--- /dev/null
+From 5a22747b76ca2384057d8e783265404439d31d7f Mon Sep 17 00:00:00 2001
+From: Koen Vandeputte <koen.vandeputte@citymesh.com>
+Date: Thu, 7 Jan 2021 10:19:06 +0100
+Subject: ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming
+
+From: Koen Vandeputte <koen.vandeputte@citymesh.com>
+
+commit 5a22747b76ca2384057d8e783265404439d31d7f upstream.
+
+2 regulator descriptions carry identical naming.
+
+This leads to following boot warning:
+[ 0.173138] debugfs: Directory 'vdd1p8' with parent 'regulator' already present!
+
+Fix this by renaming the one used for audio.
+
+Fixes: 5051bff33102 ("ARM: dts: imx: ventana: add LTC3676 PMIC support")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Cc: stable@vger.kernel.org # v4.11
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+@@ -418,7 +418,7 @@
+
+ /* VDD_AUD_1P8: Audio codec */
+ reg_aud_1p8v: ldo3 {
+- regulator-name = "vdd1p8";
++ regulator-name = "vdd1p8a";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ regulator-boot-on;
--- /dev/null
+From fd25c883667b61f845a4188b6be110bb45de0bac Mon Sep 17 00:00:00 2001
+From: Soeren Moch <smoch@web.de>
+Date: Tue, 22 Dec 2020 16:59:08 +0100
+Subject: ARM: dts: tbs2910: rename MMC node aliases
+
+From: Soeren Moch <smoch@web.de>
+
+commit fd25c883667b61f845a4188b6be110bb45de0bac upstream.
+
+to be consistent with kernel versions up to v5.9 (mmc aliases not used here).
+usdhc1 is not wired up on this board and therefore cannot be used.
+Start mmc aliases with usdhc2.
+
+Signed-off-by: Soeren Moch <smoch@web.de>
+Cc: stable@vger.kernel.org # 5.10.x
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6q-tbs2910.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/imx6q-tbs2910.dts
++++ b/arch/arm/boot/dts/imx6q-tbs2910.dts
+@@ -16,6 +16,13 @@
+ stdout-path = &uart1;
+ };
+
++ aliases {
++ mmc0 = &usdhc2;
++ mmc1 = &usdhc3;
++ mmc2 = &usdhc4;
++ /delete-property/ mmc3;
++ };
++
+ memory@10000000 {
+ device_type = "memory";
+ reg = <0x10000000 0x80000000>;
--- /dev/null
+From 8a996b2d8a03beae3cb6adfc12673778c192085d Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sun, 13 Dec 2020 23:55:17 +0100
+Subject: ARM: dts: ux500: Reserve memory carveouts
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 8a996b2d8a03beae3cb6adfc12673778c192085d upstream.
+
+The Ux500 platforms have some memory carveouts set aside for
+communicating with the modem and for the initial secure software
+(ISSW). These areas are protected by the memory controller
+and will result in an external abort if accessed like common
+read/write memory.
+
+On the legacy boot loaders, these were set aside by using
+cmdline arguments such as this:
+
+ mem=96M@0 mem_mtrace=15M@96M mem_mshared=1M@111M
+ mem_modem=16M@112M mali.mali_mem=32M@128M mem=96M@160M
+ hwmem=127M@256M mem_issw=1M@383M mem_ram_console=1M@384M
+ mem=638M@385M
+
+Reserve the relevant areas in the device tree instead. The
+"mali", "hwmem", "mem_ram_console" and the trailing 1MB at the
+end of the memory reservations in the list are not relevant for
+the upstream kernel as these are nowadays replaced with
+upstream technologies such as CMA. The modem and ISSW
+reservations are necessary.
+
+This was manifested in a bug that surfaced in response to
+commit 7fef431be9c9 ("mm/page_alloc: place pages to tail in __free_pages_core()")
+which changes the behaviour of memory allocations
+in such a way that the platform will sooner run into these
+dangerous areas, with "Unhandled fault: imprecise external
+abort (0xc06) at 0xb6fd83dc" or similar: the real reason
+turns out to be that the PTE is pointing right into one of
+the reserved memory areas. We were just lucky until now.
+
+We need to augment the DB8500 and DB8520 SoCs similarly
+and also create a new include for the DB9500 used in the
+Snowball since this does not have a modem and thus does
+not need the modem memory reservation, albeit it needs
+the ISSW reservation.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: stable@vger.kernel.org
+Cc: David Hildenbrand <david@redhat.com>
+Link: https://lore.kernel.org/r/20201213225517.3838501-1-linus.walleij@linaro.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/ste-db8500.dtsi | 38 +++++++++++++++++++++++++++++++++++++
+ arch/arm/boot/dts/ste-db8520.dtsi | 38 +++++++++++++++++++++++++++++++++++++
+ arch/arm/boot/dts/ste-db9500.dtsi | 35 ++++++++++++++++++++++++++++++++++
+ arch/arm/boot/dts/ste-snowball.dts | 2 -
+ 4 files changed, 112 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/ste-db8500.dtsi
++++ b/arch/arm/boot/dts/ste-db8500.dtsi
+@@ -12,4 +12,42 @@
+ 200000 0>;
+ };
+ };
++
++ reserved-memory {
++ #address-cells = <1>;
++ #size-cells = <1>;
++ ranges;
++
++ /* Modem trace memory */
++ ram@06000000 {
++ reg = <0x06000000 0x00f00000>;
++ no-map;
++ };
++
++ /* Modem shared memory */
++ ram@06f00000 {
++ reg = <0x06f00000 0x00100000>;
++ no-map;
++ };
++
++ /* Modem private memory */
++ ram@07000000 {
++ reg = <0x07000000 0x01000000>;
++ no-map;
++ };
++
++ /*
++ * Initial Secure Software ISSW memory
++ *
++ * This is probably only used if the kernel tries
++ * to actually call into trustzone to run secure
++ * applications, which the mainline kernel probably
++ * will not do on this old chipset. But you can never
++ * be too careful, so reserve this memory anyway.
++ */
++ ram@17f00000 {
++ reg = <0x17f00000 0x00100000>;
++ no-map;
++ };
++ };
+ };
+--- a/arch/arm/boot/dts/ste-db8520.dtsi
++++ b/arch/arm/boot/dts/ste-db8520.dtsi
+@@ -12,4 +12,42 @@
+ 200000 0>;
+ };
+ };
++
++ reserved-memory {
++ #address-cells = <1>;
++ #size-cells = <1>;
++ ranges;
++
++ /* Modem trace memory */
++ ram@06000000 {
++ reg = <0x06000000 0x00f00000>;
++ no-map;
++ };
++
++ /* Modem shared memory */
++ ram@06f00000 {
++ reg = <0x06f00000 0x00100000>;
++ no-map;
++ };
++
++ /* Modem private memory */
++ ram@07000000 {
++ reg = <0x07000000 0x01000000>;
++ no-map;
++ };
++
++ /*
++ * Initial Secure Software ISSW memory
++ *
++ * This is probably only used if the kernel tries
++ * to actually call into trustzone to run secure
++ * applications, which the mainline kernel probably
++ * will not do on this old chipset. But you can never
++ * be too careful, so reserve this memory anyway.
++ */
++ ram@17f00000 {
++ reg = <0x17f00000 0x00100000>;
++ no-map;
++ };
++ };
+ };
+--- /dev/null
++++ b/arch/arm/boot/dts/ste-db9500.dtsi
+@@ -0,0 +1,35 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++#include "ste-dbx5x0.dtsi"
++
++/ {
++ cpus {
++ cpu@300 {
++ /* cpufreq controls */
++ operating-points = <1152000 0
++ 800000 0
++ 400000 0
++ 200000 0>;
++ };
++ };
++
++ reserved-memory {
++ #address-cells = <1>;
++ #size-cells = <1>;
++ ranges;
++
++ /*
++ * Initial Secure Software ISSW memory
++ *
++ * This is probably only used if the kernel tries
++ * to actually call into trustzone to run secure
++ * applications, which the mainline kernel probably
++ * will not do on this old chipset. But you can never
++ * be too careful, so reserve this memory anyway.
++ */
++ ram@17f00000 {
++ reg = <0x17f00000 0x00100000>;
++ no-map;
++ };
++ };
++};
+--- a/arch/arm/boot/dts/ste-snowball.dts
++++ b/arch/arm/boot/dts/ste-snowball.dts
+@@ -4,7 +4,7 @@
+ */
+
+ /dts-v1/;
+-#include "ste-db8500.dtsi"
++#include "ste-db9500.dtsi"
+ #include "ste-href-ab8500.dtsi"
+ #include "ste-href-family-pinctrl.dtsi"
+
--- /dev/null
+From 40caffd66ca9ad1baa2d5541232675160bc6c772 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 20 Jan 2021 15:42:11 +0100
+Subject: ASoC: AMD Renoir - refine DMI entries for some Lenovo products
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit 40caffd66ca9ad1baa2d5541232675160bc6c772 upstream.
+
+Apparently, the DMI board name LNVNB161216 is also used also
+for products with the digital microphones connected to the AMD's
+audio bridge. Refine the DMI table - use product name identifiers
+extracted from https://bugzilla.redhat.com/show_bug.cgi?id=1892115 .
+
+The report for Lenovo Yoga Slim 7 14ARE05 (82A2) is in buglink.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211299
+Cc: <stable@kernel.org>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Cc: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210120144211.817937-1-perex@perex.cz
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/amd/renoir/rn-pci-acp3x.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/amd/renoir/rn-pci-acp3x.c
++++ b/sound/soc/amd/renoir/rn-pci-acp3x.c
+@@ -165,10 +165,24 @@ static int rn_acp_deinit(void __iomem *a
+
+ static const struct dmi_system_id rn_acp_quirk_table[] = {
+ {
+- /* Lenovo IdeaPad Flex 5 14ARE05, IdeaPad 5 15ARE05 */
++ /* Lenovo IdeaPad S340-14API */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
+- DMI_EXACT_MATCH(DMI_BOARD_NAME, "LNVNB161216"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81NB"),
++ }
++ },
++ {
++ /* Lenovo IdeaPad Flex 5 14ARE05 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81X2"),
++ }
++ },
++ {
++ /* Lenovo IdeaPad 5 15ARE05 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81YQ"),
+ }
+ },
+ {
--- /dev/null
+From 0df28cad06eb41cc36bfea69d9c882fb567fd0d6 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 28 Jan 2021 18:48:47 +0800
+Subject: bcache: only check feature sets when sb->version >= BCACHE_SB_VERSION_CDEV_WITH_FEATURES
+
+From: Coly Li <colyli@suse.de>
+
+commit 0df28cad06eb41cc36bfea69d9c882fb567fd0d6 upstream.
+
+For super block version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES, it
+doesn't make sense to check the feature sets. This patch checks
+super block version in bch_has_feature_* routines, if the version
+doesn't have feature sets yet, returns 0 (false) to the caller.
+
+Fixes: 5342fd425502 ("bcache: set bcache device into read-only mode for BCH_FEATURE_INCOMPAT_OBSO_LARGE_BUCKET")
+Fixes: ffa470327572 ("bcache: add bucket_size_hi into struct cache_sb_disk for large bucket")
+Cc: stable@vger.kernel.org # 5.9+
+Reported-and-tested-by: Bockholdt Arne <a.bockholdt@precitec-optronik.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/bcache/features.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/bcache/features.h
++++ b/drivers/md/bcache/features.h
+@@ -33,6 +33,8 @@
+ #define BCH_FEATURE_COMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++ return 0; \
+ return (((sb)->feature_compat & \
+ BCH##_FEATURE_COMPAT_##flagname) != 0); \
+ } \
+@@ -50,6 +52,8 @@ static inline void bch_clear_feature_##n
+ #define BCH_FEATURE_RO_COMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++ return 0; \
+ return (((sb)->feature_ro_compat & \
+ BCH##_FEATURE_RO_COMPAT_##flagname) != 0); \
+ } \
+@@ -67,6 +71,8 @@ static inline void bch_clear_feature_##n
+ #define BCH_FEATURE_INCOMPAT_FUNCS(name, flagname) \
+ static inline int bch_has_feature_##name(struct cache_sb *sb) \
+ { \
++ if (sb->version < BCACHE_SB_VERSION_CDEV_WITH_FEATURES) \
++ return 0; \
+ return (((sb)->feature_incompat & \
+ BCH##_FEATURE_INCOMPAT_##flagname) != 0); \
+ } \
--- /dev/null
+From 7c6d659868c77da9b518f32348160340dcdfa008 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 18 Jan 2021 20:54:12 -0500
+Subject: drivers/nouveau/kms/nv50-: Reject format modifiers for cursor planes
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit 7c6d659868c77da9b518f32348160340dcdfa008 upstream.
+
+Nvidia hardware doesn't actually support using tiling formats with the
+cursor plane, only linear is allowed. In the future, we should write a
+testcase for this.
+
+Fixes: c586f30bf74c ("drm/nouveau/kms: Add format mod prop to base/ovly/nvdisp")
+Cc: James Jones <jajones@nvidia.com>
+Cc: Martin Peres <martin.peres@free.fr>
+Cc: Jeremy Cline <jcline@redhat.com>
+Cc: Simon Ser <contact@emersion.fr>
+Cc: <stable@vger.kernel.org> # v5.8+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: James Jones <jajones@nvidia.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/dispnv50/wndw.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c
+@@ -702,6 +702,11 @@ nv50_wndw_init(struct nv50_wndw *wndw)
+ nvif_notify_get(&wndw->notify);
+ }
+
++static const u64 nv50_cursor_format_modifiers[] = {
++ DRM_FORMAT_MOD_LINEAR,
++ DRM_FORMAT_MOD_INVALID,
++};
++
+ int
+ nv50_wndw_new_(const struct nv50_wndw_func *func, struct drm_device *dev,
+ enum drm_plane_type type, const char *name, int index,
+@@ -713,6 +718,7 @@ nv50_wndw_new_(const struct nv50_wndw_fu
+ struct nvif_mmu *mmu = &drm->client.mmu;
+ struct nv50_disp *disp = nv50_disp(dev);
+ struct nv50_wndw *wndw;
++ const u64 *format_modifiers;
+ int nformat;
+ int ret;
+
+@@ -728,10 +734,13 @@ nv50_wndw_new_(const struct nv50_wndw_fu
+
+ for (nformat = 0; format[nformat]; nformat++);
+
+- ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw,
+- format, nformat,
+- nouveau_display(dev)->format_modifiers,
+- type, "%s-%d", name, index);
++ if (type == DRM_PLANE_TYPE_CURSOR)
++ format_modifiers = nv50_cursor_format_modifiers;
++ else
++ format_modifiers = nouveau_display(dev)->format_modifiers;
++
++ ret = drm_universal_plane_init(dev, &wndw->plane, heads, &nv50_wndw, format, nformat,
++ format_modifiers, type, "%s-%d", name, index);
+ if (ret) {
+ kfree(*pwndw);
+ *pwndw = NULL;
--- /dev/null
+From f6e98a1809faa02f40e0d089d6cfc1aa372a34c0 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 21 Jan 2021 23:28:07 +0000
+Subject: drm/i915: Always flush the active worker before returning from the wait
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit f6e98a1809faa02f40e0d089d6cfc1aa372a34c0 upstream.
+
+The first thing the active retirement worker does is decrement the
+i915_active count.
+
+The first thing we do during i915_active_wait is try to increment the
+i915_active count, but only if already active [non-zero].
+
+The wait may see that the retirement is already started and so marked the
+i915_active as idle, and skip waiting for the retirement handler.
+However, the caller of i915_active_wait may immediately free the
+i915_active upon returning (e.g. i915_vma_destroy) so we must not return
+before the concurrent access from the worker is completed. We must
+always flush the worker.
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2473
+Fixes: 274cbf20fd10 ("drm/i915: Push the i915_active.retire into a worker")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: <stable@vger.kernel.org> # v5.5+
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210121232807.16618-1-chris@chris-wilson.co.uk
+(cherry picked from commit 977a372e972cb42799746c284035a33c64ebace9)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/gpu/drm/i915/i915_active.c b/drivers/gpu/drm/i915/i915_active.c
+index 10a865f3dc09..9ed19b8bca60 100644
+--- a/drivers/gpu/drm/i915/i915_active.c
++++ b/drivers/gpu/drm/i915/i915_active.c
+@@ -631,24 +631,26 @@ static int flush_lazy_signals(struct i915_active *ref)
+
+ int __i915_active_wait(struct i915_active *ref, int state)
+ {
+- int err;
+-
+ might_sleep();
+
+- if (!i915_active_acquire_if_busy(ref))
+- return 0;
+-
+ /* Any fence added after the wait begins will not be auto-signaled */
+- err = flush_lazy_signals(ref);
+- i915_active_release(ref);
+- if (err)
+- return err;
++ if (i915_active_acquire_if_busy(ref)) {
++ int err;
+
+- if (!i915_active_is_idle(ref) &&
+- ___wait_var_event(ref, i915_active_is_idle(ref),
+- state, 0, 0, schedule()))
+- return -EINTR;
++ err = flush_lazy_signals(ref);
++ i915_active_release(ref);
++ if (err)
++ return err;
+
++ if (___wait_var_event(ref, i915_active_is_idle(ref),
++ state, 0, 0, schedule()))
++ return -EINTR;
++ }
++
++ /*
++ * After the wait is complete, the caller may free the active.
++ * We have to flush any concurrent retirement before returning.
++ */
+ flush_work(&ref->work);
+ return 0;
+ }
--- /dev/null
+From 489140b5ba2e7cc4b853c29e0591895ddb462a82 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 25 Jan 2021 12:50:33 +0000
+Subject: drm/i915/gt: Always try to reserve GGTT address 0x0
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 489140b5ba2e7cc4b853c29e0591895ddb462a82 upstream.
+
+Since writing to address 0 is a very common mistake, let's try to avoid
+putting anything sensitive there.
+
+References: https://gitlab.freedesktop.org/drm/intel/-/issues/2989
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210125125033.23656-1-chris@chris-wilson.co.uk
+Cc: stable@vger.kernel.org
+(cherry picked from commit 56b429cc584c6ed8b895d8d8540959655db1ff73)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/gt/intel_ggtt.c | 47 ++++++++++++++++++++++++++---------
+ 1 file changed, 35 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_ggtt.c
++++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c
+@@ -526,16 +526,39 @@ static int init_ggtt(struct i915_ggtt *g
+
+ mutex_init(&ggtt->error_mutex);
+ if (ggtt->mappable_end) {
+- /* Reserve a mappable slot for our lockless error capture */
+- ret = drm_mm_insert_node_in_range(&ggtt->vm.mm,
+- &ggtt->error_capture,
+- PAGE_SIZE, 0,
+- I915_COLOR_UNEVICTABLE,
+- 0, ggtt->mappable_end,
+- DRM_MM_INSERT_LOW);
+- if (ret)
+- return ret;
++ /*
++ * Reserve a mappable slot for our lockless error capture.
++ *
++ * We strongly prefer taking address 0x0 in order to protect
++ * other critical buffers against accidental overwrites,
++ * as writing to address 0 is a very common mistake.
++ *
++ * Since 0 may already be in use by the system (e.g. the BIOS
++ * framebuffer), we let the reservation fail quietly and hope
++ * 0 remains reserved always.
++ *
++ * If we fail to reserve 0, and then fail to find any space
++ * for an error-capture, remain silent. We can afford not
++ * to reserve an error_capture node as we have fallback
++ * paths, and we trust that 0 will remain reserved. However,
++ * the only likely reason for failure to insert is a driver
++ * bug, which we expect to cause other failures...
++ */
++ ggtt->error_capture.size = I915_GTT_PAGE_SIZE;
++ ggtt->error_capture.color = I915_COLOR_UNEVICTABLE;
++ if (drm_mm_reserve_node(&ggtt->vm.mm, &ggtt->error_capture))
++ drm_mm_insert_node_in_range(&ggtt->vm.mm,
++ &ggtt->error_capture,
++ ggtt->error_capture.size, 0,
++ ggtt->error_capture.color,
++ 0, ggtt->mappable_end,
++ DRM_MM_INSERT_LOW);
+ }
++ if (drm_mm_node_allocated(&ggtt->error_capture))
++ drm_dbg(&ggtt->vm.i915->drm,
++ "Reserved GGTT:[%llx, %llx] for use by error capture\n",
++ ggtt->error_capture.start,
++ ggtt->error_capture.start + ggtt->error_capture.size);
+
+ /*
+ * The upper portion of the GuC address space has a sizeable hole
+@@ -548,9 +571,9 @@ static int init_ggtt(struct i915_ggtt *g
+
+ /* Clear any non-preallocated blocks */
+ drm_mm_for_each_hole(entry, &ggtt->vm.mm, hole_start, hole_end) {
+- drm_dbg_kms(&ggtt->vm.i915->drm,
+- "clearing unused GTT space: [%lx, %lx]\n",
+- hole_start, hole_end);
++ drm_dbg(&ggtt->vm.i915->drm,
++ "clearing unused GTT space: [%lx, %lx]\n",
++ hole_start, hole_end);
+ ggtt->vm.clear_range(&ggtt->vm, hole_start,
+ hole_end - hole_start);
+ }
--- /dev/null
+From ba839b7598440a5d78550a115bac21b08d57cc32 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Mon, 18 Jan 2021 20:54:14 -0500
+Subject: drm/nouveau/kms/gk104-gp1xx: Fix > 64x64 cursors
+
+From: Lyude Paul <lyude@redhat.com>
+
+commit ba839b7598440a5d78550a115bac21b08d57cc32 upstream.
+
+While we do handle the additional cursor sizes introduced in NVE4, it looks
+like we accidentally broke this when converting over to use Nvidia's
+display headers. Since we now use NVVAL in dispnv50/head907d.c in order to
+format the value for the cursor layout and NVD9 only had one byte reserved
+vs. the 2 bytes reserved in later generations, we end up accidentally
+stripping the second bit in the cursor layout format parameter - causing us
+to set the wrong cursor size.
+
+This fixes that by adding our own curs_set hook for 917d which uses the
+NV917D headers.
+
+Cc: Martin Peres <martin.peres@free.fr>
+Cc: Jeremy Cline <jcline@redhat.com>
+Cc: Simon Ser <contact@emersion.fr>
+Cc: <stable@vger.kernel.org> # v5.9+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: ed0b86a90bf9 ("drm/nouveau/kms/nv50-: use NVIDIA's headers for core head_curs_set()")
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/head917d.c b/drivers/gpu/drm/nouveau/dispnv50/head917d.c
+index a5d827403660..ea9f8667305e 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/head917d.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/head917d.c
+@@ -22,6 +22,7 @@
+ #include "head.h"
+ #include "core.h"
+
++#include "nvif/push.h"
+ #include <nvif/push507c.h>
+
+ #include <nvhw/class/cl917d.h>
+@@ -73,6 +74,31 @@ head917d_base(struct nv50_head *head, struct nv50_head_atom *asyh)
+ return 0;
+ }
+
++static int
++head917d_curs_set(struct nv50_head *head, struct nv50_head_atom *asyh)
++{
++ struct nvif_push *push = nv50_disp(head->base.base.dev)->core->chan.push;
++ const int i = head->base.index;
++ int ret;
++
++ ret = PUSH_WAIT(push, 5);
++ if (ret)
++ return ret;
++
++ PUSH_MTHD(push, NV917D, HEAD_SET_CONTROL_CURSOR(i),
++ NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, ENABLE, ENABLE) |
++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, FORMAT, asyh->curs.format) |
++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, SIZE, asyh->curs.layout) |
++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_X, 0) |
++ NVVAL(NV917D, HEAD_SET_CONTROL_CURSOR, HOT_SPOT_Y, 0) |
++ NVDEF(NV917D, HEAD_SET_CONTROL_CURSOR, COMPOSITION, ALPHA_BLEND),
++
++ HEAD_SET_OFFSET_CURSOR(i), asyh->curs.offset >> 8);
++
++ PUSH_MTHD(push, NV917D, HEAD_SET_CONTEXT_DMA_CURSOR(i), asyh->curs.handle);
++ return 0;
++}
++
+ int
+ head917d_curs_layout(struct nv50_head *head, struct nv50_wndw_atom *asyw,
+ struct nv50_head_atom *asyh)
+@@ -101,7 +127,7 @@ head917d = {
+ .core_clr = head907d_core_clr,
+ .curs_layout = head917d_curs_layout,
+ .curs_format = head507d_curs_format,
+- .curs_set = head907d_curs_set,
++ .curs_set = head917d_curs_set,
+ .curs_clr = head907d_curs_clr,
+ .base = head917d_base,
+ .ovly = head907d_ovly,
+diff --git a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
+index 2a2612d6e1e0..fb223723a38a 100644
+--- a/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
++++ b/drivers/gpu/drm/nouveau/include/nvhw/class/cl917d.h
+@@ -66,6 +66,10 @@
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_ALPHA_BLEND (0x00000000)
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_PREMULT_ALPHA_BLEND (0x00000001)
+ #define NV917D_HEAD_SET_CONTROL_CURSOR_COMPOSITION_XOR (0x00000002)
++#define NV917D_HEAD_SET_OFFSET_CURSOR(a) (0x00000484 + (a)*0x00000300)
++#define NV917D_HEAD_SET_OFFSET_CURSOR_ORIGIN 31:0
++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR(a) (0x0000048C + (a)*0x00000300)
++#define NV917D_HEAD_SET_CONTEXT_DMA_CURSOR_HANDLE 31:0
+ #define NV917D_HEAD_SET_DITHER_CONTROL(a) (0x000004A0 + (a)*0x00000300)
+ #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE 0:0
+ #define NV917D_HEAD_SET_DITHER_CONTROL_ENABLE_DISABLE (0x00000000)
--- /dev/null
+From eaf18a4165141f04dd26f0c48a7e53438e5a3ea2 Mon Sep 17 00:00:00 2001
+From: Yannick Fertre <yannick.fertre@foss.st.com>
+Date: Fri, 15 Jan 2021 15:31:44 +0100
+Subject: media: cec: add stm32 driver
+
+From: Yannick Fertre <yannick.fertre@foss.st.com>
+
+commit eaf18a4165141f04dd26f0c48a7e53438e5a3ea2 upstream.
+
+Missing stm32 directory to Makefile.
+
+Signed-off-by: Yannick Fertre <yannick.fertre@foss.st.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: 4be5e8648b0c ("media: move CEC platform drivers to a separate directory")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/cec/platform/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/cec/platform/Makefile
++++ b/drivers/media/cec/platform/Makefile
+@@ -10,5 +10,6 @@ obj-$(CONFIG_CEC_MESON_AO) += meson/
+ obj-$(CONFIG_CEC_SAMSUNG_S5P) += s5p/
+ obj-$(CONFIG_CEC_SECO) += seco/
+ obj-$(CONFIG_CEC_STI) += sti/
++obj-$(CONFIG_CEC_STM32) += stm32/
+ obj-$(CONFIG_CEC_TEGRA) += tegra/
+
--- /dev/null
+From 73bc0b0c2a96b31199da0ce6c3d04be81ef73bb9 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Wed, 23 Dec 2020 12:06:59 +0100
+Subject: media: cedrus: Fix H264 decoding
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+commit 73bc0b0c2a96b31199da0ce6c3d04be81ef73bb9 upstream.
+
+During H264 API overhaul subtle bug was introduced Cedrus driver.
+Progressive references have both, top and bottom reference flags set.
+Cedrus reference list expects only bottom reference flag and only when
+interlaced frames are decoded. However, due to a bug in Cedrus check,
+exclusivity is not tested and that flag is set also for progressive
+references. That causes "jumpy" background with many videos.
+
+Fix that by checking that only bottom reference flag is set in control
+and nothing else.
+
+Tested-by: Andre Heider <a.heider@gmail.com>
+Fixes: cfc8c3ed533e ("media: cedrus: h264: Properly configure reference field")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -203,7 +203,7 @@ static void _cedrus_write_ref_list(struc
+ position = cedrus_buf->codec.h264.position;
+
+ sram_array[i] |= position << 1;
+- if (ref_list[i].fields & V4L2_H264_BOTTOM_FIELD_REF)
++ if (ref_list[i].fields == V4L2_H264_BOTTOM_FIELD_REF)
+ sram_array[i] |= BIT(0);
+ }
+
--- /dev/null
+From e081863ab48d9b2eee9e899cbd05752a2a30308d Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Thu, 14 Jan 2021 14:03:16 +0100
+Subject: media: hantro: Fix reset_raw_fmt initialization
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit e081863ab48d9b2eee9e899cbd05752a2a30308d upstream.
+
+raw_fmt->height in never initialized. But width in initialized twice.
+
+Fixes: 88d06362d1d05 ("media: hantro: Refactor for V4L2 API spec compliancy")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_v4l2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/hantro/hantro_v4l2.c
++++ b/drivers/staging/media/hantro/hantro_v4l2.c
+@@ -367,7 +367,7 @@ hantro_reset_raw_fmt(struct hantro_ctx *
+
+ hantro_reset_fmt(raw_fmt, raw_vpu_fmt);
+ raw_fmt->width = encoded_fmt->width;
+- raw_fmt->width = encoded_fmt->width;
++ raw_fmt->height = encoded_fmt->height;
+ if (ctx->is_encoder)
+ hantro_set_fmt_out(ctx, raw_fmt);
+ else
--- /dev/null
+From 896111dc4bcf887b835b3ef54f48b450d4692a1d Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Sun, 20 Dec 2020 13:29:54 +0100
+Subject: media: rc: ensure that uevent can be read directly after rc device register
+
+From: Sean Young <sean@mess.org>
+
+commit 896111dc4bcf887b835b3ef54f48b450d4692a1d upstream.
+
+There is a race condition where if the /sys/class/rc0/uevent file is read
+before rc_dev->registered is set to true, -ENODEV will be returned.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1901089
+
+Cc: stable@vger.kernel.org
+Fixes: a2e2d73fa281 ("media: rc: do not access device via sysfs after rc_unregister_device()")
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/rc-main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -1928,6 +1928,8 @@ int rc_register_device(struct rc_dev *de
+ goto out_raw;
+ }
+
++ dev->registered = true;
++
+ rc = device_add(&dev->dev);
+ if (rc)
+ goto out_rx_free;
+@@ -1937,8 +1939,6 @@ int rc_register_device(struct rc_dev *de
+ dev->device_name ?: "Unspecified device", path ?: "N/A");
+ kfree(path);
+
+- dev->registered = true;
+-
+ /*
+ * once the the input device is registered in rc_setup_rx_device,
+ * userspace can open the input device and rc_open() will be called
--- /dev/null
+From 06b831588b639ad9d94e4789b0250562228722c2 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Tue, 5 Jan 2021 10:30:23 +0100
+Subject: media: rc: fix timeout handling after switch to microsecond durations
+
+From: Matthias Reichl <hias@horus.com>
+
+commit 06b831588b639ad9d94e4789b0250562228722c2 upstream.
+
+Commit 528222d853f92 ("media: rc: harmonize infrared durations to
+microseconds") missed to switch some timeout calculations from
+nanoseconds to microseconds. This resulted in spurious key_up+key_down
+events at the last scancode if the rc device uses a long timeout
+(eg 100ms on nuvoton-cir) as the device timeout wasn't properly
+accounted for in the keyup timeout calculation.
+
+Fix this by applying the proper conversion functions.
+
+Cc: stable@vger.kernel.org
+Fixes: 528222d853f92 ("media: rc: harmonize infrared durations to microseconds")
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/ir-mce_kbd-decoder.c | 2 +-
+ drivers/media/rc/rc-main.c | 4 ++--
+ drivers/media/rc/serial_ir.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/rc/ir-mce_kbd-decoder.c
++++ b/drivers/media/rc/ir-mce_kbd-decoder.c
+@@ -320,7 +320,7 @@ again:
+ data->body);
+ spin_lock(&data->keylock);
+ if (scancode) {
+- delay = nsecs_to_jiffies(dev->timeout) +
++ delay = usecs_to_jiffies(dev->timeout) +
+ msecs_to_jiffies(100);
+ mod_timer(&data->rx_timeout, jiffies + delay);
+ } else {
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -737,7 +737,7 @@ static unsigned int repeat_period(int pr
+ void rc_repeat(struct rc_dev *dev)
+ {
+ unsigned long flags;
+- unsigned int timeout = nsecs_to_jiffies(dev->timeout) +
++ unsigned int timeout = usecs_to_jiffies(dev->timeout) +
+ msecs_to_jiffies(repeat_period(dev->last_protocol));
+ struct lirc_scancode sc = {
+ .scancode = dev->last_scancode, .rc_proto = dev->last_protocol,
+@@ -855,7 +855,7 @@ void rc_keydown(struct rc_dev *dev, enum
+ ir_do_keydown(dev, protocol, scancode, keycode, toggle);
+
+ if (dev->keypressed) {
+- dev->keyup_jiffies = jiffies + nsecs_to_jiffies(dev->timeout) +
++ dev->keyup_jiffies = jiffies + usecs_to_jiffies(dev->timeout) +
+ msecs_to_jiffies(repeat_period(protocol));
+ mod_timer(&dev->timer_keyup, dev->keyup_jiffies);
+ }
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -385,7 +385,7 @@ static irqreturn_t serial_ir_irq_handler
+ } while (!(sinp(UART_IIR) & UART_IIR_NO_INT)); /* still pending ? */
+
+ mod_timer(&serial_ir.timeout_timer,
+- jiffies + nsecs_to_jiffies(serial_ir.rcdev->timeout));
++ jiffies + usecs_to_jiffies(serial_ir.rcdev->timeout));
+
+ ir_raw_event_handle(serial_ir.rcdev);
+
--- /dev/null
+From e1def45b5291278590bc3033cc518bf5c964a18d Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Sat, 9 Jan 2021 21:10:55 +0100
+Subject: media: rc: ite-cir: fix min_timeout calculation
+
+From: Matthias Reichl <hias@horus.com>
+
+commit e1def45b5291278590bc3033cc518bf5c964a18d upstream.
+
+Commit 528222d853f92 ("media: rc: harmonize infrared durations to
+microseconds") missed to switch the min_timeout calculation from ns
+to us. This resulted in a minimum timeout of 1.2 seconds instead of 1.2ms,
+leading to large delays and long key repeats.
+
+Fix this by applying proper ns->us conversion.
+
+Cc: stable@vger.kernel.org
+Fixes: 528222d853f92 ("media: rc: harmonize infrared durations to microseconds")
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/ite-cir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ite-cir.c
++++ b/drivers/media/rc/ite-cir.c
+@@ -1551,7 +1551,7 @@ static int ite_probe(struct pnp_dev *pde
+ rdev->s_rx_carrier_range = ite_set_rx_carrier_range;
+ /* FIFO threshold is 17 bytes, so 17 * 8 samples minimum */
+ rdev->min_timeout = 17 * 8 * ITE_BAUDRATE_DIVISOR *
+- itdev->params.sample_period;
++ itdev->params.sample_period / 1000;
+ rdev->timeout = IR_DEFAULT_TIMEOUT;
+ rdev->max_timeout = 10 * IR_DEFAULT_TIMEOUT;
+ rdev->rx_resolution = ITE_BAUDRATE_DIVISOR *
--- /dev/null
+From 7e0e63d09516e96994c879f07c5a3c3269d7015e Mon Sep 17 00:00:00 2001
+From: Giacinto Cifelli <gciofono@gmail.com>
+Date: Wed, 20 Jan 2021 05:56:50 +0100
+Subject: net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Giacinto Cifelli <gciofono@gmail.com>
+
+commit 7e0e63d09516e96994c879f07c5a3c3269d7015e upstream.
+
+Bus 003 Device 009: ID 1e2d:006f
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 2.00
+ bDeviceClass 239 Miscellaneous Device
+ bDeviceSubClass 2 ?
+ bDeviceProtocol 1 Interface Association
+ bMaxPacketSize0 64
+ idVendor 0x1e2d
+ idProduct 0x006f
+ bcdDevice 0.00
+ iManufacturer 3 Cinterion Wireless Modules
+ iProduct 2 PLSx3
+ iSerial 4 fa3c1419
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 303
+ bNumInterfaces 9
+ bConfigurationValue 1
+ iConfiguration 1 Cinterion Configuration
+ bmAttributes 0xe0
+ Self Powered
+ Remote Wakeup
+ MaxPower 500mA
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 0
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 2 Abstract (modem)
+ bFunctionProtocol 1 AT-commands (v.25ter)
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x02
+ line coding and serial state
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 1
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x81 EP 1 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 5
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x82 EP 2 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x01 EP 1 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 2
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 2 Abstract (modem)
+ bFunctionProtocol 1 AT-commands (v.25ter)
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 2
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x02
+ line coding and serial state
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 3
+ CDC Union:
+ bMasterInterface 2
+ bSlaveInterface 3
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x83 EP 3 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 5
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 3
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x84 EP 4 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x02 EP 2 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 4
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 2 Abstract (modem)
+ bFunctionProtocol 1 AT-commands (v.25ter)
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 4
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x02
+ line coding and serial state
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 5
+ CDC Union:
+ bMasterInterface 4
+ bSlaveInterface 5
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x85 EP 5 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 5
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 5
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x86 EP 6 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x03 EP 3 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Interface Association:
+ bLength 8
+ bDescriptorType 11
+ bFirstInterface 6
+ bInterfaceCount 2
+ bFunctionClass 2 Communications
+ bFunctionSubClass 2 Abstract (modem)
+ bFunctionProtocol 1 AT-commands (v.25ter)
+ iFunction 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 6
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x02
+ line coding and serial state
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 7
+ CDC Union:
+ bMasterInterface 6
+ bSlaveInterface 7
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x87 EP 7 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 5
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 7
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x88 EP 8 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x04 EP 4 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 8
+ bAlternateSetting 0
+ bNumEndpoints 3
+ bInterfaceClass 255 Vendor Specific Class
+ bInterfaceSubClass 255 Vendor Specific Subclass
+ bInterfaceProtocol 255 Vendor Specific Protocol
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x89 EP 9 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0040 1x 64 bytes
+ bInterval 5
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x8a EP 10 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x05 EP 5 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0200 1x 512 bytes
+ bInterval 0
+Device Qualifier (for other device speed):
+ bLength 10
+ bDescriptorType 6
+ bcdUSB 2.00
+ bDeviceClass 239 Miscellaneous Device
+ bDeviceSubClass 2 ?
+ bDeviceProtocol 1 Interface Association
+ bMaxPacketSize0 64
+ bNumConfigurations 1
+Device Status: 0x0000
+ (Bus Powered)
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Giacinto Cifelli <gciofono@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20210120045650.10855-1-gciofono@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1325,6 +1325,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */
+ {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */
+ {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */
++ {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */
+ {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */
+ {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */
+ {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */
--- /dev/null
+From 00e35f2b0e8acb88d4e1aa96ff0490e3bfe46580 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 26 Jan 2021 20:16:21 +0100
+Subject: parisc: Enable -mlong-calls gcc option by default when !CONFIG_MODULES
+
+From: Helge Deller <deller@gmx.de>
+
+commit 00e35f2b0e8acb88d4e1aa96ff0490e3bfe46580 upstream.
+
+When building a kernel without module support, the CONFIG_MLONGCALL option
+needs to be enabled in order to reach symbols which are outside of a 22-bit
+branch.
+
+This patch changes the autodetection in the Kconfig script to always enable
+CONFIG_MLONGCALL when modules are disabled and uses a far call to
+preempt_schedule_irq() in intr_do_preempt() to reach the symbol in all cases.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: stable@vger.kernel.org # v5.6+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Kconfig | 5 ++---
+ arch/parisc/kernel/entry.S | 13 ++++++++++---
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -202,9 +202,8 @@ config PREFETCH
+ depends on PA8X00 || PA7200
+
+ config MLONGCALLS
+- bool "Enable the -mlong-calls compiler option for big kernels"
+- default y if !MODULES || UBSAN || FTRACE
+- default n
++ def_bool y if !MODULES || UBSAN || FTRACE
++ bool "Enable the -mlong-calls compiler option for big kernels" if MODULES && !UBSAN && !FTRACE
+ depends on PA8X00
+ help
+ If you configure the kernel to include many drivers built-in instead
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -997,10 +997,17 @@ intr_do_preempt:
+ bb,<,n %r20, 31 - PSW_SM_I, intr_restore
+ nop
+
++ /* ssm PSW_SM_I done later in intr_restore */
++#ifdef CONFIG_MLONGCALLS
++ ldil L%intr_restore, %r2
++ load32 preempt_schedule_irq, %r1
++ bv %r0(%r1)
++ ldo R%intr_restore(%r2), %r2
++#else
++ ldil L%intr_restore, %r1
+ BL preempt_schedule_irq, %r2
+- nop
+-
+- b,n intr_restore /* ssm PSW_SM_I done by intr_restore */
++ ldo R%intr_restore(%r1), %r2
++#endif
+ #endif /* CONFIG_PREEMPTION */
+
+ /*
--- /dev/null
+From fef9c8d28e28a808274a18fbd8cc2685817fd62a Mon Sep 17 00:00:00 2001
+From: Laurent Badel <laurentbadel@eaton.com>
+Date: Fri, 22 Jan 2021 17:19:41 +0100
+Subject: PM: hibernate: flush swap writer after marking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Badel <laurentbadel@eaton.com>
+
+commit fef9c8d28e28a808274a18fbd8cc2685817fd62a upstream.
+
+Flush the swap writer after, not before, marking the files, to ensure the
+signature is properly written.
+
+Fixes: 6f612af57821 ("PM / Hibernate: Group swap ops")
+Signed-off-by: Laurent Badel <laurentbadel@eaton.com>
+Cc: All applicable <stable@vger.kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/power/swap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/power/swap.c
++++ b/kernel/power/swap.c
+@@ -497,10 +497,10 @@ static int swap_writer_finish(struct swa
+ unsigned int flags, int error)
+ {
+ if (!error) {
+- flush_swap_writer(handle);
+ pr_info("S");
+ error = mark_swapfiles(handle, flags);
+ pr_cont("|\n");
++ flush_swap_writer(handle);
+ }
+
+ if (error)
--- /dev/null
+From a119f87b86bcdf14a18ce39a899e97a1e9160f7f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 28 Jan 2021 13:28:59 -0500
+Subject: Revert "drm/amdgpu/swsmu: drop set_fan_speed_percent (v2)"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a119f87b86bcdf14a18ce39a899e97a1e9160f7f upstream.
+
+On some boards the rpm interface apparently does not work at all
+leading to the fan not spinning or spinning at strange speeds.
+Revert this for now to fix 5.10, 5.11. The follow on patch
+fixes this properly for 5.12.
+
+This reverts commit 8d6e65adc25e23fabbc5293b6cd320195c708dca.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1408
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h | 1
+ drivers/gpu/drm/amd/pm/inc/smu_v11_0.h | 3 +
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 9 +---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 1
+ drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 1
+ drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 1
+ drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 31 +++++++++++++++-
+ 7 files changed, 39 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
++++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
+@@ -575,6 +575,7 @@ struct pptable_funcs {
+ int (*conv_power_profile_to_pplib_workload)(int power_profile);
+ uint32_t (*get_fan_control_mode)(struct smu_context *smu);
+ int (*set_fan_control_mode)(struct smu_context *smu, uint32_t mode);
++ int (*set_fan_speed_percent)(struct smu_context *smu, uint32_t speed);
+ int (*set_fan_speed_rpm)(struct smu_context *smu, uint32_t speed);
+ int (*set_xgmi_pstate)(struct smu_context *smu, uint32_t pstate);
+ int (*gfx_off_control)(struct smu_context *smu, bool enable);
+--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h
++++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_0.h
+@@ -200,6 +200,9 @@ int
+ smu_v11_0_set_fan_control_mode(struct smu_context *smu,
+ uint32_t mode);
+
++int
++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed);
++
+ int smu_v11_0_set_fan_speed_rpm(struct smu_context *smu,
+ uint32_t speed);
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -2255,19 +2255,14 @@ int smu_get_fan_speed_percent(struct smu
+ int smu_set_fan_speed_percent(struct smu_context *smu, uint32_t speed)
+ {
+ int ret = 0;
+- uint32_t rpm;
+
+ if (!smu->pm_enabled || !smu->adev->pm.dpm_enabled)
+ return -EOPNOTSUPP;
+
+ mutex_lock(&smu->mutex);
+
+- if (smu->ppt_funcs->set_fan_speed_rpm) {
+- if (speed > 100)
+- speed = 100;
+- rpm = speed * smu->fan_max_rpm / 100;
+- ret = smu->ppt_funcs->set_fan_speed_rpm(smu, rpm);
+- }
++ if (smu->ppt_funcs->set_fan_speed_percent)
++ ret = smu->ppt_funcs->set_fan_speed_percent(smu, speed);
+
+ mutex_unlock(&smu->mutex);
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2366,6 +2366,7 @@ static const struct pptable_funcs arctur
+ .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ .get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ .set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ .gfx_off_control = smu_v11_0_gfx_off_control,
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c
+@@ -2710,6 +2710,7 @@ static const struct pptable_funcs navi10
+ .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ .get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ .set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ .gfx_off_control = smu_v11_0_gfx_off_control,
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+@@ -2776,6 +2776,7 @@ static const struct pptable_funcs sienna
+ .display_clock_voltage_request = smu_v11_0_display_clock_voltage_request,
+ .get_fan_control_mode = smu_v11_0_get_fan_control_mode,
+ .set_fan_control_mode = smu_v11_0_set_fan_control_mode,
++ .set_fan_speed_percent = smu_v11_0_set_fan_speed_percent,
+ .set_fan_speed_rpm = smu_v11_0_set_fan_speed_rpm,
+ .set_xgmi_pstate = smu_v11_0_set_xgmi_pstate,
+ .gfx_off_control = smu_v11_0_gfx_off_control,
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+@@ -1123,6 +1123,35 @@ smu_v11_0_set_fan_static_mode(struct smu
+ }
+
+ int
++smu_v11_0_set_fan_speed_percent(struct smu_context *smu, uint32_t speed)
++{
++ struct amdgpu_device *adev = smu->adev;
++ uint32_t duty100, duty;
++ uint64_t tmp64;
++
++ if (speed > 100)
++ speed = 100;
++
++ if (smu_v11_0_auto_fan_control(smu, 0))
++ return -EINVAL;
++
++ duty100 = REG_GET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL1),
++ CG_FDO_CTRL1, FMAX_DUTY100);
++ if (!duty100)
++ return -EINVAL;
++
++ tmp64 = (uint64_t)speed * duty100;
++ do_div(tmp64, 100);
++ duty = (uint32_t)tmp64;
++
++ WREG32_SOC15(THM, 0, mmCG_FDO_CTRL0,
++ REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_FDO_CTRL0),
++ CG_FDO_CTRL0, FDO_STATIC_DUTY, duty));
++
++ return smu_v11_0_set_fan_static_mode(smu, FDO_PWM_MODE_STATIC);
++}
++
++int
+ smu_v11_0_set_fan_control_mode(struct smu_context *smu,
+ uint32_t mode)
+ {
+@@ -1130,7 +1159,7 @@ smu_v11_0_set_fan_control_mode(struct sm
+
+ switch (mode) {
+ case AMD_FAN_CTRL_NONE:
+- ret = smu_v11_0_set_fan_speed_rpm(smu, smu->fan_max_rpm);
++ ret = smu_v11_0_set_fan_speed_percent(smu, 100);
+ break;
+ case AMD_FAN_CTRL_MANUAL:
+ ret = smu_v11_0_auto_fan_control(smu, 0);
--- /dev/null
+From e82080e1f456467cc185fe65ee69fe9f9bd0b576 Mon Sep 17 00:00:00 2001
+From: Janosch Frank <frankja@linux.ibm.com>
+Date: Wed, 13 Jan 2021 11:56:26 -0500
+Subject: s390: uv: Fix sysfs max number of VCPUs reporting
+
+From: Janosch Frank <frankja@linux.ibm.com>
+
+commit e82080e1f456467cc185fe65ee69fe9f9bd0b576 upstream.
+
+The number reported by the query is N-1 and I think people reading the
+sysfs file would expect N instead. For users creating VMs there's no
+actual difference because KVM's limit is currently below the UV's
+limit.
+
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Fixes: a0f60f8431999 ("s390/protvirt: Add sysfs firmware interface for Ultravisor information")
+Cc: stable@vger.kernel.org
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/arch/s390/boot/uv.c b/arch/s390/boot/uv.c
+index a15c033f53ca..87641dd65ccf 100644
+--- a/arch/s390/boot/uv.c
++++ b/arch/s390/boot/uv.c
+@@ -35,7 +35,7 @@ void uv_query_info(void)
+ uv_info.guest_cpu_stor_len = uvcb.cpu_stor_len;
+ uv_info.max_sec_stor_addr = ALIGN(uvcb.max_guest_stor_addr, PAGE_SIZE);
+ uv_info.max_num_sec_conf = uvcb.max_num_sec_conf;
+- uv_info.max_guest_cpus = uvcb.max_guest_cpus;
++ uv_info.max_guest_cpu_id = uvcb.max_guest_cpu_id;
+ }
+
+ #ifdef CONFIG_PROTECTED_VIRTUALIZATION_GUEST
+diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h
+index 0325fc0469b7..7b98d4caee77 100644
+--- a/arch/s390/include/asm/uv.h
++++ b/arch/s390/include/asm/uv.h
+@@ -96,7 +96,7 @@ struct uv_cb_qui {
+ u32 max_num_sec_conf;
+ u64 max_guest_stor_addr;
+ u8 reserved88[158 - 136];
+- u16 max_guest_cpus;
++ u16 max_guest_cpu_id;
+ u8 reserveda0[200 - 160];
+ } __packed __aligned(8);
+
+@@ -273,7 +273,7 @@ struct uv_info {
+ unsigned long guest_cpu_stor_len;
+ unsigned long max_sec_stor_addr;
+ unsigned int max_num_sec_conf;
+- unsigned short max_guest_cpus;
++ unsigned short max_guest_cpu_id;
+ };
+
+ extern struct uv_info uv_info;
+diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
+index 883bfed9f5c2..b2d2ad153067 100644
+--- a/arch/s390/kernel/uv.c
++++ b/arch/s390/kernel/uv.c
+@@ -368,7 +368,7 @@ static ssize_t uv_query_max_guest_cpus(struct kobject *kobj,
+ struct kobj_attribute *attr, char *page)
+ {
+ return scnprintf(page, PAGE_SIZE, "%d\n",
+- uv_info.max_guest_cpus);
++ uv_info.max_guest_cpu_id + 1);
+ }
+
+ static struct kobj_attribute uv_query_max_guest_cpus_attr =
--- /dev/null
+From f21916ec4826766463fe9fb55a5f43d2a365811d Mon Sep 17 00:00:00 2001
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+Date: Tue, 22 Dec 2020 20:20:13 -0500
+Subject: s390/vfio-ap: clean up vfio_ap resources when KVM pointer invalidated
+
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+
+commit f21916ec4826766463fe9fb55a5f43d2a365811d upstream.
+
+The vfio_ap device driver registers a group notifier with VFIO when the
+file descriptor for a VFIO mediated device for a KVM guest is opened to
+receive notification that the KVM pointer is set (VFIO_GROUP_NOTIFY_SET_KVM
+event). When the KVM pointer is set, the vfio_ap driver takes the
+following actions:
+1. Stashes the KVM pointer in the vfio_ap_mdev struct that holds the state
+ of the mediated device.
+2. Calls the kvm_get_kvm() function to increment its reference counter.
+3. Sets the function pointer to the function that handles interception of
+ the instruction that enables/disables interrupt processing.
+4. Sets the masks in the KVM guest's CRYCB to pass AP resources through to
+ the guest.
+
+In order to avoid memory leaks, when the notifier is called to receive
+notification that the KVM pointer has been set to NULL, the vfio_ap device
+driver should reverse the actions taken when the KVM pointer was set.
+
+Fixes: 258287c994de ("s390: vfio-ap: implement mediated device open callback")
+Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
+Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20201223012013.5418-1-akrowiak@linux.ibm.com
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/crypto/vfio_ap_ops.c | 49 +++++++++++++++++++++-----------------
+ 1 file changed, 28 insertions(+), 21 deletions(-)
+
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -1038,19 +1038,14 @@ static int vfio_ap_mdev_set_kvm(struct a
+ {
+ struct ap_matrix_mdev *m;
+
+- mutex_lock(&matrix_dev->lock);
+-
+ list_for_each_entry(m, &matrix_dev->mdev_list, node) {
+- if ((m != matrix_mdev) && (m->kvm == kvm)) {
+- mutex_unlock(&matrix_dev->lock);
++ if ((m != matrix_mdev) && (m->kvm == kvm))
+ return -EPERM;
+- }
+ }
+
+ matrix_mdev->kvm = kvm;
+ kvm_get_kvm(kvm);
+ kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook;
+- mutex_unlock(&matrix_dev->lock);
+
+ return 0;
+ }
+@@ -1084,35 +1079,52 @@ static int vfio_ap_mdev_iommu_notifier(s
+ return NOTIFY_DONE;
+ }
+
++static void vfio_ap_mdev_unset_kvm(struct ap_matrix_mdev *matrix_mdev)
++{
++ kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
++ matrix_mdev->kvm->arch.crypto.pqap_hook = NULL;
++ vfio_ap_mdev_reset_queues(matrix_mdev->mdev);
++ kvm_put_kvm(matrix_mdev->kvm);
++ matrix_mdev->kvm = NULL;
++}
++
+ static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+- int ret;
++ int ret, notify_rc = NOTIFY_OK;
+ struct ap_matrix_mdev *matrix_mdev;
+
+ if (action != VFIO_GROUP_NOTIFY_SET_KVM)
+ return NOTIFY_OK;
+
+ matrix_mdev = container_of(nb, struct ap_matrix_mdev, group_notifier);
++ mutex_lock(&matrix_dev->lock);
+
+ if (!data) {
+- matrix_mdev->kvm = NULL;
+- return NOTIFY_OK;
++ if (matrix_mdev->kvm)
++ vfio_ap_mdev_unset_kvm(matrix_mdev);
++ goto notify_done;
+ }
+
+ ret = vfio_ap_mdev_set_kvm(matrix_mdev, data);
+- if (ret)
+- return NOTIFY_DONE;
++ if (ret) {
++ notify_rc = NOTIFY_DONE;
++ goto notify_done;
++ }
+
+ /* If there is no CRYCB pointer, then we can't copy the masks */
+- if (!matrix_mdev->kvm->arch.crypto.crycbd)
+- return NOTIFY_DONE;
++ if (!matrix_mdev->kvm->arch.crypto.crycbd) {
++ notify_rc = NOTIFY_DONE;
++ goto notify_done;
++ }
+
+ kvm_arch_crypto_set_masks(matrix_mdev->kvm, matrix_mdev->matrix.apm,
+ matrix_mdev->matrix.aqm,
+ matrix_mdev->matrix.adm);
+
+- return NOTIFY_OK;
++notify_done:
++ mutex_unlock(&matrix_dev->lock);
++ return notify_rc;
+ }
+
+ static struct vfio_ap_queue *vfio_ap_find_queue(int apqn)
+@@ -1246,13 +1258,8 @@ static void vfio_ap_mdev_release(struct
+ struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
+
+ mutex_lock(&matrix_dev->lock);
+- if (matrix_mdev->kvm) {
+- kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
+- matrix_mdev->kvm->arch.crypto.pqap_hook = NULL;
+- vfio_ap_mdev_reset_queues(mdev);
+- kvm_put_kvm(matrix_mdev->kvm);
+- matrix_mdev->kvm = NULL;
+- }
++ if (matrix_mdev->kvm)
++ vfio_ap_mdev_unset_kvm(matrix_mdev);
+ mutex_unlock(&matrix_dev->lock);
+
+ vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
--- /dev/null
+From 6c12a6384e0c0b96debd88b24028e58f2ebd417b Mon Sep 17 00:00:00 2001
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+Date: Tue, 22 Dec 2020 20:15:53 -0500
+Subject: s390/vfio-ap: No need to disable IRQ after queue reset
+
+From: Tony Krowiak <akrowiak@linux.ibm.com>
+
+commit 6c12a6384e0c0b96debd88b24028e58f2ebd417b upstream.
+
+The queues assigned to a matrix mediated device are currently reset when:
+
+* The VFIO_DEVICE_RESET ioctl is invoked
+* The mdev fd is closed by userspace (QEMU)
+* The mdev is removed from sysfs.
+
+Immediately after the reset of a queue, a call is made to disable
+interrupts for the queue. This is entirely unnecessary because the reset of
+a queue disables interrupts, so this will be removed.
+
+Furthermore, vfio_ap_irq_disable() does an unconditional PQAP/AQIC which
+can result in a specification exception (when the corresponding facility
+is not available), so this is actually a bugfix.
+
+Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
+[pasic@linux.ibm.com: minor rework before merging]
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Fixes: ec89b55e3bce ("s390: ap: implement PAPQ AQIC interception in kernel")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/crypto/vfio_ap_drv.c | 6 --
+ drivers/s390/crypto/vfio_ap_ops.c | 100 +++++++++++++++++++++-------------
+ drivers/s390/crypto/vfio_ap_private.h | 12 ++--
+ 3 files changed, 69 insertions(+), 49 deletions(-)
+
+--- a/drivers/s390/crypto/vfio_ap_drv.c
++++ b/drivers/s390/crypto/vfio_ap_drv.c
+@@ -71,15 +71,11 @@ static int vfio_ap_queue_dev_probe(struc
+ static void vfio_ap_queue_dev_remove(struct ap_device *apdev)
+ {
+ struct vfio_ap_queue *q;
+- int apid, apqi;
+
+ mutex_lock(&matrix_dev->lock);
+ q = dev_get_drvdata(&apdev->device);
++ vfio_ap_mdev_reset_queue(q, 1);
+ dev_set_drvdata(&apdev->device, NULL);
+- apid = AP_QID_CARD(q->apqn);
+- apqi = AP_QID_QUEUE(q->apqn);
+- vfio_ap_mdev_reset_queue(apid, apqi, 1);
+- vfio_ap_irq_disable(q);
+ kfree(q);
+ mutex_unlock(&matrix_dev->lock);
+ }
+--- a/drivers/s390/crypto/vfio_ap_ops.c
++++ b/drivers/s390/crypto/vfio_ap_ops.c
+@@ -25,6 +25,7 @@
+ #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device"
+
+ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev);
++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn);
+
+ static int match_apqn(struct device *dev, const void *data)
+ {
+@@ -49,20 +50,15 @@ static struct vfio_ap_queue *vfio_ap_get
+ int apqn)
+ {
+ struct vfio_ap_queue *q;
+- struct device *dev;
+
+ if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm))
+ return NULL;
+ if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm))
+ return NULL;
+
+- dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+- &apqn, match_apqn);
+- if (!dev)
+- return NULL;
+- q = dev_get_drvdata(dev);
+- q->matrix_mdev = matrix_mdev;
+- put_device(dev);
++ q = vfio_ap_find_queue(apqn);
++ if (q)
++ q->matrix_mdev = matrix_mdev;
+
+ return q;
+ }
+@@ -119,13 +115,18 @@ static void vfio_ap_wait_for_irqclear(in
+ */
+ static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
+ {
+- if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev)
++ if (!q)
++ return;
++ if (q->saved_isc != VFIO_AP_ISC_INVALID &&
++ !WARN_ON(!(q->matrix_mdev && q->matrix_mdev->kvm))) {
+ kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc);
+- if (q->saved_pfn && q->matrix_mdev)
++ q->saved_isc = VFIO_AP_ISC_INVALID;
++ }
++ if (q->saved_pfn && !WARN_ON(!q->matrix_mdev)) {
+ vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev),
+ &q->saved_pfn, 1);
+- q->saved_pfn = 0;
+- q->saved_isc = VFIO_AP_ISC_INVALID;
++ q->saved_pfn = 0;
++ }
+ }
+
+ /**
+@@ -144,7 +145,7 @@ static void vfio_ap_free_aqic_resources(
+ * Returns if ap_aqic function failed with invalid, deconfigured or
+ * checkstopped AP.
+ */
+-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
++static struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
+ {
+ struct ap_qirq_ctrl aqic_gisa = {};
+ struct ap_queue_status status;
+@@ -1114,48 +1115,70 @@ static int vfio_ap_mdev_group_notifier(s
+ return NOTIFY_OK;
+ }
+
+-static void vfio_ap_irq_disable_apqn(int apqn)
++static struct vfio_ap_queue *vfio_ap_find_queue(int apqn)
+ {
+ struct device *dev;
+- struct vfio_ap_queue *q;
++ struct vfio_ap_queue *q = NULL;
+
+ dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+ &apqn, match_apqn);
+ if (dev) {
+ q = dev_get_drvdata(dev);
+- vfio_ap_irq_disable(q);
+ put_device(dev);
+ }
++
++ return q;
+ }
+
+-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
+ unsigned int retry)
+ {
+ struct ap_queue_status status;
++ int ret;
+ int retry2 = 2;
+- int apqn = AP_MKQID(apid, apqi);
+
+- do {
+- status = ap_zapq(apqn);
+- switch (status.response_code) {
+- case AP_RESPONSE_NORMAL:
+- while (!status.queue_empty && retry2--) {
+- msleep(20);
+- status = ap_tapq(apqn, NULL);
+- }
+- WARN_ON_ONCE(retry2 <= 0);
+- return 0;
+- case AP_RESPONSE_RESET_IN_PROGRESS:
+- case AP_RESPONSE_BUSY:
++ if (!q)
++ return 0;
++
++retry_zapq:
++ status = ap_zapq(q->apqn);
++ switch (status.response_code) {
++ case AP_RESPONSE_NORMAL:
++ ret = 0;
++ break;
++ case AP_RESPONSE_RESET_IN_PROGRESS:
++ if (retry--) {
+ msleep(20);
+- break;
+- default:
+- /* things are really broken, give up */
+- return -EIO;
++ goto retry_zapq;
+ }
+- } while (retry--);
++ ret = -EBUSY;
++ break;
++ case AP_RESPONSE_Q_NOT_AVAIL:
++ case AP_RESPONSE_DECONFIGURED:
++ case AP_RESPONSE_CHECKSTOPPED:
++ WARN_ON_ONCE(status.irq_enabled);
++ ret = -EBUSY;
++ goto free_resources;
++ default:
++ /* things are really broken, give up */
++ WARN(true, "PQAP/ZAPQ completed with invalid rc (%x)\n",
++ status.response_code);
++ return -EIO;
++ }
++
++ /* wait for the reset to take effect */
++ while (retry2--) {
++ if (status.queue_empty && !status.irq_enabled)
++ break;
++ msleep(20);
++ status = ap_tapq(q->apqn, NULL);
++ }
++ WARN_ON_ONCE(retry2 <= 0);
+
+- return -EBUSY;
++free_resources:
++ vfio_ap_free_aqic_resources(q);
++
++ return ret;
+ }
+
+ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
+@@ -1163,13 +1186,15 @@ static int vfio_ap_mdev_reset_queues(str
+ int ret;
+ int rc = 0;
+ unsigned long apid, apqi;
++ struct vfio_ap_queue *q;
+ struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
+
+ for_each_set_bit_inv(apid, matrix_mdev->matrix.apm,
+ matrix_mdev->matrix.apm_max + 1) {
+ for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm,
+ matrix_mdev->matrix.aqm_max + 1) {
+- ret = vfio_ap_mdev_reset_queue(apid, apqi, 1);
++ q = vfio_ap_find_queue(AP_MKQID(apid, apqi));
++ ret = vfio_ap_mdev_reset_queue(q, 1);
+ /*
+ * Regardless whether a queue turns out to be busy, or
+ * is not operational, we need to continue resetting
+@@ -1177,7 +1202,6 @@ static int vfio_ap_mdev_reset_queues(str
+ */
+ if (ret)
+ rc = ret;
+- vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi));
+ }
+ }
+
+--- a/drivers/s390/crypto/vfio_ap_private.h
++++ b/drivers/s390/crypto/vfio_ap_private.h
+@@ -88,11 +88,6 @@ struct ap_matrix_mdev {
+ struct mdev_device *mdev;
+ };
+
+-extern int vfio_ap_mdev_register(void);
+-extern void vfio_ap_mdev_unregister(void);
+-int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
+- unsigned int retry);
+-
+ struct vfio_ap_queue {
+ struct ap_matrix_mdev *matrix_mdev;
+ unsigned long saved_pfn;
+@@ -100,5 +95,10 @@ struct vfio_ap_queue {
+ #define VFIO_AP_ISC_INVALID 0xff
+ unsigned char saved_isc;
+ };
+-struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q);
++
++int vfio_ap_mdev_register(void);
++void vfio_ap_mdev_unregister(void);
++int vfio_ap_mdev_reset_queue(struct vfio_ap_queue *q,
++ unsigned int retry);
++
+ #endif /* _VFIO_AP_PRIVATE_H_ */
kernel-kexec-remove-the-lock-operation-of-system_transition_mutex.patch
alsa-hda-realtek-enable-headset-of-asus-b1400cepe-with-alc256.patch
alsa-hda-via-apply-the-workaround-generically-for-clevo-machines.patch
+parisc-enable-mlong-calls-gcc-option-by-default-when-config_modules.patch
+media-cec-add-stm32-driver.patch
+media-cedrus-fix-h264-decoding.patch
+media-hantro-fix-reset_raw_fmt-initialization.patch
+media-rc-fix-timeout-handling-after-switch-to-microsecond-durations.patch
+media-rc-ite-cir-fix-min_timeout-calculation.patch
+media-rc-ensure-that-uevent-can-be-read-directly-after-rc-device-register.patch
+arm-dts-tbs2910-rename-mmc-node-aliases.patch
+arm-dts-ux500-reserve-memory-carveouts.patch
+arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch
+wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch
+x86-xen-avoid-warning-in-xen-pv-guest-with-config_amd_mem_encrypt-enabled.patch
+asoc-amd-renoir-refine-dmi-entries-for-some-lenovo-products.patch
+revert-drm-amdgpu-swsmu-drop-set_fan_speed_percent-v2.patch
+drm-nouveau-kms-gk104-gp1xx-fix-64x64-cursors.patch
+drm-i915-always-flush-the-active-worker-before-returning-from-the-wait.patch
+drm-i915-gt-always-try-to-reserve-ggtt-address-0x0.patch
+drivers-nouveau-kms-nv50-reject-format-modifiers-for-cursor-planes.patch
+bcache-only-check-feature-sets-when-sb-version-bcache_sb_version_cdev_with_features.patch
+net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch
+s390-uv-fix-sysfs-max-number-of-vcpus-reporting.patch
+s390-vfio-ap-no-need-to-disable-irq-after-queue-reset.patch
+s390-vfio-ap-clean-up-vfio_ap-resources-when-kvm-pointer-invalidated.patch
+pm-hibernate-flush-swap-writer-after-marking.patch
--- /dev/null
+From 5122565188bae59d507d90a9a9fd2fd6107f4439 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 21 Jan 2021 17:16:22 +0100
+Subject: wext: fix NULL-ptr-dereference with cfg80211's lack of commit()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 5122565188bae59d507d90a9a9fd2fd6107f4439 upstream.
+
+Since cfg80211 doesn't implement commit, we never really cared about
+that code there (and it's configured out w/o CONFIG_WIRELESS_EXT).
+After all, since it has no commit, it shouldn't return -EIWCOMMIT to
+indicate commit is needed.
+
+However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_
+happen if e.g. we try to change the frequency but we're already in
+the process of connecting to some network, and drivers could return
+that value (or even cfg80211 itself might).
+
+This then causes us to crash because dev->wireless_handlers is NULL
+but we try to check dev->wireless_handlers->standard[0].
+
+Fix this by also checking dev->wireless_handlers. Also simplify the
+code a little bit.
+
+Cc: stable@vger.kernel.org
+Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com
+Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/wext-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -896,8 +896,9 @@ out:
+ int call_commit_handler(struct net_device *dev)
+ {
+ #ifdef CONFIG_WIRELESS_EXT
+- if ((netif_running(dev)) &&
+- (dev->wireless_handlers->standard[0] != NULL))
++ if (netif_running(dev) &&
++ dev->wireless_handlers &&
++ dev->wireless_handlers->standard[0])
+ /* Call the commit handler on the driver */
+ return dev->wireless_handlers->standard[0](dev, NULL,
+ NULL, NULL);
--- /dev/null
+From 2e92493637a09547734f92c62a2471f6f0cb9a2c Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 25 Jan 2021 14:42:07 +0100
+Subject: x86/xen: avoid warning in Xen pv guest with CONFIG_AMD_MEM_ENCRYPT enabled
+
+From: Juergen Gross <jgross@suse.com>
+
+commit 2e92493637a09547734f92c62a2471f6f0cb9a2c upstream.
+
+When booting a kernel which has been built with CONFIG_AMD_MEM_ENCRYPT
+enabled as a Xen pv guest a warning is issued for each processor:
+
+[ 5.964347] ------------[ cut here ]------------
+[ 5.968314] WARNING: CPU: 0 PID: 1 at /home/gross/linux/head/arch/x86/xen/enlighten_pv.c:660 get_trap_addr+0x59/0x90
+[ 5.972321] Modules linked in:
+[ 5.976313] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W 5.11.0-rc5-default #75
+[ 5.980313] Hardware name: Dell Inc. OptiPlex 9020/0PC5F7, BIOS A05 12/05/2013
+[ 5.984313] RIP: e030:get_trap_addr+0x59/0x90
+[ 5.988313] Code: 42 10 83 f0 01 85 f6 74 04 84 c0 75 1d b8 01 00 00 00 c3 48 3d 00 80 83 82 72 08 48 3d 20 81 83 82 72 0c b8 01 00 00 00 eb db <0f> 0b 31 c0 c3 48 2d 00 80 83 82 48 ba 72 1c c7 71 1c c7 71 1c 48
+[ 5.992313] RSP: e02b:ffffc90040033d38 EFLAGS: 00010202
+[ 5.996313] RAX: 0000000000000001 RBX: ffffffff82a141d0 RCX: ffffffff8222ec38
+[ 6.000312] RDX: ffffffff8222ec38 RSI: 0000000000000005 RDI: ffffc90040033d40
+[ 6.004313] RBP: ffff8881003984a0 R08: 0000000000000007 R09: ffff888100398000
+[ 6.008312] R10: 0000000000000007 R11: ffffc90040246000 R12: ffff8884082182a8
+[ 6.012313] R13: 0000000000000100 R14: 000000000000001d R15: ffff8881003982d0
+[ 6.016316] FS: 0000000000000000(0000) GS:ffff888408200000(0000) knlGS:0000000000000000
+[ 6.020313] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 6.024313] CR2: ffffc900020ef000 CR3: 000000000220a000 CR4: 0000000000050660
+[ 6.028314] Call Trace:
+[ 6.032313] cvt_gate_to_trap.part.7+0x3f/0x90
+[ 6.036313] ? asm_exc_double_fault+0x30/0x30
+[ 6.040313] xen_convert_trap_info+0x87/0xd0
+[ 6.044313] xen_pv_cpu_up+0x17a/0x450
+[ 6.048313] bringup_cpu+0x2b/0xc0
+[ 6.052313] ? cpus_read_trylock+0x50/0x50
+[ 6.056313] cpuhp_invoke_callback+0x80/0x4c0
+[ 6.060313] _cpu_up+0xa7/0x140
+[ 6.064313] cpu_up+0x98/0xd0
+[ 6.068313] bringup_nonboot_cpus+0x4f/0x60
+[ 6.072313] smp_init+0x26/0x79
+[ 6.076313] kernel_init_freeable+0x103/0x258
+[ 6.080313] ? rest_init+0xd0/0xd0
+[ 6.084313] kernel_init+0xa/0x110
+[ 6.088313] ret_from_fork+0x1f/0x30
+[ 6.092313] ---[ end trace be9ecf17dceeb4f3 ]---
+
+Reason is that there is no Xen pv trap entry for X86_TRAP_VC.
+
+Fix that by adding a generic trap handler for unknown traps and wire all
+unknown bare metal handlers to this generic handler, which will just
+crash the system in case such a trap will ever happen.
+
+Fixes: 0786138c78e793 ("x86/sev-es: Add a Runtime #VC Exception Handler")
+Cc: <stable@vger.kernel.org> # v5.10
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/idtentry.h | 1 +
+ arch/x86/xen/enlighten_pv.c | 15 ++++++++++++++-
+ arch/x86/xen/xen-asm.S | 1 +
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/idtentry.h
++++ b/arch/x86/include/asm/idtentry.h
+@@ -616,6 +616,7 @@ DECLARE_IDTENTRY_VC(X86_TRAP_VC, exc_vmm
+
+ #ifdef CONFIG_XEN_PV
+ DECLARE_IDTENTRY_XENCB(X86_TRAP_OTHER, exc_xen_hypervisor_callback);
++DECLARE_IDTENTRY_RAW(X86_TRAP_OTHER, exc_xen_unknown_trap);
+ #endif
+
+ /* Device interrupts common/spurious */
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -583,6 +583,13 @@ DEFINE_IDTENTRY_RAW(xenpv_exc_debug)
+ exc_debug(regs);
+ }
+
++DEFINE_IDTENTRY_RAW(exc_xen_unknown_trap)
++{
++ /* This should never happen and there is no way to handle it. */
++ pr_err("Unknown trap in Xen PV mode.");
++ BUG();
++}
++
+ struct trap_array_entry {
+ void (*orig)(void);
+ void (*xen)(void);
+@@ -631,6 +638,7 @@ static bool __ref get_trap_addr(void **a
+ {
+ unsigned int nr;
+ bool ist_okay = false;
++ bool found = false;
+
+ /*
+ * Replace trap handler addresses by Xen specific ones.
+@@ -645,6 +653,7 @@ static bool __ref get_trap_addr(void **a
+ if (*addr == entry->orig) {
+ *addr = entry->xen;
+ ist_okay = entry->ist_okay;
++ found = true;
+ break;
+ }
+ }
+@@ -655,9 +664,13 @@ static bool __ref get_trap_addr(void **a
+ nr = (*addr - (void *)early_idt_handler_array[0]) /
+ EARLY_IDT_HANDLER_SIZE;
+ *addr = (void *)xen_early_idt_handler_array[nr];
++ found = true;
+ }
+
+- if (WARN_ON(ist != 0 && !ist_okay))
++ if (!found)
++ *addr = (void *)xen_asm_exc_xen_unknown_trap;
++
++ if (WARN_ON(found && ist != 0 && !ist_okay))
+ return false;
+
+ return true;
+--- a/arch/x86/xen/xen-asm.S
++++ b/arch/x86/xen/xen-asm.S
+@@ -178,6 +178,7 @@ xen_pv_trap asm_exc_simd_coprocessor_err
+ #ifdef CONFIG_IA32_EMULATION
+ xen_pv_trap entry_INT80_compat
+ #endif
++xen_pv_trap asm_exc_xen_unknown_trap
+ xen_pv_trap asm_exc_xen_hypervisor_callback
+
+ __INIT
projects / thirdparty / kernel / stable-queue.git / commitdiff
