--- /dev/null
+From c56954c668c9ca0f2bf18b02e63ee6df9e5b9a39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Sep 2020 17:18:34 -0700
+Subject: autofs: use __kernel_write() for the autofs pipe writing
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 90fb702791bf99b959006972e8ee7bb4609f441b ]
+
+autofs got broken in some configurations by commit 13c164b1a186
+("autofs: switch to kernel_write") because there is now an extra LSM
+permission check done by security_file_permission() in rw_verify_area().
+
+autofs is one if the few places that really does want the much more
+limited __kernel_write(), because the write is an internal kernel one
+that shouldn't do any user permission checks (it also doesn't need the
+file_start_write/file_end_write logic, since it's just a pipe).
+
+There are a couple of other cases like that - accounting, core dumping,
+and splice - but autofs stands out because it can be built as a module.
+
+As a result, we need to export this internal __kernel_write() function
+again.
+
+We really don't want any other module to use this, but we don't have a
+"EXPORT_SYMBOL_FOR_AUTOFS_ONLY()". But we can mark it GPL-only to at
+least approximate that "internal use only" for licensing.
+
+While in this area, make autofs pass in NULL for the file position
+pointer, since it's always a pipe, and we now use a NULL file pointer
+for streaming file descriptors (see file_ppos() and commit 438ab720c675:
+"vfs: pass ppos=NULL to .read()/.write() of FMODE_STREAM files")
+
+This effectively reverts commits 9db977522449 ("fs: unexport
+__kernel_write") and 13c164b1a186 ("autofs: switch to kernel_write").
+
+Fixes: 13c164b1a186 ("autofs: switch to kernel_write")
+Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Acked-by: Ian Kent <raven@themaw.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/autofs/waitq.c | 2 +-
+ fs/read_write.c | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
+index 74c886f7c51cb..5ced859dac539 100644
+--- a/fs/autofs/waitq.c
++++ b/fs/autofs/waitq.c
+@@ -53,7 +53,7 @@ static int autofs_write(struct autofs_sb_info *sbi,
+
+ mutex_lock(&sbi->pipe_mutex);
+ while (bytes) {
+- wr = kernel_write(file, data, bytes, &file->f_pos);
++ wr = __kernel_write(file, data, bytes, NULL);
+ if (wr <= 0)
+ break;
+ data += wr;
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 4fb797822567a..9a5cb9c2f0d46 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -538,6 +538,14 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t
+ inc_syscw(current);
+ return ret;
+ }
++/*
++ * This "EXPORT_SYMBOL_GPL()" is more of a "EXPORT_SYMBOL_DONTUSE()",
++ * but autofs is one of the few internal kernel users that actually
++ * wants this _and_ can be built as a module. So we need to export
++ * this symbol for autofs, even though it really isn't appropriate
++ * for any other kernel modules.
++ */
++EXPORT_SYMBOL_GPL(__kernel_write);
+
+ ssize_t kernel_write(struct file *file, const void *buf, size_t count,
+ loff_t *pos)
+--
+2.25.1
+
--- /dev/null
+From 23bf0943e22dae5b420be09272bf61699564e2cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Sep 2020 19:25:56 +0800
+Subject: blk-mq: call commit_rqs while list empty but error happen
+
+From: yangerkun <yangerkun@huawei.com>
+
+[ Upstream commit 632bfb6323799c087fcb4108dfe59518609667a7 ]
+
+Blk-mq should call commit_rqs once 'bd.last != true' and no more
+request will come(so virtscsi can kick the virtqueue, e.g.). We already
+do that in 'blk_mq_dispatch_rq_list/blk_mq_try_issue_list_directly' while
+list not empty and 'queued > 0'. However, we can seen the same scene
+once the last request in list call queue_rq and return error like
+BLK_STS_IOERR which will not requeue the request, and lead that list
+empty but need call commit_rqs too(Or the request for virtscsi will stay
+timeout until other request kick virtqueue).
+
+We found this problem by do fsstress test with offline/online virtscsi
+device repeat quickly.
+
+Fixes: d666ba98f849 ("blk-mq: add mq_ops->commit_rqs()")
+Reported-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index a366726094a89..8e623e0282757 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1304,6 +1304,11 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+
+ hctx->dispatched[queued_to_index(queued)]++;
+
++ /* If we didn't flush the entire list, we could have told the driver
++ * there was more coming, but that turned out to be a lie.
++ */
++ if ((!list_empty(list) || errors) && q->mq_ops->commit_rqs && queued)
++ q->mq_ops->commit_rqs(hctx);
+ /*
+ * Any items that need requeuing? Stuff them into hctx->dispatch,
+ * that is where we will continue on next queue run.
+@@ -1311,14 +1316,6 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ if (!list_empty(list)) {
+ bool needs_restart;
+
+- /*
+- * If we didn't flush the entire list, we could have told
+- * the driver there was more coming, but that turned out to
+- * be a lie.
+- */
+- if (q->mq_ops->commit_rqs && queued)
+- q->mq_ops->commit_rqs(hctx);
+-
+ spin_lock(&hctx->lock);
+ list_splice_tail_init(list, &hctx->dispatch);
+ spin_unlock(&hctx->lock);
+@@ -1971,6 +1968,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
+ struct list_head *list)
+ {
+ int queued = 0;
++ int errors = 0;
+
+ while (!list_empty(list)) {
+ blk_status_t ret;
+@@ -1987,6 +1985,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
+ break;
+ }
+ blk_mq_end_request(rq, ret);
++ errors++;
+ } else
+ queued++;
+ }
+@@ -1996,7 +1995,8 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx,
+ * the driver there was more coming, but that turned out to
+ * be a lie.
+ */
+- if (!list_empty(list) && hctx->queue->mq_ops->commit_rqs && queued)
++ if ((!list_empty(list) || errors) &&
++ hctx->queue->mq_ops->commit_rqs && queued)
+ hctx->queue->mq_ops->commit_rqs(hctx);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 7e000d47969506a48ce1d5e76a319244955e3ebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 14:40:46 +0200
+Subject: clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit f3bb0f796f5ffe32f0fbdce5b1b12eb85511158f ]
+
+The ChipID IO region has it's own clock, which is being disabled while
+scanning for unused clocks. It turned out that some CPU hotplug, CPU idle
+or even SOC firmware code depends on the reads from that area. Fix the
+mysterious hang caused by entering deep CPU idle state by ignoring the
+'chipid' clock during unused clocks scan, as there are no direct clients
+for it which will keep it enabled.
+
+Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20200922124046.10496-1-m.szyprowski@samsung.com
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos4.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 51564fc23c639..f4086287bb71b 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -927,7 +927,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = {
+ GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0),
+ GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0),
+ GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0),
+- GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0),
++ GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0,
+ CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0,
+@@ -969,7 +969,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = {
+ 0),
+ GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0),
+ GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0),
+- GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0),
++ GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1,
+ CLK_IGNORE_UNUSED, 0),
+ GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0,
+--
+2.25.1
+
--- /dev/null
+From b8f8f37dfcc2121f7a385296a9321636f90d5a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 13:13:07 +0200
+Subject: clk: tegra: Always program PLL_E when enabled
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 5105660ee80862b85f7769626d0f936c18ce1885 ]
+
+Commit bff1cef5f23a ("clk: tegra: Don't enable already enabled PLLs")
+added checks to avoid enabling PLLs that have already been enabled by
+the bootloader. However, the PLL_E configuration inherited from the
+bootloader isn't necessarily the one that is needed for the kernel.
+
+This can cause SATA to fail like this:
+
+ [ 5.310270] phy phy-sata.6: phy poweron failed --> -110
+ [ 5.315604] tegra-ahci 70027000.sata: failed to power on AHCI controller: -110
+ [ 5.323022] tegra-ahci: probe of 70027000.sata failed with error -110
+
+Fix this by always programming the PLL_E. This ensures that any mis-
+configuration by the bootloader will be overwritten by the kernel.
+
+Fixes: bff1cef5f23a ("clk: tegra: Don't enable already enabled PLLs")
+Reported-by: LABBE Corentin <clabbe@baylibre.com>
+Tested-by: Corentin Labbe <clabbe@baylibre.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-pll.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index 0b212cf2e7942..1cc982d3de635 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -1601,9 +1601,6 @@ static int clk_plle_tegra114_enable(struct clk_hw *hw)
+ unsigned long flags = 0;
+ unsigned long input_rate;
+
+- if (clk_pll_is_enabled(hw))
+- return 0;
+-
+ input_rate = clk_hw_get_rate(clk_hw_get_parent(hw));
+
+ if (_get_table_rate(hw, &sel, pll->params->fixed_rate, input_rate))
+--
+2.25.1
+
--- /dev/null
+From 36af8b962118dad1051303c0c630a3925ebfc60c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 08:08:26 +0200
+Subject: clk: tegra: Fix missing prototype for tegra210_clk_register_emc()
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 2f878d04218c8b26f6d0ab26955ca6b03848a1ad ]
+
+Include the Tegra driver's clk.h to pull in the prototype definition for
+this function so that compilers don't warn about it being missing.
+
+Fixes: 0ac65fc946d3 ("clk: tegra: Implement Tegra210 EMC clock")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra210-emc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/tegra/clk-tegra210-emc.c b/drivers/clk/tegra/clk-tegra210-emc.c
+index 352a2c3fc3740..51fd0ec2a2d04 100644
+--- a/drivers/clk/tegra/clk-tegra210-emc.c
++++ b/drivers/clk/tegra/clk-tegra210-emc.c
+@@ -12,6 +12,8 @@
+ #include <linux/io.h>
+ #include <linux/slab.h>
+
++#include "clk.h"
++
+ #define CLK_SOURCE_EMC 0x19c
+ #define CLK_SOURCE_EMC_2X_CLK_SRC GENMASK(31, 29)
+ #define CLK_SOURCE_EMC_MC_EMC_SAME_FREQ BIT(16)
+--
+2.25.1
+
--- /dev/null
+From 730b813a764e4a3983c28a7354af04467c905ffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 14:58:45 +0300
+Subject: dmaengine: dmatest: Prevent to run on misconfigured channel
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit ce65d55f92a67e247f4d799e581cf9fed677871c ]
+
+Andy reported that commit 6b41030fdc79 ("dmaengine: dmatest:
+Restore default for channel") broke his scripts for the case
+where "busy" channel is used for configuration with expectation
+that run command would do nothing. Instead, behavior was
+(unintentionally) changed to treat such case as under-configuration
+and progress with defaults, i.e. run command would start a test
+with default setting for channel (which would use all channels).
+
+Restore original behavior with tracking status of channel setter
+so we can distinguish between misconfigured and under-configured
+cases in run command and act accordingly.
+
+Fixes: 6b41030fdc79 ("dmaengine: dmatest: Restore default for channel")
+Reported-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20200922115847.30100-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dmatest.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
+index 604f803579312..323822372b4ce 100644
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -129,6 +129,7 @@ struct dmatest_params {
+ * @nr_channels: number of channels under test
+ * @lock: access protection to the fields of this structure
+ * @did_init: module has been initialized completely
++ * @last_error: test has faced configuration issues
+ */
+ static struct dmatest_info {
+ /* Test parameters */
+@@ -137,6 +138,7 @@ static struct dmatest_info {
+ /* Internal state */
+ struct list_head channels;
+ unsigned int nr_channels;
++ int last_error;
+ struct mutex lock;
+ bool did_init;
+ } test_info = {
+@@ -1175,10 +1177,22 @@ static int dmatest_run_set(const char *val, const struct kernel_param *kp)
+ return ret;
+ } else if (dmatest_run) {
+ if (!is_threaded_test_pending(info)) {
+- pr_info("No channels configured, continue with any\n");
+- if (!is_threaded_test_run(info))
+- stop_threaded_test(info);
+- add_threaded_test(info);
++ /*
++ * We have nothing to run. This can be due to:
++ */
++ ret = info->last_error;
++ if (ret) {
++ /* 1) Misconfiguration */
++ pr_err("Channel misconfigured, can't continue\n");
++ mutex_unlock(&info->lock);
++ return ret;
++ } else {
++ /* 2) We rely on defaults */
++ pr_info("No channels configured, continue with any\n");
++ if (!is_threaded_test_run(info))
++ stop_threaded_test(info);
++ add_threaded_test(info);
++ }
+ }
+ start_threaded_tests(info);
+ } else {
+@@ -1195,7 +1209,7 @@ static int dmatest_chan_set(const char *val, const struct kernel_param *kp)
+ struct dmatest_info *info = &test_info;
+ struct dmatest_chan *dtc;
+ char chan_reset_val[20];
+- int ret = 0;
++ int ret;
+
+ mutex_lock(&info->lock);
+ ret = param_set_copystring(val, kp);
+@@ -1250,12 +1264,14 @@ static int dmatest_chan_set(const char *val, const struct kernel_param *kp)
+ goto add_chan_err;
+ }
+
++ info->last_error = ret;
+ mutex_unlock(&info->lock);
+
+ return ret;
+
+ add_chan_err:
+ param_set_copystring(chan_reset_val, kp);
++ info->last_error = ret;
+ mutex_unlock(&info->lock);
+
+ return ret;
+--
+2.25.1
+
--- /dev/null
+From 4020ba021a9413128a699cdce4501f47aec75063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Sep 2020 13:42:16 -0700
+Subject: gpio: aspeed: fix ast2600 bank properties
+
+From: Tao Ren <rentao.bupt@gmail.com>
+
+[ Upstream commit 3e640b1eec38e4c8eba160f26cba4f592e657f3d ]
+
+GPIO_U is mapped to the least significant byte of input/output mask, and
+the byte in "output" mask should be 0 because GPIO_U is input only. All
+the other bits need to be 1 because GPIO_V/W/X support both input and
+output modes.
+
+Similarly, GPIO_Y/Z are mapped to the 2 least significant bytes, and the
+according bits need to be 1 because GPIO_Y/Z support both input and
+output modes.
+
+Fixes: ab4a85534c3e ("gpio: aspeed: Add in ast2600 details to Aspeed driver")
+Signed-off-by: Tao Ren <rentao.bupt@gmail.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 879db23d84549..d07bf2c3f1369 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -1114,8 +1114,8 @@ static const struct aspeed_gpio_config ast2500_config =
+
+ static const struct aspeed_bank_props ast2600_bank_props[] = {
+ /* input output */
+- {5, 0xffffffff, 0x0000ffff}, /* U/V/W/X */
+- {6, 0xffff0000, 0x0fff0000}, /* Y/Z */
++ {5, 0xffffffff, 0xffffff00}, /* U/V/W/X */
++ {6, 0x0000ffff, 0x0000ffff}, /* Y/Z */
+ { },
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 2dbaed0deaffda0cd44e85b5029470ba756bdc82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Sep 2020 09:51:05 +0800
+Subject: gpio/aspeed-sgpio: don't enable all interrupts by default
+
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+
+[ Upstream commit bf0d394e885015941ed2d5724c0a6ed8d42dd95e ]
+
+Currently, the IRQ setup for the SGPIO driver enables all interrupts in
+dual-edge trigger mode. Since the default handler is handle_bad_irq, any
+state change on input GPIOs will trigger bad IRQ warnings.
+
+This change applies sensible IRQ defaults: single-edge trigger, and all
+IRQs disabled.
+
+Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Fixes: 7db47faae79b ("gpio: aspeed: Add SGPIO driver")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Acked-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed-sgpio.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index 5d678dbf1a621..a0eb00c024f62 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -452,17 +452,15 @@ static int aspeed_sgpio_setup_irqs(struct aspeed_sgpio *gpio,
+ irq->parents = &gpio->irq;
+ irq->num_parents = 1;
+
+- /* set IRQ settings and Enable Interrupt */
++ /* Apply default IRQ settings */
+ for (i = 0; i < ARRAY_SIZE(aspeed_sgpio_banks); i++) {
+ bank = &aspeed_sgpio_banks[i];
+ /* set falling or level-low irq */
+ iowrite32(0x00000000, bank_reg(gpio, bank, reg_irq_type0));
+ /* trigger type is edge */
+ iowrite32(0x00000000, bank_reg(gpio, bank, reg_irq_type1));
+- /* dual edge trigger mode. */
+- iowrite32(0xffffffff, bank_reg(gpio, bank, reg_irq_type2));
+- /* enable irq */
+- iowrite32(0xffffffff, bank_reg(gpio, bank, reg_irq_enable));
++ /* single edge trigger */
++ iowrite32(0x00000000, bank_reg(gpio, bank, reg_irq_type2));
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From fd150ed977d11dd5db6ed9bd56c1e62954073208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Sep 2020 09:51:04 +0800
+Subject: gpio/aspeed-sgpio: enable access to all 80 input & output sgpios
+
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+
+[ Upstream commit ac67b07e268d46eba675a60c37051bb3e59fd201 ]
+
+Currently, the aspeed-sgpio driver exposes up to 80 GPIO lines,
+corresponding to the 80 status bits available in hardware. Each of these
+lines can be configured as either an input or an output.
+
+However, each of these GPIOs is actually an input *and* an output; we
+actually have 80 inputs plus 80 outputs.
+
+This change expands the maximum number of GPIOs to 160; the lower half
+of this range are the input-only GPIOs, the upper half are the outputs.
+We fix the GPIO directions to correspond to this mapping.
+
+This also fixes a bug when setting GPIOs - we were reading from the
+input register, making it impossible to set more than one output GPIO.
+
+Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Fixes: 7db47faae79b ("gpio: aspeed: Add SGPIO driver")
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/sgpio-aspeed.txt | 5 +-
+ drivers/gpio/gpio-aspeed-sgpio.c | 126 ++++++++++++------
+ 2 files changed, 87 insertions(+), 44 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/sgpio-aspeed.txt b/Documentation/devicetree/bindings/gpio/sgpio-aspeed.txt
+index d4d83916c09dd..be329ea4794f8 100644
+--- a/Documentation/devicetree/bindings/gpio/sgpio-aspeed.txt
++++ b/Documentation/devicetree/bindings/gpio/sgpio-aspeed.txt
+@@ -20,8 +20,9 @@ Required properties:
+ - gpio-controller : Marks the device node as a GPIO controller
+ - interrupts : Interrupt specifier, see interrupt-controller/interrupts.txt
+ - interrupt-controller : Mark the GPIO controller as an interrupt-controller
+-- ngpios : number of GPIO lines, see gpio.txt
+- (should be multiple of 8, up to 80 pins)
++- ngpios : number of *hardware* GPIO lines, see gpio.txt. This will expose
++ 2 software GPIOs per hardware GPIO: one for hardware input, one for hardware
++ output. Up to 80 pins, must be a multiple of 8.
+ - clocks : A phandle to the APB clock for SGPM clock division
+ - bus-frequency : SGPM CLK frequency
+
+diff --git a/drivers/gpio/gpio-aspeed-sgpio.c b/drivers/gpio/gpio-aspeed-sgpio.c
+index d16645c1d8d9d..5d678dbf1a621 100644
+--- a/drivers/gpio/gpio-aspeed-sgpio.c
++++ b/drivers/gpio/gpio-aspeed-sgpio.c
+@@ -17,7 +17,17 @@
+ #include <linux/spinlock.h>
+ #include <linux/string.h>
+
+-#define MAX_NR_SGPIO 80
++/*
++ * MAX_NR_HW_GPIO represents the number of actual hardware-supported GPIOs (ie,
++ * slots within the clocked serial GPIO data). Since each HW GPIO is both an
++ * input and an output, we provide MAX_NR_HW_GPIO * 2 lines on our gpiochip
++ * device.
++ *
++ * We use SGPIO_OUTPUT_OFFSET to define the split between the inputs and
++ * outputs; the inputs start at line 0, the outputs start at OUTPUT_OFFSET.
++ */
++#define MAX_NR_HW_SGPIO 80
++#define SGPIO_OUTPUT_OFFSET MAX_NR_HW_SGPIO
+
+ #define ASPEED_SGPIO_CTRL 0x54
+
+@@ -30,8 +40,8 @@ struct aspeed_sgpio {
+ struct clk *pclk;
+ spinlock_t lock;
+ void __iomem *base;
+- uint32_t dir_in[3];
+ int irq;
++ int n_sgpio;
+ };
+
+ struct aspeed_sgpio_bank {
+@@ -111,31 +121,69 @@ static void __iomem *bank_reg(struct aspeed_sgpio *gpio,
+ }
+ }
+
+-#define GPIO_BANK(x) ((x) >> 5)
+-#define GPIO_OFFSET(x) ((x) & 0x1f)
++#define GPIO_BANK(x) ((x % SGPIO_OUTPUT_OFFSET) >> 5)
++#define GPIO_OFFSET(x) ((x % SGPIO_OUTPUT_OFFSET) & 0x1f)
+ #define GPIO_BIT(x) BIT(GPIO_OFFSET(x))
+
+ static const struct aspeed_sgpio_bank *to_bank(unsigned int offset)
+ {
+- unsigned int bank = GPIO_BANK(offset);
++ unsigned int bank;
++
++ bank = GPIO_BANK(offset);
+
+ WARN_ON(bank >= ARRAY_SIZE(aspeed_sgpio_banks));
+ return &aspeed_sgpio_banks[bank];
+ }
+
++static int aspeed_sgpio_init_valid_mask(struct gpio_chip *gc,
++ unsigned long *valid_mask, unsigned int ngpios)
++{
++ struct aspeed_sgpio *sgpio = gpiochip_get_data(gc);
++ int n = sgpio->n_sgpio;
++ int c = SGPIO_OUTPUT_OFFSET - n;
++
++ WARN_ON(ngpios < MAX_NR_HW_SGPIO * 2);
++
++ /* input GPIOs in the lower range */
++ bitmap_set(valid_mask, 0, n);
++ bitmap_clear(valid_mask, n, c);
++
++ /* output GPIOS above SGPIO_OUTPUT_OFFSET */
++ bitmap_set(valid_mask, SGPIO_OUTPUT_OFFSET, n);
++ bitmap_clear(valid_mask, SGPIO_OUTPUT_OFFSET + n, c);
++
++ return 0;
++}
++
++static void aspeed_sgpio_irq_init_valid_mask(struct gpio_chip *gc,
++ unsigned long *valid_mask, unsigned int ngpios)
++{
++ struct aspeed_sgpio *sgpio = gpiochip_get_data(gc);
++ int n = sgpio->n_sgpio;
++
++ WARN_ON(ngpios < MAX_NR_HW_SGPIO * 2);
++
++ /* input GPIOs in the lower range */
++ bitmap_set(valid_mask, 0, n);
++ bitmap_clear(valid_mask, n, ngpios - n);
++}
++
++static bool aspeed_sgpio_is_input(unsigned int offset)
++{
++ return offset < SGPIO_OUTPUT_OFFSET;
++}
++
+ static int aspeed_sgpio_get(struct gpio_chip *gc, unsigned int offset)
+ {
+ struct aspeed_sgpio *gpio = gpiochip_get_data(gc);
+ const struct aspeed_sgpio_bank *bank = to_bank(offset);
+ unsigned long flags;
+ enum aspeed_sgpio_reg reg;
+- bool is_input;
+ int rc = 0;
+
+ spin_lock_irqsave(&gpio->lock, flags);
+
+- is_input = gpio->dir_in[GPIO_BANK(offset)] & GPIO_BIT(offset);
+- reg = is_input ? reg_val : reg_rdata;
++ reg = aspeed_sgpio_is_input(offset) ? reg_val : reg_rdata;
+ rc = !!(ioread32(bank_reg(gpio, bank, reg)) & GPIO_BIT(offset));
+
+ spin_unlock_irqrestore(&gpio->lock, flags);
+@@ -143,22 +191,31 @@ static int aspeed_sgpio_get(struct gpio_chip *gc, unsigned int offset)
+ return rc;
+ }
+
+-static void sgpio_set_value(struct gpio_chip *gc, unsigned int offset, int val)
++static int sgpio_set_value(struct gpio_chip *gc, unsigned int offset, int val)
+ {
+ struct aspeed_sgpio *gpio = gpiochip_get_data(gc);
+ const struct aspeed_sgpio_bank *bank = to_bank(offset);
+- void __iomem *addr;
++ void __iomem *addr_r, *addr_w;
+ u32 reg = 0;
+
+- addr = bank_reg(gpio, bank, reg_val);
+- reg = ioread32(addr);
++ if (aspeed_sgpio_is_input(offset))
++ return -EINVAL;
++
++ /* Since this is an output, read the cached value from rdata, then
++ * update val. */
++ addr_r = bank_reg(gpio, bank, reg_rdata);
++ addr_w = bank_reg(gpio, bank, reg_val);
++
++ reg = ioread32(addr_r);
+
+ if (val)
+ reg |= GPIO_BIT(offset);
+ else
+ reg &= ~GPIO_BIT(offset);
+
+- iowrite32(reg, addr);
++ iowrite32(reg, addr_w);
++
++ return 0;
+ }
+
+ static void aspeed_sgpio_set(struct gpio_chip *gc, unsigned int offset, int val)
+@@ -175,43 +232,28 @@ static void aspeed_sgpio_set(struct gpio_chip *gc, unsigned int offset, int val)
+
+ static int aspeed_sgpio_dir_in(struct gpio_chip *gc, unsigned int offset)
+ {
+- struct aspeed_sgpio *gpio = gpiochip_get_data(gc);
+- unsigned long flags;
+-
+- spin_lock_irqsave(&gpio->lock, flags);
+- gpio->dir_in[GPIO_BANK(offset)] |= GPIO_BIT(offset);
+- spin_unlock_irqrestore(&gpio->lock, flags);
+-
+- return 0;
++ return aspeed_sgpio_is_input(offset) ? 0 : -EINVAL;
+ }
+
+ static int aspeed_sgpio_dir_out(struct gpio_chip *gc, unsigned int offset, int val)
+ {
+ struct aspeed_sgpio *gpio = gpiochip_get_data(gc);
+ unsigned long flags;
++ int rc;
+
+- spin_lock_irqsave(&gpio->lock, flags);
+-
+- gpio->dir_in[GPIO_BANK(offset)] &= ~GPIO_BIT(offset);
+- sgpio_set_value(gc, offset, val);
++ /* No special action is required for setting the direction; we'll
++ * error-out in sgpio_set_value if this isn't an output GPIO */
+
++ spin_lock_irqsave(&gpio->lock, flags);
++ rc = sgpio_set_value(gc, offset, val);
+ spin_unlock_irqrestore(&gpio->lock, flags);
+
+- return 0;
++ return rc;
+ }
+
+ static int aspeed_sgpio_get_direction(struct gpio_chip *gc, unsigned int offset)
+ {
+- int dir_status;
+- struct aspeed_sgpio *gpio = gpiochip_get_data(gc);
+- unsigned long flags;
+-
+- spin_lock_irqsave(&gpio->lock, flags);
+- dir_status = gpio->dir_in[GPIO_BANK(offset)] & GPIO_BIT(offset);
+- spin_unlock_irqrestore(&gpio->lock, flags);
+-
+- return dir_status;
+-
++ return !!aspeed_sgpio_is_input(offset);
+ }
+
+ static void irqd_to_aspeed_sgpio_data(struct irq_data *d,
+@@ -402,6 +444,7 @@ static int aspeed_sgpio_setup_irqs(struct aspeed_sgpio *gpio,
+
+ irq = &gpio->chip.irq;
+ irq->chip = &aspeed_sgpio_irqchip;
++ irq->init_valid_mask = aspeed_sgpio_irq_init_valid_mask;
+ irq->handler = handle_bad_irq;
+ irq->default_type = IRQ_TYPE_NONE;
+ irq->parent_handler = aspeed_sgpio_irq_handler;
+@@ -452,11 +495,12 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ if (rc < 0) {
+ dev_err(&pdev->dev, "Could not read ngpios property\n");
+ return -EINVAL;
+- } else if (nr_gpios > MAX_NR_SGPIO) {
++ } else if (nr_gpios > MAX_NR_HW_SGPIO) {
+ dev_err(&pdev->dev, "Number of GPIOs exceeds the maximum of %d: %d\n",
+- MAX_NR_SGPIO, nr_gpios);
++ MAX_NR_HW_SGPIO, nr_gpios);
+ return -EINVAL;
+ }
++ gpio->n_sgpio = nr_gpios;
+
+ rc = of_property_read_u32(pdev->dev.of_node, "bus-frequency", &sgpio_freq);
+ if (rc < 0) {
+@@ -497,7 +541,8 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ spin_lock_init(&gpio->lock);
+
+ gpio->chip.parent = &pdev->dev;
+- gpio->chip.ngpio = nr_gpios;
++ gpio->chip.ngpio = MAX_NR_HW_SGPIO * 2;
++ gpio->chip.init_valid_mask = aspeed_sgpio_init_valid_mask;
+ gpio->chip.direction_input = aspeed_sgpio_dir_in;
+ gpio->chip.direction_output = aspeed_sgpio_dir_out;
+ gpio->chip.get_direction = aspeed_sgpio_get_direction;
+@@ -509,9 +554,6 @@ static int __init aspeed_sgpio_probe(struct platform_device *pdev)
+ gpio->chip.label = dev_name(&pdev->dev);
+ gpio->chip.base = -1;
+
+- /* set all SGPIO pins as input (1). */
+- memset(gpio->dir_in, 0xff, sizeof(gpio->dir_in));
+-
+ aspeed_sgpio_setup_irqs(gpio, pdev);
+
+ rc = devm_gpiochip_add_data(&pdev->dev, &gpio->chip, gpio);
+--
+2.25.1
+
--- /dev/null
+From 7b7628e7e4ef996e8244919e055b66b75ae3a976 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 17:20:13 +0300
+Subject: gpio: pca953x: Correctly initialize registers 6 and 7 for PCA957x
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 8c1f1c34777bddb633d4a068a9c812d29974c6bd ]
+
+When driver has been converted to the bitmap API the non-bitmap functions
+started behaving differently on 32-bit BE architectures since the bytes in
+two consequent unsigned longs are in different order in comparison to byte
+array. Hence if the chip had had more than 32 lines the memset() call over
+it would have not set up upper lines correctly.
+Although it's currently a theoretical case (no supported chips of this type
+has 32+ lines), it's better to provide a clean code to avoid people thinking
+this is okay and potentially producing not fully working things.
+
+Fixes: 35d13d94893f ("gpio: pca953x: convert to use bitmap API")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Link: https://lore.kernel.org/r/20200930142013.59247-2-andriy.shevchenko@linux.intel.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index cc95f1630feb0..11c3bbd105f11 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -938,6 +938,7 @@ static int device_pca95xx_init(struct pca953x_chip *chip, u32 invert)
+ static int device_pca957x_init(struct pca953x_chip *chip, u32 invert)
+ {
+ DECLARE_BITMAP(val, MAX_LINE);
++ unsigned int i;
+ int ret;
+
+ ret = device_pca95xx_init(chip, invert);
+@@ -945,7 +946,9 @@ static int device_pca957x_init(struct pca953x_chip *chip, u32 invert)
+ goto out;
+
+ /* To enable register 6, 7 to control pull up and pull down */
+- memset(val, 0x02, NBANK(chip));
++ for (i = 0; i < NBANK(chip); i++)
++ bitmap_set_value8(val, 0x02, i * BANK_SZ);
++
+ ret = pca953x_write_regs(chip, PCA957X_BKEN, val);
+ if (ret)
+ goto out;
+--
+2.25.1
+
--- /dev/null
+From 7ad9b714a9b85aaf4e0153e44ce5f4bc39b9b629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Sep 2020 02:03:44 -0700
+Subject: gpio: pca953x: Fix uninitialized pending variable
+
+From: Ye Li <ye.li@nxp.com>
+
+[ Upstream commit e43c26e12dd49a41cf5a4cd5c5b59a1eb98ed11e ]
+
+When pca953x_irq_pending returns false, the pending parameter won't
+be set. But pca953x_irq_handler continues using this uninitialized
+variable as pending irqs and will cause problem.
+Fix the issue by initializing pending to 0.
+
+Fixes: 064c73afe738 ("gpio: pca953x: Synchronize interrupt handler properly")
+Signed-off-by: Ye Li <ye.li@nxp.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index a3b9bdedbe443..cc95f1630feb0 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -813,7 +813,7 @@ static irqreturn_t pca953x_irq_handler(int irq, void *devid)
+ {
+ struct pca953x_chip *chip = devid;
+ struct gpio_chip *gc = &chip->gpio_chip;
+- DECLARE_BITMAP(pending, MAX_LINE);
++ DECLARE_BITMAP(pending, MAX_LINE) = {};
+ int level;
+ bool ret;
+
+--
+2.25.1
+
--- /dev/null
+From 40a00a031989c4287da0390739985d7d7bd51b27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 17:09:47 +0800
+Subject: gpio: sprd: Clear interrupt when setting the type as edge
+
+From: Taiping Lai <taiping.lai@unisoc.com>
+
+[ Upstream commit 5fcface659aab7eac4bd65dd116d98b8f7bb88d5 ]
+
+The raw interrupt status of GPIO maybe set before the interrupt is enabled,
+which would trigger the interrupt event once enabled it from user side.
+This is the case for edge interrupts only. Adding a clear operation when
+setting interrupt type can avoid that.
+
+There're a few considerations for the solution:
+1) This issue is for edge interrupt only; The interrupts requested by users
+ are IRQ_TYPE_LEVEL_HIGH as default, so clearing interrupt when request
+ is useless.
+2) The interrupt type can be set to edge when request and following up
+ with clearing it though, but the problem is still there once users set
+ the interrupt type to level trggier.
+3) We can add a clear operation after each time of setting interrupt
+ enable bit, but it is redundant for level trigger interrupt.
+
+Therefore, the solution is this patch seems the best for now.
+
+Fixes: 9a3821c2bb47 ("gpio: Add GPIO driver for Spreadtrum SC9860 platform")
+Signed-off-by: Taiping Lai <taiping.lai@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sprd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpio/gpio-sprd.c b/drivers/gpio/gpio-sprd.c
+index d7314d39ab65b..36ea8a3bd4510 100644
+--- a/drivers/gpio/gpio-sprd.c
++++ b/drivers/gpio/gpio-sprd.c
+@@ -149,17 +149,20 @@ static int sprd_gpio_irq_set_type(struct irq_data *data,
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IEV, 1);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_FALLING:
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IEV, 0);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IS, 0);
+ sprd_gpio_update(chip, offset, SPRD_GPIO_IBE, 1);
++ sprd_gpio_update(chip, offset, SPRD_GPIO_IC, 1);
+ irq_set_handler_locked(data, handle_edge_irq);
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+--
+2.25.1
+
--- /dev/null
+From 89c832515fa816d1e5d9bfe5cd3bbb6124c59bad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Sep 2020 15:58:16 +0300
+Subject: gpiolib: Fix line event handling in syscall compatible mode
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 5ad284ab3a01e2d6a89be2a8663ae76f4e617549 ]
+
+The introduced line event handling ABI in the commit
+
+ 61f922db7221 ("gpio: userspace ABI for reading GPIO line events")
+
+missed the fact that 64-bit kernel may serve for 32-bit applications.
+In such case the very first check in the lineevent_read() will fail
+due to alignment differences.
+
+To workaround this introduce lineevent_get_size() helper which returns actual
+size of the structure in user space.
+
+Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events")
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Tested-by: Kent Gibson <warthog618@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 4fa075d49fbc9..6e813b13d6988 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -836,6 +836,21 @@ static __poll_t lineevent_poll(struct file *filep,
+ return events;
+ }
+
++static ssize_t lineevent_get_size(void)
++{
++#ifdef __x86_64__
++ /* i386 has no padding after 'id' */
++ if (in_ia32_syscall()) {
++ struct compat_gpioeevent_data {
++ compat_u64 timestamp;
++ u32 id;
++ };
++
++ return sizeof(struct compat_gpioeevent_data);
++ }
++#endif
++ return sizeof(struct gpioevent_data);
++}
+
+ static ssize_t lineevent_read(struct file *filep,
+ char __user *buf,
+@@ -845,9 +860,20 @@ static ssize_t lineevent_read(struct file *filep,
+ struct lineevent_state *le = filep->private_data;
+ struct gpioevent_data ge;
+ ssize_t bytes_read = 0;
++ ssize_t ge_size;
+ int ret;
+
+- if (count < sizeof(ge))
++ /*
++ * When compatible system call is being used the struct gpioevent_data,
++ * in case of at least ia32, has different size due to the alignment
++ * differences. Because we have first member 64 bits followed by one of
++ * 32 bits there is no gap between them. The only difference is the
++ * padding at the end of the data structure. Hence, we calculate the
++ * actual sizeof() and pass this as an argument to copy_to_user() to
++ * drop unneeded bytes from the output.
++ */
++ ge_size = lineevent_get_size();
++ if (count < ge_size)
+ return -EINVAL;
+
+ do {
+@@ -883,10 +909,10 @@ static ssize_t lineevent_read(struct file *filep,
+ break;
+ }
+
+- if (copy_to_user(buf + bytes_read, &ge, sizeof(ge)))
++ if (copy_to_user(buf + bytes_read, &ge, ge_size))
+ return -EFAULT;
+- bytes_read += sizeof(ge);
+- } while (count >= bytes_read + sizeof(ge));
++ bytes_read += ge_size;
++ } while (count >= bytes_read + ge_size);
+
+ return bytes_read;
+ }
+--
+2.25.1
+
--- /dev/null
+From f83e5e2b6dd6a3ff03a2c433e1b28f7f440391da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Sep 2020 16:08:40 +0200
+Subject: i2c: cpm: Fix i2c_ram structure
+
+From: Nicolas VINCENT <nicolas.vincent@vossloh.com>
+
+[ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ]
+
+the i2c_ram structure is missing the sdmatmp field mentionned in
+datasheet for MPC8272 at paragraph 36.5. With this field missing, the
+hardware would write past the allocated memory done through
+cpm_muram_alloc for the i2c_ram structure and land in memory allocated
+for the buffers descriptors corrupting the cbd_bufaddr field. Since this
+field is only set during setup(), the first i2c transaction would work
+and the following would send data read from an arbitrary memory
+location.
+
+Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers")
+Signed-off-by: Nicolas VINCENT <nicolas.vincent@vossloh.com>
+Acked-by: Jochen Friedrich <jochen@scram.de>
+Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-cpm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
+index 1213e1932ccb5..24d584a1c9a78 100644
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -65,6 +65,9 @@ struct i2c_ram {
+ char res1[4]; /* Reserved */
+ ushort rpbase; /* Relocation pointer */
+ char res2[2]; /* Reserved */
++ /* The following elements are only for CPM2 */
++ char res3[4]; /* Reserved */
++ uint sdmatmp; /* Internal */
+ };
+
+ #define I2COM_START 0x80
+--
+2.25.1
+
--- /dev/null
+From 19255bcfc707e9801c32ffaca437740f6e6448a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Sep 2020 23:48:09 +0300
+Subject: i2c: npcm7xx: Clear LAST bit after a failed transaction.
+
+From: Tali Perry <tali.perry1@gmail.com>
+
+[ Upstream commit 8947efc077168c53b84d039881a7c967086a248a ]
+
+Due to a HW issue, in some scenarios the LAST bit might remain set.
+This will cause an unexpected NACK after reading 16 bytes on the next
+read.
+
+Example: if user tries to read from a missing device, get a NACK,
+then if the next command is a long read ( > 16 bytes),
+the master will stop reading after 16 bytes.
+To solve this, if a command fails, check if LAST bit is still
+set. If it does, reset the module.
+
+Fixes: 56a1485b102e (i2c: npcm7xx: Add Nuvoton NPCM I2C controller driver)
+Signed-off-by: Tali Perry <tali.perry1@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-npcm7xx.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-npcm7xx.c b/drivers/i2c/busses/i2c-npcm7xx.c
+index dfcf04e1967f1..2ad166355ec9b 100644
+--- a/drivers/i2c/busses/i2c-npcm7xx.c
++++ b/drivers/i2c/busses/i2c-npcm7xx.c
+@@ -2163,6 +2163,15 @@ static int npcm_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
+ if (bus->cmd_err == -EAGAIN)
+ ret = i2c_recover_bus(adap);
+
++ /*
++ * After any type of error, check if LAST bit is still set,
++ * due to a HW issue.
++ * It cannot be cleared without resetting the module.
++ */
++ if (bus->cmd_err &&
++ (NPCM_I2CRXF_CTL_LAST_PEC & ioread8(bus->reg + NPCM_I2CRXF_CTL)))
++ npcm_i2c_reset(bus);
++
+ #if IS_ENABLED(CONFIG_I2C_SLAVE)
+ /* reenable slave if it was enabled */
+ if (bus->slave)
+--
+2.25.1
+
--- /dev/null
+From dd0974966dbaf99599f9f16ccc1cb70c1d805a59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 16:19:05 -0700
+Subject: Input: trackpoint - enable Synaptics trackpoints
+
+From: Vincent Huang <vincent.huang@tw.synaptics.com>
+
+[ Upstream commit 996d585b079ad494a30cac10e08585bcd5345125 ]
+
+Add Synaptics IDs in trackpoint_start_protocol() to mark them as valid.
+
+Signed-off-by: Vincent Huang <vincent.huang@tw.synaptics.com>
+Fixes: 6c77545af100 ("Input: trackpoint - add new trackpoint variant IDs")
+Reviewed-by: Harry Cutts <hcutts@chromium.org>
+Tested-by: Harry Cutts <hcutts@chromium.org>
+Link: https://lore.kernel.org/r/20200924053013.1056953-1-vincent.huang@tw.synaptics.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/trackpoint.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
+index 854d5e7587241..ef2fa0905208d 100644
+--- a/drivers/input/mouse/trackpoint.c
++++ b/drivers/input/mouse/trackpoint.c
+@@ -282,6 +282,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse,
+ case TP_VARIANT_ALPS:
+ case TP_VARIANT_ELAN:
+ case TP_VARIANT_NXP:
++ case TP_VARIANT_JYT_SYNAPTICS:
++ case TP_VARIANT_SYNAPTICS:
+ if (variant_id)
+ *variant_id = param[0];
+ if (firmware_id)
+--
+2.25.1
+
--- /dev/null
+From 036e8dcfdfc4c20a19edff5c9508925e8da1037c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Sep 2020 18:26:02 +0800
+Subject: iommu/amd: Fix the overwritten field in IVMD header
+
+From: Adrian Huang <ahuang12@lenovo.com>
+
+[ Upstream commit 0bbe4ced53e36786eafc2ecbf9a1761f55b4a82e ]
+
+Commit 387caf0b759a ("iommu/amd: Treat per-device exclusion
+ranges as r/w unity-mapped regions") accidentally overwrites
+the 'flags' field in IVMD (struct ivmd_header) when the I/O
+virtualization memory definition is associated with the
+exclusion range entry. This leads to the corrupted IVMD table
+(incorrect checksum). The kdump kernel reports the invalid checksum:
+
+ACPI BIOS Warning (bug): Incorrect checksum in table [IVRS] - 0x5C, should be 0x60 (20200717/tbprint-177)
+AMD-Vi: [Firmware Bug]: IVRS invalid checksum
+
+Fix the above-mentioned issue by modifying the 'struct unity_map_entry'
+member instead of the IVMD header.
+
+Cleanup: The *exclusion_range* functions are not used anymore, so
+get rid of them.
+
+Fixes: 387caf0b759a ("iommu/amd: Treat per-device exclusion ranges as r/w unity-mapped regions")
+Reported-and-tested-by: Baoquan He <bhe@redhat.com>
+Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
+Cc: Jerry Snitselaar <jsnitsel@redhat.com>
+Link: https://lore.kernel.org/r/20200926102602.19177-1-adrianhuang0701@gmail.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 56 +++++++---------------------------------
+ 1 file changed, 10 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index bf45f8e2c7edd..016e35d3d6c86 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1110,25 +1110,6 @@ static int __init add_early_maps(void)
+ return 0;
+ }
+
+-/*
+- * Reads the device exclusion range from ACPI and initializes the IOMMU with
+- * it
+- */
+-static void __init set_device_exclusion_range(u16 devid, struct ivmd_header *m)
+-{
+- if (!(m->flags & IVMD_FLAG_EXCL_RANGE))
+- return;
+-
+- /*
+- * Treat per-device exclusion ranges as r/w unity-mapped regions
+- * since some buggy BIOSes might lead to the overwritten exclusion
+- * range (exclusion_start and exclusion_length members). This
+- * happens when there are multiple exclusion ranges (IVMD entries)
+- * defined in ACPI table.
+- */
+- m->flags = (IVMD_FLAG_IW | IVMD_FLAG_IR | IVMD_FLAG_UNITY_MAP);
+-}
+-
+ /*
+ * Takes a pointer to an AMD IOMMU entry in the ACPI table and
+ * initializes the hardware and our data structures with it.
+@@ -2080,30 +2061,6 @@ static void __init free_unity_maps(void)
+ }
+ }
+
+-/* called when we find an exclusion range definition in ACPI */
+-static int __init init_exclusion_range(struct ivmd_header *m)
+-{
+- int i;
+-
+- switch (m->type) {
+- case ACPI_IVMD_TYPE:
+- set_device_exclusion_range(m->devid, m);
+- break;
+- case ACPI_IVMD_TYPE_ALL:
+- for (i = 0; i <= amd_iommu_last_bdf; ++i)
+- set_device_exclusion_range(i, m);
+- break;
+- case ACPI_IVMD_TYPE_RANGE:
+- for (i = m->devid; i <= m->aux; ++i)
+- set_device_exclusion_range(i, m);
+- break;
+- default:
+- break;
+- }
+-
+- return 0;
+-}
+-
+ /* called for unity map ACPI definition */
+ static int __init init_unity_map_range(struct ivmd_header *m)
+ {
+@@ -2114,9 +2071,6 @@ static int __init init_unity_map_range(struct ivmd_header *m)
+ if (e == NULL)
+ return -ENOMEM;
+
+- if (m->flags & IVMD_FLAG_EXCL_RANGE)
+- init_exclusion_range(m);
+-
+ switch (m->type) {
+ default:
+ kfree(e);
+@@ -2140,6 +2094,16 @@ static int __init init_unity_map_range(struct ivmd_header *m)
+ e->address_end = e->address_start + PAGE_ALIGN(m->range_length);
+ e->prot = m->flags >> 1;
+
++ /*
++ * Treat per-device exclusion ranges as r/w unity-mapped regions
++ * since some buggy BIOSes might lead to the overwritten exclusion
++ * range (exclusion_start and exclusion_length members). This
++ * happens when there are multiple exclusion ranges (IVMD entries)
++ * defined in ACPI table.
++ */
++ if (m->flags & IVMD_FLAG_EXCL_RANGE)
++ e->prot = (IVMD_FLAG_IW | IVMD_FLAG_IR) >> 1;
++
+ DUMP_printk("%s devid_start: %02x:%02x.%x devid_end: %02x:%02x.%x"
+ " range_start: %016llx range_end: %016llx flags: %x\n", s,
+ PCI_BUS_NUM(e->devid_start), PCI_SLOT(e->devid_start),
+--
+2.25.1
+
--- /dev/null
+From 739c00788805742beb2e82041578e6fd22b035d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Sep 2020 09:13:35 +0800
+Subject: iommu/exynos: add missing put_device() call in
+ exynos_iommu_of_xlate()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 1a26044954a6d1f4d375d5e62392446af663be7a ]
+
+if of_find_device_by_node() succeed, exynos_iommu_of_xlate() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20200918011335.909141-1-yukuai3@huawei.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/exynos-iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
+index 60c8a56e4a3f8..89f628da148ac 100644
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -1295,13 +1295,17 @@ static int exynos_iommu_of_xlate(struct device *dev,
+ return -ENODEV;
+
+ data = platform_get_drvdata(sysmmu);
+- if (!data)
++ if (!data) {
++ put_device(&sysmmu->dev);
+ return -ENODEV;
++ }
+
+ if (!owner) {
+ owner = kzalloc(sizeof(*owner), GFP_KERNEL);
+- if (!owner)
++ if (!owner) {
++ put_device(&sysmmu->dev);
+ return -ENOMEM;
++ }
+
+ INIT_LIST_HEAD(&owner->controllers);
+ mutex_init(&owner->rpm_lock);
+--
+2.25.1
+
--- /dev/null
+From aefb4f2b445166d08554edcc6893e4680c9608b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Sep 2020 16:42:52 -0500
+Subject: nfs: Fix security label length not being reset
+
+From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+
+[ Upstream commit d33030e2ee3508d65db5644551435310df86010e ]
+
+nfs_readdir_page_filler() iterates over entries in a directory, reusing
+the same security label buffer, but does not reset the buffer's length.
+This causes decode_attr_security_label() to return -ERANGE if an entry's
+security label is longer than the previous one's. This error, in
+nfs4_decode_dirent(), only gets passed up as -EAGAIN, which causes another
+failed attempt to copy into the buffer. The second error is ignored and
+the remaining entries do not show up in ls, specifically the getdents64()
+syscall.
+
+Reproduce by creating multiple files in NFS and giving one of the later
+files a longer security label. ls will not see that file nor any that are
+added afterwards, though they will exist on the backend.
+
+In nfs_readdir_page_filler(), reset security label buffer length before
+every reuse
+
+Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/dir.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 5a331da5f55ad..785f46217f11a 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -579,6 +579,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
+ xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
+
+ do {
++ if (entry->label)
++ entry->label->len = NFS4_MAXLABELLEN;
++
+ status = xdr_decode(desc, entry, &stream);
+ if (status != 0) {
+ if (status == -EAGAIN)
+--
+2.25.1
+
--- /dev/null
+From b77ede4c5fbb3bb6b1c26d88a909aa9109ce160d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Sep 2020 09:07:54 -0400
+Subject: NFSv4.2: fix client's attribute cache management for copy_file_range
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 16abd2a0c124a6c3543c88ca4c53c997c9fb4114 ]
+
+After client is done with the COPY operation, it needs to invalidate
+its pagecache (as it did no reading or writing of the data locally)
+and it needs to invalidate it's attributes just like it would have
+for a read on the source file and write on the destination file.
+
+Once the linux server started giving out read delegations to
+read+write opens, the destination file of the copy_file range
+started having delegations and not doing syncup on close of the
+file leading to xfstest failures for generic/430,431,432,433,565.
+
+v2: changing cache_validity needs to be protected by the i_lock.
+
+Reported-by: Murphy Zhou <jencce.kernel@gmail.com>
+Fixes: 2e72448b07dc ("NFS: Add COPY nfs operation")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42proc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index e2ae54b35dfe1..395a468e349b0 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -355,7 +355,15 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+
+ truncate_pagecache_range(dst_inode, pos_dst,
+ pos_dst + res->write_res.count);
+-
++ spin_lock(&dst_inode->i_lock);
++ NFS_I(dst_inode)->cache_validity |= (NFS_INO_REVAL_PAGECACHE |
++ NFS_INO_REVAL_FORCED | NFS_INO_INVALID_SIZE |
++ NFS_INO_INVALID_ATTR | NFS_INO_INVALID_DATA);
++ spin_unlock(&dst_inode->i_lock);
++ spin_lock(&src_inode->i_lock);
++ NFS_I(src_inode)->cache_validity |= (NFS_INO_REVAL_PAGECACHE |
++ NFS_INO_REVAL_FORCED | NFS_INO_INVALID_ATIME);
++ spin_unlock(&src_inode->i_lock);
+ status = res->write_res.count;
+ out:
+ if (args->sync)
+--
+2.25.1
+
--- /dev/null
+From b111f738a0961453c06c67c136859653b26a747a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Sep 2020 15:46:48 +0300
+Subject: phy: ti: am654: Fix a leak in serdes_am654_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 850280156f6421a404f2351bee07a0e7bedfd4c6 ]
+
+If devm_phy_create() fails then we need to call of_clk_del_provider(node)
+to undo the call to of_clk_add_provider().
+
+Fixes: 71e2f5c5c224 ("phy: ti: Add a new SERDES driver for TI's AM654x SoC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200905124648.GA183976@mwanda
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-am654-serdes.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-am654-serdes.c b/drivers/phy/ti/phy-am654-serdes.c
+index a174b3c3f010f..819c49af169ac 100644
+--- a/drivers/phy/ti/phy-am654-serdes.c
++++ b/drivers/phy/ti/phy-am654-serdes.c
+@@ -725,8 +725,10 @@ static int serdes_am654_probe(struct platform_device *pdev)
+ pm_runtime_enable(dev);
+
+ phy = devm_phy_create(dev, NULL, &ops);
+- if (IS_ERR(phy))
+- return PTR_ERR(phy);
++ if (IS_ERR(phy)) {
++ ret = PTR_ERR(phy);
++ goto clk_err;
++ }
+
+ phy_set_drvdata(phy, am654_phy);
+ phy_provider = devm_of_phy_provider_register(dev, serdes_am654_xlate);
+--
+2.25.1
+
--- /dev/null
+From 502ff0adb30168e85ea3b9893026eddc27a7e1b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 19:22:25 +0800
+Subject: pinctrl: mediatek: check mtk_is_virt_gpio input parameter
+
+From: Hanks Chen <hanks.chen@mediatek.com>
+
+[ Upstream commit 39c4dbe4cc363accd676162c24b264f44c581490 ]
+
+check mtk_is_virt_gpio input parameter,
+virtual gpio need to support eint mode.
+
+add error handler for the ko case
+to fix this boot fail:
+pc : mtk_is_virt_gpio+0x20/0x38 [pinctrl_mtk_common_v2]
+lr : mtk_gpio_get_direction+0x44/0xb0 [pinctrl_paris]
+
+Fixes: edd546465002 ("pinctrl: mediatek: avoid virtual gpio trying to set reg")
+Signed-off-by: Hanks Chen <hanks.chen@mediatek.com>
+Acked-by: Sean Wang <sean.wang@kernel.org>
+Singed-off-by: Jie Yang <sin_jieyang@mediatek.com>
+Link: https://lore.kernel.org/r/1597922546-29633-1-git-send-email-hanks.chen@mediatek.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+index 2f3dfb56c3fa4..35bbe59357088 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
+@@ -259,6 +259,10 @@ bool mtk_is_virt_gpio(struct mtk_pinctrl *hw, unsigned int gpio_n)
+
+ desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio_n];
+
++ /* if the GPIO is not supported for eint mode */
++ if (desc->eint.eint_m == NO_EINT_SUPPORT)
++ return virt_gpio;
++
+ if (desc->funcs && !desc->funcs[desc->eint.eint_m].name)
+ virt_gpio = true;
+
+--
+2.25.1
+
--- /dev/null
+From 4b3f952e26d6da6a6b6e09a9f91416943da8f258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 09:17:10 +1200
+Subject: pinctrl: mvebu: Fix i2c sda definition for 98DX3236
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 63c3212e7a37d68c89a13bdaebce869f4e064e67 ]
+
+Per the datasheet the i2c functions use MPP_Sel=0x1. They are documented
+as using MPP_Sel=0x4 as well but mixing 0x1 and 0x4 is clearly wrong. On
+the board tested 0x4 resulted in a non-functioning i2c bus so stick with
+0x1 which works.
+
+Fixes: d7ae8f8dee7f ("pinctrl: mvebu: pinctrl driver for 98DX3236 SoC")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20200907211712.9697-2-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-xp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+index a767a05fa3a0d..48e2a6c56a83b 100644
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
+@@ -414,7 +414,7 @@ static struct mvebu_mpp_mode mv98dx3236_mpp_modes[] = {
+ MPP_VAR_FUNCTION(0x1, "i2c0", "sck", V_98DX3236_PLUS)),
+ MPP_MODE(15,
+ MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_98DX3236_PLUS),
+- MPP_VAR_FUNCTION(0x4, "i2c0", "sda", V_98DX3236_PLUS)),
++ MPP_VAR_FUNCTION(0x1, "i2c0", "sda", V_98DX3236_PLUS)),
+ MPP_MODE(16,
+ MPP_VAR_FUNCTION(0x0, "gpo", NULL, V_98DX3236_PLUS),
+ MPP_VAR_FUNCTION(0x4, "dev", "oe", V_98DX3236_PLUS)),
+--
+2.25.1
+
--- /dev/null
+From 2db57467da7a86189a63f2c7a8a940c2239d234d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Sep 2020 12:18:46 +0300
+Subject: pinctrl: qcom: sm8250: correct sdc2_clk
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5d8ff95a52c36740bf4e61202d08549e7a9caf20 ]
+
+Correct sdc2_clk pin definition (register offset is wrong, verified by
+the msm-4.19 driver).
+
+Fixes: 4e3ec9e407ad ("pinctrl: qcom: Add sm8250 pinctrl driver.")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20200914091846.55204-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-sm8250.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-sm8250.c b/drivers/pinctrl/qcom/pinctrl-sm8250.c
+index a660f1274b667..826df0d637eaa 100644
+--- a/drivers/pinctrl/qcom/pinctrl-sm8250.c
++++ b/drivers/pinctrl/qcom/pinctrl-sm8250.c
+@@ -1308,7 +1308,7 @@ static const struct msm_pingroup sm8250_groups[] = {
+ [178] = PINGROUP(178, WEST, _, _, _, _, _, _, _, _, _),
+ [179] = PINGROUP(179, WEST, _, _, _, _, _, _, _, _, _),
+ [180] = UFS_RESET(ufs_reset, 0xb8000),
+- [181] = SDC_PINGROUP(sdc2_clk, 0x7000, 14, 6),
++ [181] = SDC_PINGROUP(sdc2_clk, 0xb7000, 14, 6),
+ [182] = SDC_PINGROUP(sdc2_cmd, 0xb7000, 11, 3),
+ [183] = SDC_PINGROUP(sdc2_data, 0xb7000, 9, 0),
+ };
+--
+2.25.1
+
--- /dev/null
+From 3ae5673bc9fe44156ab95b3c07d79fe29d02d141 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 19:14:36 -0700
+Subject: pipe: remove pipe_wait() and fix wakeup race with splice
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 472e5b056f000a778abb41f1e443de58eb259783 ]
+
+The pipe splice code still used the old model of waiting for pipe IO by
+using a non-specific "pipe_wait()" that waited for any pipe event to
+happen, which depended on all pipe IO being entirely serialized by the
+pipe lock. So by checking the state you were waiting for, and then
+adding yourself to the wait queue before dropping the lock, you were
+guaranteed to see all the wakeups.
+
+Strictly speaking, the actual wakeups were not done under the lock, but
+the pipe_wait() model still worked, because since the waiter held the
+lock when checking whether it should sleep, it would always see the
+current state, and the wakeup was always done after updating the state.
+
+However, commit 0ddad21d3e99 ("pipe: use exclusive waits when reading or
+writing") split the single wait-queue into two, and in the process also
+made the "wait for event" code wait for _two_ wait queues, and that then
+showed a race with the wakers that were not serialized by the pipe lock.
+
+It's only splice that used that "pipe_wait()" model, so the problem
+wasn't obvious, but Josef Bacik reports:
+
+ "I hit a hang with fstest btrfs/187, which does a btrfs send into
+ /dev/null. This works by creating a pipe, the write side is given to
+ the kernel to write into, and the read side is handed to a thread that
+ splices into a file, in this case /dev/null.
+
+ The box that was hung had the write side stuck here [pipe_write] and
+ the read side stuck here [splice_from_pipe_next -> pipe_wait].
+
+ [ more details about pipe_wait() scenario ]
+
+ The problem is we're doing the prepare_to_wait, which sets our state
+ each time, however we can be woken up either with reads or writes. In
+ the case above we race with the WRITER waking us up, and re-set our
+ state to INTERRUPTIBLE, and thus never break out of schedule"
+
+Josef had a patch that avoided the issue in pipe_wait() by just making
+it set the state only once, but the deeper problem is that pipe_wait()
+depends on a level of synchonization by the pipe mutex that it really
+shouldn't. And the whole "wait for any pipe state change" model really
+isn't very good to begin with.
+
+So rather than trying to work around things in pipe_wait(), remove that
+legacy model of "wait for arbitrary pipe event" entirely, and actually
+create functions that wait for the pipe actually being readable or
+writable, and can do so without depending on the pipe lock serializing
+everything.
+
+Fixes: 0ddad21d3e99 ("pipe: use exclusive waits when reading or writing")
+Link: https://lore.kernel.org/linux-fsdevel/bfa88b5ad6f069b2b679316b9e495a970130416c.1601567868.git.josef@toxicpanda.com/
+Reported-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-and-tested-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pipe.c | 62 ++++++++++++++++++++++++++-------------
+ fs/splice.c | 8 ++---
+ include/linux/pipe_fs_i.h | 5 ++--
+ 3 files changed, 48 insertions(+), 27 deletions(-)
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 60dbee4571436..117db82b10af5 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -106,25 +106,6 @@ void pipe_double_lock(struct pipe_inode_info *pipe1,
+ }
+ }
+
+-/* Drop the inode semaphore and wait for a pipe event, atomically */
+-void pipe_wait(struct pipe_inode_info *pipe)
+-{
+- DEFINE_WAIT(rdwait);
+- DEFINE_WAIT(wrwait);
+-
+- /*
+- * Pipes are system-local resources, so sleeping on them
+- * is considered a noninteractive wait:
+- */
+- prepare_to_wait(&pipe->rd_wait, &rdwait, TASK_INTERRUPTIBLE);
+- prepare_to_wait(&pipe->wr_wait, &wrwait, TASK_INTERRUPTIBLE);
+- pipe_unlock(pipe);
+- schedule();
+- finish_wait(&pipe->rd_wait, &rdwait);
+- finish_wait(&pipe->wr_wait, &wrwait);
+- pipe_lock(pipe);
+-}
+-
+ static void anon_pipe_buf_release(struct pipe_inode_info *pipe,
+ struct pipe_buffer *buf)
+ {
+@@ -1035,12 +1016,52 @@ SYSCALL_DEFINE1(pipe, int __user *, fildes)
+ return do_pipe2(fildes, 0);
+ }
+
++/*
++ * This is the stupid "wait for pipe to be readable or writable"
++ * model.
++ *
++ * See pipe_read/write() for the proper kind of exclusive wait,
++ * but that requires that we wake up any other readers/writers
++ * if we then do not end up reading everything (ie the whole
++ * "wake_next_reader/writer" logic in pipe_read/write()).
++ */
++void pipe_wait_readable(struct pipe_inode_info *pipe)
++{
++ pipe_unlock(pipe);
++ wait_event_interruptible(pipe->rd_wait, pipe_readable(pipe));
++ pipe_lock(pipe);
++}
++
++void pipe_wait_writable(struct pipe_inode_info *pipe)
++{
++ pipe_unlock(pipe);
++ wait_event_interruptible(pipe->wr_wait, pipe_writable(pipe));
++ pipe_lock(pipe);
++}
++
++/*
++ * This depends on both the wait (here) and the wakeup (wake_up_partner)
++ * holding the pipe lock, so "*cnt" is stable and we know a wakeup cannot
++ * race with the count check and waitqueue prep.
++ *
++ * Normally in order to avoid races, you'd do the prepare_to_wait() first,
++ * then check the condition you're waiting for, and only then sleep. But
++ * because of the pipe lock, we can check the condition before being on
++ * the wait queue.
++ *
++ * We use the 'rd_wait' waitqueue for pipe partner waiting.
++ */
+ static int wait_for_partner(struct pipe_inode_info *pipe, unsigned int *cnt)
+ {
++ DEFINE_WAIT(rdwait);
+ int cur = *cnt;
+
+ while (cur == *cnt) {
+- pipe_wait(pipe);
++ prepare_to_wait(&pipe->rd_wait, &rdwait, TASK_INTERRUPTIBLE);
++ pipe_unlock(pipe);
++ schedule();
++ finish_wait(&pipe->rd_wait, &rdwait);
++ pipe_lock(pipe);
+ if (signal_pending(current))
+ break;
+ }
+@@ -1050,7 +1071,6 @@ static int wait_for_partner(struct pipe_inode_info *pipe, unsigned int *cnt)
+ static void wake_up_partner(struct pipe_inode_info *pipe)
+ {
+ wake_up_interruptible_all(&pipe->rd_wait);
+- wake_up_interruptible_all(&pipe->wr_wait);
+ }
+
+ static int fifo_open(struct inode *inode, struct file *filp)
+diff --git a/fs/splice.c b/fs/splice.c
+index d7c8a7c4db07f..c3d00dfc73446 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -563,7 +563,7 @@ static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_des
+ sd->need_wakeup = false;
+ }
+
+- pipe_wait(pipe);
++ pipe_wait_readable(pipe);
+ }
+
+ return 1;
+@@ -1077,7 +1077,7 @@ static int wait_for_space(struct pipe_inode_info *pipe, unsigned flags)
+ return -EAGAIN;
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+- pipe_wait(pipe);
++ pipe_wait_writable(pipe);
+ }
+ }
+
+@@ -1454,7 +1454,7 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+ ret = -EAGAIN;
+ break;
+ }
+- pipe_wait(pipe);
++ pipe_wait_readable(pipe);
+ }
+
+ pipe_unlock(pipe);
+@@ -1493,7 +1493,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+ ret = -ERESTARTSYS;
+ break;
+ }
+- pipe_wait(pipe);
++ pipe_wait_writable(pipe);
+ }
+
+ pipe_unlock(pipe);
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 50afd0d0084ca..5d2705f1d01c3 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -240,8 +240,9 @@ extern unsigned int pipe_max_size;
+ extern unsigned long pipe_user_pages_hard;
+ extern unsigned long pipe_user_pages_soft;
+
+-/* Drop the inode semaphore and wait for a pipe event, atomically */
+-void pipe_wait(struct pipe_inode_info *pipe);
++/* Wait for a pipe to be readable/writable while dropping the pipe lock */
++void pipe_wait_readable(struct pipe_inode_info *);
++void pipe_wait_writable(struct pipe_inode_info *);
+
+ struct pipe_inode_info *alloc_pipe_info(void);
+ void free_pipe_info(struct pipe_inode_info *);
+--
+2.25.1
+
--- /dev/null
+From 0ba3076fe72edc7fc01e2644b862bf763933f345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Sep 2020 08:58:58 -0400
+Subject: pNFS/flexfiles: Ensure we initialise the mirror bsizes correctly on
+ read
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit ee15c7b53e52fb04583f734461244c4dcca828fa ]
+
+While it is true that reading from an unmirrored source always uses
+index 0, that is no longer true for mirrored sources when we fail over.
+
+Fixes: 563c53e73b8b ("NFS: Fix flexfiles read failover")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 048272d60a165..f9348ed1bcdad 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -838,6 +838,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
+ struct nfs4_ff_layout_mirror *mirror;
+ struct nfs4_pnfs_ds *ds;
+ int ds_idx;
++ u32 i;
+
+ retry:
+ ff_layout_pg_check_layout(pgio, req);
+@@ -864,14 +865,14 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
+ goto retry;
+ }
+
+- mirror = FF_LAYOUT_COMP(pgio->pg_lseg, ds_idx);
++ for (i = 0; i < pgio->pg_mirror_count; i++) {
++ mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i);
++ pgm = &pgio->pg_mirrors[i];
++ pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize;
++ }
+
+ pgio->pg_mirror_idx = ds_idx;
+
+- /* read always uses only one mirror - idx 0 for pgio layer */
+- pgm = &pgio->pg_mirrors[0];
+- pgm->pg_bsize = mirror->mirror_ds->ds_versions[0].rsize;
+-
+ if (NFS_SERVER(pgio->pg_inode)->flags &
+ (NFS_MOUNT_SOFT|NFS_MOUNT_SOFTERR))
+ pgio->pg_maxretrans = io_maxretrans;
+--
+2.25.1
+
--- /dev/null
+From 6edc5dce13e490c4f6d3415066b2659bb7afb900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Oct 2020 17:16:11 +0200
+Subject: random32: Restore __latent_entropy attribute on net_rand_state
+
+From: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+
+[ Upstream commit 09a6b0bc3be793ca8cba580b7992d73e9f68f15d ]
+
+Commit f227e3ec3b5c ("random32: update the net random state on interrupt
+and activity") broke compilation and was temporarily fixed by Linus in
+83bdc7275e62 ("random32: remove net_rand_state from the latent entropy
+gcc plugin") by entirely moving net_rand_state out of the things handled
+by the latent_entropy GCC plugin.
+
+From what I understand when reading the plugin code, using the
+__latent_entropy attribute on a declaration was the wrong part and
+simply keeping the __latent_entropy attribute on the variable definition
+was the correct fix.
+
+Fixes: 83bdc7275e62 ("random32: remove net_rand_state from the latent entropy gcc plugin")
+Acked-by: Willy Tarreau <w@1wt.eu>
+Cc: Emese Revfy <re.emese@gmail.com>
+Signed-off-by: Thibaut Sautereau <thibaut.sautereau@ssi.gouv.fr>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/random32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/random32.c b/lib/random32.c
+index 3d749abb9e80d..1786f78bf4c53 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void)
+ }
+ #endif
+
+-DEFINE_PER_CPU(struct rnd_state, net_rand_state);
++DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
+ /**
+ * prandom_u32_state - seeded pseudo-random number generator.
+--
+2.25.1
+
--- /dev/null
+From af1ae30a8e2442d991c3d36fb475ade0e097a048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Sep 2020 16:39:22 +0200
+Subject: scripts/dtc: only append to HOST_EXTRACFLAGS instead of overwriting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit efe84d408bf41975db8506d3a1cc02e794e2309c ]
+
+When building with
+
+ $ HOST_EXTRACFLAGS=-g make
+
+the expectation is that host tools are built with debug informations.
+This however doesn't happen if the Makefile assigns a new value to the
+HOST_EXTRACFLAGS instead of appending to it. So use += instead of := for
+the first assignment.
+
+Fixes: e3fd9b5384f3 ("scripts/dtc: consolidate include path options in Makefile")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/dtc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile
+index 0b44917f981c7..d4129e0275e4a 100644
+--- a/scripts/dtc/Makefile
++++ b/scripts/dtc/Makefile
+@@ -10,7 +10,7 @@ dtc-objs := dtc.o flattree.o fstree.o data.o livetree.o treesource.o \
+ dtc-objs += dtc-lexer.lex.o dtc-parser.tab.o
+
+ # Source files need to get at the userspace version of libfdt_env.h to compile
+-HOST_EXTRACFLAGS := -I $(srctree)/$(src)/libfdt
++HOST_EXTRACFLAGS += -I $(srctree)/$(src)/libfdt
+
+ ifeq ($(shell pkg-config --exists yaml-0.1 2>/dev/null && echo yes),)
+ ifneq ($(CHECK_DT_BINDING)$(CHECK_DTBS),)
+--
+2.25.1
+
--- /dev/null
+From 71e7f28f77c0dc04156cb6a3cd0f204216ac89d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Sep 2020 23:54:31 +0000
+Subject: scsi: target: Fix lun lookup for TARGET_SCF_LOOKUP_LUN_FROM_TAG case
+
+From: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
+
+[ Upstream commit 149415586243bd0ea729760fb6dd7b3c50601871 ]
+
+transport_lookup_tmr_lun() uses "orig_fe_lun" member of struct se_cmd for
+the lookup. Hence, update this field directly for the
+TARGET_SCF_LOOKUP_LUN_FROM_TAG case.
+
+Link: https://lore.kernel.org/r/1600300471-26135-1-git-send-email-sudhakar.panneerselvam@oracle.com
+Fixes: a36840d80027 ("target: Initialize LUN in transport_init_se_cmd()")
+Reported-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Sudhakar Panneerselvam <sudhakar.panneerselvam@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index e6e1fa68de542..94f4f05b5002c 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1840,7 +1840,8 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
+ * out unpacked_lun for the original se_cmd.
+ */
+ if (tm_type == TMR_ABORT_TASK && (flags & TARGET_SCF_LOOKUP_LUN_FROM_TAG)) {
+- if (!target_lookup_lun_from_tag(se_sess, tag, &unpacked_lun))
++ if (!target_lookup_lun_from_tag(se_sess, tag,
++ &se_cmd->orig_fe_lun))
+ goto failure;
+ }
+
+--
+2.25.1
+
nvme-pci-fix-null-req-in-completion-handler.patch
nvme-fc-fail-new-connections-to-a-deleted-host-or-re.patch
scripts-kallsyms-skip-ppc-compiler-stub-.long_branch.patch
+gpio-sprd-clear-interrupt-when-setting-the-type-as-e.patch
+phy-ti-am654-fix-a-leak-in-serdes_am654_probe.patch
+pinctrl-mvebu-fix-i2c-sda-definition-for-98dx3236.patch
+nfs-fix-security-label-length-not-being-reset.patch
+nfsv4.2-fix-client-s-attribute-cache-management-for-.patch
+pnfs-flexfiles-ensure-we-initialise-the-mirror-bsize.patch
+clk-tegra-always-program-pll_e-when-enabled.patch
+clk-tegra-fix-missing-prototype-for-tegra210_clk_reg.patch
+dmaengine-dmatest-prevent-to-run-on-misconfigured-ch.patch
+clk-samsung-exynos4-mark-chipid-clock-as-clk_ignore_.patch
+scsi-target-fix-lun-lookup-for-target_scf_lookup_lun.patch
+iommu-exynos-add-missing-put_device-call-in-exynos_i.patch
+gpio-pca953x-fix-uninitialized-pending-variable.patch
+gpio-aspeed-sgpio-enable-access-to-all-80-input-outp.patch
+gpio-aspeed-sgpio-don-t-enable-all-interrupts-by-def.patch
+gpio-aspeed-fix-ast2600-bank-properties.patch
+i2c-cpm-fix-i2c_ram-structure.patch
+i2c-npcm7xx-clear-last-bit-after-a-failed-transactio.patch
+input-trackpoint-enable-synaptics-trackpoints.patch
+blk-mq-call-commit_rqs-while-list-empty-but-error-ha.patch
+scripts-dtc-only-append-to-host_extracflags-instead-.patch
+autofs-use-__kernel_write-for-the-autofs-pipe-writin.patch
+pinctrl-qcom-sm8250-correct-sdc2_clk.patch
+pinctrl-mediatek-check-mtk_is_virt_gpio-input-parame.patch
+gpio-pca953x-correctly-initialize-registers-6-and-7-.patch
+iommu-amd-fix-the-overwritten-field-in-ivmd-header.patch
+pipe-remove-pipe_wait-and-fix-wakeup-race-with-splic.patch
+random32-restore-__latent_entropy-attribute-on-net_r.patch
+gpiolib-fix-line-event-handling-in-syscall-compatibl.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
