--- /dev/null
+From 214a5ea081e77346e4963dd6d20c5539ff8b6ae6 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Thu, 21 Jan 2021 08:22:48 +1000
+Subject: cifs: do not fail __smb_send_rqst if non-fatal signals are pending
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+commit 214a5ea081e77346e4963dd6d20c5539ff8b6ae6 upstream.
+
+RHBZ 1848178
+
+The original intent of returning an error in this function
+in the patch:
+ "CIFS: Mask off signals when sending SMB packets"
+was to avoid interrupting packet send in the middle of
+sending the data (and thus breaking an SMB connection),
+but we also don't want to fail the request for non-fatal
+signals even before we have had a chance to try to
+send it (the reported problem could be reproduced e.g.
+by exiting a child process when the parent process was in
+the midst of calling futimens to update a file's timestamps).
+
+In addition, since the signal may remain pending when we enter the
+sending loop, we may end up not sending the whole packet before
+TCP buffers become full. In this case the code returns -EINTR
+but what we need here is to return -ERESTARTSYS instead to
+allow system calls to be restarted.
+
+Fixes: b30c74c73c78 ("CIFS: Mask off signals when sending SMB packets")
+Cc: stable@vger.kernel.org # v5.1+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/transport.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -338,7 +338,7 @@ __smb_send_rqst(struct TCP_Server_Info *
+ if (ssocket == NULL)
+ return -EAGAIN;
+
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ cifs_dbg(FYI, "signal pending before send request\n");
+ return -ERESTARTSYS;
+ }
+@@ -429,7 +429,7 @@ unmask:
+
+ if (signal_pending(current) && (total_len != send_length)) {
+ cifs_dbg(FYI, "signal is pending after attempt to send\n");
+- rc = -EINTR;
++ rc = -ERESTARTSYS;
+ }
+
+ /* uncork it */
--- /dev/null
+From 49a9565a7a7ce168e3e6482fb24e62d12f72ab81 Mon Sep 17 00:00:00 2001
+From: David Lechner <david@lechnology.com>
+Date: Sun, 13 Dec 2020 18:09:27 -0600
+Subject: counter:ti-eqep: remove floor
+
+From: David Lechner <david@lechnology.com>
+
+commit 49a9565a7a7ce168e3e6482fb24e62d12f72ab81 upstream.
+
+The hardware doesn't support this. QPOSINIT is an initialization value
+that is triggered by other things. When the counter overflows, it
+always wraps around to zero.
+
+Fixes: f213729f6796 "counter: new TI eQEP driver"
+Signed-off-by: David Lechner <david@lechnology.com>
+Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Link: https://lore.kernel.org/r/20201214000927.1793062-1-david@lechnology.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/counter/ti-eqep.c | 35 -----------------------------------
+ 1 file changed, 35 deletions(-)
+
+--- a/drivers/counter/ti-eqep.c
++++ b/drivers/counter/ti-eqep.c
+@@ -235,36 +235,6 @@ static ssize_t ti_eqep_position_ceiling_
+ return len;
+ }
+
+-static ssize_t ti_eqep_position_floor_read(struct counter_device *counter,
+- struct counter_count *count,
+- void *ext_priv, char *buf)
+-{
+- struct ti_eqep_cnt *priv = counter->priv;
+- u32 qposinit;
+-
+- regmap_read(priv->regmap32, QPOSINIT, &qposinit);
+-
+- return sprintf(buf, "%u\n", qposinit);
+-}
+-
+-static ssize_t ti_eqep_position_floor_write(struct counter_device *counter,
+- struct counter_count *count,
+- void *ext_priv, const char *buf,
+- size_t len)
+-{
+- struct ti_eqep_cnt *priv = counter->priv;
+- int err;
+- u32 res;
+-
+- err = kstrtouint(buf, 0, &res);
+- if (err < 0)
+- return err;
+-
+- regmap_write(priv->regmap32, QPOSINIT, res);
+-
+- return len;
+-}
+-
+ static ssize_t ti_eqep_position_enable_read(struct counter_device *counter,
+ struct counter_count *count,
+ void *ext_priv, char *buf)
+@@ -302,11 +272,6 @@ static struct counter_count_ext ti_eqep_
+ .write = ti_eqep_position_ceiling_write,
+ },
+ {
+- .name = "floor",
+- .read = ti_eqep_position_floor_read,
+- .write = ti_eqep_position_floor_write,
+- },
+- {
+ .name = "enable",
+ .read = ti_eqep_position_enable_read,
+ .write = ti_eqep_position_enable_write,
--- /dev/null
+From 3d1cf435e201d1fd63e4346b141881aed086effd Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Fri, 15 Jan 2021 19:30:51 +0100
+Subject: driver core: Extend device_is_dependent()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 3d1cf435e201d1fd63e4346b141881aed086effd upstream.
+
+If the device passed as the target (second argument) to
+device_is_dependent() is not completely registered (that is, it has
+been initialized, but not added yet), but the parent pointer of it
+is set, it may be missing from the list of the parent's children
+and device_for_each_child() called by device_is_dependent() cannot
+be relied on to catch that dependency.
+
+For this reason, modify device_is_dependent() to check the ancestors
+of the target device by following its parent pointer in addition to
+the device_for_each_child() walk.
+
+Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
+Reported-by: Stephan Gerhold <stephan@gerhold.net>
+Tested-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Saravana Kannan <saravanak@google.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/17705994.d592GUb2YH@kreacher
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/core.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -115,6 +115,16 @@ int device_links_read_lock_held(void)
+ #endif
+ #endif /* !CONFIG_SRCU */
+
++static bool device_is_ancestor(struct device *dev, struct device *target)
++{
++ while (target->parent) {
++ target = target->parent;
++ if (dev == target)
++ return true;
++ }
++ return false;
++}
++
+ /**
+ * device_is_dependent - Check if one device depends on another one
+ * @dev: Device to check dependencies for.
+@@ -128,7 +138,12 @@ int device_is_dependent(struct device *d
+ struct device_link *link;
+ int ret;
+
+- if (dev == target)
++ /*
++ * The "ancestors" check is needed to catch the case when the target
++ * device has not been completely initialized yet and it is still
++ * missing from the list of children of its parent device.
++ */
++ if (dev == target || device_is_ancestor(dev, target))
+ return 1;
+
+ ret = device_for_each_child(dev, target, device_is_dependent);
--- /dev/null
+From e020ff611ba9be54e959e6b548038f8a020da1c9 Mon Sep 17 00:00:00 2001
+From: Saravana Kannan <saravanak@google.com>
+Date: Sun, 10 Jan 2021 09:54:07 -0800
+Subject: driver core: Fix device link device name collision
+
+From: Saravana Kannan <saravanak@google.com>
+
+commit e020ff611ba9be54e959e6b548038f8a020da1c9 upstream.
+
+The device link device's name was of the form:
+<supplier-dev-name>--<consumer-dev-name>
+
+This can cause name collision as reported here [1] as device names are
+not globally unique. Since device names have to be unique within the
+bus/class, add the bus/class name as a prefix to the device names used to
+construct the device link device name.
+
+So the devuce link device's name will be of the form:
+<supplier-bus-name>:<supplier-dev-name>--<consumer-bus-name>:<consumer-dev-name>
+
+[1] - https://lore.kernel.org/lkml/20201229033440.32142-1-michael@walle.cc/
+
+Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs")
+Cc: stable@vger.kernel.org
+Reported-by: Michael Walle <michael@walle.cc>
+Tested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Link: https://lore.kernel.org/r/20210110175408.1465657-1-saravanak@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/sysfs-class-devlink | 4 +--
+ Documentation/ABI/testing/sysfs-devices-consumer | 5 ++--
+ Documentation/ABI/testing/sysfs-devices-supplier | 5 ++--
+ drivers/base/core.c | 27 ++++++++++++-----------
+ include/linux/device.h | 12 ++++++++++
+ 5 files changed, 35 insertions(+), 18 deletions(-)
+
+--- a/Documentation/ABI/testing/sysfs-class-devlink
++++ b/Documentation/ABI/testing/sysfs-class-devlink
+@@ -5,8 +5,8 @@ Description:
+ Provide a place in sysfs for the device link objects in the
+ kernel at any given time. The name of a device link directory,
+ denoted as ... above, is of the form <supplier>--<consumer>
+- where <supplier> is the supplier device name and <consumer> is
+- the consumer device name.
++ where <supplier> is the supplier bus:device name and <consumer>
++ is the consumer bus:device name.
+
+ What: /sys/class/devlink/.../auto_remove_on
+ Date: May 2020
+--- a/Documentation/ABI/testing/sysfs-devices-consumer
++++ b/Documentation/ABI/testing/sysfs-devices-consumer
+@@ -4,5 +4,6 @@ Contact: Saravana Kannan <saravanak@goog
+ Description:
+ The /sys/devices/.../consumer:<consumer> are symlinks to device
+ links where this device is the supplier. <consumer> denotes the
+- name of the consumer in that device link. There can be zero or
+- more of these symlinks for a given device.
++ name of the consumer in that device link and is of the form
++ bus:device name. There can be zero or more of these symlinks
++ for a given device.
+--- a/Documentation/ABI/testing/sysfs-devices-supplier
++++ b/Documentation/ABI/testing/sysfs-devices-supplier
+@@ -4,5 +4,6 @@ Contact: Saravana Kannan <saravanak@goog
+ Description:
+ The /sys/devices/.../supplier:<supplier> are symlinks to device
+ links where this device is the consumer. <supplier> denotes the
+- name of the supplier in that device link. There can be zero or
+- more of these symlinks for a given device.
++ name of the supplier in that device link and is of the form
++ bus:device name. There can be zero or more of these symlinks
++ for a given device.
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -363,7 +363,9 @@ static int devlink_add_symlinks(struct d
+ struct device *con = link->consumer;
+ char *buf;
+
+- len = max(strlen(dev_name(sup)), strlen(dev_name(con)));
++ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)),
++ strlen(dev_bus_name(con)) + strlen(dev_name(con)));
++ len += strlen(":");
+ len += strlen("supplier:") + 1;
+ buf = kzalloc(len, GFP_KERNEL);
+ if (!buf)
+@@ -377,12 +379,12 @@ static int devlink_add_symlinks(struct d
+ if (ret)
+ goto err_con;
+
+- snprintf(buf, len, "consumer:%s", dev_name(con));
++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
+ ret = sysfs_create_link(&sup->kobj, &link->link_dev.kobj, buf);
+ if (ret)
+ goto err_con_dev;
+
+- snprintf(buf, len, "supplier:%s", dev_name(sup));
++ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup));
+ ret = sysfs_create_link(&con->kobj, &link->link_dev.kobj, buf);
+ if (ret)
+ goto err_sup_dev;
+@@ -390,7 +392,7 @@ static int devlink_add_symlinks(struct d
+ goto out;
+
+ err_sup_dev:
+- snprintf(buf, len, "consumer:%s", dev_name(con));
++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
+ sysfs_remove_link(&sup->kobj, buf);
+ err_con_dev:
+ sysfs_remove_link(&link->link_dev.kobj, "consumer");
+@@ -413,7 +415,9 @@ static void devlink_remove_symlinks(stru
+ sysfs_remove_link(&link->link_dev.kobj, "consumer");
+ sysfs_remove_link(&link->link_dev.kobj, "supplier");
+
+- len = max(strlen(dev_name(sup)), strlen(dev_name(con)));
++ len = max(strlen(dev_bus_name(sup)) + strlen(dev_name(sup)),
++ strlen(dev_bus_name(con)) + strlen(dev_name(con)));
++ len += strlen(":");
+ len += strlen("supplier:") + 1;
+ buf = kzalloc(len, GFP_KERNEL);
+ if (!buf) {
+@@ -421,9 +425,9 @@ static void devlink_remove_symlinks(stru
+ return;
+ }
+
+- snprintf(buf, len, "supplier:%s", dev_name(sup));
++ snprintf(buf, len, "supplier:%s:%s", dev_bus_name(sup), dev_name(sup));
+ sysfs_remove_link(&con->kobj, buf);
+- snprintf(buf, len, "consumer:%s", dev_name(con));
++ snprintf(buf, len, "consumer:%s:%s", dev_bus_name(con), dev_name(con));
+ sysfs_remove_link(&sup->kobj, buf);
+ kfree(buf);
+ }
+@@ -633,8 +637,9 @@ struct device_link *device_link_add(stru
+
+ link->link_dev.class = &devlink_class;
+ device_set_pm_not_required(&link->link_dev);
+- dev_set_name(&link->link_dev, "%s--%s",
+- dev_name(supplier), dev_name(consumer));
++ dev_set_name(&link->link_dev, "%s:%s--%s:%s",
++ dev_bus_name(supplier), dev_name(supplier),
++ dev_bus_name(consumer), dev_name(consumer));
+ if (device_register(&link->link_dev)) {
+ put_device(consumer);
+ put_device(supplier);
+@@ -1652,9 +1657,7 @@ const char *dev_driver_string(const stru
+ * never change once they are set, so they don't need special care.
+ */
+ drv = READ_ONCE(dev->driver);
+- return drv ? drv->name :
+- (dev->bus ? dev->bus->name :
+- (dev->class ? dev->class->name : ""));
++ return drv ? drv->name : dev_bus_name(dev);
+ }
+ EXPORT_SYMBOL(dev_driver_string);
+
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -615,6 +615,18 @@ static inline const char *dev_name(const
+ return kobject_name(&dev->kobj);
+ }
+
++/**
++ * dev_bus_name - Return a device's bus/class name, if at all possible
++ * @dev: struct device to get the bus/class name of
++ *
++ * Will return the name of the bus/class the device is attached to. If it is
++ * not attached to a bus/class, an empty string will be returned.
++ */
++static inline const char *dev_bus_name(const struct device *dev)
++{
++ return dev->bus ? dev->bus->name : (dev->class ? dev->class->name : "");
++}
++
+ __printf(2, 3) int dev_set_name(struct device *dev, const char *name, ...);
+
+ #ifdef CONFIG_NUMA
--- /dev/null
+From d0243bbd5dd3ebbd49dafa8b56bb911d971131d0 Mon Sep 17 00:00:00 2001
+From: Meng Li <Meng.Li@windriver.com>
+Date: Tue, 5 Jan 2021 15:09:27 +0800
+Subject: drivers core: Free dma_range_map when driver probe failed
+
+From: Meng Li <Meng.Li@windriver.com>
+
+commit d0243bbd5dd3ebbd49dafa8b56bb911d971131d0 upstream.
+
+There will be memory leak if driver probe failed. Trace as below:
+ backtrace:
+ [<000000002415258f>] kmemleak_alloc+0x3c/0x50
+ [<00000000f447ebe4>] __kmalloc+0x208/0x530
+ [<0000000048bc7b3a>] of_dma_get_range+0xe4/0x1b0
+ [<0000000041e39065>] of_dma_configure_id+0x58/0x27c
+ [<000000006356866a>] platform_dma_configure+0x2c/0x40
+ ......
+ [<000000000afcf9b5>] ret_from_fork+0x10/0x3c
+
+This issue is introduced by commit e0d072782c73("dma-mapping:
+introduce DMA range map, supplanting dma_pfn_offset "). It doesn't
+free dma_range_map when driver probe failed and cause above
+memory leak. So, add code to free it in error path.
+
+Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset ")
+Cc: stable@vger.kernel.org
+Signed-off-by: Meng Li <Meng.Li@windriver.com>
+Link: https://lore.kernel.org/r/20210105070927.14968-1-Meng.Li@windriver.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -612,6 +612,8 @@ dev_groups_failed:
+ else if (drv->remove)
+ drv->remove(dev);
+ probe_failed:
++ kfree(dev->dma_range_map);
++ dev->dma_range_map = NULL;
+ if (dev->bus)
+ blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
+ BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
--- /dev/null
+From cf5b1385d748b2f91b0c05bb301fcaf9bdbad385 Mon Sep 17 00:00:00 2001
+From: Slaveyko Slaveykov <sis@melexis.com>
+Date: Wed, 16 Dec 2020 13:57:20 +0200
+Subject: drivers: iio: temperature: Add delay after the addressed reset command in mlx90632.c
+
+From: Slaveyko Slaveykov <sis@melexis.com>
+
+commit cf5b1385d748b2f91b0c05bb301fcaf9bdbad385 upstream.
+
+After an I2C reset command, the mlx90632 needs some time before
+responding to other I2C commands. Without that delay, there is a chance
+that the I2C command(s) after the reset will not be accepted.
+
+Signed-off-by: Slaveyko Slaveykov <sis@melexis.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Crt Mori <cmo@melexis.com>
+Fixes: e02472f74a81 ("iio:temperature:mlx90632: Adding extended calibration option")
+Link: https://lore.kernel.org/r/20201216115720.12404-2-sis@melexis.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/temperature/mlx90632.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iio/temperature/mlx90632.c
++++ b/drivers/iio/temperature/mlx90632.c
+@@ -248,6 +248,12 @@ static int mlx90632_set_meas_type(struct
+ if (ret < 0)
+ return ret;
+
++ /*
++ * Give the mlx90632 some time to reset properly before sending a new I2C command
++ * if this is not done, the following I2C command(s) will not be accepted.
++ */
++ usleep_range(150, 200);
++
+ ret = regmap_write_bits(regmap, MLX90632_REG_CONTROL,
+ (MLX90632_CFG_MTYP_MASK | MLX90632_CFG_PWR_MASK),
+ (MLX90632_MTYP_STATUS(type) | MLX90632_PWR_STATUS_HALT));
--- /dev/null
+From 1c4995b0a576d24bb7ead991fb037c8b47ab6e32 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 18 Jan 2021 17:43:55 +0200
+Subject: drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting YCbCr 4:4:4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 1c4995b0a576d24bb7ead991fb037c8b47ab6e32 upstream.
+
+Let's not enable the 4:4:4->4:2:0 conversion bit in the DFP unless we're
+actually outputting YCbCr 4:4:4. It would appear some protocol
+converters blindy consult this bit even when the source is outputting
+RGB, resulting in a visual mess.
+
+Cc: stable@vger.kernel.org
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2914
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111164111.13302-1-ville.syrjala@linux.intel.com
+Fixes: 181567aa9f0d ("drm/i915: Do YCbCr 444->420 conversion via DP protocol converters")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 3170a21f7059c4660c469f59bf529f372a57da5f)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210118154355.24453-1-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_ddi.c | 2 +-
+ drivers/gpu/drm/i915/display/intel_dp.c | 9 +++++----
+ drivers/gpu/drm/i915/display/intel_dp.h | 3 ++-
+ 3 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_ddi.c
++++ b/drivers/gpu/drm/i915/display/intel_ddi.c
+@@ -3470,7 +3470,7 @@ static void hsw_ddi_pre_enable_dp(struct
+ intel_ddi_init_dp_buf_reg(encoder);
+ if (!is_mst)
+ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+- intel_dp_configure_protocol_converter(intel_dp);
++ intel_dp_configure_protocol_converter(intel_dp, crtc_state);
+ intel_dp_sink_set_decompression_state(intel_dp, crtc_state,
+ true);
+ intel_dp_sink_set_fec_ready(intel_dp, crtc_state);
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -3856,7 +3856,8 @@ static void intel_dp_enable_port(struct
+ intel_de_posting_read(dev_priv, intel_dp->output_reg);
+ }
+
+-void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp)
++void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp,
++ const struct intel_crtc_state *crtc_state)
+ {
+ struct drm_i915_private *i915 = dp_to_i915(intel_dp);
+ u8 tmp;
+@@ -3875,8 +3876,8 @@ void intel_dp_configure_protocol_convert
+ drm_dbg_kms(&i915->drm, "Failed to set protocol converter HDMI mode to %s\n",
+ enableddisabled(intel_dp->has_hdmi_sink));
+
+- tmp = intel_dp->dfp.ycbcr_444_to_420 ?
+- DP_CONVERSION_TO_YCBCR420_ENABLE : 0;
++ tmp = crtc_state->output_format == INTEL_OUTPUT_FORMAT_YCBCR444 &&
++ intel_dp->dfp.ycbcr_444_to_420 ? DP_CONVERSION_TO_YCBCR420_ENABLE : 0;
+
+ if (drm_dp_dpcd_writeb(&intel_dp->aux,
+ DP_PROTOCOL_CONVERTER_CONTROL_1, tmp) != 1)
+@@ -3930,7 +3931,7 @@ static void intel_enable_dp(struct intel
+ }
+
+ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+- intel_dp_configure_protocol_converter(intel_dp);
++ intel_dp_configure_protocol_converter(intel_dp, pipe_config);
+ intel_dp_start_link_train(intel_dp);
+ intel_dp_stop_link_train(intel_dp);
+
+--- a/drivers/gpu/drm/i915/display/intel_dp.h
++++ b/drivers/gpu/drm/i915/display/intel_dp.h
+@@ -51,7 +51,8 @@ int intel_dp_get_link_train_fallback_val
+ int intel_dp_retrain_link(struct intel_encoder *encoder,
+ struct drm_modeset_acquire_ctx *ctx);
+ void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode);
+-void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp);
++void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp,
++ const struct intel_crtc_state *crtc_state);
+ void intel_dp_sink_set_decompression_state(struct intel_dp *intel_dp,
+ const struct intel_crtc_state *crtc_state,
+ bool enable);
--- /dev/null
+From 0e634efd858e0e9331ea037e1a142e34a446e9e3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Fri, 16 Oct 2020 22:48:00 +0300
+Subject: drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 0e634efd858e0e9331ea037e1a142e34a446e9e3 upstream.
+
+Rename intel_dp_sink_dpms() to intel_dp_set_power()
+so one doesn't always have to convert from the DPMS
+enum values to the actual DP D-states.
+
+Also when dealing with a branch device this has nothing to
+do with any sink, so the old name was nonsense anyway.
+Also adjust the debug message accordingly, and pimp it
+with the standard encoder id+name thing.
+
+Trivial bits done with cocci:
+@@
+expression DP;
+@@
+(
+- intel_dp_sink_dpms(DP, DRM_MODE_DPMS_OFF)
++ intel_dp_set_power(DP, DP_SET_POWER_D3)
+|
+- intel_dp_sink_dpms(DP, DRM_MODE_DPMS_ON)
++ intel_dp_set_power(DP, DP_SET_POWER_D0)
+)
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201016194800.25581-2-ville.syrjala@linux.intel.com
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_ddi.c | 6 +++---
+ drivers/gpu/drm/i915/display/intel_dp.c | 24 ++++++++++++------------
+ drivers/gpu/drm/i915/display/intel_dp.h | 2 +-
+ drivers/gpu/drm/i915/display/intel_dp_mst.c | 2 +-
+ 4 files changed, 17 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_ddi.c
++++ b/drivers/gpu/drm/i915/display/intel_ddi.c
+@@ -3387,7 +3387,7 @@ static void tgl_ddi_pre_enable_dp(struct
+ intel_ddi_init_dp_buf_reg(encoder);
+
+ if (!is_mst)
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+
+ intel_dp_sink_set_decompression_state(intel_dp, crtc_state, true);
+ /*
+@@ -3469,7 +3469,7 @@ static void hsw_ddi_pre_enable_dp(struct
+
+ intel_ddi_init_dp_buf_reg(encoder);
+ if (!is_mst)
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+ intel_dp_configure_protocol_converter(intel_dp);
+ intel_dp_sink_set_decompression_state(intel_dp, crtc_state,
+ true);
+@@ -3647,7 +3647,7 @@ static void intel_ddi_post_disable_dp(st
+ * Power down sink before disabling the port, otherwise we end
+ * up getting interrupts from the sink on detecting link loss.
+ */
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D3);
+
+ if (INTEL_GEN(dev_priv) >= 12) {
+ if (is_mst) {
+--- a/drivers/gpu/drm/i915/display/intel_dp.c
++++ b/drivers/gpu/drm/i915/display/intel_dp.c
+@@ -3496,22 +3496,22 @@ void intel_dp_sink_set_decompression_sta
+ enable ? "enable" : "disable");
+ }
+
+-/* If the sink supports it, try to set the power state appropriately */
+-void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode)
++/* If the device supports it, try to set the power state appropriately */
++void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode)
+ {
+- struct drm_i915_private *i915 = dp_to_i915(intel_dp);
++ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
++ struct drm_i915_private *i915 = to_i915(encoder->base.dev);
+ int ret, i;
+
+ /* Should have a valid DPCD by this point */
+ if (intel_dp->dpcd[DP_DPCD_REV] < 0x11)
+ return;
+
+- if (mode != DRM_MODE_DPMS_ON) {
++ if (mode != DP_SET_POWER_D0) {
+ if (downstream_hpd_needs_d0(intel_dp))
+ return;
+
+- ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER,
+- DP_SET_POWER_D3);
++ ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, mode);
+ } else {
+ struct intel_lspcon *lspcon = dp_to_lspcon(intel_dp);
+
+@@ -3520,8 +3520,7 @@ void intel_dp_sink_dpms(struct intel_dp
+ * time to wake up.
+ */
+ for (i = 0; i < 3; i++) {
+- ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER,
+- DP_SET_POWER_D0);
++ ret = drm_dp_dpcd_writeb(&intel_dp->aux, DP_SET_POWER, mode);
+ if (ret == 1)
+ break;
+ msleep(1);
+@@ -3532,8 +3531,9 @@ void intel_dp_sink_dpms(struct intel_dp
+ }
+
+ if (ret != 1)
+- drm_dbg_kms(&i915->drm, "failed to %s sink power state\n",
+- mode == DRM_MODE_DPMS_ON ? "enable" : "disable");
++ drm_dbg_kms(&i915->drm, "[ENCODER:%d:%s] Set power to %s failed\n",
++ encoder->base.base.id, encoder->base.name,
++ mode == DP_SET_POWER_D0 ? "D0" : "D3");
+ }
+
+ static bool cpt_dp_port_selected(struct drm_i915_private *dev_priv,
+@@ -3707,7 +3707,7 @@ static void intel_disable_dp(struct inte
+ * ensure that we have vdd while we switch off the panel. */
+ intel_edp_panel_vdd_on(intel_dp);
+ intel_edp_backlight_off(old_conn_state);
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D3);
+ intel_edp_panel_off(intel_dp);
+ }
+
+@@ -3929,7 +3929,7 @@ static void intel_enable_dp(struct intel
+ lane_mask);
+ }
+
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+ intel_dp_configure_protocol_converter(intel_dp);
+ intel_dp_start_link_train(intel_dp);
+ intel_dp_stop_link_train(intel_dp);
+--- a/drivers/gpu/drm/i915/display/intel_dp.h
++++ b/drivers/gpu/drm/i915/display/intel_dp.h
+@@ -50,7 +50,7 @@ int intel_dp_get_link_train_fallback_val
+ int link_rate, u8 lane_count);
+ int intel_dp_retrain_link(struct intel_encoder *encoder,
+ struct drm_modeset_acquire_ctx *ctx);
+-void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode);
++void intel_dp_set_power(struct intel_dp *intel_dp, u8 mode);
+ void intel_dp_configure_protocol_converter(struct intel_dp *intel_dp);
+ void intel_dp_sink_set_decompression_state(struct intel_dp *intel_dp,
+ const struct intel_crtc_state *crtc_state,
+--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
+@@ -488,7 +488,7 @@ static void intel_mst_pre_enable_dp(stru
+ intel_dp->active_mst_links);
+
+ if (first_mst_stream)
+- intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
++ intel_dp_set_power(intel_dp, DP_SET_POWER_D0);
+
+ drm_dp_send_power_updown_phy(&intel_dp->mst_mgr, connector->port, true);
+
--- /dev/null
+From 280a9045bb18833db921b316a5527d2b565e9f2e Mon Sep 17 00:00:00 2001
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Date: Sun, 10 Jan 2021 20:36:09 +0300
+Subject: ehci: fix EHCI host controller initialization sequence
+
+From: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+
+commit 280a9045bb18833db921b316a5527d2b565e9f2e upstream.
+
+According to EHCI spec, EHCI HC clears USBSTS.HCHalted whenever
+USBCMD.RS=1.
+
+However, it is a good practice to wait some time after setting USBCMD.RS
+(approximately 100ms) until USBSTS.HCHalted become zero.
+
+Without this waiting, VirtualBox's EHCI virtual HC accidentally hangs
+(see BugLink).
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211095
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Eugene Korenevsky <ekorenevsky@astralinux.ru>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210110173609.GA17313@himera.home
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hcd.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -574,6 +574,7 @@ static int ehci_run (struct usb_hcd *hcd
+ struct ehci_hcd *ehci = hcd_to_ehci (hcd);
+ u32 temp;
+ u32 hcc_params;
++ int rc;
+
+ hcd->uses_new_polling = 1;
+
+@@ -629,9 +630,20 @@ static int ehci_run (struct usb_hcd *hcd
+ down_write(&ehci_cf_port_reset_rwsem);
+ ehci->rh_state = EHCI_RH_RUNNING;
+ ehci_writel(ehci, FLAG_CF, &ehci->regs->configured_flag);
++
++ /* Wait until HC become operational */
+ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
+ msleep(5);
++ rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
++
+ up_write(&ehci_cf_port_reset_rwsem);
++
++ if (rc) {
++ ehci_err(ehci, "USB %x.%x, controller refused to start: %d\n",
++ ((ehci->sbrn & 0xf0)>>4), (ehci->sbrn & 0x0f), rc);
++ return rc;
++ }
++
+ ehci->last_periodic_enable = ktime_get_real();
+
+ temp = HC_VERSION(ehci, ehci_readl(ehci, &ehci->caps->hc_capbase));
--- /dev/null
+From efd597b2839a9895e8a98fcb0b76d2f545802cd4 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 9 Dec 2020 11:46:49 +0100
+Subject: iio: ad5504: Fix setting power-down state
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit efd597b2839a9895e8a98fcb0b76d2f545802cd4 upstream.
+
+The power-down mask of the ad5504 is actually a power-up mask. Meaning if
+a bit is set the corresponding channel is powered up and if it is not set
+the channel is powered down.
+
+The driver currently has this the wrong way around, resulting in the
+channel being powered up when requested to be powered down and vice versa.
+
+Fixes: 3bbbf150ffde ("staging:iio:dac:ad5504: Use strtobool for boolean values")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Link: https://lore.kernel.org/r/20201209104649.5794-1-lars@metafoo.de
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/ad5504.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/dac/ad5504.c
++++ b/drivers/iio/dac/ad5504.c
+@@ -187,9 +187,9 @@ static ssize_t ad5504_write_dac_powerdow
+ return ret;
+
+ if (pwr_down)
+- st->pwr_down_mask |= (1 << chan->channel);
+- else
+ st->pwr_down_mask &= ~(1 << chan->channel);
++ else
++ st->pwr_down_mask |= (1 << chan->channel);
+
+ ret = ad5504_spi_write(st, AD5504_ADDR_CTRL,
+ AD5504_DAC_PWRDWN_MODE(st->pwr_down_mode) |
--- /dev/null
+From 7e6d9788aa02333a4353058816d52b9a90aae0d3 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Thu, 3 Dec 2020 09:26:50 +0200
+Subject: iio: adc: ti_am335x_adc: remove omitted iio_kfifo_free()
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+commit 7e6d9788aa02333a4353058816d52b9a90aae0d3 upstream.
+
+When the conversion was done to use devm_iio_kfifo_allocate(), a call to
+iio_kfifo_free() was omitted (to be removed).
+This change removes it.
+
+Fixes: 3c5308058899 ("iio: adc: ti_am335x_adc: alloc kfifo & IRQ via devm_ functions")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Link: https://lore.kernel.org/r/20201203072650.24128-1-alexandru.ardelean@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/ti_am335x_adc.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/iio/adc/ti_am335x_adc.c
++++ b/drivers/iio/adc/ti_am335x_adc.c
+@@ -397,16 +397,12 @@ static int tiadc_iio_buffered_hardware_s
+ ret = devm_request_threaded_irq(dev, irq, pollfunc_th, pollfunc_bh,
+ flags, indio_dev->name, indio_dev);
+ if (ret)
+- goto error_kfifo_free;
++ return ret;
+
+ indio_dev->setup_ops = setup_ops;
+ indio_dev->modes |= INDIO_BUFFER_SOFTWARE;
+
+ return 0;
+-
+-error_kfifo_free:
+- iio_kfifo_free(indio_dev->buffer);
+- return ret;
+ }
+
+ static const char * const chan_name_ain[] = {
--- /dev/null
+From 40c48fb79b9798954691f24b8ece1d3a7eb1b353 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 8 Dec 2020 15:36:40 +0100
+Subject: iio: common: st_sensors: fix possible infinite loop in st_sensors_irq_thread
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit 40c48fb79b9798954691f24b8ece1d3a7eb1b353 upstream.
+
+Return a boolean value in st_sensors_new_samples_available routine in
+order to avoid an infinite loop in st_sensors_irq_thread if
+stat_drdy.addr is not defined or stat_drdy read fails
+
+Fixes: 90efe05562921 ("iio: st_sensors: harden interrupt handling")
+Reported-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/c9ec69ed349e7200c779fd7a5bf04c1aaa2817aa.1607438132.git.lorenzo@kernel.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/common/st_sensors/st_sensors_trigger.c | 31 +++++++++++----------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c
++++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c
+@@ -23,35 +23,31 @@
+ * @sdata: Sensor data.
+ *
+ * returns:
+- * 0 - no new samples available
+- * 1 - new samples available
+- * negative - error or unknown
++ * false - no new samples available or read error
++ * true - new samples available
+ */
+-static int st_sensors_new_samples_available(struct iio_dev *indio_dev,
+- struct st_sensor_data *sdata)
++static bool st_sensors_new_samples_available(struct iio_dev *indio_dev,
++ struct st_sensor_data *sdata)
+ {
+ int ret, status;
+
+ /* How would I know if I can't check it? */
+ if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr)
+- return -EINVAL;
++ return true;
+
+ /* No scan mask, no interrupt */
+ if (!indio_dev->active_scan_mask)
+- return 0;
++ return false;
+
+ ret = regmap_read(sdata->regmap,
+ sdata->sensor_settings->drdy_irq.stat_drdy.addr,
+ &status);
+ if (ret < 0) {
+ dev_err(sdata->dev, "error checking samples available\n");
+- return ret;
++ return false;
+ }
+
+- if (status & sdata->sensor_settings->drdy_irq.stat_drdy.mask)
+- return 1;
+-
+- return 0;
++ return !!(status & sdata->sensor_settings->drdy_irq.stat_drdy.mask);
+ }
+
+ /**
+@@ -180,9 +176,15 @@ int st_sensors_allocate_trigger(struct i
+
+ /* Tell the interrupt handler that we're dealing with edges */
+ if (irq_trig == IRQF_TRIGGER_FALLING ||
+- irq_trig == IRQF_TRIGGER_RISING)
++ irq_trig == IRQF_TRIGGER_RISING) {
++ if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) {
++ dev_err(&indio_dev->dev,
++ "edge IRQ not supported w/o stat register.\n");
++ err = -EOPNOTSUPP;
++ goto iio_trigger_free;
++ }
+ sdata->edge_irq = true;
+- else
++ } else {
+ /*
+ * If we're not using edges (i.e. level interrupts) we
+ * just mask off the IRQ, handle one interrupt, then
+@@ -190,6 +192,7 @@ int st_sensors_allocate_trigger(struct i
+ * interrupt handler top half again and start over.
+ */
+ irq_trig |= IRQF_ONESHOT;
++ }
+
+ /*
+ * If the interrupt pin is Open Drain, by definition this
--- /dev/null
+From cb5c681ab9037e25fcca20689c82cf034566d610 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 15 Jan 2021 22:59:17 +0300
+Subject: intel_th: pci: Add Alder Lake-P support
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit cb5c681ab9037e25fcca20689c82cf034566d610 upstream.
+
+This adds support for the Trace Hub in Alder Lake-P.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115195917.3184-3-alexander.shishkin@linux.intel.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -269,6 +269,11 @@ static const struct pci_device_id intel_
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
++ /* Alder Lake-P */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x51a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
+ /* Alder Lake CPU */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x466f),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
--- /dev/null
+From 9a173346bd9e16ab19c7addb8862d95a5cea9feb Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Thu, 21 Jan 2021 12:01:08 +0000
+Subject: io_uring: fix short read retries for non-reg files
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 9a173346bd9e16ab19c7addb8862d95a5cea9feb upstream.
+
+Sockets and other non-regular files may actually expect short reads to
+happen, don't retry reads for them. Because non-reg files don't set
+FMODE_BUF_RASYNC and so it won't do second/retry do_read, we can filter
+out those cases after first do_read() attempt with ret>0.
+
+Cc: stable@vger.kernel.org # 5.9+
+Suggested-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -3461,7 +3461,7 @@ static int io_read(struct io_kiocb *req,
+
+ /* read it all, or we did blocking attempt. no retry. */
+ if (!iov_iter_count(iter) || !force_nonblock ||
+- (req->file->f_flags & O_NONBLOCK))
++ (req->file->f_flags & O_NONBLOCK) || !(req->flags & REQ_F_ISREG))
+ goto done;
+
+ io_size -= ret;
--- /dev/null
+From 607ec89ed18f49ca59689572659b9c0076f1991f Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 19 Jan 2021 10:10:54 -0700
+Subject: io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 607ec89ed18f49ca59689572659b9c0076f1991f upstream.
+
+IORING_OP_CLOSE is special in terms of cancelation, since it has an
+intermediate state where we've removed the file descriptor but hasn't
+closed the file yet. For that reason, it's currently marked with
+IO_WQ_WORK_NO_CANCEL to prevent cancelation. This ensures that the op
+is always run even if canceled, to prevent leaving us with a live file
+but an fd that is gone. However, with SQPOLL, since a cancel request
+doesn't carry any resources on behalf of the request being canceled, if
+we cancel before any of the close op has been run, we can end up with
+io-wq not having the ->files assigned. This can result in the following
+oops reported by Joseph:
+
+BUG: kernel NULL pointer dereference, address: 00000000000000d8
+PGD 800000010b76f067 P4D 800000010b76f067 PUD 10b462067 PMD 0
+Oops: 0000 [#1] SMP PTI
+CPU: 1 PID: 1788 Comm: io_uring-sq Not tainted 5.11.0-rc4 #1
+Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
+RIP: 0010:__lock_acquire+0x19d/0x18c0
+Code: 00 00 8b 1d fd 56 dd 08 85 db 0f 85 43 05 00 00 48 c7 c6 98 7b 95 82 48 c7 c7 57 96 93 82 e8 9a bc f5 ff 0f 0b e9 2b 05 00 00 <48> 81 3f c0 ca 67 8a b8 00 00 00 00 41 0f 45 c0 89 04 24 e9 81 fe
+RSP: 0018:ffffc90001933828 EFLAGS: 00010002
+RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000d8
+RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+R13: 0000000000000000 R14: ffff888106e8a140 R15: 00000000000000d8
+FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00000000000000d8 CR3: 0000000106efa004 CR4: 00000000003706e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ lock_acquire+0x31a/0x440
+ ? close_fd_get_file+0x39/0x160
+ ? __lock_acquire+0x647/0x18c0
+ _raw_spin_lock+0x2c/0x40
+ ? close_fd_get_file+0x39/0x160
+ close_fd_get_file+0x39/0x160
+ io_issue_sqe+0x1334/0x14e0
+ ? lock_acquire+0x31a/0x440
+ ? __io_free_req+0xcf/0x2e0
+ ? __io_free_req+0x175/0x2e0
+ ? find_held_lock+0x28/0xb0
+ ? io_wq_submit_work+0x7f/0x240
+ io_wq_submit_work+0x7f/0x240
+ io_wq_cancel_cb+0x161/0x580
+ ? io_wqe_wake_worker+0x114/0x360
+ ? io_uring_get_socket+0x40/0x40
+ io_async_find_and_cancel+0x3b/0x140
+ io_issue_sqe+0xbe1/0x14e0
+ ? __lock_acquire+0x647/0x18c0
+ ? __io_queue_sqe+0x10b/0x5f0
+ __io_queue_sqe+0x10b/0x5f0
+ ? io_req_prep+0xdb/0x1150
+ ? mark_held_locks+0x6d/0xb0
+ ? mark_held_locks+0x6d/0xb0
+ ? io_queue_sqe+0x235/0x4b0
+ io_queue_sqe+0x235/0x4b0
+ io_submit_sqes+0xd7e/0x12a0
+ ? _raw_spin_unlock_irq+0x24/0x30
+ ? io_sq_thread+0x3ae/0x940
+ io_sq_thread+0x207/0x940
+ ? do_wait_intr_irq+0xc0/0xc0
+ ? __ia32_sys_io_uring_enter+0x650/0x650
+ kthread+0x134/0x180
+ ? kthread_create_worker_on_cpu+0x90/0x90
+ ret_from_fork+0x1f/0x30
+
+Fix this by moving the IO_WQ_WORK_NO_CANCEL until _after_ we've modified
+the fdtable. Canceling before this point is totally fine, and running
+it in the io-wq context _after_ that point is also fine.
+
+For 5.12, we'll handle this internally and get rid of the no-cancel
+flag, as IORING_OP_CLOSE is the only user of it.
+
+Cc: stable@vger.kernel.org
+Fixes: b5dba59e0cf7 ("io_uring: add support for IORING_OP_CLOSE")
+Reported-by: "Abaci <abaci@linux.alibaba.com>"
+Reviewed-and-tested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4250,7 +4250,6 @@ static int io_close_prep(struct io_kiocb
+ * io_wq_work.flags, so initialize io_wq_work firstly.
+ */
+ io_req_init_async(req);
+- req->work.flags |= IO_WQ_WORK_NO_CANCEL;
+
+ if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
+ return -EINVAL;
+@@ -4283,6 +4282,8 @@ static int io_close(struct io_kiocb *req
+
+ /* if the file has a flush method, be safe and punt to async */
+ if (close->put_file->f_op->flush && force_nonblock) {
++ /* not safe to cancel at this point */
++ req->work.flags |= IO_WQ_WORK_NO_CANCEL;
+ /* was never set, but play safe */
+ req->flags &= ~REQ_F_NOWAIT;
+ /* avoid grabbing files - we don't need the files */
--- /dev/null
+From c93cc9e16d88e0f5ea95d2d65d58a8a4dab258bc Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sat, 16 Jan 2021 11:52:11 -0700
+Subject: io_uring: iopoll requests should also wake task ->in_idle state
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit c93cc9e16d88e0f5ea95d2d65d58a8a4dab258bc upstream.
+
+If we're freeing/finishing iopoll requests, ensure we check if the task
+is in idling in terms of cancelation. Otherwise we could end up waiting
+forever in __io_uring_task_cancel() if the task has active iopoll
+requests that need cancelation.
+
+Cc: stable@vger.kernel.org # 5.9+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/io_uring.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -2167,6 +2167,8 @@ static void io_req_free_batch_finish(str
+ struct io_uring_task *tctx = rb->task->io_uring;
+
+ percpu_counter_sub(&tctx->inflight, rb->task_refs);
++ if (atomic_read(&tctx->in_idle))
++ wake_up(&tctx->wait);
+ put_task_struct_many(rb->task, rb->task_refs);
+ rb->task = NULL;
+ }
+@@ -2186,6 +2188,8 @@ static void io_req_free_batch(struct req
+ struct io_uring_task *tctx = rb->task->io_uring;
+
+ percpu_counter_sub(&tctx->inflight, rb->task_refs);
++ if (atomic_read(&tctx->in_idle))
++ wake_up(&tctx->wait);
+ put_task_struct_many(rb->task, rb->task_refs);
+ }
+ rb->task = req->task;
--- /dev/null
+From 599b3063adf4bf041a87a69244ee36aded0d878f Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Thu, 7 Jan 2021 22:36:03 +0100
+Subject: irqchip/mips-cpu: Set IPI domain parent chip
+
+From: Mathias Kresin <dev@kresin.me>
+
+commit 599b3063adf4bf041a87a69244ee36aded0d878f upstream.
+
+Since commit 55567976629e ("genirq/irqdomain: Allow partial trimming of
+irq_data hierarchy") the irq_data chain is valided.
+
+The irq_domain_trim_hierarchy() function doesn't consider the irq + ipi
+domain hierarchy as valid, since the ipi domain has the irq domain set
+as parent, but the parent domain has no chip set. Hence the boot ends in
+a kernel panic.
+
+Set the chip for the parent domain as it is done in the mips gic irq
+driver, to have a valid irq_data chain.
+
+Fixes: 3838a547fda2 ("irqchip: mips-cpu: Introduce IPI IRQ domain support")
+Cc: <stable@vger.kernel.org> # v5.10+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210107213603.1637781-1-dev@kresin.me
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-mips-cpu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/irqchip/irq-mips-cpu.c
++++ b/drivers/irqchip/irq-mips-cpu.c
+@@ -197,6 +197,13 @@ static int mips_cpu_ipi_alloc(struct irq
+ if (ret)
+ return ret;
+
++ ret = irq_domain_set_hwirq_and_chip(domain->parent, virq + i, hwirq,
++ &mips_mt_cpu_irq_controller,
++ NULL);
++
++ if (ret)
++ return ret;
++
+ ret = irq_set_irq_type(virq + i, IRQ_TYPE_LEVEL_HIGH);
+ if (ret)
+ return ret;
--- /dev/null
+From d3921cb8be29ce5668c64e23ffdaeec5f8c69399 Mon Sep 17 00:00:00 2001
+From: Mike Rapoport <rppt@kernel.org>
+Date: Sat, 23 Jan 2021 21:01:02 -0800
+Subject: mm: fix initialization of struct page for holes in memory layout
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+commit d3921cb8be29ce5668c64e23ffdaeec5f8c69399 upstream.
+
+There could be struct pages that are not backed by actual physical
+memory. This can happen when the actual memory bank is not a multiple
+of SECTION_SIZE or when an architecture does not register memory holes
+reserved by the firmware as memblock.memory.
+
+Such pages are currently initialized using init_unavailable_mem()
+function that iterates through PFNs in holes in memblock.memory and if
+there is a struct page corresponding to a PFN, the fields if this page
+are set to default values and the page is marked as Reserved.
+
+init_unavailable_mem() does not take into account zone and node the page
+belongs to and sets both zone and node links in struct page to zero.
+
+On a system that has firmware reserved holes in a zone above ZONE_DMA,
+for instance in a configuration below:
+
+ # grep -A1 E820 /proc/iomem
+ 7a17b000-7a216fff : Unknown E820 type
+ 7a217000-7bffffff : System RAM
+
+unset zone link in struct page will trigger
+
+ VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);
+
+because there are pages in both ZONE_DMA32 and ZONE_DMA (unset zone link
+in struct page) in the same pageblock.
+
+Update init_unavailable_mem() to use zone constraints defined by an
+architecture to properly setup the zone link and use node ID of the
+adjacent range in memblock.memory to set the node link.
+
+Link: https://lkml.kernel.org/r/20210111194017.22696-3-rppt@kernel.org
+Fixes: 73a6e474cb37 ("mm: memmap_init: iterate over memblock regions rather that check each PFN")
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Reported-by: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Qian Cai <cai@lca.pw>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 84 +++++++++++++++++++++++++++++++++-----------------------
+ 1 file changed, 50 insertions(+), 34 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -7003,23 +7003,26 @@ void __init free_area_init_memoryless_no
+ * Initialize all valid struct pages in the range [spfn, epfn) and mark them
+ * PageReserved(). Return the number of struct pages that were initialized.
+ */
+-static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn)
++static u64 __init init_unavailable_range(unsigned long spfn, unsigned long epfn,
++ int zone, int nid)
+ {
+- unsigned long pfn;
++ unsigned long pfn, zone_spfn, zone_epfn;
+ u64 pgcnt = 0;
+
++ zone_spfn = arch_zone_lowest_possible_pfn[zone];
++ zone_epfn = arch_zone_highest_possible_pfn[zone];
++
++ spfn = clamp(spfn, zone_spfn, zone_epfn);
++ epfn = clamp(epfn, zone_spfn, zone_epfn);
++
+ for (pfn = spfn; pfn < epfn; pfn++) {
+ if (!pfn_valid(ALIGN_DOWN(pfn, pageblock_nr_pages))) {
+ pfn = ALIGN_DOWN(pfn, pageblock_nr_pages)
+ + pageblock_nr_pages - 1;
+ continue;
+ }
+- /*
+- * Use a fake node/zone (0) for now. Some of these pages
+- * (in memblock.reserved but not in memblock.memory) will
+- * get re-initialized via reserve_bootmem_region() later.
+- */
+- __init_single_page(pfn_to_page(pfn), pfn, 0, 0);
++
++ __init_single_page(pfn_to_page(pfn), pfn, zone, nid);
+ __SetPageReserved(pfn_to_page(pfn));
+ pgcnt++;
+ }
+@@ -7028,51 +7031,64 @@ static u64 __init init_unavailable_range
+ }
+
+ /*
+- * Only struct pages that are backed by physical memory are zeroed and
+- * initialized by going through __init_single_page(). But, there are some
+- * struct pages which are reserved in memblock allocator and their fields
+- * may be accessed (for example page_to_pfn() on some configuration accesses
+- * flags). We must explicitly initialize those struct pages.
++ * Only struct pages that correspond to ranges defined by memblock.memory
++ * are zeroed and initialized by going through __init_single_page() during
++ * memmap_init().
+ *
+- * This function also addresses a similar issue where struct pages are left
+- * uninitialized because the physical address range is not covered by
+- * memblock.memory or memblock.reserved. That could happen when memblock
+- * layout is manually configured via memmap=, or when the highest physical
+- * address (max_pfn) does not end on a section boundary.
++ * But, there could be struct pages that correspond to holes in
++ * memblock.memory. This can happen because of the following reasons:
++ * - phyiscal memory bank size is not necessarily the exact multiple of the
++ * arbitrary section size
++ * - early reserved memory may not be listed in memblock.memory
++ * - memory layouts defined with memmap= kernel parameter may not align
++ * nicely with memmap sections
++ *
++ * Explicitly initialize those struct pages so that:
++ * - PG_Reserved is set
++ * - zone link is set accorging to the architecture constrains
++ * - node is set to node id of the next populated region except for the
++ * trailing hole where last node id is used
+ */
+-static void __init init_unavailable_mem(void)
++static void __init init_zone_unavailable_mem(int zone)
+ {
+- phys_addr_t start, end;
+- u64 i, pgcnt;
+- phys_addr_t next = 0;
++ unsigned long start, end;
++ int i, nid;
++ u64 pgcnt;
++ unsigned long next = 0;
+
+ /*
+- * Loop through unavailable ranges not covered by memblock.memory.
++ * Loop through holes in memblock.memory and initialize struct
++ * pages corresponding to these holes
+ */
+ pgcnt = 0;
+- for_each_mem_range(i, &start, &end) {
++ for_each_mem_pfn_range(i, MAX_NUMNODES, &start, &end, &nid) {
+ if (next < start)
+- pgcnt += init_unavailable_range(PFN_DOWN(next),
+- PFN_UP(start));
++ pgcnt += init_unavailable_range(next, start, zone, nid);
+ next = end;
+ }
+
+ /*
+- * Early sections always have a fully populated memmap for the whole
+- * section - see pfn_valid(). If the last section has holes at the
+- * end and that section is marked "online", the memmap will be
+- * considered initialized. Make sure that memmap has a well defined
+- * state.
++ * Last section may surpass the actual end of memory (e.g. we can
++ * have 1Gb section and 512Mb of RAM pouplated).
++ * Make sure that memmap has a well defined state in this case.
+ */
+- pgcnt += init_unavailable_range(PFN_DOWN(next),
+- round_up(max_pfn, PAGES_PER_SECTION));
++ end = round_up(max_pfn, PAGES_PER_SECTION);
++ pgcnt += init_unavailable_range(next, end, zone, nid);
+
+ /*
+ * Struct pages that do not have backing memory. This could be because
+ * firmware is using some of this memory, or for some other reasons.
+ */
+ if (pgcnt)
+- pr_info("Zeroed struct page in unavailable ranges: %lld pages", pgcnt);
++ pr_info("Zone %s: zeroed struct page in unavailable ranges: %lld pages", zone_names[zone], pgcnt);
++}
++
++static void __init init_unavailable_mem(void)
++{
++ int zone;
++
++ for (zone = 0; zone < ZONE_MOVABLE; zone++)
++ init_zone_unavailable_mem(zone);
+ }
+ #else
+ static inline void __init init_unavailable_mem(void)
--- /dev/null
+From 5c447d274f3746fbed6e695e7b9a2d7bd8b31b71 Mon Sep 17 00:00:00 2001
+From: Shakeel Butt <shakeelb@google.com>
+Date: Sat, 23 Jan 2021 21:01:15 -0800
+Subject: mm: fix numa stats for thp migration
+
+From: Shakeel Butt <shakeelb@google.com>
+
+commit 5c447d274f3746fbed6e695e7b9a2d7bd8b31b71 upstream.
+
+Currently the kernel is not correctly updating the numa stats for
+NR_FILE_PAGES and NR_SHMEM on THP migration. Fix that.
+
+For NR_FILE_DIRTY and NR_ZONE_WRITE_PENDING, although at the moment
+there is no need to handle THP migration as kernel still does not have
+write support for file THP but to be more future proof, this patch adds
+the THP support for those stats as well.
+
+Link: https://lkml.kernel.org/r/20210108155813.2914586-2-shakeelb@google.com
+Fixes: e71769ae52609 ("mm: enable thp migration for shmem thp")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Acked-by: Yang Shi <shy828301@gmail.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Muchun Song <songmuchun@bytedance.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/migrate.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -406,6 +406,7 @@ int migrate_page_move_mapping(struct add
+ struct zone *oldzone, *newzone;
+ int dirty;
+ int expected_count = expected_page_refs(mapping, page) + extra_count;
++ int nr = thp_nr_pages(page);
+
+ if (!mapping) {
+ /* Anonymous page without mapping */
+@@ -441,7 +442,7 @@ int migrate_page_move_mapping(struct add
+ */
+ newpage->index = page->index;
+ newpage->mapping = page->mapping;
+- page_ref_add(newpage, thp_nr_pages(page)); /* add cache reference */
++ page_ref_add(newpage, nr); /* add cache reference */
+ if (PageSwapBacked(page)) {
+ __SetPageSwapBacked(newpage);
+ if (PageSwapCache(page)) {
+@@ -463,7 +464,7 @@ int migrate_page_move_mapping(struct add
+ if (PageTransHuge(page)) {
+ int i;
+
+- for (i = 1; i < HPAGE_PMD_NR; i++) {
++ for (i = 1; i < nr; i++) {
+ xas_next(&xas);
+ xas_store(&xas, newpage);
+ }
+@@ -474,7 +475,7 @@ int migrate_page_move_mapping(struct add
+ * to one less reference.
+ * We know this isn't the last reference.
+ */
+- page_ref_unfreeze(page, expected_count - thp_nr_pages(page));
++ page_ref_unfreeze(page, expected_count - nr);
+
+ xas_unlock(&xas);
+ /* Leave irq disabled to prevent preemption while updating stats */
+@@ -497,17 +498,17 @@ int migrate_page_move_mapping(struct add
+ old_lruvec = mem_cgroup_lruvec(memcg, oldzone->zone_pgdat);
+ new_lruvec = mem_cgroup_lruvec(memcg, newzone->zone_pgdat);
+
+- __dec_lruvec_state(old_lruvec, NR_FILE_PAGES);
+- __inc_lruvec_state(new_lruvec, NR_FILE_PAGES);
++ __mod_lruvec_state(old_lruvec, NR_FILE_PAGES, -nr);
++ __mod_lruvec_state(new_lruvec, NR_FILE_PAGES, nr);
+ if (PageSwapBacked(page) && !PageSwapCache(page)) {
+- __dec_lruvec_state(old_lruvec, NR_SHMEM);
+- __inc_lruvec_state(new_lruvec, NR_SHMEM);
++ __mod_lruvec_state(old_lruvec, NR_SHMEM, -nr);
++ __mod_lruvec_state(new_lruvec, NR_SHMEM, nr);
+ }
+ if (dirty && mapping_can_writeback(mapping)) {
+- __dec_lruvec_state(old_lruvec, NR_FILE_DIRTY);
+- __dec_zone_state(oldzone, NR_ZONE_WRITE_PENDING);
+- __inc_lruvec_state(new_lruvec, NR_FILE_DIRTY);
+- __inc_zone_state(newzone, NR_ZONE_WRITE_PENDING);
++ __mod_lruvec_state(old_lruvec, NR_FILE_DIRTY, -nr);
++ __mod_zone_page_state(oldzone, NR_ZONE_WRITE_PENDING, -nr);
++ __mod_lruvec_state(new_lruvec, NR_FILE_DIRTY, nr);
++ __mod_zone_page_state(newzone, NR_ZONE_WRITE_PENDING, nr);
+ }
+ }
+ local_irq_enable();
--- /dev/null
+From 8a8792f600abacd7e1b9bb667759dca1c153f64c Mon Sep 17 00:00:00 2001
+From: Shakeel Butt <shakeelb@google.com>
+Date: Sat, 23 Jan 2021 21:01:11 -0800
+Subject: mm: memcg: fix memcg file_dirty numa stat
+
+From: Shakeel Butt <shakeelb@google.com>
+
+commit 8a8792f600abacd7e1b9bb667759dca1c153f64c upstream.
+
+The kernel updates the per-node NR_FILE_DIRTY stats on page migration
+but not the memcg numa stats.
+
+That was not an issue until recently the commit 5f9a4f4a7096 ("mm:
+memcontrol: add the missing numa_stat interface for cgroup v2") exposed
+numa stats for the memcg.
+
+So fix the file_dirty per-memcg numa stat.
+
+Link: https://lkml.kernel.org/r/20210108155813.2914586-1-shakeelb@google.com
+Fixes: 5f9a4f4a7096 ("mm: memcontrol: add the missing numa_stat interface for cgroup v2")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Yang Shi <shy828301@gmail.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/migrate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -504,9 +504,9 @@ int migrate_page_move_mapping(struct add
+ __inc_lruvec_state(new_lruvec, NR_SHMEM);
+ }
+ if (dirty && mapping_can_writeback(mapping)) {
+- __dec_node_state(oldzone->zone_pgdat, NR_FILE_DIRTY);
++ __dec_lruvec_state(old_lruvec, NR_FILE_DIRTY);
+ __dec_zone_state(oldzone, NR_ZONE_WRITE_PENDING);
+- __inc_node_state(newzone->zone_pgdat, NR_FILE_DIRTY);
++ __inc_lruvec_state(new_lruvec, NR_FILE_DIRTY);
+ __inc_zone_state(newzone, NR_ZONE_WRITE_PENDING);
+ }
+ }
--- /dev/null
+From 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c Mon Sep 17 00:00:00 2001
+From: Roman Gushchin <guro@fb.com>
+Date: Sat, 23 Jan 2021 21:01:07 -0800
+Subject: mm: memcg/slab: optimize objcg stock draining
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roman Gushchin <guro@fb.com>
+
+commit 3de7d4f25a7438f09fef4e71ef111f1805cd8e7c upstream.
+
+Imran Khan reported a 16% regression in hackbench results caused by the
+commit f2fe7b09a52b ("mm: memcg/slab: charge individual slab objects
+instead of pages"). The regression is noticeable in the case of a
+consequent allocation of several relatively large slab objects, e.g.
+skb's. As soon as the amount of stocked bytes exceeds PAGE_SIZE,
+drain_obj_stock() and __memcg_kmem_uncharge() are called, and it leads
+to a number of atomic operations in page_counter_uncharge().
+
+The corresponding call graph is below (provided by Imran Khan):
+
+ |__alloc_skb
+ | |
+ | |__kmalloc_reserve.isra.61
+ | | |
+ | | |__kmalloc_node_track_caller
+ | | | |
+ | | | |slab_pre_alloc_hook.constprop.88
+ | | | obj_cgroup_charge
+ | | | | |
+ | | | | |__memcg_kmem_charge
+ | | | | | |
+ | | | | | |page_counter_try_charge
+ | | | | |
+ | | | | |refill_obj_stock
+ | | | | | |
+ | | | | | |drain_obj_stock.isra.68
+ | | | | | | |
+ | | | | | | |__memcg_kmem_uncharge
+ | | | | | | | |
+ | | | | | | | |page_counter_uncharge
+ | | | | | | | | |
+ | | | | | | | | |page_counter_cancel
+ | | | |
+ | | | |
+ | | | |__slab_alloc
+ | | | | |
+ | | | | |___slab_alloc
+ | | | | |
+ | | | |slab_post_alloc_hook
+
+Instead of directly uncharging the accounted kernel memory, it's
+possible to refill the generic page-sized per-cpu stock instead. It's a
+much faster operation, especially on a default hierarchy. As a bonus,
+__memcg_kmem_uncharge_page() will also get faster, so the freeing of
+page-sized kernel allocations (e.g. large kmallocs) will become faster.
+
+A similar change has been done earlier for the socket memory by the
+commit 475d0487a2ad ("mm: memcontrol: use per-cpu stocks for socket
+memory uncharging").
+
+Link: https://lkml.kernel.org/r/20210106042239.2860107-1-guro@fb.com
+Fixes: f2fe7b09a52b ("mm: memcg/slab: charge individual slab objects instead of pages")
+Signed-off-by: Roman Gushchin <guro@fb.com>
+Reported-by: Imran Khan <imran.f.khan@oracle.com>
+Tested-by: Imran Khan <imran.f.khan@oracle.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Michal Koutn <mkoutny@suse.com>
+Cc: Michal Koutný <mkoutny@suse.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -3083,9 +3083,7 @@ void __memcg_kmem_uncharge(struct mem_cg
+ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
+ page_counter_uncharge(&memcg->kmem, nr_pages);
+
+- page_counter_uncharge(&memcg->memory, nr_pages);
+- if (do_memsw_account())
+- page_counter_uncharge(&memcg->memsw, nr_pages);
++ refill_stock(memcg, nr_pages);
+ }
+
+ /**
--- /dev/null
+From 08685be7761d69914f08c3d6211c543a385a5b9c Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Mon, 11 Jan 2021 16:24:08 +1000
+Subject: powerpc/64s: fix scv entry fallback flush vs interrupt
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+commit 08685be7761d69914f08c3d6211c543a385a5b9c upstream.
+
+The L1D flush fallback functions are not recoverable vs interrupts,
+yet the scv entry flush runs with MSR[EE]=1. This can result in a
+timer (soft-NMI) or MCE or SRESET interrupt hitting here and overwriting
+the EXRFI save area, which ends up corrupting userspace registers for
+scv return.
+
+Fix this by disabling RI and EE for the scv entry fallback flush.
+
+Fixes: f79643787e0a0 ("powerpc/64s: flush L1D on kernel entry")
+Cc: stable@vger.kernel.org # 5.9+ which also have flush L1D patch backport
+Reported-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210111062408.287092-1-npiggin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/exception-64s.h | 13 +++++++++++++
+ arch/powerpc/include/asm/feature-fixups.h | 10 ++++++++++
+ arch/powerpc/kernel/entry_64.S | 2 +-
+ arch/powerpc/kernel/exceptions-64s.S | 19 +++++++++++++++++++
+ arch/powerpc/kernel/vmlinux.lds.S | 7 +++++++
+ arch/powerpc/lib/feature-fixups.c | 24 +++++++++++++++++++++---
+ 6 files changed, 71 insertions(+), 4 deletions(-)
+
+--- a/arch/powerpc/include/asm/exception-64s.h
++++ b/arch/powerpc/include/asm/exception-64s.h
+@@ -63,6 +63,12 @@
+ nop; \
+ nop;
+
++#define SCV_ENTRY_FLUSH_SLOT \
++ SCV_ENTRY_FLUSH_FIXUP_SECTION; \
++ nop; \
++ nop; \
++ nop;
++
+ /*
+ * r10 must be free to use, r13 must be paca
+ */
+@@ -71,6 +77,13 @@
+ ENTRY_FLUSH_SLOT
+
+ /*
++ * r10, ctr must be free to use, r13 must be paca
++ */
++#define SCV_INTERRUPT_TO_KERNEL \
++ STF_ENTRY_BARRIER_SLOT; \
++ SCV_ENTRY_FLUSH_SLOT
++
++/*
+ * Macros for annotating the expected destination of (h)rfid
+ *
+ * The nop instructions allow us to insert one or more instructions to flush the
+--- a/arch/powerpc/include/asm/feature-fixups.h
++++ b/arch/powerpc/include/asm/feature-fixups.h
+@@ -221,6 +221,14 @@ label##3: \
+ FTR_ENTRY_OFFSET 957b-958b; \
+ .popsection;
+
++#define SCV_ENTRY_FLUSH_FIXUP_SECTION \
++957: \
++ .pushsection __scv_entry_flush_fixup,"a"; \
++ .align 2; \
++958: \
++ FTR_ENTRY_OFFSET 957b-958b; \
++ .popsection;
++
+ #define RFI_FLUSH_FIXUP_SECTION \
+ 951: \
+ .pushsection __rfi_flush_fixup,"a"; \
+@@ -254,10 +262,12 @@ label##3: \
+
+ extern long stf_barrier_fallback;
+ extern long entry_flush_fallback;
++extern long scv_entry_flush_fallback;
+ extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup;
+ extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup;
+ extern long __start___uaccess_flush_fixup, __stop___uaccess_flush_fixup;
+ extern long __start___entry_flush_fixup, __stop___entry_flush_fixup;
++extern long __start___scv_entry_flush_fixup, __stop___scv_entry_flush_fixup;
+ extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup;
+ extern long __start___barrier_nospec_fixup, __stop___barrier_nospec_fixup;
+ extern long __start__btb_flush_fixup, __stop__btb_flush_fixup;
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -75,7 +75,7 @@ BEGIN_FTR_SECTION
+ bne .Ltabort_syscall
+ END_FTR_SECTION_IFSET(CPU_FTR_TM)
+ #endif
+- INTERRUPT_TO_KERNEL
++ SCV_INTERRUPT_TO_KERNEL
+ mr r10,r1
+ ld r1,PACAKSAVE(r13)
+ std r10,0(r1)
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -2993,6 +2993,25 @@ TRAMP_REAL_BEGIN(entry_flush_fallback)
+ ld r11,PACA_EXRFI+EX_R11(r13)
+ blr
+
++/*
++ * The SCV entry flush happens with interrupts enabled, so it must disable
++ * to prevent EXRFI being clobbered by NMIs (e.g., soft_nmi_common). r10
++ * (containing LR) does not need to be preserved here because scv entry
++ * puts 0 in the pt_regs, CTR can be clobbered for the same reason.
++ */
++TRAMP_REAL_BEGIN(scv_entry_flush_fallback)
++ li r10,0
++ mtmsrd r10,1
++ lbz r10,PACAIRQHAPPENED(r13)
++ ori r10,r10,PACA_IRQ_HARD_DIS
++ stb r10,PACAIRQHAPPENED(r13)
++ std r11,PACA_EXRFI+EX_R11(r13)
++ L1D_DISPLACEMENT_FLUSH
++ ld r11,PACA_EXRFI+EX_R11(r13)
++ li r10,MSR_RI
++ mtmsrd r10,1
++ blr
++
+ TRAMP_REAL_BEGIN(rfi_flush_fallback)
+ SET_SCRATCH0(r13);
+ GET_PACA(r13);
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -146,6 +146,13 @@ SECTIONS
+ }
+
+ . = ALIGN(8);
++ __scv_entry_flush_fixup : AT(ADDR(__scv_entry_flush_fixup) - LOAD_OFFSET) {
++ __start___scv_entry_flush_fixup = .;
++ *(__scv_entry_flush_fixup)
++ __stop___scv_entry_flush_fixup = .;
++ }
++
++ . = ALIGN(8);
+ __stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) {
+ __start___stf_exit_barrier_fixup = .;
+ *(__stf_exit_barrier_fixup)
+--- a/arch/powerpc/lib/feature-fixups.c
++++ b/arch/powerpc/lib/feature-fixups.c
+@@ -290,9 +290,6 @@ void do_entry_flush_fixups(enum l1d_flus
+ long *start, *end;
+ int i;
+
+- start = PTRRELOC(&__start___entry_flush_fixup);
+- end = PTRRELOC(&__stop___entry_flush_fixup);
+-
+ instrs[0] = 0x60000000; /* nop */
+ instrs[1] = 0x60000000; /* nop */
+ instrs[2] = 0x60000000; /* nop */
+@@ -312,6 +309,8 @@ void do_entry_flush_fixups(enum l1d_flus
+ if (types & L1D_FLUSH_MTTRIG)
+ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */
+
++ start = PTRRELOC(&__start___entry_flush_fixup);
++ end = PTRRELOC(&__stop___entry_flush_fixup);
+ for (i = 0; start < end; start++, i++) {
+ dest = (void *)start + *start;
+
+@@ -328,6 +327,25 @@ void do_entry_flush_fixups(enum l1d_flus
+ patch_instruction((struct ppc_inst *)(dest + 2), ppc_inst(instrs[2]));
+ }
+
++ start = PTRRELOC(&__start___scv_entry_flush_fixup);
++ end = PTRRELOC(&__stop___scv_entry_flush_fixup);
++ for (; start < end; start++, i++) {
++ dest = (void *)start + *start;
++
++ pr_devel("patching dest %lx\n", (unsigned long)dest);
++
++ patch_instruction((struct ppc_inst *)dest, ppc_inst(instrs[0]));
++
++ if (types == L1D_FLUSH_FALLBACK)
++ patch_branch((struct ppc_inst *)(dest + 1), (unsigned long)&scv_entry_flush_fallback,
++ BRANCH_SET_LINK);
++ else
++ patch_instruction((struct ppc_inst *)(dest + 1), ppc_inst(instrs[1]));
++
++ patch_instruction((struct ppc_inst *)(dest + 2), ppc_inst(instrs[2]));
++ }
++
++
+ printk(KERN_DEBUG "entry-flush: patched %d locations (%s flush)\n", i,
+ (types == L1D_FLUSH_NONE) ? "no" :
+ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" :
--- /dev/null
+From 697edcb0e4eadc41645fe88c991fe6a206b1a08d Mon Sep 17 00:00:00 2001
+From: Xiaoming Ni <nixiaoming@huawei.com>
+Date: Sat, 23 Jan 2021 21:02:16 -0800
+Subject: proc_sysctl: fix oops caused by incorrect command parameters
+
+From: Xiaoming Ni <nixiaoming@huawei.com>
+
+commit 697edcb0e4eadc41645fe88c991fe6a206b1a08d upstream.
+
+The process_sysctl_arg() does not check whether val is empty before
+invoking strlen(val). If the command line parameter () is incorrectly
+configured and val is empty, oops is triggered.
+
+For example:
+ "hung_task_panic=1" is incorrectly written as "hung_task_panic", oops is
+ triggered. The call stack is as follows:
+ Kernel command line: .... hung_task_panic
+ ......
+ Call trace:
+ __pi_strlen+0x10/0x98
+ parse_args+0x278/0x344
+ do_sysctl_args+0x8c/0xfc
+ kernel_init+0x5c/0xf4
+ ret_from_fork+0x10/0x30
+
+To fix it, check whether "val" is empty when "phram" is a sysctl field.
+Error codes are returned in the failure branch, and error logs are
+generated by parse_args().
+
+Link: https://lkml.kernel.org/r/20210118133029.28580-1-nixiaoming@huawei.com
+Fixes: 3db978d480e2843 ("kernel/sysctl: support setting sysctl parameters from kernel command line")
+Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Iurii Zaikin <yzaikin@google.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Heiner Kallweit <hkallweit1@gmail.com>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: <stable@vger.kernel.org> [5.8+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/proc_sysctl.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -1770,6 +1770,12 @@ static int process_sysctl_arg(char *para
+ return 0;
+ }
+
++ if (!val)
++ return -EINVAL;
++ len = strlen(val);
++ if (len == 0)
++ return -EINVAL;
++
+ /*
+ * To set sysctl options, we use a temporary mount of proc, look up the
+ * respective sys/ file and write to it. To avoid mounting it when no
+@@ -1811,7 +1817,6 @@ static int process_sysctl_arg(char *para
+ file, param, val);
+ goto out;
+ }
+- len = strlen(val);
+ wret = kernel_write(file, val, len, &pos);
+ if (wret < 0) {
+ err = wret;
--- /dev/null
+From 54ca955b5a4024e2ce0f206b03adb7109bc4da26 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Wed, 23 Dec 2020 20:19:31 +0100
+Subject: serial: mvebu-uart: fix tx lost characters at power off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+commit 54ca955b5a4024e2ce0f206b03adb7109bc4da26 upstream.
+
+Commit c685af1108d7 ("serial: mvebu-uart: fix tx lost characters") fixed tx
+lost characters at low baud rates but started causing tx lost characters
+when kernel is going to power off or reboot.
+
+TX_EMP tells us when transmit queue is empty therefore all characters were
+transmitted. TX_RDY tells us when CPU can send a new character.
+
+Therefore we need to use different check prior transmitting new character
+and different check after all characters were sent.
+
+This patch splits polling code into two functions: wait_for_xmitr() which
+waits for TX_RDY and wait_for_xmite() which waits for TX_EMP.
+
+When rebooting A3720 platform without this patch on UART is print only:
+[ 42.699�
+
+And with this patch on UART is full output:
+[ 39.530216] reboot: Restarting system
+
+Fixes: c685af1108d7 ("serial: mvebu-uart: fix tx lost characters")
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201223191931.18343-1-pali@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/mvebu-uart.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -648,6 +648,14 @@ static void wait_for_xmitr(struct uart_p
+ (val & STAT_TX_RDY(port)), 1, 10000);
+ }
+
++static void wait_for_xmite(struct uart_port *port)
++{
++ u32 val;
++
++ readl_poll_timeout_atomic(port->membase + UART_STAT, val,
++ (val & STAT_TX_EMP), 1, 10000);
++}
++
+ static void mvebu_uart_console_putchar(struct uart_port *port, int ch)
+ {
+ wait_for_xmitr(port);
+@@ -675,7 +683,7 @@ static void mvebu_uart_console_write(str
+
+ uart_console_write(port, s, count, mvebu_uart_console_putchar);
+
+- wait_for_xmitr(port);
++ wait_for_xmite(port);
+
+ if (ier)
+ writel(ier, port->membase + UART_CTRL(port));
can-peak_usb-fix-use-after-free-bugs.patch
perf-evlist-fix-id-index-for-heterogeneous-systems.patch
i2c-sprd-depend-on-common_clk-to-fix-compile-tests.patch
+iio-common-st_sensors-fix-possible-infinite-loop-in-st_sensors_irq_thread.patch
+iio-ad5504-fix-setting-power-down-state.patch
+drivers-iio-temperature-add-delay-after-the-addressed-reset-command-in-mlx90632.c.patch
+iio-adc-ti_am335x_adc-remove-omitted-iio_kfifo_free.patch
+counter-ti-eqep-remove-floor.patch
+powerpc-64s-fix-scv-entry-fallback-flush-vs-interrupt.patch
+cifs-do-not-fail-__smb_send_rqst-if-non-fatal-signals-are-pending.patch
+irqchip-mips-cpu-set-ipi-domain-parent-chip.patch
+x86-mmx-use-kfpu_387-for-mmx-string-operations.patch
+x86-setup-don-t-remove-e820_type_ram-for-pfn-0.patch
+proc_sysctl-fix-oops-caused-by-incorrect-command-parameters.patch
+mm-fix-initialization-of-struct-page-for-holes-in-memory-layout.patch
+mm-memcg-slab-optimize-objcg-stock-draining.patch
+mm-memcg-fix-memcg-file_dirty-numa-stat.patch
+mm-fix-numa-stats-for-thp-migration.patch
+io_uring-iopoll-requests-should-also-wake-task-in_idle-state.patch
+io_uring-fix-sqpoll-ioring_op_close-cancelation-state.patch
+io_uring-fix-short-read-retries-for-non-reg-files.patch
+intel_th-pci-add-alder-lake-p-support.patch
+stm-class-fix-module-init-return-on-allocation-failure.patch
+serial-mvebu-uart-fix-tx-lost-characters-at-power-off.patch
+ehci-fix-ehci-host-controller-initialization-sequence.patch
+usb-ehci-fix-an-interrupt-calltrace-error.patch
+usb-gadget-aspeed-fix-stop-dma-register-setting.patch
+usb-gadget-dummy-hcd-fix-errors-in-port-reset-handling.patch
+usb-udc-core-use-lock-when-write-to-soft_connect.patch
+usb-bdc-make-bdc-pci-driver-depend-on-broken.patch
+usb-cdns3-imx-fix-writing-read-only-memory-issue.patch
+usb-cdns3-imx-fix-can-t-create-core-device-the-second-time-issue.patch
+xhci-make-sure-trb-is-fully-written-before-giving-it-to-the-controller.patch
+xhci-tegra-delay-for-disabling-lfps-detector.patch
+drivers-core-free-dma_range_map-when-driver-probe-failed.patch
+driver-core-fix-device-link-device-name-collision.patch
+driver-core-extend-device_is_dependent.patch
+drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch
+drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch
--- /dev/null
+From 927633a6d20af319d986f3e42c3ef9f6d7835008 Mon Sep 17 00:00:00 2001
+From: Wang Hui <john.wanghui@huawei.com>
+Date: Fri, 15 Jan 2021 22:59:16 +0300
+Subject: stm class: Fix module init return on allocation failure
+
+From: Wang Hui <john.wanghui@huawei.com>
+
+commit 927633a6d20af319d986f3e42c3ef9f6d7835008 upstream.
+
+In stm_heartbeat_init(): return value gets reset after the first
+iteration by stm_source_register_device(), so allocation failures
+after that will, after a clean up, return success. Fix that.
+
+Fixes: 119291853038 ("stm class: Add heartbeat stm source device")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hui <john.wanghui@huawei.com>
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115195917.3184-2-alexander.shishkin@linux.intel.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/heartbeat.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwtracing/stm/heartbeat.c
++++ b/drivers/hwtracing/stm/heartbeat.c
+@@ -64,7 +64,7 @@ static void stm_heartbeat_unlink(struct
+
+ static int stm_heartbeat_init(void)
+ {
+- int i, ret = -ENOMEM;
++ int i, ret;
+
+ if (nr_devs < 0 || nr_devs > STM_HEARTBEAT_MAX)
+ return -EINVAL;
+@@ -72,8 +72,10 @@ static int stm_heartbeat_init(void)
+ for (i = 0; i < nr_devs; i++) {
+ stm_heartbeat[i].data.name =
+ kasprintf(GFP_KERNEL, "heartbeat.%d", i);
+- if (!stm_heartbeat[i].data.name)
++ if (!stm_heartbeat[i].data.name) {
++ ret = -ENOMEM;
+ goto fail_unregister;
++ }
+
+ stm_heartbeat[i].data.nr_chans = 1;
+ stm_heartbeat[i].data.link = stm_heartbeat_link;
--- /dev/null
+From ef02684c4e67d8c35ac83083564135bc7b1d3445 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Mon, 18 Jan 2021 21:36:15 +0100
+Subject: usb: bdc: Make bdc pci driver depend on BROKEN
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit ef02684c4e67d8c35ac83083564135bc7b1d3445 upstream.
+
+The bdc pci driver is going to be removed due to it not existing in the
+wild. This patch turns off compilation of the driver so that stable
+kernels can also pick up the change. This helps the out-of-tree
+facetimehd webcam driver as the pci id conflicts with bdc.
+
+Cc: Al Cooper <alcooperx@gmail.com>
+Cc: <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://lore.kernel.org/r/20210118203615.13995-1-patrik.r.jakobsson@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/bdc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/bdc/Kconfig
++++ b/drivers/usb/gadget/udc/bdc/Kconfig
+@@ -17,7 +17,7 @@ if USB_BDC_UDC
+ comment "Platform Support"
+ config USB_BDC_PCI
+ tristate "BDC support for PCIe based platforms"
+- depends on USB_PCI
++ depends on USB_PCI && BROKEN
+ default USB_BDC_UDC
+ help
+ Enable support for platforms which have BDC connected through PCIe, such as Lego3 FPGA platform.
--- /dev/null
+From 2ef02b846ee2526249a562a66d6dcb25fcbca9d8 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Thu, 10 Dec 2020 21:31:37 +0800
+Subject: usb: cdns3: imx: fix can't create core device the second time issue
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 2ef02b846ee2526249a562a66d6dcb25fcbca9d8 upstream.
+
+The cdns3 core device is populated by calling of_platform_populate,
+the flag OF_POPULATED is set for core device node, if this flag
+is not cleared, when calling of_platform_populate the second time
+after loading parent module again, the OF code will not try to create
+platform device for core device.
+
+To fix it, it uses of_platform_depopulate to depopulate the core
+device which the parent created, and the flag OF_POPULATED for
+core device node will be cleared accordingly.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 1e056efab993 ("usb: cdns3: add NXP imx8qm glue layer")
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/cdns3-imx.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/usb/cdns3/cdns3-imx.c
++++ b/drivers/usb/cdns3/cdns3-imx.c
+@@ -218,20 +218,11 @@ err:
+ return ret;
+ }
+
+-static int cdns_imx_remove_core(struct device *dev, void *data)
+-{
+- struct platform_device *pdev = to_platform_device(dev);
+-
+- platform_device_unregister(pdev);
+-
+- return 0;
+-}
+-
+ static int cdns_imx_remove(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+
+- device_for_each_child(dev, NULL, cdns_imx_remove_core);
++ of_platform_depopulate(dev);
+ platform_set_drvdata(pdev, NULL);
+
+ return 0;
--- /dev/null
+From 92cbdb923c17544684c2dd3be9f8636617898a44 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Thu, 10 Dec 2020 21:31:36 +0800
+Subject: usb: cdns3: imx: fix writing read-only memory issue
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 92cbdb923c17544684c2dd3be9f8636617898a44 upstream.
+
+The memory for struct clk_bulk_data should not be static which will be written
+during the clk_bulk_get. It fixed below oops when loading cdns3-imx as module.
+
+[ 17.272605] Unable to handle kernel write to read-only memory at virtual address ffff8000092a5398
+[ 17.299730] Mem abort info:
+[ 17.313542] unregister ISI channel: mxc_isi.4
+[ 17.324076] ESR = 0x9600004f
+[ 17.344658] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 17.402055] SET = 0, FnV = 0
+[ 17.404321] mxs_phy 5b100000.usbphy: supply phy-3p0 not found, using dummy regulator
+[ 17.405121] EA = 0, S1PTW = 0
+[ 17.405133] Data abort info:
+[ 17.496231] ISV = 0, ISS = 0x0000004f
+[ 17.510871] CM = 0, WnR = 1
+[ 17.533542] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081ea5000
+[ 17.545709] [ffff8000092a5398] pgd=00000008bffff003, p4d=00000008bffff003, pud=00000008bfffe003, pmd=0000000885041003, pte=006000088513b783
+[ 17.573521] Internal error: Oops: 9600004f [#1] PREEMPT SMP
+[ 17.579113] Modules linked in: usbmisc_imx phy_mxs_usb phy_cadence_salvo cdns3_imx(+) tcpci imx8_media_dev(C) caam error
+[ 17.590044] CPU: 2 PID: 253 Comm: systemd-udevd Tainted: G C 5.10.0-rc4-04445-g11f3c3a29d0-dirty #19
+[ 17.600488] Hardware name: Freescale i.MX8QXP MEK (DT)
+[ 17.605633] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--)
+[ 17.611662] pc : __clk_bulk_get+0x48/0x130
+[ 17.615786] lr : clk_bulk_get+0x18/0x20
+[ 17.619634] sp : ffff80001369b880
+[ 17.622953] x29: ffff80001369b880 x28: 0000000000000013
+[ 17.628277] x27: 0000000000000100 x26: ffff00080553b100
+[ 17.633602] x25: ffff80001229b4d8 x24: 0000000000000000
+[ 17.638928] x23: ffff000800665410 x22: 0000000000000005
+[ 17.644275] x21: ffff8000092a5390 x20: ffff000800665400
+[ 17.649605] x19: ffff000804e6f980 x18: 000000005b110000
+[ 17.654946] x17: 0000000000000000 x16: 0000000000000000
+[ 17.660274] x15: ffff800011989100 x14: 0000000000000000
+[ 17.665599] x13: ffff800013ce1000 x12: ffff800013ca1000
+[ 17.670924] x11: 000000005b110000 x10: 0000000000000000
+[ 17.676249] x9 : ffff8000106c5a30 x8 : ffff000804e6fa00
+[ 17.681575] x7 : 0000000000000000 x6 : 000000000000003f
+[ 17.686901] x5 : 0000000000000040 x4 : ffff80001369b8b0
+[ 17.692228] x3 : ffff8000092a5398 x2 : ffff8000092a5390
+[ 17.697574] x1 : ffff8000092a53e8 x0 : 0000000000000004
+[ 17.702905] Call trace:
+[ 17.705366] __clk_bulk_get+0x48/0x130
+[ 17.709125] clk_bulk_get+0x18/0x20
+[ 17.712620] devm_clk_bulk_get+0x58/0xb8
+[ 17.716563] cdns_imx_probe+0x84/0x1f0 [cdns3_imx]
+[ 17.721363] platform_drv_probe+0x58/0xa8
+[ 17.725381] really_probe+0xec/0x4c8
+[ 17.728967] driver_probe_device+0xf4/0x160
+[ 17.733160] device_driver_attach+0x74/0x80
+[ 17.737355] __driver_attach+0xa4/0x170
+[ 17.741202] bus_for_each_dev+0x74/0xc8
+[ 17.745043] driver_attach+0x28/0x30
+[ 17.748620] bus_add_driver+0x144/0x228
+[ 17.752462] driver_register+0x68/0x118
+[ 17.756308] __platform_driver_register+0x4c/0x58
+[ 17.761022] cdns_imx_driver_init+0x24/0x1000 [cdns3_imx]
+[ 17.766434] do_one_initcall+0x48/0x2c0
+[ 17.770280] do_init_module+0x5c/0x220
+[ 17.774029] load_module+0x210c/0x2858
+[ 17.777784] __do_sys_finit_module+0xb8/0x120
+[ 17.782148] __arm64_sys_finit_module+0x24/0x30
+[ 17.786691] el0_svc_common.constprop.0+0x70/0x168
+[ 17.791497] do_el0_svc+0x28/0x88
+[ 17.794822] el0_sync_handler+0x158/0x160
+[ 17.798833] el0_sync+0x140/0x180
+[ 17.802158] Code: aa0203f5 91002043 8b205021 a90153f3 (f801047f)
+
+Cc: <stable@vger.kernel.org>
+Fixes: 1e056efab993 ("usb: cdns3: add NXP imx8qm glue layer")
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/cdns3-imx.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/cdns3/cdns3-imx.c
++++ b/drivers/usb/cdns3/cdns3-imx.c
+@@ -184,7 +184,11 @@ static int cdns_imx_probe(struct platfor
+ }
+
+ data->num_clks = ARRAY_SIZE(imx_cdns3_core_clks);
+- data->clks = (struct clk_bulk_data *)imx_cdns3_core_clks;
++ data->clks = devm_kmemdup(dev, imx_cdns3_core_clks,
++ sizeof(imx_cdns3_core_clks), GFP_KERNEL);
++ if (!data->clks)
++ return -ENOMEM;
++
+ ret = devm_clk_bulk_get(dev, data->num_clks, data->clks);
+ if (ret)
+ return ret;
--- /dev/null
+From 643a4df7fe3f6831d14536fd692be85f92670a52 Mon Sep 17 00:00:00 2001
+From: Longfang Liu <liulongfang@huawei.com>
+Date: Tue, 12 Jan 2021 09:57:27 +0800
+Subject: USB: ehci: fix an interrupt calltrace error
+
+From: Longfang Liu <liulongfang@huawei.com>
+
+commit 643a4df7fe3f6831d14536fd692be85f92670a52 upstream.
+
+The system that use Synopsys USB host controllers goes to suspend
+when using USB audio player. This causes the USB host controller
+continuous send interrupt signal to system, When the number of
+interrupts exceeds 100000, the system will forcibly close the
+interrupts and output a calltrace error.
+
+When the system goes to suspend, the last interrupt is reported to
+the driver. At this time, the system has set the state to suspend.
+This causes the last interrupt to not be processed by the system and
+not clear the interrupt flag. This uncleared interrupt flag constantly
+triggers new interrupt event. This causing the driver to receive more
+than 100,000 interrupts, which causes the system to forcibly close the
+interrupt report and report the calltrace error.
+
+so, when the driver goes to sleep and changes the system state to
+suspend, the interrupt flag needs to be cleared.
+
+Signed-off-by: Longfang Liu <liulongfang@huawei.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/1610416647-45774-1-git-send-email-liulongfang@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-hub.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -345,6 +345,9 @@ static int ehci_bus_suspend (struct usb_
+
+ unlink_empty_async_suspended(ehci);
+
++ /* Some Synopsys controllers mistakenly leave IAA turned on */
++ ehci_writel(ehci, STS_IAA, &ehci->regs->status);
++
+ /* Any IAA cycle that started before the suspend is now invalid */
+ end_iaa_cycle(ehci);
+ ehci_handle_start_intr_unlinks(ehci);
--- /dev/null
+From 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 Mon Sep 17 00:00:00 2001
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+Date: Fri, 8 Jan 2021 16:12:38 +0800
+Subject: usb: gadget: aspeed: fix stop dma register setting.
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+commit 4e0dcf62ab4cf917d0cbe751b8bf229a065248d4 upstream.
+
+The vhub engine has two dma mode, one is descriptor list, another
+is single stage DMA. Each mode has different stop register setting.
+Descriptor list operation (bit2) : 0 disable reset, 1: enable reset
+Single mode operation (bit0) : 0 : disable, 1: enable
+
+Fixes: 7ecca2a4080c ("usb/gadget: Add driver for Aspeed SoC virtual hub")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Acked-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://lore.kernel.org/r/20210108081238.10199-2-ryan_chen@aspeedtech.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/aspeed-vhub/epn.c
++++ b/drivers/usb/gadget/udc/aspeed-vhub/epn.c
+@@ -420,7 +420,10 @@ static void ast_vhub_stop_active_req(str
+ u32 state, reg, loops;
+
+ /* Stop DMA activity */
+- writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ if (ep->epn.desc_mode)
++ writel(VHUB_EP_DMA_CTRL_RESET, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
++ else
++ writel(0, ep->epn.regs + AST_VHUB_EP_DMA_CTLSTAT);
+
+ /* Wait for it to complete */
+ for (loops = 0; loops < 1000; loops++) {
--- /dev/null
+From 6e6aa61d81194c01283880950df563b1b9abec46 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 13 Jan 2021 14:45:10 -0500
+Subject: USB: gadget: dummy-hcd: Fix errors in port-reset handling
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6e6aa61d81194c01283880950df563b1b9abec46 upstream.
+
+Commit c318840fb2a4 ("USB: Gadget: dummy-hcd: Fix shift-out-of-bounds
+bug") messed up the way dummy-hcd handles requests to turn on the
+RESET port feature (I didn't notice that the original switch case
+ended with a fallthrough). The call to set_link_state() was
+inadvertently removed, as was the code to set the USB_PORT_STAT_RESET
+flag when the speed is USB2.
+
+In addition, the original code never checked whether the port was
+connected before handling the port-reset request. There was a check
+for the port being powered, but it was removed by that commit! In
+practice this doesn't matter much because the kernel doesn't try to
+reset disconnected ports, but it's still bad form.
+
+This patch fixes these problems by changing the fallthrough to break,
+adding back in the missing set_link_state() call, setting the
+port-reset status flag, adding a port-is-connected test, and removing
+a redundant assignment statement.
+
+Fixes: c318840fb2a4 ("USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug")
+CC: <stable@vger.kernel.org>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20210113194510.GA1290698@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/dummy_hcd.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -2266,17 +2266,20 @@ static int dummy_hub_control(
+ }
+ fallthrough;
+ case USB_PORT_FEAT_RESET:
++ if (!(dum_hcd->port_status & USB_PORT_STAT_CONNECTION))
++ break;
+ /* if it's already enabled, disable */
+ if (hcd->speed == HCD_USB3) {
+- dum_hcd->port_status = 0;
+ dum_hcd->port_status =
+ (USB_SS_PORT_STAT_POWER |
+ USB_PORT_STAT_CONNECTION |
+ USB_PORT_STAT_RESET);
+- } else
++ } else {
+ dum_hcd->port_status &= ~(USB_PORT_STAT_ENABLE
+ | USB_PORT_STAT_LOW_SPEED
+ | USB_PORT_STAT_HIGH_SPEED);
++ dum_hcd->port_status |= USB_PORT_STAT_RESET;
++ }
+ /*
+ * We want to reset device status. All but the
+ * Self powered feature
+@@ -2288,7 +2291,8 @@ static int dummy_hub_control(
+ * interval? Is it still 50msec as for HS?
+ */
+ dum_hcd->re_timeout = jiffies + msecs_to_jiffies(50);
+- fallthrough;
++ set_link_state(dum_hcd);
++ break;
+ case USB_PORT_FEAT_C_CONNECTION:
+ case USB_PORT_FEAT_C_RESET:
+ case USB_PORT_FEAT_C_ENABLE:
--- /dev/null
+From c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 14 Jan 2021 00:09:51 -0800
+Subject: usb: udc: core: Use lock when write to soft_connect
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit c28095bc99073ddda65e4f31f6ae0d908d4d5cd8 upstream.
+
+Use lock to guard against concurrent access for soft-connect/disconnect
+operations when writing to soft_connect sysfs.
+
+Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class")
+Cc: stable@vger.kernel.org
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/338ea01fbd69b1985ef58f0f59af02c805ddf189.1610611437.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/core.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -1532,10 +1532,13 @@ static ssize_t soft_connect_store(struct
+ struct device_attribute *attr, const char *buf, size_t n)
+ {
+ struct usb_udc *udc = container_of(dev, struct usb_udc, dev);
++ ssize_t ret;
+
++ mutex_lock(&udc_lock);
+ if (!udc->driver) {
+ dev_err(dev, "soft-connect without a gadget driver\n");
+- return -EOPNOTSUPP;
++ ret = -EOPNOTSUPP;
++ goto out;
+ }
+
+ if (sysfs_streq(buf, "connect")) {
+@@ -1546,10 +1549,14 @@ static ssize_t soft_connect_store(struct
+ usb_gadget_udc_stop(udc);
+ } else {
+ dev_err(dev, "unsupported command '%s'\n", buf);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out;
+ }
+
+- return n;
++ ret = n;
++out:
++ mutex_unlock(&udc_lock);
++ return ret;
+ }
+ static DEVICE_ATTR_WO(soft_connect);
+
--- /dev/null
+From 67de8dca50c027ca0fa3b62a488ee5035036a0da Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 20 Jan 2021 21:09:49 -0800
+Subject: x86/mmx: Use KFPU_387 for MMX string operations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 67de8dca50c027ca0fa3b62a488ee5035036a0da upstream.
+
+The default kernel_fpu_begin() doesn't work on systems that support XMM but
+haven't yet enabled CR4.OSFXSR. This causes crashes when _mmx_memcpy() is
+called too early because LDMXCSR generates #UD when the aforementioned bit
+is clear.
+
+Fix it by using kernel_fpu_begin_mask(KFPU_387) explicitly.
+
+Fixes: 7ad816762f9b ("x86/fpu: Reset MXCSR to default in kernel_fpu_begin()")
+Reported-by: Krzysztof Mazur <krzysiek@podlesie.net>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Krzysztof Piotr Olędzki <ole@ans.pl>
+Tested-by: Krzysztof Mazur <krzysiek@podlesie.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lkml.kernel.org/r/e7bf21855fe99e5f3baa27446e32623358f69e8d.1611205691.git.luto@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/lib/mmx_32.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/lib/mmx_32.c
++++ b/arch/x86/lib/mmx_32.c
+@@ -26,6 +26,16 @@
+ #include <asm/fpu/api.h>
+ #include <asm/asm.h>
+
++/*
++ * Use KFPU_387. MMX instructions are not affected by MXCSR,
++ * but both AMD and Intel documentation states that even integer MMX
++ * operations will result in #MF if an exception is pending in FCW.
++ *
++ * EMMS is not needed afterwards because, after calling kernel_fpu_end(),
++ * any subsequent user of the 387 stack will reinitialize it using
++ * KFPU_387.
++ */
++
+ void *_mmx_memcpy(void *to, const void *from, size_t len)
+ {
+ void *p;
+@@ -37,7 +47,7 @@ void *_mmx_memcpy(void *to, const void *
+ p = to;
+ i = len >> 6; /* len/64 */
+
+- kernel_fpu_begin();
++ kernel_fpu_begin_mask(KFPU_387);
+
+ __asm__ __volatile__ (
+ "1: prefetch (%0)\n" /* This set is 28 bytes */
+@@ -127,7 +137,7 @@ static void fast_clear_page(void *page)
+ {
+ int i;
+
+- kernel_fpu_begin();
++ kernel_fpu_begin_mask(KFPU_387);
+
+ __asm__ __volatile__ (
+ " pxor %%mm0, %%mm0\n" : :
+@@ -160,7 +170,7 @@ static void fast_copy_page(void *to, voi
+ {
+ int i;
+
+- kernel_fpu_begin();
++ kernel_fpu_begin_mask(KFPU_387);
+
+ /*
+ * maybe the prefetch stuff can go before the expensive fnsave...
+@@ -247,7 +257,7 @@ static void fast_clear_page(void *page)
+ {
+ int i;
+
+- kernel_fpu_begin();
++ kernel_fpu_begin_mask(KFPU_387);
+
+ __asm__ __volatile__ (
+ " pxor %%mm0, %%mm0\n" : :
+@@ -282,7 +292,7 @@ static void fast_copy_page(void *to, voi
+ {
+ int i;
+
+- kernel_fpu_begin();
++ kernel_fpu_begin_mask(KFPU_387);
+
+ __asm__ __volatile__ (
+ "1: prefetch (%0)\n"
--- /dev/null
+From bde9cfa3afe4324ec251e4af80ebf9b7afaf7afe Mon Sep 17 00:00:00 2001
+From: Mike Rapoport <rppt@kernel.org>
+Date: Sat, 23 Jan 2021 21:00:57 -0800
+Subject: x86/setup: don't remove E820_TYPE_RAM for pfn 0
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+commit bde9cfa3afe4324ec251e4af80ebf9b7afaf7afe upstream.
+
+Patch series "mm: fix initialization of struct page for holes in memory layout", v3.
+
+Commit 73a6e474cb37 ("mm: memmap_init: iterate over memblock regions
+rather that check each PFN") exposed several issues with the memory map
+initialization and these patches fix those issues.
+
+Initially there were crashes during compaction that Qian Cai reported
+back in April [1]. It seemed back then that the problem was fixed, but
+a few weeks ago Andrea Arcangeli hit the same bug [2] and there was an
+additional discussion at [3].
+
+[1] https://lore.kernel.org/lkml/8C537EB7-85EE-4DCF-943E-3CC0ED0DF56D@lca.pw
+[2] https://lore.kernel.org/lkml/20201121194506.13464-1-aarcange@redhat.com
+[3] https://lore.kernel.org/mm-commits/20201206005401.qKuAVgOXr%akpm@linux-foundation.org
+
+This patch (of 2):
+
+The first 4Kb of memory is a BIOS owned area and to avoid its allocation
+for the kernel it was not listed in e820 tables as memory. As the result,
+pfn 0 was never recognised by the generic memory management and it is not
+a part of neither node 0 nor ZONE_DMA.
+
+If set_pfnblock_flags_mask() would be ever called for the pageblock
+corresponding to the first 2Mbytes of memory, having pfn 0 outside of
+ZONE_DMA would trigger
+
+ VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);
+
+Along with reserving the first 4Kb in e820 tables, several first pages are
+reserved with memblock in several places during setup_arch(). These
+reservations are enough to ensure the kernel does not touch the BIOS area
+and it is not necessary to remove E820_TYPE_RAM for pfn 0.
+
+Remove the update of e820 table that changes the type of pfn 0 and move
+the comment describing why it was done to trim_low_memory_range() that
+reserves the beginning of the memory.
+
+Link: https://lkml.kernel.org/r/20210111194017.22696-2-rppt@kernel.org
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Qian Cai <cai@lca.pw>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/setup.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -666,17 +666,6 @@ static void __init trim_platform_memory_
+ static void __init trim_bios_range(void)
+ {
+ /*
+- * A special case is the first 4Kb of memory;
+- * This is a BIOS owned area, not kernel ram, but generally
+- * not listed as such in the E820 table.
+- *
+- * This typically reserves additional memory (64KiB by default)
+- * since some BIOSes are known to corrupt low memory. See the
+- * Kconfig help text for X86_RESERVE_LOW.
+- */
+- e820__range_update(0, PAGE_SIZE, E820_TYPE_RAM, E820_TYPE_RESERVED);
+-
+- /*
+ * special case: Some BIOSes report the PC BIOS
+ * area (640Kb -> 1Mb) as RAM even though it is not.
+ * take them out.
+@@ -733,6 +722,15 @@ early_param("reservelow", parse_reservel
+
+ static void __init trim_low_memory_range(void)
+ {
++ /*
++ * A special case is the first 4Kb of memory;
++ * This is a BIOS owned area, not kernel ram, but generally
++ * not listed as such in the E820 table.
++ *
++ * This typically reserves additional memory (64KiB by default)
++ * since some BIOSes are known to corrupt low memory. See the
++ * Kconfig help text for X86_RESERVE_LOW.
++ */
+ memblock_reserve(0, ALIGN(reserve_low, PAGE_SIZE));
+ }
+
--- /dev/null
+From 576667bad341516edc4e18eb85acb0a2b4c9c9d9 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Fri, 15 Jan 2021 18:19:06 +0200
+Subject: xhci: make sure TRB is fully written before giving it to the controller
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 576667bad341516edc4e18eb85acb0a2b4c9c9d9 upstream.
+
+Once the command ring doorbell is rung the xHC controller will parse all
+command TRBs on the command ring that have the cycle bit set properly.
+
+If the driver just started writing the next command TRB to the ring when
+hardware finished the previous TRB, then HW might fetch an incomplete TRB
+as long as its cycle bit set correctly.
+
+A command TRB is 16 bytes (128 bits) long.
+Driver writes the command TRB in four 32 bit chunks, with the chunk
+containing the cycle bit last. This does however not guarantee that
+chunks actually get written in that order.
+
+This was detected in stress testing when canceling URBs with several
+connected USB devices.
+Two consecutive "Set TR Dequeue pointer" commands got queued right
+after each other, and the second one was only partially written when
+the controller parsed it, causing the dequeue pointer to be set
+to bogus values. This was seen as error messages:
+
+"Mismatch between completed Set TR Deq Ptr command & xHCI internal state"
+
+Solution is to add a write memory barrier before writing the cycle bit.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Ross Zwisler <zwisler@google.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115161907.2875631-2-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-ring.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2930,6 +2930,8 @@ static void queue_trb(struct xhci_hcd *x
+ trb->field[0] = cpu_to_le32(field1);
+ trb->field[1] = cpu_to_le32(field2);
+ trb->field[2] = cpu_to_le32(field3);
++ /* make sure TRB is fully written before giving it to the controller */
++ wmb();
+ trb->field[3] = cpu_to_le32(field4);
+
+ trace_xhci_queue_trb(ring, trb);
--- /dev/null
+From da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb Mon Sep 17 00:00:00 2001
+From: JC Kuo <jckuo@nvidia.com>
+Date: Fri, 15 Jan 2021 18:19:07 +0200
+Subject: xhci: tegra: Delay for disabling LFPS detector
+
+From: JC Kuo <jckuo@nvidia.com>
+
+commit da7e0c3c2909a3d9bf8acfe1db3cb213bd7febfb upstream.
+
+Occasionally, we are seeing some SuperSpeed devices resumes right after
+being directed to U3. This commits add 500us delay to ensure LFPS
+detector is disabled before sending ACK to firmware.
+
+[ 16.099363] tegra-xusb 70090000.usb: entering ELPG
+[ 16.104343] tegra-xusb 70090000.usb: 2-1 isn't suspended: 0x0c001203
+[ 16.114576] tegra-xusb 70090000.usb: not all ports suspended: -16
+[ 16.120789] tegra-xusb 70090000.usb: entering ELPG failed
+
+The register write passes through a few flop stages of 32KHz clock domain.
+NVIDIA ASIC designer reviewed RTL and suggests 500us delay.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: JC Kuo <jckuo@nvidia.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115161907.2875631-3-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-tegra.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -623,6 +623,13 @@ static void tegra_xusb_mbox_handle(struc
+ enable);
+ if (err < 0)
+ break;
++
++ /*
++ * wait 500us for LFPS detector to be disabled before
++ * sending ACK
++ */
++ if (!enable)
++ usleep_range(500, 1000);
+ }
+
+ if (err < 0) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
