--- /dev/null
+From f10a8f9a258a88ca5e8d1a5b04632f2c7607f06e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 10:54:14 +0530
+Subject: ALSA: hda: Fix 2 channel swapping for Tegra
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+[ Upstream commit 216116eae43963c662eb84729507bad95214ca6b ]
+
+The Tegra HDA codec HW implementation has an issue related to not
+swapping the 2 channel Audio Sample Packet(ASP) channel mapping.
+Whatever the FL and FR mapping specified the left channel always
+comes out of left speaker and right channel on right speaker. So
+add condition to disallow the swapping of FL,FR during the playback.
+
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Acked-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/20200825052415.20626-2-mkumard@nvidia.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b8e5f2b19ff85..708efb9b43877 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3431,6 +3431,7 @@ static int tegra_hdmi_build_pcms(struct hda_codec *codec)
+
+ static int patch_tegra_hdmi(struct hda_codec *codec)
+ {
++ struct hdmi_spec *spec;
+ int err;
+
+ err = patch_generic_hdmi(codec);
+@@ -3438,6 +3439,10 @@ static int patch_tegra_hdmi(struct hda_codec *codec)
+ return err;
+
+ codec->patch_ops.build_pcms = tegra_hdmi_build_pcms;
++ spec = codec->spec;
++ spec->chmap.ops.chmap_cea_alloc_validate_get_type =
++ nvhdmi_chmap_cea_alloc_validate_get_type;
++ spec->chmap.ops.chmap_validate = nvhdmi_chmap_validate;
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From fe2c0a4c55bba4503477bb6fff9bc5b288568947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 18:42:18 +0300
+Subject: ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is
+ disabled
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit 13774d81f38538c5fa2924bdcdfa509155480fa6 ]
+
+In snd_hdac_device_init pm_runtime_set_active is called to
+increase child_count in parent device. But when it is failed
+to build connection with GPU for one case that integrated
+graphic gpu is disabled, snd_hdac_ext_bus_device_exit will be
+invoked to clean up a HD-audio extended codec base device. At
+this time the child_count of parent is not decreased, which
+makes parent device can't get suspended.
+
+This patch calls pm_runtime_set_suspended to decrease child_count
+in parent device in snd_hdac_device_exit to match with
+snd_hdac_device_init. pm_runtime_set_suspended can make sure that
+it will not decrease child_count if the device is already suspended.
+
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20200902154218.1440441-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/hdac_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
+index dbf02a3a8d2f2..58b53a4bc4d01 100644
+--- a/sound/hda/hdac_device.c
++++ b/sound/hda/hdac_device.c
+@@ -124,6 +124,8 @@ EXPORT_SYMBOL_GPL(snd_hdac_device_init);
+ void snd_hdac_device_exit(struct hdac_device *codec)
+ {
+ pm_runtime_put_noidle(&codec->dev);
++ /* keep balance of runtime PM child_count in parent device */
++ pm_runtime_set_suspended(&codec->dev);
+ snd_hdac_bus_remove_device(codec->bus, codec);
+ kfree(codec->vendor_name);
+ kfree(codec->chip_name);
+--
+2.25.1
+
--- /dev/null
+From 0a322a2fe728d9d7f702c2e0478772416bdc7e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 19:52:32 -0700
+Subject: ARC: HSDK: wireup perf irq
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit fe81d927b78c4f0557836661d32e41ebc957b024 ]
+
+Newer version of HSDK aka HSDK-4xD (with dual issue HS48x4 CPU) wired up
+the perf interrupt, so enable that in DT.
+This is OK for old HSDK where this irq is ignored because pct irq is not
+wired up in hardware.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index d131c54acd3ec..ab01b75bfa67d 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -83,6 +83,8 @@
+
+ arcpct: pct {
+ compatible = "snps,archs-pct";
++ interrupt-parent = <&cpu_intc>;
++ interrupts = <20>;
+ };
+
+ /* TIMER0 with interrupt for clockevent */
+--
+2.25.1
+
--- /dev/null
+From 1a93d06bb8392e54c7efcefd4dafc9920acb0a56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 18:38:58 +0300
+Subject: ARC: [plat-hsdk]: Switch ethernet phy-mode to rgmii-id
+
+From: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+
+[ Upstream commit 26907eb605fbc3ba9dbf888f21d9d8d04471271d ]
+
+HSDK board has Micrel KSZ9031, recent commit
+bcf3440c6dd ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
+caused a breakdown of Ethernet.
+Using 'phy-mode = "rgmii"' is not correct because accodring RGMII
+specification it is necessary to have delay on RX (PHY to MAX)
+which is not generated in case of "rgmii".
+Using "rgmii-id" adds necessary delay and solves the issue.
+
+Also adding name of PHY placed on HSDK board.
+
+Signed-off-by: Evgeniy Didin <Evgeniy.Didin@synopsys.com>
+Cc: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Cc: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/boot/dts/hsdk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
+index ab01b75bfa67d..f6b6e3c9ca8aa 100644
+--- a/arch/arc/boot/dts/hsdk.dts
++++ b/arch/arc/boot/dts/hsdk.dts
+@@ -175,7 +175,7 @@
+ reg = <0x8000 0x2000>;
+ interrupts = <10>;
+ interrupt-names = "macirq";
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ snps,pbl = <32>;
+ snps,multicast-filter-bins = <256>;
+ clocks = <&gmacclk>;
+@@ -193,7 +193,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ compatible = "snps,dwmac-mdio";
+- phy0: ethernet-phy@0 {
++ phy0: ethernet-phy@0 { /* Micrel KSZ9031 */
+ reg = <0>;
+ ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
+ ti,tx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
+--
+2.25.1
+
--- /dev/null
+From d6072477ec627b4a50a752f0a7fbe3e407c376e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:43:41 -0700
+Subject: ARM: dts: bcm: HR2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d663186293a818af97c648624bee6c7a59e8218b ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e35398cc60a06..dd71ab08136be 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -217,7 +217,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 8ce68d5b9b6d89b029c06aea864ad9174dac005a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:45:29 -0700
+Subject: ARM: dts: BCM5301X: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit b793dab8d811e103665d6bddaaea1c25db3776eb ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 1c8f40650723 ("ARM: dts: BCM5301X: convert to iProc QSPI")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm5301x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
+index a678fb7c9e3b2..c91716d5980c3 100644
+--- a/arch/arm/boot/dts/bcm5301x.dtsi
++++ b/arch/arm/boot/dts/bcm5301x.dtsi
+@@ -445,7 +445,7 @@
+ };
+
+ spi@18029200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x18029200 0x184>,
+ <0x18029000 0x124>,
+ <0x1811b408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From ef9ac5f0006c0cc36b7f0515713f75f4e94b4c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 07:53:38 -0500
+Subject: ARM: dts: logicpd-som-lv-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 4d26e9a028e3d88223e06fa133c3d55af7ddbceb ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree but never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 5cb8b0fa55a9 ("ARM: dts: Move most of logicpd-som-lv-37xx-devkit.dts to logicpd-som-lv-baseboard.dtsi")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+index 3e39b9a1f35d0..0093548d50ff8 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv-baseboard.dtsi
+@@ -55,6 +55,8 @@
+
+ &mcbsp2 {
+ status = "okay";
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ };
+
+ &charger {
+--
+2.25.1
+
--- /dev/null
+From cfbf5372775d718005234f08c5f87e9382d2486a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Aug 2020 21:56:10 -0500
+Subject: ARM: dts: logicpd-torpedo-baseboard: Fix broken audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit d7dfee67688ac7f2dfd4c3bc70c053ee990c40b5 ]
+
+Older versions of U-Boot would pinmux the whole board, but as
+the bootloader got updated, it started to only pinmux the pins
+it needed, and expected Linux to configure what it needed.
+
+Unfortunately this caused an issue with the audio, because the
+mcbsp2 pins were configured in the device tree, they were never
+referenced by the driver. When U-Boot stopped muxing the audio
+pins, the audio died.
+
+This patch adds the references to the associate the pin controller
+with the mcbsp2 driver which makes audio operate again.
+
+Fixes: 739f85bba5ab ("ARM: dts: Move most of logicpd-torpedo-37xx-devkit to logicpd-torpedo-baseboard")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+index 86c5644f558cb..032e8dde13817 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi
+@@ -84,6 +84,8 @@
+ };
+
+ &mcbsp2 {
++ pinctrl-names = "default";
++ pinctrl-0 = <&mcbsp2_pins>;
+ status = "okay";
+ };
+
+--
+2.25.1
+
--- /dev/null
+From a95cf2229da00c536c308bb24b535a60d8d1f05c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jul 2020 12:50:06 +0200
+Subject: ARM: dts: ls1021a: fix QuadSPI-memory reg range
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit 81dbbb417da4d1ac407dca5b434d39d5b6b91ef3 ]
+
+According to the Reference Manual, the correct size is 512 MiB.
+
+Without this fix, probing the QSPI fails:
+
+ fsl-quadspi 1550000.spi: ioremap failed for resource
+ [mem 0x40000000-0x7fffffff]
+ fsl-quadspi 1550000.spi: Freescale QuadSPI probe failed
+ fsl-quadspi: probe of 1550000.spi failed with error -12
+
+Fixes: 85f8ee78ab72 ("ARM: dts: ls1021a: Add support for QSPI with ls1021a SoC")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index d18c043264440..b66b2bd1aa856 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -168,7 +168,7 @@
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x0 0x1550000 0x0 0x10000>,
+- <0x0 0x40000000 0x0 0x40000000>;
++ <0x0 0x40000000 0x0 0x20000000>;
+ reg-names = "QuadSPI", "QuadSPI-memory";
+ interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ clock-names = "qspi_en", "qspi";
+--
+2.25.1
+
--- /dev/null
+From 26ffbe76afe1ae0d8ec83ffb5ec25c9972da8813 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:44:25 -0700
+Subject: ARM: dts: NSP: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit d1ecc40a954fd0f5e3789b91fa80f15e82284e39 ]
+
+The string was incorrectly defined before from least to most
+specific, swap the compatible strings accordingly.
+
+Fixes: 329f98c1974e ("ARM: dts: NSP: Add QSPI nodes to NSPI and bcm958625k DTSes")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi
+index 273a316045798..b395cb195db21 100644
+--- a/arch/arm/boot/dts/bcm-nsp.dtsi
++++ b/arch/arm/boot/dts/bcm-nsp.dtsi
+@@ -274,7 +274,7 @@
+ };
+
+ qspi: spi@27200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-nsp-qspi";
++ compatible = "brcm,spi-nsp-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x027200 0x184>,
+ <0x027000 0x124>,
+ <0x11c408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 3594af1cd77013b51adc327f54c3301a9ab2eba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jul 2020 10:26:40 -0500
+Subject: ARM: dts: socfpga: fix register entry for timer3 on Arria10
+
+From: Dinh Nguyen <dinguyen@kernel.org>
+
+[ Upstream commit 0ff5a4812be4ebd4782bbb555d369636eea164f7 ]
+
+Fixes the register address for the timer3 entry on Arria10.
+
+Fixes: 475dc86d08de4 ("arm: dts: socfpga: Add a base DTSI for Altera's Arria10 SOC")
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index ba5657574d9bb..4b1c8bec2de35 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -791,7 +791,7 @@
+ timer3: timer3@ffd00100 {
+ compatible = "snps,dw-apb-timer";
+ interrupts = <0 118 IRQ_TYPE_LEVEL_HIGH>;
+- reg = <0xffd01000 0x100>;
++ reg = <0xffd00100 0x100>;
+ clocks = <&l4_sys_free_clk>;
+ clock-names = "timer";
+ };
+--
+2.25.1
+
--- /dev/null
+From 95afd7028f755dcbda905e50f12bdbd937d53006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 16:49:19 -0700
+Subject: arm64: dts: ns2: Fixed QSPI compatible string
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 686e0a0c8c61e0e3f55321d0181fece3efd92777 ]
+
+The string was incorrectly defined before from least to most specific,
+swap the compatible strings accordingly.
+
+Fixes: ff73917d38a6 ("ARM64: dts: Add QSPI Device Tree node for NS2")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+index ea854f689fda8..6bfb7bbd264af 100644
+--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi
+@@ -745,7 +745,7 @@
+ };
+
+ qspi: spi@66470200 {
+- compatible = "brcm,spi-bcm-qspi", "brcm,spi-ns2-qspi";
++ compatible = "brcm,spi-ns2-qspi", "brcm,spi-bcm-qspi";
+ reg = <0x66470200 0x184>,
+ <0x66470000 0x124>,
+ <0x67017408 0x004>,
+--
+2.25.1
+
--- /dev/null
+From 1b0c336f82d1e43decd8dfcf3ec2b1c4709a51e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 20:02:50 -0700
+Subject: cpufreq: intel_pstate: Fix intel_pstate_get_hwp_max() for turbo
+ disabled
+
+From: Francisco Jerez <currojerez@riseup.net>
+
+[ Upstream commit eacc9c5a927e474c173a5d53dd7fb8e306511768 ]
+
+This fixes the behavior of the scaling_max_freq and scaling_min_freq
+sysfs files in systems which had turbo disabled by the BIOS.
+
+Caleb noticed that the HWP is programmed to operate in the wrong
+P-state range on his system when the CPUFREQ policy min/max frequency
+is set via sysfs. This seems to be because in his system
+intel_pstate_get_hwp_max() is returning the maximum turbo P-state even
+though turbo was disabled by the BIOS, which causes intel_pstate to
+scale kHz frequencies incorrectly e.g. setting the maximum turbo
+frequency whenever the maximum guaranteed frequency is requested via
+sysfs.
+
+Tested-by: Caleb Callaway <caleb.callaway@intel.com>
+Signed-off-by: Francisco Jerez <currojerez@riseup.net>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+[ rjw: Minor subject edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 8fa22aa2ac65b..864a7e8ebdfc3 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -712,7 +712,7 @@ static void intel_pstate_get_hwp_max(unsigned int cpu, int *phy_max,
+
+ rdmsrl_on_cpu(cpu, MSR_HWP_CAPABILITIES, &cap);
+ WRITE_ONCE(all_cpu_data[cpu]->hwp_cap_cached, cap);
+- if (global.no_turbo)
++ if (global.no_turbo || global.turbo_disabled)
+ *current_max = HWP_GUARANTEED_PERF(cap);
+ else
+ *current_max = HWP_HIGHEST_PERF(cap);
+--
+2.25.1
+
--- /dev/null
+From 1243912267161f4e83e240494a1e2dfab7454fee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Aug 2020 17:40:02 +0200
+Subject: cpufreq: intel_pstate: Refuse to turn off with HWP enabled
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 43298db3009f06fe5c69e1ca8b6cfc2565772fa1 ]
+
+After commit f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive
+mode with HWP enabled") it is possible to change the driver status
+to "off" via sysfs with HWP enabled, which effectively causes the
+driver to unregister itself, but HWP remains active and it forces the
+minimum performance, so even if another cpufreq driver is loaded,
+it will not be able to control the CPU frequency.
+
+For this reason, make the driver refuse to change the status to
+"off" with HWP enabled.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/intel_pstate.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 99166000ffb77..8fa22aa2ac65b 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -2325,9 +2325,15 @@ static int intel_pstate_update_status(const char *buf, size_t size)
+ {
+ int ret;
+
+- if (size == 3 && !strncmp(buf, "off", size))
+- return intel_pstate_driver ?
+- intel_pstate_unregister_driver() : -EINVAL;
++ if (size == 3 && !strncmp(buf, "off", size)) {
++ if (!intel_pstate_driver)
++ return -EINVAL;
++
++ if (hwp_active)
++ return -EBUSY;
++
++ return intel_pstate_unregister_driver();
++ }
+
+ if (size == 6 && !strncmp(buf, "active", size)) {
+ if (intel_pstate_driver) {
+--
+2.25.1
+
--- /dev/null
+From 2a7ed6029c2e697d55362220059862ebc82eb56a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 17:54:21 +0800
+Subject: dmaengine: acpi: Put the CSRT table after using it
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 7eb48dd094de5fe0e216b550e73aa85257903973 ]
+
+The acpi_get_table() should be coupled with acpi_put_table() if
+the mapped table is not used at runtime to release the table
+mapping, put the CSRT table buf after using it.
+
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1595411661-15936-1-git-send-email-guohanjun@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/acpi-dma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
+index 4a748c3435d7d..8d99c84361cbb 100644
+--- a/drivers/dma/acpi-dma.c
++++ b/drivers/dma/acpi-dma.c
+@@ -131,11 +131,13 @@ static void acpi_dma_parse_csrt(struct acpi_device *adev, struct acpi_dma *adma)
+ if (ret < 0) {
+ dev_warn(&adev->dev,
+ "error in parsing resource group\n");
+- return;
++ break;
+ }
+
+ grp = (struct acpi_csrt_group *)((void *)grp + grp->length);
+ }
++
++ acpi_put_table((struct acpi_table_header *)csrt);
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From f1bdbda82cbac8fecac319c3d7419cad603f5a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 00:07:52 -0700
+Subject: drivers/net/wan/hdlc_cisco: Add hard_header_len
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1a545ebe380bf4c1433e3c136e35a77764fda5ad ]
+
+This driver didn't set hard_header_len. This patch sets hard_header_len
+for it according to its header_ops->create function.
+
+This driver's header_ops->create function (cisco_hard_header) creates
+a header of (struct hdlc_header), so hard_header_len should be set to
+sizeof(struct hdlc_header).
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Acked-by: Krzysztof Halasa <khc@pm.waw.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_cisco.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index 320039d329c7d..c169a26e5359a 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -374,6 +374,7 @@ static int cisco_ioctl(struct net_device *dev, struct ifreq *ifr)
+ memcpy(&state(hdlc)->settings, &new_settings, size);
+ spin_lock_init(&state(hdlc)->lock);
+ dev->header_ops = &cisco_header_ops;
++ dev->hard_header_len = sizeof(struct hdlc_header);
+ dev->type = ARPHRD_CISCO;
+ call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
+ netif_dormant_on(dev);
+--
+2.25.1
+
--- /dev/null
+From b68d3eecaab7615e4e7f20758b54d8c9917788e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 14:26:59 -0700
+Subject: drivers/net/wan/lapbether: Added needed_tailroom
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 1ee39c1448c4e0d480c5b390e2db1987561fb5c2 ]
+
+The underlying Ethernet device may request necessary tailroom to be
+allocated by setting needed_tailroom. This driver should also set
+needed_tailroom to request the tailroom needed by the underlying
+Ethernet device to be allocated.
+
+Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index c94dfa70f2a33..6b2553e893aca 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -343,6 +343,7 @@ static int lapbeth_new_device(struct net_device *dev)
+ */
+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len
+ + dev->needed_headroom;
++ ndev->needed_tailroom = dev->needed_tailroom;
+
+ lapbeth = netdev_priv(ndev);
+ lapbeth->axdev = ndev;
+--
+2.25.1
+
--- /dev/null
+From 0fa4ace8bfc9d71a6a6c15f98770f6538d809dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 20:03:53 -0700
+Subject: drivers/net/wan/lapbether: Set network_header before transmitting
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 91244d108441013b7367b3b4dcc6869998676473 ]
+
+Set the skb's network_header before it is passed to the underlying
+Ethernet device for transmission.
+
+This patch fixes the following issue:
+
+When we use this driver with AF_PACKET sockets, there would be error
+messages of:
+ protocol 0805 is buggy, dev (Ethernet interface name)
+printed in the system "dmesg" log.
+
+This is because skbs passed down to the Ethernet device for transmission
+don't have their network_header properly set, and the dev_queue_xmit_nit
+function in net/core/dev.c complains about this.
+
+Reason of setting the network_header to this place (at the end of the
+Ethernet header, and at the beginning of the Ethernet payload):
+
+Because when this driver receives an skb from the Ethernet device, the
+network_header is also set at this place.
+
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/lapbether.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index 6b2553e893aca..15177a54b17d7 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -213,6 +213,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+
+ skb->dev = dev = lapbeth->ethdev;
+
++ skb_reset_network_header(skb);
++
+ dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+
+ dev_queue_xmit(skb);
+--
+2.25.1
+
--- /dev/null
+From c36f61be7eefa44784cf2f755f84bb2b6de04bd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 18:43:37 +0530
+Subject: drm/amdgpu: Fix bug in reporting voltage for CIK
+
+From: Sandeep Raghuraman <sandy.8925@gmail.com>
+
+[ Upstream commit d98299885c9ea140c1108545186593deba36c4ac ]
+
+On my R9 390, the voltage was reported as a constant 1000 mV.
+This was due to a bug in smu7_hwmgr.c, in the smu7_read_sensor()
+function, where some magic constants were used in a condition,
+to determine whether the voltage should be read from PLANE2_VID
+or PLANE1_VID. The VDDC mask was incorrectly used, instead of
+the VDDGFX mask.
+
+This patch changes the code to use the correct defined constants
+(and apply the correct bitshift), thus resulting in correct voltage reporting.
+
+Signed-off-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 219440bebd052..72c0a2ae2dd4f 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -3566,7 +3566,8 @@ static int smu7_read_sensor(struct pp_hwmgr *hwmgr, int idx,
+ case AMDGPU_PP_SENSOR_GPU_POWER:
+ return smu7_get_gpu_power(hwmgr, (uint32_t *)value);
+ case AMDGPU_PP_SENSOR_VDDGFX:
+- if ((data->vr_config & 0xff) == 0x2)
++ if ((data->vr_config & VRCONF_VDDGFX_MASK) ==
++ (VR_SVI2_PLANE_2 << VRCONF_VDDGFX_SHIFT))
+ val_vid = PHM_READ_INDIRECT_FIELD(hwmgr->device,
+ CGS_IND_REG__SMC, PWR_SVI2_STATUS, PLANE2_VID);
+ else
+--
+2.25.1
+
--- /dev/null
+From 851568aab7da5ca340407861c0dcabd3705868ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 14:50:32 +0200
+Subject: drm/sun4i: Fix dsi dcs long write function
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit fd90e3808fd2c207560270c39b86b71af2231aa1 ]
+
+It's writing too much data. regmap_bulk_write expects number of
+register sized chunks to write, not a byte sized length of the
+bounce buffer. Bounce buffer needs to be padded too, so that
+regmap_bulk_write will not read past the end of the buffer.
+
+Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200828125032.937148-1-megous@megous.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 79eb11cd185d1..9a5584efd5e78 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -761,7 +761,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(0),
+ sun6i_dsi_dcs_build_pkt_hdr(dsi, msg));
+
+- bounce = kzalloc(msg->tx_len + sizeof(crc), GFP_KERNEL);
++ bounce = kzalloc(ALIGN(msg->tx_len + sizeof(crc), 4), GFP_KERNEL);
+ if (!bounce)
+ return -ENOMEM;
+
+@@ -772,7 +772,7 @@ static int sun6i_dsi_dcs_write_long(struct sun6i_dsi *dsi,
+ memcpy((u8 *)bounce + msg->tx_len, &crc, sizeof(crc));
+ len += sizeof(crc);
+
+- regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, len);
++ regmap_bulk_write(dsi->regs, SUN6I_DSI_CMD_TX_REG(1), bounce, DIV_ROUND_UP(len, 4));
+ regmap_write(dsi->regs, SUN6I_DSI_CMD_CTL_REG, len + 4 - 1);
+ kfree(bounce);
+
+--
+2.25.1
+
--- /dev/null
+From d562d4dccbe75599cf983b2620a18790bbfeafbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 19:29:35 +0800
+Subject: firestream: Fix memleak in fs_open
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15ac5cdafb9202424206dc5bd376437a358963f9 ]
+
+When make_rate() fails, vcc should be freed just
+like other error paths in fs_open().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/firestream.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
+index 112b1001c2694..ef395b238816c 100644
+--- a/drivers/atm/firestream.c
++++ b/drivers/atm/firestream.c
+@@ -1013,6 +1013,7 @@ static int fs_open(struct atm_vcc *atm_vcc)
+ error = make_rate (pcr, r, &tmc0, NULL);
+ if (error) {
+ kfree(tc);
++ kfree(vcc);
+ return error;
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 8ebc86c90a318ab8c93a7b0245d2fcc75bc763fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Sep 2020 18:58:08 +0300
+Subject: gcov: Disable gcov build with GCC 10
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit cfc905f158eaa099d6258031614d11869e7ef71c ]
+
+GCOV built with GCC 10 doesn't initialize n_function variable. This
+produces different kernel panics as was seen by Colin in Ubuntu and me
+in FC 32.
+
+As a workaround, let's disable GCOV build for broken GCC 10 version.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1891288
+Link: https://lore.kernel.org/lkml/20200827133932.3338519-1-leon@kernel.org
+Link: https://lore.kernel.org/lkml/CAHk-=whbijeSdSvx-Xcr0DPMj0BiwhJ+uiNnDSVZcr_h_kg7UA@mail.gmail.com/
+Cc: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/gcov/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
+index 1e3823fa799b2..bfb6579a19d07 100644
+--- a/kernel/gcov/Kconfig
++++ b/kernel/gcov/Kconfig
+@@ -3,6 +3,7 @@ menu "GCOV-based kernel profiling"
+ config GCOV_KERNEL
+ bool "Enable gcov-based kernel profiling"
+ depends on DEBUG_FS
++ depends on !CC_IS_GCC || GCC_VERSION < 100000
+ select CONSTRUCTORS if !UML
+ default n
+ ---help---
+--
+2.25.1
+
--- /dev/null
+From a1026df7eda46937975519b5d725f75b1c74e433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 31 Aug 2020 17:06:43 +0800
+Subject: HID: elan: Fix memleak in elan_input_configured
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit b7429ea53d6c0936a0f10a5d64164f0aea440143 ]
+
+When input_mt_init_slots() fails, input should be freed
+to prevent memleak. When input_register_device() fails,
+we should call input_mt_destroy_slots() to free memory
+allocated by input_mt_init_slots().
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-elan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-elan.c b/drivers/hid/hid-elan.c
+index 07e26c3567eb9..6346282e0ff05 100644
+--- a/drivers/hid/hid-elan.c
++++ b/drivers/hid/hid-elan.c
+@@ -192,6 +192,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ ret = input_mt_init_slots(input, ELAN_MAX_FINGERS, INPUT_MT_POINTER);
+ if (ret) {
+ hid_err(hdev, "Failed to init elan MT slots: %d\n", ret);
++ input_free_device(input);
+ return ret;
+ }
+
+@@ -202,6 +203,7 @@ static int elan_input_configured(struct hid_device *hdev, struct hid_input *hi)
+ if (ret) {
+ hid_err(hdev, "Failed to register elan input device: %d\n",
+ ret);
++ input_mt_destroy_slots(input);
+ input_free_device(input);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From a5a4c8ba8c4f99bd36d68af6ea28fa9f535c2d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Aug 2020 17:48:59 -0700
+Subject: HID: quirks: Set INCREMENT_USAGE_ON_DUPLICATE for all Saitek X52
+ devices
+
+From: Nirenjan Krishnan <nirenjan@gmail.com>
+
+[ Upstream commit 77df710ba633dfb6c65c65cf99ea9e084a1c9933 ]
+
+The Saitek X52 family of joysticks has a pair of axes that were
+originally (by the Windows driver) used as mouse pointer controls. The
+corresponding usage page is the Game Controls page, which is not
+recognized by the generic HID driver, and therefore, both axes get
+mapped to ABS_MISC. The quirk makes the second axis get mapped to
+ABS_MISC+1, and therefore made available separately.
+
+One Saitek X52 device is already fixed. This patch fixes the other two
+known devices with VID/PID 06a3:0255 and 06a3:0762.
+
+Signed-off-by: Nirenjan Krishnan <nirenjan@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 2c100b73d3fc1..e18d796d985f8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -985,6 +985,8 @@
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
+ #define USB_DEVICE_ID_SAITEK_X52 0x075c
++#define USB_DEVICE_ID_SAITEK_X52_2 0x0255
++#define USB_DEVICE_ID_SAITEK_X52_PRO 0x0762
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 62f87f8bd9720..2d8d20a7f4574 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -147,6 +147,8 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_2), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52_PRO), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+--
+2.25.1
+
--- /dev/null
+From a3b67df589174da20dda92c5a5dff51c742a3b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 11:32:18 +0200
+Subject: iio: adc: mcp3422: fix locking on error path
+
+From: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+
+[ Upstream commit a139ffa40f0c24b753838b8ef3dcf6ad10eb7854 ]
+
+Reading from the chip should be unlocked on error path else the lock
+could never being released.
+
+Fixes: 07914c84ba30 ("iio: adc: Add driver for Microchip MCP3422/3/4 high resolution ADC")
+Fixes: 3f1093d83d71 ("iio: adc: mcp3422: fix locking scope")
+Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+Link: https://lore.kernel.org/r/20200901093218.1500845-1-angelo.compagnucci@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3422.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/mcp3422.c b/drivers/iio/adc/mcp3422.c
+index 819f260115005..a5a687257c0b8 100644
+--- a/drivers/iio/adc/mcp3422.c
++++ b/drivers/iio/adc/mcp3422.c
+@@ -148,8 +148,10 @@ static int mcp3422_read_channel(struct mcp3422 *adc,
+ config &= ~MCP3422_PGA_MASK;
+ config |= MCP3422_PGA_VALUE(adc->pga[req_channel]);
+ ret = mcp3422_update_config(adc, config);
+- if (ret < 0)
++ if (ret < 0) {
++ mutex_unlock(&adc->lock);
+ return ret;
++ }
+ msleep(mcp3422_read_times[MCP3422_SAMPLE_RATE(adc->config)]);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 876713a48421caf1ac5e4ce0ea3022e9059ecadf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:54:15 +0200
+Subject: iommu/amd: Do not use IOMMUv2 functionality when SME is active
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 2822e582501b65707089b097e773e6fd70774841 ]
+
+When memory encryption is active the device is likely not in a direct
+mapped domain. Forbid using IOMMUv2 functionality for now until finer
+grained checks for this have been implemented.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Link: https://lore.kernel.org/r/20200824105415.21000-3-joro@8bytes.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_v2.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
+index 58da65df03f5e..7a59a8ebac108 100644
+--- a/drivers/iommu/amd_iommu_v2.c
++++ b/drivers/iommu/amd_iommu_v2.c
+@@ -776,6 +776,13 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
+
+ might_sleep();
+
++ /*
++ * When memory encryption is active the device is likely not in a
++ * direct-mapped domain. Forbid using IOMMUv2 functionality for now.
++ */
++ if (mem_encrypt_active())
++ return -ENODEV;
++
+ if (!amd_iommu_v2_supported())
+ return -ENODEV;
+
+--
+2.25.1
+
--- /dev/null
+From b1f013d3fd582f6566d6e554407c63b0a5689257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 12:10:33 -0700
+Subject: irqchip/eznps: Fix build error for !ARC700 builds
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit 89d29997f103d08264b0685796b420d911658b96 ]
+
+eznps driver is supposed to be platform independent however it ends up
+including stuff from inside arch/arc headers leading to rand config
+build errors.
+
+The quick hack to fix this (proper fix is too much chrun for non active
+user-base) is to add following to nps platform agnostic header.
+ - copy AUX_IENABLE from arch/arc header
+ - move CTOP_AUX_IACK from arch/arc/plat-eznps/*/**
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lkml.kernel.org/r/20200824095831.5lpkmkafelnvlpi2@linutronix.de
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/plat-eznps/include/plat/ctop.h | 1 -
+ include/soc/nps/common.h | 6 ++++++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arc/plat-eznps/include/plat/ctop.h b/arch/arc/plat-eznps/include/plat/ctop.h
+index 4f6a1673b3a6e..ddfca2c3357a0 100644
+--- a/arch/arc/plat-eznps/include/plat/ctop.h
++++ b/arch/arc/plat-eznps/include/plat/ctop.h
+@@ -43,7 +43,6 @@
+ #define CTOP_AUX_DPC (CTOP_AUX_BASE + 0x02C)
+ #define CTOP_AUX_LPC (CTOP_AUX_BASE + 0x030)
+ #define CTOP_AUX_EFLAGS (CTOP_AUX_BASE + 0x080)
+-#define CTOP_AUX_IACK (CTOP_AUX_BASE + 0x088)
+ #define CTOP_AUX_GPA1 (CTOP_AUX_BASE + 0x08C)
+ #define CTOP_AUX_UDMC (CTOP_AUX_BASE + 0x300)
+
+diff --git a/include/soc/nps/common.h b/include/soc/nps/common.h
+index 9b1d43d671a3f..8c18dc6d3fde5 100644
+--- a/include/soc/nps/common.h
++++ b/include/soc/nps/common.h
+@@ -45,6 +45,12 @@
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_INST 0x5B60
+ #define CTOP_INST_MOV2B_FLIP_R3_B1_B2_LIMM 0x00010422
+
++#ifndef AUX_IENABLE
++#define AUX_IENABLE 0x40c
++#endif
++
++#define CTOP_AUX_IACK (0xFFFFF800 + 0x088)
++
+ #ifndef __ASSEMBLY__
+
+ /* In order to increase compilation test coverage */
+--
+2.25.1
+
--- /dev/null
+From 65f79b267ac88d71c4f53b42446df1a439dee59d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 07:58:41 -0700
+Subject: mmc: sdhci-msm: Add retries when all tuning phases are found valid
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9d5dcefb7b114d610aeb2371f6a6f119af316e43 ]
+
+As the comments in this patch say, if we tune and find all phases are
+valid it's _almost_ as bad as no phases being found valid. Probably
+all phases are not really reliable but we didn't detect where the
+unreliable place is. That means we'll essentially be guessing and
+hoping we get a good phase.
+
+This is not just a problem in theory. It was causing real problems on
+a real board. On that board, most often phase 10 is found as the only
+invalid phase, though sometimes 10 and 11 are invalid and sometimes
+just 11. Some percentage of the time, however, all phases are found
+to be valid. When this happens, the current logic will decide to use
+phase 11. Since phase 11 is sometimes found to be invalid, this is a
+bad choice. Sure enough, when phase 11 is picked we often get mmc
+errors later in boot.
+
+I have seen cases where all phases were found to be valid 3 times in a
+row, so increase the retry count to 10 just to be extra sure.
+
+Fixes: 415b5a75da43 ("mmc: sdhci-msm: Add platform_execute_tuning implementation")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20200827075809.1.If179abf5ecb67c963494db79c3bc4247d987419b@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-msm.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index 643fd1a1b88be..4970cd40813b2 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1060,7 +1060,7 @@ static void sdhci_msm_set_cdr(struct sdhci_host *host, bool enable)
+ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ {
+ struct sdhci_host *host = mmc_priv(mmc);
+- int tuning_seq_cnt = 3;
++ int tuning_seq_cnt = 10;
+ u8 phase, tuned_phases[16], tuned_phase_cnt = 0;
+ int rc;
+ struct mmc_ios ios = host->mmc->ios;
+@@ -1124,6 +1124,22 @@ retry:
+ } while (++phase < ARRAY_SIZE(tuned_phases));
+
+ if (tuned_phase_cnt) {
++ if (tuned_phase_cnt == ARRAY_SIZE(tuned_phases)) {
++ /*
++ * All phases valid is _almost_ as bad as no phases
++ * valid. Probably all phases are not really reliable
++ * but we didn't detect where the unreliable place is.
++ * That means we'll essentially be guessing and hoping
++ * we get a good phase. Better to try a few times.
++ */
++ dev_dbg(mmc_dev(mmc), "%s: All phases valid; try again\n",
++ mmc_hostname(mmc));
++ if (--tuning_seq_cnt) {
++ tuned_phase_cnt = 0;
++ goto retry;
++ }
++ }
++
+ rc = msm_find_most_appropriate_phase(host, tuned_phases,
+ tuned_phase_cnt);
+ if (rc < 0)
+--
+2.25.1
+
--- /dev/null
+From 741b993ec5cb82a080873677a9f4daba16847a66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Aug 2020 16:15:58 +0200
+Subject: netfilter: conntrack: allow sctp hearbeat after connection re-use
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit cc5453a5b7e90c39f713091a7ebc53c1f87d1700 ]
+
+If an sctp connection gets re-used, heartbeats are flagged as invalid
+because their vtag doesn't match.
+
+Handle this in a similar way as TCP conntrack when it suspects that the
+endpoints and conntrack are out-of-sync.
+
+When a HEARTBEAT request fails its vtag validation, flag this in the
+conntrack state and accept the packet.
+
+When a HEARTBEAT_ACK is received with an invalid vtag in the reverse
+direction after we allowed such a HEARTBEAT through, assume we are
+out-of-sync and re-set the vtag info.
+
+v2: remove left-over snippet from an older incarnation that moved
+ new_state/old_state assignments, thats not needed so keep that
+ as-is.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nf_conntrack_sctp.h | 2 ++
+ net/netfilter/nf_conntrack_proto_sctp.c | 39 ++++++++++++++++++---
+ 2 files changed, 37 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/netfilter/nf_conntrack_sctp.h b/include/linux/netfilter/nf_conntrack_sctp.h
+index 9a33f171aa822..625f491b95de8 100644
+--- a/include/linux/netfilter/nf_conntrack_sctp.h
++++ b/include/linux/netfilter/nf_conntrack_sctp.h
+@@ -9,6 +9,8 @@ struct ip_ct_sctp {
+ enum sctp_conntrack state;
+
+ __be32 vtag[IP_CT_DIR_MAX];
++ u8 last_dir;
++ u8 flags;
+ };
+
+ #endif /* _NF_CONNTRACK_SCTP_H */
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 7d7e30ea0ecf9..a937d4f75613f 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -65,6 +65,8 @@ static const unsigned int sctp_timeouts[SCTP_CONNTRACK_MAX] = {
+ [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
+ };
+
++#define SCTP_FLAG_HEARTBEAT_VTAG_FAILED 1
++
+ #define sNO SCTP_CONNTRACK_NONE
+ #define sCL SCTP_CONNTRACK_CLOSED
+ #define sCW SCTP_CONNTRACK_COOKIE_WAIT
+@@ -288,6 +290,7 @@ static int sctp_packet(struct nf_conn *ct,
+ u_int32_t offset, count;
+ unsigned int *timeouts;
+ unsigned long map[256 / sizeof(unsigned long)] = { 0 };
++ bool ignore = false;
+
+ sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
+ if (sh == NULL)
+@@ -332,15 +335,39 @@ static int sctp_packet(struct nf_conn *ct,
+ /* Sec 8.5.1 (D) */
+ if (sh->vtag != ct->proto.sctp.vtag[dir])
+ goto out_unlock;
+- } else if (sch->type == SCTP_CID_HEARTBEAT ||
+- sch->type == SCTP_CID_HEARTBEAT_ACK) {
++ } else if (sch->type == SCTP_CID_HEARTBEAT) {
++ if (ct->proto.sctp.vtag[dir] == 0) {
++ pr_debug("Setting %d vtag %x for dir %d\n", sch->type, sh->vtag, dir);
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ ct->proto.sctp.flags |= SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.last_dir = dir;
++ ignore = true;
++ continue;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ }
++ } else if (sch->type == SCTP_CID_HEARTBEAT_ACK) {
+ if (ct->proto.sctp.vtag[dir] == 0) {
+ pr_debug("Setting vtag %x for dir %d\n",
+ sh->vtag, dir);
+ ct->proto.sctp.vtag[dir] = sh->vtag;
+ } else if (sh->vtag != ct->proto.sctp.vtag[dir]) {
+- pr_debug("Verification tag check failed\n");
+- goto out_unlock;
++ if (test_bit(SCTP_CID_DATA, map) || ignore)
++ goto out_unlock;
++
++ if ((ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) == 0 ||
++ ct->proto.sctp.last_dir == dir)
++ goto out_unlock;
++
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
++ ct->proto.sctp.vtag[dir] = sh->vtag;
++ ct->proto.sctp.vtag[!dir] = 0;
++ } else if (ct->proto.sctp.flags & SCTP_FLAG_HEARTBEAT_VTAG_FAILED) {
++ ct->proto.sctp.flags &= ~SCTP_FLAG_HEARTBEAT_VTAG_FAILED;
+ }
+ }
+
+@@ -375,6 +402,10 @@ static int sctp_packet(struct nf_conn *ct,
+ }
+ spin_unlock_bh(&ct->lock);
+
++ /* allow but do not refresh timeout */
++ if (ignore)
++ return NF_ACCEPT;
++
+ timeouts = nf_ct_timeout_lookup(ct);
+ if (!timeouts)
+ timeouts = sctp_pernet(nf_ct_net(ct))->timeouts;
+--
+2.25.1
+
--- /dev/null
+From 77b81ecd2c9b9227e61ea2ca3d2be42688b44679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 15:23:43 +0800
+Subject: NFC: st95hf: Fix memleak in st95hf_in_send_cmd
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit f97c04c316d8fea16dca449fdfbe101fbdfee6a2 ]
+
+When down_killable() fails, skb_resp should be freed
+just like when st95hf_spi_send() fails.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st95hf/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
+index 01acb6e533655..c4b6e29c07192 100644
+--- a/drivers/nfc/st95hf/core.c
++++ b/drivers/nfc/st95hf/core.c
+@@ -981,7 +981,7 @@ static int st95hf_in_send_cmd(struct nfc_digital_dev *ddev,
+ rc = down_killable(&stcontext->exchange_lock);
+ if (rc) {
+ WARN(1, "Semaphore is not found up in st95hf_in_send_cmd\n");
+- return rc;
++ goto free_skb_resp;
+ }
+
+ rc = st95hf_spi_send(&stcontext->spicontext, skb->data,
+--
+2.25.1
+
--- /dev/null
+From 9a470c8328981e3acf6c18d1e237ac0bb0f2fea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 11:46:51 -0700
+Subject: nvme-fabrics: don't check state NVME_CTRL_NEW for request acceptance
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit d7144f5c4cf4de95fdc3422943cf51c06aeaf7a7 ]
+
+NVME_CTRL_NEW should never see any I/O, because in order to start
+initialization it has to transition to NVME_CTRL_CONNECTING and from
+there it will never return to this state.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index bcd09d3a44dad..05dd46f984414 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -577,7 +577,6 @@ bool __nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ * which is require to set the queue live in the appropinquate states.
+ */
+ switch (ctrl->state) {
+- case NVME_CTRL_NEW:
+ case NVME_CTRL_CONNECTING:
+ if (req->cmd->common.opcode == nvme_fabrics_command &&
+ req->cmd->fabrics.fctype == nvme_fabrics_type_connect)
+--
+2.25.1
+
--- /dev/null
+From bb38c77e08e5a9389aa5685594defdb78ee6cc48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 13:24:45 -0700
+Subject: nvme: have nvme_wait_freeze_timeout return if it timed out
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 7cf0d7c0f3c3b0203aaf81c1bc884924d8fdb9bd ]
+
+Users can detect if the wait has completed or not and take appropriate
+actions based on this information (e.g. weather to continue
+initialization or rather fail and schedule another initialization
+attempt).
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 3 ++-
+ drivers/nvme/host/nvme.h | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 0d60f2f8f3eec..1b0133564f0ca 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3726,7 +3726,7 @@ void nvme_unfreeze(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_unfreeze);
+
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ {
+ struct nvme_ns *ns;
+
+@@ -3737,6 +3737,7 @@ void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout)
+ break;
+ }
+ up_read(&ctrl->namespaces_rwsem);
++ return timeout;
+ }
+ EXPORT_SYMBOL_GPL(nvme_wait_freeze_timeout);
+
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index cc4273f119894..9bada68b4bd0c 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -438,7 +438,7 @@ void nvme_start_queues(struct nvme_ctrl *ctrl);
+ void nvme_kill_queues(struct nvme_ctrl *ctrl);
+ void nvme_unfreeze(struct nvme_ctrl *ctrl);
+ void nvme_wait_freeze(struct nvme_ctrl *ctrl);
+-void nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
++int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
+ void nvme_start_freeze(struct nvme_ctrl *ctrl);
+
+ #define NVME_QID_ANY -1
+--
+2.25.1
+
--- /dev/null
+From d8f56208dfbc4c76cc667da9908bd0e08a621f80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 18:13:58 -0700
+Subject: nvme-rdma: serialize controller teardown sequences
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 5110f40241d08334375eb0495f174b1d2c07657e ]
+
+In the timeout handler we may need to complete a request because the
+request that timed out may be an I/O that is a part of a serial sequence
+of controller teardown or initialization. In order to complete the
+request, we need to fence any other context that may compete with us
+and complete the request that is timing out.
+
+In this case, we could have a potential double completion in case
+a hard-irq or a different competing context triggered error recovery
+and is running inflight request cancellation concurrently with the
+timeout handler.
+
+Protect using a ctrl teardown_lock to serialize contexts that may
+complete a cancelled request due to error recovery or a reset.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index f393a6193252e..7e2cdb17c26d8 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -118,6 +118,7 @@ struct nvme_rdma_ctrl {
+ struct sockaddr_storage src_addr;
+
+ struct nvme_ctrl ctrl;
++ struct mutex teardown_lock;
+ bool use_inline_data;
+ };
+
+@@ -880,6 +881,7 @@ out_free_io_queues:
+ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (ctrl->ctrl.admin_tagset)
+@@ -887,11 +889,13 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ nvme_cancel_request, &ctrl->ctrl);
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
++ mutex_lock(&ctrl->teardown_lock);
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+@@ -902,6 +906,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+ }
++ mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_stop_ctrl(struct nvme_ctrl *nctrl)
+@@ -1955,6 +1960,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+ ctrl->ctrl.opts = opts;
+ INIT_LIST_HEAD(&ctrl->list);
++ mutex_init(&ctrl->teardown_lock);
+
+ if (opts->mask & NVMF_OPT_TRSVCID)
+ port = opts->trsvcid;
+--
+2.25.1
+
--- /dev/null
+From a97e3ad91faf3ed571a551fd5434dd92f5fde8ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Aug 2020 11:14:32 -0700
+Subject: RDMA/bnxt_re: Do not report transparent vlan from QP1
+
+From: Selvin Xavier <selvin.xavier@broadcom.com>
+
+[ Upstream commit 2d0e60ee322d512fa6bc62d23a6760b39a380847 ]
+
+QP1 Rx CQE reports transparent VLAN ID in the completion and this is used
+while reporting the completion for received MAD packet. Check if the vlan
+id is configured before reporting it in the work completion.
+
+Fixes: 84511455ac5b ("RDMA/bnxt_re: report vlan_id and sl in qp1 recv completion")
+Link: https://lore.kernel.org/r/1598292876-26529-3-git-send-email-selvin.xavier@broadcom.com
+Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index c9af2d139f5cb..957da3ffe593c 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -3033,6 +3033,19 @@ static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
+ wc->wc_flags |= IB_WC_GRH;
+ }
+
++static bool bnxt_re_check_if_vlan_valid(struct bnxt_re_dev *rdev,
++ u16 vlan_id)
++{
++ /*
++ * Check if the vlan is configured in the host. If not configured, it
++ * can be a transparent VLAN. So dont report the vlan id.
++ */
++ if (!__vlan_find_dev_deep_rcu(rdev->netdev,
++ htons(ETH_P_8021Q), vlan_id))
++ return false;
++ return true;
++}
++
+ static bool bnxt_re_is_vlan_pkt(struct bnxt_qplib_cqe *orig_cqe,
+ u16 *vid, u8 *sl)
+ {
+@@ -3101,9 +3114,11 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp,
+ wc->src_qp = orig_cqe->src_qp;
+ memcpy(wc->smac, orig_cqe->smac, ETH_ALEN);
+ if (bnxt_re_is_vlan_pkt(orig_cqe, &vlan_id, &sl)) {
+- wc->vlan_id = vlan_id;
+- wc->sl = sl;
+- wc->wc_flags |= IB_WC_WITH_VLAN;
++ if (bnxt_re_check_if_vlan_valid(rdev, vlan_id)) {
++ wc->vlan_id = vlan_id;
++ wc->sl = sl;
++ wc->wc_flags |= IB_WC_WITH_VLAN;
++ }
+ }
+ wc->port_num = 1;
+ wc->vendor_err = orig_cqe->status;
+--
+2.25.1
+
--- /dev/null
+From bcb7c16cb1a8abf627b2fdf55ff63e2bd94390a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 15:43:04 +0300
+Subject: RDMA/core: Fix reported speed and width
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 28b0865714b315e318ac45c4fc9156f3d4649646 ]
+
+When the returned speed from __ethtool_get_link_ksettings() is
+SPEED_UNKNOWN this will lead to reporting a wrong speed and width for
+providers that uses ib_get_eth_speed(), fix that by defaulting the
+netdev_speed to SPEED_1000 in case the returned value from
+__ethtool_get_link_ksettings() is SPEED_UNKNOWN.
+
+Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
+Link: https://lore.kernel.org/r/20200902124304.170912-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
+index e8432876cc860..e1ecd4682c096 100644
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -1711,7 +1711,7 @@ int ib_get_eth_speed(struct ib_device *dev, u8 port_num, u8 *speed, u8 *width)
+
+ dev_put(netdev);
+
+- if (!rc) {
++ if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
+ netdev_speed = lksettings.base.speed;
+ } else {
+ netdev_speed = SPEED_1000;
+--
+2.25.1
+
--- /dev/null
+From 93fdfe84a62474209bb31de701cca1fdb320c657 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jul 2020 13:43:10 +0300
+Subject: RDMA/rxe: Drop pointless checks in rxe_init_ports
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6112ef62826e91afbae5446d5d47b38e25f47e3f ]
+
+Both pkey_tbl_len and gid_tbl_len are set in rxe_init_port_param() - so no
+need to check if they aren't set.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200705104313.283034-2-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
+index 10999fa692818..94dedabe648c2 100644
+--- a/drivers/infiniband/sw/rxe/rxe.c
++++ b/drivers/infiniband/sw/rxe/rxe.c
+@@ -163,9 +163,6 @@ static int rxe_init_ports(struct rxe_dev *rxe)
+
+ rxe_init_port_param(port);
+
+- if (!port->attr.pkey_tbl_len || !port->attr.gid_tbl_len)
+- return -EINVAL;
+-
+ port->pkey_tbl = kcalloc(port->attr.pkey_tbl_len,
+ sizeof(*port->pkey_tbl), GFP_KERNEL);
+
+--
+2.25.1
+
--- /dev/null
+From e5e9451c396b4520e05a10e62b317e60ca411c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Aug 2020 15:56:32 +0800
+Subject: RDMA/rxe: Fix memleak in rxe_mem_init_user
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit e3ddd6067ee62f6e76ebcf61ff08b2c729ae412b ]
+
+When page_address() fails, umem should be freed just like when
+rxe_mem_alloc() fails.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20200819075632.22285-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index dff605fdf60fa..2cca89ca08cd4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -203,6 +203,7 @@ int rxe_mem_init_user(struct rxe_pd *pd, u64 start,
+ vaddr = page_address(sg_page(sg));
+ if (!vaddr) {
+ pr_warn("null vaddr\n");
++ ib_umem_release(umem);
+ err = -ENOMEM;
+ goto err1;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4bd34ba4d9f1d42c112b2b2d29b53b7129293087 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 15:24:26 +0800
+Subject: scsi: libsas: Set data_dir as DMA_NONE if libata marks qc as NODATA
+
+From: Luo Jiaxing <luojiaxing@huawei.com>
+
+[ Upstream commit 53de092f47ff40e8d4d78d590d95819d391bf2e0 ]
+
+It was discovered that sdparm will fail when attempting to disable write
+cache on a SATA disk connected via libsas.
+
+In the ATA command set the write cache state is controlled through the SET
+FEATURES operation. This is roughly corresponds to MODE SELECT in SCSI and
+the latter command is what is used in the SCSI-ATA translation layer. A
+subtle difference is that a MODE SELECT carries data whereas SET FEATURES
+is defined as a non-data command in ATA.
+
+Set the DMA data direction to DMA_NONE if the requested ATA command is
+identified as non-data.
+
+[mkp: commit desc]
+
+Fixes: fa1c1e8f1ece ("[SCSI] Add SATA support to libsas")
+Link: https://lore.kernel.org/r/1598426666-54544-1-git-send-email-luojiaxing@huawei.com
+Reviewed-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Jason Yan <yanaijie@huawei.com>
+Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_ata.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
+index 64a958a99f6a8..d82698b7dfe6c 100644
+--- a/drivers/scsi/libsas/sas_ata.c
++++ b/drivers/scsi/libsas/sas_ata.c
+@@ -223,7 +223,10 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc)
+ task->num_scatter = si;
+ }
+
+- task->data_dir = qc->dma_dir;
++ if (qc->tf.protocol == ATA_PROT_NODATA)
++ task->data_dir = DMA_NONE;
++ else
++ task->data_dir = qc->dma_dir;
+ task->scatter = qc->sg;
+ task->ata_task.retry_count = 1;
+ task->task_state_flags = SAS_TASK_STATE_PENDING;
+--
+2.25.1
+
--- /dev/null
+arm-dts-logicpd-torpedo-baseboard-fix-broken-audio.patch
+arm-dts-logicpd-som-lv-baseboard-fix-broken-audio.patch
+arm-dts-socfpga-fix-register-entry-for-timer3-on-arr.patch
+arm-dts-ls1021a-fix-quadspi-memory-reg-range.patch
+rdma-rxe-fix-memleak-in-rxe_mem_init_user.patch
+rdma-rxe-drop-pointless-checks-in-rxe_init_ports.patch
+rdma-bnxt_re-do-not-report-transparent-vlan-from-qp1.patch
+drm-sun4i-fix-dsi-dcs-long-write-function.patch
+iio-adc-mcp3422-fix-locking-on-error-path.patch
+scsi-libsas-set-data_dir-as-dma_none-if-libata-marks.patch
+rdma-core-fix-reported-speed-and-width.patch
+mmc-sdhci-msm-add-retries-when-all-tuning-phases-are.patch
+arm-dts-bcm-hr2-fixed-qspi-compatible-string.patch
+arm-dts-nsp-fixed-qspi-compatible-string.patch
+arm-dts-bcm5301x-fixed-qspi-compatible-string.patch
+arm64-dts-ns2-fixed-qspi-compatible-string.patch
+arc-hsdk-wireup-perf-irq.patch
+dmaengine-acpi-put-the-csrt-table-after-using-it.patch
+netfilter-conntrack-allow-sctp-hearbeat-after-connec.patch
+drivers-net-wan-lapbether-added-needed_tailroom.patch
+nfc-st95hf-fix-memleak-in-st95hf_in_send_cmd.patch
+firestream-fix-memleak-in-fs_open.patch
+alsa-hda-fix-2-channel-swapping-for-tegra.patch
+drivers-net-wan-lapbether-set-network_header-before-.patch
+xfs-initialize-the-shortform-attr-header-padding-ent.patch
+irqchip-eznps-fix-build-error-for-arc700-builds.patch
+nvme-fabrics-don-t-check-state-nvme_ctrl_new-for-req.patch
+nvme-have-nvme_wait_freeze_timeout-return-if-it-time.patch
+nvme-rdma-serialize-controller-teardown-sequences.patch
+hid-quirks-set-increment_usage_on_duplicate-for-all-.patch
+drivers-net-wan-hdlc_cisco-add-hard_header_len.patch
+hid-elan-fix-memleak-in-elan_input_configured.patch
+arc-plat-hsdk-switch-ethernet-phy-mode-to-rgmii-id.patch
+cpufreq-intel_pstate-refuse-to-turn-off-with-hwp-ena.patch
+cpufreq-intel_pstate-fix-intel_pstate_get_hwp_max-fo.patch
+alsa-hda-fix-a-runtime-pm-issue-in-sof-when-integrat.patch
+drm-amdgpu-fix-bug-in-reporting-voltage-for-cik.patch
+iommu-amd-do-not-use-iommuv2-functionality-when-sme-.patch
+gcov-disable-gcov-build-with-gcc-10.patch
--- /dev/null
+From f8da9a4b256c2b50e56cba96a7ca5d905176b7be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Aug 2020 14:12:18 -0700
+Subject: xfs: initialize the shortform attr header padding entry
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 125eac243806e021f33a1fdea3687eccbb9f7636 ]
+
+Don't leak kernel memory contents into the shortform attr fork.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_attr_leaf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index 087a5715cf20e..bd37f4a292c3b 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -551,8 +551,8 @@ xfs_attr_shortform_create(xfs_da_args_t *args)
+ ASSERT(ifp->if_flags & XFS_IFINLINE);
+ }
+ xfs_idata_realloc(dp, sizeof(*hdr), XFS_ATTR_FORK);
+- hdr = (xfs_attr_sf_hdr_t *)ifp->if_u1.if_data;
+- hdr->count = 0;
++ hdr = (struct xfs_attr_sf_hdr *)ifp->if_u1.if_data;
++ memset(hdr, 0, sizeof(*hdr));
+ hdr->totsize = cpu_to_be16(sizeof(*hdr));
+ xfs_trans_log_inode(args->trans, dp, XFS_ILOG_CORE | XFS_ILOG_ADATA);
+ }
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
