--- /dev/null
+From 0bfc153d2b8260e9cb0d2aaa44e9418626f26594 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:14 +0530
+Subject: ALSA: hda: Fix 2 channel swapping for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 216116eae43963c662eb84729507bad95214ca6b ]
+
+The Tegra HDA codec HW implementation has an issue related to not
+swapping the 2 channel Audio Sample Packet(ASP) channel mapping.
+Whatever the FL and FR mapping specified the left channel always
+comes out of left speaker and right channel on right speaker. So
+add condition to disallow the swapping of FL,FR during the playback.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-2-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index a13bad262598d..e4e228c095f03 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3678,6 +3678,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)
+
+ static int patch_tegra_hdmi(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec;
+ int err;
+
+ err = patch_generic_hdmi(codec);
+@@ -3685,6 +3686,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ return err;
+
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
++ spec = codec->spec;
++ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
++ nvhdmi_chmap_cea_alloc_validate_get_type;
++ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From f57f30b096335935aca00ab578b6be7ed9426624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:18 +0300
+Subject: ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is
+ disabled
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]
+
+In snd_hdac_device_init pm_runtime_set_active is called to
+increase child_count in parent device. But when it is failed
+to build connection with GPU for one case that integrated
+graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be
+invoked to clean up a HD-audio extended codec base device. At
+this time the child_count of parent is not decreased, which
+makes parent device can't get suspended.
+
+This patch calls pm_runtime_set_suspended to decrease child_count
+in parent device in snd_hdac_device_exit to match with
+snd_hdac_device_init. pm_runtime_set_suspended can make sure that
+it will not decrease child_count if the device is already suspended.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154218.1440441-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index c946fd8beebca..b84e12f4f8046 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -127,6 +127,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
+ void snd_hdac_device_exit(struct hdac_device *codec)
+ {
+ pm_runtime_put_noidle(&codec->dev);
++ /* keep balance of runtime PM child_count in parent device */
++ pm_runtime_set_suspended(&codec->dev);
+ snd_hdac_bus_remove_device(codec->bus, codec);
+ kfree(codec->vendor_name);
+ kfree(codec->chip_name);
+--
+2.25.1
+
--- /dev/null
+From 798baab317cc61d1fbeea85b7314d6da6008142c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:07 +0300
+Subject: ALSA: hda: hdmi - add Rocketlake support
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit f804a324a41a880c1ab43cc5145d8b3e5790430d ]
+
+Add Rocketlake HDMI codec support. Rocketlake shares
+the pin-to-port mapping table with Tigerlake.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154207.1440393-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index e4e228c095f03..51798632d334c 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -4205,6 +4205,7 @@ HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI", patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI", patch_i915_tgl_hdmi),
++HDA_CODEC_ENTRY(0x80862816, "Rocketlake HDMI", patch_i915_tgl_hdmi),
+ HDA_CODEC_ENTRY(0x8086281a, "Jasperlake HDMI", patch_i915_icl_hdmi),
+ HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
+ HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi),
+--
+2.25.1
+
--- /dev/null
+From 8c361a6e3ad46947cf21c07ecaeddd3cc2807fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:15 +0530
+Subject: ALSA: hda/tegra: Program WAKEEN register for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 23d63a31d9f44d7daeac0d1fb65c6a73c70e5216 ]
+
+The WAKEEN bits are used to indicate which bits in the
+STATESTS register may cause wake event during the codec
+state change request. Configure the WAKEEN register for
+the Tegra to detect the wake events.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-3-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_tegra.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index e5191584638ab..e378cb33c69df 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -169,6 +169,10 @@ static int __maybe_unused hda_tegra_runtime_suspend(struct device *dev)
+ struct hdac_bus *bus = azx_bus(chip);
+
+ if (chip && chip->running) {
++ /* enable controller wake up event */
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) |
++ STATESTS_INT_MASK);
++
+ azx_stop_chip(chip);
+ synchronize_irq(bus->irq);
+ azx_enter_link_reset(chip);
+@@ -191,6 +195,9 @@ static int __maybe_unused hda_tegra_runtime_resume(struct device *dev)
+ if (chip && chip->running) {
+ hda_tegra_init(hda);
+ azx_init_chip(chip, 1);
++ /* disable controller wake up event*/
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
++ ~STATESTS_INT_MASK);
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 9b1a0dd4b39baca4bed3815695bac4eec9207d44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 19:52:32 -0700
+Subject: ARC: HSDK: wireup perf irq
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit fe81d927b78c4f0557836661d32e41ebc957b024 ]
+
+Newer version of HSDK aka HSDK-4xD (with dual issue HS48x4 CPU) wired up
+the perf interrupt, so enable that in DT.
+This is OK for old HSDK where this irq is ignored because pct irq is not
+wired up in hardware.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 9acbeba832c0b..5d64a5a940ee6 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -88,6 +88,8 @@
+
+ arcpct: pct {
+ compatible = "snps,archs-pct";
++ interrupt-parent = <&cpu_intc>;
++ interrupts = <20>;
+ };
+
+ /* TIMER0 with interrupt for clockevent */
+--
+2.25.1
+
--- /dev/null
+From 89baf7bb46d3204330d8565c47bbefc5d26026f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 18:38:58 +0300
+Subject: ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id
+
+From: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+
+[ Upstream commit 26907eb605fbc3ba9dbf888f21d9d8d04471271d ]
+
+HSDK board has Micrel KSZ9031, recent commit
+bcf3440c6dd ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
+caused a breakdown of Ethernet.
+Using 'phy-mode = "rgmii"' is not correct because accodring RGMII
+specification it is necessary to have delay on RX (PHY to MAX)
+which is not generated in case of "rgmii".
+Using "rgmii-id" adds necessary delay and solves the issue.
+
+Also adding name of PHY placed on HSDK board.
+
+Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index 5d64a5a940ee6..dcaa44e408ace 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -210,7 +210,7 @@
+ reg = <0x8000 0x2000>;
+ interrupts = <10>;
+ interrupt-names = "macirq";
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ snps,pbl = <32>;
+ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+@@ -228,7 +228,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+- phy0: ethernet-phy@0 {
++ phy0: ethernet-phy@0 { /* Micrel KSZ9031 */
+ reg = <0>;
+ };
+ };
+--
+2.25.1
+
--- /dev/null
+From 85985a5816544365b94677c38d708ea381ece950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:43:41 -0700
+Subject: ARM: dts: bcm: HR2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d663186293a818af97c648624bee6c7a59e8218b ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e35398cc60a06..dd71ab08136be 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -217,7 +217,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 0f7b8c1bca42f0c660a754244719773012ba043d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:45:29 -0700
+Subject: ARM: dts: BCM5301X: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit b793dab8d811e103665d6bddaaea1c25db3776eb ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 1c8f40650723 ("ARM: dts: BCM5301X: convert to iProc QSPI")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index 2d9b4dd058307..0016720ce5300 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -488,7 +488,7 @@
+ };
+
+ spi@18029200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x18029200 0x184>,
+ <0x18029000 0x124>,
+ <0x1811b408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From d6877b0e33c9851336f92ba756502ba5b4a69154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:01:24 +0800
+Subject: ARM: dts: imx7ulp: Correct gpio ranges
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit deb6323b739c54e1a1e83cd3a2bae4901e3eebf6 ]
+
+Correct gpio ranges according to i.MX7ULP pinctrl driver:
+
+gpio_ptc: ONLY pin 0~19 are available;
+gpio_ptd: ONLY pin 0~11 are available;
+gpio_pte: ONLY pin 0~15 are available;
+gpio_ptf: ONLY pin 0~19 are available;
+
+Fixes: 20434dc92c05 ("ARM: dts: imx: add common imx7ulp dtsi support")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7ulp.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7ulp.dtsi b/arch/arm/boot/dts/imx7ulp.dtsi
+index 3dac6898cdc57..0108b63df77d3 100644
+--- a/arch/arm/boot/dts/imx7ulp.dtsi
++++ b/arch/arm/boot/dts/imx7ulp.dtsi
+@@ -397,7 +397,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLC>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 0 32>;
++ gpio-ranges = <&iomuxc1 0 0 20>;
+ };
+
+ gpio_ptd: gpio@40af0000 {
+@@ -411,7 +411,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLD>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 32 32>;
++ gpio-ranges = <&iomuxc1 0 32 12>;
+ };
+
+ gpio_pte: gpio@40b00000 {
+@@ -425,7 +425,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLE>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 64 32>;
++ gpio-ranges = <&iomuxc1 0 64 16>;
+ };
+
+ gpio_ptf: gpio@40b10000 {
+@@ -439,7 +439,7 @@
+ clocks = <&pcc2 IMX7ULP_CLK_RGPIO2P1>,
+ <&pcc3 IMX7ULP_CLK_PCTLF>;
+ clock-names = "gpio", "port";
+- gpio-ranges = <&iomuxc1 0 96 32>;
++ gpio-ranges = <&iomuxc1 0 96 20>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From ac3d56ceb130ef0f9dc14439197dbf1fcd1363aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:53:38 -0500
+Subject: ARM: dts: logicpd-som-lv-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 4d26e9a028e3d88223e06fa133c3d55af7ddbceb ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree but never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 5cb8b0fa55a9 ("ARM: dts: Move most of logicpd-som-lv-37xx-devkit.dts to logicpd-som-lv-baseboard.dtsi")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 100396f6c2feb..c310c33ca6f3f 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -51,6 +51,8 @@
+
+ &mcbsp2 {
+ status = "okay";
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ };
+
+ &charger {
+--
+2.25.1
+
--- /dev/null
+From 310991de7fbc1e43ccc77f41c3a5ad332ae0b6f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:24:41 -0500
+Subject: ARM: dts: logicpd-som-lv-baseboard: Fix missing video
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d1db7b80a6c8c5f81db0e80664d29b374750e2c6 ]
+
+A previous commit removed the panel-dpi driver, which made the
+SOM-LV video stop working because it relied on the DPI driver
+for setting video timings. Now that the simple-panel driver is
+available in omap2plus, this patch migrates the SOM-LV dev kits
+to use a similar panel and remove the manual timing requirements.
+A similar patch was already done and applied to the Torpedo family.
+
+Fixes: 8bf4b1621178 ("drm/omap: Remove panel-dpi driver")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/logicpd-som-lv-baseboard.dtsi | 27 ++++---------------
+ 1 file changed, 5 insertions(+), 22 deletions(-)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index c310c33ca6f3f..395e05f10d36c 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -104,35 +104,18 @@
+ regulator-max-microvolt = <3300000>;
+ };
+
+- lcd0: display@0 {
+- compatible = "panel-dpi";
+- label = "28";
+- status = "okay";
+- /* default-on; */
++ lcd0: display {
++ /* This isn't the exact LCD, but the timings meet spec */
++ compatible = "logicpd,type28";
+ pinctrl-names = "default";
+ pinctrl-0 = <&lcd_enable_pin>;
+- enable-gpios = <&gpio5 27 GPIO_ACTIVE_HIGH>; /* gpio155, lcd INI */
++ backlight = <&bl>;
++ enable-gpios = <&gpio5 27 GPIO_ACTIVE_HIGH>;
+ port {
+ lcd_in: endpoint {
+ remote-endpoint = <&dpi_out>;
+ };
+ };
+-
+- panel-timing {
+- clock-frequency = <9000000>;
+- hactive = <480>;
+- vactive = <272>;
+- hfront-porch = <3>;
+- hback-porch = <2>;
+- hsync-len = <42>;
+- vback-porch = <3>;
+- vfront-porch = <2>;
+- vsync-len = <11>;
+- hsync-active = <1>;
+- vsync-active = <1>;
+- de-active = <1>;
+- pixelclk-active = <0>;
+- };
+ };
+
+ bl: backlight {
+--
+2.25.1
+
--- /dev/null
+From 68d49b77aa5bfcabde41b4a486187df4bbb7f337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2020 21:56:10 -0500
+Subject: ARM: dts: logicpd-torpedo-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d7dfee67688ac7f2dfd4c3bc70c053ee990c40b5 ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree, they were never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 739f85bba5ab ("ARM: dts: Move most of logicpd-torpedo-37xx-devkit to logicpd-torpedo-baseboard")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+index 449cc7616da63..e7a8f8addb6e0 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+@@ -80,6 +80,8 @@
+ };
+
+ &mcbsp2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ status = "okay";
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 3af6d79f15fed2455ea93e6336f2b04d2f9a662f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 12:50:06 +0200
+Subject: ARM: dts: ls1021a: fix QuadSPI-memory reg range
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 81dbbb417da4d1ac407dca5b434d39d5b6b91ef3 ]
+
+According to the Reference Manual, the correct size is 512 MiB.
+
+Without this fix, probing the QSPI fails:
+
+ fsl-quadspi 1550000.spi: ioremap failed for resource
+ [mem 0x40000000-0x7fffffff]
+ fsl-quadspi 1550000.spi: Freescale QuadSPI probe failed
+ fsl-quadspi: probe of 1550000.spi failed with error -12
+
+Fixes: 85f8ee78ab72 ("ARM: dts: ls1021a: Add support for QSPI with ls1021a SoC")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 5a8e58b663420..c62fcca7b4263 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -181,7 +181,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x0 0x1550000 0x0 0x10000>,
+- <0x0 0x40000000 0x0 0x40000000>;
++ <0x0 0x40000000 0x0 0x20000000>;
+ reg-names = "QuadSPI", "QuadSPI-memory";
+ interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "qspi_en", "qspi";
+--
+2.25.1
+
--- /dev/null
+From b1e1346440733370355c43b8992a342e793b6677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:44:25 -0700
+Subject: ARM: dts: NSP: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d1ecc40a954fd0f5e3789b91fa80f15e82284e39 ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 329f98c1974e ("ARM: dts: NSP: Add QSPI nodes to NSPI and bcm958625k DTSes")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 418e6b97cb2ec..8615d89fa4690 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -282,7 +282,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 95ef554a93a088c4de43060f8cfa79b175c54459 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 10:26:40 -0500
+Subject: ARM: dts: socfpga: fix register entry for timer3 on Arria10
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]
+
+Fixes the register address for the timer3 entry on Arria10.
+
+Fixes: 475dc86d08de4 ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index 906bfb580e9e7..f261a33440710 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -819,7 +819,7 @@
+ timer3: timer3@ffd00100 {
+ compatible = "snps,dw-apb-timer";
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0xffd01000 0x100>;
++ reg = <0xffd00100 0x100>;
+ clocks = <&l4_sys_free_clk>;
+ clock-names = "timer";
+ resets = <&rst L4SYSTIMER1_RESET>;
+--
+2.25.1
+
--- /dev/null
+From 2f22da3eaae07ed57fc335042551a497ca3a53e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Aug 2020 13:12:48 +0200
+Subject: arm64: dts: imx8mq: Fix TMU interrupt property
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1f2f98f2703e8134678fe20982886085631eda23 ]
+
+"interrupt" is not a valid property. Using proper name fixes dtbs_check
+warning:
+
+ arch/arm64/boot/dts/freescale/imx8mq-zii-ultra-zest.dt.yaml: tmu@30260000: 'interrupts' is a required property
+
+Fixes: e464fd2ba4d4 ("arm64: dts: imx8mq: enable the multi sensor TMU")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+index 55a3d1c4bdf04..bc8540f879654 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi
+@@ -349,7 +349,7 @@
+ tmu: tmu@30260000 {
+ compatible = "fsl,imx8mq-tmu";
+ reg = <0x30260000 0x10000>;
+- interrupt = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MQ_CLK_TMU_ROOT>;
+ little-endian;
+ fsl,tmu-range = <0xb0000 0xa0026 0x80048 0x70061>;
+--
+2.25.1
+
--- /dev/null
+From bf0999c1f7eb2f8229eab9f7d9d5d7beb1e96fd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:49:19 -0700
+Subject: arm64: dts: ns2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 686e0a0c8c61e0e3f55321d0181fece3efd92777 ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: ff73917d38a6 ("ARM64: dts: Add QSPI Device Tree node for NS2")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index 15f7b0ed38369..39802066232e1 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -745,7 +745,7 @@
+ };
+
+ qspi: spi@66470200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-ns2-qspi";
++ compatible = "brcm,spi-ns2-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x66470200 0x184>,
+ <0x66470000 0x124>,
+ <0x67017408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 77e1ab4e8b1c857efa056aba50638ea33d9e4b8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 18:00:16 +0200
+Subject: arm64/module: set trampoline section flags regardless of
+ CONFIG_DYNAMIC_FTRACE
+
+From: Jessica Yu <jeyu@kernel.org>
+
+[ Upstream commit e0328feda79d9681b3e3245e6e180295550c8ee9 ]
+
+In the arm64 module linker script, the section .text.ftrace_trampoline
+is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
+is enabled (this is simply due to the limitation that module linker
+scripts are not preprocessed like the vmlinux one).
+
+Normally, for .plt and .text.ftrace_trampoline, the section flags
+present in the module binary wouldn't matter since module_frob_arch_sections()
+would assign them manually anyway. However, the arm64 module loader only
+sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
+That's only become problematic recently due to a recent change in
+binutils-2.35, where the .text.ftrace_trampoline section (along with the
+.plt section) is now marked writable and executable (WAX).
+
+We no longer allow writable and executable sections to be loaded due to
+commit 5c3a7db0c7ec ("module: Harden STRICT_MODULE_RWX"), so this is
+causing all modules linked with binutils-2.35 to be rejected under arm64.
+Drop the IS_ENABLED(CONFIG_DYNAMIC_FTRACE) check in module_frob_arch_sections()
+so that the section flags for .text.ftrace_trampoline get properly set to
+SHF_EXECINSTR|SHF_ALLOC, without SHF_WRITE.
+
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Acked-by: Will Deacon <will@kernel.org>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Link: http://lore.kernel.org/r/20200831094651.GA16385@linux-8ccs
+Link: https://lore.kernel.org/r/20200901160016.3646-1-jeyu@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/module-plts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
+index b182442b87a32..426018ebb7007 100644
+--- a/arch/arm64/kernel/module-plts.c
++++ b/arch/arm64/kernel/module-plts.c
+@@ -270,8 +270,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
+ mod->arch.core.plt_shndx = i;
+ else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
+ mod->arch.init.plt_shndx = i;
+- else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
+- !strcmp(secstrings + sechdrs[i].sh_name,
++ else if (!strcmp(secstrings + sechdrs[i].sh_name,
+ ".text.ftrace_trampoline"))
+ tramp = sechdrs + i;
+ else if (sechdrs[i].sh_type == SHT_SYMTAB)
+--
+2.25.1
+
--- /dev/null
+From 43b9302682ea3bec9f51ddc36c0d7f9872cb6d59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 08:44:25 +0530
+Subject: block: Set same_page to false in __bio_try_merge_page if ret is false
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit 2cd896a5e86fc326bda8614b96c0401dcc145868 ]
+
+If we hit the UINT_MAX limit of bio->bi_iter.bi_size and so we are anyway
+not merging this page in this bio, then it make sense to make same_page
+also as false before returning.
+
+Without this patch, we hit below WARNING in iomap.
+This mostly happens with very large memory system and / or after tweaking
+vm dirty threshold params to delay writeback of dirty data.
+
+WARNING: CPU: 18 PID: 5130 at fs/iomap/buffered-io.c:74 iomap_page_release+0x120/0x150
+ CPU: 18 PID: 5130 Comm: fio Kdump: loaded Tainted: G W 5.8.0-rc3 #6
+ Call Trace:
+ __remove_mapping+0x154/0x320 (unreliable)
+ iomap_releasepage+0x80/0x180
+ try_to_release_page+0x94/0xe0
+ invalidate_inode_page+0xc8/0x110
+ invalidate_mapping_pages+0x1dc/0x540
+ generic_fadvise+0x3c8/0x450
+ xfs_file_fadvise+0x2c/0xe0 [xfs]
+ vfs_fadvise+0x3c/0x60
+ ksys_fadvise64_64+0x68/0xe0
+ sys_fadvise64+0x28/0x40
+ system_call_exception+0xf8/0x1c0
+ system_call_common+0xf0/0x278
+
+Fixes: cc90bc68422 ("block: fix "check bi_size overflow before merge"")
+Reported-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index 87505a93bcff6..f07739300dfe3 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -807,8 +807,10 @@ bool __bio_try_merge_page(struct bio *bio, struct page *page,
+ struct bio_vec *bv = &bio->bi_io_vec[bio->bi_vcnt - 1];
+
+ if (page_is_mergeable(bv, page, len, off, same_page)) {
+- if (bio->bi_iter.bi_size > UINT_MAX - len)
++ if (bio->bi_iter.bi_size > UINT_MAX - len) {
++ *same_page = false;
+ return false;
++ }
+ bv->bv_len += len;
+ bio->bi_iter.bi_size += len;
+ return true;
+--
+2.25.1
+
--- /dev/null
+From b818d056ffc2325bf6035643595008153d80086c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 13:52:01 -0700
+Subject: cfg80211: Adjust 6 GHz frequency to channel conversion
+
+From: Amar Singhal <asinghal@codeaurora.org>
+
+[ Upstream commit 2d9b55508556ccee6410310fb9ea2482fd3328eb ]
+
+Adjust the 6 GHz frequency to channel conversion function,
+the other way around was previously handled.
+
+Signed-off-by: Amar Singhal <asinghal@codeaurora.org>
+Link: https://lore.kernel.org/r/1592599921-10607-1-git-send-email-asinghal@codeaurora.org
+[rewrite commit message, hard-code channel 2]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/util.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 8481e9ac33da5..9abafd76ec50e 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -116,11 +116,13 @@ int ieee80211_frequency_to_channel(int freq)
+ return (freq - 2407) / 5;
+ else if (freq >= 4910 && freq <= 4980)
+ return (freq - 4000) / 5;
+- else if (freq < 5945)
++ else if (freq < 5925)
+ return (freq - 5000) / 5;
++ else if (freq == 5935)
++ return 2;
+ else if (freq <= 45000) /* DMG band lower limit */
+- /* see 802.11ax D4.1 27.3.22.2 */
+- return (freq - 5940) / 5;
++ /* see 802.11ax D6.1 27.3.22.2 */
++ return (freq - 5950) / 5;
+ else if (freq >= 58320 && freq <= 70200)
+ return (freq - 56160) / 2160;
+ else
+--
+2.25.1
+
--- /dev/null
+From 80fc49b398a9cf7a7d9d6012682d8e43da2d1209 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 20:02:50 -0700
+Subject: cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo
+ disabled
+
+From: Francisco Jerez <currojerez@riseup.net>
+
+[ Upstream commit eacc9c5a927e474c173a5d53dd7fb8e306511768 ]
+
+This fixes the behavior of the scaling_max_freq and scaling_min_freq
+sysfs files in systems which had turbo disabled by the BIOS.
+
+Caleb noticed that the HWP is programmed to operate in the wrong
+P-state range on his system when the CPUFREQ policy min/max frequency
+is set via sysfs. This seems to be because in his system
+intel_pstate_get_hwp_max() is returning the maximum turbo P-state even
+though turbo was disabled by the BIOS, which causes intel_pstate to
+scale kHz frequencies incorrectly e.g. setting the maximum turbo
+frequency whenever the maximum guaranteed frequency is requested via
+sysfs.
+
+Tested-by: Caleb Callaway <caleb.callaway@intel.com>
+Signed-off-by: Francisco Jerez <currojerez@riseup.net>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+[ rjw: Minor subject edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 5bad88f6ddd59..b9ca89dc75c7d 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -762,7 +762,7 @@ static void intel_pstate_get_hwp_max(unsigned int cpu, int *phy_max,
+
+ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
+ WRITE_ONCE(all_cpu_data[cpu]->hwp_cap_cached, cap);
+- if (global.no_turbo)
++ if (global.no_turbo || global.turbo_disabled)
+ *current_max = HWP_GUARANTEED_PERF(cap);
+ else
+ *current_max = HWP_HIGHEST_PERF(cap);
+--
+2.25.1
+
--- /dev/null
+From 223957c3ac4af878a535580a08f299447ac70d71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 17:40:02 +0200
+Subject: cpufreq: intel_pstate: Refuse to turn off with HWP enabled
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43298db3009f06fe5c69e1ca8b6cfc2565772fa1 ]
+
+After commit f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive
+mode with HWP enabled") it is possible to change the driver status
+to "off" via sysfs with HWP enabled, which effectively causes the
+driver to unregister itself, but HWP remains active and it forces the
+minimum performance, so even if another cpufreq driver is loaded,
+it will not be able to control the CPU frequency.
+
+For this reason, make the driver refuse to change the status to
+"off" with HWP enabled.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 927eb3fd23660..5bad88f6ddd59 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2533,9 +2533,15 @@ static int intel_pstate_update_status(const char *buf, size_t size)
+ {
+ int ret;
+
+- if (size == 3 && !strncmp(buf, "off", size))
+- return intel_pstate_driver ?
+- intel_pstate_unregister_driver() : -EINVAL;
++ if (size == 3 && !strncmp(buf, "off", size)) {
++ if (!intel_pstate_driver)
++ return -EINVAL;
++
++ if (hwp_active)
++ return -EBUSY;
++
++ return intel_pstate_unregister_driver();
++ }
+
+ if (size == 6 && !strncmp(buf, "active", size)) {
+ if (intel_pstate_driver) {
+--
+2.25.1
+
--- /dev/null
+From a9ebfcde5a98d47274d1a2a14d3060a16b21256b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 17:54:21 +0800
+Subject: dmaengine: acpi: Put the CSRT table after using it
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 7eb48dd094de5fe0e216b550e73aa85257903973 ]
+
+The acpi_get_table() should be coupled with acpi_put_table() if
+the mapped table is not used at runtime to release the table
+mapping, put the CSRT table buf after using it.
+
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1595411661-15936-1-git-send-email-guohanjun@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/acpi-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
+index 8a05db3343d39..dcbcb712de6e8 100644
+--- a/drivers/dma/acpi-dma.c
++++ b/drivers/dma/acpi-dma.c
+@@ -135,11 +135,13 @@ static void acpi_dma_parse_csrt(struct acpi_device *adev, struct acpi_dma *adma)
+ if (ret < 0) {
+ dev_warn(&adev->dev,
+ "error in parsing resource group\n");
+- return;
++ break;
+ }
+
+ grp = (struct acpi_csrt_group *)((void *)grp + grp->length);
+ }
++
++ acpi_put_table((struct acpi_table_header *)csrt);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From 580f2d9520d0596b589a118176f7ed9500d94d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 09:14:23 +0530
+Subject: drivers/dma/dma-jz4780: Fix race condition between probe and irq
+ handler
+
+From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+
+[ Upstream commit 6d6018fc30bee67290dbed2fa51123f7c6f3d691 ]
+
+In probe, IRQ is requested before zchan->id is initialized which can be
+read in the irq handler. Hence, shift request irq after other initializations
+complete.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+Reviewed-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://lore.kernel.org/r/20200821034423.12713-1-madhuparnabhowmik10@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-jz4780.c | 38 +++++++++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index bf95f1d551c51..0ecb724b394f5 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -885,24 +885,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ return -EINVAL;
+ }
+
+- ret = platform_get_irq(pdev, 0);
+- if (ret < 0)
+- return ret;
+-
+- jzdma->irq = ret;
+-
+- ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
+- jzdma);
+- if (ret) {
+- dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
+- return ret;
+- }
+-
+ jzdma->clk = devm_clk_get(dev, NULL);
+ if (IS_ERR(jzdma->clk)) {
+ dev_err(dev, "failed to get clock\n");
+ ret = PTR_ERR(jzdma->clk);
+- goto err_free_irq;
++ return ret;
+ }
+
+ clk_prepare_enable(jzdma->clk);
+@@ -955,10 +942,23 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ jzchan->vchan.desc_free = jz4780_dma_desc_free;
+ }
+
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ goto err_disable_clk;
++
++ jzdma->irq = ret;
++
++ ret = request_irq(jzdma->irq, jz4780_dma_irq_handler, 0, dev_name(dev),
++ jzdma);
++ if (ret) {
++ dev_err(dev, "failed to request IRQ %u!\n", jzdma->irq);
++ goto err_disable_clk;
++ }
++
+ ret = dmaenginem_async_device_register(dd);
+ if (ret) {
+ dev_err(dev, "failed to register device\n");
+- goto err_disable_clk;
++ goto err_free_irq;
+ }
+
+ /* Register with OF DMA helpers. */
+@@ -966,17 +966,17 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ jzdma);
+ if (ret) {
+ dev_err(dev, "failed to register OF DMA controller\n");
+- goto err_disable_clk;
++ goto err_free_irq;
+ }
+
+ dev_info(dev, "JZ4780 DMA controller initialised\n");
+ return 0;
+
+-err_disable_clk:
+- clk_disable_unprepare(jzdma->clk);
+-
+ err_free_irq:
+ free_irq(jzdma->irq, jzdma);
++
++err_disable_clk:
++ clk_disable_unprepare(jzdma->clk);
+ return ret;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 7abde02eec05301e1e89532f8071771a359dd3d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 00:07:52 -0700
+Subject: drivers/net/wan/hdlc_cisco: Add hard_header_len
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]
+
+This driver didn't set hard_header_len. This patch sets hard_header_len
+for it according to its header_ops->create function.
+
+This driver's header_ops->create function (cisco_hard_header) creates
+a header of (struct hdlc_header), so hard_header_len should be set to
+sizeof(struct hdlc_header).
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_cisco.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index a030f5aa6b951..cc33441af4691 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -370,6 +370,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
+ memcpy(&state(hdlc)->settings, &new_settings, size);
+ spin_lock_init(&state(hdlc)->lock);
+ dev->header_ops = &cisco_header_ops;
++ dev->hard_header_len = sizeof(struct hdlc_header);
+ dev->type = ARPHRD_CISCO;
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_on(dev);
+--
+2.25.1
+
--- /dev/null
+From e73e6b2d5b5154b792f28b3ee1652b2160e91e3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 14:26:59 -0700
+Subject: drivers/net/wan/lapbether: Added needed_tailroom
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]
+
+The underlying Ethernet device may request necessary tailroom to be
+allocated by setting needed_tailroom. This driver should also set
+needed_tailroom to request the tailroom needed by the underlying
+Ethernet device to be allocated.
+
+Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 996eb9c55b39a..373c9ce4010a3 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -340,6 +340,7 @@ static int lapbeth_new_device(struct net_device *dev)
+ */
+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+ + dev->needed_headroom;
++ ndev->needed_tailroom = dev->needed_tailroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+--
+2.25.1
+
--- /dev/null
+From 4f05f39cd50da1a5527f81eb14193abe982eaa03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 20:03:53 -0700
+Subject: drivers/net/wan/lapbether: Set network_header before transmitting
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]
+
+Set the skb's network_header before it is passed to the underlying
+Ethernet device for transmission.
+
+This patch fixes the following issue:
+
+When we use this driver with AF_PACKET sockets, there would be error
+messages of:
+ protocol 0805 is buggy, dev (Ethernet interface name)
+printed in the system "dmesg" log.
+
+This is because skbs passed down to the Ethernet device for transmission
+don't have their network_header properly set, and the dev_queue_xmit_nit
+function in net/core/dev.c complains about this.
+
+Reason of setting the network_header to this place (at the end of the
+Ethernet header, and at the beginning of the Ethernet payload):
+
+Because when this driver receives an skb from the Ethernet device, the
+network_header is also set at this place.
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 373c9ce4010a3..2cff914aada55 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -210,6 +210,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb_reset_network_header(skb);
++
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+
+ dev_queue_xmit(skb);
+--
+2.25.1
+
--- /dev/null
+From 3bfa4ca1128df7d634ec62b2dcf1b5530df0db3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 18:43:37 +0530
+Subject: drm/amdgpu: Fix bug in reporting voltage for CIK
+
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+
+[ Upstream commit d98299885c9ea140c1108545186593deba36c4ac ]
+
+On my R9 390, the voltage was reported as a constant 1000 mV.
+This was due to a bug in smu7_hwmgr.c, in the smu7_read_sensor()
+function, where some magic constants were used in a condition,
+to determine whether the voltage should be read from PLANE2_VID
+or PLANE1_VID. The VDDC mask was incorrectly used, instead of
+the VDDGFX mask.
+
+This patch changes the code to use the correct defined constants
+(and apply the correct bitshift), thus resulting in correct voltage reporting.
+
+Signed-off-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index e6da53e9c3f46..3a2a1dc9a786a 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3575,7 +3575,8 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx,
+ case AMDGPU_PP_SENSOR_GPU_POWER:
+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value);
+ case AMDGPU_PP_SENSOR_VDDGFX:
+- if ((data->vr_config & 0xff) == 0x2)
++ if ((data->vr_config & VRCONF_VDDGFX_MASK) ==
++ (VR_SVI2_PLANE_2 << VRCONF_VDDGFX_SHIFT))
+ val_vid = PHM_READ_INDIRECT_FIELD(hwmgr->device,
+ CGS_IND_REG__SMC, PWR_SVI2_STATUS, PLANE2_VID);
+ else
+--
+2.25.1
+
--- /dev/null
+From 128ba95be7dee75bb612d2ea3affdc75232078d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 09:08:26 +0800
+Subject: drm/sun4i: add missing put_device() call in
+ sun8i_r40_tcon_tv_set_mux()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 07b5b12d97dc9f47ff3dff46c4f944a15bd762e5 ]
+
+If sun8i_r40_tcon_tv_set_mux() succeed, sun8i_r40_tcon_tv_set_mux()
+doesn't have a corresponding put_device(). Thus add put_device()
+to fix the exception handling for this function implementation.
+
+Fixes: 0305189afb32 ("drm/sun4i: tcon: Add support for R40 TCON")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200826010826.1785487-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 0f7eafedfe8f5..ae7ae432aa4ab 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -1409,14 +1409,18 @@ static int sun8i_r40_tcon_tv_set_mux(struct sun4i_tcon *tcon,
+ if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP) &&
+ encoder->encoder_type == DRM_MODE_ENCODER_TMDS) {
+ ret = sun8i_tcon_top_set_hdmi_src(&pdev->dev, id);
+- if (ret)
++ if (ret) {
++ put_device(&pdev->dev);
+ return ret;
++ }
+ }
+
+ if (IS_ENABLED(CONFIG_DRM_SUN8I_TCON_TOP)) {
+ ret = sun8i_tcon_top_de_config(&pdev->dev, tcon->id, id);
+- if (ret)
++ if (ret) {
++ put_device(&pdev->dev);
+ return ret;
++ }
+ }
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From d57472e2663412e8bc157dc74f4053c4f9d19429 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:48:10 +0200
+Subject: drm/sun4i: backend: Disable alpha on the lowest plane on the A20
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 5e2e2600a3744491a8b49b92597c13b693692082 ]
+
+Unlike we previously thought, the per-pixel alpha is just as broken on the
+A20 as it is on the A10. Remove the quirk that says we can use it.
+
+Fixes: dcf496a6a608 ("drm/sun4i: sun4i: Introduce a quirk for lowest plane alpha support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200728134810.883457-2-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index 9ac637019f039..99f081ccc15de 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -985,7 +985,6 @@ static const struct sun4i_backend_quirks sun6i_backend_quirks = {
+
+ static const struct sun4i_backend_quirks sun7i_backend_quirks = {
+ .needs_output_muxing = true,
+- .supports_lowest_plane_alpha = true,
+ };
+
+ static const struct sun4i_backend_quirks sun8i_a33_backend_quirks = {
+--
+2.25.1
+
--- /dev/null
+From 3e93b7c46ec86d97ad3ce277e2c0ec067c9696b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 15:48:09 +0200
+Subject: drm/sun4i: backend: Support alpha property on lowest plane
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit e359c70462d2a82aae80274d027351d38792dde6 ]
+
+Unlike what we previously thought, only the per-pixel alpha is broken on
+the lowest plane and the per-plane alpha isn't. Remove the check on the
+alpha property being set on the lowest plane to reject a mode.
+
+Fixes: dcf496a6a608 ("drm/sun4i: sun4i: Introduce a quirk for lowest plane alpha support")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Cc: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200728134810.883457-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_backend.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_backend.c b/drivers/gpu/drm/sun4i/sun4i_backend.c
+index 4e29f4fe4a05e..9ac637019f039 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_backend.c
++++ b/drivers/gpu/drm/sun4i/sun4i_backend.c
+@@ -589,8 +589,7 @@ static int sun4i_backend_atomic_check(struct sunxi_engine *engine,
+
+ /* We can't have an alpha plane at the lowest position */
+ if (!backend->quirks->supports_lowest_plane_alpha &&
+- (plane_states[0]->fb->format->has_alpha ||
+- (plane_states[0]->alpha != DRM_BLEND_ALPHA_OPAQUE)))
++ (plane_states[0]->alpha != DRM_BLEND_ALPHA_OPAQUE))
+ return -EINVAL;
+
+ for (i = 1; i < num_planes; i++) {
+--
+2.25.1
+
--- /dev/null
+From ee79f4d99131d304fd5b5155d5ac3e3b5ade14ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 14:50:32 +0200
+Subject: drm/sun4i: Fix dsi dcs long write function
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit fd90e3808fd2c207560270c39b86b71af2231aa1 ]
+
+It's writing too much data. regmap_bulk_write expects number of
+register sized chunks to write, not a byte sized length of the
+bounce buffer. Bounce buffer needs to be padded too, so that
+regmap_bulk_write will not read past the end of the buffer.
+
+Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200828125032.937148-1-megous@megous.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 4f944ace665d5..f2b288037b909 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -867,7 +867,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
+ sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
+
+- bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
++ bounce = kzalloc(ALIGN(msg->tx_len + sizeof(crc), 4), GFP_KERNEL);
+ if (!bounce)
+ return -ENOMEM;
+
+@@ -878,7 +878,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
+ len += sizeof(crc);
+
+- regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len);
++ regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4));
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1);
+ kfree(bounce);
+
+--
+2.25.1
+
--- /dev/null
+From fbef296a973b5cb657bb5aae26140c83e2a8aee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 19:29:35 +0800
+Subject: firestream: Fix memleak in fs_open
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]
+
+When make_rate() fails, vcc should be freed just
+like other error paths in fs_open().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/firestream.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index d287837ed7555..5acb459856752 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -998,6 +998,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ error = make_rate (pcr, r, &tmc0, NULL);
+ if (error) {
+ kfree(tc);
++ kfree(vcc);
+ return error;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 0057f48f15dc72fa93ea1f332f5a3229ce363bb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 18:58:08 +0300
+Subject: gcov: Disable gcov build with GCC 10
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]
+
+GCOV built with GCC 10 doesn't initialize n_function variable. This
+produces different kernel panics as was seen by Colin in Ubuntu and me
+in FC 32.
+
+As a workaround, let's disable GCOV build for broken GCC 10 version.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
+Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
+Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
+Cc: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gcov/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
+index 3941a9c48f833..005d8b851bc18 100644
+--- a/kernel/gcov/Kconfig
++++ b/kernel/gcov/Kconfig
+@@ -4,6 +4,7 @@ menu "GCOV-based kernel profiling"
+ config GCOV_KERNEL
+ bool "Enable gcov-based kernel profiling"
+ depends on DEBUG_FS
++ depends on !CC_IS_GCC || GCC_VERSION < 100000
+ select CONSTRUCTORS if !UML
+ default n
+ ---help---
+--
+2.25.1
+
--- /dev/null
+From 01ec50fc24c172a441b0470c8e6551a56fd508fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 17:06:43 +0800
+Subject: HID: elan: Fix memleak in elan_input_configured
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit b7429ea53d6c0936a0f10a5d64164f0aea440143 ]
+
+When input_mt_init_slots() fails, input should be freed
+to prevent memleak. When input_register_device() fails,
+we should call input_mt_destroy_slots() to free memory
+allocated by input_mt_init_slots().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 45c4f888b7c4e..dae193749d443 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -188,6 +188,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
+ if (ret) {
+ hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
++ input_free_device(input);
+ return ret;
+ }
+
+@@ -198,6 +199,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (ret) {
+ hid_err(hdev, "Failed to register elan input device: %d\n",
+ ret);
++ input_mt_destroy_slots(input);
+ input_free_device(input);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 2daf0bd65e1fafa32cdd7a36a3f68f407be37bcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 21:14:29 -0700
+Subject: HID: microsoft: Add rumble support for the 8bitdo SN30 Pro+
+ controller
+
+From: Nicholas Miell <nmiell@gmail.com>
+
+[ Upstream commit 724a419ea28f7514a391e80040230f69cf626707 ]
+
+When operating in XInput mode, the 8bitdo SN30 Pro+ requires the same
+quirk as the official Xbox One Bluetooth controllers for rumble to
+function.
+
+Other controllers like the N30 Pro 2, SF30 Pro, SN30 Pro, etc. probably
+also need this quirk, but I do not have the hardware to test.
+
+Signed-off-by: Nicholas Miell <nmiell@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-microsoft.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 076c20a7a6540..e03a4d794240c 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -846,6 +846,7 @@
+ #define USB_DEVICE_ID_MS_POWER_COVER 0x07da
+ #define USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER 0x02fd
+ #define USB_DEVICE_ID_MS_PIXART_MOUSE 0x00cb
++#define USB_DEVICE_ID_8BITDO_SN30_PRO_PLUS 0x02e0
+
+ #define USB_VENDOR_ID_MOJO 0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
+diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
+index 2d8b589201a4e..8cb1ca1936e42 100644
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -451,6 +451,8 @@ static const struct hid_device_id ms_devices[] = {
+ .driver_data = MS_SURFACE_DIAL },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_XBOX_ONE_S_CONTROLLER),
+ .driver_data = MS_QUIRK_FF },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_8BITDO_SN30_PRO_PLUS),
++ .driver_data = MS_QUIRK_FF },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, ms_devices);
+--
+2.25.1
+
--- /dev/null
+From 4c72d3a0fc002489bd99d8fb0a10cc29558b083f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Aug 2020 17:48:59 -0700
+Subject: HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52
+ devices
+
+From: Nirenjan Krishnan <nirenjan@gmail.com>
+
+[ Upstream commit 77df710ba633dfb6c65c65cf99ea9e084a1c9933 ]
+
+The Saitek X52 family of joysticks has a pair of axes that were
+originally (by the Windows driver) used as mouse pointer controls. The
+corresponding usage page is the Game Controls page, which is not
+recognized by the generic HID driver, and therefore, both axes get
+mapped to ABS_MISC. The quirk makes the second axis get mapped to
+ABS_MISC+1, and therefore made available separately.
+
+One Saitek X52 device is already fixed. This patch fixes the other two
+known devices with VID/PID 06a3:0255 and 06a3:0762.
+
+Signed-off-by: Nirenjan Krishnan <nirenjan@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index fbc93d8dda5ed..076c20a7a6540 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -1011,6 +1011,8 @@
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c
++#define USB_DEVICE_ID_SAITEK_X52_2 0x0255
++#define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 8a739ec50cc00..0440e2f6e8a3c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -150,6 +150,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+--
+2.25.1
+
--- /dev/null
+From 152b7bac7b6ff77bd2ea73f54a954623157edb72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 12:50:39 -0700
+Subject: IB/isert: Fix unaligned immediate-data handling
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0b089c1ef7047652b13b4cdfdb1e0e7dbdb8c9ab ]
+
+Currently we allocate rx buffers in a single contiguous buffers for
+headers (iser and iscsi) and data trailer. This means that most likely the
+data starting offset is aligned to 76 bytes (size of both headers).
+
+This worked fine for years, but at some point this broke, resulting in
+data corruptions in isert when a command comes with immediate data and the
+underlying backend device assumes 512 bytes buffer alignment.
+
+We assume a hard-requirement for all direct I/O buffers to be 512 bytes
+aligned. To fix this, we should avoid passing unaligned buffers for I/O.
+
+Instead, we allocate our recv buffers with some extra space such that we
+can have the data portion align to 512 byte boundary. This also means that
+we cannot reference headers or data using structure but rather
+accessors (as they may move based on alignment). Also, get rid of the
+wrong __packed annotation from iser_rx_desc as this has only harmful
+effects (not aligned to anything).
+
+This affects the rx descriptors for iscsi login and data plane.
+
+Fixes: 3d75ca0adef4 ("block: introduce multi-page bvec helpers")
+Link: https://lore.kernel.org/r/20200904195039.31687-1-sagi@grimberg.me
+Reported-by: Stephen Rust <srust@blockbridge.com>
+Tested-by: Doug Dumitru <doug@dumitru.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/isert/ib_isert.c | 93 +++++++++++++------------
+ drivers/infiniband/ulp/isert/ib_isert.h | 41 ++++++++---
+ 2 files changed, 78 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
+index a1a035270cabf..71268d61d2b8a 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.c
++++ b/drivers/infiniband/ulp/isert/ib_isert.c
+@@ -182,15 +182,15 @@ isert_alloc_rx_descriptors(struct isert_conn *isert_conn)
+ rx_desc = isert_conn->rx_descs;
+
+ for (i = 0; i < ISERT_QP_MAX_RECV_DTOS; i++, rx_desc++) {
+- dma_addr = ib_dma_map_single(ib_dev, (void *)rx_desc,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ dma_addr = ib_dma_map_single(ib_dev, rx_desc->buf,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ if (ib_dma_mapping_error(ib_dev, dma_addr))
+ goto dma_map_fail;
+
+ rx_desc->dma_addr = dma_addr;
+
+ rx_sg = &rx_desc->rx_sg;
+- rx_sg->addr = rx_desc->dma_addr;
++ rx_sg->addr = rx_desc->dma_addr + isert_get_hdr_offset(rx_desc);
+ rx_sg->length = ISER_RX_PAYLOAD_SIZE;
+ rx_sg->lkey = device->pd->local_dma_lkey;
+ rx_desc->rx_cqe.done = isert_recv_done;
+@@ -202,7 +202,7 @@ dma_map_fail:
+ rx_desc = isert_conn->rx_descs;
+ for (j = 0; j < i; j++, rx_desc++) {
+ ib_dma_unmap_single(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+ kfree(isert_conn->rx_descs);
+ isert_conn->rx_descs = NULL;
+@@ -223,7 +223,7 @@ isert_free_rx_descriptors(struct isert_conn *isert_conn)
+ rx_desc = isert_conn->rx_descs;
+ for (i = 0; i < ISERT_QP_MAX_RECV_DTOS; i++, rx_desc++) {
+ ib_dma_unmap_single(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ kfree(isert_conn->rx_descs);
+@@ -408,10 +408,9 @@ isert_free_login_buf(struct isert_conn *isert_conn)
+ ISER_RX_PAYLOAD_SIZE, DMA_TO_DEVICE);
+ kfree(isert_conn->login_rsp_buf);
+
+- ib_dma_unmap_single(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE,
+- DMA_FROM_DEVICE);
+- kfree(isert_conn->login_req_buf);
++ ib_dma_unmap_single(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++ kfree(isert_conn->login_desc);
+ }
+
+ static int
+@@ -420,25 +419,25 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
+ {
+ int ret;
+
+- isert_conn->login_req_buf = kzalloc(sizeof(*isert_conn->login_req_buf),
++ isert_conn->login_desc = kzalloc(sizeof(*isert_conn->login_desc),
+ GFP_KERNEL);
+- if (!isert_conn->login_req_buf)
++ if (!isert_conn->login_desc)
+ return -ENOMEM;
+
+- isert_conn->login_req_dma = ib_dma_map_single(ib_dev,
+- isert_conn->login_req_buf,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
+- ret = ib_dma_mapping_error(ib_dev, isert_conn->login_req_dma);
++ isert_conn->login_desc->dma_addr = ib_dma_map_single(ib_dev,
++ isert_conn->login_desc->buf,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++ ret = ib_dma_mapping_error(ib_dev, isert_conn->login_desc->dma_addr);
+ if (ret) {
+- isert_err("login_req_dma mapping error: %d\n", ret);
+- isert_conn->login_req_dma = 0;
+- goto out_free_login_req_buf;
++ isert_err("login_desc dma mapping error: %d\n", ret);
++ isert_conn->login_desc->dma_addr = 0;
++ goto out_free_login_desc;
+ }
+
+ isert_conn->login_rsp_buf = kzalloc(ISER_RX_PAYLOAD_SIZE, GFP_KERNEL);
+ if (!isert_conn->login_rsp_buf) {
+ ret = -ENOMEM;
+- goto out_unmap_login_req_buf;
++ goto out_unmap_login_desc;
+ }
+
+ isert_conn->login_rsp_dma = ib_dma_map_single(ib_dev,
+@@ -455,11 +454,11 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
+
+ out_free_login_rsp_buf:
+ kfree(isert_conn->login_rsp_buf);
+-out_unmap_login_req_buf:
+- ib_dma_unmap_single(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
+-out_free_login_req_buf:
+- kfree(isert_conn->login_req_buf);
++out_unmap_login_desc:
++ ib_dma_unmap_single(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
++out_free_login_desc:
++ kfree(isert_conn->login_desc);
+ return ret;
+ }
+
+@@ -578,7 +577,7 @@ isert_connect_release(struct isert_conn *isert_conn)
+ ib_destroy_qp(isert_conn->qp);
+ }
+
+- if (isert_conn->login_req_buf)
++ if (isert_conn->login_desc)
+ isert_free_login_buf(isert_conn);
+
+ isert_device_put(device);
+@@ -964,17 +963,18 @@ isert_login_post_recv(struct isert_conn *isert_conn)
+ int ret;
+
+ memset(&sge, 0, sizeof(struct ib_sge));
+- sge.addr = isert_conn->login_req_dma;
++ sge.addr = isert_conn->login_desc->dma_addr +
++ isert_get_hdr_offset(isert_conn->login_desc);
+ sge.length = ISER_RX_PAYLOAD_SIZE;
+ sge.lkey = isert_conn->device->pd->local_dma_lkey;
+
+ isert_dbg("Setup sge: addr: %llx length: %d 0x%08x\n",
+ sge.addr, sge.length, sge.lkey);
+
+- isert_conn->login_req_buf->rx_cqe.done = isert_login_recv_done;
++ isert_conn->login_desc->rx_cqe.done = isert_login_recv_done;
+
+ memset(&rx_wr, 0, sizeof(struct ib_recv_wr));
+- rx_wr.wr_cqe = &isert_conn->login_req_buf->rx_cqe;
++ rx_wr.wr_cqe = &isert_conn->login_desc->rx_cqe;
+ rx_wr.sg_list = &sge;
+ rx_wr.num_sge = 1;
+
+@@ -1051,7 +1051,7 @@ post_send:
+ static void
+ isert_rx_login_req(struct isert_conn *isert_conn)
+ {
+- struct iser_rx_desc *rx_desc = isert_conn->login_req_buf;
++ struct iser_rx_desc *rx_desc = isert_conn->login_desc;
+ int rx_buflen = isert_conn->login_req_len;
+ struct iscsi_conn *conn = isert_conn->conn;
+ struct iscsi_login *login = conn->conn_login;
+@@ -1063,7 +1063,7 @@ isert_rx_login_req(struct isert_conn *isert_conn)
+
+ if (login->first_request) {
+ struct iscsi_login_req *login_req =
+- (struct iscsi_login_req *)&rx_desc->iscsi_header;
++ (struct iscsi_login_req *)isert_get_iscsi_hdr(rx_desc);
+ /*
+ * Setup the initial iscsi_login values from the leading
+ * login request PDU.
+@@ -1082,13 +1082,13 @@ isert_rx_login_req(struct isert_conn *isert_conn)
+ login->tsih = be16_to_cpu(login_req->tsih);
+ }
+
+- memcpy(&login->req[0], (void *)&rx_desc->iscsi_header, ISCSI_HDR_LEN);
++ memcpy(&login->req[0], isert_get_iscsi_hdr(rx_desc), ISCSI_HDR_LEN);
+
+ size = min(rx_buflen, MAX_KEY_VALUE_PAIRS);
+ isert_dbg("Using login payload size: %d, rx_buflen: %d "
+ "MAX_KEY_VALUE_PAIRS: %d\n", size, rx_buflen,
+ MAX_KEY_VALUE_PAIRS);
+- memcpy(login->req_buf, &rx_desc->data[0], size);
++ memcpy(login->req_buf, isert_get_data(rx_desc), size);
+
+ if (login->first_request) {
+ complete(&isert_conn->login_comp);
+@@ -1153,14 +1153,15 @@ isert_handle_scsi_cmd(struct isert_conn *isert_conn,
+ if (imm_data_len != data_len) {
+ sg_nents = max(1UL, DIV_ROUND_UP(imm_data_len, PAGE_SIZE));
+ sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,
+- &rx_desc->data[0], imm_data_len);
++ isert_get_data(rx_desc), imm_data_len);
+ isert_dbg("Copy Immediate sg_nents: %u imm_data_len: %d\n",
+ sg_nents, imm_data_len);
+ } else {
+ sg_init_table(&isert_cmd->sg, 1);
+ cmd->se_cmd.t_data_sg = &isert_cmd->sg;
+ cmd->se_cmd.t_data_nents = 1;
+- sg_set_buf(&isert_cmd->sg, &rx_desc->data[0], imm_data_len);
++ sg_set_buf(&isert_cmd->sg, isert_get_data(rx_desc),
++ imm_data_len);
+ isert_dbg("Transfer Immediate imm_data_len: %d\n",
+ imm_data_len);
+ }
+@@ -1229,9 +1230,9 @@ isert_handle_iscsi_dataout(struct isert_conn *isert_conn,
+ }
+ isert_dbg("Copying DataOut: sg_start: %p, sg_off: %u "
+ "sg_nents: %u from %p %u\n", sg_start, sg_off,
+- sg_nents, &rx_desc->data[0], unsol_data_len);
++ sg_nents, isert_get_data(rx_desc), unsol_data_len);
+
+- sg_copy_from_buffer(sg_start, sg_nents, &rx_desc->data[0],
++ sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),
+ unsol_data_len);
+
+ rc = iscsit_check_dataout_payload(cmd, hdr, false);
+@@ -1290,7 +1291,7 @@ isert_handle_text_cmd(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd
+ }
+ cmd->text_in_ptr = text_in;
+
+- memcpy(cmd->text_in_ptr, &rx_desc->data[0], payload_length);
++ memcpy(cmd->text_in_ptr, isert_get_data(rx_desc), payload_length);
+
+ return iscsit_process_text_cmd(conn, cmd, hdr);
+ }
+@@ -1300,7 +1301,7 @@ isert_rx_opcode(struct isert_conn *isert_conn, struct iser_rx_desc *rx_desc,
+ uint32_t read_stag, uint64_t read_va,
+ uint32_t write_stag, uint64_t write_va)
+ {
+- struct iscsi_hdr *hdr = &rx_desc->iscsi_header;
++ struct iscsi_hdr *hdr = isert_get_iscsi_hdr(rx_desc);
+ struct iscsi_conn *conn = isert_conn->conn;
+ struct iscsi_cmd *cmd;
+ struct isert_cmd *isert_cmd;
+@@ -1398,8 +1399,8 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ struct isert_conn *isert_conn = wc->qp->qp_context;
+ struct ib_device *ib_dev = isert_conn->cm_id->device;
+ struct iser_rx_desc *rx_desc = cqe_to_rx_desc(wc->wr_cqe);
+- struct iscsi_hdr *hdr = &rx_desc->iscsi_header;
+- struct iser_ctrl *iser_ctrl = &rx_desc->iser_header;
++ struct iscsi_hdr *hdr = isert_get_iscsi_hdr(rx_desc);
++ struct iser_ctrl *iser_ctrl = isert_get_iser_hdr(rx_desc);
+ uint64_t read_va = 0, write_va = 0;
+ uint32_t read_stag = 0, write_stag = 0;
+
+@@ -1413,7 +1414,7 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ rx_desc->in_use = true;
+
+ ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+
+ isert_dbg("DMA: 0x%llx, iSCSI opcode: 0x%02x, ITT: 0x%08x, flags: 0x%02x dlen: %d\n",
+ rx_desc->dma_addr, hdr->opcode, hdr->itt, hdr->flags,
+@@ -1448,7 +1449,7 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ read_stag, read_va, write_stag, write_va);
+
+ ib_dma_sync_single_for_device(ib_dev, rx_desc->dma_addr,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ static void
+@@ -1462,8 +1463,8 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ return;
+ }
+
+- ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+
+ isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN;
+
+@@ -1478,8 +1479,8 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc)
+ complete(&isert_conn->login_req_comp);
+ mutex_unlock(&isert_conn->mutex);
+
+- ib_dma_sync_single_for_device(ib_dev, isert_conn->login_req_dma,
+- ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE);
++ ib_dma_sync_single_for_device(ib_dev, isert_conn->login_desc->dma_addr,
++ ISER_RX_SIZE, DMA_FROM_DEVICE);
+ }
+
+ static void
+diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
+index 3b296bac4f603..d267a6d60d87d 100644
+--- a/drivers/infiniband/ulp/isert/ib_isert.h
++++ b/drivers/infiniband/ulp/isert/ib_isert.h
+@@ -59,9 +59,11 @@
+ ISERT_MAX_TX_MISC_PDUS + \
+ ISERT_MAX_RX_MISC_PDUS)
+
+-#define ISER_RX_PAD_SIZE (ISCSI_DEF_MAX_RECV_SEG_LEN + 4096 - \
+- (ISER_RX_PAYLOAD_SIZE + sizeof(u64) + sizeof(struct ib_sge) + \
+- sizeof(struct ib_cqe) + sizeof(bool)))
++/*
++ * RX size is default of 8k plus headers, but data needs to align to
++ * 512 boundary, so use 1024 to have the extra space for alignment.
++ */
++#define ISER_RX_SIZE (ISCSI_DEF_MAX_RECV_SEG_LEN + 1024)
+
+ #define ISCSI_ISER_SG_TABLESIZE 256
+
+@@ -80,21 +82,41 @@ enum iser_conn_state {
+ };
+
+ struct iser_rx_desc {
+- struct iser_ctrl iser_header;
+- struct iscsi_hdr iscsi_header;
+- char data[ISCSI_DEF_MAX_RECV_SEG_LEN];
++ char buf[ISER_RX_SIZE];
+ u64 dma_addr;
+ struct ib_sge rx_sg;
+ struct ib_cqe rx_cqe;
+ bool in_use;
+- char pad[ISER_RX_PAD_SIZE];
+-} __packed;
++};
+
+ static inline struct iser_rx_desc *cqe_to_rx_desc(struct ib_cqe *cqe)
+ {
+ return container_of(cqe, struct iser_rx_desc, rx_cqe);
+ }
+
++static void *isert_get_iser_hdr(struct iser_rx_desc *desc)
++{
++ return PTR_ALIGN(desc->buf + ISER_HEADERS_LEN, 512) - ISER_HEADERS_LEN;
++}
++
++static size_t isert_get_hdr_offset(struct iser_rx_desc *desc)
++{
++ return isert_get_iser_hdr(desc) - (void *)desc->buf;
++}
++
++static void *isert_get_iscsi_hdr(struct iser_rx_desc *desc)
++{
++ return isert_get_iser_hdr(desc) + sizeof(struct iser_ctrl);
++}
++
++static void *isert_get_data(struct iser_rx_desc *desc)
++{
++ void *data = isert_get_iser_hdr(desc) + ISER_HEADERS_LEN;
++
++ WARN_ON((uintptr_t)data & 511);
++ return data;
++}
++
+ struct iser_tx_desc {
+ struct iser_ctrl iser_header;
+ struct iscsi_hdr iscsi_header;
+@@ -141,9 +163,8 @@ struct isert_conn {
+ u32 responder_resources;
+ u32 initiator_depth;
+ bool pi_support;
+- struct iser_rx_desc *login_req_buf;
++ struct iser_rx_desc *login_desc;
+ char *login_rsp_buf;
+- u64 login_req_dma;
+ int login_req_len;
+ u64 login_rsp_dma;
+ struct iser_rx_desc *rx_descs;
+--
+2.25.1
+
--- /dev/null
+From 7524ad369768ab6c2770b8018c90b209efadb50c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 11:32:18 +0200
+Subject: iio: adc: mcp3422: fix locking on error path
+
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+
+[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]
+
+Reading from the chip should be unlocked on error path else the lock
+could never being released.
+
+Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
+Fixes: 3f1093d83d71 ("iio: adc: mcp3422: fix locking scope")
+Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3422.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index ea24d7c58b127..4d03b1f265d9c 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -144,8 +144,10 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ config &= ~MCP3422_PGA_MASK;
+ config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
+ ret = mcp3422_update_config(adc, config);
+- if (ret < 0)
++ if (ret < 0) {
++ mutex_unlock(&adc->lock);
+ return ret;
++ }
+ msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f496ac3c6dca868c2110e3ba49a7ebbc37edee24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:54:15 +0200
+Subject: iommu/amd: Do not use IOMMUv2 functionality when SME is active
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 2822e582501b65707089b097e773e6fd70774841 ]
+
+When memory encryption is active the device is likely not in a direct
+mapped domain. Forbid using IOMMUv2 functionality for now until finer
+grained checks for this have been implemented.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Link: https://lore.kernel.org/r/20200824105415.21000-3-joro@8bytes.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_v2.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
+index d6d85debd01b0..05f3d93cf480c 100644
+--- a/drivers/iommu/amd_iommu_v2.c
++++ b/drivers/iommu/amd_iommu_v2.c
+@@ -741,6 +741,13 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
+
+ might_sleep();
+
++ /*
++ * When memory encryption is active the device is likely not in a
++ * direct-mapped domain. Forbid using IOMMUv2 functionality for now.
++ */
++ if (mem_encrypt_active())
++ return -ENODEV;
++
+ if (!amd_iommu_v2_supported())
+ return -ENODEV;
+
+--
+2.25.1
+
--- /dev/null
+From 3faf19489a258c77e9e66898ad3ebc5a4f88b740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:10:33 -0700
+Subject: irqchip/eznps: Fix build error for !ARC700 builds
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit 89d29997f103d08264b0685796b420d911658b96 ]
+
+eznps driver is supposed to be platform independent however it ends up
+including stuff from inside arch/arc headers leading to rand config
+build errors.
+
+The quick hack to fix this (proper fix is too much chrun for non active
+user-base) is to add following to nps platform agnostic header.
+ - copy AUX_IENABLE from arch/arc header
+ - move CTOP_AUX_IACK from arch/arc/plat-eznps/*/**
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lkml.kernel.org/r/20200824095831.5lpkmkafelnvlpi2@linutronix.de
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/plat-eznps/include/plat/ctop.h | 1 -
+ include/soc/nps/common.h | 6 ++++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
+index a4a61531c7fb9..77712c5ffe848 100644
+--- a/arch/arc/plat-eznps/include/plat/ctop.h
++++ b/arch/arc/plat-eznps/include/plat/ctop.h
+@@ -33,7 +33,6 @@
+ #define CTOP_AUX_DPC (CTOP_AUX_BASE + 0x02C)
+ #define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)
+ #define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080)
+-#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)
+ #define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)
+ #define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
+
+diff --git a/include/soc/nps/common.h b/include/soc/nps/common.h
+index 9b1d43d671a3f..8c18dc6d3fde5 100644
+--- a/include/soc/nps/common.h
++++ b/include/soc/nps/common.h
+@@ -45,6 +45,12 @@
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422
+
++#ifndef AUX_IENABLE
++#define AUX_IENABLE 0x40c
++#endif
++
++#define CTOP_AUX_IACK (0xFFFFF800 + 0x088)
++
+ #ifndef __ASSEMBLY__
+
+ /* In order to increase compilation test coverage */
+--
+2.25.1
+
--- /dev/null
+From f48b81142fbdf57a18a30723b9a2e4c27713bfd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 15:10:32 -0600
+Subject: mmc: sdhci-acpi: Clear amd_sdhci_host on reset
+
+From: Raul E Rangel <rrangel@chromium.org>
+
+[ Upstream commit 2cf9bfe9be75ed3656bbf882fb70c3e3047866e4 ]
+
+The commit 61d7437ed1390 ("mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040")
+broke resume for eMMC HS400. When the system suspends the eMMC controller
+is powered down. So, on resume we need to reinitialize the controller.
+Although, amd_sdhci_host was not getting cleared, so the DLL was never
+re-enabled on resume. This results in HS400 being non-functional.
+
+To fix the problem, this change clears the tuned_clock flag, clears the
+dll_enabled flag and disables the DLL on reset.
+
+Fixes: 61d7437ed1390 ("mmc: sdhci-acpi: Fix HS400 tuning for AMDI0040")
+Signed-off-by: Raul E Rangel <rrangel@chromium.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20200831150517.1.I93c78bfc6575771bb653c9d3fca5eb018a08417d@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-acpi.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 5581a5c86fce3..b2d924c5e82ee 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -547,12 +547,18 @@ static int amd_select_drive_strength(struct mmc_card *card,
+ return MMC_SET_DRIVER_TYPE_A;
+ }
+
+-static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host)
++static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host, bool enable)
+ {
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
++
+ /* AMD Platform requires dll setting */
+ sdhci_writel(host, 0x40003210, SDHCI_AMD_RESET_DLL_REGISTER);
+ usleep_range(10, 20);
+- sdhci_writel(host, 0x40033210, SDHCI_AMD_RESET_DLL_REGISTER);
++ if (enable)
++ sdhci_writel(host, 0x40033210, SDHCI_AMD_RESET_DLL_REGISTER);
++
++ amd_host->dll_enabled = enable;
+ }
+
+ /*
+@@ -592,10 +598,8 @@ static void amd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+
+ /* DLL is only required for HS400 */
+ if (host->timing == MMC_TIMING_MMC_HS400 &&
+- !amd_host->dll_enabled) {
+- sdhci_acpi_amd_hs400_dll(host);
+- amd_host->dll_enabled = true;
+- }
++ !amd_host->dll_enabled)
++ sdhci_acpi_amd_hs400_dll(host, true);
+ }
+ }
+
+@@ -616,10 +620,23 @@ static int amd_sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ return err;
+ }
+
++static void amd_sdhci_reset(struct sdhci_host *host, u8 mask)
++{
++ struct sdhci_acpi_host *acpi_host = sdhci_priv(host);
++ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host);
++
++ if (mask & SDHCI_RESET_ALL) {
++ amd_host->tuned_clock = false;
++ sdhci_acpi_amd_hs400_dll(host, false);
++ }
++
++ sdhci_reset(host, mask);
++}
++
+ static const struct sdhci_ops sdhci_acpi_ops_amd = {
+ .set_clock = sdhci_set_clock,
+ .set_bus_width = sdhci_set_bus_width,
+- .reset = sdhci_reset,
++ .reset = amd_sdhci_reset,
+ .set_uhs_signaling = sdhci_set_uhs_signaling,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 685f13c43be8149aa18df8791c437e38b821ae03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 07:58:41 -0700
+Subject: mmc: sdhci-msm: Add retries when all tuning phases are found valid
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9d5dcefb7b114d610aeb2371f6a6f119af316e43 ]
+
+As the comments in this patch say, if we tune and find all phases are
+valid it's _almost_ as bad as no phases being found valid. Probably
+all phases are not really reliable but we didn't detect where the
+unreliable place is. That means we'll essentially be guessing and
+hoping we get a good phase.
+
+This is not just a problem in theory. It was causing real problems on
+a real board. On that board, most often phase 10 is found as the only
+invalid phase, though sometimes 10 and 11 are invalid and sometimes
+just 11. Some percentage of the time, however, all phases are found
+to be valid. When this happens, the current logic will decide to use
+phase 11. Since phase 11 is sometimes found to be invalid, this is a
+bad choice. Sure enough, when phase 11 is picked we often get mmc
+errors later in boot.
+
+I have seen cases where all phases were found to be valid 3 times in a
+row, so increase the retry count to 10 just to be extra sure.
+
+Fixes: 415b5a75da43 ("mmc: sdhci-msm: Add platform_execute_tuning implementation")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20200827075809.1.If179abf5ecb67c963494db79c3bc4247d987419b@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 84cffdef264b7..8bed81cf03adc 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1096,7 +1096,7 @@ static void sdhci_msm_set_cdr(struct sdhci_host *host, bool enable)
+ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+- int tuning_seq_cnt = 3;
++ int tuning_seq_cnt = 10;
+ u8 phase, tuned_phases[16], tuned_phase_cnt = 0;
+ int rc;
+ struct mmc_ios ios = host->mmc->ios;
+@@ -1152,6 +1152,22 @@ retry:
+ } while (++phase < ARRAY_SIZE(tuned_phases));
+
+ if (tuned_phase_cnt) {
++ if (tuned_phase_cnt == ARRAY_SIZE(tuned_phases)) {
++ /*
++ * All phases valid is _almost_ as bad as no phases
++ * valid. Probably all phases are not really reliable
++ * but we didn't detect where the unreliable place is.
++ * That means we'll essentially be guessing and hoping
++ * we get a good phase. Better to try a few times.
++ */
++ dev_dbg(mmc_dev(mmc), "%s: All phases valid; try again\n",
++ mmc_hostname(mmc));
++ if (--tuning_seq_cnt) {
++ tuned_phase_cnt = 0;
++ goto retry;
++ }
++ }
++
+ rc = msm_find_most_appropriate_phase(host, tuned_phases,
+ tuned_phase_cnt);
+ if (rc < 0)
+--
+2.25.1
+
--- /dev/null
+From a131c52db2d0b56ceafe77f8da12b5640fa5ea30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 13:11:50 +0800
+Subject: net: hns3: Fix for geneve tx checksum bug
+
+From: Yi Li <yili@winhong.com>
+
+[ Upstream commit a156998fc92d3859c8e820f1583f6d0541d643c3 ]
+
+when skb->encapsulation is 0, skb->ip_summed is CHECKSUM_PARTIAL
+and it is udp packet, which has a dest port as the IANA assigned.
+the hardware is expected to do the checksum offload, but the
+hardware will not do the checksum offload when udp dest port is
+6081.
+
+This patch fixes it by doing the checksum in software.
+
+Reported-by: Li Bing <libing@winhong.com>
+Signed-off-by: Yi Li <yili@winhong.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index a8ce6ca0f5081..92af7204711c8 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -21,6 +21,7 @@
+ #include <net/pkt_cls.h>
+ #include <net/tcp.h>
+ #include <net/vxlan.h>
++#include <net/geneve.h>
+
+ #include "hnae3.h"
+ #include "hns3_enet.h"
+@@ -795,7 +796,7 @@ static int hns3_get_l4_protocol(struct sk_buff *skb, u8 *ol4_proto,
+ * and it is udp packet, which has a dest port as the IANA assigned.
+ * the hardware is expected to do the checksum offload, but the
+ * hardware will not do the checksum offload when udp dest port is
+- * 4789.
++ * 4789 or 6081.
+ */
+ static bool hns3_tunnel_csum_bug(struct sk_buff *skb)
+ {
+@@ -804,7 +805,8 @@ static bool hns3_tunnel_csum_bug(struct sk_buff *skb)
+ l4.hdr = skb_transport_header(skb);
+
+ if (!(!skb->encapsulation &&
+- l4.udp->dest == htons(IANA_VXLAN_UDP_PORT)))
++ (l4.udp->dest == htons(IANA_VXLAN_UDP_PORT) ||
++ l4.udp->dest == htons(GENEVE_UDP_PORT))))
+ return false;
+
+ skb_checksum_help(skb);
+--
+2.25.1
+
--- /dev/null
+From 60f49812982c1bf0f64578d466a9a4ba095ee7d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 16:15:58 +0200
+Subject: netfilter: conntrack: allow sctp hearbeat after connection re-use
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit cc5453a5b7e90c39f713091a7ebc53c1f87d1700 ]
+
+If an sctp connection gets re-used, heartbeats are flagged as invalid
+because their vtag doesn't match.
+
+Handle this in a similar way as TCP conntrack when it suspects that the
+endpoints and conntrack are out-of-sync.
+
+When a HEARTBEAT request fails its vtag validation, flag this in the
+conntrack state and accept the packet.
+
+When a HEARTBEAT_ACK is received with an invalid vtag in the reverse
+direction after we allowed such a HEARTBEAT through, assume we are
+out-of-sync and re-set the vtag info.
+
+v2: remove left-over snippet from an older incarnation that moved
+ new_state/old_state assignments, thats not needed so keep that
+ as-is.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nf_conntrack_sctp.h | 2 ++
+ net/netfilter/nf_conntrack_proto_sctp.c | 39 ++++++++++++++++++---
+ 2 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/netfilter/nf_conntrack_sctp.h b/include/linux/netfilter/nf_conntrack_sctp.h
+index 9a33f171aa822..625f491b95de8 100644
+--- a/include/linux/netfilter/nf_conntrack_sctp.h
++++ b/include/linux/netfilter/nf_conntrack_sctp.h
+@@ -9,6 +9,8 @@ struct ip_ct_sctp {
+ enum sctp_conntrack state;
+
+ __be32 vtag[IP_CT_DIR_MAX];
++ u8 last_dir;
++ u8 flags;
+ };
+
+ #endif /* _NF_CONNTRACK_SCTP_H */
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 4f897b14b6069..810cca24b3990 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -62,6 +62,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
+ [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
+ };
+
++#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
++
+ #define sNO SCTP_CONNTRACK_NONE
+ #define sCL SCTP_CONNTRACK_CLOSED
+ #define sCW SCTP_CONNTRACK_COOKIE_WAIT
+@@ -369,6 +371,7 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ u_int32_t offset, count;
+ unsigned int *timeouts;
+ unsigned long map[256 / sizeof(unsigned long)] = { 0 };
++ bool ignore = false;
+
+ if (sctp_error(skb, dataoff, state))
+ return -NF_ACCEPT;
+@@ -427,15 +430,39 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ /* Sec 8.5.1 (D) */
+ if (sh->vtag != ct->proto.sctp.vtag[dir])
+ goto out_unlock;
+- } else if (sch->type == SCTP_CID_HEARTBEAT ||
+- sch->type == SCTP_CID_HEARTBEAT_ACK) {
++ } else if (sch->type == SCTP_CID_HEARTBEAT) {
++ if (ct->proto.sctp.vtag[dir] == 0) {
++ pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.last_dir = dir;
++ ignore = true;
++ continue;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ }
++ } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) {
+ if (ct->proto.sctp.vtag[dir] == 0) {
+ pr_debug("Setting vtag %x for dir %d\n",
+ sh->vtag, dir);
+ ct->proto.sctp.vtag[dir] = sh->vtag;
+ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
+- pr_debug("Verification tag check failed\n");
+- goto out_unlock;
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 ||
++ ct->proto.sctp.last_dir == dir)
++ goto out_unlock;
++
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ ct->proto.sctp.vtag[!dir] = 0;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
+ }
+ }
+
+@@ -470,6 +497,10 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,
+ }
+ spin_unlock_bh(&ct->lock);
+
++ /* allow but do not refresh timeout */
++ if (ignore)
++ return NF_ACCEPT;
++
+ timeouts = nf_ct_timeout_lookup(ct);
+ if (!timeouts)
+ timeouts = nf_sctp_pernet(nf_ct_net(ct))->timeouts;
+--
+2.25.1
+
--- /dev/null
+From c9156ad915d3bce4c1d5d9be2bdf55159bd84047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 15:23:43 +0800
+Subject: NFC: st95hf: Fix memleak in st95hf_in_send_cmd
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit f97c04c316d8fea16dca449fdfbe101fbdfee6a2 ]
+
+When down_killable() fails, skb_resp should be freed
+just like when st95hf_spi_send() fails.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st95hf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 9642971e89cea..4578547659839 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -966,7 +966,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
+ rc = down_killable(&stcontext->exchange_lock);
+ if (rc) {
+ WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
+- return rc;
++ goto free_skb_resp;
+ }
+
+ rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
+--
+2.25.1
+
--- /dev/null
+From f7fc07c3bff43e10b52ebb9526b2fb4a926f6c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 12:56:08 -0700
+Subject: nvme-fabrics: allow to queue requests for live queues
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 73a5379937ec89b91e907bb315e2434ee9696a2c ]
+
+Right now we are failing requests based on the controller state (which
+is checked inline in nvmf_check_ready) however we should definitely
+accept requests if the queue is live.
+
+When entering controller reset, we transition the controller into
+NVME_CTRL_RESETTING, and then return BLK_STS_RESOURCE for non-mpath
+requests (have blk_noretry_request set).
+
+This is also the case for NVME_REQ_USER for the wrong reason. There
+shouldn't be any reason for us to reject this I/O in a controller reset.
+We do want to prevent passthru commands on the admin queue because we
+need the controller to fully initialize first before we let user passthru
+admin commands to be issued.
+
+In a non-mpath setup, this means that the requests will simply be
+requeued over and over forever not allowing the q_usage_counter to drop
+its final reference, causing controller reset to hang if running
+concurrently with heavy I/O.
+
+Fixes: 35897b920c8a ("nvme-fabrics: fix and refine state checks in __nvmf_check_ready")
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 74b8818ac9a1e..aa8d0805ba148 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -565,10 +565,14 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ struct nvme_request *req = nvme_req(rq);
+
+ /*
+- * If we are in some state of setup or teardown only allow
+- * internally generated commands.
++ * currently we have a problem sending passthru commands
++ * on the admin_q if the controller is not LIVE because we can't
++ * make sure that they are going out after the admin connect,
++ * controller enable and/or other commands in the initialization
++ * sequence. until the controller will be LIVE, fail with
++ * BLK_STS_RESOURCE so that they will be rescheduled.
+ */
+- if (!blk_rq_is_passthrough(rq) || (req->flags & NVME_REQ_USERCMD))
++ if (rq->q == ctrl->admin_q && (req->flags & NVME_REQ_USERCMD))
+ return false;
+
+ /*
+@@ -578,7 +582,7 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ switch (ctrl->state) {
+ case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+- if (nvme_is_fabrics(req->cmd) &&
++ if (blk_rq_is_passthrough(rq) && nvme_is_fabrics(req->cmd) &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+ return true;
+ break;
+--
+2.25.1
+
--- /dev/null
+From b087604ccb8e6944d45006732a293d0522e39003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 11:46:51 -0700
+Subject: nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit d7144f5c4cf4de95fdc3422943cf51c06aeaf7a7 ]
+
+NVME_CTRL_NEW should never see any I/O, because in order to start
+initialization it has to transition to NVME_CTRL_CONNECTING and from
+there it will never return to this state.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index aa8d0805ba148..3bb71f177dfda 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -580,7 +580,6 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ * which is require to set the queue live in the appropinquate states.
+ */
+ switch (ctrl->state) {
+- case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+ if (blk_rq_is_passthrough(rq) && nvme_is_fabrics(req->cmd) &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+--
+2.25.1
+
--- /dev/null
+From 82823853e01a02d6303a3a12fdad5ec3d2bb002c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:24:45 -0700
+Subject: nvme: have nvme_wait_freeze_timeout return if it timed out
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 7cf0d7c0f3c3b0203aaf81c1bc884924d8fdb9bd ]
+
+Users can detect if the wait has completed or not and take appropriate
+actions based on this information (e.g. weather to continue
+initialization or rather fail and schedule another initialization
+attempt).
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ drivers/nvme/host/nvme.h | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 3cb017fa3a790..2d2673d360ff2 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4148,7 +4148,7 @@ void nvme_unfreeze(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_unfreeze);
+
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ {
+ struct nvme_ns *ns;
+
+@@ -4159,6 +4159,7 @@ void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ break;
+ }
+ up_read(&ctrl->namespaces_rwsem);
++ return timeout;
+ }
+ EXPORT_SYMBOL_GPL(nvme_wait_freeze_timeout);
+
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 056953bd8bd81..2bd9f7c3084f2 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -485,7 +485,7 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl);
+ void nvme_sync_queues(struct nvme_ctrl *ctrl);
+ void nvme_unfreeze(struct nvme_ctrl *ctrl);
+ void nvme_wait_freeze(struct nvme_ctrl *ctrl);
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
+ void nvme_start_freeze(struct nvme_ctrl *ctrl);
+
+ #define NVME_QID_ANY -1
+--
+2.25.1
+
--- /dev/null
+From cc626d3f8dba319267f5e1eeb99a578d2f15c63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 10:17:08 -0400
+Subject: nvme-pci: cancel nvme device request before disabling
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 7ad92f656bddff4cf8f641e0e3b1acd4eb9644cb ]
+
+This patch addresses an irq free warning and null pointer dereference
+error problem when nvme devices got timeout error during initialization.
+This problem happens when nvme_timeout() function is called while
+nvme_reset_work() is still in execution. This patch fixed the problem by
+setting flag of the problematic request to NVME_REQ_CANCELLED before
+calling nvme_dev_disable() to make sure __nvme_submit_sync_cmd() returns
+an error code and let nvme_submit_sync_cmd() fail gracefully.
+The following is console output.
+
+[ 62.472097] nvme nvme0: I/O 13 QID 0 timeout, disable controller
+[ 62.488796] nvme nvme0: could not set timestamp (881)
+[ 62.494888] ------------[ cut here ]------------
+[ 62.495142] Trying to free already-free IRQ 11
+[ 62.495366] WARNING: CPU: 0 PID: 7 at kernel/irq/manage.c:1751 free_irq+0x1f7/0x370
+[ 62.495742] Modules linked in:
+[ 62.495902] CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.8.0+ #8
+[ 62.496206] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-p4
+[ 62.496772] Workqueue: nvme-reset-wq nvme_reset_work
+[ 62.497019] RIP: 0010:free_irq+0x1f7/0x370
+[ 62.497223] Code: e8 ce 49 11 00 48 83 c4 08 4c 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 44 89 f6 48 c70
+[ 62.498133] RSP: 0000:ffffa96800043d40 EFLAGS: 00010086
+[ 62.498391] RAX: 0000000000000000 RBX: ffff9b87fc458400 RCX: 0000000000000000
+[ 62.498741] RDX: 0000000000000001 RSI: 0000000000000096 RDI: ffffffff9693d72c
+[ 62.499091] RBP: ffff9b87fd4c8f60 R08: ffffa96800043bfd R09: 0000000000000163
+[ 62.499440] R10: ffffa96800043bf8 R11: ffffa96800043bfd R12: ffff9b87fd4c8e00
+[ 62.499790] R13: ffff9b87fd4c8ea4 R14: 000000000000000b R15: ffff9b87fd76b000
+[ 62.500140] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 62.500534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 62.500816] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 62.501165] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 62.501515] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 62.501864] Call Trace:
+[ 62.501993] pci_free_irq+0x13/0x20
+[ 62.502167] nvme_reset_work+0x5d0/0x12a0
+[ 62.502369] ? update_load_avg+0x59/0x580
+[ 62.502569] ? ttwu_queue_wakelist+0xa8/0xc0
+[ 62.502780] ? try_to_wake_up+0x1a2/0x450
+[ 62.502979] process_one_work+0x1d2/0x390
+[ 62.503179] worker_thread+0x45/0x3b0
+[ 62.503361] ? process_one_work+0x390/0x390
+[ 62.503568] kthread+0xf9/0x130
+[ 62.503726] ? kthread_park+0x80/0x80
+[ 62.503911] ret_from_fork+0x22/0x30
+[ 62.504090] ---[ end trace de9ed4a70f8d71e2 ]---
+[ 123.912275] nvme nvme0: I/O 12 QID 0 timeout, disable controller
+[ 123.914670] nvme nvme0: 1/0/0 default/read/poll queues
+[ 123.916310] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[ 123.917469] #PF: supervisor write access in kernel mode
+[ 123.917725] #PF: error_code(0x0002) - not-present page
+[ 123.917976] PGD 0 P4D 0
+[ 123.918109] Oops: 0002 [#1] SMP PTI
+[ 123.918283] CPU: 0 PID: 7 Comm: kworker/u4:0 Tainted: G W 5.8.0+ #8
+[ 123.918650] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-p4
+[ 123.919219] Workqueue: nvme-reset-wq nvme_reset_work
+[ 123.919469] RIP: 0010:__blk_mq_alloc_map_and_request+0x21/0x80
+[ 123.919757] Code: 66 0f 1f 84 00 00 00 00 00 41 55 41 54 55 48 63 ee 53 48 8b 47 68 89 ee 48 89 fb 8b4
+[ 123.920657] RSP: 0000:ffffa96800043d40 EFLAGS: 00010286
+[ 123.920912] RAX: ffff9b87fc4fee40 RBX: ffff9b87fc8cb008 RCX: 0000000000000000
+[ 123.921258] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9b87fc618000
+[ 123.921602] RBP: 0000000000000000 R08: ffff9b87fdc2c4a0 R09: ffff9b87fc616000
+[ 123.921949] R10: 0000000000000000 R11: ffff9b87fffd1500 R12: 0000000000000000
+[ 123.922295] R13: 0000000000000000 R14: ffff9b87fc8cb200 R15: ffff9b87fc8cb000
+[ 123.922641] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 123.923032] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 123.923312] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 123.923660] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 123.924007] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 123.924353] Call Trace:
+[ 123.924479] blk_mq_alloc_tag_set+0x137/0x2a0
+[ 123.924694] nvme_reset_work+0xed6/0x12a0
+[ 123.924898] process_one_work+0x1d2/0x390
+[ 123.925099] worker_thread+0x45/0x3b0
+[ 123.925280] ? process_one_work+0x390/0x390
+[ 123.925486] kthread+0xf9/0x130
+[ 123.925642] ? kthread_park+0x80/0x80
+[ 123.925825] ret_from_fork+0x22/0x30
+[ 123.926004] Modules linked in:
+[ 123.926158] CR2: 0000000000000000
+[ 123.926322] ---[ end trace de9ed4a70f8d71e3 ]---
+[ 123.926549] RIP: 0010:__blk_mq_alloc_map_and_request+0x21/0x80
+[ 123.926832] Code: 66 0f 1f 84 00 00 00 00 00 41 55 41 54 55 48 63 ee 53 48 8b 47 68 89 ee 48 89 fb 8b4
+[ 123.927734] RSP: 0000:ffffa96800043d40 EFLAGS: 00010286
+[ 123.927989] RAX: ffff9b87fc4fee40 RBX: ffff9b87fc8cb008 RCX: 0000000000000000
+[ 123.928336] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9b87fc618000
+[ 123.928679] RBP: 0000000000000000 R08: ffff9b87fdc2c4a0 R09: ffff9b87fc616000
+[ 123.929025] R10: 0000000000000000 R11: ffff9b87fffd1500 R12: 0000000000000000
+[ 123.929370] R13: 0000000000000000 R14: ffff9b87fc8cb200 R15: ffff9b87fc8cb000
+[ 123.929715] FS: 0000000000000000(0000) GS:ffff9b87fdc00000(0000) knlGS:0000000000000000
+[ 123.930106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 123.930384] CR2: 0000000000000000 CR3: 000000003aa0a000 CR4: 00000000000006f0
+[ 123.930731] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 123.931077] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Co-developed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 100da11ce98cb..a91433bdf5de4 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1274,8 +1274,8 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ dev_warn_ratelimited(dev->ctrl.device,
+ "I/O %d QID %d timeout, disable controller\n",
+ req->tag, nvmeq->qid);
+- nvme_dev_disable(dev, true);
+ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
++ nvme_dev_disable(dev, true);
+ return BLK_EH_DONE;
+ case NVME_CTRL_RESETTING:
+ return BLK_EH_RESET_TIMER;
+@@ -1292,10 +1292,10 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
+ dev_warn(dev->ctrl.device,
+ "I/O %d QID %d timeout, reset controller\n",
+ req->tag, nvmeq->qid);
++ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ nvme_dev_disable(dev, false);
+ nvme_reset_ctrl(&dev->ctrl);
+
+- nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ return BLK_EH_DONE;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 13fd213330f95bc8884c04f3b9fd4a399af5347d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:42:42 -0700
+Subject: nvme-rdma: fix reset hang if controller died in the middle of a reset
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 2362acb6785611eda795bfc12e1ea6b202ecf62c ]
+
+If the controller becomes unresponsive in the middle of a reset, we
+will hang because we are waiting for the freeze to complete, but that
+cannot happen since we have commands that are inflight holding the
+q_usage_counter, and we can't blindly fail requests that times out.
+
+So give a timeout and if we cannot wait for queue freeze before
+unfreezing, fail and have the error handling take care how to
+proceed (either schedule a reconnect of remove the controller).
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 4e73da2c45bb6..f0847f2bb117b 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -899,7 +899,15 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ if (!new) {
+ nvme_start_queues(&ctrl->ctrl);
+- nvme_wait_freeze(&ctrl->ctrl);
++ if (!nvme_wait_freeze_timeout(&ctrl->ctrl, NVME_IO_TIMEOUT)) {
++ /*
++ * If we timed out waiting for freeze we are likely to
++ * be stuck. Fail the controller initialization just
++ * to be safe.
++ */
++ ret = -ENODEV;
++ goto out_wait_freeze_timed_out;
++ }
+ blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
+ ctrl->ctrl.queue_count - 1);
+ nvme_unfreeze(&ctrl->ctrl);
+@@ -907,6 +915,9 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ return 0;
+
++out_wait_freeze_timed_out:
++ nvme_stop_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.connect_q);
+--
+2.25.1
+
--- /dev/null
+From c7eefd4167d82e736194a02662997623cf90dc80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 02:36:03 -0700
+Subject: nvme-rdma: fix timeout handler
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0475a8dcbcee92a5d22e40c9c6353829fc6294b8 ]
+
+When a request times out in a LIVE state, we simply trigger error
+recovery and let the error recovery handle the request cancellation,
+however when a request times out in a non LIVE state, we make sure to
+complete it immediately as it might block controller setup or teardown
+and prevent forward progress.
+
+However tearing down the entire set of I/O and admin queues causes
+freeze/unfreeze imbalance (q->mq_freeze_depth) because and is really
+an overkill to what we actually need, which is to just fence controller
+teardown that may be running, stop the queue, and cancel the request if
+it is not already completed.
+
+Now that we have the controller teardown_lock, we can safely serialize
+request cancellation. This addresses a hang caused by calling extra
+queue freeze on controller namespaces, causing unfreeze to not complete
+correctly.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 49 +++++++++++++++++++++++++++-------------
+ 1 file changed, 33 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index b164c662fed30..4e73da2c45bb6 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1101,6 +1101,7 @@ static void nvme_rdma_error_recovery(struct nvme_rdma_ctrl *ctrl)
+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
+ return;
+
++ dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+ queue_work(nvme_reset_wq, &ctrl->err_work);
+ }
+
+@@ -1704,6 +1705,22 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
+ return 0;
+ }
+
++static void nvme_rdma_complete_timed_out(struct request *rq)
++{
++ struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_rdma_queue *queue = req->queue;
++ struct nvme_rdma_ctrl *ctrl = queue->ctrl;
++
++ /* fence other contexts that may complete the command */
++ mutex_lock(&ctrl->teardown_lock);
++ nvme_rdma_stop_queue(queue);
++ if (!blk_mq_request_completed(rq)) {
++ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
++ blk_mq_complete_request(rq);
++ }
++ mutex_unlock(&ctrl->teardown_lock);
++}
++
+ static enum blk_eh_timer_return
+ nvme_rdma_timeout(struct request *rq, bool reserved)
+ {
+@@ -1714,29 +1731,29 @@ nvme_rdma_timeout(struct request *rq, bool reserved)
+ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n",
+ rq->tag, nvme_rdma_queue_idx(queue));
+
+- /*
+- * Restart the timer if a controller reset is already scheduled. Any
+- * timed out commands would be handled before entering the connecting
+- * state.
+- */
+- if (ctrl->ctrl.state == NVME_CTRL_RESETTING)
+- return BLK_EH_RESET_TIMER;
+-
+ if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
+ /*
+- * Teardown immediately if controller times out while starting
+- * or we are already started error recovery. all outstanding
+- * requests are completed on shutdown, so we return BLK_EH_DONE.
++ * If we are resetting, connecting or deleting we should
++ * complete immediately because we may block controller
++ * teardown or setup sequence
++ * - ctrl disable/shutdown fabrics requests
++ * - connect requests
++ * - initialization admin requests
++ * - I/O requests that entered after unquiescing and
++ * the controller stopped responding
++ *
++ * All other requests should be cancelled by the error
++ * recovery work, so it's fine that we fail it here.
+ */
+- flush_work(&ctrl->err_work);
+- nvme_rdma_teardown_io_queues(ctrl, false);
+- nvme_rdma_teardown_admin_queue(ctrl, false);
++ nvme_rdma_complete_timed_out(rq);
+ return BLK_EH_DONE;
+ }
+
+- dev_warn(ctrl->ctrl.device, "starting error recovery\n");
++ /*
++ * LIVE state should trigger the normal error recovery which will
++ * handle completing this request.
++ */
+ nvme_rdma_error_recovery(ctrl);
+-
+ return BLK_EH_RESET_TIMER;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a96319d7f42b1ec509c04c85fc1cc0095c16e2f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 18:13:58 -0700
+Subject: nvme-rdma: serialize controller teardown sequences
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 5110f40241d08334375eb0495f174b1d2c07657e ]
+
+In the timeout handler we may need to complete a request because the
+request that timed out may be an I/O that is a part of a serial sequence
+of controller teardown or initialization. In order to complete the
+request, we need to fence any other context that may compete with us
+and complete the request that is timing out.
+
+In this case, we could have a potential double completion in case
+a hard-irq or a different competing context triggered error recovery
+and is running inflight request cancellation concurrently with the
+timeout handler.
+
+Protect using a ctrl teardown_lock to serialize contexts that may
+complete a cancelled request due to error recovery or a reset.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index d0336545e1fe0..b164c662fed30 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -110,6 +110,7 @@ struct nvme_rdma_ctrl {
+ struct sockaddr_storage src_addr;
+
+ struct nvme_ctrl ctrl;
++ struct mutex teardown_lock;
+ bool use_inline_data;
+ u32 io_queues[HCTX_MAX_TYPES];
+ };
+@@ -920,6 +921,7 @@ out_free_io_queues:
+ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (ctrl->ctrl.admin_tagset) {
+@@ -930,11 +932,13 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_start_freeze(&ctrl->ctrl);
+ nvme_stop_queues(&ctrl->ctrl);
+@@ -948,6 +952,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+ }
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
+@@ -1988,6 +1993,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+ ctrl->ctrl.opts = opts;
+ INIT_LIST_HEAD(&ctrl->list);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.25.1
+
--- /dev/null
+From 069acb38211ff950d5c783f3412e34ba19b59f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:25:34 -0700
+Subject: nvme-tcp: fix reset hang if controller died in the middle of a reset
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit e5c01f4f7f623e768e868bcc08d8e7ceb03b75d0 ]
+
+If the controller becomes unresponsive in the middle of a reset, we will
+hang because we are waiting for the freeze to complete, but that cannot
+happen since we have commands that are inflight holding the
+q_usage_counter, and we can't blindly fail requests that times out.
+
+So give a timeout and if we cannot wait for queue freeze before
+unfreezing, fail and have the error handling take care how to proceed
+(either schedule a reconnect of remove the controller).
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 98a045429293e..9b81763b44d99 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1693,7 +1693,15 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ if (!new) {
+ nvme_start_queues(ctrl);
+- nvme_wait_freeze(ctrl);
++ if (!nvme_wait_freeze_timeout(ctrl, NVME_IO_TIMEOUT)) {
++ /*
++ * If we timed out waiting for freeze we are likely to
++ * be stuck. Fail the controller initialization just
++ * to be safe.
++ */
++ ret = -ENODEV;
++ goto out_wait_freeze_timed_out;
++ }
+ blk_mq_update_nr_hw_queues(ctrl->tagset,
+ ctrl->queue_count - 1);
+ nvme_unfreeze(ctrl);
+@@ -1701,6 +1709,9 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ return 0;
+
++out_wait_freeze_timed_out:
++ nvme_stop_queues(ctrl);
++ nvme_tcp_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
+ if (new)
+ blk_cleanup_queue(ctrl->connect_q);
+--
+2.25.1
+
--- /dev/null
+From 0b84d1273f7f472f567e84659327dca604860a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 13:16:36 -0700
+Subject: nvme-tcp: fix timeout handler
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 236187c4ed195161dfa4237c7beffbba0c5ae45b ]
+
+When a request times out in a LIVE state, we simply trigger error
+recovery and let the error recovery handle the request cancellation,
+however when a request times out in a non LIVE state, we make sure to
+complete it immediately as it might block controller setup or teardown
+and prevent forward progress.
+
+However tearing down the entire set of I/O and admin queues causes
+freeze/unfreeze imbalance (q->mq_freeze_depth) because and is really
+an overkill to what we actually need, which is to just fence controller
+teardown that may be running, stop the queue, and cancel the request if
+it is not already completed.
+
+Now that we have the controller teardown_lock, we can safely serialize
+request cancellation. This addresses a hang caused by calling extra
+queue freeze on controller namespaces, causing unfreeze to not complete
+correctly.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 56 ++++++++++++++++++++++++++---------------
+ 1 file changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index a94c80727de1e..98a045429293e 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -421,6 +421,7 @@ static void nvme_tcp_error_recovery(struct nvme_ctrl *ctrl)
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING))
+ return;
+
++ dev_warn(ctrl->device, "starting error recovery\n");
+ queue_work(nvme_reset_wq, &to_tcp_ctrl(ctrl)->err_work);
+ }
+
+@@ -2057,40 +2058,55 @@ static void nvme_tcp_submit_async_event(struct nvme_ctrl *arg)
+ nvme_tcp_queue_request(&ctrl->async_req);
+ }
+
++static void nvme_tcp_complete_timed_out(struct request *rq)
++{
++ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
++ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
++
++ /* fence other contexts that may complete the command */
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
++ nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue));
++ if (!blk_mq_request_completed(rq)) {
++ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
++ blk_mq_complete_request(rq);
++ }
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
++}
++
+ static enum blk_eh_timer_return
+ nvme_tcp_timeout(struct request *rq, bool reserved)
+ {
+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+- struct nvme_tcp_ctrl *ctrl = req->queue->ctrl;
++ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
+ struct nvme_tcp_cmd_pdu *pdu = req->pdu;
+
+- /*
+- * Restart the timer if a controller reset is already scheduled. Any
+- * timed out commands would be handled before entering the connecting
+- * state.
+- */
+- if (ctrl->ctrl.state == NVME_CTRL_RESETTING)
+- return BLK_EH_RESET_TIMER;
+-
+- dev_warn(ctrl->ctrl.device,
++ dev_warn(ctrl->device,
+ "queue %d: timeout request %#x type %d\n",
+ nvme_tcp_queue_id(req->queue), rq->tag, pdu->hdr.type);
+
+- if (ctrl->ctrl.state != NVME_CTRL_LIVE) {
++ if (ctrl->state != NVME_CTRL_LIVE) {
+ /*
+- * Teardown immediately if controller times out while starting
+- * or we are already started error recovery. all outstanding
+- * requests are completed on shutdown, so we return BLK_EH_DONE.
++ * If we are resetting, connecting or deleting we should
++ * complete immediately because we may block controller
++ * teardown or setup sequence
++ * - ctrl disable/shutdown fabrics requests
++ * - connect requests
++ * - initialization admin requests
++ * - I/O requests that entered after unquiescing and
++ * the controller stopped responding
++ *
++ * All other requests should be cancelled by the error
++ * recovery work, so it's fine that we fail it here.
+ */
+- flush_work(&ctrl->err_work);
+- nvme_tcp_teardown_io_queues(&ctrl->ctrl, false);
+- nvme_tcp_teardown_admin_queue(&ctrl->ctrl, false);
++ nvme_tcp_complete_timed_out(rq);
+ return BLK_EH_DONE;
+ }
+
+- dev_warn(ctrl->ctrl.device, "starting error recovery\n");
+- nvme_tcp_error_recovery(&ctrl->ctrl);
+-
++ /*
++ * LIVE state should trigger the normal error recovery which will
++ * handle completing this request.
++ */
++ nvme_tcp_error_recovery(ctrl);
+ return BLK_EH_RESET_TIMER;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 6c0ebe62e7b63df23f29eccdae4fcd1bfd76e2e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 18:13:48 -0700
+Subject: nvme-tcp: serialize controller teardown sequences
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit d4d61470ae48838f49e668503e840e1520b97162 ]
+
+In the timeout handler we may need to complete a request because the
+request that timed out may be an I/O that is a part of a serial sequence
+of controller teardown or initialization. In order to complete the
+request, we need to fence any other context that may compete with us
+and complete the request that is timing out.
+
+In this case, we could have a potential double completion in case
+a hard-irq or a different competing context triggered error recovery
+and is running inflight request cancellation concurrently with the
+timeout handler.
+
+Protect using a ctrl teardown_lock to serialize contexts that may
+complete a cancelled request due to error recovery or a reset.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 0166ff0e4738e..a94c80727de1e 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -110,6 +110,7 @@ struct nvme_tcp_ctrl {
+ struct sockaddr_storage src_addr;
+ struct nvme_ctrl ctrl;
+
++ struct mutex teardown_lock;
+ struct work_struct err_work;
+ struct delayed_work connect_work;
+ struct nvme_tcp_request async_req;
+@@ -1438,7 +1439,6 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid)
+
+ if (!test_and_clear_bit(NVME_TCP_Q_LIVE, &queue->flags))
+ return;
+-
+ __nvme_tcp_stop_queue(queue);
+ }
+
+@@ -1785,6 +1785,7 @@ out_free_queue:
+ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->admin_q);
+ nvme_tcp_stop_queue(ctrl, 0);
+ if (ctrl->admin_tagset) {
+@@ -1795,13 +1796,16 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+ nvme_tcp_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ if (ctrl->queue_count <= 1)
+- return;
++ goto out;
++ blk_mq_quiesce_queue(ctrl->admin_q);
+ nvme_start_freeze(ctrl);
+ nvme_stop_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+@@ -1813,6 +1817,8 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ if (remove)
+ nvme_start_queues(ctrl);
+ nvme_tcp_destroy_io_queues(ctrl, remove);
++out:
++ mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl)
+@@ -2311,6 +2317,7 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev,
+ nvme_tcp_reconnect_ctrl_work);
+ INIT_WORK(&ctrl->err_work, nvme_tcp_error_recovery_work);
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_reset_ctrl_work);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.25.1
+
--- /dev/null
+From b1461b7f2636e5fda4450528f69a33d655c5d023 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Aug 2020 00:48:10 +0800
+Subject: nvmet-tcp: Fix NULL dereference when a connect data comes in h2cdata
+ pdu
+
+From: Ziye Yang <ziye.yang@intel.com>
+
+[ Upstream commit a6ce7d7b4adaebc27ee7e78e5ecc378a1cfc221d ]
+
+When handling commands without in-capsule data, we assign the ttag
+assuming we already have the queue commands array allocated (based
+on the queue size information in the connect data payload). However
+if the connect itself did not send the connect data in-capsule we
+have yet to allocate the queue commands,and we will assign a bogus
+ttag and suffer a NULL dereference when we receive the corresponding
+h2cdata pdu.
+
+Fix this by checking if we already allocated commands before
+dereferencing it when handling h2cdata, if we didn't, its for sure a
+connect and we should use the preallocated connect command.
+
+Signed-off-by: Ziye Yang <ziye.yang@intel.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 22014e76d7714..e31823f19a0fa 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -150,6 +150,11 @@ static void nvmet_tcp_finish_cmd(struct nvmet_tcp_cmd *cmd);
+ static inline u16 nvmet_tcp_cmd_tag(struct nvmet_tcp_queue *queue,
+ struct nvmet_tcp_cmd *cmd)
+ {
++ if (unlikely(!queue->nr_cmds)) {
++ /* We didn't allocate cmds yet, send 0xffff */
++ return USHRT_MAX;
++ }
++
+ return cmd - queue->cmds;
+ }
+
+@@ -847,7 +852,10 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
+ struct nvme_tcp_data_pdu *data = &queue->pdu.data;
+ struct nvmet_tcp_cmd *cmd;
+
+- cmd = &queue->cmds[data->ttag];
++ if (likely(queue->nr_cmds))
++ cmd = &queue->cmds[data->ttag];
++ else
++ cmd = &queue->connect;
+
+ if (le32_to_cpu(data->data_offset) != cmd->rbytes_done) {
+ pr_err("ttag %u unexpected data offset %u (expected %u)\n",
+--
+2.25.1
+
--- /dev/null
+From e64abe8656a022237b3bcc649654071687e436a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:32 -0700
+Subject: RDMA/bnxt_re: Do not report transparent vlan from QP1
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 2d0e60ee322d512fa6bc62d23a6760b39a380847 ]
+
+QP1 Rx CQE reports transparent VLAN ID in the completion and this is used
+while reporting the completion for received MAD packet. Check if the vlan
+id is configured before reporting it in the work completion.
+
+Fixes: 84511455ac5b ("RDMA/bnxt_re: report vlan_id and sl in qp1 recv completion")
+Link: https://lore.kernel.org/r/1598292876-26529-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index ebc3e3d4a6e2a..3b05c0640338f 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -2973,6 +2973,19 @@ static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
+ wc->wc_flags |= IB_WC_GRH;
+ }
+
++static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev,
++ u16 vlan_id)
++{
++ /*
++ * Check if the vlan is configured in the host. If not configured, it
++ * can be a transparent VLAN. So dont report the vlan id.
++ */
++ if (!__vlan_find_dev_deep_rcu(rdev->netdev,
++ htons(ETH_P_8021Q), vlan_id))
++ return false;
++ return true;
++}
++
+ static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe,
+ u16 *vid, u8 *sl)
+ {
+@@ -3041,9 +3054,11 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp,
+ wc->src_qp = orig_cqe->src_qp;
+ memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
+ if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
+- wc->vlan_id = vlan_id;
+- wc->sl = sl;
+- wc->wc_flags |= IB_WC_WITH_VLAN;
++ if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) {
++ wc->vlan_id = vlan_id;
++ wc->sl = sl;
++ wc->wc_flags |= IB_WC_WITH_VLAN;
++ }
+ }
+ wc->port_num = 1;
+ wc->vendor_err = orig_cqe->status;
+--
+2.25.1
+
--- /dev/null
+From 050b60fd3a22d86be8ced3e6f09c3623bcad179c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 15:43:04 +0300
+Subject: RDMA/core: Fix reported speed and width
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 28b0865714b315e318ac45c4fc9156f3d4649646 ]
+
+When the returned speed from __ethtool_get_link_ksettings() is
+SPEED_UNKNOWN this will lead to reporting a wrong speed and width for
+providers that uses ib_get_eth_speed(), fix that by defaulting the
+netdev_speed to SPEED_1000 in case the returned value from
+__ethtool_get_link_ksettings() is SPEED_UNKNOWN.
+
+Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
+Link: https://lore.kernel.org/r/20200902124304.170912-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index d4815f29cfd24..5d896f6b2b617 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1749,7 +1749,7 @@ int ib_get_eth_speed(struct ib_device *dev, u8 port_num, u8 *speed, u8 *width)
+
+ dev_put(netdev);
+
+- if (!rc) {
++ if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
+ netdev_speed = lksettings.base.speed;
+ } else {
+ netdev_speed = SPEED_1000;
+--
+2.25.1
+
--- /dev/null
+From 55d4c9ea329c9f44e0d82d4af8ba194087aa03f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2020 13:43:10 +0300
+Subject: RDMA/rxe: Drop pointless checks in rxe_init_ports
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6112ef62826e91afbae5446d5d47b38e25f47e3f ]
+
+Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no
+need to check if they aren't set.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200705104313.283034-2-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index a8c11b5e1e943..dee0c2b7897ac 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -157,9 +157,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)
+
+ rxe_init_port_param(port);
+
+- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len)
+- return -EINVAL;
+-
+ port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len,
+ sizeof(*port->pkey_tbl), GFP_KERNEL);
+
+--
+2.25.1
+
--- /dev/null
+From a5e42eab8b5025691445af86c90eb09a2ef21535 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 15:56:32 +0800
+Subject: RDMA/rxe: Fix memleak in rxe_mem_init_user
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b ]
+
+When page_address() fails, umem should be freed just like when
+rxe_mem_alloc() fails.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200819075632.22285-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index ea6a819b71675..ffbc50341a55a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -207,6 +207,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start,
+ vaddr = page_address(sg_page_iter_page(&sg_iter));
+ if (!vaddr) {
+ pr_warn("null vaddr\n");
++ ib_umem_release(umem);
+ err = -ENOMEM;
+ goto err1;
+ }
+--
+2.25.1
+
--- /dev/null
+From 7e17e3726d74d73b7b6057db88a62b035c5461a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 18:17:25 +0300
+Subject: RDMA/rxe: Fix panic when calling kmem_cache_create()
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit d862060a4b43479887ae8e2c0b74a58c4e27e5f3 ]
+
+To avoid the following kernel panic when calling kmem_cache_create() with
+a NULL pointer from pool_cache(), Block the rxe_param_set_add() from
+running if the rdma_rxe module is not initialized.
+
+ BUG: unable to handle kernel NULL pointer dereference at 000000000000000b
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP NOPTI
+ CPU: 4 PID: 8512 Comm: modprobe Kdump: loaded Not tainted 4.18.0-231.el8.x86_64 #1
+ Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 10/02/2018
+ RIP: 0010:kmem_cache_alloc+0xd1/0x1b0
+ Code: 8b 57 18 45 8b 77 1c 48 8b 5c 24 30 0f 1f 44 00 00 5b 48 89 e8 5d 41 5c 41 5d 41 5e 41 5f c3 81 e3 00 00 10 00 75 0e 4d 89 fe <41> f6 47 0b 04 0f 84 6c ff ff ff 4c 89 ff e8 cc da 01 00 49 89 c6
+ RSP: 0018:ffffa2b8c773f9d0 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000005
+ RDX: 0000000000000004 RSI: 00000000006080c0 RDI: 0000000000000000
+ RBP: ffff8ea0a8634fd0 R08: ffffa2b8c773f988 R09: 00000000006000c0
+ R10: 0000000000000000 R11: 0000000000000230 R12: 00000000006080c0
+ R13: ffffffffc0a97fc8 R14: 0000000000000000 R15: 0000000000000000
+ FS: 00007f9138ed9740(0000) GS:ffff8ea4ae800000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 000000000000000b CR3: 000000046d59a000 CR4: 00000000003406e0
+ Call Trace:
+ rxe_alloc+0xc8/0x160 [rdma_rxe]
+ rxe_get_dma_mr+0x25/0xb0 [rdma_rxe]
+ __ib_alloc_pd+0xcb/0x160 [ib_core]
+ ib_mad_init_device+0x296/0x8b0 [ib_core]
+ add_client_context+0x11a/0x160 [ib_core]
+ enable_device_and_get+0xdc/0x1d0 [ib_core]
+ ib_register_device+0x572/0x6b0 [ib_core]
+ ? crypto_create_tfm+0x32/0xe0
+ ? crypto_create_tfm+0x7a/0xe0
+ ? crypto_alloc_tfm+0x58/0xf0
+ rxe_register_device+0x19d/0x1c0 [rdma_rxe]
+ rxe_net_add+0x3d/0x70 [rdma_rxe]
+ ? dev_get_by_name_rcu+0x73/0x90
+ rxe_param_set_add+0xaf/0xc0 [rdma_rxe]
+ parse_args+0x179/0x370
+ ? ref_module+0x1b0/0x1b0
+ load_module+0x135e/0x17e0
+ ? ref_module+0x1b0/0x1b0
+ ? __do_sys_init_module+0x13b/0x180
+ __do_sys_init_module+0x13b/0x180
+ do_syscall_64+0x5b/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x65/0xca
+ RIP: 0033:0x7f9137ed296e
+
+This can be triggered if a user tries to use the 'module option' which is
+not actually a real module option but some idiotic (and thankfully no
+obsolete) sysfs interface.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200825151725.254046-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 4 ++++
+ drivers/infiniband/sw/rxe/rxe.h | 2 ++
+ drivers/infiniband/sw/rxe/rxe_sysfs.c | 5 +++++
+ 3 files changed, 11 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index dee0c2b7897ac..70c4ea438664d 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -48,6 +48,8 @@ static void rxe_cleanup_ports(struct rxe_dev *rxe)
+
+ }
+
++bool rxe_initialized;
++
+ /* free resources for a rxe device all objects created for this device must
+ * have been destroyed
+ */
+@@ -355,6 +357,7 @@ static int __init rxe_module_init(void)
+ return err;
+
+ rdma_link_register(&rxe_link_ops);
++ rxe_initialized = true;
+ pr_info("loaded\n");
+ return 0;
+ }
+@@ -366,6 +369,7 @@ static void __exit rxe_module_exit(void)
+ rxe_net_exit();
+ rxe_cache_exit();
+
++ rxe_initialized = false;
+ pr_info("unloaded\n");
+ }
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.h b/drivers/infiniband/sw/rxe/rxe.h
+index fb07eed9e4028..cae1b0a24c850 100644
+--- a/drivers/infiniband/sw/rxe/rxe.h
++++ b/drivers/infiniband/sw/rxe/rxe.h
+@@ -67,6 +67,8 @@
+
+ #define RXE_ROCE_V2_SPORT (0xc000)
+
++extern bool rxe_initialized;
++
+ static inline u32 rxe_crc32(struct rxe_dev *rxe,
+ u32 crc, void *next, size_t len)
+ {
+diff --git a/drivers/infiniband/sw/rxe/rxe_sysfs.c b/drivers/infiniband/sw/rxe/rxe_sysfs.c
+index ccda5f5a3bc0a..2af31d421bfc3 100644
+--- a/drivers/infiniband/sw/rxe/rxe_sysfs.c
++++ b/drivers/infiniband/sw/rxe/rxe_sysfs.c
+@@ -61,6 +61,11 @@ static int rxe_param_set_add(const char *val, const struct kernel_param *kp)
+ struct net_device *ndev;
+ struct rxe_dev *exists;
+
++ if (!rxe_initialized) {
++ pr_err("Module parameters are not supported, use rdma link add or rxe_cfg\n");
++ return -EAGAIN;
++ }
++
+ len = sanitize_arg(val, intf, sizeof(intf));
+ if (!len) {
+ pr_err("add: invalid interface name\n");
+--
+2.25.1
+
--- /dev/null
+From 7ff2ce8c46fd8ebe577099b4d1202db6edc1dd4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 03:31:34 +0200
+Subject: regulator: push allocation in regulator_ena_gpio_request() out of
+ lock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit 467bf30142c64f2eb64e2ac67fa4595126230efd ]
+
+Move another allocation out of regulator_list_mutex-protected region, as
+reclaim might want to take the same lock.
+
+WARNING: possible circular locking dependency detected
+5.7.13+ #534 Not tainted
+------------------------------------------------------
+kswapd0/383 is trying to acquire lock:
+c0e5d920 (regulator_list_mutex){+.+.}-{3:3}, at: regulator_lock_dependent+0x54/0x2c0
+
+but task is already holding lock:
+c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #1 (fs_reclaim){+.+.}-{0:0}:
+ fs_reclaim_acquire.part.11+0x40/0x50
+ fs_reclaim_acquire+0x24/0x28
+ kmem_cache_alloc_trace+0x40/0x1e8
+ regulator_register+0x384/0x1630
+ devm_regulator_register+0x50/0x84
+ reg_fixed_voltage_probe+0x248/0x35c
+[...]
+other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(fs_reclaim);
+ lock(regulator_list_mutex);
+ lock(fs_reclaim);
+ lock(regulator_list_mutex);
+
+ *** DEADLOCK ***
+[...]
+2 locks held by kswapd0/383:
+ #0: c0e38518 (fs_reclaim){+.+.}-{0:0}, at: __fs_reclaim_acquire+0x0/0x50
+ #1: cb70e5e0 (hctx->srcu){....}-{0:0}, at: hctx_lock+0x60/0xb8
+[...]
+
+Fixes: 541d052d7215 ("regulator: core: Only support passing enable GPIO descriptors")
+[this commit only changes context]
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+[this is when the regulator_list_mutex was introduced in reclaim locking path]
+
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/41fe6a9670335721b48e8f5195038c3d67a3bf92.1597195321.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index a17aebe0aa7a7..19826641881bb 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -2217,10 +2217,13 @@ EXPORT_SYMBOL_GPL(regulator_bulk_unregister_supply_alias);
+ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ const struct regulator_config *config)
+ {
+- struct regulator_enable_gpio *pin;
++ struct regulator_enable_gpio *pin, *new_pin;
+ struct gpio_desc *gpiod;
+
+ gpiod = config->ena_gpiod;
++ new_pin = kzalloc(sizeof(*new_pin), GFP_KERNEL);
++
++ mutex_lock(®ulator_list_mutex);
+
+ list_for_each_entry(pin, ®ulator_ena_gpio_list, list) {
+ if (pin->gpiod == gpiod) {
+@@ -2229,9 +2232,13 @@ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ }
+ }
+
+- pin = kzalloc(sizeof(struct regulator_enable_gpio), GFP_KERNEL);
+- if (pin == NULL)
++ if (new_pin == NULL) {
++ mutex_unlock(®ulator_list_mutex);
+ return -ENOMEM;
++ }
++
++ pin = new_pin;
++ new_pin = NULL;
+
+ pin->gpiod = gpiod;
+ list_add(&pin->list, ®ulator_ena_gpio_list);
+@@ -2239,6 +2246,10 @@ static int regulator_ena_gpio_request(struct regulator_dev *rdev,
+ update_ena_gpio_to_rdev:
+ pin->request_count++;
+ rdev->ena_pin = pin;
++
++ mutex_unlock(®ulator_list_mutex);
++ kfree(new_pin);
++
+ return 0;
+ }
+
+@@ -5108,9 +5119,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ }
+
+ if (config->ena_gpiod) {
+- mutex_lock(®ulator_list_mutex);
+ ret = regulator_ena_gpio_request(rdev, config);
+- mutex_unlock(®ulator_list_mutex);
+ if (ret != 0) {
+ rdev_err(rdev, "Failed to request enable GPIO: %d\n",
+ ret);
+--
+2.25.1
+
--- /dev/null
+From d24fe6e48b66ead0ab96fc0d2daf035603f2cf01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 03:31:38 +0200
+Subject: regulator: remove superfluous lock in regulator_resolve_coupling()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+[ Upstream commit a577f3456c0a2fac3dee037c483753e6e68f3e49 ]
+
+The code modifies rdev, but locks c_rdev instead. Remove the lock
+as this is held together by regulator_list_mutex taken in the caller.
+
+Fixes: f9503385b187 ("regulator: core: Mutually resolve regulators coupling")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/25eb81cefb37a646f3e44eaaf1d8ae8881cfde52.1597195321.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 19826641881bb..c457fa3b8c3e6 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4868,13 +4868,9 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev)
+ return;
+ }
+
+- regulator_lock(c_rdev);
+-
+ c_desc->coupled_rdevs[i] = c_rdev;
+ c_desc->n_resolved++;
+
+- regulator_unlock(c_rdev);
+-
+ regulator_resolve_coupling(c_rdev);
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 83c1d3564244ad5a30dfa639f904ffe5d90bc1dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 15:24:26 +0800
+Subject: scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
+
+From: Luo Jiaxing <luojiaxing@huawei.com>
+
+[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]
+
+It was discovered that sdparm will fail when attempting to disable write
+cache on a SATA disk connected via libsas.
+
+In the ATA command set the write cache state is controlled through the SET
+FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and
+the latter command is what is used in the SCSI-ATA translation layer. A
+subtle difference is that a MODE SELECT carries data whereas SET FEATURES
+is defined as a non-data command in ATA.
+
+Set the DMA data direction to DMA_NONE if the requested ATA command is
+identified as non-data.
+
+[mkp: commit desc]
+
+Fixes: fa1c1e8f1ece ("[SCSI] Add SATA support to libsas")
+Link: https://lore.kernel.org/r/1598426666-54544-1-git-send-email-luojiaxing@huawei.com
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_ata.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index e9e00740f7ca6..dd755a56cf521 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -208,7 +208,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->num_scatter = si;
+ }
+
+- task->data_dir = qc->dma_dir;
++ if (qc->tf.protocol == ATA_PROT_NODATA)
++ task->data_dir = DMA_NONE;
++ else
++ task->data_dir = qc->dma_dir;
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+--
+2.25.1
+
--- /dev/null
+From 4cc8a2169bc2c7517c5610d6841eda7c00534019 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 18:53:32 +0200
+Subject: scsi: megaraid_sas: Don't call disable_irq from process IRQ poll
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit d2af39141eea34ef651961e885f49d96781a1016 ]
+
+disable_irq() might sleep. Replace it with disable_irq_nosync() which is
+sufficient as irq_poll_scheduled protects against concurrently running
+complete_cmd_fusion() from megasas_irqpoll() and megasas_isr_fusion().
+
+Link: https://lore.kernel.org/r/20200827165332.8432-1-thenzl@redhat.com
+Fixes: a6ffd5bf681 scsi: megaraid_sas: Call disable_irq from process IRQ poll
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 5bcef9769740b..5dcd7b9b72ced 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -3738,7 +3738,7 @@ int megasas_irqpoll(struct irq_poll *irqpoll, int budget)
+ instance = irq_ctx->instance;
+
+ if (irq_ctx->irq_line_enable) {
+- disable_irq(irq_ctx->os_irq);
++ disable_irq_nosync(irq_ctx->os_irq);
+ irq_ctx->irq_line_enable = false;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From f11d908df3ad90544b9a66cbc49ddcabe67d66cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 16:50:26 +0200
+Subject: scsi: mpt3sas: Don't call disable_irq from IRQ poll handler
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit b614d55b970d08bcac5b0bc15a5526181b3e4459 ]
+
+disable_irq() might sleep, replace it with disable_irq_nosync(). For
+synchronisation 'irq_poll_scheduled' is sufficient
+
+Fixes: 320e77acb3 scsi: mpt3sas: Irq poll to avoid CPU hard lockups
+Link: https://lore.kernel.org/r/20200901145026.12174-1-thenzl@redhat.com
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 7fd1d731555f9..b7e44634d0dc2 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -1632,7 +1632,7 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget)
+ reply_q = container_of(irqpoll, struct adapter_reply_queue,
+ irqpoll);
+ if (reply_q->irq_line_enable) {
+- disable_irq(reply_q->os_irq);
++ disable_irq_nosync(reply_q->os_irq);
+ reply_q->irq_line_enable = false;
+ }
+ num_entries = _base_process_reply_queue(reply_q);
+--
+2.25.1
+
--- /dev/null
+From 3e3ccab38a6159a2c51fc1cf0b2394eb869b445e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2020 10:42:15 +0800
+Subject: selftests/timers: Turn off timeout setting
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 5c1e4f7e9e49b6925b1fb5c507d2c614f3edb292 ]
+
+The following 4 tests in timers can take longer than the default 45
+seconds that added in commit 852c8cbf34d3 ("selftests/kselftest/runner.sh:
+Add 45 second timeout per test") to run:
+ * nsleep-lat - 2m7.350s
+ * set-timer-lat - 2m0.66s
+ * inconsistency-check - 1m45.074s
+ * raw_skew - 2m0.013s
+
+Thus they will be marked as failed with the current 45s setting:
+ not ok 3 selftests: timers: nsleep-lat # TIMEOUT
+ not ok 4 selftests: timers: set-timer-lat # TIMEOUT
+ not ok 6 selftests: timers: inconsistency-check # TIMEOUT
+ not ok 7 selftests: timers: raw_skew # TIMEOUT
+
+Disable the timeout setting for timers can make these tests finish
+properly:
+ ok 3 selftests: timers: nsleep-lat
+ ok 4 selftests: timers: set-timer-lat
+ ok 6 selftests: timers: inconsistency-check
+ ok 7 selftests: timers: raw_skew
+
+https://bugs.launchpad.net/bugs/1864626
+Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test")
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Acked-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/timers/Makefile | 1 +
+ tools/testing/selftests/timers/settings | 1 +
+ 2 files changed, 2 insertions(+)
+ create mode 100644 tools/testing/selftests/timers/settings
+
+diff --git a/tools/testing/selftests/timers/Makefile b/tools/testing/selftests/timers/Makefile
+index 7656c7ce79d90..0e73a16874c4c 100644
+--- a/tools/testing/selftests/timers/Makefile
++++ b/tools/testing/selftests/timers/Makefile
+@@ -13,6 +13,7 @@ DESTRUCTIVE_TESTS = alarmtimer-suspend valid-adjtimex adjtick change_skew \
+
+ TEST_GEN_PROGS_EXTENDED = $(DESTRUCTIVE_TESTS)
+
++TEST_FILES := settings
+
+ include ../lib.mk
+
+diff --git a/tools/testing/selftests/timers/settings b/tools/testing/selftests/timers/settings
+new file mode 100644
+index 0000000000000..e7b9417537fbc
+--- /dev/null
++++ b/tools/testing/selftests/timers/settings
+@@ -0,0 +1 @@
++timeout=0
+--
+2.25.1
+
--- /dev/null
+arm-dts-logicpd-torpedo-baseboard-fix-broken-audio.patch
+arm-dts-logicpd-som-lv-baseboard-fix-broken-audio.patch
+arm-dts-logicpd-som-lv-baseboard-fix-missing-video.patch
+regulator-push-allocation-in-regulator_ena_gpio_requ.patch
+regulator-remove-superfluous-lock-in-regulator_resol.patch
+arm-dts-socfpga-fix-register-entry-for-timer3-on-arr.patch
+selftests-timers-turn-off-timeout-setting.patch
+arm-dts-ls1021a-fix-quadspi-memory-reg-range.patch
+arm-dts-imx7ulp-correct-gpio-ranges.patch
+rdma-rxe-fix-memleak-in-rxe_mem_init_user.patch
+rdma-rxe-drop-pointless-checks-in-rxe_init_ports.patch
+rdma-rxe-fix-panic-when-calling-kmem_cache_create.patch
+rdma-bnxt_re-do-not-report-transparent-vlan-from-qp1.patch
+drm-sun4i-add-missing-put_device-call-in-sun8i_r40_t.patch
+arm64-dts-imx8mq-fix-tmu-interrupt-property.patch
+drm-sun4i-fix-dsi-dcs-long-write-function.patch
+iio-adc-mcp3422-fix-locking-on-error-path.patch
+scsi-libsas-set-data_dir-as-dma_none-if-libata-marks.patch
+rdma-core-fix-reported-speed-and-width.patch
+scsi-megaraid_sas-don-t-call-disable_irq-from-proces.patch
+scsi-mpt3sas-don-t-call-disable_irq-from-irq-poll-ha.patch
+soundwire-fix-double-free-of-dangling-pointer.patch
+drm-sun4i-backend-support-alpha-property-on-lowest-p.patch
+drm-sun4i-backend-disable-alpha-on-the-lowest-plane-.patch
+mmc-sdhci-acpi-clear-amd_sdhci_host-on-reset.patch
+mmc-sdhci-msm-add-retries-when-all-tuning-phases-are.patch
+spi-stm32-rate-limit-the-communication-suspended-mes.patch
+nvme-fabrics-allow-to-queue-requests-for-live-queues.patch
+spi-stm32-fix-pm_runtime_get_sync-error-checking.patch
+block-set-same_page-to-false-in-__bio_try_merge_page.patch
+ib-isert-fix-unaligned-immediate-data-handling.patch
+arm-dts-bcm-hr2-fixed-qspi-compatible-string.patch
+arm-dts-nsp-fixed-qspi-compatible-string.patch
+arm-dts-bcm5301x-fixed-qspi-compatible-string.patch
+arm64-dts-ns2-fixed-qspi-compatible-string.patch
+arc-hsdk-wireup-perf-irq.patch
+dmaengine-acpi-put-the-csrt-table-after-using-it.patch
+netfilter-conntrack-allow-sctp-hearbeat-after-connec.patch
+drivers-net-wan-lapbether-added-needed_tailroom.patch
+nfc-st95hf-fix-memleak-in-st95hf_in_send_cmd.patch
+firestream-fix-memleak-in-fs_open.patch
+alsa-hda-fix-2-channel-swapping-for-tegra.patch
+alsa-hda-tegra-program-wakeen-register-for-tegra.patch
+drivers-dma-dma-jz4780-fix-race-condition-between-pr.patch
+net-hns3-fix-for-geneve-tx-checksum-bug.patch
+xfs-fix-off-by-one-in-inode-alloc-block-reservation-.patch
+drivers-net-wan-lapbether-set-network_header-before-.patch
+cfg80211-adjust-6-ghz-frequency-to-channel-conversio.patch
+xfs-initialize-the-shortform-attr-header-padding-ent.patch
+irqchip-eznps-fix-build-error-for-arc700-builds.patch
+nvmet-tcp-fix-null-dereference-when-a-connect-data-c.patch
+nvme-fabrics-don-t-check-state-nvme_ctrl_new-for-req.patch
+nvme-have-nvme_wait_freeze_timeout-return-if-it-time.patch
+nvme-tcp-serialize-controller-teardown-sequences.patch
+nvme-tcp-fix-timeout-handler.patch
+nvme-tcp-fix-reset-hang-if-controller-died-in-the-mi.patch
+nvme-rdma-serialize-controller-teardown-sequences.patch
+nvme-rdma-fix-timeout-handler.patch
+nvme-rdma-fix-reset-hang-if-controller-died-in-the-m.patch
+nvme-pci-cancel-nvme-device-request-before-disabling.patch
+hid-quirks-set-increment_usage_on_duplicate-for-all-.patch
+hid-microsoft-add-rumble-support-for-the-8bitdo-sn30.patch
+drivers-net-wan-hdlc_cisco-add-hard_header_len.patch
+hid-elan-fix-memleak-in-elan_input_configured.patch
+arc-plat-hsdk-switch-ethernet-phy-mode-to-rgmii-id.patch
+cpufreq-intel_pstate-refuse-to-turn-off-with-hwp-ena.patch
+cpufreq-intel_pstate-fix-intel_pstate_get_hwp_max-fo.patch
+arm64-module-set-trampoline-section-flags-regardless.patch
+alsa-hda-hdmi-add-rocketlake-support.patch
+alsa-hda-fix-a-runtime-pm-issue-in-sof-when-integrat.patch
+drm-amdgpu-fix-bug-in-reporting-voltage-for-cik.patch
+iommu-amd-do-not-use-iommuv2-functionality-when-sme-.patch
+gcov-disable-gcov-build-with-gcc-10.patch
--- /dev/null
+From c4d95620b0f663d2dbf9b3decf735698d15bec84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 13:26:50 -0700
+Subject: soundwire: fix double free of dangling pointer
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 3fbbf2148a406b3e350fe91e6fdd78eb42ecad24 ]
+
+clang static analysis flags this problem
+
+stream.c:844:9: warning: Use of memory after
+ it is freed
+ kfree(bus->defer_msg.msg->buf);
+ ^~~~~~~~~~~~~~~~~~~~~~~
+
+This happens in an error handler cleaning up memory
+allocated for elements in a list.
+
+ list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+ bus = m_rt->bus;
+
+ kfree(bus->defer_msg.msg->buf);
+ kfree(bus->defer_msg.msg);
+ }
+
+And is triggered when the call to sdw_bank_switch() fails.
+There are a two problems.
+
+First, when sdw_bank_switch() fails, though it frees memory it
+does not clear bus's reference 'defer_msg.msg' to that memory.
+
+The second problem is the freeing msg->buf. In some cases
+msg will be NULL so this will dereference a null pointer.
+Need to check before freeing.
+
+Fixes: 99b8a5d608a6 ("soundwire: Add bank switch routine")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902202650.14189-1-trix@redhat.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/stream.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index e69f94a8c3a86..de7c57e17710a 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -702,6 +702,7 @@ error:
+ kfree(wbuf);
+ error_1:
+ kfree(wr_msg);
++ bus->defer_msg.msg = NULL;
+ return ret;
+ }
+
+@@ -825,9 +826,10 @@ static int do_bank_switch(struct sdw_stream_runtime *stream)
+ error:
+ list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+ bus = m_rt->bus;
+-
+- kfree(bus->defer_msg.msg->buf);
+- kfree(bus->defer_msg.msg);
++ if (bus->defer_msg.msg) {
++ kfree(bus->defer_msg.msg->buf);
++ kfree(bus->defer_msg.msg);
++ }
+ }
+
+ msg_unlock:
+--
+2.25.1
+
--- /dev/null
+From af0f8f7bfec300774e7179021f710ea51fad5003 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 12:43:04 +0300
+Subject: spi: stm32: fix pm_runtime_get_sync() error checking
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c170a5a3b6944ad8e76547c4a1d9fe81c8f23ac8 ]
+
+The pm_runtime_get_sync() can return either 0 or 1 on success but this
+code treats 1 as a failure.
+
+Fixes: db96bf976a4f ("spi: stm32: fixes suspend/resume management")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Alain Volmat <alain.volmat@st.com>
+Link: https://lore.kernel.org/r/20200909094304.GA420136@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 09b418ff99b16..9d8ceb63f7db1 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -2054,7 +2054,7 @@ static int stm32_spi_resume(struct device *dev)
+ }
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret) {
++ if (ret < 0) {
+ dev_err(dev, "Unable to power device:%d\n", ret);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From c252566979ff54122deb209214e1c7a13525c017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Sep 2020 17:19:13 +0200
+Subject: spi: stm32: Rate-limit the 'Communication suspended' message
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit ea8be08cc9358f811e4175ba7fa7fea23c5d393e ]
+
+The 'spi_stm32 44004000.spi: Communication suspended' message means that
+when using PIO, the kernel did not read the FIFO fast enough and so the
+SPI controller paused the transfer. Currently, this is printed on every
+single such event, so if the kernel is busy and the controller is pausing
+the transfers often, the kernel will be all the more busy scrolling this
+message into the log buffer every few milliseconds. That is not helpful.
+
+Instead, rate-limit the message and print it every once in a while. It is
+not possible to use the default dev_warn_ratelimited(), because that is
+still too verbose, as it prints 10 lines (DEFAULT_RATELIMIT_BURST) every
+5 seconds (DEFAULT_RATELIMIT_INTERVAL). The policy here is to print 1 line
+every 50 seconds (DEFAULT_RATELIMIT_INTERVAL * 10), because 1 line is more
+than enough and the cycles saved on printing are better left to the CPU to
+handle the SPI. However, dev_warn_once() is also not useful, as the user
+should be aware that this condition is possibly recurring or ongoing. Thus
+the custom rate-limit policy.
+
+Finally, turn the message from dev_warn() to dev_dbg(), since the system
+does not suffer any sort of malfunction if this message appears, it is
+just slowing down. This further reduces the printing into the log buffer
+and frees the CPU to do useful work.
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Amelie Delaunay <amelie.delaunay@st.com>
+Cc: Antonio Borneo <borneo.antonio@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20200905151913.117775-1-marex@denx.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 8146c2d91d307..09b418ff99b16 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -931,7 +931,11 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ }
+
+ if (sr & STM32H7_SPI_SR_SUSP) {
+- dev_warn(spi->dev, "Communication suspended\n");
++ static DEFINE_RATELIMIT_STATE(rs,
++ DEFAULT_RATELIMIT_INTERVAL * 10,
++ 1);
++ if (__ratelimit(&rs))
++ dev_dbg_ratelimited(spi->dev, "Communication suspended\n");
+ if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+ stm32h7_spi_read_rxfifo(spi, false);
+ /*
+--
+2.25.1
+
--- /dev/null
+From 8fede5675bec781b3155653ad15e3f462a3003f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:08:27 -0700
+Subject: xfs: fix off-by-one in inode alloc block reservation calculation
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit 657f101930bc6c5b41bd7d6c22565c4302a80d33 ]
+
+The inode chunk allocation transaction reserves inobt_maxlevels-1
+blocks to accommodate a full split of the inode btree. A full split
+requires an allocation for every existing level and a new root
+block, which means inobt_maxlevels is the worst case block
+requirement for a transaction that inserts to the inobt. This can
+lead to a transaction block reservation overrun when tmpfile
+creation allocates an inode chunk and expands the inobt to its
+maximum depth. This problem has been observed in conjunction with
+overlayfs, which makes frequent use of tmpfiles internally.
+
+The existing reservation code goes back as far as the Linux git repo
+history (v2.6.12). It was likely never observed as a problem because
+the traditional file/directory creation transactions also include
+worst case block reservation for directory modifications, which most
+likely is able to make up for a single block deficiency in the inode
+allocation portion of the calculation. tmpfile support is relatively
+more recent (v3.15), less heavily used, and only includes the inode
+allocation block reservation as tmpfiles aren't linked into the
+directory tree on creation.
+
+Fix up the inode alloc block reservation macro and a couple of the
+block allocator minleft parameters that enforce an allocation to
+leave enough free blocks in the AG for a full inobt split.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_ialloc.c | 4 ++--
+ fs/xfs/libxfs/xfs_trans_space.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
+index 588d446130944..443cf33f66668 100644
+--- a/fs/xfs/libxfs/xfs_ialloc.c
++++ b/fs/xfs/libxfs/xfs_ialloc.c
+@@ -679,7 +679,7 @@ xfs_ialloc_ag_alloc(
+ args.minalignslop = igeo->cluster_align - 1;
+
+ /* Allow space for the inode btree to split. */
+- args.minleft = igeo->inobt_maxlevels - 1;
++ args.minleft = igeo->inobt_maxlevels;
+ if ((error = xfs_alloc_vextent(&args)))
+ return error;
+
+@@ -727,7 +727,7 @@ xfs_ialloc_ag_alloc(
+ /*
+ * Allow space for the inode btree to split.
+ */
+- args.minleft = igeo->inobt_maxlevels - 1;
++ args.minleft = igeo->inobt_maxlevels;
+ if ((error = xfs_alloc_vextent(&args)))
+ return error;
+ }
+diff --git a/fs/xfs/libxfs/xfs_trans_space.h b/fs/xfs/libxfs/xfs_trans_space.h
+index c6df01a2a1585..7ad3659c5d2a9 100644
+--- a/fs/xfs/libxfs/xfs_trans_space.h
++++ b/fs/xfs/libxfs/xfs_trans_space.h
+@@ -58,7 +58,7 @@
+ #define XFS_IALLOC_SPACE_RES(mp) \
+ (M_IGEO(mp)->ialloc_blks + \
+ ((xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1) * \
+- (M_IGEO(mp)->inobt_maxlevels - 1)))
++ M_IGEO(mp)->inobt_maxlevels))
+
+ /*
+ * Space reservation values for various transactions.
+--
+2.25.1
+
--- /dev/null
+From 9a58d87753bbd0c2cfc62d41bb72334baf04f352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:12:18 -0700
+Subject: xfs: initialize the shortform attr header padding entry
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]
+
+Don't leak kernel memory contents into the shortform attr fork.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index fe277ee5ec7c4..5472ed3ce6943 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -583,8 +583,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)
+ ASSERT(ifp->if_flags & XFS_IFINLINE);
+ }
+ xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
+- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
+- hdr->count = 0;
++ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
++ memset(hdr, 0, sizeof(*hdr));
+ hdr->totsize = cpu_to_be16(sizeof(*hdr));
+ xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
