--- /dev/null
+From e4bada00ce729b1b78f77669e9a897dd41d248f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 17:15:35 +0100
+Subject: arm64: initialize all of CNTHCTL_EL2
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit bde8fff82e4a4b0f000dbf4d5eadab2079be0b56 ]
+
+In __init_el2_timers we initialize CNTHCTL_EL2.{EL1PCEN,EL1PCTEN} with a
+RMW sequence, leaving all other bits UNKNOWN.
+
+In general, we should initialize all bits in a register rather than
+using an RMW sequence, since most bits are UNKNOWN out of reset, and as
+new bits are added to the reigster their reset value might not result in
+expected behaviour.
+
+In the case of CNTHCTL_EL2, FEAT_ECV added a number of new control bits
+in previously RES0 bits, which reset to UNKNOWN values, and may cause
+issues for EL1 and EL0:
+
+* CNTHCTL_EL2.ECV enables the CNTPOFF_EL2 offset (which itself resets to
+ an UNKNOWN value) at EL0 and EL1. Since the offset could reset to
+ distinct values across CPUs, when the control bit resets to 1 this
+ could break timekeeping generally.
+
+* CNTHCTL_EL2.{EL1TVT,EL1TVCT} trap EL0 and EL1 accesses to the EL1
+ virtual timer/counter registers to EL2. When reset to 1, this could
+ cause unexpected traps to EL2.
+
+Initializing these bits to zero avoids these problems, and all other
+bits in CNTHCTL_EL2 other than EL1PCEN and EL1PCTEN can safely be reset
+to zero.
+
+This patch ensures we initialize CNTHCTL_EL2 accordingly, only setting
+EL1PCEN and EL1PCTEN, and setting all other bits to zero.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Oliver Upton <oupton@google.com>
+Cc: Will Deacon <will@kernel.org>
+Reviewed-by: Oliver Upton <oupton@google.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210818161535.52786-1-mark.rutland@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/el2_setup.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/include/asm/el2_setup.h b/arch/arm64/include/asm/el2_setup.h
+index 21fa330f498d..b83fb24954b7 100644
+--- a/arch/arm64/include/asm/el2_setup.h
++++ b/arch/arm64/include/asm/el2_setup.h
+@@ -33,8 +33,7 @@
+ * EL2.
+ */
+ .macro __init_el2_timers
+- mrs x0, cnthctl_el2
+- orr x0, x0, #3 // Enable EL1 physical timers
++ mov x0, #3 // Enable EL1 physical timers
+ msr cnthctl_el2, x0
+ msr cntvoff_el2, xzr // Clear virtual offset
+ .endm
+--
+2.30.2
+
--- /dev/null
+From 64d0367d8fedaf8dcf43cc6748f9c14e016e668a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 23:52:02 +0800
+Subject: blk-mq: don't grab rq's refcount in blk_mq_check_expired()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit c797b40ccc340b8a66f7a7842aecc90bf749f087 ]
+
+Inside blk_mq_queue_tag_busy_iter() we already grabbed request's
+refcount before calling ->fn(), so needn't to grab it one more time
+in blk_mq_check_expired().
+
+Meantime remove extra request expire check in blk_mq_check_expired().
+
+Cc: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/20210811155202.629575-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 30 +++++-------------------------
+ 1 file changed, 5 insertions(+), 25 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index c732aa581124..6dfa572ac1fc 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -923,34 +923,14 @@ static bool blk_mq_check_expired(struct blk_mq_hw_ctx *hctx,
+ unsigned long *next = priv;
+
+ /*
+- * Just do a quick check if it is expired before locking the request in
+- * so we're not unnecessarilly synchronizing across CPUs.
+- */
+- if (!blk_mq_req_expired(rq, next))
+- return true;
+-
+- /*
+- * We have reason to believe the request may be expired. Take a
+- * reference on the request to lock this request lifetime into its
+- * currently allocated context to prevent it from being reallocated in
+- * the event the completion by-passes this timeout handler.
+- *
+- * If the reference was already released, then the driver beat the
+- * timeout handler to posting a natural completion.
+- */
+- if (!refcount_inc_not_zero(&rq->ref))
+- return true;
+-
+- /*
+- * The request is now locked and cannot be reallocated underneath the
+- * timeout handler's processing. Re-verify this exact request is truly
+- * expired; if it is not expired, then the request was completed and
+- * reallocated as a new request.
++ * blk_mq_queue_tag_busy_iter() has locked the request, so it cannot
++ * be reallocated underneath the timeout handler's processing, then
++ * the expire check is reliable. If the request is not expired, then
++ * it was completed and reallocated as a new request after returning
++ * from blk_mq_check_expired().
+ */
+ if (blk_mq_req_expired(rq, next))
+ blk_mq_rq_timed_out(rq, reserved);
+-
+- blk_mq_put_rq_ref(rq);
+ return true;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 5d1166be5e5035ba6306b374b04a82f89e212b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 16:34:20 -0400
+Subject: cpufreq: blocklist Qualcomm sm8150 in cpufreq-dt-platdev
+
+From: Thara Gopinath <thara.gopinath@linaro.org>
+
+[ Upstream commit 5d79e5ce5489b489cbc4c327305be9dfca0fc9ce ]
+
+The Qualcomm sm8150 platform uses the qcom-cpufreq-hw driver, so
+add it to the cpufreq-dt-platdev driver's blocklist.
+
+Signed-off-by: Thara Gopinath <thara.gopinath@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index 5e07065ec22f..1f8dc1164ba2 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -138,6 +138,7 @@ static const struct of_device_id blacklist[] __initconst = {
+ { .compatible = "qcom,qcs404", },
+ { .compatible = "qcom,sc7180", },
+ { .compatible = "qcom,sdm845", },
++ { .compatible = "qcom,sm8150", },
+
+ { .compatible = "st,stih407", },
+ { .compatible = "st,stih410", },
+--
+2.30.2
+
--- /dev/null
+From 2dd1eef3cc8f40f74334137f73a8d1bb95422e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 14:40:18 +0800
+Subject: drm/amd/pm: change the workload type for some cards
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+[ Upstream commit 93c5701b00d50d192ce2247cb10d6c0b3fe25cd8 ]
+
+change the workload type for some cards as it is needed.
+
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+index f5a32654cde7..cc6f19a48dea 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+@@ -5123,6 +5123,13 @@ static int vega10_get_power_profile_mode(struct pp_hwmgr *hwmgr, char *buf)
+ return size;
+ }
+
++static bool vega10_get_power_profile_mode_quirks(struct pp_hwmgr *hwmgr)
++{
++ struct amdgpu_device *adev = hwmgr->adev;
++
++ return (adev->pdev->device == 0x6860);
++}
++
+ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, uint32_t size)
+ {
+ struct vega10_hwmgr *data = hwmgr->backend;
+@@ -5159,9 +5166,15 @@ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui
+ }
+
+ out:
+- smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_SetWorkloadMask,
++ if (vega10_get_power_profile_mode_quirks(hwmgr))
++ smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_SetWorkloadMask,
+ 1 << power_profile_mode,
+ NULL);
++ else
++ smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_SetWorkloadMask,
++ (!power_profile_mode) ? 0 : 1 << (power_profile_mode - 1),
++ NULL);
++
+ hwmgr->power_profile_mode = power_profile_mode;
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 10b942aadd0746c1588fdcdb840e2f09c770d5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 15:49:17 -0400
+Subject: drm: Copy drm_wait_vblank to user before returning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Yacoub <markyacoub@google.com>
+
+[ Upstream commit fa0b1ef5f7a694f48e00804a391245f3471aa155 ]
+
+[Why]
+Userspace should get back a copy of drm_wait_vblank that's been modified
+even when drm_wait_vblank_ioctl returns a failure.
+
+Rationale:
+drm_wait_vblank_ioctl modifies the request and expects the user to read
+it back. When the type is RELATIVE, it modifies it to ABSOLUTE and updates
+the sequence to become current_vblank_count + sequence (which was
+RELATIVE), but now it became ABSOLUTE.
+drmWaitVBlank (in libdrm) expects this to be the case as it modifies
+the request to be Absolute so it expects the sequence to would have been
+updated.
+
+The change is in compat_drm_wait_vblank, which is called by
+drm_compat_ioctl. This change of copying the data back regardless of the
+return number makes it en par with drm_ioctl, which always copies the
+data before returning.
+
+[How]
+Return from the function after everything has been copied to user.
+
+Fixes IGT:kms_flip::modeset-vs-vblank-race-interruptible
+Tested on ChromeOS Trogdor(msm)
+
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+Signed-off-by: Mark Yacoub <markyacoub@chromium.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210812194917.1703356-1-markyacoub@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_ioc32.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
+index 33390f02f5eb..e41d3a69a02a 100644
+--- a/drivers/gpu/drm/drm_ioc32.c
++++ b/drivers/gpu/drm/drm_ioc32.c
+@@ -856,8 +856,6 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ req.request.sequence = req32.request.sequence;
+ req.request.signal = req32.request.signal;
+ err = drm_ioctl_kernel(file, drm_wait_vblank_ioctl, &req, DRM_UNLOCKED);
+- if (err)
+- return err;
+
+ req32.reply.type = req.reply.type;
+ req32.reply.sequence = req.reply.sequence;
+@@ -866,7 +864,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
+ if (copy_to_user(argp, &req32, sizeof(req32)))
+ return -EFAULT;
+
+- return 0;
++ return err;
+ }
+
+ #if defined(CONFIG_X86)
+--
+2.30.2
+
--- /dev/null
+From 5a42a487d32101c86a0ac5782b06adbf055689bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 16:40:48 +1000
+Subject: drm/nouveau/disp: power down unused DP links during init
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 6eaa1f3c59a707332e921e32782ffcad49915c5e ]
+
+When booted with multiple displays attached, the EFI GOP driver on (at
+least) Ampere, can leave DP links powered up that aren't being used to
+display anything. This confuses our tracking of SOR routing, with the
+likely result being a failed modeset and display engine hang.
+
+Fix this by (ab?)using the DisableLT IED script to power-down the link,
+restoring HW to a state the driver expects.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 2 +-
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h | 1 +
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c | 9 +++++++++
+ 3 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+index 55fbfe28c6dc..9669472a2749 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c
+@@ -440,7 +440,7 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps)
+ return ret;
+ }
+
+-static void
++void
+ nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior)
+ {
+ struct nvkm_dp *dp = nvkm_dp(outp);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
+index 428b3f488f03..e484d0c3b0d4 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h
+@@ -32,6 +32,7 @@ struct nvkm_dp {
+
+ int nvkm_dp_new(struct nvkm_disp *, int index, struct dcb_output *,
+ struct nvkm_outp **);
++void nvkm_dp_disable(struct nvkm_outp *, struct nvkm_ior *);
+
+ /* DPCD Receiver Capabilities */
+ #define DPCD_RC00_DPCD_REV 0x00000
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+index dffcac249211..129982fef7ef 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+@@ -22,6 +22,7 @@
+ * Authors: Ben Skeggs
+ */
+ #include "outp.h"
++#include "dp.h"
+ #include "ior.h"
+
+ #include <subdev/bios.h>
+@@ -257,6 +258,14 @@ nvkm_outp_init_route(struct nvkm_outp *outp)
+ if (!ior->arm.head || ior->arm.proto != proto) {
+ OUTP_DBG(outp, "no heads (%x %d %d)", ior->arm.head,
+ ior->arm.proto, proto);
++
++ /* The EFI GOP driver on Ampere can leave unused DP links routed,
++ * which we don't expect. The DisableLT IED script *should* get
++ * us back to where we need to be.
++ */
++ if (ior->func->route.get && !ior->arm.head && outp->info.type == DCB_OUTPUT_DP)
++ nvkm_dp_disable(outp, ior);
++
+ return;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 24f2f80e88da9fb4c6256b633fe887b89d6c5746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 19:29:57 +1000
+Subject: drm/nouveau/kms/nv50: workaround EFI GOP window channel format
+ differences
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit e78b1b545c6cfe9f87fc577128e00026fff230ba ]
+
+Should fix some initial modeset failures on (at least) Ampere boards.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/dispnv50/disp.c | 27 +++++++++++++++++++++++++
+ drivers/gpu/drm/nouveau/dispnv50/head.c | 13 ++++++++----
+ drivers/gpu/drm/nouveau/dispnv50/head.h | 1 +
+ 3 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 1c9c0cdf85db..578aaac2e277 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -2235,6 +2235,33 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
+ interlock[NV50_DISP_INTERLOCK_CORE] = 0;
+ }
+
++ /* Finish updating head(s)...
++ *
++ * NVD is rather picky about both where window assignments can change,
++ * *and* about certain core and window channel states matching.
++ *
++ * The EFI GOP driver on newer GPUs configures window channels with a
++ * different output format to what we do, and the core channel update
++ * in the assign_windows case above would result in a state mismatch.
++ *
++ * Delay some of the head update until after that point to workaround
++ * the issue. This only affects the initial modeset.
++ *
++ * TODO: handle this better when adding flexible window mapping
++ */
++ for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
++ struct nv50_head_atom *asyh = nv50_head_atom(new_crtc_state);
++ struct nv50_head *head = nv50_head(crtc);
++
++ NV_ATOMIC(drm, "%s: set %04x (clr %04x)\n", crtc->name,
++ asyh->set.mask, asyh->clr.mask);
++
++ if (asyh->set.mask) {
++ nv50_head_flush_set_wndw(head, asyh);
++ interlock[NV50_DISP_INTERLOCK_CORE] = 1;
++ }
++ }
++
+ /* Update plane(s). */
+ for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+ struct nv50_wndw_atom *asyw = nv50_wndw_atom(new_plane_state);
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c
+index ec361d17e900..d66f97280282 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head.c
+@@ -50,11 +50,8 @@ nv50_head_flush_clr(struct nv50_head *head,
+ }
+
+ void
+-nv50_head_flush_set(struct nv50_head *head, struct nv50_head_atom *asyh)
++nv50_head_flush_set_wndw(struct nv50_head *head, struct nv50_head_atom *asyh)
+ {
+- if (asyh->set.view ) head->func->view (head, asyh);
+- if (asyh->set.mode ) head->func->mode (head, asyh);
+- if (asyh->set.core ) head->func->core_set(head, asyh);
+ if (asyh->set.olut ) {
+ asyh->olut.offset = nv50_lut_load(&head->olut,
+ asyh->olut.buffer,
+@@ -62,6 +59,14 @@ nv50_head_flush_set(struct nv50_head *head, struct nv50_head_atom *asyh)
+ asyh->olut.load);
+ head->func->olut_set(head, asyh);
+ }
++}
++
++void
++nv50_head_flush_set(struct nv50_head *head, struct nv50_head_atom *asyh)
++{
++ if (asyh->set.view ) head->func->view (head, asyh);
++ if (asyh->set.mode ) head->func->mode (head, asyh);
++ if (asyh->set.core ) head->func->core_set(head, asyh);
+ if (asyh->set.curs ) head->func->curs_set(head, asyh);
+ if (asyh->set.base ) head->func->base (head, asyh);
+ if (asyh->set.ovly ) head->func->ovly (head, asyh);
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.h b/drivers/gpu/drm/nouveau/dispnv50/head.h
+index dae841dc05fd..0bac6be9ba34 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head.h
++++ b/drivers/gpu/drm/nouveau/dispnv50/head.h
+@@ -21,6 +21,7 @@ struct nv50_head {
+
+ struct nv50_head *nv50_head_create(struct drm_device *, int index);
+ void nv50_head_flush_set(struct nv50_head *head, struct nv50_head_atom *asyh);
++void nv50_head_flush_set_wndw(struct nv50_head *head, struct nv50_head_atom *asyh);
+ void nv50_head_flush_clr(struct nv50_head *head,
+ struct nv50_head_atom *asyh, bool flush);
+
+--
+2.30.2
+
--- /dev/null
+From 8a6762d5d21ba751c1d70230c89bf5b2cbffd007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 20:29:24 +1000
+Subject: drm/nouveau: recognise GA107
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit fa25f28ef2cef19bc9ffeb827b8ecbf48af7f892 ]
+
+Still no GA106 as I don't have HW to verif.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/engine/device/base.c | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+index b930f539feec..93ddf63d1114 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+@@ -2624,6 +2624,26 @@ nv174_chipset = {
+ .dma = { 0x00000001, gv100_dma_new },
+ };
+
++static const struct nvkm_device_chip
++nv177_chipset = {
++ .name = "GA107",
++ .bar = { 0x00000001, tu102_bar_new },
++ .bios = { 0x00000001, nvkm_bios_new },
++ .devinit = { 0x00000001, ga100_devinit_new },
++ .fb = { 0x00000001, ga102_fb_new },
++ .gpio = { 0x00000001, ga102_gpio_new },
++ .i2c = { 0x00000001, gm200_i2c_new },
++ .imem = { 0x00000001, nv50_instmem_new },
++ .mc = { 0x00000001, ga100_mc_new },
++ .mmu = { 0x00000001, tu102_mmu_new },
++ .pci = { 0x00000001, gp100_pci_new },
++ .privring = { 0x00000001, gm200_privring_new },
++ .timer = { 0x00000001, gk20a_timer_new },
++ .top = { 0x00000001, ga100_top_new },
++ .disp = { 0x00000001, ga102_disp_new },
++ .dma = { 0x00000001, gv100_dma_new },
++};
++
+ static int
+ nvkm_device_event_ctor(struct nvkm_object *object, void *data, u32 size,
+ struct nvkm_notify *notify)
+@@ -3049,6 +3069,7 @@ nvkm_device_ctor(const struct nvkm_device_func *func,
+ case 0x168: device->chip = &nv168_chipset; break;
+ case 0x172: device->chip = &nv172_chipset; break;
+ case 0x174: device->chip = &nv174_chipset; break;
++ case 0x177: device->chip = &nv177_chipset; break;
+ default:
+ if (nvkm_boolopt(device->cfgopt, "NvEnableUnsupportedChipsets", false)) {
+ switch (device->chipset) {
+--
+2.30.2
+
--- /dev/null
+From c564a5f814d9e1a2093ee402a893372c87bfbf07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 14:45:39 +0200
+Subject: iwlwifi: add new so-jf devices
+
+From: Yaara Baruch <yaara.baruch@intel.com>
+
+[ Upstream commit 891332f697e14bfb2002f56e21d9bbd4800a7098 ]
+
+Add new so-jf devices to the driver.
+
+Signed-off-by: Yaara Baruch <yaara.baruch@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210719144523.1c9a59fd2760.If5aef1942007828210f0f2c4a17985f63050bb45@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 36 ++++++++++++++++++-
+ 1 file changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index cd204a9ec87d..9f11a1d5d034 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -1142,7 +1142,41 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
+ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
+ IWL_CFG_RF_TYPE_GF, IWL_CFG_ANY,
+ IWL_CFG_160, IWL_CFG_ANY, IWL_CFG_NO_CDB,
+- iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_name)
++ iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_name),
++
++/* So with JF2 */
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF2, IWL_CFG_RF_ID_JF,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9560_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF2, IWL_CFG_RF_ID_JF,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9560_name),
++
++/* So with JF */
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9461_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1_DIV,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9462_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9461_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1_DIV,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9462_name)
+
+ #endif /* CONFIG_IWLMVM */
+ };
+--
+2.30.2
+
--- /dev/null
+From 389048f2cc058eedff6b78886320eff29eff3a04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 14:45:38 +0200
+Subject: iwlwifi: add new SoF with JF devices
+
+From: Yaara Baruch <yaara.baruch@intel.com>
+
+[ Upstream commit a5bf1d4434b93394fa37494d78fe9f3513557185 ]
+
+Add new SoF JF devices to the driver.
+
+Signed-off-by: Yaara Baruch <yaara.baruch@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210719144523.0545d8964ff2.I3498879d8c184e42b1578a64aa7b7c99a18b75fb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 34 +++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index d94bd8d732e9..cd204a9ec87d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -1103,6 +1103,40 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
+ IWL_CFG_ANY, IWL_CFG_ANY, IWL_CFG_NO_CDB,
+ iwl_cfg_bz_a0_mr_a0, iwl_ax211_name),
+
++/* SoF with JF2 */
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF2, IWL_CFG_RF_ID_JF,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9560_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF2, IWL_CFG_RF_ID_JF,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9560_name),
++
++/* SoF with JF */
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9461_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1_DIV,
++ IWL_CFG_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9462_160_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9461_name),
++ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
++ IWL_CFG_MAC_TYPE_SOF, IWL_CFG_ANY,
++ IWL_CFG_RF_TYPE_JF1, IWL_CFG_RF_ID_JF1_DIV,
++ IWL_CFG_NO_160, IWL_CFG_CORES_BT, IWL_CFG_NO_CDB,
++ iwlax210_2ax_cfg_so_jf_b0, iwl9462_name),
++
+ /* So with GF */
+ _IWL_DEV_INFO(IWL_CFG_ANY, IWL_CFG_ANY,
+ IWL_CFG_MAC_TYPE_SO, IWL_CFG_ANY,
+--
+2.30.2
+
--- /dev/null
+From 8c95fe374ca2346733c78cfb93cb8980b7e93cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 14:01:56 +0200
+Subject: iwlwifi: pnvm: accept multiple HW-type TLVs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 0f673c16c850250db386537a422c11d248fb123c ]
+
+Some products (So) may have two different types of products
+with different mac-type that are otherwise equivalent, and
+have the same PNVM data, so the PNVM file will contain two
+(or perhaps later more) HW-type TLVs. Accept the file and
+use the data section that contains any matching entry.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210719140154.a6a86e903035.Ic0b1b75c45d386698859f251518e8a5144431938@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 25 +++++++++++++-------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 40f2109a097f..1a63cae6567e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -37,6 +37,7 @@ static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data,
+ u32 sha1 = 0;
+ u16 mac_type = 0, rf_id = 0;
+ u8 *pnvm_data = NULL, *tmp;
++ bool hw_match = false;
+ u32 size = 0;
+ int ret;
+
+@@ -83,6 +84,9 @@ static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data,
+ break;
+ }
+
++ if (hw_match)
++ break;
++
+ mac_type = le16_to_cpup((__le16 *)data);
+ rf_id = le16_to_cpup((__le16 *)(data + sizeof(__le16)));
+
+@@ -90,15 +94,9 @@ static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data,
+ "Got IWL_UCODE_TLV_HW_TYPE mac_type 0x%0x rf_id 0x%0x\n",
+ mac_type, rf_id);
+
+- if (mac_type != CSR_HW_REV_TYPE(trans->hw_rev) ||
+- rf_id != CSR_HW_RFID_TYPE(trans->hw_rf_id)) {
+- IWL_DEBUG_FW(trans,
+- "HW mismatch, skipping PNVM section, mac_type 0x%0x, rf_id 0x%0x.\n",
+- CSR_HW_REV_TYPE(trans->hw_rev), trans->hw_rf_id);
+- ret = -ENOENT;
+- goto out;
+- }
+-
++ if (mac_type == CSR_HW_REV_TYPE(trans->hw_rev) &&
++ rf_id == CSR_HW_RFID_TYPE(trans->hw_rf_id))
++ hw_match = true;
+ break;
+ case IWL_UCODE_TLV_SEC_RT: {
+ struct iwl_pnvm_section *section = (void *)data;
+@@ -149,6 +147,15 @@ static int iwl_pnvm_handle_section(struct iwl_trans *trans, const u8 *data,
+ }
+
+ done:
++ if (!hw_match) {
++ IWL_DEBUG_FW(trans,
++ "HW mismatch, skipping PNVM section (need mac_type 0x%x rf_id 0x%x)\n",
++ CSR_HW_REV_TYPE(trans->hw_rev),
++ CSR_HW_RFID_TYPE(trans->hw_rf_id));
++ ret = -ENOENT;
++ goto out;
++ }
++
+ if (!size) {
+ IWL_DEBUG_FW(trans, "Empty PNVM, skipping.\n");
+ ret = -ENOENT;
+--
+2.30.2
+
--- /dev/null
+From 79accaa16826da0784c7a5aece4cd0a1a343a75e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 10:04:37 -0700
+Subject: net/rds: dma_map_sg is entitled to merge entries
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit fb4b1373dcab086d0619c29310f0466a0b2ceb8a ]
+
+Function "dma_map_sg" is entitled to merge adjacent entries
+and return a value smaller than what was passed as "nents".
+
+Subsequently "ib_map_mr_sg" needs to work with this value ("sg_dma_len")
+rather than the original "nents" parameter ("sg_len").
+
+This old RDS bug was exposed and reliably causes kernel panics
+(using RDMA operations "rds-stress -D") on x86_64 starting with:
+commit c588072bba6b ("iommu/vt-d: Convert intel iommu driver to the iommu ops")
+
+Simply put: Linux 5.11 and later.
+
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Link: https://lore.kernel.org/r/60efc69f-1f35-529d-a7ef-da0549cad143@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib_frmr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
+index 9b6ffff72f2d..28c1b0022178 100644
+--- a/net/rds/ib_frmr.c
++++ b/net/rds/ib_frmr.c
+@@ -131,9 +131,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr)
+ cpu_relax();
+ }
+
+- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len,
++ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len,
+ &off, PAGE_SIZE);
+- if (unlikely(ret != ibmr->sg_len))
++ if (unlikely(ret != ibmr->sg_dma_len))
+ return ret < 0 ? ret : -EINVAL;
+
+ if (cmpxchg(&frmr->fr_state,
+--
+2.30.2
+
--- /dev/null
+From 3ea1b0523f9cf90039c500878af4afdfedd20dfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 10:30:56 +0200
+Subject: opp: remove WARN when no valid OPPs remain
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 335ffab3ef864539e814b9a2903b0ae420c1c067 ]
+
+This WARN can be triggered per-core and the stack trace is not useful.
+Replace it with plain dev_err(). Fix a comment while at it.
+
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index c582a9ca397b..01feeba78426 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -985,8 +985,9 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ }
+ }
+
+- /* There should be one of more OPP defined */
+- if (WARN_ON(!count)) {
++ /* There should be one or more OPPs defined */
++ if (!count) {
++ dev_err(dev, "%s: no supported OPPs", __func__);
+ ret = -ENOENT;
+ goto remove_static_opp;
+ }
+--
+2.30.2
+
--- /dev/null
+From da84b49c9be4127adf8ed9e1eb40228642f73a4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:55:13 +0200
+Subject: platform/x86: asus-nb-wmi: Add tablet_mode_sw=lid-flip quirk for the
+ TP200s
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 73fcbad691110ece47a487c9e584822070e3626f ]
+
+The Asus TP200s / E205SA 360 degree hinges 2-in-1 supports reporting
+SW_TABLET_MODE info through the ASUS_WMI_DEVID_LID_FLIP WMI device-id.
+Add a quirk to enable this.
+
+BugLink: https://gitlab.freedesktop.org/libinput/libinput/-/issues/639
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210812145513.39117-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 9929eedf7dd8..a81dc4b191b7 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -462,6 +462,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ },
+ .driver_data = &quirk_asus_use_lid_flip_devid,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "ASUS TP200s / E205SA",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "E205SA"),
++ },
++ .driver_data = &quirk_asus_use_lid_flip_devid,
++ },
+ {},
+ };
+
+--
+2.30.2
+
--- /dev/null
+From d9f43ad8a355f1b0cc39f6e7372ac4ebe86068f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:55:12 +0200
+Subject: platform/x86: asus-nb-wmi: Allow configuring SW_TABLET_MODE method
+ with a module option
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7f45621c14a209b986cd636447bb53b7f6f881c3 ]
+
+Unfortunately we have been unable to find a reliable way to detect if
+and how SW_TABLET_MODE reporting is supported, so we are relying on
+DMI quirks for this.
+
+Add a module-option to specify the SW_TABLET_MODE method so that this can
+be easily tested without needing to rebuild the kernel.
+
+BugLink: https://gitlab.freedesktop.org/libinput/libinput/-/issues/639
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210812145513.39117-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-nb-wmi.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 0cb927f0f301..9929eedf7dd8 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -41,6 +41,10 @@ static int wapf = -1;
+ module_param(wapf, uint, 0444);
+ MODULE_PARM_DESC(wapf, "WAPF value");
+
++static int tablet_mode_sw = -1;
++module_param(tablet_mode_sw, uint, 0444);
++MODULE_PARM_DESC(tablet_mode_sw, "Tablet mode detect: -1:auto 0:disable 1:kbd-dock 2:lid-flip");
++
+ static struct quirk_entry *quirks;
+
+ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
+@@ -477,6 +481,21 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver)
+ else
+ wapf = quirks->wapf;
+
++ switch (tablet_mode_sw) {
++ case 0:
++ quirks->use_kbd_dock_devid = false;
++ quirks->use_lid_flip_devid = false;
++ break;
++ case 1:
++ quirks->use_kbd_dock_devid = true;
++ quirks->use_lid_flip_devid = false;
++ break;
++ case 2:
++ quirks->use_kbd_dock_devid = false;
++ quirks->use_lid_flip_devid = true;
++ break;
++ }
++
+ if (quirks->i8042_filter) {
+ ret = i8042_install_filter(quirks->i8042_filter);
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From 66bc982207c576e6926cc095c819186d1e97dcee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 18:44:35 +0200
+Subject: platform/x86: gigabyte-wmi: add support for B450M S2H V2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 1e35b8a7780a0c043cc5389420f069b69343f5d9 ]
+
+Reported as working here:
+https://github.com/t-8ch/linux-gigabyte-wmi-driver/issues/1#issuecomment-901207693
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/r/20210818164435.99821-1-linux@weissschuh.net
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index 9e8cfac403d3..7f3a03f937f6 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -140,6 +140,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev)
+ }}
+
+ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B450M S2H V2"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE V2"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 GAMING X V2"),
+--
+2.30.2
+
--- /dev/null
+From 73d30ab2dfa3e9f5c72327da667e76c5b1a255eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 17:46:28 +0200
+Subject: platform/x86: gigabyte-wmi: add support for X570 GAMING X
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit b9570f5c9240cadf87fb5f9313e8f425aa9e788f ]
+
+Reported as working here:
+https://github.com/t-8ch/linux-gigabyte-wmi-driver/issues/1#issuecomment-900263115
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/r/20210817154628.84992-1-linux@weissschuh.net
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index fbb224a82e34..9e8cfac403d3 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -147,6 +147,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550M DS3H"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z390 I AORUS PRO WIFI-CF"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 AORUS ELITE"),
++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 GAMING X"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 I AORUS PRO WIFI"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("X570 UD"),
+ { }
+--
+2.30.2
+
--- /dev/null
+From 59f474a3f475d36ccff2f55eb3e00f49dc40c9fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 14:06:39 +0300
+Subject: qed: Fix null-pointer dereference in qed_rdma_create_qp()
+
+From: Shai Malin <smalin@marvell.com>
+
+[ Upstream commit d33d19d313d3466abdf8b0428be7837aff767802 ]
+
+Fix a possible null-pointer dereference in qed_rdma_create_qp().
+
+Changes from V2:
+- Revert checkpatch fixes.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Shai Malin <smalin@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index da864d12916b..4f4b79250a2b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -1285,8 +1285,7 @@ qed_rdma_create_qp(void *rdma_cxt,
+
+ if (!rdma_cxt || !in_params || !out_params ||
+ !p_hwfn->p_rdma_info->active) {
+- DP_ERR(p_hwfn->cdev,
+- "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
++ pr_err("qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n",
+ rdma_cxt, in_params, out_params);
+ return NULL;
+ }
+--
+2.30.2
+
--- /dev/null
+From 990ff9d18ca041eaa18ccea133360751874605fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 14:05:08 +0300
+Subject: qed: qed ll2 race condition fixes
+
+From: Shai Malin <smalin@marvell.com>
+
+[ Upstream commit 37110237f31105d679fc0aa7b11cdec867750ea7 ]
+
+Avoiding qed ll2 race condition and NULL pointer dereference as part
+of the remove and recovery flows.
+
+Changes form V1:
+- Change (!p_rx->set_prod_addr).
+- qed_ll2.c checkpatch fixes.
+
+Change from V2:
+- Revert "qed_ll2.c checkpatch fixes".
+
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Shai Malin <smalin@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index 49783f365079..f2c8273dce67 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -327,6 +327,9 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ unsigned long flags;
+ int rc = -EINVAL;
+
++ if (!p_ll2_conn)
++ return rc;
++
+ spin_lock_irqsave(&p_tx->lock, flags);
+ if (p_tx->b_completing_packet) {
+ rc = -EBUSY;
+@@ -500,7 +503,16 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie)
+ unsigned long flags = 0;
+ int rc = 0;
+
++ if (!p_ll2_conn)
++ return rc;
++
+ spin_lock_irqsave(&p_rx->lock, flags);
++
++ if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) {
++ spin_unlock_irqrestore(&p_rx->lock, flags);
++ return 0;
++ }
++
+ cq_new_idx = le16_to_cpu(*p_rx->p_fw_cons);
+ cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain);
+
+@@ -821,6 +833,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie;
+ int rc;
+
++ if (!p_ll2_conn)
++ return 0;
++
+ if (!QED_LL2_RX_REGISTERED(p_ll2_conn))
+ return 0;
+
+@@ -844,6 +859,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie)
+ u16 new_idx = 0, num_bds = 0;
+ int rc;
+
++ if (!p_ll2_conn)
++ return 0;
++
+ if (!QED_LL2_TX_REGISTERED(p_ll2_conn))
+ return 0;
+
+@@ -1725,6 +1743,8 @@ int qed_ll2_post_rx_buffer(void *cxt,
+ if (!p_ll2_conn)
+ return -EINVAL;
+ p_rx = &p_ll2_conn->rx_queue;
++ if (!p_rx->set_prod_addr)
++ return -EIO;
+
+ spin_lock_irqsave(&p_rx->lock, flags);
+ if (!list_empty(&p_rx->free_descq))
+--
+2.30.2
+
--- /dev/null
+From b0ebea20af944420b819dcba192741d4e2565932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 14:20:33 +0800
+Subject: Revert "drm/amd/pm: fix workload mismatch on vega10"
+
+From: Kenneth Feng <kenneth.feng@amd.com>
+
+[ Upstream commit 2fd31689f9e44af949f60ff4f8aca013e628ab81 ]
+
+This reverts commit 0979d43259e13846d86ba17e451e17fec185d240.
+Revert this because it does not apply to all the cards.
+
+Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+index 31c61ac3bd5e..f5a32654cde7 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c
+@@ -5160,7 +5160,7 @@ static int vega10_set_power_profile_mode(struct pp_hwmgr *hwmgr, long *input, ui
+
+ out:
+ smum_send_msg_to_smc_with_parameter(hwmgr, PPSMC_MSG_SetWorkloadMask,
+- (!power_profile_mode) ? 0 : 1 << (power_profile_mode - 1),
++ 1 << power_profile_mode,
+ NULL);
+ hwmgr->power_profile_mode = power_profile_mode;
+
+--
+2.30.2
+
perf-x86-intel-uncore-fix-integer-overflow-on-23-bit.patch
sched-fix-get_push_task-vs-migrate_disable.patch
clk-renesas-rcar-usb2-clock-sel-fix-kernel-null-poin.patch
+iwlwifi-pnvm-accept-multiple-hw-type-tlvs.patch
+iwlwifi-add-new-sof-with-jf-devices.patch
+iwlwifi-add-new-so-jf-devices.patch
+opp-remove-warn-when-no-valid-opps-remain.patch
+cpufreq-blocklist-qualcomm-sm8150-in-cpufreq-dt-plat.patch
+virtio-improve-vq-broken-access-to-avoid-any-compile.patch
+virtio_pci-support-surprise-removal-of-virtio-pci-de.patch
+virtio_vdpa-reject-invalid-vq-indices.patch
+vringh-use-wiov-used-to-check-for-read-write-desc-or.patch
+tools-virtio-fix-build.patch
+platform-x86-asus-nb-wmi-allow-configuring-sw_tablet.patch
+platform-x86-asus-nb-wmi-add-tablet_mode_sw-lid-flip.patch
+qed-qed-ll2-race-condition-fixes.patch
+qed-fix-null-pointer-dereference-in-qed_rdma_create_.patch
+revert-drm-amd-pm-fix-workload-mismatch-on-vega10.patch
+drm-amd-pm-change-the-workload-type-for-some-cards.patch
+blk-mq-don-t-grab-rq-s-refcount-in-blk_mq_check_expi.patch
+drm-copy-drm_wait_vblank-to-user-before-returning.patch
+platform-x86-gigabyte-wmi-add-support-for-x570-gamin.patch
+drm-nouveau-recognise-ga107.patch
+drm-nouveau-disp-power-down-unused-dp-links-during-i.patch
+drm-nouveau-kms-nv50-workaround-efi-gop-window-chann.patch
+platform-x86-gigabyte-wmi-add-support-for-b450m-s2h-.patch
+net-rds-dma_map_sg-is-entitled-to-merge-entries.patch
+arm64-initialize-all-of-cnthctl_el2.patch
--- /dev/null
+From 3ec51b66da9759aa449b5cbb2efb5357e215c694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:26:05 -0400
+Subject: tools/virtio: fix build
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit a24ce06c70fe7df795a846ad713ccaa9b56a7666 ]
+
+We use a spinlock now so add a stub.
+Ignore bogus uninitialized variable warnings.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/virtio/Makefile | 3 +-
+ tools/virtio/linux/spinlock.h | 56 +++++++++++++++++++++++++++++++++++
+ tools/virtio/linux/virtio.h | 2 ++
+ 3 files changed, 60 insertions(+), 1 deletion(-)
+ create mode 100644 tools/virtio/linux/spinlock.h
+
+diff --git a/tools/virtio/Makefile b/tools/virtio/Makefile
+index b587b9a7a124..0d7bbe49359d 100644
+--- a/tools/virtio/Makefile
++++ b/tools/virtio/Makefile
+@@ -4,7 +4,8 @@ test: virtio_test vringh_test
+ virtio_test: virtio_ring.o virtio_test.o
+ vringh_test: vringh_test.o vringh.o virtio_ring.o
+
+-CFLAGS += -g -O2 -Werror -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h
++CFLAGS += -g -O2 -Werror -Wno-maybe-uninitialized -Wall -I. -I../include/ -I ../../usr/include/ -Wno-pointer-sign -fno-strict-overflow -fno-strict-aliasing -fno-common -MMD -U_FORTIFY_SOURCE -include ../../include/linux/kconfig.h
++LDFLAGS += -lpthread
+ vpath %.c ../../drivers/virtio ../../drivers/vhost
+ mod:
+ ${MAKE} -C `pwd`/../.. M=`pwd`/vhost_test V=${V}
+diff --git a/tools/virtio/linux/spinlock.h b/tools/virtio/linux/spinlock.h
+new file mode 100644
+index 000000000000..028e3cdcc5d3
+--- /dev/null
++++ b/tools/virtio/linux/spinlock.h
+@@ -0,0 +1,56 @@
++#ifndef SPINLOCK_H_STUB
++#define SPINLOCK_H_STUB
++
++#include <pthread.h>
++
++typedef pthread_spinlock_t spinlock_t;
++
++static inline void spin_lock_init(spinlock_t *lock)
++{
++ int r = pthread_spin_init(lock, 0);
++ assert(!r);
++}
++
++static inline void spin_lock(spinlock_t *lock)
++{
++ int ret = pthread_spin_lock(lock);
++ assert(!ret);
++}
++
++static inline void spin_unlock(spinlock_t *lock)
++{
++ int ret = pthread_spin_unlock(lock);
++ assert(!ret);
++}
++
++static inline void spin_lock_bh(spinlock_t *lock)
++{
++ spin_lock(lock);
++}
++
++static inline void spin_unlock_bh(spinlock_t *lock)
++{
++ spin_unlock(lock);
++}
++
++static inline void spin_lock_irq(spinlock_t *lock)
++{
++ spin_lock(lock);
++}
++
++static inline void spin_unlock_irq(spinlock_t *lock)
++{
++ spin_unlock(lock);
++}
++
++static inline void spin_lock_irqsave(spinlock_t *lock, unsigned long f)
++{
++ spin_lock(lock);
++}
++
++static inline void spin_unlock_irqrestore(spinlock_t *lock, unsigned long f)
++{
++ spin_unlock(lock);
++}
++
++#endif
+diff --git a/tools/virtio/linux/virtio.h b/tools/virtio/linux/virtio.h
+index 5d90254ddae4..363b98228301 100644
+--- a/tools/virtio/linux/virtio.h
++++ b/tools/virtio/linux/virtio.h
+@@ -3,6 +3,7 @@
+ #define LINUX_VIRTIO_H
+ #include <linux/scatterlist.h>
+ #include <linux/kernel.h>
++#include <linux/spinlock.h>
+
+ struct device {
+ void *parent;
+@@ -12,6 +13,7 @@ struct virtio_device {
+ struct device dev;
+ u64 features;
+ struct list_head vqs;
++ spinlock_t vqs_list_lock;
+ };
+
+ struct virtqueue {
+--
+2.30.2
+
--- /dev/null
+From 59b3d729fd26748a5b8ef7e223d44ce1b5d7e216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:26:45 +0300
+Subject: virtio: Improve vq->broken access to avoid any compiler optimization
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 60f0779862e4ab943810187752c462e85f5fa371 ]
+
+Currently vq->broken field is read by virtqueue_is_broken() in busy
+loop in one context by virtnet_send_command().
+
+vq->broken is set to true in other process context by
+virtio_break_device(). Reader and writer are accessing it without any
+synchronization. This may lead to a compiler optimization which may
+result to optimize reading vq->broken only once.
+
+Hence, force reading vq->broken on each invocation of
+virtqueue_is_broken() and also force writing it so that such
+update is visible to the readers.
+
+It is a theoretical fix that isn't yet encountered in the field.
+
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Link: https://lore.kernel.org/r/20210721142648.1525924-2-parav@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_ring.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 6b7aa26c5384..6c730d6d50f7 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -2268,7 +2268,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq)
+ {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+
+- return vq->broken;
++ return READ_ONCE(vq->broken);
+ }
+ EXPORT_SYMBOL_GPL(virtqueue_is_broken);
+
+@@ -2283,7 +2283,9 @@ void virtio_break_device(struct virtio_device *dev)
+ spin_lock(&dev->vqs_list_lock);
+ list_for_each_entry(_vq, &dev->vqs, list) {
+ struct vring_virtqueue *vq = to_vvq(_vq);
+- vq->broken = true;
++
++ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */
++ WRITE_ONCE(vq->broken, true);
+ }
+ spin_unlock(&dev->vqs_list_lock);
+ }
+--
+2.30.2
+
--- /dev/null
+From 7317bd33a612098c42267640a1b0ceb9a473fe17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 17:26:48 +0300
+Subject: virtio_pci: Support surprise removal of virtio pci device
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 43bb40c5b92659966bdf4bfe584fde0a3575a049 ]
+
+When a virtio pci device undergo surprise removal (aka async removal in
+PCIe spec), mark the device as broken so that any upper layer drivers can
+abort any outstanding operation.
+
+When a virtio net pci device undergo surprise removal which is used by a
+NetworkManager, a below call trace was observed.
+
+kernel:watchdog: BUG: soft lockup - CPU#1 stuck for 26s! [kworker/1:1:27059]
+watchdog: BUG: soft lockup - CPU#1 stuck for 52s! [kworker/1:1:27059]
+CPU: 1 PID: 27059 Comm: kworker/1:1 Tainted: G S W I L 5.13.0-hotplug+ #8
+Hardware name: Dell Inc. PowerEdge R640/0H28RR, BIOS 2.9.4 11/06/2020
+Workqueue: events linkwatch_event
+RIP: 0010:virtnet_send_command+0xfc/0x150 [virtio_net]
+Call Trace:
+ virtnet_set_rx_mode+0xcf/0x2a7 [virtio_net]
+ ? __hw_addr_create_ex+0x85/0xc0
+ __dev_mc_add+0x72/0x80
+ igmp6_group_added+0xa7/0xd0
+ ipv6_mc_up+0x3c/0x60
+ ipv6_find_idev+0x36/0x80
+ addrconf_add_dev+0x1e/0xa0
+ addrconf_dev_config+0x71/0x130
+ addrconf_notify+0x1f5/0xb40
+ ? rtnl_is_locked+0x11/0x20
+ ? __switch_to_asm+0x42/0x70
+ ? finish_task_switch+0xaf/0x2c0
+ ? raw_notifier_call_chain+0x3e/0x50
+ raw_notifier_call_chain+0x3e/0x50
+ netdev_state_change+0x67/0x90
+ linkwatch_do_dev+0x3c/0x50
+ __linkwatch_run_queue+0xd2/0x220
+ linkwatch_event+0x21/0x30
+ process_one_work+0x1c8/0x370
+ worker_thread+0x30/0x380
+ ? process_one_work+0x370/0x370
+ kthread+0x118/0x140
+ ? set_kthread_struct+0x40/0x40
+ ret_from_fork+0x1f/0x30
+
+Hence, add the ability to abort the command on surprise removal
+which prevents infinite loop and system lockup.
+
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Link: https://lore.kernel.org/r/20210721142648.1525924-5-parav@nvidia.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_pci_common.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index 222d630c41fc..b35bb2d57f62 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -576,6 +576,13 @@ static void virtio_pci_remove(struct pci_dev *pci_dev)
+ struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+ struct device *dev = get_device(&vp_dev->vdev.dev);
+
++ /*
++ * Device is marked broken on surprise removal so that virtio upper
++ * layers can abort any ongoing operation.
++ */
++ if (!pci_device_is_present(pci_dev))
++ virtio_break_device(&vp_dev->vdev);
++
+ pci_disable_sriov(pci_dev);
+
+ unregister_virtio_device(&vp_dev->vdev);
+--
+2.30.2
+
--- /dev/null
+From 458966df9ac561392efaa3554c66c86eb8d1ad5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 13:46:52 +0200
+Subject: virtio_vdpa: reject invalid vq indices
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit cb5d2c1f6cc0e5769099a7d44b9d08cf58cae206 ]
+
+Do not call vDPA drivers' callbacks with vq indicies larger than what
+the drivers indicate that they support. vDPA drivers do not bounds
+check the indices.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Link: https://lore.kernel.org/r/20210701114652.21956-1-vincent.whitchurch@axis.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_vdpa.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c
+index e28acf482e0c..e9b9dd03f44a 100644
+--- a/drivers/virtio/virtio_vdpa.c
++++ b/drivers/virtio/virtio_vdpa.c
+@@ -149,6 +149,9 @@ virtio_vdpa_setup_vq(struct virtio_device *vdev, unsigned int index,
+ if (!name)
+ return NULL;
+
++ if (index >= vdpa->nvqs)
++ return ERR_PTR(-ENOENT);
++
+ /* Queue shouldn't already be set up. */
+ if (ops->get_vq_ready(vdpa, index))
+ return ERR_PTR(-ENOENT);
+--
+2.30.2
+
--- /dev/null
+From a1c5ecbe671ba8891d2fd5215fb3811236b84a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 08:55:02 +0530
+Subject: vringh: Use wiov->used to check for read/write desc order
+
+From: Neeraj Upadhyay <neeraju@codeaurora.org>
+
+[ Upstream commit e74cfa91f42c50f7f649b0eca46aa049754ccdbd ]
+
+As __vringh_iov() traverses a descriptor chain, it populates
+each descriptor entry into either read or write vring iov
+and increments that iov's ->used member. So, as we iterate
+over a descriptor chain, at any point, (riov/wriov)->used
+value gives the number of descriptor enteries available,
+which are to be read or written by the device. As all read
+iovs must precede the write iovs, wiov->used should be zero
+when we are traversing a read descriptor. Current code checks
+for wiov->i, to figure out whether any previous entry in the
+current descriptor chain was a write descriptor. However,
+iov->i is only incremented, when these vring iovs are consumed,
+at a later point, and remain 0 in __vringh_iov(). So, correct
+the check for read and write descriptor order, to use
+wiov->used.
+
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
+Link: https://lore.kernel.org/r/1624591502-4827-1-git-send-email-neeraju@codeaurora.org
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vringh.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
+index 4af8fa259d65..14e2043d7685 100644
+--- a/drivers/vhost/vringh.c
++++ b/drivers/vhost/vringh.c
+@@ -359,7 +359,7 @@ __vringh_iov(struct vringh *vrh, u16 i,
+ iov = wiov;
+ else {
+ iov = riov;
+- if (unlikely(wiov && wiov->i)) {
++ if (unlikely(wiov && wiov->used)) {
+ vringh_bad("Readable desc %p after writable",
+ &descs[i]);
+ err = -EINVAL;
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
