--- /dev/null
+From e91a8308433dfd05b750c3df6f8da13d312d8b8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 21:00:38 +0800
+Subject: ALSA: hda: Reinstate runtime_allow() for all hda controllers
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 9fc149c3bce7bdbb94948a8e6bd025e3b3538603 ]
+
+The broken jack detection should be fixed by commit a6e7d0a4bdb0 ("ALSA:
+hda: fix jack detection with Realtek codecs when in D3"), let's try
+enabling runtime PM by default again.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20201027130038.16463-4-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d43245937db7e..8e1eb5f243a27 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2478,6 +2478,7 @@ static int azx_probe_continue(struct azx *chip)
+
+ if (azx_has_pm_runtime(chip)) {
+ pm_runtime_use_autosuspend(&pci->dev);
++ pm_runtime_allow(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 4ddce8084fdd498033a1ed8e94fb34e6077ae9b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 15:02:15 +0800
+Subject: cfg80211: regulatory: Fix inconsistent format argument
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ]
+
+Fix follow warning:
+[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2)
+requires 'int' but the argument type is 'unsigned int'.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 935aebf150107..c7825b951f725 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3374,7 +3374,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
+ power_rule = ®_rule->power_rule;
+
+ if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
++ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO",
+ freq_range->max_bandwidth_khz,
+ reg_get_max_bandwidth(rd, reg_rule));
+ else
+--
+2.27.0
+
--- /dev/null
+From 5fb2fa63568c362ec407d758b98a242c7cf19f31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:24:18 +0800
+Subject: drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ]
+
+This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu:
+Fix bug where DPM is not enabled after hibernate and resume").
+It was intended to fix Hawaii S4(hibernation) issue but break S3. As
+ixFEATURE_STATUS is filled with garbage data on resume which can be
+only cleared by reloading smc firmware(but that will involve many
+changes). So, we will revert this S4 fix and seek a new way.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 0d4dd607e85c8..c05bec5effb2e 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2723,10 +2723,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)
+
+ static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
+ {
+- return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
+- CGS_IND_REG__SMC, FEATURE_STATUS,
+- VOLTAGE_CONTROLLER_ON))
+- ? true : false;
++ return ci_is_smc_ram_running(hwmgr);
+ }
+
+ static int ci_smu_init(struct pp_hwmgr *hwmgr)
+--
+2.27.0
+
--- /dev/null
+From b8327aa0ade710cdd5caae1cf53946d7beb1d9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 10:45:26 +0800
+Subject: drm/amd/pm: perform SMC reset on suspend/hibernation
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ]
+
+So that the succeeding resume can be performed based on
+a clean state.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++
+ drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 +
+ drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++
+ .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++
+ drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++
+ 5 files changed, 39 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 058898b321b8a..d8e624d64ae38 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -1531,6 +1531,10 @@ int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to reset to default!", result = tmp_result);
+
++ tmp_result = smum_stop_smc(hwmgr);
++ PP_ASSERT_WITH_CODE((tmp_result == 0),
++ "Failed to stop smc!", result = tmp_result);
++
+ tmp_result = smu7_force_switch_to_arbf0(hwmgr);
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to force to switch arbf0!", result = tmp_result);
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+index 6ee864455a12a..f59e1e737735f 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+@@ -216,6 +216,7 @@ struct pp_smumgr_func {
+ bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr);
+ int (*update_dpm_settings)(struct pp_hwmgr *hwmgr, void *profile_setting);
+ int (*smc_table_manager)(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); /*rw: true for read, false for write */
++ int (*stop_smc)(struct pp_hwmgr *hwmgr);
+ };
+
+ struct pp_hwmgr_func {
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+index 82550a8a3a3fc..ef4f2392e2e7d 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settin
+
+ extern int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw);
+
++extern int smum_stop_smc(struct pp_hwmgr *hwmgr);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index db87cb8930d24..0d4dd607e85c8 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2934,6 +2934,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type)
+ return 0;
+ }
+
++static void ci_reset_smc(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_RESET_CNTL,
++ rst_reg, 1);
++}
++
++
++static void ci_stop_smc_clock(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_CLOCK_CNTL_0,
++ ck_disable, 1);
++}
++
++static int ci_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ ci_reset_smc(hwmgr);
++ ci_stop_smc_clock(hwmgr);
++
++ return 0;
++}
++
+ const struct pp_smumgr_func ci_smu_funcs = {
+ .smu_init = ci_smu_init,
+ .smu_fini = ci_smu_fini,
+@@ -2957,4 +2980,5 @@ const struct pp_smumgr_func ci_smu_funcs = {
+ .is_dpm_running = ci_is_dpm_running,
+ .update_dpm_settings = ci_update_dpm_settings,
+ .update_smc_table = ci_update_smc_table,
++ .stop_smc = ci_stop_smc,
+ };
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+index a6edd5df33b0f..20ecf994d47f3 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+@@ -213,3 +213,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tabl
+
+ return -EINVAL;
+ }
++
++int smum_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ if (hwmgr->smumgr_funcs->stop_smc)
++ return hwmgr->smumgr_funcs->stop_smc(hwmgr);
++
++ return 0;
++}
+--
+2.27.0
+
--- /dev/null
+From 3a0c81ec66d9ffcea305c1ddad1078efe4c7ea2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 15:29:59 +0800
+Subject: drm/amdgpu: perform srbm soft reset always on SDMA resume
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ]
+
+This can address the random SDMA hang after pci config reset
+seen on Hawaii.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+index d0fa2aac23888..ca66c2f797584 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+@@ -1086,22 +1086,19 @@ static int cik_sdma_soft_reset(void *handle)
+ {
+ u32 srbm_soft_reset = 0;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- u32 tmp = RREG32(mmSRBM_STATUS2);
++ u32 tmp;
+
+- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) {
+- /* sdma0 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
+- }
+- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) {
+- /* sdma1 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+- }
++ /* sdma0 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
++
++ /* sdma1 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+
+ if (srbm_soft_reset) {
+ tmp = RREG32(mmSRBM_SOFT_RESET);
+--
+2.27.0
+
--- /dev/null
+From 9a76418d26dfab1d6b06f691283b94531b20fb93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:10:02 -0500
+Subject: gfs2: Add missing truncate_inode_pages_final for sd_aspace
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit a9dd945ccef07a904e412f208f8de708a3d7159e ]
+
+Gfs2 creates an address space for its rgrps called sd_aspace, but it never
+called truncate_inode_pages_final on it. This confused vfs greatly which
+tried to reference the address space after gfs2 had freed the superblock
+that contained it.
+
+This patch adds a call to truncate_inode_pages_final for sd_aspace, thus
+avoiding the use-after-free.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index a971862b186e3..22cd68bd8c9b0 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -934,6 +934,7 @@ restart:
+ gfs2_jindex_free(sdp);
+ /* Take apart glock structures and buffer lists */
+ gfs2_gl_hash_clear(sdp);
++ truncate_inode_pages_final(&sdp->sd_aspace);
+ gfs2_delete_debugfs_file(sdp);
+ /* Unmount the locking protocol */
+ gfs2_lm_unmount(sdp);
+--
+2.27.0
+
--- /dev/null
+From 2b3b11745445a869bdbd16ec1cecfcfd7008c4e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 13:42:18 -0500
+Subject: gfs2: check for live vs. read-only file system in gfs2_fitrim
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ]
+
+Before this patch, gfs2_fitrim was not properly checking for a "live" file
+system. If the file system had something to trim and the file system
+was read-only (or spectator) it would start the trim, but when it starts
+the transaction, gfs2_trans_begin returns -EROFS (read-only file system)
+and it errors out. However, if the file system was already trimmed so
+there's no work to do, it never called gfs2_trans_begin. That code is
+bypassed so it never returns the error. Instead, it returns a good
+return code with 0 work. All this makes for inconsistent behavior:
+The same fstrim command can return -EROFS in one case and 0 in another.
+This tripped up xfstests generic/537 which reports the error as:
+
+ +fstrim with unrecovered metadata just ate your filesystem
+
+This patch adds a check for a "live" (iow, active journal, iow, RW)
+file system, and if not, returns the error properly.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 1686a40099f21..de9b561b1c385 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1387,6 +1387,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
++ return -EROFS;
++
+ if (!blk_queue_discard(q))
+ return -EOPNOTSUPP;
+
+--
+2.27.0
+
--- /dev/null
+From d19dea29eb38dbd862d2f072a1f237a0a05f1361 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:10:01 -0500
+Subject: gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
+
+Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
+return_all_reservations, but return_all_reservations still dereferences
+rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
+call to return_all_reservations.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index c94c4ac1ae78b..1686a40099f21 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -739,9 +739,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+ }
+
+ gfs2_free_clones(rgd);
++ return_all_reservations(rgd);
+ kfree(rgd->rd_bits);
+ rgd->rd_bits = NULL;
+- return_all_reservations(rgd);
+ kmem_cache_free(gfs2_rgrpd_cachep, rgd);
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From 675e59fa98a4871bcaef8c7e37662aa9011e8e87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 02:50:02 +0000
+Subject: iommu/amd: Increase interrupt remapping table limit to 512 entries
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ]
+
+Certain device drivers allocate IO queues on a per-cpu basis.
+On AMD EPYC platform, which can support up-to 256 cpu threads,
+this can exceed the current MAX_IRQ_PER_TABLE limit of 256,
+and result in the error message:
+
+ AMD-Vi: Failed to allocate IRTE
+
+This has been observed with certain NVME devices.
+
+AMD IOMMU hardware can actually support upto 512 interrupt
+remapping table entries. Therefore, update the driver to
+match the hardware limit.
+
+Please note that this also increases the size of interrupt remapping
+table to 8KB per device when using the 128-bit IRTE format.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Link: https://lore.kernel.org/r/20201015025002.87997-1-suravee.suthikulpanit@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_types.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 859b06424e5c4..df6f3cc958e5e 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -410,7 +410,11 @@ extern bool amd_iommu_np_cache;
+ /* Only true if all IOMMUs support device IOTLBs */
+ extern bool amd_iommu_iotlb_sup;
+
+-#define MAX_IRQS_PER_TABLE 256
++/*
++ * AMD IOMMU hardware only support 512 IRTEs despite
++ * the architectural limitation of 2048 entries.
++ */
++#define MAX_IRQS_PER_TABLE 512
+ #define IRQ_TABLE_ALIGNMENT 128
+
+ struct irq_remap_table {
+--
+2.27.0
+
--- /dev/null
+From 4a5c7469e7d809dc4b44294831f6d0efe00b03d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:17:11 +0200
+Subject: mac80211: always wind down STA state
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ]
+
+When (for example) an IBSS station is pre-moved to AUTHORIZED
+before it's inserted, and then the insertion fails, we don't
+clean up the fast RX/TX states that might already have been
+created, since we don't go through all the state transitions
+again on the way down.
+
+Do that, if it hasn't been done already, when the station is
+freed. I considered only freeing the fast TX/RX state there,
+but we might add more state so it's more robust to wind down
+the state properly.
+
+Note that we warn if the station was ever inserted, it should
+have been properly cleaned up in that case, and the driver
+will probably not like things happening out of order.
+
+Reported-by: syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 9968b8a976f19..d11eb5139c92a 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -244,6 +244,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+ */
+ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
+ {
++ /*
++ * If we had used sta_info_pre_move_state() then we might not
++ * have gone through the state transitions down again, so do
++ * it here now (and warn if it's inserted).
++ *
++ * This will clear state such as fast TX/RX that may have been
++ * allocated during state transitions.
++ */
++ while (sta->sta_state > IEEE80211_STA_NONE) {
++ int ret;
++
++ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));
++
++ ret = sta_info_move_state(sta, sta->sta_state - 1);
++ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret))
++ break;
++ }
++
+ if (sta->rate_ctrl)
+ rate_control_free_sta(sta);
+
+--
+2.27.0
+
--- /dev/null
+From 1fc4b8f0c2017e6816e283ae9776dfdcdbe730dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 13:25:41 +0200
+Subject: mac80211: fix use of skb payload instead of header
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ]
+
+When ieee80211_skb_resize() is called from ieee80211_build_hdr()
+the skb has no 802.11 header yet, in fact it consist only of the
+payload as the ethernet frame is removed. As such, we're using
+the payload data for ieee80211_is_mgmt(), which is of course
+completely wrong. This didn't really hurt us because these are
+always data frames, so we could only have added more tailroom
+than we needed if we determined it was a management frame and
+sdata->crypto_tx_tailroom_needed_cnt was false.
+
+However, syzbot found that of course there need not be any payload,
+so we're using at best uninitialized memory for the check.
+
+Fix this to pass explicitly the kind of frame that we have instead
+of checking there, by replacing the "bool may_encrypt" argument
+with an argument that can carry the three possible states - it's
+not going to be encrypted, it's a management frame, or it's a data
+frame (and then we check sdata->crypto_tx_tailroom_needed_cnt).
+
+Reported-by: syzbot+32fd1a1bfe355e93f1e2@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20201009132538.e1fd7f802947.I799b288466ea2815f9d4c84349fae697dca2f189@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 3160ffd93a153..98d048630ad2f 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1908,19 +1908,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+
+ /* device xmit handlers */
+
++enum ieee80211_encrypt {
++ ENCRYPT_NO,
++ ENCRYPT_MGMT,
++ ENCRYPT_DATA,
++};
++
+ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ struct sk_buff *skb,
+- int head_need, bool may_encrypt)
++ int head_need,
++ enum ieee80211_encrypt encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
+- struct ieee80211_hdr *hdr;
+ bool enc_tailroom;
+ int tail_need = 0;
+
+- hdr = (struct ieee80211_hdr *) skb->data;
+- enc_tailroom = may_encrypt &&
+- (sdata->crypto_tx_tailroom_needed_cnt ||
+- ieee80211_is_mgmt(hdr->frame_control));
++ enc_tailroom = encrypt == ENCRYPT_MGMT ||
++ (encrypt == ENCRYPT_DATA &&
++ sdata->crypto_tx_tailroom_needed_cnt);
+
+ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+@@ -1952,23 +1957,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+- struct ieee80211_hdr *hdr;
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ int headroom;
+- bool may_encrypt;
++ enum ieee80211_encrypt encrypt;
+
+- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
++ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
++ encrypt = ENCRYPT_NO;
++ else if (ieee80211_is_mgmt(hdr->frame_control))
++ encrypt = ENCRYPT_MGMT;
++ else
++ encrypt = ENCRYPT_DATA;
+
+ headroom = local->tx_headroom;
+- if (may_encrypt)
++ if (encrypt != ENCRYPT_NO)
+ headroom += sdata->encrypt_headroom;
+ headroom -= skb_headroom(skb);
+ headroom = max_t(int, 0, headroom);
+
+- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
++ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ return;
+ }
+
++ /* reload after potential resize */
+ hdr = (struct ieee80211_hdr *) skb->data;
+ info->control.vif = &sdata->vif;
+
+@@ -2751,7 +2762,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
+ head_need += sdata->encrypt_headroom;
+ head_need += local->tx_headroom;
+ head_need = max_t(int, 0, head_need);
+- if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
++ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ skb = NULL;
+ return ERR_PTR(-ENOMEM);
+@@ -3414,7 +3425,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+ if (unlikely(ieee80211_skb_resize(sdata, skb,
+ max_t(int, extra_head + hw_headroom -
+ skb_headroom(skb), 0),
+- false))) {
++ ENCRYPT_NO))) {
+ kfree_skb(skb);
+ return true;
+ }
+--
+2.27.0
+
--- /dev/null
+From e66086ba2887d779c7b0ecde1de2b10e4956c94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 14:27:42 -0400
+Subject: s390/smp: move rcu_cpu_starting() earlier
+
+From: Qian Cai <cai@redhat.com>
+
+[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ]
+
+The call to rcu_cpu_starting() in smp_init_secondary() is not early
+enough in the CPU-hotplug onlining process, which results in lockdep
+splats as follows:
+
+ WARNING: suspicious RCU usage
+ -----------------------------
+ kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!!
+
+ other info that might help us debug this:
+
+ RCU used illegally from offline CPU!
+ rcu_scheduler_active = 1, debug_locks = 1
+ no locks held by swapper/1/0.
+
+ Call Trace:
+ show_stack+0x158/0x1f0
+ dump_stack+0x1f2/0x238
+ __lock_acquire+0x2640/0x4dd0
+ lock_acquire+0x3a8/0xd08
+ _raw_spin_lock_irqsave+0xc0/0xf0
+ clockevents_register_device+0xa8/0x528
+ init_cpu_timer+0x33e/0x468
+ smp_init_secondary+0x11a/0x328
+ smp_start_secondary+0x82/0x88
+
+This is avoided by moving the call to rcu_cpu_starting up near the
+beginning of the smp_init_secondary() function. Note that the
+raw_smp_processor_id() is required in order to avoid calling into
+lockdep before RCU has declared the CPU to be watched for readers.
+
+Link: https://lore.kernel.org/lkml/160223032121.7002.1269740091547117869.tip-bot2@tip-bot2/
+Signed-off-by: Qian Cai <cai@redhat.com>
+Acked-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/smp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 8e31dfd85de32..888f247c9261a 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -831,7 +831,7 @@ void __init smp_detect_cpus(void)
+ */
+ static void smp_start_secondary(void *cpuvoid)
+ {
+- int cpu = smp_processor_id();
++ int cpu = raw_smp_processor_id();
+
+ S390_lowcore.last_update_clock = get_tod_clock();
+ S390_lowcore.restart_stack = (unsigned long) restart_stack;
+@@ -844,6 +844,7 @@ static void smp_start_secondary(void *cpuvoid)
+ set_cpu_flag(CIF_ASCE_PRIMARY);
+ set_cpu_flag(CIF_ASCE_SECONDARY);
+ cpu_init();
++ rcu_cpu_starting(cpu);
+ preempt_disable();
+ init_cpu_timer();
+ vtime_init();
+--
+2.27.0
+
--- /dev/null
+From b6f909addf389e50c7398015d708f1203dfd22b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 07:31:24 +0000
+Subject: scsi: hpsa: Fix memory leak in hpsa_init_one()
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ]
+
+When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is
+missing a free() in the error handler.
+
+Fix this by adding free() when hpsa_scsi_add_host() fails.
+
+Link: https://lore.kernel.org/r/20201027073125.14229-1-keitasuzuki.park@sslab.ics.keio.ac.jp
+Tested-by: Don Brace <don.brace@microchip.com>
+Acked-by: Don Brace <don.brace@microchip.com>
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 11de2198bb87d..0fe21cbdf0ca7 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -8781,7 +8781,7 @@ reinit_after_soft_reset:
+ /* hook into SCSI subsystem */
+ rc = hpsa_scsi_add_host(h);
+ if (rc)
+- goto clean7; /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ goto clean8; /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
+
+ /* Monitor the controller for firmware lockups */
+ h->heartbeat_sample_interval = HEARTBEAT_SAMPLE_INTERVAL;
+@@ -8796,6 +8796,8 @@ reinit_after_soft_reset:
+ HPSA_EVENT_MONITOR_INTERVAL);
+ return 0;
+
++clean8: /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ kfree(h->lastlogicals);
+ clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
+ hpsa_free_performant_mode(h);
+ h->access.set_intr_mask(h, HPSA_INTR_OFF);
+--
+2.27.0
+
--- /dev/null
+From 615c1f8e8f6a4dd6890dc6adb18d33493e3491e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 12:45:59 +0200
+Subject: scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca ]
+
+alua_bus_detach() might be running concurrently with alua_rtpg_work(), so
+we might trip over h->sdev == NULL and call BUG_ON(). The correct way of
+handling it is to not set h->sdev to NULL in alua_bus_detach(), and call
+rcu_synchronize() before the final delete to ensure that all concurrent
+threads have left the critical section. Then we can get rid of the
+BUG_ON() and replace it with a simple if condition.
+
+Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com
+Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de
+Cc: Brian Bunker <brian@purestorage.com>
+Acked-by: Brian Bunker <brian@purestorage.com>
+Tested-by: Jitendra Khasdev <jitendra.khasdev@oracle.com>
+Reviewed-by: Jitendra Khasdev <jitendra.khasdev@oracle.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index c95c782b93a53..60c48dc5d9453 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -672,8 +672,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ rcu_read_lock();
+ list_for_each_entry_rcu(h,
+ &tmp_pg->dh_list, node) {
+- /* h->sdev should always be valid */
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state = desc[0];
+ }
+ rcu_read_unlock();
+@@ -719,7 +719,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ pg->expiry = 0;
+ rcu_read_lock();
+ list_for_each_entry_rcu(h, &pg->dh_list, node) {
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state =
+ (pg->state & SCSI_ACCESS_STATE_MASK);
+ if (pg->pref)
+@@ -1160,7 +1161,6 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ spin_lock(&h->pg_lock);
+ pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock));
+ rcu_assign_pointer(h->pg, NULL);
+- h->sdev = NULL;
+ spin_unlock(&h->pg_lock);
+ if (pg) {
+ spin_lock_irq(&pg->lock);
+@@ -1169,6 +1169,7 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ kref_put(&pg->kref, release_port_group);
+ }
+ sdev->handler_data = NULL;
++ synchronize_rcu();
+ kfree(h);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From a77af8a3b28417d7939e095caeeea335ba534ce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 15:26:30 +0300
+Subject: selftests: proc: fix warning: _GNU_SOURCE redefined
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ]
+
+Makefile already contains -D_GNU_SOURCE, so we can remove it from the
+*.c files.
+
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/proc/proc-loadavg-001.c | 1 -
+ tools/testing/selftests/proc/proc-self-syscall.c | 1 -
+ tools/testing/selftests/proc/proc-uptime-002.c | 1 -
+ 3 files changed, 3 deletions(-)
+
+diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c
+index fcff7047000da..8edaafc2b92fd 100644
+--- a/tools/testing/selftests/proc/proc-loadavg-001.c
++++ b/tools/testing/selftests/proc/proc-loadavg-001.c
+@@ -14,7 +14,6 @@
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+ /* Test that /proc/loadavg correctly reports last pid in pid namespace. */
+-#define _GNU_SOURCE
+ #include <errno.h>
+ #include <sched.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c
+index 5ab5f4810e43a..7b9018fad092a 100644
+--- a/tools/testing/selftests/proc/proc-self-syscall.c
++++ b/tools/testing/selftests/proc/proc-self-syscall.c
+@@ -13,7 +13,6 @@
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+-#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c
+index 30e2b78490898..e7ceabed7f51f 100644
+--- a/tools/testing/selftests/proc/proc-uptime-002.c
++++ b/tools/testing/selftests/proc/proc-uptime-002.c
+@@ -15,7 +15,6 @@
+ */
+ // Test that values in /proc/uptime increment monotonically
+ // while shifting across CPUs.
+-#define _GNU_SOURCE
+ #undef NDEBUG
+ #include <assert.h>
+ #include <unistd.h>
+--
+2.27.0
+
ath9k_htc-use-appropriate-rs_datalen-type.patch
netfilter-use-actual-socket-sk-rather-than-skb-sk-when-routing-harder.patch
crypto-arm64-aes-modes-get-rid-of-literal-load-of-addend-vector.patch
+usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch
+alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch
+gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch
+gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch
+gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch
+scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch
+drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch
+drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch
+drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch
+mac80211-fix-use-of-skb-payload-instead-of-header.patch
+mac80211-always-wind-down-sta-state.patch
+cfg80211-regulatory-fix-inconsistent-format-argument.patch
+scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch
+iommu-amd-increase-interrupt-remapping-table-limit-t.patch
+s390-smp-move-rcu_cpu_starting-earlier.patch
+vfio-platform-fix-reference-leak-in-vfio_platform_op.patch
+selftests-proc-fix-warning-_gnu_source-redefined.patch
+tpm_tis-disable-interrupts-on-thinkpad-t490s.patch
--- /dev/null
+From f90e473271eea710b510c8b274a3148ebb9d1569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:44:30 -0700
+Subject: tpm_tis: Disable interrupts on ThinkPad T490s
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit b154ce11ead925de6a94feb3b0317fafeefa0ebc ]
+
+There is a misconfiguration in the bios of the gpio pin used for the
+interrupt in the T490s. When interrupts are enabled in the tpm_tis
+driver code this results in an interrupt storm. This was initially
+reported when we attempted to enable the interrupt code in the tpm_tis
+driver, which previously wasn't setting a flag to enable it. Due to
+the reports of the interrupt storm that code was reverted and we went back
+to polling instead of using interrupts. Now that we know the T490s problem
+is a firmware issue, add code to check if the system is a T490s and
+disable interrupts if that is the case. This will allow us to enable
+interrupts for everyone else. If the user has a fixed bios they can
+force the enabling of interrupts with tpm_tis.interrupts=1 on the
+kernel command line.
+
+Cc: Peter Huewe <peterhuewe@gmx.de>
+Cc: Jason Gunthorpe <jgg@ziepe.ca>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index f08949a5f6785..5a3a4f0953910 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -31,6 +31,7 @@
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+ #include <linux/kernel.h>
++#include <linux/dmi.h>
+ #include "tpm.h"
+ #include "tpm_tis_core.h"
+
+@@ -53,8 +54,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da
+ return container_of(data, struct tpm_tis_tcg_phy, priv);
+ }
+
+-static bool interrupts = true;
+-module_param(interrupts, bool, 0444);
++static int interrupts = -1;
++module_param(interrupts, int, 0444);
+ MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+ static bool itpm;
+@@ -67,6 +68,28 @@ module_param(force, bool, 0444);
+ MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
+ #endif
+
++static int tpm_tis_disable_irq(const struct dmi_system_id *d)
++{
++ if (interrupts == -1) {
++ pr_notice("tpm_tis: %s detected: disabling interrupts.\n", d->ident);
++ interrupts = 0;
++ }
++
++ return 0;
++}
++
++static const struct dmi_system_id tpm_tis_dmi_table[] = {
++ {
++ .callback = tpm_tis_disable_irq,
++ .ident = "ThinkPad T490s",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"),
++ },
++ },
++ {}
++};
++
+ #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
+ static int has_hid(struct acpi_device *dev, const char *hid)
+ {
+@@ -196,6 +219,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)
+ int irq = -1;
+ int rc;
+
++ dmi_check_system(tpm_tis_dmi_table);
++
+ rc = check_acpi_tpm2(dev);
+ if (rc)
+ return rc;
+--
+2.27.0
+
--- /dev/null
+From 0651915fd3e4f8da194e4926b3cc846d65bdca19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Oct 2020 18:01:55 +0300
+Subject: usb: gadget: goku_udc: fix potential crashes in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]
+
+goku_probe() goes to error label "err" and invokes goku_remove()
+in case of failures of pci_enable_device(), pci_resource_start()
+and ioremap(). goku_remove() gets a device from
+pci_get_drvdata(pdev) and works with it without any checks, in
+particular it dereferences a corresponding pointer. But
+goku_probe() did not set this device yet. So, one can expect
+various crashes. The patch moves setting the device just after
+allocation of memory for it.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Reported-by: Pavel Andrianov <andrianov@ispras.ru>
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/goku_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
+index c3721225b61ed..b706ad3034bc1 100644
+--- a/drivers/usb/gadget/udc/goku_udc.c
++++ b/drivers/usb/gadget/udc/goku_udc.c
+@@ -1757,6 +1757,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err;
+ }
+
++ pci_set_drvdata(pdev, dev);
+ spin_lock_init(&dev->lock);
+ dev->pdev = pdev;
+ dev->gadget.ops = &goku_ops;
+@@ -1790,7 +1791,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+ dev->regs = (struct goku_udc_regs __iomem *) base;
+
+- pci_set_drvdata(pdev, dev);
+ INFO(dev, "%s\n", driver_desc);
+ INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
+ INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
+--
+2.27.0
+
--- /dev/null
+From 16d7989091b702b486afb8c64a5878c1bb8479d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Oct 2020 11:03:53 +0800
+Subject: vfio: platform: fix reference leak in vfio_platform_open
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit bb742ad01961a3b9d1f9d19375487b879668b6b2 ]
+
+pm_runtime_get_sync() will increment pm usage counter even it
+failed. Forgetting to call pm_runtime_put will result in
+reference leak in vfio_platform_open, so we should fix it.
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/platform/vfio_platform_common.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index c0cd824be2b76..460760d0becfe 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -273,7 +273,7 @@ static int vfio_platform_open(void *device_data)
+
+ ret = pm_runtime_get_sync(vdev->device);
+ if (ret < 0)
+- goto err_pm;
++ goto err_rst;
+
+ ret = vfio_platform_call_reset(vdev, &extra_dbg);
+ if (ret && vdev->reset_required) {
+@@ -290,7 +290,6 @@ static int vfio_platform_open(void *device_data)
+
+ err_rst:
+ pm_runtime_put(vdev->device);
+-err_pm:
+ vfio_platform_irq_cleanup(vdev);
+ err_irq:
+ vfio_platform_regions_cleanup(vdev);
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
