitbang(priv->mii_bus);
++
++ return 0;
++}
++
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1344,6 +1389,13 @@ static int ravb_open(struct net_device *ndev)
+ struct device *dev = &pdev->dev;
+ int error;
+
++ /* MDIO bus init */
++ error = ravb_mdio_init(priv);
++ if (error) {
++ netdev_err(ndev, "failed to initialize MDIO\n");
++ return error;
++ }
++
+ napi_enable(&priv->napi[RAVB_BE]);
+ napi_enable(&priv->napi[RAVB_NC]);
+
+@@ -1421,6 +1473,7 @@ out_free_irq:
+ out_napi_off:
+ napi_disable(&priv->napi[RAVB_NC]);
+ napi_disable(&priv->napi[RAVB_BE]);
++ ravb_mdio_release(priv);
+ return error;
+ }
+
+@@ -1718,6 +1771,8 @@ static int ravb_close(struct net_device *ndev)
+ ravb_ring_free(ndev, RAVB_BE);
+ ravb_ring_free(ndev, RAVB_NC);
+
++ ravb_mdio_release(priv);
++
+ return 0;
+ }
+
+@@ -1820,51 +1875,6 @@ static const struct net_device_ops ravb_netdev_ops = {
+ .ndo_change_mtu = eth_change_mtu,
+ };
+
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+- struct platform_device *pdev = priv->pdev;
+- struct device *dev = &pdev->dev;
+- int error;
+-
+- /* Bitbang init */
+- priv->mdiobb.ops = &bb_ops;
+-
+- /* MII controller setting */
+- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+- if (!priv->mii_bus)
+- return -ENOMEM;
+-
+- /* Hook up MII support for ethtool */
+- priv->mii_bus->name = "ravb_mii";
+- priv->mii_bus->parent = dev;
+- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+- pdev->name, pdev->id);
+-
+- /* Register MDIO bus */
+- error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+- if (error)
+- goto out_free_bus;
+-
+- return 0;
+-
+-out_free_bus:
+- free_mdio_bitbang(priv->mii_bus);
+- return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+- /* Unregister mdio bus */
+- mdiobus_unregister(priv->mii_bus);
+-
+- /* Free bitbang info */
+- free_mdio_bitbang(priv->mii_bus);
+-
+- return 0;
+-}
+-
+ static const struct of_device_id ravb_match_table[] = {
+ { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2069,13 +2079,6 @@ static int ravb_probe(struct platform_device *pdev)
+ eth_hw_addr_random(ndev);
+ }
+
+- /* MDIO bus init */
+- error = ravb_mdio_init(priv);
+- if (error) {
+- dev_err(&pdev->dev, "failed to initialize MDIO\n");
+- goto out_dma_free;
+- }
+-
+ netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+
+@@ -2095,8 +2098,6 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+-out_dma_free:
+ dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ priv->desc_bat_dma);
+
+@@ -2129,7 +2130,6 @@ static int ravb_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ netif_napi_del(&priv->napi[RAVB_NC]);
+ netif_napi_del(&priv->napi[RAVB_BE]);
+- ravb_mdio_release(priv);
+ pm_runtime_disable(&pdev->dev);
+ free_netdev(ndev);
+ platform_set_drvdata(pdev, NULL);
+--
+2.25.1
+
ceph-don-t-allow-setlease-on-cephfs.patch
s390-don-t-trace-preemption-in-percpu-macros.patch
xen-xenbus-fix-granting-of-vmalloc-d-memory.patch
+dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch
+batman-adv-avoid-uninitialized-chaddr-when-handling-.patch
+batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch
+dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch
+mips-mm-bmips5000-has-inclusive-physical-caches.patch
+mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch
+netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch
+netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch
+netfilter-nf_tables-fix-destination-register-zeroing.patch
+net-hns-fix-memleak-in-hns_nic_dev_probe.patch
+ravb-fixed-to-be-able-to-unload-modules.patch
+net-arc_emac-fix-memleak-in-arc_mdio_probe.patch
+dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch
+bnxt_en-check-for-zero-dir-entries-in-nvram.patch
+bnxt_en-fix-pci-aer-error-recovery-flow.patch
+fix-regression-in-epoll-keep-a-reference-on-files-ad.patch
+drm-radeon-prefer-lower-feedback-dividers.patch
+tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch
+iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch
+thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch
+include-linux-log2.h-add-missing-around-n-in-roundup.patch
--- /dev/null
+From d93d8fe822f629cbb81dc5148aa58ee24a1db59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Sep 2020 14:28:54 -0400
+Subject: tg3: Fix soft lockup when tg3_reset_task() fails.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 556699341efa98243e08e34401b3f601da91f5a3 ]
+
+If tg3_reset_task() fails, the device state is left in an inconsistent
+state with IFF_RUNNING still set but NAPI state not enabled. A
+subsequent operation, such as ifdown or AER error can cause it to
+soft lock up when it tries to disable NAPI state.
+
+Fix it by bringing down the device to !IFF_RUNNING state when
+tg3_reset_task() fails. tg3_reset_task() running from workqueue
+will now call tg3_close() when the reset fails. We need to
+modify tg3_reset_task_cancel() slightly to avoid tg3_close()
+calling cancel_work_sync() to cancel tg3_reset_task(). Otherwise
+cancel_work_sync() will wait forever for tg3_reset_task() to
+finish.
+
+Reported-by: David Christensen <drc@linux.vnet.ibm.com>
+Reported-by: Baptiste Covolato <baptiste@arista.com>
+Fixes: db2199737990 ("tg3: Schedule at most one tg3_reset_task run")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 5790b35064a8d..2db6102ed5848 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -7201,8 +7201,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp)
+
+ static inline void tg3_reset_task_cancel(struct tg3 *tp)
+ {
+- cancel_work_sync(&tp->reset_task);
+- tg3_flag_clear(tp, RESET_TASK_PENDING);
++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags))
++ cancel_work_sync(&tp->reset_task);
+ tg3_flag_clear(tp, TX_RECOVERY_PENDING);
+ }
+
+@@ -11174,18 +11174,27 @@ static void tg3_reset_task(struct work_struct *work)
+
+ tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
+ err = tg3_init_hw(tp, true);
+- if (err)
++ if (err) {
++ tg3_full_unlock(tp);
++ tp->irq_sync = 0;
++ tg3_napi_enable(tp);
++ /* Clear this flag so that tg3_reset_task_cancel() will not
++ * call cancel_work_sync() and wait forever.
++ */
++ tg3_flag_clear(tp, RESET_TASK_PENDING);
++ dev_close(tp->dev);
+ goto out;
++ }
+
+ tg3_netif_start(tp);
+
+-out:
+ tg3_full_unlock(tp);
+
+ if (!err)
+ tg3_phy_start(tp);
+
+ tg3_flag_clear(tp, RESET_TASK_PENDING);
++out:
+ rtnl_unlock();
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 9a4791749886d260540c74bcec01bb54d08c7976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 11:33:38 -0700
+Subject: thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 30d24faba0532d6972df79a1bf060601994b5873 ]
+
+We can sometimes get bogus thermal shutdowns on omap4430 at least with
+droid4 running idle with a battery charger connected:
+
+thermal thermal_zone0: critical temperature reached (143 C), shutting down
+
+Dumping out the register values shows we can occasionally get a 0x7f value
+that is outside the TRM listed values in the ADC conversion table. And then
+we get a normal value when reading again after that. Reading the register
+multiple times does not seem help avoiding the bogus values as they stay
+until the next sample is ready.
+
+Looking at the TRM chapter "18.4.10.2.3 ADC Codes Versus Temperature", we
+should have values from 13 to 107 listed with a total of 95 values. But
+looking at the omap4430_adc_to_temp array, the values are off, and the
+end values are missing. And it seems that the 4430 ADC table is similar
+to omap3630 rather than omap4460.
+
+Let's fix the issue by using values based on the omap3630 table and just
+ignoring invalid values. Compared to the 4430 TRM, the omap3630 table has
+the missing values added while the TRM table only shows every second
+value.
+
+Note that sometimes the ADC register values within the valid table can
+also be way off for about 1 out of 10 values. But it seems that those
+just show about 25 C too low values rather than too high values. So those
+do not cause a bogus thermal shutdown.
+
+Fixes: 1a31270e54d7 ("staging: omap-thermal: add OMAP4 data structures")
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200706183338.25622-1-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ti-soc-thermal/omap4-thermal-data.c | 23 ++++++++++---------
+ .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +++++---
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+index d255d33da9eb3..02e71d461d5c5 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c
+@@ -49,20 +49,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = {
+
+ /*
+ * Temperature values in milli degree celsius
+- * ADC code values from 530 to 923
++ * ADC code values from 13 to 107, see TRM
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
+ */
+ static const int
+ omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = {
+- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000,
+- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000,
+- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000,
+- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000,
+- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000,
+- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000,
+- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000,
+- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000,
+- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000,
+- 117000, 118000, 120000, 122000, 123000,
++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000,
++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000,
++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000,
++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500,
++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000,
++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000,
++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000,
++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000,
++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000,
++ 115000, 117000, 118500, 120000, 122000, 123500, 125000,
+ };
+
+ /* OMAP4430 data */
+diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+index 6f2de3a3356d4..86850082b24b9 100644
+--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h
+@@ -67,9 +67,13 @@
+ * and thresholds for OMAP4430.
+ */
+
+-/* ADC conversion table limits */
+-#define OMAP4430_ADC_START_VALUE 0
+-#define OMAP4430_ADC_END_VALUE 127
++/*
++ * ADC conversion table limits. Ignore values outside the TRM listed
++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter
++ * "18.4.10.2.3 ADC Codes Versus Temperature".
++ */
++#define OMAP4430_ADC_START_VALUE 13
++#define OMAP4430_ADC_END_VALUE 107
+ /* bandgap clock limits (no control on 4430) */
+ #define OMAP4430_MAX_FREQ 32768
+ #define OMAP4430_MIN_FREQ 32768
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
