--- /dev/null
+From 2a6838d54128952ace6f0ca166dd8706abe46649 Mon Sep 17 00:00:00 2001
+From: Chris Healy <cphealy@gmail.com>
+Date: Fri, 21 Aug 2020 14:21:02 -0700
+Subject: ARM: dts: vfxxx: Add syscon compatible with OCOTP
+
+From: Chris Healy <cphealy@gmail.com>
+
+commit 2a6838d54128952ace6f0ca166dd8706abe46649 upstream.
+
+Add syscon compatibility with Vybrid OCOTP node. This is required to
+access the UID.
+
+Fixes: fa8d20c8dbb77 ("ARM: dts: vfxxx: Add node corresponding to OCOTP")
+Cc: stable@vger.kernel.org
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Chris Healy <cphealy@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/vfxxx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/vfxxx.dtsi
++++ b/arch/arm/boot/dts/vfxxx.dtsi
+@@ -495,7 +495,7 @@
+ };
+
+ ocotp: ocotp@400a5000 {
+- compatible = "fsl,vf610-ocotp";
++ compatible = "fsl,vf610-ocotp", "syscon";
+ reg = <0x400a5000 0x1000>;
+ clocks = <&clks VF610_CLK_OCOTP>;
+ };
--- /dev/null
+From 66138621f2473e29625dfa6bb229872203b71b90 Mon Sep 17 00:00:00 2001
+From: Robin Gong <yibin.gong@nxp.com>
+Date: Tue, 1 Sep 2020 18:21:49 +0800
+Subject: arm64: dts: imx8mp: correct sdma1 clk setting
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+commit 66138621f2473e29625dfa6bb229872203b71b90 upstream.
+
+Correct sdma1 ahb clk, otherwise wrong 1:1 clk ratio will be chosed so
+that sdma1 function broken. sdma1 should use 1:2 clk, while sdma2/3 use
+1:1.
+
+Fixes: 6d9b8d20431f ("arm64: dts: freescale: Add i.MX8MP dtsi support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -688,7 +688,7 @@
+ reg = <0x30bd0000 0x10000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MP_CLK_SDMA1_ROOT>,
+- <&clk IMX8MP_CLK_SDMA1_ROOT>;
++ <&clk IMX8MP_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin";
--- /dev/null
+From e3b9fc7eec55e6fdc8beeed18f2ed207086341e2 Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Tue, 11 Aug 2020 17:01:29 +0200
+Subject: debugfs: Fix module state check condition
+
+From: Vladis Dronov <vdronov@redhat.com>
+
+commit e3b9fc7eec55e6fdc8beeed18f2ed207086341e2 upstream.
+
+The '#ifdef MODULE' check in the original commit does not work as intended.
+The code under the check is not built at all if CONFIG_DEBUG_FS=y. Fix this
+by using a correct check.
+
+Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()")
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200811150129.53343-1-vdronov@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/debugfs/file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/debugfs/file.c
++++ b/fs/debugfs/file.c
+@@ -177,7 +177,7 @@ static int open_proxy_open(struct inode
+ goto out;
+
+ if (!fops_get(real_fops)) {
+-#ifdef MODULE
++#ifdef CONFIG_MODULES
+ if (real_fops->owner &&
+ real_fops->owner->state == MODULE_STATE_GOING)
+ goto out;
+@@ -312,7 +312,7 @@ static int full_proxy_open(struct inode
+ goto out;
+
+ if (!fops_get(real_fops)) {
+-#ifdef MODULE
++#ifdef CONFIG_MODULES
+ if (real_fops->owner &&
+ real_fops->owner->state == MODULE_STATE_GOING)
+ goto out;
--- /dev/null
+From 06a0df4d1b8b13b551668e47b11fd7629033b7df Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Tue, 8 Sep 2020 10:56:27 -0700
+Subject: fbcon: remove now unusued 'softback_lines' cursor() argument
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 06a0df4d1b8b13b551668e47b11fd7629033b7df upstream.
+
+Since the softscroll code got removed, this argument is always zero and
+makes no sense any more.
+
+Tested-by: Yuan Ming <yuanmingbuaa@gmail.com>
+Tested-by: Willy Tarreau <w@1wt.eu>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/core/bitblit.c | 11 +----------
+ drivers/video/fbdev/core/fbcon.c | 4 ++--
+ drivers/video/fbdev/core/fbcon.h | 2 +-
+ drivers/video/fbdev/core/fbcon_ccw.c | 11 +----------
+ drivers/video/fbdev/core/fbcon_cw.c | 11 +----------
+ drivers/video/fbdev/core/fbcon_ud.c | 11 +----------
+ drivers/video/fbdev/core/tileblit.c | 2 +-
+ 7 files changed, 8 insertions(+), 44 deletions(-)
+
+--- a/drivers/video/fbdev/core/bitblit.c
++++ b/drivers/video/fbdev/core/bitblit.c
+@@ -234,7 +234,7 @@ static void bit_clear_margins(struct vc_
+ }
+
+ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -247,15 +247,6 @@ static void bit_cursor(struct vc_data *v
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -394,7 +394,7 @@ static void fb_flashcursor(struct work_s
+ c = scr_readw((u16 *) vc->vc_pos);
+ mode = (!ops->cursor_flash || ops->cursor_state.enable) ?
+ CM_ERASE : CM_DRAW;
+- ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ console_unlock();
+ }
+@@ -1345,7 +1345,7 @@ static void fbcon_cursor(struct vc_data
+
+ ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
+
+- ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ }
+
+--- a/drivers/video/fbdev/core/fbcon.h
++++ b/drivers/video/fbdev/core/fbcon.h
+@@ -62,7 +62,7 @@ struct fbcon_ops {
+ void (*clear_margins)(struct vc_data *vc, struct fb_info *info,
+ int color, int bottom_only);
+ void (*cursor)(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg);
++ int fg, int bg);
+ int (*update_start)(struct fb_info *info);
+ int (*rotate_font)(struct fb_info *info, struct vc_data *vc);
+ struct fb_var_screeninfo var; /* copy of the current fb_var_screeninfo */
+--- a/drivers/video/fbdev/core/fbcon_ccw.c
++++ b/drivers/video/fbdev/core/fbcon_ccw.c
+@@ -219,7 +219,7 @@ static void ccw_clear_margins(struct vc_
+ }
+
+ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -236,15 +236,6 @@ static void ccw_cursor(struct vc_data *v
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+--- a/drivers/video/fbdev/core/fbcon_cw.c
++++ b/drivers/video/fbdev/core/fbcon_cw.c
+@@ -202,7 +202,7 @@ static void cw_clear_margins(struct vc_d
+ }
+
+ static void cw_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -219,15 +219,6 @@ static void cw_cursor(struct vc_data *vc
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+--- a/drivers/video/fbdev/core/fbcon_ud.c
++++ b/drivers/video/fbdev/core/fbcon_ud.c
+@@ -249,7 +249,7 @@ static void ud_clear_margins(struct vc_d
+ }
+
+ static void ud_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_cursor cursor;
+ struct fbcon_ops *ops = info->fbcon_par;
+@@ -267,15 +267,6 @@ static void ud_cursor(struct vc_data *vc
+
+ cursor.set = 0;
+
+- if (softback_lines) {
+- if (y + softback_lines >= vc->vc_rows) {
+- mode = CM_ERASE;
+- ops->cursor_flash = 0;
+- return;
+- } else
+- y += softback_lines;
+- }
+-
+ c = scr_readw((u16 *) vc->vc_pos);
+ attribute = get_attribute(info, c);
+ src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
+--- a/drivers/video/fbdev/core/tileblit.c
++++ b/drivers/video/fbdev/core/tileblit.c
+@@ -80,7 +80,7 @@ static void tile_clear_margins(struct vc
+ }
+
+ static void tile_cursor(struct vc_data *vc, struct fb_info *info, int mode,
+- int softback_lines, int fg, int bg)
++ int fg, int bg)
+ {
+ struct fb_tilecursor cursor;
+ int use_sw = (vc->vc_cursor_type & 0x10);
--- /dev/null
+From 50145474f6ef4a9c19205b173da6264a644c7489 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Mon, 7 Sep 2020 11:45:27 -0700
+Subject: fbcon: remove soft scrollback code
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 50145474f6ef4a9c19205b173da6264a644c7489 upstream.
+
+This (and the VGA soft scrollback) turns out to have various nasty small
+special cases that nobody really is willing to fight. The soft
+scrollback code was really useful a few decades ago when you typically
+used the console interactively as the main way to interact with the
+machine, but that just isn't the case any more.
+
+So it's not worth dragging along.
+
+Tested-by: Yuan Ming <yuanmingbuaa@gmail.com>
+Tested-by: Willy Tarreau <w@1wt.eu>
+Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/core/fbcon.c | 334 ---------------------------------------
+ 1 file changed, 4 insertions(+), 330 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -122,12 +122,6 @@ static int logo_lines;
+ /* logo_shown is an index to vc_cons when >= 0; otherwise follows FBCON_LOGO
+ enums. */
+ static int logo_shown = FBCON_LOGO_CANSHOW;
+-/* Software scrollback */
+-static int fbcon_softback_size = 32768;
+-static unsigned long softback_buf, softback_curr;
+-static unsigned long softback_in;
+-static unsigned long softback_top, softback_end;
+-static int softback_lines;
+ /* console mappings */
+ static int first_fb_vc;
+ static int last_fb_vc = MAX_NR_CONSOLES - 1;
+@@ -167,8 +161,6 @@ static int margin_color;
+
+ static const struct consw fb_con;
+
+-#define CM_SOFTBACK (8)
+-
+ #define advance_row(p, delta) (unsigned short *)((unsigned long)(p) + (delta) * vc->vc_size_row)
+
+ static int fbcon_set_origin(struct vc_data *);
+@@ -373,18 +365,6 @@ static int get_color(struct vc_data *vc,
+ return color;
+ }
+
+-static void fbcon_update_softback(struct vc_data *vc)
+-{
+- int l = fbcon_softback_size / vc->vc_size_row;
+-
+- if (l > 5)
+- softback_end = softback_buf + l * vc->vc_size_row;
+- else
+- /* Smaller scrollback makes no sense, and 0 would screw
+- the operation totally */
+- softback_top = 0;
+-}
+-
+ static void fb_flashcursor(struct work_struct *work)
+ {
+ struct fb_info *info = container_of(work, struct fb_info, queue);
+@@ -414,7 +394,7 @@ static void fb_flashcursor(struct work_s
+ c = scr_readw((u16 *) vc->vc_pos);
+ mode = (!ops->cursor_flash || ops->cursor_state.enable) ?
+ CM_ERASE : CM_DRAW;
+- ops->cursor(vc, info, mode, softback_lines, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ console_unlock();
+ }
+@@ -471,13 +451,7 @@ static int __init fb_console_setup(char
+ }
+
+ if (!strncmp(options, "scrollback:", 11)) {
+- options += 11;
+- if (*options) {
+- fbcon_softback_size = simple_strtoul(options, &options, 0);
+- if (*options == 'k' || *options == 'K') {
+- fbcon_softback_size *= 1024;
+- }
+- }
++ pr_warn("Ignoring scrollback size option\n");
+ continue;
+ }
+
+@@ -1022,31 +996,6 @@ static const char *fbcon_startup(void)
+
+ set_blitting_type(vc, info);
+
+- if (info->fix.type != FB_TYPE_TEXT) {
+- if (fbcon_softback_size) {
+- if (!softback_buf) {
+- softback_buf =
+- (unsigned long)
+- kvmalloc(fbcon_softback_size,
+- GFP_KERNEL);
+- if (!softback_buf) {
+- fbcon_softback_size = 0;
+- softback_top = 0;
+- }
+- }
+- } else {
+- if (softback_buf) {
+- kvfree((void *) softback_buf);
+- softback_buf = 0;
+- softback_top = 0;
+- }
+- }
+- if (softback_buf)
+- softback_in = softback_top = softback_curr =
+- softback_buf;
+- softback_lines = 0;
+- }
+-
+ /* Setup default font */
+ if (!p->fontdata && !vc->vc_font.data) {
+ if (!fontname[0] || !(font = find_font(fontname)))
+@@ -1220,9 +1169,6 @@ static void fbcon_init(struct vc_data *v
+ if (logo)
+ fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
+
+- if (vc == svc && softback_buf)
+- fbcon_update_softback(vc);
+-
+ if (ops->rotate_font && ops->rotate_font(info, vc)) {
+ ops->rotate = FB_ROTATE_UR;
+ set_blitting_type(vc, info);
+@@ -1385,7 +1331,6 @@ static void fbcon_cursor(struct vc_data
+ {
+ struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]];
+ struct fbcon_ops *ops = info->fbcon_par;
+- int y;
+ int c = scr_readw((u16 *) vc->vc_pos);
+
+ ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+@@ -1399,16 +1344,8 @@ static void fbcon_cursor(struct vc_data
+ fbcon_add_cursor_timer(info);
+
+ ops->cursor_flash = (mode == CM_ERASE) ? 0 : 1;
+- if (mode & CM_SOFTBACK) {
+- mode &= ~CM_SOFTBACK;
+- y = softback_lines;
+- } else {
+- if (softback_lines)
+- fbcon_set_origin(vc);
+- y = 0;
+- }
+
+- ops->cursor(vc, info, mode, y, get_color(vc, info, c, 1),
++ ops->cursor(vc, info, mode, 0, get_color(vc, info, c, 1),
+ get_color(vc, info, c, 0));
+ }
+
+@@ -1479,8 +1416,6 @@ static void fbcon_set_disp(struct fb_inf
+
+ if (con_is_visible(vc)) {
+ update_screen(vc);
+- if (softback_buf)
+- fbcon_update_softback(vc);
+ }
+ }
+
+@@ -1618,99 +1553,6 @@ static __inline__ void ypan_down_redraw(
+ scrollback_current = 0;
+ }
+
+-static void fbcon_redraw_softback(struct vc_data *vc, struct fbcon_display *p,
+- long delta)
+-{
+- int count = vc->vc_rows;
+- unsigned short *d, *s;
+- unsigned long n;
+- int line = 0;
+-
+- d = (u16 *) softback_curr;
+- if (d == (u16 *) softback_in)
+- d = (u16 *) vc->vc_origin;
+- n = softback_curr + delta * vc->vc_size_row;
+- softback_lines -= delta;
+- if (delta < 0) {
+- if (softback_curr < softback_top && n < softback_buf) {
+- n += softback_end - softback_buf;
+- if (n < softback_top) {
+- softback_lines -=
+- (softback_top - n) / vc->vc_size_row;
+- n = softback_top;
+- }
+- } else if (softback_curr >= softback_top
+- && n < softback_top) {
+- softback_lines -=
+- (softback_top - n) / vc->vc_size_row;
+- n = softback_top;
+- }
+- } else {
+- if (softback_curr > softback_in && n >= softback_end) {
+- n += softback_buf - softback_end;
+- if (n > softback_in) {
+- n = softback_in;
+- softback_lines = 0;
+- }
+- } else if (softback_curr <= softback_in && n > softback_in) {
+- n = softback_in;
+- softback_lines = 0;
+- }
+- }
+- if (n == softback_curr)
+- return;
+- softback_curr = n;
+- s = (u16 *) softback_curr;
+- if (s == (u16 *) softback_in)
+- s = (u16 *) vc->vc_origin;
+- while (count--) {
+- unsigned short *start;
+- unsigned short *le;
+- unsigned short c;
+- int x = 0;
+- unsigned short attr = 1;
+-
+- start = s;
+- le = advance_row(s, 1);
+- do {
+- c = scr_readw(s);
+- if (attr != (c & 0xff00)) {
+- attr = c & 0xff00;
+- if (s > start) {
+- fbcon_putcs(vc, start, s - start,
+- line, x);
+- x += s - start;
+- start = s;
+- }
+- }
+- if (c == scr_readw(d)) {
+- if (s > start) {
+- fbcon_putcs(vc, start, s - start,
+- line, x);
+- x += s - start + 1;
+- start = s + 1;
+- } else {
+- x++;
+- start++;
+- }
+- }
+- s++;
+- d++;
+- } while (s < le);
+- if (s > start)
+- fbcon_putcs(vc, start, s - start, line, x);
+- line++;
+- if (d == (u16 *) softback_end)
+- d = (u16 *) softback_buf;
+- if (d == (u16 *) softback_in)
+- d = (u16 *) vc->vc_origin;
+- if (s == (u16 *) softback_end)
+- s = (u16 *) softback_buf;
+- if (s == (u16 *) softback_in)
+- s = (u16 *) vc->vc_origin;
+- }
+-}
+-
+ static void fbcon_redraw_move(struct vc_data *vc, struct fbcon_display *p,
+ int line, int count, int dy)
+ {
+@@ -1850,31 +1692,6 @@ static void fbcon_redraw(struct vc_data
+ }
+ }
+
+-static inline void fbcon_softback_note(struct vc_data *vc, int t,
+- int count)
+-{
+- unsigned short *p;
+-
+- if (vc->vc_num != fg_console)
+- return;
+- p = (unsigned short *) (vc->vc_origin + t * vc->vc_size_row);
+-
+- while (count) {
+- scr_memcpyw((u16 *) softback_in, p, vc->vc_size_row);
+- count--;
+- p = advance_row(p, 1);
+- softback_in += vc->vc_size_row;
+- if (softback_in == softback_end)
+- softback_in = softback_buf;
+- if (softback_in == softback_top) {
+- softback_top += vc->vc_size_row;
+- if (softback_top == softback_end)
+- softback_top = softback_buf;
+- }
+- }
+- softback_curr = softback_in;
+-}
+-
+ static bool fbcon_scroll(struct vc_data *vc, unsigned int t, unsigned int b,
+ enum con_scroll dir, unsigned int count)
+ {
+@@ -1897,8 +1714,6 @@ static bool fbcon_scroll(struct vc_data
+ case SM_UP:
+ if (count > vc->vc_rows) /* Maximum realistic size */
+ count = vc->vc_rows;
+- if (softback_top)
+- fbcon_softback_note(vc, t, count);
+ if (logo_shown >= 0)
+ goto redraw_up;
+ switch (p->scrollmode) {
+@@ -2269,14 +2084,6 @@ static int fbcon_switch(struct vc_data *
+ info = registered_fb[con2fb_map[vc->vc_num]];
+ ops = info->fbcon_par;
+
+- if (softback_top) {
+- if (softback_lines)
+- fbcon_set_origin(vc);
+- softback_top = softback_curr = softback_in = softback_buf;
+- softback_lines = 0;
+- fbcon_update_softback(vc);
+- }
+-
+ if (logo_shown >= 0) {
+ struct vc_data *conp2 = vc_cons[logo_shown].d;
+
+@@ -2600,9 +2407,6 @@ static int fbcon_do_set_font(struct vc_d
+ int cnt;
+ char *old_data = NULL;
+
+- if (con_is_visible(vc) && softback_lines)
+- fbcon_set_origin(vc);
+-
+ resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
+ if (p->userfont)
+ old_data = vc->vc_font.data;
+@@ -2628,8 +2432,6 @@ static int fbcon_do_set_font(struct vc_d
+ cols /= w;
+ rows /= h;
+ vc_resize(vc, cols, rows);
+- if (con_is_visible(vc) && softback_buf)
+- fbcon_update_softback(vc);
+ } else if (con_is_visible(vc)
+ && vc->vc_mode == KD_TEXT) {
+ fbcon_clear_margins(vc, 0);
+@@ -2788,19 +2590,7 @@ static void fbcon_set_palette(struct vc_
+
+ static u16 *fbcon_screen_pos(struct vc_data *vc, int offset)
+ {
+- unsigned long p;
+- int line;
+-
+- if (vc->vc_num != fg_console || !softback_lines)
+- return (u16 *) (vc->vc_origin + offset);
+- line = offset / vc->vc_size_row;
+- if (line >= softback_lines)
+- return (u16 *) (vc->vc_origin + offset -
+- softback_lines * vc->vc_size_row);
+- p = softback_curr + offset;
+- if (p >= softback_end)
+- p += softback_buf - softback_end;
+- return (u16 *) p;
++ return (u16 *) (vc->vc_origin + offset);
+ }
+
+ static unsigned long fbcon_getxy(struct vc_data *vc, unsigned long pos,
+@@ -2814,22 +2604,7 @@ static unsigned long fbcon_getxy(struct
+
+ x = offset % vc->vc_cols;
+ y = offset / vc->vc_cols;
+- if (vc->vc_num == fg_console)
+- y += softback_lines;
+ ret = pos + (vc->vc_cols - x) * 2;
+- } else if (vc->vc_num == fg_console && softback_lines) {
+- unsigned long offset = pos - softback_curr;
+-
+- if (pos < softback_curr)
+- offset += softback_end - softback_buf;
+- offset /= 2;
+- x = offset % vc->vc_cols;
+- y = offset / vc->vc_cols;
+- ret = pos + (vc->vc_cols - x) * 2;
+- if (ret == softback_end)
+- ret = softback_buf;
+- if (ret == softback_in)
+- ret = vc->vc_origin;
+ } else {
+ /* Should not happen */
+ x = y = 0;
+@@ -2857,106 +2632,11 @@ static void fbcon_invert_region(struct v
+ a = ((a) & 0x88ff) | (((a) & 0x7000) >> 4) |
+ (((a) & 0x0700) << 4);
+ scr_writew(a, p++);
+- if (p == (u16 *) softback_end)
+- p = (u16 *) softback_buf;
+- if (p == (u16 *) softback_in)
+- p = (u16 *) vc->vc_origin;
+- }
+-}
+-
+-static void fbcon_scrolldelta(struct vc_data *vc, int lines)
+-{
+- struct fb_info *info = registered_fb[con2fb_map[fg_console]];
+- struct fbcon_ops *ops = info->fbcon_par;
+- struct fbcon_display *disp = &fb_display[fg_console];
+- int offset, limit, scrollback_old;
+-
+- if (softback_top) {
+- if (vc->vc_num != fg_console)
+- return;
+- if (vc->vc_mode != KD_TEXT || !lines)
+- return;
+- if (logo_shown >= 0) {
+- struct vc_data *conp2 = vc_cons[logo_shown].d;
+-
+- if (conp2->vc_top == logo_lines
+- && conp2->vc_bottom == conp2->vc_rows)
+- conp2->vc_top = 0;
+- if (logo_shown == vc->vc_num) {
+- unsigned long p, q;
+- int i;
+-
+- p = softback_in;
+- q = vc->vc_origin +
+- logo_lines * vc->vc_size_row;
+- for (i = 0; i < logo_lines; i++) {
+- if (p == softback_top)
+- break;
+- if (p == softback_buf)
+- p = softback_end;
+- p -= vc->vc_size_row;
+- q -= vc->vc_size_row;
+- scr_memcpyw((u16 *) q, (u16 *) p,
+- vc->vc_size_row);
+- }
+- softback_in = softback_curr = p;
+- update_region(vc, vc->vc_origin,
+- logo_lines * vc->vc_cols);
+- }
+- logo_shown = FBCON_LOGO_CANSHOW;
+- }
+- fbcon_cursor(vc, CM_ERASE | CM_SOFTBACK);
+- fbcon_redraw_softback(vc, disp, lines);
+- fbcon_cursor(vc, CM_DRAW | CM_SOFTBACK);
+- return;
+ }
+-
+- if (!scrollback_phys_max)
+- return;
+-
+- scrollback_old = scrollback_current;
+- scrollback_current -= lines;
+- if (scrollback_current < 0)
+- scrollback_current = 0;
+- else if (scrollback_current > scrollback_max)
+- scrollback_current = scrollback_max;
+- if (scrollback_current == scrollback_old)
+- return;
+-
+- if (fbcon_is_inactive(vc, info))
+- return;
+-
+- fbcon_cursor(vc, CM_ERASE);
+-
+- offset = disp->yscroll - scrollback_current;
+- limit = disp->vrows;
+- switch (disp->scrollmode) {
+- case SCROLL_WRAP_MOVE:
+- info->var.vmode |= FB_VMODE_YWRAP;
+- break;
+- case SCROLL_PAN_MOVE:
+- case SCROLL_PAN_REDRAW:
+- limit -= vc->vc_rows;
+- info->var.vmode &= ~FB_VMODE_YWRAP;
+- break;
+- }
+- if (offset < 0)
+- offset += limit;
+- else if (offset >= limit)
+- offset -= limit;
+-
+- ops->var.xoffset = 0;
+- ops->var.yoffset = offset * vc->vc_font.height;
+- ops->update_start(info);
+-
+- if (!scrollback_current)
+- fbcon_cursor(vc, CM_DRAW);
+ }
+
+ static int fbcon_set_origin(struct vc_data *vc)
+ {
+- if (softback_lines)
+- fbcon_scrolldelta(vc, softback_lines);
+ return 0;
+ }
+
+@@ -3020,8 +2700,6 @@ static void fbcon_modechanged(struct fb_
+
+ fbcon_set_palette(vc, color_table);
+ update_screen(vc);
+- if (softback_buf)
+- fbcon_update_softback(vc);
+ }
+ }
+
+@@ -3432,7 +3110,6 @@ static const struct consw fb_con = {
+ .con_font_default = fbcon_set_def_font,
+ .con_font_copy = fbcon_copy_font,
+ .con_set_palette = fbcon_set_palette,
+- .con_scrolldelta = fbcon_scrolldelta,
+ .con_set_origin = fbcon_set_origin,
+ .con_invert_region = fbcon_invert_region,
+ .con_screen_pos = fbcon_screen_pos,
+@@ -3667,9 +3344,6 @@ static void fbcon_exit(void)
+ }
+ #endif
+
+- kvfree((void *)softback_buf);
+- softback_buf = 0UL;
+-
+ for_each_registered_fb(i) {
+ int pending = 0;
+
--- /dev/null
+From 3fb884ffe921c99483a84b0175f3c03f048e9069 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Wed, 2 Sep 2020 11:18:29 +0100
+Subject: KVM: arm64: Do not try to map PUDs when they are folded into PMD
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 3fb884ffe921c99483a84b0175f3c03f048e9069 upstream.
+
+For the obscure cases where PMD and PUD are the same size
+(64kB pages with 42bit VA, for example, which results in only
+two levels of page tables), we can't map anything as a PUD,
+because there is... erm... no PUD to speak of. Everything is
+either a PMD or a PTE.
+
+So let's only try and map a PUD when its size is different from
+that of a PMD.
+
+Cc: stable@vger.kernel.org
+Fixes: b8e0ba7c8bea ("KVM: arm64: Add support for creating PUD hugepages at stage 2")
+Reported-by: Gavin Shan <gshan@redhat.com>
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Reviewed-by: Gavin Shan <gshan@redhat.com>
+Tested-by: Gavin Shan <gshan@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kvm/mmu.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kvm/mmu.c
++++ b/arch/arm64/kvm/mmu.c
+@@ -1968,7 +1968,12 @@ static int user_mem_abort(struct kvm_vcp
+ (fault_status == FSC_PERM &&
+ stage2_is_exec(kvm, fault_ipa, vma_pagesize));
+
+- if (vma_pagesize == PUD_SIZE) {
++ /*
++ * If PUD_SIZE == PMD_SIZE, there is no real PUD level, and
++ * all we have is a 2-level page table. Trying to map a PUD in
++ * this case would be fatally wrong.
++ */
++ if (PUD_SIZE != PMD_SIZE && vma_pagesize == PUD_SIZE) {
+ pud_t new_pud = kvm_pfn_pud(pfn, mem_type);
+
+ new_pud = kvm_pud_mkhuge(new_pud);
--- /dev/null
+From f65886606c2d3b562716de030706dfe1bea4ed5e Mon Sep 17 00:00:00 2001
+From: Rustam Kovhaev <rkovhaev@gmail.com>
+Date: Mon, 7 Sep 2020 11:55:35 -0700
+Subject: KVM: fix memory leak in kvm_io_bus_unregister_dev()
+
+From: Rustam Kovhaev <rkovhaev@gmail.com>
+
+commit f65886606c2d3b562716de030706dfe1bea4ed5e upstream.
+
+when kmalloc() fails in kvm_io_bus_unregister_dev(), before removing
+the bus, we should iterate over all other devices linked to it and call
+kvm_iodevice_destructor() for them
+
+Fixes: 90db10434b16 ("KVM: kvm_io_bus_unregister_dev() should never fail")
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: syzbot+f196caa45793d6374707@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=f196caa45793d6374707
+Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Message-Id: <20200907185535.233114-1-rkovhaev@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ virt/kvm/kvm_main.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -4269,7 +4269,7 @@ int kvm_io_bus_register_dev(struct kvm *
+ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ struct kvm_io_device *dev)
+ {
+- int i;
++ int i, j;
+ struct kvm_io_bus *new_bus, *bus;
+
+ bus = kvm_get_bus(kvm, bus_idx);
+@@ -4286,17 +4286,20 @@ void kvm_io_bus_unregister_dev(struct kv
+
+ new_bus = kmalloc(struct_size(bus, range, bus->dev_count - 1),
+ GFP_KERNEL_ACCOUNT);
+- if (!new_bus) {
++ if (new_bus) {
++ memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
++ new_bus->dev_count--;
++ memcpy(new_bus->range + i, bus->range + i + 1,
++ (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
++ } else {
+ pr_err("kvm: failed to shrink bus, removing it completely\n");
+- goto broken;
++ for (j = 0; j < bus->dev_count; j++) {
++ if (j == i)
++ continue;
++ kvm_iodevice_destructor(bus->range[j].dev);
++ }
+ }
+
+- memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+- new_bus->dev_count--;
+- memcpy(new_bus->range + i, bus->range + i + 1,
+- (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+-
+-broken:
+ rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
+ synchronize_srcu_expedited(&kvm->srcu);
+ kfree(bus);
--- /dev/null
+From 99b82a1437cb31340dbb2c437a2923b9814a7b15 Mon Sep 17 00:00:00 2001
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Wed, 19 Aug 2020 16:55:27 +0800
+Subject: KVM: VMX: Don't freeze guest when event delivery causes an APIC-access exit
+
+From: Wanpeng Li <wanpengli@tencent.com>
+
+commit 99b82a1437cb31340dbb2c437a2923b9814a7b15 upstream.
+
+According to SDM 27.2.4, Event delivery causes an APIC-access VM exit.
+Don't report internal error and freeze guest when event delivery causes
+an APIC-access exit, it is handleable and the event will be re-injected
+during the next vmentry.
+
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Message-Id: <1597827327-25055-2-git-send-email-wanpengli@tencent.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx/vmx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -6028,6 +6028,7 @@ static int vmx_handle_exit(struct kvm_vc
+ (exit_reason != EXIT_REASON_EXCEPTION_NMI &&
+ exit_reason != EXIT_REASON_EPT_VIOLATION &&
+ exit_reason != EXIT_REASON_PML_FULL &&
++ exit_reason != EXIT_REASON_APIC_ACCESS &&
+ exit_reason != EXIT_REASON_TASK_SWITCH)) {
+ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
+ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
--- /dev/null
+From f6f6195b888c28a0b59ceb0562daff92a2be86c3 Mon Sep 17 00:00:00 2001
+From: Lai Jiangshan <laijs@linux.alibaba.com>
+Date: Wed, 2 Sep 2020 21:54:21 +0800
+Subject: kvm x86/mmu: use KVM_REQ_MMU_SYNC to sync when needed
+
+From: Lai Jiangshan <laijs@linux.alibaba.com>
+
+commit f6f6195b888c28a0b59ceb0562daff92a2be86c3 upstream.
+
+When kvm_mmu_get_page() gets a page with unsynced children, the spt
+pagetable is unsynchronized with the guest pagetable. But the
+guest might not issue a "flush" operation on it when the pagetable
+entry is changed from zero or other cases. The hypervisor has the
+responsibility to synchronize the pagetables.
+
+KVM behaved as above for many years, But commit 8c8560b83390
+("KVM: x86/mmu: Use KVM_REQ_TLB_FLUSH_CURRENT for MMU specific flushes")
+inadvertently included a line of code to change it without giving any
+reason in the changelog. It is clear that the commit's intention was to
+change KVM_REQ_TLB_FLUSH -> KVM_REQ_TLB_FLUSH_CURRENT, so we don't
+needlessly flush other contexts; however, one of the hunks changed
+a nearby KVM_REQ_MMU_SYNC instead. This patch changes it back.
+
+Link: https://lore.kernel.org/lkml/20200320212833.3507-26-sean.j.christopherson@intel.com/
+Cc: Sean Christopherson <sean.j.christopherson@intel.com>
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Lai Jiangshan <laijs@linux.alibaba.com>
+Message-Id: <20200902135421.31158-1-jiangshanlai@gmail.com>
+fixes: 8c8560b83390 ("KVM: x86/mmu: Use KVM_REQ_TLB_FLUSH_CURRENT for MMU specific flushes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/mmu/mmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -2521,7 +2521,7 @@ static struct kvm_mmu_page *kvm_mmu_get_
+ }
+
+ if (sp->unsync_children)
+- kvm_make_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu);
++ kvm_make_request(KVM_REQ_MMU_SYNC, vcpu);
+
+ __clear_sp_write_flooding_count(sp);
+ trace_kvm_mmu_get_page(sp, false);
--- /dev/null
+From afd55e6d1bd35b4b36847869011447a83a81c8e0 Mon Sep 17 00:00:00 2001
+From: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Date: Wed, 29 Jul 2020 21:00:03 +0530
+Subject: phy: qcom-qmp: Use correct values for ipq8074 PCIe Gen2 PHY init
+
+From: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+
+commit afd55e6d1bd35b4b36847869011447a83a81c8e0 upstream.
+
+There were some problem in ipq8074 Gen2 PCIe phy init sequence.
+
+1. Few register values were wrongly updated in the phy init sequence.
+2. The register QSERDES_RX_SIGDET_CNTRL is a RX tuning parameter
+ register which is added in serdes table causing the wrong register
+ was getting updated.
+3. Clocks and resets were not added in the phy init.
+
+Fix these to make Gen2 PCIe port on ipq8074 devices to work.
+
+Fixes: eef243d04b2b6 ("phy: qcom-qmp: Add support for IPQ8074")
+Cc: stable@vger.kernel.org
+Co-developed-by: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
+Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@codeaurora.org>
+Signed-off-by: Sivaprakash Murugesan <sivaprak@codeaurora.org>
+Link: https://lore.kernel.org/r/1596036607-11877-4-git-send-email-sivaprak@codeaurora.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 16 +++++++++-------
+ drivers/phy/qualcomm/phy-qcom-qmp.h | 2 ++
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -504,8 +504,8 @@ static const struct qmp_phy_init_tbl ipq
+ QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0xf),
+ QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x1),
+ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x0),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0x1f),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x3f),
++ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER1, 0xff),
++ QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_TIMER2, 0x1f),
+ QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x6),
+ QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0xf),
+ QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x0),
+@@ -531,7 +531,6 @@ static const struct qmp_phy_init_tbl ipq
+ QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x0),
+ QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
+ QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x1),
+- QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_CTRL, 0xa),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x1),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x1),
+@@ -540,7 +539,6 @@ static const struct qmp_phy_init_tbl ipq
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0x2f),
+ QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x19),
+ QMP_PHY_INIT_CFG(QSERDES_COM_CLK_EP_DIV, 0x19),
+- QMP_PHY_INIT_CFG(QSERDES_RX_SIGDET_CNTRL, 0x7),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_tx_tbl[] = {
+@@ -548,6 +546,8 @@ static const struct qmp_phy_init_tbl ipq
+ QMP_PHY_INIT_CFG(QSERDES_TX_LANE_MODE, 0x6),
+ QMP_PHY_INIT_CFG(QSERDES_TX_RES_CODE_LANE_OFFSET, 0x2),
+ QMP_PHY_INIT_CFG(QSERDES_TX_RCV_DETECT_LVL_2, 0x12),
++ QMP_PHY_INIT_CFG(QSERDES_TX_EMP_POST1_LVL, 0x36),
++ QMP_PHY_INIT_CFG(QSERDES_TX_SLEW_CNTL, 0x0a),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_rx_tbl[] = {
+@@ -558,7 +558,6 @@ static const struct qmp_phy_init_tbl ipq
+ QMP_PHY_INIT_CFG(QSERDES_RX_RX_EQU_ADAPTOR_CNTRL4, 0xdb),
+ QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x4b),
+ QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN, 0x4),
+- QMP_PHY_INIT_CFG(QSERDES_RX_UCDR_SO_GAIN_HALF, 0x4),
+ };
+
+ static const struct qmp_phy_init_tbl ipq8074_pcie_pcs_tbl[] = {
+@@ -1673,6 +1672,9 @@ static const struct qmp_phy_cfg msm8996_
+ .pwrdn_ctrl = SW_PWRDN,
+ };
+
++static const char * const ipq8074_pciephy_clk_l[] = {
++ "aux", "cfg_ahb",
++};
+ /* list of resets */
+ static const char * const ipq8074_pciephy_reset_l[] = {
+ "phy", "common",
+@@ -1690,8 +1692,8 @@ static const struct qmp_phy_cfg ipq8074_
+ .rx_tbl_num = ARRAY_SIZE(ipq8074_pcie_rx_tbl),
+ .pcs_tbl = ipq8074_pcie_pcs_tbl,
+ .pcs_tbl_num = ARRAY_SIZE(ipq8074_pcie_pcs_tbl),
+- .clk_list = NULL,
+- .num_clks = 0,
++ .clk_list = ipq8074_pciephy_clk_l,
++ .num_clks = ARRAY_SIZE(ipq8074_pciephy_clk_l),
+ .reset_list = ipq8074_pciephy_reset_l,
+ .num_resets = ARRAY_SIZE(ipq8074_pciephy_reset_l),
+ .vreg_list = NULL,
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.h
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.h
+@@ -77,6 +77,8 @@
+ #define QSERDES_COM_CORECLK_DIV_MODE1 0x1bc
+
+ /* Only for QMP V2 PHY - TX registers */
++#define QSERDES_TX_EMP_POST1_LVL 0x018
++#define QSERDES_TX_SLEW_CNTL 0x040
+ #define QSERDES_TX_RES_CODE_LANE_OFFSET 0x054
+ #define QSERDES_TX_DEBUG_BUS_SEL 0x064
+ #define QSERDES_TX_HIGHZ_TRANSCEIVEREN_BIAS_DRVR_EN 0x068
--- /dev/null
+From a6498d51821edf9615b42b968fb419a40197a982 Mon Sep 17 00:00:00 2001
+From: Amjad Ouled-Ameur <aouledameur@baylibre.com>
+Date: Thu, 27 Aug 2020 16:48:10 +0200
+Subject: Revert "usb: dwc3: meson-g12a: fix shared reset control use"
+
+From: Amjad Ouled-Ameur <aouledameur@baylibre.com>
+
+commit a6498d51821edf9615b42b968fb419a40197a982 upstream.
+
+This reverts commit 7a410953d1fb4dbe91ffcfdee9cbbf889d19b0d7.
+
+This commit breaks USB on meson-gxl-s905x-libretech-cc. Reverting
+the change solves the issue.
+
+In fact, according to the reset framework code, consumers must not use
+reset_control_(de)assert() on shared reset lines when reset_control_reset
+has been used, and vice-versa.
+
+Moreover, with this commit, usb is not guaranted to be reset since the
+reset is likely to be initially deasserted.
+
+Reverting the commit will bring back the suspend warning mentioned in the
+commit description. Nevertheless, a warning is much less critical than
+breaking dwc3-meson-g12a USB completely. We will address the warning
+issue in another way as a 2nd step.
+
+Fixes: 7a410953d1fb ("usb: dwc3: meson-g12a: fix shared reset control use")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Amjad Ouled-Ameur <aouledameur@baylibre.com>
+Reported-by: Jerome Brunet <jbrunet@baylibre.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20200827144810.26657-1-aouledameur@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -737,13 +737,13 @@ static int dwc3_meson_g12a_probe(struct
+ goto err_disable_clks;
+ }
+
+- ret = reset_control_deassert(priv->reset);
++ ret = reset_control_reset(priv->reset);
+ if (ret)
+- goto err_assert_reset;
++ goto err_disable_clks;
+
+ ret = dwc3_meson_g12a_get_phys(priv);
+ if (ret)
+- goto err_assert_reset;
++ goto err_disable_clks;
+
+ ret = priv->drvdata->setup_regmaps(priv, base);
+ if (ret)
+@@ -752,7 +752,7 @@ static int dwc3_meson_g12a_probe(struct
+ if (priv->vbus) {
+ ret = regulator_enable(priv->vbus);
+ if (ret)
+- goto err_assert_reset;
++ goto err_disable_clks;
+ }
+
+ /* Get dr_mode */
+@@ -765,13 +765,13 @@ static int dwc3_meson_g12a_probe(struct
+
+ ret = priv->drvdata->usb_init(priv);
+ if (ret)
+- goto err_assert_reset;
++ goto err_disable_clks;
+
+ /* Init PHYs */
+ for (i = 0 ; i < PHY_COUNT ; ++i) {
+ ret = phy_init(priv->phys[i]);
+ if (ret)
+- goto err_assert_reset;
++ goto err_disable_clks;
+ }
+
+ /* Set PHY Power */
+@@ -809,9 +809,6 @@ err_phys_exit:
+ for (i = 0 ; i < PHY_COUNT ; ++i)
+ phy_exit(priv->phys[i]);
+
+-err_assert_reset:
+- reset_control_assert(priv->reset);
+-
+ err_disable_clks:
+ clk_bulk_disable_unprepare(priv->drvdata->num_clks,
+ priv->drvdata->clks);
rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch
rdma-rxe-fix-the-parent-sysfs-read-when-the-interface-has-15-chars.patch
rdma-mlx4-read-pkey-table-length-instead-of-hardcoded-value.patch
+fbcon-remove-soft-scrollback-code.patch
+fbcon-remove-now-unusued-softback_lines-cursor-argument.patch
+vgacon-remove-software-scrollback-support.patch
+kvm-vmx-don-t-freeze-guest-when-event-delivery-causes-an-apic-access-exit.patch
+kvm-arm64-do-not-try-to-map-puds-when-they-are-folded-into-pmd.patch
+kvm-x86-mmu-use-kvm_req_mmu_sync-to-sync-when-needed.patch
+kvm-fix-memory-leak-in-kvm_io_bus_unregister_dev.patch
+revert-usb-dwc3-meson-g12a-fix-shared-reset-control-use.patch
+debugfs-fix-module-state-check-condition.patch
+test_firmware-test-platform-fw-loading-on-non-efi-systems.patch
+arm64-dts-imx8mp-correct-sdma1-clk-setting.patch
+arm-dts-vfxxx-add-syscon-compatible-with-ocotp.patch
+video-fbdev-fix-oob-read-in-vga_8planes_imageblit.patch
+staging-greybus-audio-fix-uninitialized-value-issue.patch
+phy-qcom-qmp-use-correct-values-for-ipq8074-pcie-gen2-phy-init.patch
+usb-core-fix-slab-out-of-bounds-read-in-read_descriptors.patch
+usb-serial-ftdi_sio-add-ids-for-xsens-mti-usb-converter.patch
+usb-serial-option-support-dynamic-quectel-usb-compositions.patch
+usb-serial-option-add-support-for-sim7070-sim7080-sim7090-modules.patch
+usb-fix-out-of-sync-data-toggle-if-a-configured-device-is-reconfigured.patch
+usb-typec-ucsi-acpi-check-the-_dep-dependencies.patch
+usb-typec-intel_pmc_mux-un-register-the-usb-role-switch.patch
+usb-typec-intel_pmc_mux-do-not-configure-altmode-hpd-high.patch
+usb-typec-intel_pmc_mux-do-not-configure-sbu-and-hsl-orientation-in-alternate-modes.patch
--- /dev/null
+From 1dffeb8b8b4c261c45416d53c75ea51e6ece1770 Mon Sep 17 00:00:00 2001
+From: Vaibhav Agarwal <vaibhav.sr@gmail.com>
+Date: Fri, 14 Aug 2020 18:03:15 +0530
+Subject: staging: greybus: audio: fix uninitialized value issue
+
+From: Vaibhav Agarwal <vaibhav.sr@gmail.com>
+
+commit 1dffeb8b8b4c261c45416d53c75ea51e6ece1770 upstream.
+
+The current implementation for gbcodec_mixer_dapm_ctl_put() uses
+uninitialized gbvalue for comparison with updated value. This was found
+using static analysis with coverity.
+
+Uninitialized scalar variable (UNINIT)
+11. uninit_use: Using uninitialized value
+gbvalue.value.integer_value[0].
+460 if (gbvalue.value.integer_value[0] != val) {
+
+This patch fixes the issue with fetching the gbvalue before using it for
+ comparision.
+
+Fixes: 6339d2322c47 ("greybus: audio: Add topology parser for GB codec")
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Vaibhav Agarwal <vaibhav.sr@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/bc4f29eb502ccf93cd2ffd98db0e319fa7d0f247.1597408126.git.vaibhav.sr@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/audio_topology.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+--- a/drivers/staging/greybus/audio_topology.c
++++ b/drivers/staging/greybus/audio_topology.c
+@@ -460,6 +460,15 @@ static int gbcodec_mixer_dapm_ctl_put(st
+ val = ucontrol->value.integer.value[0] & mask;
+ connect = !!val;
+
++ ret = gb_pm_runtime_get_sync(bundle);
++ if (ret)
++ return ret;
++
++ ret = gb_audio_gb_get_control(module->mgmt_connection, data->ctl_id,
++ GB_AUDIO_INVALID_INDEX, &gbvalue);
++ if (ret)
++ goto exit;
++
+ /* update ucontrol */
+ if (gbvalue.value.integer_value[0] != val) {
+ for (wi = 0; wi < wlist->num_widgets; wi++) {
+@@ -473,25 +482,17 @@ static int gbcodec_mixer_dapm_ctl_put(st
+ gbvalue.value.integer_value[0] =
+ cpu_to_le32(ucontrol->value.integer.value[0]);
+
+- ret = gb_pm_runtime_get_sync(bundle);
+- if (ret)
+- return ret;
+-
+ ret = gb_audio_gb_set_control(module->mgmt_connection,
+ data->ctl_id,
+ GB_AUDIO_INVALID_INDEX, &gbvalue);
+-
+- gb_pm_runtime_put_autosuspend(bundle);
+-
+- if (ret) {
+- dev_err_ratelimited(codec->dev,
+- "%d:Error in %s for %s\n", ret,
+- __func__, kcontrol->id.name);
+- return ret;
+- }
+ }
+
+- return 0;
++exit:
++ gb_pm_runtime_put_autosuspend(bundle);
++ if (ret)
++ dev_err_ratelimited(codec_dev, "%d:Error in %s for %s\n", ret,
++ __func__, kcontrol->id.name);
++ return ret;
+ }
+
+ #define SOC_DAPM_MIXER_GB(xname, kcount, data) \
--- /dev/null
+From baaabecfc80fad255f866563b53b8c7a3eec176e Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 9 Sep 2020 15:53:54 -0700
+Subject: test_firmware: Test platform fw loading on non-EFI systems
+
+From: Kees Cook <keescook@chromium.org>
+
+commit baaabecfc80fad255f866563b53b8c7a3eec176e upstream.
+
+On non-EFI systems, it wasn't possible to test the platform firmware
+loader because it will have never set "checked_fw" during __init.
+Instead, allow the test code to override this check. Additionally split
+the declarations into a private symbol namespace so there is greater
+enforcement of the symbol visibility.
+
+Fixes: 548193cba2a7 ("test_firmware: add support for firmware_request_platform")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Link: https://lore.kernel.org/r/20200909225354.3118328-1-keescook@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/efi/embedded-firmware.c | 10 +++++-----
+ include/linux/efi_embedded_fw.h | 6 ++----
+ lib/test_firmware.c | 9 +++++++++
+ 3 files changed, 16 insertions(+), 9 deletions(-)
+
+--- a/drivers/firmware/efi/embedded-firmware.c
++++ b/drivers/firmware/efi/embedded-firmware.c
+@@ -16,9 +16,9 @@
+
+ /* Exported for use by lib/test_firmware.c only */
+ LIST_HEAD(efi_embedded_fw_list);
+-EXPORT_SYMBOL_GPL(efi_embedded_fw_list);
+-
+-static bool checked_for_fw;
++EXPORT_SYMBOL_NS_GPL(efi_embedded_fw_list, TEST_FIRMWARE);
++bool efi_embedded_fw_checked;
++EXPORT_SYMBOL_NS_GPL(efi_embedded_fw_checked, TEST_FIRMWARE);
+
+ static const struct dmi_system_id * const embedded_fw_table[] = {
+ #ifdef CONFIG_TOUCHSCREEN_DMI
+@@ -119,14 +119,14 @@ void __init efi_check_for_embedded_firmw
+ }
+ }
+
+- checked_for_fw = true;
++ efi_embedded_fw_checked = true;
+ }
+
+ int efi_get_embedded_fw(const char *name, const u8 **data, size_t *size)
+ {
+ struct efi_embedded_fw *iter, *fw = NULL;
+
+- if (!checked_for_fw) {
++ if (!efi_embedded_fw_checked) {
+ pr_warn("Warning %s called while we did not check for embedded fw\n",
+ __func__);
+ return -ENOENT;
+--- a/include/linux/efi_embedded_fw.h
++++ b/include/linux/efi_embedded_fw.h
+@@ -8,8 +8,8 @@
+ #define EFI_EMBEDDED_FW_PREFIX_LEN 8
+
+ /*
+- * This struct and efi_embedded_fw_list are private to the efi-embedded fw
+- * implementation they are in this header for use by lib/test_firmware.c only!
++ * This struct is private to the efi-embedded fw implementation.
++ * They are in this header for use by lib/test_firmware.c only!
+ */
+ struct efi_embedded_fw {
+ struct list_head list;
+@@ -18,8 +18,6 @@ struct efi_embedded_fw {
+ size_t length;
+ };
+
+-extern struct list_head efi_embedded_fw_list;
+-
+ /**
+ * struct efi_embedded_fw_desc - This struct is used by the EFI embedded-fw
+ * code to search for embedded firmwares.
+--- a/lib/test_firmware.c
++++ b/lib/test_firmware.c
+@@ -26,6 +26,8 @@
+ #include <linux/vmalloc.h>
+ #include <linux/efi_embedded_fw.h>
+
++MODULE_IMPORT_NS(TEST_FIRMWARE);
++
+ #define TEST_FIRMWARE_NAME "test-firmware.bin"
+ #define TEST_FIRMWARE_NUM_REQS 4
+ #define TEST_FIRMWARE_BUF_SIZE SZ_1K
+@@ -489,6 +491,9 @@ out:
+ static DEVICE_ATTR_WO(trigger_request);
+
+ #ifdef CONFIG_EFI_EMBEDDED_FIRMWARE
++extern struct list_head efi_embedded_fw_list;
++extern bool efi_embedded_fw_checked;
++
+ static ssize_t trigger_request_platform_store(struct device *dev,
+ struct device_attribute *attr,
+ const char *buf, size_t count)
+@@ -501,6 +506,7 @@ static ssize_t trigger_request_platform_
+ };
+ struct efi_embedded_fw efi_embedded_fw;
+ const struct firmware *firmware = NULL;
++ bool saved_efi_embedded_fw_checked;
+ char *name;
+ int rc;
+
+@@ -513,6 +519,8 @@ static ssize_t trigger_request_platform_
+ efi_embedded_fw.data = (void *)test_data;
+ efi_embedded_fw.length = sizeof(test_data);
+ list_add(&efi_embedded_fw.list, &efi_embedded_fw_list);
++ saved_efi_embedded_fw_checked = efi_embedded_fw_checked;
++ efi_embedded_fw_checked = true;
+
+ pr_info("loading '%s'\n", name);
+ rc = firmware_request_platform(&firmware, name, dev);
+@@ -530,6 +538,7 @@ static ssize_t trigger_request_platform_
+ rc = count;
+
+ out:
++ efi_embedded_fw_checked = saved_efi_embedded_fw_checked;
+ release_firmware(firmware);
+ list_del(&efi_embedded_fw.list);
+ kfree(name);
--- /dev/null
+From a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 Mon Sep 17 00:00:00 2001
+From: Zeng Tao <prime.zeng@hisilicon.com>
+Date: Fri, 4 Sep 2020 14:37:44 +0800
+Subject: usb: core: fix slab-out-of-bounds Read in read_descriptors
+
+From: Zeng Tao <prime.zeng@hisilicon.com>
+
+commit a18cd6c9b6bc73dc17e8b7e9bd07decaa8833c97 upstream.
+
+The USB device descriptor may get changed between two consecutive
+enumerations on the same device for some reason, such as DFU or
+malicius device.
+In that case, we may access the changing descriptor if we don't take
+the device lock here.
+
+The issue is reported:
+https://syzkaller.appspot.com/bug?id=901a0d9e6519ef8dc7acab25344bd287dd3c7be9
+
+Cc: stable <stable@vger.kernel.org>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: syzbot+256e56ddde8b8957eabd@syzkaller.appspotmail.com
+Fixes: 217a9081d8e6 ("USB: add all configs to the "descriptors" attribute")
+Signed-off-by: Zeng Tao <prime.zeng@hisilicon.com>
+Link: https://lore.kernel.org/r/1599201467-11000-1-git-send-email-prime.zeng@hisilicon.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/sysfs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -889,7 +889,11 @@ read_descriptors(struct file *filp, stru
+ size_t srclen, n;
+ int cfgno;
+ void *src;
++ int retval;
+
++ retval = usb_lock_device_interruptible(udev);
++ if (retval < 0)
++ return -EINTR;
+ /* The binary attribute begins with the device descriptor.
+ * Following that are the raw descriptor entries for all the
+ * configurations (config plus subsidiary descriptors).
+@@ -914,6 +918,7 @@ read_descriptors(struct file *filp, stru
+ off -= srclen;
+ }
+ }
++ usb_unlock_device(udev);
+ return count - nleft;
+ }
+
--- /dev/null
+From cfd54fa83a5068b61b7eb28d3c117d8354c74c7a Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 1 Sep 2020 11:25:28 +0300
+Subject: usb: Fix out of sync data toggle if a configured device is reconfigured
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit cfd54fa83a5068b61b7eb28d3c117d8354c74c7a upstream.
+
+Userspace drivers that use a SetConfiguration() request to "lightweight"
+reset an already configured usb device might cause data toggles to get out
+of sync between the device and host, and the device becomes unusable.
+
+The xHCI host requires endpoints to be dropped and added back to reset the
+toggle. If USB core notices the new configuration is the same as the
+current active configuration it will avoid these extra steps by calling
+usb_reset_configuration() instead of usb_set_configuration().
+
+A SetConfiguration() request will reset the device side data toggles.
+Make sure usb_reset_configuration() function also drops and adds back the
+endpoints to ensure data toggles are in sync.
+
+To avoid code duplication split the current usb_disable_device() function
+and reuse the endpoint specific part.
+
+Cc: stable <stable@vger.kernel.org>
+Tested-by: Martin Thierer <mthierer@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20200901082528.12557-1-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/message.c | 93 ++++++++++++++++++++-------------------------
+ 1 file changed, 43 insertions(+), 50 deletions(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -1205,6 +1205,34 @@ void usb_disable_interface(struct usb_de
+ }
+ }
+
++/*
++ * usb_disable_device_endpoints -- Disable all endpoints for a device
++ * @dev: the device whose endpoints are being disabled
++ * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
++ */
++static void usb_disable_device_endpoints(struct usb_device *dev, int skip_ep0)
++{
++ struct usb_hcd *hcd = bus_to_hcd(dev->bus);
++ int i;
++
++ if (hcd->driver->check_bandwidth) {
++ /* First pass: Cancel URBs, leave endpoint pointers intact. */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, false);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, false);
++ }
++ /* Remove endpoints from the host controller internal state */
++ mutex_lock(hcd->bandwidth_mutex);
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ mutex_unlock(hcd->bandwidth_mutex);
++ }
++ /* Second pass: remove endpoint pointers */
++ for (i = skip_ep0; i < 16; ++i) {
++ usb_disable_endpoint(dev, i, true);
++ usb_disable_endpoint(dev, i + USB_DIR_IN, true);
++ }
++}
++
+ /**
+ * usb_disable_device - Disable all the endpoints for a USB device
+ * @dev: the device whose endpoints are being disabled
+@@ -1218,7 +1246,6 @@ void usb_disable_interface(struct usb_de
+ void usb_disable_device(struct usb_device *dev, int skip_ep0)
+ {
+ int i;
+- struct usb_hcd *hcd = bus_to_hcd(dev->bus);
+
+ /* getting rid of interfaces will disconnect
+ * any drivers bound to them (a key side effect)
+@@ -1264,22 +1291,8 @@ void usb_disable_device(struct usb_devic
+
+ dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
+ skip_ep0 ? "non-ep0" : "all");
+- if (hcd->driver->check_bandwidth) {
+- /* First pass: Cancel URBs, leave endpoint pointers intact. */
+- for (i = skip_ep0; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, false);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, false);
+- }
+- /* Remove endpoints from the host controller internal state */
+- mutex_lock(hcd->bandwidth_mutex);
+- usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
+- mutex_unlock(hcd->bandwidth_mutex);
+- /* Second pass: remove endpoint pointers */
+- }
+- for (i = skip_ep0; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, true);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+- }
++
++ usb_disable_device_endpoints(dev, skip_ep0);
+ }
+
+ /**
+@@ -1522,6 +1535,9 @@ EXPORT_SYMBOL_GPL(usb_set_interface);
+ * The caller must own the device lock.
+ *
+ * Return: Zero on success, else a negative error code.
++ *
++ * If this routine fails the device will probably be in an unusable state
++ * with endpoints disabled, and interfaces only partially enabled.
+ */
+ int usb_reset_configuration(struct usb_device *dev)
+ {
+@@ -1537,10 +1553,7 @@ int usb_reset_configuration(struct usb_d
+ * calls during probe() are fine
+ */
+
+- for (i = 1; i < 16; ++i) {
+- usb_disable_endpoint(dev, i, true);
+- usb_disable_endpoint(dev, i + USB_DIR_IN, true);
+- }
++ usb_disable_device_endpoints(dev, 1); /* skip ep0*/
+
+ config = dev->actconfig;
+ retval = 0;
+@@ -1553,34 +1566,10 @@ int usb_reset_configuration(struct usb_d
+ mutex_unlock(hcd->bandwidth_mutex);
+ return -ENOMEM;
+ }
+- /* Make sure we have enough bandwidth for each alternate setting 0 */
+- for (i = 0; i < config->desc.bNumInterfaces; i++) {
+- struct usb_interface *intf = config->interface[i];
+- struct usb_host_interface *alt;
+-
+- alt = usb_altnum_to_altsetting(intf, 0);
+- if (!alt)
+- alt = &intf->altsetting[0];
+- if (alt != intf->cur_altsetting)
+- retval = usb_hcd_alloc_bandwidth(dev, NULL,
+- intf->cur_altsetting, alt);
+- if (retval < 0)
+- break;
+- }
+- /* If not, reinstate the old alternate settings */
++
++ /* xHCI adds all endpoints in usb_hcd_alloc_bandwidth */
++ retval = usb_hcd_alloc_bandwidth(dev, config, NULL, NULL);
+ if (retval < 0) {
+-reset_old_alts:
+- for (i--; i >= 0; i--) {
+- struct usb_interface *intf = config->interface[i];
+- struct usb_host_interface *alt;
+-
+- alt = usb_altnum_to_altsetting(intf, 0);
+- if (!alt)
+- alt = &intf->altsetting[0];
+- if (alt != intf->cur_altsetting)
+- usb_hcd_alloc_bandwidth(dev, NULL,
+- alt, intf->cur_altsetting);
+- }
+ usb_enable_lpm(dev);
+ mutex_unlock(hcd->bandwidth_mutex);
+ return retval;
+@@ -1589,8 +1578,12 @@ reset_old_alts:
+ USB_REQ_SET_CONFIGURATION, 0,
+ config->desc.bConfigurationValue, 0,
+ NULL, 0, USB_CTRL_SET_TIMEOUT);
+- if (retval < 0)
+- goto reset_old_alts;
++ if (retval < 0) {
++ usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
++ usb_enable_lpm(dev);
++ mutex_unlock(hcd->bandwidth_mutex);
++ return retval;
++ }
+ mutex_unlock(hcd->bandwidth_mutex);
+
+ /* re-init hc/hcd interface/endpoint state */
--- /dev/null
+From 6ccc48e0eb2f3a5f3bd39954a21317e5f8874726 Mon Sep 17 00:00:00 2001
+From: Patrick Riphagen <patrick.riphagen@xsens.com>
+Date: Thu, 6 Aug 2020 13:55:47 +0200
+Subject: USB: serial: ftdi_sio: add IDs for Xsens Mti USB converter
+
+From: Patrick Riphagen <patrick.riphagen@xsens.com>
+
+commit 6ccc48e0eb2f3a5f3bd39954a21317e5f8874726 upstream.
+
+The device added has an FTDI chip inside.
+The device is used to connect Xsens USB Motion Trackers.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Patrick Riphagen <patrick.riphagen@xsens.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -713,6 +713,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTIUSBCONVERTER_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -160,6 +160,7 @@
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
+ #define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
++#define XSENS_MTIUSBCONVERTER_PID 0x0301 /* MTi USB converter */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
--- /dev/null
+From 1ac698790819b83f39fd7ea4f6cdabee9bdd7b38 Mon Sep 17 00:00:00 2001
+From: Aleksander Morgado <aleksander@aleksander.es>
+Date: Sat, 29 Aug 2020 11:05:39 +0200
+Subject: USB: serial: option: add support for SIM7070/SIM7080/SIM7090 modules
+
+From: Aleksander Morgado <aleksander@aleksander.es>
+
+commit 1ac698790819b83f39fd7ea4f6cdabee9bdd7b38 upstream.
+
+These modules have 2 different USB layouts:
+
+The default layout with PID 0x9205 (AT+CUSBSELNV=1) exposes 4 TTYs and
+an ECM interface:
+
+ T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+ D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+ P: Vendor=1e0e ProdID=9205 Rev=00.00
+ S: Manufacturer=SimTech, Incorporated
+ S: Product=SimTech SIM7080
+ S: SerialNumber=1234567890ABCDEF
+ C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
+ I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+ I: If#=0x5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+
+The purpose of each TTY is as follows:
+ * ttyUSB0: DIAG/QCDM port.
+ * ttyUSB1: GNSS data.
+ * ttyUSB2: AT-capable port (control).
+ * ttyUSB3: AT-capable port (data).
+
+In the secondary layout with PID=0x9206 (AT+CUSBSELNV=86) the module
+exposes 6 TTY ports:
+
+ T: Bus=02 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 8 Spd=480 MxCh= 0
+ D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+ P: Vendor=1e0e ProdID=9206 Rev=00.00
+ S: Manufacturer=SimTech, Incorporated
+ S: Product=SimTech SIM7080
+ S: SerialNumber=1234567890ABCDEF
+ C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
+ I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ I: If#=0x5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+
+The purpose of each TTY is as follows:
+ * ttyUSB0: DIAG/QCDM port.
+ * ttyUSB1: GNSS data.
+ * ttyUSB2: AT-capable port (control).
+ * ttyUSB3: QFLOG interface.
+ * ttyUSB4: DAM interface.
+ * ttyUSB5: AT-capable port (data).
+
+Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1823,6 +1823,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */
+ .driver_info = RSVD(7) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9205, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT+ECM mode */
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9206, 0xff) }, /* Simcom SIM7070/SIM7080/SIM7090 AT-only mode */
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
--- /dev/null
+From 2bb70f0a4b238323e4e2f392fc3ddeb5b7208c9e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Sat, 29 Aug 2020 15:42:50 +0200
+Subject: USB: serial: option: support dynamic Quectel USB compositions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 2bb70f0a4b238323e4e2f392fc3ddeb5b7208c9e upstream.
+
+The USB composition, defining the set of exported functions, is dynamic
+in newer Quectel modems. Default functions can be disabled and
+alternative functions can be enabled instead. The alternatives
+includes class functions using interface pairs, which should be
+handled by the respective class drivers.
+
+Active interfaces are numbered consecutively, so static
+blacklisting based on interface numbers will fail when the
+composition changes. An example of such an error, where the
+option driver has bound to the CDC ECM data interface,
+preventing cdc_ether from handling this function:
+
+ T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+ D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+ P: Vendor=2c7c ProdID=0125 Rev= 3.18
+ S: Manufacturer=Quectel
+ S: Product=EC25-AF
+ C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+ A: FirstIf#= 4 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
+ I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 4 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=(none)
+ E: Ad=89(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
+ I:* If#= 5 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=option
+ I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=option
+ E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Another device with the same id gets correct drivers, since the
+interface of the network function happens to be blacklisted by option:
+
+ T: Bus=01 Lev=02 Prnt=02 Port=01 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+ D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+ P: Vendor=2c7c ProdID=0125 Rev= 3.18
+ S: Manufacturer=Android
+ S: Product=Android
+ C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+ I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+ E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+ E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+ E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+ E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+ E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+ E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Change rules for EC21, EC25, BG96 and EG95 to match vendor specific
+serial functions only, to prevent binding to class functions. Require
+2 endpoints on ff/ff/ff functions, avoiding the 3 endpoint QMI/RMNET
+network functions.
+
+Cc: AceLan Kao <acelan.kao@canonical.com>
+Cc: Sebastian Sjoholm <ssjoholm@mac.com>
+Cc: Dan Williams <dcbw@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1094,14 +1094,18 @@ static const struct usb_device_id option
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M),
+ .driver_info = RSVD(1) | RSVD(3) },
+ /* Quectel products using Quectel vendor ID */
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
+- .driver_info = RSVD(4) },
+- { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+- .driver_info = RSVD(4) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0xff, 0xff),
++ .driver_info = NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
--- /dev/null
+From 294955fd43dbf1e8f3a84cffa4797c6f22badc31 Mon Sep 17 00:00:00 2001
+From: Utkarsh Patel <utkarsh.h.patel@intel.com>
+Date: Mon, 7 Sep 2020 17:21:51 +0300
+Subject: usb: typec: intel_pmc_mux: Do not configure Altmode HPD High
+
+From: Utkarsh Patel <utkarsh.h.patel@intel.com>
+
+commit 294955fd43dbf1e8f3a84cffa4797c6f22badc31 upstream.
+
+According to the PMC Type C Subsystem (TCSS) Mux programming guide rev
+0.7, bit 14 is reserved in Alternate mode.
+In DP Alternate Mode state, if the HPD_STATE (bit 7) field in the
+status update command VDO is set to HPD_HIGH, HPD is configured via
+separate HPD mode request after configuring DP Alternate mode request.
+Configuring reserved bit may show unexpected behaviour.
+So do not configure them while issuing the Alternate Mode request.
+
+Fixes: 7990be48ef4d ("usb: typec: mux: intel: Handle alt mode HPD_HIGH")
+Cc: stable@vger.kernel.org
+Signed-off-by: Utkarsh Patel <utkarsh.h.patel@intel.com>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20200907142152.35678-2-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -63,7 +63,6 @@ enum {
+ #define PMC_USB_ALTMODE_DP_MODE_SHIFT 8
+
+ /* TBT specific Mode Data bits */
+-#define PMC_USB_ALTMODE_HPD_HIGH BIT(14)
+ #define PMC_USB_ALTMODE_TBT_TYPE BIT(17)
+ #define PMC_USB_ALTMODE_CABLE_TYPE BIT(18)
+ #define PMC_USB_ALTMODE_ACTIVE_LINK BIT(20)
+@@ -180,9 +179,6 @@ pmc_usb_mux_dp(struct pmc_usb_port *port
+ req.mode_data |= (state->mode - TYPEC_STATE_MODAL) <<
+ PMC_USB_ALTMODE_DP_MODE_SHIFT;
+
+- if (data->status & DP_STATUS_HPD_STATE)
+- req.mode_data |= PMC_USB_ALTMODE_HPD_HIGH;
+-
+ ret = pmc_usb_command(port, (void *)&req, sizeof(req));
+ if (ret)
+ return ret;
--- /dev/null
+From 7c6bbdf086ac7f1374bcf1ef0994b15109ecaf48 Mon Sep 17 00:00:00 2001
+From: Utkarsh Patel <utkarsh.h.patel@intel.com>
+Date: Mon, 7 Sep 2020 17:21:52 +0300
+Subject: usb: typec: intel_pmc_mux: Do not configure SBU and HSL Orientation in Alternate modes
+
+From: Utkarsh Patel <utkarsh.h.patel@intel.com>
+
+commit 7c6bbdf086ac7f1374bcf1ef0994b15109ecaf48 upstream.
+
+According to the PMC Type C Subsystem (TCSS) Mux programming guide rev
+0.7, bits 4 and 5 are reserved in Alternate modes.
+SBU Orientation and HSL Orientation needs to be configured only during
+initial cable detection in USB connect flow based on device property of
+"sbu-orientation" and "hsl-orientation".
+Configuring these reserved bits in the Alternate modes may result in delay
+in display link training or some unexpected behaviour.
+So do not configure them while issuing Alternate Mode requests.
+
+Fixes: ff4a30d5e243 ("usb: typec: mux: intel_pmc_mux: Support for static SBU/HSL orientation")
+Signed-off-by: Utkarsh Patel <utkarsh.h.patel@intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20200907142152.35678-3-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -56,8 +56,6 @@ enum {
+
+ #define PMC_USB_ALTMODE_ORI_SHIFT 1
+ #define PMC_USB_ALTMODE_UFP_SHIFT 3
+-#define PMC_USB_ALTMODE_ORI_AUX_SHIFT 4
+-#define PMC_USB_ALTMODE_ORI_HSL_SHIFT 5
+
+ /* DP specific Mode Data bits */
+ #define PMC_USB_ALTMODE_DP_MODE_SHIFT 8
+@@ -173,9 +171,6 @@ pmc_usb_mux_dp(struct pmc_usb_port *port
+ req.mode_data = (port->orientation - 1) << PMC_USB_ALTMODE_ORI_SHIFT;
+ req.mode_data |= (port->role - 1) << PMC_USB_ALTMODE_UFP_SHIFT;
+
+- req.mode_data |= sbu_orientation(port) << PMC_USB_ALTMODE_ORI_AUX_SHIFT;
+- req.mode_data |= hsl_orientation(port) << PMC_USB_ALTMODE_ORI_HSL_SHIFT;
+-
+ req.mode_data |= (state->mode - TYPEC_STATE_MODAL) <<
+ PMC_USB_ALTMODE_DP_MODE_SHIFT;
+
+@@ -203,9 +198,6 @@ pmc_usb_mux_tbt(struct pmc_usb_port *por
+ req.mode_data = (port->orientation - 1) << PMC_USB_ALTMODE_ORI_SHIFT;
+ req.mode_data |= (port->role - 1) << PMC_USB_ALTMODE_UFP_SHIFT;
+
+- req.mode_data |= sbu_orientation(port) << PMC_USB_ALTMODE_ORI_AUX_SHIFT;
+- req.mode_data |= hsl_orientation(port) << PMC_USB_ALTMODE_ORI_HSL_SHIFT;
+-
+ if (TBT_ADAPTER(data->device_mode) == TBT_ADAPTER_TBT3)
+ req.mode_data |= PMC_USB_ALTMODE_TBT_TYPE;
+
--- /dev/null
+From 290a405ce318d036666c4155d5899eb8cd6e0d97 Mon Sep 17 00:00:00 2001
+From: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+Date: Wed, 26 Aug 2020 00:08:11 +0530
+Subject: usb: typec: intel_pmc_mux: Un-register the USB role switch
+
+From: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+
+commit 290a405ce318d036666c4155d5899eb8cd6e0d97 upstream.
+
+Added missing code for un-register USB role switch in the remove and
+error path.
+
+Cc: Stable <stable@vger.kernel.org> # v5.8
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Fixes: 6701adfa9693b ("usb: typec: driver for Intel PMC mux control")
+Signed-off-by: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+Link: https://lore.kernel.org/r/20200825183811.7262-1-madhusudanarao.amara@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -441,6 +441,7 @@ err_remove_ports:
+ for (i = 0; i < pmc->num_ports; i++) {
+ typec_switch_unregister(pmc->port[i].typec_sw);
+ typec_mux_unregister(pmc->port[i].typec_mux);
++ usb_role_switch_unregister(pmc->port[i].usb_sw);
+ }
+
+ return ret;
+@@ -454,6 +455,7 @@ static int pmc_usb_remove(struct platfor
+ for (i = 0; i < pmc->num_ports; i++) {
+ typec_switch_unregister(pmc->port[i].typec_sw);
+ typec_mux_unregister(pmc->port[i].typec_mux);
++ usb_role_switch_unregister(pmc->port[i].usb_sw);
+ }
+
+ return 0;
--- /dev/null
+From 1f3546ff3f0a1000971daef58406954bad3f7061 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Fri, 4 Sep 2020 14:09:18 +0300
+Subject: usb: typec: ucsi: acpi: Check the _DEP dependencies
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 1f3546ff3f0a1000971daef58406954bad3f7061 upstream.
+
+Failing probe with -EPROBE_DEFER until all dependencies
+listed in the _DEP (Operation Region Dependencies) object
+have been met.
+
+This will fix an issue where on some platforms UCSI ACPI
+driver fails to probe because the address space handler for
+the operation region that the UCSI ACPI interface uses has
+not been loaded yet.
+
+Fixes: 8243edf44152 ("usb: typec: ucsi: Add ACPI driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20200904110918.51546-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/ucsi/ucsi_acpi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c
+@@ -112,11 +112,15 @@ static void ucsi_acpi_notify(acpi_handle
+
+ static int ucsi_acpi_probe(struct platform_device *pdev)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
+ struct ucsi_acpi *ua;
+ struct resource *res;
+ acpi_status status;
+ int ret;
+
++ if (adev->dep_unmet)
++ return -EPROBE_DEFER;
++
+ ua = devm_kzalloc(&pdev->dev, sizeof(*ua), GFP_KERNEL);
+ if (!ua)
+ return -ENOMEM;
--- /dev/null
+From 973c096f6a85e5b5f2a295126ba6928d9a6afd45 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 9 Sep 2020 14:53:50 -0700
+Subject: vgacon: remove software scrollback support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 973c096f6a85e5b5f2a295126ba6928d9a6afd45 upstream.
+
+Yunhai Zhang recently fixed a VGA software scrollback bug in commit
+ebfdfeeae8c0 ("vgacon: Fix for missing check in scrollback handling"),
+but that then made people look more closely at some of this code, and
+there were more problems on the vgacon side, but also the fbcon software
+scrollback.
+
+We don't really have anybody who maintains this code - probably because
+nobody actually _uses_ it any more. Sure, people still use both VGA and
+the framebuffer consoles, but they are no longer the main user
+interfaces to the kernel, and haven't been for decades, so these kinds
+of extra features end up bitrotting and not really being used.
+
+So rather than try to maintain a likely unused set of code, I'll just
+aggressively remove it, and see if anybody even notices. Maybe there
+are people who haven't jumped on the whole GUI badnwagon yet, and think
+it's just a fad. And maybe those people use the scrollback code.
+
+If that turns out to be the case, we can resurrect this again, once
+we've found the sucker^Wmaintainer for it who actually uses it.
+
+Reported-by: NopNop Nop <nopitydays@gmail.com>
+Tested-by: Willy Tarreau <w@1wt.eu>
+Cc: 张云海 <zhangyunhai@nsfocus.com>
+Acked-by: Andy Lutomirski <luto@amacapital.net>
+Acked-by: Willy Tarreau <w@1wt.eu>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/configs/pasemi_defconfig | 1
+ arch/powerpc/configs/ppc6xx_defconfig | 1
+ arch/x86/configs/i386_defconfig | 1
+ arch/x86/configs/x86_64_defconfig | 1
+ drivers/video/console/Kconfig | 46 -------
+ drivers/video/console/vgacon.c | 221 ----------------------------------
+ 6 files changed, 1 insertion(+), 270 deletions(-)
+
+--- a/arch/powerpc/configs/pasemi_defconfig
++++ b/arch/powerpc/configs/pasemi_defconfig
+@@ -109,7 +109,6 @@ CONFIG_FB_NVIDIA=y
+ CONFIG_FB_NVIDIA_I2C=y
+ CONFIG_FB_RADEON=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ CONFIG_SOUND=y
+ CONFIG_SND=y
+--- a/arch/powerpc/configs/ppc6xx_defconfig
++++ b/arch/powerpc/configs/ppc6xx_defconfig
+@@ -772,7 +772,6 @@ CONFIG_FB_TRIDENT=m
+ CONFIG_FB_SM501=m
+ CONFIG_FB_IBM_GXT4500=y
+ CONFIG_LCD_PLATFORM=m
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_FRAMEBUFFER_CONSOLE_ROTATION=y
+ CONFIG_LOGO=y
+--- a/arch/x86/configs/i386_defconfig
++++ b/arch/x86/configs/i386_defconfig
+@@ -202,7 +202,6 @@ CONFIG_FB_MODE_HELPERS=y
+ CONFIG_FB_TILEBLITTING=y
+ CONFIG_FB_EFI=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ # CONFIG_LOGO_LINUX_MONO is not set
+ # CONFIG_LOGO_LINUX_VGA16 is not set
+--- a/arch/x86/configs/x86_64_defconfig
++++ b/arch/x86/configs/x86_64_defconfig
+@@ -197,7 +197,6 @@ CONFIG_FB_MODE_HELPERS=y
+ CONFIG_FB_TILEBLITTING=y
+ CONFIG_FB_EFI=y
+ # CONFIG_LCD_CLASS_DEVICE is not set
+-CONFIG_VGACON_SOFT_SCROLLBACK=y
+ CONFIG_LOGO=y
+ # CONFIG_LOGO_LINUX_MONO is not set
+ # CONFIG_LOGO_LINUX_VGA16 is not set
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -22,52 +22,6 @@ config VGA_CONSOLE
+
+ Say Y.
+
+-config VGACON_SOFT_SCROLLBACK
+- bool "Enable Scrollback Buffer in System RAM"
+- depends on VGA_CONSOLE
+- default n
+- help
+- The scrollback buffer of the standard VGA console is located in
+- the VGA RAM. The size of this RAM is fixed and is quite small.
+- If you require a larger scrollback buffer, this can be placed in
+- System RAM which is dynamically allocated during initialization.
+- Placing the scrollback buffer in System RAM will slightly slow
+- down the console.
+-
+- If you want this feature, say 'Y' here and enter the amount of
+- RAM to allocate for this buffer. If unsure, say 'N'.
+-
+-config VGACON_SOFT_SCROLLBACK_SIZE
+- int "Scrollback Buffer Size (in KB)"
+- depends on VGACON_SOFT_SCROLLBACK
+- range 1 1024
+- default "64"
+- help
+- Enter the amount of System RAM to allocate for scrollback
+- buffers of VGA consoles. Each 64KB will give you approximately
+- 16 80x25 screenfuls of scrollback buffer.
+-
+-config VGACON_SOFT_SCROLLBACK_PERSISTENT_ENABLE_BY_DEFAULT
+- bool "Persistent Scrollback History for each console by default"
+- depends on VGACON_SOFT_SCROLLBACK
+- default n
+- help
+- Say Y here if the scrollback history should persist by default when
+- switching between consoles. Otherwise, the scrollback history will be
+- flushed each time the console is switched. This feature can also be
+- enabled using the boot command line parameter
+- 'vgacon.scrollback_persistent=1'.
+-
+- This feature might break your tool of choice to flush the scrollback
+- buffer, e.g. clear(1) will work fine but Debian's clear_console(1)
+- will be broken, which might cause security issues.
+- You can use the escape sequence \e[3J instead if this feature is
+- activated.
+-
+- Note that a buffer of VGACON_SOFT_SCROLLBACK_SIZE is taken for each
+- created tty device.
+- So if you use a RAM-constrained system, say N here.
+-
+ config MDA_CONSOLE
+ depends on !M68K && !PARISC && ISA
+ tristate "MDA text console (dual-headed)"
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -165,214 +165,6 @@ static inline void vga_set_mem_top(struc
+ write_vga(12, (c->vc_visible_origin - vga_vram_base) / 2);
+ }
+
+-#ifdef CONFIG_VGACON_SOFT_SCROLLBACK
+-/* software scrollback */
+-struct vgacon_scrollback_info {
+- void *data;
+- int tail;
+- int size;
+- int rows;
+- int cnt;
+- int cur;
+- int save;
+- int restore;
+-};
+-
+-static struct vgacon_scrollback_info *vgacon_scrollback_cur;
+-static struct vgacon_scrollback_info vgacon_scrollbacks[MAX_NR_CONSOLES];
+-static bool scrollback_persistent = \
+- IS_ENABLED(CONFIG_VGACON_SOFT_SCROLLBACK_PERSISTENT_ENABLE_BY_DEFAULT);
+-module_param_named(scrollback_persistent, scrollback_persistent, bool, 0000);
+-MODULE_PARM_DESC(scrollback_persistent, "Enable persistent scrollback for all vga consoles");
+-
+-static void vgacon_scrollback_reset(int vc_num, size_t reset_size)
+-{
+- struct vgacon_scrollback_info *scrollback = &vgacon_scrollbacks[vc_num];
+-
+- if (scrollback->data && reset_size > 0)
+- memset(scrollback->data, 0, reset_size);
+-
+- scrollback->cnt = 0;
+- scrollback->tail = 0;
+- scrollback->cur = 0;
+-}
+-
+-static void vgacon_scrollback_init(int vc_num)
+-{
+- int pitch = vga_video_num_columns * 2;
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+- int rows = size / pitch;
+- void *data;
+-
+- data = kmalloc_array(CONFIG_VGACON_SOFT_SCROLLBACK_SIZE, 1024,
+- GFP_NOWAIT);
+-
+- vgacon_scrollbacks[vc_num].data = data;
+- vgacon_scrollback_cur = &vgacon_scrollbacks[vc_num];
+-
+- vgacon_scrollback_cur->rows = rows - 1;
+- vgacon_scrollback_cur->size = rows * pitch;
+-
+- vgacon_scrollback_reset(vc_num, size);
+-}
+-
+-static void vgacon_scrollback_switch(int vc_num)
+-{
+- if (!scrollback_persistent)
+- vc_num = 0;
+-
+- if (!vgacon_scrollbacks[vc_num].data) {
+- vgacon_scrollback_init(vc_num);
+- } else {
+- if (scrollback_persistent) {
+- vgacon_scrollback_cur = &vgacon_scrollbacks[vc_num];
+- } else {
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+-
+- vgacon_scrollback_reset(vc_num, size);
+- }
+- }
+-}
+-
+-static void vgacon_scrollback_startup(void)
+-{
+- vgacon_scrollback_cur = &vgacon_scrollbacks[0];
+- vgacon_scrollback_init(0);
+-}
+-
+-static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
+-{
+- void *p;
+-
+- if (!vgacon_scrollback_cur->data || !vgacon_scrollback_cur->size ||
+- c->vc_num != fg_console)
+- return;
+-
+- p = (void *) (c->vc_origin + t * c->vc_size_row);
+-
+- while (count--) {
+- if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+- vgacon_scrollback_cur->size)
+- vgacon_scrollback_cur->tail = 0;
+-
+- scr_memcpyw(vgacon_scrollback_cur->data +
+- vgacon_scrollback_cur->tail,
+- p, c->vc_size_row);
+-
+- vgacon_scrollback_cur->cnt++;
+- p += c->vc_size_row;
+- vgacon_scrollback_cur->tail += c->vc_size_row;
+-
+- if (vgacon_scrollback_cur->tail >= vgacon_scrollback_cur->size)
+- vgacon_scrollback_cur->tail = 0;
+-
+- if (vgacon_scrollback_cur->cnt > vgacon_scrollback_cur->rows)
+- vgacon_scrollback_cur->cnt = vgacon_scrollback_cur->rows;
+-
+- vgacon_scrollback_cur->cur = vgacon_scrollback_cur->cnt;
+- }
+-}
+-
+-static void vgacon_restore_screen(struct vc_data *c)
+-{
+- c->vc_origin = c->vc_visible_origin;
+- vgacon_scrollback_cur->save = 0;
+-
+- if (!vga_is_gfx && !vgacon_scrollback_cur->restore) {
+- scr_memcpyw((u16 *) c->vc_origin, (u16 *) c->vc_screenbuf,
+- c->vc_screenbuf_size > vga_vram_size ?
+- vga_vram_size : c->vc_screenbuf_size);
+- vgacon_scrollback_cur->restore = 1;
+- vgacon_scrollback_cur->cur = vgacon_scrollback_cur->cnt;
+- }
+-}
+-
+-static void vgacon_scrolldelta(struct vc_data *c, int lines)
+-{
+- int start, end, count, soff;
+-
+- if (!lines) {
+- vgacon_restore_screen(c);
+- return;
+- }
+-
+- if (!vgacon_scrollback_cur->data)
+- return;
+-
+- if (!vgacon_scrollback_cur->save) {
+- vgacon_cursor(c, CM_ERASE);
+- vgacon_save_screen(c);
+- c->vc_origin = (unsigned long)c->vc_screenbuf;
+- vgacon_scrollback_cur->save = 1;
+- }
+-
+- vgacon_scrollback_cur->restore = 0;
+- start = vgacon_scrollback_cur->cur + lines;
+- end = start + abs(lines);
+-
+- if (start < 0)
+- start = 0;
+-
+- if (start > vgacon_scrollback_cur->cnt)
+- start = vgacon_scrollback_cur->cnt;
+-
+- if (end < 0)
+- end = 0;
+-
+- if (end > vgacon_scrollback_cur->cnt)
+- end = vgacon_scrollback_cur->cnt;
+-
+- vgacon_scrollback_cur->cur = start;
+- count = end - start;
+- soff = vgacon_scrollback_cur->tail -
+- ((vgacon_scrollback_cur->cnt - end) * c->vc_size_row);
+- soff -= count * c->vc_size_row;
+-
+- if (soff < 0)
+- soff += vgacon_scrollback_cur->size;
+-
+- count = vgacon_scrollback_cur->cnt - start;
+-
+- if (count > c->vc_rows)
+- count = c->vc_rows;
+-
+- if (count) {
+- int copysize;
+-
+- int diff = c->vc_rows - count;
+- void *d = (void *) c->vc_visible_origin;
+- void *s = (void *) c->vc_screenbuf;
+-
+- count *= c->vc_size_row;
+- /* how much memory to end of buffer left? */
+- copysize = min(count, vgacon_scrollback_cur->size - soff);
+- scr_memcpyw(d, vgacon_scrollback_cur->data + soff, copysize);
+- d += copysize;
+- count -= copysize;
+-
+- if (count) {
+- scr_memcpyw(d, vgacon_scrollback_cur->data, count);
+- d += count;
+- }
+-
+- if (diff)
+- scr_memcpyw(d, s, diff * c->vc_size_row);
+- } else
+- vgacon_cursor(c, CM_MOVE);
+-}
+-
+-static void vgacon_flush_scrollback(struct vc_data *c)
+-{
+- size_t size = CONFIG_VGACON_SOFT_SCROLLBACK_SIZE * 1024;
+-
+- vgacon_scrollback_reset(c->vc_num, size);
+-}
+-#else
+-#define vgacon_scrollback_startup(...) do { } while (0)
+-#define vgacon_scrollback_init(...) do { } while (0)
+-#define vgacon_scrollback_update(...) do { } while (0)
+-#define vgacon_scrollback_switch(...) do { } while (0)
+-
+ static void vgacon_restore_screen(struct vc_data *c)
+ {
+ if (c->vc_origin != c->vc_visible_origin)
+@@ -386,11 +178,6 @@ static void vgacon_scrolldelta(struct vc
+ vga_set_mem_top(c);
+ }
+
+-static void vgacon_flush_scrollback(struct vc_data *c)
+-{
+-}
+-#endif /* CONFIG_VGACON_SOFT_SCROLLBACK */
+-
+ static const char *vgacon_startup(void)
+ {
+ const char *display_desc = NULL;
+@@ -573,10 +360,7 @@ static const char *vgacon_startup(void)
+ vgacon_xres = screen_info.orig_video_cols * VGA_FONTWIDTH;
+ vgacon_yres = vga_scan_lines;
+
+- if (!vga_init_done) {
+- vgacon_scrollback_startup();
+- vga_init_done = true;
+- }
++ vga_init_done = true;
+
+ return display_desc;
+ }
+@@ -867,7 +651,6 @@ static int vgacon_switch(struct vc_data
+ vgacon_doresize(c, c->vc_cols, c->vc_rows);
+ }
+
+- vgacon_scrollback_switch(c->vc_num);
+ return 0; /* Redrawing not needed */
+ }
+
+@@ -1384,7 +1167,6 @@ static bool vgacon_scroll(struct vc_data
+ oldo = c->vc_origin;
+ delta = lines * c->vc_size_row;
+ if (dir == SM_UP) {
+- vgacon_scrollback_update(c, t, lines);
+ if (c->vc_scr_end + delta >= vga_vram_end) {
+ scr_memcpyw((u16 *) vga_vram_base,
+ (u16 *) (oldo + delta),
+@@ -1448,7 +1230,6 @@ const struct consw vga_con = {
+ .con_save_screen = vgacon_save_screen,
+ .con_build_attr = vgacon_build_attr,
+ .con_invert_region = vgacon_invert_region,
+- .con_flush_scrollback = vgacon_flush_scrollback,
+ };
+ EXPORT_SYMBOL(vga_con);
+
--- /dev/null
+From bd018a6a75cebb511bb55a0e7690024be975fe93 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Date: Mon, 31 Aug 2020 19:37:00 +0900
+Subject: video: fbdev: fix OOB read in vga_8planes_imageblit()
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+commit bd018a6a75cebb511bb55a0e7690024be975fe93 upstream.
+
+syzbot is reporting OOB read at vga_8planes_imageblit() [1], for
+"cdat[y] >> 4" can become a negative value due to "const char *cdat".
+
+[1] https://syzkaller.appspot.com/bug?id=0d7a0da1557dcd1989e00cb3692b26d4173b4132
+
+Reported-by: syzbot <syzbot+69fbd3e01470f169c8c4@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/90b55ec3-d5b0-3307-9f7c-7ff5c5fd6ad3@i-love.sakura.ne.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/vga16fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/vga16fb.c
++++ b/drivers/video/fbdev/vga16fb.c
+@@ -1121,7 +1121,7 @@ static void vga_8planes_imageblit(struct
+ char oldop = setop(0);
+ char oldsr = setsr(0);
+ char oldmask = selectmask();
+- const char *cdat = image->data;
++ const unsigned char *cdat = image->data;
+ u32 dx = image->dx;
+ char __iomem *where;
+ int y;
projects / thirdparty / kernel / stable-queue.git / commitdiff
