--- /dev/null
+From 124570163e83b53f65719694f73773356530fe2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:14 +0530
+Subject: ALSA: hda: Fix 2 channel swapping for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 216116eae43963c662eb84729507bad95214ca6b ]
+
+The Tegra HDA codec HW implementation has an issue related to not
+swapping the 2 channel Audio Sample Packet(ASP) channel mapping.
+Whatever the FL and FR mapping specified the left channel always
+comes out of left speaker and right channel on right speaker. So
+add condition to disallow the swapping of FL,FR during the playback.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-2-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index fc22bdc30da3e..bde3b3a169eb2 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3671,6 +3671,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)
+
+ static int patch_tegra_hdmi(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec;
+ int err;
+
+ err = patch_generic_hdmi(codec);
+@@ -3678,6 +3679,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ return err;
+
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
++ spec = codec->spec;
++ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
++ nvhdmi_chmap_cea_alloc_validate_get_type;
++ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4b14507b687d1ee01e077bef3ef8904734590d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:18 +0300
+Subject: ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is
+ disabled
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]
+
+In snd_hdac_device_init pm_runtime_set_active is called to
+increase child_count in parent device. But when it is failed
+to build connection with GPU for one case that integrated
+graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be
+invoked to clean up a HD-audio extended codec base device. At
+this time the child_count of parent is not decreased, which
+makes parent device can't get suspended.
+
+This patch calls pm_runtime_set_suspended to decrease child_count
+in parent device in snd_hdac_device_exit to match with
+snd_hdac_device_init. pm_runtime_set_suspended can make sure that
+it will not decrease child_count if the device is already suspended.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154218.1440441-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index 333220f0f8afc..3e9e9ac804f62 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -127,6 +127,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
+ void snd_hdac_device_exit(struct hdac_device *codec)
+ {
+ pm_runtime_put_noidle(&codec->dev);
++ /* keep balance of runtime PM child_count in parent device */
++ pm_runtime_set_suspended(&codec->dev);
+ snd_hdac_bus_remove_device(codec->bus, codec);
+ kfree(codec->vendor_name);
+ kfree(codec->chip_name);
+--
+2.25.1
+
--- /dev/null
+From 6b64bff421c6535ce4a5705fa3746ee8d5d44fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:07 +0300
+Subject: ALSA: hda: hdmi - add Rocketlake support
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit f804a324a41a880c1ab43cc5145d8b3e5790430d ]
+
+Add Rocketlake HDMI codec support. Rocketlake shares
+the pin-to-port mapping table with Tigerlake.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154207.1440393-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index bde3b3a169eb2..419f012b9853c 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -4205,6 +4205,7 @@ HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI", patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI", patch_i915_tgl_hdmi),
++HDA_CODEC_ENTRY(0x80862816, "Rocketlake HDMI", patch_i915_tgl_hdmi),
+ HDA_CODEC_ENTRY(0x8086281a, "Jasperlake HDMI", patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x8086281b, "Elkhartlake HDMI", patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
+--
+2.25.1
+
--- /dev/null
+From 8c8ab501dde5fd49c01acd4e20963ae323ceb0ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:15 +0530
+Subject: ALSA: hda/tegra: Program WAKEEN register for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 23d63a31d9f44d7daeac0d1fb65c6a73c70e5216 ]
+
+The WAKEEN bits are used to indicate which bits in the
+STATESTS register may cause wake event during the codec
+state change request. Configure the WAKEEN register for
+the Tegra to detect the wake events.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-3-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_tegra.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index 0cc5fad1af8a9..ae40ca3f29837 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -179,6 +179,10 @@ static int __maybe_unused hda_tegra_runtime_suspend(struct device *dev)
+ struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
+
+ if (chip && chip->running) {
++ /* enable controller wake up event */
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) |
++ STATESTS_INT_MASK);
++
+ azx_stop_chip(chip);
+ azx_enter_link_reset(chip);
+ }
+@@ -200,6 +204,9 @@ static int __maybe_unused hda_tegra_runtime_resume(struct device *dev)
+ if (chip && chip->running) {
+ hda_tegra_init(hda);
+ azx_init_chip(chip, 1);
++ /* disable controller wake up event*/
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
++ ~STATESTS_INT_MASK);
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From ecd373634b8399bce5ce39fe79cfbf524f042a19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:50 +0300
+Subject: ALSA: hda: use consistent HDAudio spelling in comments/docs
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit b79de57b4378a93115307be6962d05b099eb0f37 ]
+
+We use HDaudio and HDAudio, pick one to make searches easier.
+No functionality change
+
+Also fix timestamping typo in documentation.
+
+Reported-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154250.1440585-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/sound/designs/timestamping.rst | 2 +-
+ sound/hda/intel-dsp-config.c | 10 +++++-----
+ sound/x86/Kconfig | 2 +-
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/Documentation/sound/designs/timestamping.rst b/Documentation/sound/designs/timestamping.rst
+index 2b0fff5034151..7c7ecf5dbc4bd 100644
+--- a/Documentation/sound/designs/timestamping.rst
++++ b/Documentation/sound/designs/timestamping.rst
+@@ -143,7 +143,7 @@ timestamp shows when the information is put together by the driver
+ before returning from the ``STATUS`` and ``STATUS_EXT`` ioctl. in most cases
+ this driver_timestamp will be identical to the regular system tstamp.
+
+-Examples of typestamping with HDaudio:
++Examples of timestamping with HDAudio:
+
+ 1. DMA timestamp, no compensation for DMA+analog delay
+ ::
+diff --git a/sound/hda/intel-dsp-config.c b/sound/hda/intel-dsp-config.c
+index 99aec73491676..1c5114dedda92 100644
+--- a/sound/hda/intel-dsp-config.c
++++ b/sound/hda/intel-dsp-config.c
+@@ -54,7 +54,7 @@ static const struct config_entry config_table[] = {
+ #endif
+ /*
+ * Apollolake (Broxton-P)
+- * the legacy HDaudio driver is used except on Up Squared (SOF) and
++ * the legacy HDAudio driver is used except on Up Squared (SOF) and
+ * Chromebooks (SST)
+ */
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_APOLLOLAKE)
+@@ -89,7 +89,7 @@ static const struct config_entry config_table[] = {
+ },
+ #endif
+ /*
+- * Skylake and Kabylake use legacy HDaudio driver except for Google
++ * Skylake and Kabylake use legacy HDAudio driver except for Google
+ * Chromebooks (SST)
+ */
+
+@@ -135,7 +135,7 @@ static const struct config_entry config_table[] = {
+ #endif
+
+ /*
+- * Geminilake uses legacy HDaudio driver except for Google
++ * Geminilake uses legacy HDAudio driver except for Google
+ * Chromebooks
+ */
+ /* Geminilake */
+@@ -157,7 +157,7 @@ static const struct config_entry config_table[] = {
+
+ /*
+ * CoffeeLake, CannonLake, CometLake, IceLake, TigerLake use legacy
+- * HDaudio driver except for Google Chromebooks and when DMICs are
++ * HDAudio driver except for Google Chromebooks and when DMICs are
+ * present. Two cases are required since Coreboot does not expose NHLT
+ * tables.
+ *
+@@ -391,7 +391,7 @@ int snd_intel_dsp_driver_probe(struct pci_dev *pci)
+ if (pci->class == 0x040300)
+ return SND_INTEL_DSP_DRIVER_LEGACY;
+ if (pci->class != 0x040100 && pci->class != 0x040380) {
+- dev_err(&pci->dev, "Unknown PCI class/subclass/prog-if information (0x%06x) found, selecting HDA legacy driver\n", pci->class);
++ dev_err(&pci->dev, "Unknown PCI class/subclass/prog-if information (0x%06x) found, selecting HDAudio legacy driver\n", pci->class);
+ return SND_INTEL_DSP_DRIVER_LEGACY;
+ }
+
+diff --git a/sound/x86/Kconfig b/sound/x86/Kconfig
+index 77777192f6508..4ffcc5e623c22 100644
+--- a/sound/x86/Kconfig
++++ b/sound/x86/Kconfig
+@@ -9,7 +9,7 @@ menuconfig SND_X86
+ if SND_X86
+
+ config HDMI_LPE_AUDIO
+- tristate "HDMI audio without HDaudio on Intel Atom platforms"
++ tristate "HDMI audio without HDAudio on Intel Atom platforms"
+ depends on DRM_I915
+ select SND_PCM
+ help
+--
+2.25.1
+
--- /dev/null
+From 1da609b522acc71ccffa4f50e59857c2aad16a2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 19:52:32 -0700
+Subject: ARC: HSDK: wireup perf irq
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit fe81d927b78c4f0557836661d32e41ebc957b024 ]
+
+Newer version of HSDK aka HSDK-4xD (with dual issue HS48x4 CPU) wired up
+the perf interrupt, so enable that in DT.
+This is OK for old HSDK where this irq is ignored because pct irq is not
+wired up in hardware.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 9acbeba832c0b..5d64a5a940ee6 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -88,6 +88,8 @@
+
+ arcpct: pct {
+ compatible = "snps,archs-pct";
++ interrupt-parent = <&cpu_intc>;
++ interrupts = <20>;
+ };
+
+ /* TIMER0 with interrupt for clockevent */
+--
+2.25.1
+
--- /dev/null
+From 052ffead9c22dea7a12fc869020aa917735c8740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 18:38:58 +0300
+Subject: ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id
+
+From: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+
+[ Upstream commit 26907eb605fbc3ba9dbf888f21d9d8d04471271d ]
+
+HSDK board has Micrel KSZ9031, recent commit
+bcf3440c6dd ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
+caused a breakdown of Ethernet.
+Using 'phy-mode = "rgmii"' is not correct because accodring RGMII
+specification it is necessary to have delay on RX (PHY to MAX)
+which is not generated in case of "rgmii".
+Using "rgmii-id" adds necessary delay and solves the issue.
+
+Also adding name of PHY placed on HSDK board.
+
+Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 5d64a5a940ee6..dcaa44e408ace 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -210,7 +210,7 @@
+ reg = <0x8000 0x2000>;
+ interrupts = <10>;
+ interrupt-names = "macirq";
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ snps,pbl = <32>;
+ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+@@ -228,7 +228,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+- phy0: ethernet-phy@0 {
++ phy0: ethernet-phy@0 { /* Micrel KSZ9031 */
+ reg = <0>;
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 2598a73928a5a6c5c1143a9ed5c77d52fa2ca34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Aug 2020 21:29:28 -0700
+Subject: ARC: show_regs: fix r12 printing and simplify
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit e5c388b4b967037a0e00b60194b0dbcf94881a9b ]
+
+when working on ARC64, spotted an issue in ARCv2 reg file printing.
+print_reg_file() assumes contiguous reg-file whereas in ARCv2 they are
+not: r12 comes before r0-r11 due to hardware auto-save. Apparently this
+issue has been present since v2 port submission.
+
+To avoid bolting hacks for this discontinuity while looping through
+pt_regs, just ditching the loop and print pt_regs directly.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/troubleshoot.c | 77 +++++++++++++---------------------
+ 1 file changed, 30 insertions(+), 47 deletions(-)
+
+diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c
+index 28e8bf04b253f..a331bb5d8319f 100644
+--- a/arch/arc/kernel/troubleshoot.c
++++ b/arch/arc/kernel/troubleshoot.c
+@@ -18,44 +18,37 @@
+
+ #define ARC_PATH_MAX 256
+
+-/*
+- * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25)
+- * -Prints 3 regs per line and a CR.
+- * -To continue, callee regs right after scratch, special handling of CR
+- */
+-static noinline void print_reg_file(long *reg_rev, int start_num)
++static noinline void print_regs_scratch(struct pt_regs *regs)
+ {
+- unsigned int i;
+- char buf[512];
+- int n = 0, len = sizeof(buf);
+-
+- for (i = start_num; i < start_num + 13; i++) {
+- n += scnprintf(buf + n, len - n, "r%02u: 0x%08lx\t",
+- i, (unsigned long)*reg_rev);
+-
+- if (((i + 1) % 3) == 0)
+- n += scnprintf(buf + n, len - n, "\n");
+-
+- /* because pt_regs has regs reversed: r12..r0, r25..r13 */
+- if (is_isa_arcv2() && start_num == 0)
+- reg_rev++;
+- else
+- reg_rev--;
+- }
+-
+- if (start_num != 0)
+- n += scnprintf(buf + n, len - n, "\n\n");
++ pr_cont("BTA: 0x%08lx\n SP: 0x%08lx FP: 0x%08lx BLK: %pS\n",
++ regs->bta, regs->sp, regs->fp, (void *)regs->blink);
++ pr_cont("LPS: 0x%08lx\tLPE: 0x%08lx\tLPC: 0x%08lx\n",
++ regs->lp_start, regs->lp_end, regs->lp_count);
+
+- /* To continue printing callee regs on same line as scratch regs */
+- if (start_num == 0)
+- pr_info("%s", buf);
+- else
+- pr_cont("%s\n", buf);
++ pr_info("r00: 0x%08lx\tr01: 0x%08lx\tr02: 0x%08lx\n" \
++ "r03: 0x%08lx\tr04: 0x%08lx\tr05: 0x%08lx\n" \
++ "r06: 0x%08lx\tr07: 0x%08lx\tr08: 0x%08lx\n" \
++ "r09: 0x%08lx\tr10: 0x%08lx\tr11: 0x%08lx\n" \
++ "r12: 0x%08lx\t",
++ regs->r0, regs->r1, regs->r2,
++ regs->r3, regs->r4, regs->r5,
++ regs->r6, regs->r7, regs->r8,
++ regs->r9, regs->r10, regs->r11,
++ regs->r12);
+ }
+
+-static void show_callee_regs(struct callee_regs *cregs)
++static void print_regs_callee(struct callee_regs *regs)
+ {
+- print_reg_file(&(cregs->r13), 13);
++ pr_cont("r13: 0x%08lx\tr14: 0x%08lx\n" \
++ "r15: 0x%08lx\tr16: 0x%08lx\tr17: 0x%08lx\n" \
++ "r18: 0x%08lx\tr19: 0x%08lx\tr20: 0x%08lx\n" \
++ "r21: 0x%08lx\tr22: 0x%08lx\tr23: 0x%08lx\n" \
++ "r24: 0x%08lx\tr25: 0x%08lx\n",
++ regs->r13, regs->r14,
++ regs->r15, regs->r16, regs->r17,
++ regs->r18, regs->r19, regs->r20,
++ regs->r21, regs->r22, regs->r23,
++ regs->r24, regs->r25);
+ }
+
+ static void print_task_path_n_nm(struct task_struct *tsk)
+@@ -175,7 +168,7 @@ static void show_ecr_verbose(struct pt_regs *regs)
+ void show_regs(struct pt_regs *regs)
+ {
+ struct task_struct *tsk = current;
+- struct callee_regs *cregs;
++ struct callee_regs *cregs = (struct callee_regs *)tsk->thread.callee_reg;
+
+ /*
+ * generic code calls us with preemption disabled, but some calls
+@@ -204,25 +197,15 @@ void show_regs(struct pt_regs *regs)
+ STS_BIT(regs, A2), STS_BIT(regs, A1),
+ STS_BIT(regs, E2), STS_BIT(regs, E1));
+ #else
+- pr_cont(" [%2s%2s%2s%2s]",
++ pr_cont(" [%2s%2s%2s%2s] ",
+ STS_BIT(regs, IE),
+ (regs->status32 & STATUS_U_MASK) ? "U " : "K ",
+ STS_BIT(regs, DE), STS_BIT(regs, AE));
+ #endif
+- pr_cont(" BTA: 0x%08lx\n SP: 0x%08lx FP: 0x%08lx BLK: %pS\n",
+- regs->bta, regs->sp, regs->fp, (void *)regs->blink);
+- pr_info("LPS: 0x%08lx\tLPE: 0x%08lx\tLPC: 0x%08lx\n",
+- regs->lp_start, regs->lp_end, regs->lp_count);
+-
+- /* print regs->r0 thru regs->r12
+- * Sequential printing was generating horrible code
+- */
+- print_reg_file(&(regs->r0), 0);
+
+- /* If Callee regs were saved, display them too */
+- cregs = (struct callee_regs *)current->thread.callee_reg;
++ print_regs_scratch(regs);
+ if (cregs)
+- show_callee_regs(cregs);
++ print_regs_callee(cregs);
+
+ preempt_disable();
+ }
+--
+2.25.1
+
--- /dev/null
+From d2813f197ff9a9f669ffd23411c097fa3df30f48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:43:41 -0700
+Subject: ARM: dts: bcm: HR2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d663186293a818af97c648624bee6c7a59e8218b ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index 5e5f5ca3c86f1..bba0e8cd2acbd 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -217,7 +217,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From a42bf5ad72d9e09c8820167f3510e39fe0c1e004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:45:29 -0700
+Subject: ARM: dts: BCM5301X: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit b793dab8d811e103665d6bddaaea1c25db3776eb ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 1c8f40650723 ("ARM: dts: BCM5301X: convert to iProc QSPI")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 2d9b4dd058307..0016720ce5300 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -488,7 +488,7 @@
+ };
+
+ spi@18029200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x18029200 0x184>,
+ <0x18029000 0x124>,
+ <0x1811b408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 901d286bf50dcbb9f7eccce9ff8ef3bf9e476eb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Sep 2020 18:05:21 +0800
+Subject: ARM: dts: imx6sx: fix the pad QSPI1B_SCLK mux mode for uart3
+
+From: Fugang Duan <fugang.duan@nxp.com>
+
+[ Upstream commit 3ee99f6a2379eca87ab11122b7e9abd68f3441e2 ]
+
+The pad QSPI1B_SCLK mux mode 0x1 is for function UART3_DTE_TX,
+correct the mux mode.
+
+Fixes: 743636f25f1d ("ARM: dts: imx: add pin function header for imx6sx")
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sx-pinfunc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6sx-pinfunc.h b/arch/arm/boot/dts/imx6sx-pinfunc.h
+index 0b02c7e60c174..f4dc46207954c 100644
+--- a/arch/arm/boot/dts/imx6sx-pinfunc.h
++++ b/arch/arm/boot/dts/imx6sx-pinfunc.h
+@@ -1026,7 +1026,7 @@
+ #define MX6SX_PAD_QSPI1B_DQS__SIM_M_HADDR_15 0x01B0 0x04F8 0x0000 0x7 0x0
+ #define MX6SX_PAD_QSPI1B_SCLK__QSPI1_B_SCLK 0x01B4 0x04FC 0x0000 0x0 0x0
+ #define MX6SX_PAD_QSPI1B_SCLK__UART3_DCE_RX 0x01B4 0x04FC 0x0840 0x1 0x4
+-#define MX6SX_PAD_QSPI1B_SCLK__UART3_DTE_TX 0x01B4 0x04FC 0x0000 0x0 0x0
++#define MX6SX_PAD_QSPI1B_SCLK__UART3_DTE_TX 0x01B4 0x04FC 0x0000 0x1 0x0
+ #define MX6SX_PAD_QSPI1B_SCLK__ECSPI3_SCLK 0x01B4 0x04FC 0x0730 0x2 0x1
+ #define MX6SX_PAD_QSPI1B_SCLK__ESAI_RX_HF_CLK 0x01B4 0x04FC 0x0780 0x3 0x2
+ #define MX6SX_PAD_QSPI1B_SCLK__CSI1_DATA_16 0x01B4 0x04FC 0x06DC 0x4 0x1
+--
+2.25.1
+
--- /dev/null
+From 5a8a184759343937ea86c65fa436b2c8d2069e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Aug 2020 19:25:05 -0700
+Subject: ARM: dts: imx7d-zii-rmu2: fix rgmii phy-mode for ksz9031 phy
+
+From: Chris Healy <cphealy@gmail.com>
+
+[ Upstream commit 5cbb80d5236b47b149da292b86d5fc99a680894b ]
+
+Since commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY") the networking is broken on the imx7d-zii-rmu2 board.
+
+The end result is that network receive behaviour is marginal with lots of
+RX CRC errors experienced and NFS frequently failing.
+
+Quoting the explanation from Andrew Lunn in commit 0672d22a19244
+("ARM: dts: imx: Fix the AR803X phy-mode"):
+
+"The problem here is, all the DTs were broken since day 0. However,
+because the PHY driver was also broken, nobody noticed and it
+worked. Now that the PHY driver has been fixed, all the bugs in the
+DTs now become an issue"
+
+Fix it by switching to phy-mode = "rgmii-id".
+
+Fixes: bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
+Signed-off-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-zii-rmu2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-zii-rmu2.dts b/arch/arm/boot/dts/imx7d-zii-rmu2.dts
+index e5e20b07f184b..7cb6153fc650b 100644
+--- a/arch/arm/boot/dts/imx7d-zii-rmu2.dts
++++ b/arch/arm/boot/dts/imx7d-zii-rmu2.dts
+@@ -58,7 +58,7 @@
+ <&clks IMX7D_ENET1_TIME_ROOT_CLK>;
+ assigned-clock-parents = <&clks IMX7D_PLL_ENET_MAIN_100M_CLK>;
+ assigned-clock-rates = <0>, <100000000>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&fec1_phy>;
+ status = "okay";
+
+--
+2.25.1
+
--- /dev/null
+From 85a5c9131b2ed899256e2aaa8380026c1abe7e24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:01:24 +0800
+Subject: ARM: dts: imx7ulp: Correct gpio ranges
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit deb6323b739c54e1a1e83cd3a2bae4901e3eebf6 ]
+
+Correct gpio ranges according to i.MX7ULP pinctrl driver:
+
+gpio_ptc: ONLY pin 0~19 are available;
+gpio_ptd: ONLY pin 0~11 are available;
+gpio_pte: ONLY pin 0~15 are available;
+gpio_ptf: ONLY pin 0~19 are available;
+
+Fixes: 20434dc92c05 ("ARM: dts: imx: add common imx7ulp dtsi support")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7ulp.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7ulp.dtsi b/arch/arm/boot/dts/imx7ulp.dtsi
+index f7c4878534c8e..1bff3efe8aafe 100644
+--- a/arch/arm/boot/dts/imx7ulp.dtsi
++++ b/arch/arm/boot/dts/imx7ulp.dtsi
+@@ -394,7 +394,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLC>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 0 32>;
++ gpio-ranges = <&iomuxc1 0 0 20>;
+ };
+
+ gpio_ptd: gpio@40af0000 {
+@@ -408,7 +408,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLD>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 32 32>;
++ gpio-ranges = <&iomuxc1 0 32 12>;
+ };
+
+ gpio_pte: gpio@40b00000 {
+@@ -422,7 +422,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLE>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 64 32>;
++ gpio-ranges = <&iomuxc1 0 64 16>;
+ };
+
+ gpio_ptf: gpio@40b10000 {
+@@ -436,7 +436,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLF>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 96 32>;
++ gpio-ranges = <&iomuxc1 0 96 20>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 741c22a702fabf03b1cd0da20da36cdbd38c9796 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:53:38 -0500
+Subject: ARM: dts: logicpd-som-lv-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 4d26e9a028e3d88223e06fa133c3d55af7ddbceb ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree but never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 5cb8b0fa55a9 ("ARM: dts: Move most of logicpd-som-lv-37xx-devkit.dts to logicpd-som-lv-baseboard.dtsi")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 100396f6c2feb..c310c33ca6f3f 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -51,6 +51,8 @@
+
+ &mcbsp2 {
+ status = "okay";
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ };
+
+ &charger {
+--
+2.25.1
+
--- /dev/null
+From 785855caf7f152ac0441dd18cfe7e9ec4ae23584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:24:41 -0500
+Subject: ARM: dts: logicpd-som-lv-baseboard: Fix missing video
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d1db7b80a6c8c5f81db0e80664d29b374750e2c6 ]
+
+A previous commit removed the panel-dpi driver, which made the
+SOM-LV video stop working because it relied on the DPI driver
+for setting video timings. Now that the simple-panel driver is
+available in omap2plus, this patch migrates the SOM-LV dev kits
+to use a similar panel and remove the manual timing requirements.
+A similar patch was already done and applied to the Torpedo family.
+
+Fixes: 8bf4b1621178 ("drm/omap: Remove panel-dpi driver")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/logicpd-som-lv-baseboard.dtsi | 27 ++++---------------
+ 1 file changed, 5 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index c310c33ca6f3f..395e05f10d36c 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -104,35 +104,18 @@
+ regulator-max-microvolt = <3300000>;
+ };
+
+- lcd0: display@0 {
+- compatible = "panel-dpi";
+- label = "28";
+- status = "okay";
+- /* default-on; */
++ lcd0: display {
++ /* This isn't the exact LCD, but the timings meet spec */
++ compatible = "logicpd,type28";
+ pinctrl-names = "default";
+ pinctrl-0 = <&lcd_enable_pin>;
+- enable-gpios = <&gpio5 27 GPIO_ACTIVE_HIGH>; /* gpio155, lcd INI */
++ backlight = <&bl>;
++ enable-gpios = <&gpio5 27 GPIO_ACTIVE_HIGH>;
+ port {
+ lcd_in: endpoint {
+ remote-endpoint = <&dpi_out>;
+ };
+ };
+-
+- panel-timing {
+- clock-frequency = <9000000>;
+- hactive = <480>;
+- vactive = <272>;
+- hfront-porch = <3>;
+- hback-porch = <2>;
+- hsync-len = <42>;
+- vback-porch = <3>;
+- vfront-porch = <2>;
+- vsync-len = <11>;
+- hsync-active = <1>;
+- vsync-active = <1>;
+- de-active = <1>;
+- pixelclk-active = <0>;
+- };
+ };
+
+ bl: backlight {
+--
+2.25.1
+
--- /dev/null
+From 9a2a1bb2a57ab2933e649bd9972249ba4cc41980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2020 21:56:10 -0500
+Subject: ARM: dts: logicpd-torpedo-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d7dfee67688ac7f2dfd4c3bc70c053ee990c40b5 ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree, they were never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 739f85bba5ab ("ARM: dts: Move most of logicpd-torpedo-37xx-devkit to logicpd-torpedo-baseboard")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+index 381f0e82bb706..b0f6613e6d549 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+@@ -81,6 +81,8 @@
+ };
+
+ &mcbsp2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ status = "okay";
+ };
+
+--
+2.25.1
+
--- /dev/null
+From a539b17d2c82a09b01e33e4ceb17c12b9a356a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 12:50:06 +0200
+Subject: ARM: dts: ls1021a: fix QuadSPI-memory reg range
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 81dbbb417da4d1ac407dca5b434d39d5b6b91ef3 ]
+
+According to the Reference Manual, the correct size is 512 MiB.
+
+Without this fix, probing the QSPI fails:
+
+ fsl-quadspi 1550000.spi: ioremap failed for resource
+ [mem 0x40000000-0x7fffffff]
+ fsl-quadspi 1550000.spi: Freescale QuadSPI probe failed
+ fsl-quadspi: probe of 1550000.spi failed with error -12
+
+Fixes: 85f8ee78ab72 ("ARM: dts: ls1021a: Add support for QSPI with ls1021a SoC")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index b2ff27af090ec..9435ce527e855 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -181,7 +181,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x0 0x1550000 0x0 0x10000>,
+- <0x0 0x40000000 0x0 0x40000000>;
++ <0x0 0x40000000 0x0 0x20000000>;
+ reg-names = "QuadSPI", "QuadSPI-memory";
+ interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "qspi_en", "qspi";
+--
+2.25.1
+
--- /dev/null
+From 686ef3e42608605ede51589f373293dd49dc9776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:44:25 -0700
+Subject: ARM: dts: NSP: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d1ecc40a954fd0f5e3789b91fa80f15e82284e39 ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 329f98c1974e ("ARM: dts: NSP: Add QSPI nodes to NSPI and bcm958625k DTSes")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 3175266ede646..465937b79c8e4 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -284,7 +284,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 61fe958c464a396fc05a23bf26c50a028163fffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 10:51:00 +0100
+Subject: ARM: dts: omap5: Fix DSI base address and clocks
+
+From: David Shah <dave@ds0.me>
+
+[ Upstream commit 6542e2b613c2b1952e83973dc434831332ce8e27 ]
+
+DSI was not probing due to base address off by 0x1000, and sys_clk
+missing.
+
+With this patch, the Pyra display works if HDMI is disabled in the
+device tree.
+
+Fixes: 5a507162f096 ("ARM: dts: Configure interconnect target module for omap5 dsi1")
+Signed-off-by: David Shah <dave@ds0.me>
+Tested-by: H. Nikolaus Schaller <hns@goldelico.com>
+[tony@atomide.com: standardized subject line, added fixes tag]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap5.dtsi | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
+index fb889c5b00c9d..de55ac5e60f39 100644
+--- a/arch/arm/boot/dts/omap5.dtsi
++++ b/arch/arm/boot/dts/omap5.dtsi
+@@ -463,11 +463,11 @@
+ };
+ };
+
+- target-module@5000 {
++ target-module@4000 {
+ compatible = "ti,sysc-omap2", "ti,sysc";
+- reg = <0x5000 0x4>,
+- <0x5010 0x4>,
+- <0x5014 0x4>;
++ reg = <0x4000 0x4>,
++ <0x4010 0x4>,
++ <0x4014 0x4>;
+ reg-names = "rev", "sysc", "syss";
+ ti,sysc-sidle = <SYSC_IDLE_FORCE>,
+ <SYSC_IDLE_NO>,
+@@ -479,7 +479,7 @@
+ ti,syss-mask = <1>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+- ranges = <0 0x5000 0x1000>;
++ ranges = <0 0x4000 0x1000>;
+
+ dsi1: encoder@0 {
+ compatible = "ti,omap5-dsi";
+@@ -489,8 +489,9 @@
+ reg-names = "proto", "phy", "pll";
+ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+- clocks = <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 8>;
+- clock-names = "fck";
++ clocks = <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 8>,
++ <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 10>;
++ clock-names = "fck", "sys_clk";
+ };
+ };
+
+@@ -520,8 +521,9 @@
+ reg-names = "proto", "phy", "pll";
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+- clocks = <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 8>;
+- clock-names = "fck";
++ clocks = <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 8>,
++ <&dss_clkctrl OMAP5_DSS_CORE_CLKCTRL 10>;
++ clock-names = "fck", "sys_clk";
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From aaa78dc9ed795fd9eeada1eacaa053d2edd1005d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 10:26:40 -0500
+Subject: ARM: dts: socfpga: fix register entry for timer3 on Arria10
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]
+
+Fixes the register address for the timer3 entry on Arria10.
+
+Fixes: 475dc86d08de4 ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index 8f614c4b0e3eb..9c71472c237bd 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -819,7 +819,7 @@
+ timer3: timer3@ffd00100 {
+ compatible = "snps,dw-apb-timer";
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0xffd01000 0x100>;
++ reg = <0xffd00100 0x100>;
+ clocks = <&l4_sys_free_clk>;
+ clock-names = "timer";
+ resets = <&rst L4SYSTIMER1_RESET>;
+--
+2.25.1
+
--- /dev/null
+From f03b6fa653b98c65536b12f8b7597aee9d300147 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 11:54:30 +0800
+Subject: ARM: OMAP2+: Fix an IS_ERR() vs NULL check in _get_pwrdm()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit a58cfdba2039ff2d5758840e97a23a2dedecf1e8 ]
+
+The of_clk_get() function returns error pointers, it never returns NULL.
+
+Fixes: 4ea3711aece4 ("ARM: OMAP2+: omap-iommu.c conversion to ti-sysc")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap-iommu.c b/arch/arm/mach-omap2/omap-iommu.c
+index 54aff33e55e6e..bfa5e1b8dba7f 100644
+--- a/arch/arm/mach-omap2/omap-iommu.c
++++ b/arch/arm/mach-omap2/omap-iommu.c
+@@ -74,7 +74,7 @@ static struct powerdomain *_get_pwrdm(struct device *dev)
+ return pwrdm;
+
+ clk = of_clk_get(dev->of_node->parent, 0);
+- if (!clk) {
++ if (IS_ERR(clk)) {
+ dev_err(dev, "no fck found\n");
+ return NULL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 824387f5ca6f8affc8c9cd04e17ccd4dfb1a6537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 14:25:31 -0600
+Subject: arm64: dts: imx: Add missing imx8mm-beacon-kit.dtb to build
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 56e79dfd036b538940227fb31371c1cd67b2467f ]
+
+The imx8mm-beacon-kit.dtb was never added to dtbs-y and wasn't getting
+built. Fix it.
+
+Fixes: 593816fa2f35 ("arm64: dts: imx: Add Beacon i.MX8m-Mini development kit")
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/Makefile b/arch/arm64/boot/dts/freescale/Makefile
+index a39f0a1723e02..903c0eb61290d 100644
+--- a/arch/arm64/boot/dts/freescale/Makefile
++++ b/arch/arm64/boot/dts/freescale/Makefile
+@@ -28,6 +28,7 @@ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2160a-honeycomb.dtb
+ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2160a-qds.dtb
+ dtb-$(CONFIG_ARCH_LAYERSCAPE) += fsl-lx2160a-rdb.dtb
+
++dtb-$(CONFIG_ARCH_MXC) += imx8mm-beacon-kit.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-evk.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mn-evk.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mn-ddr4-evk.dtb
+--
+2.25.1
+
--- /dev/null
+From d9ee9d7bf012203e49152d68f44ab5dc9660da49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Aug 2020 13:12:48 +0200
+Subject: arm64: dts: imx8mq: Fix TMU interrupt property
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1f2f98f2703e8134678fe20982886085631eda23 ]
+
+"interrupt" is not a valid property. Using proper name fixes dtbs_check
+warning:
+
+ arch/arm64/boot/dts/freescale/imx8mq-zii-ultra-zest.dt.yaml: tmu@30260000: 'interrupts' is a required property
+
+Fixes: e464fd2ba4d4 ("arm64: dts: imx8mq: enable the multi sensor TMU")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+index 978f8122c0d2c..66ac66856e7e8 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+@@ -420,7 +420,7 @@
+ tmu: tmu@30260000 {
+ compatible = "fsl,imx8mq-tmu";
+ reg = <0x30260000 0x10000>;
+- interrupt = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MQ_CLK_TMU_ROOT>;
+ little-endian;
+ fsl,tmu-range = <0xb0000 0xa0026 0x80048 0x70061>;
+--
+2.25.1
+
--- /dev/null
+From f5a3cf1408c72c2764ffc3427551fa19a84cd7a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:49:19 -0700
+Subject: arm64: dts: ns2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 686e0a0c8c61e0e3f55321d0181fece3efd92777 ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: ff73917d38a6 ("ARM64: dts: Add QSPI Device Tree node for NS2")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 15f7b0ed38369..39802066232e1 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -745,7 +745,7 @@
+ };
+
+ qspi: spi@66470200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-ns2-qspi";
++ compatible = "brcm,spi-ns2-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x66470200 0x184>,
+ <0x66470000 0x124>,
+ <0x67017408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 90783ed67fe1925177981196abb0fbcbfaadd448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 18:00:16 +0200
+Subject: arm64/module: set trampoline section flags regardless of
+ CONFIG_DYNAMIC_FTRACE
+
+From: Jessica Yu <jeyu@kernel.org>
+
+[ Upstream commit e0328feda79d9681b3e3245e6e180295550c8ee9 ]
+
+In the arm64 module linker script, the section .text.ftrace_trampoline
+is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
+is enabled (this is simply due to the limitation that module linker
+scripts are not preprocessed like the vmlinux one).
+
+Normally, for .plt and .text.ftrace_trampoline, the section flags
+present in the module binary wouldn't matter since module_frob_arch_sections()
+would assign them manually anyway. However, the arm64 module loader only
+sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
+That's only become problematic recently due to a recent change in
+binutils-2.35, where the .text.ftrace_trampoline section (along with the
+.plt section) is now marked writable and executable (WAX).
+
+We no longer allow writable and executable sections to be loaded due to
+commit 5c3a7db0c7ec ("module: Harden STRICT_MODULE_RWX"), so this is
+causing all modules linked with binutils-2.35 to be rejected under arm64.
+Drop the IS_ENABLED(CONFIG_DYNAMIC_FTRACE) check in module_frob_arch_sections()
+so that the section flags for .text.ftrace_trampoline get properly set to
+SHF_EXECINSTR|SHF_ALLOC, without SHF_WRITE.
+
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Acked-by: Will Deacon <will@kernel.org>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Link: http://lore.kernel.org/r/20200831094651.GA16385@linux-8ccs
+Link: https://lore.kernel.org/r/20200901160016.3646-1-jeyu@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/module-plts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
+index 65b08a74aec65..37c0b51a7b7b5 100644
+--- a/arch/arm64/kernel/module-plts.c
++++ b/arch/arm64/kernel/module-plts.c
+@@ -271,8 +271,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ mod->arch.core.plt_shndx = i;
+ else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
+ mod->arch.init.plt_shndx = i;
+- else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
+- !strcmp(secstrings + sechdrs[i].sh_name,
++ else if (!strcmp(secstrings + sechdrs[i].sh_name,
+ ".text.ftrace_trampoline"))
+ tramp = sechdrs + i;
+ else if (sechdrs[i].sh_type == SHT_SYMTAB)
+--
+2.25.1
+
--- /dev/null
+From 10b34a18180269103dafc68f1a4257ae61c87415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 16:15:06 +0200
+Subject: block: restore a specific error code in bdev_del_partition
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 88ce2a530cc9865a894454b2e40eba5957a60e1a ]
+
+mdadm relies on the fact that deleting an invalid partition returns
+-ENXIO or -ENOTTY to detect if a block device is a partition or a
+whole device.
+
+Fixes: 08fc1ab6d748 ("block: fix locking in bdev_del_partition")
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/partitions/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/partitions/core.c b/block/partitions/core.c
+index 534e11285a8d4..b45539764c994 100644
+--- a/block/partitions/core.c
++++ b/block/partitions/core.c
+@@ -529,7 +529,7 @@ int bdev_del_partition(struct block_device *bdev, int partno)
+
+ bdevp = bdget_disk(bdev->bd_disk, partno);
+ if (!bdevp)
+- return -ENOMEM;
++ return -ENXIO;
+
+ mutex_lock(&bdevp->bd_mutex);
+ mutex_lock_nested(&bdev->bd_mutex, 1);
+--
+2.25.1
+
--- /dev/null
+From fae0d157e03ef0f3c52b99597415d80d0999b2e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 08:44:25 +0530
+Subject: block: Set same_page to false in __bio_try_merge_page if ret is false
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit 2cd896a5e86fc326bda8614b96c0401dcc145868 ]
+
+If we hit the UINT_MAX limit of bio->bi_iter.bi_size and so we are anyway
+not merging this page in this bio, then it make sense to make same_page
+also as false before returning.
+
+Without this patch, we hit below WARNING in iomap.
+This mostly happens with very large memory system and / or after tweaking
+vm dirty threshold params to delay writeback of dirty data.
+
+WARNING: CPU: 18 PID: 5130 at fs/iomap/buffered-io.c:74 iomap_page_release+0x120/0x150
+ CPU: 18 PID: 5130 Comm: fio Kdump: loaded Tainted: G W 5.8.0-rc3 #6
+ Call Trace:
+ __remove_mapping+0x154/0x320 (unreliable)
+ iomap_releasepage+0x80/0x180
+ try_to_release_page+0x94/0xe0
+ invalidate_inode_page+0xc8/0x110
+ invalidate_mapping_pages+0x1dc/0x540
+ generic_fadvise+0x3c8/0x450
+ xfs_file_fadvise+0x2c/0xe0 [xfs]
+ vfs_fadvise+0x3c/0x60
+ ksys_fadvise64_64+0x68/0xe0
+ sys_fadvise64+0x28/0x40
+ system_call_exception+0xf8/0x1c0
+ system_call_common+0xf0/0x278
+
+Fixes: cc90bc68422 ("block: fix "check bi_size overflow before merge"")
+Reported-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index b1883adc8f154..eac129f21d2df 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -877,8 +877,10 @@ bool __bio_try_merge_page(struct bio *bio, struct page *page,
+ struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1];
+
+ if (page_is_mergeable(bv, page, len, off, same_page)) {
+- if (bio->bi_iter.bi_size > UINT_MAX - len)
++ if (bio->bi_iter.bi_size > UINT_MAX - len) {
++ *same_page = false;
+ return false;
++ }
+ bv->bv_len += len;
+ bio->bi_iter.bi_size += len;
+ return true;
+--
+2.25.1
+
--- /dev/null
+From 7272babb7172420758b0089a57c767f77b4701ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 17:22:57 +0100
+Subject: btrfs: fix NULL pointer dereference after failure to create snapshot
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 2d892ccdc163a3d2e08c5ed1cea8b61bf7e4f531 ]
+
+When trying to get a new fs root for a snapshot during the transaction
+at transaction.c:create_pending_snapshot(), if btrfs_get_new_fs_root()
+fails we leave "pending->snap" pointing to an error pointer, and then
+later at ioctl.c:create_snapshot() we dereference that pointer, resulting
+in a crash:
+
+ [12264.614689] BUG: kernel NULL pointer dereference, address: 00000000000007c4
+ [12264.615650] #PF: supervisor write access in kernel mode
+ [12264.616487] #PF: error_code(0x0002) - not-present page
+ [12264.617436] PGD 0 P4D 0
+ [12264.618328] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
+ [12264.619150] CPU: 0 PID: 2310635 Comm: fsstress Tainted: G W 5.9.0-rc3-btrfs-next-67 #1
+ [12264.619960] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ [12264.621769] RIP: 0010:btrfs_mksubvol+0x438/0x4a0 [btrfs]
+ [12264.622528] Code: bc ef ff ff (...)
+ [12264.624092] RSP: 0018:ffffaa6fc7277cd8 EFLAGS: 00010282
+ [12264.624669] RAX: 00000000fffffff4 RBX: ffff9d3e8f151a60 RCX: 0000000000000000
+ [12264.625249] RDX: 0000000000000001 RSI: ffffffff9d56c9be RDI: fffffffffffffff4
+ [12264.625830] RBP: ffff9d3e8f151b48 R08: 0000000000000000 R09: 0000000000000000
+ [12264.626413] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff4
+ [12264.626994] R13: ffff9d3ede380538 R14: ffff9d3ede380500 R15: ffff9d3f61b2eeb8
+ [12264.627582] FS: 00007f140d5d8200(0000) GS:ffff9d3fb5e00000(0000) knlGS:0000000000000000
+ [12264.628176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [12264.628773] CR2: 00000000000007c4 CR3: 000000020f8e8004 CR4: 00000000003706f0
+ [12264.629379] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [12264.629994] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [12264.630594] Call Trace:
+ [12264.631227] btrfs_mksnapshot+0x7b/0xb0 [btrfs]
+ [12264.631840] __btrfs_ioctl_snap_create+0x16f/0x1a0 [btrfs]
+ [12264.632458] btrfs_ioctl_snap_create_v2+0xb0/0xf0 [btrfs]
+ [12264.633078] btrfs_ioctl+0x1864/0x3130 [btrfs]
+ [12264.633689] ? do_sys_openat2+0x1a7/0x2d0
+ [12264.634295] ? kmem_cache_free+0x147/0x3a0
+ [12264.634899] ? __x64_sys_ioctl+0x83/0xb0
+ [12264.635488] __x64_sys_ioctl+0x83/0xb0
+ [12264.636058] do_syscall_64+0x33/0x80
+ [12264.636616] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ (gdb) list *(btrfs_mksubvol+0x438)
+ 0x7c7b8 is in btrfs_mksubvol (fs/btrfs/ioctl.c:858).
+ 853 ret = 0;
+ 854 pending_snapshot->anon_dev = 0;
+ 855 fail:
+ 856 /* Prevent double freeing of anon_dev */
+ 857 if (ret && pending_snapshot->snap)
+ 858 pending_snapshot->snap->anon_dev = 0;
+ 859 btrfs_put_root(pending_snapshot->snap);
+ 860 btrfs_subvolume_release_metadata(root, &pending_snapshot->block_rsv);
+ 861 free_pending:
+ 862 if (pending_snapshot->anon_dev)
+
+So fix this by setting "pending->snap" to NULL if we get an error from the
+call to btrfs_get_new_fs_root() at transaction.c:create_pending_snapshot().
+
+Fixes: 2dfb1e43f57dd3 ("btrfs: preallocate anon block device at first phase of snapshot creation")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/transaction.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 2710f8ddb95fb..b43ebf55b93e1 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1636,6 +1636,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
+ pending->snap = btrfs_get_new_fs_root(fs_info, objectid, pending->anon_dev);
+ if (IS_ERR(pending->snap)) {
+ ret = PTR_ERR(pending->snap);
++ pending->snap = NULL;
+ btrfs_abort_transaction(trans, ret);
+ goto fail;
+ }
+--
+2.25.1
+
--- /dev/null
+From 159d3e6623e90b2d579042eb478d7eaecdec51c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 13:52:01 -0700
+Subject: cfg80211: Adjust 6 GHz frequency to channel conversion
+
+From: Amar Singhal <asinghal@codeaurora.org>
+
+[ Upstream commit 2d9b55508556ccee6410310fb9ea2482fd3328eb ]
+
+Adjust the 6 GHz frequency to channel conversion function,
+the other way around was previously handled.
+
+Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
+Link: https://lore.kernel.org/r/1592599921-10607-1-git-send-email-asinghal@codeaurora.org
+[rewrite commit message, hard-code channel 2]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/util.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 4d3b76f94f55e..a72d2ad6ade8b 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -121,11 +121,13 @@ int ieee80211_freq_khz_to_channel(u32 freq)
+ return (freq - 2407) / 5;
+ else if (freq >= 4910 && freq <= 4980)
+ return (freq - 4000) / 5;
+- else if (freq < 5945)
++ else if (freq < 5925)
+ return (freq - 5000) / 5;
++ else if (freq == 5935)
++ return 2;
+ else if (freq <= 45000) /* DMG band lower limit */
+- /* see 802.11ax D4.1 27.3.22.2 */
+- return (freq - 5940) / 5;
++ /* see 802.11ax D6.1 27.3.22.2 */
++ return (freq - 5950) / 5;
+ else if (freq >= 58320 && freq <= 70200)
+ return (freq - 56160) / 2160;
+ else
+--
+2.25.1
+
--- /dev/null
+From ac25d6e15e01cfa6451b3fadf0060459322e3af6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 20:02:50 -0700
+Subject: cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo
+ disabled
+
+From: Francisco Jerez <currojerez@riseup.net>
+
+[ Upstream commit eacc9c5a927e474c173a5d53dd7fb8e306511768 ]
+
+This fixes the behavior of the scaling_max_freq and scaling_min_freq
+sysfs files in systems which had turbo disabled by the BIOS.
+
+Caleb noticed that the HWP is programmed to operate in the wrong
+P-state range on his system when the CPUFREQ policy min/max frequency
+is set via sysfs. This seems to be because in his system
+intel_pstate_get_hwp_max() is returning the maximum turbo P-state even
+though turbo was disabled by the BIOS, which causes intel_pstate to
+scale kHz frequencies incorrectly e.g. setting the maximum turbo
+frequency whenever the maximum guaranteed frequency is requested via
+sysfs.
+
+Tested-by: Caleb Callaway <caleb.callaway@intel.com>
+Signed-off-by: Francisco Jerez <currojerez@riseup.net>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+[ rjw: Minor subject edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 97ed4fd0f1342..36a469150ff9c 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -762,7 +762,7 @@ static void intel_pstate_get_hwp_max(unsigned int cpu, int *phy_max,
+
+ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
+ WRITE_ONCE(all_cpu_data[cpu]->hwp_cap_cached, cap);
+- if (global.no_turbo)
++ if (global.no_turbo || global.turbo_disabled)
+ *current_max = HWP_GUARANTEED_PERF(cap);
+ else
+ *current_max = HWP_HIGHEST_PERF(cap);
+--
+2.25.1
+
--- /dev/null
+From cae590f63013bdb9ebb3440622598a8933335ae2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 17:40:02 +0200
+Subject: cpufreq: intel_pstate: Refuse to turn off with HWP enabled
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43298db3009f06fe5c69e1ca8b6cfc2565772fa1 ]
+
+After commit f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive
+mode with HWP enabled") it is possible to change the driver status
+to "off" via sysfs with HWP enabled, which effectively causes the
+driver to unregister itself, but HWP remains active and it forces the
+minimum performance, so even if another cpufreq driver is loaded,
+it will not be able to control the CPU frequency.
+
+For this reason, make the driver refuse to change the status to
+"off" with HWP enabled.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 8c730a47e0537..97ed4fd0f1342 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2534,9 +2534,15 @@ static int intel_pstate_update_status(const char *buf, size_t size)
+ {
+ int ret;
+
+- if (size == 3 && !strncmp(buf, "off", size))
+- return intel_pstate_driver ?
+- intel_pstate_unregister_driver() : -EINVAL;
++ if (size == 3 && !strncmp(buf, "off", size)) {
++ if (!intel_pstate_driver)
++ return -EINVAL;
++
++ if (hwp_active)
++ return -EBUSY;
++
++ return intel_pstate_unregister_driver();
++ }
+
+ if (size == 6 && !strncmp(buf, "active", size)) {
+ if (intel_pstate_driver) {
+--
+2.25.1
+
--- /dev/null
+From ea303170d96d2a5ece3d0e31d9d239686e5340b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 17:54:21 +0800
+Subject: dmaengine: acpi: Put the CSRT table after using it
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 7eb48dd094de5fe0e216b550e73aa85257903973 ]
+
+The acpi_get_table() should be coupled with acpi_put_table() if
+the mapped table is not used at runtime to release the table
+mapping, put the CSRT table buf after using it.
+
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1595411661-15936-1-git-send-email-guohanjun@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/acpi-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
+index 8a05db3343d39..dcbcb712de6e8 100644
+--- a/drivers/dma/acpi-dma.c
++++ b/drivers/dma/acpi-dma.c
+@@ -135,11 +135,13 @@ static void acpi_dma_parse_csrt(struct acpi_device *adev, struct acpi_dma *adma)
+ if (ret < 0) {
+ dev_warn(&adev->dev,
+ "error in parsing resource group\n");
+- return;
++ break;
+ }
+
+ grp = (struct acpi_csrt_group *)((void *)grp + grp->length);
+ }
++
++ acpi_put_table((struct acpi_table_header *)csrt);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 38df82d0f1159f0ff8e0f8e9fa7c23fb6fa74bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 09:14:23 +0530
+Subject: drivers/dma/dma-jz4780: Fix race condition between probe and irq
+ handler
+
+From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+
+[ Upstream commit 6d6018fc30bee67290dbed2fa51123f7c6f3d691 ]
+
+In probe, IRQ is requested before zchan->id is initialized which can be
+read in the irq handler. Hence, shift request irq after other initializations
+complete.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+Reviewed-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://lore.kernel.org/r/20200821034423.12713-1-madhuparnabhowmik10@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 448f663da89c6..8beed91428bd6 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -879,24 +879,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- ret = platform_get_irq(pdev, 0);
+- if (ret < 0)
+- return ret;
+-
+- jzdma->irq = ret;
+-
+- ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
+- jzdma);
+- if (ret) {
+- dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
+- return ret;
+- }
+-
+ jzdma->clk = devm_clk_get(dev, NULL);
+ if (IS_ERR(jzdma->clk)) {
+ dev_err(dev, "failed to get clock\n");
+ ret = PTR_ERR(jzdma->clk);
+- goto err_free_irq;
++ return ret;
+ }
+
+ clk_prepare_enable(jzdma->clk);
+@@ -949,10 +936,23 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ jzchan->vchan.desc_free = jz4780_dma_desc_free;
+ }
+
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_disable_clk;
++
++ jzdma->irq = ret;
++
++ ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
++ jzdma);
++ if (ret) {
++ dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
++ goto err_disable_clk;
++ }
++
+ ret = dmaenginem_async_device_register(dd);
+ if (ret) {
+ dev_err(dev, "failed to register device\n");
+- goto err_disable_clk;
++ goto err_free_irq;
+ }
+
+ /* Register with OF DMA helpers. */
+@@ -960,17 +960,17 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ jzdma);
+ if (ret) {
+ dev_err(dev, "failed to register OF DMA controller\n");
+- goto err_disable_clk;
++ goto err_free_irq;
+ }
+
+ dev_info(dev, "JZ4780 DMA controller initialised\n");
+ return 0;
+
+-err_disable_clk:
+- clk_disable_unprepare(jzdma->clk);
+-
+ err_free_irq:
+ free_irq(jzdma->irq, jzdma);
++
++err_disable_clk:
++ clk_disable_unprepare(jzdma->clk);
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 751093a5c099696a6d632117edd0bd6dbd3a9504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 05:07:06 -0700
+Subject: drivers/net/wan/hdlc: Change the default of hard_header_len to 0
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 2b7bcd967a0f5b7ac9bb0c37b92de36e073dd119 ]
+
+Change the default value of hard_header_len in hdlc.c from 16 to 0.
+
+Currently there are 6 HDLC protocol drivers, among them:
+
+hdlc_raw_eth, hdlc_cisco, hdlc_ppp, hdlc_x25 set hard_header_len when
+attaching the protocol, overriding the default. So this patch does not
+affect them.
+
+hdlc_raw and hdlc_fr don't set hard_header_len when attaching the
+protocol. So this patch will change the hard_header_len of the HDLC
+device for them from 16 to 0.
+
+This is the correct change because both hdlc_raw and hdlc_fr don't have
+header_ops, and the code in net/packet/af_packet.c expects the value of
+hard_header_len to be consistent with header_ops.
+
+In net/packet/af_packet.c, in the packet_snd function,
+for AF_PACKET/DGRAM sockets it would reserve a headroom of
+hard_header_len and call dev_hard_header to fill in that headroom,
+and for AF_PACKET/RAW sockets, it does not reserve the headroom and
+does not call dev_hard_header, but checks if the user has provided a
+header of length hard_header_len (in function dev_validate_header).
+
+Cc: Krzysztof Halasa <khc@pm.waw.pl>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
+index 386ed2aa31fd9..9b00708676cf7 100644
+--- a/drivers/net/wan/hdlc.c
++++ b/drivers/net/wan/hdlc.c
+@@ -229,7 +229,7 @@ static void hdlc_setup_dev(struct net_device *dev)
+ dev->min_mtu = 68;
+ dev->max_mtu = HDLC_MAX_MTU;
+ dev->type = ARPHRD_RAWHDLC;
+- dev->hard_header_len = 16;
++ dev->hard_header_len = 0;
+ dev->needed_headroom = 0;
+ dev->addr_len = 0;
+ dev->header_ops = &hdlc_null_ops;
+--
+2.25.1
+
--- /dev/null
+From a2c51a8ee99eb4ba0c8387ebfb396c985d946c72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 00:07:52 -0700
+Subject: drivers/net/wan/hdlc_cisco: Add hard_header_len
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]
+
+This driver didn't set hard_header_len. This patch sets hard_header_len
+for it according to its header_ops->create function.
+
+This driver's header_ops->create function (cisco_hard_header) creates
+a header of (struct hdlc_header), so hard_header_len should be set to
+sizeof(struct hdlc_header).
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_cisco.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index d8cba3625c185..444130655d8ea 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -370,6 +370,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
+ memcpy(&state(hdlc)->settings, &new_settings, size);
+ spin_lock_init(&state(hdlc)->lock);
+ dev->header_ops = &cisco_header_ops;
++ dev->hard_header_len = sizeof(struct hdlc_header);
+ dev->type = ARPHRD_CISCO;
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_on(dev);
+--
+2.25.1
+
--- /dev/null
+From 7b4a41f98af07f05e9f7f7eb3e81cebf89820f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 14:26:59 -0700
+Subject: drivers/net/wan/lapbether: Added needed_tailroom
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]
+
+The underlying Ethernet device may request necessary tailroom to be
+allocated by setting needed_tailroom. This driver should also set
+needed_tailroom to request the tailroom needed by the underlying
+Ethernet device to be allocated.
+
+Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 1ea15f2123ed5..cc297ea9c6ece 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -340,6 +340,7 @@ static int lapbeth_new_device(struct net_device *dev)
+ */
+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+ + dev->needed_headroom;
++ ndev->needed_tailroom = dev->needed_tailroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+--
+2.25.1
+
--- /dev/null
+From 83f8fa160e5f1d79059ac62f757b770d9d1e2d54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 20:03:53 -0700
+Subject: drivers/net/wan/lapbether: Set network_header before transmitting
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]
+
+Set the skb's network_header before it is passed to the underlying
+Ethernet device for transmission.
+
+This patch fixes the following issue:
+
+When we use this driver with AF_PACKET sockets, there would be error
+messages of:
+ protocol 0805 is buggy, dev (Ethernet interface name)
+printed in the system "dmesg" log.
+
+This is because skbs passed down to the Ethernet device for transmission
+don't have their network_header properly set, and the dev_queue_xmit_nit
+function in net/core/dev.c complains about this.
+
+Reason of setting the network_header to this place (at the end of the
+Ethernet header, and at the beginning of the Ethernet payload):
+
+Because when this driver receives an skb from the Ethernet device, the
+network_header is also set at this place.
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index cc297ea9c6ece..e61616b0b91c7 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -210,6 +210,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb_reset_network_header(skb);
++
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+
+ dev_queue_xmit(skb);
+--
+2.25.1
+
--- /dev/null
+From 73e0fbdb4f66f93505920bad1e5bff08bf672685 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 18:43:37 +0530
+Subject: drm/amdgpu: Fix bug in reporting voltage for CIK
+
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+
+[ Upstream commit d98299885c9ea140c1108545186593deba36c4ac ]
+
+On my R9 390, the voltage was reported as a constant 1000 mV.
+This was due to a bug in smu7_hwmgr.c, in the smu7_read_sensor()
+function, where some magic constants were used in a condition,
+to determine whether the voltage should be read from PLANE2_VID
+or PLANE1_VID. The VDDC mask was incorrectly used, instead of
+the VDDGFX mask.
+
+This patch changes the code to use the correct defined constants
+(and apply the correct bitshift), thus resulting in correct voltage reporting.
+
+Signed-off-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 753cb2cf6b77e..3adf9c1dfdbb0 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3587,7 +3587,8 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx,
+ case AMDGPU_PP_SENSOR_GPU_POWER:
+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value);
+ case AMDGPU_PP_SENSOR_VDDGFX:
+- if ((data->vr_config & 0xff) == 0x2)
++ if ((data->vr_config & VRCONF_VDDGFX_MASK) ==
++ (VR_SVI2_PLANE_2 << VRCONF_VDDGFX_SHIFT))
+ val_vid = PHM_READ_INDIRECT_FIELD(hwmgr->device,
+ CGS_IND_REG__SMC, PWR_SVI2_STATUS, PLANE2_VID);
+ else
+--
+2.25.1
+
--- /dev/null
+From b4d64d78cd0c0e6fb716f02028d799482a6468f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 09:08:26 +0800
+Subject: drm/sun4i: add missing put_device() call in
+ sun8i_r40_tcon_tv_set_mux()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 07b5b12d97dc9f47ff3dff46c4f944a15bd762e5 ]
+
+If sun8i_r40_tcon_tv_set_mux() succeed, sun8i_r40_tcon_tv_set_mux()
+doesn't have a corresponding put_device(). Thus add put_device()
+to fix the exception handling for this function implementation.
+
+Fixes: 0305189afb32 ("drm/sun4i: tcon: Add support for R40 TCON")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200826010826.1785487-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 359b56e43b83c..24d95f058918c 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -1433,14 +1433,18 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon,
+ if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP) &&
+ encoder->encoder_type == DRM_MODE_ENCODER_TMDS) {
+ ret = sun8i_tcon_top_set_hdmi_src(&pdev->dev, id);
+- if (ret)
++ if (ret) {
++ put_device(&pdev->dev);
+ return ret;
++ }
+ }
+
+ if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP)) {
+ ret = sun8i_tcon_top_de_config(&pdev->dev, tcon->id, id);
+- if (ret)
++ if (ret) {
++ put_device(&pdev->dev);
+ return ret;
++ }
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 292f57465af2b9b900f9523ea2b6e7211a183d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:48:10 +0200
+Subject: drm/sun4i: backend: Disable alpha on the lowest plane on the A20
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 5e2e2600a3744491a8b49b92597c13b693692082 ]
+
+Unlike we previously thought, the per-pixel alpha is just as broken on the
+A20 as it is on the A10. Remove the quirk that says we can use it.
+
+Fixes: dcf496a6a608 ("drm/sun4i: sun4i: Introduce a quirk for lowest plane alpha support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200728134810.883457-2-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index 30672c4c634da..ed5d866178028 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -994,7 +994,6 @@ static const struct sun4i_backend_quirks sun6i_backend_quirks = {
+
+ static const struct sun4i_backend_quirks sun7i_backend_quirks = {
+ .needs_output_muxing = true,
+- .supports_lowest_plane_alpha = true,
+ };
+
+ static const struct sun4i_backend_quirks sun8i_a33_backend_quirks = {
+--
+2.25.1
+
--- /dev/null
+From aaddc210f21513fc064bb13454eb830eab630f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:48:09 +0200
+Subject: drm/sun4i: backend: Support alpha property on lowest plane
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit e359c70462d2a82aae80274d027351d38792dde6 ]
+
+Unlike what we previously thought, only the per-pixel alpha is broken on
+the lowest plane and the per-plane alpha isn't. Remove the check on the
+alpha property being set on the lowest plane to reject a mode.
+
+Fixes: dcf496a6a608 ("drm/sun4i: sun4i: Introduce a quirk for lowest plane alpha support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200728134810.883457-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index 072ea113e6be5..30672c4c634da 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -589,8 +589,7 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
+
+ /* We can't have an alpha plane at the lowest position */
+ if (!backend->quirks->supports_lowest_plane_alpha &&
+- (plane_states[0]->fb->format->has_alpha ||
+- (plane_states[0]->alpha != DRM_BLEND_ALPHA_OPAQUE)))
++ (plane_states[0]->alpha != DRM_BLEND_ALPHA_OPAQUE))
+ return -EINVAL;
+
+ for (i = 1; i < num_planes; i++) {
+--
+2.25.1
+
--- /dev/null
+From 93e1441ba8aa373d78d468664797a7fb8e3dc9c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 00:03:05 +0200
+Subject: drm/sun4i: Fix DE2 YVU handling
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 0ee9f600e69d901d31469359287b90bbe8e54553 ]
+
+Function sun8i_vi_layer_get_csc_mode() is supposed to return CSC mode
+but due to inproper return type (bool instead of u32) it returns just 0
+or 1. Colors are wrong for YVU formats because of that.
+
+Fixes: daab3d0e8e2b ("drm/sun4i: de2: csc_mode in de2 format struct is mostly redundant")
+Reported-by: Roman Stratiienko <r.stratiienko@gmail.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Tested-by: Roman Stratiienko <r.stratiienko@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200901220305.6809-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+index 22c8c5375d0db..c0147af6a8406 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c
+@@ -211,7 +211,7 @@ static int sun8i_vi_layer_update_coord(struct sun8i_mixer *mixer, int channel,
+ return 0;
+ }
+
+-static bool sun8i_vi_layer_get_csc_mode(const struct drm_format_info *format)
++static u32 sun8i_vi_layer_get_csc_mode(const struct drm_format_info *format)
+ {
+ if (!format->is_yuv)
+ return SUN8I_CSC_MODE_OFF;
+--
+2.25.1
+
--- /dev/null
+From 3a8d5032c7aeecef6bf106542ec5326bc2673ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 14:50:32 +0200
+Subject: drm/sun4i: Fix dsi dcs long write function
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit fd90e3808fd2c207560270c39b86b71af2231aa1 ]
+
+It's writing too much data. regmap_bulk_write expects number of
+register sized chunks to write, not a byte sized length of the
+bounce buffer. Bounce buffer needs to be padded too, so that
+regmap_bulk_write will not read past the end of the buffer.
+
+Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200828125032.937148-1-megous@megous.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index aa67cb037e9d1..32d4c3f7fc4eb 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -889,7 +889,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
+ sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
+
+- bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
++ bounce = kzalloc(ALIGN(msg->tx_len + sizeof(crc), 4), GFP_KERNEL);
+ if (!bounce)
+ return -ENOMEM;
+
+@@ -900,7 +900,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
+ len += sizeof(crc);
+
+- regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len);
++ regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4));
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1);
+ kfree(bounce);
+
+--
+2.25.1
+
--- /dev/null
+From 8431ac1d1ae992b7540359a434d46623440297c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 09:25:10 +0200
+Subject: drm/virtio: fix unblank
+
+From: Gerd Hoffmann <kraxel@redhat.com>
+
+[ Upstream commit c6016c6e39c3ee8fd671532520be3cc13e439db2 ]
+
+When going through a disable/enable cycle without changing the
+framebuffer the optimization added by commit 3954ff10e06e ("drm/virtio:
+skip set_scanout if framebuffer didn't change") causes the screen stay
+blank. Add a bool to force an update to fix that.
+
+v2: use drm_atomic_crtc_needs_modeset() (Daniel).
+
+Cc: 1882851@bugs.launchpad.net
+Fixes: 3954ff10e06e ("drm/virtio: skip set_scanout if framebuffer didn't change")
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Tested-by: Jiri Slaby <jirislaby@kernel.org>
+Tested-by: Diego Viola <diego.viola@gmail.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20200818072511.6745-2-kraxel@redhat.com
+(cherry picked from commit 1bc371cd0ec907bab870cacb6e898105f9c41dc8)
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_display.c | 11 +++++++++++
+ drivers/gpu/drm/virtio/virtgpu_drv.h | 1 +
+ drivers/gpu/drm/virtio/virtgpu_plane.c | 4 +++-
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c
+index cc7fd957a3072..2b8421a35ab94 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_display.c
++++ b/drivers/gpu/drm/virtio/virtgpu_display.c
+@@ -123,6 +123,17 @@ static int virtio_gpu_crtc_atomic_check(struct drm_crtc *crtc,
+ static void virtio_gpu_crtc_atomic_flush(struct drm_crtc *crtc,
+ struct drm_crtc_state *old_state)
+ {
++ struct virtio_gpu_output *output = drm_crtc_to_virtio_gpu_output(crtc);
++
++ /*
++ * virtio-gpu can't do modeset and plane update operations
++ * independent from each other. So the actual modeset happens
++ * in the plane update callback, and here we just check
++ * whenever we must force the modeset.
++ */
++ if (drm_atomic_crtc_needs_modeset(crtc->state)) {
++ output->needs_modeset = true;
++ }
+ }
+
+ static const struct drm_crtc_helper_funcs virtio_gpu_crtc_helper_funcs = {
+diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
+index 9ff9f4ac0522a..4ab1b0ba29253 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
++++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
+@@ -138,6 +138,7 @@ struct virtio_gpu_output {
+ int cur_x;
+ int cur_y;
+ bool enabled;
++ bool needs_modeset;
+ };
+ #define drm_crtc_to_virtio_gpu_output(x) \
+ container_of(x, struct virtio_gpu_output, crtc)
+diff --git a/drivers/gpu/drm/virtio/virtgpu_plane.c b/drivers/gpu/drm/virtio/virtgpu_plane.c
+index 52d24179bcecc..65757409d9ed1 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_plane.c
++++ b/drivers/gpu/drm/virtio/virtgpu_plane.c
+@@ -163,7 +163,9 @@ static void virtio_gpu_primary_plane_update(struct drm_plane *plane,
+ plane->state->src_w != old_state->src_w ||
+ plane->state->src_h != old_state->src_h ||
+ plane->state->src_x != old_state->src_x ||
+- plane->state->src_y != old_state->src_y) {
++ plane->state->src_y != old_state->src_y ||
++ output->needs_modeset) {
++ output->needs_modeset = false;
+ DRM_DEBUG("handle 0x%x, crtc %dx%d+%d+%d, src %dx%d+%d+%d\n",
+ bo->hw_res_handle,
+ plane->state->crtc_w, plane->state->crtc_h,
+--
+2.25.1
+
--- /dev/null
+From 7a58d41d0fb4105a8087a19121c86869abf5163e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 19:29:35 +0800
+Subject: firestream: Fix memleak in fs_open
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]
+
+When make_rate() fails, vcc should be freed just
+like other error paths in fs_open().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/firestream.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index cc87004d5e2d6..5f22555933df1 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -998,6 +998,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ error = make_rate (pcr, r, &tmc0, NULL);
+ if (error) {
+ kfree(tc);
++ kfree(vcc);
+ return error;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From aa643fae6afb8d9184a8800e6ea2c3a6d0faf130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 18:58:08 +0300
+Subject: gcov: Disable gcov build with GCC 10
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]
+
+GCOV built with GCC 10 doesn't initialize n_function variable. This
+produces different kernel panics as was seen by Colin in Ubuntu and me
+in FC 32.
+
+As a workaround, let's disable GCOV build for broken GCC 10 version.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
+Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
+Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
+Cc: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gcov/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
+index 3110c77230c7f..bb4b680e8455a 100644
+--- a/kernel/gcov/Kconfig
++++ b/kernel/gcov/Kconfig
+@@ -4,6 +4,7 @@ menu "GCOV-based kernel profiling"
+ config GCOV_KERNEL
+ bool "Enable gcov-based kernel profiling"
+ depends on DEBUG_FS
++ depends on !CC_IS_GCC || GCC_VERSION < 100000
+ select CONSTRUCTORS if !UML
+ default n
+ help
+--
+2.25.1
+
--- /dev/null
+From 392a5d997c147f9e597929a32c6aa181b907cd19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 17:06:43 +0800
+Subject: HID: elan: Fix memleak in elan_input_configured
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit b7429ea53d6c0936a0f10a5d64164f0aea440143 ]
+
+When input_mt_init_slots() fails, input should be freed
+to prevent memleak. When input_register_device() fails,
+we should call input_mt_destroy_slots() to free memory
+allocated by input_mt_init_slots().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 45c4f888b7c4e..dae193749d443 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -188,6 +188,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
+ if (ret) {
+ hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
++ input_free_device(input);
+ return ret;
+ }
+
+@@ -198,6 +199,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (ret) {
+ hid_err(hdev, "Failed to register elan input device: %d\n",
+ ret);
++ input_mt_destroy_slots(input);
+ input_free_device(input);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From d09cd8c4b8079f88714e98bb76325f44b665817f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 21:14:29 -0700
+Subject: HID: microsoft: Add rumble support for the 8bitdo SN30 Pro+
+ controller
+
+From: Nicholas Miell <nmiell@gmail.com>
+
+[ Upstream commit 724a419ea28f7514a391e80040230f69cf626707 ]
+
+When operating in XInput mode, the 8bitdo SN30 Pro+ requires the same
+quirk as the official Xbox One Bluetooth controllers for rumble to
+function.
+
+Other controllers like the N30 Pro 2, SF30 Pro, SN30 Pro, etc. probably
+also need this quirk, but I do not have the hardware to test.
+
+Signed-off-by: Nicholas Miell <nmiell@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-microsoft.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 8fa034b3b7073..b49ec7dde6457 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -849,6 +849,7 @@
+ #define USB_DEVICE_ID_MS_POWER_COVER 0x07da
+ #define USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER 0x02fd
+ #define USB_DEVICE_ID_MS_PIXART_MOUSE 0x00cb
++#define USB_DEVICE_ID_8BITDO_SN30_PRO_PLUS 0x02e0
+
+ #define USB_VENDOR_ID_MOJO 0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
+diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
+index 2d8b589201a4e..8cb1ca1936e42 100644
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -451,6 +451,8 @@ static const struct hid_device_id ms_devices[] = {
+ .driver_data = MS_SURFACE_DIAL },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER),
+ .driver_data = MS_QUIRK_FF },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_8BITDO_SN30_PRO_PLUS),
++ .driver_data = MS_QUIRK_FF },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ms_devices);
+--
+2.25.1
+
--- /dev/null
+From fbd15c2a13a8a230fd2c05a06fa3852d611de8f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Aug 2020 17:48:59 -0700
+Subject: HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52
+ devices
+
+From: Nirenjan Krishnan <nirenjan@gmail.com>
+
+[ Upstream commit 77df710ba633dfb6c65c65cf99ea9e084a1c9933 ]
+
+The Saitek X52 family of joysticks has a pair of axes that were
+originally (by the Windows driver) used as mouse pointer controls. The
+corresponding usage page is the Game Controls page, which is not
+recognized by the generic HID driver, and therefore, both axes get
+mapped to ABS_MISC. The quirk makes the second axis get mapped to
+ABS_MISC+1, and therefore made available separately.
+
+One Saitek X52 device is already fixed. This patch fixes the other two
+known devices with VID/PID 06a3:0255 and 06a3:0762.
+
+Signed-off-by: Nirenjan Krishnan <nirenjan@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 6ea3619842d8d..8fa034b3b7073 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1014,6 +1014,8 @@
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c
++#define USB_DEVICE_ID_SAITEK_X52_2 0x0255
++#define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index a65aef6a322fb..7a2be0205dfd1 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -150,6 +150,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+--
+2.25.1
+
--- /dev/null
+From bb61974f03ca099b1d52d7e9c76b554d3b148afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 00:31:21 +0300
+Subject: i2c: npcm7xx: Fix timeout calculation
+
+From: Tali Perry <tali.perry1@gmail.com>
+
+[ Upstream commit 06be67266a0c9a6a1ffb330a4ab50c2f21612e2b ]
+
+timeout_usec value calculation was wrong, the calculated value
+was in msec instead of usec.
+
+Fixes: 56a1485b102e ("i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver")
+Signed-off-by: Tali Perry <tali.perry1@gmail.com>
+Reviewed-by: Avi Fishman <avifishman70@gmail.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Alex Qiu <xqiu@google.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-npcm7xx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c
+index 75f07138a6fa2..dfcf04e1967f1 100644
+--- a/drivers/i2c/busses/i2c-npcm7xx.c
++++ b/drivers/i2c/busses/i2c-npcm7xx.c
+@@ -2093,8 +2093,12 @@ static int npcm_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ }
+ }
+
+- /* Adaptive TimeOut: astimated time in usec + 100% margin */
+- timeout_usec = (2 * 10000 / bus->bus_freq) * (2 + nread + nwrite);
++ /*
++ * Adaptive TimeOut: estimated time in usec + 100% margin:
++ * 2: double the timeout for clock stretching case
++ * 9: bits per transaction (including the ack/nack)
++ */
++ timeout_usec = (2 * 9 * USEC_PER_SEC / bus->bus_freq) * (2 + nread + nwrite);
+ timeout = max(msecs_to_jiffies(35), usecs_to_jiffies(timeout_usec));
+ if (nwrite >= 32 * 1024 || nread >= 32 * 1024) {
+ dev_err(bus->dev, "i2c%d buffer too big\n", bus->num);
+--
+2.25.1
+
--- /dev/null
+From fc270b293b40055a2019e825c2b726db607e21a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 12:50:39 -0700
+Subject: IB/isert: Fix unaligned immediate-data handling
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0b089c1ef7047652b13b4cdfdb1e0e7dbdb8c9ab ]
+
+Currently we allocate rx buffers in a single contiguous buffers for
+headers (iser and iscsi) and data trailer. This means that most likely the
+data starting offset is aligned to 76 bytes (size of both headers).
+
+This worked fine for years, but at some point this broke, resulting in
+data corruptions in isert when a command comes with immediate data and the
+underlying backend device assumes 512 bytes buffer alignment.
+
+We assume a hard-requirement for all direct I/O buffers to be 512 bytes
+aligned. To fix this, we should avoid passing unaligned buffers for I/O.
+
+Instead, we allocate our recv buffers with some extra space such that we
+can have the data portion align to 512 byte boundary. This also means that
+we cannot reference headers or data using structure but rather
+accessors (as they may move based on alignment). Also, get rid of the
+wrong __packed annotation from iser_rx_desc as this has only harmful
+effects (not aligned to anything).
+
+This affects the rx descriptors for iscsi login and data plane.
+
+Fixes: 3d75ca0adef4 ("block: introduce multi-page bvec helpers")
+Link: https://lore.kernel.org/r/20200904195039.31687-1-sagi@grimberg.me
+Reported-by: Stephen Rust <srust@blockbridge.com>
+Tested-by: Doug Dumitru <doug@dumitru.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 93 +++++++++++++------------
+ drivers/infiniband/ulp/isert/ib_isert.h | 41 ++++++++---
+ 2 files changed, 78 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index b7df38ee8ae05..49ca8727e3fa3 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -183,15 +183,15 @@ isert_alloc_rx_descriptors(struct isert_conn *isert_conn)
+ rx_desc = isert_conn->rx_descs;
+
+ for (i = 0; i < ISERT_QP_MAX_RECV_DTOS; i++, rx_desc++) {
+- dma_addr = ib_dma_map_single(ib_dev, (void *)rx_desc,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ dma_addr = ib_dma_map_single(ib_dev, rx_desc->buf,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ if (ib_dma_mapping_error(ib_dev, dma_addr))
+ goto dma_map_fail;
+
+ rx_desc->dma_addr = dma_addr;
+
+ rx_sg = &rx_desc->rx_sg;
+- rx_sg->addr = rx_desc->dma_addr;
++ rx_sg->addr = rx_desc->dma_addr + isert_get_hdr_offset(rx_desc);
+ rx_sg->length = ISER_RX_PAYLOAD_SIZE;
+ rx_sg->lkey = device->pd->local_dma_lkey;
+ rx_desc->rx_cqe.done = isert_recv_done;
+@@ -203,7 +203,7 @@ dma_map_fail:
+ rx_desc = isert_conn->rx_descs;
+ for (j = 0; j < i; j++, rx_desc++) {
+ ib_dma_unmap_single(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+ kfree(isert_conn->rx_descs);
+ isert_conn->rx_descs = NULL;
+@@ -224,7 +224,7 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
+ rx_desc = isert_conn->rx_descs;
+ for (i = 0; i < ISERT_QP_MAX_RECV_DTOS; i++, rx_desc++) {
+ ib_dma_unmap_single(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ kfree(isert_conn->rx_descs);
+@@ -409,10 +409,9 @@ isert_free_login_buf(struct isert_conn *isert_conn)
+ ISER_RX_PAYLOAD_SIZE, DMA_TO_DEVICE);
+ kfree(isert_conn->login_rsp_buf);
+
+- ib_dma_unmap_single(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE,
+- DMA_FROM_DEVICE);
+- kfree(isert_conn->login_req_buf);
++ ib_dma_unmap_single(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++ kfree(isert_conn->login_desc);
+ }
+
+ static int
+@@ -421,25 +420,25 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
+ {
+ int ret;
+
+- isert_conn->login_req_buf = kzalloc(sizeof(*isert_conn->login_req_buf),
++ isert_conn->login_desc = kzalloc(sizeof(*isert_conn->login_desc),
+ GFP_KERNEL);
+- if (!isert_conn->login_req_buf)
++ if (!isert_conn->login_desc)
+ return -ENOMEM;
+
+- isert_conn->login_req_dma = ib_dma_map_single(ib_dev,
+- isert_conn->login_req_buf,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
+- ret = ib_dma_mapping_error(ib_dev, isert_conn->login_req_dma);
++ isert_conn->login_desc->dma_addr = ib_dma_map_single(ib_dev,
++ isert_conn->login_desc->buf,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++ ret = ib_dma_mapping_error(ib_dev, isert_conn->login_desc->dma_addr);
+ if (ret) {
+- isert_err("login_req_dma mapping error: %d\n", ret);
+- isert_conn->login_req_dma = 0;
+- goto out_free_login_req_buf;
++ isert_err("login_desc dma mapping error: %d\n", ret);
++ isert_conn->login_desc->dma_addr = 0;
++ goto out_free_login_desc;
+ }
+
+ isert_conn->login_rsp_buf = kzalloc(ISER_RX_PAYLOAD_SIZE, GFP_KERNEL);
+ if (!isert_conn->login_rsp_buf) {
+ ret = -ENOMEM;
+- goto out_unmap_login_req_buf;
++ goto out_unmap_login_desc;
+ }
+
+ isert_conn->login_rsp_dma = ib_dma_map_single(ib_dev,
+@@ -456,11 +455,11 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
+
+ out_free_login_rsp_buf:
+ kfree(isert_conn->login_rsp_buf);
+-out_unmap_login_req_buf:
+- ib_dma_unmap_single(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
+-out_free_login_req_buf:
+- kfree(isert_conn->login_req_buf);
++out_unmap_login_desc:
++ ib_dma_unmap_single(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++out_free_login_desc:
++ kfree(isert_conn->login_desc);
+ return ret;
+ }
+
+@@ -579,7 +578,7 @@ isert_connect_release(struct isert_conn *isert_conn)
+ ib_destroy_qp(isert_conn->qp);
+ }
+
+- if (isert_conn->login_req_buf)
++ if (isert_conn->login_desc)
+ isert_free_login_buf(isert_conn);
+
+ isert_device_put(device);
+@@ -965,17 +964,18 @@ isert_login_post_recv(struct isert_conn *isert_conn)
+ int ret;
+
+ memset(&sge, 0, sizeof(struct ib_sge));
+- sge.addr = isert_conn->login_req_dma;
++ sge.addr = isert_conn->login_desc->dma_addr +
++ isert_get_hdr_offset(isert_conn->login_desc);
+ sge.length = ISER_RX_PAYLOAD_SIZE;
+ sge.lkey = isert_conn->device->pd->local_dma_lkey;
+
+ isert_dbg("Setup sge: addr: %llx length: %d 0x%08x\n",
+ sge.addr, sge.length, sge.lkey);
+
+- isert_conn->login_req_buf->rx_cqe.done = isert_login_recv_done;
++ isert_conn->login_desc->rx_cqe.done = isert_login_recv_done;
+
+ memset(&rx_wr, 0, sizeof(struct ib_recv_wr));
+- rx_wr.wr_cqe = &isert_conn->login_req_buf->rx_cqe;
++ rx_wr.wr_cqe = &isert_conn->login_desc->rx_cqe;
+ rx_wr.sg_list = &sge;
+ rx_wr.num_sge = 1;
+
+@@ -1052,7 +1052,7 @@ post_send:
+ static void
+ isert_rx_login_req(struct isert_conn *isert_conn)
+ {
+- struct iser_rx_desc *rx_desc = isert_conn->login_req_buf;
++ struct iser_rx_desc *rx_desc = isert_conn->login_desc;
+ int rx_buflen = isert_conn->login_req_len;
+ struct iscsi_conn *conn = isert_conn->conn;
+ struct iscsi_login *login = conn->conn_login;
+@@ -1064,7 +1064,7 @@ isert_rx_login_req(struct isert_conn *isert_conn)
+
+ if (login->first_request) {
+ struct iscsi_login_req *login_req =
+- (struct iscsi_login_req *)&rx_desc->iscsi_header;
++ (struct iscsi_login_req *)isert_get_iscsi_hdr(rx_desc);
+ /*
+ * Setup the initial iscsi_login values from the leading
+ * login request PDU.
+@@ -1083,13 +1083,13 @@ isert_rx_login_req(struct isert_conn *isert_conn)
+ login->tsih = be16_to_cpu(login_req->tsih);
+ }
+
+- memcpy(&login->req[0], (void *)&rx_desc->iscsi_header, ISCSI_HDR_LEN);
++ memcpy(&login->req[0], isert_get_iscsi_hdr(rx_desc), ISCSI_HDR_LEN);
+
+ size = min(rx_buflen, MAX_KEY_VALUE_PAIRS);
+ isert_dbg("Using login payload size: %d, rx_buflen: %d "
+ "MAX_KEY_VALUE_PAIRS: %d\n", size, rx_buflen,
+ MAX_KEY_VALUE_PAIRS);
+- memcpy(login->req_buf, &rx_desc->data[0], size);
++ memcpy(login->req_buf, isert_get_data(rx_desc), size);
+
+ if (login->first_request) {
+ complete(&isert_conn->login_comp);
+@@ -1154,14 +1154,15 @@ isert_handle_scsi_cmd(struct isert_conn *isert_conn,
+ if (imm_data_len != data_len) {
+ sg_nents = max(1UL, DIV_ROUND_UP(imm_data_len, PAGE_SIZE));
+ sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,
+- &rx_desc->data[0], imm_data_len);
++ isert_get_data(rx_desc), imm_data_len);
+ isert_dbg("Copy Immediate sg_nents: %u imm_data_len: %d\n",
+ sg_nents, imm_data_len);
+ } else {
+ sg_init_table(&isert_cmd->sg, 1);
+ cmd->se_cmd.t_data_sg = &isert_cmd->sg;
+ cmd->se_cmd.t_data_nents = 1;
+- sg_set_buf(&isert_cmd->sg, &rx_desc->data[0], imm_data_len);
++ sg_set_buf(&isert_cmd->sg, isert_get_data(rx_desc),
++ imm_data_len);
+ isert_dbg("Transfer Immediate imm_data_len: %d\n",
+ imm_data_len);
+ }
+@@ -1230,9 +1231,9 @@ isert_handle_iscsi_dataout(struct isert_conn *isert_conn,
+ }
+ isert_dbg("Copying DataOut: sg_start: %p, sg_off: %u "
+ "sg_nents: %u from %p %u\n", sg_start, sg_off,
+- sg_nents, &rx_desc->data[0], unsol_data_len);
++ sg_nents, isert_get_data(rx_desc), unsol_data_len);
+
+- sg_copy_from_buffer(sg_start, sg_nents, &rx_desc->data[0],
++ sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),
+ unsol_data_len);
+
+ rc = iscsit_check_dataout_payload(cmd, hdr, false);
+@@ -1291,7 +1292,7 @@ isert_handle_text_cmd(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd
+ }
+ cmd->text_in_ptr = text_in;
+
+- memcpy(cmd->text_in_ptr, &rx_desc->data[0], payload_length);
++ memcpy(cmd->text_in_ptr, isert_get_data(rx_desc), payload_length);
+
+ return iscsit_process_text_cmd(conn, cmd, hdr);
+ }
+@@ -1301,7 +1302,7 @@ isert_rx_opcode(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc,
+ uint32_t read_stag, uint64_t read_va,
+ uint32_t write_stag, uint64_t write_va)
+ {
+- struct iscsi_hdr *hdr = &rx_desc->iscsi_header;
++ struct iscsi_hdr *hdr = isert_get_iscsi_hdr(rx_desc);
+ struct iscsi_conn *conn = isert_conn->conn;
+ struct iscsi_cmd *cmd;
+ struct isert_cmd *isert_cmd;
+@@ -1399,8 +1400,8 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ struct isert_conn *isert_conn = wc->qp->qp_context;
+ struct ib_device *ib_dev = isert_conn->cm_id->device;
+ struct iser_rx_desc *rx_desc = cqe_to_rx_desc(wc->wr_cqe);
+- struct iscsi_hdr *hdr = &rx_desc->iscsi_header;
+- struct iser_ctrl *iser_ctrl = &rx_desc->iser_header;
++ struct iscsi_hdr *hdr = isert_get_iscsi_hdr(rx_desc);
++ struct iser_ctrl *iser_ctrl = isert_get_iser_hdr(rx_desc);
+ uint64_t read_va = 0, write_va = 0;
+ uint32_t read_stag = 0, write_stag = 0;
+
+@@ -1414,7 +1415,7 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ rx_desc->in_use = true;
+
+ ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+
+ isert_dbg("DMA: 0x%llx, iSCSI opcode: 0x%02x, ITT: 0x%08x, flags: 0x%02x dlen: %d\n",
+ rx_desc->dma_addr, hdr->opcode, hdr->itt, hdr->flags,
+@@ -1449,7 +1450,7 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ read_stag, read_va, write_stag, write_va);
+
+ ib_dma_sync_single_for_device(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ static void
+@@ -1463,8 +1464,8 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ return;
+ }
+
+- ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+
+ isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN;
+
+@@ -1479,8 +1480,8 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ complete(&isert_conn->login_req_comp);
+ mutex_unlock(&isert_conn->mutex);
+
+- ib_dma_sync_single_for_device(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ib_dma_sync_single_for_device(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ static void
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index 3b296bac4f603..d267a6d60d87d 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -59,9 +59,11 @@
+ ISERT_MAX_TX_MISC_PDUS + \
+ ISERT_MAX_RX_MISC_PDUS)
+
+-#define ISER_RX_PAD_SIZE (ISCSI_DEF_MAX_RECV_SEG_LEN + 4096 - \
+- (ISER_RX_PAYLOAD_SIZE + sizeof(u64) + sizeof(struct ib_sge) + \
+- sizeof(struct ib_cqe) + sizeof(bool)))
++/*
++ * RX size is default of 8k plus headers, but data needs to align to
++ * 512 boundary, so use 1024 to have the extra space for alignment.
++ */
++#define ISER_RX_SIZE (ISCSI_DEF_MAX_RECV_SEG_LEN + 1024)
+
+ #define ISCSI_ISER_SG_TABLESIZE 256
+
+@@ -80,21 +82,41 @@ enum iser_conn_state {
+ };
+
+ struct iser_rx_desc {
+- struct iser_ctrl iser_header;
+- struct iscsi_hdr iscsi_header;
+- char data[ISCSI_DEF_MAX_RECV_SEG_LEN];
++ char buf[ISER_RX_SIZE];
+ u64 dma_addr;
+ struct ib_sge rx_sg;
+ struct ib_cqe rx_cqe;
+ bool in_use;
+- char pad[ISER_RX_PAD_SIZE];
+-} __packed;
++};
+
+ static inline struct iser_rx_desc *cqe_to_rx_desc(struct ib_cqe *cqe)
+ {
+ return container_of(cqe, struct iser_rx_desc, rx_cqe);
+ }
+
++static void *isert_get_iser_hdr(struct iser_rx_desc *desc)
++{
++ return PTR_ALIGN(desc->buf + ISER_HEADERS_LEN, 512) - ISER_HEADERS_LEN;
++}
++
++static size_t isert_get_hdr_offset(struct iser_rx_desc *desc)
++{
++ return isert_get_iser_hdr(desc) - (void *)desc->buf;
++}
++
++static void *isert_get_iscsi_hdr(struct iser_rx_desc *desc)
++{
++ return isert_get_iser_hdr(desc) + sizeof(struct iser_ctrl);
++}
++
++static void *isert_get_data(struct iser_rx_desc *desc)
++{
++ void *data = isert_get_iser_hdr(desc) + ISER_HEADERS_LEN;
++
++ WARN_ON((uintptr_t)data & 511);
++ return data;
++}
++
+ struct iser_tx_desc {
+ struct iser_ctrl iser_header;
+ struct iscsi_hdr iscsi_header;
+@@ -141,9 +163,8 @@ struct isert_conn {
+ u32 responder_resources;
+ u32 initiator_depth;
+ bool pi_support;
+- struct iser_rx_desc *login_req_buf;
++ struct iser_rx_desc *login_desc;
+ char *login_rsp_buf;
+- u64 login_req_dma;
+ int login_req_len;
+ u64 login_rsp_dma;
+ struct iser_rx_desc *rx_descs;
+--
+2.25.1
+
--- /dev/null
+From 8e3ebf6a36d38ead65af9271a09b74aa32270f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 11:32:18 +0200
+Subject: iio: adc: mcp3422: fix locking on error path
+
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+
+[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]
+
+Reading from the chip should be unlocked on error path else the lock
+could never being released.
+
+Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
+Fixes: 3f1093d83d71 ("iio: adc: mcp3422: fix locking scope")
+Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3422.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index d86c0b5d80a3d..c717981c8fb03 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -145,8 +145,10 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ config &= ~MCP3422_PGA_MASK;
+ config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
+ ret = mcp3422_update_config(adc, config);
+- if (ret < 0)
++ if (ret < 0) {
++ mutex_unlock(&adc->lock);
+ return ret;
++ }
+ msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From af14210c956a0a7dfb9562e96501c3382da359c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Sep 2020 12:21:44 -0700
+Subject: interconnect: qcom: Fix small BW votes being truncated to zero
+
+From: Mike Tipton <mdtipton@codeaurora.org>
+
+[ Upstream commit 91e045b93db79a2ef66e045ad0d1f8f9d348e1f4 ]
+
+Small BW votes that translate to less than a single BCM unit are
+currently truncated to zero. Ensure that non-zero BW requests always
+result in at least a vote of 1 to BCM.
+
+Fixes: 976daac4a1c5 ("interconnect: qcom: Consolidate interconnect RPMh support")
+Signed-off-by: Mike Tipton <mdtipton@codeaurora.org>
+Link: https://lore.kernel.org/r/20200903192149.30385-2-mdtipton@codeaurora.org
+Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/bcm-voter.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c
+index 2a11a63e7217a..b360dc34c90c7 100644
+--- a/drivers/interconnect/qcom/bcm-voter.c
++++ b/drivers/interconnect/qcom/bcm-voter.c
+@@ -52,8 +52,20 @@ static int cmp_vcd(void *priv, struct list_head *a, struct list_head *b)
+ return 1;
+ }
+
++static u64 bcm_div(u64 num, u32 base)
++{
++ /* Ensure that small votes aren't lost. */
++ if (num && num < base)
++ return 1;
++
++ do_div(num, base);
++
++ return num;
++}
++
+ static void bcm_aggregate(struct qcom_icc_bcm *bcm)
+ {
++ struct qcom_icc_node *node;
+ size_t i, bucket;
+ u64 agg_avg[QCOM_ICC_NUM_BUCKETS] = {0};
+ u64 agg_peak[QCOM_ICC_NUM_BUCKETS] = {0};
+@@ -61,22 +73,21 @@ static void bcm_aggregate(struct qcom_icc_bcm *bcm)
+
+ for (bucket = 0; bucket < QCOM_ICC_NUM_BUCKETS; bucket++) {
+ for (i = 0; i < bcm->num_nodes; i++) {
+- temp = bcm->nodes[i]->sum_avg[bucket] * bcm->aux_data.width;
+- do_div(temp, bcm->nodes[i]->buswidth * bcm->nodes[i]->channels);
++ node = bcm->nodes[i];
++ temp = bcm_div(node->sum_avg[bucket] * bcm->aux_data.width,
++ node->buswidth * node->channels);
+ agg_avg[bucket] = max(agg_avg[bucket], temp);
+
+- temp = bcm->nodes[i]->max_peak[bucket] * bcm->aux_data.width;
+- do_div(temp, bcm->nodes[i]->buswidth);
++ temp = bcm_div(node->max_peak[bucket] * bcm->aux_data.width,
++ node->buswidth);
+ agg_peak[bucket] = max(agg_peak[bucket], temp);
+ }
+
+ temp = agg_avg[bucket] * 1000ULL;
+- do_div(temp, bcm->aux_data.unit);
+- bcm->vote_x[bucket] = temp;
++ bcm->vote_x[bucket] = bcm_div(temp, bcm->aux_data.unit);
+
+ temp = agg_peak[bucket] * 1000ULL;
+- do_div(temp, bcm->aux_data.unit);
+- bcm->vote_y[bucket] = temp;
++ bcm->vote_y[bucket] = bcm_div(temp, bcm->aux_data.unit);
+ }
+
+ if (bcm->keepalive && bcm->vote_x[QCOM_ICC_BUCKET_AMC] == 0 &&
+--
+2.25.1
+
--- /dev/null
+From e2a36b4062cbce4c38d37061f2312a2a5023979d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:54:14 +0200
+Subject: iommu/amd: Do not force direct mapping when SME is active
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 7cad554887f1c5fd77e57e6bf4be38370c2160cb ]
+
+Do not force devices supporting IOMMUv2 to be direct mapped when memory
+encryption is active. This might cause them to be unusable because their
+DMA mask does not include the encryption bit.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Link: https://lore.kernel.org/r/20200824105415.21000-2-joro@8bytes.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index 200ee948f6ec1..37c74c842f3a3 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -2650,7 +2650,12 @@ static int amd_iommu_def_domain_type(struct device *dev)
+ if (!dev_data)
+ return 0;
+
+- if (dev_data->iommu_v2)
++ /*
++ * Do not identity map IOMMUv2 capable devices when memory encryption is
++ * active, because some of those devices (AMD GPUs) don't have the
++ * encryption bit in their DMA-mask and require remapping.
++ */
++ if (!mem_encrypt_active() && dev_data->iommu_v2)
+ return IOMMU_DOMAIN_IDENTITY;
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From dae235081ae08e105157ef1220e34b4eb64c8f18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:54:15 +0200
+Subject: iommu/amd: Do not use IOMMUv2 functionality when SME is active
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 2822e582501b65707089b097e773e6fd70774841 ]
+
+When memory encryption is active the device is likely not in a direct
+mapped domain. Forbid using IOMMUv2 functionality for now until finer
+grained checks for this have been implemented.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Link: https://lore.kernel.org/r/20200824105415.21000-3-joro@8bytes.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/iommu_v2.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iommu/amd/iommu_v2.c b/drivers/iommu/amd/iommu_v2.c
+index e4b025c5637c4..5a188cac7a0f1 100644
+--- a/drivers/iommu/amd/iommu_v2.c
++++ b/drivers/iommu/amd/iommu_v2.c
+@@ -737,6 +737,13 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
+
+ might_sleep();
+
++ /*
++ * When memory encryption is active the device is likely not in a
++ * direct-mapped domain. Forbid using IOMMUv2 functionality for now.
++ */
++ if (mem_encrypt_active())
++ return -ENODEV;
++
+ if (!amd_iommu_v2_supported())
+ return -ENODEV;
+
+--
+2.25.1
+
--- /dev/null
+From 2feeae6ab0203ebbe89f1d0a8dc0cd76f48269eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:10:33 -0700
+Subject: irqchip/eznps: Fix build error for !ARC700 builds
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit 89d29997f103d08264b0685796b420d911658b96 ]
+
+eznps driver is supposed to be platform independent however it ends up
+including stuff from inside arch/arc headers leading to rand config
+build errors.
+
+The quick hack to fix this (proper fix is too much chrun for non active
+user-base) is to add following to nps platform agnostic header.
+ - copy AUX_IENABLE from arch/arc header
+ - move CTOP_AUX_IACK from arch/arc/plat-eznps/*/**
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lkml.kernel.org/r/20200824095831.5lpkmkafelnvlpi2@linutronix.de
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/plat-eznps/include/plat/ctop.h | 1 -
+ include/soc/nps/common.h | 6 ++++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
+index a4a61531c7fb9..77712c5ffe848 100644
+--- a/arch/arc/plat-eznps/include/plat/ctop.h
++++ b/arch/arc/plat-eznps/include/plat/ctop.h
+@@ -33,7 +33,6 @@
+ #define CTOP_AUX_DPC (CTOP_AUX_BASE + 0x02C)
+ #define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)
+ #define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080)
+-#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)
+ #define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)
+ #define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
+
+diff --git a/include/soc/nps/common.h b/include/soc/nps/common.h
+index 9b1d43d671a3f..8c18dc6d3fde5 100644
+--- a/include/soc/nps/common.h
++++ b/include/soc/nps/common.h
+@@ -45,6 +45,12 @@
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422
+
++#ifndef AUX_IENABLE
++#define AUX_IENABLE 0x40c
++#endif
++
++#define CTOP_AUX_IACK (0xFFFFF800 + 0x088)
++
+ #ifndef __ASSEMBLY__
+
+ /* In order to increase compilation test coverage */
+--
+2.25.1
+
--- /dev/null
+From 2917325903744e0fef47adf03e5ce95d6a068752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 14:33:56 +0100
+Subject: KVM: arm64: Update page shift if stage 2 block mapping not supported
+
+From: Alexandru Elisei <alexandru.elisei@arm.com>
+
+[ Upstream commit 7b75cd5128421c673153efb1236705696a1a9812 ]
+
+Commit 196f878a7ac2e (" KVM: arm/arm64: Signal SIGBUS when stage2 discovers
+hwpoison memory") modifies user_mem_abort() to send a SIGBUS signal when
+the fault IPA maps to a hwpoisoned page. Commit 1559b7583ff6 ("KVM:
+arm/arm64: Re-check VMA on detecting a poisoned page") changed
+kvm_send_hwpoison_signal() to use the page shift instead of the VMA because
+at that point the code had already released the mmap lock, which means
+userspace could have modified the VMA.
+
+If userspace uses hugetlbfs for the VM memory, user_mem_abort() tries to
+map the guest fault IPA using block mappings in stage 2. That is not always
+possible, if, for example, userspace uses dirty page logging for the VM.
+Update the page shift appropriately in those cases when we downgrade the
+stage 2 entry from a block mapping to a page.
+
+Fixes: 1559b7583ff6 ("KVM: arm/arm64: Re-check VMA on detecting a poisoned page")
+Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Gavin Shan <gshan@redhat.com>
+Link: https://lore.kernel.org/r/20200901133357.52640-2-alexandru.elisei@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/mmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
+index bd47f06739d6c..d1320f3f2b137 100644
+--- a/arch/arm64/kvm/mmu.c
++++ b/arch/arm64/kvm/mmu.c
+@@ -1873,6 +1873,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ !fault_supports_stage2_huge_mapping(memslot, hva, vma_pagesize)) {
+ force_pte = true;
+ vma_pagesize = PAGE_SIZE;
++ vma_shift = PAGE_SHIFT;
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 4db689d7552da8b2c7c807e6ba3730fe894858c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 16:56:21 +0800
+Subject: KVM: nVMX: Fix the update value of nested load IA32_PERF_GLOBAL_CTRL
+ control
+
+From: Chenyi Qiang <chenyi.qiang@intel.com>
+
+[ Upstream commit c6b177a3beb9140dc0ba05b61c5142fcec5f2bf7 ]
+
+A minor fix for the update of VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL field
+in exit_ctls_high.
+
+Fixes: 03a8871add95 ("KVM: nVMX: Expose load IA32_PERF_GLOBAL_CTRL
+VM-{Entry,Exit} control")
+Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
+Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
+Message-Id: <20200828085622.8365-5-chenyi.qiang@intel.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx/nested.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
+index 11e4df5600183..a5810928b011f 100644
+--- a/arch/x86/kvm/vmx/nested.c
++++ b/arch/x86/kvm/vmx/nested.c
+@@ -4620,7 +4620,7 @@ void nested_vmx_pmu_entry_exit_ctls_update(struct kvm_vcpu *vcpu)
+ vmx->nested.msrs.entry_ctls_high &=
+ ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+ vmx->nested.msrs.exit_ctls_high &=
+- ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
++ ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 4e40bb6bc363ed8e263980e8142062c3954caaf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Sep 2020 11:31:47 +0200
+Subject: KVM: x86: always allow writing '0' to MSR_KVM_ASYNC_PF_EN
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit d831de177217cd494bfb99f2c849a0d40c2a7890 ]
+
+Even without in-kernel LAPIC we should allow writing '0' to
+MSR_KVM_ASYNC_PF_EN as we're not enabling the mechanism. In
+particular, QEMU with 'kernel-irqchip=off' fails to start
+a guest with
+
+qemu-system-x86_64: error: failed to set MSR 0x4b564d02 to 0x0
+
+Fixes: 9d3c447c72fb2 ("KVM: X86: Fix async pf caused null-ptr-deref")
+Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Message-Id: <20200911093147.484565-1-vkuznets@redhat.com>
+[Actually commit the version proposed by Sean Christopherson. - Paolo]
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/x86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f7304132d5907..f5481ae588aff 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2696,7 +2696,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ return 1;
+
+ if (!lapic_in_kernel(vcpu))
+- return 1;
++ return data ? 1 : 0;
+
+ vcpu->arch.apf.msr_en_val = data;
+
+--
+2.25.1
+
--- /dev/null
+From 085e10705e956c81799898848dca8dbac12d72cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2020 19:25:42 +0200
+Subject: mac80211: reduce packet loss event false positives
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 47df8e059b49a80c179fae39256bcd7096810934 ]
+
+When running a large number of packets per second with a high data rate
+and long A-MPDUs, the packet loss threshold can be reached very quickly
+when the link conditions change. This frequently shows up as spurious
+disconnects.
+Mitigate false positives by using a similar logic for regular stations
+as the one being used for TDLS, though with a more aggressive timeout.
+Packet loss events are only reported if no ACK was received for a second.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20200808172542.41628-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.h | 4 ++--
+ net/mac80211/status.c | 31 +++++++++++++++----------------
+ 2 files changed, 17 insertions(+), 18 deletions(-)
+
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 49728047dfad6..f66fcce8e6a45 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -522,7 +522,7 @@ struct ieee80211_sta_rx_stats {
+ * @status_stats.retry_failed: # of frames that failed after retry
+ * @status_stats.retry_count: # of retries attempted
+ * @status_stats.lost_packets: # of lost packets
+- * @status_stats.last_tdls_pkt_time: timestamp of last TDLS packet
++ * @status_stats.last_pkt_time: timestamp of last ACKed packet
+ * @status_stats.msdu_retries: # of MSDU retries
+ * @status_stats.msdu_failed: # of failed MSDUs
+ * @status_stats.last_ack: last ack timestamp (jiffies)
+@@ -595,7 +595,7 @@ struct sta_info {
+ unsigned long filtered;
+ unsigned long retry_failed, retry_count;
+ unsigned int lost_packets;
+- unsigned long last_tdls_pkt_time;
++ unsigned long last_pkt_time;
+ u64 msdu_retries[IEEE80211_NUM_TIDS + 1];
+ u64 msdu_failed[IEEE80211_NUM_TIDS + 1];
+ unsigned long last_ack;
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index cbc40b358ba26..819c4221c284e 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -755,12 +755,16 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
+ * - current throughput (higher value for higher tpt)?
+ */
+ #define STA_LOST_PKT_THRESHOLD 50
++#define STA_LOST_PKT_TIME HZ /* 1 sec since last ACK */
+ #define STA_LOST_TDLS_PKT_THRESHOLD 10
+ #define STA_LOST_TDLS_PKT_TIME (10*HZ) /* 10secs since last ACK */
+
+ static void ieee80211_lost_packet(struct sta_info *sta,
+ struct ieee80211_tx_info *info)
+ {
++ unsigned long pkt_time = STA_LOST_PKT_TIME;
++ unsigned int pkt_thr = STA_LOST_PKT_THRESHOLD;
++
+ /* If driver relies on its own algorithm for station kickout, skip
+ * mac80211 packet loss mechanism.
+ */
+@@ -773,21 +777,20 @@ static void ieee80211_lost_packet(struct sta_info *sta,
+ return;
+
+ sta->status_stats.lost_packets++;
+- if (!sta->sta.tdls &&
+- sta->status_stats.lost_packets < STA_LOST_PKT_THRESHOLD)
+- return;
++ if (sta->sta.tdls) {
++ pkt_time = STA_LOST_TDLS_PKT_TIME;
++ pkt_thr = STA_LOST_PKT_THRESHOLD;
++ }
+
+ /*
+ * If we're in TDLS mode, make sure that all STA_LOST_TDLS_PKT_THRESHOLD
+ * of the last packets were lost, and that no ACK was received in the
+ * last STA_LOST_TDLS_PKT_TIME ms, before triggering the CQM packet-loss
+ * mechanism.
++ * For non-TDLS, use STA_LOST_PKT_THRESHOLD and STA_LOST_PKT_TIME
+ */
+- if (sta->sta.tdls &&
+- (sta->status_stats.lost_packets < STA_LOST_TDLS_PKT_THRESHOLD ||
+- time_before(jiffies,
+- sta->status_stats.last_tdls_pkt_time +
+- STA_LOST_TDLS_PKT_TIME)))
++ if (sta->status_stats.lost_packets < pkt_thr ||
++ !time_after(jiffies, sta->status_stats.last_pkt_time + pkt_time))
+ return;
+
+ cfg80211_cqm_pktloss_notify(sta->sdata->dev, sta->sta.addr,
+@@ -1035,9 +1038,7 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw,
+ sta->status_stats.lost_packets = 0;
+
+ /* Track when last TDLS packet was ACKed */
+- if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+- sta->status_stats.last_tdls_pkt_time =
+- jiffies;
++ sta->status_stats.last_pkt_time = jiffies;
+ } else if (noack_success) {
+ /* nothing to do here, do not account as lost */
+ } else {
+@@ -1170,9 +1171,8 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw,
+ if (sta->status_stats.lost_packets)
+ sta->status_stats.lost_packets = 0;
+
+- /* Track when last TDLS packet was ACKed */
+- if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+- sta->status_stats.last_tdls_pkt_time = jiffies;
++ /* Track when last packet was ACKed */
++ sta->status_stats.last_pkt_time = jiffies;
+ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+ return;
+ } else if (noack_success) {
+@@ -1261,8 +1261,7 @@ void ieee80211_tx_status_8023(struct ieee80211_hw *hw,
+ if (sta->status_stats.lost_packets)
+ sta->status_stats.lost_packets = 0;
+
+- if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+- sta->status_stats.last_tdls_pkt_time = jiffies;
++ sta->status_stats.last_pkt_time = jiffies;
+ } else {
+ ieee80211_lost_packet(sta, info);
+ }
+--
+2.25.1
+
--- /dev/null
+From dd3ea477826505c8c27474228ee4a3c8497d755e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Aug 2020 11:08:49 +0200
+Subject: media: gpio-ir-tx: spinlock is not needed to disable interrupts
+
+From: Sean Young <sean@mess.org>
+
+[ Upstream commit 1451b93223bbe3b4e9c91fca6b451d00667c5bf0 ]
+
+During bit-banging the IR on a gpio pin, we cannot be scheduled or have
+anything interrupt us, else the generated signal will be incorrect.
+Therefore, we need to disable interrupts on the local cpu. This also
+disables preemption.
+
+local_irq_disable() does exactly what we need and does not require a
+spinlock.
+
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-tx.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c
+index f33b443bfa47b..c6cd2e6d8e654 100644
+--- a/drivers/media/rc/gpio-ir-tx.c
++++ b/drivers/media/rc/gpio-ir-tx.c
+@@ -19,8 +19,6 @@ struct gpio_ir {
+ struct gpio_desc *gpio;
+ unsigned int carrier;
+ unsigned int duty_cycle;
+- /* we need a spinlock to hold the cpu while transmitting */
+- spinlock_t lock;
+ };
+
+ static const struct of_device_id gpio_ir_tx_of_match[] = {
+@@ -53,12 +51,11 @@ static int gpio_ir_tx_set_carrier(struct rc_dev *dev, u32 carrier)
+ static void gpio_ir_tx_unmodulated(struct gpio_ir *gpio_ir, uint *txbuf,
+ uint count)
+ {
+- unsigned long flags;
+ ktime_t edge;
+ s32 delta;
+ int i;
+
+- spin_lock_irqsave(&gpio_ir->lock, flags);
++ local_irq_disable();
+
+ edge = ktime_get();
+
+@@ -72,14 +69,11 @@ static void gpio_ir_tx_unmodulated(struct gpio_ir *gpio_ir, uint *txbuf,
+ }
+
+ gpiod_set_value(gpio_ir->gpio, 0);
+-
+- spin_unlock_irqrestore(&gpio_ir->lock, flags);
+ }
+
+ static void gpio_ir_tx_modulated(struct gpio_ir *gpio_ir, uint *txbuf,
+ uint count)
+ {
+- unsigned long flags;
+ ktime_t edge;
+ /*
+ * delta should never exceed 0.5 seconds (IR_MAX_DURATION) and on
+@@ -95,7 +89,7 @@ static void gpio_ir_tx_modulated(struct gpio_ir *gpio_ir, uint *txbuf,
+ space = DIV_ROUND_CLOSEST((100 - gpio_ir->duty_cycle) *
+ (NSEC_PER_SEC / 100), gpio_ir->carrier);
+
+- spin_lock_irqsave(&gpio_ir->lock, flags);
++ local_irq_disable();
+
+ edge = ktime_get();
+
+@@ -128,19 +122,20 @@ static void gpio_ir_tx_modulated(struct gpio_ir *gpio_ir, uint *txbuf,
+ edge = last;
+ }
+ }
+-
+- spin_unlock_irqrestore(&gpio_ir->lock, flags);
+ }
+
+ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+ unsigned int count)
+ {
+ struct gpio_ir *gpio_ir = dev->priv;
++ unsigned long flags;
+
++ local_irq_save(flags);
+ if (gpio_ir->carrier)
+ gpio_ir_tx_modulated(gpio_ir, txbuf, count);
+ else
+ gpio_ir_tx_unmodulated(gpio_ir, txbuf, count);
++ local_irq_restore(flags);
+
+ return count;
+ }
+@@ -176,7 +171,6 @@ static int gpio_ir_tx_probe(struct platform_device *pdev)
+
+ gpio_ir->carrier = 38000;
+ gpio_ir->duty_cycle = 50;
+- spin_lock_init(&gpio_ir->lock);
+
+ rc = devm_rc_register_device(&pdev->dev, rcdev);
+ if (rc < 0)
+--
+2.25.1
+
--- /dev/null
+From 32a4f7731a10c7c26cd78162a081ccd7a727f7cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2020 20:32:27 +0800
+Subject: MIPS: Loongson64: Do not override watch and ejtag feature
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+[ Upstream commit 433c1ca0d441ee0b88fdd83c84ee6d6d43080dcd ]
+
+Do not override ejtag feature to 0 as Loongson 3A1000+ do have ejtag.
+For watch, as KVM emulated CPU doesn't have watch feature, we should
+not enable it unconditionally.
+
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Reviewed-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/cpu-feature-overrides.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/cpu-feature-overrides.h b/arch/mips/include/asm/mach-loongson64/cpu-feature-overrides.h
+index b6e9c99b85a52..eb181224eb4c4 100644
+--- a/arch/mips/include/asm/mach-loongson64/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-loongson64/cpu-feature-overrides.h
+@@ -26,7 +26,6 @@
+ #define cpu_has_counter 1
+ #define cpu_has_dc_aliases (PAGE_SIZE < 0x4000)
+ #define cpu_has_divec 0
+-#define cpu_has_ejtag 0
+ #define cpu_has_inclusive_pcaches 1
+ #define cpu_has_llsc 1
+ #define cpu_has_mcheck 0
+@@ -42,7 +41,6 @@
+ #define cpu_has_veic 0
+ #define cpu_has_vint 0
+ #define cpu_has_vtag_icache 0
+-#define cpu_has_watch 1
+ #define cpu_has_wsbh 1
+ #define cpu_has_ic_fills_f_dc 1
+ #define cpu_hwrena_impl_bits 0xc0000000
+--
+2.25.1
+
--- /dev/null
+From a6f1eb6103dd022318bf45f023a1cd8f3ac079a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 15:10:32 -0600
+Subject: mmc: sdhci-acpi: Clear amd_sdhci_host on reset
+
+From: Raul E Rangel <rrangel@chromium.org>
+
+[ Upstream commit 2cf9bfe9be75ed3656bbf882fb70c3e3047866e4 ]
+
+The commit 61d7437ed1390 ("mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040")
+broke resume for eMMC HS400. When the system suspends the eMMC controller
+is powered down. So, on resume we need to reinitialize the controller.
+Although, amd_sdhci_host was not getting cleared, so the DLL was never
+re-enabled on resume. This results in HS400 being non-functional.
+
+To fix the problem, this change clears the tuned_clock flag, clears the
+dll_enabled flag and disables the DLL on reset.
+
+Fixes: 61d7437ed1390 ("mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040")
+Signed-off-by: Raul E Rangel <rrangel@chromium.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20200831150517.1.I93c78bfc6575771bb653c9d3fca5eb018a08417d@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-acpi.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 2d9f79b50a7fa..841e34aa7caae 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -550,12 +550,18 @@ static int amd_select_drive_strength(struct mmc_card *card,
+ return MMC_SET_DRIVER_TYPE_A;
+ }
+
+-static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host)
++static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host, bool enable)
+ {
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
++
+ /* AMD Platform requires dll setting */
+ sdhci_writel(host, 0x40003210, SDHCI_AMD_RESET_DLL_REGISTER);
+ usleep_range(10, 20);
+- sdhci_writel(host, 0x40033210, SDHCI_AMD_RESET_DLL_REGISTER);
++ if (enable)
++ sdhci_writel(host, 0x40033210, SDHCI_AMD_RESET_DLL_REGISTER);
++
++ amd_host->dll_enabled = enable;
+ }
+
+ /*
+@@ -595,10 +601,8 @@ static void amd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+
+ /* DLL is only required for HS400 */
+ if (host->timing == MMC_TIMING_MMC_HS400 &&
+- !amd_host->dll_enabled) {
+- sdhci_acpi_amd_hs400_dll(host);
+- amd_host->dll_enabled = true;
+- }
++ !amd_host->dll_enabled)
++ sdhci_acpi_amd_hs400_dll(host, true);
+ }
+ }
+
+@@ -619,10 +623,23 @@ static int amd_sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ return err;
+ }
+
++static void amd_sdhci_reset(struct sdhci_host *host, u8 mask)
++{
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
++
++ if (mask & SDHCI_RESET_ALL) {
++ amd_host->tuned_clock = false;
++ sdhci_acpi_amd_hs400_dll(host, false);
++ }
++
++ sdhci_reset(host, mask);
++}
++
+ static const struct sdhci_ops sdhci_acpi_ops_amd = {
+ .set_clock = sdhci_set_clock,
+ .set_bus_width = sdhci_set_bus_width,
+- .reset = sdhci_reset,
++ .reset = amd_sdhci_reset,
+ .set_uhs_signaling = sdhci_set_uhs_signaling,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 77c5f385d5b0c0ef824f91a2c4c27a4b5115533e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 07:58:41 -0700
+Subject: mmc: sdhci-msm: Add retries when all tuning phases are found valid
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9d5dcefb7b114d610aeb2371f6a6f119af316e43 ]
+
+As the comments in this patch say, if we tune and find all phases are
+valid it's _almost_ as bad as no phases being found valid. Probably
+all phases are not really reliable but we didn't detect where the
+unreliable place is. That means we'll essentially be guessing and
+hoping we get a good phase.
+
+This is not just a problem in theory. It was causing real problems on
+a real board. On that board, most often phase 10 is found as the only
+invalid phase, though sometimes 10 and 11 are invalid and sometimes
+just 11. Some percentage of the time, however, all phases are found
+to be valid. When this happens, the current logic will decide to use
+phase 11. Since phase 11 is sometimes found to be invalid, this is a
+bad choice. Sure enough, when phase 11 is picked we often get mmc
+errors later in boot.
+
+I have seen cases where all phases were found to be valid 3 times in a
+row, so increase the retry count to 10 just to be extra sure.
+
+Fixes: 415b5a75da43 ("mmc: sdhci-msm: Add platform_execute_tuning implementation")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20200827075809.1.If179abf5ecb67c963494db79c3bc4247d987419b@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index c0d58e9fcc333..0450f521c6f9a 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1158,7 +1158,7 @@ static void sdhci_msm_set_cdr(struct sdhci_host *host, bool enable)
+ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+- int tuning_seq_cnt = 3;
++ int tuning_seq_cnt = 10;
+ u8 phase, tuned_phases[16], tuned_phase_cnt = 0;
+ int rc;
+ struct mmc_ios ios = host->mmc->ios;
+@@ -1214,6 +1214,22 @@ retry:
+ } while (++phase < ARRAY_SIZE(tuned_phases));
+
+ if (tuned_phase_cnt) {
++ if (tuned_phase_cnt == ARRAY_SIZE(tuned_phases)) {
++ /*
++ * All phases valid is _almost_ as bad as no phases
++ * valid. Probably all phases are not really reliable
++ * but we didn't detect where the unreliable place is.
++ * That means we'll essentially be guessing and hoping
++ * we get a good phase. Better to try a few times.
++ */
++ dev_dbg(mmc_dev(mmc), "%s: All phases valid; try again\n",
++ mmc_hostname(mmc));
++ if (--tuning_seq_cnt) {
++ tuned_phase_cnt = 0;
++ goto retry;
++ }
++ }
++
+ rc = msm_find_most_appropriate_phase(host, tuned_phases,
+ tuned_phase_cnt);
+ if (rc < 0)
+--
+2.25.1
+
--- /dev/null
+From 1116e902342a19c28c81e98643cf63d812a39383 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 13:11:50 +0800
+Subject: net: hns3: Fix for geneve tx checksum bug
+
+From: Yi Li <yili@winhong.com>
+
+[ Upstream commit a156998fc92d3859c8e820f1583f6d0541d643c3 ]
+
+when skb->encapsulation is 0, skb->ip_summed is CHECKSUM_PARTIAL
+and it is udp packet, which has a dest port as the IANA assigned.
+the hardware is expected to do the checksum offload, but the
+hardware will not do the checksum offload when udp dest port is
+6081.
+
+This patch fixes it by doing the checksum in software.
+
+Reported-by: Li Bing <libing@winhong.com>
+Signed-off-by: Yi Li <yili@winhong.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 71ed4c54f6d5d..eaadcc7043349 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -20,6 +20,7 @@
+ #include <net/pkt_cls.h>
+ #include <net/tcp.h>
+ #include <net/vxlan.h>
++#include <net/geneve.h>
+
+ #include "hnae3.h"
+ #include "hns3_enet.h"
+@@ -780,7 +781,7 @@ static int hns3_get_l4_protocol(struct sk_buff *skb, u8 *ol4_proto,
+ * and it is udp packet, which has a dest port as the IANA assigned.
+ * the hardware is expected to do the checksum offload, but the
+ * hardware will not do the checksum offload when udp dest port is
+- * 4789.
++ * 4789 or 6081.
+ */
+ static bool hns3_tunnel_csum_bug(struct sk_buff *skb)
+ {
+@@ -789,7 +790,8 @@ static bool hns3_tunnel_csum_bug(struct sk_buff *skb)
+ l4.hdr = skb_transport_header(skb);
+
+ if (!(!skb->encapsulation &&
+- l4.udp->dest == htons(IANA_VXLAN_UDP_PORT)))
++ (l4.udp->dest == htons(IANA_VXLAN_UDP_PORT) ||
++ l4.udp->dest == htons(GENEVE_UDP_PORT))))
+ return false;
+
+ skb_checksum_help(skb);
+--
+2.25.1
+
--- /dev/null
+From 87faac8c2045f0d11522392c30d41f411ae2c84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 16:15:58 +0200
+Subject: netfilter: conntrack: allow sctp hearbeat after connection re-use
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit cc5453a5b7e90c39f713091a7ebc53c1f87d1700 ]
+
+If an sctp connection gets re-used, heartbeats are flagged as invalid
+because their vtag doesn't match.
+
+Handle this in a similar way as TCP conntrack when it suspects that the
+endpoints and conntrack are out-of-sync.
+
+When a HEARTBEAT request fails its vtag validation, flag this in the
+conntrack state and accept the packet.
+
+When a HEARTBEAT_ACK is received with an invalid vtag in the reverse
+direction after we allowed such a HEARTBEAT through, assume we are
+out-of-sync and re-set the vtag info.
+
+v2: remove left-over snippet from an older incarnation that moved
+ new_state/old_state assignments, thats not needed so keep that
+ as-is.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nf_conntrack_sctp.h | 2 ++
+ net/netfilter/nf_conntrack_proto_sctp.c | 39 ++++++++++++++++++---
+ 2 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/netfilter/nf_conntrack_sctp.h b/include/linux/netfilter/nf_conntrack_sctp.h
+index 9a33f171aa822..625f491b95de8 100644
+--- a/include/linux/netfilter/nf_conntrack_sctp.h
++++ b/include/linux/netfilter/nf_conntrack_sctp.h
+@@ -9,6 +9,8 @@ struct ip_ct_sctp {
+ enum sctp_conntrack state;
+
+ __be32 vtag[IP_CT_DIR_MAX];
++ u8 last_dir;
++ u8 flags;
+ };
+
+ #endif /* _NF_CONNTRACK_SCTP_H */
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 4f897b14b6069..810cca24b3990 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -62,6 +62,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
+ [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
+ };
+
++#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
++
+ #define sNO SCTP_CONNTRACK_NONE
+ #define sCL SCTP_CONNTRACK_CLOSED
+ #define sCW SCTP_CONNTRACK_COOKIE_WAIT
+@@ -369,6 +371,7 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ u_int32_t offset, count;
+ unsigned int *timeouts;
+ unsigned long map[256 / sizeof(unsigned long)] = { 0 };
++ bool ignore = false;
+
+ if (sctp_error(skb, dataoff, state))
+ return -NF_ACCEPT;
+@@ -427,15 +430,39 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ /* Sec 8.5.1 (D) */
+ if (sh->vtag != ct->proto.sctp.vtag[dir])
+ goto out_unlock;
+- } else if (sch->type == SCTP_CID_HEARTBEAT ||
+- sch->type == SCTP_CID_HEARTBEAT_ACK) {
++ } else if (sch->type == SCTP_CID_HEARTBEAT) {
++ if (ct->proto.sctp.vtag[dir] == 0) {
++ pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.last_dir = dir;
++ ignore = true;
++ continue;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ }
++ } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) {
+ if (ct->proto.sctp.vtag[dir] == 0) {
+ pr_debug("Setting vtag %x for dir %d\n",
+ sh->vtag, dir);
+ ct->proto.sctp.vtag[dir] = sh->vtag;
+ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
+- pr_debug("Verification tag check failed\n");
+- goto out_unlock;
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 ||
++ ct->proto.sctp.last_dir == dir)
++ goto out_unlock;
++
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ ct->proto.sctp.vtag[!dir] = 0;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
+ }
+ }
+
+@@ -470,6 +497,10 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ }
+ spin_unlock_bh(&ct->lock);
+
++ /* allow but do not refresh timeout */
++ if (ignore)
++ return NF_ACCEPT;
++
+ timeouts = nf_ct_timeout_lookup(ct);
+ if (!timeouts)
+ timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
+--
+2.25.1
+
--- /dev/null
+From bca631731d516150f6eb97fcbe5b5907772d0b21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 23:59:15 +0200
+Subject: netfilter: nft_set_rbtree: Detect partial overlap with start endpoint
+ match
+
+From: Stefano Brivio <sbrivio@redhat.com>
+
+[ Upstream commit 0726763043dc10dd4c12481f050b1a5ef8f15410 ]
+
+Getting creative with nft and omitting the interval_overlap()
+check from the set_overlap() function, without omitting
+set_overlap() altogether, led to the observation of a partial
+overlap that wasn't detected, and would actually result in
+replacement of the end element of an existing interval.
+
+This is due to the fact that we'll return -EEXIST on a matching,
+pre-existing start element, instead of -ENOTEMPTY, and the error
+is cleared by API if NLM_F_EXCL is not given. At this point, we
+can insert a matching start, and duplicate the end element as long
+as we don't end up into other intervals.
+
+For instance, inserting interval 0 - 2 with an existing 0 - 3
+interval would result in a single 0 - 2 interval, and a dangling
+'3' end element. This is because nft will proceed after inserting
+the '0' start element as no error is reported, and no further
+conflicting intervals are detected on insertion of the end element.
+
+This needs a different approach as it's a local condition that can
+be detected by looking for duplicate ends coming from left and
+right, separately. Track those and directly report -ENOTEMPTY on
+duplicated end elements for a matching start.
+
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_rbtree.c | 34 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
+index b85ce6f0c0a6f..f317ad80cd6bc 100644
+--- a/net/netfilter/nft_set_rbtree.c
++++ b/net/netfilter/nft_set_rbtree.c
+@@ -218,11 +218,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+ struct nft_rbtree_elem *new,
+ struct nft_set_ext **ext)
+ {
++ bool overlap = false, dup_end_left = false, dup_end_right = false;
+ struct nft_rbtree *priv = nft_set_priv(set);
+ u8 genmask = nft_genmask_next(net);
+ struct nft_rbtree_elem *rbe;
+ struct rb_node *parent, **p;
+- bool overlap = false;
+ int d;
+
+ /* Detect overlaps as we descend the tree. Set the flag in these cases:
+@@ -262,6 +262,20 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+ *
+ * which always happen as last step and imply that no further
+ * overlapping is possible.
++ *
++ * Another special case comes from the fact that start elements matching
++ * an already existing start element are allowed: insertion is not
++ * performed but we return -EEXIST in that case, and the error will be
++ * cleared by the caller if NLM_F_EXCL is not present in the request.
++ * This way, request for insertion of an exact overlap isn't reported as
++ * error to userspace if not desired.
++ *
++ * However, if the existing start matches a pre-existing start, but the
++ * end element doesn't match the corresponding pre-existing end element,
++ * we need to report a partial overlap. This is a local condition that
++ * can be noticed without need for a tracking flag, by checking for a
++ * local duplicated end for a corresponding start, from left and right,
++ * separately.
+ */
+
+ parent = NULL;
+@@ -281,19 +295,35 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+ !nft_set_elem_expired(&rbe->ext) && !*p)
+ overlap = false;
+ } else {
++ if (dup_end_left && !*p)
++ return -ENOTEMPTY;
++
+ overlap = nft_rbtree_interval_end(rbe) &&
+ nft_set_elem_active(&rbe->ext,
+ genmask) &&
+ !nft_set_elem_expired(&rbe->ext);
++
++ if (overlap) {
++ dup_end_right = true;
++ continue;
++ }
+ }
+ } else if (d > 0) {
+ p = &parent->rb_right;
+
+ if (nft_rbtree_interval_end(new)) {
++ if (dup_end_right && !*p)
++ return -ENOTEMPTY;
++
+ overlap = nft_rbtree_interval_end(rbe) &&
+ nft_set_elem_active(&rbe->ext,
+ genmask) &&
+ !nft_set_elem_expired(&rbe->ext);
++
++ if (overlap) {
++ dup_end_left = true;
++ continue;
++ }
+ } else if (nft_set_elem_active(&rbe->ext, genmask) &&
+ !nft_set_elem_expired(&rbe->ext)) {
+ overlap = nft_rbtree_interval_end(rbe);
+@@ -321,6 +351,8 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
+ p = &parent->rb_left;
+ }
+ }
++
++ dup_end_left = dup_end_right = false;
+ }
+
+ if (overlap)
+--
+2.25.1
+
--- /dev/null
+From 30bb899ee4f8672de970280679bc3f3da7a3af2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 15:23:43 +0800
+Subject: NFC: st95hf: Fix memleak in st95hf_in_send_cmd
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit f97c04c316d8fea16dca449fdfbe101fbdfee6a2 ]
+
+When down_killable() fails, skb_resp should be freed
+just like when st95hf_spi_send() fails.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st95hf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 9642971e89cea..4578547659839 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -966,7 +966,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
+ rc = down_killable(&stcontext->exchange_lock);
+ if (rc) {
+ WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
+- return rc;
++ goto free_skb_resp;
+ }
+
+ rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
+--
+2.25.1
+
--- /dev/null
+From 417e0ef8c056229ee15c6c68a469d0cf4052605e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 12:56:08 -0700
+Subject: nvme-fabrics: allow to queue requests for live queues
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 73a5379937ec89b91e907bb315e2434ee9696a2c ]
+
+Right now we are failing requests based on the controller state (which
+is checked inline in nvmf_check_ready) however we should definitely
+accept requests if the queue is live.
+
+When entering controller reset, we transition the controller into
+NVME_CTRL_RESETTING, and then return BLK_STS_RESOURCE for non-mpath
+requests (have blk_noretry_request set).
+
+This is also the case for NVME_REQ_USER for the wrong reason. There
+shouldn't be any reason for us to reject this I/O in a controller reset.
+We do want to prevent passthru commands on the admin queue because we
+need the controller to fully initialize first before we let user passthru
+admin commands to be issued.
+
+In a non-mpath setup, this means that the requests will simply be
+requeued over and over forever not allowing the q_usage_counter to drop
+its final reference, causing controller reset to hang if running
+concurrently with heavy I/O.
+
+Fixes: 35897b920c8a ("nvme-fabrics: fix and refine state checks in __nvmf_check_ready")
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 4ec4829d62334..7799d032bf38b 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -565,10 +565,14 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ struct nvme_request *req = nvme_req(rq);
+
+ /*
+- * If we are in some state of setup or teardown only allow
+- * internally generated commands.
++ * currently we have a problem sending passthru commands
++ * on the admin_q if the controller is not LIVE because we can't
++ * make sure that they are going out after the admin connect,
++ * controller enable and/or other commands in the initialization
++ * sequence. until the controller will be LIVE, fail with
++ * BLK_STS_RESOURCE so that they will be rescheduled.
+ */
+- if (!blk_rq_is_passthrough(rq) || (req->flags & NVME_REQ_USERCMD))
++ if (rq->q == ctrl->admin_q && (req->flags & NVME_REQ_USERCMD))
+ return false;
+
+ /*
+@@ -578,7 +582,7 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ switch (ctrl->state) {
+ case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+- if (nvme_is_fabrics(req->cmd) &&
++ if (blk_rq_is_passthrough(rq) && nvme_is_fabrics(req->cmd) &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+ return true;
+ break;
+--
+2.25.1
+
--- /dev/null
+From 5d66f0c74ce2163740132e5e0742ed6b165dabd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 11:46:51 -0700
+Subject: nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit d7144f5c4cf4de95fdc3422943cf51c06aeaf7a7 ]
+
+NVME_CTRL_NEW should never see any I/O, because in order to start
+initialization it has to transition to NVME_CTRL_CONNECTING and from
+there it will never return to this state.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 7799d032bf38b..8575724734e02 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -580,7 +580,6 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ * which is require to set the queue live in the appropinquate states.
+ */
+ switch (ctrl->state) {
+- case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+ if (blk_rq_is_passthrough(rq) && nvme_is_fabrics(req->cmd) &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+--
+2.25.1
+
--- /dev/null
+From 47e090991555a3738b4dbd7cb47e810513494d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:24:45 -0700
+Subject: nvme: have nvme_wait_freeze_timeout return if it timed out
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 7cf0d7c0f3c3b0203aaf81c1bc884924d8fdb9bd ]
+
+Users can detect if the wait has completed or not and take appropriate
+actions based on this information (e.g. weather to continue
+initialization or rather fail and schedule another initialization
+attempt).
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ drivers/nvme/host/nvme.h | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index fa0039dcacc66..da82ba1896d8d 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4287,7 +4287,7 @@ void nvme_unfreeze(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_unfreeze);
+
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ {
+ struct nvme_ns *ns;
+
+@@ -4298,6 +4298,7 @@ void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ break;
+ }
+ up_read(&ctrl->namespaces_rwsem);
++ return timeout;
+ }
+ EXPORT_SYMBOL_GPL(nvme_wait_freeze_timeout);
+
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index e268f1d7e1a0f..c053aedbc55db 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -538,7 +538,7 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl);
+ void nvme_sync_queues(struct nvme_ctrl *ctrl);
+ void nvme_unfreeze(struct nvme_ctrl *ctrl);
+ void nvme_wait_freeze(struct nvme_ctrl *ctrl);
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
+ void nvme_start_freeze(struct nvme_ctrl *ctrl);
+
+ #define NVME_QID_ANY -1
+--
+2.25.1
+
--- /dev/null
+From 7bb0de953caca7b0c9d91faff45db246cce3e4fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 10:17:08 -0400
+Subject: nvme-pci: cancel nvme device request before disabling
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 7ad92f656bddff4cf8f641e0e3b1acd4eb9644cb ]
+
+This patch addresses an irq free warning and null pointer dereference
+error problem when nvme devices got timeout error during initialization.
+This problem happens when nvme_timeout() function is called while
+nvme_reset_work() is still in execution. This patch fixed the problem by
+setting flag of the problematic request to NVME_REQ_CANCELLED before
+calling nvme_dev_disable() to make sure __nvme_submit_sync_cmd() returns
+an error code and let nvme_submit_sync_cmd() fail gracefully.
+The following is console output.
+
+[ 62.472097] nvme nvme0: I/O 13 QID 0 timeout, disable controller
+[ 62.488796] nvme nvme0: could not set timestamp (881)
+[ 62.494888] ------------[ cut here ]------------
+[ 62.495142] Trying to free already-free IRQ 11
+[ 62.495366] WARNING: CPU: 0 PID: 7 at kernel/irq/manage.c:1751 free_irq+0x1f7/0x370
+[ 62.495742] Modules linked in:
+[ 62.495902] CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.8.0+ #8
+[ 62.496206] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-p4
+[ 62.496772] Workqueue: nvme-reset-wq nvme_reset_work
+[ 62.497019] RIP: 0010:free_irq+0x1f7/0x370
+[ 62.497223] Code: e8 ce 49 11 00 48 83 c4 08 4c 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 44 89 f6 48 c70
+[ 62.498133] RSP: 0000:ffffa96800043d40 EFLAGS: 00010086
+[ 62.498391] RAX: 0000000000000000 RBX: ffff9b87fc458400 RCX: 0000000000000000
+[ 62.498741] RDX: 0000000000000001 RSI: 0000000000000096 RDI: ffffffff9693d72c
+[ 62.499091] RBP: ffff9b87fd4c8f60 R08: ffffa96800043bfd R09: 0000000000000163
+[ 62.499440] R10: ffffa96800043bf8 R11: ffffa96800043bfd R12: ffff9b87fd4c8e00
+[ 62.499790] R13: ffff9b87fd4c8ea4 R14: 000000000000000b R15: ffff9b87fd76b000
+[ 62.500140] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 62.500534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 62.500816] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 62.501165] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 62.501515] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 62.501864] Call Trace:
+[ 62.501993] pci_free_irq+0x13/0x20
+[ 62.502167] nvme_reset_work+0x5d0/0x12a0
+[ 62.502369] ? update_load_avg+0x59/0x580
+[ 62.502569] ? ttwu_queue_wakelist+0xa8/0xc0
+[ 62.502780] ? try_to_wake_up+0x1a2/0x450
+[ 62.502979] process_one_work+0x1d2/0x390
+[ 62.503179] worker_thread+0x45/0x3b0
+[ 62.503361] ? process_one_work+0x390/0x390
+[ 62.503568] kthread+0xf9/0x130
+[ 62.503726] ? kthread_park+0x80/0x80
+[ 62.503911] ret_from_fork+0x22/0x30
+[ 62.504090] ---[ end trace de9ed4a70f8d71e2 ]---
+[ 123.912275] nvme nvme0: I/O 12 QID 0 timeout, disable controller
+[ 123.914670] nvme nvme0: 1/0/0 default/read/poll queues
+[ 123.916310] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 123.917469] #PF: supervisor write access in kernel mode
+[ 123.917725] #PF: error_code(0x0002) - not-present page
+[ 123.917976] PGD 0 P4D 0
+[ 123.918109] Oops: 0002 [#1] SMP PTI
+[ 123.918283] CPU: 0 PID: 7 Comm: kworker/u4:0 Tainted: G W 5.8.0+ #8
+[ 123.918650] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-p4
+[ 123.919219] Workqueue: nvme-reset-wq nvme_reset_work
+[ 123.919469] RIP: 0010:__blk_mq_alloc_map_and_request+0x21/0x80
+[ 123.919757] Code: 66 0f 1f 84 00 00 00 00 00 41 55 41 54 55 48 63 ee 53 48 8b 47 68 89 ee 48 89 fb 8b4
+[ 123.920657] RSP: 0000:ffffa96800043d40 EFLAGS: 00010286
+[ 123.920912] RAX: ffff9b87fc4fee40 RBX: ffff9b87fc8cb008 RCX: 0000000000000000
+[ 123.921258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9b87fc618000
+[ 123.921602] RBP: 0000000000000000 R08: ffff9b87fdc2c4a0 R09: ffff9b87fc616000
+[ 123.921949] R10: 0000000000000000 R11: ffff9b87fffd1500 R12: 0000000000000000
+[ 123.922295] R13: 0000000000000000 R14: ffff9b87fc8cb200 R15: ffff9b87fc8cb000
+[ 123.922641] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 123.923032] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 123.923312] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 123.923660] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 123.924007] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 123.924353] Call Trace:
+[ 123.924479] blk_mq_alloc_tag_set+0x137/0x2a0
+[ 123.924694] nvme_reset_work+0xed6/0x12a0
+[ 123.924898] process_one_work+0x1d2/0x390
+[ 123.925099] worker_thread+0x45/0x3b0
+[ 123.925280] ? process_one_work+0x390/0x390
+[ 123.925486] kthread+0xf9/0x130
+[ 123.925642] ? kthread_park+0x80/0x80
+[ 123.925825] ret_from_fork+0x22/0x30
+[ 123.926004] Modules linked in:
+[ 123.926158] CR2: 0000000000000000
+[ 123.926322] ---[ end trace de9ed4a70f8d71e3 ]---
+[ 123.926549] RIP: 0010:__blk_mq_alloc_map_and_request+0x21/0x80
+[ 123.926832] Code: 66 0f 1f 84 00 00 00 00 00 41 55 41 54 55 48 63 ee 53 48 8b 47 68 89 ee 48 89 fb 8b4
+[ 123.927734] RSP: 0000:ffffa96800043d40 EFLAGS: 00010286
+[ 123.927989] RAX: ffff9b87fc4fee40 RBX: ffff9b87fc8cb008 RCX: 0000000000000000
+[ 123.928336] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9b87fc618000
+[ 123.928679] RBP: 0000000000000000 R08: ffff9b87fdc2c4a0 R09: ffff9b87fc616000
+[ 123.929025] R10: 0000000000000000 R11: ffff9b87fffd1500 R12: 0000000000000000
+[ 123.929370] R13: 0000000000000000 R14: ffff9b87fc8cb200 R15: ffff9b87fc8cb000
+[ 123.929715] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 123.930106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 123.930384] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 123.930731] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 123.931077] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Co-developed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index d4b1ff7471231..69a19fe241063 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1250,8 +1250,8 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ dev_warn_ratelimited(dev->ctrl.device,
+ "I/O %d QID %d timeout, disable controller\n",
+ req->tag, nvmeq->qid);
+- nvme_dev_disable(dev, true);
+ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
++ nvme_dev_disable(dev, true);
+ return BLK_EH_DONE;
+ case NVME_CTRL_RESETTING:
+ return BLK_EH_RESET_TIMER;
+@@ -1268,10 +1268,10 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ dev_warn(dev->ctrl.device,
+ "I/O %d QID %d timeout, reset controller\n",
+ req->tag, nvmeq->qid);
++ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ nvme_dev_disable(dev, false);
+ nvme_reset_ctrl(&dev->ctrl);
+
+- nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ return BLK_EH_DONE;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From fb77bb29d6e2fc770b57417a692c5ee0370d1047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:42:42 -0700
+Subject: nvme-rdma: fix reset hang if controller died in the middle of a reset
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 2362acb6785611eda795bfc12e1ea6b202ecf62c ]
+
+If the controller becomes unresponsive in the middle of a reset, we
+will hang because we are waiting for the freeze to complete, but that
+cannot happen since we have commands that are inflight holding the
+q_usage_counter, and we can't blindly fail requests that times out.
+
+So give a timeout and if we cannot wait for queue freeze before
+unfreezing, fail and have the error handling take care how to
+proceed (either schedule a reconnect of remove the controller).
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 99bf88eb812c5..6c07bb55b0f83 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -950,7 +950,15 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ if (!new) {
+ nvme_start_queues(&ctrl->ctrl);
+- nvme_wait_freeze(&ctrl->ctrl);
++ if (!nvme_wait_freeze_timeout(&ctrl->ctrl, NVME_IO_TIMEOUT)) {
++ /*
++ * If we timed out waiting for freeze we are likely to
++ * be stuck. Fail the controller initialization just
++ * to be safe.
++ */
++ ret = -ENODEV;
++ goto out_wait_freeze_timed_out;
++ }
+ blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
+ ctrl->ctrl.queue_count - 1);
+ nvme_unfreeze(&ctrl->ctrl);
+@@ -958,6 +966,9 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ return 0;
+
++out_wait_freeze_timed_out:
++ nvme_stop_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.connect_q);
+--
+2.25.1
+
--- /dev/null
+From 78ef881fd9ffb1078a945ae937fe78fe196b7f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 02:36:03 -0700
+Subject: nvme-rdma: fix timeout handler
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0475a8dcbcee92a5d22e40c9c6353829fc6294b8 ]
+
+When a request times out in a LIVE state, we simply trigger error
+recovery and let the error recovery handle the request cancellation,
+however when a request times out in a non LIVE state, we make sure to
+complete it immediately as it might block controller setup or teardown
+and prevent forward progress.
+
+However tearing down the entire set of I/O and admin queues causes
+freeze/unfreeze imbalance (q->mq_freeze_depth) because and is really
+an overkill to what we actually need, which is to just fence controller
+teardown that may be running, stop the queue, and cancel the request if
+it is not already completed.
+
+Now that we have the controller teardown_lock, we can safely serialize
+request cancellation. This addresses a hang caused by calling extra
+queue freeze on controller namespaces, causing unfreeze to not complete
+correctly.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 49 +++++++++++++++++++++++++++-------------
+ 1 file changed, 33 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index ffe83d1f576bf..99bf88eb812c5 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1159,6 +1159,7 @@ static void nvme_rdma_error_recovery(struct nvme_rdma_ctrl *ctrl)
+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
+ return;
+
++ dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+ queue_work(nvme_reset_wq, &ctrl->err_work);
+ }
+
+@@ -1925,6 +1926,22 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
+ return 0;
+ }
+
++static void nvme_rdma_complete_timed_out(struct request *rq)
++{
++ struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_rdma_queue *queue = req->queue;
++ struct nvme_rdma_ctrl *ctrl = queue->ctrl;
++
++ /* fence other contexts that may complete the command */
++ mutex_lock(&ctrl->teardown_lock);
++ nvme_rdma_stop_queue(queue);
++ if (!blk_mq_request_completed(rq)) {
++ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
++ blk_mq_complete_request(rq);
++ }
++ mutex_unlock(&ctrl->teardown_lock);
++}
++
+ static enum blk_eh_timer_return
+ nvme_rdma_timeout(struct request *rq, bool reserved)
+ {
+@@ -1935,29 +1952,29 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
+ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
+ rq->tag, nvme_rdma_queue_idx(queue));
+
+- /*
+- * Restart the timer if a controller reset is already scheduled. Any
+- * timed out commands would be handled before entering the connecting
+- * state.
+- */
+- if (ctrl->ctrl.state == NVME_CTRL_RESETTING)
+- return BLK_EH_RESET_TIMER;
+-
+ if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
+ /*
+- * Teardown immediately if controller times out while starting
+- * or we are already started error recovery. all outstanding
+- * requests are completed on shutdown, so we return BLK_EH_DONE.
++ * If we are resetting, connecting or deleting we should
++ * complete immediately because we may block controller
++ * teardown or setup sequence
++ * - ctrl disable/shutdown fabrics requests
++ * - connect requests
++ * - initialization admin requests
++ * - I/O requests that entered after unquiescing and
++ * the controller stopped responding
++ *
++ * All other requests should be cancelled by the error
++ * recovery work, so it's fine that we fail it here.
+ */
+- flush_work(&ctrl->err_work);
+- nvme_rdma_teardown_io_queues(ctrl, false);
+- nvme_rdma_teardown_admin_queue(ctrl, false);
++ nvme_rdma_complete_timed_out(rq);
+ return BLK_EH_DONE;
+ }
+
+- dev_warn(ctrl->ctrl.device, "starting error recovery\n");
++ /*
++ * LIVE state should trigger the normal error recovery which will
++ * handle completing this request.
++ */
+ nvme_rdma_error_recovery(ctrl);
+-
+ return BLK_EH_RESET_TIMER;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 1dfff7849bad4bca852b61bf8e70a67e7578e47e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 18:13:58 -0700
+Subject: nvme-rdma: serialize controller teardown sequences
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 5110f40241d08334375eb0495f174b1d2c07657e ]
+
+In the timeout handler we may need to complete a request because the
+request that timed out may be an I/O that is a part of a serial sequence
+of controller teardown or initialization. In order to complete the
+request, we need to fence any other context that may compete with us
+and complete the request that is timing out.
+
+In this case, we could have a potential double completion in case
+a hard-irq or a different competing context triggered error recovery
+and is running inflight request cancellation concurrently with the
+timeout handler.
+
+Protect using a ctrl teardown_lock to serialize contexts that may
+complete a cancelled request due to error recovery or a reset.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 876859cd14e86..ffe83d1f576bf 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -121,6 +121,7 @@ struct nvme_rdma_ctrl {
+ struct sockaddr_storage src_addr;
+
+ struct nvme_ctrl ctrl;
++ struct mutex teardown_lock;
+ bool use_inline_data;
+ u32 io_queues[HCTX_MAX_TYPES];
+ };
+@@ -971,6 +972,7 @@ out_free_io_queues:
+ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (ctrl->ctrl.admin_tagset) {
+@@ -981,11 +983,13 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_start_freeze(&ctrl->ctrl);
+ nvme_stop_queues(&ctrl->ctrl);
+@@ -999,6 +1003,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+ }
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
+@@ -2252,6 +2257,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+ ctrl->ctrl.opts = opts;
+ INIT_LIST_HEAD(&ctrl->list);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.25.1
+
--- /dev/null
+From 098691947a7183b9ade008b01e8a9825e84e4c20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:25:34 -0700
+Subject: nvme-tcp: fix reset hang if controller died in the middle of a reset
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit e5c01f4f7f623e768e868bcc08d8e7ceb03b75d0 ]
+
+If the controller becomes unresponsive in the middle of a reset, we will
+hang because we are waiting for the freeze to complete, but that cannot
+happen since we have commands that are inflight holding the
+q_usage_counter, and we can't blindly fail requests that times out.
+
+So give a timeout and if we cannot wait for queue freeze before
+unfreezing, fail and have the error handling take care how to proceed
+(either schedule a reconnect of remove the controller).
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 65a3bad778104..f1f66bf96cbb9 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1753,7 +1753,15 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ if (!new) {
+ nvme_start_queues(ctrl);
+- nvme_wait_freeze(ctrl);
++ if (!nvme_wait_freeze_timeout(ctrl, NVME_IO_TIMEOUT)) {
++ /*
++ * If we timed out waiting for freeze we are likely to
++ * be stuck. Fail the controller initialization just
++ * to be safe.
++ */
++ ret = -ENODEV;
++ goto out_wait_freeze_timed_out;
++ }
+ blk_mq_update_nr_hw_queues(ctrl->tagset,
+ ctrl->queue_count - 1);
+ nvme_unfreeze(ctrl);
+@@ -1761,6 +1769,9 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ return 0;
+
++out_wait_freeze_timed_out:
++ nvme_stop_queues(ctrl);
++ nvme_tcp_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
+ if (new)
+ blk_cleanup_queue(ctrl->connect_q);
+--
+2.25.1
+
--- /dev/null
+From 1ed8d2111315d3b601282cfbe2d18439d24ca625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 13:16:36 -0700
+Subject: nvme-tcp: fix timeout handler
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 236187c4ed195161dfa4237c7beffbba0c5ae45b ]
+
+When a request times out in a LIVE state, we simply trigger error
+recovery and let the error recovery handle the request cancellation,
+however when a request times out in a non LIVE state, we make sure to
+complete it immediately as it might block controller setup or teardown
+and prevent forward progress.
+
+However tearing down the entire set of I/O and admin queues causes
+freeze/unfreeze imbalance (q->mq_freeze_depth) because and is really
+an overkill to what we actually need, which is to just fence controller
+teardown that may be running, stop the queue, and cancel the request if
+it is not already completed.
+
+Now that we have the controller teardown_lock, we can safely serialize
+request cancellation. This addresses a hang caused by calling extra
+queue freeze on controller namespaces, causing unfreeze to not complete
+correctly.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 56 ++++++++++++++++++++++++++---------------
+ 1 file changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index d1e5b27675b1b..65a3bad778104 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -448,6 +448,7 @@ static void nvme_tcp_error_recovery(struct nvme_ctrl *ctrl)
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING))
+ return;
+
++ dev_warn(ctrl->device, "starting error recovery\n");
+ queue_work(nvme_reset_wq, &to_tcp_ctrl(ctrl)->err_work);
+ }
+
+@@ -2125,40 +2126,55 @@ static void nvme_tcp_submit_async_event(struct nvme_ctrl *arg)
+ nvme_tcp_queue_request(&ctrl->async_req, true);
+ }
+
++static void nvme_tcp_complete_timed_out(struct request *rq)
++{
++ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
++
++ /* fence other contexts that may complete the command */
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
++ nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue));
++ if (!blk_mq_request_completed(rq)) {
++ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
++ blk_mq_complete_request(rq);
++ }
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
++}
++
+ static enum blk_eh_timer_return
+ nvme_tcp_timeout(struct request *rq, bool reserved)
+ {
+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+- struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
++ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
+ struct nvme_tcp_cmd_pdu *pdu = req->pdu;
+
+- /*
+- * Restart the timer if a controller reset is already scheduled. Any
+- * timed out commands would be handled before entering the connecting
+- * state.
+- */
+- if (ctrl->ctrl.state == NVME_CTRL_RESETTING)
+- return BLK_EH_RESET_TIMER;
+-
+- dev_warn(ctrl->ctrl.device,
++ dev_warn(ctrl->device,
+ "queue %d: timeout request %#x type %d\n",
+ nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
+
+- if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
++ if (ctrl->state != NVME_CTRL_LIVE) {
+ /*
+- * Teardown immediately if controller times out while starting
+- * or we are already started error recovery. all outstanding
+- * requests are completed on shutdown, so we return BLK_EH_DONE.
++ * If we are resetting, connecting or deleting we should
++ * complete immediately because we may block controller
++ * teardown or setup sequence
++ * - ctrl disable/shutdown fabrics requests
++ * - connect requests
++ * - initialization admin requests
++ * - I/O requests that entered after unquiescing and
++ * the controller stopped responding
++ *
++ * All other requests should be cancelled by the error
++ * recovery work, so it's fine that we fail it here.
+ */
+- flush_work(&ctrl->err_work);
+- nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+- nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
++ nvme_tcp_complete_timed_out(rq);
+ return BLK_EH_DONE;
+ }
+
+- dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+- nvme_tcp_error_recovery(&ctrl->ctrl);
+-
++ /*
++ * LIVE state should trigger the normal error recovery which will
++ * handle completing this request.
++ */
++ nvme_tcp_error_recovery(ctrl);
+ return BLK_EH_RESET_TIMER;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 09f7cc6de289e42577fb0b8d37f84de363aa55b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 18:13:48 -0700
+Subject: nvme-tcp: serialize controller teardown sequences
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit d4d61470ae48838f49e668503e840e1520b97162 ]
+
+In the timeout handler we may need to complete a request because the
+request that timed out may be an I/O that is a part of a serial sequence
+of controller teardown or initialization. In order to complete the
+request, we need to fence any other context that may compete with us
+and complete the request that is timing out.
+
+In this case, we could have a potential double completion in case
+a hard-irq or a different competing context triggered error recovery
+and is running inflight request cancellation concurrently with the
+timeout handler.
+
+Protect using a ctrl teardown_lock to serialize contexts that may
+complete a cancelled request due to error recovery or a reset.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index a6d2e3330a584..d1e5b27675b1b 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -122,6 +122,7 @@ struct nvme_tcp_ctrl {
+ struct sockaddr_storage src_addr;
+ struct nvme_ctrl ctrl;
+
++ struct mutex teardown_lock;
+ struct work_struct err_work;
+ struct delayed_work connect_work;
+ struct nvme_tcp_request async_req;
+@@ -1497,7 +1498,6 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid)
+
+ if (!test_and_clear_bit(NVME_TCP_Q_LIVE, &queue->flags))
+ return;
+-
+ __nvme_tcp_stop_queue(queue);
+ }
+
+@@ -1845,6 +1845,7 @@ out_free_queue:
+ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->admin_q);
+ nvme_tcp_stop_queue(ctrl, 0);
+ if (ctrl->admin_tagset) {
+@@ -1855,13 +1856,16 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+ nvme_tcp_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ if (ctrl->queue_count <= 1)
+- return;
++ goto out;
++ blk_mq_quiesce_queue(ctrl->admin_q);
+ nvme_start_freeze(ctrl);
+ nvme_stop_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+@@ -1873,6 +1877,8 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ if (remove)
+ nvme_start_queues(ctrl);
+ nvme_tcp_destroy_io_queues(ctrl, remove);
++out:
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl)
+@@ -2384,6 +2390,7 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev,
+ nvme_tcp_reconnect_ctrl_work);
+ INIT_WORK(&ctrl->err_work, nvme_tcp_error_recovery_work);
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_reset_ctrl_work);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.25.1
+
--- /dev/null
+From 123e699699470b519be4e61cd28777463a8685c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Aug 2020 00:48:10 +0800
+Subject: nvmet-tcp: Fix NULL dereference when a connect data comes in h2cdata
+ pdu
+
+From: Ziye Yang <ziye.yang@intel.com>
+
+[ Upstream commit a6ce7d7b4adaebc27ee7e78e5ecc378a1cfc221d ]
+
+When handling commands without in-capsule data, we assign the ttag
+assuming we already have the queue commands array allocated (based
+on the queue size information in the connect data payload). However
+if the connect itself did not send the connect data in-capsule we
+have yet to allocate the queue commands,and we will assign a bogus
+ttag and suffer a NULL dereference when we receive the corresponding
+h2cdata pdu.
+
+Fix this by checking if we already allocated commands before
+dereferencing it when handling h2cdata, if we didn't, its for sure a
+connect and we should use the preallocated connect command.
+
+Signed-off-by: Ziye Yang <ziye.yang@intel.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index de9217cfd22d7..3d29b773ced27 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -160,6 +160,11 @@ static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd);
+ static inline u16 nvmet_tcp_cmd_tag(struct nvmet_tcp_queue *queue,
+ struct nvmet_tcp_cmd *cmd)
+ {
++ if (unlikely(!queue->nr_cmds)) {
++ /* We didn't allocate cmds yet, send 0xffff */
++ return USHRT_MAX;
++ }
++
+ return cmd - queue->cmds;
+ }
+
+@@ -872,7 +877,10 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
+ struct nvme_tcp_data_pdu *data = &queue->pdu.data;
+ struct nvmet_tcp_cmd *cmd;
+
+- cmd = &queue->cmds[data->ttag];
++ if (likely(queue->nr_cmds))
++ cmd = &queue->cmds[data->ttag];
++ else
++ cmd = &queue->connect;
+
+ if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) {
+ pr_err("ttag %u unexpected data offset %u (expected %u)\n",
+--
+2.25.1
+
--- /dev/null
+From 5a4514a4fb1665da7877eae27a40a987fe17f7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 13:07:56 -0400
+Subject: padata: fix possible padata_works_lock deadlock
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 1b0df11fde0f14a269a181b3b7f5122415bc5ed7 ]
+
+syzbot reports,
+
+ WARNING: inconsistent lock state
+ 5.9.0-rc2-syzkaller #0 Not tainted
+ --------------------------------
+ inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
+ syz-executor.0/26715 takes:
+ (padata_works_lock){+.?.}-{2:2}, at: padata_do_parallel kernel/padata.c:220
+ {IN-SOFTIRQ-W} state was registered at:
+ spin_lock include/linux/spinlock.h:354 [inline]
+ padata_do_parallel kernel/padata.c:220
+ ...
+ __do_softirq kernel/softirq.c:298
+ ...
+ sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1091
+ asm_sysvec_apic_timer_interrupt arch/x86/include/asm/idtentry.h:581
+
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(padata_works_lock);
+ <Interrupt>
+ lock(padata_works_lock);
+
+padata_do_parallel() takes padata_works_lock with softirqs enabled, so a
+deadlock is possible if, on the same CPU, the lock is acquired in
+process context and then softirq handling done in an interrupt leads to
+the same path.
+
+Fix by leaving softirqs disabled while do_parallel holds
+padata_works_lock.
+
+Reported-by: syzbot+f4b9f49e38e25eb4ef52@syzkaller.appspotmail.com
+Fixes: 4611ce2246889 ("padata: allocate work structures for parallel jobs from a pool")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 4373f7adaa40a..3bc90fec0904c 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -215,12 +215,13 @@ int padata_do_parallel(struct padata_shell *ps,
+ padata->pd = pd;
+ padata->cb_cpu = *cb_cpu;
+
+- rcu_read_unlock_bh();
+-
+ spin_lock(&padata_works_lock);
+ padata->seq_nr = ++pd->seq_nr;
+ pw = padata_work_alloc();
+ spin_unlock(&padata_works_lock);
++
++ rcu_read_unlock_bh();
++
+ if (pw) {
+ padata_work_init(pw, padata_parallel_worker, padata, 0);
+ queue_work(pinst->parallel_wq, &pw->pw_work);
+--
+2.25.1
+
--- /dev/null
+From 07d6cc1073ea59346ba236be5ad8485794f3a008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:32 -0700
+Subject: RDMA/bnxt_re: Do not report transparent vlan from QP1
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 2d0e60ee322d512fa6bc62d23a6760b39a380847 ]
+
+QP1 Rx CQE reports transparent VLAN ID in the completion and this is used
+while reporting the completion for received MAD packet. Check if the vlan
+id is configured before reporting it in the work completion.
+
+Fixes: 84511455ac5b ("RDMA/bnxt_re: report vlan_id and sl in qp1 recv completion")
+Link: https://lore.kernel.org/r/1598292876-26529-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 8b6ad5cddfce9..dad38aa06403d 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -3178,6 +3178,19 @@ static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
+ wc->wc_flags |= IB_WC_GRH;
+ }
+
++static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev,
++ u16 vlan_id)
++{
++ /*
++ * Check if the vlan is configured in the host. If not configured, it
++ * can be a transparent VLAN. So dont report the vlan id.
++ */
++ if (!__vlan_find_dev_deep_rcu(rdev->netdev,
++ htons(ETH_P_8021Q), vlan_id))
++ return false;
++ return true;
++}
++
+ static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe,
+ u16 *vid, u8 *sl)
+ {
+@@ -3246,9 +3259,11 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp,
+ wc->src_qp = orig_cqe->src_qp;
+ memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
+ if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
+- wc->vlan_id = vlan_id;
+- wc->sl = sl;
+- wc->wc_flags |= IB_WC_WITH_VLAN;
++ if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) {
++ wc->vlan_id = vlan_id;
++ wc->sl = sl;
++ wc->wc_flags |= IB_WC_WITH_VLAN;
++ }
+ }
+ wc->port_num = 1;
+ wc->vendor_err = orig_cqe->status;
+--
+2.25.1
+
--- /dev/null
+From 89331f5dfd8a627e596ec61e8d316116914857c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:36 -0700
+Subject: RDMA/bnxt_re: Fix driver crash on unaligned PSN entry address
+
+From: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+
+[ Upstream commit 934d0ac9a64d21523e3ad03ea4098da7826bc788 ]
+
+When computing the first psn entry, driver checks for page alignment. If
+this address is not page aligned,it attempts to compute the offset in that
+page for later use by using ALIGN macro. ALIGN macro does not return
+offset bytes but the requested aligned address and hence cannot be used
+directly to store as offset. Since driver was using the address itself
+instead of offset, it resulted in invalid address when filling the psn
+buffer.
+
+Fixed driver to use PAGE_MASK macro to calculate the offset.
+
+Fixes: fddcbbb02af4 ("RDMA/bnxt_re: Simplify obtaining queue entry from hw ring")
+Link: https://lore.kernel.org/r/1598292876-26529-7-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index b217208f6bcce..4b53f79b91d1d 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -922,10 +922,10 @@ static void bnxt_qplib_init_psn_ptr(struct bnxt_qplib_qp *qp, int size)
+ sq = &qp->sq;
+ hwq = &sq->hwq;
+
++ /* First psn entry */
+ fpsne = (u64)bnxt_qplib_get_qe(hwq, hwq->max_elements, &psn_pg);
+ if (!IS_ALIGNED(fpsne, PAGE_SIZE))
+- indx_pad = ALIGN(fpsne, PAGE_SIZE) / size;
+-
++ indx_pad = (fpsne & ~PAGE_MASK) / size;
+ page = (u64 *)psn_pg;
+ for (indx = 0; indx < hwq->max_elements; indx++) {
+ pg_num = (indx + indx_pad) / (PAGE_SIZE / size);
+--
+2.25.1
+
--- /dev/null
+From 36d7ced3a078694308637565238b25500cdd5f48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:33 -0700
+Subject: RDMA/bnxt_re: Fix the qp table indexing
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 84cf229f4001c1216afc3e4c7f05e1620a0dd4bc ]
+
+qp->id can be a value outside the max number of qp. Indexing the qp table
+with the id can cause out of bounds crash. So changing the qp table
+indexing by (qp->id % max_qp -1).
+
+Allocating one extra entry for QP1. Some adapters create one more than the
+max_qp requested to accommodate QP1. If the qp->id is 1, store the
+inforamtion in the last entry of the qp table.
+
+Fixes: f218d67ef004 ("RDMA/bnxt_re: Allow posting when QPs are in error")
+Link: https://lore.kernel.org/r/1598292876-26529-4-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 22 ++++++++++++++--------
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 10 ++++++----
+ drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 5 +++++
+ 3 files changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index c5e29577cd434..b217208f6bcce 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -796,6 +796,7 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
+ u16 cmd_flags = 0;
+ u32 qp_flags = 0;
+ u8 pg_sz_lvl;
++ u32 tbl_indx;
+ int rc;
+
+ RCFW_CMD_PREP(req, CREATE_QP1, cmd_flags);
+@@ -891,8 +892,9 @@ int bnxt_qplib_create_qp1(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
+ rq->dbinfo.xid = qp->id;
+ rq->dbinfo.db = qp->dpi->dbr;
+ }
+- rcfw->qp_tbl[qp->id].qp_id = qp->id;
+- rcfw->qp_tbl[qp->id].qp_handle = (void *)qp;
++ tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
++ rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
++ rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp;
+
+ return 0;
+
+@@ -950,6 +952,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
+ u32 qp_flags = 0;
+ u8 pg_sz_lvl;
+ u16 max_rsge;
++ u32 tbl_indx;
+
+ RCFW_CMD_PREP(req, CREATE_QP, cmd_flags);
+
+@@ -1118,8 +1121,9 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp)
+ rq->dbinfo.xid = qp->id;
+ rq->dbinfo.db = qp->dpi->dbr;
+ }
+- rcfw->qp_tbl[qp->id].qp_id = qp->id;
+- rcfw->qp_tbl[qp->id].qp_handle = (void *)qp;
++ tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
++ rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
++ rcfw->qp_tbl[tbl_indx].qp_handle = (void *)qp;
+
+ return 0;
+
+@@ -1467,10 +1471,12 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
+ struct cmdq_destroy_qp req;
+ struct creq_destroy_qp_resp resp;
+ u16 cmd_flags = 0;
++ u32 tbl_indx;
+ int rc;
+
+- rcfw->qp_tbl[qp->id].qp_id = BNXT_QPLIB_QP_ID_INVALID;
+- rcfw->qp_tbl[qp->id].qp_handle = NULL;
++ tbl_indx = map_qp_id_to_tbl_indx(qp->id, rcfw);
++ rcfw->qp_tbl[tbl_indx].qp_id = BNXT_QPLIB_QP_ID_INVALID;
++ rcfw->qp_tbl[tbl_indx].qp_handle = NULL;
+
+ RCFW_CMD_PREP(req, DESTROY_QP, cmd_flags);
+
+@@ -1478,8 +1484,8 @@ int bnxt_qplib_destroy_qp(struct bnxt_qplib_res *res,
+ rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req,
+ (void *)&resp, NULL, 0);
+ if (rc) {
+- rcfw->qp_tbl[qp->id].qp_id = qp->id;
+- rcfw->qp_tbl[qp->id].qp_handle = qp;
++ rcfw->qp_tbl[tbl_indx].qp_id = qp->id;
++ rcfw->qp_tbl[tbl_indx].qp_handle = qp;
+ return rc;
+ }
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 4e211162acee2..f7736e34ac64c 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -307,14 +307,15 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ __le16 mcookie;
+ u16 cookie;
+ int rc = 0;
+- u32 qp_id;
++ u32 qp_id, tbl_indx;
+
+ pdev = rcfw->pdev;
+ switch (qp_event->event) {
+ case CREQ_QP_EVENT_EVENT_QP_ERROR_NOTIFICATION:
+ err_event = (struct creq_qp_error_notification *)qp_event;
+ qp_id = le32_to_cpu(err_event->xid);
+- qp = rcfw->qp_tbl[qp_id].qp_handle;
++ tbl_indx = map_qp_id_to_tbl_indx(qp_id, rcfw);
++ qp = rcfw->qp_tbl[tbl_indx].qp_handle;
+ dev_dbg(&pdev->dev, "Received QP error notification\n");
+ dev_dbg(&pdev->dev,
+ "qpid 0x%x, req_err=0x%x, resp_err=0x%x\n",
+@@ -615,8 +616,9 @@ int bnxt_qplib_alloc_rcfw_channel(struct bnxt_qplib_res *res,
+
+ cmdq->bmap_size = bmap_size;
+
+- rcfw->qp_tbl_size = qp_tbl_sz;
+- rcfw->qp_tbl = kcalloc(qp_tbl_sz, sizeof(struct bnxt_qplib_qp_node),
++ /* Allocate one extra to hold the QP1 entries */
++ rcfw->qp_tbl_size = qp_tbl_sz + 1;
++ rcfw->qp_tbl = kcalloc(rcfw->qp_tbl_size, sizeof(struct bnxt_qplib_qp_node),
+ GFP_KERNEL);
+ if (!rcfw->qp_tbl)
+ goto fail;
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+index 157387636d004..5f2f0a5a3560f 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h
+@@ -216,4 +216,9 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw);
+ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw,
+ struct bnxt_qplib_ctx *ctx, int is_virtfn);
+ void bnxt_qplib_mark_qp_error(void *qp_handle);
++static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw)
++{
++ /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/
++ return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2;
++}
+ #endif /* __BNXT_QPLIB_RCFW_H__ */
+--
+2.25.1
+
--- /dev/null
+From be1f8f47f02a3910c44c0cf92ad7c47e19a32a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:31 -0700
+Subject: RDMA/bnxt_re: Remove the qp from list only if the qp destroy succeeds
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 097a9d23b7250355b182c5fd47dd4c55b22b1c33 ]
+
+Driver crashes when destroy_qp is re-tried because of an error
+returned. This is because the qp entry was removed from the qp list during
+the first call.
+
+Remove qp from the list only if destroy_qp returns success.
+
+The driver will still trigger a WARN_ON due to the memory leaking, but at
+least it isn't corrupting memory too.
+
+Fixes: 8dae419f9ec7 ("RDMA/bnxt_re: Refactor queue pair creation code")
+Link: https://lore.kernel.org/r/1598292876-26529-2-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index dad38aa06403d..cb6e873039df5 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -752,12 +752,6 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
+ gsi_sqp = rdev->gsi_ctx.gsi_sqp;
+ gsi_sah = rdev->gsi_ctx.gsi_sah;
+
+- /* remove from active qp list */
+- mutex_lock(&rdev->qp_lock);
+- list_del(&gsi_sqp->list);
+- mutex_unlock(&rdev->qp_lock);
+- atomic_dec(&rdev->qp_count);
+-
+ ibdev_dbg(&rdev->ibdev, "Destroy the shadow AH\n");
+ bnxt_qplib_destroy_ah(&rdev->qplib_res,
+ &gsi_sah->qplib_ah,
+@@ -772,6 +766,12 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
+ }
+ bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp);
+
++ /* remove from active qp list */
++ mutex_lock(&rdev->qp_lock);
++ list_del(&gsi_sqp->list);
++ mutex_unlock(&rdev->qp_lock);
++ atomic_dec(&rdev->qp_count);
++
+ kfree(rdev->gsi_ctx.sqp_tbl);
+ kfree(gsi_sah);
+ kfree(gsi_sqp);
+@@ -792,11 +792,6 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
+ unsigned int flags;
+ int rc;
+
+- mutex_lock(&rdev->qp_lock);
+- list_del(&qp->list);
+- mutex_unlock(&rdev->qp_lock);
+- atomic_dec(&rdev->qp_count);
+-
+ bnxt_qplib_flush_cqn_wq(&qp->qplib_qp);
+
+ rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp);
+@@ -819,6 +814,11 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata)
+ goto sh_fail;
+ }
+
++ mutex_lock(&rdev->qp_lock);
++ list_del(&qp->list);
++ mutex_unlock(&rdev->qp_lock);
++ atomic_dec(&rdev->qp_count);
++
+ ib_umem_release(qp->rumem);
+ ib_umem_release(qp->sumem);
+
+--
+2.25.1
+
--- /dev/null
+From e48f39e728d439de586804c63e552c91fa675c20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:34 -0700
+Subject: RDMA/bnxt_re: Static NQ depth allocation
+
+From: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+
+[ Upstream commit f86b31c6a28f06eed3f6d9dc958079853b0792f1 ]
+
+At first, driver allocates memory for NQ based on qplib_ctx->cq_count and
+qplib_ctx->srqc_count. Later when creating ring, it uses a static value
+of 128K -1.
+
+Fixing this with a static value for now.
+
+Fixes: b08fe048a69d ("RDMA/bnxt_re: Refactor net ring allocation function")
+Link: https://lore.kernel.org/r/1598292876-26529-5-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Naresh Kumar PBS <nareshkumar.pbs@broadcom.com>
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
+index 5c41e13496a02..882c4f49d3a87 100644
+--- a/drivers/infiniband/hw/bnxt_re/main.c
++++ b/drivers/infiniband/hw/bnxt_re/main.c
+@@ -1027,8 +1027,7 @@ static int bnxt_re_alloc_res(struct bnxt_re_dev *rdev)
+ struct bnxt_qplib_nq *nq;
+
+ nq = &rdev->nq[i];
+- nq->hwq.max_elements = (qplib_ctx->cq_count +
+- qplib_ctx->srqc_count + 2);
++ nq->hwq.max_elements = BNXT_QPLIB_NQE_MAX_CNT;
+ rc = bnxt_qplib_alloc_nq(&rdev->qplib_res, &rdev->nq[i]);
+ if (rc) {
+ ibdev_err(&rdev->ibdev, "Alloc Failed NQ%d rc:%#x",
+--
+2.25.1
+
--- /dev/null
+From fb2326c9d4cee5b8a5c0be784371614b237ce8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 15:43:04 +0300
+Subject: RDMA/core: Fix reported speed and width
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 28b0865714b315e318ac45c4fc9156f3d4649646 ]
+
+When the returned speed from __ethtool_get_link_ksettings() is
+SPEED_UNKNOWN this will lead to reporting a wrong speed and width for
+providers that uses ib_get_eth_speed(), fix that by defaulting the
+netdev_speed to SPEED_1000 in case the returned value from
+__ethtool_get_link_ksettings() is SPEED_UNKNOWN.
+
+Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
+Link: https://lore.kernel.org/r/20200902124304.170912-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index f369f0a19e851..1b0ea945756f0 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1803,7 +1803,7 @@ int ib_get_eth_speed(struct ib_device *dev, u8 port_num, u8 *speed, u8 *width)
+
+ dev_put(netdev);
+
+- if (!rc) {
++ if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
+ netdev_speed = lksettings.base.speed;
+ } else {
+ netdev_speed = SPEED_1000;
+--
+2.25.1
+
--- /dev/null
+From 913ded4cbe286c4ee4bb4814010c7b247e147fab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 20:38:55 +0800
+Subject: RDMA/core: Fix unsafe linked list traversal after failing to allocate
+ CQ
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 8aa64be019567c4f90d45c5082a4b6f22e182d00 ]
+
+It's not safe to access the next CQ in list_for_each_entry() after
+invoking ib_free_cq(), because the CQ has already been freed in current
+iteration. It should be replaced by list_for_each_entry_safe().
+
+Fixes: c7ff819aefea ("RDMA/core: Introduce shared CQ pool API")
+Link: https://lore.kernel.org/r/1598963935-32335-1-git-send-email-liweihang@huawei.com
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
+index 513825e424bff..a92fc3f90bb5b 100644
+--- a/drivers/infiniband/core/cq.c
++++ b/drivers/infiniband/core/cq.c
+@@ -379,7 +379,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
+ {
+ LIST_HEAD(tmp_list);
+ unsigned int nr_cqs, i;
+- struct ib_cq *cq;
++ struct ib_cq *cq, *n;
+ int ret;
+
+ if (poll_ctx > IB_POLL_LAST_POOL_TYPE) {
+@@ -412,7 +412,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
+ return 0;
+
+ out_free_cqs:
+- list_for_each_entry(cq, &tmp_list, pool_entry) {
++ list_for_each_entry_safe(cq, n, &tmp_list, pool_entry) {
+ cq->shared = false;
+ ib_free_cq(cq);
+ }
+--
+2.25.1
+
--- /dev/null
+From 320d735d6c3935b46b83480490369f0aab269f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 14:57:22 +0530
+Subject: RDMA/rtrs-srv: Replace device_register with device_initialize and
+ device_add
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit baa5b28b7a474f66a511ebf71a2ade510652a2f6 ]
+
+There are error cases when we will call free_srv before device kobject is
+initialized; in such cases calling put_device generates the following
+warning:
+
+ kobject: '(null)' (000000009f5445ed): is not initialized, yet
+ kobject_put() is being called.
+
+So call device_initialize() only once when the server is allocated. If we
+end up calling put_srv() and subsequently free_srv(), our call to
+put_device() would result in deletion of the obj. Call device_add() later
+when we actually have a connection. Correspondingly, call device_del()
+instead of device_unregister() when srv->dev_ref falls to 0.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20200811092722.2450-1-haris.iqbal@cloud.ionos.com
+Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 8 ++++----
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 +
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index 3d7877534bcc9..2f981ae970767 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -182,16 +182,16 @@ static int rtrs_srv_create_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ * sysfs files are created
+ */
+ dev_set_uevent_suppress(&srv->dev, true);
+- err = device_register(&srv->dev);
++ err = device_add(&srv->dev);
+ if (err) {
+- pr_err("device_register(): %d\n", err);
++ pr_err("device_add(): %d\n", err);
+ goto put;
+ }
+ srv->kobj_paths = kobject_create_and_add("paths", &srv->dev.kobj);
+ if (!srv->kobj_paths) {
+ err = -ENOMEM;
+ pr_err("kobject_create_and_add(): %d\n", err);
+- device_unregister(&srv->dev);
++ device_del(&srv->dev);
+ goto unlock;
+ }
+ dev_set_uevent_suppress(&srv->dev, false);
+@@ -216,7 +216,7 @@ rtrs_srv_destroy_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ kobject_del(srv->kobj_paths);
+ kobject_put(srv->kobj_paths);
+ mutex_unlock(&srv->paths_mutex);
+- device_unregister(&srv->dev);
++ device_del(&srv->dev);
+ } else {
+ mutex_unlock(&srv->paths_mutex);
+ }
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index a219bd1bdbc26..b61a18e57aeba 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1336,6 +1336,7 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+ uuid_copy(&srv->paths_uuid, paths_uuid);
+ srv->queue_depth = sess_queue_depth;
+ srv->ctx = ctx;
++ device_initialize(&srv->dev);
+
+ srv->chunks = kcalloc(srv->queue_depth, sizeof(*srv->chunks),
+ GFP_KERNEL);
+--
+2.25.1
+
--- /dev/null
+From 6dab4cda4f7822ec9bdeb737a79b4b695d0d1f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Sep 2020 15:52:16 +0530
+Subject: RDMA/rtrs-srv: Set .release function for rtrs srv device during
+ device init
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit 39c2d639ca183a400ba3259fa0825714cbb09c53 ]
+
+The device .release function was not being set during the device
+initialization. This was leading to the below warning, in error cases when
+put_srv was called before device_add was called.
+
+Warning:
+
+Device '(null)' does not have a release() function, it is broken and must
+be fixed. See Documentation/kobject.txt.
+
+So, set the device .release function during device initialization in the
+__alloc_srv() function.
+
+Fixes: baa5b28b7a47 ("RDMA/rtrs-srv: Replace device_register with device_initialize and device_add")
+Link: https://lore.kernel.org/r/20200907102216.104041-1-haris.iqbal@cloud.ionos.com
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 8 --------
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 8 ++++++++
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index 2f981ae970767..cf6a2be61695d 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -152,13 +152,6 @@ static struct attribute_group rtrs_srv_stats_attr_group = {
+ .attrs = rtrs_srv_stats_attrs,
+ };
+
+-static void rtrs_srv_dev_release(struct device *dev)
+-{
+- struct rtrs_srv *srv = container_of(dev, struct rtrs_srv, dev);
+-
+- kfree(srv);
+-}
+-
+ static int rtrs_srv_create_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ {
+ struct rtrs_srv *srv = sess->srv;
+@@ -172,7 +165,6 @@ static int rtrs_srv_create_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ goto unlock;
+ }
+ srv->dev.class = rtrs_dev_class;
+- srv->dev.release = rtrs_srv_dev_release;
+ err = dev_set_name(&srv->dev, "%s", sess->s.sessname);
+ if (err)
+ goto unlock;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index b61a18e57aeba..28f6414dfa3dc 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1319,6 +1319,13 @@ static int rtrs_srv_get_next_cq_vector(struct rtrs_srv_sess *sess)
+ return sess->cur_cq_vector;
+ }
+
++static void rtrs_srv_dev_release(struct device *dev)
++{
++ struct rtrs_srv *srv = container_of(dev, struct rtrs_srv, dev);
++
++ kfree(srv);
++}
++
+ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+ const uuid_t *paths_uuid)
+ {
+@@ -1337,6 +1344,7 @@ static struct rtrs_srv *__alloc_srv(struct rtrs_srv_ctx *ctx,
+ srv->queue_depth = sess_queue_depth;
+ srv->ctx = ctx;
+ device_initialize(&srv->dev);
++ srv->dev.release = rtrs_srv_dev_release;
+
+ srv->chunks = kcalloc(srv->queue_depth, sizeof(*srv->chunks),
+ GFP_KERNEL);
+--
+2.25.1
+
--- /dev/null
+From 699ed0e6946f791b0c5712c65d2e6ba1502235ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2020 13:43:10 +0300
+Subject: RDMA/rxe: Drop pointless checks in rxe_init_ports
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6112ef62826e91afbae5446d5d47b38e25f47e3f ]
+
+Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no
+need to check if they aren't set.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200705104313.283034-2-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 5642eefb4ba1c..c7191b5e04a5a 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -147,9 +147,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)
+
+ rxe_init_port_param(port);
+
+- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len)
+- return -EINVAL;
+-
+ port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len,
+ sizeof(*port->pkey_tbl), GFP_KERNEL);
+
+--
+2.25.1
+
--- /dev/null
+From 1783e58919790333cacc742821c63b59b765833a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 15:56:32 +0800
+Subject: RDMA/rxe: Fix memleak in rxe_mem_init_user
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b ]
+
+When page_address() fails, umem should be freed just like when
+rxe_mem_alloc() fails.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200819075632.22285-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index e83c7b518bfa2..bfb96a0d071bb 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -207,6 +207,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start,
+ vaddr = page_address(sg_page_iter_page(&sg_iter));
+ if (!vaddr) {
+ pr_warn("null vaddr\n");
++ ib_umem_release(umem);
+ err = -ENOMEM;
+ goto err1;
+ }
+--
+2.25.1
+
--- /dev/null
+From a450efe60037f8a3831b852d2a73a21529534874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 18:17:25 +0300
+Subject: RDMA/rxe: Fix panic when calling kmem_cache_create()
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit d862060a4b43479887ae8e2c0b74a58c4e27e5f3 ]
+
+To avoid the following kernel panic when calling kmem_cache_create() with
+a NULL pointer from pool_cache(), Block the rxe_param_set_add() from
+running if the rdma_rxe module is not initialized.
+
+ BUG: unable to handle kernel NULL pointer dereference at 000000000000000b
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP NOPTI
+ CPU: 4 PID: 8512 Comm: modprobe Kdump: loaded Not tainted 4.18.0-231.el8.x86_64 #1
+ Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 10/02/2018
+ RIP: 0010:kmem_cache_alloc+0xd1/0x1b0
+ Code: 8b 57 18 45 8b 77 1c 48 8b 5c 24 30 0f 1f 44 00 00 5b 48 89 e8 5d 41 5c 41 5d 41 5e 41 5f c3 81 e3 00 00 10 00 75 0e 4d 89 fe <41> f6 47 0b 04 0f 84 6c ff ff ff 4c 89 ff e8 cc da 01 00 49 89 c6
+ RSP: 0018:ffffa2b8c773f9d0 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000005
+ RDX: 0000000000000004 RSI: 00000000006080c0 RDI: 0000000000000000
+ RBP: ffff8ea0a8634fd0 R08: ffffa2b8c773f988 R09: 00000000006000c0
+ R10: 0000000000000000 R11: 0000000000000230 R12: 00000000006080c0
+ R13: ffffffffc0a97fc8 R14: 0000000000000000 R15: 0000000000000000
+ FS: 00007f9138ed9740(0000) GS:ffff8ea4ae800000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 000000000000000b CR3: 000000046d59a000 CR4: 00000000003406e0
+ Call Trace:
+ rxe_alloc+0xc8/0x160 [rdma_rxe]
+ rxe_get_dma_mr+0x25/0xb0 [rdma_rxe]
+ __ib_alloc_pd+0xcb/0x160 [ib_core]
+ ib_mad_init_device+0x296/0x8b0 [ib_core]
+ add_client_context+0x11a/0x160 [ib_core]
+ enable_device_and_get+0xdc/0x1d0 [ib_core]
+ ib_register_device+0x572/0x6b0 [ib_core]
+ ? crypto_create_tfm+0x32/0xe0
+ ? crypto_create_tfm+0x7a/0xe0
+ ? crypto_alloc_tfm+0x58/0xf0
+ rxe_register_device+0x19d/0x1c0 [rdma_rxe]
+ rxe_net_add+0x3d/0x70 [rdma_rxe]
+ ? dev_get_by_name_rcu+0x73/0x90
+ rxe_param_set_add+0xaf/0xc0 [rdma_rxe]
+ parse_args+0x179/0x370
+ ? ref_module+0x1b0/0x1b0
+ load_module+0x135e/0x17e0
+ ? ref_module+0x1b0/0x1b0
+ ? __do_sys_init_module+0x13b/0x180
+ __do_sys_init_module+0x13b/0x180
+ do_syscall_64+0x5b/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x65/0xca
+ RIP: 0033:0x7f9137ed296e
+
+This can be triggered if a user tries to use the 'module option' which is
+not actually a real module option but some idiotic (and thankfully no
+obsolete) sysfs interface.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200825151725.254046-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 4 ++++
+ drivers/infiniband/sw/rxe/rxe.h | 2 ++
+ drivers/infiniband/sw/rxe/rxe_sysfs.c | 5 +++++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index c7191b5e04a5a..d6b1236b114ab 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -48,6 +48,8 @@ static void rxe_cleanup_ports(struct rxe_dev *rxe)
+
+ }
+
++bool rxe_initialized;
++
+ /* free resources for a rxe device all objects created for this device must
+ * have been destroyed
+ */
+@@ -345,6 +347,7 @@ static int __init rxe_module_init(void)
+ return err;
+
+ rdma_link_register(&rxe_link_ops);
++ rxe_initialized = true;
+ pr_info("loaded\n");
+ return 0;
+ }
+@@ -356,6 +359,7 @@ static void __exit rxe_module_exit(void)
+ rxe_net_exit();
+ rxe_cache_exit();
+
++ rxe_initialized = false;
+ pr_info("unloaded\n");
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index fb07eed9e4028..cae1b0a24c850 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -67,6 +67,8 @@
+
+ #define RXE_ROCE_V2_SPORT (0xc000)
+
++extern bool rxe_initialized;
++
+ static inline u32 rxe_crc32(struct rxe_dev *rxe,
+ u32 crc, void *next, size_t len)
+ {
+diff --git a/drivers/infiniband/sw/rxe/rxe_sysfs.c b/drivers/infiniband/sw/rxe/rxe_sysfs.c
+index ccda5f5a3bc0a..2af31d421bfc3 100644
+--- a/drivers/infiniband/sw/rxe/rxe_sysfs.c
++++ b/drivers/infiniband/sw/rxe/rxe_sysfs.c
+@@ -61,6 +61,11 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp)
+ struct net_device *ndev;
+ struct rxe_dev *exists;
+
++ if (!rxe_initialized) {
++ pr_err("Module parameters are not supported, use rdma link add or rxe_cfg\n");
++ return -EAGAIN;
++ }
++
+ len = sanitize_arg(val, intf, sizeof(intf));
+ if (!len) {
+ pr_err("add: invalid interface name\n");
+--
+2.25.1
+
--- /dev/null
+From cdac60b705832a69aa0c84966b1e6f69e4f397da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 03:31:34 +0200
+Subject: regulator: push allocation in regulator_ena_gpio_request() out of
+ lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 467bf30142c64f2eb64e2ac67fa4595126230efd ]
+
+Move another allocation out of regulator_list_mutex-protected region, as
+reclaim might want to take the same lock.
+
+WARNING: possible circular locking dependency detected
+5.7.13+ #534 Not tainted
+------------------------------------------------------
+kswapd0/383 is trying to acquire lock:
+c0e5d920 (regulator_list_mutex){+.+.}-{3:3}, at: regulator_lock_dependent+0x54/0x2c0
+
+but task is already holding lock:
+c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (fs_reclaim){+.+.}-{0:0}:
+ fs_reclaim_acquire.part.11+0x40/0x50
+ fs_reclaim_acquire+0x24/0x28
+ kmem_cache_alloc_trace+0x40/0x1e8
+ regulator_register+0x384/0x1630
+ devm_regulator_register+0x50/0x84
+ reg_fixed_voltage_probe+0x248/0x35c
+[...]
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(fs_reclaim);
+ lock(regulator_list_mutex);
+ lock(fs_reclaim);
+ lock(regulator_list_mutex);
+
+ *** DEADLOCK ***
+[...]
+2 locks held by kswapd0/383:
+ #0: c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
+ #1: cb70e5e0 (hctx->srcu){....}-{0:0}, at: hctx_lock+0x60/0xb8
+[...]
+
+Fixes: 541d052d7215 ("regulator: core: Only support passing enable GPIO descriptors")
+[this commit only changes context]
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+[this is when the regulator_list_mutex was introduced in reclaim locking path]
+
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/41fe6a9670335721b48e8f5195038c3d67a3bf92.1597195321.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 720f28844795b..86107d2e1733e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2222,10 +2222,13 @@ EXPORT_SYMBOL_GPL(regulator_bulk_unregister_supply_alias);
+ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ const struct regulator_config *config)
+ {
+- struct regulator_enable_gpio *pin;
++ struct regulator_enable_gpio *pin, *new_pin;
+ struct gpio_desc *gpiod;
+
+ gpiod = config->ena_gpiod;
++ new_pin = kzalloc(sizeof(*new_pin), GFP_KERNEL);
++
++ mutex_lock(®ulator_list_mutex);
+
+ list_for_each_entry(pin, ®ulator_ena_gpio_list, list) {
+ if (pin->gpiod == gpiod) {
+@@ -2234,9 +2237,13 @@ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ }
+ }
+
+- pin = kzalloc(sizeof(struct regulator_enable_gpio), GFP_KERNEL);
+- if (pin == NULL)
++ if (new_pin == NULL) {
++ mutex_unlock(®ulator_list_mutex);
+ return -ENOMEM;
++ }
++
++ pin = new_pin;
++ new_pin = NULL;
+
+ pin->gpiod = gpiod;
+ list_add(&pin->list, ®ulator_ena_gpio_list);
+@@ -2244,6 +2251,10 @@ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ update_ena_gpio_to_rdev:
+ pin->request_count++;
+ rdev->ena_pin = pin;
++
++ mutex_unlock(®ulator_list_mutex);
++ kfree(new_pin);
++
+ return 0;
+ }
+
+@@ -5137,9 +5148,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ }
+
+ if (config->ena_gpiod) {
+- mutex_lock(®ulator_list_mutex);
+ ret = regulator_ena_gpio_request(rdev, config);
+- mutex_unlock(®ulator_list_mutex);
+ if (ret != 0) {
+ rdev_err(rdev, "Failed to request enable GPIO: %d\n",
+ ret);
+--
+2.25.1
+
--- /dev/null
+From 0e9ffb73fbd3b6a25aa9e8eb5d1e23d4cab49e13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 03:31:38 +0200
+Subject: regulator: remove superfluous lock in regulator_resolve_coupling()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit a577f3456c0a2fac3dee037c483753e6e68f3e49 ]
+
+The code modifies rdev, but locks c_rdev instead. Remove the lock
+as this is held together by regulator_list_mutex taken in the caller.
+
+Fixes: f9503385b187 ("regulator: core: Mutually resolve regulators coupling")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/25eb81cefb37a646f3e44eaaf1d8ae8881cfde52.1597195321.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 86107d2e1733e..0ba5ca7082afd 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4891,13 +4891,9 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev)
+ return;
+ }
+
+- regulator_lock(c_rdev);
+-
+ c_desc->coupled_rdevs[i] = c_rdev;
+ c_desc->n_resolved++;
+
+- regulator_unlock(c_rdev);
+-
+ regulator_resolve_coupling(c_rdev);
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 2cbed0f435ba659353d53d7c46790ab675873a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 13:29:48 -0500
+Subject: Revert "kbuild: use -flive-patching when CONFIG_LIVEPATCH is enabled"
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 318af7b80b6a6751520cf2b71edb8c45abb9d9d8 ]
+
+Use of the new -flive-patching flag was introduced with the following
+commit:
+
+ 43bd3a95c98e ("kbuild: use -flive-patching when CONFIG_LIVEPATCH is enabled")
+
+This flag has several drawbacks:
+
+- It disables some optimizations, so it can have a negative effect on
+ performance.
+
+- According to the GCC documentation it's not compatible with LTO, which
+ will become a compatibility issue as LTO support gets upstreamed in
+ the kernel.
+
+- It was intended to be used for source-based patch generation tooling,
+ as opposed to binary-based patch generation tooling (e.g.,
+ kpatch-build). It probably should have at least been behind a
+ separate config option so as not to negatively affect other livepatch
+ users.
+
+- Clang doesn't have the flag, so as far as I can tell, this method of
+ generating patches is incompatible with Clang, which like LTO is
+ becoming more mainstream.
+
+- It breaks GCC's implicit noreturn detection for local functions. This
+ is the cause of several "unreachable instruction" objtool warnings.
+
+- The broken noreturn detection is an obvious GCC regression, but we
+ haven't yet gotten GCC developers to acknowledge that, which doesn't
+ inspire confidence in their willingness to keep the feature working as
+ optimizations are added or changed going forward.
+
+- While there *is* a distro which relies on this flag for their distro
+ livepatch module builds, there's not a publicly documented way to
+ create safe livepatch modules with it. Its use seems to be based on
+ tribal knowledge. It serves no benefit to those who don't know how to
+ use it.
+
+ (In fact, I believe the current livepatch documentation and samples
+ are misleading and dangerous, and should be corrected. Or at least
+ amended with a disclaimer. But I don't feel qualified to make such
+ changes.)
+
+Also, we have an idea for using objtool to detect function changes,
+which could potentially obsolete the need for this flag anyway.
+
+At this point the flag has no benefits for upstream which would
+counteract the above drawbacks. Revert it until it becomes more ready.
+
+This reverts commit 43bd3a95c98e1a86b8b55d97f745c224ecff02b9.
+
+Fixes: 43bd3a95c98e ("kbuild: use -flive-patching when CONFIG_LIVEPATCH is enabled")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/696262e997359666afa053fe7d1a9fb2bb373964.1595010490.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 36eab48d1d4a6..3299cc45c1dd0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -876,10 +876,6 @@ KBUILD_CFLAGS_KERNEL += -ffunction-sections -fdata-sections
+ LDFLAGS_vmlinux += --gc-sections
+ endif
+
+-ifdef CONFIG_LIVEPATCH
+-KBUILD_CFLAGS += $(call cc-option, -flive-patching=inline-clone)
+-endif
+-
+ ifdef CONFIG_SHADOW_CALL_STACK
+ CC_FLAGS_SCS := -fsanitize=shadow-call-stack
+ KBUILD_CFLAGS += $(CC_FLAGS_SCS)
+--
+2.25.1
+
--- /dev/null
+From bc46fc33d239a98aea8eb9aad8bd083647a5904a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 15:24:26 +0800
+Subject: scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
+
+From: Luo Jiaxing <luojiaxing@huawei.com>
+
+[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]
+
+It was discovered that sdparm will fail when attempting to disable write
+cache on a SATA disk connected via libsas.
+
+In the ATA command set the write cache state is controlled through the SET
+FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and
+the latter command is what is used in the SCSI-ATA translation layer. A
+subtle difference is that a MODE SELECT carries data whereas SET FEATURES
+is defined as a non-data command in ATA.
+
+Set the DMA data direction to DMA_NONE if the requested ATA command is
+identified as non-data.
+
+[mkp: commit desc]
+
+Fixes: fa1c1e8f1ece ("[SCSI] Add SATA support to libsas")
+Link: https://lore.kernel.org/r/1598426666-54544-1-git-send-email-luojiaxing@huawei.com
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_ata.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index 5d716d3887071..6de4bc77fd55c 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -209,7 +209,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->num_scatter = si;
+ }
+
+- task->data_dir = qc->dma_dir;
++ if (qc->tf.protocol == ATA_PROT_NODATA)
++ task->data_dir = DMA_NONE;
++ else
++ task->data_dir = qc->dma_dir;
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+--
+2.25.1
+
--- /dev/null
+From 7381e5c96e6b339565d6987d9e12c02b85e374cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 18:53:32 +0200
+Subject: scsi: megaraid_sas: Don't call disable_irq from process IRQ poll
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit d2af39141eea34ef651961e885f49d96781a1016 ]
+
+disable_irq() might sleep. Replace it with disable_irq_nosync() which is
+sufficient as irq_poll_scheduled protects against concurrently running
+complete_cmd_fusion() from megasas_irqpoll() and megasas_isr_fusion().
+
+Link: https://lore.kernel.org/r/20200827165332.8432-1-thenzl@redhat.com
+Fixes: a6ffd5bf681 scsi: megaraid_sas: Call disable_irq from process IRQ poll
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index fcf03f733e417..1a0e2e4342ad8 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -3690,7 +3690,7 @@ int megasas_irqpoll(struct irq_poll *irqpoll, int budget)
+ instance = irq_ctx->instance;
+
+ if (irq_ctx->irq_line_enable) {
+- disable_irq(irq_ctx->os_irq);
++ disable_irq_nosync(irq_ctx->os_irq);
+ irq_ctx->irq_line_enable = false;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f0659b89ce00a3e8e4fcb8b0d0737e495d95e138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 16:50:26 +0200
+Subject: scsi: mpt3sas: Don't call disable_irq from IRQ poll handler
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit b614d55b970d08bcac5b0bc15a5526181b3e4459 ]
+
+disable_irq() might sleep, replace it with disable_irq_nosync(). For
+synchronisation 'irq_poll_scheduled' is sufficient
+
+Fixes: 320e77acb3 scsi: mpt3sas: Irq poll to avoid CPU hard lockups
+Link: https://lore.kernel.org/r/20200901145026.12174-1-thenzl@redhat.com
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 96b78fdc6b8a9..a85c9672c6ea3 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -1732,7 +1732,7 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget)
+ reply_q = container_of(irqpoll, struct adapter_reply_queue,
+ irqpoll);
+ if (reply_q->irq_line_enable) {
+- disable_irq(reply_q->os_irq);
++ disable_irq_nosync(reply_q->os_irq);
+ reply_q->irq_line_enable = false;
+ }
+ num_entries = _base_process_reply_queue(reply_q);
+--
+2.25.1
+
--- /dev/null
+From 3186718b4082fd26febad4a50df59a7d265050ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:34:36 +0800
+Subject: scsi: qedf: Fix null ptr reference in qedf_stag_change_work
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit f308a35f547cd7c1d8a901c12b3ac508e96df665 ]
+
+Link: https://lore.kernel.org/r/20200824033436.45570-1-yebin10@huawei.com
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 36b1ca2dadbb5..51cfab9d1afdc 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3843,7 +3843,7 @@ void qedf_stag_change_work(struct work_struct *work)
+ container_of(work, struct qedf_ctx, stag_work.work);
+
+ if (!qedf) {
+- QEDF_ERR(&qedf->dbg_ctx, "qedf is NULL");
++ QEDF_ERR(NULL, "qedf is NULL");
+ return;
+ }
+ QEDF_ERR(&qedf->dbg_ctx, "Performing software context reset.\n");
+--
+2.25.1
+
--- /dev/null
+From 7f2e6cee3f744e72b749c1329a9649972a61961c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 22:27:29 +0200
+Subject: scsi: qla2xxx: Fix regression on sparc64
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: René Rebe <rene@exactcode.com>
+
+[ Upstream commit 2a87d485c4cb4d1b34be6c278a1c6ce3e15c8b8a ]
+
+Commit 98aee70d19a7 ("qla2xxx: Add endianizer to max_payload_size
+modifier.") in 2014 broke qla2xxx on sparc64, e.g. as in the Sun Blade 1000
+/ 2000. Unbreak by partial revert to fix endianness in nvram firmware
+default initialization. Also mark the second frame_payload_size in nvram_t
+__le16 to avoid new sparse warnings.
+
+Link: https://lore.kernel.org/r/20200827.222729.1875148247374704975.rene@exactcode.com
+Fixes: 98aee70d19a7 ("qla2xxx: Add endianizer to max_payload_size modifier.")
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Arun Easi <aeasi@marvell.com>
+Signed-off-by: René Rebe <rene@exactcode.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 2 +-
+ drivers/scsi/qla2xxx/qla_init.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index 42dbf90d46510..392312333746f 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -1605,7 +1605,7 @@ typedef struct {
+ */
+ uint8_t firmware_options[2];
+
+- uint16_t frame_payload_size;
++ __le16 frame_payload_size;
+ __le16 max_iocb_allocation;
+ __le16 execution_throttle;
+ uint8_t retry_count;
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 2436a17f5cd91..2861c636dd651 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4603,18 +4603,18 @@ qla2x00_nvram_config(scsi_qla_host_t *vha)
+ nv->firmware_options[1] = BIT_7 | BIT_5;
+ nv->add_firmware_options[0] = BIT_5;
+ nv->add_firmware_options[1] = BIT_5 | BIT_4;
+- nv->frame_payload_size = 2048;
++ nv->frame_payload_size = cpu_to_le16(2048);
+ nv->special_options[1] = BIT_7;
+ } else if (IS_QLA2200(ha)) {
+ nv->firmware_options[0] = BIT_2 | BIT_1;
+ nv->firmware_options[1] = BIT_7 | BIT_5;
+ nv->add_firmware_options[0] = BIT_5;
+ nv->add_firmware_options[1] = BIT_5 | BIT_4;
+- nv->frame_payload_size = 1024;
++ nv->frame_payload_size = cpu_to_le16(1024);
+ } else if (IS_QLA2100(ha)) {
+ nv->firmware_options[0] = BIT_3 | BIT_1;
+ nv->firmware_options[1] = BIT_5;
+- nv->frame_payload_size = 1024;
++ nv->frame_payload_size = cpu_to_le16(1024);
+ }
+
+ nv->max_iocb_allocation = cpu_to_le16(256);
+--
+2.25.1
+
--- /dev/null
+From a74cf313af417eac3a4d42504500f71544a68f45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 19:40:16 -0600
+Subject: seccomp: don't leak memory when filter install races
+
+From: Tycho Andersen <tycho@tycho.pizza>
+
+[ Upstream commit a566a9012acd7c9a4be7e30dc7acb7a811ec2260 ]
+
+In seccomp_set_mode_filter() with TSYNC | NEW_LISTENER, we first initialize
+the listener fd, then check to see if we can actually use it later in
+seccomp_may_assign_mode(), which can fail if anyone else in our thread
+group has installed a filter and caused some divergence. If we can't, we
+partially clean up the newly allocated file: we put the fd, put the file,
+but don't actually clean up the *memory* that was allocated at
+filter->notif. Let's clean that up too.
+
+To accomplish this, let's hoist the actual "detach a notifier from a
+filter" code to its own helper out of seccomp_notify_release(), so that in
+case anyone adds stuff to init_listener(), they only have to add the
+cleanup code in one spot. This does a bit of extra locking and such on the
+failure path when the filter is not attached, but it's a slow failure path
+anyway.
+
+Fixes: 51891498f2da ("seccomp: allow TSYNC and USER_NOTIF together")
+Reported-by: syzbot+3ad9614a12f80994c32e@syzkaller.appspotmail.com
+Signed-off-by: Tycho Andersen <tycho@tycho.pizza>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Link: https://lore.kernel.org/r/20200902014017.934315-1-tycho@tycho.pizza
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/seccomp.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/seccomp.c b/kernel/seccomp.c
+index c461ba9925136..54cf84bac3c9b 100644
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -997,13 +997,12 @@ out:
+ }
+
+ #ifdef CONFIG_SECCOMP_FILTER
+-static int seccomp_notify_release(struct inode *inode, struct file *file)
++static void seccomp_notify_detach(struct seccomp_filter *filter)
+ {
+- struct seccomp_filter *filter = file->private_data;
+ struct seccomp_knotif *knotif;
+
+ if (!filter)
+- return 0;
++ return;
+
+ mutex_lock(&filter->notify_lock);
+
+@@ -1025,6 +1024,13 @@ static int seccomp_notify_release(struct inode *inode, struct file *file)
+ kfree(filter->notif);
+ filter->notif = NULL;
+ mutex_unlock(&filter->notify_lock);
++}
++
++static int seccomp_notify_release(struct inode *inode, struct file *file)
++{
++ struct seccomp_filter *filter = file->private_data;
++
++ seccomp_notify_detach(filter);
+ __put_seccomp_filter(filter);
+ return 0;
+ }
+@@ -1358,6 +1364,7 @@ out_put_fd:
+ listener_f->private_data = NULL;
+ fput(listener_f);
+ put_unused_fd(listener);
++ seccomp_notify_detach(prepared);
+ } else {
+ fd_install(listener, listener_f);
+ ret = listener;
+--
+2.25.1
+
--- /dev/null
+From f1d7e2c6878fe0b912bf51b06c7c11ac6ab1c2bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2020 10:42:15 +0800
+Subject: selftests/timers: Turn off timeout setting
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 5c1e4f7e9e49b6925b1fb5c507d2c614f3edb292 ]
+
+The following 4 tests in timers can take longer than the default 45
+seconds that added in commit 852c8cbf34d3 ("selftests/kselftest/runner.sh:
+Add 45 second timeout per test") to run:
+ * nsleep-lat - 2m7.350s
+ * set-timer-lat - 2m0.66s
+ * inconsistency-check - 1m45.074s
+ * raw_skew - 2m0.013s
+
+Thus they will be marked as failed with the current 45s setting:
+ not ok 3 selftests: timers: nsleep-lat # TIMEOUT
+ not ok 4 selftests: timers: set-timer-lat # TIMEOUT
+ not ok 6 selftests: timers: inconsistency-check # TIMEOUT
+ not ok 7 selftests: timers: raw_skew # TIMEOUT
+
+Disable the timeout setting for timers can make these tests finish
+properly:
+ ok 3 selftests: timers: nsleep-lat
+ ok 4 selftests: timers: set-timer-lat
+ ok 6 selftests: timers: inconsistency-check
+ ok 7 selftests: timers: raw_skew
+
+https://bugs.launchpad.net/bugs/1864626
+Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test")
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Acked-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/timers/Makefile | 1 +
+ tools/testing/selftests/timers/settings | 1 +
+ 2 files changed, 2 insertions(+)
+ create mode 100644 tools/testing/selftests/timers/settings
+
+diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
+index 7656c7ce79d90..0e73a16874c4c 100644
+--- a/tools/testing/selftests/timers/Makefile
++++ b/tools/testing/selftests/timers/Makefile
+@@ -13,6 +13,7 @@ DESTRUCTIVE_TESTS = alarmtimer-suspend valid-adjtimex adjtick change_skew \
+
+ TEST_GEN_PROGS_EXTENDED = $(DESTRUCTIVE_TESTS)
+
++TEST_FILES := settings
+
+ include ../lib.mk
+
+diff --git a/tools/testing/selftests/timers/settings b/tools/testing/selftests/timers/settings
+new file mode 100644
+index 0000000000000..e7b9417537fbc
+--- /dev/null
++++ b/tools/testing/selftests/timers/settings
+@@ -0,0 +1 @@
++timeout=0
+--
+2.25.1
+
--- /dev/null
+arm-omap2-fix-an-is_err-vs-null-check-in-_get_pwrdm.patch
+arm-dts-logicpd-torpedo-baseboard-fix-broken-audio.patch
+arm-dts-logicpd-som-lv-baseboard-fix-broken-audio.patch
+arm-dts-logicpd-som-lv-baseboard-fix-missing-video.patch
+regulator-push-allocation-in-regulator_ena_gpio_requ.patch
+regulator-remove-superfluous-lock-in-regulator_resol.patch
+arm-dts-socfpga-fix-register-entry-for-timer3-on-arr.patch
+arm-dts-omap5-fix-dsi-base-address-and-clocks.patch
+selftests-timers-turn-off-timeout-setting.patch
+arm-dts-ls1021a-fix-quadspi-memory-reg-range.patch
+arm-dts-imx7ulp-correct-gpio-ranges.patch
+arm64-dts-imx-add-missing-imx8mm-beacon-kit.dtb-to-b.patch
+arm-dts-imx7d-zii-rmu2-fix-rgmii-phy-mode-for-ksz903.patch
+rdma-rtrs-srv-replace-device_register-with-device_in.patch
+rdma-rxe-fix-memleak-in-rxe_mem_init_user.patch
+rdma-rxe-drop-pointless-checks-in-rxe_init_ports.patch
+rdma-rxe-fix-panic-when-calling-kmem_cache_create.patch
+rdma-bnxt_re-do-not-report-transparent-vlan-from-qp1.patch
+rdma-bnxt_re-fix-the-qp-table-indexing.patch
+rdma-bnxt_re-static-nq-depth-allocation.patch
+rdma-bnxt_re-fix-driver-crash-on-unaligned-psn-entry.patch
+rdma-bnxt_re-remove-the-qp-from-list-only-if-the-qp-.patch
+drm-sun4i-add-missing-put_device-call-in-sun8i_r40_t.patch
+arm64-dts-imx8mq-fix-tmu-interrupt-property.patch
+drm-sun4i-fix-dsi-dcs-long-write-function.patch
+scsi-qla2xxx-fix-regression-on-sparc64.patch
+iio-adc-mcp3422-fix-locking-on-error-path.patch
+scsi-libsas-set-data_dir-as-dma_none-if-libata-marks.patch
+drm-virtio-fix-unblank.patch
+rdma-core-fix-unsafe-linked-list-traversal-after-fai.patch
+rdma-core-fix-reported-speed-and-width.patch
+scsi-megaraid_sas-don-t-call-disable_irq-from-proces.patch
+scsi-mpt3sas-don-t-call-disable_irq-from-irq-poll-ha.patch
+soundwire-fix-double-free-of-dangling-pointer.patch
+revert-kbuild-use-flive-patching-when-config_livepat.patch
+interconnect-qcom-fix-small-bw-votes-being-truncated.patch
+padata-fix-possible-padata_works_lock-deadlock.patch
+drm-sun4i-fix-de2-yvu-handling.patch
+drm-sun4i-backend-support-alpha-property-on-lowest-p.patch
+drm-sun4i-backend-disable-alpha-on-the-lowest-plane-.patch
+kvm-arm64-update-page-shift-if-stage-2-block-mapping.patch
+arm-dts-imx6sx-fix-the-pad-qspi1b_sclk-mux-mode-for-.patch
+mmc-sdhci-acpi-clear-amd_sdhci_host-on-reset.patch
+mmc-sdhci-msm-add-retries-when-all-tuning-phases-are.patch
+spi-stm32-rate-limit-the-communication-suspended-mes.patch
+btrfs-fix-null-pointer-dereference-after-failure-to-.patch
+i2c-npcm7xx-fix-timeout-calculation.patch
+block-restore-a-specific-error-code-in-bdev_del_part.patch
+seccomp-don-t-leak-memory-when-filter-install-races.patch
+nvme-fabrics-allow-to-queue-requests-for-live-queues.patch
+spi-stm32-fix-pm_runtime_get_sync-error-checking.patch
+block-set-same_page-to-false-in-__bio_try_merge_page.patch
+rdma-rtrs-srv-set-.release-function-for-rtrs-srv-dev.patch
+ib-isert-fix-unaligned-immediate-data-handling.patch
+arm-dts-bcm-hr2-fixed-qspi-compatible-string.patch
+arm-dts-nsp-fixed-qspi-compatible-string.patch
+arm-dts-bcm5301x-fixed-qspi-compatible-string.patch
+arm64-dts-ns2-fixed-qspi-compatible-string.patch
+kvm-nvmx-fix-the-update-value-of-nested-load-ia32_pe.patch
+kvm-x86-always-allow-writing-0-to-msr_kvm_async_pf_e.patch
+arc-hsdk-wireup-perf-irq.patch
+dmaengine-acpi-put-the-csrt-table-after-using-it.patch
+mips-loongson64-do-not-override-watch-and-ejtag-feat.patch
+netfilter-conntrack-allow-sctp-hearbeat-after-connec.patch
+netfilter-nft_set_rbtree-detect-partial-overlap-with.patch
+drivers-net-wan-lapbether-added-needed_tailroom.patch
+nfc-st95hf-fix-memleak-in-st95hf_in_send_cmd.patch
+firestream-fix-memleak-in-fs_open.patch
+scsi-qedf-fix-null-ptr-reference-in-qedf_stag_change.patch
+alsa-hda-fix-2-channel-swapping-for-tegra.patch
+alsa-hda-tegra-program-wakeen-register-for-tegra.patch
+drivers-dma-dma-jz4780-fix-race-condition-between-pr.patch
+net-hns3-fix-for-geneve-tx-checksum-bug.patch
+xfs-fix-off-by-one-in-inode-alloc-block-reservation-.patch
+drivers-net-wan-lapbether-set-network_header-before-.patch
+wireless-fix-wrong-160-80-80-mhz-setting.patch
+mac80211-reduce-packet-loss-event-false-positives.patch
+cfg80211-adjust-6-ghz-frequency-to-channel-conversio.patch
+xfs-initialize-the-shortform-attr-header-padding-ent.patch
+arc-show_regs-fix-r12-printing-and-simplify.patch
+irqchip-eznps-fix-build-error-for-arc700-builds.patch
+media-gpio-ir-tx-spinlock-is-not-needed-to-disable-i.patch
+nvmet-tcp-fix-null-dereference-when-a-connect-data-c.patch
+nvme-fabrics-don-t-check-state-nvme_ctrl_new-for-req.patch
+nvme-have-nvme_wait_freeze_timeout-return-if-it-time.patch
+nvme-tcp-serialize-controller-teardown-sequences.patch
+nvme-tcp-fix-timeout-handler.patch
+nvme-tcp-fix-reset-hang-if-controller-died-in-the-mi.patch
+nvme-rdma-serialize-controller-teardown-sequences.patch
+nvme-rdma-fix-timeout-handler.patch
+nvme-rdma-fix-reset-hang-if-controller-died-in-the-m.patch
+nvme-pci-cancel-nvme-device-request-before-disabling.patch
+hid-quirks-set-increment_usage_on_duplicate-for-all-.patch
+hid-microsoft-add-rumble-support-for-the-8bitdo-sn30.patch
+drivers-net-wan-hdlc_cisco-add-hard_header_len.patch
+hid-elan-fix-memleak-in-elan_input_configured.patch
+arc-plat-hsdk-switch-ethernet-phy-mode-to-rgmii-id.patch
+cpufreq-intel_pstate-refuse-to-turn-off-with-hwp-ena.patch
+cpufreq-intel_pstate-fix-intel_pstate_get_hwp_max-fo.patch
+arm64-module-set-trampoline-section-flags-regardless.patch
+alsa-hda-hdmi-add-rocketlake-support.patch
+alsa-hda-fix-a-runtime-pm-issue-in-sof-when-integrat.patch
+alsa-hda-use-consistent-hdaudio-spelling-in-comments.patch
+drivers-net-wan-hdlc-change-the-default-of-hard_head.patch
+drm-amdgpu-fix-bug-in-reporting-voltage-for-cik.patch
+iommu-amd-do-not-force-direct-mapping-when-sme-is-ac.patch
+iommu-amd-do-not-use-iommuv2-functionality-when-sme-.patch
+gcov-disable-gcov-build-with-gcc-10.patch
--- /dev/null
+From 190e29c259915c9ae761fef1c1a20f0cfea46105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 13:26:50 -0700
+Subject: soundwire: fix double free of dangling pointer
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 3fbbf2148a406b3e350fe91e6fdd78eb42ecad24 ]
+
+clang static analysis flags this problem
+
+stream.c:844:9: warning: Use of memory after
+ it is freed
+ kfree(bus->defer_msg.msg->buf);
+ ^~~~~~~~~~~~~~~~~~~~~~~
+
+This happens in an error handler cleaning up memory
+allocated for elements in a list.
+
+ list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+ bus = m_rt->bus;
+
+ kfree(bus->defer_msg.msg->buf);
+ kfree(bus->defer_msg.msg);
+ }
+
+And is triggered when the call to sdw_bank_switch() fails.
+There are a two problems.
+
+First, when sdw_bank_switch() fails, though it frees memory it
+does not clear bus's reference 'defer_msg.msg' to that memory.
+
+The second problem is the freeing msg->buf. In some cases
+msg will be NULL so this will dereference a null pointer.
+Need to check before freeing.
+
+Fixes: 99b8a5d608a6 ("soundwire: Add bank switch routine")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902202650.14189-1-trix@redhat.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/stream.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index a9a72574b34ab..684761e86d4fc 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -716,6 +716,7 @@ error:
+ kfree(wbuf);
+ error_1:
+ kfree(wr_msg);
++ bus->defer_msg.msg = NULL;
+ return ret;
+ }
+
+@@ -839,9 +840,10 @@ static int do_bank_switch(struct sdw_stream_runtime *stream)
+ error:
+ list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+ bus = m_rt->bus;
+-
+- kfree(bus->defer_msg.msg->buf);
+- kfree(bus->defer_msg.msg);
++ if (bus->defer_msg.msg) {
++ kfree(bus->defer_msg.msg->buf);
++ kfree(bus->defer_msg.msg);
++ }
+ }
+
+ msg_unlock:
+--
+2.25.1
+
--- /dev/null
+From 040e6eea95d428d81a282294f6303941b6eb50cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 12:43:04 +0300
+Subject: spi: stm32: fix pm_runtime_get_sync() error checking
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c170a5a3b6944ad8e76547c4a1d9fe81c8f23ac8 ]
+
+The pm_runtime_get_sync() can return either 0 or 1 on success but this
+code treats 1 as a failure.
+
+Fixes: db96bf976a4f ("spi: stm32: fixes suspend/resume management")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/20200909094304.GA420136@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index a00f6b51ccbfc..3056428b09f31 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -2064,7 +2064,7 @@ static int stm32_spi_resume(struct device *dev)
+ }
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(dev, "Unable to power device:%d\n", ret);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From fb8a4a729b3eec794b95357b5398e53399e88620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Sep 2020 17:19:13 +0200
+Subject: spi: stm32: Rate-limit the 'Communication suspended' message
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit ea8be08cc9358f811e4175ba7fa7fea23c5d393e ]
+
+The 'spi_stm32 44004000.spi: Communication suspended' message means that
+when using PIO, the kernel did not read the FIFO fast enough and so the
+SPI controller paused the transfer. Currently, this is printed on every
+single such event, so if the kernel is busy and the controller is pausing
+the transfers often, the kernel will be all the more busy scrolling this
+message into the log buffer every few milliseconds. That is not helpful.
+
+Instead, rate-limit the message and print it every once in a while. It is
+not possible to use the default dev_warn_ratelimited(), because that is
+still too verbose, as it prints 10 lines (DEFAULT_RATELIMIT_BURST) every
+5 seconds (DEFAULT_RATELIMIT_INTERVAL). The policy here is to print 1 line
+every 50 seconds (DEFAULT_RATELIMIT_INTERVAL * 10), because 1 line is more
+than enough and the cycles saved on printing are better left to the CPU to
+handle the SPI. However, dev_warn_once() is also not useful, as the user
+should be aware that this condition is possibly recurring or ongoing. Thus
+the custom rate-limit policy.
+
+Finally, turn the message from dev_warn() to dev_dbg(), since the system
+does not suffer any sort of malfunction if this message appears, it is
+just slowing down. This further reduces the printing into the log buffer
+and frees the CPU to do useful work.
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Amelie Delaunay <amelie.delaunay@st.com>
+Cc: Antonio Borneo <borneo.antonio@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20200905151913.117775-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index d4b33b358a31e..a00f6b51ccbfc 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -936,7 +936,11 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ }
+
+ if (sr & STM32H7_SPI_SR_SUSP) {
+- dev_warn(spi->dev, "Communication suspended\n");
++ static DEFINE_RATELIMIT_STATE(rs,
++ DEFAULT_RATELIMIT_INTERVAL * 10,
++ 1);
++ if (__ratelimit(&rs))
++ dev_dbg_ratelimited(spi->dev, "Communication suspended\n");
+ if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+ stm32h7_spi_read_rxfifo(spi, false);
+ /*
+--
+2.25.1
+
--- /dev/null
+From a3dd6c7d103b39cbfd763bcc4969d00d53cc503b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 17:31:39 +0300
+Subject: wireless: fix wrong 160/80+80 MHz setting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shay Bar <shay.bar@celeno.com>
+
+[ Upstream commit 3579994476b65cb5e272ff0f720a1fd31322e53f ]
+
+Fix cfg80211_chandef_usable():
+consider IEEE80211_VHT_CAP_EXT_NSS_BW when verifying 160/80+80 MHz.
+
+Based on:
+"Table 9-272 — Setting of the Supported Channel Width Set subfield and Extended NSS BW
+Support subfield at a STA transmitting the VHT Capabilities Information field"
+From "Draft P802.11REVmd_D3.0.pdf"
+
+Signed-off-by: Aviad Brikman <aviad.brikman@celeno.com>
+Signed-off-by: Shay Bar <shay.bar@celeno.com>
+Link: https://lore.kernel.org/r/20200826143139.25976-1-shay.bar@celeno.com
+[reformat the code a bit and use u32_get_bits()]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/chan.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/net/wireless/chan.c b/net/wireless/chan.c
+index cddf92c5d09ef..7a7cc4ade2b36 100644
+--- a/net/wireless/chan.c
++++ b/net/wireless/chan.c
+@@ -10,6 +10,7 @@
+ */
+
+ #include <linux/export.h>
++#include <linux/bitfield.h>
+ #include <net/cfg80211.h>
+ #include "core.h"
+ #include "rdev-ops.h"
+@@ -892,6 +893,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ struct ieee80211_sta_vht_cap *vht_cap;
+ struct ieee80211_edmg *edmg_cap;
+ u32 width, control_freq, cap;
++ bool support_80_80 = false;
+
+ if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+ return false;
+@@ -944,9 +946,13 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ return false;
+ break;
+ case NL80211_CHAN_WIDTH_80P80:
+- cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+- if (chandef->chan->band != NL80211_BAND_6GHZ &&
+- cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
++ cap = vht_cap->cap;
++ support_80_80 =
++ (cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) ||
++ (cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
++ cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) ||
++ u32_get_bits(cap, IEEE80211_VHT_CAP_EXT_NSS_BW_MASK) > 1;
++ if (chandef->chan->band != NL80211_BAND_6GHZ && !support_80_80)
+ return false;
+ /* fall through */
+ case NL80211_CHAN_WIDTH_80:
+@@ -966,7 +972,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
+ return false;
+ cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+ if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
+- cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
++ cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ &&
++ !(vht_cap->cap & IEEE80211_VHT_CAP_EXT_NSS_BW_MASK))
+ return false;
+ break;
+ default:
+--
+2.25.1
+
--- /dev/null
+From e590417823c03b2fe7f3c3c3463168fe30b3d334 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:08:27 -0700
+Subject: xfs: fix off-by-one in inode alloc block reservation calculation
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit 657f101930bc6c5b41bd7d6c22565c4302a80d33 ]
+
+The inode chunk allocation transaction reserves inobt_maxlevels-1
+blocks to accommodate a full split of the inode btree. A full split
+requires an allocation for every existing level and a new root
+block, which means inobt_maxlevels is the worst case block
+requirement for a transaction that inserts to the inobt. This can
+lead to a transaction block reservation overrun when tmpfile
+creation allocates an inode chunk and expands the inobt to its
+maximum depth. This problem has been observed in conjunction with
+overlayfs, which makes frequent use of tmpfiles internally.
+
+The existing reservation code goes back as far as the Linux git repo
+history (v2.6.12). It was likely never observed as a problem because
+the traditional file/directory creation transactions also include
+worst case block reservation for directory modifications, which most
+likely is able to make up for a single block deficiency in the inode
+allocation portion of the calculation. tmpfile support is relatively
+more recent (v3.15), less heavily used, and only includes the inode
+allocation block reservation as tmpfiles aren't linked into the
+directory tree on creation.
+
+Fix up the inode alloc block reservation macro and a couple of the
+block allocator minleft parameters that enforce an allocation to
+leave enough free blocks in the AG for a full inobt split.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_ialloc.c | 4 ++--
+ fs/xfs/libxfs/xfs_trans_space.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
+index 7fcf62b324b0d..8c1a7cc484b65 100644
+--- a/fs/xfs/libxfs/xfs_ialloc.c
++++ b/fs/xfs/libxfs/xfs_ialloc.c
+@@ -688,7 +688,7 @@ xfs_ialloc_ag_alloc(
+ args.minalignslop = igeo->cluster_align - 1;
+
+ /* Allow space for the inode btree to split. */
+- args.minleft = igeo->inobt_maxlevels - 1;
++ args.minleft = igeo->inobt_maxlevels;
+ if ((error = xfs_alloc_vextent(&args)))
+ return error;
+
+@@ -736,7 +736,7 @@ xfs_ialloc_ag_alloc(
+ /*
+ * Allow space for the inode btree to split.
+ */
+- args.minleft = igeo->inobt_maxlevels - 1;
++ args.minleft = igeo->inobt_maxlevels;
+ if ((error = xfs_alloc_vextent(&args)))
+ return error;
+ }
+diff --git a/fs/xfs/libxfs/xfs_trans_space.h b/fs/xfs/libxfs/xfs_trans_space.h
+index c6df01a2a1585..7ad3659c5d2a9 100644
+--- a/fs/xfs/libxfs/xfs_trans_space.h
++++ b/fs/xfs/libxfs/xfs_trans_space.h
+@@ -58,7 +58,7 @@
+ #define XFS_IALLOC_SPACE_RES(mp) \
+ (M_IGEO(mp)->ialloc_blks + \
+ ((xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1) * \
+- (M_IGEO(mp)->inobt_maxlevels - 1)))
++ M_IGEO(mp)->inobt_maxlevels))
+
+ /*
+ * Space reservation values for various transactions.
+--
+2.25.1
+
--- /dev/null
+From 81f72ba19b99bed9ff4e2c45882d31e3545f9772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:12:18 -0700
+Subject: xfs: initialize the shortform attr header padding entry
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]
+
+Don't leak kernel memory contents into the shortform attr fork.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 4eb2ecd31b0d2..9bafe50a21240 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -653,8 +653,8 @@ xfs_attr_shortform_create(
+ ASSERT(ifp->if_flags & XFS_IFINLINE);
+ }
+ xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
+- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
+- hdr->count = 0;
++ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
++ memset(hdr, 0, sizeof(*hdr));
+ hdr->totsize = cpu_to_be16(sizeof(*hdr));
+ xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
