--- /dev/null
+From 7b3f3948c8b7053d771acc9f79810cc410f5e2e0 Mon Sep 17 00:00:00 2001
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Thu, 3 Sep 2020 20:03:12 -0600
+Subject: drm/msm: Disable preemption on all 5xx targets
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+commit 7b3f3948c8b7053d771acc9f79810cc410f5e2e0 upstream.
+
+Temporarily disable preemption on a5xx targets pending some improvements
+to protect the RPTR shadow from being corrupted.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -1510,7 +1510,8 @@ struct msm_gpu *a5xx_gpu_init(struct drm
+
+ check_speed_bin(&pdev->dev);
+
+- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4);
++ /* Restricting nr_rings to 1 to temporarily disable preemption */
++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+ if (ret) {
+ a5xx_destroy(&(a5xx_gpu->base.base));
+ return ERR_PTR(ret);
--- /dev/null
+From f6828e0c4045f03f9cf2df6c2a768102641183f4 Mon Sep 17 00:00:00 2001
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Thu, 3 Sep 2020 20:03:13 -0600
+Subject: drm/msm: Disable the RPTR shadow
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+commit f6828e0c4045f03f9cf2df6c2a768102641183f4 upstream.
+
+Disable the RPTR shadow across all targets. It will be selectively
+re-enabled later for targets that need it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 5 +++++
+ drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 10 ++++++++++
+ drivers/gpu/drm/msm/adreno/a4xx_gpu.c | 10 ++++++++++
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 11 +++++++++--
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 7 +++++++
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 27 ++-------------------------
+ 6 files changed, 43 insertions(+), 27 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
+@@ -164,6 +164,11 @@ static int a2xx_hw_init(struct msm_gpu *
+ if (ret)
+ return ret;
+
++ gpu_write(gpu, REG_AXXX_CP_RB_CNTL,
++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
++
++ gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
++
+ /* NOTE: PM4/micro-engine firmware registers look to be the same
+ * for a2xx and a3xx.. we could possibly push that part down to
+ * adreno_gpu base class. Or push both PM4 and PFP but
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -211,6 +211,16 @@ static int a3xx_hw_init(struct msm_gpu *
+ if (ret)
+ return ret;
+
++ /*
++ * Use the default ringbuffer size and block size but disable the RPTR
++ * shadow
++ */
++ gpu_write(gpu, REG_AXXX_CP_RB_CNTL,
++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
++
++ /* Set the ringbuffer address */
++ gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
++
+ /* setup access protection: */
+ gpu_write(gpu, REG_A3XX_CP_PROTECT_CTRL, 0x00000007);
+
+--- a/drivers/gpu/drm/msm/adreno/a4xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a4xx_gpu.c
+@@ -267,6 +267,16 @@ static int a4xx_hw_init(struct msm_gpu *
+ if (ret)
+ return ret;
+
++ /*
++ * Use the default ringbuffer size and block size but disable the RPTR
++ * shadow
++ */
++ gpu_write(gpu, REG_A4XX_CP_RB_CNTL,
++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
++
++ /* Set the ringbuffer address */
++ gpu_write(gpu, REG_A4XX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova));
++
+ /* Load PM4: */
+ ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PM4]->data);
+ len = adreno_gpu->fw[ADRENO_FW_PM4]->size / 4;
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -702,8 +702,6 @@ static int a5xx_hw_init(struct msm_gpu *
+ if (ret)
+ return ret;
+
+- a5xx_preempt_hw_init(gpu);
+-
+ if (!adreno_is_a510(adreno_gpu))
+ a5xx_gpmu_ucode_init(gpu);
+
+@@ -711,6 +709,15 @@ static int a5xx_hw_init(struct msm_gpu *
+ if (ret)
+ return ret;
+
++ /* Set the ringbuffer address */
++ gpu_write64(gpu, REG_A5XX_CP_RB_BASE, REG_A5XX_CP_RB_BASE_HI,
++ gpu->rb[0]->iova);
++
++ gpu_write(gpu, REG_A5XX_CP_RB_CNTL,
++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
++
++ a5xx_preempt_hw_init(gpu);
++
+ /* Disable the interrupts through the initial bringup stage */
+ gpu_write(gpu, REG_A5XX_RBBM_INT_0_MASK, A5XX_INT_MASK);
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -557,6 +557,13 @@ static int a6xx_hw_init(struct msm_gpu *
+ if (ret)
+ goto out;
+
++ /* Set the ringbuffer address */
++ gpu_write64(gpu, REG_A6XX_CP_RB_BASE, REG_A6XX_CP_RB_BASE_HI,
++ gpu->rb[0]->iova);
++
++ gpu_write(gpu, REG_A6XX_CP_RB_CNTL,
++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE);
++
+ /* Always come up on rb 0 */
+ a6xx_gpu->cur_ring = gpu->rb[0];
+
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -400,26 +400,6 @@ int adreno_hw_init(struct msm_gpu *gpu)
+ ring->memptrs->rptr = 0;
+ }
+
+- /*
+- * Setup REG_CP_RB_CNTL. The same value is used across targets (with
+- * the excpetion of A430 that disables the RPTR shadow) - the cacluation
+- * for the ringbuffer size and block size is moved to msm_gpu.h for the
+- * pre-processor to deal with and the A430 variant is ORed in here
+- */
+- adreno_gpu_write(adreno_gpu, REG_ADRENO_CP_RB_CNTL,
+- MSM_GPU_RB_CNTL_DEFAULT |
+- (adreno_is_a430(adreno_gpu) ? AXXX_CP_RB_CNTL_NO_UPDATE : 0));
+-
+- /* Setup ringbuffer address - use ringbuffer[0] for GPU init */
+- adreno_gpu_write64(adreno_gpu, REG_ADRENO_CP_RB_BASE,
+- REG_ADRENO_CP_RB_BASE_HI, gpu->rb[0]->iova);
+-
+- if (!adreno_is_a430(adreno_gpu)) {
+- adreno_gpu_write64(adreno_gpu, REG_ADRENO_CP_RB_RPTR_ADDR,
+- REG_ADRENO_CP_RB_RPTR_ADDR_HI,
+- rbmemptr(gpu->rb[0], rptr));
+- }
+-
+ return 0;
+ }
+
+@@ -427,11 +407,8 @@ int adreno_hw_init(struct msm_gpu *gpu)
+ static uint32_t get_rptr(struct adreno_gpu *adreno_gpu,
+ struct msm_ringbuffer *ring)
+ {
+- if (adreno_is_a430(adreno_gpu))
+- return ring->memptrs->rptr = adreno_gpu_read(
+- adreno_gpu, REG_ADRENO_CP_RB_RPTR);
+- else
+- return ring->memptrs->rptr;
++ return ring->memptrs->rptr = adreno_gpu_read(
++ adreno_gpu, REG_ADRENO_CP_RB_RPTR);
+ }
+
+ struct msm_ringbuffer *adreno_active_ring(struct msm_gpu *gpu)
--- /dev/null
+From 34221545d2069dc947131f42392fd4cebabe1b39 Mon Sep 17 00:00:00 2001
+From: Jordan Crouse <jcrouse@codeaurora.org>
+Date: Thu, 3 Sep 2020 20:03:10 -0600
+Subject: drm/msm: Split the a5xx preemption record
+
+From: Jordan Crouse <jcrouse@codeaurora.org>
+
+commit 34221545d2069dc947131f42392fd4cebabe1b39 upstream.
+
+The main a5xx preemption record can be marked as privileged to
+protect it from user access but the counters storage needs to be
+remain unprivileged. Split the buffers and mark the critical memory
+as privileged.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 +
+ drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 25 ++++++++++++++++++++-----
+ 2 files changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h
+@@ -31,6 +31,7 @@ struct a5xx_gpu {
+ struct msm_ringbuffer *next_ring;
+
+ struct drm_gem_object *preempt_bo[MSM_GPU_MAX_RINGS];
++ struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS];
+ struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS];
+ uint64_t preempt_iova[MSM_GPU_MAX_RINGS];
+
+--- a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c
+@@ -226,19 +226,31 @@ static int preempt_init_ring(struct a5xx
+ struct adreno_gpu *adreno_gpu = &a5xx_gpu->base;
+ struct msm_gpu *gpu = &adreno_gpu->base;
+ struct a5xx_preempt_record *ptr;
+- struct drm_gem_object *bo = NULL;
+- u64 iova = 0;
++ void *counters;
++ struct drm_gem_object *bo = NULL, *counters_bo = NULL;
++ u64 iova = 0, counters_iova = 0;
+
+ ptr = msm_gem_kernel_new(gpu->dev,
+ A5XX_PREEMPT_RECORD_SIZE + A5XX_PREEMPT_COUNTER_SIZE,
+- MSM_BO_UNCACHED, gpu->aspace, &bo, &iova);
++ MSM_BO_UNCACHED | MSM_BO_MAP_PRIV, gpu->aspace, &bo, &iova);
+
+ if (IS_ERR(ptr))
+ return PTR_ERR(ptr);
+
++ /* The buffer to store counters needs to be unprivileged */
++ counters = msm_gem_kernel_new(gpu->dev,
++ A5XX_PREEMPT_COUNTER_SIZE,
++ MSM_BO_UNCACHED, gpu->aspace, &counters_bo, &counters_iova);
++ if (IS_ERR(counters)) {
++ msm_gem_kernel_put(bo, gpu->aspace, true);
++ return PTR_ERR(counters);
++ }
++
+ msm_gem_object_set_name(bo, "preempt");
++ msm_gem_object_set_name(counters_bo, "preempt_counters");
+
+ a5xx_gpu->preempt_bo[ring->id] = bo;
++ a5xx_gpu->preempt_counters_bo[ring->id] = counters_bo;
+ a5xx_gpu->preempt_iova[ring->id] = iova;
+ a5xx_gpu->preempt[ring->id] = ptr;
+
+@@ -249,7 +261,7 @@ static int preempt_init_ring(struct a5xx
+ ptr->data = 0;
+ ptr->cntl = MSM_GPU_RB_CNTL_DEFAULT;
+ ptr->rptr_addr = rbmemptr(ring, rptr);
+- ptr->counter = iova + A5XX_PREEMPT_RECORD_SIZE;
++ ptr->counter = counters_iova;
+
+ return 0;
+ }
+@@ -260,8 +272,11 @@ void a5xx_preempt_fini(struct msm_gpu *g
+ struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu);
+ int i;
+
+- for (i = 0; i < gpu->nr_rings; i++)
++ for (i = 0; i < gpu->nr_rings; i++) {
+ msm_gem_kernel_put(a5xx_gpu->preempt_bo[i], gpu->aspace, true);
++ msm_gem_kernel_put(a5xx_gpu->preempt_counters_bo[i],
++ gpu->aspace, true);
++ }
+ }
+
+ void a5xx_preempt_init(struct msm_gpu *gpu)
--- /dev/null
+From f71800228dc74711c3df43854ce7089562a3bc2d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 20 Aug 2020 22:31:44 +0200
+Subject: drm/tve200: Stabilize enable/disable
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit f71800228dc74711c3df43854ce7089562a3bc2d upstream.
+
+The TVE200 will occasionally print a bunch of lost interrupts
+and similar dmesg messages, sometimes during boot and sometimes
+after disabling and coming back to enablement. This is probably
+because the hardware is left in an unknown state by the boot
+loader that displays a logo.
+
+This can be fixed by bringing the controller into a known state
+by resetting the controller while enabling it. We retry reset 5
+times like the vendor driver does. We also put the controller
+into reset before de-clocking it and clear all interrupts before
+enabling the vblank IRQ.
+
+This makes the video enable/disable/enable cycle rock solid
+on the D-Link DIR-685. Tested extensively.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: stable@vger.kernel.org
+Link: https://patchwork.freedesktop.org/patch/msgid/20200820203144.271081-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/tve200/tve200_display.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/tve200/tve200_display.c
++++ b/drivers/gpu/drm/tve200/tve200_display.c
+@@ -14,6 +14,7 @@
+ #include <linux/version.h>
+ #include <linux/dma-buf.h>
+ #include <linux/of_graph.h>
++#include <linux/delay.h>
+
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_fourcc.h>
+@@ -130,9 +131,25 @@ static void tve200_display_enable(struct
+ struct drm_connector *connector = priv->connector;
+ u32 format = fb->format->format;
+ u32 ctrl1 = 0;
++ int retries;
+
+ clk_prepare_enable(priv->clk);
+
++ /* Reset the TVE200 and wait for it to come back online */
++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4);
++ for (retries = 0; retries < 5; retries++) {
++ usleep_range(30000, 50000);
++ if (readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET)
++ continue;
++ else
++ break;
++ }
++ if (retries == 5 &&
++ readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET) {
++ dev_err(drm->dev, "can't get hardware out of reset\n");
++ return;
++ }
++
+ /* Function 1 */
+ ctrl1 |= TVE200_CTRL_CSMODE;
+ /* Interlace mode for CCIR656: parameterize? */
+@@ -230,8 +247,9 @@ static void tve200_display_disable(struc
+
+ drm_crtc_vblank_off(crtc);
+
+- /* Disable and Power Down */
++ /* Disable put into reset and Power Down */
+ writel(0, priv->regs + TVE200_CTRL);
++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4);
+
+ clk_disable_unprepare(priv->clk);
+ }
+@@ -279,6 +297,8 @@ static int tve200_display_enable_vblank(
+ struct drm_device *drm = crtc->dev;
+ struct tve200_drm_dev_private *priv = drm->dev_private;
+
++ /* Clear any IRQs and enable */
++ writel(0xFF, priv->regs + TVE200_INT_CLR);
+ writel(TVE200_INT_V_STATUS, priv->regs + TVE200_INT_EN);
+ return 0;
+ }
--- /dev/null
+From 060522d89705f9d961ef1762dc1468645dd21fbd Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Thu, 3 Sep 2020 13:20:29 +1200
+Subject: mmc: sdhci-of-esdhc: Don't walk device-tree on every interrupt
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 060522d89705f9d961ef1762dc1468645dd21fbd upstream.
+
+Commit b214fe592ab7 ("mmc: sdhci-of-esdhc: add erratum eSDHC7 support")
+added code to check for a specific compatible string in the device-tree
+on every esdhc interrupat. Instead of doing this record the quirk in
+struct sdhci_esdhc and lookup the struct in esdhc_irq.
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20200903012029.25673-1-chris.packham@alliedtelesis.co.nz
+Fixes: b214fe592ab7 ("mmc: sdhci-of-esdhc: add erratum eSDHC7 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-of-esdhc.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -81,6 +81,7 @@ struct sdhci_esdhc {
+ bool quirk_tuning_erratum_type2;
+ bool quirk_ignore_data_inhibit;
+ bool quirk_delay_before_data_reset;
++ bool quirk_trans_complete_erratum;
+ bool in_sw_tuning;
+ unsigned int peripheral_clock;
+ const struct esdhc_clk_fixup *clk_fixup;
+@@ -1177,10 +1178,11 @@ static void esdhc_set_uhs_signaling(stru
+
+ static u32 esdhc_irq(struct sdhci_host *host, u32 intmask)
+ {
++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host);
+ u32 command;
+
+- if (of_find_compatible_node(NULL, NULL,
+- "fsl,p2020-esdhc")) {
++ if (esdhc->quirk_trans_complete_erratum) {
+ command = SDHCI_GET_CMD(sdhci_readw(host,
+ SDHCI_COMMAND));
+ if (command == MMC_WRITE_MULTIPLE_BLOCK &&
+@@ -1334,8 +1336,10 @@ static void esdhc_init(struct platform_d
+ esdhc->clk_fixup = match->data;
+ np = pdev->dev.of_node;
+
+- if (of_device_is_compatible(np, "fsl,p2020-esdhc"))
++ if (of_device_is_compatible(np, "fsl,p2020-esdhc")) {
+ esdhc->quirk_delay_before_data_reset = true;
++ esdhc->quirk_trans_complete_erratum = true;
++ }
+
+ clk = of_clk_get(np, 0);
+ if (!IS_ERR(clk)) {
--- /dev/null
+From f0c393e2104e48c8a881719a8bd37996f71b0aee Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 3 Sep 2020 11:20:07 +0300
+Subject: mmc: sdio: Use mmc_pre_req() / mmc_post_req()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit f0c393e2104e48c8a881719a8bd37996f71b0aee upstream.
+
+SDHCI changed from using a tasklet to finish requests, to using an IRQ
+thread i.e. commit c07a48c2651965 ("mmc: sdhci: Remove finish_tasklet").
+Because this increased the latency to complete requests, a preparatory
+change was made to complete the request from the IRQ handler if
+possible i.e. commit 19d2f695f4e827 ("mmc: sdhci: Call mmc_request_done()
+from IRQ handler if possible"). That alleviated the situation for MMC
+block devices because the MMC block driver makes use of mmc_pre_req()
+and mmc_post_req() so that successful requests are completed in the IRQ
+handler and any DMA unmapping is handled separately in mmc_post_req().
+However SDIO was still affected, and an example has been reported with
+up to 20% degradation in performance.
+
+Looking at SDIO I/O helper functions, sdio_io_rw_ext_helper() appeared
+to be a possible candidate for making use of asynchronous requests
+within its I/O loops, but analysis revealed that these loops almost
+never iterate more than once, so the complexity of the change would not
+be warrented.
+
+Instead, mmc_pre_req() and mmc_post_req() are added before and after I/O
+submission (mmc_wait_for_req) in mmc_io_rw_extended(). This still has
+the potential benefit of reducing the duration of interrupt handlers, as
+well as addressing the latency issue for SDHCI. It also seems a more
+reasonable solution than forcing drivers to do everything in the IRQ
+handler.
+
+Reported-by: Dmitry Osipenko <digetx@gmail.com>
+Fixes: c07a48c2651965 ("mmc: sdhci: Remove finish_tasklet")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Tested-by: Dmitry Osipenko <digetx@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200903082007.18715-1-adrian.hunter@intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/sdio_ops.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+--- a/drivers/mmc/core/sdio_ops.c
++++ b/drivers/mmc/core/sdio_ops.c
+@@ -121,6 +121,7 @@ int mmc_io_rw_extended(struct mmc_card *
+ struct sg_table sgtable;
+ unsigned int nents, left_size, i;
+ unsigned int seg_size = card->host->max_seg_size;
++ int err;
+
+ WARN_ON(blksz == 0);
+
+@@ -170,28 +171,32 @@ int mmc_io_rw_extended(struct mmc_card *
+
+ mmc_set_data_timeout(&data, card);
+
+- mmc_wait_for_req(card->host, &mrq);
++ mmc_pre_req(card->host, &mrq);
+
+- if (nents > 1)
+- sg_free_table(&sgtable);
++ mmc_wait_for_req(card->host, &mrq);
+
+ if (cmd.error)
+- return cmd.error;
+- if (data.error)
+- return data.error;
+-
+- if (mmc_host_is_spi(card->host)) {
++ err = cmd.error;
++ else if (data.error)
++ err = data.error;
++ else if (mmc_host_is_spi(card->host))
+ /* host driver already reported errors */
+- } else {
+- if (cmd.resp[0] & R5_ERROR)
+- return -EIO;
+- if (cmd.resp[0] & R5_FUNCTION_NUMBER)
+- return -EINVAL;
+- if (cmd.resp[0] & R5_OUT_OF_RANGE)
+- return -ERANGE;
+- }
++ err = 0;
++ else if (cmd.resp[0] & R5_ERROR)
++ err = -EIO;
++ else if (cmd.resp[0] & R5_FUNCTION_NUMBER)
++ err = -EINVAL;
++ else if (cmd.resp[0] & R5_OUT_OF_RANGE)
++ err = -ERANGE;
++ else
++ err = 0;
++
++ mmc_post_req(card->host, &mrq, err);
++
++ if (nents > 1)
++ sg_free_table(&sgtable);
+
+- return 0;
++ return err;
+ }
+
+ int sdio_reset(struct mmc_host *host)
--- /dev/null
+From b63de8400a6e1001b5732286cf6f5ec27799b7b4 Mon Sep 17 00:00:00 2001
+From: James Smart <james.smart@broadcom.com>
+Date: Fri, 28 Aug 2020 12:01:50 -0700
+Subject: nvme: Revert: Fix controller creation races with teardown flow
+
+From: James Smart <james.smart@broadcom.com>
+
+commit b63de8400a6e1001b5732286cf6f5ec27799b7b4 upstream.
+
+The indicated patch introduced a barrier in the sysfs_delete attribute
+for the controller that rejects the request if the controller isn't
+created. "Created" is defined as at least 1 call to nvme_start_ctrl().
+
+This is problematic in error-injection testing. If an error occurs on
+the initial attempt to create an association and the controller enters
+reconnect(s) attempts, the admin cannot delete the controller until
+either there is a successful association created or ctrl_loss_tmo
+times out.
+
+Where this issue is particularly hurtful is when the "admin" is the
+nvme-cli, it is performing a connection to a discovery controller, and
+it is initiated via auto-connect scripts. With the FC transport, if the
+first connection attempt fails, the controller enters a normal reconnect
+state but returns control to the cli thread that created the controller.
+In this scenario, the cli attempts to read the discovery log via ioctl,
+which fails, causing the cli to see it as an empty log and then proceeds
+to delete the discovery controller. The delete is rejected and the
+controller is left live. If the discovery controller reconnect then
+succeeds, there is no action to delete it, and it sits live doing nothing.
+
+Cc: <stable@vger.kernel.org> # v5.7+
+Fixes: ce1518139e69 ("nvme: Fix controller creation races with teardown flow")
+Signed-off-by: James Smart <james.smart@broadcom.com>
+CC: Israel Rukshin <israelr@mellanox.com>
+CC: Max Gurtovoy <maxg@mellanox.com>
+CC: Christoph Hellwig <hch@lst.de>
+CC: Keith Busch <kbusch@kernel.org>
+CC: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/core.c | 5 -----
+ drivers/nvme/host/nvme.h | 1 -
+ 2 files changed, 6 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3324,10 +3324,6 @@ static ssize_t nvme_sysfs_delete(struct
+ {
+ struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+
+- /* Can't delete non-created controllers */
+- if (!ctrl->created)
+- return -EBUSY;
+-
+ if (device_remove_file_self(dev, attr))
+ nvme_delete_ctrl_sync(ctrl);
+ return count;
+@@ -4129,7 +4125,6 @@ void nvme_start_ctrl(struct nvme_ctrl *c
+ nvme_queue_scan(ctrl);
+ nvme_start_queues(ctrl);
+ }
+- ctrl->created = true;
+ }
+ EXPORT_SYMBOL_GPL(nvme_start_ctrl);
+
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -271,7 +271,6 @@ struct nvme_ctrl {
+ struct nvme_command ka_cmd;
+ struct work_struct fw_act_work;
+ unsigned long events;
+- bool created;
+
+ #ifdef CONFIG_NVME_MULTIPATH
+ /* asymmetric namespace access: */
--- /dev/null
+From f44d04e696feaf13d192d942c4f14ad2e117065a Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Thu, 3 Sep 2020 13:24:11 +0200
+Subject: rbd: require global CAP_SYS_ADMIN for mapping and unmapping
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream.
+
+It turns out that currently we rely only on sysfs attribute
+permissions:
+
+ $ ll /sys/bus/rbd/{add*,remove*}
+ --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add
+ --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add_single_major
+ --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/remove
+ --w------- 1 root root 4096 Sep 3 20:38 /sys/bus/rbd/remove_single_major
+
+This means that images can be mapped and unmapped (i.e. block devices
+can be created and deleted) by a UID 0 process even after it drops all
+privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
+as long as UID 0 is mapped into that user namespace.
+
+Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
+and require CAP_SYS_ADMIN in the initial user namespace for mapping and
+unmapping, and also for dumping the configuration string and refreshing
+the image header.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/rbd.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -5120,6 +5120,9 @@ static ssize_t rbd_config_info_show(stru
+ {
+ struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ return sprintf(buf, "%s\n", rbd_dev->config_info);
+ }
+
+@@ -5231,6 +5234,9 @@ static ssize_t rbd_image_refresh(struct
+ struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
+ int ret;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ ret = rbd_dev_refresh(rbd_dev);
+ if (ret)
+ return ret;
+@@ -7059,6 +7065,9 @@ static ssize_t do_rbd_add(struct bus_typ
+ struct rbd_client *rbdc;
+ int rc;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ if (!try_module_get(THIS_MODULE))
+ return -ENODEV;
+
+@@ -7209,6 +7218,9 @@ static ssize_t do_rbd_remove(struct bus_
+ bool force = false;
+ int ret;
+
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++
+ dev_id = -1;
+ opt_buf[0] = '\0';
+ sscanf(buf, "%d %5s", &dev_id, opt_buf);
scsi-target-iscsi-fix-data-digest-calculation.patch
scsi-lpfc-fix-setting-irq-affinity-with-an-empty-cpu-mask.patch
scsi-target-iscsi-fix-hang-in-iscsit_access_np-when-getting-tpg-np_login_sem.patch
+drm-tve200-stabilize-enable-disable.patch
+drm-msm-split-the-a5xx-preemption-record.patch
+drm-msm-disable-preemption-on-all-5xx-targets.patch
+drm-msm-disable-the-rptr-shadow.patch
+mmc-sdio-use-mmc_pre_req-mmc_post_req.patch
+mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch
+nvme-revert-fix-controller-creation-races-with-teardown-flow.patch
+rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
