--- /dev/null
+From 545ea683d9e3c6ee284d8f1020582a448723e0b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 17:48:13 -0800
+Subject: KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit 710c476514313c74045c41c0571bb5178fd16e3d ]
+
+AMD's event select is 3 nybbles, with the high nybble in bits 35:32 of
+a PerfEvtSeln MSR. Don't mask off the high nybble when configuring a
+RAW perf event.
+
+Fixes: ca724305a2b0 ("KVM: x86/vPMU: Implement AMD vPMU code for KVM")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Message-Id: <20220203014813.2130559-2-jmattson@google.com>
+Reviewed-by: David Dunn <daviddunn@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/pmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index 1bca8016ee8ae..b1fde6a548403 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -171,7 +171,7 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)
+ }
+
+ if (type == PERF_TYPE_RAW)
+- config = eventsel & X86_RAW_EVENT_MASK;
++ config = eventsel & AMD64_RAW_EVENT_MASK;
+
+ pmc_reprogram_counter(pmc, type, config,
+ !(eventsel & ARCH_PERFMON_EVENTSEL_USR),
+--
+2.34.1
+
--- /dev/null
+From 24a4912819f943b3e865413e644789b5634bbbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jan 2022 23:43:44 +0100
+Subject: mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
+
+From: david regan <dregan@mail.com>
+
+[ Upstream commit 36415a7964711822e63695ea67fede63979054d9 ]
+
+The brcmnand driver contains a bug in which if a page (example 2k byte)
+is read from the parallel/ONFI NAND and within that page a subpage (512
+byte) has correctable errors which is followed by a subpage with
+uncorrectable errors, the page read will return the wrong status of
+correctable (as opposed to the actual status of uncorrectable.)
+
+The bug is in function brcmnand_read_by_pio where there is a check for
+uncorrectable bits which will be preempted if a previous status for
+correctable bits is detected.
+
+The fix is to stop checking for bad bits only if we already have a bad
+bits status.
+
+Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
+Signed-off-by: david regan <dregan@mail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/trinity-478e0c09-9134-40e8-8f8c-31c371225eda-1643237024774@3c-app-mailcom-lxa02
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/brcmnand/brcmnand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
+index be4c6f256e807..2741147481c0a 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -1673,7 +1673,7 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
+ mtd->oobsize / trans,
+ host->hwcfg.sector_size_1k);
+
+- if (!ret) {
++ if (ret != -EBADMSG) {
+ *err_addr = brcmnand_get_uncorrecc_addr(ctrl);
+
+ if (*err_addr)
+--
+2.34.1
+
--- /dev/null
+From 27b7a5f08dd0e6573b2336cb006be75c534923e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:36:29 -0400
+Subject: mtd: rawnand: brcmnand: Refactored code to introduce helper functions
+
+From: Kamal Dasu <kdasu.kdev@gmail.com>
+
+[ Upstream commit 3c7c1e4594efd57b98ae6f7298f40cff4f4fb47b ]
+
+Refactored NAND ECC and CMD address configuration code to use helper
+functions.
+
+Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/brcmnand/brcmnand.c | 100 +++++++++++++++++----------
+ 1 file changed, 62 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
+index c65724d0c725d..be4c6f256e807 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -589,6 +589,54 @@ static inline void brcmnand_write_fc(struct brcmnand_controller *ctrl,
+ __raw_writel(val, ctrl->nand_fc + word * 4);
+ }
+
++static void brcmnand_clear_ecc_addr(struct brcmnand_controller *ctrl)
++{
++
++ /* Clear error addresses */
++ brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
++ brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
++}
++
++static u64 brcmnand_get_uncorrecc_addr(struct brcmnand_controller *ctrl)
++{
++ u64 err_addr;
++
++ err_addr = brcmnand_read_reg(ctrl, BRCMNAND_UNCORR_ADDR);
++ err_addr |= ((u64)(brcmnand_read_reg(ctrl,
++ BRCMNAND_UNCORR_EXT_ADDR)
++ & 0xffff) << 32);
++
++ return err_addr;
++}
++
++static u64 brcmnand_get_correcc_addr(struct brcmnand_controller *ctrl)
++{
++ u64 err_addr;
++
++ err_addr = brcmnand_read_reg(ctrl, BRCMNAND_CORR_ADDR);
++ err_addr |= ((u64)(brcmnand_read_reg(ctrl,
++ BRCMNAND_CORR_EXT_ADDR)
++ & 0xffff) << 32);
++
++ return err_addr;
++}
++
++static void brcmnand_set_cmd_addr(struct mtd_info *mtd, u64 addr)
++{
++ struct nand_chip *chip = mtd_to_nand(mtd);
++ struct brcmnand_host *host = nand_get_controller_data(chip);
++ struct brcmnand_controller *ctrl = host->ctrl;
++
++ brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
++ (host->cs << 16) | ((addr >> 32) & 0xffff));
++ (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
++ brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
++ lower_32_bits(addr));
++ (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++}
++
+ static inline u16 brcmnand_cs_offset(struct brcmnand_controller *ctrl, int cs,
+ enum brcmnand_cs_reg reg)
+ {
+@@ -1217,9 +1265,12 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)
+ {
+ struct brcmnand_controller *ctrl = host->ctrl;
+ int ret;
++ u64 cmd_addr;
++
++ cmd_addr = brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++
++ dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
+
+- dev_dbg(ctrl->dev, "send native cmd %d addr_lo 0x%x\n", cmd,
+- brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS));
+ BUG_ON(ctrl->cmd_pending != 0);
+ ctrl->cmd_pending = cmd;
+
+@@ -1380,12 +1431,7 @@ static void brcmnand_cmdfunc(struct mtd_info *mtd, unsigned command,
+ if (!native_cmd)
+ return;
+
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS, lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
+-
++ brcmnand_set_cmd_addr(mtd, addr);
+ brcmnand_send_cmd(host, native_cmd);
+ brcmnand_waitfunc(mtd, chip);
+
+@@ -1605,20 +1651,10 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
+ struct brcmnand_controller *ctrl = host->ctrl;
+ int i, j, ret = 0;
+
+- /* Clear error addresses */
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_CORR_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_EXT_ADDR, 0);
+- brcmnand_write_reg(ctrl, BRCMNAND_CORR_EXT_ADDR, 0);
+-
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
++ brcmnand_clear_ecc_addr(ctrl);
+
+ for (i = 0; i < trans; i++, addr += FC_BYTES) {
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+- lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++ brcmnand_set_cmd_addr(mtd, addr);
+ /* SPARE_AREA_READ does not use ECC, so just use PAGE_READ */
+ brcmnand_send_cmd(host, CMD_PAGE_READ);
+ brcmnand_waitfunc(mtd, chip);
+@@ -1638,21 +1674,15 @@ static int brcmnand_read_by_pio(struct mtd_info *mtd, struct nand_chip *chip,
+ host->hwcfg.sector_size_1k);
+
+ if (!ret) {
+- *err_addr = brcmnand_read_reg(ctrl,
+- BRCMNAND_UNCORR_ADDR) |
+- ((u64)(brcmnand_read_reg(ctrl,
+- BRCMNAND_UNCORR_EXT_ADDR)
+- & 0xffff) << 32);
++ *err_addr = brcmnand_get_uncorrecc_addr(ctrl);
++
+ if (*err_addr)
+ ret = -EBADMSG;
+ }
+
+ if (!ret) {
+- *err_addr = brcmnand_read_reg(ctrl,
+- BRCMNAND_CORR_ADDR) |
+- ((u64)(brcmnand_read_reg(ctrl,
+- BRCMNAND_CORR_EXT_ADDR)
+- & 0xffff) << 32);
++ *err_addr = brcmnand_get_correcc_addr(ctrl);
++
+ if (*err_addr)
+ ret = -EUCLEAN;
+ }
+@@ -1723,7 +1753,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
+
+ try_dmaread:
+- brcmnand_write_reg(ctrl, BRCMNAND_UNCORR_COUNT, 0);
++ brcmnand_clear_ecc_addr(ctrl);
+
+ if (has_flash_dma(ctrl) && !oob && flash_dma_buf_ok(buf)) {
+ err = brcmnand_dma_trans(host, addr, buf, trans * FC_BYTES,
+@@ -1863,15 +1893,9 @@ static int brcmnand_write(struct mtd_info *mtd, struct nand_chip *chip,
+ goto out;
+ }
+
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS,
+- (host->cs << 16) | ((addr >> 32) & 0xffff));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_EXT_ADDRESS);
+-
+ for (i = 0; i < trans; i++, addr += FC_BYTES) {
+ /* full address MUST be set before populating FC */
+- brcmnand_write_reg(ctrl, BRCMNAND_CMD_ADDRESS,
+- lower_32_bits(addr));
+- (void)brcmnand_read_reg(ctrl, BRCMNAND_CMD_ADDRESS);
++ brcmnand_set_cmd_addr(mtd, addr);
+
+ if (buf) {
+ brcmnand_soc_data_bus_prepare(ctrl->soc, false);
+--
+2.34.1
+