--- /dev/null
+From 67e40054de86aae520ddc2a072d7f6951812a14f Mon Sep 17 00:00:00 2001
+From: Qinglang Miao <miaoqinglang@huawei.com>
+Date: Fri, 15 Jan 2021 10:22:50 +0800
+Subject: ACPI: configfs: add missing check after configfs_register_default_group()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+commit 67e40054de86aae520ddc2a072d7f6951812a14f upstream.
+
+A list_add corruption is reported by Hulk Robot like this:
+==============
+list_add corruption.
+Call Trace:
+link_obj+0xc0/0x1c0
+link_group+0x21/0x140
+configfs_register_subsystem+0xdb/0x380
+acpi_configfs_init+0x25/0x1000 [acpi_configfs]
+do_one_initcall+0x149/0x820
+do_init_module+0x1ef/0x720
+load_module+0x35c8/0x4380
+__do_sys_finit_module+0x10d/0x1a0
+do_syscall_64+0x34/0x80
+
+It's because of the missing check after configfs_register_default_group,
+where configfs_unregister_subsystem should be called once failure.
+
+Fixes: 612bd01fc6e0 ("ACPI: add support for loading SSDTs via configfs")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Suggested-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Cc: 4.10+ <stable@vger.kernel.org> # 4.10+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/acpi_configfs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpi_configfs.c
++++ b/drivers/acpi/acpi_configfs.c
+@@ -268,7 +268,12 @@ static int __init acpi_configfs_init(voi
+
+ acpi_table_group = configfs_register_default_group(root, "table",
+ &acpi_tables_type);
+- return PTR_ERR_OR_ZERO(acpi_table_group);
++ if (IS_ERR(acpi_table_group)) {
++ configfs_unregister_subsystem(&acpi_configfs);
++ return PTR_ERR(acpi_table_group);
++ }
++
++ return 0;
+ }
+ module_init(acpi_configfs_init);
+
--- /dev/null
+From e1e6bd2995ac0e1ad0c2a2d906a06f59ce2ed293 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 11 Feb 2021 19:30:01 +0100
+Subject: ACPI: property: Fix fwnode string properties matching
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit e1e6bd2995ac0e1ad0c2a2d906a06f59ce2ed293 upstream.
+
+Property matching does not work for ACPI fwnodes if the value of the
+given property is not represented as a package in the _DSD package
+containing it. For example, the "compatible" property in the _DSD
+below
+
+ Name (_DSD, Package () {
+ ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"),
+ Package () {
+ Package () {"compatible", "ethernet-phy-ieee802.3-c45"}
+ }
+ })
+
+will not be found by fwnode_property_match_string(), because the ACPI
+code handling device properties does not regard the single value as a
+"list" in that case.
+
+Namely, fwnode_property_match_string() invoked to match a given
+string property value first calls fwnode_property_read_string_array()
+with the last two arguments equal to NULL and 0, respectively, in
+order to count the items in the value of the given property, with the
+assumption that this value may be an array. For ACPI fwnodes, that
+operation is carried out by acpi_node_prop_read() which calls
+acpi_data_prop_read() for this purpose. However, when the return
+(val) pointer is NULL, that function only looks for a property whose
+value is a package without checking the single-value case at all.
+
+To fix that, make acpi_data_prop_read() check the single-value
+case if its return pointer argument is NULL and modify
+acpi_data_prop_read_single() handling that case to attempt to
+read the value of the property if the return pointer is NULL
+and return 1 if that succeeds.
+
+Fixes: 3708184afc77 ("device property: Move FW type specific functionality to FW specific files")
+Reported-by: Calvin Johnson <calvin.johnson@oss.nxp.com>
+Cc: 4.13+ <stable@vger.kernel.org> # 4.13+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/property.c | 44 +++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 33 insertions(+), 11 deletions(-)
+
+--- a/drivers/acpi/property.c
++++ b/drivers/acpi/property.c
+@@ -787,9 +787,6 @@ static int acpi_data_prop_read_single(co
+ const union acpi_object *obj;
+ int ret;
+
+- if (!val)
+- return -EINVAL;
+-
+ if (proptype >= DEV_PROP_U8 && proptype <= DEV_PROP_U64) {
+ ret = acpi_data_get_property(data, propname, ACPI_TYPE_INTEGER, &obj);
+ if (ret)
+@@ -799,28 +796,43 @@ static int acpi_data_prop_read_single(co
+ case DEV_PROP_U8:
+ if (obj->integer.value > U8_MAX)
+ return -EOVERFLOW;
+- *(u8 *)val = obj->integer.value;
++
++ if (val)
++ *(u8 *)val = obj->integer.value;
++
+ break;
+ case DEV_PROP_U16:
+ if (obj->integer.value > U16_MAX)
+ return -EOVERFLOW;
+- *(u16 *)val = obj->integer.value;
++
++ if (val)
++ *(u16 *)val = obj->integer.value;
++
+ break;
+ case DEV_PROP_U32:
+ if (obj->integer.value > U32_MAX)
+ return -EOVERFLOW;
+- *(u32 *)val = obj->integer.value;
++
++ if (val)
++ *(u32 *)val = obj->integer.value;
++
+ break;
+ default:
+- *(u64 *)val = obj->integer.value;
++ if (val)
++ *(u64 *)val = obj->integer.value;
++
+ break;
+ }
++
++ if (!val)
++ return 1;
+ } else if (proptype == DEV_PROP_STRING) {
+ ret = acpi_data_get_property(data, propname, ACPI_TYPE_STRING, &obj);
+ if (ret)
+ return ret;
+
+- *(char **)val = obj->string.pointer;
++ if (val)
++ *(char **)val = obj->string.pointer;
+
+ return 1;
+ } else {
+@@ -834,7 +846,7 @@ int acpi_dev_prop_read_single(struct acp
+ {
+ int ret;
+
+- if (!adev)
++ if (!adev || !val)
+ return -EINVAL;
+
+ ret = acpi_data_prop_read_single(&adev->data, propname, proptype, val);
+@@ -928,10 +940,20 @@ static int acpi_data_prop_read(const str
+ const union acpi_object *items;
+ int ret;
+
+- if (val && nval == 1) {
++ if (nval == 1 || !val) {
+ ret = acpi_data_prop_read_single(data, propname, proptype, val);
+- if (ret >= 0)
++ /*
++ * The overflow error means that the property is there and it is
++ * single-value, but its type does not match, so return.
++ */
++ if (ret >= 0 || ret == -EOVERFLOW)
+ return ret;
++
++ /*
++ * Reading this property as a single-value one failed, but its
++ * value may still be represented as one-element array, so
++ * continue.
++ */
+ }
+
+ ret = acpi_data_get_property_array(data, propname, ACPI_TYPE_ANY, &obj);
--- /dev/null
+From c50bfc8a6866775be39d7e747e83e8a5a9051e2e Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Mon, 8 Feb 2021 00:47:36 +0900
+Subject: ALSA: fireface: fix to parse sync status register of latter protocol
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit c50bfc8a6866775be39d7e747e83e8a5a9051e2e upstream.
+
+Fireface UCX, UFX, and FF802 are categorized for latter protocol of the
+series. Current support for FF802 (and UFX) includes failure to parse
+sync status register and results in EIO.
+
+Further investigation figures out that the content of register differs
+depending on models. This commit adds tables specific to FF802 and UFX
+to fix it.
+
+Fixes: 062bb452b078b ("ALSA: fireface: add support for RME FireFace 802")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20210207154736.229551-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/firewire/fireface/ff-protocol-latter.c | 118 ++++++++++++++++++++++-----
+ 1 file changed, 100 insertions(+), 18 deletions(-)
+
+--- a/sound/firewire/fireface/ff-protocol-latter.c
++++ b/sound/firewire/fireface/ff-protocol-latter.c
+@@ -15,6 +15,61 @@
+ #define LATTER_FETCH_MODE 0xffff00000010ULL
+ #define LATTER_SYNC_STATUS 0x0000801c0000ULL
+
++// The content of sync status register differs between models.
++//
++// Fireface UCX:
++// 0xf0000000: (unidentified)
++// 0x0f000000: effective rate of sampling clock
++// 0x00f00000: detected rate of word clock on BNC interface
++// 0x000f0000: detected rate of ADAT or S/PDIF on optical interface
++// 0x0000f000: detected rate of S/PDIF on coaxial interface
++// 0x00000e00: effective source of sampling clock
++// 0x00000e00: Internal
++// 0x00000800: (unidentified)
++// 0x00000600: Word clock on BNC interface
++// 0x00000400: ADAT on optical interface
++// 0x00000200: S/PDIF on coaxial or optical interface
++// 0x00000100: Optical interface is used for ADAT signal
++// 0x00000080: (unidentified)
++// 0x00000040: Synchronized to word clock on BNC interface
++// 0x00000020: Synchronized to ADAT or S/PDIF on optical interface
++// 0x00000010: Synchronized to S/PDIF on coaxial interface
++// 0x00000008: (unidentified)
++// 0x00000004: Lock word clock on BNC interface
++// 0x00000002: Lock ADAT or S/PDIF on optical interface
++// 0x00000001: Lock S/PDIF on coaxial interface
++//
++// Fireface 802 (and perhaps UFX):
++// 0xf0000000: effective rate of sampling clock
++// 0x0f000000: detected rate of ADAT-B on 2nd optical interface
++// 0x00f00000: detected rate of ADAT-A on 1st optical interface
++// 0x000f0000: detected rate of AES/EBU on XLR or coaxial interface
++// 0x0000f000: detected rate of word clock on BNC interface
++// 0x00000e00: effective source of sampling clock
++// 0x00000e00: internal
++// 0x00000800: ADAT-B
++// 0x00000600: ADAT-A
++// 0x00000400: AES/EBU
++// 0x00000200: Word clock
++// 0x00000080: Synchronized to ADAT-B on 2nd optical interface
++// 0x00000040: Synchronized to ADAT-A on 1st optical interface
++// 0x00000020: Synchronized to AES/EBU on XLR or 2nd optical interface
++// 0x00000010: Synchronized to word clock on BNC interface
++// 0x00000008: Lock ADAT-B on 2nd optical interface
++// 0x00000004: Lock ADAT-A on 1st optical interface
++// 0x00000002: Lock AES/EBU on XLR or 2nd optical interface
++// 0x00000001: Lock word clock on BNC interface
++//
++// The pattern for rate bits:
++// 0x00: 32.0 kHz
++// 0x01: 44.1 kHz
++// 0x02: 48.0 kHz
++// 0x04: 64.0 kHz
++// 0x05: 88.2 kHz
++// 0x06: 96.0 kHz
++// 0x08: 128.0 kHz
++// 0x09: 176.4 kHz
++// 0x0a: 192.0 kHz
+ static int parse_clock_bits(u32 data, unsigned int *rate,
+ enum snd_ff_clock_src *src,
+ enum snd_ff_unit_version unit_version)
+@@ -23,35 +78,48 @@ static int parse_clock_bits(u32 data, un
+ unsigned int rate;
+ u32 flag;
+ } *rate_entry, rate_entries[] = {
+- { 32000, 0x00000000, },
+- { 44100, 0x01000000, },
+- { 48000, 0x02000000, },
+- { 64000, 0x04000000, },
+- { 88200, 0x05000000, },
+- { 96000, 0x06000000, },
+- { 128000, 0x08000000, },
+- { 176400, 0x09000000, },
+- { 192000, 0x0a000000, },
++ { 32000, 0x00, },
++ { 44100, 0x01, },
++ { 48000, 0x02, },
++ { 64000, 0x04, },
++ { 88200, 0x05, },
++ { 96000, 0x06, },
++ { 128000, 0x08, },
++ { 176400, 0x09, },
++ { 192000, 0x0a, },
+ };
+ static const struct {
+ enum snd_ff_clock_src src;
+ u32 flag;
+- } *clk_entry, clk_entries[] = {
++ } *clk_entry, *clk_entries, ucx_clk_entries[] = {
+ { SND_FF_CLOCK_SRC_SPDIF, 0x00000200, },
+ { SND_FF_CLOCK_SRC_ADAT1, 0x00000400, },
+ { SND_FF_CLOCK_SRC_WORD, 0x00000600, },
+ { SND_FF_CLOCK_SRC_INTERNAL, 0x00000e00, },
++ }, ufx_ff802_clk_entries[] = {
++ { SND_FF_CLOCK_SRC_WORD, 0x00000200, },
++ { SND_FF_CLOCK_SRC_SPDIF, 0x00000400, },
++ { SND_FF_CLOCK_SRC_ADAT1, 0x00000600, },
++ { SND_FF_CLOCK_SRC_ADAT2, 0x00000800, },
++ { SND_FF_CLOCK_SRC_INTERNAL, 0x00000e00, },
+ };
++ u32 rate_bits;
++ unsigned int clk_entry_count;
+ int i;
+
+- if (unit_version != SND_FF_UNIT_VERSION_UCX) {
+- // e.g. 0x00fe0f20 but expected 0x00eff002.
+- data = ((data & 0xf0f0f0f0) >> 4) | ((data & 0x0f0f0f0f) << 4);
++ if (unit_version == SND_FF_UNIT_VERSION_UCX) {
++ rate_bits = (data & 0x0f000000) >> 24;
++ clk_entries = ucx_clk_entries;
++ clk_entry_count = ARRAY_SIZE(ucx_clk_entries);
++ } else {
++ rate_bits = (data & 0xf0000000) >> 28;
++ clk_entries = ufx_ff802_clk_entries;
++ clk_entry_count = ARRAY_SIZE(ufx_ff802_clk_entries);
+ }
+
+ for (i = 0; i < ARRAY_SIZE(rate_entries); ++i) {
+ rate_entry = rate_entries + i;
+- if ((data & 0x0f000000) == rate_entry->flag) {
++ if (rate_bits == rate_entry->flag) {
+ *rate = rate_entry->rate;
+ break;
+ }
+@@ -59,14 +127,14 @@ static int parse_clock_bits(u32 data, un
+ if (i == ARRAY_SIZE(rate_entries))
+ return -EIO;
+
+- for (i = 0; i < ARRAY_SIZE(clk_entries); ++i) {
++ for (i = 0; i < clk_entry_count; ++i) {
+ clk_entry = clk_entries + i;
+ if ((data & 0x000e00) == clk_entry->flag) {
+ *src = clk_entry->src;
+ break;
+ }
+ }
+- if (i == ARRAY_SIZE(clk_entries))
++ if (i == clk_entry_count)
+ return -EIO;
+
+ return 0;
+@@ -249,16 +317,22 @@ static void latter_dump_status(struct sn
+ char *const label;
+ u32 locked_mask;
+ u32 synced_mask;
+- } *clk_entry, clk_entries[] = {
++ } *clk_entry, *clk_entries, ucx_clk_entries[] = {
+ { "S/PDIF", 0x00000001, 0x00000010, },
+ { "ADAT", 0x00000002, 0x00000020, },
+ { "WDClk", 0x00000004, 0x00000040, },
++ }, ufx_ff802_clk_entries[] = {
++ { "WDClk", 0x00000001, 0x00000010, },
++ { "AES/EBU", 0x00000002, 0x00000020, },
++ { "ADAT-A", 0x00000004, 0x00000040, },
++ { "ADAT-B", 0x00000008, 0x00000080, },
+ };
+ __le32 reg;
+ u32 data;
+ unsigned int rate;
+ enum snd_ff_clock_src src;
+ const char *label;
++ unsigned int clk_entry_count;
+ int i;
+ int err;
+
+@@ -270,7 +344,15 @@ static void latter_dump_status(struct sn
+
+ snd_iprintf(buffer, "External source detection:\n");
+
+- for (i = 0; i < ARRAY_SIZE(clk_entries); ++i) {
++ if (ff->unit_version == SND_FF_UNIT_VERSION_UCX) {
++ clk_entries = ucx_clk_entries;
++ clk_entry_count = ARRAY_SIZE(ucx_clk_entries);
++ } else {
++ clk_entries = ufx_ff802_clk_entries;
++ clk_entry_count = ARRAY_SIZE(ufx_ff802_clk_entries);
++ }
++
++ for (i = 0; i < clk_entry_count; ++i) {
+ clk_entry = clk_entries + i;
+ snd_iprintf(buffer, "%s: ", clk_entry->label);
+ if (data & clk_entry->locked_mask) {
--- /dev/null
+From 0d3070f5e6551d8a759619e85736e49a3bf40398 Mon Sep 17 00:00:00 2001
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Date: Fri, 12 Feb 2021 17:10:22 +0200
+Subject: ALSA: hda: Add another CometLake-H PCI ID
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+commit 0d3070f5e6551d8a759619e85736e49a3bf40398 upstream.
+
+Add one more HD Audio PCI ID for CometLake-H PCH.
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210212151022.2568567-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2481,6 +2481,8 @@ static const struct pci_device_id azx_id
+ /* CometLake-H */
+ { PCI_DEVICE(0x8086, 0x06C8),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
++ { PCI_DEVICE(0x8086, 0xf1c8),
++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
+ /* CometLake-S */
+ { PCI_DEVICE(0x8086, 0xa3f0),
+ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
--- /dev/null
+From 056a3da5d07fc5d3ceacfa2cdf013c9d8df630bd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Feb 2021 09:31:39 +0100
+Subject: ALSA: hda/hdmi: Drop bogus check at closing a stream
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 056a3da5d07fc5d3ceacfa2cdf013c9d8df630bd upstream.
+
+Some users reported the kernel WARNING with stack traces from
+hdmi_pcm_close(), and it's the line checking the per_cvt->assigned
+flag. This used to be a valid check in the past because the flag was
+turned on/off only at opening and closing a PCM stream. Meanwhile,
+since the introduction of the silent-stream mode, this flag may be
+turned on/off at the monitor connection/disconnection time, which
+isn't always associated with the PCM open/close. Hence this may lead
+to the inconsistent per_cvt->assigned flag at closing.
+
+As the check itself became almost useless and confuses users as if it
+were a serious problem, just drop the check.
+
+Fixes: b1a5039759cb ("ALSA: hda/hdmi: fix silent stream for first playback to DP")
+Cc: <stable@vger.kernel.org>
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210987
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210211083139.29531-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2130,7 +2130,6 @@ static int hdmi_pcm_close(struct hda_pcm
+ goto unlock;
+ }
+ per_cvt = get_cvt(spec, cvt_idx);
+- snd_BUG_ON(!per_cvt->assigned);
+ per_cvt->assigned = 0;
+ hinfo->nid = 0;
+
--- /dev/null
+From 4841b8e6318a7f0ae57c4e5ec09032ea057c97a8 Mon Sep 17 00:00:00 2001
+From: PeiSen Hou <pshou@realtek.com>
+Date: Tue, 2 Feb 2021 10:30:22 +0100
+Subject: ALSA: hda/realtek: modify EAPD in the ALC886
+
+From: PeiSen Hou <pshou@realtek.com>
+
+commit 4841b8e6318a7f0ae57c4e5ec09032ea057c97a8 upstream.
+
+Modify 0x20 index 7 bit 5 to 1, make the 0x15 EAPD the same as 0x14.
+
+Signed-off-by: PeiSen Hou <pshou@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/e62c5058957f48d8b8953e97135ff108@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -1905,6 +1905,7 @@ enum {
+ ALC889_FIXUP_FRONT_HP_NO_PRESENCE,
+ ALC889_FIXUP_VAIO_TT,
+ ALC888_FIXUP_EEE1601,
++ ALC886_FIXUP_EAPD,
+ ALC882_FIXUP_EAPD,
+ ALC883_FIXUP_EAPD,
+ ALC883_FIXUP_ACER_EAPD,
+@@ -2238,6 +2239,15 @@ static const struct hda_fixup alc882_fix
+ { }
+ }
+ },
++ [ALC886_FIXUP_EAPD] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* change to EAPD mode */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0068 },
++ { }
++ }
++ },
+ [ALC882_FIXUP_EAPD] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -2510,6 +2520,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
++ SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950),
--- /dev/null
+From c3bb2b521944ffbbc8c24b849f81977a9915fb5e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Feb 2021 09:25:40 +0100
+Subject: ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c3bb2b521944ffbbc8c24b849f81977a9915fb5e upstream.
+
+HP Spectre x360 14 model (PCI SSID 103c:87f7) seems requiring a unique
+setup for its external amp: the GPIO0 needs to be toggled on and off
+shortly at each device initialization via runtime PM.
+
+This patch implements that workaround as well as the model option
+string, so that users with other devices may try the same workaround
+more easily.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210633
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210215082540.4520-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4291,6 +4291,28 @@ static void alc280_fixup_hp_gpio4(struct
+ }
+ }
+
++/* HP Spectre x360 14 model needs a unique workaround for enabling the amp;
++ * it needs to toggle the GPIO0 once on and off at each time (bko#210633)
++ */
++static void alc245_fixup_hp_x360_amp(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->gpio_mask |= 0x01;
++ spec->gpio_dir |= 0x01;
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ /* need to toggle GPIO to enable the amp */
++ alc_update_gpio_data(codec, 0x01, true);
++ msleep(100);
++ alc_update_gpio_data(codec, 0x01, false);
++ break;
++ }
++}
++
+ static void alc_update_coef_led(struct hda_codec *codec,
+ struct alc_coef_led *led,
+ bool polarity, bool on)
+@@ -6277,6 +6299,7 @@ enum {
+ ALC280_FIXUP_HP_DOCK_PINS,
+ ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
+ ALC280_FIXUP_HP_9480M,
++ ALC245_FIXUP_HP_X360_AMP,
+ ALC288_FIXUP_DELL_HEADSET_MODE,
+ ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC288_FIXUP_DELL_XPS_13,
+@@ -6982,6 +7005,10 @@ static const struct hda_fixup alc269_fix
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc280_fixup_hp_9480m,
+ },
++ [ALC245_FIXUP_HP_X360_AMP] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc245_fixup_hp_x360_amp,
++ },
+ [ALC288_FIXUP_DELL_HEADSET_MODE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode_dell_alc288,
+@@ -7996,6 +8023,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -8368,6 +8396,7 @@ static const struct hda_model_fixup alc2
+ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
+ {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+ {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"},
++ {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
--- /dev/null
+From 15447b64789d9ade71eb374d5ae1f37d0bbce0bd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 14 Feb 2021 16:42:51 +0100
+Subject: ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 15447b64789d9ade71eb374d5ae1f37d0bbce0bd upstream.
+
+BOSS GP-10 with 0582:0185 requires the similar quirk to make the
+implicit feedback working like other BOSS devices.
+
+Reported-by: Keith Milner <kamilner@superlative.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210214154251.10750-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/implicit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/implicit.c
++++ b/sound/usb/implicit.c
+@@ -73,6 +73,7 @@ static const struct snd_usb_implicit_fb_
+ /* No quirk for playback but with capture quirk (see below) */
+ IMPLICIT_FB_SKIP_DEV(0x0582, 0x0130), /* BOSS BR-80 */
+ IMPLICIT_FB_SKIP_DEV(0x0582, 0x0171), /* BOSS RC-505 */
++ IMPLICIT_FB_SKIP_DEV(0x0582, 0x0185), /* BOSS GP-10 */
+ IMPLICIT_FB_SKIP_DEV(0x0582, 0x0189), /* BOSS GT-100v2 */
+ IMPLICIT_FB_SKIP_DEV(0x0582, 0x01d6), /* BOSS GT-1 */
+ IMPLICIT_FB_SKIP_DEV(0x0582, 0x01d8), /* BOSS Katana */
+@@ -86,6 +87,7 @@ static const struct snd_usb_implicit_fb_
+ static const struct snd_usb_implicit_fb_match capture_implicit_fb_quirks[] = {
+ IMPLICIT_FB_FIXED_DEV(0x0582, 0x0130, 0x0d, 0x01), /* BOSS BR-80 */
+ IMPLICIT_FB_FIXED_DEV(0x0582, 0x0171, 0x0d, 0x01), /* BOSS RC-505 */
++ IMPLICIT_FB_FIXED_DEV(0x0582, 0x0185, 0x0d, 0x01), /* BOSS GP-10 */
+ IMPLICIT_FB_FIXED_DEV(0x0582, 0x0189, 0x0d, 0x01), /* BOSS GT-100v2 */
+ IMPLICIT_FB_FIXED_DEV(0x0582, 0x01d6, 0x0d, 0x01), /* BOSS GT-1 */
+ IMPLICIT_FB_FIXED_DEV(0x0582, 0x01d8, 0x0d, 0x01), /* BOSS Katana */
--- /dev/null
+From 036f90dd92bb0aac66fdeec8386401dd396c6079 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 5 Feb 2021 09:28:37 +0100
+Subject: ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 036f90dd92bb0aac66fdeec8386401dd396c6079 upstream.
+
+The kerndoc comment for the new function snd_usb_endpoint_free_all()
+had a typo wrt the argument name. Fix it.
+
+Fixes: 00272c61827e ("ALSA: usb-audio: Avoid unnecessary interface re-setup")
+Reported-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210205082837.6327-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -1451,7 +1451,7 @@ void snd_usb_endpoint_release(struct snd
+
+ /**
+ * snd_usb_endpoint_free_all: Free the resources of an snd_usb_endpoint
+- * @card: The chip
++ * @chip: The chip
+ *
+ * This free all endpoints and those resources
+ */
--- /dev/null
+From 257d2d7e9e798305d65825cb82b0a7d1c0511e89 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 6 Feb 2021 21:30:52 +0100
+Subject: ALSA: usb-audio: Don't avoid stopping the stream at disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 257d2d7e9e798305d65825cb82b0a7d1c0511e89 upstream.
+
+In the later patch, we're going to issue the PCM sync_stop calls at
+disconnection. But currently the USB-audio driver can't handle it
+because it has a check of shutdown flag for stopping the URBs. This
+is basically superfluous (the stopping URBs are safe at disconnection
+state), so let's drop the check.
+
+Fixes: dc5eafe7787c ("ALSA: usb-audio: Support PCM sync_stop")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210206203052.15606-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 3 ---
+ sound/usb/pcm.c | 5 +----
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -890,9 +890,6 @@ static int stop_urbs(struct snd_usb_endp
+ {
+ unsigned int i;
+
+- if (!force && atomic_read(&ep->chip->shutdown)) /* to be sure... */
+- return -EBADFD;
+-
+ if (!force && atomic_read(&ep->running))
+ return -EBUSY;
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -270,10 +270,7 @@ static int snd_usb_pcm_sync_stop(struct
+ {
+ struct snd_usb_substream *subs = substream->runtime->private_data;
+
+- if (!snd_usb_lock_shutdown(subs->stream->chip)) {
+- sync_pending_stops(subs);
+- snd_usb_unlock_shutdown(subs->stream->chip);
+- }
++ sync_pending_stops(subs);
+ return 0;
+ }
+
--- /dev/null
+From d6cda4655e2a7612a1e48c49795a5330abc01c5a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 6 Feb 2021 21:30:50 +0100
+Subject: ALSA: usb-audio: Handle invalid running state at releasing EP
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit d6cda4655e2a7612a1e48c49795a5330abc01c5a upstream.
+
+When we stop an endpoint in release_urbs(), it ignores the
+inconsistent endpoint state and tries to release the resources.
+This shouldn't happen in theory, but it's still safer to abort the
+release and let the caller proper error handling.
+
+Also, stop_and_unlink_urbs() called from release_urbs() does two step
+works, and it's more straightforward to split this to two functions
+again, so that the call from the PCM trigger won't take the path with
+sleeping.
+
+This patch modifies the EP management code to adapt two points above.
+
+Fixes: d0f09d1e4a88 ("ALSA: usb-audio: Refactoring endpoint URB deactivation")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210206203052.15606-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/endpoint.c | 40 +++++++++++++++++++++-------------------
+ 1 file changed, 21 insertions(+), 19 deletions(-)
+
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -868,24 +868,22 @@ void snd_usb_endpoint_sync_pending_stop(
+ }
+
+ /*
+- * Stop and unlink active urbs.
++ * Stop active urbs
+ *
+- * This function checks and clears EP_FLAG_RUNNING state.
+- * When @wait_sync is set, it waits until all pending URBs are killed.
++ * This function moves the EP to STOPPING state if it's being RUNNING.
+ */
+-static int stop_and_unlink_urbs(struct snd_usb_endpoint *ep, bool force,
+- bool wait_sync)
++static int stop_urbs(struct snd_usb_endpoint *ep, bool force)
+ {
+ unsigned int i;
+
+ if (!force && atomic_read(&ep->chip->shutdown)) /* to be sure... */
+ return -EBADFD;
+
+- if (atomic_read(&ep->running))
++ if (!force && atomic_read(&ep->running))
+ return -EBUSY;
+
+ if (!test_and_clear_bit(EP_FLAG_RUNNING, &ep->flags))
+- goto out;
++ return 0;
+
+ set_bit(EP_FLAG_STOPPING, &ep->flags);
+ INIT_LIST_HEAD(&ep->ready_playback_urbs);
+@@ -901,24 +899,25 @@ static int stop_and_unlink_urbs(struct s
+ }
+ }
+
+- out:
+- if (wait_sync)
+- return wait_clear_urbs(ep);
+ return 0;
+ }
+
+ /*
+ * release an endpoint's urbs
+ */
+-static void release_urbs(struct snd_usb_endpoint *ep, int force)
++static int release_urbs(struct snd_usb_endpoint *ep, bool force)
+ {
+- int i;
++ int i, err;
+
+ /* route incoming urbs to nirvana */
+ snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL);
+
+- /* stop urbs */
+- stop_and_unlink_urbs(ep, force, true);
++ /* stop and unlink urbs */
++ err = stop_urbs(ep, force);
++ if (err)
++ return err;
++
++ wait_clear_urbs(ep);
+
+ for (i = 0; i < ep->nurbs; i++)
+ release_urb_ctx(&ep->urb[i]);
+@@ -928,6 +927,7 @@ static void release_urbs(struct snd_usb_
+
+ ep->syncbuf = NULL;
+ ep->nurbs = 0;
++ return 0;
+ }
+
+ /*
+@@ -1118,7 +1118,7 @@ static int data_ep_set_params(struct snd
+ return 0;
+
+ out_of_memory:
+- release_urbs(ep, 0);
++ release_urbs(ep, false);
+ return -ENOMEM;
+ }
+
+@@ -1162,7 +1162,7 @@ static int sync_ep_set_params(struct snd
+ return 0;
+
+ out_of_memory:
+- release_urbs(ep, 0);
++ release_urbs(ep, false);
+ return -ENOMEM;
+ }
+
+@@ -1180,7 +1180,9 @@ static int snd_usb_endpoint_set_params(s
+ int err;
+
+ /* release old buffers, if any */
+- release_urbs(ep, 0);
++ err = release_urbs(ep, false);
++ if (err < 0)
++ return err;
+
+ ep->datainterval = fmt->datainterval;
+ ep->maxpacksize = fmt->maxpacksize;
+@@ -1433,7 +1435,7 @@ void snd_usb_endpoint_stop(struct snd_us
+ WRITE_ONCE(ep->sync_source->sync_sink, NULL);
+
+ if (!atomic_dec_return(&ep->running))
+- stop_and_unlink_urbs(ep, false, false);
++ stop_urbs(ep, false);
+ }
+
+ /**
+@@ -1446,7 +1448,7 @@ void snd_usb_endpoint_stop(struct snd_us
+ */
+ void snd_usb_endpoint_release(struct snd_usb_endpoint *ep)
+ {
+- release_urbs(ep, 1);
++ release_urbs(ep, true);
+ }
+
+ /**
--- /dev/null
+From 5c2b301476ec493be15546f05e23414e2aa9d472 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 6 Feb 2021 21:30:51 +0100
+Subject: ALSA: usb-audio: More strict state change in EP
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5c2b301476ec493be15546f05e23414e2aa9d472 upstream.
+
+The endpoint management has bit flags to indicate the current state,
+and we're dealing two things: the running bit and the stopping bit.
+There is a thin window in transition from the running to the stopping
+in stop_urbs(), and as long as the bit flags are used, it's difficult
+to plug.
+
+This patch modifies the state management code to use the atomic int
+and follow the explicit three states, STOPPED, RUNNING and STOPPING.
+The state change is done via atomic_cmpxhg() for avoiding possible
+races, and check the state change more strictly. The unexpected state
+change is now handled as an error.
+
+Fixes: d0f09d1e4a88 ("ALSA: usb-audio: Refactoring endpoint URB deactivation")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210206203052.15606-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/card.h | 2 +-
+ sound/usb/endpoint.c | 42 ++++++++++++++++++++++++++++--------------
+ 2 files changed, 29 insertions(+), 15 deletions(-)
+
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -71,7 +71,7 @@ struct snd_usb_endpoint {
+ unsigned char altsetting; /* corresponding alternate setting */
+ unsigned char ep_idx; /* endpoint array index */
+
+- unsigned long flags; /* running bit flags */
++ atomic_t state; /* running state */
+
+ void (*prepare_data_urb) (struct snd_usb_substream *subs,
+ struct urb *urb);
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -21,8 +21,11 @@
+ #include "clock.h"
+ #include "quirks.h"
+
+-#define EP_FLAG_RUNNING 1
+-#define EP_FLAG_STOPPING 2
++enum {
++ EP_STATE_STOPPED,
++ EP_STATE_RUNNING,
++ EP_STATE_STOPPING,
++};
+
+ /* interface refcounting */
+ struct snd_usb_iface_ref {
+@@ -115,6 +118,16 @@ static const char *usb_error_string(int
+ }
+ }
+
++static inline bool ep_state_running(struct snd_usb_endpoint *ep)
++{
++ return atomic_read(&ep->state) == EP_STATE_RUNNING;
++}
++
++static inline bool ep_state_update(struct snd_usb_endpoint *ep, int old, int new)
++{
++ return atomic_cmpxchg(&ep->state, old, new) == old;
++}
++
+ /**
+ * snd_usb_endpoint_implicit_feedback_sink: Report endpoint usage type
+ *
+@@ -393,7 +406,7 @@ next_packet_fifo_dequeue(struct snd_usb_
+ */
+ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep)
+ {
+- while (test_bit(EP_FLAG_RUNNING, &ep->flags)) {
++ while (ep_state_running(ep)) {
+
+ unsigned long flags;
+ struct snd_usb_packet_info *packet;
+@@ -454,13 +467,13 @@ static void snd_complete_urb(struct urb
+ if (unlikely(atomic_read(&ep->chip->shutdown)))
+ goto exit_clear;
+
+- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ if (unlikely(!ep_state_running(ep)))
+ goto exit_clear;
+
+ if (usb_pipeout(ep->pipe)) {
+ retire_outbound_urb(ep, ctx);
+ /* can be stopped during retire callback */
+- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ if (unlikely(!ep_state_running(ep)))
+ goto exit_clear;
+
+ if (snd_usb_endpoint_implicit_feedback_sink(ep)) {
+@@ -474,12 +487,12 @@ static void snd_complete_urb(struct urb
+
+ prepare_outbound_urb(ep, ctx);
+ /* can be stopped during prepare callback */
+- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ if (unlikely(!ep_state_running(ep)))
+ goto exit_clear;
+ } else {
+ retire_inbound_urb(ep, ctx);
+ /* can be stopped during retire callback */
+- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
++ if (unlikely(!ep_state_running(ep)))
+ goto exit_clear;
+
+ prepare_inbound_urb(ep, ctx);
+@@ -835,7 +848,7 @@ static int wait_clear_urbs(struct snd_us
+ unsigned long end_time = jiffies + msecs_to_jiffies(1000);
+ int alive;
+
+- if (!test_bit(EP_FLAG_STOPPING, &ep->flags))
++ if (atomic_read(&ep->state) != EP_STATE_STOPPING)
+ return 0;
+
+ do {
+@@ -850,10 +863,11 @@ static int wait_clear_urbs(struct snd_us
+ usb_audio_err(ep->chip,
+ "timeout: still %d active urbs on EP #%x\n",
+ alive, ep->ep_num);
+- clear_bit(EP_FLAG_STOPPING, &ep->flags);
+
+- ep->sync_sink = NULL;
+- snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL);
++ if (ep_state_update(ep, EP_STATE_STOPPING, EP_STATE_STOPPED)) {
++ ep->sync_sink = NULL;
++ snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL);
++ }
+
+ return 0;
+ }
+@@ -882,10 +896,9 @@ static int stop_urbs(struct snd_usb_endp
+ if (!force && atomic_read(&ep->running))
+ return -EBUSY;
+
+- if (!test_and_clear_bit(EP_FLAG_RUNNING, &ep->flags))
++ if (!ep_state_update(ep, EP_STATE_RUNNING, EP_STATE_STOPPING))
+ return 0;
+
+- set_bit(EP_FLAG_STOPPING, &ep->flags);
+ INIT_LIST_HEAD(&ep->ready_playback_urbs);
+ ep->next_packet_head = 0;
+ ep->next_packet_queued = 0;
+@@ -1362,7 +1375,8 @@ int snd_usb_endpoint_start(struct snd_us
+ * from that context.
+ */
+
+- set_bit(EP_FLAG_RUNNING, &ep->flags);
++ if (!ep_state_update(ep, EP_STATE_STOPPED, EP_STATE_RUNNING))
++ goto __error;
+
+ if (snd_usb_endpoint_implicit_feedback_sink(ep)) {
+ for (i = 0; i < ep->nurbs; i++) {
--- /dev/null
+From b7ff3a447d100c999d9848353ef8a4046831d893 Mon Sep 17 00:00:00 2001
+From: Dinh Nguyen <dinguyen@kernel.org>
+Date: Thu, 4 Feb 2021 14:24:33 -0600
+Subject: arm64: dts: agilex: fix phy interface bit shift for gmac1 and gmac2
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+commit b7ff3a447d100c999d9848353ef8a4046831d893 upstream.
+
+The shift for the phy_intf_sel bit in the system manager for gmac1 and
+gmac2 should be 0.
+
+Fixes: 2f804ba7aa9ee ("arm64: dts: agilex: Add SysMgr to Ethernet nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi
++++ b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi
+@@ -166,7 +166,7 @@
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
+ iommus = <&smmu 2>;
+- altr,sysmgr-syscon = <&sysmgr 0x48 8>;
++ altr,sysmgr-syscon = <&sysmgr 0x48 0>;
+ clocks = <&clkmgr AGILEX_EMAC1_CLK>, <&clkmgr AGILEX_EMAC_PTP_CLK>;
+ clock-names = "stmmaceth", "ptp_ref";
+ status = "disabled";
+@@ -184,7 +184,7 @@
+ rx-fifo-depth = <16384>;
+ snps,multicast-filter-bins = <256>;
+ iommus = <&smmu 3>;
+- altr,sysmgr-syscon = <&sysmgr 0x4c 16>;
++ altr,sysmgr-syscon = <&sysmgr 0x4c 0>;
+ clocks = <&clkmgr AGILEX_EMAC2_CLK>, <&clkmgr AGILEX_EMAC_PTP_CLK>;
+ clock-names = "stmmaceth", "ptp_ref";
+ status = "disabled";
--- /dev/null
+From df84fe94708985cdfb78a83148322bcd0a699472 Mon Sep 17 00:00:00 2001
+From: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
+Date: Sat, 16 Jan 2021 15:18:54 +0000
+Subject: arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL)
+
+From: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
+
+commit df84fe94708985cdfb78a83148322bcd0a699472 upstream.
+
+Since commit f086f67485c5 ("arm64: ptrace: add support for syscall
+emulation"), if system call number -1 is called and the process is being
+traced with PTRACE_SYSCALL, for example by strace, the seccomp check is
+skipped and -ENOSYS is returned unconditionally (unless altered by the
+tracer) rather than carrying out action specified in the seccomp filter.
+
+The consequence of this is that it is not possible to reliably strace
+a seccomp based implementation of a foreign system call interface in
+which r7/x8 is permitted to be -1 on entry to a system call.
+
+Also trace_sys_enter and audit_syscall_entry are skipped if a system
+call is skipped.
+
+Fix by removing the in_syscall(regs) check restoring the previous
+behaviour which is like AArch32, x86 (which uses generic code) and
+everything else.
+
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Catalin Marinas<catalin.marinas@arm.com>
+Cc: <stable@vger.kernel.org>
+Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Timothy E Baldwin <T.E.Baldwin99@members.leeds.ac.uk>
+Link: https://lore.kernel.org/r/90edd33b-6353-1228-791f-0336d94d5f8c@majoroak.me.uk
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/ptrace.c
++++ b/arch/arm64/kernel/ptrace.c
+@@ -1796,7 +1796,7 @@ int syscall_trace_enter(struct pt_regs *
+
+ if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) {
+ tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+- if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU))
++ if (flags & _TIF_SYSCALL_EMU)
+ return NO_SYSCALL;
+ }
+
--- /dev/null
+From ae07f5c7c5e9ebca5b9d6471bb4b99a9da5c6d88 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 26 Jan 2021 16:47:02 +0100
+Subject: ASoC: siu: Fix build error by a wrong const prefix
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ae07f5c7c5e9ebca5b9d6471bb4b99a9da5c6d88 upstream.
+
+A const prefix was put wrongly in the middle at the code refactoring
+commit 932eaf7c7904 ("ASoC: sh: siu_pcm: remove snd_pcm_ops"), which
+leads to a build error as:
+ sound/soc/sh/siu_pcm.c:546:8: error: expected '{' before 'const'
+
+Also, another inconsistency is that the declaration of siu_component
+misses the const prefix.
+
+This patch corrects both failures.
+
+Fixes: 932eaf7c7904 ("ASoC: sh: siu_pcm: remove snd_pcm_ops")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20210126154702.3974-1-tiwai@suse.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/sh/siu.h | 2 +-
+ sound/soc/sh/siu_pcm.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/sh/siu.h
++++ b/sound/soc/sh/siu.h
+@@ -169,7 +169,7 @@ static inline u32 siu_read32(u32 __iomem
+ #define SIU_BRGBSEL (0x108 / sizeof(u32))
+ #define SIU_BRRB (0x10c / sizeof(u32))
+
+-extern struct snd_soc_component_driver siu_component;
++extern const struct snd_soc_component_driver siu_component;
+ extern struct siu_info *siu_i2s_data;
+
+ int siu_init_port(int port, struct siu_port **port_info, struct snd_card *card);
+--- a/sound/soc/sh/siu_pcm.c
++++ b/sound/soc/sh/siu_pcm.c
+@@ -543,7 +543,7 @@ static void siu_pcm_free(struct snd_soc_
+ dev_dbg(pcm->card->dev, "%s\n", __func__);
+ }
+
+-struct const snd_soc_component_driver siu_component = {
++const struct snd_soc_component_driver siu_component = {
+ .name = DRV_NAME,
+ .open = siu_pcm_open,
+ .close = siu_pcm_close,
--- /dev/null
+From d797bd9897e3559eb48d68368550d637d32e468c Mon Sep 17 00:00:00 2001
+From: Kai Krakow <kai@kaishome.de>
+Date: Wed, 10 Feb 2021 13:07:26 +0800
+Subject: bcache: Give btree_io_wq correct semantics again
+
+From: Kai Krakow <kai@kaishome.de>
+
+commit d797bd9897e3559eb48d68368550d637d32e468c upstream.
+
+Before killing `btree_io_wq`, the queue was allocated using
+`create_singlethread_workqueue()` which has `WQ_MEM_RECLAIM`. After
+killing it, it no longer had this property but `system_wq` is not
+single threaded.
+
+Let's combine both worlds and make it multi threaded but able to
+reclaim memory.
+
+Cc: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org # 5.4+
+Signed-off-by: Kai Krakow <kai@kaishome.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -2775,7 +2775,7 @@ void bch_btree_exit(void)
+
+ int __init bch_btree_init(void)
+ {
+- btree_io_wq = create_singlethread_workqueue("bch_btree_io");
++ btree_io_wq = alloc_workqueue("bch_btree_io", WQ_MEM_RECLAIM, 0);
+ if (!btree_io_wq)
+ return -ENOMEM;
+
--- /dev/null
+From afe78ab46f638ecdf80a35b122ffc92c20d9ae5d Mon Sep 17 00:00:00 2001
+From: Kai Krakow <kai@kaishome.de>
+Date: Wed, 10 Feb 2021 13:07:27 +0800
+Subject: bcache: Move journal work to new flush wq
+
+From: Kai Krakow <kai@kaishome.de>
+
+commit afe78ab46f638ecdf80a35b122ffc92c20d9ae5d upstream.
+
+This is potentially long running and not latency sensitive, let's get
+it out of the way of other latency sensitive events.
+
+As observed in the previous commit, the `system_wq` comes easily
+congested by bcache, and this fixes a few more stalls I was observing
+every once in a while.
+
+Let's not make this `WQ_MEM_RECLAIM` as it showed to reduce performance
+of boot and file system operations in my tests. Also, without
+`WQ_MEM_RECLAIM`, I no longer see desktop stalls. This matches the
+previous behavior as `system_wq` also does no memory reclaim:
+
+> // workqueue.c:
+> system_wq = alloc_workqueue("events", 0, 0);
+
+Cc: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org # 5.4+
+Signed-off-by: Kai Krakow <kai@kaishome.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/bcache.h | 1 +
+ drivers/md/bcache/journal.c | 4 ++--
+ drivers/md/bcache/super.c | 16 ++++++++++++++++
+ 3 files changed, 19 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -1001,6 +1001,7 @@ void bch_write_bdev_super(struct cached_
+
+ extern struct workqueue_struct *bcache_wq;
+ extern struct workqueue_struct *bch_journal_wq;
++extern struct workqueue_struct *bch_flush_wq;
+ extern struct mutex bch_register_lock;
+ extern struct list_head bch_cache_sets;
+
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -932,8 +932,8 @@ atomic_t *bch_journal(struct cache_set *
+ journal_try_write(c);
+ } else if (!w->dirty) {
+ w->dirty = true;
+- schedule_delayed_work(&c->journal.work,
+- msecs_to_jiffies(c->journal_delay_ms));
++ queue_delayed_work(bch_flush_wq, &c->journal.work,
++ msecs_to_jiffies(c->journal_delay_ms));
+ spin_unlock(&c->journal.lock);
+ } else {
+ spin_unlock(&c->journal.lock);
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -49,6 +49,7 @@ static int bcache_major;
+ static DEFINE_IDA(bcache_device_idx);
+ static wait_queue_head_t unregister_wait;
+ struct workqueue_struct *bcache_wq;
++struct workqueue_struct *bch_flush_wq;
+ struct workqueue_struct *bch_journal_wq;
+
+
+@@ -2821,6 +2822,8 @@ static void bcache_exit(void)
+ destroy_workqueue(bcache_wq);
+ if (bch_journal_wq)
+ destroy_workqueue(bch_journal_wq);
++ if (bch_flush_wq)
++ destroy_workqueue(bch_flush_wq);
+ bch_btree_exit();
+
+ if (bcache_major)
+@@ -2884,6 +2887,19 @@ static int __init bcache_init(void)
+ if (!bcache_wq)
+ goto err;
+
++ /*
++ * Let's not make this `WQ_MEM_RECLAIM` for the following reasons:
++ *
++ * 1. It used `system_wq` before which also does no memory reclaim.
++ * 2. With `WQ_MEM_RECLAIM` desktop stalls, increased boot times, and
++ * reduced throughput can be observed.
++ *
++ * We still want to user our own queue to not congest the `system_wq`.
++ */
++ bch_flush_wq = alloc_workqueue("bch_flush", 0, 0);
++ if (!bch_flush_wq)
++ goto err;
++
+ bch_journal_wq = alloc_workqueue("bch_journal", WQ_MEM_RECLAIM, 0);
+ if (!bch_journal_wq)
+ goto err;
--- /dev/null
+From 97f433c3601a24d3513d06f575a389a2ca4e11e4 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 23 Feb 2021 19:25:30 -0700
+Subject: blk-settings: align max_sectors on "logical_block_size" boundary
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 97f433c3601a24d3513d06f575a389a2ca4e11e4 upstream.
+
+We get I/O errors when we run md-raid1 on the top of dm-integrity on the
+top of ramdisk.
+device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
+device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff
+device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
+device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1
+device-mapper: integrity: Bio not aligned on 8 sectors: 0x8048, 0xff
+device-mapper: integrity: Bio not aligned on 8 sectors: 0x8147, 0xff
+device-mapper: integrity: Bio not aligned on 8 sectors: 0x8246, 0xff
+device-mapper: integrity: Bio not aligned on 8 sectors: 0x8345, 0xbb
+
+The ramdisk device has logical_block_size 512 and max_sectors 255. The
+dm-integrity device uses logical_block_size 4096 and it doesn't affect the
+"max_sectors" value - thus, it inherits 255 from the ramdisk. So, we have
+a device with max_sectors not aligned on logical_block_size.
+
+The md-raid device sees that the underlying leg has max_sectors 255 and it
+will split the bios on 255-sector boundary, making the bios unaligned on
+logical_block_size.
+
+In order to fix the bug, we round down max_sectors to logical_block_size.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-settings.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -481,6 +481,14 @@ void blk_queue_io_opt(struct request_que
+ }
+ EXPORT_SYMBOL(blk_queue_io_opt);
+
++static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbs)
++{
++ sectors = round_down(sectors, lbs >> SECTOR_SHIFT);
++ if (sectors < PAGE_SIZE >> SECTOR_SHIFT)
++ sectors = PAGE_SIZE >> SECTOR_SHIFT;
++ return sectors;
++}
++
+ /**
+ * blk_stack_limits - adjust queue_limits for stacked devices
+ * @t: the stacking driver limits (top device)
+@@ -607,6 +615,10 @@ int blk_stack_limits(struct queue_limits
+ ret = -1;
+ }
+
++ t->max_sectors = blk_round_down_sectors(t->max_sectors, t->logical_block_size);
++ t->max_hw_sectors = blk_round_down_sectors(t->max_hw_sectors, t->logical_block_size);
++ t->max_dev_sectors = blk_round_down_sectors(t->max_dev_sectors, t->logical_block_size);
++
+ /* Discard alignment and granularity */
+ if (b->discard_granularity) {
+ alignment = queue_limit_discard_alignment(b, start);
--- /dev/null
+From 867ed321f90d06aaba84e2c91de51cd3038825ef Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Thu, 14 Jan 2021 14:02:46 -0500
+Subject: btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 867ed321f90d06aaba84e2c91de51cd3038825ef upstream.
+
+While testing my error handling patches, I added a error injection site
+at btrfs_inc_extent_ref, to validate the error handling I added was
+doing the correct thing. However I hit a pretty ugly corruption while
+doing this check, with the following error injection stack trace:
+
+btrfs_inc_extent_ref
+ btrfs_copy_root
+ create_reloc_root
+ btrfs_init_reloc_root
+ btrfs_record_root_in_trans
+ btrfs_start_transaction
+ btrfs_update_inode
+ btrfs_update_time
+ touch_atime
+ file_accessed
+ btrfs_file_mmap
+
+This is because we do not catch the error from btrfs_inc_extent_ref,
+which in practice would be ENOMEM, which means we lose the extent
+references for a root that has already been allocated and inserted,
+which is the problem. Fix this by aborting the transaction if we fail
+to do the reference modification.
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -221,9 +221,10 @@ int btrfs_copy_root(struct btrfs_trans_h
+ ret = btrfs_inc_ref(trans, root, cow, 1);
+ else
+ ret = btrfs_inc_ref(trans, root, cow, 0);
+-
+- if (ret)
++ if (ret) {
++ btrfs_abort_transaction(trans, ret);
+ return ret;
++ }
+
+ btrfs_mark_buffer_dirty(cow);
+ *cow_ret = cow;
--- /dev/null
+From 81e75ac74ecba929d1e922bf93f9fc467232e39f Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 15 Jan 2021 16:48:56 -0500
+Subject: btrfs: account for new extents being deleted in total_bytes_pinned
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 81e75ac74ecba929d1e922bf93f9fc467232e39f upstream.
+
+My recent patch set "A variety of lock contention fixes", found here
+
+https://lore.kernel.org/linux-btrfs/cover.1608319304.git.josef@toxicpanda.com/
+(Tracked in https://github.com/btrfs/linux/issues/86)
+
+that reduce lock contention on the extent root by running delayed refs
+less often resulted in a regression in generic/371. This test
+fallocate()'s the fs until it's full, deletes all the files, and then
+tries to fallocate() until full again.
+
+Before these patches we would run all of the delayed refs during
+flushing, and then would commit the transaction because we had plenty of
+pinned space to recover in order to allocate. However my patches made
+it so we weren't running the delayed refs as aggressively, which meant
+that we appeared to have less pinned space when we were deciding to
+commit the transaction.
+
+We use the space_info->total_bytes_pinned to approximate how much space
+we have pinned. It's approximate because if we remove a reference to an
+extent we may free it, but there may be more references to it than we
+know of at that point, but we account it as pinned at the creation time,
+and then it's properly accounted when the delayed ref runs.
+
+The way we account for pinned space is if the
+delayed_ref_head->total_ref_mod is < 0, because that is clearly a
+freeing option. However there is another case, and that is where
+->total_ref_mod == 0 && ->must_insert_reserved == 1.
+
+When we allocate a new extent, we have ->total_ref_mod == 1 and we have
+->must_insert_reserved == 1. This is used to indicate that it is a
+brand new extent and will need to have its extent entry added before we
+modify any references on the delayed ref head. But if we subsequently
+remove that extent reference, our ->total_ref_mod will be 0, and that
+space will be pinned and freed. Accounting for this case properly
+allows for generic/371 to pass with my delayed refs patches applied.
+
+It's important to note that this problem exists without the referenced
+patches, it just was uncovered by them.
+
+CC: stable@vger.kernel.org # 5.10
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/delayed-ref.c | 5 +++++
+ fs/btrfs/extent-tree.c | 33 +++++++++++++++++++--------------
+ 2 files changed, 24 insertions(+), 14 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -732,11 +732,16 @@ static noinline void update_existing_hea
+ * 2. We were negative and went to 0 or positive, so no longer can say
+ * that the space would be pinned, decrement our counter from the
+ * total_bytes_pinned counter.
++ * 3. We are now at 0 and have ->must_insert_reserved set, which means
++ * this was a new allocation and then we dropped it, and thus must
++ * add our space to the total_bytes_pinned counter.
+ */
+ if (existing->total_ref_mod < 0 && old_ref_mod >= 0)
+ btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes);
+ else if (existing->total_ref_mod >= 0 && old_ref_mod < 0)
+ btrfs_mod_total_bytes_pinned(fs_info, flags, -existing->num_bytes);
++ else if (existing->total_ref_mod == 0 && existing->must_insert_reserved)
++ btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes);
+
+ spin_unlock(&existing->lock);
+ }
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1754,23 +1754,28 @@ void btrfs_cleanup_ref_head_accounting(s
+ {
+ int nr_items = 1; /* Dropping this ref head update. */
+
+- if (head->total_ref_mod < 0) {
++ /*
++ * We had csum deletions accounted for in our delayed refs rsv, we need
++ * to drop the csum leaves for this update from our delayed_refs_rsv.
++ */
++ if (head->total_ref_mod < 0 && head->is_data) {
++ spin_lock(&delayed_refs->lock);
++ delayed_refs->pending_csums -= head->num_bytes;
++ spin_unlock(&delayed_refs->lock);
++ nr_items += btrfs_csum_bytes_to_leaves(fs_info, head->num_bytes);
++ }
++
++ /*
++ * We were dropping refs, or had a new ref and dropped it, and thus must
++ * adjust down our total_bytes_pinned, the space may or may not have
++ * been pinned and so is accounted for properly in the pinned space by
++ * now.
++ */
++ if (head->total_ref_mod < 0 ||
++ (head->total_ref_mod == 0 && head->must_insert_reserved)) {
+ u64 flags = btrfs_ref_head_to_space_flags(head);
+
+ btrfs_mod_total_bytes_pinned(fs_info, flags, -head->num_bytes);
+-
+- /*
+- * We had csum deletions accounted for in our delayed refs rsv,
+- * we need to drop the csum leaves for this update from our
+- * delayed_refs_rsv.
+- */
+- if (head->is_data) {
+- spin_lock(&delayed_refs->lock);
+- delayed_refs->pending_csums -= head->num_bytes;
+- spin_unlock(&delayed_refs->lock);
+- nr_items += btrfs_csum_bytes_to_leaves(fs_info,
+- head->num_bytes);
+- }
+ }
+
+ btrfs_delayed_refs_rsv_release(fs_info, nr_items);
--- /dev/null
+From eddda68d97732ce05ca145f8e85e8a447f65cdad Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Thu, 14 Jan 2021 14:02:45 -0500
+Subject: btrfs: add asserts for deleting backref cache nodes
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit eddda68d97732ce05ca145f8e85e8a447f65cdad upstream.
+
+A weird KASAN problem that Zygo reported could have been easily caught
+if we checked for basic things in our backref freeing code. We have two
+methods of freeing a backref node
+
+- btrfs_backref_free_node: this just is kfree() essentially.
+- btrfs_backref_drop_node: this actually unlinks the node and cleans up
+ everything and then calls btrfs_backref_free_node().
+
+We should mostly be using btrfs_backref_drop_node(), to make sure the
+node is properly unlinked from the backref cache, and only use
+btrfs_backref_free_node() when we know the node isn't actually linked to
+the backref cache. We made a mistake here and thus got the KASAN splat.
+
+Make this style of issue easier to find by adding some ASSERT()'s to
+btrfs_backref_free_node() and adjusting our deletion stuff to properly
+init the list so we can rely on list_empty() checks working properly.
+
+ BUG: KASAN: use-after-free in btrfs_backref_cleanup_node+0x18a/0x420
+ Read of size 8 at addr ffff888112402950 by task btrfs/28836
+
+ CPU: 0 PID: 28836 Comm: btrfs Tainted: G W 5.10.0-e35f27394290-for-next+ #23
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+ Call Trace:
+ dump_stack+0xbc/0xf9
+ ? btrfs_backref_cleanup_node+0x18a/0x420
+ print_address_description.constprop.8+0x21/0x210
+ ? record_print_text.cold.34+0x11/0x11
+ ? btrfs_backref_cleanup_node+0x18a/0x420
+ ? btrfs_backref_cleanup_node+0x18a/0x420
+ kasan_report.cold.10+0x20/0x37
+ ? btrfs_backref_cleanup_node+0x18a/0x420
+ __asan_load8+0x69/0x90
+ btrfs_backref_cleanup_node+0x18a/0x420
+ btrfs_backref_release_cache+0x83/0x1b0
+ relocate_block_group+0x394/0x780
+ ? merge_reloc_roots+0x4a0/0x4a0
+ btrfs_relocate_block_group+0x26e/0x4c0
+ btrfs_relocate_chunk+0x52/0x120
+ btrfs_balance+0xe2e/0x1900
+ ? check_flags.part.50+0x6c/0x1e0
+ ? btrfs_relocate_chunk+0x120/0x120
+ ? kmem_cache_alloc_trace+0xa06/0xcb0
+ ? _copy_from_user+0x83/0xc0
+ btrfs_ioctl_balance+0x3a7/0x460
+ btrfs_ioctl+0x24c8/0x4360
+ ? __kasan_check_read+0x11/0x20
+ ? check_chain_key+0x1f4/0x2f0
+ ? __asan_loadN+0xf/0x20
+ ? btrfs_ioctl_get_supported_features+0x30/0x30
+ ? kvm_sched_clock_read+0x18/0x30
+ ? check_chain_key+0x1f4/0x2f0
+ ? lock_downgrade+0x3f0/0x3f0
+ ? handle_mm_fault+0xad6/0x2150
+ ? do_vfs_ioctl+0xfc/0x9d0
+ ? ioctl_file_clone+0xe0/0xe0
+ ? check_flags.part.50+0x6c/0x1e0
+ ? check_flags.part.50+0x6c/0x1e0
+ ? check_flags+0x26/0x30
+ ? lock_is_held_type+0xc3/0xf0
+ ? syscall_enter_from_user_mode+0x1b/0x60
+ ? do_syscall_64+0x13/0x80
+ ? rcu_read_lock_sched_held+0xa1/0xd0
+ ? __kasan_check_read+0x11/0x20
+ ? __fget_light+0xae/0x110
+ __x64_sys_ioctl+0xc3/0x100
+ do_syscall_64+0x37/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f4c4bdfe427
+ RSP: 002b:00007fff33ee6df8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ RAX: ffffffffffffffda RBX: 00007fff33ee6e98 RCX: 00007f4c4bdfe427
+ RDX: 00007fff33ee6e98 RSI: 00000000c4009420 RDI: 0000000000000003
+ RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000078
+ R10: fffffffffffff59d R11: 0000000000000202 R12: 0000000000000001
+ R13: 0000000000000000 R14: 00007fff33ee8a34 R15: 0000000000000001
+
+ Allocated by task 28836:
+ kasan_save_stack+0x21/0x50
+ __kasan_kmalloc.constprop.18+0xbe/0xd0
+ kasan_kmalloc+0x9/0x10
+ kmem_cache_alloc_trace+0x410/0xcb0
+ btrfs_backref_alloc_node+0x46/0xf0
+ btrfs_backref_add_tree_node+0x60d/0x11d0
+ build_backref_tree+0xc5/0x700
+ relocate_tree_blocks+0x2be/0xb90
+ relocate_block_group+0x2eb/0x780
+ btrfs_relocate_block_group+0x26e/0x4c0
+ btrfs_relocate_chunk+0x52/0x120
+ btrfs_balance+0xe2e/0x1900
+ btrfs_ioctl_balance+0x3a7/0x460
+ btrfs_ioctl+0x24c8/0x4360
+ __x64_sys_ioctl+0xc3/0x100
+ do_syscall_64+0x37/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ Freed by task 28836:
+ kasan_save_stack+0x21/0x50
+ kasan_set_track+0x20/0x30
+ kasan_set_free_info+0x1f/0x30
+ __kasan_slab_free+0xf3/0x140
+ kasan_slab_free+0xe/0x10
+ kfree+0xde/0x200
+ btrfs_backref_error_cleanup+0x452/0x530
+ build_backref_tree+0x1a5/0x700
+ relocate_tree_blocks+0x2be/0xb90
+ relocate_block_group+0x2eb/0x780
+ btrfs_relocate_block_group+0x26e/0x4c0
+ btrfs_relocate_chunk+0x52/0x120
+ btrfs_balance+0xe2e/0x1900
+ btrfs_ioctl_balance+0x3a7/0x460
+ btrfs_ioctl+0x24c8/0x4360
+ __x64_sys_ioctl+0xc3/0x100
+ do_syscall_64+0x37/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ The buggy address belongs to the object at ffff888112402900
+ which belongs to the cache kmalloc-128 of size 128
+ The buggy address is located 80 bytes inside of
+ 128-byte region [ffff888112402900, ffff888112402980)
+ The buggy address belongs to the page:
+ page:0000000028b1cd08 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888131c810c0 pfn:0x112402
+ flags: 0x17ffe0000000200(slab)
+ raw: 017ffe0000000200 ffffea000424f308 ffffea0007d572c8 ffff888100040440
+ raw: ffff888131c810c0 ffff888112402000 0000000100000009 0000000000000000
+ page dumped because: kasan: bad access detected
+
+ Memory state around the buggy address:
+ ffff888112402800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888112402880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ >ffff888112402900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff888112402980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff888112402a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+
+Link: https://lore.kernel.org/linux-btrfs/20201208194607.GI31381@hungrycats.org/
+CC: stable@vger.kernel.org # 5.10+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/backref.h | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/fs/btrfs/backref.h
++++ b/fs/btrfs/backref.h
+@@ -296,6 +296,9 @@ static inline void btrfs_backref_free_no
+ struct btrfs_backref_node *node)
+ {
+ if (node) {
++ ASSERT(list_empty(&node->list));
++ ASSERT(list_empty(&node->lower));
++ ASSERT(node->eb == NULL);
+ cache->nr_nodes--;
+ btrfs_put_root(node->root);
+ kfree(node);
+@@ -340,11 +343,11 @@ static inline void btrfs_backref_drop_no
+ static inline void btrfs_backref_drop_node(struct btrfs_backref_cache *tree,
+ struct btrfs_backref_node *node)
+ {
+- BUG_ON(!list_empty(&node->upper));
++ ASSERT(list_empty(&node->upper));
+
+ btrfs_backref_drop_node_buffer(node);
+- list_del(&node->list);
+- list_del(&node->lower);
++ list_del_init(&node->list);
++ list_del_init(&node->lower);
+ if (!RB_EMPTY_NODE(&node->rb_node))
+ rb_erase(&node->rb_node, &tree->rb_root);
+ btrfs_backref_free_node(tree, node);
--- /dev/null
+From 7e2a870a599d4699a626ec26430c7a1ab14a2a49 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Wed, 16 Dec 2020 11:22:16 -0500
+Subject: btrfs: do not cleanup upper nodes in btrfs_backref_cleanup_node
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 7e2a870a599d4699a626ec26430c7a1ab14a2a49 upstream.
+
+Zygo reported the following panic when testing my error handling patches
+for relocation:
+
+ kernel BUG at fs/btrfs/backref.c:2545!
+ invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 3 PID: 8472 Comm: btrfs Tainted: G W 14
+ Hardware name: QEMU Standard PC (i440FX + PIIX,
+
+ Call Trace:
+ btrfs_backref_error_cleanup+0x4df/0x530
+ build_backref_tree+0x1a5/0x700
+ ? _raw_spin_unlock+0x22/0x30
+ ? release_extent_buffer+0x225/0x280
+ ? free_extent_buffer.part.52+0xd7/0x140
+ relocate_tree_blocks+0x2a6/0xb60
+ ? kasan_unpoison_shadow+0x35/0x50
+ ? do_relocation+0xc10/0xc10
+ ? kasan_kmalloc+0x9/0x10
+ ? kmem_cache_alloc_trace+0x6a3/0xcb0
+ ? free_extent_buffer.part.52+0xd7/0x140
+ ? rb_insert_color+0x342/0x360
+ ? add_tree_block.isra.36+0x236/0x2b0
+ relocate_block_group+0x2eb/0x780
+ ? merge_reloc_roots+0x470/0x470
+ btrfs_relocate_block_group+0x26e/0x4c0
+ btrfs_relocate_chunk+0x52/0x120
+ btrfs_balance+0xe2e/0x18f0
+ ? pvclock_clocksource_read+0xeb/0x190
+ ? btrfs_relocate_chunk+0x120/0x120
+ ? lock_contended+0x620/0x6e0
+ ? do_raw_spin_lock+0x1e0/0x1e0
+ ? do_raw_spin_unlock+0xa8/0x140
+ btrfs_ioctl_balance+0x1f9/0x460
+ btrfs_ioctl+0x24c8/0x4380
+ ? __kasan_check_read+0x11/0x20
+ ? check_chain_key+0x1f4/0x2f0
+ ? __asan_loadN+0xf/0x20
+ ? btrfs_ioctl_get_supported_features+0x30/0x30
+ ? kvm_sched_clock_read+0x18/0x30
+ ? check_chain_key+0x1f4/0x2f0
+ ? lock_downgrade+0x3f0/0x3f0
+ ? handle_mm_fault+0xad6/0x2150
+ ? do_vfs_ioctl+0xfc/0x9d0
+ ? ioctl_file_clone+0xe0/0xe0
+ ? check_flags.part.50+0x6c/0x1e0
+ ? check_flags.part.50+0x6c/0x1e0
+ ? check_flags+0x26/0x30
+ ? lock_is_held_type+0xc3/0xf0
+ ? syscall_enter_from_user_mode+0x1b/0x60
+ ? do_syscall_64+0x13/0x80
+ ? rcu_read_lock_sched_held+0xa1/0xd0
+ ? __kasan_check_read+0x11/0x20
+ ? __fget_light+0xae/0x110
+ __x64_sys_ioctl+0xc3/0x100
+ do_syscall_64+0x37/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+This occurs because of this check
+
+ if (RB_EMPTY_NODE(&upper->rb_node))
+ BUG_ON(!list_empty(&node->upper));
+
+As we are dropping the backref node, if we discover that our upper node
+in the edge we just cleaned up isn't linked into the cache that we are
+now done with this node, thus the BUG_ON().
+
+However this is an erroneous assumption, as we will look up all the
+references for a node first, and then process the pending edges. All of
+the 'upper' nodes in our pending edges won't be in the cache's rb_tree
+yet, because they haven't been processed. We could very well have many
+edges still left to cleanup on this node.
+
+The fact is we simply do not need this check, we can just process all of
+the edges only for this node, because below this check we do the
+following
+
+ if (list_empty(&upper->lower)) {
+ list_add_tail(&upper->lower, &cache->leaves);
+ upper->lowest = 1;
+ }
+
+If the upper node truly isn't used yet, then we add it to the
+cache->leaves list to be cleaned up later. If it is still used then the
+last child node that has it linked into its node will add it to the
+leaves list and then it will be cleaned up.
+
+Fix this problem by dropping this logic altogether. With this fix I no
+longer see the panic when testing with error injection in the backref
+code.
+
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/backref.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -2541,13 +2541,6 @@ void btrfs_backref_cleanup_node(struct b
+ list_del(&edge->list[UPPER]);
+ btrfs_backref_free_edge(cache, edge);
+
+- if (RB_EMPTY_NODE(&upper->rb_node)) {
+- BUG_ON(!list_empty(&node->upper));
+- btrfs_backref_drop_node(cache, node);
+- node = upper;
+- node->lowest = 1;
+- continue;
+- }
+ /*
+ * Add the node to leaf node list if no other child block
+ * cached.
--- /dev/null
+From f78743fbdae1bb31bc9c9233c3590a5048782381 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Thu, 14 Jan 2021 14:02:44 -0500
+Subject: btrfs: do not warn if we can't find the reloc root when looking up backref
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit f78743fbdae1bb31bc9c9233c3590a5048782381 upstream.
+
+The backref code is looking for a reloc_root that corresponds to the
+given fs root. However any number of things could have gone wrong while
+initializing that reloc_root, like ENOMEM while trying to allocate the
+root itself, or EIO while trying to write the root item. This would
+result in no corresponding reloc_root being in the reloc root cache, and
+thus would return NULL when we do the find_reloc_root() call.
+
+Because of this we do not want to WARN_ON(). This presumably was meant
+to catch developer errors, cases where we messed up adding the reloc
+root. However we can easily hit this case with error injection, and
+thus should not do a WARN_ON().
+
+CC: stable@vger.kernel.org # 5.10+
+Reported-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/backref.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -2617,7 +2617,7 @@ static int handle_direct_tree_backref(st
+ /* Only reloc backref cache cares about a specific root */
+ if (cache->is_reloc) {
+ root = find_reloc_root(cache->fs_info, cur->bytenr);
+- if (WARN_ON(!root))
++ if (!root)
+ return -ENOENT;
+ cur->root = root;
+ } else {
--- /dev/null
+From 72c9925f87c8b74f36f8e75a4cd93d964538d3ca Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 4 Feb 2021 14:35:44 +0000
+Subject: btrfs: fix extent buffer leak on failure to copy root
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 72c9925f87c8b74f36f8e75a4cd93d964538d3ca upstream.
+
+At btrfs_copy_root(), if the call to btrfs_inc_ref() fails we end up
+returning without unlocking and releasing our reference on the extent
+buffer named "cow" we previously allocated with btrfs_alloc_tree_block().
+
+So fix that by unlocking the extent buffer and dropping our reference on
+it before returning.
+
+Fixes: be20aa9dbadc8c ("Btrfs: Add mount option to turn off data cow")
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -222,6 +222,8 @@ int btrfs_copy_root(struct btrfs_trans_h
+ else
+ ret = btrfs_inc_ref(trans, root, cow, 0);
+ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
--- /dev/null
+From c78a10aebb275c38d0cfccae129a803fe622e305 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Thu, 14 Jan 2021 14:02:42 -0500
+Subject: btrfs: fix reloc root leak with 0 ref reloc roots on recovery
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit c78a10aebb275c38d0cfccae129a803fe622e305 upstream.
+
+When recovering a relocation, if we run into a reloc root that has 0
+refs we simply add it to the reloc_control->reloc_roots list, and then
+clean it up later. The problem with this is __del_reloc_root() doesn't
+do anything if the root isn't in the radix tree, which in this case it
+won't be because we never call __add_reloc_root() on the reloc_root.
+
+This exit condition simply isn't correct really. During normal
+operation we can remove ourselves from the rb tree and then we're meant
+to clean up later at merge_reloc_roots() time, and this happens
+correctly. During recovery we're depending on free_reloc_roots() to
+drop our references, but we're short-circuiting.
+
+Fix this by continuing to check if we're on the list and dropping
+ourselves from the reloc_control root list and dropping our reference
+appropriately. Change the corresponding BUG_ON() to an ASSERT() that
+does the correct thing if we aren't in the rb tree.
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/relocation.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -668,9 +668,7 @@ static void __del_reloc_root(struct btrf
+ RB_CLEAR_NODE(&node->rb_node);
+ }
+ spin_unlock(&rc->reloc_root_tree.lock);
+- if (!node)
+- return;
+- BUG_ON((struct btrfs_root *)node->data != root);
++ ASSERT(!node || (struct btrfs_root *)node->data == root);
+ }
+
+ /*
--- /dev/null
+From 2187374f35fe9cadbddaa9fcf0c4121365d914e8 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 15 Jan 2021 16:48:55 -0500
+Subject: btrfs: handle space_info::total_bytes_pinned inside the delayed ref itself
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 2187374f35fe9cadbddaa9fcf0c4121365d914e8 upstream.
+
+Currently we pass things around to figure out if we maybe freeing data
+based on the state of the delayed refs head. This makes the accounting
+sort of confusing and hard to follow, as it's distinctly separate from
+the delayed ref heads stuff, but also depends on it entirely.
+
+Fix this by explicitly adjusting the space_info->total_bytes_pinned in
+the delayed refs code. We now have two places where we modify this
+counter, once where we create the delayed and destroy the delayed refs,
+and once when we pin and unpin the extents. This means there is a
+slight overlap between delayed refs and the pin/unpin mechanisms, but
+this is simply used by the ENOSPC infrastructure to determine if we need
+to commit the transaction, so there's no adverse affect from this, we
+might simply commit thinking it will give us enough space when it might
+not.
+
+CC: stable@vger.kernel.org # 5.10
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 10 +----
+ fs/btrfs/delayed-ref.c | 51 +++++++++++++++----------
+ fs/btrfs/delayed-ref.h | 16 ++++++--
+ fs/btrfs/extent-tree.c | 97 ++++++-------------------------------------------
+ fs/btrfs/space-info.h | 17 ++++++++
+ 5 files changed, 74 insertions(+), 117 deletions(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1371,9 +1371,7 @@ void btrfs_delete_unused_bgs(struct btrf
+ btrfs_space_info_update_bytes_pinned(fs_info, space_info,
+ -block_group->pinned);
+ space_info->bytes_readonly += block_group->pinned;
+- percpu_counter_add_batch(&space_info->total_bytes_pinned,
+- -block_group->pinned,
+- BTRFS_TOTAL_BYTES_PINNED_BATCH);
++ __btrfs_mod_total_bytes_pinned(space_info, -block_group->pinned);
+ block_group->pinned = 0;
+
+ spin_unlock(&block_group->lock);
+@@ -2901,10 +2899,8 @@ int btrfs_update_block_group(struct btrf
+ spin_unlock(&cache->lock);
+ spin_unlock(&cache->space_info->lock);
+
+- percpu_counter_add_batch(
+- &cache->space_info->total_bytes_pinned,
+- num_bytes,
+- BTRFS_TOTAL_BYTES_PINNED_BATCH);
++ __btrfs_mod_total_bytes_pinned(cache->space_info,
++ num_bytes);
+ set_extent_dirty(&trans->transaction->pinned_extents,
+ bytenr, bytenr + num_bytes - 1,
+ GFP_NOFS | __GFP_NOFAIL);
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -648,12 +648,12 @@ inserted:
+ */
+ static noinline void update_existing_head_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *existing,
+- struct btrfs_delayed_ref_head *update,
+- int *old_ref_mod_ret)
++ struct btrfs_delayed_ref_head *update)
+ {
+ struct btrfs_delayed_ref_root *delayed_refs =
+ &trans->transaction->delayed_refs;
+ struct btrfs_fs_info *fs_info = trans->fs_info;
++ u64 flags = btrfs_ref_head_to_space_flags(existing);
+ int old_ref_mod;
+
+ BUG_ON(existing->is_data != update->is_data);
+@@ -701,8 +701,6 @@ static noinline void update_existing_hea
+ * currently, for refs we just added we know we're a-ok.
+ */
+ old_ref_mod = existing->total_ref_mod;
+- if (old_ref_mod_ret)
+- *old_ref_mod_ret = old_ref_mod;
+ existing->ref_mod += update->ref_mod;
+ existing->total_ref_mod += update->ref_mod;
+
+@@ -724,6 +722,22 @@ static noinline void update_existing_hea
+ trans->delayed_ref_updates += csum_leaves;
+ }
+ }
++
++ /*
++ * This handles the following conditions:
++ *
++ * 1. We had a ref mod of 0 or more and went negative, indicating that
++ * we may be freeing space, so add our space to the
++ * total_bytes_pinned counter.
++ * 2. We were negative and went to 0 or positive, so no longer can say
++ * that the space would be pinned, decrement our counter from the
++ * total_bytes_pinned counter.
++ */
++ if (existing->total_ref_mod < 0 && old_ref_mod >= 0)
++ btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes);
++ else if (existing->total_ref_mod >= 0 && old_ref_mod < 0)
++ btrfs_mod_total_bytes_pinned(fs_info, flags, -existing->num_bytes);
++
+ spin_unlock(&existing->lock);
+ }
+
+@@ -798,8 +812,7 @@ static noinline struct btrfs_delayed_ref
+ add_delayed_ref_head(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head_ref,
+ struct btrfs_qgroup_extent_record *qrecord,
+- int action, int *qrecord_inserted_ret,
+- int *old_ref_mod, int *new_ref_mod)
++ int action, int *qrecord_inserted_ret)
+ {
+ struct btrfs_delayed_ref_head *existing;
+ struct btrfs_delayed_ref_root *delayed_refs;
+@@ -821,8 +834,7 @@ add_delayed_ref_head(struct btrfs_trans_
+ existing = htree_insert(&delayed_refs->href_root,
+ &head_ref->href_node);
+ if (existing) {
+- update_existing_head_ref(trans, existing, head_ref,
+- old_ref_mod);
++ update_existing_head_ref(trans, existing, head_ref);
+ /*
+ * we've updated the existing ref, free the newly
+ * allocated ref
+@@ -830,14 +842,17 @@ add_delayed_ref_head(struct btrfs_trans_
+ kmem_cache_free(btrfs_delayed_ref_head_cachep, head_ref);
+ head_ref = existing;
+ } else {
+- if (old_ref_mod)
+- *old_ref_mod = 0;
++ u64 flags = btrfs_ref_head_to_space_flags(head_ref);
++
+ if (head_ref->is_data && head_ref->ref_mod < 0) {
+ delayed_refs->pending_csums += head_ref->num_bytes;
+ trans->delayed_ref_updates +=
+ btrfs_csum_bytes_to_leaves(trans->fs_info,
+ head_ref->num_bytes);
+ }
++ if (head_ref->ref_mod < 0)
++ btrfs_mod_total_bytes_pinned(trans->fs_info, flags,
++ head_ref->num_bytes);
+ delayed_refs->num_heads++;
+ delayed_refs->num_heads_ready++;
+ atomic_inc(&delayed_refs->num_entries);
+@@ -845,8 +860,6 @@ add_delayed_ref_head(struct btrfs_trans_
+ }
+ if (qrecord_inserted_ret)
+ *qrecord_inserted_ret = qrecord_inserted;
+- if (new_ref_mod)
+- *new_ref_mod = head_ref->total_ref_mod;
+
+ return head_ref;
+ }
+@@ -909,8 +922,7 @@ static void init_delayed_ref_common(stru
+ */
+ int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_ref *generic_ref,
+- struct btrfs_delayed_extent_op *extent_op,
+- int *old_ref_mod, int *new_ref_mod)
++ struct btrfs_delayed_extent_op *extent_op)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+ struct btrfs_delayed_tree_ref *ref;
+@@ -977,8 +989,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+ * the spin lock
+ */
+ head_ref = add_delayed_ref_head(trans, head_ref, record,
+- action, &qrecord_inserted,
+- old_ref_mod, new_ref_mod);
++ action, &qrecord_inserted);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node);
+ spin_unlock(&delayed_refs->lock);
+@@ -1006,8 +1017,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+ */
+ int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_ref *generic_ref,
+- u64 reserved, int *old_ref_mod,
+- int *new_ref_mod)
++ u64 reserved)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+ struct btrfs_delayed_data_ref *ref;
+@@ -1073,8 +1083,7 @@ int btrfs_add_delayed_data_ref(struct bt
+ * the spin lock
+ */
+ head_ref = add_delayed_ref_head(trans, head_ref, record,
+- action, &qrecord_inserted,
+- old_ref_mod, new_ref_mod);
++ action, &qrecord_inserted);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node);
+ spin_unlock(&delayed_refs->lock);
+@@ -1117,7 +1126,7 @@ int btrfs_add_delayed_extent_op(struct b
+ spin_lock(&delayed_refs->lock);
+
+ add_delayed_ref_head(trans, head_ref, NULL, BTRFS_UPDATE_DELAYED_HEAD,
+- NULL, NULL, NULL);
++ NULL);
+
+ spin_unlock(&delayed_refs->lock);
+
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -326,6 +326,16 @@ static inline void btrfs_put_delayed_ref
+ }
+ }
+
++static inline u64 btrfs_ref_head_to_space_flags(
++ struct btrfs_delayed_ref_head *head_ref)
++{
++ if (head_ref->is_data)
++ return BTRFS_BLOCK_GROUP_DATA;
++ else if (head_ref->is_system)
++ return BTRFS_BLOCK_GROUP_SYSTEM;
++ return BTRFS_BLOCK_GROUP_METADATA;
++}
++
+ static inline void btrfs_put_delayed_ref_head(struct btrfs_delayed_ref_head *head)
+ {
+ if (refcount_dec_and_test(&head->refs))
+@@ -334,12 +344,10 @@ static inline void btrfs_put_delayed_ref
+
+ int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_ref *generic_ref,
+- struct btrfs_delayed_extent_op *extent_op,
+- int *old_ref_mod, int *new_ref_mod);
++ struct btrfs_delayed_extent_op *extent_op);
+ int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_ref *generic_ref,
+- u64 reserved, int *old_ref_mod,
+- int *new_ref_mod);
++ u64 reserved);
+ int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans,
+ u64 bytenr, u64 num_bytes,
+ struct btrfs_delayed_extent_op *extent_op);
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -82,41 +82,6 @@ void btrfs_free_excluded_extents(struct
+ EXTENT_UPTODATE);
+ }
+
+-static u64 generic_ref_to_space_flags(struct btrfs_ref *ref)
+-{
+- if (ref->type == BTRFS_REF_METADATA) {
+- if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
+- return BTRFS_BLOCK_GROUP_SYSTEM;
+- else
+- return BTRFS_BLOCK_GROUP_METADATA;
+- }
+- return BTRFS_BLOCK_GROUP_DATA;
+-}
+-
+-static void add_pinned_bytes(struct btrfs_fs_info *fs_info,
+- struct btrfs_ref *ref)
+-{
+- struct btrfs_space_info *space_info;
+- u64 flags = generic_ref_to_space_flags(ref);
+-
+- space_info = btrfs_find_space_info(fs_info, flags);
+- ASSERT(space_info);
+- percpu_counter_add_batch(&space_info->total_bytes_pinned, ref->len,
+- BTRFS_TOTAL_BYTES_PINNED_BATCH);
+-}
+-
+-static void sub_pinned_bytes(struct btrfs_fs_info *fs_info,
+- struct btrfs_ref *ref)
+-{
+- struct btrfs_space_info *space_info;
+- u64 flags = generic_ref_to_space_flags(ref);
+-
+- space_info = btrfs_find_space_info(fs_info, flags);
+- ASSERT(space_info);
+- percpu_counter_add_batch(&space_info->total_bytes_pinned, -ref->len,
+- BTRFS_TOTAL_BYTES_PINNED_BATCH);
+-}
+-
+ /* simple helper to search for an existing data extent at a given offset */
+ int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len)
+ {
+@@ -1388,7 +1353,6 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ struct btrfs_ref *generic_ref)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- int old_ref_mod, new_ref_mod;
+ int ret;
+
+ ASSERT(generic_ref->type != BTRFS_REF_NOT_SET &&
+@@ -1397,17 +1361,12 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ generic_ref->tree_ref.root == BTRFS_TREE_LOG_OBJECTID);
+
+ if (generic_ref->type == BTRFS_REF_METADATA)
+- ret = btrfs_add_delayed_tree_ref(trans, generic_ref,
+- NULL, &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_tree_ref(trans, generic_ref, NULL);
+ else
+- ret = btrfs_add_delayed_data_ref(trans, generic_ref, 0,
+- &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_data_ref(trans, generic_ref, 0);
+
+ btrfs_ref_tree_mod(fs_info, generic_ref);
+
+- if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0)
+- sub_pinned_bytes(fs_info, generic_ref);
+-
+ return ret;
+ }
+
+@@ -1796,20 +1755,9 @@ void btrfs_cleanup_ref_head_accounting(s
+ int nr_items = 1; /* Dropping this ref head update. */
+
+ if (head->total_ref_mod < 0) {
+- struct btrfs_space_info *space_info;
+- u64 flags;
++ u64 flags = btrfs_ref_head_to_space_flags(head);
+
+- if (head->is_data)
+- flags = BTRFS_BLOCK_GROUP_DATA;
+- else if (head->is_system)
+- flags = BTRFS_BLOCK_GROUP_SYSTEM;
+- else
+- flags = BTRFS_BLOCK_GROUP_METADATA;
+- space_info = btrfs_find_space_info(fs_info, flags);
+- ASSERT(space_info);
+- percpu_counter_add_batch(&space_info->total_bytes_pinned,
+- -head->num_bytes,
+- BTRFS_TOTAL_BYTES_PINNED_BATCH);
++ btrfs_mod_total_bytes_pinned(fs_info, flags, -head->num_bytes);
+
+ /*
+ * We had csum deletions accounted for in our delayed refs rsv,
+@@ -2572,8 +2520,7 @@ static int pin_down_extent(struct btrfs_
+ spin_unlock(&cache->lock);
+ spin_unlock(&cache->space_info->lock);
+
+- percpu_counter_add_batch(&cache->space_info->total_bytes_pinned,
+- num_bytes, BTRFS_TOTAL_BYTES_PINNED_BATCH);
++ __btrfs_mod_total_bytes_pinned(cache->space_info, num_bytes);
+ set_extent_dirty(&trans->transaction->pinned_extents, bytenr,
+ bytenr + num_bytes - 1, GFP_NOFS | __GFP_NOFAIL);
+ return 0;
+@@ -2784,8 +2731,7 @@ static int unpin_extent_range(struct btr
+ cache->pinned -= len;
+ btrfs_space_info_update_bytes_pinned(fs_info, space_info, -len);
+ space_info->max_extent_size = 0;
+- percpu_counter_add_batch(&space_info->total_bytes_pinned,
+- -len, BTRFS_TOTAL_BYTES_PINNED_BATCH);
++ __btrfs_mod_total_bytes_pinned(space_info, -len);
+ if (cache->ro) {
+ space_info->bytes_readonly += len;
+ readonly = true;
+@@ -3318,7 +3264,6 @@ void btrfs_free_tree_block(struct btrfs_
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct btrfs_ref generic_ref = { 0 };
+- int pin = 1;
+ int ret;
+
+ btrfs_init_generic_ref(&generic_ref, BTRFS_DROP_DELAYED_REF,
+@@ -3327,13 +3272,9 @@ void btrfs_free_tree_block(struct btrfs_
+ root->root_key.objectid);
+
+ if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) {
+- int old_ref_mod, new_ref_mod;
+-
+ btrfs_ref_tree_mod(fs_info, &generic_ref);
+- ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL,
+- &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL);
+ BUG_ON(ret); /* -ENOMEM */
+- pin = old_ref_mod >= 0 && new_ref_mod < 0;
+ }
+
+ if (last_ref && btrfs_header_generation(buf) == trans->transid) {
+@@ -3345,7 +3286,6 @@ void btrfs_free_tree_block(struct btrfs_
+ goto out;
+ }
+
+- pin = 0;
+ cache = btrfs_lookup_block_group(fs_info, buf->start);
+
+ if (btrfs_header_flag(buf, BTRFS_HEADER_FLAG_WRITTEN)) {
+@@ -3362,9 +3302,6 @@ void btrfs_free_tree_block(struct btrfs_
+ trace_btrfs_reserved_extent_free(fs_info, buf->start, buf->len);
+ }
+ out:
+- if (pin)
+- add_pinned_bytes(fs_info, &generic_ref);
+-
+ if (last_ref) {
+ /*
+ * Deleting the buffer, clear the corrupt flag since it doesn't
+@@ -3378,7 +3315,6 @@ out:
+ int btrfs_free_extent(struct btrfs_trans_handle *trans, struct btrfs_ref *ref)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- int old_ref_mod, new_ref_mod;
+ int ret;
+
+ if (btrfs_is_testing(fs_info))
+@@ -3394,14 +3330,11 @@ int btrfs_free_extent(struct btrfs_trans
+ ref->data_ref.ref_root == BTRFS_TREE_LOG_OBJECTID)) {
+ /* unlocks the pinned mutex */
+ btrfs_pin_extent(trans, ref->bytenr, ref->len, 1);
+- old_ref_mod = new_ref_mod = 0;
+ ret = 0;
+ } else if (ref->type == BTRFS_REF_METADATA) {
+- ret = btrfs_add_delayed_tree_ref(trans, ref, NULL,
+- &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_tree_ref(trans, ref, NULL);
+ } else {
+- ret = btrfs_add_delayed_data_ref(trans, ref, 0,
+- &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_data_ref(trans, ref, 0);
+ }
+
+ if (!((ref->type == BTRFS_REF_METADATA &&
+@@ -3410,9 +3343,6 @@ int btrfs_free_extent(struct btrfs_trans
+ ref->data_ref.ref_root == BTRFS_TREE_LOG_OBJECTID)))
+ btrfs_ref_tree_mod(fs_info, ref);
+
+- if (ret == 0 && old_ref_mod >= 0 && new_ref_mod < 0)
+- add_pinned_bytes(fs_info, ref);
+-
+ return ret;
+ }
+
+@@ -4528,7 +4458,6 @@ int btrfs_alloc_reserved_file_extent(str
+ struct btrfs_key *ins)
+ {
+ struct btrfs_ref generic_ref = { 0 };
+- int ret;
+
+ BUG_ON(root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID);
+
+@@ -4536,9 +4465,8 @@ int btrfs_alloc_reserved_file_extent(str
+ ins->objectid, ins->offset, 0);
+ btrfs_init_data_ref(&generic_ref, root->root_key.objectid, owner, offset);
+ btrfs_ref_tree_mod(root->fs_info, &generic_ref);
+- ret = btrfs_add_delayed_data_ref(trans, &generic_ref,
+- ram_bytes, NULL, NULL);
+- return ret;
++
++ return btrfs_add_delayed_data_ref(trans, &generic_ref, ram_bytes);
+ }
+
+ /*
+@@ -4730,8 +4658,7 @@ struct extent_buffer *btrfs_alloc_tree_b
+ generic_ref.real_root = root->root_key.objectid;
+ btrfs_init_tree_ref(&generic_ref, level, root_objectid);
+ btrfs_ref_tree_mod(fs_info, &generic_ref);
+- ret = btrfs_add_delayed_tree_ref(trans, &generic_ref,
+- extent_op, NULL, NULL);
++ ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, extent_op);
+ if (ret)
+ goto out_free_delayed;
+ }
+--- a/fs/btrfs/space-info.h
++++ b/fs/btrfs/space-info.h
+@@ -152,4 +152,21 @@ static inline void btrfs_space_info_free
+ int btrfs_reserve_data_bytes(struct btrfs_fs_info *fs_info, u64 bytes,
+ enum btrfs_reserve_flush_enum flush);
+
++static inline void __btrfs_mod_total_bytes_pinned(
++ struct btrfs_space_info *space_info,
++ s64 mod)
++{
++ percpu_counter_add_batch(&space_info->total_bytes_pinned, mod,
++ BTRFS_TOTAL_BYTES_PINNED_BATCH);
++}
++
++static inline void btrfs_mod_total_bytes_pinned(struct btrfs_fs_info *fs_info,
++ u64 flags, s64 mod)
++{
++ struct btrfs_space_info *space_info = btrfs_find_space_info(fs_info, flags);
++
++ ASSERT(space_info);
++ __btrfs_mod_total_bytes_pinned(space_info, mod);
++}
++
+ #endif /* BTRFS_SPACE_INFO_H */
--- /dev/null
+From 938fcbfb0cbcf532a1869efab58e6009446b1ced Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Thu, 14 Jan 2021 14:02:43 -0500
+Subject: btrfs: splice remaining dirty_bg's onto the transaction dirty bg list
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 938fcbfb0cbcf532a1869efab58e6009446b1ced upstream.
+
+While doing error injection testing with my relocation patches I hit the
+following assert:
+
+ assertion failed: list_empty(&block_group->dirty_list), in fs/btrfs/block-group.c:3356
+ ------------[ cut here ]------------
+ kernel BUG at fs/btrfs/ctree.h:3357!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 0 PID: 24351 Comm: umount Tainted: G W 5.10.0-rc3+ #193
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
+ RIP: 0010:assertfail.constprop.0+0x18/0x1a
+ RSP: 0018:ffffa09b019c7e00 EFLAGS: 00010282
+ RAX: 0000000000000056 RBX: ffff8f6492c18000 RCX: 0000000000000000
+ RDX: ffff8f64fbc27c60 RSI: ffff8f64fbc19050 RDI: ffff8f64fbc19050
+ RBP: ffff8f6483bbdc00 R08: 0000000000000000 R09: 0000000000000000
+ R10: ffffa09b019c7c38 R11: ffffffff85d70928 R12: ffff8f6492c18100
+ R13: ffff8f6492c18148 R14: ffff8f6483bbdd70 R15: dead000000000100
+ FS: 00007fbfda4cdc40(0000) GS:ffff8f64fbc00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007fbfda666fd0 CR3: 000000013cf66002 CR4: 0000000000370ef0
+ Call Trace:
+ btrfs_free_block_groups.cold+0x55/0x55
+ close_ctree+0x2c5/0x306
+ ? fsnotify_destroy_marks+0x14/0x100
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20
+ deactivate_locked_super+0x36/0xa0
+ cleanup_mnt+0x12d/0x190
+ task_work_run+0x5c/0xa0
+ exit_to_user_mode_prepare+0x1b1/0x1d0
+ syscall_exit_to_user_mode+0x54/0x280
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+This happened because I injected an error in btrfs_cow_block() while
+running the dirty block groups. When we run the dirty block groups, we
+splice the list onto a local list to process. However if an error
+occurs, we only cleanup the transactions dirty block group list, not any
+pending block groups we have on our locally spliced list.
+
+In fact if we fail to allocate a path in this function we'll also fail
+to clean up the splice list.
+
+Fix this by splicing the list back onto the transaction dirty block
+group list so that the block groups are cleaned up. Then add a 'out'
+label and have the error conditions jump to out so that the errors are
+handled properly. This also has the side-effect of fixing a problem
+where we would clear 'ret' on error because we unconditionally ran
+btrfs_run_delayed_refs().
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -2564,8 +2564,10 @@ again:
+
+ if (!path) {
+ path = btrfs_alloc_path();
+- if (!path)
+- return -ENOMEM;
++ if (!path) {
++ ret = -ENOMEM;
++ goto out;
++ }
+ }
+
+ /*
+@@ -2659,16 +2661,14 @@ again:
+ btrfs_put_block_group(cache);
+ if (drop_reserve)
+ btrfs_delayed_refs_rsv_release(fs_info, 1);
+-
+- if (ret)
+- break;
+-
+ /*
+ * Avoid blocking other tasks for too long. It might even save
+ * us from writing caches for block groups that are going to be
+ * removed.
+ */
+ mutex_unlock(&trans->transaction->cache_write_mutex);
++ if (ret)
++ goto out;
+ mutex_lock(&trans->transaction->cache_write_mutex);
+ }
+ mutex_unlock(&trans->transaction->cache_write_mutex);
+@@ -2692,7 +2692,12 @@ again:
+ goto again;
+ }
+ spin_unlock(&cur_trans->dirty_bgs_lock);
+- } else if (ret < 0) {
++ }
++out:
++ if (ret < 0) {
++ spin_lock(&cur_trans->dirty_bgs_lock);
++ list_splice_init(&dirty, &cur_trans->dirty_bgs);
++ spin_unlock(&cur_trans->dirty_bgs_lock);
+ btrfs_cleanup_dirty_bgs(cur_trans, fs_info);
+ }
+
--- /dev/null
+From 538b0188da4653b9f4511a114f014354fb6fb7a5 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Mon, 15 Feb 2021 20:24:46 +0100
+Subject: cpufreq: ACPI: Set cpuinfo.max_freq directly if max boost is known
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 538b0188da4653b9f4511a114f014354fb6fb7a5 upstream.
+
+Commit 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover
+boost frequencies") attempted to address a performance issue involving
+acpi-cpufreq, the schedutil governor and scale-invariance on x86 by
+extending the frequency tables created by acpi-cpufreq to cover the
+entire range of "turbo" (or "boost") frequencies, but that caused
+frequencies reported via /proc/cpuinfo and the scaling_cur_freq
+attribute in sysfs to change which may confuse users and monitoring
+tools.
+
+For this reason, revert the part of commit 3c55e94c0ade adding the
+extra entry to the frequency table and use the observation that
+in principle cpuinfo.max_freq need not be equal to the maximum
+frequency listed in the frequency table for the given policy.
+
+Namely, modify cpufreq_frequency_table_cpuinfo() to allow cpufreq
+drivers to set their own cpuinfo.max_freq above that frequency and
+change acpi-cpufreq to set cpuinfo.max_freq to the maximum boost
+frequency found via CPPC.
+
+This should be sufficient to let all of the cpufreq subsystem know
+the real maximum frequency of the CPU without changing frequency
+reporting.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=211305
+Fixes: 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover boost frequencies")
+Reported-by: Matt McDonald <gardotd426@gmail.com>
+Tested-by: Matt McDonald <gardotd426@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Tested-by: Giovanni Gherdovich <ggherdovich@suse.cz>
+Tested-by: Michael Larabel <Michael@phoronix.com>
+Cc: 5.11+ <stable@vger.kernel.org> # 5.11+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cpufreq/acpi-cpufreq.c | 62 ++++++++++-------------------------------
+ drivers/cpufreq/freq_table.c | 8 ++++-
+ 2 files changed, 23 insertions(+), 47 deletions(-)
+
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -54,7 +54,6 @@ struct acpi_cpufreq_data {
+ unsigned int resume;
+ unsigned int cpu_feature;
+ unsigned int acpi_perf_cpu;
+- unsigned int first_perf_state;
+ cpumask_var_t freqdomain_cpus;
+ void (*cpu_freq_write)(struct acpi_pct_register *reg, u32 val);
+ u32 (*cpu_freq_read)(struct acpi_pct_register *reg);
+@@ -223,10 +222,10 @@ static unsigned extract_msr(struct cpufr
+
+ perf = to_perf_data(data);
+
+- cpufreq_for_each_entry(pos, policy->freq_table + data->first_perf_state)
++ cpufreq_for_each_entry(pos, policy->freq_table)
+ if (msr == perf->states[pos->driver_data].status)
+ return pos->frequency;
+- return policy->freq_table[data->first_perf_state].frequency;
++ return policy->freq_table[0].frequency;
+ }
+
+ static unsigned extract_freq(struct cpufreq_policy *policy, u32 val)
+@@ -365,7 +364,6 @@ static unsigned int get_cur_freq_on_cpu(
+ struct cpufreq_policy *policy;
+ unsigned int freq;
+ unsigned int cached_freq;
+- unsigned int state;
+
+ pr_debug("%s (%d)\n", __func__, cpu);
+
+@@ -377,11 +375,7 @@ static unsigned int get_cur_freq_on_cpu(
+ if (unlikely(!data || !policy->freq_table))
+ return 0;
+
+- state = to_perf_data(data)->state;
+- if (state < data->first_perf_state)
+- state = data->first_perf_state;
+-
+- cached_freq = policy->freq_table[state].frequency;
++ cached_freq = policy->freq_table[to_perf_data(data)->state].frequency;
+ freq = extract_freq(policy, get_cur_val(cpumask_of(cpu), data));
+ if (freq != cached_freq) {
+ /*
+@@ -680,7 +674,6 @@ static int acpi_cpufreq_cpu_init(struct
+ struct cpuinfo_x86 *c = &cpu_data(cpu);
+ unsigned int valid_states = 0;
+ unsigned int result = 0;
+- unsigned int state_count;
+ u64 max_boost_ratio;
+ unsigned int i;
+ #ifdef CONFIG_SMP
+@@ -795,28 +788,8 @@ static int acpi_cpufreq_cpu_init(struct
+ goto err_unreg;
+ }
+
+- state_count = perf->state_count + 1;
+-
+- max_boost_ratio = get_max_boost_ratio(cpu);
+- if (max_boost_ratio) {
+- /*
+- * Make a room for one more entry to represent the highest
+- * available "boost" frequency.
+- */
+- state_count++;
+- valid_states++;
+- data->first_perf_state = valid_states;
+- } else {
+- /*
+- * If the maximum "boost" frequency is unknown, ask the arch
+- * scale-invariance code to use the "nominal" performance for
+- * CPU utilization scaling so as to prevent the schedutil
+- * governor from selecting inadequate CPU frequencies.
+- */
+- arch_set_max_freq_ratio(true);
+- }
+-
+- freq_table = kcalloc(state_count, sizeof(*freq_table), GFP_KERNEL);
++ freq_table = kcalloc(perf->state_count + 1, sizeof(*freq_table),
++ GFP_KERNEL);
+ if (!freq_table) {
+ result = -ENOMEM;
+ goto err_unreg;
+@@ -851,27 +824,25 @@ static int acpi_cpufreq_cpu_init(struct
+ }
+ freq_table[valid_states].frequency = CPUFREQ_TABLE_END;
+
++ max_boost_ratio = get_max_boost_ratio(cpu);
+ if (max_boost_ratio) {
+- unsigned int state = data->first_perf_state;
+- unsigned int freq = freq_table[state].frequency;
++ unsigned int freq = freq_table[0].frequency;
+
+ /*
+ * Because the loop above sorts the freq_table entries in the
+ * descending order, freq is the maximum frequency in the table.
+ * Assume that it corresponds to the CPPC nominal frequency and
+- * use it to populate the frequency field of the extra "boost"
+- * frequency entry.
++ * use it to set cpuinfo.max_freq.
+ */
+- freq_table[0].frequency = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT;
++ policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT;
++ } else {
+ /*
+- * The purpose of the extra "boost" frequency entry is to make
+- * the rest of cpufreq aware of the real maximum frequency, but
+- * the way to request it is the same as for the first_perf_state
+- * entry that is expected to cover the entire range of "boost"
+- * frequencies of the CPU, so copy the driver_data value from
+- * that entry.
++ * If the maximum "boost" frequency is unknown, ask the arch
++ * scale-invariance code to use the "nominal" performance for
++ * CPU utilization scaling so as to prevent the schedutil
++ * governor from selecting inadequate CPU frequencies.
+ */
+- freq_table[0].driver_data = freq_table[state].driver_data;
++ arch_set_max_freq_ratio(true);
+ }
+
+ policy->freq_table = freq_table;
+@@ -947,8 +918,7 @@ static void acpi_cpufreq_cpu_ready(struc
+ {
+ struct acpi_processor_performance *perf = per_cpu_ptr(acpi_perf_data,
+ policy->cpu);
+- struct acpi_cpufreq_data *data = policy->driver_data;
+- unsigned int freq = policy->freq_table[data->first_perf_state].frequency;
++ unsigned int freq = policy->freq_table[0].frequency;
+
+ if (perf->states[0].core_frequency * 1000 != freq)
+ pr_warn(FW_WARN "P-state 0 is not max freq\n");
+--- a/drivers/cpufreq/freq_table.c
++++ b/drivers/cpufreq/freq_table.c
+@@ -52,7 +52,13 @@ int cpufreq_frequency_table_cpuinfo(stru
+ }
+
+ policy->min = policy->cpuinfo.min_freq = min_freq;
+- policy->max = policy->cpuinfo.max_freq = max_freq;
++ policy->max = max_freq;
++ /*
++ * If the driver has set its own cpuinfo.max_freq above max_freq, leave
++ * it as is.
++ */
++ if (policy->cpuinfo.max_freq < max_freq)
++ policy->max = policy->cpuinfo.max_freq = max_freq;
+
+ if (policy->min == ~0)
+ return -EINVAL;
--- /dev/null
+From a13ed1d15b07a04b1f74b2df61ff7a5e47f45dd8 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 4 Jan 2021 16:55:46 +0100
+Subject: crypto: aesni - prevent misaligned buffers on the stack
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit a13ed1d15b07a04b1f74b2df61ff7a5e47f45dd8 upstream.
+
+The GCM mode driver uses 16 byte aligned buffers on the stack to pass
+the IV to the asm helpers, but unfortunately, the x86 port does not
+guarantee that the stack pointer is 16 byte aligned upon entry in the
+first place. Since the compiler is not aware of this, it will not emit
+the additional stack realignment sequence that is needed, and so the
+alignment is not guaranteed to be more than 8 bytes.
+
+So instead, allocate some padding on the stack, and realign the IV
+pointer by hand.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/crypto/aesni-intel_glue.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -686,7 +686,8 @@ static int gcmaes_crypt_by_sg(bool enc,
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ unsigned long auth_tag_len = crypto_aead_authsize(tfm);
+ const struct aesni_gcm_tfm_s *gcm_tfm = aesni_gcm_tfm;
+- struct gcm_context_data data AESNI_ALIGN_ATTR;
++ u8 databuf[sizeof(struct gcm_context_data) + (AESNI_ALIGN - 8)] __aligned(8);
++ struct gcm_context_data *data = PTR_ALIGN((void *)databuf, AESNI_ALIGN);
+ struct scatter_walk dst_sg_walk = {};
+ unsigned long left = req->cryptlen;
+ unsigned long len, srclen, dstlen;
+@@ -735,8 +736,7 @@ static int gcmaes_crypt_by_sg(bool enc,
+ }
+
+ kernel_fpu_begin();
+- gcm_tfm->init(aes_ctx, &data, iv,
+- hash_subkey, assoc, assoclen);
++ gcm_tfm->init(aes_ctx, data, iv, hash_subkey, assoc, assoclen);
+ if (req->src != req->dst) {
+ while (left) {
+ src = scatterwalk_map(&src_sg_walk);
+@@ -746,10 +746,10 @@ static int gcmaes_crypt_by_sg(bool enc,
+ len = min(srclen, dstlen);
+ if (len) {
+ if (enc)
+- gcm_tfm->enc_update(aes_ctx, &data,
++ gcm_tfm->enc_update(aes_ctx, data,
+ dst, src, len);
+ else
+- gcm_tfm->dec_update(aes_ctx, &data,
++ gcm_tfm->dec_update(aes_ctx, data,
+ dst, src, len);
+ }
+ left -= len;
+@@ -767,10 +767,10 @@ static int gcmaes_crypt_by_sg(bool enc,
+ len = scatterwalk_clamp(&src_sg_walk, left);
+ if (len) {
+ if (enc)
+- gcm_tfm->enc_update(aes_ctx, &data,
++ gcm_tfm->enc_update(aes_ctx, data,
+ src, src, len);
+ else
+- gcm_tfm->dec_update(aes_ctx, &data,
++ gcm_tfm->dec_update(aes_ctx, data,
+ src, src, len);
+ }
+ left -= len;
+@@ -779,7 +779,7 @@ static int gcmaes_crypt_by_sg(bool enc,
+ scatterwalk_done(&src_sg_walk, 1, left);
+ }
+ }
+- gcm_tfm->finalize(aes_ctx, &data, authTag, auth_tag_len);
++ gcm_tfm->finalize(aes_ctx, data, authTag, auth_tag_len);
+ kernel_fpu_end();
+
+ if (!assocmem)
+@@ -828,7 +828,8 @@ static int helper_rfc4106_encrypt(struct
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
+ void *aes_ctx = &(ctx->aes_key_expanded);
+- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8);
++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN);
+ unsigned int i;
+ __be32 counter = cpu_to_be32(1);
+
+@@ -855,7 +856,8 @@ static int helper_rfc4106_decrypt(struct
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm);
+ void *aes_ctx = &(ctx->aes_key_expanded);
+- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8);
++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN);
+ unsigned int i;
+
+ if (unlikely(req->assoclen != 16 && req->assoclen != 20))
+@@ -985,7 +987,8 @@ static int generic_gcmaes_encrypt(struct
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct generic_gcmaes_ctx *ctx = generic_gcmaes_ctx_get(tfm);
+ void *aes_ctx = &(ctx->aes_key_expanded);
+- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8);
++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN);
+ __be32 counter = cpu_to_be32(1);
+
+ memcpy(iv, req->iv, 12);
+@@ -1001,7 +1004,8 @@ static int generic_gcmaes_decrypt(struct
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ struct generic_gcmaes_ctx *ctx = generic_gcmaes_ctx_get(tfm);
+ void *aes_ctx = &(ctx->aes_key_expanded);
+- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN)));
++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8);
++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN);
+
+ memcpy(iv, req->iv, 12);
+ *((__be32 *)(iv+12)) = counter;
--- /dev/null
+From 0df07d8117c3576f1603b05b84089742a118d10a Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Thu, 14 Jan 2021 19:10:10 +0100
+Subject: crypto: arm64/sha - add missing module aliases
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 0df07d8117c3576f1603b05b84089742a118d10a upstream.
+
+The accelerated, instruction based implementations of SHA1, SHA2 and
+SHA3 are autoloaded based on CPU capabilities, given that the code is
+modest in size, and widely used, which means that resolving the algo
+name, loading all compatible modules and picking the one with the
+highest priority is taken to be suboptimal.
+
+However, if these algorithms are requested before this CPU feature
+based matching and autoloading occurs, these modules are not even
+considered, and we end up with suboptimal performance.
+
+So add the missing module aliases for the various SHA implementations.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/crypto/sha1-ce-glue.c | 1 +
+ arch/arm64/crypto/sha2-ce-glue.c | 2 ++
+ arch/arm64/crypto/sha3-ce-glue.c | 4 ++++
+ arch/arm64/crypto/sha512-ce-glue.c | 2 ++
+ 4 files changed, 9 insertions(+)
+
+--- a/arch/arm64/crypto/sha1-ce-glue.c
++++ b/arch/arm64/crypto/sha1-ce-glue.c
+@@ -19,6 +19,7 @@
+ MODULE_DESCRIPTION("SHA1 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha1");
+
+ struct sha1_ce_state {
+ struct sha1_state sst;
+--- a/arch/arm64/crypto/sha2-ce-glue.c
++++ b/arch/arm64/crypto/sha2-ce-glue.c
+@@ -19,6 +19,8 @@
+ MODULE_DESCRIPTION("SHA-224/SHA-256 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha224");
++MODULE_ALIAS_CRYPTO("sha256");
+
+ struct sha256_ce_state {
+ struct sha256_state sst;
+--- a/arch/arm64/crypto/sha3-ce-glue.c
++++ b/arch/arm64/crypto/sha3-ce-glue.c
+@@ -23,6 +23,10 @@
+ MODULE_DESCRIPTION("SHA3 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha3-224");
++MODULE_ALIAS_CRYPTO("sha3-256");
++MODULE_ALIAS_CRYPTO("sha3-384");
++MODULE_ALIAS_CRYPTO("sha3-512");
+
+ asmlinkage void sha3_ce_transform(u64 *st, const u8 *data, int blocks,
+ int md_len);
+--- a/arch/arm64/crypto/sha512-ce-glue.c
++++ b/arch/arm64/crypto/sha512-ce-glue.c
+@@ -23,6 +23,8 @@
+ MODULE_DESCRIPTION("SHA-384/SHA-512 secure hash using ARMv8 Crypto Extensions");
+ MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>");
+ MODULE_LICENSE("GPL v2");
++MODULE_ALIAS_CRYPTO("sha384");
++MODULE_ALIAS_CRYPTO("sha512");
+
+ asmlinkage void sha512_ce_transform(struct sha512_state *sst, u8 const *src,
+ int blocks);
--- /dev/null
+From e1b2d980f03b833442768c1987d5ad0b9a58cfe7 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 1 Feb 2021 19:02:29 +0100
+Subject: crypto: michael_mic - fix broken misalignment handling
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit e1b2d980f03b833442768c1987d5ad0b9a58cfe7 upstream.
+
+The Michael MIC driver uses the cra_alignmask to ensure that pointers
+presented to its update and finup/final methods are 32-bit aligned.
+However, due to the way the shash API works, this is no guarantee that
+the 32-bit reads occurring in the update method are also aligned, as the
+size of the buffer presented to update may be of uneven length. For
+instance, an update() of 3 bytes followed by a misaligned update() of 4
+or more bytes will result in a misaligned access using an accessor that
+is not suitable for this.
+
+On most architectures, this does not matter, and so setting the
+cra_alignmask is pointless. On architectures where this does matter,
+setting the cra_alignmask does not actually solve the problem.
+
+So let's get rid of the cra_alignmask, and use unaligned accessors
+instead, where appropriate.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ crypto/michael_mic.c | 31 ++++++++++++-------------------
+ 1 file changed, 12 insertions(+), 19 deletions(-)
+
+--- a/crypto/michael_mic.c
++++ b/crypto/michael_mic.c
+@@ -7,7 +7,7 @@
+ * Copyright (c) 2004 Jouni Malinen <j@w1.fi>
+ */
+ #include <crypto/internal/hash.h>
+-#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/string.h>
+@@ -19,7 +19,7 @@ struct michael_mic_ctx {
+ };
+
+ struct michael_mic_desc_ctx {
+- u8 pending[4];
++ __le32 pending;
+ size_t pending_len;
+
+ u32 l, r;
+@@ -60,13 +60,12 @@ static int michael_update(struct shash_d
+ unsigned int len)
+ {
+ struct michael_mic_desc_ctx *mctx = shash_desc_ctx(desc);
+- const __le32 *src;
+
+ if (mctx->pending_len) {
+ int flen = 4 - mctx->pending_len;
+ if (flen > len)
+ flen = len;
+- memcpy(&mctx->pending[mctx->pending_len], data, flen);
++ memcpy((u8 *)&mctx->pending + mctx->pending_len, data, flen);
+ mctx->pending_len += flen;
+ data += flen;
+ len -= flen;
+@@ -74,23 +73,21 @@ static int michael_update(struct shash_d
+ if (mctx->pending_len < 4)
+ return 0;
+
+- src = (const __le32 *)mctx->pending;
+- mctx->l ^= le32_to_cpup(src);
++ mctx->l ^= le32_to_cpu(mctx->pending);
+ michael_block(mctx->l, mctx->r);
+ mctx->pending_len = 0;
+ }
+
+- src = (const __le32 *)data;
+-
+ while (len >= 4) {
+- mctx->l ^= le32_to_cpup(src++);
++ mctx->l ^= get_unaligned_le32(data);
+ michael_block(mctx->l, mctx->r);
++ data += 4;
+ len -= 4;
+ }
+
+ if (len > 0) {
+ mctx->pending_len = len;
+- memcpy(mctx->pending, src, len);
++ memcpy(&mctx->pending, data, len);
+ }
+
+ return 0;
+@@ -100,8 +97,7 @@ static int michael_update(struct shash_d
+ static int michael_final(struct shash_desc *desc, u8 *out)
+ {
+ struct michael_mic_desc_ctx *mctx = shash_desc_ctx(desc);
+- u8 *data = mctx->pending;
+- __le32 *dst = (__le32 *)out;
++ u8 *data = (u8 *)&mctx->pending;
+
+ /* Last block and padding (0x5a, 4..7 x 0) */
+ switch (mctx->pending_len) {
+@@ -123,8 +119,8 @@ static int michael_final(struct shash_de
+ /* l ^= 0; */
+ michael_block(mctx->l, mctx->r);
+
+- dst[0] = cpu_to_le32(mctx->l);
+- dst[1] = cpu_to_le32(mctx->r);
++ put_unaligned_le32(mctx->l, out);
++ put_unaligned_le32(mctx->r, out + 4);
+
+ return 0;
+ }
+@@ -135,13 +131,11 @@ static int michael_setkey(struct crypto_
+ {
+ struct michael_mic_ctx *mctx = crypto_shash_ctx(tfm);
+
+- const __le32 *data = (const __le32 *)key;
+-
+ if (keylen != 8)
+ return -EINVAL;
+
+- mctx->l = le32_to_cpu(data[0]);
+- mctx->r = le32_to_cpu(data[1]);
++ mctx->l = get_unaligned_le32(key);
++ mctx->r = get_unaligned_le32(key + 4);
+ return 0;
+ }
+
+@@ -156,7 +150,6 @@ static struct shash_alg alg = {
+ .cra_name = "michael_mic",
+ .cra_driver_name = "michael_mic-generic",
+ .cra_blocksize = 8,
+- .cra_alignmask = 3,
+ .cra_ctxsize = sizeof(struct michael_mic_ctx),
+ .cra_module = THIS_MODULE,
+ }
--- /dev/null
+From 7bdcd851fa7eb66e8922aa7f6cba9e2f2427a7cf Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 14 Dec 2020 20:02:26 +0000
+Subject: crypto: sun4i-ss - checking sg length is not sufficient
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+commit 7bdcd851fa7eb66e8922aa7f6cba9e2f2427a7cf upstream.
+
+The optimized cipher function need length multiple of 4 bytes.
+But it get sometimes odd length.
+This is due to SG data could be stored with an offset.
+
+So the fix is to check also if the offset is aligned with 4 bytes.
+Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -201,12 +201,12 @@ static int sun4i_ss_cipher_poll(struct s
+ * we can use the SS optimized function
+ */
+ while (in_sg && no_chunk == 1) {
+- if (in_sg->length % 4)
++ if ((in_sg->length | in_sg->offset) & 3u)
+ no_chunk = 0;
+ in_sg = sg_next(in_sg);
+ }
+ while (out_sg && no_chunk == 1) {
+- if (out_sg->length % 4)
++ if ((out_sg->length | out_sg->offset) & 3u)
+ no_chunk = 0;
+ out_sg = sg_next(out_sg);
+ }
--- /dev/null
+From 5ab6177fa02df15cd8a02a1f1fb361d2d5d8b946 Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 14 Dec 2020 20:02:28 +0000
+Subject: crypto: sun4i-ss - handle BigEndian for cipher
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+commit 5ab6177fa02df15cd8a02a1f1fb361d2d5d8b946 upstream.
+
+Ciphers produce invalid results on BE.
+Key and IV need to be written in LE.
+
+Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -54,13 +54,13 @@ static int noinline_for_stack sun4i_ss_o
+
+ spin_lock_irqsave(&ss->slock, flags);
+
+- for (i = 0; i < op->keylen; i += 4)
+- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i);
++ for (i = 0; i < op->keylen / 4; i++)
++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1);
+
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+ v = *(u32 *)(areq->iv + i * 4);
+- writel(v, ss->base + SS_IV0 + i * 4);
++ writesl(ss->base + SS_IV0 + i * 4, &v, 1);
+ }
+ }
+ writel(mode, ss->base + SS_CTL);
+@@ -238,13 +238,13 @@ static int sun4i_ss_cipher_poll(struct s
+
+ spin_lock_irqsave(&ss->slock, flags);
+
+- for (i = 0; i < op->keylen; i += 4)
+- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i);
++ for (i = 0; i < op->keylen / 4; i++)
++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1);
+
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+ v = *(u32 *)(areq->iv + i * 4);
+- writel(v, ss->base + SS_IV0 + i * 4);
++ writesl(ss->base + SS_IV0 + i * 4, &v, 1);
+ }
+ }
+ writel(mode, ss->base + SS_CTL);
--- /dev/null
+From 4ec8977b921fd9d512701e009ce8082cb94b5c1c Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 14 Dec 2020 20:02:29 +0000
+Subject: crypto: sun4i-ss - initialize need_fallback
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+commit 4ec8977b921fd9d512701e009ce8082cb94b5c1c upstream.
+
+The need_fallback is never initialized and seem to be always true at runtime.
+So all hardware operations are always bypassed.
+
+Fixes: 0ae1f46c55f87 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -194,7 +194,7 @@ static int sun4i_ss_cipher_poll(struct s
+ unsigned int obo = 0; /* offset in bufo*/
+ unsigned int obl = 0; /* length of data in bufo */
+ unsigned long flags;
+- bool need_fallback;
++ bool need_fallback = false;
+
+ if (!areq->cryptlen)
+ return 0;
--- /dev/null
+From b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Mon, 14 Dec 2020 20:02:27 +0000
+Subject: crypto: sun4i-ss - IV register does not work on A10 and A13
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+commit b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 upstream.
+
+Allwinner A10 and A13 SoC have a version of the SS which produce
+invalid IV in IVx register.
+
+Instead of adding a variant for those, let's convert SS to produce IV
+directly from data.
+Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 34 ++++++++++++++++----
+ 1 file changed, 28 insertions(+), 6 deletions(-)
+
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -20,6 +20,7 @@ static int noinline_for_stack sun4i_ss_o
+ unsigned int ivsize = crypto_skcipher_ivsize(tfm);
+ struct sun4i_cipher_req_ctx *ctx = skcipher_request_ctx(areq);
+ u32 mode = ctx->mode;
++ void *backup_iv = NULL;
+ /* when activating SS, the default FIFO space is SS_RX_DEFAULT(32) */
+ u32 rx_cnt = SS_RX_DEFAULT;
+ u32 tx_cnt = 0;
+@@ -44,6 +45,13 @@ static int noinline_for_stack sun4i_ss_o
+ return -EINVAL;
+ }
+
++ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
++ backup_iv = kzalloc(ivsize, GFP_KERNEL);
++ if (!backup_iv)
++ return -ENOMEM;
++ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
++ }
++
+ spin_lock_irqsave(&ss->slock, flags);
+
+ for (i = 0; i < op->keylen; i += 4)
+@@ -117,9 +125,12 @@ static int noinline_for_stack sun4i_ss_o
+ } while (oleft);
+
+ if (areq->iv) {
+- for (i = 0; i < 4 && i < ivsize / 4; i++) {
+- v = readl(ss->base + SS_IV0 + i * 4);
+- *(u32 *)(areq->iv + i * 4) = v;
++ if (mode & SS_DECRYPTION) {
++ memcpy(areq->iv, backup_iv, ivsize);
++ kfree_sensitive(backup_iv);
++ } else {
++ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
++ ivsize, 0);
+ }
+ }
+
+@@ -174,6 +185,7 @@ static int sun4i_ss_cipher_poll(struct s
+ unsigned int ileft = areq->cryptlen;
+ unsigned int oleft = areq->cryptlen;
+ unsigned int todo;
++ void *backup_iv = NULL;
+ struct sg_mapping_iter mi, mo;
+ unsigned long pi = 0, po = 0; /* progress for in and out */
+ bool miter_err;
+@@ -217,6 +229,13 @@ static int sun4i_ss_cipher_poll(struct s
+ if (need_fallback)
+ return sun4i_ss_cipher_poll_fallback(areq);
+
++ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) {
++ backup_iv = kzalloc(ivsize, GFP_KERNEL);
++ if (!backup_iv)
++ return -ENOMEM;
++ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0);
++ }
++
+ spin_lock_irqsave(&ss->slock, flags);
+
+ for (i = 0; i < op->keylen; i += 4)
+@@ -345,9 +364,12 @@ static int sun4i_ss_cipher_poll(struct s
+ sg_miter_stop(&mo);
+ }
+ if (areq->iv) {
+- for (i = 0; i < 4 && i < ivsize / 4; i++) {
+- v = readl(ss->base + SS_IV0 + i * 4);
+- *(u32 *)(areq->iv + i * 4) = v;
++ if (mode & SS_DECRYPTION) {
++ memcpy(areq->iv, backup_iv, ivsize);
++ kfree_sensitive(backup_iv);
++ } else {
++ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize,
++ ivsize, 0);
+ }
+ }
+
--- /dev/null
+From 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e Mon Sep 17 00:00:00 2001
+From: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
+Date: Tue, 9 Feb 2021 16:26:12 +0600
+Subject: drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue
+
+From: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
+
+commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream.
+
+syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue()
+when num_pages is 0x100001, giving queue_size + queue_page_size
+bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER
+condition.
+
+queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000.
+
+[1]
+Call Trace:
+ alloc_pages include/linux/gfp.h:547 [inline]
+ kmalloc_order+0x40/0x130 mm/slab_common.c:837
+ kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853
+ kmalloc_large include/linux/slab.h:481 [inline]
+ __kmalloc+0x257/0x330 mm/slub.c:3959
+ kmalloc include/linux/slab.h:557 [inline]
+ kzalloc include/linux/slab.h:682 [inline]
+ qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline]
+ qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline]
+ qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739
+
+Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com
+Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
+Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -537,6 +537,9 @@ static struct vmci_queue *qp_host_alloc_
+
+ queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page);
+
++ if (queue_size + queue_page_size > KMALLOC_MAX_SIZE)
++ return NULL;
++
+ queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL);
+ if (queue) {
+ queue->q_header = NULL;
--- /dev/null
+From 41401ac67791810dd880345962339aa1bedd3c0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Kokem=C3=BCller?= <jan.kokemueller@gmail.com>
+Date: Thu, 11 Feb 2021 19:28:43 +0100
+Subject: drm/amd/display: Add FPU wrappers to dcn21_validate_bandwidth()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kokemüller <jan.kokemueller@gmail.com>
+
+commit 41401ac67791810dd880345962339aa1bedd3c0d upstream.
+
+dcn21_validate_bandwidth() calls functions that use floating point math.
+On my machine this sometimes results in simd exceptions when there are
+other FPU users such as KVM virtual machines running. The screen freezes
+completely in this case.
+
+Wrapping the function with DC_FP_START()/DC_FP_END() seems to solve the
+problem. This mirrors the approach used for dcn20_validate_bandwidth.
+
+Tested on a AMD Ryzen 7 PRO 4750U (Renoir).
+
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206987
+Signed-off-by: Jan Kokemüller <jan.kokemueller@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 -
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 20 ++++++++++++++++--
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -3245,7 +3245,7 @@ restore_dml_state:
+ bool dcn20_validate_bandwidth(struct dc *dc, struct dc_state *context,
+ bool fast_validate)
+ {
+- bool voltage_supported = false;
++ bool voltage_supported;
+ DC_FP_START();
+ voltage_supported = dcn20_validate_bandwidth_fp(dc, context, fast_validate);
+ DC_FP_END();
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -1329,8 +1329,8 @@ validate_out:
+ return out;
+ }
+
+-bool dcn21_validate_bandwidth(struct dc *dc, struct dc_state *context,
+- bool fast_validate)
++static noinline bool dcn21_validate_bandwidth_fp(struct dc *dc,
++ struct dc_state *context, bool fast_validate)
+ {
+ bool out = false;
+
+@@ -1383,6 +1383,22 @@ validate_out:
+
+ return out;
+ }
++
++/*
++ * Some of the functions further below use the FPU, so we need to wrap this
++ * with DC_FP_START()/DC_FP_END(). Use the same approach as for
++ * dcn20_validate_bandwidth in dcn20_resource.c.
++ */
++bool dcn21_validate_bandwidth(struct dc *dc, struct dc_state *context,
++ bool fast_validate)
++{
++ bool voltage_supported;
++ DC_FP_START();
++ voltage_supported = dcn21_validate_bandwidth_fp(dc, context, fast_validate);
++ DC_FP_END();
++ return voltage_supported;
++}
++
+ static void dcn21_destroy_resource_pool(struct resource_pool **pool)
+ {
+ struct dcn21_resource_pool *dcn21_pool = TO_DCN21_RES_POOL(*pool);
--- /dev/null
+From 688f97ed3f5e339c0c2c09d9ee7ff23d5807b0a7 Mon Sep 17 00:00:00 2001
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Date: Fri, 5 Feb 2021 14:15:11 -0500
+Subject: drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+commit 688f97ed3f5e339c0c2c09d9ee7ff23d5807b0a7 upstream.
+
+When run igt@kms_vrr in a device that uses DCN2.1 architecture, we
+noticed multiple failures. Furthermore, when we tested a VRR demo, we
+noticed a system hang where the mouse pointer still works, but the
+entire system freezes; in this case, we don't see any dmesg warning or
+failure messages kernel. This happens due to a lack of vupdate_no_lock
+interrupt, making the userspace wait eternally to get the event back.
+For fixing this issue, we need to add the vupdate_no_lock interrupt in
+the interrupt list.
+
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Acked-by: Bindu Ramamurthy <bindu.r@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c | 22 +++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c
+@@ -168,6 +168,11 @@ static const struct irq_source_info_func
+ .ack = NULL
+ };
+
++static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = {
++ .set = NULL,
++ .ack = NULL
++};
++
+ #undef BASE_INNER
+ #define BASE_INNER(seg) DMU_BASE__INST0_SEG ## seg
+
+@@ -230,6 +235,17 @@ static const struct irq_source_info_func
+ .funcs = &vblank_irq_info_funcs\
+ }
+
++/* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic
++ * of DCE's DC_IRQ_SOURCE_VUPDATEx.
++ */
++#define vupdate_no_lock_int_entry(reg_num)\
++ [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\
++ IRQ_REG_ENTRY(OTG, reg_num,\
++ OTG_GLOBAL_SYNC_STATUS, VUPDATE_NO_LOCK_INT_EN,\
++ OTG_GLOBAL_SYNC_STATUS, VUPDATE_NO_LOCK_EVENT_CLEAR),\
++ .funcs = &vupdate_no_lock_irq_info_funcs\
++ }
++
+ #define vblank_int_entry(reg_num)\
+ [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\
+ IRQ_REG_ENTRY(OTG, reg_num,\
+@@ -338,6 +354,12 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NU
+ vupdate_int_entry(3),
+ vupdate_int_entry(4),
+ vupdate_int_entry(5),
++ vupdate_no_lock_int_entry(0),
++ vupdate_no_lock_int_entry(1),
++ vupdate_no_lock_int_entry(2),
++ vupdate_no_lock_int_entry(3),
++ vupdate_no_lock_int_entry(4),
++ vupdate_no_lock_int_entry(5),
+ vblank_int_entry(0),
+ vblank_int_entry(1),
+ vblank_int_entry(2),
--- /dev/null
+From 83e6667b675f101fb66659dfa72e45d08773d763 Mon Sep 17 00:00:00 2001
+From: Eric Bernstein <eric.bernstein@amd.com>
+Date: Fri, 5 Feb 2021 13:53:31 -0500
+Subject: drm/amd/display: Remove Assert from dcn10_get_dig_frontend
+
+From: Eric Bernstein <eric.bernstein@amd.com>
+
+commit 83e6667b675f101fb66659dfa72e45d08773d763 upstream.
+
+[Why]
+In some cases, this function is called when DIG BE is not
+connected to DIG FE, in which case a value of zero isn't
+invalid and assert should not be hit.
+
+[How]
+Remove assert and handle ENGINE_ID_UNKNOWN result in calling
+function.
+
+Signed-off-by: Eric Bernstein <eric.bernstein@amd.com>
+Acked-by: Bindu Ramamurthy <bindu.r@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c | 1 -
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 2 ++
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c
+@@ -480,7 +480,6 @@ unsigned int dcn10_get_dig_frontend(stru
+ break;
+ default:
+ // invalid source select DIG
+- ASSERT(false);
+ result = ENGINE_ID_UNKNOWN;
+ }
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+@@ -539,6 +539,8 @@ void dcn30_init_hw(struct dc *dc)
+
+ fe = dc->links[i]->link_enc->funcs->get_dig_frontend(
+ dc->links[i]->link_enc);
++ if (fe == ENGINE_ID_UNKNOWN)
++ continue;
+
+ for (j = 0; j < dc->res_pool->stream_enc_count; j++) {
+ if (fe == dc->res_pool->stream_enc[j]->id) {
--- /dev/null
+From 4112c00354004cbb1bf56f0114fa9951bf6b13ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Ol=C5=A1=C3=A1k?= <marek.olsak@amd.com>
+Date: Thu, 4 Feb 2021 02:46:20 -0500
+Subject: drm/amdgpu: fix CGTS_TCC_DISABLE register offset on gfx10.3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Olšák <marek.olsak@amd.com>
+
+commit 4112c00354004cbb1bf56f0114fa9951bf6b13ed upstream.
+
+This fixes incorrect TCC harvesting info reported to userspace.
+The impact was a very very tiny performance degradation (unnecessary
+GL2 cache flushes).
+
+Signed-off-by: Marek Olšák <marek.olsak@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -71,6 +71,11 @@
+ #define GB_ADDR_CONFIG__NUM_PKRS__SHIFT 0x8
+ #define GB_ADDR_CONFIG__NUM_PKRS_MASK 0x00000700L
+
++#define mmCGTS_TCC_DISABLE_gc_10_3 0x5006
++#define mmCGTS_TCC_DISABLE_gc_10_3_BASE_IDX 1
++#define mmCGTS_USER_TCC_DISABLE_gc_10_3 0x5007
++#define mmCGTS_USER_TCC_DISABLE_gc_10_3_BASE_IDX 1
++
+ #define mmCP_MEC_CNTL_Sienna_Cichlid 0x0f55
+ #define mmCP_MEC_CNTL_Sienna_Cichlid_BASE_IDX 0
+ #define mmRLC_SAFE_MODE_Sienna_Cichlid 0x4ca0
+@@ -99,10 +104,6 @@
+ #define mmGCR_GENERAL_CNTL_Sienna_Cichlid 0x1580
+ #define mmGCR_GENERAL_CNTL_Sienna_Cichlid_BASE_IDX 0
+
+-#define mmCGTS_TCC_DISABLE_Vangogh 0x5006
+-#define mmCGTS_TCC_DISABLE_Vangogh_BASE_IDX 1
+-#define mmCGTS_USER_TCC_DISABLE_Vangogh 0x5007
+-#define mmCGTS_USER_TCC_DISABLE_Vangogh_BASE_IDX 1
+ #define mmGOLDEN_TSC_COUNT_UPPER_Vangogh 0x0025
+ #define mmGOLDEN_TSC_COUNT_UPPER_Vangogh_BASE_IDX 1
+ #define mmGOLDEN_TSC_COUNT_LOWER_Vangogh 0x0026
+@@ -4942,15 +4943,12 @@ static void gfx_v10_0_get_tcc_info(struc
+ /* TCCs are global (not instanced). */
+ uint32_t tcc_disable;
+
+- switch (adev->asic_type) {
+- case CHIP_VANGOGH:
+- tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE_Vangogh) |
+- RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE_Vangogh);
+- break;
+- default:
++ if (adev->asic_type >= CHIP_SIENNA_CICHLID) {
++ tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE_gc_10_3) |
++ RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE_gc_10_3);
++ } else {
+ tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE) |
+- RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE);
+- break;
++ RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE);
+ }
+
+ adev->gfx.config.tcc_disabled_mask =
--- /dev/null
+From b092b19602cfd47de1eeeb3a1b03822afd86b136 Mon Sep 17 00:00:00 2001
+From: Prike Liang <Prike.Liang@amd.com>
+Date: Mon, 22 Feb 2021 14:04:12 +0800
+Subject: drm/amdgpu: fix shutdown and poweroff process failed with s0ix
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+commit b092b19602cfd47de1eeeb3a1b03822afd86b136 upstream.
+
+In the shutdown and poweroff opt on the s0i3 system we still need
+un-gate the gfx clock gating and power gating before destory amdgpu device.
+
+Fixes: 628c36d7b238e2 ("drm/amdgpu: update amdgpu device suspend/resume sequence for s0i3 support")
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1499
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 6 ++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++--
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 9 ++++++++-
+ 3 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -1003,6 +1003,12 @@ struct amdgpu_device {
+ bool in_suspend;
+ bool in_hibernate;
+
++ /*
++ * The combination flag in_poweroff_reboot_com used to identify the poweroff
++ * and reboot opt in the s0i3 system-wide suspend.
++ */
++ bool in_poweroff_reboot_com;
++
+ atomic_t in_gpu_reset;
+ enum pp_mp1_state mp1_state;
+ struct rw_semaphore reset_sem;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2666,7 +2666,8 @@ static int amdgpu_device_ip_suspend_phas
+ {
+ int i, r;
+
+- if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) {
++ if (adev->in_poweroff_reboot_com ||
++ !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) {
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+ }
+@@ -3726,7 +3727,8 @@ int amdgpu_device_suspend(struct drm_dev
+
+ amdgpu_fence_driver_suspend(adev);
+
+- if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev))
++ if (adev->in_poweroff_reboot_com ||
++ !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev))
+ r = amdgpu_device_ip_suspend_phase2(adev);
+ else
+ amdgpu_gfx_state_change_set(adev, sGpuChangeState_D3Entry);
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1266,7 +1266,9 @@ amdgpu_pci_shutdown(struct pci_dev *pdev
+ */
+ if (!amdgpu_passthrough(adev))
+ adev->mp1_state = PP_MP1_STATE_UNLOAD;
++ adev->in_poweroff_reboot_com = true;
+ amdgpu_device_ip_suspend(adev);
++ adev->in_poweroff_reboot_com = false;
+ adev->mp1_state = PP_MP1_STATE_NONE;
+ }
+
+@@ -1308,8 +1310,13 @@ static int amdgpu_pmops_thaw(struct devi
+ static int amdgpu_pmops_poweroff(struct device *dev)
+ {
+ struct drm_device *drm_dev = dev_get_drvdata(dev);
++ struct amdgpu_device *adev = drm_to_adev(drm_dev);
++ int r;
+
+- return amdgpu_device_suspend(drm_dev, true);
++ adev->in_poweroff_reboot_com = true;
++ r = amdgpu_device_suspend(drm_dev, true);
++ adev->in_poweroff_reboot_com = false;
++ return r;
+ }
+
+ static int amdgpu_pmops_restore(struct device *dev)
--- /dev/null
+From 6e80fb8ab04f6c4f377e2fd422bdd1855beb7371 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 16 Feb 2021 10:57:00 -0500
+Subject: drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6e80fb8ab04f6c4f377e2fd422bdd1855beb7371 upstream.
+
+Fixes the rlc reference clock used for GPU timestamps.
+Value is 100Mhz. Confirmed with hardware team.
+
+v2: reword commit message.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1480
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -241,6 +241,8 @@ static u32 soc15_get_xclk(struct amdgpu_
+ {
+ u32 reference_clock = adev->clock.spll.reference_freq;
+
++ if (adev->asic_type == CHIP_RENOIR)
++ return 10000;
+ if (adev->asic_type == CHIP_RAVEN)
+ return reference_clock / 4;
+
--- /dev/null
+From 1fb8b1fc4dd1035a264c81d15d41f05884cc8058 Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Thu, 4 Feb 2021 00:11:17 -0500
+Subject: drm/amdkfd: Fix recursive lock warnings
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+commit 1fb8b1fc4dd1035a264c81d15d41f05884cc8058 upstream.
+
+memalloc_nofs_save/restore are no longer sufficient to prevent recursive
+lock warnings when holding locks that can be taken in MMU notifiers. Use
+memalloc_noreclaim_save/restore instead.
+
+Fixes: f920e413ff9c ("mm: track mmu notifiers in fs_reclaim_acquire/release")
+CC: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Philip Yang <Philip.Yang@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 5.10.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h
+@@ -243,11 +243,11 @@ get_sh_mem_bases_nybble_64(struct kfd_pr
+ static inline void dqm_lock(struct device_queue_manager *dqm)
+ {
+ mutex_lock(&dqm->lock_hidden);
+- dqm->saved_flags = memalloc_nofs_save();
++ dqm->saved_flags = memalloc_noreclaim_save();
+ }
+ static inline void dqm_unlock(struct device_queue_manager *dqm)
+ {
+- memalloc_nofs_restore(dqm->saved_flags);
++ memalloc_noreclaim_restore(dqm->saved_flags);
+ mutex_unlock(&dqm->lock_hidden);
+ }
+
--- /dev/null
+From 81ce8f04aa96f7f6cae05770f68b5d15be91f5a2 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 10 Feb 2021 12:27:28 +0000
+Subject: drm/i915/gt: Correct surface base address for renderclear
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 81ce8f04aa96f7f6cae05770f68b5d15be91f5a2 upstream.
+
+The surface_state_base is an offset into the batch, so we need to pass
+the correct batch address for STATE_BASE_ADDRESS.
+
+Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Prathap Kumar Valsan <prathap.kumar.valsan@intel.com>
+Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.7+
+Link: https://patchwork.freedesktop.org/patch/msgid/20210210122728.20097-1-chris@chris-wilson.co.uk
+(cherry picked from commit 1914911f4aa08ddc05bae71d3516419463e0c567)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/gen7_renderclear.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+@@ -240,7 +240,7 @@ gen7_emit_state_base_address(struct batc
+ /* general */
+ *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY;
+ /* surface */
+- *cs++ = batch_addr(batch) | surface_state_base | BASE_ADDRESS_MODIFY;
++ *cs++ = (batch_addr(batch) + surface_state_base) | BASE_ADDRESS_MODIFY;
+ /* dynamic */
+ *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY;
+ /* indirect */
--- /dev/null
+From d5109f739c9f14a3bda249cb48b16de1065932f0 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 25 Jan 2021 22:02:47 +0000
+Subject: drm/i915/gt: Flush before changing register state
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit d5109f739c9f14a3bda249cb48b16de1065932f0 upstream.
+
+Flush; invalidate; change registers; invalidate; flush.
+
+Will this finally work on every device? Or will Baytrail complain again?
+
+On the positive side, we immediately see the benefit of having hsw-gt1 in
+CI.
+
+Fixes: ace44e13e577 ("drm/i915/gt: Clear CACHE_MODE prior to clearing residuals")
+Testcase: igt/gem_render_tiled_blits # hsw-gt1
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
+Acked-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210125220247.31701-1-chris@chris-wilson.co.uk
+(cherry picked from commit d30bbd62b1bfd9e0a33c3583c5a9e5d66f60cbd7)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Diego Calleja <diegocg@gmail.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/gen7_renderclear.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c
++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c
+@@ -393,6 +393,7 @@ static void emit_batch(struct i915_vma *
+ desc_count);
+
+ /* Reset inherited context registers */
++ gen7_emit_pipeline_flush(&cmds);
+ gen7_emit_pipeline_invalidate(&cmds);
+ batch_add(&cmds, MI_LOAD_REGISTER_IMM(2));
+ batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7));
--- /dev/null
+From 5b34ab52401f0f1f191bcb83a182c83b506f4763 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Thu, 22 Oct 2020 22:42:56 +0300
+Subject: drm/modes: Switch to 64bit maths to avoid integer overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 5b34ab52401f0f1f191bcb83a182c83b506f4763 upstream.
+
+The new >8k CEA modes have dotclocks reaching 5.94 GHz, which
+means our clock*1000 will now overflow the 32bit unsigned
+integer. Switch to 64bit maths to avoid it.
+
+Cc: stable@vger.kernel.org
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201022194256.30978-1-ville.syrjala@linux.intel.com
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_modes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_modes.c
++++ b/drivers/gpu/drm/drm_modes.c
+@@ -762,7 +762,7 @@ int drm_mode_vrefresh(const struct drm_d
+ if (mode->htotal == 0 || mode->vtotal == 0)
+ return 0;
+
+- num = mode->clock * 1000;
++ num = mode->clock;
+ den = mode->htotal * mode->vtotal;
+
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+@@ -772,7 +772,7 @@ int drm_mode_vrefresh(const struct drm_d
+ if (mode->vscan > 1)
+ den *= mode->vscan;
+
+- return DIV_ROUND_CLOSEST(num, den);
++ return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den);
+ }
+ EXPORT_SYMBOL(drm_mode_vrefresh);
+
--- /dev/null
+From d1f5a3fc85566e9ddce9361ef180f070367e6eab Mon Sep 17 00:00:00 2001
+From: Karol Herbst <kherbst@redhat.com>
+Date: Fri, 27 Nov 2020 19:39:09 +0100
+Subject: drm/nouveau/kms: handle mDP connectors
+
+From: Karol Herbst <kherbst@redhat.com>
+
+commit d1f5a3fc85566e9ddce9361ef180f070367e6eab upstream.
+
+In some cases we have the handle those explicitly as the fallback
+connector type detection fails and marks those as eDP connectors.
+
+Attempting to use such a connector with mutter leads to a crash of mutter
+as it ends up with two eDP displays.
+
+Information is taken from the official DCB documentation.
+
+Cc: stable@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Reported-by: Mark Pearson <markpearson@lenovo.com>
+Tested-by: Mark Pearson <markpearson@lenovo.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h | 1 +
+ drivers/gpu/drm/nouveau/nouveau_connector.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h
++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h
+@@ -14,6 +14,7 @@ enum dcb_connector_type {
+ DCB_CONNECTOR_LVDS_SPWG = 0x41,
+ DCB_CONNECTOR_DP = 0x46,
+ DCB_CONNECTOR_eDP = 0x47,
++ DCB_CONNECTOR_mDP = 0x48,
+ DCB_CONNECTOR_HDMI_0 = 0x60,
+ DCB_CONNECTOR_HDMI_1 = 0x61,
+ DCB_CONNECTOR_HDMI_C = 0x63,
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -1210,6 +1210,7 @@ drm_conntype_from_dcb(enum dcb_connector
+ case DCB_CONNECTOR_DMS59_DP0:
+ case DCB_CONNECTOR_DMS59_DP1:
+ case DCB_CONNECTOR_DP :
++ case DCB_CONNECTOR_mDP :
+ case DCB_CONNECTOR_USB_C : return DRM_MODE_CONNECTOR_DisplayPort;
+ case DCB_CONNECTOR_eDP : return DRM_MODE_CONNECTOR_eDP;
+ case DCB_CONNECTOR_HDMI_0 :
--- /dev/null
+From d922d58fedcd98ba625e89b625a98e222b090b10 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Sat, 6 Feb 2021 14:50:20 +0100
+Subject: drm/panel: kd35t133: allow using non-continuous dsi clock
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit d922d58fedcd98ba625e89b625a98e222b090b10 upstream.
+
+The panel is able to work when dsi clock is non-continuous, thus
+the system power consumption can be reduced using such feature.
+
+Add MIPI_DSI_CLOCK_NON_CONTINUOUS to panel's mode_flags.
+
+Also the flag actually becomes necessary after
+commit c6d94e37bdbb ("drm/bridge/synopsys: dsi: add support for non-continuous HS clock")
+and without it the panel only emits stripes instead of output.
+
+Fixes: c6d94e37bdbb ("drm/bridge/synopsys: dsi: add support for non-continuous HS clock")
+Cc: stable@vger.kernel.org # 5.10+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Tested-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Christopher Morgan <macromorgan@hotmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210206135020.1991820-1-heiko@sntech.de
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panel/panel-elida-kd35t133.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c
++++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+@@ -265,7 +265,8 @@ static int kd35t133_probe(struct mipi_ds
+ dsi->lanes = 1;
+ dsi->format = MIPI_DSI_FMT_RGB888;
+ dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST |
+- MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_EOT_PACKET;
++ MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_EOT_PACKET |
++ MIPI_DSI_CLOCK_NON_CONTINUOUS;
+
+ drm_panel_init(&ctx->panel, &dsi->dev, &kd35t133_funcs,
+ DRM_MODE_CONNECTOR_DSI);
--- /dev/null
+From 5f94e3571459abb626077aedb65d71264c2a58c0 Mon Sep 17 00:00:00 2001
+From: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+Date: Tue, 11 Aug 2020 16:26:31 -0400
+Subject: drm/rockchip: Require the YTR modifier for AFBC
+
+From: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+
+commit 5f94e3571459abb626077aedb65d71264c2a58c0 upstream.
+
+The AFBC decoder used in the Rockchip VOP assumes the use of the
+YUV-like colourspace transform (YTR). YTR is lossless for RGB(A)
+buffers, which covers the RGBA8 and RGB565 formats supported in
+vop_convert_afbc_format. Use of YTR is signaled with the
+AFBC_FORMAT_MOD_YTR modifier, which prior to this commit was missing. As
+such, a producer would have to generate buffers that do not use YTR,
+which the VOP would erroneously decode as YTR, leading to severe visual
+corruption.
+
+The upstream AFBC support was developed against a captured frame, which
+failed to exercise modifier support. Prior to bring-up of AFBC in Mesa
+(in the Panfrost driver), no open userspace respected modifier
+reporting. As such, this change is not expected to affect broken
+userspaces.
+
+Tested on RK3399 with Panfrost and Weston.
+
+Fixes: 7707f7227f09 ("drm/rockchip: Add support for afbc")
+Cc: stable@vger.kernel.org
+Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
+Acked-by: Daniel Stone <daniels@collabora.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200811202631.3603-1-alyssa.rosenzweig@collabora.com
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h
+@@ -17,9 +17,20 @@
+
+ #define NUM_YUV2YUV_COEFFICIENTS 12
+
++/* AFBC supports a number of configurable modes. Relevant to us is block size
++ * (16x16 or 32x8), storage modifiers (SPARSE, SPLIT), and the YUV-like
++ * colourspace transform (YTR). 16x16 SPARSE mode is always used. SPLIT mode
++ * could be enabled via the hreg_block_split register, but is not currently
++ * handled. The colourspace transform is implicitly always assumed by the
++ * decoder, so consumers must use this transform as well.
++ *
++ * Failure to match modifiers will cause errors displaying AFBC buffers
++ * produced by conformant AFBC producers, including Mesa.
++ */
+ #define ROCKCHIP_AFBC_MOD \
+ DRM_FORMAT_MOD_ARM_AFBC( \
+ AFBC_FORMAT_MOD_BLOCK_SIZE_16x16 | AFBC_FORMAT_MOD_SPARSE \
++ | AFBC_FORMAT_MOD_YTR \
+ )
+
+ enum vop_data_format {
--- /dev/null
+From e582951baabba3e278c97169d0acc1e09b24a72e Mon Sep 17 00:00:00 2001
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Date: Mon, 18 Jan 2021 16:01:13 -0500
+Subject: drm/sched: Cancel and flush all outstanding jobs before finish.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+
+commit e582951baabba3e278c97169d0acc1e09b24a72e upstream.
+
+To avoid any possible use after free.
+
+Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/414814/
+CC: stable@vger.kernel.org
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/scheduler/sched_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/scheduler/sched_main.c
++++ b/drivers/gpu/drm/scheduler/sched_main.c
+@@ -891,6 +891,9 @@ void drm_sched_fini(struct drm_gpu_sched
+ if (sched->thread)
+ kthread_stop(sched->thread);
+
++ /* Confirm no work left behind accessing device structures */
++ cancel_delayed_work_sync(&sched->work_tdr);
++
+ sched->ready = false;
+ }
+ EXPORT_SYMBOL(drm_sched_fini);
--- /dev/null
+From 7a8a4b0729a8807e37196e44629b31ee03f88872 Mon Sep 17 00:00:00 2001
+From: xinhui pan <xinhui.pan@amd.com>
+Date: Fri, 19 Feb 2021 12:25:47 +0800
+Subject: drm/ttm: Fix a memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: xinhui pan <xinhui.pan@amd.com>
+
+commit 7a8a4b0729a8807e37196e44629b31ee03f88872 upstream.
+
+Free the memory on failure.
+Also no need to re-alloc memory on retry.
+
+Signed-off-by: xinhui pan <xinhui.pan@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210219042547.44855-1-xinhui.pan@amd.com
+Reviewed-by: Christian König <christian.koenig@amd.com>
+CC: stable@vger.kernel.org # 5.11
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -967,8 +967,10 @@ static int ttm_bo_bounce_temp_buffer(str
+ return ret;
+ /* move to the bounce domain */
+ ret = ttm_bo_handle_move_mem(bo, &hop_mem, false, ctx, NULL);
+- if (ret)
++ if (ret) {
++ ttm_resource_free(bo, &hop_mem);
+ return ret;
++ }
+ return 0;
+ }
+
+@@ -1000,18 +1002,19 @@ static int ttm_bo_move_buffer(struct ttm
+ * stop and the driver will be called to make
+ * the second hop.
+ */
+-bounce:
+ ret = ttm_bo_mem_space(bo, placement, &mem, ctx);
+ if (ret)
+ return ret;
++bounce:
+ ret = ttm_bo_handle_move_mem(bo, &mem, false, ctx, &hop);
+ if (ret == -EMULTIHOP) {
+ ret = ttm_bo_bounce_temp_buffer(bo, &mem, ctx, &hop);
+ if (ret)
+- return ret;
++ goto out;
+ /* try and move to final place now. */
+ goto bounce;
+ }
++out:
+ if (ret)
+ ttm_resource_free(bo, &mem);
+ return ret;
--- /dev/null
+From dc2e76175417e69c41d927dba75a966399f18354 Mon Sep 17 00:00:00 2001
+From: Frank Wunderlich <frank-w@public-files.de>
+Date: Wed, 13 Jan 2021 19:09:19 +0100
+Subject: dts64: mt7622: fix slow sd card access
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+commit dc2e76175417e69c41d927dba75a966399f18354 upstream.
+
+Fix extreme slow speed (200MB takes ~20 min) on writing sdcard on
+bananapi-r64 by adding reset-control for mmc1 like it's done for mmc0/emmc.
+
+Fixes: 2c002a3049f7 ("arm64: dts: mt7622: add mmc related device nodes")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20210113180919.49523-1-linux@fw-web.de
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -698,6 +698,8 @@
+ clocks = <&pericfg CLK_PERI_MSDC30_1_PD>,
+ <&topckgen CLK_TOP_AXI_SEL>;
+ clock-names = "source", "hclk";
++ resets = <&pericfg MT7622_PERI_MSDC1_SW_RST>;
++ reset-names = "hrst";
+ status = "disabled";
+ };
+
--- /dev/null
+From ce063129181312f8781a047a50be439c5859747b Mon Sep 17 00:00:00 2001
+From: Gao Xiang <hsiangkao@redhat.com>
+Date: Tue, 9 Feb 2021 21:06:18 +0800
+Subject: erofs: initialized fields can only be observed after bit is set
+
+From: Gao Xiang <hsiangkao@redhat.com>
+
+commit ce063129181312f8781a047a50be439c5859747b upstream.
+
+Currently, although set_bit() & test_bit() pairs are used as a fast-
+path for initialized configurations. However, these atomic ops are
+actually relaxed forms. Instead, load-acquire & store-release form is
+needed to make sure uninitialized fields won't be observed in advance
+here (yet no such corresponding bitops so use full barriers instead.)
+
+Link: https://lore.kernel.org/r/20210209130618.15838-1-hsiangkao@aol.com
+Fixes: 62dc45979f3f ("staging: erofs: fix race of initializing xattrs of a inode at the same time")
+Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
+Cc: <stable@vger.kernel.org> # 5.3+
+Reported-by: Huang Jianan <huangjianan@oppo.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/erofs/xattr.c | 10 +++++++++-
+ fs/erofs/zmap.c | 10 +++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/fs/erofs/xattr.c
++++ b/fs/erofs/xattr.c
+@@ -48,8 +48,14 @@ static int init_inode_xattrs(struct inod
+ int ret = 0;
+
+ /* the most case is that xattrs of this inode are initialized. */
+- if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags))
++ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) {
++ /*
++ * paired with smp_mb() at the end of the function to ensure
++ * fields will only be observed after the bit is set.
++ */
++ smp_mb();
+ return 0;
++ }
+
+ if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_XATTR_BIT, TASK_KILLABLE))
+ return -ERESTARTSYS;
+@@ -137,6 +143,8 @@ static int init_inode_xattrs(struct inod
+ }
+ xattr_iter_end(&it, atomic_map);
+
++ /* paired with smp_mb() at the beginning of the function. */
++ smp_mb();
+ set_bit(EROFS_I_EA_INITED_BIT, &vi->flags);
+
+ out_unlock:
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -36,8 +36,14 @@ static int z_erofs_fill_inode_lazy(struc
+ void *kaddr;
+ struct z_erofs_map_header *h;
+
+- if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags))
++ if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) {
++ /*
++ * paired with smp_mb() at the end of the function to ensure
++ * fields will only be observed after the bit is set.
++ */
++ smp_mb();
+ return 0;
++ }
+
+ if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_Z_BIT, TASK_KILLABLE))
+ return -ERESTARTSYS;
+@@ -83,6 +89,8 @@ static int z_erofs_fill_inode_lazy(struc
+
+ vi->z_physical_clusterbits[1] = vi->z_logical_clusterbits +
+ ((h->h_clusterbits >> 5) & 7);
++ /* paired with smp_mb() at the beginning of the function */
++ smp_mb();
+ set_bit(EROFS_I_Z_INITED_BIT, &vi->flags);
+ unmap_done:
+ kunmap_atomic(kaddr);
--- /dev/null
+From ef07c116d98772952807492bd32a61f5af172a94 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Filipe=20La=C3=ADns?= <lains@riseup.net>
+Date: Fri, 5 Feb 2021 14:34:44 +0000
+Subject: HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Filipe Laíns <lains@riseup.net>
+
+commit ef07c116d98772952807492bd32a61f5af172a94 upstream.
+
+In e400071a805d6229223a98899e9da8c6233704a1 I added support for the
+receiver that comes with the G602 device, but unfortunately I screwed up
+during testing and it seems the keyboard events were actually not being
+sent to userspace.
+This resulted in keyboard events being broken in userspace, please
+backport the fix.
+
+The receiver uses the normal 0x01 Logitech keyboard report descriptor,
+as expected, so it is just a matter of flagging it as supported.
+
+Reported in
+https://github.com/libratbag/libratbag/issues/1124
+
+Fixes: e400071a805d6 ("HID: logitech-dj: add the G602 receiver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Filipe Laíns <lains@riseup.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-logitech-dj.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -980,6 +980,7 @@ static void logi_hidpp_recv_queue_notif(
+ case 0x07:
+ device_type = "eQUAD step 4 Gaming";
+ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
++ workitem.reports_supported |= STD_KEYBOARD;
+ break;
+ case 0x08:
+ device_type = "eQUAD step 4 for gamepads";
--- /dev/null
+From 88f38846bfb1a452a3d47e38aeab20a4ceb74294 Mon Sep 17 00:00:00 2001
+From: Jason Gerecke <killertofu@gmail.com>
+Date: Tue, 16 Feb 2021 11:41:54 -0800
+Subject: HID: wacom: Ignore attempts to overwrite the touch_max value from HID
+
+From: Jason Gerecke <killertofu@gmail.com>
+
+commit 88f38846bfb1a452a3d47e38aeab20a4ceb74294 upstream.
+
+The `wacom_feature_mapping` function is careful to only set the the
+touch_max value a single time, but this care does not extend to the
+`wacom_wac_finger_event` function. In particular, if a device sends
+multiple HID_DG_CONTACTMAX items in a single feature report, the
+driver will end up retaining the value of last item.
+
+The HID descriptor for the Cintiq Companion 2 does exactly this. It
+incorrectly sets a "Report Count" of 2, which will cause the driver
+to process two HID_DG_CONTACTCOUNT items. The first item has the actual
+count, while the second item should have been declared as a constant
+zero. The constant zero is the value the driver ends up using, however,
+since it is the last HID_DG_CONTACTCOUNT in the report.
+
+ Report ID (16),
+ Usage (Contact Count Maximum), ; Contact count maximum (55h, static value)
+ Report Count (2),
+ Logical Maximum (10),
+ Feature (Variable),
+
+To address this, we add a check that the touch_max is not already set
+within the `wacom_wac_finger_event` function that processes the
+HID_DG_TOUCHMAX item. We emit a warning if the value is set and ignore
+the updated value.
+
+This could potentially cause problems if there is a tablet which has
+a similar issue but requires the last item to be used. This is unlikely,
+however, since it would have to have a different non-zero value for
+HID_DG_CONTACTMAX earlier in the same report, which makes no sense
+except in the case of a firmware bug. Note that cases where the
+HID_DG_CONTACTMAX items are in different reports is already handled
+(and similarly ignored) by `wacom_feature_mapping` as mentioned above.
+
+Link: https://github.com/linuxwacom/input-wacom/issues/223
+Fixes: 184eccd40389 ("HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report")
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_wac.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2600,7 +2600,12 @@ static void wacom_wac_finger_event(struc
+ wacom_wac->is_invalid_bt_frame = !value;
+ return;
+ case HID_DG_CONTACTMAX:
+- features->touch_max = value;
++ if (!features->touch_max) {
++ features->touch_max = value;
++ } else {
++ hid_warn(hdev, "%s: ignoring attempt to overwrite non-zero touch_max "
++ "%d -> %d\n", __func__, features->touch_max, value);
++ }
+ return;
+ }
+
--- /dev/null
+From b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 Mon Sep 17 00:00:00 2001
+From: Marcos Paulo de Souza <mpdesouza@suse.com>
+Date: Fri, 19 Feb 2021 10:37:13 -0800
+Subject: Input: i8042 - add ASUS Zenbook Flip to noselftest list
+
+From: Marcos Paulo de Souza <mpdesouza@suse.com>
+
+commit b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 upstream.
+
+After commit 77b425399f6d ("Input: i8042 - use chassis info to skip
+selftest on Asus laptops"), all modern Asus laptops have the i8042
+selftest disabled. It has done by using chassys type "10" (laptop).
+
+The Asus Zenbook Flip suffers from similar suspend/resume issues, but
+it _sometimes_ work and sometimes it doesn't. Setting noselftest makes
+it work reliably. In this case, we need to add chassis type "31"
+(convertible) in order to avoid selftest in this device.
+
+Reported-by: Ludvig Norgren Guldhag <ludvigng@gmail.com>
+Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
+Link: https://lore.kernel.org/r/20210219164638.761-1-mpdesouza@suse.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -588,6 +588,10 @@ static const struct dmi_system_id i8042_
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */
+ },
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */
++ },
+ },
+ { }
+ };
--- /dev/null
+From 182d679b2298d62bf42bb14b12a8067b8e17b617 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 17 Feb 2021 12:21:10 -0800
+Subject: Input: joydev - prevent potential read overflow in ioctl
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream.
+
+The problem here is that "len" might be less than "joydev->nabs" so the
+loops which verfy abspam[i] and keypam[] might read beyond the buffer.
+
+Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda
+[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP]
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joydev.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/joydev.c
++++ b/drivers/input/joydev.c
+@@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(str
+ if (IS_ERR(abspam))
+ return PTR_ERR(abspam);
+
+- for (i = 0; i < joydev->nabs; i++) {
++ for (i = 0; i < len && i < joydev->nabs; i++) {
+ if (abspam[i] > ABS_MAX) {
+ retval = -EINVAL;
+ goto out;
+@@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(st
+ int i;
+ int retval = 0;
+
++ if (len % sizeof(*keypam))
++ return -EINVAL;
++
+ len = min(len, sizeof(joydev->keypam));
+
+ /* Validate the map. */
+@@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(st
+ if (IS_ERR(keypam))
+ return PTR_ERR(keypam);
+
+- for (i = 0; i < joydev->nkey; i++) {
++ for (i = 0; i < (len / 2) && i < joydev->nkey; i++) {
+ if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) {
+ retval = -EINVAL;
+ goto out;
--- /dev/null
+From fafd320ae51b9c72d371585b2501f86640ea7b7d Mon Sep 17 00:00:00 2001
+From: "jeffrey.lin" <jeffrey.lin@rad-ic.com>
+Date: Tue, 15 Dec 2020 10:50:12 -0800
+Subject: Input: raydium_ts_i2c - do not send zero length
+
+From: jeffrey.lin <jeffrey.lin@rad-ic.com>
+
+commit fafd320ae51b9c72d371585b2501f86640ea7b7d upstream.
+
+Add default write command package to prevent i2c quirk error of zero
+data length as Raydium touch firmware update is executed.
+
+Signed-off-by: jeffrey.lin <jeffrey.lin@rad-ic.com>
+Link: https://lore.kernel.org/r/1608031217-7247-1-git-send-email-jeffrey.lin@raydium.corp-partner.google.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/touchscreen/raydium_i2c_ts.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/input/touchscreen/raydium_i2c_ts.c
++++ b/drivers/input/touchscreen/raydium_i2c_ts.c
+@@ -445,6 +445,7 @@ static int raydium_i2c_write_object(stru
+ enum raydium_bl_ack state)
+ {
+ int error;
++ static const u8 cmd[] = { 0xFF, 0x39 };
+
+ error = raydium_i2c_send(client, RM_CMD_BOOT_WRT, data, len);
+ if (error) {
+@@ -453,7 +454,7 @@ static int raydium_i2c_write_object(stru
+ return error;
+ }
+
+- error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, NULL, 0);
++ error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, cmd, sizeof(cmd));
+ if (error) {
+ dev_err(&client->dev, "Ack obj command failed: %d\n", error);
+ return error;
--- /dev/null
+From 42ffcd1dba1796bcda386eb6f260df9fc23c90af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Olivier=20Cr=C3=AAte?= <olivier.crete@ocrete.ca>
+Date: Fri, 5 Feb 2021 11:59:08 -0800
+Subject: Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Olivier Crête <olivier.crete@ocrete.ca>
+
+commit 42ffcd1dba1796bcda386eb6f260df9fc23c90af upstream.
+
+Signed-off-by: Olivier Crête <olivier.crete@ocrete.ca>
+Link: https://lore.kernel.org/r/20210204005318.615647-1-olivier.crete@collabora.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/input/joystick/xpad.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -305,6 +305,7 @@ static const struct xpad_device {
+ { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 },
+ { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 },
+ { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
++ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
+ { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
+ { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
+ { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
--- /dev/null
+From 5df16caada3fba3b21cb09b85cdedf99507f4ec1 Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko@kernel.org>
+Date: Fri, 29 Jan 2021 01:56:19 +0200
+Subject: KEYS: trusted: Fix incorrect handling of tpm_get_random()
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+commit 5df16caada3fba3b21cb09b85cdedf99507f4ec1 upstream.
+
+When tpm_get_random() was introduced, it defined the following API for the
+return value:
+
+1. A positive value tells how many bytes of random data was generated.
+2. A negative value on error.
+
+However, in the call sites the API was used incorrectly, i.e. as it would
+only return negative values and otherwise zero. Returning he positive read
+counts to the user space does not make any possible sense.
+
+Fix this by returning -EIO when tpm_get_random() returns a positive value.
+
+Fixes: 41ab999c80f1 ("tpm: Move tpm_get_random api into the TPM device driver")
+Cc: stable@vger.kernel.org
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Kent Yoder <key@linux.vnet.ibm.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/keys/trusted-keys/trusted_tpm1.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/security/keys/trusted-keys/trusted_tpm1.c
++++ b/security/keys/trusted-keys/trusted_tpm1.c
+@@ -403,9 +403,12 @@ static int osap(struct tpm_buf *tb, stru
+ int ret;
+
+ ret = tpm_get_random(chip, ononce, TPM_NONCE_SIZE);
+- if (ret != TPM_NONCE_SIZE)
++ if (ret < 0)
+ return ret;
+
++ if (ret != TPM_NONCE_SIZE)
++ return -EIO;
++
+ tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_OSAP);
+ tpm_buf_append_u16(tb, type);
+ tpm_buf_append_u32(tb, handle);
+@@ -496,8 +499,12 @@ static int tpm_seal(struct tpm_buf *tb,
+ goto out;
+
+ ret = tpm_get_random(chip, td->nonceodd, TPM_NONCE_SIZE);
++ if (ret < 0)
++ return ret;
++
+ if (ret != TPM_NONCE_SIZE)
+- goto out;
++ return -EIO;
++
+ ordinal = htonl(TPM_ORD_SEAL);
+ datsize = htonl(datalen);
+ pcrsize = htonl(pcrinfosize);
+@@ -601,9 +608,12 @@ static int tpm_unseal(struct tpm_buf *tb
+
+ ordinal = htonl(TPM_ORD_UNSEAL);
+ ret = tpm_get_random(chip, nonceodd, TPM_NONCE_SIZE);
++ if (ret < 0)
++ return ret;
++
+ if (ret != TPM_NONCE_SIZE) {
+ pr_info("trusted_key: tpm_get_random failed (%d)\n", ret);
+- return ret;
++ return -EIO;
+ }
+ ret = TSS_authhmac(authdata1, keyauth, TPM_NONCE_SIZE,
+ enonce1, nonceodd, cont, sizeof(uint32_t),
+@@ -1013,8 +1023,12 @@ static int trusted_instantiate(struct ke
+ case Opt_new:
+ key_len = payload->key_len;
+ ret = tpm_get_random(chip, payload->key, key_len);
++ if (ret < 0)
++ goto out;
++
+ if (ret != key_len) {
+ pr_info("trusted_key: key_create failed (%d)\n", ret);
++ ret = -EIO;
+ goto out;
+ }
+ if (tpm2)
--- /dev/null
+From 8da7520c80468c48f981f0b81fc1be6599e3b0ad Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko@kernel.org>
+Date: Fri, 29 Jan 2021 01:56:20 +0200
+Subject: KEYS: trusted: Fix migratable=1 failing
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+commit 8da7520c80468c48f981f0b81fc1be6599e3b0ad upstream.
+
+Consider the following transcript:
+
+$ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u
+add_key: Invalid argument
+
+The documentation has the following description:
+
+ migratable= 0|1 indicating permission to reseal to new PCR values,
+ default 1 (resealing allowed)
+
+The consequence is that "migratable=1" should succeed. Fix this by
+allowing this condition to pass instead of return -EINVAL.
+
+[*] Documentation/security/keys/trusted-encrypted.rst
+
+Cc: stable@vger.kernel.org
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: David Howells <dhowells@redhat.com>
+Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/keys/trusted-keys/trusted_tpm1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/keys/trusted-keys/trusted_tpm1.c
++++ b/security/keys/trusted-keys/trusted_tpm1.c
+@@ -801,7 +801,7 @@ static int getoptions(char *c, struct tr
+ case Opt_migratable:
+ if (*args[0].from == '0')
+ pay->migratable = 0;
+- else
++ else if (*args[0].from != '1')
+ return -EINVAL;
+ break;
+ case Opt_pcrlock:
--- /dev/null
+From 8c657a0590de585b1115847c17b34a58025f2f4b Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko@kernel.org>
+Date: Fri, 29 Jan 2021 01:56:21 +0200
+Subject: KEYS: trusted: Reserve TPM for seal and unseal operations
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+commit 8c657a0590de585b1115847c17b34a58025f2f4b upstream.
+
+When TPM 2.0 trusted keys code was moved to the trusted keys subsystem,
+the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(),
+which are used to take temporarily the ownership of the TPM chip. The
+ownership is only taken inside tpm_send(), but this is not sufficient,
+as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT
+need to be done as a one single atom.
+
+Take the TPM chip ownership before sending anything with
+tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send
+TPM commands instead of tpm_send(), reverting back to the old behaviour.
+
+Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code")
+Reported-by: "James E.J. Bottomley" <James.Bottomley@HansenPartnership.com>
+Cc: stable@vger.kernel.org
+Cc: David Howells <dhowells@redhat.com>
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Acked-by Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm.h | 4 ----
+ include/linux/tpm.h | 5 ++++-
+ security/keys/trusted-keys/trusted_tpm2.c | 22 ++++++++++++++++++----
+ 3 files changed, 22 insertions(+), 9 deletions(-)
+
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -164,8 +164,6 @@ extern const struct file_operations tpmr
+ extern struct idr dev_nums_idr;
+
+ ssize_t tpm_transmit(struct tpm_chip *chip, u8 *buf, size_t bufsiz);
+-ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
+- size_t min_rsp_body_length, const char *desc);
+ int tpm_get_timeouts(struct tpm_chip *);
+ int tpm_auto_startup(struct tpm_chip *chip);
+
+@@ -194,8 +192,6 @@ static inline void tpm_msleep(unsigned i
+ int tpm_chip_start(struct tpm_chip *chip);
+ void tpm_chip_stop(struct tpm_chip *chip);
+ struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip);
+-__must_check int tpm_try_get_ops(struct tpm_chip *chip);
+-void tpm_put_ops(struct tpm_chip *chip);
+
+ struct tpm_chip *tpm_chip_alloc(struct device *dev,
+ const struct tpm_class_ops *ops);
+--- a/include/linux/tpm.h
++++ b/include/linux/tpm.h
+@@ -397,6 +397,10 @@ static inline u32 tpm2_rc_value(u32 rc)
+ #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
+
+ extern int tpm_is_tpm2(struct tpm_chip *chip);
++extern __must_check int tpm_try_get_ops(struct tpm_chip *chip);
++extern void tpm_put_ops(struct tpm_chip *chip);
++extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
++ size_t min_rsp_body_length, const char *desc);
+ extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
+ struct tpm_digest *digest);
+ extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
+@@ -410,7 +414,6 @@ static inline int tpm_is_tpm2(struct tpm
+ {
+ return -ENODEV;
+ }
+-
+ static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx,
+ struct tpm_digest *digest)
+ {
+--- a/security/keys/trusted-keys/trusted_tpm2.c
++++ b/security/keys/trusted-keys/trusted_tpm2.c
+@@ -83,6 +83,12 @@ int tpm2_seal_trusted(struct tpm_chip *c
+ if (rc)
+ return rc;
+
++ rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE);
++ if (rc) {
++ tpm_put_ops(chip);
++ return rc;
++ }
++
+ tpm_buf_append_u32(&buf, options->keyhandle);
+ tpm2_buf_append_auth(&buf, TPM2_RS_PW,
+ NULL /* nonce */, 0,
+@@ -130,7 +136,7 @@ int tpm2_seal_trusted(struct tpm_chip *c
+ goto out;
+ }
+
+- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf));
++ rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data");
+ if (rc)
+ goto out;
+
+@@ -157,6 +163,7 @@ out:
+ rc = -EPERM;
+ }
+
++ tpm_put_ops(chip);
+ return rc;
+ }
+
+@@ -211,7 +218,7 @@ static int tpm2_load_cmd(struct tpm_chip
+ goto out;
+ }
+
+- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf));
++ rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob");
+ if (!rc)
+ *blob_handle = be32_to_cpup(
+ (__be32 *) &buf.data[TPM_HEADER_SIZE]);
+@@ -260,7 +267,7 @@ static int tpm2_unseal_cmd(struct tpm_ch
+ options->blobauth /* hmac */,
+ TPM_DIGEST_SIZE);
+
+- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf));
++ rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing");
+ if (rc > 0)
+ rc = -EPERM;
+
+@@ -304,12 +311,19 @@ int tpm2_unseal_trusted(struct tpm_chip
+ u32 blob_handle;
+ int rc;
+
+- rc = tpm2_load_cmd(chip, payload, options, &blob_handle);
++ rc = tpm_try_get_ops(chip);
+ if (rc)
+ return rc;
+
++ rc = tpm2_load_cmd(chip, payload, options, &blob_handle);
++ if (rc)
++ goto out;
++
+ rc = tpm2_unseal_cmd(chip, payload, options, blob_handle);
+ tpm2_flush_context(chip, blob_handle);
+
++out:
++ tpm_put_ops(chip);
++
+ return rc;
+ }
--- /dev/null
+From 1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58 Mon Sep 17 00:00:00 2001
+From: James Reynolds <jr@memlen.com>
+Date: Tue, 22 Dec 2020 13:07:04 +0100
+Subject: media: mceusb: Fix potential out-of-bounds shift
+
+From: James Reynolds <jr@memlen.com>
+
+commit 1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58 upstream.
+
+When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in
+ir->txports_cabled comes from response data, and isn't validated.
+
+As ir->txports_cabled is a u8, nothing should be done if the bit index
+is greater than 7.
+
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com
+Signed-off-by: James Reynolds <jr@memlen.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/rc/mceusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1169,7 +1169,7 @@ static void mceusb_handle_command(struct
+ switch (subcmd) {
+ /* the one and only 5-byte return value command */
+ case MCE_RSP_GETPORTSTATUS:
+- if (buf_in[5] == 0)
++ if (buf_in[5] == 0 && *hi < 8)
+ ir->txports_cabled |= 1 << *hi;
+ break;
+
--- /dev/null
+From fc4cac4cfc437659ce445c3c47b807e1cc625b66 Mon Sep 17 00:00:00 2001
+From: Alexander Lobakin <alobakin@pm.me>
+Date: Mon, 8 Feb 2021 12:37:42 +0000
+Subject: MIPS: compressed: fix build with enabled UBSAN
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+commit fc4cac4cfc437659ce445c3c47b807e1cc625b66 upstream.
+
+Commit 1e35918ad9d1 ("MIPS: Enable Undefined Behavior Sanitizer
+UBSAN") added a possibility to build the entire kernel with UBSAN
+instrumentation for MIPS, with the exception for VDSO.
+However, self-extracting head wasn't been added to exceptions, so
+this occurs:
+
+mips-alpine-linux-musl-ld: arch/mips/boot/compressed/decompress.o:
+in function `FSE_buildDTable_wksp':
+decompress.c:(.text.FSE_buildDTable_wksp+0x278): undefined reference
+to `__ubsan_handle_shift_out_of_bounds'
+mips-alpine-linux-musl-ld: decompress.c:(.text.FSE_buildDTable_wksp+0x2a8):
+undefined reference to `__ubsan_handle_shift_out_of_bounds'
+mips-alpine-linux-musl-ld: decompress.c:(.text.FSE_buildDTable_wksp+0x2c4):
+undefined reference to `__ubsan_handle_shift_out_of_bounds'
+mips-alpine-linux-musl-ld: arch/mips/boot/compressed/decompress.o:
+decompress.c:(.text.FSE_buildDTable_raw+0x9c): more undefined references
+to `__ubsan_handle_shift_out_of_bounds' follow
+
+Add UBSAN_SANITIZE := n to mips/boot/compressed/Makefile to exclude
+it from instrumentation scope and fix this issue.
+
+Fixes: 1e35918ad9d1 ("MIPS: Enable Undefined Behavior Sanitizer UBSAN")
+Cc: stable@vger.kernel.org # 5.0+
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/boot/compressed/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/mips/boot/compressed/Makefile
++++ b/arch/mips/boot/compressed/Makefile
+@@ -37,6 +37,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__AS
+ # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
+ KCOV_INSTRUMENT := n
+ GCOV_PROFILE := n
++UBSAN_SANITIZE := n
+
+ # decompressor objects (linked with vmlinuz)
+ vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o
--- /dev/null
+From a5360958a3cd1d876aae1f504ae014658513e1af Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sat, 12 Dec 2020 00:03:54 +0000
+Subject: MIPS: Ingenic: Disable HPTLB for D0 XBurst CPUs too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit a5360958a3cd1d876aae1f504ae014658513e1af upstream.
+
+The JZ4760 has the HPTLB as well, but has a XBurst CPU with a D0 CPUID.
+
+Disable the HPTLB for all XBurst CPUs with a D0 CPUID. In the case where
+there is no HPTLB (e.g. for older SoCs), this won't have any side
+effect.
+
+Fixes: b02efeb05699 ("MIPS: Ingenic: Disable abandoned HPTLB function.")
+Cc: <stable@vger.kernel.org> # 5.4
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Reviewed-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kernel/cpu-probe.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/arch/mips/kernel/cpu-probe.c
++++ b/arch/mips/kernel/cpu-probe.c
+@@ -1830,16 +1830,17 @@ static inline void cpu_probe_ingenic(str
+ */
+ case PRID_COMP_INGENIC_D0:
+ c->isa_level &= ~MIPS_CPU_ISA_M32R2;
+- break;
++ fallthrough;
+
+ /*
+ * The config0 register in the XBurst CPUs with a processor ID of
+- * PRID_COMP_INGENIC_D1 has an abandoned huge page tlb mode, this
+- * mode is not compatible with the MIPS standard, it will cause
+- * tlbmiss and into an infinite loop (line 21 in the tlb-funcs.S)
+- * when starting the init process. After chip reset, the default
+- * is HPTLB mode, Write 0xa9000000 to cp0 register 5 sel 4 to
+- * switch back to VTLB mode to prevent getting stuck.
++ * PRID_COMP_INGENIC_D0 or PRID_COMP_INGENIC_D1 has an abandoned
++ * huge page tlb mode, this mode is not compatible with the MIPS
++ * standard, it will cause tlbmiss and into an infinite loop
++ * (line 21 in the tlb-funcs.S) when starting the init process.
++ * After chip reset, the default is HPTLB mode, Write 0xa9000000
++ * to cp0 register 5 sel 4 to switch back to VTLB mode to prevent
++ * getting stuck.
+ */
+ case PRID_COMP_INGENIC_D1:
+ write_c0_page_ctrl(XBURST_PAGECTRL_HPTLB_DIS);
--- /dev/null
+From 5373ae67c3aad1ab306cc722b5a80b831eb4d4d1 Mon Sep 17 00:00:00 2001
+From: Aurelien Jarno <aurelien@aurel32.net>
+Date: Sat, 9 Jan 2021 20:30:47 +0100
+Subject: MIPS: Support binutils configured with --enable-mips-fix-loongson3-llsc=yes
+
+From: Aurelien Jarno <aurelien@aurel32.net>
+
+commit 5373ae67c3aad1ab306cc722b5a80b831eb4d4d1 upstream.
+
+From version 2.35, binutils can be configured with
+--enable-mips-fix-loongson3-llsc=yes, which means it defaults to
+-mfix-loongson3-llsc. This breaks labels which might then point at the
+wrong instruction.
+
+The workaround to explicitly pass -mno-fix-loongson3-llsc has been
+added in Linux version 5.1, but is only enabled when building a Loongson
+64 kernel. As vendors might use a common toolchain for building Loongson
+and non-Loongson kernels, just move that workaround to
+arch/mips/Makefile. At the same time update the comments to reflect the
+current status.
+
+Cc: stable@vger.kernel.org # 5.1+
+Cc: YunQiang Su <syq@debian.org>
+Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/Makefile | 19 +++++++++++++++++++
+ arch/mips/loongson64/Platform | 22 ----------------------
+ 2 files changed, 19 insertions(+), 22 deletions(-)
+
+--- a/arch/mips/Makefile
++++ b/arch/mips/Makefile
+@@ -136,6 +136,25 @@ cflags-$(CONFIG_SB1XXX_CORELIS) += $(cal
+ #
+ cflags-y += -fno-stack-check
+
++# binutils from v2.35 when built with --enable-mips-fix-loongson3-llsc=yes,
++# supports an -mfix-loongson3-llsc flag which emits a sync prior to each ll
++# instruction to work around a CPU bug (see __SYNC_loongson3_war in asm/sync.h
++# for a description).
++#
++# We disable this in order to prevent the assembler meddling with the
++# instruction that labels refer to, ie. if we label an ll instruction:
++#
++# 1: ll v0, 0(a0)
++#
++# ...then with the assembler fix applied the label may actually point at a sync
++# instruction inserted by the assembler, and if we were using the label in an
++# exception table the table would no longer contain the address of the ll
++# instruction.
++#
++# Avoid this by explicitly disabling that assembler behaviour.
++#
++cflags-y += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,)
++
+ #
+ # CPU-dependent compiler/assembler options for optimization.
+ #
+--- a/arch/mips/loongson64/Platform
++++ b/arch/mips/loongson64/Platform
+@@ -6,28 +6,6 @@
+ cflags-$(CONFIG_CPU_LOONGSON64) += -Wa,--trap
+
+ #
+-# Some versions of binutils, not currently mainline as of 2019/02/04, support
+-# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction
+-# to work around a CPU bug (see __SYNC_loongson3_war in asm/sync.h for a
+-# description).
+-#
+-# We disable this in order to prevent the assembler meddling with the
+-# instruction that labels refer to, ie. if we label an ll instruction:
+-#
+-# 1: ll v0, 0(a0)
+-#
+-# ...then with the assembler fix applied the label may actually point at a sync
+-# instruction inserted by the assembler, and if we were using the label in an
+-# exception table the table would no longer contain the address of the ll
+-# instruction.
+-#
+-# Avoid this by explicitly disabling that assembler behaviour. If upstream
+-# binutils does not merge support for the flag then we can revisit & remove
+-# this later - for now it ensures vendor toolchains don't cause problems.
+-#
+-cflags-$(CONFIG_CPU_LOONGSON64) += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,)
+-
+-#
+ # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a
+ # as MIPS64 R2; older versions as just R1. This leaves the possibility open
+ # that GCC might generate R2 code for -march=loongson3a which then is rejected
--- /dev/null
+From 76d7fff22be3e4185ee5f9da2eecbd8188e76b2c Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Fri, 15 Jan 2021 12:26:22 -0700
+Subject: MIPS: VDSO: Use CLANG_FLAGS instead of filtering out '--target='
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 76d7fff22be3e4185ee5f9da2eecbd8188e76b2c upstream.
+
+Commit ee67855ecd9d ("MIPS: vdso: Allow clang's --target flag in VDSO
+cflags") allowed the '--target=' flag from the main Makefile to filter
+through to the vDSO. However, it did not bring any of the other clang
+specific flags for controlling the integrated assembler and the GNU
+tools locations (--prefix=, --gcc-toolchain=, and -no-integrated-as).
+Without these, we will get a warning (visible with tinyconfig):
+
+arch/mips/vdso/elf.S:14:1: warning: DWARF2 only supports one section per
+compilation unit
+.pushsection .note.Linux, "a",@note ; .balign 4 ; .long 2f - 1f ; .long
+4484f - 3f ; .long 0 ; 1:.asciz "Linux" ; 2:.balign 4 ; 3:
+^
+arch/mips/vdso/elf.S:34:2: warning: DWARF2 only supports one section per
+compilation unit
+ .section .mips_abiflags, "a"
+ ^
+
+All of these flags are bundled up under CLANG_FLAGS in the main Makefile
+and exported so that they can be added to Makefiles that set their own
+CFLAGS. Use this value instead of filtering out '--target=' so there is
+no warning and all of the tools are properly used.
+
+Cc: stable@vger.kernel.org
+Fixes: ee67855ecd9d ("MIPS: vdso: Allow clang's --target flag in VDSO cflags")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1256
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/vdso/Makefile | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -16,16 +16,13 @@ ccflags-vdso := \
+ $(filter -march=%,$(KBUILD_CFLAGS)) \
+ $(filter -m%-float,$(KBUILD_CFLAGS)) \
+ $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \
++ $(CLANG_FLAGS) \
+ -D__VDSO__
+
+ ifndef CONFIG_64BIT
+ ccflags-vdso += -DBUILD_VDSO32
+ endif
+
+-ifdef CONFIG_CC_IS_CLANG
+-ccflags-vdso += $(filter --target=%,$(KBUILD_CFLAGS))
+-endif
+-
+ #
+ # The -fno-jump-tables flag only prevents the compiler from generating
+ # jump tables but does not prevent the compiler from emitting absolute
--- /dev/null
+From 920fd8a70619074eac7687352c8f1c6f3c2a64a5 Mon Sep 17 00:00:00 2001
+From: Ricky Wu <ricky_wu@realtek.com>
+Date: Thu, 4 Feb 2021 16:31:15 +0800
+Subject: misc: rtsx: init of rts522a add OCP power off when no card is present
+
+From: Ricky Wu <ricky_wu@realtek.com>
+
+commit 920fd8a70619074eac7687352c8f1c6f3c2a64a5 upstream.
+
+Power down OCP for power consumption
+when no SD/MMC card is present
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ricky Wu <ricky_wu@realtek.com>
+Link: https://lore.kernel.org/r/20210204083115.9471-1-ricky_wu@realtek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cardreader/rts5227.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -398,6 +398,11 @@ static int rts522a_extra_init_hw(struct
+ {
+ rts5227_extra_init_hw(pcr);
+
++ /* Power down OCP for power consumption */
++ if (!pcr->card_exist)
++ rtsx_pci_write_register(pcr, FPDCTL, OC_POWER_DOWN,
++ OC_POWER_DOWN);
++
+ rtsx_pci_write_register(pcr, FUNC_FORCE_CTL, FUNC_FORCE_UPME_XMT_DBG,
+ FUNC_FORCE_UPME_XMT_DBG);
+ rtsx_pci_write_register(pcr, PCLK_CTL, 0x04, 0x04);
--- /dev/null
+From 36acd5e24e3000691fb8d1ee31cf959cb1582d35 Mon Sep 17 00:00:00 2001
+From: Mathias Kresin <dev@kresin.me>
+Date: Thu, 7 Jan 2021 23:49:01 +0100
+Subject: phy: lantiq: rcu-usb2: wait after clock enable
+
+From: Mathias Kresin <dev@kresin.me>
+
+commit 36acd5e24e3000691fb8d1ee31cf959cb1582d35 upstream.
+
+Commit 65dc2e725286 ("usb: dwc2: Update Core Reset programming flow.")
+revealed that the phy isn't ready immediately after enabling it's
+clocks. The dwc2_check_core_version() fails and the dwc2 usb driver
+errors out.
+
+Add a short delay to let the phy get up and running. There isn't any
+documentation how much time is required, the value was chosen based on
+tests.
+
+Signed-off-by: Mathias Kresin <dev@kresin.me>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Cc: <stable@vger.kernel.org> # v5.7+
+Link: https://lore.kernel.org/r/20210107224901.2102479-1-dev@kresin.me
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/lantiq/phy-lantiq-rcu-usb2.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
++++ b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c
+@@ -124,8 +124,16 @@ static int ltq_rcu_usb2_phy_power_on(str
+ reset_control_deassert(priv->phy_reset);
+
+ ret = clk_prepare_enable(priv->phy_gate_clk);
+- if (ret)
++ if (ret) {
+ dev_err(dev, "failed to enable PHY gate\n");
++ return ret;
++ }
++
++ /*
++ * at least the xrx200 usb2 phy requires some extra time to be
++ * operational after enabling the clock
++ */
++ usleep_range(100, 200);
+
+ return ret;
+ }
--- /dev/null
+From 19d8e9149c27b689c6224f5c84b96a159342195a Mon Sep 17 00:00:00 2001
+From: Jiri Bohac <jbohac@suse.cz>
+Date: Thu, 18 Feb 2021 12:15:47 +0100
+Subject: pstore: Fix typo in compression option name
+
+From: Jiri Bohac <jbohac@suse.cz>
+
+commit 19d8e9149c27b689c6224f5c84b96a159342195a upstream.
+
+Both pstore_compress() and decompress_record() use a mistyped config
+option name ("PSTORE_COMPRESSION" instead of "PSTORE_COMPRESS"). As
+a result compression and decompression of pstore records was always
+disabled.
+
+Use the correct config option name.
+
+Signed-off-by: Jiri Bohac <jbohac@suse.cz>
+Fixes: fd49e03280e5 ("pstore: Fix linking when crypto API disabled")
+Acked-by: Matteo Croce <mcroce@microsoft.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20210218111547.johvp5klpv3xrpnn@dwarf.suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/pstore/platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -269,7 +269,7 @@ static int pstore_compress(const void *i
+ {
+ int ret;
+
+- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION))
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS))
+ return -EINVAL;
+
+ ret = crypto_comp_compress(tfm, in, inlen, out, &outlen);
+@@ -671,7 +671,7 @@ static void decompress_record(struct pst
+ int unzipped_len;
+ char *unzipped, *workspace;
+
+- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed)
++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS) || !record->compressed)
+ return;
+
+ /* Only PSTORE_TYPE_DMESG support compression. */
--- /dev/null
+From 9f233ffe02e5cef611100cd8c5bcf4de26ca7bef Mon Sep 17 00:00:00 2001
+From: Kai Krakow <kai@kaishome.de>
+Date: Wed, 10 Feb 2021 13:07:25 +0800
+Subject: Revert "bcache: Kill btree_io_wq"
+
+From: Kai Krakow <kai@kaishome.de>
+
+commit 9f233ffe02e5cef611100cd8c5bcf4de26ca7bef upstream.
+
+This reverts commit 56b30770b27d54d68ad51eccc6d888282b568cee.
+
+With the btree using the `system_wq`, I seem to see a lot more desktop
+latency than I should.
+
+After some more investigation, it looks like the original assumption
+of 56b3077 no longer is true, and bcache has a very high potential of
+congesting the `system_wq`. In turn, this introduces laggy desktop
+performance, IO stalls (at least with btrfs), and input events may be
+delayed.
+
+So let's revert this. It's important to note that the semantics of
+using `system_wq` previously mean that `btree_io_wq` should be created
+before and destroyed after other bcache wqs to keep the same
+assumptions.
+
+Cc: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org # 5.4+
+Signed-off-by: Kai Krakow <kai@kaishome.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/bcache/bcache.h | 2 ++
+ drivers/md/bcache/btree.c | 21 +++++++++++++++++++--
+ drivers/md/bcache/super.c | 4 ++++
+ 3 files changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -1042,5 +1042,7 @@ void bch_debug_exit(void);
+ void bch_debug_init(void);
+ void bch_request_exit(void);
+ int bch_request_init(void);
++void bch_btree_exit(void);
++int bch_btree_init(void);
+
+ #endif /* _BCACHE_H */
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -99,6 +99,8 @@
+ #define PTR_HASH(c, k) \
+ (((k)->ptr[0] >> c->bucket_bits) | PTR_GEN(k, 0))
+
++static struct workqueue_struct *btree_io_wq;
++
+ #define insert_lock(s, b) ((b)->level <= (s)->lock)
+
+
+@@ -308,7 +310,7 @@ static void __btree_node_write_done(stru
+ btree_complete_write(b, w);
+
+ if (btree_node_dirty(b))
+- schedule_delayed_work(&b->work, 30 * HZ);
++ queue_delayed_work(btree_io_wq, &b->work, 30 * HZ);
+
+ closure_return_with_destructor(cl, btree_node_write_unlock);
+ }
+@@ -481,7 +483,7 @@ static void bch_btree_leaf_dirty(struct
+ BUG_ON(!i->keys);
+
+ if (!btree_node_dirty(b))
+- schedule_delayed_work(&b->work, 30 * HZ);
++ queue_delayed_work(btree_io_wq, &b->work, 30 * HZ);
+
+ set_btree_node_dirty(b);
+
+@@ -2764,3 +2766,18 @@ void bch_keybuf_init(struct keybuf *buf)
+ spin_lock_init(&buf->lock);
+ array_allocator_init(&buf->freelist);
+ }
++
++void bch_btree_exit(void)
++{
++ if (btree_io_wq)
++ destroy_workqueue(btree_io_wq);
++}
++
++int __init bch_btree_init(void)
++{
++ btree_io_wq = create_singlethread_workqueue("bch_btree_io");
++ if (!btree_io_wq)
++ return -ENOMEM;
++
++ return 0;
++}
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2821,6 +2821,7 @@ static void bcache_exit(void)
+ destroy_workqueue(bcache_wq);
+ if (bch_journal_wq)
+ destroy_workqueue(bch_journal_wq);
++ bch_btree_exit();
+
+ if (bcache_major)
+ unregister_blkdev(bcache_major, "bcache");
+@@ -2876,6 +2877,9 @@ static int __init bcache_init(void)
+ return bcache_major;
+ }
+
++ if (bch_btree_init())
++ goto err;
++
+ bcache_wq = alloc_workqueue("bcache", WQ_MEM_RECLAIM, 0);
+ if (!bcache_wq)
+ goto err;
--- /dev/null
+From efc8278eecfd5e6fa36c5d41e71d038f534fe107 Mon Sep 17 00:00:00 2001
+From: Anson Jacob <Anson.Jacob@amd.com>
+Date: Thu, 18 Feb 2021 19:42:57 -0500
+Subject: Revert "drm/amd/display: reuse current context instead of recreating one"
+
+From: Anson Jacob <Anson.Jacob@amd.com>
+
+commit efc8278eecfd5e6fa36c5d41e71d038f534fe107 upstream.
+
+This reverts commit 8866a67ab86cc0812e65c04f1ef02bcc41e24d68.
+
+Reason for revert: This breaks hotplug of HDMI on some systems,
+resulting in a blank screen. Caused general hangs on boot/hotplugs.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1487
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1492
+Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211649
+Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
+Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 23 ++++++++++--------
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 27 ++++++----------------
+ drivers/gpu/drm/amd/display/dc/dc_stream.h | 3 +-
+ 3 files changed, 23 insertions(+), 30 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1934,7 +1934,7 @@ static void dm_gpureset_commit_state(str
+ dc_commit_updates_for_stream(
+ dm->dc, bundle->surface_updates,
+ dc_state->stream_status->plane_count,
+- dc_state->streams[k], &bundle->stream_update);
++ dc_state->streams[k], &bundle->stream_update, dc_state);
+ }
+
+ cleanup:
+@@ -1965,7 +1965,8 @@ static void dm_set_dpms_off(struct dc_li
+
+ stream_update.stream = stream_state;
+ dc_commit_updates_for_stream(stream_state->ctx->dc, NULL, 0,
+- stream_state, &stream_update);
++ stream_state, &stream_update,
++ stream_state->ctx->dc->current_state);
+ mutex_unlock(&adev->dm.dc_lock);
+ }
+
+@@ -7548,7 +7549,7 @@ static void amdgpu_dm_commit_planes(stru
+ struct drm_crtc *pcrtc,
+ bool wait_for_vblank)
+ {
+- int i;
++ uint32_t i;
+ uint64_t timestamp_ns;
+ struct drm_plane *plane;
+ struct drm_plane_state *old_plane_state, *new_plane_state;
+@@ -7589,7 +7590,7 @@ static void amdgpu_dm_commit_planes(stru
+ amdgpu_dm_commit_cursors(state);
+
+ /* update planes when needed */
+- for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) {
++ for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) {
+ struct drm_crtc *crtc = new_plane_state->crtc;
+ struct drm_crtc_state *new_crtc_state;
+ struct drm_framebuffer *fb = new_plane_state->fb;
+@@ -7812,7 +7813,8 @@ static void amdgpu_dm_commit_planes(stru
+ bundle->surface_updates,
+ planes_count,
+ acrtc_state->stream,
+- &bundle->stream_update);
++ &bundle->stream_update,
++ dc_state);
+
+ /**
+ * Enable or disable the interrupts on the backend.
+@@ -8148,13 +8150,13 @@ static void amdgpu_dm_atomic_commit_tail
+ struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state);
+ struct dm_connector_state *dm_old_con_state = to_dm_connector_state(old_con_state);
+ struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc);
+- struct dc_surface_update surface_updates[MAX_SURFACES];
++ struct dc_surface_update dummy_updates[MAX_SURFACES];
+ struct dc_stream_update stream_update;
+ struct dc_info_packet hdr_packet;
+ struct dc_stream_status *status = NULL;
+ bool abm_changed, hdr_changed, scaling_changed;
+
+- memset(&surface_updates, 0, sizeof(surface_updates));
++ memset(&dummy_updates, 0, sizeof(dummy_updates));
+ memset(&stream_update, 0, sizeof(stream_update));
+
+ if (acrtc) {
+@@ -8211,15 +8213,16 @@ static void amdgpu_dm_atomic_commit_tail
+ * To fix this, DC should permit updating only stream properties.
+ */
+ for (j = 0; j < status->plane_count; j++)
+- surface_updates[j].surface = status->plane_states[j];
++ dummy_updates[j].surface = status->plane_states[0];
+
+
+ mutex_lock(&dm->dc_lock);
+ dc_commit_updates_for_stream(dm->dc,
+- surface_updates,
++ dummy_updates,
+ status->plane_count,
+ dm_new_crtc_state->stream,
+- &stream_update);
++ &stream_update,
++ dc_state);
+ mutex_unlock(&dm->dc_lock);
+ }
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2679,7 +2679,8 @@ void dc_commit_updates_for_stream(struct
+ struct dc_surface_update *srf_updates,
+ int surface_count,
+ struct dc_stream_state *stream,
+- struct dc_stream_update *stream_update)
++ struct dc_stream_update *stream_update,
++ struct dc_state *state)
+ {
+ const struct dc_stream_status *stream_status;
+ enum surface_update_type update_type;
+@@ -2698,12 +2699,6 @@ void dc_commit_updates_for_stream(struct
+
+
+ if (update_type >= UPDATE_TYPE_FULL) {
+- struct dc_plane_state *new_planes[MAX_SURFACES];
+-
+- memset(new_planes, 0, sizeof(new_planes));
+-
+- for (i = 0; i < surface_count; i++)
+- new_planes[i] = srf_updates[i].surface;
+
+ /* initialize scratch memory for building context */
+ context = dc_create_state(dc);
+@@ -2712,21 +2707,15 @@ void dc_commit_updates_for_stream(struct
+ return;
+ }
+
+- dc_resource_state_copy_construct(
+- dc->current_state, context);
++ dc_resource_state_copy_construct(state, context);
+
+- /*remove old surfaces from context */
+- if (!dc_rem_all_planes_for_stream(dc, stream, context)) {
+- DC_ERROR("Failed to remove streams for new validate context!\n");
+- return;
+- }
++ for (i = 0; i < dc->res_pool->pipe_count; i++) {
++ struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i];
++ struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i];
+
+- /* add surface to context */
+- if (!dc_add_all_planes_for_stream(dc, stream, new_planes, surface_count, context)) {
+- DC_ERROR("Failed to add streams for new validate context!\n");
+- return;
++ if (new_pipe->plane_state && new_pipe->plane_state != old_pipe->plane_state)
++ new_pipe->plane_state->force_full_update = true;
+ }
+-
+ }
+
+
+--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+@@ -283,7 +283,8 @@ void dc_commit_updates_for_stream(struct
+ struct dc_surface_update *srf_updates,
+ int surface_count,
+ struct dc_stream_state *stream,
+- struct dc_stream_update *stream_update);
++ struct dc_stream_update *stream_update,
++ struct dc_state *state);
+ /*
+ * Log the current stream state.
+ */
--- /dev/null
+From 910f1601addae3e430fc7d3cd589d7622c5df693 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 3 Feb 2021 14:03:50 -0500
+Subject: Revert "drm/amd/display: Update NV1x SR latency values"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 910f1601addae3e430fc7d3cd589d7622c5df693 upstream.
+
+This reverts commit 4a3dea8932d3b1199680d2056dd91d31d94d70b7.
+
+This causes blank screens for some users.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1388
+Cc: Alvin Lee <alvin.lee2@amd.com>
+Cc: Jun Lei <Jun.Lei@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -408,8 +408,8 @@ static struct _vcs_dpi_soc_bounding_box_
+ },
+ },
+ .num_states = 5,
+- .sr_exit_time_us = 11.6,
+- .sr_enter_plus_exit_time_us = 13.9,
++ .sr_exit_time_us = 8.6,
++ .sr_enter_plus_exit_time_us = 10.9,
+ .urgent_latency_us = 4.0,
+ .urgent_latency_pixel_data_only_us = 4.0,
+ .urgent_latency_pixel_mixed_with_vm_data_us = 4.0,
--- /dev/null
+From fe82de91af83a9212b6c704b1ce6cf6d129a108b Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Tue, 19 Jan 2021 19:15:31 +0800
+Subject: Revert "MIPS: Octeon: Remove special handling of CONFIG_MIPS_ELF_APPENDED_DTB=y"
+
+From: Kevin Hao <haokexin@gmail.com>
+
+commit fe82de91af83a9212b6c704b1ce6cf6d129a108b upstream.
+
+This reverts commit d9df9fb901d25b941ab2cfb5b570d91fb2abf7a3.
+
+For the OCTEON boards, it need to patch the built-in DTB before using
+it. Previously it judges if it is a built-in DTB by checking
+fw_passed_dtb. But after commit 37e5c69ffd41 ("MIPS: head.S: Init
+fw_passed_dtb to builtin DTB", the fw_passed_dtb is initialized even
+when using built-in DTB. This causes the OCTEON boards boot broken due
+to an unpatched built-in DTB is used. Revert the commit d9df9fb901d2 to
+restore the codes before the fw_passed_dtb is used and then fix this
+issue.
+
+Fixed: 37e5c69ffd41 ("MIPS: head.S: Init fw_passed_dtb to builtin DTB")
+Cc: stable@vger.kernel.org
+Suggested-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/cavium-octeon/setup.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -1149,12 +1149,15 @@ void __init device_tree_init(void)
+ bool do_prune;
+ bool fill_mac;
+
+- if (fw_passed_dtb) {
+- fdt = (void *)fw_passed_dtb;
++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB
++ if (!fdt_check_header(&__appended_dtb)) {
++ fdt = &__appended_dtb;
+ do_prune = false;
+ fill_mac = true;
+ pr_info("Using appended Device Tree.\n");
+- } else if (octeon_bootinfo->minor_version >= 3 && octeon_bootinfo->fdt_addr) {
++ } else
++#endif
++ if (octeon_bootinfo->minor_version >= 3 && octeon_bootinfo->fdt_addr) {
+ fdt = phys_to_virt(octeon_bootinfo->fdt_addr);
+ if (fdt_check_header(fdt))
+ panic("Corrupt Device Tree passed to kernel.");
--- /dev/null
+From aaf15f8c6de932861f1fce6aeec6a89ac0e354b6 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sun, 21 Feb 2021 18:10:42 -0800
+Subject: scsi: sd: Fix Opal support
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit aaf15f8c6de932861f1fce6aeec6a89ac0e354b6 upstream.
+
+The SCSI core has been modified recently such that it only processes PM
+requests if rpm_status != RPM_ACTIVE. Since some Opal requests are
+submitted while rpm_status != RPM_ACTIVE, set flag RQF_PM for Opal
+requests.
+
+See also https://bugzilla.kernel.org/show_bug.cgi?id=211227.
+
+[mkp: updated sha for PM patch]
+
+Link: https://lore.kernel.org/r/20210222021042.3534-1-bvanassche@acm.org
+Fixes: d80210f25ff0 ("sd: add support for TCG OPAL self encrypting disks")
+Fixes: e6044f714b25 ("scsi: core: Only process PM requests if rpm_status != RPM_ACTIVE")
+Cc: chriscjsus@yahoo.com
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: stable@vger.kernel.org
+Reported-by: chriscjsus@yahoo.com
+Tested-by: chriscjsus@yahoo.com
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/sd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -707,9 +707,9 @@ static int sd_sec_submit(void *data, u16
+ put_unaligned_be16(spsp, &cdb[2]);
+ put_unaligned_be32(len, &cdb[6]);
+
+- ret = scsi_execute_req(sdev, cdb,
+- send ? DMA_TO_DEVICE : DMA_FROM_DEVICE,
+- buffer, len, NULL, SD_TIMEOUT, sdkp->max_retries, NULL);
++ ret = scsi_execute(sdev, cdb, send ? DMA_TO_DEVICE : DMA_FROM_DEVICE,
++ buffer, len, NULL, NULL, SD_TIMEOUT, sdkp->max_retries, 0,
++ RQF_PM, NULL);
+ return ret <= 0 ? ret : -EIO;
+ }
+ #endif /* CONFIG_BLK_SED_OPAL */
--- /dev/null
+From 04b38d012556199ba4c31195940160e0c44c64f0 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Mon, 11 Jan 2021 17:28:39 +0000
+Subject: seccomp: Add missing return in non-void function
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 04b38d012556199ba4c31195940160e0c44c64f0 upstream.
+
+We don't actually care about the value, since the kernel will panic
+before that; but a value should nonetheless be returned, otherwise the
+compiler will complain.
+
+Fixes: 8112c4f140fa ("seccomp: remove 2-phase API")
+Cc: stable@vger.kernel.org # 4.7+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20210111172839.640914-1-paul@crapouillou.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/seccomp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1284,6 +1284,8 @@ static int __seccomp_filter(int this_sys
+ const bool recheck_after_trace)
+ {
+ BUG();
++
++ return -1;
+ }
+ #endif
+
--- /dev/null
+From a9ffe682c58aaff643764547f5420e978b6e0830 Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Sat, 19 Dec 2020 12:05:27 +0200
+Subject: selinux: fix inconsistency between inode_getxattr and inode_listsecurity
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit a9ffe682c58aaff643764547f5420e978b6e0830 upstream.
+
+When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr
+calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will
+intercept in inode_getxattr hooks.
+
+When selinux LSM is installed but not initialized, it will list the
+security.selinux xattr in inode_listsecurity, but will not intercept it
+in inode_getxattr. This results in -ENODATA for a getxattr call for an
+xattr returned by listxattr.
+
+This situation was manifested as overlayfs failure to copy up lower
+files from squashfs when selinux is built-in but not initialized,
+because ovl_copy_xattr() iterates the lower inode xattrs by
+vfs_listxattr() and vfs_getxattr().
+
+Match the logic of inode_listsecurity to that of inode_getxattr and
+do not list the security.selinux xattr if selinux is not initialized.
+
+Reported-by: Michael Labriola <michael.d.labriola@gmail.com>
+Tested-by: Michael Labriola <michael.d.labriola@gmail.com>
+Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/
+Fixes: c8e222616c7e ("selinux: allow reading labels before policy is loaded")
+Cc: stable@vger.kernel.org#v5.9+
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/selinux/hooks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3413,6 +3413,10 @@ static int selinux_inode_setsecurity(str
+ static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
+ {
+ const int len = sizeof(XATTR_NAME_SELINUX);
++
++ if (!selinux_initialized(&selinux_state))
++ return 0;
++
+ if (buffer && len <= buffer_size)
+ memcpy(buffer, XATTR_NAME_SELINUX, len);
+ return len;
block-reopen-the-device-in-blkdev_reread_part.patch
block-fix-logging-on-capacity-change.patch
ide-falconide-fix-module-unload.patch
+scsi-sd-fix-opal-support.patch
+blk-settings-align-max_sectors-on-logical_block_size-boundary.patch
+soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch
+acpi-property-fix-fwnode-string-properties-matching.patch
+acpi-configfs-add-missing-check-after-configfs_register_default_group.patch
+cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch
+hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch
+hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch
+input-raydium_ts_i2c-do-not-send-zero-length.patch
+input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch
+input-joydev-prevent-potential-read-overflow-in-ioctl.patch
+input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch
+media-mceusb-fix-potential-out-of-bounds-shift.patch
+usb-serial-option-update-interface-mapping-for-zte-p685m.patch
+usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch
+usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch
+usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch
+usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch
+usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch
+usb-serial-mos7840-fix-error-code-in-mos7840_write.patch
+usb-serial-mos7720-fix-error-code-in-mos7720_write.patch
+phy-lantiq-rcu-usb2-wait-after-clock-enable.patch
+alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch
+alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch
+alsa-usb-audio-more-strict-state-change-in-ep.patch
+alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch
+alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch
+alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch
+alsa-hda-add-another-cometlake-h-pci-id.patch
+alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch
+alsa-hda-realtek-modify-eapd-in-the-alc886.patch
+alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch
+mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch
+mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch
+mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch
+revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch
+mips-compressed-fix-build-with-enabled-ubsan.patch
+revert-bcache-kill-btree_io_wq.patch
+bcache-give-btree_io_wq-correct-semantics-again.patch
+bcache-move-journal-work-to-new-flush-wq.patch
+revert-drm-amd-display-update-nv1x-sr-latency-values.patch
+drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch
+drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch
+drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch
+revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch
+drm-amdkfd-fix-recursive-lock-warnings.patch
+drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch
+drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch
+drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch
+drm-ttm-fix-a-memory-leak.patch
+drm-nouveau-kms-handle-mdp-connectors.patch
+drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch
+drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch
+drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch
+drm-rockchip-require-the-ytr-modifier-for-afbc.patch
+asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch
+selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch
+erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch
+tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch
+tpm_tis-clean-up-locality-release.patch
+keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch
+keys-trusted-fix-migratable-1-failing.patch
+keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch
+btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch
+btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch
+btrfs-add-asserts-for-deleting-backref-cache-nodes.patch
+btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch
+btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch
+btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch
+btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch
+btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch
+btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch
+drm-i915-gt-flush-before-changing-register-state.patch
+drm-i915-gt-correct-surface-base-address-for-renderclear.patch
+crypto-arm64-sha-add-missing-module-aliases.patch
+crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch
+crypto-michael_mic-fix-broken-misalignment-handling.patch
+crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch
+crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch
+crypto-sun4i-ss-handle-bigendian-for-cipher.patch
+crypto-sun4i-ss-initialize-need_fallback.patch
+soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch
+soc-samsung-exynos-asv-handle-reading-revision-register-error.patch
+seccomp-add-missing-return-in-non-void-function.patch
+arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch
+misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch
+drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch
+pstore-fix-typo-in-compression-option-name.patch
+dts64-mt7622-fix-slow-sd-card-access.patch
+arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch
+staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch
+staging-gdm724x-fix-dma-from-stack.patch
+staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch
--- /dev/null
+From 0458b88267c637fb872b0359da9ff0b243081e9e Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Mon, 7 Dec 2020 20:05:14 +0100
+Subject: soc: samsung: exynos-asv: don't defer early on not-supported SoCs
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 0458b88267c637fb872b0359da9ff0b243081e9e upstream.
+
+Check if the SoC is really supported before gathering the needed
+resources. This fixes endless deferred probe on some SoCs other than
+Exynos5422 (like Exynos5410).
+
+Fixes: 5ea428595cc5 ("soc: samsung: Add Exynos Adaptive Supply Voltage driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Pankaj Dubey <pankaj.dubey@samsung.com>
+Link: https://lore.kernel.org/r/20201207190517.262051-2-krzk@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/samsung/exynos-asv.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/soc/samsung/exynos-asv.c
++++ b/drivers/soc/samsung/exynos-asv.c
+@@ -119,11 +119,6 @@ static int exynos_asv_probe(struct platf
+ u32 product_id = 0;
+ int ret, i;
+
+- cpu_dev = get_cpu_device(0);
+- ret = dev_pm_opp_get_opp_count(cpu_dev);
+- if (ret < 0)
+- return -EPROBE_DEFER;
+-
+ asv = devm_kzalloc(&pdev->dev, sizeof(*asv), GFP_KERNEL);
+ if (!asv)
+ return -ENOMEM;
+@@ -144,6 +139,11 @@ static int exynos_asv_probe(struct platf
+ return -ENODEV;
+ }
+
++ cpu_dev = get_cpu_device(0);
++ ret = dev_pm_opp_get_opp_count(cpu_dev);
++ if (ret < 0)
++ return -EPROBE_DEFER;
++
+ ret = of_property_read_u32(pdev->dev.of_node, "samsung,asv-bin",
+ &asv->of_bin);
+ if (ret < 0)
--- /dev/null
+From 4561560dfb4f847a0b327d48bdd1f45bf1b6261f Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 7 Dec 2020 20:05:15 +0100
+Subject: soc: samsung: exynos-asv: handle reading revision register error
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 4561560dfb4f847a0b327d48bdd1f45bf1b6261f upstream.
+
+If regmap_read() fails, the product_id local variable will contain
+random value from the stack. Do not try to parse such value and fail
+the ASV driver probe.
+
+Fixes: 5ea428595cc5 ("soc: samsung: Add Exynos Adaptive Supply Voltage driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Reviewed-by: Pankaj Dubey <pankaj.dubey@samsung.com>
+Link: https://lore.kernel.org/r/20201207190517.262051-3-krzk@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soc/samsung/exynos-asv.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/soc/samsung/exynos-asv.c
++++ b/drivers/soc/samsung/exynos-asv.c
+@@ -129,7 +129,13 @@ static int exynos_asv_probe(struct platf
+ return PTR_ERR(asv->chipid_regmap);
+ }
+
+- regmap_read(asv->chipid_regmap, EXYNOS_CHIPID_REG_PRO_ID, &product_id);
++ ret = regmap_read(asv->chipid_regmap, EXYNOS_CHIPID_REG_PRO_ID,
++ &product_id);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "Cannot read revision from ChipID: %d\n",
++ ret);
++ return -ENODEV;
++ }
+
+ switch (product_id & EXYNOS_MASK) {
+ case 0xE5422000:
--- /dev/null
+From 957e3f797917b36355766807b1d8a54a1ba0cfc9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marcin=20=C5=9Alusarz?= <marcin.slusarz@intel.com>
+Date: Mon, 8 Feb 2021 13:01:03 +0100
+Subject: soundwire: intel: fix possible crash when no device is detected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marcin Ślusarz <marcin.slusarz@intel.com>
+
+commit 957e3f797917b36355766807b1d8a54a1ba0cfc9 upstream.
+
+acpi_walk_namespace can return success without executing our
+callback which initializes info->handle.
+If the random value in this structure is a valid address (which
+is on the stack, so it's quite possible), then nothing bad will
+happen, because:
+sdw_intel_scan_controller
+ -> acpi_bus_get_device
+ -> acpi_get_device_data
+ -> acpi_get_data_full
+ -> acpi_ns_validate_handle
+will reject this handle.
+
+However, if the value from the stack doesn't point to a valid
+address, we get this:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000050
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP NOPTI
+CPU: 6 PID: 472 Comm: systemd-udevd Tainted: G W 5.10.0-1-amd64 #1 Debian 5.10.4-1
+Hardware name: HP HP Pavilion Laptop 15-cs3xxx/86E2, BIOS F.05 01/01/2020
+RIP: 0010:acpi_ns_validate_handle+0x1a/0x23
+Code: 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 44 00 00 48 8d 57 ff 48 89 f8 48 83 fa fd 76 08 48 8b 05 0c b8 67 01 c3 <80> 7f 08 0f 74 02 31 c0 c3 0f 1f 44 00 00 48 8b 3d f6 b7 67 01 e8
+RSP: 0000:ffffc388807c7b20 EFLAGS: 00010213
+RAX: 0000000000000048 RBX: ffffc388807c7b70 RCX: 0000000000000000
+RDX: 0000000000000047 RSI: 0000000000000246 RDI: 0000000000000048
+RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
+R10: ffffffffc0f5f4d1 R11: ffffffff8f0cb268 R12: 0000000000001001
+R13: ffffffff8e33b160 R14: 0000000000000048 R15: 0000000000000000
+FS: 00007f24548288c0(0000) GS:ffff9f781fb80000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000050 CR3: 0000000106158004 CR4: 0000000000770ee0
+PKRU: 55555554
+Call Trace:
+ acpi_get_data_full+0x4d/0x92
+ acpi_bus_get_device+0x1f/0x40
+ sdw_intel_acpi_scan+0x59/0x230 [soundwire_intel]
+ ? strstr+0x22/0x60
+ ? dmi_matches+0x76/0xe0
+ snd_intel_dsp_driver_probe.cold+0xaf/0x163 [snd_intel_dspcfg]
+ azx_probe+0x7a/0x970 [snd_hda_intel]
+ local_pci_probe+0x42/0x80
+ ? _cond_resched+0x16/0x40
+ pci_device_probe+0xfd/0x1b0
+ really_probe+0x205/0x460
+ driver_probe_device+0xe1/0x150
+ device_driver_attach+0xa1/0xb0
+ __driver_attach+0x8a/0x150
+ ? device_driver_attach+0xb0/0xb0
+ ? device_driver_attach+0xb0/0xb0
+ bus_for_each_dev+0x78/0xc0
+ bus_add_driver+0x12b/0x1e0
+ driver_register+0x8b/0xe0
+ ? 0xffffffffc0f65000
+ do_one_initcall+0x44/0x1d0
+ ? do_init_module+0x23/0x250
+ ? kmem_cache_alloc_trace+0xf5/0x200
+ do_init_module+0x5c/0x250
+ __do_sys_finit_module+0xb1/0x110
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Marcin Ślusarz <marcin.slusarz@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+CC: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20210208120104.204761-1-marcin.slusarz@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/soundwire/intel_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/soundwire/intel_init.c
++++ b/drivers/soundwire/intel_init.c
+@@ -405,11 +405,12 @@ int sdw_intel_acpi_scan(acpi_handle *par
+ {
+ acpi_status status;
+
++ info->handle = NULL;
+ status = acpi_walk_namespace(ACPI_TYPE_DEVICE,
+ parent_handle, 1,
+ sdw_intel_acpi_cb,
+ NULL, info, NULL);
+- if (ACPI_FAILURE(status))
++ if (ACPI_FAILURE(status) || info->handle == NULL)
+ return -ENODEV;
+
+ return sdw_intel_scan_controller(info);
--- /dev/null
+From 7c3a0635cd008eaca9a734dc802709ee0b81cac5 Mon Sep 17 00:00:00 2001
+From: Amey Narkhede <ameynarkhede03@gmail.com>
+Date: Thu, 11 Feb 2021 11:08:19 +0530
+Subject: staging: gdm724x: Fix DMA from stack
+
+From: Amey Narkhede <ameynarkhede03@gmail.com>
+
+commit 7c3a0635cd008eaca9a734dc802709ee0b81cac5 upstream.
+
+Stack allocated buffers cannot be used for DMA
+on all architectures so allocate hci_packet buffer
+using kmalloc.
+
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Amey Narkhede <ameynarkhede03@gmail.com>
+Link: https://lore.kernel.org/r/20210211053819.34858-1-ameynarkhede03@gmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/gdm724x/gdm_usb.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/staging/gdm724x/gdm_usb.c
++++ b/drivers/staging/gdm724x/gdm_usb.c
+@@ -56,20 +56,24 @@ static int gdm_usb_recv(void *priv_dev,
+
+ static int request_mac_address(struct lte_udev *udev)
+ {
+- u8 buf[16] = {0,};
+- struct hci_packet *hci = (struct hci_packet *)buf;
++ struct hci_packet *hci;
+ struct usb_device *usbdev = udev->usbdev;
+ int actual;
+ int ret = -1;
+
++ hci = kmalloc(struct_size(hci, data, 1), GFP_KERNEL);
++ if (!hci)
++ return -ENOMEM;
++
+ hci->cmd_evt = gdm_cpu_to_dev16(udev->gdm_ed, LTE_GET_INFORMATION);
+ hci->len = gdm_cpu_to_dev16(udev->gdm_ed, 1);
+ hci->data[0] = MAC_ADDRESS;
+
+- ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), buf, 5,
++ ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), hci, 5,
+ &actual, 1000);
+
+ udev->request_mac_addr = 1;
++ kfree(hci);
+
+ return ret;
+ }
--- /dev/null
+From 1f92798cbe7fe923479cff754dd06dd23d352e36 Mon Sep 17 00:00:00 2001
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Date: Fri, 29 Jan 2021 19:45:07 -0800
+Subject: staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c
+
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+
+commit 1f92798cbe7fe923479cff754dd06dd23d352e36 upstream.
+
+Also use KBUILD_MODNAME for module name.
+
+This driver is only used by RALINK MIPS MT7621 SoCs. Tested by building
+against that target using OpenWrt with Linux 5.10.10.
+
+Fixes the following error:
+error: the following would cause module name conflict:
+ drivers/dma/mediatek/mtk-hsdma.ko
+ drivers/staging/mt7621-dma/mtk-hsdma.ko
+
+Cc: stable@vger.kernel.org
+Cc: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Link: https://lore.kernel.org/r/20210130034507.2115280-1-ilya.lipnitskiy@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/mt7621-dma/Makefile | 2
+ drivers/staging/mt7621-dma/hsdma-mt7621.c | 760 ++++++++++++++++++++++++++++++
+ drivers/staging/mt7621-dma/mtk-hsdma.c | 760 ------------------------------
+ 3 files changed, 761 insertions(+), 761 deletions(-)
+ rename drivers/staging/mt7621-dma/{mtk-hsdma.c => hsdma-mt7621.c} (99%)
+
+--- a/drivers/staging/mt7621-dma/Makefile
++++ b/drivers/staging/mt7621-dma/Makefile
+@@ -1,4 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+-obj-$(CONFIG_MTK_HSDMA) += mtk-hsdma.o
++obj-$(CONFIG_MTK_HSDMA) += hsdma-mt7621.o
+
+ ccflags-y += -I$(srctree)/drivers/dma
+--- /dev/null
++++ b/drivers/staging/mt7621-dma/hsdma-mt7621.c
+@@ -0,0 +1,760 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * Copyright (C) 2015, Michael Lee <igvtee@gmail.com>
++ * MTK HSDMA support
++ */
++
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/init.h>
++#include <linux/list.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/irq.h>
++#include <linux/of_dma.h>
++#include <linux/reset.h>
++#include <linux/of_device.h>
++
++#include "virt-dma.h"
++
++#define HSDMA_BASE_OFFSET 0x800
++
++#define HSDMA_REG_TX_BASE 0x00
++#define HSDMA_REG_TX_CNT 0x04
++#define HSDMA_REG_TX_CTX 0x08
++#define HSDMA_REG_TX_DTX 0x0c
++#define HSDMA_REG_RX_BASE 0x100
++#define HSDMA_REG_RX_CNT 0x104
++#define HSDMA_REG_RX_CRX 0x108
++#define HSDMA_REG_RX_DRX 0x10c
++#define HSDMA_REG_INFO 0x200
++#define HSDMA_REG_GLO_CFG 0x204
++#define HSDMA_REG_RST_CFG 0x208
++#define HSDMA_REG_DELAY_INT 0x20c
++#define HSDMA_REG_FREEQ_THRES 0x210
++#define HSDMA_REG_INT_STATUS 0x220
++#define HSDMA_REG_INT_MASK 0x228
++#define HSDMA_REG_SCH_Q01 0x280
++#define HSDMA_REG_SCH_Q23 0x284
++
++#define HSDMA_DESCS_MAX 0xfff
++#define HSDMA_DESCS_NUM 8
++#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1)
++#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK)
++
++/* HSDMA_REG_INFO */
++#define HSDMA_INFO_INDEX_MASK 0xf
++#define HSDMA_INFO_INDEX_SHIFT 24
++#define HSDMA_INFO_BASE_MASK 0xff
++#define HSDMA_INFO_BASE_SHIFT 16
++#define HSDMA_INFO_RX_MASK 0xff
++#define HSDMA_INFO_RX_SHIFT 8
++#define HSDMA_INFO_TX_MASK 0xff
++#define HSDMA_INFO_TX_SHIFT 0
++
++/* HSDMA_REG_GLO_CFG */
++#define HSDMA_GLO_TX_2B_OFFSET BIT(31)
++#define HSDMA_GLO_CLK_GATE BIT(30)
++#define HSDMA_GLO_BYTE_SWAP BIT(29)
++#define HSDMA_GLO_MULTI_DMA BIT(10)
++#define HSDMA_GLO_TWO_BUF BIT(9)
++#define HSDMA_GLO_32B_DESC BIT(8)
++#define HSDMA_GLO_BIG_ENDIAN BIT(7)
++#define HSDMA_GLO_TX_DONE BIT(6)
++#define HSDMA_GLO_BT_MASK 0x3
++#define HSDMA_GLO_BT_SHIFT 4
++#define HSDMA_GLO_RX_BUSY BIT(3)
++#define HSDMA_GLO_RX_DMA BIT(2)
++#define HSDMA_GLO_TX_BUSY BIT(1)
++#define HSDMA_GLO_TX_DMA BIT(0)
++
++#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT)
++#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT)
++
++#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \
++ HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES)
++
++/* HSDMA_REG_RST_CFG */
++#define HSDMA_RST_RX_SHIFT 16
++#define HSDMA_RST_TX_SHIFT 0
++
++/* HSDMA_REG_DELAY_INT */
++#define HSDMA_DELAY_INT_EN BIT(15)
++#define HSDMA_DELAY_PEND_OFFSET 8
++#define HSDMA_DELAY_TIME_OFFSET 0
++#define HSDMA_DELAY_TX_OFFSET 16
++#define HSDMA_DELAY_RX_OFFSET 0
++
++#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \
++ ((x) << HSDMA_DELAY_PEND_OFFSET))
++#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \
++ HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x))
++
++/* HSDMA_REG_INT_STATUS */
++#define HSDMA_INT_DELAY_RX_COH BIT(31)
++#define HSDMA_INT_DELAY_RX_INT BIT(30)
++#define HSDMA_INT_DELAY_TX_COH BIT(29)
++#define HSDMA_INT_DELAY_TX_INT BIT(28)
++#define HSDMA_INT_RX_MASK 0x3
++#define HSDMA_INT_RX_SHIFT 16
++#define HSDMA_INT_RX_Q0 BIT(16)
++#define HSDMA_INT_TX_MASK 0xf
++#define HSDMA_INT_TX_SHIFT 0
++#define HSDMA_INT_TX_Q0 BIT(0)
++
++/* tx/rx dma desc flags */
++#define HSDMA_PLEN_MASK 0x3fff
++#define HSDMA_DESC_DONE BIT(31)
++#define HSDMA_DESC_LS0 BIT(30)
++#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16)
++#define HSDMA_DESC_TAG BIT(15)
++#define HSDMA_DESC_LS1 BIT(14)
++#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK)
++
++/* align 4 bytes */
++#define HSDMA_ALIGN_SIZE 3
++/* align size 128bytes */
++#define HSDMA_MAX_PLEN 0x3f80
++
++struct hsdma_desc {
++ u32 addr0;
++ u32 flags;
++ u32 addr1;
++ u32 unused;
++};
++
++struct mtk_hsdma_sg {
++ dma_addr_t src_addr;
++ dma_addr_t dst_addr;
++ u32 len;
++};
++
++struct mtk_hsdma_desc {
++ struct virt_dma_desc vdesc;
++ unsigned int num_sgs;
++ struct mtk_hsdma_sg sg[1];
++};
++
++struct mtk_hsdma_chan {
++ struct virt_dma_chan vchan;
++ unsigned int id;
++ dma_addr_t desc_addr;
++ int tx_idx;
++ int rx_idx;
++ struct hsdma_desc *tx_ring;
++ struct hsdma_desc *rx_ring;
++ struct mtk_hsdma_desc *desc;
++ unsigned int next_sg;
++};
++
++struct mtk_hsdam_engine {
++ struct dma_device ddev;
++ struct device_dma_parameters dma_parms;
++ void __iomem *base;
++ struct tasklet_struct task;
++ volatile unsigned long chan_issued;
++
++ struct mtk_hsdma_chan chan[1];
++};
++
++static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev(
++ struct mtk_hsdma_chan *chan)
++{
++ return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine,
++ ddev);
++}
++
++static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c)
++{
++ return container_of(c, struct mtk_hsdma_chan, vchan.chan);
++}
++
++static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc(
++ struct virt_dma_desc *vdesc)
++{
++ return container_of(vdesc, struct mtk_hsdma_desc, vdesc);
++}
++
++static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg)
++{
++ return readl(hsdma->base + reg);
++}
++
++static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma,
++ unsigned int reg, u32 val)
++{
++ writel(val, hsdma->base + reg);
++}
++
++static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ chan->tx_idx = 0;
++ chan->rx_idx = HSDMA_DESCS_NUM - 1;
++
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
++
++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
++ 0x1 << (chan->id + HSDMA_RST_TX_SHIFT));
++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
++ 0x1 << (chan->id + HSDMA_RST_RX_SHIFT));
++}
++
++static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma)
++{
++ dev_dbg(hsdma->ddev.dev,
++ "tbase %08x, tcnt %08x, tctx %08x, tdtx: %08x, rbase %08x, rcnt %08x, rctx %08x, rdtx %08x\n",
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX),
++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX));
++
++ dev_dbg(hsdma->ddev.dev,
++ "info %08x, glo %08x, delay %08x, intr_stat %08x, intr_mask %08x\n",
++ mtk_hsdma_read(hsdma, HSDMA_REG_INFO),
++ mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG),
++ mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT),
++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS),
++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK));
++}
++
++static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ struct hsdma_desc *tx_desc;
++ struct hsdma_desc *rx_desc;
++ int i;
++
++ dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n",
++ chan->tx_idx, chan->rx_idx);
++
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ tx_desc = &chan->tx_ring[i];
++ rx_desc = &chan->rx_ring[i];
++
++ dev_dbg(hsdma->ddev.dev,
++ "%d tx addr0: %08x, flags %08x, tx addr1: %08x, rx addr0 %08x, flags %08x\n",
++ i, tx_desc->addr0, tx_desc->flags,
++ tx_desc->addr1, rx_desc->addr0, rx_desc->flags);
++ }
++}
++
++static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ int i;
++
++ /* disable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
++
++ /* disable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
++
++ /* init desc value */
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ chan->tx_ring[i].addr0 = 0;
++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
++ }
++ for (i = 0; i < HSDMA_DESCS_NUM; i++) {
++ chan->rx_ring[i].addr0 = 0;
++ chan->rx_ring[i].flags = 0;
++ }
++
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++
++ /* enable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
++
++ /* enable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
++}
++
++static int mtk_hsdma_terminate_all(struct dma_chan *c)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
++ unsigned long timeout;
++ LIST_HEAD(head);
++
++ spin_lock_bh(&chan->vchan.lock);
++ chan->desc = NULL;
++ clear_bit(chan->id, &hsdma->chan_issued);
++ vchan_get_all_descriptors(&chan->vchan, &head);
++ spin_unlock_bh(&chan->vchan.lock);
++
++ vchan_dma_desc_free_list(&chan->vchan, &head);
++
++ /* wait dma transfer complete */
++ timeout = jiffies + msecs_to_jiffies(2000);
++ while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) &
++ (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) {
++ if (time_after_eq(jiffies, timeout)) {
++ hsdma_dump_desc(hsdma, chan);
++ mtk_hsdma_reset(hsdma, chan);
++ dev_err(hsdma->ddev.dev, "timeout, reset it\n");
++ break;
++ }
++ cpu_relax();
++ }
++
++ return 0;
++}
++
++static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ dma_addr_t src, dst;
++ size_t len, tlen;
++ struct hsdma_desc *tx_desc, *rx_desc;
++ struct mtk_hsdma_sg *sg;
++ unsigned int i;
++ int rx_idx;
++
++ sg = &chan->desc->sg[0];
++ len = sg->len;
++ chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN);
++
++ /* tx desc */
++ src = sg->src_addr;
++ for (i = 0; i < chan->desc->num_sgs; i++) {
++ tx_desc = &chan->tx_ring[chan->tx_idx];
++
++ if (len > HSDMA_MAX_PLEN)
++ tlen = HSDMA_MAX_PLEN;
++ else
++ tlen = len;
++
++ if (i & 0x1) {
++ tx_desc->addr1 = src;
++ tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
++ } else {
++ tx_desc->addr0 = src;
++ tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
++
++ /* update index */
++ chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx);
++ }
++
++ src += tlen;
++ len -= tlen;
++ }
++ if (i & 0x1)
++ tx_desc->flags |= HSDMA_DESC_LS0;
++ else
++ tx_desc->flags |= HSDMA_DESC_LS1;
++
++ /* rx desc */
++ rx_idx = HSDMA_NEXT_DESC(chan->rx_idx);
++ len = sg->len;
++ dst = sg->dst_addr;
++ for (i = 0; i < chan->desc->num_sgs; i++) {
++ rx_desc = &chan->rx_ring[rx_idx];
++ if (len > HSDMA_MAX_PLEN)
++ tlen = HSDMA_MAX_PLEN;
++ else
++ tlen = len;
++
++ rx_desc->addr0 = dst;
++ rx_desc->flags = HSDMA_DESC_PLEN0(tlen);
++
++ dst += tlen;
++ len -= tlen;
++
++ /* update index */
++ rx_idx = HSDMA_NEXT_DESC(rx_idx);
++ }
++
++ /* make sure desc and index all up to date */
++ wmb();
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
++
++ return 0;
++}
++
++static int gdma_next_desc(struct mtk_hsdma_chan *chan)
++{
++ struct virt_dma_desc *vdesc;
++
++ vdesc = vchan_next_desc(&chan->vchan);
++ if (!vdesc) {
++ chan->desc = NULL;
++ return 0;
++ }
++ chan->desc = to_mtk_hsdma_desc(vdesc);
++ chan->next_sg = 0;
++
++ return 1;
++}
++
++static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ struct mtk_hsdma_desc *desc;
++ int chan_issued;
++
++ chan_issued = 0;
++ spin_lock_bh(&chan->vchan.lock);
++ desc = chan->desc;
++ if (likely(desc)) {
++ if (chan->next_sg == desc->num_sgs) {
++ list_del(&desc->vdesc.node);
++ vchan_cookie_complete(&desc->vdesc);
++ chan_issued = gdma_next_desc(chan);
++ }
++ } else {
++ dev_dbg(hsdma->ddev.dev, "no desc to complete\n");
++ }
++
++ if (chan_issued)
++ set_bit(chan->id, &hsdma->chan_issued);
++ spin_unlock_bh(&chan->vchan.lock);
++}
++
++static irqreturn_t mtk_hsdma_irq(int irq, void *devid)
++{
++ struct mtk_hsdam_engine *hsdma = devid;
++ u32 status;
++
++ status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS);
++ if (unlikely(!status))
++ return IRQ_NONE;
++
++ if (likely(status & HSDMA_INT_RX_Q0))
++ tasklet_schedule(&hsdma->task);
++ else
++ dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n", status);
++ /* clean intr bits */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status);
++
++ return IRQ_HANDLED;
++}
++
++static void mtk_hsdma_issue_pending(struct dma_chan *c)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
++
++ spin_lock_bh(&chan->vchan.lock);
++ if (vchan_issue_pending(&chan->vchan) && !chan->desc) {
++ if (gdma_next_desc(chan)) {
++ set_bit(chan->id, &hsdma->chan_issued);
++ tasklet_schedule(&hsdma->task);
++ } else {
++ dev_dbg(hsdma->ddev.dev, "no desc to issue\n");
++ }
++ }
++ spin_unlock_bh(&chan->vchan.lock);
++}
++
++static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy(
++ struct dma_chan *c, dma_addr_t dest, dma_addr_t src,
++ size_t len, unsigned long flags)
++{
++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
++ struct mtk_hsdma_desc *desc;
++
++ if (len <= 0)
++ return NULL;
++
++ desc = kzalloc(sizeof(*desc), GFP_ATOMIC);
++ if (!desc) {
++ dev_err(c->device->dev, "alloc memcpy decs error\n");
++ return NULL;
++ }
++
++ desc->sg[0].src_addr = src;
++ desc->sg[0].dst_addr = dest;
++ desc->sg[0].len = len;
++
++ return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
++}
++
++static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c,
++ dma_cookie_t cookie,
++ struct dma_tx_state *state)
++{
++ return dma_cookie_status(c, cookie, state);
++}
++
++static void mtk_hsdma_free_chan_resources(struct dma_chan *c)
++{
++ vchan_free_chan_resources(to_virt_chan(c));
++}
++
++static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc)
++{
++ kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc));
++}
++
++static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++
++ if (test_and_clear_bit(0, &hsdma->chan_issued)) {
++ chan = &hsdma->chan[0];
++ if (chan->desc)
++ mtk_hsdma_start_transfer(hsdma, chan);
++ else
++ dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n");
++ }
++}
++
++static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++ int next_idx, drx_idx, cnt;
++
++ chan = &hsdma->chan[0];
++ next_idx = HSDMA_NEXT_DESC(chan->rx_idx);
++ drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX);
++
++ cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK;
++ if (!cnt)
++ return;
++
++ chan->next_sg += cnt;
++ chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK;
++
++ /* update rx crx */
++ wmb();
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
++
++ mtk_hsdma_chan_done(hsdma, chan);
++}
++
++static void mtk_hsdma_tasklet(struct tasklet_struct *t)
++{
++ struct mtk_hsdam_engine *hsdma = from_tasklet(hsdma, t, task);
++
++ mtk_hsdma_rx(hsdma);
++ mtk_hsdma_tx(hsdma);
++}
++
++static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ int i;
++
++ chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev,
++ 2 * HSDMA_DESCS_NUM *
++ sizeof(*chan->tx_ring),
++ &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO);
++ if (!chan->tx_ring)
++ goto no_mem;
++
++ chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM];
++
++ /* init tx ring value */
++ for (i = 0; i < HSDMA_DESCS_NUM; i++)
++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
++
++ return 0;
++no_mem:
++ return -ENOMEM;
++}
++
++static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma,
++ struct mtk_hsdma_chan *chan)
++{
++ if (chan->tx_ring) {
++ dma_free_coherent(hsdma->ddev.dev,
++ 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
++ chan->tx_ring, chan->desc_addr);
++ chan->tx_ring = NULL;
++ chan->rx_ring = NULL;
++ }
++}
++
++static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++ int ret;
++ u32 reg;
++
++ /* init desc */
++ chan = &hsdma->chan[0];
++ ret = mtk_hsdam_alloc_desc(hsdma, chan);
++ if (ret)
++ return ret;
++
++ /* tx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr);
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM);
++ /* rx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr +
++ (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM));
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM);
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++
++ /* enable rx intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
++
++ /* enable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
++
++ /* hardware info */
++ reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO);
++ dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n",
++ (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK,
++ (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK);
++
++ hsdma_dump_reg(hsdma);
++
++ return ret;
++}
++
++static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma)
++{
++ struct mtk_hsdma_chan *chan;
++
++ /* disable dma */
++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
++
++ /* disable intr */
++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
++
++ /* free desc */
++ chan = &hsdma->chan[0];
++ mtk_hsdam_free_desc(hsdma, chan);
++
++ /* tx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0);
++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0);
++ /* rx */
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0);
++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0);
++ /* reset */
++ mtk_hsdma_reset_chan(hsdma, chan);
++}
++
++static const struct of_device_id mtk_hsdma_of_match[] = {
++ { .compatible = "mediatek,mt7621-hsdma" },
++ { },
++};
++
++static int mtk_hsdma_probe(struct platform_device *pdev)
++{
++ const struct of_device_id *match;
++ struct mtk_hsdma_chan *chan;
++ struct mtk_hsdam_engine *hsdma;
++ struct dma_device *dd;
++ int ret;
++ int irq;
++ void __iomem *base;
++
++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
++ if (ret)
++ return ret;
++
++ match = of_match_device(mtk_hsdma_of_match, &pdev->dev);
++ if (!match)
++ return -EINVAL;
++
++ hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL);
++ if (!hsdma)
++ return -EINVAL;
++
++ base = devm_platform_ioremap_resource(pdev, 0);
++ if (IS_ERR(base))
++ return PTR_ERR(base);
++ hsdma->base = base + HSDMA_BASE_OFFSET;
++ tasklet_setup(&hsdma->task, mtk_hsdma_tasklet);
++
++ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return -EINVAL;
++ ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq,
++ 0, dev_name(&pdev->dev), hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to request irq\n");
++ return ret;
++ }
++
++ device_reset(&pdev->dev);
++
++ dd = &hsdma->ddev;
++ dma_cap_set(DMA_MEMCPY, dd->cap_mask);
++ dd->copy_align = HSDMA_ALIGN_SIZE;
++ dd->device_free_chan_resources = mtk_hsdma_free_chan_resources;
++ dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy;
++ dd->device_terminate_all = mtk_hsdma_terminate_all;
++ dd->device_tx_status = mtk_hsdma_tx_status;
++ dd->device_issue_pending = mtk_hsdma_issue_pending;
++ dd->dev = &pdev->dev;
++ dd->dev->dma_parms = &hsdma->dma_parms;
++ dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN);
++ INIT_LIST_HEAD(&dd->channels);
++
++ chan = &hsdma->chan[0];
++ chan->id = 0;
++ chan->vchan.desc_free = mtk_hsdma_desc_free;
++ vchan_init(&chan->vchan, dd);
++
++ /* init hardware */
++ ret = mtk_hsdma_init(hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to alloc ring descs\n");
++ return ret;
++ }
++
++ ret = dma_async_device_register(dd);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to register dma device\n");
++ goto err_uninit_hsdma;
++ }
++
++ ret = of_dma_controller_register(pdev->dev.of_node,
++ of_dma_xlate_by_chan_id, hsdma);
++ if (ret) {
++ dev_err(&pdev->dev, "failed to register of dma controller\n");
++ goto err_unregister;
++ }
++
++ platform_set_drvdata(pdev, hsdma);
++
++ return 0;
++
++err_unregister:
++ dma_async_device_unregister(dd);
++err_uninit_hsdma:
++ mtk_hsdma_uninit(hsdma);
++ return ret;
++}
++
++static int mtk_hsdma_remove(struct platform_device *pdev)
++{
++ struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev);
++
++ mtk_hsdma_uninit(hsdma);
++
++ of_dma_controller_free(pdev->dev.of_node);
++ dma_async_device_unregister(&hsdma->ddev);
++
++ return 0;
++}
++
++static struct platform_driver mtk_hsdma_driver = {
++ .probe = mtk_hsdma_probe,
++ .remove = mtk_hsdma_remove,
++ .driver = {
++ .name = KBUILD_MODNAME,
++ .of_match_table = mtk_hsdma_of_match,
++ },
++};
++module_platform_driver(mtk_hsdma_driver);
++
++MODULE_AUTHOR("Michael Lee <igvtee@gmail.com>");
++MODULE_DESCRIPTION("MTK HSDMA driver");
++MODULE_LICENSE("GPL v2");
+--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
++++ /dev/null
+@@ -1,760 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/*
+- * Copyright (C) 2015, Michael Lee <igvtee@gmail.com>
+- * MTK HSDMA support
+- */
+-
+-#include <linux/dmaengine.h>
+-#include <linux/dma-mapping.h>
+-#include <linux/err.h>
+-#include <linux/init.h>
+-#include <linux/list.h>
+-#include <linux/module.h>
+-#include <linux/platform_device.h>
+-#include <linux/slab.h>
+-#include <linux/spinlock.h>
+-#include <linux/irq.h>
+-#include <linux/of_dma.h>
+-#include <linux/reset.h>
+-#include <linux/of_device.h>
+-
+-#include "virt-dma.h"
+-
+-#define HSDMA_BASE_OFFSET 0x800
+-
+-#define HSDMA_REG_TX_BASE 0x00
+-#define HSDMA_REG_TX_CNT 0x04
+-#define HSDMA_REG_TX_CTX 0x08
+-#define HSDMA_REG_TX_DTX 0x0c
+-#define HSDMA_REG_RX_BASE 0x100
+-#define HSDMA_REG_RX_CNT 0x104
+-#define HSDMA_REG_RX_CRX 0x108
+-#define HSDMA_REG_RX_DRX 0x10c
+-#define HSDMA_REG_INFO 0x200
+-#define HSDMA_REG_GLO_CFG 0x204
+-#define HSDMA_REG_RST_CFG 0x208
+-#define HSDMA_REG_DELAY_INT 0x20c
+-#define HSDMA_REG_FREEQ_THRES 0x210
+-#define HSDMA_REG_INT_STATUS 0x220
+-#define HSDMA_REG_INT_MASK 0x228
+-#define HSDMA_REG_SCH_Q01 0x280
+-#define HSDMA_REG_SCH_Q23 0x284
+-
+-#define HSDMA_DESCS_MAX 0xfff
+-#define HSDMA_DESCS_NUM 8
+-#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1)
+-#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK)
+-
+-/* HSDMA_REG_INFO */
+-#define HSDMA_INFO_INDEX_MASK 0xf
+-#define HSDMA_INFO_INDEX_SHIFT 24
+-#define HSDMA_INFO_BASE_MASK 0xff
+-#define HSDMA_INFO_BASE_SHIFT 16
+-#define HSDMA_INFO_RX_MASK 0xff
+-#define HSDMA_INFO_RX_SHIFT 8
+-#define HSDMA_INFO_TX_MASK 0xff
+-#define HSDMA_INFO_TX_SHIFT 0
+-
+-/* HSDMA_REG_GLO_CFG */
+-#define HSDMA_GLO_TX_2B_OFFSET BIT(31)
+-#define HSDMA_GLO_CLK_GATE BIT(30)
+-#define HSDMA_GLO_BYTE_SWAP BIT(29)
+-#define HSDMA_GLO_MULTI_DMA BIT(10)
+-#define HSDMA_GLO_TWO_BUF BIT(9)
+-#define HSDMA_GLO_32B_DESC BIT(8)
+-#define HSDMA_GLO_BIG_ENDIAN BIT(7)
+-#define HSDMA_GLO_TX_DONE BIT(6)
+-#define HSDMA_GLO_BT_MASK 0x3
+-#define HSDMA_GLO_BT_SHIFT 4
+-#define HSDMA_GLO_RX_BUSY BIT(3)
+-#define HSDMA_GLO_RX_DMA BIT(2)
+-#define HSDMA_GLO_TX_BUSY BIT(1)
+-#define HSDMA_GLO_TX_DMA BIT(0)
+-
+-#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT)
+-#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT)
+-
+-#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \
+- HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES)
+-
+-/* HSDMA_REG_RST_CFG */
+-#define HSDMA_RST_RX_SHIFT 16
+-#define HSDMA_RST_TX_SHIFT 0
+-
+-/* HSDMA_REG_DELAY_INT */
+-#define HSDMA_DELAY_INT_EN BIT(15)
+-#define HSDMA_DELAY_PEND_OFFSET 8
+-#define HSDMA_DELAY_TIME_OFFSET 0
+-#define HSDMA_DELAY_TX_OFFSET 16
+-#define HSDMA_DELAY_RX_OFFSET 0
+-
+-#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \
+- ((x) << HSDMA_DELAY_PEND_OFFSET))
+-#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \
+- HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x))
+-
+-/* HSDMA_REG_INT_STATUS */
+-#define HSDMA_INT_DELAY_RX_COH BIT(31)
+-#define HSDMA_INT_DELAY_RX_INT BIT(30)
+-#define HSDMA_INT_DELAY_TX_COH BIT(29)
+-#define HSDMA_INT_DELAY_TX_INT BIT(28)
+-#define HSDMA_INT_RX_MASK 0x3
+-#define HSDMA_INT_RX_SHIFT 16
+-#define HSDMA_INT_RX_Q0 BIT(16)
+-#define HSDMA_INT_TX_MASK 0xf
+-#define HSDMA_INT_TX_SHIFT 0
+-#define HSDMA_INT_TX_Q0 BIT(0)
+-
+-/* tx/rx dma desc flags */
+-#define HSDMA_PLEN_MASK 0x3fff
+-#define HSDMA_DESC_DONE BIT(31)
+-#define HSDMA_DESC_LS0 BIT(30)
+-#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16)
+-#define HSDMA_DESC_TAG BIT(15)
+-#define HSDMA_DESC_LS1 BIT(14)
+-#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK)
+-
+-/* align 4 bytes */
+-#define HSDMA_ALIGN_SIZE 3
+-/* align size 128bytes */
+-#define HSDMA_MAX_PLEN 0x3f80
+-
+-struct hsdma_desc {
+- u32 addr0;
+- u32 flags;
+- u32 addr1;
+- u32 unused;
+-};
+-
+-struct mtk_hsdma_sg {
+- dma_addr_t src_addr;
+- dma_addr_t dst_addr;
+- u32 len;
+-};
+-
+-struct mtk_hsdma_desc {
+- struct virt_dma_desc vdesc;
+- unsigned int num_sgs;
+- struct mtk_hsdma_sg sg[1];
+-};
+-
+-struct mtk_hsdma_chan {
+- struct virt_dma_chan vchan;
+- unsigned int id;
+- dma_addr_t desc_addr;
+- int tx_idx;
+- int rx_idx;
+- struct hsdma_desc *tx_ring;
+- struct hsdma_desc *rx_ring;
+- struct mtk_hsdma_desc *desc;
+- unsigned int next_sg;
+-};
+-
+-struct mtk_hsdam_engine {
+- struct dma_device ddev;
+- struct device_dma_parameters dma_parms;
+- void __iomem *base;
+- struct tasklet_struct task;
+- volatile unsigned long chan_issued;
+-
+- struct mtk_hsdma_chan chan[1];
+-};
+-
+-static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev(
+- struct mtk_hsdma_chan *chan)
+-{
+- return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine,
+- ddev);
+-}
+-
+-static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c)
+-{
+- return container_of(c, struct mtk_hsdma_chan, vchan.chan);
+-}
+-
+-static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc(
+- struct virt_dma_desc *vdesc)
+-{
+- return container_of(vdesc, struct mtk_hsdma_desc, vdesc);
+-}
+-
+-static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg)
+-{
+- return readl(hsdma->base + reg);
+-}
+-
+-static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma,
+- unsigned int reg, u32 val)
+-{
+- writel(val, hsdma->base + reg);
+-}
+-
+-static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- chan->tx_idx = 0;
+- chan->rx_idx = HSDMA_DESCS_NUM - 1;
+-
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
+-
+- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
+- 0x1 << (chan->id + HSDMA_RST_TX_SHIFT));
+- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG,
+- 0x1 << (chan->id + HSDMA_RST_RX_SHIFT));
+-}
+-
+-static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma)
+-{
+- dev_dbg(hsdma->ddev.dev,
+- "tbase %08x, tcnt %08x, tctx %08x, tdtx: %08x, rbase %08x, rcnt %08x, rctx %08x, rdtx %08x\n",
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX),
+- mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX));
+-
+- dev_dbg(hsdma->ddev.dev,
+- "info %08x, glo %08x, delay %08x, intr_stat %08x, intr_mask %08x\n",
+- mtk_hsdma_read(hsdma, HSDMA_REG_INFO),
+- mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG),
+- mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT),
+- mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS),
+- mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK));
+-}
+-
+-static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- struct hsdma_desc *tx_desc;
+- struct hsdma_desc *rx_desc;
+- int i;
+-
+- dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n",
+- chan->tx_idx, chan->rx_idx);
+-
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- tx_desc = &chan->tx_ring[i];
+- rx_desc = &chan->rx_ring[i];
+-
+- dev_dbg(hsdma->ddev.dev,
+- "%d tx addr0: %08x, flags %08x, tx addr1: %08x, rx addr0 %08x, flags %08x\n",
+- i, tx_desc->addr0, tx_desc->flags,
+- tx_desc->addr1, rx_desc->addr0, rx_desc->flags);
+- }
+-}
+-
+-static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- int i;
+-
+- /* disable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
+-
+- /* disable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
+-
+- /* init desc value */
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- chan->tx_ring[i].addr0 = 0;
+- chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
+- }
+- for (i = 0; i < HSDMA_DESCS_NUM; i++) {
+- chan->rx_ring[i].addr0 = 0;
+- chan->rx_ring[i].flags = 0;
+- }
+-
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-
+- /* enable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
+-
+- /* enable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
+-}
+-
+-static int mtk_hsdma_terminate_all(struct dma_chan *c)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
+- unsigned long timeout;
+- LIST_HEAD(head);
+-
+- spin_lock_bh(&chan->vchan.lock);
+- chan->desc = NULL;
+- clear_bit(chan->id, &hsdma->chan_issued);
+- vchan_get_all_descriptors(&chan->vchan, &head);
+- spin_unlock_bh(&chan->vchan.lock);
+-
+- vchan_dma_desc_free_list(&chan->vchan, &head);
+-
+- /* wait dma transfer complete */
+- timeout = jiffies + msecs_to_jiffies(2000);
+- while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) &
+- (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) {
+- if (time_after_eq(jiffies, timeout)) {
+- hsdma_dump_desc(hsdma, chan);
+- mtk_hsdma_reset(hsdma, chan);
+- dev_err(hsdma->ddev.dev, "timeout, reset it\n");
+- break;
+- }
+- cpu_relax();
+- }
+-
+- return 0;
+-}
+-
+-static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- dma_addr_t src, dst;
+- size_t len, tlen;
+- struct hsdma_desc *tx_desc, *rx_desc;
+- struct mtk_hsdma_sg *sg;
+- unsigned int i;
+- int rx_idx;
+-
+- sg = &chan->desc->sg[0];
+- len = sg->len;
+- chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN);
+-
+- /* tx desc */
+- src = sg->src_addr;
+- for (i = 0; i < chan->desc->num_sgs; i++) {
+- tx_desc = &chan->tx_ring[chan->tx_idx];
+-
+- if (len > HSDMA_MAX_PLEN)
+- tlen = HSDMA_MAX_PLEN;
+- else
+- tlen = len;
+-
+- if (i & 0x1) {
+- tx_desc->addr1 = src;
+- tx_desc->flags |= HSDMA_DESC_PLEN1(tlen);
+- } else {
+- tx_desc->addr0 = src;
+- tx_desc->flags = HSDMA_DESC_PLEN0(tlen);
+-
+- /* update index */
+- chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx);
+- }
+-
+- src += tlen;
+- len -= tlen;
+- }
+- if (i & 0x1)
+- tx_desc->flags |= HSDMA_DESC_LS0;
+- else
+- tx_desc->flags |= HSDMA_DESC_LS1;
+-
+- /* rx desc */
+- rx_idx = HSDMA_NEXT_DESC(chan->rx_idx);
+- len = sg->len;
+- dst = sg->dst_addr;
+- for (i = 0; i < chan->desc->num_sgs; i++) {
+- rx_desc = &chan->rx_ring[rx_idx];
+- if (len > HSDMA_MAX_PLEN)
+- tlen = HSDMA_MAX_PLEN;
+- else
+- tlen = len;
+-
+- rx_desc->addr0 = dst;
+- rx_desc->flags = HSDMA_DESC_PLEN0(tlen);
+-
+- dst += tlen;
+- len -= tlen;
+-
+- /* update index */
+- rx_idx = HSDMA_NEXT_DESC(rx_idx);
+- }
+-
+- /* make sure desc and index all up to date */
+- wmb();
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx);
+-
+- return 0;
+-}
+-
+-static int gdma_next_desc(struct mtk_hsdma_chan *chan)
+-{
+- struct virt_dma_desc *vdesc;
+-
+- vdesc = vchan_next_desc(&chan->vchan);
+- if (!vdesc) {
+- chan->desc = NULL;
+- return 0;
+- }
+- chan->desc = to_mtk_hsdma_desc(vdesc);
+- chan->next_sg = 0;
+-
+- return 1;
+-}
+-
+-static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- struct mtk_hsdma_desc *desc;
+- int chan_issued;
+-
+- chan_issued = 0;
+- spin_lock_bh(&chan->vchan.lock);
+- desc = chan->desc;
+- if (likely(desc)) {
+- if (chan->next_sg == desc->num_sgs) {
+- list_del(&desc->vdesc.node);
+- vchan_cookie_complete(&desc->vdesc);
+- chan_issued = gdma_next_desc(chan);
+- }
+- } else {
+- dev_dbg(hsdma->ddev.dev, "no desc to complete\n");
+- }
+-
+- if (chan_issued)
+- set_bit(chan->id, &hsdma->chan_issued);
+- spin_unlock_bh(&chan->vchan.lock);
+-}
+-
+-static irqreturn_t mtk_hsdma_irq(int irq, void *devid)
+-{
+- struct mtk_hsdam_engine *hsdma = devid;
+- u32 status;
+-
+- status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS);
+- if (unlikely(!status))
+- return IRQ_NONE;
+-
+- if (likely(status & HSDMA_INT_RX_Q0))
+- tasklet_schedule(&hsdma->task);
+- else
+- dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n", status);
+- /* clean intr bits */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static void mtk_hsdma_issue_pending(struct dma_chan *c)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan);
+-
+- spin_lock_bh(&chan->vchan.lock);
+- if (vchan_issue_pending(&chan->vchan) && !chan->desc) {
+- if (gdma_next_desc(chan)) {
+- set_bit(chan->id, &hsdma->chan_issued);
+- tasklet_schedule(&hsdma->task);
+- } else {
+- dev_dbg(hsdma->ddev.dev, "no desc to issue\n");
+- }
+- }
+- spin_unlock_bh(&chan->vchan.lock);
+-}
+-
+-static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy(
+- struct dma_chan *c, dma_addr_t dest, dma_addr_t src,
+- size_t len, unsigned long flags)
+-{
+- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c);
+- struct mtk_hsdma_desc *desc;
+-
+- if (len <= 0)
+- return NULL;
+-
+- desc = kzalloc(sizeof(*desc), GFP_ATOMIC);
+- if (!desc) {
+- dev_err(c->device->dev, "alloc memcpy decs error\n");
+- return NULL;
+- }
+-
+- desc->sg[0].src_addr = src;
+- desc->sg[0].dst_addr = dest;
+- desc->sg[0].len = len;
+-
+- return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags);
+-}
+-
+-static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c,
+- dma_cookie_t cookie,
+- struct dma_tx_state *state)
+-{
+- return dma_cookie_status(c, cookie, state);
+-}
+-
+-static void mtk_hsdma_free_chan_resources(struct dma_chan *c)
+-{
+- vchan_free_chan_resources(to_virt_chan(c));
+-}
+-
+-static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc)
+-{
+- kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc));
+-}
+-
+-static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+-
+- if (test_and_clear_bit(0, &hsdma->chan_issued)) {
+- chan = &hsdma->chan[0];
+- if (chan->desc)
+- mtk_hsdma_start_transfer(hsdma, chan);
+- else
+- dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n");
+- }
+-}
+-
+-static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+- int next_idx, drx_idx, cnt;
+-
+- chan = &hsdma->chan[0];
+- next_idx = HSDMA_NEXT_DESC(chan->rx_idx);
+- drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX);
+-
+- cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK;
+- if (!cnt)
+- return;
+-
+- chan->next_sg += cnt;
+- chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK;
+-
+- /* update rx crx */
+- wmb();
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx);
+-
+- mtk_hsdma_chan_done(hsdma, chan);
+-}
+-
+-static void mtk_hsdma_tasklet(struct tasklet_struct *t)
+-{
+- struct mtk_hsdam_engine *hsdma = from_tasklet(hsdma, t, task);
+-
+- mtk_hsdma_rx(hsdma);
+- mtk_hsdma_tx(hsdma);
+-}
+-
+-static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- int i;
+-
+- chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev,
+- 2 * HSDMA_DESCS_NUM *
+- sizeof(*chan->tx_ring),
+- &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO);
+- if (!chan->tx_ring)
+- goto no_mem;
+-
+- chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM];
+-
+- /* init tx ring value */
+- for (i = 0; i < HSDMA_DESCS_NUM; i++)
+- chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE;
+-
+- return 0;
+-no_mem:
+- return -ENOMEM;
+-}
+-
+-static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma,
+- struct mtk_hsdma_chan *chan)
+-{
+- if (chan->tx_ring) {
+- dma_free_coherent(hsdma->ddev.dev,
+- 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring),
+- chan->tx_ring, chan->desc_addr);
+- chan->tx_ring = NULL;
+- chan->rx_ring = NULL;
+- }
+-}
+-
+-static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+- int ret;
+- u32 reg;
+-
+- /* init desc */
+- chan = &hsdma->chan[0];
+- ret = mtk_hsdam_alloc_desc(hsdma, chan);
+- if (ret)
+- return ret;
+-
+- /* tx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr);
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM);
+- /* rx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr +
+- (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM));
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM);
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-
+- /* enable rx intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0);
+-
+- /* enable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT);
+-
+- /* hardware info */
+- reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO);
+- dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n",
+- (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK,
+- (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK);
+-
+- hsdma_dump_reg(hsdma);
+-
+- return ret;
+-}
+-
+-static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma)
+-{
+- struct mtk_hsdma_chan *chan;
+-
+- /* disable dma */
+- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0);
+-
+- /* disable intr */
+- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0);
+-
+- /* free desc */
+- chan = &hsdma->chan[0];
+- mtk_hsdam_free_desc(hsdma, chan);
+-
+- /* tx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0);
+- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0);
+- /* rx */
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0);
+- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0);
+- /* reset */
+- mtk_hsdma_reset_chan(hsdma, chan);
+-}
+-
+-static const struct of_device_id mtk_hsdma_of_match[] = {
+- { .compatible = "mediatek,mt7621-hsdma" },
+- { },
+-};
+-
+-static int mtk_hsdma_probe(struct platform_device *pdev)
+-{
+- const struct of_device_id *match;
+- struct mtk_hsdma_chan *chan;
+- struct mtk_hsdam_engine *hsdma;
+- struct dma_device *dd;
+- int ret;
+- int irq;
+- void __iomem *base;
+-
+- ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32));
+- if (ret)
+- return ret;
+-
+- match = of_match_device(mtk_hsdma_of_match, &pdev->dev);
+- if (!match)
+- return -EINVAL;
+-
+- hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL);
+- if (!hsdma)
+- return -EINVAL;
+-
+- base = devm_platform_ioremap_resource(pdev, 0);
+- if (IS_ERR(base))
+- return PTR_ERR(base);
+- hsdma->base = base + HSDMA_BASE_OFFSET;
+- tasklet_setup(&hsdma->task, mtk_hsdma_tasklet);
+-
+- irq = platform_get_irq(pdev, 0);
+- if (irq < 0)
+- return -EINVAL;
+- ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq,
+- 0, dev_name(&pdev->dev), hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to request irq\n");
+- return ret;
+- }
+-
+- device_reset(&pdev->dev);
+-
+- dd = &hsdma->ddev;
+- dma_cap_set(DMA_MEMCPY, dd->cap_mask);
+- dd->copy_align = HSDMA_ALIGN_SIZE;
+- dd->device_free_chan_resources = mtk_hsdma_free_chan_resources;
+- dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy;
+- dd->device_terminate_all = mtk_hsdma_terminate_all;
+- dd->device_tx_status = mtk_hsdma_tx_status;
+- dd->device_issue_pending = mtk_hsdma_issue_pending;
+- dd->dev = &pdev->dev;
+- dd->dev->dma_parms = &hsdma->dma_parms;
+- dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN);
+- INIT_LIST_HEAD(&dd->channels);
+-
+- chan = &hsdma->chan[0];
+- chan->id = 0;
+- chan->vchan.desc_free = mtk_hsdma_desc_free;
+- vchan_init(&chan->vchan, dd);
+-
+- /* init hardware */
+- ret = mtk_hsdma_init(hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to alloc ring descs\n");
+- return ret;
+- }
+-
+- ret = dma_async_device_register(dd);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to register dma device\n");
+- goto err_uninit_hsdma;
+- }
+-
+- ret = of_dma_controller_register(pdev->dev.of_node,
+- of_dma_xlate_by_chan_id, hsdma);
+- if (ret) {
+- dev_err(&pdev->dev, "failed to register of dma controller\n");
+- goto err_unregister;
+- }
+-
+- platform_set_drvdata(pdev, hsdma);
+-
+- return 0;
+-
+-err_unregister:
+- dma_async_device_unregister(dd);
+-err_uninit_hsdma:
+- mtk_hsdma_uninit(hsdma);
+- return ret;
+-}
+-
+-static int mtk_hsdma_remove(struct platform_device *pdev)
+-{
+- struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev);
+-
+- mtk_hsdma_uninit(hsdma);
+-
+- of_dma_controller_free(pdev->dev.of_node);
+- dma_async_device_unregister(&hsdma->ddev);
+-
+- return 0;
+-}
+-
+-static struct platform_driver mtk_hsdma_driver = {
+- .probe = mtk_hsdma_probe,
+- .remove = mtk_hsdma_remove,
+- .driver = {
+- .name = "hsdma-mt7621",
+- .of_match_table = mtk_hsdma_of_match,
+- },
+-};
+-module_platform_driver(mtk_hsdma_driver);
+-
+-MODULE_AUTHOR("Michael Lee <igvtee@gmail.com>");
+-MODULE_DESCRIPTION("MTK HSDMA driver");
+-MODULE_LICENSE("GPL v2");
--- /dev/null
+From 7a8d2f1908a59003e55ef8691d09efb7fbc51625 Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Thu, 4 Feb 2021 09:52:17 +0100
+Subject: staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+commit 7a8d2f1908a59003e55ef8691d09efb7fbc51625 upstream.
+
+The Edimax EW-7811UN V2 uses an RTL8188EU chipset and works with this
+driver.
+
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210204085217.9743-1-martin@kaiser.cx
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -41,6 +41,7 @@ static const struct usb_device_id rtw_us
+ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
+ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
++ {USB_DEVICE(0x7392, 0xb811)}, /* Edimax EW-7811UN V2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
+ };
--- /dev/null
+From e42acf104d6e0bd7ccd2f09103d5be5e6d3c637c Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Thu, 1 Oct 2020 11:09:22 -0700
+Subject: tpm_tis: Clean up locality release
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit e42acf104d6e0bd7ccd2f09103d5be5e6d3c637c upstream.
+
+The current release locality code seems to be based on the
+misunderstanding that the TPM interrupts when a locality is released:
+it doesn't, only when the locality is acquired.
+
+Furthermore, there seems to be no point in waiting for the locality to
+be released. All it does is penalize the last TPM user. However, if
+there's no next TPM user, this is a pointless wait and if there is a
+next TPM user, they'll pay the penalty waiting for the new locality
+(or possibly not if it's the same as the old locality).
+
+Fix the code by making release_locality as simple write to release
+with no waiting for completion.
+
+Cc: stable@ger.kernel.org
+Fixes: 33bafe90824b ("tpm_tis: verify locality released before returning from release_locality")
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 47 ----------------------------------------
+ 1 file changed, 1 insertion(+), 46 deletions(-)
+
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -135,58 +135,13 @@ static bool check_locality(struct tpm_ch
+ return false;
+ }
+
+-static bool locality_inactive(struct tpm_chip *chip, int l)
+-{
+- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+- int rc;
+- u8 access;
+-
+- rc = tpm_tis_read8(priv, TPM_ACCESS(l), &access);
+- if (rc < 0)
+- return false;
+-
+- if ((access & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY))
+- == TPM_ACCESS_VALID)
+- return true;
+-
+- return false;
+-}
+-
+ static int release_locality(struct tpm_chip *chip, int l)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+- unsigned long stop, timeout;
+- long rc;
+
+ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
+
+- stop = jiffies + chip->timeout_a;
+-
+- if (chip->flags & TPM_CHIP_FLAG_IRQ) {
+-again:
+- timeout = stop - jiffies;
+- if ((long)timeout <= 0)
+- return -1;
+-
+- rc = wait_event_interruptible_timeout(priv->int_queue,
+- (locality_inactive(chip, l)),
+- timeout);
+-
+- if (rc > 0)
+- return 0;
+-
+- if (rc == -ERESTARTSYS && freezing(current)) {
+- clear_thread_flag(TIF_SIGPENDING);
+- goto again;
+- }
+- } else {
+- do {
+- if (locality_inactive(chip, l))
+- return 0;
+- tpm_msleep(TPM_TIMEOUT);
+- } while (time_before(jiffies, stop));
+- }
+- return -1;
++ return 0;
+ }
+
+ static int request_locality(struct tpm_chip *chip, int l)
--- /dev/null
+From 3d9ae54af1d02a7c0edc55c77d7df2b921e58a87 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Thu, 1 Oct 2020 11:09:21 -0700
+Subject: tpm_tis: Fix check_locality for correct locality acquisition
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit 3d9ae54af1d02a7c0edc55c77d7df2b921e58a87 upstream.
+
+The TPM TIS specification says the TPM signals the acquisition of locality
+when the TMP_ACCESS_REQUEST_USE bit goes to one *and* the
+TPM_ACCESS_REQUEST_USE bit goes to zero. Currently we only check the
+former not the latter, so check both. Adding the check on
+TPM_ACCESS_REQUEST_USE should fix the case where the locality is
+re-requested before the TPM has released it. In this case the locality may
+get released briefly before it is reacquired, which causes all sorts of
+problems. However, with the added check, TPM_ACCESS_REQUEST_USE should
+remain 1 until the second request for the locality is granted.
+
+Cc: stable@ger.kernel.org
+Fixes: 27084efee0c3 ("[PATCH] tpm: driver for next generation TPM chips")
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -125,7 +125,8 @@ static bool check_locality(struct tpm_ch
+ if (rc < 0)
+ return false;
+
+- if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
++ if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID
++ | TPM_ACCESS_REQUEST_USE)) ==
+ (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) {
+ priv->locality = l;
+ return true;
--- /dev/null
+From 4b049f55ed95cd889bcdb3034fd75e1f01852b38 Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 8 Feb 2021 13:53:16 -0800
+Subject: usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit 4b049f55ed95cd889bcdb3034fd75e1f01852b38 upstream.
+
+The dep->interval captures the number of frames/microframes per interval
+from bInterval. Fullspeed interrupt endpoint bInterval is the number of
+frames per interval and not 2^(bInterval - 1). So fix it here. This
+change is only for debugging purpose and should not affect the interrupt
+endpoint operation.
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/1263b563dedc4ab8b0fb854fba06ce4bc56bd495.1612820995.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -615,8 +615,13 @@ static int dwc3_gadget_set_ep_config(str
+ if (dwc->gadget->speed == USB_SPEED_FULL)
+ bInterval_m1 = 0;
+
++ if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT &&
++ dwc->gadget->speed == USB_SPEED_FULL)
++ dep->interval = desc->bInterval;
++ else
++ dep->interval = 1 << (desc->bInterval - 1);
++
+ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
+- dep->interval = 1 << (desc->bInterval - 1);
+ }
+
+ return dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_SETEPCONFIG, ¶ms);
--- /dev/null
+From a1679af85b2ae35a2b78ad04c18bb069c37330cc Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Mon, 8 Feb 2021 13:53:10 -0800
+Subject: usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit a1679af85b2ae35a2b78ad04c18bb069c37330cc upstream.
+
+Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it must be set
+to 0 when the controller operates in full-speed. See the programming
+guide for DEPCFG command section 3.2.2.1 (v3.30a).
+
+Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/3f57026f993c0ce71498dbb06e49b3a47c4d0265.1612820995.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -605,7 +605,17 @@ static int dwc3_gadget_set_ep_config(str
+ params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1);
+
+ if (desc->bInterval) {
+- params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1);
++ u8 bInterval_m1;
++
++ /*
++ * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it
++ * must be set to 0 when the controller operates in full-speed.
++ */
++ bInterval_m1 = min_t(u8, desc->bInterval - 1, 13);
++ if (dwc->gadget->speed == USB_SPEED_FULL)
++ bInterval_m1 = 0;
++
++ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1);
+ dep->interval = 1 << (desc->bInterval - 1);
+ }
+
--- /dev/null
+From 0eaa1a3714db34a59ce121de5733c3909c529463 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sat, 23 Jan 2021 14:24:59 +0000
+Subject: usb: musb: Fix runtime PM race in musb_queue_resume_work
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 0eaa1a3714db34a59ce121de5733c3909c529463 upstream.
+
+musb_queue_resume_work() would call the provided callback if the runtime
+PM status was 'active'. Otherwise, it would enqueue the request if the
+hardware was still suspended (musb->is_runtime_suspended is true).
+
+This causes a race with the runtime PM handlers, as it is possible to be
+in the case where the runtime PM status is not yet 'active', but the
+hardware has been awaken (PM resume function has been called).
+
+When hitting the race, the resume work was not enqueued, which probably
+triggered other bugs further down the stack. For instance, a telnet
+connection on Ingenic SoCs would result in a 50/50 chance of a
+segmentation fault somewhere in the musb code.
+
+Rework the code so that either we call the callback directly if
+(musb->is_runtime_suspended == 0), or enqueue the query otherwise.
+
+Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
+Cc: stable@vger.kernel.org # v4.9+
+Tested-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://lore.kernel.org/r/20210123142502.16980-1-paul@crapouillou.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_core.c | 31 +++++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2240,32 +2240,35 @@ int musb_queue_resume_work(struct musb *
+ {
+ struct musb_pending_work *w;
+ unsigned long flags;
++ bool is_suspended;
+ int error;
+
+ if (WARN_ON(!callback))
+ return -EINVAL;
+
+- if (pm_runtime_active(musb->controller))
+- return callback(musb, data);
++ spin_lock_irqsave(&musb->list_lock, flags);
++ is_suspended = musb->is_runtime_suspended;
+
+- w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
+- if (!w)
+- return -ENOMEM;
++ if (is_suspended) {
++ w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC);
++ if (!w) {
++ error = -ENOMEM;
++ goto out_unlock;
++ }
++
++ w->callback = callback;
++ w->data = data;
+
+- w->callback = callback;
+- w->data = data;
+- spin_lock_irqsave(&musb->list_lock, flags);
+- if (musb->is_runtime_suspended) {
+ list_add_tail(&w->node, &musb->pending_list);
+ error = 0;
+- } else {
+- dev_err(musb->controller, "could not add resume work %p\n",
+- callback);
+- devm_kfree(musb->controller, w);
+- error = -EINPROGRESS;
+ }
++
++out_unlock:
+ spin_unlock_irqrestore(&musb->list_lock, flags);
+
++ if (!is_suspended)
++ error = callback(musb, data);
++
+ return error;
+ }
+ EXPORT_SYMBOL_GPL(musb_queue_resume_work);
--- /dev/null
+From 528222d0c8ce93e435a95cd1e476b60409dd5381 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 26 Jan 2021 14:59:17 +0100
+Subject: USB: serial: ftdi_sio: fix FTX sub-integer prescaler
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 528222d0c8ce93e435a95cd1e476b60409dd5381 upstream.
+
+The most-significant bit of the sub-integer-prescaler index is set in
+the high byte of the baudrate request wIndex also for FTX devices.
+
+This fixes rates like 1152000 which got mapped to 1.2 MBd.
+
+Reported-by: Vladimir <svv75@mail.ru>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210351
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1386,8 +1386,9 @@ static int change_speed(struct tty_struc
+ index_value = get_ftdi_divisor(tty, port);
+ value = (u16)index_value;
+ index = (u16)(index_value >> 16);
+- if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) ||
+- (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) {
++ if (priv->chip_type == FT2232C || priv->chip_type == FT2232H ||
++ priv->chip_type == FT4232H || priv->chip_type == FT232H ||
++ priv->chip_type == FTX) {
+ /* Probably the BM type needs the MSB of the encoded fractional
+ * divider also moved like for the chips above. Any infos? */
+ index = (u16)((index << 8) | priv->interface);
--- /dev/null
+From fea7372cbc40869876df0f045e367f6f97a1666c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 28 Jan 2021 12:35:23 +0300
+Subject: USB: serial: mos7720: fix error code in mos7720_write()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit fea7372cbc40869876df0f045e367f6f97a1666c upstream.
+
+This code should return -ENOMEM if the kmalloc() fails but instead
+it returns success.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/mos7720.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1092,8 +1092,10 @@ static int mos7720_write(struct tty_stru
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+ GFP_ATOMIC);
+- if (!urb->transfer_buffer)
++ if (!urb->transfer_buffer) {
++ bytes_sent = -ENOMEM;
+ goto exit;
++ }
+ }
+ transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
+
--- /dev/null
+From a70aa7dc60099bbdcbd6faca42a915d80f31161e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 26 Jan 2021 13:26:54 +0300
+Subject: USB: serial: mos7840: fix error code in mos7840_write()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a70aa7dc60099bbdcbd6faca42a915d80f31161e upstream.
+
+This should return -ENOMEM instead of 0 if the kmalloc() fails.
+
+Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/mos7840.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -883,8 +883,10 @@ static int mos7840_write(struct tty_stru
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+ GFP_ATOMIC);
+- if (!urb->transfer_buffer)
++ if (!urb->transfer_buffer) {
++ bytes_sent = -ENOMEM;
+ goto exit;
++ }
+ }
+ transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE);
+
--- /dev/null
+From 6420a569504e212d618d4a4736e2c59ed80a8478 Mon Sep 17 00:00:00 2001
+From: Lech Perczak <lech.perczak@gmail.com>
+Date: Sun, 7 Feb 2021 01:54:43 +0100
+Subject: USB: serial: option: update interface mapping for ZTE P685M
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lech Perczak <lech.perczak@gmail.com>
+
+commit 6420a569504e212d618d4a4736e2c59ed80a8478 upstream.
+
+This patch prepares for qmi_wwan driver support for the device.
+Previously "option" driver mapped itself to interfaces 0 and 3 (matching
+ff/ff/ff), while interface 3 is in fact a QMI port.
+Interfaces 1 and 2 (matching ff/00/00) expose AT commands,
+and weren't supported previously at all.
+Without this patch, a possible conflict would exist if device ID was
+added to qmi_wwan driver for interface 3.
+
+Update and simplify device ID to match interfaces 0-2 directly,
+to expose QCDM (0), PCUI (1), and modem (2) ports and avoid conflict
+with QMI (3), and ADB (4).
+
+The modem is used inside ZTE MF283+ router and carriers identify it as
+such.
+Interface mapping is:
+0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB
+
+T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=1275 Rev=f0.00
+S: Manufacturer=ZTE,Incorporated
+S: Product=ZTE Technologies MSM
+S: SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0
+C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: Johan Hovold <johan@kernel.org>
+Cc: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
+Link: https://lore.kernel.org/r/20210207005443.12936-1-lech.perczak@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1569,7 +1569,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ZTE_VENDOR_ID, 0x1275), /* ZTE P685M */
++ .driver_info = RSVD(3) | RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) },
--- /dev/null
+From 979d9cbe75b922ab1695b8ad5576115774f72e62 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 11 Jan 2021 18:00:19 +0100
+Subject: USB: serial: pl2303: fix line-speed handling on newer chips
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 979d9cbe75b922ab1695b8ad5576115774f72e62 upstream.
+
+The latest chip family (HXN) apparently does not support setting the
+line speed using divisors and instead needs to use the direct encoding
+scheme for all rates.
+
+This specifically enables 50, 110, 134, 200 bps and other rates not
+supported by the original chip type.
+
+Fixes: ebd09f1cd417 ("USB: serial: pl2303: add support for PL2303HXN")
+Cc: stable@vger.kernel.org # 5.5
+Cc: Charles Yeh <charlesyeh522@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/pl2303.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -183,6 +183,7 @@ struct pl2303_type_data {
+ speed_t max_baud_rate;
+ unsigned long quirks;
+ unsigned int no_autoxonxoff:1;
++ unsigned int no_divisors:1;
+ };
+
+ struct pl2303_serial_private {
+@@ -209,6 +210,7 @@ static const struct pl2303_type_data pl2
+ },
+ [TYPE_HXN] = {
+ .max_baud_rate = 12000000,
++ .no_divisors = true,
+ },
+ };
+
+@@ -571,8 +573,12 @@ static void pl2303_encode_baud_rate(stru
+ baud = min_t(speed_t, baud, spriv->type->max_baud_rate);
+ /*
+ * Use direct method for supported baud rates, otherwise use divisors.
++ * Newer chip types do not support divisor encoding.
+ */
+- baud_sup = pl2303_get_supported_baud_rate(baud);
++ if (spriv->type->no_divisors)
++ baud_sup = baud;
++ else
++ baud_sup = pl2303_get_supported_baud_rate(baud);
+
+ if (baud == baud_sup)
+ baud = pl2303_encode_baud_rate_direct(buf, baud);
projects / thirdparty / kernel / stable-queue.git / commitdiff
