--- /dev/null
+From a58015d638cd4e4555297b04bec9b49028369075 Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Thu, 7 Jan 2021 23:23:48 -0800
+Subject: ACPI: scan: Harden acpi_device_add() against device ID overflows
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit a58015d638cd4e4555297b04bec9b49028369075 upstream.
+
+Linux VM on Hyper-V crashes with the latest mainline:
+
+[ 4.069624] detected buffer overflow in strcpy
+[ 4.077733] kernel BUG at lib/string.c:1149!
+..
+[ 4.085819] RIP: 0010:fortify_panic+0xf/0x11
+...
+[ 4.085819] Call Trace:
+[ 4.085819] acpi_device_add.cold.15+0xf2/0xfb
+[ 4.085819] acpi_add_single_object+0x2a6/0x690
+[ 4.085819] acpi_bus_check_add+0xc6/0x280
+[ 4.085819] acpi_ns_walk_namespace+0xda/0x1aa
+[ 4.085819] acpi_walk_namespace+0x9a/0xc2
+[ 4.085819] acpi_bus_scan+0x78/0x90
+[ 4.085819] acpi_scan_init+0xfa/0x248
+[ 4.085819] acpi_init+0x2c1/0x321
+[ 4.085819] do_one_initcall+0x44/0x1d0
+[ 4.085819] kernel_init_freeable+0x1ab/0x1f4
+
+This is because of the recent buffer overflow detection in the
+commit 6a39e62abbaf ("lib: string.h: detect intra-object overflow in
+fortified string functions")
+
+Here acpi_device_bus_id->bus_id can only hold 14 characters, while the
+the acpi_device_hid(device) returns a 22-char string
+"HYPER_V_GEN_COUNTER_V1".
+
+Per ACPI Spec v6.2, Section 6.1.5 _HID (Hardware ID), if the ID is a
+string, it must be of the form AAA#### or NNNN####, i.e. 7 chars or 8
+chars.
+
+The field bus_id in struct acpi_device_bus_id was originally defined as
+char bus_id[9], and later was enlarged to char bus_id[15] in 2007 in the
+commit bb0958544f3c ("ACPI: use more understandable bus_id for ACPI
+devices")
+
+Fix the issue by changing the field bus_id to const char *, and use
+kstrdup_const() to initialize it.
+
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Tested-By: Jethro Beekman <jethro@fortanix.com>
+[ rjw: Subject change, whitespace adjustment ]
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/internal.h | 2 +-
+ drivers/acpi/scan.c | 15 ++++++++++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -97,7 +97,7 @@ void acpi_scan_table_handler(u32 event,
+ extern struct list_head acpi_bus_id_list;
+
+ struct acpi_device_bus_id {
+- char bus_id[15];
++ const char *bus_id;
+ unsigned int instance_no;
+ struct list_head node;
+ };
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -486,6 +486,7 @@ static void acpi_device_del(struct acpi_
+ acpi_device_bus_id->instance_no--;
+ else {
+ list_del(&acpi_device_bus_id->node);
++ kfree_const(acpi_device_bus_id->bus_id);
+ kfree(acpi_device_bus_id);
+ }
+ break;
+@@ -674,7 +675,14 @@ int acpi_device_add(struct acpi_device *
+ }
+ if (!found) {
+ acpi_device_bus_id = new_bus_id;
+- strcpy(acpi_device_bus_id->bus_id, acpi_device_hid(device));
++ acpi_device_bus_id->bus_id =
++ kstrdup_const(acpi_device_hid(device), GFP_KERNEL);
++ if (!acpi_device_bus_id->bus_id) {
++ pr_err(PREFIX "Memory allocation error for bus id\n");
++ result = -ENOMEM;
++ goto err_free_new_bus_id;
++ }
++
+ acpi_device_bus_id->instance_no = 0;
+ list_add_tail(&acpi_device_bus_id->node, &acpi_bus_id_list);
+ }
+@@ -709,6 +717,11 @@ int acpi_device_add(struct acpi_device *
+ if (device->parent)
+ list_del(&device->node);
+ list_del(&device->wakeup_list);
++
++ err_free_new_bus_id:
++ if (!found)
++ kfree(new_bus_id);
++
+ mutex_unlock(&acpi_device_lock);
+
+ err_detach:
--- /dev/null
+From 3e096a2112b7b407549020cf095e2a425f00fabb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jonathan=20Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
+Date: Fri, 1 Jan 2021 23:19:42 +0100
+Subject: ALSA: doc: Fix reference to mixart.rst
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+commit 3e096a2112b7b407549020cf095e2a425f00fabb upstream.
+
+MIXART.txt has been converted to ReST and renamed. Fix the reference
+in alsa-configuration.rst.
+
+Fixes: 3d8e81862ce4 ("ALSA: doc: ReSTize MIXART.txt")
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210101221942.1068388-1-j.neuschaefer@gmx.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/Documentation/sound/alsa-configuration.rst b/Documentation/sound/alsa-configuration.rst
+index fe52c314b763..b36af65a08ed 100644
+--- a/Documentation/sound/alsa-configuration.rst
++++ b/Documentation/sound/alsa-configuration.rst
+@@ -1501,7 +1501,7 @@ Module for Digigram miXart8 sound cards.
+
+ This module supports multiple cards.
+ Note: One miXart8 board will be represented as 4 alsa cards.
+-See MIXART.txt for details.
++See Documentation/sound/cards/mixart.rst for details.
+
+ When the driver is compiled as a module and the hotplug firmware
+ is supported, the firmware data is loaded via hotplug automatically.
--- /dev/null
+From 91bc156817a3c2007332b64b4f85c32aafbbbea6 Mon Sep 17 00:00:00 2001
+From: Jeremy Szu <jeremy.szu@canonical.com>
+Date: Wed, 6 Jan 2021 21:05:46 +0800
+Subject: ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines
+
+From: Jeremy Szu <jeremy.szu@canonical.com>
+
+commit 91bc156817a3c2007332b64b4f85c32aafbbbea6 upstream.
+
+ * The HP ZBook Fury 15/17 G7 Mobile Workstation are using ALC285 codec
+ which is using 0x04 to control mute LED and 0x01 to control micmute LED.
+
+ * The right channel speaker is no sound and it needs to expose GPIO1 for
+ initialing AMP.
+
+Add quirks to support them.
+
+Signed-off-by: Jeremy Szu <jeremy.szu@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210106130549.100532-1-jeremy.szu@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7970,6 +7970,10 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8760, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x8780, "HP ZBook Fury 17 G7 Mobile Workstation",
++ ALC285_FIXUP_HP_GPIO_AMP_INIT),
++ SND_PCI_QUIRK(0x103c, 0x8783, "HP ZBook Fury 15 G7 Mobile Workstation",
++ ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
--- /dev/null
+From 1f092d1c8819679d78a7d9c62a46d4939d217a9d Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Sun, 27 Dec 2020 17:41:09 +0100
+Subject: ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 1f092d1c8819679d78a7d9c62a46d4939d217a9d upstream.
+
+The ThinkPad X395 latop does not have the internal digital
+microphone connected to the AMD's ACP bridge, but it's advertised
+via BIOS. The internal microphone is connected to the HDA codec.
+
+Use DMI to block the microphone PCM device for this platform.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1892115
+Cc: <stable@kernel.org>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20201227164109.269973-1-perex@perex.cz
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/amd/renoir/rn-pci-acp3x.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/soc/amd/renoir/rn-pci-acp3x.c
++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c
+@@ -171,6 +171,13 @@ static const struct dmi_system_id rn_acp
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"),
+ }
+ },
++ {
++ /* Lenovo ThinkPad X395 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "20NLCTO1WW"),
++ }
++ },
+ {}
+ };
+
--- /dev/null
+From 5c6679b5cb120f07652418524ab186ac47680b49 Mon Sep 17 00:00:00 2001
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Sat, 12 Dec 2020 17:20:12 -0800
+Subject: ASoC: dapm: remove widget from dirty list on free
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+commit 5c6679b5cb120f07652418524ab186ac47680b49 upstream.
+
+A widget's "dirty" list_head, much like its "list" list_head, eventually
+chains back to a list_head on the snd_soc_card itself. This means that
+the list can stick around even after the widget (or all widgets) have
+been freed. Currently, however, widgets that are in the dirty list when
+freed remain there, corrupting the entire list and leading to memory
+errors and undefined behavior when the list is next accessed or
+modified.
+
+I encountered this issue when a component failed to probe relatively
+late in snd_soc_bind_card(), causing it to bail out and call
+soc_cleanup_card_resources(), which eventually called
+snd_soc_dapm_free() with widgets that were still dirty from when they'd
+been added.
+
+Fixes: db432b414e20 ("ASoC: Do DAPM power checks only for widgets changed since last run")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/f8b5f031d50122bf1a9bfc9cae046badf4a7a31a.1607822410.git.tommyhebb@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2486,6 +2486,7 @@ void snd_soc_dapm_free_widget(struct snd
+ enum snd_soc_dapm_direction dir;
+
+ list_del(&w->list);
++ list_del(&w->dirty);
+ /*
+ * remove source and sink paths associated to this widget.
+ * While removing the path, remove reference to it from both
--- /dev/null
+From 29b665cc51e8b602bf2a275734349494776e3dbc Mon Sep 17 00:00:00 2001
+From: Su Yue <l@damenly.su>
+Date: Sun, 3 Jan 2021 17:28:03 +0800
+Subject: btrfs: prevent NULL pointer dereference in extent_io_tree_panic
+
+From: Su Yue <l@damenly.su>
+
+commit 29b665cc51e8b602bf2a275734349494776e3dbc upstream.
+
+Some extent io trees are initialized with NULL private member (e.g.
+btrfs_device::alloc_state and btrfs_fs_info::excluded_extents).
+Dereference of a NULL tree->private as inode pointer will cause panic.
+
+Pass tree->fs_info as it's known to be valid in all cases.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929
+Fixes: 05912a3c04eb ("btrfs: drop extent_io_ops::tree_fs_info callback")
+CC: stable@vger.kernel.org # 4.19+
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Su Yue <l@damenly.su>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent_io.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -676,9 +676,7 @@ alloc_extent_state_atomic(struct extent_
+
+ static void extent_io_tree_panic(struct extent_io_tree *tree, int err)
+ {
+- struct inode *inode = tree->private_data;
+-
+- btrfs_panic(btrfs_sb(inode->i_sb), err,
++ btrfs_panic(tree->fs_info, err,
+ "locking error: extent tree was modified by another thread while locked");
+ }
+
--- /dev/null
+From 50e31ef486afe60f128d42fb9620e2a63172c15c Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 29 Dec 2020 21:29:34 +0800
+Subject: btrfs: reloc: fix wrong file extent type check to avoid false ENOENT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qu Wenruo <wqu@suse.com>
+
+commit 50e31ef486afe60f128d42fb9620e2a63172c15c upstream.
+
+[BUG]
+There are several bug reports about recent kernel unable to relocate
+certain data block groups.
+
+Sometimes the error just goes away, but there is one reporter who can
+reproduce it reliably.
+
+The dmesg would look like:
+
+ [438.260483] BTRFS info (device dm-10): balance: start -dvrange=34625344765952..34625344765953
+ [438.269018] BTRFS info (device dm-10): relocating block group 34625344765952 flags data|raid1
+ [450.439609] BTRFS info (device dm-10): found 167 extents, stage: move data extents
+ [463.501781] BTRFS info (device dm-10): balance: ended with status: -2
+
+[CAUSE]
+The ENOENT error is returned from the following call chain:
+
+ add_data_references()
+ |- delete_v1_space_cache();
+ |- if (!found)
+ return -ENOENT;
+
+The variable @found is set to true if we find a data extent whose
+disk bytenr matches parameter @data_bytes.
+
+With extra debugging, the offending tree block looks like this:
+
+ leaf bytenr = 42676709441536, data_bytenr = 34626327621632
+
+ ctime 1567904822.739884119 (2019-09-08 03:07:02)
+ mtime 0.0 (1970-01-01 01:00:00)
+ otime 0.0 (1970-01-01 01:00:00)
+ item 27 key (51933 EXTENT_DATA 0) itemoff 9854 itemsize 53
+ generation 1517381 type 2 (prealloc)
+ prealloc data disk byte 34626327621632 nr 262144 <<<
+ prealloc data offset 0 nr 262144
+ item 28 key (52262 ROOT_ITEM 0) itemoff 9415 itemsize 439
+ generation 2618893 root_dirid 256 bytenr 42677048360960 level 3 refs 1
+ lastsnap 2618893 byte_limit 0 bytes_used 5557338112 flags 0x0(none)
+ uuid d0d4361f-d231-6d40-8901-fe506e4b2b53
+
+Although item 27 has disk bytenr 34626327621632, which matches the
+data_bytenr, its type is prealloc, not reg.
+This makes the existing code skip that item, and return ENOENT.
+
+[FIX]
+The code is modified in commit 19b546d7a1b2 ("btrfs: relocation: Use
+btrfs_find_all_leafs to locate data extent parent tree leaves"), before
+that commit, we use something like
+
+ "if (type == BTRFS_FILE_EXTENT_INLINE) continue;"
+
+But in that offending commit, we use (type == BTRFS_FILE_EXTENT_REG),
+ignoring BTRFS_FILE_EXTENT_PREALLOC.
+
+Fix it by also checking BTRFS_FILE_EXTENT_PREALLOC.
+
+Reported-by: Stéphane Lesimple <stephane_btrfs2@lesimple.fr>
+Link: https://lore.kernel.org/linux-btrfs/505cabfa88575ed6dbe7cb922d8914fb@lesimple.fr
+Fixes: 19b546d7a1b2 ("btrfs: relocation: Use btrfs_find_all_leafs to locate data extent parent tree leaves")
+CC: stable@vger.kernel.org # 5.6+
+Tested-By: Stéphane Lesimple <stephane_btrfs2@lesimple.fr>
+Reviewed-by: Su Yue <l@damenly.su>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/relocation.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3027,11 +3027,16 @@ static int delete_v1_space_cache(struct
+ return 0;
+
+ for (i = 0; i < btrfs_header_nritems(leaf); i++) {
++ u8 type;
++
+ btrfs_item_key_to_cpu(leaf, &key, i);
+ if (key.type != BTRFS_EXTENT_DATA_KEY)
+ continue;
+ ei = btrfs_item_ptr(leaf, i, struct btrfs_file_extent_item);
+- if (btrfs_file_extent_type(leaf, ei) == BTRFS_FILE_EXTENT_REG &&
++ type = btrfs_file_extent_type(leaf, ei);
++
++ if ((type == BTRFS_FILE_EXTENT_REG ||
++ type == BTRFS_FILE_EXTENT_PREALLOC) &&
+ btrfs_file_extent_disk_bytenr(leaf, ei) == data_bytenr) {
+ found = true;
+ space_cache_ino = key.objectid;
--- /dev/null
+From 77b6ec01c29aade01701aa30bf1469acc7f2be76 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Tue, 5 Jan 2021 12:21:26 -0800
+Subject: cifs: check pointer before freeing
+
+From: Tom Rix <trix@redhat.com>
+
+commit 77b6ec01c29aade01701aa30bf1469acc7f2be76 upstream.
+
+clang static analysis reports this problem
+
+dfs_cache.c:591:2: warning: Argument to kfree() is a constant address
+ (18446744073709551614), which is not memory allocated by malloc()
+ kfree(vi);
+ ^~~~~~~~~
+
+In dfs_cache_del_vol() the volume info pointer 'vi' being freed
+is the return of a call to find_vol(). The large constant address
+is find_vol() returning an error.
+
+Add an error check to dfs_cache_del_vol() similar to the one done
+in dfs_cache_update_vol().
+
+Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+CC: <stable@vger.kernel.org> # v5.0+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/dfs_cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cifs/dfs_cache.c
++++ b/fs/cifs/dfs_cache.c
+@@ -1317,7 +1317,8 @@ void dfs_cache_del_vol(const char *fullp
+ vi = find_vol(fullpath);
+ spin_unlock(&vol_list_lock);
+
+- kref_put(&vi->refcnt, vol_release);
++ if (!IS_ERR(vi))
++ kref_put(&vi->refcnt, vol_release);
+ }
+
+ /**
--- /dev/null
+From 2659d3bff3e1b000f49907d0839178b101a89887 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@cjr.nz>
+Date: Wed, 13 Jan 2021 14:16:16 -0300
+Subject: cifs: fix interrupted close commands
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+commit 2659d3bff3e1b000f49907d0839178b101a89887 upstream.
+
+Retry close command if it gets interrupted to not leak open handles on
+the server.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reported-by: Duncan Findlay <duncf@duncf.ca>
+Suggested-by: Pavel Shilovsky <pshilov@microsoft.com>
+Fixes: 6988a619f5b7 ("cifs: allow syscalls to be restarted in __smb_send_rqst()")
+Cc: stable@vger.kernel.org
+Reviewd-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2pdu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3248,7 +3248,7 @@ close_exit:
+ free_rsp_buf(resp_buftype, rsp);
+
+ /* retry close in a worker thread if this one is interrupted */
+- if (rc == -EINTR) {
++ if (is_interrupt_error(rc)) {
+ int tmp_rc;
+
+ tmp_rc = smb2_handle_cancelled_close(tcon, persistent_fid,
--- /dev/null
+From dca5244d2f5b94f1809f0c02a549edf41ccd5493 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Tue, 12 Jan 2021 22:48:32 +0000
+Subject: compiler.h: Raise minimum version of GCC to 5.1 for arm64
+
+From: Will Deacon <will@kernel.org>
+
+commit dca5244d2f5b94f1809f0c02a549edf41ccd5493 upstream.
+
+GCC versions >= 4.9 and < 5.1 have been shown to emit memory references
+beyond the stack pointer, resulting in memory corruption if an interrupt
+is taken after the stack pointer has been adjusted but before the
+reference has been executed. This leads to subtle, infrequent data
+corruption such as the EXT4 problems reported by Russell King at the
+link below.
+
+Life is too short for buggy compilers, so raise the minimum GCC version
+required by arm64 to 5.1.
+
+Reported-by: Russell King <linux@armlinux.org.uk>
+Suggested-by: Arnd Bergmann <arnd@kernel.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: <stable@vger.kernel.org>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Cc: Florian Weimer <fweimer@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/r/20210105154726.GD1551@shell.armlinux.org.uk
+Link: https://lore.kernel.org/r/20210112224832.10980-1-will@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/compiler-gcc.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -13,6 +13,12 @@
+ /* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 */
+ #if GCC_VERSION < 40900
+ # error Sorry, your version of GCC is too old - please use 4.9 or newer.
++#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100
++/*
++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
++ * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
++ */
++# error Sorry, your version of GCC is too old - please use 5.1 or newer.
+ #endif
+
+ /*
--- /dev/null
+From c87a95dc28b1431c7e77e2c0c983cf37698089d2 Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Wed, 13 Jan 2021 19:17:17 +0000
+Subject: dm crypt: defer decryption to a tasklet if interrupts disabled
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit c87a95dc28b1431c7e77e2c0c983cf37698089d2 upstream.
+
+On some specific hardware on early boot we occasionally get:
+
+[ 1193.920255][ T0] BUG: sleeping function called from invalid context at mm/mempool.c:381
+[ 1193.936616][ T0] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/69
+[ 1193.953233][ T0] no locks held by swapper/69/0.
+[ 1193.965871][ T0] irq event stamp: 575062
+[ 1193.977724][ T0] hardirqs last enabled at (575061): [<ffffffffab73f662>] tick_nohz_idle_exit+0xe2/0x3e0
+[ 1194.002762][ T0] hardirqs last disabled at (575062): [<ffffffffab74e8af>] flush_smp_call_function_from_idle+0x4f/0x80
+[ 1194.029035][ T0] softirqs last enabled at (575050): [<ffffffffad600fd2>] asm_call_irq_on_stack+0x12/0x20
+[ 1194.054227][ T0] softirqs last disabled at (575043): [<ffffffffad600fd2>] asm_call_irq_on_stack+0x12/0x20
+[ 1194.079389][ T0] CPU: 69 PID: 0 Comm: swapper/69 Not tainted 5.10.6-cloudflare-kasan-2021.1.4-dev #1
+[ 1194.104103][ T0] Hardware name: NULL R162-Z12-CD/MZ12-HD4-CD, BIOS R10 06/04/2020
+[ 1194.119591][ T0] Call Trace:
+[ 1194.130233][ T0] dump_stack+0x9a/0xcc
+[ 1194.141617][ T0] ___might_sleep.cold+0x180/0x1b0
+[ 1194.153825][ T0] mempool_alloc+0x16b/0x300
+[ 1194.165313][ T0] ? remove_element+0x160/0x160
+[ 1194.176961][ T0] ? blk_mq_end_request+0x4b/0x490
+[ 1194.188778][ T0] crypt_convert+0x27f6/0x45f0 [dm_crypt]
+[ 1194.201024][ T0] ? rcu_read_lock_sched_held+0x3f/0x70
+[ 1194.212906][ T0] ? module_assert_mutex_or_preempt+0x3e/0x70
+[ 1194.225318][ T0] ? __module_address.part.0+0x1b/0x3a0
+[ 1194.237212][ T0] ? is_kernel_percpu_address+0x5b/0x190
+[ 1194.249238][ T0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0 [dm_crypt]
+[ 1194.261593][ T0] ? is_module_address+0x25/0x40
+[ 1194.272905][ T0] ? static_obj+0x8a/0xc0
+[ 1194.283582][ T0] ? lockdep_init_map_waits+0x26a/0x700
+[ 1194.295570][ T0] ? __raw_spin_lock_init+0x39/0x110
+[ 1194.307330][ T0] kcryptd_crypt_read_convert+0x31c/0x560 [dm_crypt]
+[ 1194.320496][ T0] ? kcryptd_queue_crypt+0x1be/0x380 [dm_crypt]
+[ 1194.333203][ T0] blk_update_request+0x6d7/0x1500
+[ 1194.344841][ T0] ? blk_mq_trigger_softirq+0x190/0x190
+[ 1194.356831][ T0] blk_mq_end_request+0x4b/0x490
+[ 1194.367994][ T0] ? blk_mq_trigger_softirq+0x190/0x190
+[ 1194.379693][ T0] flush_smp_call_function_queue+0x24b/0x560
+[ 1194.391847][ T0] flush_smp_call_function_from_idle+0x59/0x80
+[ 1194.403969][ T0] do_idle+0x287/0x450
+[ 1194.413891][ T0] ? arch_cpu_idle_exit+0x40/0x40
+[ 1194.424716][ T0] ? lockdep_hardirqs_on_prepare+0x286/0x3f0
+[ 1194.436399][ T0] ? _raw_spin_unlock_irqrestore+0x39/0x40
+[ 1194.447759][ T0] cpu_startup_entry+0x19/0x20
+[ 1194.458038][ T0] secondary_startup_64_no_verify+0xb0/0xbb
+
+IO completion can be queued to a different CPU by the block subsystem as a "call
+single function/data". The CPU may run these routines from the idle task, but it
+does so with interrupts disabled.
+
+It is not a good idea to do decryption with irqs disabled even in an idle task
+context, so just defer it to a tasklet (as is done with requests from hard irqs).
+
+Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues")
+Cc: stable@vger.kernel.org # v5.9+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2221,8 +2221,12 @@ static void kcryptd_queue_crypt(struct d
+
+ if ((bio_data_dir(io->base_bio) == READ && test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags)) ||
+ (bio_data_dir(io->base_bio) == WRITE && test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags))) {
+- if (in_irq()) {
+- /* Crypto API's "skcipher_walk_first() refuses to work in hard IRQ context */
++ /*
++ * in_irq(): Crypto API's skcipher_walk_first() refuses to work in hard IRQ context.
++ * irqs_disabled(): the kernel may run some IO completion from the idle thread, but
++ * it is being executed with irqs disabled.
++ */
++ if (in_irq() || irqs_disabled()) {
+ tasklet_init(&io->tasklet, kcryptd_crypt_tasklet, (unsigned long)&io->work);
+ tasklet_schedule(&io->tasklet);
+ return;
--- /dev/null
+From 8e14f610159d524cd7aac37982826d3ef75c09e8 Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Sat, 9 Jan 2021 15:17:06 +0000
+Subject: dm crypt: do not call bio_endio() from the dm-crypt tasklet
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit 8e14f610159d524cd7aac37982826d3ef75c09e8 upstream.
+
+Sometimes, when dm-crypt executes decryption in a tasklet, we may get
+"BUG: KASAN: use-after-free in tasklet_action_common.constprop..."
+with a kasan-enabled kernel.
+
+When the decryption fully completes in the tasklet, dm-crypt will call
+bio_endio(), which in turn will call clone_endio() from dm.c core code. That
+function frees the resources associated with the bio, including per bio private
+structures. For dm-crypt it will free the current struct dm_crypt_io, which
+contains our tasklet object, causing use-after-free, when the tasklet is being
+dequeued by the kernel.
+
+To avoid this, do not call bio_endio() from the current tasklet context, but
+delay its execution to the dm-crypt IO workqueue.
+
+Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues")
+Cc: <stable@vger.kernel.org> # v5.9+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1730,6 +1730,12 @@ static void crypt_inc_pending(struct dm_
+ atomic_inc(&io->io_pending);
+ }
+
++static void kcryptd_io_bio_endio(struct work_struct *work)
++{
++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
++ bio_endio(io->base_bio);
++}
++
+ /*
+ * One of the bios was finished. Check for completion of
+ * the whole request and correctly clean up the buffer.
+@@ -1752,7 +1758,23 @@ static void crypt_dec_pending(struct dm_
+ kfree(io->integrity_metadata);
+
+ base_bio->bi_status = error;
+- bio_endio(base_bio);
++
++ /*
++ * If we are running this function from our tasklet,
++ * we can't call bio_endio() here, because it will call
++ * clone_endio() from dm.c, which in turn will
++ * free the current struct dm_crypt_io structure with
++ * our tasklet. In this case we need to delay bio_endio()
++ * execution to after the tasklet is done and dequeued.
++ */
++ if (tasklet_trylock(&io->tasklet)) {
++ tasklet_unlock(&io->tasklet);
++ bio_endio(base_bio);
++ return;
++ }
++
++ INIT_WORK(&io->work, kcryptd_io_bio_endio);
++ queue_work(cc->io_queue, &io->work);
+ }
+
+ /*
--- /dev/null
+From 8abec36d1274bbd5ae8f36f3658b9abb3db56c31 Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Mon, 4 Jan 2021 14:59:47 +0000
+Subject: dm crypt: do not wait for backlogged crypto request completion in softirq
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit 8abec36d1274bbd5ae8f36f3658b9abb3db56c31 upstream.
+
+Commit 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd
+workqueues") made it possible for some code paths in dm-crypt to be
+executed in softirq context, when the underlying driver processes IO
+requests in interrupt/softirq context.
+
+When Crypto API backlogs a crypto request, dm-crypt uses
+wait_for_completion to avoid sending further requests to an already
+overloaded crypto driver. However, if the code is executing in softirq
+context, we might get the following stacktrace:
+
+[ 210.235213][ C0] BUG: scheduling while atomic: fio/2602/0x00000102
+[ 210.236701][ C0] Modules linked in:
+[ 210.237566][ C0] CPU: 0 PID: 2602 Comm: fio Tainted: G W 5.10.0+ #50
+[ 210.239292][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
+[ 210.241233][ C0] Call Trace:
+[ 210.241946][ C0] <IRQ>
+[ 210.242561][ C0] dump_stack+0x7d/0xa3
+[ 210.243466][ C0] __schedule_bug.cold+0xb3/0xc2
+[ 210.244539][ C0] __schedule+0x156f/0x20d0
+[ 210.245518][ C0] ? io_schedule_timeout+0x140/0x140
+[ 210.246660][ C0] schedule+0xd0/0x270
+[ 210.247541][ C0] schedule_timeout+0x1fb/0x280
+[ 210.248586][ C0] ? usleep_range+0x150/0x150
+[ 210.249624][ C0] ? unpoison_range+0x3a/0x60
+[ 210.250632][ C0] ? ____kasan_kmalloc.constprop.0+0x82/0xa0
+[ 210.251949][ C0] ? unpoison_range+0x3a/0x60
+[ 210.252958][ C0] ? __prepare_to_swait+0xa7/0x190
+[ 210.254067][ C0] do_wait_for_common+0x2ab/0x370
+[ 210.255158][ C0] ? usleep_range+0x150/0x150
+[ 210.256192][ C0] ? bit_wait_io_timeout+0x160/0x160
+[ 210.257358][ C0] ? blk_update_request+0x757/0x1150
+[ 210.258582][ C0] ? _raw_spin_lock_irq+0x82/0xd0
+[ 210.259674][ C0] ? _raw_read_unlock_irqrestore+0x30/0x30
+[ 210.260917][ C0] wait_for_completion+0x4c/0x90
+[ 210.261971][ C0] crypt_convert+0x19a6/0x4c00
+[ 210.263033][ C0] ? _raw_spin_lock_irqsave+0x87/0xe0
+[ 210.264193][ C0] ? kasan_set_track+0x1c/0x30
+[ 210.265191][ C0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0
+[ 210.266283][ C0] ? kmem_cache_free+0x104/0x470
+[ 210.267363][ C0] ? crypt_endio+0x91/0x180
+[ 210.268327][ C0] kcryptd_crypt_read_convert+0x30e/0x420
+[ 210.269565][ C0] blk_update_request+0x757/0x1150
+[ 210.270563][ C0] blk_mq_end_request+0x4b/0x480
+[ 210.271680][ C0] blk_done_softirq+0x21d/0x340
+[ 210.272775][ C0] ? _raw_spin_lock+0x81/0xd0
+[ 210.273847][ C0] ? blk_mq_stop_hw_queue+0x30/0x30
+[ 210.275031][ C0] ? _raw_read_lock_irq+0x40/0x40
+[ 210.276182][ C0] __do_softirq+0x190/0x611
+[ 210.277203][ C0] ? handle_edge_irq+0x221/0xb60
+[ 210.278340][ C0] asm_call_irq_on_stack+0x12/0x20
+[ 210.279514][ C0] </IRQ>
+[ 210.280164][ C0] do_softirq_own_stack+0x37/0x40
+[ 210.281281][ C0] irq_exit_rcu+0x110/0x1b0
+[ 210.282286][ C0] common_interrupt+0x74/0x120
+[ 210.283376][ C0] asm_common_interrupt+0x1e/0x40
+[ 210.284496][ C0] RIP: 0010:_aesni_enc1+0x65/0xb0
+
+Fix this by making crypt_convert function reentrant from the point of
+a single bio and make dm-crypt defer further bio processing to a
+workqueue, if Crypto API backlogs a request in interrupt context.
+
+Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues")
+Cc: stable@vger.kernel.org # v5.9+
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Acked-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 103 +++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 98 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1539,13 +1539,19 @@ static void crypt_free_req(struct crypt_
+ * Encrypt / decrypt data from one bio to another one (can be the same one)
+ */
+ static blk_status_t crypt_convert(struct crypt_config *cc,
+- struct convert_context *ctx, bool atomic)
++ struct convert_context *ctx, bool atomic, bool reset_pending)
+ {
+ unsigned int tag_offset = 0;
+ unsigned int sector_step = cc->sector_size >> SECTOR_SHIFT;
+ int r;
+
+- atomic_set(&ctx->cc_pending, 1);
++ /*
++ * if reset_pending is set we are dealing with the bio for the first time,
++ * else we're continuing to work on the previous bio, so don't mess with
++ * the cc_pending counter
++ */
++ if (reset_pending)
++ atomic_set(&ctx->cc_pending, 1);
+
+ while (ctx->iter_in.bi_size && ctx->iter_out.bi_size) {
+
+@@ -1568,7 +1574,25 @@ static blk_status_t crypt_convert(struct
+ * but the driver request queue is full, let's wait.
+ */
+ case -EBUSY:
+- wait_for_completion(&ctx->restart);
++ if (in_interrupt()) {
++ if (try_wait_for_completion(&ctx->restart)) {
++ /*
++ * we don't have to block to wait for completion,
++ * so proceed
++ */
++ } else {
++ /*
++ * we can't wait for completion without blocking
++ * exit and continue processing in a workqueue
++ */
++ ctx->r.req = NULL;
++ ctx->cc_sector += sector_step;
++ tag_offset++;
++ return BLK_STS_DEV_RESOURCE;
++ }
++ } else {
++ wait_for_completion(&ctx->restart);
++ }
+ reinit_completion(&ctx->restart);
+ fallthrough;
+ /*
+@@ -1960,6 +1984,37 @@ static bool kcryptd_crypt_write_inline(s
+ }
+ }
+
++static void kcryptd_crypt_write_continue(struct work_struct *work)
++{
++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
++ struct crypt_config *cc = io->cc;
++ struct convert_context *ctx = &io->ctx;
++ int crypt_finished;
++ sector_t sector = io->sector;
++ blk_status_t r;
++
++ wait_for_completion(&ctx->restart);
++ reinit_completion(&ctx->restart);
++
++ r = crypt_convert(cc, &io->ctx, true, false);
++ if (r)
++ io->error = r;
++ crypt_finished = atomic_dec_and_test(&ctx->cc_pending);
++ if (!crypt_finished && kcryptd_crypt_write_inline(cc, ctx)) {
++ /* Wait for completion signaled by kcryptd_async_done() */
++ wait_for_completion(&ctx->restart);
++ crypt_finished = 1;
++ }
++
++ /* Encryption was already finished, submit io now */
++ if (crypt_finished) {
++ kcryptd_crypt_write_io_submit(io, 0);
++ io->sector = sector;
++ }
++
++ crypt_dec_pending(io);
++}
++
+ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io)
+ {
+ struct crypt_config *cc = io->cc;
+@@ -1988,7 +2043,17 @@ static void kcryptd_crypt_write_convert(
+
+ crypt_inc_pending(io);
+ r = crypt_convert(cc, ctx,
+- test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags));
++ test_bit(DM_CRYPT_NO_WRITE_WORKQUEUE, &cc->flags), true);
++ /*
++ * Crypto API backlogged the request, because its queue was full
++ * and we're in softirq context, so continue from a workqueue
++ * (TODO: is it actually possible to be in softirq in the write path?)
++ */
++ if (r == BLK_STS_DEV_RESOURCE) {
++ INIT_WORK(&io->work, kcryptd_crypt_write_continue);
++ queue_work(cc->crypt_queue, &io->work);
++ return;
++ }
+ if (r)
+ io->error = r;
+ crypt_finished = atomic_dec_and_test(&ctx->cc_pending);
+@@ -2013,6 +2078,25 @@ static void kcryptd_crypt_read_done(stru
+ crypt_dec_pending(io);
+ }
+
++static void kcryptd_crypt_read_continue(struct work_struct *work)
++{
++ struct dm_crypt_io *io = container_of(work, struct dm_crypt_io, work);
++ struct crypt_config *cc = io->cc;
++ blk_status_t r;
++
++ wait_for_completion(&io->ctx.restart);
++ reinit_completion(&io->ctx.restart);
++
++ r = crypt_convert(cc, &io->ctx, true, false);
++ if (r)
++ io->error = r;
++
++ if (atomic_dec_and_test(&io->ctx.cc_pending))
++ kcryptd_crypt_read_done(io);
++
++ crypt_dec_pending(io);
++}
++
+ static void kcryptd_crypt_read_convert(struct dm_crypt_io *io)
+ {
+ struct crypt_config *cc = io->cc;
+@@ -2024,7 +2108,16 @@ static void kcryptd_crypt_read_convert(s
+ io->sector);
+
+ r = crypt_convert(cc, &io->ctx,
+- test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags));
++ test_bit(DM_CRYPT_NO_READ_WORKQUEUE, &cc->flags), true);
++ /*
++ * Crypto API backlogged the request, because its queue was full
++ * and we're in softirq context, so continue from a workqueue
++ */
++ if (r == BLK_STS_DEV_RESOURCE) {
++ INIT_WORK(&io->work, kcryptd_crypt_read_continue);
++ queue_work(cc->crypt_queue, &io->work);
++ return;
++ }
+ if (r)
+ io->error = r;
+
--- /dev/null
+From d68b29584c25dbacd01ed44a3e45abb35353f1de Mon Sep 17 00:00:00 2001
+From: Ignat Korchagin <ignat@cloudflare.com>
+Date: Mon, 4 Jan 2021 14:59:48 +0000
+Subject: dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq
+
+From: Ignat Korchagin <ignat@cloudflare.com>
+
+commit d68b29584c25dbacd01ed44a3e45abb35353f1de upstream.
+
+Commit 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd
+workqueues") made it possible for some code paths in dm-crypt to be
+executed in softirq context, when the underlying driver processes IO
+requests in interrupt/softirq context.
+
+In this case sometimes when allocating a new crypto request we may get
+a stacktrace like below:
+
+[ 210.103008][ C0] BUG: sleeping function called from invalid context at mm/mempool.c:381
+[ 210.104746][ C0] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 2602, name: fio
+[ 210.106599][ C0] CPU: 0 PID: 2602 Comm: fio Tainted: G W 5.10.0+ #50
+[ 210.108331][ C0] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
+[ 210.110212][ C0] Call Trace:
+[ 210.110921][ C0] <IRQ>
+[ 210.111527][ C0] dump_stack+0x7d/0xa3
+[ 210.112411][ C0] ___might_sleep.cold+0x122/0x151
+[ 210.113527][ C0] mempool_alloc+0x16b/0x2f0
+[ 210.114524][ C0] ? __queue_work+0x515/0xde0
+[ 210.115553][ C0] ? mempool_resize+0x700/0x700
+[ 210.116586][ C0] ? crypt_endio+0x91/0x180
+[ 210.117479][ C0] ? blk_update_request+0x757/0x1150
+[ 210.118513][ C0] ? blk_mq_end_request+0x4b/0x480
+[ 210.119572][ C0] ? blk_done_softirq+0x21d/0x340
+[ 210.120628][ C0] ? __do_softirq+0x190/0x611
+[ 210.121626][ C0] crypt_convert+0x29f9/0x4c00
+[ 210.122668][ C0] ? _raw_spin_lock_irqsave+0x87/0xe0
+[ 210.123824][ C0] ? kasan_set_track+0x1c/0x30
+[ 210.124858][ C0] ? crypt_iv_tcw_ctr+0x4a0/0x4a0
+[ 210.125930][ C0] ? kmem_cache_free+0x104/0x470
+[ 210.126973][ C0] ? crypt_endio+0x91/0x180
+[ 210.127947][ C0] kcryptd_crypt_read_convert+0x30e/0x420
+[ 210.129165][ C0] blk_update_request+0x757/0x1150
+[ 210.130231][ C0] blk_mq_end_request+0x4b/0x480
+[ 210.131294][ C0] blk_done_softirq+0x21d/0x340
+[ 210.132332][ C0] ? _raw_spin_lock+0x81/0xd0
+[ 210.133289][ C0] ? blk_mq_stop_hw_queue+0x30/0x30
+[ 210.134399][ C0] ? _raw_read_lock_irq+0x40/0x40
+[ 210.135458][ C0] __do_softirq+0x190/0x611
+[ 210.136409][ C0] ? handle_edge_irq+0x221/0xb60
+[ 210.137447][ C0] asm_call_irq_on_stack+0x12/0x20
+[ 210.138507][ C0] </IRQ>
+[ 210.139118][ C0] do_softirq_own_stack+0x37/0x40
+[ 210.140191][ C0] irq_exit_rcu+0x110/0x1b0
+[ 210.141151][ C0] common_interrupt+0x74/0x120
+[ 210.142171][ C0] asm_common_interrupt+0x1e/0x40
+
+Fix this by allocating crypto requests with GFP_ATOMIC mask in
+interrupt context.
+
+Fixes: 39d42fa96ba1 ("dm crypt: add flags to optionally bypass kcryptd workqueues")
+Cc: stable@vger.kernel.org # v5.9+
+Reported-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
+Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
+Acked-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 35 +++++++++++++++++++++++++----------
+ 1 file changed, 25 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1454,13 +1454,16 @@ static int crypt_convert_block_skcipher(
+ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ int error);
+
+-static void crypt_alloc_req_skcipher(struct crypt_config *cc,
++static int crypt_alloc_req_skcipher(struct crypt_config *cc,
+ struct convert_context *ctx)
+ {
+ unsigned key_index = ctx->cc_sector & (cc->tfms_count - 1);
+
+- if (!ctx->r.req)
+- ctx->r.req = mempool_alloc(&cc->req_pool, GFP_NOIO);
++ if (!ctx->r.req) {
++ ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
++ if (!ctx->r.req)
++ return -ENOMEM;
++ }
+
+ skcipher_request_set_tfm(ctx->r.req, cc->cipher_tfm.tfms[key_index]);
+
+@@ -1471,13 +1474,18 @@ static void crypt_alloc_req_skcipher(str
+ skcipher_request_set_callback(ctx->r.req,
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+ kcryptd_async_done, dmreq_of_req(cc, ctx->r.req));
++
++ return 0;
+ }
+
+-static void crypt_alloc_req_aead(struct crypt_config *cc,
++static int crypt_alloc_req_aead(struct crypt_config *cc,
+ struct convert_context *ctx)
+ {
+- if (!ctx->r.req_aead)
+- ctx->r.req_aead = mempool_alloc(&cc->req_pool, GFP_NOIO);
++ if (!ctx->r.req) {
++ ctx->r.req = mempool_alloc(&cc->req_pool, in_interrupt() ? GFP_ATOMIC : GFP_NOIO);
++ if (!ctx->r.req)
++ return -ENOMEM;
++ }
+
+ aead_request_set_tfm(ctx->r.req_aead, cc->cipher_tfm.tfms_aead[0]);
+
+@@ -1488,15 +1496,17 @@ static void crypt_alloc_req_aead(struct
+ aead_request_set_callback(ctx->r.req_aead,
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+ kcryptd_async_done, dmreq_of_req(cc, ctx->r.req_aead));
++
++ return 0;
+ }
+
+-static void crypt_alloc_req(struct crypt_config *cc,
++static int crypt_alloc_req(struct crypt_config *cc,
+ struct convert_context *ctx)
+ {
+ if (crypt_integrity_aead(cc))
+- crypt_alloc_req_aead(cc, ctx);
++ return crypt_alloc_req_aead(cc, ctx);
+ else
+- crypt_alloc_req_skcipher(cc, ctx);
++ return crypt_alloc_req_skcipher(cc, ctx);
+ }
+
+ static void crypt_free_req_skcipher(struct crypt_config *cc,
+@@ -1539,7 +1549,12 @@ static blk_status_t crypt_convert(struct
+
+ while (ctx->iter_in.bi_size && ctx->iter_out.bi_size) {
+
+- crypt_alloc_req(cc, ctx);
++ r = crypt_alloc_req(cc, ctx);
++ if (r) {
++ complete(&ctx->restart);
++ return BLK_STS_DEV_RESOURCE;
++ }
++
+ atomic_inc(&ctx->cc_pending);
+
+ if (crypt_integrity_aead(cc))
--- /dev/null
+From 9b5948267adc9e689da609eb61cf7ed49cae5fa8 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 8 Jan 2021 11:15:56 -0500
+Subject: dm integrity: fix flush with external metadata device
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 9b5948267adc9e689da609eb61cf7ed49cae5fa8 upstream.
+
+With external metadata device, flush requests are not passed down to the
+data device.
+
+Fix this by submitting the flush request in dm_integrity_flush_buffers. In
+order to not degrade performance, we overlap the data device flush with
+the metadata device flush.
+
+Reported-by: Lukas Straub <lukasstraub2@web.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-bufio.c | 6 ++++
+ drivers/md/dm-integrity.c | 60 +++++++++++++++++++++++++++++++++++++---------
+ include/linux/dm-bufio.h | 1
+ 3 files changed, 56 insertions(+), 11 deletions(-)
+
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -1534,6 +1534,12 @@ sector_t dm_bufio_get_device_size(struct
+ }
+ EXPORT_SYMBOL_GPL(dm_bufio_get_device_size);
+
++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c)
++{
++ return c->dm_io;
++}
++EXPORT_SYMBOL_GPL(dm_bufio_get_dm_io_client);
++
+ sector_t dm_bufio_get_block_number(struct dm_buffer *b)
+ {
+ return b->block;
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -1379,12 +1379,52 @@ thorough_test:
+ #undef MAY_BE_HASH
+ }
+
+-static void dm_integrity_flush_buffers(struct dm_integrity_c *ic)
++struct flush_request {
++ struct dm_io_request io_req;
++ struct dm_io_region io_reg;
++ struct dm_integrity_c *ic;
++ struct completion comp;
++};
++
++static void flush_notify(unsigned long error, void *fr_)
++{
++ struct flush_request *fr = fr_;
++ if (unlikely(error != 0))
++ dm_integrity_io_error(fr->ic, "flusing disk cache", -EIO);
++ complete(&fr->comp);
++}
++
++static void dm_integrity_flush_buffers(struct dm_integrity_c *ic, bool flush_data)
+ {
+ int r;
++
++ struct flush_request fr;
++
++ if (!ic->meta_dev)
++ flush_data = false;
++ if (flush_data) {
++ fr.io_req.bi_op = REQ_OP_WRITE,
++ fr.io_req.bi_op_flags = REQ_PREFLUSH | REQ_SYNC,
++ fr.io_req.mem.type = DM_IO_KMEM,
++ fr.io_req.mem.ptr.addr = NULL,
++ fr.io_req.notify.fn = flush_notify,
++ fr.io_req.notify.context = &fr;
++ fr.io_req.client = dm_bufio_get_dm_io_client(ic->bufio),
++ fr.io_reg.bdev = ic->dev->bdev,
++ fr.io_reg.sector = 0,
++ fr.io_reg.count = 0,
++ fr.ic = ic;
++ init_completion(&fr.comp);
++ r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL);
++ BUG_ON(r);
++ }
++
+ r = dm_bufio_write_dirty_buffers(ic->bufio);
+ if (unlikely(r))
+ dm_integrity_io_error(ic, "writing tags", r);
++
++ if (flush_data)
++ wait_for_completion(&fr.comp);
+ }
+
+ static void sleep_on_endio_wait(struct dm_integrity_c *ic)
+@@ -2110,7 +2150,7 @@ offload_to_thread:
+
+ if (unlikely(dio->op == REQ_OP_DISCARD) && likely(ic->mode != 'D')) {
+ integrity_metadata(&dio->work);
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, false);
+
+ dio->in_flight = (atomic_t)ATOMIC_INIT(1);
+ dio->completion = NULL;
+@@ -2195,7 +2235,7 @@ static void integrity_commit(struct work
+ flushes = bio_list_get(&ic->flush_bio_list);
+ if (unlikely(ic->mode != 'J')) {
+ spin_unlock_irq(&ic->endio_wait.lock);
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ goto release_flush_bios;
+ }
+
+@@ -2409,7 +2449,7 @@ skip_io:
+ complete_journal_op(&comp);
+ wait_for_completion_io(&comp.comp);
+
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ }
+
+ static void integrity_writer(struct work_struct *w)
+@@ -2451,7 +2491,7 @@ static void recalc_write_super(struct dm
+ {
+ int r;
+
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, false);
+ if (dm_integrity_failed(ic))
+ return;
+
+@@ -2654,7 +2694,7 @@ static void bitmap_flush_work(struct wor
+ unsigned long limit;
+ struct bio *bio;
+
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, false);
+
+ range.logical_sector = 0;
+ range.n_sectors = ic->provided_data_sectors;
+@@ -2663,9 +2703,7 @@ static void bitmap_flush_work(struct wor
+ add_new_range_and_wait(ic, &range);
+ spin_unlock_irq(&ic->endio_wait.lock);
+
+- dm_integrity_flush_buffers(ic);
+- if (ic->meta_dev)
+- blkdev_issue_flush(ic->dev->bdev, GFP_NOIO);
++ dm_integrity_flush_buffers(ic, true);
+
+ limit = ic->provided_data_sectors;
+ if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
+@@ -2934,11 +2972,11 @@ static void dm_integrity_postsuspend(str
+ if (ic->meta_dev)
+ queue_work(ic->writer_wq, &ic->writer_work);
+ drain_workqueue(ic->writer_wq);
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ }
+
+ if (ic->mode == 'B') {
+- dm_integrity_flush_buffers(ic);
++ dm_integrity_flush_buffers(ic, true);
+ #if 1
+ /* set to 0 to test bitmap replay code */
+ init_journal(ic, 0, ic->journal_sections, 0);
+--- a/include/linux/dm-bufio.h
++++ b/include/linux/dm-bufio.h
+@@ -150,6 +150,7 @@ void dm_bufio_set_minimum_buffers(struct
+
+ unsigned dm_bufio_get_block_size(struct dm_bufio_client *c);
+ sector_t dm_bufio_get_device_size(struct dm_bufio_client *c);
++struct dm_io_client *dm_bufio_get_dm_io_client(struct dm_bufio_client *c);
+ sector_t dm_bufio_get_block_number(struct dm_buffer *b);
+ void *dm_bufio_get_block_data(struct dm_buffer *b);
+ void *dm_bufio_get_aux_data(struct dm_buffer *b);
--- /dev/null
+From 17ffc193cdc6dc7a613d00d8ad47fc1f801b9bf0 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 12 Jan 2021 14:54:47 -0500
+Subject: dm integrity: fix the maximum number of arguments
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 17ffc193cdc6dc7a613d00d8ad47fc1f801b9bf0 upstream.
+
+Advance the maximum number of arguments from 9 to 15 to account for
+all potential feature flags that may be supplied.
+
+Linux 4.19 added "meta_device"
+(356d9d52e1221ba0c9f10b8b38652f78a5298329) and "recalculate"
+(a3fcf7253139609bf9ff901fbf955fba047e75dd) flags.
+
+Commit 468dfca38b1a6fbdccd195d875599cb7c8875cd9 added
+"sectors_per_bit" and "bitmap_flush_interval".
+
+Commit 84597a44a9d86ac949900441cea7da0af0f2f473 added
+"allow_discards".
+
+And the commit d537858ac8aaf4311b51240893add2fc62003b97 added
+"fix_padding".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-integrity.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -3792,7 +3792,7 @@ static int dm_integrity_ctr(struct dm_ta
+ unsigned extra_args;
+ struct dm_arg_set as;
+ static const struct dm_arg _args[] = {
+- {0, 9, "Invalid number of feature args"},
++ {0, 15, "Invalid number of feature args"},
+ };
+ unsigned journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
+ bool should_write_sb;
--- /dev/null
+From cc07d72bf350b77faeffee1c37bc52197171473f Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Thu, 24 Sep 2020 13:14:52 -0400
+Subject: dm raid: fix discard limits for raid1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit cc07d72bf350b77faeffee1c37bc52197171473f upstream.
+
+Block core warned that discard_granularity was 0 for dm-raid with
+personality of raid1. Reason is that raid_io_hints() was incorrectly
+special-casing raid1 rather than raid0.
+
+Fix raid_io_hints() by removing discard limits settings for
+raid1. Check for raid0 instead.
+
+Fixes: 61697a6abd24a ("dm: eliminate 'split_discard_bios' flag from DM target interface")
+Cc: stable@vger.kernel.org
+Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Reported-by: Stephan Bärwolf <stephan@matrixstorm.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-raid.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3730,10 +3730,10 @@ static void raid_io_hints(struct dm_targ
+ blk_limits_io_opt(limits, chunk_size_bytes * mddev_data_stripes(rs));
+
+ /*
+- * RAID1 and RAID10 personalities require bio splitting,
+- * RAID0/4/5/6 don't and process large discard bios properly.
++ * RAID0 and RAID10 personalities require bio splitting,
++ * RAID1/4/5/6 don't and process large discard bios properly.
+ */
+- if (rs_is_raid1(rs) || rs_is_raid10(rs)) {
++ if (rs_is_raid0(rs) || rs_is_raid10(rs)) {
+ limits->discard_granularity = chunk_size_bytes;
+ limits->max_discard_sectors = rs->md.chunk_sectors;
+ }
--- /dev/null
+From fcc42338375a1e67b8568dbb558f8b784d0f3b01 Mon Sep 17 00:00:00 2001
+From: Akilesh Kailash <akailash@google.com>
+Date: Mon, 28 Dec 2020 07:14:07 +0000
+Subject: dm snapshot: flush merged data before committing metadata
+
+From: Akilesh Kailash <akailash@google.com>
+
+commit fcc42338375a1e67b8568dbb558f8b784d0f3b01 upstream.
+
+If the origin device has a volatile write-back cache and the following
+events occur:
+
+1: After finishing merge operation of one set of exceptions,
+ merge_callback() is invoked.
+2: Update the metadata in COW device tracking the merge completion.
+ This update to COW device is flushed cleanly.
+3: System crashes and the origin device's cache where the recent
+ merge was completed has not been flushed.
+
+During the next cycle when we read the metadata from the COW device,
+we will skip reading those metadata whose merge was completed in
+step (1). This will lead to data loss/corruption.
+
+To address this, flush the origin device post merge IO before
+updating the metadata.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Akilesh Kailash <akailash@google.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-snap.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -141,6 +141,11 @@ struct dm_snapshot {
+ * for them to be committed.
+ */
+ struct bio_list bios_queued_during_merge;
++
++ /*
++ * Flush data after merge.
++ */
++ struct bio flush_bio;
+ };
+
+ /*
+@@ -1121,6 +1126,17 @@ shut:
+
+ static void error_bios(struct bio *bio);
+
++static int flush_data(struct dm_snapshot *s)
++{
++ struct bio *flush_bio = &s->flush_bio;
++
++ bio_reset(flush_bio);
++ bio_set_dev(flush_bio, s->origin->bdev);
++ flush_bio->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
++
++ return submit_bio_wait(flush_bio);
++}
++
+ static void merge_callback(int read_err, unsigned long write_err, void *context)
+ {
+ struct dm_snapshot *s = context;
+@@ -1134,6 +1150,11 @@ static void merge_callback(int read_err,
+ goto shut;
+ }
+
++ if (flush_data(s) < 0) {
++ DMERR("Flush after merge failed: shutting down merge");
++ goto shut;
++ }
++
+ if (s->store->type->commit_merge(s->store,
+ s->num_merging_chunks) < 0) {
+ DMERR("Write error in exception store: shutting down merge");
+@@ -1318,6 +1339,7 @@ static int snapshot_ctr(struct dm_target
+ s->first_merging_chunk = 0;
+ s->num_merging_chunks = 0;
+ bio_list_init(&s->bios_queued_during_merge);
++ bio_init(&s->flush_bio, NULL, 0);
+
+ /* Allocate hash table for COW data */
+ if (init_hash_tables(s)) {
+@@ -1504,6 +1526,8 @@ static void snapshot_dtr(struct dm_targe
+
+ dm_exception_store_destroy(s->store);
+
++ bio_uninit(&s->flush_bio);
++
+ dm_put_device(ti, s->cow);
+
+ dm_put_device(ti, s->origin);
--- /dev/null
+From 21702c8cae51535e09b91341a069503c6ef3d2a3 Mon Sep 17 00:00:00 2001
+From: Prike Liang <Prike.Liang@amd.com>
+Date: Fri, 2 Oct 2020 10:58:55 -0400
+Subject: drm/amdgpu: add green_sardine device id (v2)
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+commit 21702c8cae51535e09b91341a069503c6ef3d2a3 upstream.
+
+Add green_sardine PCI id support and map it to renoir asic type.
+
+v2: add apu flag
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.10.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1076,6 +1076,7 @@ static const struct pci_device_id pciidl
+
+ /* Renoir */
+ {0x1002, 0x1636, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU},
++ {0x1002, 0x1638, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU},
+
+ /* Navi12 */
+ {0x1002, 0x7360, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI12},
--- /dev/null
+From 53f1e7f6a1720f8299b5283857eedc8f07d29533 Mon Sep 17 00:00:00 2001
+From: mengwang <mengbing.wang@amd.com>
+Date: Wed, 12 Aug 2020 11:49:29 +0800
+Subject: drm/amdgpu: add new device id for Renior
+
+From: mengwang <mengbing.wang@amd.com>
+
+commit 53f1e7f6a1720f8299b5283857eedc8f07d29533 upstream.
+
+add DID 0x164C into pciidlist under CHIP_RENOIR family.
+
+Signed-off-by: mengwang <mengbing.wang@amd.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.10.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1077,6 +1077,7 @@ static const struct pci_device_id pciidl
+ /* Renoir */
+ {0x1002, 0x1636, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU},
+ {0x1002, 0x1638, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU},
++ {0x1002, 0x164C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RENOIR|AMD_IS_APU},
+
+ /* Navi12 */
+ {0x1002, 0x7360, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_NAVI12},
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -1242,7 +1242,8 @@ static int soc15_common_early_init(void
+ break;
+ case CHIP_RENOIR:
+ adev->asic_funcs = &soc15_asic_funcs;
+- if (adev->pdev->device == 0x1636)
++ if ((adev->pdev->device == 0x1636) ||
++ (adev->pdev->device == 0x164c))
+ adev->apu_flags |= AMD_APU_IS_RENOIR;
+ else
+ adev->apu_flags |= AMD_APU_IS_GREEN_SARDINE;
--- /dev/null
+From ff9346dbabbb6595c5c20d90d88ae4a2247487a9 Mon Sep 17 00:00:00 2001
+From: Alexandre Demers <alexandre.f.demers@gmail.com>
+Date: Thu, 7 Jan 2021 18:53:03 -0500
+Subject: drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921)
+
+From: Alexandre Demers <alexandre.f.demers@gmail.com>
+
+commit ff9346dbabbb6595c5c20d90d88ae4a2247487a9 upstream.
+
+This fix bug 210921 where DRM_INFO floods log when hitting an unsupported ASIC in
+amdgpu_device_asic_has_dc_support(). This info should be only called once.
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=210921
+Signed-off-by: Alexandre Demers <alexandre.f.demers@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3008,7 +3008,7 @@ bool amdgpu_device_asic_has_dc_support(e
+ #endif
+ default:
+ if (amdgpu_dc > 0)
+- DRM_INFO("Display Core has been requested via kernel parameter "
++ DRM_INFO_ONCE("Display Core has been requested via kernel parameter "
+ "but isn't supported by ASIC, ignoring\n");
+ return false;
+ }
--- /dev/null
+From cc5f7e2fcbe396f2f461cd67c872af771a334bca Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Tue, 20 Oct 2020 17:14:58 -0500
+Subject: drm/bridge: sii902x: Enable I/O and core VCC supplies if present
+
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+
+commit cc5f7e2fcbe396f2f461cd67c872af771a334bca upstream.
+
+On the SII9022, the IOVCC and CVCC12 supplies must reach the correct
+voltage before the reset sequence is initiated. On most boards, this
+assumption is true at boot-up, so initialization succeeds.
+
+However, when we try to initialize the chip with incorrect supply
+voltages, it will not respond to I2C requests. sii902x_probe() fails
+with -ENXIO.
+
+To resolve this, look for the "iovcc" and "cvcc12" regulators, and
+make sure they are enabled before starting the reset sequence. If
+these supplies are not available in devicetree, then they will default
+to dummy-regulator. In that case everything will work like before.
+
+This was observed on a STM32MP157C-DK2 booting in u-boot falcon mode.
+On this board, the supplies would be set by the second stage
+bootloader, which does not run in falcon mode.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+[Fix checkpatch warnings]
+Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-2-mr.nuke.me@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/bridge/sii902x.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -17,6 +17,7 @@
+ #include <linux/i2c.h>
+ #include <linux/module.h>
+ #include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/clk.h>
+
+ #include <drm/drm_atomic_helper.h>
+@@ -168,6 +169,7 @@ struct sii902x {
+ struct drm_connector connector;
+ struct gpio_desc *reset_gpio;
+ struct i2c_mux_core *i2cmux;
++ struct regulator_bulk_data supplies[2];
+ /*
+ * Mutex protects audio and video functions from interfering
+ * each other, by keeping their i2c command sequences atomic.
+@@ -1049,7 +1051,26 @@ static int sii902x_probe(struct i2c_clie
+
+ mutex_init(&sii902x->mutex);
+
++ sii902x->supplies[0].supply = "iovcc";
++ sii902x->supplies[1].supply = "cvcc12";
++ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(sii902x->supplies),
++ sii902x->supplies);
++ if (ret < 0)
++ return ret;
++
++ ret = regulator_bulk_enable(ARRAY_SIZE(sii902x->supplies),
++ sii902x->supplies);
++ if (ret < 0) {
++ dev_err_probe(dev, ret, "Failed to enable supplies");
++ return ret;
++ }
++
+ ret = sii902x_init(sii902x);
++ if (ret < 0) {
++ regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies),
++ sii902x->supplies);
++ }
++
+ return ret;
+ }
+
+@@ -1060,6 +1081,8 @@ static int sii902x_remove(struct i2c_cli
+
+ i2c_mux_del_adapters(sii902x->i2cmux);
+ drm_bridge_remove(&sii902x->bridge);
++ regulator_bulk_disable(ARRAY_SIZE(sii902x->supplies),
++ sii902x->supplies);
+
+ return 0;
+ }
--- /dev/null
+From 91b5e26731c5d409d6134603afc061617639933e Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Tue, 20 Oct 2020 17:14:57 -0500
+Subject: drm/bridge: sii902x: Refactor init code into separate function
+
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+
+commit 91b5e26731c5d409d6134603afc061617639933e upstream.
+
+Separate the hardware initialization code from setting up the data
+structures and parsing the device tree. The purpose of this change is
+to provide a single exit point and avoid a waterfall of 'goto's in
+the subsequent patch.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-1-mr.nuke.me@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/bridge/sii902x.c | 77 +++++++++++++++++++++------------------
+ 1 file changed, 43 insertions(+), 34 deletions(-)
+
+--- a/drivers/gpu/drm/bridge/sii902x.c
++++ b/drivers/gpu/drm/bridge/sii902x.c
+@@ -954,41 +954,13 @@ static const struct drm_bridge_timings d
+ | DRM_BUS_FLAG_DE_HIGH,
+ };
+
+-static int sii902x_probe(struct i2c_client *client,
+- const struct i2c_device_id *id)
++static int sii902x_init(struct sii902x *sii902x)
+ {
+- struct device *dev = &client->dev;
++ struct device *dev = &sii902x->i2c->dev;
+ unsigned int status = 0;
+- struct sii902x *sii902x;
+ u8 chipid[4];
+ int ret;
+
+- ret = i2c_check_functionality(client->adapter,
+- I2C_FUNC_SMBUS_BYTE_DATA);
+- if (!ret) {
+- dev_err(dev, "I2C adapter not suitable\n");
+- return -EIO;
+- }
+-
+- sii902x = devm_kzalloc(dev, sizeof(*sii902x), GFP_KERNEL);
+- if (!sii902x)
+- return -ENOMEM;
+-
+- sii902x->i2c = client;
+- sii902x->regmap = devm_regmap_init_i2c(client, &sii902x_regmap_config);
+- if (IS_ERR(sii902x->regmap))
+- return PTR_ERR(sii902x->regmap);
+-
+- sii902x->reset_gpio = devm_gpiod_get_optional(dev, "reset",
+- GPIOD_OUT_LOW);
+- if (IS_ERR(sii902x->reset_gpio)) {
+- dev_err(dev, "Failed to retrieve/request reset gpio: %ld\n",
+- PTR_ERR(sii902x->reset_gpio));
+- return PTR_ERR(sii902x->reset_gpio);
+- }
+-
+- mutex_init(&sii902x->mutex);
+-
+ sii902x_reset(sii902x);
+
+ ret = regmap_write(sii902x->regmap, SII902X_REG_TPI_RQB, 0x0);
+@@ -1012,11 +984,11 @@ static int sii902x_probe(struct i2c_clie
+ regmap_read(sii902x->regmap, SII902X_INT_STATUS, &status);
+ regmap_write(sii902x->regmap, SII902X_INT_STATUS, status);
+
+- if (client->irq > 0) {
++ if (sii902x->i2c->irq > 0) {
+ regmap_write(sii902x->regmap, SII902X_INT_ENABLE,
+ SII902X_HOTPLUG_EVENT);
+
+- ret = devm_request_threaded_irq(dev, client->irq, NULL,
++ ret = devm_request_threaded_irq(dev, sii902x->i2c->irq, NULL,
+ sii902x_interrupt,
+ IRQF_ONESHOT, dev_name(dev),
+ sii902x);
+@@ -1031,9 +1003,9 @@ static int sii902x_probe(struct i2c_clie
+
+ sii902x_audio_codec_init(sii902x, dev);
+
+- i2c_set_clientdata(client, sii902x);
++ i2c_set_clientdata(sii902x->i2c, sii902x);
+
+- sii902x->i2cmux = i2c_mux_alloc(client->adapter, dev,
++ sii902x->i2cmux = i2c_mux_alloc(sii902x->i2c->adapter, dev,
+ 1, 0, I2C_MUX_GATE,
+ sii902x_i2c_bypass_select,
+ sii902x_i2c_bypass_deselect);
+@@ -1044,6 +1016,43 @@ static int sii902x_probe(struct i2c_clie
+ return i2c_mux_add_adapter(sii902x->i2cmux, 0, 0, 0);
+ }
+
++static int sii902x_probe(struct i2c_client *client,
++ const struct i2c_device_id *id)
++{
++ struct device *dev = &client->dev;
++ struct sii902x *sii902x;
++ int ret;
++
++ ret = i2c_check_functionality(client->adapter,
++ I2C_FUNC_SMBUS_BYTE_DATA);
++ if (!ret) {
++ dev_err(dev, "I2C adapter not suitable\n");
++ return -EIO;
++ }
++
++ sii902x = devm_kzalloc(dev, sizeof(*sii902x), GFP_KERNEL);
++ if (!sii902x)
++ return -ENOMEM;
++
++ sii902x->i2c = client;
++ sii902x->regmap = devm_regmap_init_i2c(client, &sii902x_regmap_config);
++ if (IS_ERR(sii902x->regmap))
++ return PTR_ERR(sii902x->regmap);
++
++ sii902x->reset_gpio = devm_gpiod_get_optional(dev, "reset",
++ GPIOD_OUT_LOW);
++ if (IS_ERR(sii902x->reset_gpio)) {
++ dev_err(dev, "Failed to retrieve/request reset gpio: %ld\n",
++ PTR_ERR(sii902x->reset_gpio));
++ return PTR_ERR(sii902x->reset_gpio);
++ }
++
++ mutex_init(&sii902x->mutex);
++
++ ret = sii902x_init(sii902x);
++ return ret;
++}
++
+ static int sii902x_remove(struct i2c_client *client)
+
+ {
--- /dev/null
+From 984cadea032b103c5824a5f29d0a36b3e9df6333 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 11 Jan 2021 22:52:20 +0000
+Subject: drm/i915: Allow the sysadmin to override security mitigations
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 984cadea032b103c5824a5f29d0a36b3e9df6333 upstream.
+
+The clear-residuals mitigation is a relatively heavy hammer and under some
+circumstances the user may wish to forgo the context isolation in order
+to meet some performance requirement. Introduce a generic module
+parameter to allow selectively enabling/disabling different mitigations.
+
+To disable just the clear-residuals mitigation (on Ivybridge, Baytrail,
+or Haswell) use the module parameter: i915.mitigations=auto,!residuals
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1858
+Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Jon Bloomfield <jon.bloomfield@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: stable@vger.kernel.org # v5.7
+Reviewed-by: Jon Bloomfield <jon.bloomfield@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111225220.3483-3-chris@chris-wilson.co.uk
+(cherry picked from commit f7452c7cbd5b5dfb9a6c84cb20bea04c89be50cd)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/Makefile | 1
+ drivers/gpu/drm/i915/gt/intel_ring_submission.c | 4
+ drivers/gpu/drm/i915/i915_mitigations.c | 146 ++++++++++++++++++++++++
+ drivers/gpu/drm/i915/i915_mitigations.h | 13 ++
+ 4 files changed, 163 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/Makefile
++++ b/drivers/gpu/drm/i915/Makefile
+@@ -38,6 +38,7 @@ i915-y += i915_drv.o \
+ i915_config.o \
+ i915_irq.o \
+ i915_getparam.o \
++ i915_mitigations.o \
+ i915_params.o \
+ i915_pci.o \
+ i915_scatterlist.o \
+--- a/drivers/gpu/drm/i915/gt/intel_ring_submission.c
++++ b/drivers/gpu/drm/i915/gt/intel_ring_submission.c
+@@ -32,6 +32,7 @@
+ #include "gen6_ppgtt.h"
+ #include "gen7_renderclear.h"
+ #include "i915_drv.h"
++#include "i915_mitigations.h"
+ #include "intel_breadcrumbs.h"
+ #include "intel_context.h"
+ #include "intel_gt.h"
+@@ -885,7 +886,8 @@ static int switch_context(struct i915_re
+ GEM_BUG_ON(HAS_EXECLISTS(engine->i915));
+
+ if (engine->wa_ctx.vma && ce != engine->kernel_context) {
+- if (engine->wa_ctx.vma->private != ce) {
++ if (engine->wa_ctx.vma->private != ce &&
++ i915_mitigate_clear_residuals()) {
+ ret = clear_residuals(rq);
+ if (ret)
+ return ret;
+--- /dev/null
++++ b/drivers/gpu/drm/i915/i915_mitigations.c
+@@ -0,0 +1,146 @@
++// SPDX-License-Identifier: MIT
++/*
++ * Copyright © 2021 Intel Corporation
++ */
++
++#include <linux/kernel.h>
++#include <linux/moduleparam.h>
++#include <linux/slab.h>
++#include <linux/string.h>
++
++#include "i915_drv.h"
++#include "i915_mitigations.h"
++
++static unsigned long mitigations __read_mostly = ~0UL;
++
++enum {
++ CLEAR_RESIDUALS = 0,
++};
++
++static const char * const names[] = {
++ [CLEAR_RESIDUALS] = "residuals",
++};
++
++bool i915_mitigate_clear_residuals(void)
++{
++ return READ_ONCE(mitigations) & BIT(CLEAR_RESIDUALS);
++}
++
++static int mitigations_set(const char *val, const struct kernel_param *kp)
++{
++ unsigned long new = ~0UL;
++ char *str, *sep, *tok;
++ bool first = true;
++ int err = 0;
++
++ BUILD_BUG_ON(ARRAY_SIZE(names) >= BITS_PER_TYPE(mitigations));
++
++ str = kstrdup(val, GFP_KERNEL);
++ if (!str)
++ return -ENOMEM;
++
++ for (sep = str; (tok = strsep(&sep, ","));) {
++ bool enable = true;
++ int i;
++
++ /* Be tolerant of leading/trailing whitespace */
++ tok = strim(tok);
++
++ if (first) {
++ first = false;
++
++ if (!strcmp(tok, "auto"))
++ continue;
++
++ new = 0;
++ if (!strcmp(tok, "off"))
++ continue;
++ }
++
++ if (*tok == '!') {
++ enable = !enable;
++ tok++;
++ }
++
++ if (!strncmp(tok, "no", 2)) {
++ enable = !enable;
++ tok += 2;
++ }
++
++ if (*tok == '\0')
++ continue;
++
++ for (i = 0; i < ARRAY_SIZE(names); i++) {
++ if (!strcmp(tok, names[i])) {
++ if (enable)
++ new |= BIT(i);
++ else
++ new &= ~BIT(i);
++ break;
++ }
++ }
++ if (i == ARRAY_SIZE(names)) {
++ pr_err("Bad \"%s.mitigations=%s\", '%s' is unknown\n",
++ DRIVER_NAME, val, tok);
++ err = -EINVAL;
++ break;
++ }
++ }
++ kfree(str);
++ if (err)
++ return err;
++
++ WRITE_ONCE(mitigations, new);
++ return 0;
++}
++
++static int mitigations_get(char *buffer, const struct kernel_param *kp)
++{
++ unsigned long local = READ_ONCE(mitigations);
++ int count, i;
++ bool enable;
++
++ if (!local)
++ return scnprintf(buffer, PAGE_SIZE, "%s\n", "off");
++
++ if (local & BIT(BITS_PER_LONG - 1)) {
++ count = scnprintf(buffer, PAGE_SIZE, "%s,", "auto");
++ enable = false;
++ } else {
++ enable = true;
++ count = 0;
++ }
++
++ for (i = 0; i < ARRAY_SIZE(names); i++) {
++ if ((local & BIT(i)) != enable)
++ continue;
++
++ count += scnprintf(buffer + count, PAGE_SIZE - count,
++ "%s%s,", enable ? "" : "!", names[i]);
++ }
++
++ buffer[count - 1] = '\n';
++ return count;
++}
++
++static const struct kernel_param_ops ops = {
++ .set = mitigations_set,
++ .get = mitigations_get,
++};
++
++module_param_cb_unsafe(mitigations, &ops, NULL, 0600);
++MODULE_PARM_DESC(mitigations,
++"Selectively enable security mitigations for all Intel® GPUs in the system.\n"
++"\n"
++" auto -- enables all mitigations required for the platform [default]\n"
++" off -- disables all mitigations\n"
++"\n"
++"Individual mitigations can be enabled by passing a comma-separated string,\n"
++"e.g. mitigations=residuals to enable only clearing residuals or\n"
++"mitigations=auto,noresiduals to disable only the clear residual mitigation.\n"
++"Either '!' or 'no' may be used to switch from enabling the mitigation to\n"
++"disabling it.\n"
++"\n"
++"Active mitigations for Ivybridge, Baytrail, Haswell:\n"
++" residuals -- clear all thread-local registers between contexts"
++);
+--- /dev/null
++++ b/drivers/gpu/drm/i915/i915_mitigations.h
+@@ -0,0 +1,13 @@
++/* SPDX-License-Identifier: MIT */
++/*
++ * Copyright © 2021 Intel Corporation
++ */
++
++#ifndef __I915_MITIGATIONS_H__
++#define __I915_MITIGATIONS_H__
++
++#include <linux/types.h>
++
++bool i915_mitigate_clear_residuals(void);
++
++#endif /* __I915_MITIGATIONS_H__ */
--- /dev/null
+From bb83d5fb550bb7db75b29e6342417fda2bbb691c Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 8 Jan 2021 17:28:41 +0200
+Subject: drm/i915/backlight: fix CPU mode backlight takeover on LPT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit bb83d5fb550bb7db75b29e6342417fda2bbb691c upstream.
+
+The pch_get_backlight(), lpt_get_backlight(), and lpt_set_backlight()
+functions operate directly on the hardware registers. If inverting the
+value is needed, using intel_panel_compute_brightness(), it should only
+be done in the interface between hardware registers and
+panel->backlight.level.
+
+The CPU mode takeover code added in commit 5b1ec9ac7ab5
+("drm/i915/backlight: Fix backlight takeover on LPT, v3.") reads the
+hardware register and converts to panel->backlight.level correctly,
+however the value written back should remain in the hardware register
+"domain".
+
+This hasn't been an issue, because GM45 machines are the only known
+users of i915.invert_brightness and the brightness invert quirk, and
+without one of them no conversion is made. It's likely nobody's ever hit
+the problem.
+
+Fixes: 5b1ec9ac7ab5 ("drm/i915/backlight: Fix backlight takeover on LPT, v3.")
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: <stable@vger.kernel.org> # v5.1+
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210108152841.6944-1-jani.nikula@intel.com
+(cherry picked from commit 0d4ced1c5bfe649196877d90442d4fd618e19153)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_panel.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_panel.c
++++ b/drivers/gpu/drm/i915/display/intel_panel.c
+@@ -1650,16 +1650,13 @@ static int lpt_setup_backlight(struct in
+ val = pch_get_backlight(connector);
+ else
+ val = lpt_get_backlight(connector);
+- val = intel_panel_compute_brightness(connector, val);
+- panel->backlight.level = clamp(val, panel->backlight.min,
+- panel->backlight.max);
+
+ if (cpu_mode) {
+ drm_dbg_kms(&dev_priv->drm,
+ "CPU backlight register was enabled, switching to PCH override\n");
+
+ /* Write converted CPU PWM value to PCH override register */
+- lpt_set_backlight(connector->base.state, panel->backlight.level);
++ lpt_set_backlight(connector->base.state, val);
+ intel_de_write(dev_priv, BLC_PWM_PCH_CTL1,
+ pch_ctl1 | BLM_PCH_OVERRIDE_ENABLE);
+
+@@ -1667,6 +1664,10 @@ static int lpt_setup_backlight(struct in
+ cpu_ctl2 & ~BLM_PWM_ENABLE);
+ }
+
++ val = intel_panel_compute_brightness(connector, val);
++ panel->backlight.level = clamp(val, panel->backlight.min,
++ panel->backlight.max);
++
+ return 0;
+ }
+
--- /dev/null
+From ffaf97899c4a58b9fefb11534f730785443611a8 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 11 Jan 2021 22:52:18 +0000
+Subject: drm/i915/gt: Limit VFE threads based on GT
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit ffaf97899c4a58b9fefb11534f730785443611a8 upstream.
+
+MEDIA_STATE_VFE only accepts the 'maximum number of threads' in the
+range [0, n-1] where n is #EU * (#threads/EU) with the number of threads
+based on plaform and the number of EU based on the number of slices and
+subslices. This is a fixed number per platform/gt, so appropriately
+limit the number of threads we spawn to match the device.
+
+v2: Oversaturate the system with tasks to force execution on every HW
+thread; if the thread idles it is returned to the pool and may be reused
+again before an unused thread.
+
+v3: Fix more state commands, which was causing Baytrail to barf.
+v4: STATE_CACHE_INVALIDATE requires a stall on Ivybridge
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2024
+Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Prathap Kumar Valsan <prathap.kumar.valsan@intel.com>
+Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Cc: Jon Bloomfield <jon.bloomfield@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Randy Wright <rwright@hpe.com>
+Cc: stable@vger.kernel.org # v5.7+
+Reviewed-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111225220.3483-1-chris@chris-wilson.co.uk
+(cherry picked from commit eebfb32e26851662d24ea86dd381fd0f83cd4b47)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/gen7_renderclear.c | 157 +++++++++++++++++------------
+ 1 file changed, 94 insertions(+), 63 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+@@ -7,8 +7,6 @@
+ #include "i915_drv.h"
+ #include "intel_gpu_commands.h"
+
+-#define MAX_URB_ENTRIES 64
+-#define STATE_SIZE (4 * 1024)
+ #define GT3_INLINE_DATA_DELAYS 0x1E00
+ #define batch_advance(Y, CS) GEM_BUG_ON((Y)->end != (CS))
+
+@@ -34,38 +32,59 @@ struct batch_chunk {
+ };
+
+ struct batch_vals {
+- u32 max_primitives;
+- u32 max_urb_entries;
+- u32 cmd_size;
+- u32 state_size;
++ u32 max_threads;
+ u32 state_start;
+- u32 batch_size;
++ u32 surface_start;
+ u32 surface_height;
+ u32 surface_width;
+- u32 scratch_size;
+- u32 max_size;
++ u32 size;
+ };
+
++static inline int num_primitives(const struct batch_vals *bv)
++{
++ /*
++ * We need to saturate the GPU with work in order to dispatch
++ * a shader on every HW thread, and clear the thread-local registers.
++ * In short, we have to dispatch work faster than the shaders can
++ * run in order to fill the EU and occupy each HW thread.
++ */
++ return bv->max_threads;
++}
++
+ static void
+ batch_get_defaults(struct drm_i915_private *i915, struct batch_vals *bv)
+ {
+ if (IS_HASWELL(i915)) {
+- bv->max_primitives = 280;
+- bv->max_urb_entries = MAX_URB_ENTRIES;
++ switch (INTEL_INFO(i915)->gt) {
++ default:
++ case 1:
++ bv->max_threads = 70;
++ break;
++ case 2:
++ bv->max_threads = 140;
++ break;
++ case 3:
++ bv->max_threads = 280;
++ break;
++ }
+ bv->surface_height = 16 * 16;
+ bv->surface_width = 32 * 2 * 16;
+ } else {
+- bv->max_primitives = 128;
+- bv->max_urb_entries = MAX_URB_ENTRIES / 2;
++ switch (INTEL_INFO(i915)->gt) {
++ default:
++ case 1: /* including vlv */
++ bv->max_threads = 36;
++ break;
++ case 2:
++ bv->max_threads = 128;
++ break;
++ }
+ bv->surface_height = 16 * 8;
+ bv->surface_width = 32 * 16;
+ }
+- bv->cmd_size = bv->max_primitives * 4096;
+- bv->state_size = STATE_SIZE;
+- bv->state_start = bv->cmd_size;
+- bv->batch_size = bv->cmd_size + bv->state_size;
+- bv->scratch_size = bv->surface_height * bv->surface_width;
+- bv->max_size = bv->batch_size + bv->scratch_size;
++ bv->state_start = round_up(SZ_1K + num_primitives(bv) * 64, SZ_4K);
++ bv->surface_start = bv->state_start + SZ_4K;
++ bv->size = bv->surface_start + bv->surface_height * bv->surface_width;
+ }
+
+ static void batch_init(struct batch_chunk *bc,
+@@ -155,7 +174,8 @@ static u32
+ gen7_fill_binding_table(struct batch_chunk *state,
+ const struct batch_vals *bv)
+ {
+- u32 surface_start = gen7_fill_surface_state(state, bv->batch_size, bv);
++ u32 surface_start =
++ gen7_fill_surface_state(state, bv->surface_start, bv);
+ u32 *cs = batch_alloc_items(state, 32, 8);
+ u32 offset = batch_offset(state, cs);
+
+@@ -214,9 +234,9 @@ static void
+ gen7_emit_state_base_address(struct batch_chunk *batch,
+ u32 surface_state_base)
+ {
+- u32 *cs = batch_alloc_items(batch, 0, 12);
++ u32 *cs = batch_alloc_items(batch, 0, 10);
+
+- *cs++ = STATE_BASE_ADDRESS | (12 - 2);
++ *cs++ = STATE_BASE_ADDRESS | (10 - 2);
+ /* general */
+ *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY;
+ /* surface */
+@@ -233,8 +253,6 @@ gen7_emit_state_base_address(struct batc
+ *cs++ = BASE_ADDRESS_MODIFY;
+ *cs++ = 0;
+ *cs++ = BASE_ADDRESS_MODIFY;
+- *cs++ = 0;
+- *cs++ = 0;
+ batch_advance(batch, cs);
+ }
+
+@@ -244,8 +262,7 @@ gen7_emit_vfe_state(struct batch_chunk *
+ u32 urb_size, u32 curbe_size,
+ u32 mode)
+ {
+- u32 urb_entries = bv->max_urb_entries;
+- u32 threads = bv->max_primitives - 1;
++ u32 threads = bv->max_threads - 1;
+ u32 *cs = batch_alloc_items(batch, 32, 8);
+
+ *cs++ = MEDIA_VFE_STATE | (8 - 2);
+@@ -254,7 +271,7 @@ gen7_emit_vfe_state(struct batch_chunk *
+ *cs++ = 0;
+
+ /* number of threads & urb entries for GPGPU vs Media Mode */
+- *cs++ = threads << 16 | urb_entries << 8 | mode << 2;
++ *cs++ = threads << 16 | 1 << 8 | mode << 2;
+
+ *cs++ = 0;
+
+@@ -293,17 +310,12 @@ gen7_emit_media_object(struct batch_chun
+ {
+ unsigned int x_offset = (media_object_index % 16) * 64;
+ unsigned int y_offset = (media_object_index / 16) * 16;
+- unsigned int inline_data_size;
+- unsigned int media_batch_size;
+- unsigned int i;
++ unsigned int pkt = 6 + 3;
+ u32 *cs;
+
+- inline_data_size = 112 * 8;
+- media_batch_size = inline_data_size + 6;
+-
+- cs = batch_alloc_items(batch, 8, media_batch_size);
++ cs = batch_alloc_items(batch, 8, pkt);
+
+- *cs++ = MEDIA_OBJECT | (media_batch_size - 2);
++ *cs++ = MEDIA_OBJECT | (pkt - 2);
+
+ /* interface descriptor offset */
+ *cs++ = 0;
+@@ -317,25 +329,44 @@ gen7_emit_media_object(struct batch_chun
+ *cs++ = 0;
+
+ /* inline */
+- *cs++ = (y_offset << 16) | (x_offset);
++ *cs++ = y_offset << 16 | x_offset;
+ *cs++ = 0;
+ *cs++ = GT3_INLINE_DATA_DELAYS;
+- for (i = 3; i < inline_data_size; i++)
+- *cs++ = 0;
+
+ batch_advance(batch, cs);
+ }
+
+ static void gen7_emit_pipeline_flush(struct batch_chunk *batch)
+ {
+- u32 *cs = batch_alloc_items(batch, 0, 5);
++ u32 *cs = batch_alloc_items(batch, 0, 4);
+
+- *cs++ = GFX_OP_PIPE_CONTROL(5);
+- *cs++ = PIPE_CONTROL_STATE_CACHE_INVALIDATE |
+- PIPE_CONTROL_GLOBAL_GTT_IVB;
++ *cs++ = GFX_OP_PIPE_CONTROL(4);
++ *cs++ = PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH |
++ PIPE_CONTROL_DEPTH_CACHE_FLUSH |
++ PIPE_CONTROL_DC_FLUSH_ENABLE |
++ PIPE_CONTROL_CS_STALL;
+ *cs++ = 0;
+ *cs++ = 0;
++
++ batch_advance(batch, cs);
++}
++
++static void gen7_emit_pipeline_invalidate(struct batch_chunk *batch)
++{
++ u32 *cs = batch_alloc_items(batch, 0, 8);
++
++ /* ivb: Stall before STATE_CACHE_INVALIDATE */
++ *cs++ = GFX_OP_PIPE_CONTROL(4);
++ *cs++ = PIPE_CONTROL_STALL_AT_SCOREBOARD |
++ PIPE_CONTROL_CS_STALL;
++ *cs++ = 0;
++ *cs++ = 0;
++
++ *cs++ = GFX_OP_PIPE_CONTROL(4);
++ *cs++ = PIPE_CONTROL_STATE_CACHE_INVALIDATE;
+ *cs++ = 0;
++ *cs++ = 0;
++
+ batch_advance(batch, cs);
+ }
+
+@@ -344,34 +375,34 @@ static void emit_batch(struct i915_vma *
+ const struct batch_vals *bv)
+ {
+ struct drm_i915_private *i915 = vma->vm->i915;
+- unsigned int desc_count = 64;
+- const u32 urb_size = 112;
++ const unsigned int desc_count = 1;
++ const unsigned int urb_size = 1;
+ struct batch_chunk cmds, state;
+- u32 interface_descriptor;
++ u32 descriptors;
+ unsigned int i;
+
+- batch_init(&cmds, vma, start, 0, bv->cmd_size);
+- batch_init(&state, vma, start, bv->state_start, bv->state_size);
++ batch_init(&cmds, vma, start, 0, bv->state_start);
++ batch_init(&state, vma, start, bv->state_start, SZ_4K);
+
+- interface_descriptor =
+- gen7_fill_interface_descriptor(&state, bv,
+- IS_HASWELL(i915) ?
+- &cb_kernel_hsw :
+- &cb_kernel_ivb,
+- desc_count);
+- gen7_emit_pipeline_flush(&cmds);
++ descriptors = gen7_fill_interface_descriptor(&state, bv,
++ IS_HASWELL(i915) ?
++ &cb_kernel_hsw :
++ &cb_kernel_ivb,
++ desc_count);
++
++ gen7_emit_pipeline_invalidate(&cmds);
+ batch_add(&cmds, PIPELINE_SELECT | PIPELINE_SELECT_MEDIA);
+ batch_add(&cmds, MI_NOOP);
+- gen7_emit_state_base_address(&cmds, interface_descriptor);
++ gen7_emit_pipeline_invalidate(&cmds);
++
+ gen7_emit_pipeline_flush(&cmds);
++ gen7_emit_state_base_address(&cmds, descriptors);
++ gen7_emit_pipeline_invalidate(&cmds);
+
+ gen7_emit_vfe_state(&cmds, bv, urb_size - 1, 0, 0);
++ gen7_emit_interface_descriptor_load(&cmds, descriptors, desc_count);
+
+- gen7_emit_interface_descriptor_load(&cmds,
+- interface_descriptor,
+- desc_count);
+-
+- for (i = 0; i < bv->max_primitives; i++)
++ for (i = 0; i < num_primitives(bv); i++)
+ gen7_emit_media_object(&cmds, i);
+
+ batch_add(&cmds, MI_BATCH_BUFFER_END);
+@@ -385,15 +416,15 @@ int gen7_setup_clear_gpr_bb(struct intel
+
+ batch_get_defaults(engine->i915, &bv);
+ if (!vma)
+- return bv.max_size;
++ return bv.size;
+
+- GEM_BUG_ON(vma->obj->base.size < bv.max_size);
++ GEM_BUG_ON(vma->obj->base.size < bv.size);
+
+ batch = i915_gem_object_pin_map(vma->obj, I915_MAP_WC);
+ if (IS_ERR(batch))
+ return PTR_ERR(batch);
+
+- emit_batch(vma, memset(batch, 0, bv.max_size), &bv);
++ emit_batch(vma, memset(batch, 0, bv.size), &bv);
+
+ i915_gem_object_flush_map(vma->obj);
+ __i915_gem_object_release_map(vma->obj);
--- /dev/null
+From 4c1e054322da99cbfd293a5fddf283f2fdb3e2d0 Mon Sep 17 00:00:00 2001
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Date: Tue, 20 Oct 2020 17:14:59 -0500
+Subject: dt-bindings: display: sii902x: Add supply bindings
+
+From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+
+commit 4c1e054322da99cbfd293a5fddf283f2fdb3e2d0 upstream.
+
+The sii902x chip family requires IO and core voltages to reach the
+correct voltage before chip initialization. Add binding for describing
+the two supplies.
+
+Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201020221501.260025-3-mr.nuke.me@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/display/bridge/sii902x.txt | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/Documentation/devicetree/bindings/display/bridge/sii902x.txt
++++ b/Documentation/devicetree/bindings/display/bridge/sii902x.txt
+@@ -8,6 +8,8 @@ Optional properties:
+ - interrupts: describe the interrupt line used to inform the host
+ about hotplug events.
+ - reset-gpios: OF device-tree gpio specification for RST_N pin.
++ - iovcc-supply: I/O Supply Voltage (1.8V or 3.3V)
++ - cvcc12-supply: Digital Core Supply Voltage (1.2V)
+
+ HDMI audio properties:
+ - #sound-dai-cells: <0> or <1>. <0> if only i2s or spdif pin
+@@ -54,6 +56,8 @@ Example:
+ compatible = "sil,sii9022";
+ reg = <0x39>;
+ reset-gpios = <&pioA 1 0>;
++ iovcc-supply = <&v3v3_hdmi>;
++ cvcc12-supply = <&v1v2_hdmi>;
+
+ #sound-dai-cells = <0>;
+ sil,i2s-data-lanes = < 0 1 2 >;
--- /dev/null
+From 6b4b8e6b4ad8553660421d6360678b3811d5deb9 Mon Sep 17 00:00:00 2001
+From: yangerkun <yangerkun@huawei.com>
+Date: Tue, 5 Jan 2021 14:28:57 +0800
+Subject: ext4: fix bug for rename with RENAME_WHITEOUT
+
+From: yangerkun <yangerkun@huawei.com>
+
+commit 6b4b8e6b4ad8553660421d6360678b3811d5deb9 upstream.
+
+We got a "deleted inode referenced" warning cross our fsstress test. The
+bug can be reproduced easily with following steps:
+
+ cd /dev/shm
+ mkdir test/
+ fallocate -l 128M img
+ mkfs.ext4 -b 1024 img
+ mount img test/
+ dd if=/dev/zero of=test/foo bs=1M count=128
+ mkdir test/dir/ && cd test/dir/
+ for ((i=0;i<1000;i++)); do touch file$i; done # consume all block
+ cd ~ && renameat2(AT_FDCWD, /dev/shm/test/dir/file1, AT_FDCWD,
+ /dev/shm/test/dir/dst_file, RENAME_WHITEOUT) # ext4_add_entry in
+ ext4_rename will return ENOSPC!!
+ cd /dev/shm/ && umount test/ && mount img test/ && ls -li test/dir/file1
+ We will get the output:
+ "ls: cannot access 'test/dir/file1': Structure needs cleaning"
+ and the dmesg show:
+ "EXT4-fs error (device loop0): ext4_lookup:1626: inode #2049: comm ls:
+ deleted inode referenced: 139"
+
+ext4_rename will create a special inode for whiteout and use this 'ino'
+to replace the source file's dir entry 'ino'. Once error happens
+latter(the error above was the ENOSPC return from ext4_add_entry in
+ext4_rename since all space has been consumed), the cleanup do drop the
+nlink for whiteout, but forget to restore 'ino' with source file. This
+will trigger the bug describle as above.
+
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: stable@vger.kernel.org
+Fixes: cd808deced43 ("ext4: support RENAME_WHITEOUT")
+Link: https://lore.kernel.org/r/20210105062857.3566-1-yangerkun@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/namei.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3602,9 +3602,6 @@ static int ext4_setent(handle_t *handle,
+ return retval2;
+ }
+ }
+- brelse(ent->bh);
+- ent->bh = NULL;
+-
+ return retval;
+ }
+
+@@ -3803,6 +3800,7 @@ static int ext4_rename(struct inode *old
+ }
+ }
+
++ old_file_type = old.de->file_type;
+ if (IS_DIRSYNC(old.dir) || IS_DIRSYNC(new.dir))
+ ext4_handle_sync(handle);
+
+@@ -3830,7 +3828,6 @@ static int ext4_rename(struct inode *old
+ force_reread = (new.dir->i_ino == old.dir->i_ino &&
+ ext4_test_inode_flag(new.dir, EXT4_INODE_INLINE_DATA));
+
+- old_file_type = old.de->file_type;
+ if (whiteout) {
+ /*
+ * Do this before adding a new entry, so the old entry is sure
+@@ -3928,15 +3925,19 @@ static int ext4_rename(struct inode *old
+ retval = 0;
+
+ end_rename:
+- brelse(old.dir_bh);
+- brelse(old.bh);
+- brelse(new.bh);
+ if (whiteout) {
+- if (retval)
++ if (retval) {
++ ext4_setent(handle, &old,
++ old.inode->i_ino, old_file_type);
+ drop_nlink(whiteout);
++ }
+ unlock_new_inode(whiteout);
+ iput(whiteout);
++
+ }
++ brelse(old.dir_bh);
++ brelse(old.bh);
++ brelse(new.bh);
+ if (handle)
+ ext4_journal_stop(handle);
+ return retval;
--- /dev/null
+From 31e203e09f036f48e7c567c2d32df0196bbd303f Mon Sep 17 00:00:00 2001
+From: Daejun Park <daejun7.park@samsung.com>
+Date: Wed, 30 Dec 2020 18:48:51 +0900
+Subject: ext4: fix wrong list_splice in ext4_fc_cleanup
+
+From: Daejun Park <daejun7.park@samsung.com>
+
+commit 31e203e09f036f48e7c567c2d32df0196bbd303f upstream.
+
+After full/fast commit, entries in staging queue are promoted to main
+queue. In ext4_fs_cleanup function, it splice to staging queue to
+staging queue.
+
+Fixes: aa75f4d3daaeb ("ext4: main fast-commit commit path")
+Signed-off-by: Daejun Park <daejun7.park@samsung.com>
+Reviewed-by: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
+Link: https://lore.kernel.org/r/20201230094851epcms2p6eeead8cc984379b37b2efd21af90fd1a@epcms2p6
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/fast_commit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -1207,7 +1207,7 @@ static void ext4_fc_cleanup(journal_t *j
+ list_splice_init(&sbi->s_fc_dentry_q[FC_Q_STAGING],
+ &sbi->s_fc_dentry_q[FC_Q_MAIN]);
+ list_splice_init(&sbi->s_fc_q[FC_Q_STAGING],
+- &sbi->s_fc_q[FC_Q_STAGING]);
++ &sbi->s_fc_q[FC_Q_MAIN]);
+
+ ext4_clear_mount_flag(sb, EXT4_MF_FC_COMMITTING);
+ ext4_clear_mount_flag(sb, EXT4_MF_FC_INELIGIBLE);
--- /dev/null
+From 23dd561ad9eae02b4d51bb502fe4e1a0666e9567 Mon Sep 17 00:00:00 2001
+From: Yi Li <yili@winhong.com>
+Date: Wed, 30 Dec 2020 11:38:27 +0800
+Subject: ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR
+
+From: Yi Li <yili@winhong.com>
+
+commit 23dd561ad9eae02b4d51bb502fe4e1a0666e9567 upstream.
+
+1: ext4_iget/ext4_find_extent never returns NULL, use IS_ERR
+instead of IS_ERR_OR_NULL to fix this.
+
+2: ext4_fc_replay_inode should set the inode to NULL when IS_ERR.
+and go to call iput properly.
+
+Fixes: 8016e29f4362 ("ext4: fast commit recovery path")
+Signed-off-by: Yi Li <yili@winhong.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20201230033827.3996064-1-yili@winhong.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/fast_commit.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -1269,14 +1269,14 @@ static int ext4_fc_replay_unlink(struct
+ entry.len = darg.dname_len;
+ inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
+
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode %d not found", darg.ino);
+ return 0;
+ }
+
+ old_parent = ext4_iget(sb, darg.parent_ino,
+ EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(old_parent)) {
++ if (IS_ERR(old_parent)) {
+ jbd_debug(1, "Dir with inode %d not found", darg.parent_ino);
+ iput(inode);
+ return 0;
+@@ -1361,7 +1361,7 @@ static int ext4_fc_replay_link(struct su
+ darg.parent_ino, darg.dname_len);
+
+ inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode not found.");
+ return 0;
+ }
+@@ -1417,10 +1417,11 @@ static int ext4_fc_replay_inode(struct s
+ trace_ext4_fc_replay(sb, tag, ino, 0, 0);
+
+ inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
+- if (!IS_ERR_OR_NULL(inode)) {
++ if (!IS_ERR(inode)) {
+ ext4_ext_clear_bb(inode);
+ iput(inode);
+ }
++ inode = NULL;
+
+ ext4_fc_record_modified_inode(sb, ino);
+
+@@ -1463,7 +1464,7 @@ static int ext4_fc_replay_inode(struct s
+
+ /* Given that we just wrote the inode on disk, this SHOULD succeed. */
+ inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode not found.");
+ return -EFSCORRUPTED;
+ }
+@@ -1515,7 +1516,7 @@ static int ext4_fc_replay_create(struct
+ goto out;
+
+ inode = ext4_iget(sb, darg.ino, EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "inode %d not found.", darg.ino);
+ inode = NULL;
+ ret = -EINVAL;
+@@ -1528,7 +1529,7 @@ static int ext4_fc_replay_create(struct
+ * dot and dot dot dirents are setup properly.
+ */
+ dir = ext4_iget(sb, darg.parent_ino, EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(dir)) {
++ if (IS_ERR(dir)) {
+ jbd_debug(1, "Dir %d not found.", darg.ino);
+ goto out;
+ }
+@@ -1604,7 +1605,7 @@ static int ext4_fc_replay_add_range(stru
+
+ inode = ext4_iget(sb, le32_to_cpu(fc_add_ex->fc_ino),
+ EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode not found.");
+ return 0;
+ }
+@@ -1728,7 +1729,7 @@ ext4_fc_replay_del_range(struct super_bl
+ le32_to_cpu(lrange->fc_ino), cur, remaining);
+
+ inode = ext4_iget(sb, le32_to_cpu(lrange->fc_ino), EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode %d not found", le32_to_cpu(lrange->fc_ino));
+ return 0;
+ }
+@@ -1809,7 +1810,7 @@ static void ext4_fc_set_bitmaps_and_coun
+ for (i = 0; i < state->fc_modified_inodes_used; i++) {
+ inode = ext4_iget(sb, state->fc_modified_inodes[i],
+ EXT4_IGET_NORMAL);
+- if (IS_ERR_OR_NULL(inode)) {
++ if (IS_ERR(inode)) {
+ jbd_debug(1, "Inode %d not found.",
+ state->fc_modified_inodes[i]);
+ continue;
+@@ -1826,7 +1827,7 @@ static void ext4_fc_set_bitmaps_and_coun
+
+ if (ret > 0) {
+ path = ext4_find_extent(inode, map.m_lblk, NULL, 0);
+- if (!IS_ERR_OR_NULL(path)) {
++ if (!IS_ERR(path)) {
+ for (j = 0; j < path->p_depth; j++)
+ ext4_mb_mark_bb(inode->i_sb,
+ path[j].p_block, 1, 1);
--- /dev/null
+From 4d4f9c1a17a3480f8fe523673f7232b254d724b7 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Wed, 16 Dec 2020 23:39:56 +0000
+Subject: MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 4d4f9c1a17a3480f8fe523673f7232b254d724b7 upstream.
+
+The compressed payload is not necesarily 4-byte aligned, at least when
+compiling with Clang. In that case, the 4-byte value appended to the
+compressed payload that corresponds to the uncompressed kernel image
+size must be read using get_unaligned_le32().
+
+This fixes Clang-built kernels not booting on MIPS (tested on a Ingenic
+JZ4770 board).
+
+Fixes: b8f54f2cde78 ("MIPS: ZBOOT: copy appended dtb to the end of the kernel")
+Cc: <stable@vger.kernel.org> # v4.7
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/boot/compressed/decompress.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -13,6 +13,7 @@
+ #include <linux/libfdt.h>
+
+ #include <asm/addrspace.h>
++#include <asm/unaligned.h>
+
+ /*
+ * These two variables specify the free mem region
+@@ -117,7 +118,7 @@ void decompress_kernel(unsigned long boo
+ dtb_size = fdt_totalsize((void *)&__appended_dtb);
+
+ /* last four bytes is always image size in little endian */
+- image_size = le32_to_cpup((void *)&__image_end - 4);
++ image_size = get_unaligned_le32((void *)&__image_end - 4);
+
+ /* copy dtb to where the booted kernel will expect it */
+ memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size,
--- /dev/null
+From 698222457465ce343443be81c5512edda86e5914 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 24 Dec 2020 19:44:38 +0000
+Subject: MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 698222457465ce343443be81c5512edda86e5914 upstream.
+
+Patches that introduced NT_FILE and NT_SIGINFO notes back in 2012
+had taken care of native (fs/binfmt_elf.c) and compat (fs/compat_binfmt_elf.c)
+coredumps; unfortunately, compat on mips (which does not go through the
+usual compat_binfmt_elf.c) had not been noticed.
+
+As the result, both N32 and O32 coredumps on 64bit mips kernels
+have those sections malformed enough to confuse the living hell out of
+all gdb and readelf versions (up to and including the tip of binutils-gdb.git).
+
+Longer term solution is to make both O32 and N32 compat use the
+regular compat_binfmt_elf.c, but that's too much for backports. The minimal
+solution is to do in arch/mips/kernel/binfmt_elf[on]32.c the same thing
+those patches have done in fs/compat_binfmt_elf.c
+
+Cc: stable@kernel.org # v3.7+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/binfmt_elfn32.c | 7 +++++++
+ arch/mips/kernel/binfmt_elfo32.c | 7 +++++++
+ 2 files changed, 14 insertions(+)
+
+--- a/arch/mips/kernel/binfmt_elfn32.c
++++ b/arch/mips/kernel/binfmt_elfn32.c
+@@ -103,4 +103,11 @@ jiffies_to_old_timeval32(unsigned long j
+ #undef ns_to_kernel_old_timeval
+ #define ns_to_kernel_old_timeval ns_to_old_timeval32
+
++/*
++ * Some data types as stored in coredump.
++ */
++#define user_long_t compat_long_t
++#define user_siginfo_t compat_siginfo_t
++#define copy_siginfo_to_external copy_siginfo_to_external32
++
+ #include "../../../fs/binfmt_elf.c"
+--- a/arch/mips/kernel/binfmt_elfo32.c
++++ b/arch/mips/kernel/binfmt_elfo32.c
+@@ -106,4 +106,11 @@ jiffies_to_old_timeval32(unsigned long j
+ #undef ns_to_kernel_old_timeval
+ #define ns_to_kernel_old_timeval ns_to_old_timeval32
+
++/*
++ * Some data types as stored in coredump.
++ */
++#define user_long_t compat_long_t
++#define user_siginfo_t compat_siginfo_t
++#define copy_siginfo_to_external copy_siginfo_to_external32
++
+ #include "../../../fs/binfmt_elf.c"
--- /dev/null
+From ad4fddef5f2345aa9214e979febe2f47639c10d9 Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Fri, 27 Nov 2020 09:39:43 +0100
+Subject: mips: fix Section mismatch in reference
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+commit ad4fddef5f2345aa9214e979febe2f47639c10d9 upstream.
+
+When building mips tinyconfig with clang the following error show up:
+
+WARNING: modpost: vmlinux.o(.text+0x1940c): Section mismatch in reference from the function r4k_cache_init() to the function .init.text:loongson3_sc_init()
+The function r4k_cache_init() references
+the function __init loongson3_sc_init().
+This is often because r4k_cache_init lacks a __init
+annotation or the annotation of loongson3_sc_init is wrong.
+
+Remove marked __init from function loongson3_sc_init(),
+mips_sc_probe_cm3(), and mips_sc_probe().
+
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/mm/c-r4k.c | 2 +-
+ arch/mips/mm/sc-mips.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1609,7 +1609,7 @@ static void __init loongson2_sc_init(voi
+ c->options |= MIPS_CPU_INCLUSIVE_CACHES;
+ }
+
+-static void __init loongson3_sc_init(void)
++static void loongson3_sc_init(void)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+ unsigned int config2, lsize;
+--- a/arch/mips/mm/sc-mips.c
++++ b/arch/mips/mm/sc-mips.c
+@@ -146,7 +146,7 @@ static inline int mips_sc_is_activated(s
+ return 1;
+ }
+
+-static int __init mips_sc_probe_cm3(void)
++static int mips_sc_probe_cm3(void)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+ unsigned long cfg = read_gcr_l2_config();
+@@ -180,7 +180,7 @@ static int __init mips_sc_probe_cm3(void
+ return 0;
+ }
+
+-static inline int __init mips_sc_probe(void)
++static inline int mips_sc_probe(void)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+ unsigned int config1, config2;
--- /dev/null
+From 5b058973d3205578aa6c9a71392e072a11ca44ef Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Fri, 11 Dec 2020 11:24:37 +0100
+Subject: mips: lib: uncached: fix non-standard usage of variable 'sp'
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+commit 5b058973d3205578aa6c9a71392e072a11ca44ef upstream.
+
+When building mips tinyconfig with clang the following warning show up:
+
+arch/mips/lib/uncached.c:45:6: warning: variable 'sp' is uninitialized when used here [-Wuninitialized]
+ if (sp >= (long)CKSEG0 && sp < (long)CKSEG2)
+ ^~
+arch/mips/lib/uncached.c:40:18: note: initialize the variable 'sp' to silence this warning
+ register long sp __asm__("$sp");
+ ^
+ = 0
+1 warning generated.
+
+Rework to make an explicit inline move, instead of the non-standard use
+of specifying registers for local variables. This is what's written
+from the gcc-10 manual [1] about specifying registers for local
+variables:
+
+"6.47.5.2 Specifying Registers for Local Variables
+.................................................
+[...]
+
+"The only supported use for this feature is to specify registers for
+input and output operands when calling Extended 'asm' (*note Extended
+Asm::). [...]".
+
+[1] https://docs.w3cub.com/gcc~10/local-register-variables
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/lib/uncached.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/lib/uncached.c
++++ b/arch/mips/lib/uncached.c
+@@ -37,10 +37,12 @@
+ */
+ unsigned long run_uncached(void *func)
+ {
+- register long sp __asm__("$sp");
+ register long ret __asm__("$2");
+ long lfunc = (long)func, ufunc;
+ long usp;
++ long sp;
++
++ __asm__("move %0, $sp" : "=r" (sp));
+
+ if (sp >= (long)CKSEG0 && sp < (long)CKSEG2)
+ usp = CKSEG1ADDR(sp);
--- /dev/null
+From 69e976831cd53f9ba304fd20305b2025ecc78eab Mon Sep 17 00:00:00 2001
+From: Alexander Lobakin <alobakin@pm.me>
+Date: Sun, 10 Jan 2021 14:21:05 +0000
+Subject: MIPS: relocatable: fix possible boot hangup with KASLR enabled
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+commit 69e976831cd53f9ba304fd20305b2025ecc78eab upstream.
+
+LLVM-built Linux triggered a boot hangup with KASLR enabled.
+
+arch/mips/kernel/relocate.c:get_random_boot() uses linux_banner,
+which is a string constant, as a random seed, but accesses it
+as an array of unsigned long (in rotate_xor()).
+When the address of linux_banner is not aligned to sizeof(long),
+such access emits unaligned access exception and hangs the kernel.
+
+Use PTR_ALIGN() to align input address to sizeof(long) and also
+align down the input length to prevent possible access-beyond-end.
+
+Fixes: 405bc8fd12f5 ("MIPS: Kernel: Implement KASLR using CONFIG_RELOCATABLE")
+Cc: stable@vger.kernel.org # 4.7+
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/relocate.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/kernel/relocate.c
++++ b/arch/mips/kernel/relocate.c
+@@ -187,8 +187,14 @@ static int __init relocate_exception_tab
+ static inline __init unsigned long rotate_xor(unsigned long hash,
+ const void *area, size_t size)
+ {
+- size_t i;
+- unsigned long *ptr = (unsigned long *)area;
++ const typeof(hash) *ptr = PTR_ALIGN(area, sizeof(hash));
++ size_t diff, i;
++
++ diff = (void *)ptr - area;
++ if (unlikely(size < diff + sizeof(hash)))
++ return hash;
++
++ size = ALIGN_DOWN(size - diff, sizeof(hash));
+
+ for (i = 0; i < size / sizeof(hash); i++) {
+ /* Rotate by odd number of bits and XOR. */
--- /dev/null
+From 0eb98f1588c2cc7a79816d84ab18a55d254f481c Mon Sep 17 00:00:00 2001
+From: Miaohe Lin <linmiaohe@huawei.com>
+Date: Tue, 12 Jan 2021 15:49:24 -0800
+Subject: mm/hugetlb: fix potential missing huge page size info
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+commit 0eb98f1588c2cc7a79816d84ab18a55d254f481c upstream.
+
+The huge page size is encoded for VM_FAULT_HWPOISON errors only. So if
+we return VM_FAULT_HWPOISON, huge page size would just be ignored.
+
+Link: https://lkml.kernel.org/r/20210107123449.38481-1-linmiaohe@huawei.com
+Fixes: aa50d3a7aa81 ("Encode huge page size for VM_FAULT_HWPOISON errors")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4372,7 +4372,7 @@ retry:
+ * So we need to block hugepage fault by PG_hwpoison bit check.
+ */
+ if (unlikely(PageHWPoison(page))) {
+- ret = VM_FAULT_HWPOISON |
++ ret = VM_FAULT_HWPOISON_LARGE |
+ VM_FAULT_SET_HINDEX(hstate_index(h));
+ goto backout_unlocked;
+ }
--- /dev/null
+From eb351d75ce1e75b4f793d609efac08426ca50acd Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 12 Jan 2021 15:49:33 -0800
+Subject: mm/process_vm_access.c: include compat.h
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit eb351d75ce1e75b4f793d609efac08426ca50acd upstream.
+
+Fix the build error:
+
+ mm/process_vm_access.c:277:5: error: implicit declaration of function 'in_compat_syscall'; did you mean 'in_ia32_syscall'? [-Werror=implicit-function-declaration]
+
+Fixes: 38dc5079da7081e "Fix compat regression in process_vm_rw()"
+Reported-by: syzbot+5b0d0de84d6c65b8dd2b@syzkaller.appspotmail.com
+Cc: Kyle Huey <me@kylehuey.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/process_vm_access.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/process_vm_access.c
++++ b/mm/process_vm_access.c
+@@ -9,6 +9,7 @@
+ #include <linux/mm.h>
+ #include <linux/uio.h>
+ #include <linux/sched.h>
++#include <linux/compat.h>
+ #include <linux/sched/mm.h>
+ #include <linux/highmem.h>
+ #include <linux/ptrace.h>
--- /dev/null
+From c22ee5284cf58017fa8c6d21d8f8c68159b6faab Mon Sep 17 00:00:00 2001
+From: Miaohe Lin <linmiaohe@huawei.com>
+Date: Tue, 12 Jan 2021 15:49:18 -0800
+Subject: mm/vmalloc.c: fix potential memory leak
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+commit c22ee5284cf58017fa8c6d21d8f8c68159b6faab upstream.
+
+In VM_MAP_PUT_PAGES case, we should put pages and free array in vfree.
+But we missed to set area->nr_pages in vmap(). So we would fail to put
+pages in __vunmap() because area->nr_pages = 0.
+
+Link: https://lkml.kernel.org/r/20210107123541.39206-1-linmiaohe@huawei.com
+Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
+Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmalloc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2405,8 +2405,10 @@ void *vmap(struct page **pages, unsigned
+ return NULL;
+ }
+
+- if (flags & VM_MAP_PUT_PAGES)
++ if (flags & VM_MAP_PUT_PAGES) {
+ area->pages = pages;
++ area->nr_pages = count;
++ }
+ return area->addr;
+ }
+ EXPORT_SYMBOL(vmap);
--- /dev/null
+From cb82a54904a99df9e8f9e9d282046055dae5a730 Mon Sep 17 00:00:00 2001
+From: Leon Schuermann <leon@is.currently.online>
+Date: Mon, 11 Jan 2021 20:03:13 +0100
+Subject: r8152: Add Lenovo Powered USB-C Travel Hub
+
+From: Leon Schuermann <leon@is.currently.online>
+
+commit cb82a54904a99df9e8f9e9d282046055dae5a730 upstream.
+
+This USB-C Hub (17ef:721e) based on the Realtek RTL8153B chip used to
+use the cdc_ether driver. However, using this driver, with the system
+suspended the device constantly sends pause-frames as soon as the
+receive buffer fills up. This causes issues with other devices, where
+some Ethernet switches stop forwarding packets altogether.
+
+Using the Realtek driver (r8152) fixes this issue. Pause frames are no
+longer sent while the host system is suspended.
+
+Signed-off-by: Leon Schuermann <leon@is.currently.online>
+Tested-by: Leon Schuermann <leon@is.currently.online>
+Link: https://lore.kernel.org/r/20210111190312.12589-2-leon@is.currently.online
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/cdc_ether.c | 7 +++++++
+ drivers/net/usb/r8152.c | 1 +
+ 2 files changed, 8 insertions(+)
+
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -793,6 +793,13 @@ static const struct usb_device_id produc
+ .driver_info = 0,
+ },
+
++/* Lenovo Powered USB-C Travel Hub (4X90S92381, based on Realtek RTL8153) */
++{
++ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0x721e, USB_CLASS_COMM,
++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
++ .driver_info = 0,
++},
++
+ /* ThinkPad USB-C Dock Gen 2 (based on Realtek RTL8153) */
+ {
+ USB_DEVICE_AND_INTERFACE_INFO(LENOVO_VENDOR_ID, 0xa387, USB_CLASS_COMM,
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -6893,6 +6893,7 @@ static const struct usb_device_id rtl815
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7205)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x720c)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x7214)},
++ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0x721e)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LENOVO, 0xa387)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
+ {REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA, 0x09ff)},
--- /dev/null
+From f2bc3af6353cb2a33dfa9d270d999d839eef54cb Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Tue, 29 Dec 2020 18:46:53 -0800
+Subject: RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
+
+From: Tom Rix <trix@redhat.com>
+
+commit f2bc3af6353cb2a33dfa9d270d999d839eef54cb upstream.
+
+In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable
+pd and then after uctx->cntxt_pd is freed, the variable pd is passed to
+function _ocrdma_dealloc_pd() which dereferences pd directly or through
+its call to ocrdma_mbx_dealloc_pd().
+
+Reorder the free using the variable pd.
+
+Cc: stable@vger.kernel.org
+Fixes: 21a428a019c9 ("RDMA: Handle PD allocations by IB/core")
+Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -434,9 +434,9 @@ static void ocrdma_dealloc_ucontext_pd(s
+ pr_err("%s(%d) Freeing in use pdid=0x%x.\n",
+ __func__, dev->id, pd->id);
+ }
+- kfree(uctx->cntxt_pd);
+ uctx->cntxt_pd = NULL;
+ _ocrdma_dealloc_pd(dev, pd);
++ kfree(pd);
+ }
+
+ static struct ocrdma_pd *ocrdma_get_ucontext_pd(struct ocrdma_ucontext *uctx)
--- /dev/null
+From 4eec66c014e9a406d8d453de958f6791d05427e4 Mon Sep 17 00:00:00 2001
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Date: Mon, 11 Jan 2021 11:31:51 -0500
+Subject: Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel"
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+commit 4eec66c014e9a406d8d453de958f6791d05427e4 upstream.
+
+commit a861736dae64 ("drm/amd/display: Fixed Intermittent blue screen on OLED panel")
+
+causes power regression for many users. It seems that this change causes
+the MCLK to get forced high; this creates a regression for many users
+since their devices were not able to drop to a low state after this
+change. For this reason, this reverts commit
+a861736dae644a0d7abbca0c638ae6aad28feeb8.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1407
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Naveed Ashfaq <Naveed.Ashfaq@amd.com>
+Cc: Hersen Wu <hersenxs.wu@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c | 11 +++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn20/display_mode_vba_20v2.c
+@@ -2635,14 +2635,15 @@ static void dml20v2_DISPCLKDPPCLKDCFCLKD
+ }
+
+ if (mode_lib->vba.DRAMClockChangeSupportsVActive &&
+- mode_lib->vba.MinActiveDRAMClockChangeMargin > 60 &&
+- mode_lib->vba.PrefetchMode[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] == 0) {
++ mode_lib->vba.MinActiveDRAMClockChangeMargin > 60) {
+ mode_lib->vba.DRAMClockChangeWatermark += 25;
+
+ for (k = 0; k < mode_lib->vba.NumberOfActivePlanes; ++k) {
+- if (mode_lib->vba.DRAMClockChangeWatermark >
+- dml_max(mode_lib->vba.StutterEnterPlusExitWatermark, mode_lib->vba.UrgentWatermark))
+- mode_lib->vba.MinTTUVBlank[k] += 25;
++ if (mode_lib->vba.PrefetchMode[mode_lib->vba.VoltageLevel][mode_lib->vba.maxMpcComb] == 0) {
++ if (mode_lib->vba.DRAMClockChangeWatermark >
++ dml_max(mode_lib->vba.StutterEnterPlusExitWatermark, mode_lib->vba.UrgentWatermark))
++ mode_lib->vba.MinTTUVBlank[k] += 25;
++ }
+ }
+
+ mode_lib->vba.DRAMClockChangeSupport[0][0] = dm_dram_clock_change_vactive;
--- /dev/null
+From 0ea02c73775277001c651ad4a0e83781a9acf406 Mon Sep 17 00:00:00 2001
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Wed, 11 Nov 2020 19:52:16 +0800
+Subject: riscv: Drop a duplicated PAGE_KERNEL_EXEC
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+commit 0ea02c73775277001c651ad4a0e83781a9acf406 upstream.
+
+commit b91540d52a08 ("RISC-V: Add EFI runtime services") add
+a duplicated PAGE_KERNEL_EXEC, kill it.
+
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Reviewed-by: Pekka Enberg <penberg@kernel.org>
+Reviewed-by: Atish Patra <atish.patra@wdc.com>
+Fixes: b91540d52a08 ("RISC-V: Add EFI runtime services")
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/include/asm/pgtable.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -99,7 +99,6 @@
+ | _PAGE_DIRTY)
+
+ #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
+-#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC)
+ #define PAGE_KERNEL_READ __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
+ #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL | _PAGE_EXEC)
+ #define PAGE_KERNEL_READ_EXEC __pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
--- /dev/null
+From c25a053e15778f6b4d6553708673736e27a6c2cf Mon Sep 17 00:00:00 2001
+From: Nick Hu <nickhu@andestech.com>
+Date: Wed, 13 Jan 2021 10:24:10 +0800
+Subject: riscv: Fix KASAN memory mapping.
+
+From: Nick Hu <nickhu@andestech.com>
+
+commit c25a053e15778f6b4d6553708673736e27a6c2cf upstream.
+
+Use virtual address instead of physical address when translating
+the address to shadow memory by kasan_mem_to_shadow().
+
+Signed-off-by: Nick Hu <nickhu@andestech.com>
+Signed-off-by: Nylon Chen <nylon7@andestech.com>
+Fixes: b10d6bca8720 ("arch, drivers: replace for_each_membock() with for_each_mem_range()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/mm/kasan_init.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/riscv/mm/kasan_init.c
++++ b/arch/riscv/mm/kasan_init.c
+@@ -93,8 +93,8 @@ void __init kasan_init(void)
+ VMALLOC_END));
+
+ for_each_mem_range(i, &_start, &_end) {
+- void *start = (void *)_start;
+- void *end = (void *)_end;
++ void *start = (void *)__va(_start);
++ void *end = (void *)__va(_end);
+
+ if (start >= end)
+ break;
--- /dev/null
+From 0aa2ec8a475fb505fd98d93bbcf4e03beeeebcb6 Mon Sep 17 00:00:00 2001
+From: Guo Ren <guoren@linux.alibaba.com>
+Date: Sat, 2 Jan 2021 13:24:34 +0000
+Subject: riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+commit 0aa2ec8a475fb505fd98d93bbcf4e03beeeebcb6 upstream.
+
+The patch fix commit: ad5d112 ("riscv: use vDSO common flow to
+reduce the latency of the time-related functions").
+
+The GENERIC_TIME_VSYSCALL should be CONFIG_GENERIC_TIME_VSYSCALL
+or vgettimeofday won't work.
+
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Reviewed-by: Pekka Enberg <penberg@kernel.org>
+Fixes: ad5d1122b82f ("riscv: use vDSO common flow to reduce the latency of the time-related functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/include/asm/vdso.h | 2 +-
+ arch/riscv/kernel/vdso.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/riscv/include/asm/vdso.h
++++ b/arch/riscv/include/asm/vdso.h
+@@ -10,7 +10,7 @@
+
+ #include <linux/types.h>
+
+-#ifndef GENERIC_TIME_VSYSCALL
++#ifndef CONFIG_GENERIC_TIME_VSYSCALL
+ struct vdso_data {
+ };
+ #endif
+--- a/arch/riscv/kernel/vdso.c
++++ b/arch/riscv/kernel/vdso.c
+@@ -12,7 +12,7 @@
+ #include <linux/binfmts.h>
+ #include <linux/err.h>
+ #include <asm/page.h>
+-#ifdef GENERIC_TIME_VSYSCALL
++#ifdef CONFIG_GENERIC_TIME_VSYSCALL
+ #include <vdso/datapage.h>
+ #else
+ #include <asm/vdso.h>
--- /dev/null
+From cf7b2ae4d70432fa94ebba3fbaab825481ae7189 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@suse.de>
+Date: Mon, 21 Dec 2020 23:52:00 +0100
+Subject: riscv: return -ENOSYS for syscall -1
+
+From: Andreas Schwab <schwab@suse.de>
+
+commit cf7b2ae4d70432fa94ebba3fbaab825481ae7189 upstream.
+
+Properly return -ENOSYS for syscall -1 instead of leaving the return value
+uninitialized. This fixes the strace teststuite.
+
+Fixes: 5340627e3fe0 ("riscv: add support for SECCOMP and SECCOMP_FILTER")
+Cc: stable@vger.kernel.org
+Signed-off-by: Andreas Schwab <schwab@suse.de>
+Reviewed-by: Tycho Andersen <tycho@tycho.pizza>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/kernel/entry.S | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -186,14 +186,7 @@ check_syscall_nr:
+ * Syscall number held in a7.
+ * If syscall number is above allowed value, redirect to ni_syscall.
+ */
+- bge a7, t0, 1f
+- /*
+- * Check if syscall is rejected by tracer, i.e., a7 == -1.
+- * If yes, we pretend it was executed.
+- */
+- li t1, -1
+- beq a7, t1, ret_from_syscall_rejected
+- blt a7, t1, 1f
++ bgeu a7, t0, 1f
+ /* Call syscall */
+ la s0, sys_call_table
+ slli t0, a7, RISCV_LGPTR
btrfs-reloc-fix-wrong-file-extent-type-check-to-avoid-false-enoent.patch
btrfs-prevent-null-pointer-dereference-in-extent_io_tree_panic.patch
+alsa-hda-realtek-fix-right-sounds-and-mute-micmute-leds-for-hp-machines.patch
+alsa-doc-fix-reference-to-mixart.rst.patch
+asoc-amd-renoir-add-dmi-entry-for-lenovo-thinkpad-x395.patch
+asoc-dapm-remove-widget-from-dirty-list-on-free.patch
+x86-hyperv-check-cpu-mask-after-interrupt-has-been-disabled.patch
+drm-amdgpu-add-green_sardine-device-id-v2.patch
+drm-amdgpu-fix-drm_info-flood-if-display-core-is-not-supported-bug-210921.patch
+revert-drm-amd-display-fixed-intermittent-blue-screen-on-oled-panel.patch
+drm-amdgpu-add-new-device-id-for-renior.patch
+drm-i915-allow-the-sysadmin-to-override-security-mitigations.patch
+drm-i915-gt-limit-vfe-threads-based-on-gt.patch
+drm-i915-backlight-fix-cpu-mode-backlight-takeover-on-lpt.patch
+drm-bridge-sii902x-refactor-init-code-into-separate-function.patch
+dt-bindings-display-sii902x-add-supply-bindings.patch
+drm-bridge-sii902x-enable-i-o-and-core-vcc-supplies-if-present.patch
+tracing-kprobes-do-the-notrace-functions-check-without-kprobes-on-ftrace.patch
+tools-bootconfig-add-tracing_on-support-to-helper-scripts.patch
+ext4-use-is_err-instead-of-is_err_or_null-and-set-inode-null-when-is_err.patch
+ext4-fix-wrong-list_splice-in-ext4_fc_cleanup.patch
+ext4-fix-bug-for-rename-with-rename_whiteout.patch
+cifs-check-pointer-before-freeing.patch
+cifs-fix-interrupted-close-commands.patch
+riscv-drop-a-duplicated-page_kernel_exec.patch
+riscv-return-enosys-for-syscall-1.patch
+riscv-fixup-config_generic_time_vsyscall.patch
+riscv-fix-kasan-memory-mapping.patch
+mips-fix-section-mismatch-in-reference.patch
+mips-lib-uncached-fix-non-standard-usage-of-variable-sp.patch
+mips-boot-fix-unaligned-access-with-config_mips_raw_appended_dtb.patch
+mips-fix-malformed-nt_file-and-nt_siginfo-in-32bit-coredumps.patch
+mips-relocatable-fix-possible-boot-hangup-with-kaslr-enabled.patch
+rdma-ocrdma-fix-use-after-free-in-ocrdma_dealloc_ucontext_pd.patch
+acpi-scan-harden-acpi_device_add-against-device-id-overflows.patch
+xen-privcmd-allow-fetching-resource-sizes.patch
+compiler.h-raise-minimum-version-of-gcc-to-5.1-for-arm64.patch
+mm-vmalloc.c-fix-potential-memory-leak.patch
+mm-hugetlb-fix-potential-missing-huge-page-size-info.patch
+mm-process_vm_access.c-include-compat.h.patch
+dm-raid-fix-discard-limits-for-raid1.patch
+dm-snapshot-flush-merged-data-before-committing-metadata.patch
+dm-integrity-fix-flush-with-external-metadata-device.patch
+dm-integrity-fix-the-maximum-number-of-arguments.patch
+dm-crypt-use-gfp_atomic-when-allocating-crypto-requests-from-softirq.patch
+dm-crypt-do-not-wait-for-backlogged-crypto-request-completion-in-softirq.patch
+dm-crypt-do-not-call-bio_endio-from-the-dm-crypt-tasklet.patch
+dm-crypt-defer-decryption-to-a-tasklet-if-interrupts-disabled.patch
+stmmac-intel-change-all-ehl-tgl-to-auto-detect-phy-addr.patch
+r8152-add-lenovo-powered-usb-c-travel-hub.patch
--- /dev/null
+From bff6f1db91e330d7fba56f815cdbc412c75fe163 Mon Sep 17 00:00:00 2001
+From: Voon Weifeng <weifeng.voon@intel.com>
+Date: Fri, 6 Nov 2020 17:43:41 +0800
+Subject: stmmac: intel: change all EHL/TGL to auto detect phy addr
+
+From: Voon Weifeng <weifeng.voon@intel.com>
+
+commit bff6f1db91e330d7fba56f815cdbc412c75fe163 upstream.
+
+Set all EHL/TGL phy_addr to -1 so that the driver will automatically
+detect it at run-time by probing all the possible 32 addresses.
+
+Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
+Signed-off-by: Wong Vee Khee <vee.khee.wong@intel.com>
+Link: https://lore.kernel.org/r/20201106094341.4241-1-vee.khee.wong@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c
+@@ -236,6 +236,7 @@ static int intel_mgbe_common_data(struct
+ int ret;
+ int i;
+
++ plat->phy_addr = -1;
+ plat->clk_csr = 5;
+ plat->has_gmac = 0;
+ plat->has_gmac4 = 1;
+@@ -345,7 +346,6 @@ static int ehl_sgmii_data(struct pci_dev
+ struct plat_stmmacenet_data *plat)
+ {
+ plat->bus_id = 1;
+- plat->phy_addr = 0;
+ plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
+
+ plat->serdes_powerup = intel_serdes_powerup;
+@@ -362,7 +362,6 @@ static int ehl_rgmii_data(struct pci_dev
+ struct plat_stmmacenet_data *plat)
+ {
+ plat->bus_id = 1;
+- plat->phy_addr = 0;
+ plat->phy_interface = PHY_INTERFACE_MODE_RGMII;
+
+ return ehl_common_data(pdev, plat);
+@@ -376,7 +375,6 @@ static int ehl_pse0_common_data(struct p
+ struct plat_stmmacenet_data *plat)
+ {
+ plat->bus_id = 2;
+- plat->phy_addr = 1;
+ return ehl_common_data(pdev, plat);
+ }
+
+@@ -408,7 +406,6 @@ static int ehl_pse1_common_data(struct p
+ struct plat_stmmacenet_data *plat)
+ {
+ plat->bus_id = 3;
+- plat->phy_addr = 1;
+ return ehl_common_data(pdev, plat);
+ }
+
+@@ -450,7 +447,6 @@ static int tgl_sgmii_data(struct pci_dev
+ struct plat_stmmacenet_data *plat)
+ {
+ plat->bus_id = 1;
+- plat->phy_addr = 0;
+ plat->phy_interface = PHY_INTERFACE_MODE_SGMII;
+ plat->serdes_powerup = intel_serdes_powerup;
+ plat->serdes_powerdown = intel_serdes_powerdown;
--- /dev/null
+From 55ed4560774d81d7343223b8fd2784c530a9c6c1 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Wed, 9 Dec 2020 14:27:44 +0900
+Subject: tools/bootconfig: Add tracing_on support to helper scripts
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 55ed4560774d81d7343223b8fd2784c530a9c6c1 upstream.
+
+Add ftrace.instance.INSTANCE.tracing_on support to ftrace2bconf.sh
+and bconf2ftrace.sh.
+
+commit 8490db06f914 ("tracing/boot: Add per-instance tracing_on
+option support") added the per-instance tracing_on option,
+but forgot to update the helper scripts.
+
+Link: https://lkml.kernel.org/r/160749166410.3497930.14204335886811029800.stgit@devnote2
+
+Cc: stable@vger.kernel.org
+Fixes: 8490db06f914 ("tracing/boot: Add per-instance tracing_on option support")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/bootconfig/scripts/bconf2ftrace.sh | 1 +
+ tools/bootconfig/scripts/ftrace2bconf.sh | 4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/tools/bootconfig/scripts/bconf2ftrace.sh
++++ b/tools/bootconfig/scripts/bconf2ftrace.sh
+@@ -152,6 +152,7 @@ setup_instance() { # [instance]
+ set_array_of ${instance}.options ${instancedir}/trace_options
+ set_value_of ${instance}.trace_clock ${instancedir}/trace_clock
+ set_value_of ${instance}.cpumask ${instancedir}/tracing_cpumask
++ set_value_of ${instance}.tracing_on ${instancedir}/tracing_on
+ set_value_of ${instance}.tracer ${instancedir}/current_tracer
+ set_array_of ${instance}.ftrace.filters \
+ ${instancedir}/set_ftrace_filter
+--- a/tools/bootconfig/scripts/ftrace2bconf.sh
++++ b/tools/bootconfig/scripts/ftrace2bconf.sh
+@@ -221,6 +221,10 @@ instance_options() { # [instance-name]
+ if [ `echo $val | sed -e s/f//g`x != x ]; then
+ emit_kv $PREFIX.cpumask = $val
+ fi
++ val=`cat $INSTANCE/tracing_on`
++ if [ `echo $val | sed -e s/f//g`x != x ]; then
++ emit_kv $PREFIX.tracing_on = $val
++ fi
+
+ val=
+ for i in `cat $INSTANCE/set_event`; do
--- /dev/null
+From 7bb83f6fc4ee84e95d0ac0d14452c2619fb3fe70 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 8 Jan 2021 13:19:38 +0900
+Subject: tracing/kprobes: Do the notrace functions check without kprobes on ftrace
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 7bb83f6fc4ee84e95d0ac0d14452c2619fb3fe70 upstream.
+
+Enable the notrace function check on the architecture which doesn't
+support kprobes on ftrace but support dynamic ftrace. This notrace
+function check is not only for the kprobes on ftrace but also
+sw-breakpoint based kprobes.
+Thus there is no reason to limit this check for the arch which
+supports kprobes on ftrace.
+
+This also changes the dependency of Kconfig. Because kprobe event
+uses the function tracer's address list for identifying notrace
+function, if the CONFIG_DYNAMIC_FTRACE=n, it can not check whether
+the target function is notrace or not.
+
+Link: https://lkml.kernel.org/r/20210105065730.2634785-1-naveen.n.rao@linux.vnet.ibm.com
+Link: https://lkml.kernel.org/r/161007957862.114704.4512260007555399463.stgit@devnote2
+
+Cc: stable@vger.kernel.org
+Fixes: 45408c4f92506 ("tracing: kprobes: Prohibit probing on notrace function")
+Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/Kconfig | 2 +-
+ kernel/trace/trace_kprobe.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -531,7 +531,7 @@ config KPROBE_EVENTS
+ config KPROBE_EVENTS_ON_NOTRACE
+ bool "Do NOT protect notrace function from kprobe events"
+ depends on KPROBE_EVENTS
+- depends on KPROBES_ON_FTRACE
++ depends on DYNAMIC_FTRACE
+ default n
+ help
+ This is only for the developers who want to debug ftrace itself
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -434,7 +434,7 @@ static int disable_trace_kprobe(struct t
+ return 0;
+ }
+
+-#if defined(CONFIG_KPROBES_ON_FTRACE) && \
++#if defined(CONFIG_DYNAMIC_FTRACE) && \
+ !defined(CONFIG_KPROBE_EVENTS_ON_NOTRACE)
+ static bool __within_notrace_func(unsigned long addr)
+ {
--- /dev/null
+From ad0a6bad44758afa3b440c254a24999a0c7e35d5 Mon Sep 17 00:00:00 2001
+From: Wei Liu <wei.liu@kernel.org>
+Date: Tue, 5 Jan 2021 17:50:43 +0000
+Subject: x86/hyperv: check cpu mask after interrupt has been disabled
+
+From: Wei Liu <wei.liu@kernel.org>
+
+commit ad0a6bad44758afa3b440c254a24999a0c7e35d5 upstream.
+
+We've observed crashes due to an empty cpu mask in
+hyperv_flush_tlb_others. Obviously the cpu mask in question is changed
+between the cpumask_empty call at the beginning of the function and when
+it is actually used later.
+
+One theory is that an interrupt comes in between and a code path ends up
+changing the mask. Move the check after interrupt has been disabled to
+see if it fixes the issue.
+
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Cc: stable@kernel.org
+Link: https://lore.kernel.org/r/20210105175043.28325-1-wei.liu@kernel.org
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/hyperv/mmu.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/hyperv/mmu.c
++++ b/arch/x86/hyperv/mmu.c
+@@ -66,11 +66,17 @@ static void hyperv_flush_tlb_others(cons
+ if (!hv_hypercall_pg)
+ goto do_native;
+
+- if (cpumask_empty(cpus))
+- return;
+-
+ local_irq_save(flags);
+
++ /*
++ * Only check the mask _after_ interrupt has been disabled to avoid the
++ * mask changing under our feet.
++ */
++ if (cpumask_empty(cpus)) {
++ local_irq_restore(flags);
++ return;
++ }
++
+ flush_pcpu = (struct hv_tlb_flush **)
+ this_cpu_ptr(hyperv_pcpu_input_arg);
+
--- /dev/null
+From ef3a575baf53571dc405ee4028e26f50856898e7 Mon Sep 17 00:00:00 2001
+From: Roger Pau Monne <roger.pau@citrix.com>
+Date: Tue, 12 Jan 2021 12:53:58 +0100
+Subject: xen/privcmd: allow fetching resource sizes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Roger Pau Monne <roger.pau@citrix.com>
+
+commit ef3a575baf53571dc405ee4028e26f50856898e7 upstream.
+
+Allow issuing an IOCTL_PRIVCMD_MMAP_RESOURCE ioctl with num = 0 and
+addr = 0 in order to fetch the size of a specific resource.
+
+Add a shortcut to the default map resource path, since fetching the
+size requires no address to be passed in, and thus no VMA to setup.
+
+This is missing from the initial implementation, and causes issues
+when mapping resources that don't have fixed or known sizes.
+
+Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: stable@vger.kernel.org # >= 4.18
+Link: https://lore.kernel.org/r/20210112115358.23346-1-roger.pau@citrix.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/xen/privcmd.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/drivers/xen/privcmd.c
++++ b/drivers/xen/privcmd.c
+@@ -717,14 +717,15 @@ static long privcmd_ioctl_restrict(struc
+ return 0;
+ }
+
+-static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
++static long privcmd_ioctl_mmap_resource(struct file *file,
++ struct privcmd_mmap_resource __user *udata)
+ {
+ struct privcmd_data *data = file->private_data;
+ struct mm_struct *mm = current->mm;
+ struct vm_area_struct *vma;
+ struct privcmd_mmap_resource kdata;
+ xen_pfn_t *pfns = NULL;
+- struct xen_mem_acquire_resource xdata;
++ struct xen_mem_acquire_resource xdata = { };
+ int rc;
+
+ if (copy_from_user(&kdata, udata, sizeof(kdata)))
+@@ -734,6 +735,22 @@ static long privcmd_ioctl_mmap_resource(
+ if (data->domid != DOMID_INVALID && data->domid != kdata.dom)
+ return -EPERM;
+
++ /* Both fields must be set or unset */
++ if (!!kdata.addr != !!kdata.num)
++ return -EINVAL;
++
++ xdata.domid = kdata.dom;
++ xdata.type = kdata.type;
++ xdata.id = kdata.id;
++
++ if (!kdata.addr && !kdata.num) {
++ /* Query the size of the resource. */
++ rc = HYPERVISOR_memory_op(XENMEM_acquire_resource, &xdata);
++ if (rc)
++ return rc;
++ return __put_user(xdata.nr_frames, &udata->num);
++ }
++
+ mmap_write_lock(mm);
+
+ vma = find_vma(mm, kdata.addr);
+@@ -768,10 +785,6 @@ static long privcmd_ioctl_mmap_resource(
+ } else
+ vma->vm_private_data = PRIV_VMA_LOCKED;
+
+- memset(&xdata, 0, sizeof(xdata));
+- xdata.domid = kdata.dom;
+- xdata.type = kdata.type;
+- xdata.id = kdata.id;
+ xdata.frame = kdata.idx;
+ xdata.nr_frames = kdata.num;
+ set_xen_guest_handle(xdata.frame_list, pfns);
projects / thirdparty / kernel / stable-queue.git / commitdiff
