--- /dev/null
+From 058c834ff817f8abb96d34b72573b19be7cc79f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Aug 2020 21:32:17 -0700
+Subject: ALSA: hda/realtek: Add model alc298-samsung-headphone
+
+From: Mike Pozulp <pozulp.kernel@gmail.com>
+
+[ Upstream commit 23dc958689449be85e39351a8c809c3d344b155b ]
+
+The very quiet and distorted headphone output bug that afflicted my
+Samsung Notebook 9 is appearing in many other Samsung laptops. Expose
+the quirk which fixed my laptop as a model so other users can try it.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207423
+Signed-off-by: Mike Pozulp <pozulp.kernel@gmail.com>
+Link: https://lore.kernel.org/r/20200817043219.458889-1-pozulp.kernel@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3c7bc398c0cbc..d1b74c7cacd76 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7939,6 +7939,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"},
+ {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
++ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
+--
+2.25.1
+
--- /dev/null
+From d455a2feb390936afe6db9dabd6a1e6eda2f3937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 18:38:24 +0100
+Subject: arm64: Allow booting of late CPUs affected by erratum 1418040
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit bf87bb0881d0f59181fe3bbcf29c609f36483ff8 ]
+
+As we can now switch from a system that isn't affected by 1418040
+to a system that globally is affected, let's allow affected CPUs
+to come in at a later time.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20200731173824.107480-3-maz@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/cpu_errata.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 0b2830379fe03..51462c59ab5da 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -917,6 +917,8 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
+ .desc = "ARM erratum 1418040",
+ .capability = ARM64_WORKAROUND_1418040,
+ ERRATA_MIDR_RANGE_LIST(erratum_1418040_list),
++ .type = (ARM64_CPUCAP_SCOPE_LOCAL_CPU |
++ ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU),
+ },
+ #endif
+ #ifdef CONFIG_ARM64_ERRATUM_1165522
+--
+2.25.1
+
--- /dev/null
+From dfcf92cbb8043d4b802b44e5430e112e93582b90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 18:38:23 +0100
+Subject: arm64: Move handling of erratum 1418040 into C code
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit d49f7d7376d0c0daf8680984a37bd07581ac7d38 ]
+
+Instead of dealing with erratum 1418040 on each entry and exit,
+let's move the handling to __switch_to() instead, which has
+several advantages:
+
+- It can be applied when it matters (switching between 32 and 64
+ bit tasks).
+- It is written in C (yay!)
+- It can rely on static keys rather than alternatives
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20200731173824.107480-2-maz@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/process.c | 34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index fab013c5ee8c9..10190c4b16dc4 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -498,6 +498,39 @@ static void entry_task_switch(struct task_struct *next)
+ __this_cpu_write(__entry_task, next);
+ }
+
++/*
++ * ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT.
++ * Assuming the virtual counter is enabled at the beginning of times:
++ *
++ * - disable access when switching from a 64bit task to a 32bit task
++ * - enable access when switching from a 32bit task to a 64bit task
++ */
++static void erratum_1418040_thread_switch(struct task_struct *prev,
++ struct task_struct *next)
++{
++ bool prev32, next32;
++ u64 val;
++
++ if (!(IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) &&
++ cpus_have_const_cap(ARM64_WORKAROUND_1418040)))
++ return;
++
++ prev32 = is_compat_thread(task_thread_info(prev));
++ next32 = is_compat_thread(task_thread_info(next));
++
++ if (prev32 == next32)
++ return;
++
++ val = read_sysreg(cntkctl_el1);
++
++ if (!next32)
++ val |= ARCH_TIMER_USR_VCT_ACCESS_EN;
++ else
++ val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN;
++
++ write_sysreg(val, cntkctl_el1);
++}
++
+ /*
+ * Thread switching.
+ */
+@@ -514,6 +547,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev,
+ uao_thread_switch(next);
+ ptrauth_thread_switch(next);
+ ssbs_thread_switch(next);
++ erratum_1418040_thread_switch(prev, next);
+
+ /*
+ * Complete any pending TLB or cache maintenance on this CPU in case
+--
+2.25.1
+
--- /dev/null
+From 95d0bbf5e592fb4e5fc1291f1e12c87b6e2b5dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 19:38:34 +0200
+Subject: ASoC: wm8994: Avoid attempts to read unreadable registers
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit f082bb59b72039a2326ec1a44496899fb8aa6d0e ]
+
+The driver supports WM1811, WM8994, WM8958 devices but according to
+documentation and the regmap definitions the WM8958_DSP2_* registers
+are only available on WM8958. In current code these registers are
+being accessed as if they were available on all the three chips.
+
+When starting playback on WM1811 CODEC multiple errors like:
+"wm8994-codec wm8994-codec: ASoC: error at soc_component_read_no_lock on wm8994-codec: -5"
+can be seen, which is caused by attempts to read an unavailable
+WM8958_DSP2_PROGRAM register. The issue has been uncovered by recent
+commit "e2329ee ASoC: soc-component: add soc_component_err()".
+
+This patch adds a check in wm8958_aif_ev() callback so the DSP2 handling
+is only done for WM8958.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20200731173834.23832-1-s.nawrocki@samsung.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8958-dsp2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c
+index 18535b326680a..04f23477039a5 100644
+--- a/sound/soc/codecs/wm8958-dsp2.c
++++ b/sound/soc/codecs/wm8958-dsp2.c
+@@ -416,8 +416,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w,
+ struct snd_kcontrol *kcontrol, int event)
+ {
+ struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm);
++ struct wm8994 *control = dev_get_drvdata(component->dev->parent);
+ int i;
+
++ if (control->type != WM8958)
++ return 0;
++
+ switch (event) {
+ case SND_SOC_DAPM_POST_PMU:
+ case SND_SOC_DAPM_PRE_PMU:
+--
+2.25.1
+
--- /dev/null
+From 6f8cecb73032984fa390f780237307acaf23c5a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 06:43:40 +0000
+Subject: bfq: fix blkio cgroup leakage v4
+
+From: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
+
+[ Upstream commit 2de791ab4918969d8108f15238a701968375f235 ]
+
+Changes from v1:
+ - update commit description with proper ref-accounting justification
+
+commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree")
+introduce leak forbfq_group and blkcg_gq objects because of get/put
+imbalance.
+In fact whole idea of original commit is wrong because bfq_group entity
+can not dissapear under us because it is referenced by child bfq_queue's
+entities from here:
+ -> bfq_init_entity()
+ ->bfqg_and_blkg_get(bfqg);
+ ->entity->parent = bfqg->my_entity
+
+ -> bfq_put_queue(bfqq)
+ FINAL_PUT
+ ->bfqg_and_blkg_put(bfqq_group(bfqq))
+ ->kmem_cache_free(bfq_pool, bfqq);
+
+So parent entity can not disappear while child entity is in tree,
+and child entities already has proper protection.
+This patch revert commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree")
+
+bfq_group leak trace caused by bad commit:
+-> blkg_alloc
+ -> bfq_pq_alloc
+ -> bfqg_get (+1)
+->bfq_activate_bfqq
+ ->bfq_activate_requeue_entity
+ -> __bfq_activate_entity
+ ->bfq_get_entity
+ ->bfqg_and_blkg_get (+1) <==== : Note1
+->bfq_del_bfqq_busy
+ ->bfq_deactivate_entity+0x53/0xc0 [bfq]
+ ->__bfq_deactivate_entity+0x1b8/0x210 [bfq]
+ -> bfq_forget_entity(is_in_service = true)
+ entity->on_st_or_in_serv = false <=== :Note2
+ if (is_in_service)
+ return; ==> do not touch reference
+-> blkcg_css_offline
+ -> blkcg_destroy_blkgs
+ -> blkg_destroy
+ -> bfq_pd_offline
+ -> __bfq_deactivate_entity
+ if (!entity->on_st_or_in_serv) /* true, because (Note2)
+ return false;
+ -> bfq_pd_free
+ -> bfqg_put() (-1, byt bfqg->ref == 2) because of (Note2)
+So bfq_group and blkcg_gq will leak forever, see test-case below.
+
+##TESTCASE_BEGIN:
+#!/bin/bash
+
+max_iters=${1:-100}
+#prep cgroup mounts
+mount -t tmpfs cgroup_root /sys/fs/cgroup
+mkdir /sys/fs/cgroup/blkio
+mount -t cgroup -o blkio none /sys/fs/cgroup/blkio
+
+# Prepare blkdev
+grep blkio /proc/cgroups
+truncate -s 1M img
+losetup /dev/loop0 img
+echo bfq > /sys/block/loop0/queue/scheduler
+
+grep blkio /proc/cgroups
+for ((i=0;i<max_iters;i++))
+do
+ mkdir -p /sys/fs/cgroup/blkio/a
+ echo 0 > /sys/fs/cgroup/blkio/a/cgroup.procs
+ dd if=/dev/loop0 bs=4k count=1 of=/dev/null iflag=direct 2> /dev/null
+ echo 0 > /sys/fs/cgroup/blkio/cgroup.procs
+ rmdir /sys/fs/cgroup/blkio/a
+ grep blkio /proc/cgroups
+done
+##TESTCASE_END:
+
+Fixes: db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree")
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 2 +-
+ block/bfq-iosched.h | 1 -
+ block/bfq-wf2q.c | 12 ++----------
+ 3 files changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index 12b707a4e52fd..342a1cfa48c57 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -332,7 +332,7 @@ static void bfqg_put(struct bfq_group *bfqg)
+ kfree(bfqg);
+ }
+
+-void bfqg_and_blkg_get(struct bfq_group *bfqg)
++static void bfqg_and_blkg_get(struct bfq_group *bfqg)
+ {
+ /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */
+ bfqg_get(bfqg);
+diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h
+index c0232975075d0..de98fdfe9ea17 100644
+--- a/block/bfq-iosched.h
++++ b/block/bfq-iosched.h
+@@ -980,7 +980,6 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
+ struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg);
+ struct bfq_group *bfqq_group(struct bfq_queue *bfqq);
+ struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node);
+-void bfqg_and_blkg_get(struct bfq_group *bfqg);
+ void bfqg_and_blkg_put(struct bfq_group *bfqg);
+
+ #ifdef CONFIG_BFQ_GROUP_IOSCHED
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index 44079147e396e..05f0bf4a1144d 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -536,9 +536,7 @@ static void bfq_get_entity(struct bfq_entity *entity)
+ bfqq->ref++;
+ bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d",
+ bfqq, bfqq->ref);
+- } else
+- bfqg_and_blkg_get(container_of(entity, struct bfq_group,
+- entity));
++ }
+ }
+
+ /**
+@@ -652,14 +650,8 @@ static void bfq_forget_entity(struct bfq_service_tree *st,
+
+ entity->on_st = false;
+ st->wsum -= entity->weight;
+- if (is_in_service)
+- return;
+-
+- if (bfqq)
++ if (bfqq && !is_in_service)
+ bfq_put_queue(bfqq);
+- else
+- bfqg_and_blkg_put(container_of(entity, struct bfq_group,
+- entity));
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 57ebcb096a743788edbc4b4355e13d8df4a519c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 17:07:28 +0800
+Subject: blk-mq: insert request not through ->queue_rq into sw/scheduler queue
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit db03f88fae8a2c8007caafa70287798817df2875 ]
+
+c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") supposed
+to add request which has been through ->queue_rq() to the hw queue dispatch
+list, however it adds request running out of budget or driver tag to hw queue
+too. This way basically bypasses request merge, and causes too many request
+dispatched to LLD, and system% is unnecessary increased.
+
+Fixes this issue by adding request not through ->queue_rq into sw/scheduler
+queue, and this way is safe because no ->queue_rq is called on this request
+yet.
+
+High %system can be observed on Azure storvsc device, and even soft lock
+is observed. This patch reduces %system during heavy sequential IO,
+meantime decreases soft lockup risk.
+
+Fixes: c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index ae7d31cb5a4e1..8f67f0f16ec2e 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1869,7 +1869,8 @@ insert:
+ if (bypass_insert)
+ return BLK_STS_RESOURCE;
+
+- blk_mq_request_bypass_insert(rq, false, run_queue);
++ blk_mq_sched_insert_request(rq, false, run_queue, false);
++
+ return BLK_STS_OK;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 68e7b6e9864befacb2feebcb93e81eda59e223af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 22:21:16 -0400
+Subject: blkcg: fix memleak for iolatency
+
+From: Yufen Yu <yuyufen@huawei.com>
+
+[ Upstream commit 27029b4b18aa5d3b060f0bf2c26dae254132cfce ]
+
+Normally, blkcg_iolatency_exit() will free related memory in iolatency
+when cleanup queue. But if blk_throtl_init() return error and queue init
+fail, blkcg_iolatency_exit() will not do that for us. Then it cause
+memory leak.
+
+Fixes: d70675121546 ("block: introduce blk-iolatency io controller")
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 1eb8895be4c6b..0c7addcd19859 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1219,13 +1219,15 @@ int blkcg_init_queue(struct request_queue *q)
+ if (preloaded)
+ radix_tree_preload_end();
+
+- ret = blk_iolatency_init(q);
++ ret = blk_throtl_init(q);
+ if (ret)
+ goto err_destroy_all;
+
+- ret = blk_throtl_init(q);
+- if (ret)
++ ret = blk_iolatency_init(q);
++ if (ret) {
++ blk_throtl_exit(q);
+ goto err_destroy_all;
++ }
+ return 0;
+
+ err_destroy_all:
+--
+2.25.1
+
--- /dev/null
+From 00f2f5e8e468c376d35433ae8a330140e5b0230c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 20:52:06 +0100
+Subject: block: Fix page_is_mergeable() for compound pages
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit d81665198b83e55a28339d1f3e4890ed8a434556 ]
+
+If we pass in an offset which is larger than PAGE_SIZE, then
+page_is_mergeable() thinks it's not mergeable with the previous bio_vec,
+leading to a large number of bio_vecs being used. Use a slightly more
+obvious test that the two pages are compatible with each other.
+
+Fixes: 52d52d1c98a9 ("block: only allow contiguous page structs in a bio_vec")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index 94d697217887a..87505a93bcff6 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -683,8 +683,8 @@ static inline bool page_is_mergeable(const struct bio_vec *bv,
+ struct page *page, unsigned int len, unsigned int off,
+ bool *same_page)
+ {
+- phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) +
+- bv->bv_offset + bv->bv_len - 1;
++ size_t bv_end = bv->bv_offset + bv->bv_len;
++ phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + bv_end - 1;
+ phys_addr_t page_addr = page_to_phys(page);
+
+ if (vec_end_addr + 1 != page_addr + off)
+@@ -693,9 +693,9 @@ static inline bool page_is_mergeable(const struct bio_vec *bv,
+ return false;
+
+ *same_page = ((vec_end_addr & PAGE_MASK) == page_addr);
+- if (!*same_page && pfn_to_page(PFN_DOWN(vec_end_addr)) + 1 != page)
+- return false;
+- return true;
++ if (*same_page)
++ return true;
++ return (bv->bv_page + bv_end / PAGE_SIZE) == (page + off / PAGE_SIZE);
+ }
+
+ static bool bio_try_merge_pc_page(struct request_queue *q, struct bio *bio,
+--
+2.25.1
+
--- /dev/null
+From 8eaefc65ea2c89791d7f86effca2a62b97b4eb64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 17:52:39 +0800
+Subject: block: respect queue limit of max discard segment
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 943b40c832beb71115e38a1c4d99b640b5342738 ]
+
+When queue_max_discard_segments(q) is 1, blk_discard_mergable() will
+return false for discard request, then normal request merge is applied.
+However, only queue_max_segments() is checked, so max discard segment
+limit isn't respected.
+
+Check max discard segment limit in the request merge code for fixing
+the issue.
+
+Discard request failure of virtio_blk is fixed.
+
+Fixes: 69840466086d ("block: fix the DISCARD request merge")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 93cff719b0661..c874931bae6b5 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -553,10 +553,17 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq,
+ }
+ EXPORT_SYMBOL(blk_rq_map_sg);
+
++static inline unsigned int blk_rq_get_max_segments(struct request *rq)
++{
++ if (req_op(rq) == REQ_OP_DISCARD)
++ return queue_max_discard_segments(rq->q);
++ return queue_max_segments(rq->q);
++}
++
+ static inline int ll_new_hw_segment(struct request *req, struct bio *bio,
+ unsigned int nr_phys_segs)
+ {
+- if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(req->q))
++ if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req))
+ goto no_merge;
+
+ if (blk_integrity_merge_bio(req->q, req, bio) == false)
+@@ -640,7 +647,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req,
+ return 0;
+
+ total_phys_segments = req->nr_phys_segments + next->nr_phys_segments;
+- if (total_phys_segments > queue_max_segments(q))
++ if (total_phys_segments > blk_rq_get_max_segments(req))
+ return 0;
+
+ if (blk_integrity_merge_rq(q, req, next) == false)
+--
+2.25.1
+
--- /dev/null
+From 5d7489d46ae308152473c7c961fae9bff3f30c77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 17:52:40 +0800
+Subject: block: virtio_blk: fix handling single range discard request
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit af822aa68fbdf0a480a17462ed70232998127453 ]
+
+1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") starts
+to support multi-range discard for virtio-blk. However, the virtio-blk
+disk may report max discard segment as 1, at least that is exactly what
+qemu is doing.
+
+So far, block layer switches to normal request merge if max discard segment
+limit is 1, and multiple bios can be merged to single segment. This way may
+cause memory corruption in virtblk_setup_discard_write_zeroes().
+
+Fix the issue by handling single max discard segment in straightforward
+way.
+
+Fixes: 1f23816b8eb8 ("virtio_blk: add discard and write zeroes support")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Cc: Changpeng Liu <changpeng.liu@intel.com>
+Cc: Daniel Verkamp <dverkamp@chromium.org>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/virtio_blk.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index c1de270046bfe..2eeb2bcb488d4 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -205,16 +205,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap)
+ if (!range)
+ return -ENOMEM;
+
+- __rq_for_each_bio(bio, req) {
+- u64 sector = bio->bi_iter.bi_sector;
+- u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT;
+-
+- range[n].flags = cpu_to_le32(flags);
+- range[n].num_sectors = cpu_to_le32(num_sectors);
+- range[n].sector = cpu_to_le64(sector);
+- n++;
++ /*
++ * Single max discard segment means multi-range discard isn't
++ * supported, and block layer only runs contiguity merge like
++ * normal RW request. So we can't reply on bio for retrieving
++ * each range info.
++ */
++ if (queue_max_discard_segments(req->q) == 1) {
++ range[0].flags = cpu_to_le32(flags);
++ range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req));
++ range[0].sector = cpu_to_le64(blk_rq_pos(req));
++ n = 1;
++ } else {
++ __rq_for_each_bio(bio, req) {
++ u64 sector = bio->bi_iter.bi_sector;
++ u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT;
++
++ range[n].flags = cpu_to_le32(flags);
++ range[n].num_sectors = cpu_to_le32(num_sectors);
++ range[n].sector = cpu_to_le64(sector);
++ n++;
++ }
+ }
+
++ WARN_ON_ONCE(n != segments);
++
+ req->special_vec.bv_page = virt_to_page(range);
+ req->special_vec.bv_offset = offset_in_page(range);
+ req->special_vec.bv_len = sizeof(*range) * segments;
+--
+2.25.1
+
--- /dev/null
+From 9ff9482ebca7333d7d99ce2cdc59fcff90761bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 12:52:00 +0200
+Subject: can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to
+ detect corruptions
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit e052d0540298bfe0f6cbbecdc7e2ea9b859575b2 ]
+
+Since the stack relays on receiving own packets, it was overwriting own
+transmit buffer from received packets.
+
+At least theoretically, the received echo buffer can be corrupt or
+changed and the session partner can request to resend previous data. In
+this case we will re-send bad data.
+
+With this patch we will stop to overwrite own TX buffer and use it for
+sanity checking.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20200807105200.26441-6-o.rempel@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/j1939/transport.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
+index dbd215cbc53d8..a8dd956b5e8e1 100644
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1803,7 +1803,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session,
+ }
+
+ tpdat = se_skb->data;
+- memcpy(&tpdat[offset], &dat[1], nbytes);
++ if (!session->transmission) {
++ memcpy(&tpdat[offset], &dat[1], nbytes);
++ } else {
++ int err;
++
++ err = memcmp(&tpdat[offset], &dat[1], nbytes);
++ if (err)
++ netdev_err_once(priv->ndev,
++ "%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n",
++ __func__, session,
++ nbytes, &dat[1],
++ nbytes, &tpdat[offset]);
++ }
++
+ if (packet == session->pkt.rx)
+ session->pkt.rx++;
+
+--
+2.25.1
+
--- /dev/null
+From b2a7313b9894458814ec8afb7af0d2fd3ceedb59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 17:43:10 -0400
+Subject: drm/amd/display: Switch to immediate mode for updating infopackets
+
+From: Anthony Koo <Anthony.Koo@amd.com>
+
+[ Upstream commit abba907c7a20032c2d504fd5afe3af7d440a09d0 ]
+
+[Why]
+Using FRAME_UPDATE will result in infopacket to be potentially updated
+one frame late.
+In commit stream scenarios for previously active stream, some stale
+infopacket data from previous config might be erroneously sent out on
+initial frame after stream is re-enabled.
+
+[How]
+Switch to using IMMEDIATE_UPDATE mode
+
+Signed-off-by: Anthony Koo <Anthony.Koo@amd.com>
+Reviewed-by: Ashley Thomas <Ashley.Thomas2@amd.com>
+Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 16 ++++++++--------
+ .../amd/display/dc/dcn10/dcn10_stream_encoder.h | 14 ++++++++++++++
+ 2 files changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c
+index 9aa258f3550b6..ddf66046616d6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c
+@@ -121,35 +121,35 @@ void enc1_update_generic_info_packet(
+ switch (packet_index) {
+ case 0:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC0_FRAME_UPDATE, 1);
++ AFMT_GENERIC0_IMMEDIATE_UPDATE, 1);
+ break;
+ case 1:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC1_FRAME_UPDATE, 1);
++ AFMT_GENERIC1_IMMEDIATE_UPDATE, 1);
+ break;
+ case 2:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC2_FRAME_UPDATE, 1);
++ AFMT_GENERIC2_IMMEDIATE_UPDATE, 1);
+ break;
+ case 3:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC3_FRAME_UPDATE, 1);
++ AFMT_GENERIC3_IMMEDIATE_UPDATE, 1);
+ break;
+ case 4:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC4_FRAME_UPDATE, 1);
++ AFMT_GENERIC4_IMMEDIATE_UPDATE, 1);
+ break;
+ case 5:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC5_FRAME_UPDATE, 1);
++ AFMT_GENERIC5_IMMEDIATE_UPDATE, 1);
+ break;
+ case 6:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC6_FRAME_UPDATE, 1);
++ AFMT_GENERIC6_IMMEDIATE_UPDATE, 1);
+ break;
+ case 7:
+ REG_UPDATE(AFMT_VBI_PACKET_CONTROL1,
+- AFMT_GENERIC7_FRAME_UPDATE, 1);
++ AFMT_GENERIC7_IMMEDIATE_UPDATE, 1);
+ break;
+ default:
+ break;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
+index a512cbea00d17..b9656614950e3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
+@@ -275,7 +275,14 @@ struct dcn10_stream_enc_registers {
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_FRAME_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_FRAME_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_FRAME_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC0_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC1_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_IMMEDIATE_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_IMMEDIATE_UPDATE, mask_sh),\
++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_IMMEDIATE_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_FRAME_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_FRAME_UPDATE, mask_sh),\
+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_FRAME_UPDATE, mask_sh),\
+@@ -339,7 +346,14 @@ struct dcn10_stream_enc_registers {
+ type AFMT_GENERIC2_FRAME_UPDATE;\
+ type AFMT_GENERIC3_FRAME_UPDATE;\
+ type AFMT_GENERIC4_FRAME_UPDATE;\
++ type AFMT_GENERIC0_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC1_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC2_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC3_IMMEDIATE_UPDATE;\
+ type AFMT_GENERIC4_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC5_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC6_IMMEDIATE_UPDATE;\
++ type AFMT_GENERIC7_IMMEDIATE_UPDATE;\
+ type AFMT_GENERIC5_FRAME_UPDATE;\
+ type AFMT_GENERIC6_FRAME_UPDATE;\
+ type AFMT_GENERIC7_FRAME_UPDATE;\
+--
+2.25.1
+
--- /dev/null
+From 439a3a638fe02318095b9a07adc84a8bfddb3e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 17:01:47 +0800
+Subject: drm/amd/powerplay: correct UVD/VCE PG state on custom pptable
+ uploading
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 2c5b8080d810d98e3e59617680218499b17c84a1 ]
+
+The UVD/VCE PG state is managed by UVD and VCE IP. It's error-prone to
+assume the bootup state in SMU based on the dpm status.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+index 08b91c31532ba..947e4fa3c5e68 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+@@ -1640,12 +1640,6 @@ static void vega20_init_powergate_state(struct pp_hwmgr *hwmgr)
+
+ data->uvd_power_gated = true;
+ data->vce_power_gated = true;
+-
+- if (data->smu_features[GNLD_DPM_UVD].enabled)
+- data->uvd_power_gated = false;
+-
+- if (data->smu_features[GNLD_DPM_VCE].enabled)
+- data->vce_power_gated = false;
+ }
+
+ static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr)
+--
+2.25.1
+
--- /dev/null
+From abfb0a79764cc92dea20c005eaeb7522f9172184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 15:03:40 +0800
+Subject: drm/amd/powerplay: correct Vega20 cached smu feature state
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 266d81d9eed30f4994d76a2b237c63ece062eefe ]
+
+Correct the cached smu feature state on pp_features sysfs
+setting.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 38 +++++++++----------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+index f5915308e643a..08b91c31532ba 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c
+@@ -981,27 +981,15 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr)
+ {
+ struct vega20_hwmgr *data =
+ (struct vega20_hwmgr *)(hwmgr->backend);
+- uint64_t features_enabled;
+- int i;
+- bool enabled;
+- int ret = 0;
++ int i, ret = 0;
+
+ PP_ASSERT_WITH_CODE((ret = smum_send_msg_to_smc(hwmgr,
+ PPSMC_MSG_DisableAllSmuFeatures)) == 0,
+ "[DisableAllSMUFeatures] Failed to disable all smu features!",
+ return ret);
+
+- ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled);
+- PP_ASSERT_WITH_CODE(!ret,
+- "[DisableAllSMUFeatures] Failed to get enabled smc features!",
+- return ret);
+-
+- for (i = 0; i < GNLD_FEATURES_MAX; i++) {
+- enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ?
+- true : false;
+- data->smu_features[i].enabled = enabled;
+- data->smu_features[i].supported = enabled;
+- }
++ for (i = 0; i < GNLD_FEATURES_MAX; i++)
++ data->smu_features[i].enabled = 0;
+
+ return 0;
+ }
+@@ -3211,10 +3199,11 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf)
+
+ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfeature_masks)
+ {
+- uint64_t features_enabled;
+- uint64_t features_to_enable;
+- uint64_t features_to_disable;
+- int ret = 0;
++ struct vega20_hwmgr *data =
++ (struct vega20_hwmgr *)(hwmgr->backend);
++ uint64_t features_enabled, features_to_enable, features_to_disable;
++ int i, ret = 0;
++ bool enabled;
+
+ if (new_ppfeature_masks >= (1ULL << GNLD_FEATURES_MAX))
+ return -EINVAL;
+@@ -3243,6 +3232,17 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe
+ return ret;
+ }
+
++ /* Update the cached feature enablement state */
++ ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled);
++ if (ret)
++ return ret;
++
++ for (i = 0; i < GNLD_FEATURES_MAX; i++) {
++ enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ?
++ true : false;
++ data->smu_features[i].enabled = enabled;
++ }
++
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a93a74933c2b2dcfc766032a216f91d111c15f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 17:03:09 -0700
+Subject: drm/msm/adreno: fix updating ring fence
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit f228af11dfa1d1616bc67f3a4119ab77c36181f1 ]
+
+We need to set it to the most recent completed fence, not the most
+recent submitted. Otherwise we have races where we think we can retire
+submits that the GPU is not finished with, if the GPU doesn't manage to
+overwrite the seqno before we look at it.
+
+This can show up with hang recovery if one of the submits after the
+crashing submit also hangs after it is replayed.
+
+Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 048c8be426f32..053da39da1cc0 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -350,7 +350,7 @@ int adreno_hw_init(struct msm_gpu *gpu)
+ ring->next = ring->start;
+
+ /* reset completed fence seqno: */
+- ring->memptrs->fence = ring->seqno;
++ ring->memptrs->fence = ring->fctx->completed_fence;
+ ring->memptrs->rptr = 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 9ce01e30a5549672318c6dc01ce0cedd864f535a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:04:37 +0200
+Subject: ext4: correctly restore system zone info when remount fails
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 0f5bde1db174f6c471f0bd27198575719dabe3e5 ]
+
+When remounting filesystem fails late during remount handling and
+block_validity mount option is also changed during the remount, we fail
+to restore system zone information to a state matching the mount option.
+This is mostly harmless, just the block validity checking will not match
+the situation described by the mount option. Make sure these two are always
+consistent.
+
+Reported-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20200728130437.7804-7-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/block_validity.c | 8 --------
+ fs/ext4/super.c | 29 +++++++++++++++++++++--------
+ 2 files changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c
+index ceb54ccc937e9..97c56d061e615 100644
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb)
+ int flex_size = ext4_flex_bg_size(sbi);
+ int ret;
+
+- if (!test_opt(sb, BLOCK_VALIDITY)) {
+- if (sbi->system_blks)
+- ext4_release_system_zone(sb);
+- return 0;
+- }
+- if (sbi->system_blks)
+- return 0;
+-
+ system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
+ if (!system_blks)
+ return -ENOMEM;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index e8923013accc0..184f2d737efc9 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4563,11 +4563,13 @@ no_journal:
+
+ ext4_set_resv_clusters(sb);
+
+- err = ext4_setup_system_zone(sb);
+- if (err) {
+- ext4_msg(sb, KERN_ERR, "failed to initialize system "
+- "zone (%d)", err);
+- goto failed_mount4a;
++ if (test_opt(sb, BLOCK_VALIDITY)) {
++ err = ext4_setup_system_zone(sb);
++ if (err) {
++ ext4_msg(sb, KERN_ERR, "failed to initialize system "
++ "zone (%d)", err);
++ goto failed_mount4a;
++ }
+ }
+
+ ext4_ext_init(sb);
+@@ -5563,9 +5565,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ ext4_register_li_request(sb, first_not_zeroed);
+ }
+
+- err = ext4_setup_system_zone(sb);
+- if (err)
+- goto restore_opts;
++ /*
++ * Handle creation of system zone data early because it can fail.
++ * Releasing of existing data is done when we are sure remount will
++ * succeed.
++ */
++ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) {
++ err = ext4_setup_system_zone(sb);
++ if (err)
++ goto restore_opts;
++ }
+
+ if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
+ err = ext4_commit_super(sb, 1);
+@@ -5587,6 +5596,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ }
+ }
+ #endif
++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
++ ext4_release_system_zone(sb);
+
+ /*
+ * Some options can be enabled by ext4 and/or by VFS mount flag
+@@ -5608,6 +5619,8 @@ restore_opts:
+ sbi->s_commit_interval = old_opts.s_commit_interval;
+ sbi->s_min_batch_time = old_opts.s_min_batch_time;
+ sbi->s_max_batch_time = old_opts.s_max_batch_time;
++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks)
++ ext4_release_system_zone(sb);
+ #ifdef CONFIG_QUOTA
+ sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++) {
+--
+2.25.1
+
--- /dev/null
+From 62489b6ecbbc90a7e656382c06a2b2e064448d18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 16:07:59 +0200
+Subject: ext4: don't BUG on inconsistent journal feature
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ]
+
+A customer has reported a BUG_ON in ext4_clear_journal_err() hitting
+during an LTP testing. Either this has been caused by a test setup
+issue where the filesystem was being overwritten while LTP was mounting
+it or the journal replay has overwritten the superblock with invalid
+data. In either case it is preferable we don't take the machine down
+with a BUG_ON. So handle the situation of unexpectedly missing
+has_journal feature more gracefully. We issue warning and fail the mount
+in the cases where the race window is narrow and the failed check is
+most likely a programming error. In cases where fs corruption is more
+likely, we do full ext4_error() handling before failing mount / remount.
+
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20200710140759.18031-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 47 insertions(+), 21 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index f7c20bb20da37..bd4feafcff294 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -66,10 +66,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *,
+ unsigned long journal_devnum);
+ static int ext4_show_options(struct seq_file *seq, struct dentry *root);
+ static int ext4_commit_super(struct super_block *sb, int sync);
+-static void ext4_mark_recovery_complete(struct super_block *sb,
++static int ext4_mark_recovery_complete(struct super_block *sb,
+ struct ext4_super_block *es);
+-static void ext4_clear_journal_err(struct super_block *sb,
+- struct ext4_super_block *es);
++static int ext4_clear_journal_err(struct super_block *sb,
++ struct ext4_super_block *es);
+ static int ext4_sync_fs(struct super_block *sb, int wait);
+ static int ext4_remount(struct super_block *sb, int *flags, char *data);
+ static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
+@@ -4635,7 +4635,9 @@ no_journal:
+ EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
+ if (needs_recovery) {
+ ext4_msg(sb, KERN_INFO, "recovery complete");
+- ext4_mark_recovery_complete(sb, es);
++ err = ext4_mark_recovery_complete(sb, es);
++ if (err)
++ goto failed_mount8;
+ }
+ if (EXT4_SB(sb)->s_journal) {
+ if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+@@ -4678,10 +4680,8 @@ cantfind_ext4:
+ ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem");
+ goto failed_mount;
+
+-#ifdef CONFIG_QUOTA
+ failed_mount8:
+ ext4_unregister_sysfs(sb);
+-#endif
+ failed_mount7:
+ ext4_unregister_li_request(sb);
+ failed_mount6:
+@@ -4820,7 +4820,8 @@ static journal_t *ext4_get_journal(struct super_block *sb,
+ struct inode *journal_inode;
+ journal_t *journal;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return NULL;
+
+ journal_inode = ext4_get_journal_inode(sb, journal_inum);
+ if (!journal_inode)
+@@ -4850,7 +4851,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
+ struct ext4_super_block *es;
+ struct block_device *bdev;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return NULL;
+
+ bdev = ext4_blkdev_get(j_dev, sb);
+ if (bdev == NULL)
+@@ -4942,7 +4944,8 @@ static int ext4_load_journal(struct super_block *sb,
+ int err = 0;
+ int really_read_only;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
++ return -EFSCORRUPTED;
+
+ if (journal_devnum &&
+ journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+@@ -5012,7 +5015,12 @@ static int ext4_load_journal(struct super_block *sb,
+ }
+
+ EXT4_SB(sb)->s_journal = journal;
+- ext4_clear_journal_err(sb, es);
++ err = ext4_clear_journal_err(sb, es);
++ if (err) {
++ EXT4_SB(sb)->s_journal = NULL;
++ jbd2_journal_destroy(journal);
++ return err;
++ }
+
+ if (!really_read_only && journal_devnum &&
+ journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+@@ -5108,26 +5116,32 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ * remounting) the filesystem readonly, then we will end up with a
+ * consistent fs on disk. Record that fact.
+ */
+-static void ext4_mark_recovery_complete(struct super_block *sb,
+- struct ext4_super_block *es)
++static int ext4_mark_recovery_complete(struct super_block *sb,
++ struct ext4_super_block *es)
+ {
++ int err;
+ journal_t *journal = EXT4_SB(sb)->s_journal;
+
+ if (!ext4_has_feature_journal(sb)) {
+- BUG_ON(journal != NULL);
+- return;
++ if (journal != NULL) {
++ ext4_error(sb, "Journal got removed while the fs was "
++ "mounted!");
++ return -EFSCORRUPTED;
++ }
++ return 0;
+ }
+ jbd2_journal_lock_updates(journal);
+- if (jbd2_journal_flush(journal) < 0)
++ err = jbd2_journal_flush(journal);
++ if (err < 0)
+ goto out;
+
+ if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) {
+ ext4_clear_feature_journal_needs_recovery(sb);
+ ext4_commit_super(sb, 1);
+ }
+-
+ out:
+ jbd2_journal_unlock_updates(journal);
++ return err;
+ }
+
+ /*
+@@ -5135,14 +5149,17 @@ out:
+ * has recorded an error from a previous lifetime, move that error to the
+ * main filesystem now.
+ */
+-static void ext4_clear_journal_err(struct super_block *sb,
++static int ext4_clear_journal_err(struct super_block *sb,
+ struct ext4_super_block *es)
+ {
+ journal_t *journal;
+ int j_errno;
+ const char *errstr;
+
+- BUG_ON(!ext4_has_feature_journal(sb));
++ if (!ext4_has_feature_journal(sb)) {
++ ext4_error(sb, "Journal got removed while the fs was mounted!");
++ return -EFSCORRUPTED;
++ }
+
+ journal = EXT4_SB(sb)->s_journal;
+
+@@ -5167,6 +5184,7 @@ static void ext4_clear_journal_err(struct super_block *sb,
+ jbd2_journal_clear_err(journal);
+ jbd2_journal_update_sb_errno(journal);
+ }
++ return 0;
+ }
+
+ /*
+@@ -5437,8 +5455,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ (sbi->s_mount_state & EXT4_VALID_FS))
+ es->s_state = cpu_to_le16(sbi->s_mount_state);
+
+- if (sbi->s_journal)
++ if (sbi->s_journal) {
++ /*
++ * We let remount-ro finish even if marking fs
++ * as clean failed...
++ */
+ ext4_mark_recovery_complete(sb, es);
++ }
+ if (sbi->s_mmp_tsk)
+ kthread_stop(sbi->s_mmp_tsk);
+ } else {
+@@ -5486,8 +5509,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ * been changed by e2fsck since we originally mounted
+ * the partition.)
+ */
+- if (sbi->s_journal)
+- ext4_clear_journal_err(sb, es);
++ if (sbi->s_journal) {
++ err = ext4_clear_journal_err(sb, es);
++ if (err)
++ goto restore_opts;
++ }
+ sbi->s_mount_state = le16_to_cpu(es->s_state);
+
+ err = ext4_setup_super(sb, es, 0);
+--
+2.25.1
+
--- /dev/null
+From e41f31783b40746bf14687c1398ad650c039fbe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:04:32 +0200
+Subject: ext4: handle error of ext4_setup_system_zone() on remount
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit d176b1f62f242ab259ff665a26fbac69db1aecba ]
+
+ext4_setup_system_zone() can fail. Handle the failure in ext4_remount().
+
+Reviewed-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20200728130437.7804-2-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 92a6741c4bdd9..e8923013accc0 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5563,7 +5563,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ ext4_register_li_request(sb, first_not_zeroed);
+ }
+
+- ext4_setup_system_zone(sb);
++ err = ext4_setup_system_zone(sb);
++ if (err)
++ goto restore_opts;
++
+ if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) {
+ err = ext4_commit_super(sb, 1);
+ if (err)
+--
+2.25.1
+
--- /dev/null
+From f2b4d4507008ee8ba1ee0441031e3f06960b052d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 17:05:26 +0200
+Subject: ext4: handle option set by mount flags correctly
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+[ Upstream commit f25391ebb475d3ffb3aa61bb90e3594c841749ef ]
+
+Currently there is a problem with mount options that can be both set by
+vfs using mount flags or by a string parsing in ext4.
+
+i_version/iversion options gets lost after remount, for example
+
+$ mount -o i_version /dev/pmem0 /mnt
+$ grep pmem0 /proc/self/mountinfo | grep i_version
+310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,seclabel,i_version
+$ mount -o remount,ro /mnt
+$ grep pmem0 /proc/self/mountinfo | grep i_version
+
+nolazytime gets ignored by ext4 on remount, for example
+
+$ mount -o lazytime /dev/pmem0 /mnt
+$ grep pmem0 /proc/self/mountinfo | grep lazytime
+310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel
+$ mount -o remount,nolazytime /mnt
+$ grep pmem0 /proc/self/mountinfo | grep lazytime
+310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel
+
+Fix it by applying the SB_LAZYTIME and SB_I_VERSION flags from *flags to
+s_flags before we parse the option and use the resulting state of the
+same flags in *flags at the end of successful remount.
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/20200723150526.19931-1-lczerner@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 76c5529394395..92a6741c4bdd9 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5342,7 +5342,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ {
+ struct ext4_super_block *es;
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- unsigned long old_sb_flags;
++ unsigned long old_sb_flags, vfs_flags;
+ struct ext4_mount_options old_opts;
+ int enable_quota = 0;
+ ext4_group_t g;
+@@ -5385,6 +5385,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ if (sbi->s_journal && sbi->s_journal->j_task->io_context)
+ journal_ioprio = sbi->s_journal->j_task->io_context->ioprio;
+
++ /*
++ * Some options can be enabled by ext4 and/or by VFS mount flag
++ * either way we need to make sure it matches in both *flags and
++ * s_flags. Copy those selected flags from *flags to s_flags
++ */
++ vfs_flags = SB_LAZYTIME | SB_I_VERSION;
++ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags);
++
+ if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) {
+ err = -EINVAL;
+ goto restore_opts;
+@@ -5438,9 +5446,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+ }
+
+- if (*flags & SB_LAZYTIME)
+- sb->s_flags |= SB_LAZYTIME;
+-
+ if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) {
+ if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
+ err = -EROFS;
+@@ -5580,7 +5585,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ }
+ #endif
+
+- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME);
++ /*
++ * Some options can be enabled by ext4 and/or by VFS mount flag
++ * either way we need to make sure it matches in both *flags and
++ * s_flags. Copy those selected flags from s_flags to *flags
++ */
++ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags);
++
+ ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data);
+ kfree(orig_data);
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 45562d8f7a7870ef813d81ea5854908b781b0290 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 11:06:05 +0200
+Subject: ext4: handle read only external journal device
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+[ Upstream commit 273108fa5015eeffc4bacfa5ce272af3434b96e4 ]
+
+Ext4 uses blkdev_get_by_dev() to get the block_device for journal device
+which does check to see if the read-only block device was opened
+read-only.
+
+As a result ext4 will hapily proceed mounting the file system with
+external journal on read-only device. This is bad as we would not be
+able to use the journal leading to errors later on.
+
+Instead of simply failing to mount file system in this case, treat it in
+a similar way we treat internal journal on read-only device. Allow to
+mount with -o noload in read-only mode.
+
+This can be reproduced easily like this:
+
+mke2fs -F -O journal_dev $JOURNAL_DEV 100M
+mkfs.$FSTYPE -F -J device=$JOURNAL_DEV $FS_DEV
+blockdev --setro $JOURNAL_DEV
+mount $FS_DEV $MNT
+touch $MNT/file
+umount $MNT
+
+leading to error like this
+
+[ 1307.318713] ------------[ cut here ]------------
+[ 1307.323362] generic_make_request: Trying to write to read-only block-device dm-2 (partno 0)
+[ 1307.331741] WARNING: CPU: 36 PID: 3224 at block/blk-core.c:855 generic_make_request_checks+0x2c3/0x580
+[ 1307.341041] Modules linked in: ext4 mbcache jbd2 rfkill intel_rapl_msr intel_rapl_common isst_if_commd
+[ 1307.419445] CPU: 36 PID: 3224 Comm: jbd2/dm-2 Tainted: G W I 5.8.0-rc5 #2
+[ 1307.427359] Hardware name: Dell Inc. PowerEdge R740/01KPX8, BIOS 2.3.10 08/15/2019
+[ 1307.434932] RIP: 0010:generic_make_request_checks+0x2c3/0x580
+[ 1307.440676] Code: 94 03 00 00 48 89 df 48 8d 74 24 08 c6 05 cf 2b 18 01 01 e8 7f a4 ff ff 48 c7 c7 50e
+[ 1307.459420] RSP: 0018:ffffc0d70eb5fb48 EFLAGS: 00010286
+[ 1307.464646] RAX: 0000000000000000 RBX: ffff9b33b2978300 RCX: 0000000000000000
+[ 1307.471780] RDX: ffff9b33e12a81e0 RSI: ffff9b33e1298000 RDI: ffff9b33e1298000
+[ 1307.478913] RBP: ffff9b7b9679e0c0 R08: 0000000000000837 R09: 0000000000000024
+[ 1307.486044] R10: 0000000000000000 R11: ffffc0d70eb5f9f0 R12: 0000000000000400
+[ 1307.493177] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
+[ 1307.500308] FS: 0000000000000000(0000) GS:ffff9b33e1280000(0000) knlGS:0000000000000000
+[ 1307.508396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1307.514142] CR2: 000055eaf4109000 CR3: 0000003dee40a006 CR4: 00000000007606e0
+[ 1307.521273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1307.528407] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1307.535538] PKRU: 55555554
+[ 1307.538250] Call Trace:
+[ 1307.540708] generic_make_request+0x30/0x340
+[ 1307.544985] submit_bio+0x43/0x190
+[ 1307.548393] ? bio_add_page+0x62/0x90
+[ 1307.552068] submit_bh_wbc+0x16a/0x190
+[ 1307.555833] jbd2_write_superblock+0xec/0x200 [jbd2]
+[ 1307.560803] jbd2_journal_update_sb_log_tail+0x65/0xc0 [jbd2]
+[ 1307.566557] jbd2_journal_commit_transaction+0x2ae/0x1860 [jbd2]
+[ 1307.572566] ? check_preempt_curr+0x7a/0x90
+[ 1307.576756] ? update_curr+0xe1/0x1d0
+[ 1307.580421] ? account_entity_dequeue+0x7b/0xb0
+[ 1307.584955] ? newidle_balance+0x231/0x3d0
+[ 1307.589056] ? __switch_to_asm+0x42/0x70
+[ 1307.592986] ? __switch_to_asm+0x36/0x70
+[ 1307.596918] ? lock_timer_base+0x67/0x80
+[ 1307.600851] kjournald2+0xbd/0x270 [jbd2]
+[ 1307.604873] ? finish_wait+0x80/0x80
+[ 1307.608460] ? commit_timeout+0x10/0x10 [jbd2]
+[ 1307.612915] kthread+0x114/0x130
+[ 1307.616152] ? kthread_park+0x80/0x80
+[ 1307.619816] ret_from_fork+0x22/0x30
+[ 1307.623400] ---[ end trace 27490236265b1630 ]---
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Andreas Dilger <adilger@dilger.ca>
+Link: https://lore.kernel.org/r/20200717090605.2612-1-lczerner@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 33 insertions(+), 18 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index bd4feafcff294..76c5529394395 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4943,6 +4943,7 @@ static int ext4_load_journal(struct super_block *sb,
+ dev_t journal_dev;
+ int err = 0;
+ int really_read_only;
++ int journal_dev_ro;
+
+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb)))
+ return -EFSCORRUPTED;
+@@ -4955,7 +4956,31 @@ static int ext4_load_journal(struct super_block *sb,
+ } else
+ journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev));
+
+- really_read_only = bdev_read_only(sb->s_bdev);
++ if (journal_inum && journal_dev) {
++ ext4_msg(sb, KERN_ERR,
++ "filesystem has both journal inode and journal device!");
++ return -EINVAL;
++ }
++
++ if (journal_inum) {
++ journal = ext4_get_journal(sb, journal_inum);
++ if (!journal)
++ return -EINVAL;
++ } else {
++ journal = ext4_get_dev_journal(sb, journal_dev);
++ if (!journal)
++ return -EINVAL;
++ }
++
++ journal_dev_ro = bdev_read_only(journal->j_dev);
++ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro;
++
++ if (journal_dev_ro && !sb_rdonly(sb)) {
++ ext4_msg(sb, KERN_ERR,
++ "journal device read-only, try mounting with '-o ro'");
++ err = -EROFS;
++ goto err_out;
++ }
+
+ /*
+ * Are we loading a blank journal or performing recovery after a
+@@ -4970,27 +4995,14 @@ static int ext4_load_journal(struct super_block *sb,
+ ext4_msg(sb, KERN_ERR, "write access "
+ "unavailable, cannot proceed "
+ "(try mounting with noload)");
+- return -EROFS;
++ err = -EROFS;
++ goto err_out;
+ }
+ ext4_msg(sb, KERN_INFO, "write access will "
+ "be enabled during recovery");
+ }
+ }
+
+- if (journal_inum && journal_dev) {
+- ext4_msg(sb, KERN_ERR, "filesystem has both journal "
+- "and inode journals!");
+- return -EINVAL;
+- }
+-
+- if (journal_inum) {
+- if (!(journal = ext4_get_journal(sb, journal_inum)))
+- return -EINVAL;
+- } else {
+- if (!(journal = ext4_get_dev_journal(sb, journal_dev)))
+- return -EINVAL;
+- }
+-
+ if (!(journal->j_flags & JBD2_BARRIER))
+ ext4_msg(sb, KERN_INFO, "barriers disabled");
+
+@@ -5010,8 +5022,7 @@ static int ext4_load_journal(struct super_block *sb,
+
+ if (err) {
+ ext4_msg(sb, KERN_ERR, "error loading journal");
+- jbd2_journal_destroy(journal);
+- return err;
++ goto err_out;
+ }
+
+ EXT4_SB(sb)->s_journal = journal;
+@@ -5031,6 +5042,10 @@ static int ext4_load_journal(struct super_block *sb,
+ }
+
+ return 0;
++
++err_out:
++ jbd2_journal_destroy(journal);
++ return err;
+ }
+
+ static int ext4_commit_super(struct super_block *sb, int sync)
+--
+2.25.1
+
--- /dev/null
+From 7f8aa158c0084d07ae26df41ec8be1327582ca1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 12:10:25 -0400
+Subject: fs: prevent BUG_ON in submit_bh_wbc()
+
+From: Xianting Tian <xianting_tian@126.com>
+
+[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ]
+
+If a device is hot-removed --- for example, when a physical device is
+unplugged from pcie slot or a nbd device's network is shutdown ---
+this can result in a BUG_ON() crash in submit_bh_wbc(). This is
+because the when the block device dies, the buffer heads will have
+their Buffer_Mapped flag get cleared, leading to the crash in
+submit_bh_wbc.
+
+We had attempted to work around this problem in commit a17712c8
+("ext4: check superblock mapped prior to committing"). Unfortunately,
+it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the
+device dies between when the work-around check in ext4_commit_super()
+and when submit_bh_wbh() is finally called:
+
+Code path:
+ext4_commit_super
+ judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8
+ lock_buffer(sbh)
+ ...
+ unlock_buffer(sbh)
+ __sync_dirty_buffer(sbh,...
+ lock_buffer(sbh)
+ judge if 'buffer_mapped(sbh))' is false, return <== added by this patch
+ submit_bh(...,sbh)
+ submit_bh_wbc(...,sbh,...)
+
+[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc()
+[100722.966503] invalid opcode: 0000 [#1] SMP
+[100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000
+[100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190
+[100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246
+[100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000
+[100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001
+[100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d
+[100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800
+[100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000
+[100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000
+[100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0
+[100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[100722.966583] PKRU: 55555554
+[100722.966583] Call Trace:
+[100722.966588] __sync_dirty_buffer+0x6e/0xd0
+[100722.966614] ext4_commit_super+0x1d8/0x290 [ext4]
+[100722.966626] __ext4_std_error+0x78/0x100 [ext4]
+[100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4]
+[100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4]
+[100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4]
+[100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4]
+[100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4]
+[100722.966679] ext4_dirty_inode+0x48/0x70 [ext4]
+[100722.966682] __mark_inode_dirty+0x17f/0x350
+[100722.966686] generic_update_time+0x87/0xd0
+[100722.966687] touch_atime+0xa9/0xd0
+[100722.966690] generic_file_read_iter+0xa09/0xcd0
+[100722.966694] ? page_cache_tree_insert+0xb0/0xb0
+[100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4]
+[100722.966707] ? __inode_security_revalidate+0x4f/0x60
+[100722.966709] __vfs_read+0xec/0x160
+[100722.966711] vfs_read+0x8c/0x130
+[100722.966712] SyS_pread64+0x87/0xb0
+[100722.966716] do_syscall_64+0x67/0x1b0
+[100722.966719] entry_SYSCALL64_slow_path+0x25/0x25
+
+To address this, add the check of 'buffer_mapped(bh)' to
+__sync_dirty_buffer(). This also has the benefit of fixing this for
+other file systems.
+
+With this addition, we can drop the workaround in ext4_commit_supper().
+
+[ Commit description rewritten by tytso. ]
+
+Signed-off-by: Xianting Tian <xianting_tian@126.com>
+Link: https://lore.kernel.org/r/1596211825-8750-1-git-send-email-xianting_tian@126.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/buffer.c | 9 +++++++++
+ fs/ext4/super.c | 7 -------
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 79c9562434a8d..22d8ac4a8c40a 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -3170,6 +3170,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags)
+ WARN_ON(atomic_read(&bh->b_count) < 1);
+ lock_buffer(bh);
+ if (test_clear_buffer_dirty(bh)) {
++ /*
++ * The bh should be mapped, but it might not be if the
++ * device was hot-removed. Not much we can do but fail the I/O.
++ */
++ if (!buffer_mapped(bh)) {
++ unlock_buffer(bh);
++ return -EIO;
++ }
++
+ get_bh(bh);
+ bh->b_end_io = end_buffer_write_sync;
+ ret = submit_bh(REQ_OP_WRITE, op_flags, bh);
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 184f2d737efc9..4aae7e3e89a12 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5059,13 +5059,6 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ if (!sbh || block_device_ejected(sb))
+ return error;
+
+- /*
+- * The superblock bh should be mapped, but it might not be if the
+- * device was hot-removed. Not much we can do but fail the I/O.
+- */
+- if (!buffer_mapped(sbh))
+- return error;
+-
+ /*
+ * If the file system is mounted read-only, don't update the
+ * superblock write time. This avoids updating the superblock
+--
+2.25.1
+
--- /dev/null
+From 77b53c9126679d6e597bfcae2fca571b674190a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 12:20:14 -0400
+Subject: hwmon: (nct7904) Correct divide by 0
+
+From: Jason Baron <jbaron@akamai.com>
+
+[ Upstream commit 8aebbbb2d573d0b4afc08b90ac7d73dba2d9da97 ]
+
+We hit a kernel panic due to a divide by 0 in nct7904_read_fan() for
+the hwmon_fan_min case. Extend the check to hwmon_fan_input case as well
+for safety.
+
+[ 1656.545650] divide error: 0000 [#1] SMP PTI
+[ 1656.545779] CPU: 12 PID: 18010 Comm: sensors Not tainted 5.4.47 #1
+[ 1656.546065] RIP: 0010:nct7904_read+0x1e9/0x510 [nct7904]
+...
+[ 1656.546549] RAX: 0000000000149970 RBX: ffffbd6b86bcbe08 RCX: 0000000000000000
+...
+[ 1656.547548] Call Trace:
+[ 1656.547665] hwmon_attr_show+0x32/0xd0 [hwmon]
+[ 1656.547783] dev_attr_show+0x18/0x50
+[ 1656.547898] sysfs_kf_seq_show+0x99/0x120
+[ 1656.548013] seq_read+0xd8/0x3e0
+[ 1656.548127] vfs_read+0x89/0x130
+[ 1656.548234] ksys_read+0x7d/0xb0
+[ 1656.548342] do_syscall_64+0x48/0x110
+[ 1656.548451] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: d65a5102a99f5 ("hwmon: (nct7904) Convert to use new hwmon registration API")
+Signed-off-by: Jason Baron <jbaron@akamai.com>
+Link: https://lore.kernel.org/r/1598026814-2604-1-git-send-email-jbaron@akamai.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct7904.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
+index dfb122b5e1b76..b812b199e5e5b 100644
+--- a/drivers/hwmon/nct7904.c
++++ b/drivers/hwmon/nct7904.c
+@@ -197,7 +197,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel,
+ if (ret < 0)
+ return ret;
+ cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f);
+- if (cnt == 0x1fff)
++ if (cnt == 0 || cnt == 0x1fff)
+ rpm = 0;
+ else
+ rpm = 1350000 / cnt;
+@@ -209,7 +209,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel,
+ if (ret < 0)
+ return ret;
+ cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f);
+- if (cnt == 0x1fff)
++ if (cnt == 0 || cnt == 0x1fff)
+ rpm = 0;
+ else
+ rpm = 1350000 / cnt;
+--
+2.25.1
+
--- /dev/null
+From 113fa83c1d7aff50613babbd78c8cd9c24114b08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 20:03:33 +0300
+Subject: i2c: core: Don't fail PRP0001 enumeration when no ID table exist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e3cb82c6d6f6c27ab754e13ae29bdd6b949982e2 ]
+
+When commit c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case
+as well") fixed the enumeration of I²C devices on ACPI enabled platforms
+when driver has no ID table, it missed the PRP0001 support.
+
+i2c_device_match() and i2c_acpi_match_device() differently match
+driver against given device. Use acpi_driver_match_device(), that is used
+in the former, in i2c_device_probe() and don't fail PRP0001 enumeration
+when no ID table exist.
+
+Fixes: c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well")
+BugLink: https://stackoverflow.com/q/63519678/2511795
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
+index cc193f2ba5d37..def62d5b42ca7 100644
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -354,7 +354,7 @@ static int i2c_device_probe(struct device *dev)
+ * or ACPI ID table is supplied for the probing device.
+ */
+ if (!driver->id_table &&
+- !i2c_acpi_match_device(dev->driver->acpi_match_table, client) &&
++ !acpi_driver_match_device(dev, dev->driver) &&
+ !i2c_of_match_device(dev->driver->of_match_table, client)) {
+ status = -ENODEV;
+ goto put_sync_adapter;
+--
+2.25.1
+
--- /dev/null
+From a4fb1dd4197fe5d6efbddd340849fe310dd8e37f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 14:19:30 +0200
+Subject: i2c: rcar: in slave mode, clear NACK earlier
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ]
+
+Currently, a NACK in slave mode is set/cleared when SCL is held low by
+the IP core right before the bit is about to be pushed out. This is too
+late for clearing and then a NACK from the previous byte is still used
+for the current one. Now, let's clear the NACK right after we detected
+the STOP condition following the NACK.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 0b90aa0318df3..9c162a01a5849 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -587,6 +587,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ /* master sent stop */
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
+ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+--
+2.25.1
+
--- /dev/null
+From ab4acf9e0886f638ef16fcc9df41fddc237c3e16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Jun 2020 10:54:26 +0800
+Subject: jbd2: abort journal if free a async write error metadata buffer
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ]
+
+If we free a metadata buffer which has been failed to async write out
+in the background, the jbd2 checkpoint procedure will not detect this
+failure in jbd2_log_do_checkpoint(), so it may lead to filesystem
+inconsistency after cleanup journal tail. This patch abort the journal
+if free a buffer has write_io_error flag to prevent potential further
+inconsistency.
+
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/transaction.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index 0b663269771d4..90453309345d5 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -2077,6 +2077,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
+ {
+ struct buffer_head *head;
+ struct buffer_head *bh;
++ bool has_write_io_error = false;
+ int ret = 0;
+
+ J_ASSERT(PageLocked(page));
+@@ -2101,11 +2102,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
+ jbd_unlock_bh_state(bh);
+ if (buffer_jbd(bh))
+ goto busy;
++
++ /*
++ * If we free a metadata buffer which has been failed to
++ * write out, the jbd2 checkpoint procedure will not detect
++ * this failure and may lead to filesystem inconsistency
++ * after cleanup journal tail.
++ */
++ if (buffer_write_io_error(bh)) {
++ pr_err("JBD2: Error while async write back metadata bh %llu.",
++ (unsigned long long)bh->b_blocknr);
++ has_write_io_error = true;
++ }
+ } while ((bh = bh->b_this_page) != head);
+
+ ret = try_to_free_buffers(page);
+
+ busy:
++ if (has_write_io_error)
++ jbd2_journal_abort(journal, -EIO);
++
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 559aee5e4f85f643342be8de2d696e76c0732a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 11:25:49 +0200
+Subject: jbd2: make sure jh have b_transaction set in refile/unfile_buffer
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
+
+Callers of __jbd2_journal_unfile_buffer() and
+__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
+fact if it's not, we can end up with journal_head refcounting errors
+leading to crash much later that might be very hard to track down. Add
+asserts to make sure that is the case.
+
+We also make sure that b_next_transaction is NULL in
+__jbd2_journal_unfile_buffer() since the callers expect that as well and
+we should not get into that stage in this state anyway, leading to
+problems later on if we do.
+
+Tested with fstests.
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/transaction.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index de992a70ddfef..0b663269771d4 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1983,6 +1983,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
+ */
+ static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
+ {
++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
++
+ __jbd2_journal_temp_unlink_buffer(jh);
+ jh->b_transaction = NULL;
+ jbd2_journal_put_journal_head(jh);
+@@ -2530,6 +2533,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
+
+ was_dirty = test_clear_buffer_jbddirty(bh);
+ __jbd2_journal_temp_unlink_buffer(jh);
++
++ /*
++ * b_transaction must be set, otherwise the new b_transaction won't
++ * be holding jh reference
++ */
++ J_ASSERT_JH(jh, jh->b_transaction != NULL);
++
+ /*
+ * We set b_transaction here because b_next_transaction will inherit
+ * our jh reference and thus __jbd2_journal_file_buffer() must not
+--
+2.25.1
+
--- /dev/null
+From f0b0bdbf7045ed59d5ec03fbbbfb64a7be5dab1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 16:39:10 +0200
+Subject: libbpf: Handle GCC built-in types for Arm NEON
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 702eddc77a905782083b14ccd05b23840675fd18 ]
+
+When building Arm NEON (SIMD) code from lib/raid6/neon.uc, GCC emits
+DWARF information using a base type "__Poly8_t", which is internal to
+GCC and not recognized by Clang. This causes build failures when
+building with Clang a vmlinux.h generated from an arm64 kernel that was
+built with GCC.
+
+ vmlinux.h:47284:9: error: unknown type name '__Poly8_t'
+ typedef __Poly8_t poly8x16_t[16];
+ ^~~~~~~~~
+
+The polyX_t types are defined as unsigned integers in the "Arm C
+Language Extension" document (101028_Q220_00_en). Emit typedefs based on
+standard integer types for the GCC internal types, similar to those
+emitted by Clang.
+
+Including linux/kernel.h to use ARRAY_SIZE() incidentally redefined
+max(), causing a build bug due to different types, hence the seemingly
+unrelated change.
+
+Reported-by: Jakov Petrina <jakov.petrina@sartura.hr>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200812143909.3293280-1-jean-philippe@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf_dump.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c
+index d9e386b8f47ed..07fcc8e79662d 100644
+--- a/tools/lib/bpf/btf_dump.c
++++ b/tools/lib/bpf/btf_dump.c
+@@ -13,6 +13,7 @@
+ #include <errno.h>
+ #include <linux/err.h>
+ #include <linux/btf.h>
++#include <linux/kernel.h>
+ #include "btf.h"
+ #include "hashmap.h"
+ #include "libbpf.h"
+@@ -543,6 +544,9 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr)
+ }
+ }
+
++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id,
++ const struct btf_type *t);
++
+ static void btf_dump_emit_struct_fwd(struct btf_dump *d, __u32 id,
+ const struct btf_type *t);
+ static void btf_dump_emit_struct_def(struct btf_dump *d, __u32 id,
+@@ -665,6 +669,9 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id)
+
+ switch (kind) {
+ case BTF_KIND_INT:
++ /* Emit type alias definitions if necessary */
++ btf_dump_emit_missing_aliases(d, id, t);
++
+ tstate->emit_state = EMITTED;
+ break;
+ case BTF_KIND_ENUM:
+@@ -899,7 +906,7 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,
+ btf_dump_printf(d, ": %d", m_sz);
+ off = m_off + m_sz;
+ } else {
+- m_sz = max(0, btf__resolve_size(d->btf, m->type));
++ m_sz = max(0LL, btf__resolve_size(d->btf, m->type));
+ off = m_off + m_sz * 8;
+ }
+ btf_dump_printf(d, ";");
+@@ -919,6 +926,32 @@ static void btf_dump_emit_struct_def(struct btf_dump *d,
+ btf_dump_printf(d, " __attribute__((packed))");
+ }
+
++static const char *missing_base_types[][2] = {
++ /*
++ * GCC emits typedefs to its internal __PolyX_t types when compiling Arm
++ * SIMD intrinsics. Alias them to standard base types.
++ */
++ { "__Poly8_t", "unsigned char" },
++ { "__Poly16_t", "unsigned short" },
++ { "__Poly64_t", "unsigned long long" },
++ { "__Poly128_t", "unsigned __int128" },
++};
++
++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id,
++ const struct btf_type *t)
++{
++ const char *name = btf_dump_type_name(d, id);
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(missing_base_types); i++) {
++ if (strcmp(name, missing_base_types[i][0]) == 0) {
++ btf_dump_printf(d, "typedef %s %s;\n\n",
++ missing_base_types[i][1], name);
++ break;
++ }
++ }
++}
++
+ static void btf_dump_emit_enum_fwd(struct btf_dump *d, __u32 id,
+ const struct btf_type *t)
+ {
+--
+2.25.1
+
--- /dev/null
+From bfac317199c67e19c487f932b65dfbfb176516bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 10:51:34 +0200
+Subject: macvlan: validate setting of multiple remote source MAC addresses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alvin Šipraga <alsi@bang-olufsen.dk>
+
+[ Upstream commit 8b61fba503904acae24aeb2bd5569b4d6544d48f ]
+
+Remote source MAC addresses can be set on a 'source mode' macvlan
+interface via the IFLA_MACVLAN_MACADDR_DATA attribute. This commit
+tightens the validation of these MAC addresses to match the validation
+already performed when setting or adding a single MAC address via the
+IFLA_MACVLAN_MACADDR attribute.
+
+iproute2 uses IFLA_MACVLAN_MACADDR_DATA for its 'macvlan macaddr set'
+command, and IFLA_MACVLAN_MACADDR for its 'macvlan macaddr add' command,
+which demonstrates the inconsistent behaviour that this commit
+addresses:
+
+ # ip link add link eth0 name macvlan0 type macvlan mode source
+ # ip link set link dev macvlan0 type macvlan macaddr add 01:00:00:00:00:00
+ RTNETLINK answers: Cannot assign requested address
+ # ip link set link dev macvlan0 type macvlan macaddr set 01:00:00:00:00:00
+ # ip -d link show macvlan0
+ 5: macvlan0@eth0: <BROADCAST,MULTICAST,DYNAMIC,UP,LOWER_UP> mtu 1500 ...
+ link/ether 2e:ac:fd:2d:69:f8 brd ff:ff:ff:ff:ff:ff promiscuity 0
+ macvlan mode source remotes (1) 01:00:00:00:00:00 numtxqueues 1 ...
+
+With this change, the 'set' command will (rightly) fail in the same way
+as the 'add' command.
+
+Signed-off-by: Alvin Šipraga <alsi@bang-olufsen.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macvlan.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 9d3209ae41cfb..07622cf8765ae 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1259,6 +1259,9 @@ static void macvlan_port_destroy(struct net_device *dev)
+ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ struct nlattr *nla, *head;
++ int rem, len;
++
+ if (tb[IFLA_ADDRESS]) {
+ if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
+ return -EINVAL;
+@@ -1306,6 +1309,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[],
+ return -EADDRNOTAVAIL;
+ }
+
++ if (data[IFLA_MACVLAN_MACADDR_DATA]) {
++ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]);
++ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
++
++ nla_for_each_attr(nla, head, len, rem) {
++ if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
++ nla_len(nla) != ETH_ALEN)
++ return -EINVAL;
++
++ if (!is_valid_ether_addr(nla_data(nla)))
++ return -EADDRNOTAVAIL;
++ }
++ }
++
+ if (data[IFLA_MACVLAN_MACADDR_COUNT])
+ return -EINVAL;
+
+@@ -1362,10 +1379,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode,
+ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]);
+
+ nla_for_each_attr(nla, head, len, rem) {
+- if (nla_type(nla) != IFLA_MACVLAN_MACADDR ||
+- nla_len(nla) != ETH_ALEN)
+- continue;
+-
+ addr = nla_data(nla);
+ ret = macvlan_hash_add_source(vlan, addr);
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From aa5a656341bd223b8a31c7006e694e62f15f1677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2020 14:50:52 +0200
+Subject: media: gpio-ir-tx: improve precision of transmitted signal due to
+ scheduling
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ]
+
+usleep_range() may take longer than the max argument due to scheduling,
+especially under load. This is causing random errors in the transmitted
+IR. Remove the usleep_range() in favour of busy-looping with udelay().
+
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-tx.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
+index 18ca12d78314c..66703989ae185 100644
+--- a/drivers/media/rc/gpio-ir-tx.c
++++ b/drivers/media/rc/gpio-ir-tx.c
+@@ -79,13 +79,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+ // space
+ edge = ktime_add_us(edge, txbuf[i]);
+ delta = ktime_us_delta(edge, ktime_get());
+- if (delta > 10) {
+- spin_unlock_irqrestore(&gpio_ir->lock, flags);
+- usleep_range(delta, delta + 10);
+- spin_lock_irqsave(&gpio_ir->lock, flags);
+- } else if (delta > 0) {
++ if (delta > 0)
+ udelay(delta);
+- }
+ } else {
+ // pulse
+ ktime_t last = ktime_add_us(edge, txbuf[i]);
+--
+2.25.1
+
--- /dev/null
+From b5e99040178a30393cd0a4117b300f1f69d5f01b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 00:22:41 +0530
+Subject: net: gianfar: Add of_node_put() before goto statement
+
+From: Sumera Priyadarsini <sylphrenadin@gmail.com>
+
+[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ]
+
+Every iteration of for_each_available_child_of_node() decrements
+reference count of the previous node, however when control
+is transferred from the middle of the loop, as in the case of
+a return or break or goto, there is no decrement thus ultimately
+resulting in a memory leak.
+
+Fix a potential memory leak in gianfar.c by inserting of_node_put()
+before the goto statement.
+
+Issue found with Coccinelle.
+
+Signed-off-by: Sumera Priyadarsini <sylphrenadin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 2580bcd850253..3978d82c95989 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -751,8 +751,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
+ continue;
+
+ err = gfar_parse_group(child, priv, model);
+- if (err)
++ if (err) {
++ of_node_put(child);
+ goto err_grp_init;
++ }
+ }
+ } else { /* SQ_SG_MODE */
+ err = gfar_parse_group(np, priv, model);
+--
+2.25.1
+
--- /dev/null
+From e63ed6db099beb05cbf4657097dc7b0177933b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 13:52:15 +0200
+Subject: netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 2404b73c3f1a5f15726c6ecd226b56f6f992767f ]
+
+nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core.
+
+The current use of the netfilter ipv6 stub indirections causes a module
+dependency between ipv6 and nf_defrag_ipv6.
+
+This prevents nf_defrag_ipv6 module from being removed because ipv6 can't
+be unloaded.
+
+Remove the indirection and always use a direct call. This creates a
+depency from nf_conntrack_bridge to nf_defrag_ipv6 instead:
+
+modinfo nf_conntrack
+depends: nf_conntrack,nf_defrag_ipv6,bridge
+
+.. and nf_conntrack already depends on nf_defrag_ipv6 anyway.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter_ipv6.h | 18 ------------------
+ net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++++++--
+ net/ipv6/netfilter.c | 3 ---
+ 3 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
+index aac42c28fe62d..9b67394471e1c 100644
+--- a/include/linux/netfilter_ipv6.h
++++ b/include/linux/netfilter_ipv6.h
+@@ -58,7 +58,6 @@ struct nf_ipv6_ops {
+ int (*output)(struct net *, struct sock *, struct sk_buff *));
+ int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry);
+ #if IS_MODULE(CONFIG_IPV6)
+- int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user);
+ int (*br_fragment)(struct net *net, struct sock *sk,
+ struct sk_buff *skb,
+ struct nf_bridge_frag_data *data,
+@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst,
+
+ #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+
+-static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb,
+- u32 user)
+-{
+-#if IS_MODULE(CONFIG_IPV6)
+- const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops();
+-
+- if (!v6_ops)
+- return 1;
+-
+- return v6_ops->br_defrag(net, skb, user);
+-#elif IS_BUILTIN(CONFIG_IPV6)
+- return nf_ct_frag6_gather(net, skb, user);
+-#else
+- return 1;
+-#endif
+-}
+-
+ int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ struct nf_bridge_frag_data *data,
+ int (*output)(struct net *, struct sock *sk,
+diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
+index 8096732223828..8d033a75a766e 100644
+--- a/net/bridge/netfilter/nf_conntrack_bridge.c
++++ b/net/bridge/netfilter/nf_conntrack_bridge.c
+@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb,
+ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,
+ const struct nf_hook_state *state)
+ {
++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ u16 zone_id = NF_CT_DEFAULT_ZONE_ID;
+ enum ip_conntrack_info ctinfo;
+ struct br_input_skb_cb cb;
+@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb,
+
+ br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm));
+
+- err = nf_ipv6_br_defrag(state->net, skb,
+- IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
++ err = nf_ct_frag6_gather(state->net, skb,
++ IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id);
+ /* queued */
+ if (err == -EINPROGRESS)
+ return NF_STOLEN;
+
+ br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size);
+ return err == 0 ? NF_ACCEPT : NF_DROP;
++#else
++ return NF_ACCEPT;
++#endif
+ }
+
+ static int nf_ct_br_ip_check(const struct sk_buff *skb)
+diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
+index 409e79b84a830..6d0e942d082d4 100644
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = {
+ .route_input = ip6_route_input,
+ .fragment = ip6_fragment,
+ .reroute = nf_ip6_reroute,
+-#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+- .br_defrag = nf_ct_frag6_gather,
+-#endif
+ #if IS_MODULE(CONFIG_IPV6)
+ .br_fragment = br_ip6_fragment,
+ #endif
+--
+2.25.1
+
--- /dev/null
+From 27f8337369e4d96a71822758554e435510740c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 04:34:42 -0400
+Subject: null_blk: fix passing of REQ_FUA flag in null_handle_rq
+
+From: Hou Pu <houpu@bytedance.com>
+
+[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ]
+
+REQ_FUA should be checked using rq->cmd_flags instead of req_op().
+
+Fixes: deb78b419dfda ("nullb: emulate cache")
+Signed-off-by: Hou Pu <houpu@bytedance.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c
+index c4454cfc6d530..13eae973eaea4 100644
+--- a/drivers/block/null_blk_main.c
++++ b/drivers/block/null_blk_main.c
+@@ -1072,7 +1072,7 @@ static int null_handle_rq(struct nullb_cmd *cmd)
+ len = bvec.bv_len;
+ err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset,
+ op_is_write(req_op(rq)), sector,
+- req_op(rq) & REQ_FUA);
++ rq->cmd_flags & REQ_FUA);
+ if (err) {
+ spin_unlock_irq(&nullb->lock);
+ return err;
+--
+2.25.1
+
--- /dev/null
+From 4d6213db109a60825dcd712626f391cdf7db5e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Aug 2020 19:15:45 +0800
+Subject: nvme-fc: Fix wrong return value in __nvme_fc_init_request()
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ]
+
+On an error exit path, a negative error code should be returned
+instead of a positive return value.
+
+Fixes: e399441de9115 ("nvme-fabrics: Add host support for FC transport")
+Cc: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 83ac88924f253..dce4d6782ceb1 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1740,7 +1740,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
+ if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) {
+ dev_err(ctrl->dev,
+ "FCP Op failed - cmdiu dma mapping failed.\n");
+- ret = EFAULT;
++ ret = -EFAULT;
+ goto out_on_error;
+ }
+
+@@ -1750,7 +1750,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl,
+ if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) {
+ dev_err(ctrl->dev,
+ "FCP Op failed - rspiu dma mapping failed.\n");
+- ret = EFAULT;
++ ret = -EFAULT;
+ }
+
+ atomic_set(&op->state, FCPOP_STATE_IDLE);
+--
+2.25.1
+
--- /dev/null
+From f1b0114504b2ad8e5261a7ddbee1f0a61caf2a91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 15:19:31 +0200
+Subject: nvme: multipath: round-robin: fix single non-optimized path case
+
+From: Martin Wilck <mwilck@suse.com>
+
+[ Upstream commit 93eb0381e13d249a18ed4aae203291ff977e7ffb ]
+
+If there's only one usable, non-optimized path, nvme_round_robin_path()
+returns NULL, which is wrong. Fix it by falling back to "old", like in
+the single optimized path case. Also, if the active path isn't changed,
+there's no need to re-assign the pointer.
+
+Fixes: 3f6e3246db0e ("nvme-multipath: fix logic for non-optimized paths")
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Martin George <marting@netapp.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 484aad0d0c9c6..0a458f7880887 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -249,12 +249,17 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head,
+ fallback = ns;
+ }
+
+- /* No optimized path found, re-check the current path */
++ /*
++ * The loop above skips the current path for round-robin semantics.
++ * Fall back to the current path if either:
++ * - no other optimized path found and current is optimized,
++ * - no other usable path found and current is usable.
++ */
+ if (!nvme_path_is_disabled(old) &&
+- old->ana_state == NVME_ANA_OPTIMIZED) {
+- found = old;
+- goto out;
+- }
++ (old->ana_state == NVME_ANA_OPTIMIZED ||
++ (!fallback && old->ana_state == NVME_ANA_NONOPTIMIZED)))
++ return old;
++
+ if (!fallback)
+ return NULL;
+ found = fallback;
+--
+2.25.1
+
--- /dev/null
+From a308ee733ff55238c850eb4877af2781b53f0d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 08:46:32 -0400
+Subject: powerpc/perf: Fix soft lockups due to missed interrupt accounting
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ]
+
+Performance monitor interrupt handler checks if any counter has
+overflown and calls record_and_restart() in core-book3s which invokes
+perf_event_overflow() to record the sample information. Apart from
+creating sample, perf_event_overflow() also does the interrupt and
+period checks via perf_event_account_interrupt().
+
+Currently we record information only if the SIAR (Sampled Instruction
+Address Register) valid bit is set (using siar_valid() check) and
+hence the interrupt check.
+
+But it is possible that we do sampling for some events that are not
+generating valid SIAR, and hence there is no chance to disable the
+event if interrupts are more than max_samples_per_tick. This leads to
+soft lockup.
+
+Fix this by adding perf_event_account_interrupt() in the invalid SIAR
+code path for a sampling event. ie if SIAR is invalid, just do
+interrupt check and don't record the sample information.
+
+Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/core-book3s.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index ca92e01d0bd1b..e32f7700303bc 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2106,6 +2106,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+
+ if (perf_event_overflow(event, &data, regs))
+ power_pmu_stop(event, 0);
++ } else if (period) {
++ /* Account for interrupt in case of invalid SIAR */
++ if (perf_event_account_interrupt(event))
++ power_pmu_stop(event, 0);
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 636affdbbdc2db2c636c0d30da276d81f191bd2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 04:10:13 -0700
+Subject: Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command"
+
+From: Saurav Kashyap <skashyap@marvell.com>
+
+[ Upstream commit de7e6194301ad31c4ce95395eb678e51a1b907e5 ]
+
+FCoE adapter initialization failed for ISP8021 with the following patch
+applied. In addition, reproduction of the issue the patch originally tried
+to address has been unsuccessful.
+
+This reverts commit 3cb182b3fa8b7a61f05c671525494697cba39c6a.
+
+Link: https://lore.kernel.org/r/20200806111014.28434-11-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 62a16463f0254..c1631e42d35d1 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -335,14 +335,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
+ if (time_after(jiffies, wait_time))
+ break;
+
+- /*
+- * Check if it's UNLOADING, cause we cannot poll in
+- * this case, or else a NULL pointer dereference
+- * is triggered.
+- */
+- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags)))
+- return QLA_FUNCTION_TIMEOUT;
+-
+ /* Check for pending interrupts. */
+ qla2x00_poll(ha->rsp_q_map[0]);
+
+--
+2.25.1
+
--- /dev/null
+From 79fd64050b6c52be12e3b948e0452c91e894b159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 16:42:45 +0200
+Subject: s390/cio: add cond_resched() in the slow_eval_known_fn() loop
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ]
+
+The scanning through subchannels during the time of an event could
+take significant amount of time in case of platforms with lots of
+known subchannels. This might result in higher scheduling latencies
+for other tasks especially on systems with a single CPU. Add
+cond_resched() call, as the loop in slow_eval_known_fn() can be
+executed for a longer duration.
+
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/css.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index 831850435c23b..5734a78dbb8e6 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -677,6 +677,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
+ rc = css_evaluate_known_subchannel(sch, 1);
+ if (rc == -EAGAIN)
+ css_schedule_eval(sch->schid);
++ /*
++ * The loop might take long time for platforms with lots of
++ * known devices. Allow scheduling here.
++ */
++ cond_resched();
+ }
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From be885e70b13adf94386ff67a99a654ae64605899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 15:23:33 -0500
+Subject: scsi: fcoe: Fix I/O path allocation
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit fa39ab5184d64563cd36f2fb5f0d3fbad83a432c ]
+
+ixgbe_fcoe_ddp_setup() can be called from the main I/O path and is called
+with a spin_lock held, so we have to use GFP_ATOMIC allocation instead of
+GFP_KERNEL.
+
+Link: https://lore.kernel.org/r/1596831813-9839-1-git-send-email-michael.christie@oracle.com
+cc: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+index ccd852ad62a4b..d50c5b55da180 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid,
+ }
+
+ /* alloc the udl from per cpu ddp pool */
+- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp);
++ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp);
+ if (!ddp->udl) {
+ e_err(drv, "failed allocated ddp context\n");
+ goto out_noddp_unmap;
+--
+2.25.1
+
--- /dev/null
+From 2ac17c1845f0b39b9bbfcad084e07484698b5939 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 04:10:11 -0700
+Subject: scsi: qla2xxx: Check if FW supports MQ before enabling
+
+From: Saurav Kashyap <skashyap@marvell.com>
+
+[ Upstream commit dffa11453313a115157b19021cc2e27ea98e624c ]
+
+OS boot during Boot from SAN was stuck at dracut emergency shell after
+enabling NVMe driver parameter. For non-MQ support the driver was enabling
+MQ. Add a check to confirm if FW supports MQ.
+
+Link: https://lore.kernel.org/r/20200806111014.28434-9-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index d91c95d9981ac..67b1e74fcd1e6 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1993,6 +1993,11 @@ skip_pio:
+ /* Determine queue resources */
+ ha->max_req_queues = ha->max_rsp_queues = 1;
+ ha->msix_count = QLA_BASE_VECTORS;
++
++ /* Check if FW supports MQ or not */
++ if (!(ha->fw_attributes & BIT_6))
++ goto mqiobase_exit;
++
+ if (!ql2xmqsupport || !ql2xnvmeenable ||
+ (!IS_QLA25XX(ha) && !IS_QLA81XX(ha)))
+ goto mqiobase_exit;
+--
+2.25.1
+
--- /dev/null
+From 5373f3b232ae7c6bad9443562a0cd2d61515c172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 04:10:07 -0700
+Subject: scsi: qla2xxx: Fix login timeout
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit abb31aeaa9b20680b0620b23fea5475ea4591e31 ]
+
+Multipath errors were seen during failback due to login timeout. The
+remote device sent LOGO, the local host tore down the session and did
+relogin. The RSCN arrived indicates remote device is going through failover
+after which the relogin is in a 20s timeout phase. At this point the
+driver is stuck in the relogin process. Add a fix to delete the session as
+part of abort/flush the login.
+
+Link: https://lore.kernel.org/r/20200806111014.28434-5-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_gs.c | 18 +++++++++++++++---
+ drivers/scsi/qla2xxx/qla_target.c | 2 +-
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index a44de4c5dcf6c..fc6e12fb7d77b 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -3673,10 +3673,22 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp)
+ }
+
+ if (fcport->scan_state != QLA_FCPORT_FOUND) {
++ bool do_delete = false;
++
++ if (fcport->scan_needed &&
++ fcport->disc_state == DSC_LOGIN_PEND) {
++ /* Cable got disconnected after we sent
++ * a login. Do delete to prevent timeout.
++ */
++ fcport->logout_on_delete = 1;
++ do_delete = true;
++ }
++
+ fcport->scan_needed = 0;
+- if ((qla_dual_mode_enabled(vha) ||
+- qla_ini_mode_enabled(vha)) &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
++ if (((qla_dual_mode_enabled(vha) ||
++ qla_ini_mode_enabled(vha)) &&
++ atomic_read(&fcport->state) == FCS_ONLINE) ||
++ do_delete) {
+ if (fcport->loop_id != FC_NO_LOOP_ID) {
+ if (fcport->flags & FCF_FCP2_DEVICE)
+ fcport->logout_on_delete = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index cb8a892e2d393..b75e6e4d58c06 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1262,7 +1262,7 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+
+ qla24xx_chk_fcp_state(sess);
+
+- ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
++ ql_dbg(ql_dbg_disc, sess->vha, 0xe001,
+ "Scheduling sess %p for deletion %8phC\n",
+ sess, sess->port_name);
+
+--
+2.25.1
+
--- /dev/null
+From 52031a76edc629e18822420428f4bd50f68dcd2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 04:10:12 -0700
+Subject: scsi: qla2xxx: Fix null pointer access during disconnect from
+ subsystem
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 83949613fac61e8e37eadf8275bf072342302f4e ]
+
+NVMEAsync command is being submitted to QLA while the same NVMe controller
+is in the middle of reset. The reset path has deleted the association and
+freed aen_op->fcp_req.private. Add a check for this private pointer before
+issuing the command.
+
+...
+ 6 [ffffb656ca11fce0] page_fault at ffffffff8c00114e
+ [exception RIP: qla_nvme_post_cmd+394]
+ RIP: ffffffffc0d012ba RSP: ffffb656ca11fd98 RFLAGS: 00010206
+ RAX: ffff8fb039eda228 RBX: ffff8fb039eda200 RCX: 00000000000da161
+ RDX: ffffffffc0d4d0f0 RSI: ffffffffc0d26c9b RDI: ffff8fb039eda220
+ RBP: 0000000000000013 R8: ffff8fb47ff6aa80 R9: 0000000000000002
+ R10: 0000000000000000 R11: ffffb656ca11fdc8 R12: ffff8fb27d04a3b0
+ R13: ffff8fc46dd98a58 R14: 0000000000000000 R15: ffff8fc4540f0000
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+ 7 [ffffb656ca11fe08] nvme_fc_start_fcp_op at ffffffffc0241568 [nvme_fc]
+ 8 [ffffb656ca11fe50] nvme_fc_submit_async_event at ffffffffc0241901 [nvme_fc]
+ 9 [ffffb656ca11fe68] nvme_async_event_work at ffffffffc014543d [nvme_core]
+10 [ffffb656ca11fe98] process_one_work at ffffffff8b6cd437
+11 [ffffb656ca11fed8] worker_thread at ffffffff8b6cdcef
+12 [ffffb656ca11ff10] kthread at ffffffff8b6d3402
+13 [ffffb656ca11ff50] ret_from_fork at ffffffff8c000255
+
+--
+PID: 37824 TASK: ffff8fb033063d80 CPU: 20 COMMAND: "kworker/u97:451"
+ 0 [ffffb656ce1abc28] __schedule at ffffffff8be629e3
+ 1 [ffffb656ce1abcc8] schedule at ffffffff8be62fe8
+ 2 [ffffb656ce1abcd0] schedule_timeout at ffffffff8be671ed
+ 3 [ffffb656ce1abd70] wait_for_completion at ffffffff8be639cf
+ 4 [ffffb656ce1abdd0] flush_work at ffffffff8b6ce2d5
+ 5 [ffffb656ce1abe70] nvme_stop_ctrl at ffffffffc0144900 [nvme_core]
+ 6 [ffffb656ce1abe80] nvme_fc_reset_ctrl_work at ffffffffc0243445 [nvme_fc]
+ 7 [ffffb656ce1abe98] process_one_work at ffffffff8b6cd437
+ 8 [ffffb656ce1abed8] worker_thread at ffffffff8b6cdb50
+ 9 [ffffb656ce1abf10] kthread at ffffffff8b6d3402
+10 [ffffb656ce1abf50] ret_from_fork at ffffffff8c000255
+
+Link: https://lore.kernel.org/r/20200806111014.28434-10-njavali@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 941aa53363f56..f4815a4084d8c 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -535,6 +535,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ struct nvme_private *priv = fd->private;
+ struct qla_nvme_rport *qla_rport = rport->private;
+
++ if (!priv) {
++ /* nvme association has been torn down */
++ return rval;
++ }
++
+ fcport = qla_rport->fcport;
+
+ if (!qpair || !fcport || (qpair && !qpair->fw_started) ||
+--
+2.25.1
+
--- /dev/null
+From 0532aa3e39261efa809b6e2380359d90d2cf14b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 16:18:58 +0200
+Subject: scsi: ufs: Clean up completed request without interrupt notification
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ]
+
+If somehow no interrupt notification is raised for a completed request and
+its doorbell bit is cleared by host, UFS driver needs to cleanup its
+outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally
+in the following scenario:
+
+After ufshcd_abort() returns, this request will be requeued by SCSI layer
+with its outstanding bit set. Any future completed request will trigger
+ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At
+this time the "abnormal outstanding bit" will be detected and the "requeued
+request" will be chosen to execute request post-processing flow. This is
+wrong because this request is still "alive".
+
+Link: https://lore.kernel.org/r/20200811141859.27399-2-huobean@gmail.com
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Acked-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b51ccbf6cc59c..5e502e1605549 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6140,7 +6140,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ /* command completed already */
+ dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n",
+ __func__, tag);
+- goto out;
++ goto cleanup;
+ } else {
+ dev_err(hba->dev,
+ "%s: no response from device. tag = %d, err %d\n",
+@@ -6174,6 +6174,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd)
+ goto out;
+ }
+
++cleanup:
+ scsi_dma_unmap(cmd);
+
+ spin_lock_irqsave(host->host_lock, flags);
+--
+2.25.1
+
--- /dev/null
+From 9978fc355540f636911686d50540025dc3fc3f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Aug 2020 13:07:34 +0800
+Subject: scsi: ufs: Fix possible infinite loop in ufshcd_hold
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ]
+
+In ufshcd_suspend(), after clk-gating is suspended and link is set
+as Hibern8 state, ufshcd_hold() is still possibly invoked before
+ufshcd_suspend() returns. For example, MediaTek's suspend vops may
+issue UIC commands which would call ufshcd_hold() during the command
+issuing flow.
+
+Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled,
+then ufshcd_hold() may enter infinite loops because there is no
+clk-ungating work scheduled or pending. In this case, ufshcd_hold()
+shall just bypass, and keep the link as Hibern8 state.
+
+Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Co-developed-by: Andy Teng <andy.teng@mediatek.com>
+Signed-off-by: Andy Teng <andy.teng@mediatek.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b41b88bcab3d9..336cf72397e50 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1516,6 +1516,7 @@ unblock_reqs:
+ int ufshcd_hold(struct ufs_hba *hba, bool async)
+ {
+ int rc = 0;
++ bool flush_result;
+ unsigned long flags;
+
+ if (!ufshcd_is_clkgating_allowed(hba))
+@@ -1547,7 +1548,9 @@ start:
+ break;
+ }
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+- flush_work(&hba->clk_gating.ungate_work);
++ flush_result = flush_work(&hba->clk_gating.ungate_work);
++ if (hba->clk_gating.is_suspended && !flush_result)
++ goto out;
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ goto start;
+ }
+--
+2.25.1
+
--- /dev/null
+From 1d8d095418e34a6f526e3adb5d86c1c11f0b7ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 16:39:36 +0300
+Subject: scsi: ufs: Improve interrupt handling for shared interrupts
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ]
+
+For shared interrupts, the interrupt status might be zero, so check that
+first.
+
+Link: https://lore.kernel.org/r/20200811133936.19171-2-adrian.hunter@intel.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 336cf72397e50..b51ccbf6cc59c 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5612,7 +5612,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status)
+ */
+ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ {
+- u32 intr_status, enabled_intr_status;
++ u32 intr_status, enabled_intr_status = 0;
+ irqreturn_t retval = IRQ_NONE;
+ struct ufs_hba *hba = __hba;
+ int retries = hba->nutrs;
+@@ -5626,7 +5626,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ * read, make sure we handle them by checking the interrupt status
+ * again in a loop until we process all of the reqs before returning.
+ */
+- do {
++ while (intr_status && retries--) {
+ enabled_intr_status =
+ intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
+ if (intr_status)
+@@ -5637,7 +5637,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba)
+ }
+
+ intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS);
+- } while (intr_status && --retries);
++ }
+
+ spin_unlock(hba->host->host_lock);
+ return retval;
+--
+2.25.1
+
--- /dev/null
+From e03ef519fa277c5551ad5508ef078177ab93e5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Aug 2020 09:43:33 -0600
+Subject: selftests: disable rp_filter for icmp_redirect.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit bcf7ddb0186d366f761f86196b480ea6dd2dc18c ]
+
+h1 is initially configured to reach h2 via r1 rather than the
+more direct path through r2. If rp_filter is set and inherited
+for r2, forwarding fails since the source address of h1 is
+reachable from eth0 vs the packet coming to it via r1 and eth1.
+Since rp_filter setting affects the test, explicitly reset it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/icmp_redirect.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/icmp_redirect.sh b/tools/testing/selftests/net/icmp_redirect.sh
+index 18c5de53558af..bf361f30d6ef9 100755
+--- a/tools/testing/selftests/net/icmp_redirect.sh
++++ b/tools/testing/selftests/net/icmp_redirect.sh
+@@ -180,6 +180,8 @@ setup()
+ ;;
+ r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1
+ ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1
++ ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0
++ ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0
+
+ ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1
+ ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10
+--
+2.25.1
+
pci-qcom-add-missing-reset-for-ipq806x.patch
cpufreq-intel_pstate-fix-epp-setting-via-sysfs-in-ac.patch
alsa-usb-audio-add-capture-support-for-saffire-6-usb.patch
+media-gpio-ir-tx-improve-precision-of-transmitted-si.patch
+block-respect-queue-limit-of-max-discard-segment.patch
+block-virtio_blk-fix-handling-single-range-discard-r.patch
+drm-msm-adreno-fix-updating-ring-fence.patch
+block-fix-page_is_mergeable-for-compound-pages.patch
+bfq-fix-blkio-cgroup-leakage-v4.patch
+hwmon-nct7904-correct-divide-by-0.patch
+blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch
+blkcg-fix-memleak-for-iolatency.patch
+nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch
+nvme-multipath-round-robin-fix-single-non-optimized-.patch
+null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch
+i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch
+i2c-rcar-in-slave-mode-clear-nack-earlier.patch
+usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch
+spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch
+jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch
+ext4-don-t-bug-on-inconsistent-journal-feature.patch
+ext4-handle-read-only-external-journal-device.patch
+jbd2-abort-journal-if-free-a-async-write-error-metad.patch
+ext4-handle-option-set-by-mount-flags-correctly.patch
+ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch
+ext4-correctly-restore-system-zone-info-when-remount.patch
+fs-prevent-bug_on-in-submit_bh_wbc.patch
+spi-stm32h7-fix-race-condition-at-end-of-transfer.patch
+spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch
+spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch
+spi-stm32-always-perform-registers-configuration-pri.patch
+drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch
+drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch
+drm-amd-display-switch-to-immediate-mode-for-updatin.patch
+libbpf-handle-gcc-built-in-types-for-arm-neon.patch
+netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch
+can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch
+alsa-hda-realtek-add-model-alc298-samsung-headphone.patch
+s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch
+asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch
+selftests-disable-rp_filter-for-icmp_redirect.sh.patch
+scsi-fcoe-fix-i-o-path-allocation.patch
+scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch
+scsi-ufs-improve-interrupt-handling-for-shared-inter.patch
+scsi-ufs-clean-up-completed-request-without-interrup.patch
+scsi-qla2xxx-fix-login-timeout.patch
+scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch
+scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch
+revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch
+macvlan-validate-setting-of-multiple-remote-source-m.patch
+net-gianfar-add-of_node_put-before-goto-statement.patch
+powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch
+arm64-move-handling-of-erratum-1418040-into-c-code.patch
+arm64-allow-booting-of-late-cpus-affected-by-erratum.patch
--- /dev/null
+From 8eac8487e921acd2ffd89697921b2d2ba1720b46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 09:12:38 +0200
+Subject: spi: stm32: always perform registers configuration prior to transfer
+
+From: Alain Volmat <alain.volmat@st.com>
+
+[ Upstream commit 60ccb3515fc61a0124c70aa37317f75b67560024 ]
+
+SPI registers content may have been lost upon suspend/resume sequence.
+So, always compute and apply the necessary configuration in
+stm32_spi_transfer_one_setup routine.
+
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/1597043558-29668-6-git-send-email-alain.volmat@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 42 +++++++++++++++++------------------------
+ 1 file changed, 17 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 50ef03a8252d7..8146c2d91d307 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1590,41 +1590,33 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi,
+ unsigned long flags;
+ unsigned int comm_type;
+ int nb_words, ret = 0;
++ int mbr;
+
+ spin_lock_irqsave(&spi->lock, flags);
+
+ spi->cur_xferlen = transfer->len;
+
+- if (spi->cur_bpw != transfer->bits_per_word) {
+- spi->cur_bpw = transfer->bits_per_word;
+- spi->cfg->set_bpw(spi);
+- }
+-
+- if (spi->cur_speed != transfer->speed_hz) {
+- int mbr;
+-
+- /* Update spi->cur_speed with real clock speed */
+- mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz,
+- spi->cfg->baud_rate_div_min,
+- spi->cfg->baud_rate_div_max);
+- if (mbr < 0) {
+- ret = mbr;
+- goto out;
+- }
++ spi->cur_bpw = transfer->bits_per_word;
++ spi->cfg->set_bpw(spi);
+
+- transfer->speed_hz = spi->cur_speed;
+- stm32_spi_set_mbr(spi, mbr);
++ /* Update spi->cur_speed with real clock speed */
++ mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz,
++ spi->cfg->baud_rate_div_min,
++ spi->cfg->baud_rate_div_max);
++ if (mbr < 0) {
++ ret = mbr;
++ goto out;
+ }
+
+- comm_type = stm32_spi_communication_type(spi_dev, transfer);
+- if (spi->cur_comm != comm_type) {
+- ret = spi->cfg->set_mode(spi, comm_type);
++ transfer->speed_hz = spi->cur_speed;
++ stm32_spi_set_mbr(spi, mbr);
+
+- if (ret < 0)
+- goto out;
++ comm_type = stm32_spi_communication_type(spi_dev, transfer);
++ ret = spi->cfg->set_mode(spi, comm_type);
++ if (ret < 0)
++ goto out;
+
+- spi->cur_comm = comm_type;
+- }
++ spi->cur_comm = comm_type;
+
+ if (spi->cfg->set_data_idleness)
+ spi->cfg->set_data_idleness(spi, transfer->len);
+--
+2.25.1
+
--- /dev/null
+From ca82cd450990aa1d08573d66ee211dd1ce7f9bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 21:51:36 +0200
+Subject: spi: stm32: clear only asserted irq flags on interrupt
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ]
+
+Previously the stm32h7 interrupt thread cleared all non-masked interrupts.
+If an interrupt was to occur during the handling of another interrupt its
+flag would be unset, resulting in a lost interrupt.
+This patches fixes the issue by clearing only the currently set interrupt
+flags.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 7e92ab0cc9920..dc6334f67e6ae 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -962,7 +962,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+ stm32h7_spi_read_rxfifo(spi, false);
+
+- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR);
++ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR);
+
+ spin_unlock_irqrestore(&spi->lock, flags);
+
+--
+2.25.1
+
--- /dev/null
+From 494bb35e1a91d0f1032e9ba649107a419592ffa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 09:12:35 +0200
+Subject: spi: stm32: fix fifo threshold level in case of short transfer
+
+From: Amelie Delaunay <amelie.delaunay@st.com>
+
+[ Upstream commit 3373e9004acc0603242622b4378c64bc01d21b5f ]
+
+When transfer is shorter than half of the fifo, set the data packet size
+up to transfer size instead of up to half of the fifo.
+Check also that threshold is set at least to 1 data frame.
+
+Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/1597043558-29668-3-git-send-email-alain.volmat@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 25b1348aaa549..f092bc8e00819 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -469,20 +469,27 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,
+ /**
+ * stm32h7_spi_prepare_fthlv - Determine FIFO threshold level
+ * @spi: pointer to the spi controller data structure
++ * @xfer_len: length of the message to be transferred
+ */
+-static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi)
++static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi, u32 xfer_len)
+ {
+- u32 fthlv, half_fifo;
++ u32 fthlv, half_fifo, packet;
+
+ /* data packet should not exceed 1/2 of fifo space */
+ half_fifo = (spi->fifo_size / 2);
+
++ /* data_packet should not exceed transfer length */
++ if (half_fifo > xfer_len)
++ packet = xfer_len;
++ else
++ packet = half_fifo;
++
+ if (spi->cur_bpw <= 8)
+- fthlv = half_fifo;
++ fthlv = packet;
+ else if (spi->cur_bpw <= 16)
+- fthlv = half_fifo / 2;
++ fthlv = packet / 2;
+ else
+- fthlv = half_fifo / 4;
++ fthlv = packet / 4;
+
+ /* align packet size with data registers access */
+ if (spi->cur_bpw > 8)
+@@ -490,6 +497,9 @@ static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi)
+ else
+ fthlv -= (fthlv % 4); /* multiple of 4 */
+
++ if (!fthlv)
++ fthlv = 1;
++
+ return fthlv;
+ }
+
+@@ -1396,7 +1406,7 @@ static void stm32h7_spi_set_bpw(struct stm32_spi *spi)
+ cfg1_setb |= (bpw << STM32H7_SPI_CFG1_DSIZE_SHIFT) &
+ STM32H7_SPI_CFG1_DSIZE;
+
+- spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi);
++ spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi, spi->cur_xferlen);
+ fthlv = spi->cur_fthlv - 1;
+
+ cfg1_clrb |= STM32H7_SPI_CFG1_FTHLV;
+@@ -1582,6 +1592,8 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi,
+
+ spin_lock_irqsave(&spi->lock, flags);
+
++ spi->cur_xferlen = transfer->len;
++
+ if (spi->cur_bpw != transfer->bits_per_word) {
+ spi->cur_bpw = transfer->bits_per_word;
+ spi->cfg->set_bpw(spi);
+@@ -1629,8 +1641,6 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi,
+ goto out;
+ }
+
+- spi->cur_xferlen = transfer->len;
+-
+ dev_dbg(spi->dev, "transfer communication mode set to %d\n",
+ spi->cur_comm);
+ dev_dbg(spi->dev,
+--
+2.25.1
+
--- /dev/null
+From 6d85acd00024f8cc063e781236ea5b1fa51aa6fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 09:12:36 +0200
+Subject: spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate
+
+From: Amelie Delaunay <amelie.delaunay@st.com>
+
+[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ]
+
+Fix spi->clk_rate when it is odd to the nearest lowest even value because
+minimum SPI divider is 2.
+
+Signed-off-by: Amelie Delaunay <amelie.delaunay@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index f092bc8e00819..50ef03a8252d7 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -443,7 +443,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,
+ {
+ u32 div, mbrdiv;
+
+- div = DIV_ROUND_UP(spi->clk_rate, speed_hz);
++ /* Ensure spi->clk_rate is even */
++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz);
+
+ /*
+ * SPI framework set xfer->speed_hz to master->max_speed_hz if
+--
+2.25.1
+
--- /dev/null
+From 573c677837692430152cf10f5c02a73313c01c3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 09:12:34 +0200
+Subject: spi: stm32h7: fix race condition at end of transfer
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 135dd873d3c76d812ae64c668adef3f2c59ed27f ]
+
+The caller of stm32_spi_transfer_one(), spi_transfer_one_message(),
+is waiting for us to call spi_finalize_current_transfer() and will
+eventually schedule a new transfer, if available.
+We should guarantee that the spi controller is really available
+before calling spi_finalize_current_transfer().
+
+Move the call to spi_finalize_current_transfer() _after_ the call
+to stm32_spi_disable().
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/1597043558-29668-2-git-send-email-alain.volmat@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index dc6334f67e6ae..25b1348aaa549 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -967,8 +967,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ spin_unlock_irqrestore(&spi->lock, flags);
+
+ if (end) {
+- spi_finalize_current_transfer(master);
+ stm32h7_spi_disable(spi);
++ spi_finalize_current_transfer(master);
+ }
+
+ return IRQ_HANDLED;
+--
+2.25.1
+
--- /dev/null
+From 53bfd328d0c19122b58dfdb43d72b1c6dfba2496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:55:01 +0200
+Subject: usb: gadget: f_tcm: Fix some resource leaks in some error paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ]
+
+If a memory allocation fails within a 'usb_ep_alloc_request()' call, the
+already allocated memory must be released.
+
+Fix a mix-up in the code and free the correct requests.
+
+Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_tcm.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
+index 7f01f78b1d238..f6d203fec4955 100644
+--- a/drivers/usb/gadget/function/f_tcm.c
++++ b/drivers/usb/gadget/function/f_tcm.c
+@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream)
+ goto err_sts;
+
+ return 0;
++
+ err_sts:
+- usb_ep_free_request(fu->ep_status, stream->req_status);
+- stream->req_status = NULL;
+-err_out:
+ usb_ep_free_request(fu->ep_out, stream->req_out);
+ stream->req_out = NULL;
++err_out:
++ usb_ep_free_request(fu->ep_in, stream->req_in);
++ stream->req_in = NULL;
+ out:
+ return -ENOMEM;
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
