--- /dev/null
+From 0c7cdab52a03d1e1f4f0cfcea53269a3bb872008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Aug 2020 15:46:30 +0800
+Subject: ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5a25de6df789cc805a9b8ba7ab5deef5067af47e ]
+
+Freeing chip on error may lead to an Oops at the next time
+the system goes to resume. Fix this by removing all
+snd_echo_free() calls on error.
+
+Fixes: 47b5d028fdce8 ("ALSA: Echoaudio - Add suspend support #2")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20200813074632.17022-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/echoaudio/echoaudio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index ca9125726be24..8596ae4c2bdef 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -2198,7 +2198,6 @@ static int snd_echo_resume(struct device *dev)
+ if (err < 0) {
+ kfree(commpage_bak);
+ dev_err(dev, "resume init_hw err=%d\n", err);
+- snd_echo_free(chip);
+ return err;
+ }
+
+@@ -2225,7 +2224,6 @@ static int snd_echo_resume(struct device *dev)
+ if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
+ KBUILD_MODNAME, chip)) {
+ dev_err(chip->card->dev, "cannot grab irq\n");
+- snd_echo_free(chip);
+ return -EBUSY;
+ }
+ chip->irq = pci->irq;
+--
+2.25.1
+
--- /dev/null
+From dd8c535c178bb867d02b230d91654c8e4146bcc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 20:05:07 +0300
+Subject: clk: actions: Fix h_clk for Actions S500 SoC
+
+From: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
+
+[ Upstream commit f47ee279d25fb0e010cae5d6e758e39b40eb6378 ]
+
+The h_clk clock in the Actions Semi S500 SoC clock driver has an
+invalid parent. Replace with the correct one.
+
+Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/c57e7ebabfa970014f073b92fe95b47d3e5a70b1.1593788312.git.cristian.ciocaltea@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-s500.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c
+index e2007ac4d235d..0eb83a0b70bcc 100644
+--- a/drivers/clk/actions/owl-s500.c
++++ b/drivers/clk/actions/owl-s500.c
+@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0);
+ static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0);
+
+ /* divider clocks */
+-static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0);
++static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0);
+ static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0);
+
+ /* factor clocks */
+--
+2.25.1
+
--- /dev/null
+From 79cb8436f61a8718ced4a0a02dfe0f33bc6b4d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 20:26:19 +0200
+Subject: clk: bcm2835: Do not use prediv with bcm2711's PLLs
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit f34e4651ce66a754f41203284acf09b28b9dd955 ]
+
+Contrary to previous SoCs, bcm2711 doesn't have a prescaler in the PLL
+feedback loop. Bypass it by zeroing fb_prediv_mask when running on
+bcm2711.
+
+Note that, since the prediv configuration bits were re-purposed, this
+was triggering miscalculations on all clocks hanging from the VPU clock,
+notably the aux UART, making its output unintelligible.
+
+Fixes: 42de9ad400af ("clk: bcm2835: Add BCM2711_CLOCK_EMMC2 support")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20200730182619.23246-1-nsaenzjulienne@suse.de
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 6e5d635f030f4..45420b514149f 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -314,6 +314,7 @@ struct bcm2835_cprman {
+ struct device *dev;
+ void __iomem *regs;
+ spinlock_t regs_lock; /* spinlock for all clocks */
++ unsigned int soc;
+
+ /*
+ * Real names of cprman clock parents looked up through
+@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw)
+ A2W_PLL_CTRL_PRST_DISABLE;
+ }
+
++static u32 bcm2835_pll_get_prediv_mask(struct bcm2835_cprman *cprman,
++ const struct bcm2835_pll_data *data)
++{
++ /*
++ * On BCM2711 there isn't a pre-divisor available in the PLL feedback
++ * loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed
++ * for to for VCO RANGE bits.
++ */
++ if (cprman->soc & SOC_BCM2711)
++ return 0;
++
++ return data->ana->fb_prediv_mask;
++}
++
+ static void bcm2835_pll_choose_ndiv_and_fdiv(unsigned long rate,
+ unsigned long parent_rate,
+ u32 *ndiv, u32 *fdiv)
+@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw,
+ ndiv = (a2wctrl & A2W_PLL_CTRL_NDIV_MASK) >> A2W_PLL_CTRL_NDIV_SHIFT;
+ pdiv = (a2wctrl & A2W_PLL_CTRL_PDIV_MASK) >> A2W_PLL_CTRL_PDIV_SHIFT;
+ using_prediv = cprman_read(cprman, data->ana_reg_base + 4) &
+- data->ana->fb_prediv_mask;
++ bcm2835_pll_get_prediv_mask(cprman, data);
+
+ if (using_prediv) {
+ ndiv *= 2;
+@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);
+ struct bcm2835_cprman *cprman = pll->cprman;
+ const struct bcm2835_pll_data *data = pll->data;
++ u32 prediv_mask = bcm2835_pll_get_prediv_mask(cprman, data);
+ bool was_using_prediv, use_fb_prediv, do_ana_setup_first;
+ u32 ndiv, fdiv, a2w_ctl;
+ u32 ana[4];
+@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ for (i = 3; i >= 0; i--)
+ ana[i] = cprman_read(cprman, data->ana_reg_base + i * 4);
+
+- was_using_prediv = ana[1] & data->ana->fb_prediv_mask;
++ was_using_prediv = ana[1] & prediv_mask;
+
+ ana[0] &= ~data->ana->mask0;
+ ana[0] |= data->ana->set0;
+@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ ana[3] |= data->ana->set3;
+
+ if (was_using_prediv && !use_fb_prediv) {
+- ana[1] &= ~data->ana->fb_prediv_mask;
++ ana[1] &= ~prediv_mask;
+ do_ana_setup_first = true;
+ } else if (!was_using_prediv && use_fb_prediv) {
+- ana[1] |= data->ana->fb_prediv_mask;
++ ana[1] |= prediv_mask;
+ do_ana_setup_first = false;
+ } else {
+ do_ana_setup_first = true;
+@@ -2234,6 +2250,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, cprman);
+
+ cprman->onecell.num = asize;
++ cprman->soc = pdata->soc;
+ hws = cprman->onecell.hws;
+
+ for (i = 0; i < asize; i++) {
+--
+2.25.1
+
--- /dev/null
+From 40e953a4c0eb77dd2a3044d14fea43b1f7e7f252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 03:21:43 +0000
+Subject: clk: clk-atlas6: fix return value check in atlas6_clk_init()
+
+From: Xu Wang <vulab@iscas.ac.cn>
+
+[ Upstream commit 12b90b40854a8461a02ef19f6f4474cc88d64b66 ]
+
+In case of error, the function clk_register() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check
+should be replaced with IS_ERR().
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20200713032143.21362-1-vulab@iscas.ac.cn
+Acked-by: Barry Song <baohua@kernel.org>
+Fixes: 7bf21bc81f28 ("clk: sirf: re-arch to make the codes support both prima2 and atlas6")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sirf/clk-atlas6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c
+index c84d5bab7ac28..b95483bb6a5ec 100644
+--- a/drivers/clk/sirf/clk-atlas6.c
++++ b/drivers/clk/sirf/clk-atlas6.c
+@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np)
+
+ for (i = pll1; i < maxclk; i++) {
+ atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]);
+- BUG_ON(!atlas6_clks[i]);
++ BUG_ON(IS_ERR(atlas6_clks[i]));
+ }
+ clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu");
+ clk_register_clkdev(atlas6_clks[io], NULL, "io");
+--
+2.25.1
+
--- /dev/null
+From 03d71094b942de6088b3249f37281a1cb858e84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 09:52:33 -0400
+Subject: clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit c8b9002f44e4a1d2771b2f59f6de900864b1f9d7 ]
+
+0x44 isn't a register offset, it is the value that goes into CAL_L_VAL.
+
+Fixes: 548a909597d5 ("clk: qcom: clk-alpha-pll: Add support for Trion PLLs")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20200709135251.643-3-jonathan@marek.ca
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index 055318f979915..a69f53e435ed5 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -55,7 +55,6 @@
+ #define PLL_STATUS(p) ((p)->offset + (p)->regs[PLL_OFF_STATUS])
+ #define PLL_OPMODE(p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE])
+ #define PLL_FRAC(p) ((p)->offset + (p)->regs[PLL_OFF_FRAC])
+-#define PLL_CAL_VAL(p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL])
+
+ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = {
+ [CLK_ALPHA_PLL_TYPE_DEFAULT] = {
+@@ -114,7 +113,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = {
+ [PLL_OFF_STATUS] = 0x30,
+ [PLL_OFF_OPMODE] = 0x38,
+ [PLL_OFF_ALPHA_VAL] = 0x40,
+- [PLL_OFF_CAL_VAL] = 0x44,
+ },
+ };
+ EXPORT_SYMBOL_GPL(clk_alpha_pll_regs);
+--
+2.25.1
+
--- /dev/null
+From c02963a682577ad8d654b5aabbaabce9d32ed49c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 09:52:32 -0400
+Subject: clk: qcom: gcc: fix sm8150 GPU and NPU clocks
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 667f39b59b494d96ae70f4217637db2ebbee3df0 ]
+
+Fix the parents and set BRANCH_HALT_SKIP. From the downstream driver it
+should be a 500us delay and not skip, however this matches what was done
+for other clocks that had 500us delay in downstream.
+
+Fixes: f73a4230d5bb ("clk: qcom: gcc: Add GPU and NPU clocks for SM8150")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20200709135251.643-2-jonathan@marek.ca
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8150.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
+index fad42897a7a7f..ee908fbfeab17 100644
+--- a/drivers/clk/qcom/gcc-sm8150.c
++++ b/drivers/clk/qcom/gcc-sm8150.c
+@@ -1616,6 +1616,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = {
+ };
+
+ static struct clk_branch gcc_gpu_gpll0_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(15),
+@@ -1631,13 +1632,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = {
+ };
+
+ static struct clk_branch gcc_gpu_gpll0_div_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(16),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_gpu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+- &gcc_gpu_gpll0_clk_src.clkr.hw },
++ &gpll0_out_even.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+@@ -1728,6 +1730,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = {
+ };
+
+ static struct clk_branch gcc_npu_gpll0_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(18),
+@@ -1743,13 +1746,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = {
+ };
+
+ static struct clk_branch gcc_npu_gpll0_div_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(19),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_npu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+- &gcc_npu_gpll0_clk_src.clkr.hw },
++ &gpll0_out_even.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+--
+2.25.1
+
--- /dev/null
+From 09fff77dbf1dbf8343cfd80dbe702feedfdadfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 13:12:05 +0200
+Subject: clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk
+
+From: Konrad Dybcio <konradybcio@gmail.com>
+
+[ Upstream commit 3386af51d3bcebcba3f7becdb1ef2e384abe90cf ]
+
+Add missing halt_check, hwcg_reg and hwcg_bit properties.
+These were likely omitted when porting the driver upstream.
+
+Signed-off-by: Konrad Dybcio <konradybcio@gmail.com>
+Link: https://lore.kernel.org/r/20200726111215.22361-9-konradybcio@gmail.com
+Fixes: f2a76a2955c0 ("clk: qcom: Add Global Clock controller (GCC) driver for SDM660")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sdm660.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c
+index bf5730832ef3d..c6fb57cd576f5 100644
+--- a/drivers/clk/qcom/gcc-sdm660.c
++++ b/drivers/clk/qcom/gcc-sdm660.c
+@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = {
+
+ static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = {
+ .halt_reg = 0x8a004,
++ .halt_check = BRANCH_HALT,
++ .hwcg_reg = 0x8a004,
++ .hwcg_bit = 1,
+ .clkr = {
+ .enable_reg = 0x8a004,
+ .enable_mask = BIT(0),
+--
+2.25.1
+
--- /dev/null
+From 3c9e007ef63ac9a2c5cf2736295046e01563d206 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 13:32:21 +1000
+Subject: crypto: af_alg - Fix regression on empty requests
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 662bb52f50bca16a74fe92b487a14d7dccb85e1a ]
+
+Some user-space programs rely on crypto requests that have no
+control metadata. This broke when a check was added to require
+the presence of control metadata with the ctx->init flag.
+
+This patch fixes the regression by setting ctx->init as long as
+one sendmsg(2) has been made, with or without a control message.
+
+Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ed8ace8675b77..35e026ba2c7ed 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -851,6 +851,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ err = -EINVAL;
+ goto unlock;
+ }
++ ctx->init = true;
+
+ if (init) {
+ ctx->enc = enc;
+@@ -858,7 +859,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ memcpy(ctx->iv, con.iv->iv, ivsize);
+
+ ctx->aead_assoclen = con.aead_assoclen;
+- ctx->init = true;
+ }
+
+ while (size) {
+--
+2.25.1
+
--- /dev/null
+From c362525ba3837c6ff77458c991ca25c5d6532ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 14:58:25 +0200
+Subject: crypto: algif_aead - fix uninitialized ctx->init
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit 21dfbcd1f5cbff9cf2f9e7e43475aed8d072b0dd ]
+
+In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is
+cleared by memset() after allocation, so add such memset() also to
+aead_accept_parent_nokey() so that the new "init" field is also
+initialized to zero. Without that the initial ctx->init checks might
+randomly return true and cause errors.
+
+While there, also remove the redundant zero assignments in both
+functions.
+
+Found via libkcapi testsuite.
+
+Cc: Stephan Mueller <smueller@chronox.de>
+Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero")
+Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/algif_aead.c | 6 ------
+ crypto/algif_skcipher.c | 7 +------
+ 2 files changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index d48d2156e6210..43c6aa784858b 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)
+
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+- ctx->used = 0;
+- atomic_set(&ctx->rcvused, 0);
+- ctx->more = 0;
+- ctx->merge = 0;
+- ctx->enc = 0;
+- ctx->aead_assoclen = 0;
+ crypto_init_wait(&ctx->wait);
+
+ ask->private = ctx;
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index a51ba22fef58f..81c4022285a7c 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+ ctx = sock_kmalloc(sk, len, GFP_KERNEL);
+ if (!ctx)
+ return -ENOMEM;
++ memset(ctx, 0, len);
+
+ ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm),
+ GFP_KERNEL);
+@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+ sock_kfree_s(sk, ctx, len);
+ return -ENOMEM;
+ }
+-
+ memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm));
+
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+- ctx->used = 0;
+- atomic_set(&ctx->rcvused, 0);
+- ctx->more = 0;
+- ctx->merge = 0;
+- ctx->enc = 0;
+ crypto_init_wait(&ctx->wait);
+
+ ask->private = ctx;
+--
+2.25.1
+
--- /dev/null
+From 93400079b5b32cb36a4d53499a7a29ec65c82ca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2020 00:23:49 +1000
+Subject: crypto: algif_aead - Only wake up when ctx->more is zero
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit f3c802a1f30013f8f723b62d7fa49eb9e991da23 ]
+
+AEAD does not support partial requests so we must not wake up
+while ctx->more is set. In order to distinguish between the
+case of no data sent yet and a zero-length request, a new init
+flag has been added to ctx.
+
+SKCIPHER has also been modified to ensure that at least a block
+of data is available if there is more data to come.
+
+Fixes: 2d97591ef43d ("crypto: af_alg - consolidation of...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 11 ++++++++---
+ crypto/algif_aead.c | 4 ++--
+ crypto/algif_skcipher.c | 4 ++--
+ include/crypto/if_alg.h | 4 +++-
+ 4 files changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index a3b9df99af6de..ed8ace8675b77 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
+
+ if (!ctx->used)
+ ctx->merge = 0;
++ ctx->init = ctx->more;
+ }
+ EXPORT_SYMBOL_GPL(af_alg_pull_tsgl);
+
+@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup);
+ *
+ * @sk socket of connection to user space
+ * @flags If MSG_DONTWAIT is set, then only report if function would sleep
++ * @min Set to minimum request size if partial requests are allowed.
+ * @return 0 when writable memory is available, < 0 upon error
+ */
+-int af_alg_wait_for_data(struct sock *sk, unsigned flags)
++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min)
+ {
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct alg_sock *ask = alg_sk(sk);
+@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags)
+ if (signal_pending(current))
+ break;
+ timeout = MAX_SCHEDULE_TIMEOUT;
+- if (sk_wait_event(sk, &timeout, (ctx->used || !ctx->more),
++ if (sk_wait_event(sk, &timeout,
++ ctx->init && (!ctx->more ||
++ (min && ctx->used >= min)),
+ &wait)) {
+ err = 0;
+ break;
+@@ -843,7 +847,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
+- if (!ctx->more && ctx->used) {
++ if (ctx->init && (init || !ctx->more)) {
+ err = -EINVAL;
+ goto unlock;
+ }
+@@ -854,6 +858,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ memcpy(ctx->iv, con.iv->iv, ivsize);
+
+ ctx->aead_assoclen = con.aead_assoclen;
++ ctx->init = true;
+ }
+
+ while (size) {
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index 0ae000a61c7f5..d48d2156e6210 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ size_t usedpages = 0; /* [in] RX bufs to be used from user */
+ size_t processed = 0; /* [in] TX bufs to be consumed */
+
+- if (!ctx->used) {
+- err = af_alg_wait_for_data(sk, flags);
++ if (!ctx->init || ctx->more) {
++ err = af_alg_wait_for_data(sk, flags, 0);
+ if (err)
+ return err;
+ }
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index ec5567c87a6df..a51ba22fef58f 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ int err = 0;
+ size_t len = 0;
+
+- if (!ctx->used) {
+- err = af_alg_wait_for_data(sk, flags);
++ if (!ctx->init || (ctx->more && ctx->used < bs)) {
++ err = af_alg_wait_for_data(sk, flags, bs);
+ if (err)
+ return err;
+ }
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 864849e942c45..c1a8d4a41bb16 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -135,6 +135,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ */
+ struct af_alg_ctx {
+@@ -151,6 +152,7 @@ struct af_alg_ctx {
+ bool more;
+ bool merge;
+ bool enc;
++ bool init;
+
+ unsigned int len;
+ };
+@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);
+ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
+ size_t dst_offset);
+ void af_alg_wmem_wakeup(struct sock *sk);
+-int af_alg_wait_for_data(struct sock *sk, unsigned flags);
++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min);
+ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ unsigned int ivsize);
+ ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
+--
+2.25.1
+
--- /dev/null
+From 1cb99bafb17c395f9ae030cae0381054d0b0ddab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 21:45:03 +1000
+Subject: crypto: caam - Remove broken arc4 support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit eeedb618378f8a09779546a3eeac16b000447d62 ]
+
+The arc4 algorithm requires storing state in the request context
+in order to allow more than one encrypt/decrypt operation. As this
+driver does not seem to do that, it means that using it for more
+than one operation is broken.
+
+Fixes: eaed71a44ad9 ("crypto: caam - add ecb(*) support")
+Link: https://lore.kernel.org/linux-crypto/CAMj1kXGvMe_A_iQ43Pmygg9xaAM-RLy=_M=v+eg--8xNmv9P+w@mail.gmail.com
+Link: https://lore.kernel.org/linux-crypto/20200702101947.682-1-ardb@kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg.c | 29 -----------------------------
+ drivers/crypto/caam/compat.h | 1 -
+ 2 files changed, 30 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index 4ce9c2b4544a2..fdd994ee55e22 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -818,12 +818,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher,
+ return skcipher_setkey(skcipher, key, keylen, ctx1_iv_off);
+ }
+
+-static int arc4_skcipher_setkey(struct crypto_skcipher *skcipher,
+- const u8 *key, unsigned int keylen)
+-{
+- return skcipher_setkey(skcipher, key, keylen, 0);
+-}
+-
+ static int des_skcipher_setkey(struct crypto_skcipher *skcipher,
+ const u8 *key, unsigned int keylen)
+ {
+@@ -2058,21 +2052,6 @@ static struct caam_skcipher_alg driver_algs[] = {
+ },
+ .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB,
+ },
+- {
+- .skcipher = {
+- .base = {
+- .cra_name = "ecb(arc4)",
+- .cra_driver_name = "ecb-arc4-caam",
+- .cra_blocksize = ARC4_BLOCK_SIZE,
+- },
+- .setkey = arc4_skcipher_setkey,
+- .encrypt = skcipher_encrypt,
+- .decrypt = skcipher_decrypt,
+- .min_keysize = ARC4_MIN_KEY_SIZE,
+- .max_keysize = ARC4_MAX_KEY_SIZE,
+- },
+- .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB,
+- },
+ };
+
+ static struct caam_aead_alg driver_aeads[] = {
+@@ -3533,7 +3512,6 @@ int caam_algapi_init(struct device *ctrldev)
+ struct caam_drv_private *priv = dev_get_drvdata(ctrldev);
+ int i = 0, err = 0;
+ u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst;
+- u32 arc4_inst;
+ unsigned int md_limit = SHA512_DIGEST_SIZE;
+ bool registered = false, gcm_support;
+
+@@ -3553,8 +3531,6 @@ int caam_algapi_init(struct device *ctrldev)
+ CHA_ID_LS_DES_SHIFT;
+ aes_inst = cha_inst & CHA_ID_LS_AES_MASK;
+ md_inst = (cha_inst & CHA_ID_LS_MD_MASK) >> CHA_ID_LS_MD_SHIFT;
+- arc4_inst = (cha_inst & CHA_ID_LS_ARC4_MASK) >>
+- CHA_ID_LS_ARC4_SHIFT;
+ ccha_inst = 0;
+ ptha_inst = 0;
+
+@@ -3575,7 +3551,6 @@ int caam_algapi_init(struct device *ctrldev)
+ md_inst = mdha & CHA_VER_NUM_MASK;
+ ccha_inst = rd_reg32(&priv->ctrl->vreg.ccha) & CHA_VER_NUM_MASK;
+ ptha_inst = rd_reg32(&priv->ctrl->vreg.ptha) & CHA_VER_NUM_MASK;
+- arc4_inst = rd_reg32(&priv->ctrl->vreg.afha) & CHA_VER_NUM_MASK;
+
+ gcm_support = aesa & CHA_VER_MISC_AES_GCM;
+ }
+@@ -3598,10 +3573,6 @@ int caam_algapi_init(struct device *ctrldev)
+ if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES))
+ continue;
+
+- /* Skip ARC4 algorithms if not supported by device */
+- if (!arc4_inst && alg_sel == OP_ALG_ALGSEL_ARC4)
+- continue;
+-
+ /*
+ * Check support for AES modes not available
+ * on LP devices.
+diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h
+index 60e2a54c19f11..c3c22a8de4c00 100644
+--- a/drivers/crypto/caam/compat.h
++++ b/drivers/crypto/caam/compat.h
+@@ -43,7 +43,6 @@
+ #include <crypto/akcipher.h>
+ #include <crypto/scatterwalk.h>
+ #include <crypto/skcipher.h>
+-#include <crypto/arc4.h>
+ #include <crypto/internal/skcipher.h>
+ #include <crypto/internal/hash.h>
+ #include <crypto/internal/rsa.h>
+--
+2.25.1
+
--- /dev/null
+From afba2c5a674ca26faed1916a3258ad741441a2ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:58:26 +0300
+Subject: devres: keep both device name and resource name in pretty name
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 35bd8c07db2ce8fd2834ef866240613a4ef982e7 ]
+
+Sometimes debugging a device is easiest using devmem on its register
+map, and that can be seen with /proc/iomem. But some device drivers have
+many memory regions. Take for example a networking switch. Its memory
+map used to look like this in /proc/iomem:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : sys
+ 1fc030000-1fc03ffff : rew
+ 1fc060000-1fc0603ff : s2
+ 1fc070000-1fc0701ff : devcpu_gcb
+ 1fc080000-1fc0800ff : qs
+ 1fc090000-1fc0900cb : ptp
+ 1fc100000-1fc10ffff : port0
+ 1fc110000-1fc11ffff : port1
+ 1fc120000-1fc12ffff : port2
+ 1fc130000-1fc13ffff : port3
+ 1fc140000-1fc14ffff : port4
+ 1fc150000-1fc15ffff : port5
+ 1fc200000-1fc21ffff : qsys
+ 1fc280000-1fc28ffff : ana
+
+But after the patch in Fixes: was applied, the information is now
+presented in a much more opaque way:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : 0000:00:00.5
+ 1fc030000-1fc03ffff : 0000:00:00.5
+ 1fc060000-1fc0603ff : 0000:00:00.5
+ 1fc070000-1fc0701ff : 0000:00:00.5
+ 1fc080000-1fc0800ff : 0000:00:00.5
+ 1fc090000-1fc0900cb : 0000:00:00.5
+ 1fc100000-1fc10ffff : 0000:00:00.5
+ 1fc110000-1fc11ffff : 0000:00:00.5
+ 1fc120000-1fc12ffff : 0000:00:00.5
+ 1fc130000-1fc13ffff : 0000:00:00.5
+ 1fc140000-1fc14ffff : 0000:00:00.5
+ 1fc150000-1fc15ffff : 0000:00:00.5
+ 1fc200000-1fc21ffff : 0000:00:00.5
+ 1fc280000-1fc28ffff : 0000:00:00.5
+
+That patch made a fair comment that /proc/iomem might be confusing when
+it shows resources without an associated device, but we can do better
+than just hide the resource name altogether. Namely, we can print the
+device name _and_ the resource name. Like this:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : 0000:00:00.5 sys
+ 1fc030000-1fc03ffff : 0000:00:00.5 rew
+ 1fc060000-1fc0603ff : 0000:00:00.5 s2
+ 1fc070000-1fc0701ff : 0000:00:00.5 devcpu_gcb
+ 1fc080000-1fc0800ff : 0000:00:00.5 qs
+ 1fc090000-1fc0900cb : 0000:00:00.5 ptp
+ 1fc100000-1fc10ffff : 0000:00:00.5 port0
+ 1fc110000-1fc11ffff : 0000:00:00.5 port1
+ 1fc120000-1fc12ffff : 0000:00:00.5 port2
+ 1fc130000-1fc13ffff : 0000:00:00.5 port3
+ 1fc140000-1fc14ffff : 0000:00:00.5 port4
+ 1fc150000-1fc15ffff : 0000:00:00.5 port5
+ 1fc200000-1fc21ffff : 0000:00:00.5 qsys
+ 1fc280000-1fc28ffff : 0000:00:00.5 ana
+
+Fixes: 8d84b18f5678 ("devres: always use dev_name() in devm_ioremap_resource()")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20200601095826.1757621-1-olteanv@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/devres.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/lib/devres.c b/lib/devres.c
+index 17624d35e82d4..77c80ca9e4856 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -155,6 +155,7 @@ void __iomem *devm_ioremap_resource(struct device *dev,
+ {
+ resource_size_t size;
+ void __iomem *dest_ptr;
++ char *pretty_name;
+
+ BUG_ON(!dev);
+
+@@ -165,7 +166,15 @@ void __iomem *devm_ioremap_resource(struct device *dev,
+
+ size = resource_size(res);
+
+- if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) {
++ if (res->name)
++ pretty_name = devm_kasprintf(dev, GFP_KERNEL, "%s %s",
++ dev_name(dev), res->name);
++ else
++ pretty_name = devm_kstrdup(dev, dev_name(dev), GFP_KERNEL);
++ if (!pretty_name)
++ return IOMEM_ERR_PTR(-ENOMEM);
++
++ if (!devm_request_mem_region(dev, res->start, size, pretty_name)) {
+ dev_err(dev, "can't request region for resource %pR\n", res);
+ return IOMEM_ERR_PTR(-EBUSY);
+ }
+--
+2.25.1
+
--- /dev/null
+From 1b5933f439c4c5cc803931dcdd858c7be66efb7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 16:42:14 +0800
+Subject: dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit e766668c6cd49d741cfb49eaeb38998ba34d27bc ]
+
+dm_stop_queue() only uses blk_mq_quiesce_queue() so it doesn't
+formally stop the blk-mq queue; therefore there is no point making the
+blk_mq_queue_stopped() check -- it will never be stopped.
+
+In addition, even though dm_stop_queue() actually tries to quiesce hw
+queues via blk_mq_quiesce_queue(), checking with blk_queue_quiesced()
+to avoid unnecessary queue quiesce isn't reliable because: the
+QUEUE_FLAG_QUIESCED flag is set before synchronize_rcu() and
+dm_stop_queue() may be called when synchronize_rcu() from another
+blk_mq_quiesce_queue() is in-progress.
+
+Fixes: 7b17c2f7292ba ("dm: Fix a race condition related to stopping and starting queues")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 3f8577e2c13be..2bd2444ad99c6 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q)
+
+ void dm_stop_queue(struct request_queue *q)
+ {
+- if (blk_mq_queue_stopped(q))
+- return;
+-
+ blk_mq_quiesce_queue(q);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 75bebdfa81ba1c6eeb4ec7f61dfcf0656af2edba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 13:39:59 +0300
+Subject: drm/vmwgfx: Fix two list_for_each loop exit tests
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ]
+
+These if statements are supposed to be true if we ended the
+list_for_each_entry() loops without hitting a break statement but they
+don't work.
+
+In the first loop, we increment "i" after the "if (i == unit)" condition
+so we don't necessarily know that "i" is not equal to unit at the end of
+the loop.
+
+In the second loop we exit when mode is not pointing to a valid
+drm_display_mode struct so it doesn't make sense to check "mode->type".
+
+Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index f47d5710cc951..33b1519887474 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2666,7 +2666,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ ++i;
+ }
+
+- if (i != unit) {
++ if (&con->head == &dev_priv->dev->mode_config.connector_list) {
+ DRM_ERROR("Could not find initial display unit.\n");
+ ret = -EINVAL;
+ goto out_unlock;
+@@ -2690,13 +2690,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ break;
+ }
+
+- if (mode->type & DRM_MODE_TYPE_PREFERRED)
+- *p_mode = mode;
+- else {
++ if (&mode->head == &con->modes) {
+ WARN_ONCE(true, "Could not find initial preferred mode.\n");
+ *p_mode = list_first_entry(&con->modes,
+ struct drm_display_mode,
+ head);
++ } else {
++ *p_mode = mode;
+ }
+
+ out_unlock:
+--
+2.25.1
+
--- /dev/null
+From b05ac3d89744be00ac94812926fb0ca04d554773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 13:34:37 +0300
+Subject: drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1d2c0c565bc0da25f5e899a862fb58e612b222df ]
+
+The "entry" pointer is an offset from the list head and it doesn't
+point to a valid vmw_legacy_display_unit struct. Presumably the
+intent was to point to the last entry.
+
+Also the "i++" wasn't used so I have removed that as well.
+
+Fixes: d7e1958dbe4a ("drm/vmwgfx: Support older hardware.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+index 5702219ec38f6..7b54c1f56208f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ struct vmw_legacy_display_unit *entry;
+ struct drm_framebuffer *fb = NULL;
+ struct drm_crtc *crtc = NULL;
+- int i = 0;
++ int i;
+
+ /* If there is no display topology the host just assumes
+ * that the guest will set the same layout as the host.
+@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ crtc = &entry->base.crtc;
+ w = max(w, crtc->x + crtc->mode.hdisplay);
+ h = max(h, crtc->y + crtc->mode.vdisplay);
+- i++;
+ }
+
+ if (crtc == NULL)
+ return 0;
+- fb = entry->base.crtc.primary->state->fb;
++ fb = crtc->primary->state->fb;
+
+ return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0],
+ fb->format->cpp[0] * 8,
+--
+2.25.1
+
--- /dev/null
+From 50e421f2b760a75a7825d2c19244c4746e659ae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:36 -0700
+Subject: fs/minix: fix block limit check for V1 filesystems
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0a12c4a8069607247cb8edc3b035a664e636fd9a ]
+
+The minix filesystem reads its maximum file size from its on-disk
+superblock. This value isn't necessarily a multiple of the block size.
+When it's not, the V1 block mapping code doesn't allow mapping the last
+possible block. Commit 6ed6a722f9ab ("minixfs: fix block limit check")
+fixed this in the V2 mapping code. Fix it in the V1 mapping code too.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-6-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/itree_v1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index c0d418209ead1..405573a79aab4 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) {
++ } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+--
+2.25.1
+
--- /dev/null
+From d95eed580af0471298f0a2824b95512f92dfba3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:39 -0700
+Subject: fs/minix: remove expected error message in block_to_path()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f666f9fb9a36f1c833b9d18923572f0e4d304754 ]
+
+When truncating a file to a size within the last allowed logical block,
+block_to_path() is called with the *next* block. This exceeds the limit,
+causing the "block %ld too big" error message to be printed.
+
+This case isn't actually an error; there are just no more blocks past that
+point. So, remove this error message.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-7-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/itree_v1.c | 12 ++++++------
+ fs/minix/itree_v2.c | 12 ++++++------
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 405573a79aab4..1fed906042aa8 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, inode->i_sb->s_bdev);
+- } else if (block < 7) {
++ return 0;
++ }
++ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes)
++ return 0;
++
++ if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 512) {
+ offsets[n++] = 7;
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index ee8af2f9e2828..9d00f31a2d9d1 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -32,12 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, sb->s_bdev);
+- } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, sb->s_bdev);
+- } else if (block < DIRCOUNT) {
++ return 0;
++ }
++ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes)
++ return 0;
++
++ if (block < DIRCOUNT) {
+ offsets[n++] = block;
+ } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) {
+ offsets[n++] = DIRCOUNT;
+--
+2.25.1
+
--- /dev/null
+From 52869404092e6905fd655c7914065e2f37bf0137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:33 -0700
+Subject: fs/minix: set s_maxbytes correctly
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 32ac86efff91a3e4ef8c3d1cadd4559e23c8e73a ]
+
+The minix filesystem leaves super_block::s_maxbytes at MAX_NON_LFS rather
+than setting it to the actual filesystem-specific limit. This is broken
+because it means userspace doesn't see the standard behavior like getting
+EFBIG and SIGXFSZ when exceeding the maximum file size.
+
+Fix this by setting s_maxbytes correctly.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-5-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 12 +++++++-----
+ fs/minix/itree_v1.c | 2 +-
+ fs/minix/itree_v2.c | 3 +--
+ fs/minix/minix.h | 1 -
+ 4 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 0dd929346f3f3..7b09a9158e401 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ return 0;
+ }
+
+-static bool minix_check_superblock(struct minix_sb_info *sbi)
++static bool minix_check_superblock(struct super_block *sb)
+ {
++ struct minix_sb_info *sbi = minix_sb(sb);
++
+ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ return false;
+
+@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi)
+ * of indirect blocks which places the limit well above U32_MAX.
+ */
+ if (sbi->s_version == MINIX_V1 &&
+- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
++ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE)
+ return false;
+
+ return true;
+@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = ms->s_zmap_blocks;
+ sbi->s_firstdatazone = ms->s_firstdatazone;
+ sbi->s_log_zone_size = ms->s_log_zone_size;
+- sbi->s_max_size = ms->s_max_size;
++ s->s_maxbytes = ms->s_max_size;
+ s->s_magic = ms->s_magic;
+ if (s->s_magic == MINIX_SUPER_MAGIC) {
+ sbi->s_version = MINIX_V1;
+@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = m3s->s_zmap_blocks;
+ sbi->s_firstdatazone = m3s->s_firstdatazone;
+ sbi->s_log_zone_size = m3s->s_log_zone_size;
+- sbi->s_max_size = m3s->s_max_size;
++ s->s_maxbytes = m3s->s_max_size;
+ sbi->s_ninodes = m3s->s_ninodes;
+ sbi->s_nzones = m3s->s_zones;
+ sbi->s_dirsize = 64;
+@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ } else
+ goto out_no_fs;
+
+- if (!minix_check_superblock(sbi))
++ if (!minix_check_superblock(s))
+ goto out_illegal_sb;
+
+ /*
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 046cc96ee7adb..c0d418209ead1 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
++ } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index f7fc7eccccccd..ee8af2f9e2828 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -32,8 +32,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, sb->s_bdev);
+- } else if ((u64)block * (u64)sb->s_blocksize >=
+- minix_sb(sb)->s_max_size) {
++ } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+diff --git a/fs/minix/minix.h b/fs/minix/minix.h
+index df081e8afcc3c..168d45d3de73e 100644
+--- a/fs/minix/minix.h
++++ b/fs/minix/minix.h
+@@ -32,7 +32,6 @@ struct minix_sb_info {
+ unsigned long s_zmap_blocks;
+ unsigned long s_firstdatazone;
+ unsigned long s_log_zone_size;
+- unsigned long s_max_size;
+ int s_dirsize;
+ int s_namelen;
+ struct buffer_head ** s_imap;
+--
+2.25.1
+
--- /dev/null
+From ea6919ebf8aba3fb536abe3c4132fb8e2a3328c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:53 -0700
+Subject: fs/ufs: avoid potential u32 multiplication overflow
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ]
+
+The 64 bit ino is being compared to the product of two u32 values,
+however, the multiplication is being performed using a 32 bit multiply so
+there is a potential of an overflow. To be fully safe, cast uspi->s_ncg
+to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of
+overflow.
+
+Fixes: f3e2a520f5fb ("ufs: NFS support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Evgeniy Dushistov <dushistov@mail.ru>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com
+Addresses-Coverity: ("Unintentional integer overflow")
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ufs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ufs/super.c b/fs/ufs/super.c
+index 1da0be667409b..e3b69fb280e8c 100644
+--- a/fs/ufs/super.c
++++ b/fs/ufs/super.c
+@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene
+ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+ struct inode *inode;
+
+- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
+ return ERR_PTR(-ESTALE);
+
+ inode = ufs_iget(sb, ino);
+--
+2.25.1
+
--- /dev/null
+From bb9ce6d92568a2992b49130d471725291ae1de97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:40:37 -0700
+Subject: gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+[ Upstream commit 0f6245f42ce9b7e4d20f2cda8d5f12b55a44d7d1 ]
+
+Combine the rotate_irq() and norotate_irq() handlers into a single
+eof_irq() handler.
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-image-convert.c | 58 +++++++++-----------------
+ 1 file changed, 20 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index eeca50d9a1ee4..f8b031ded3cf2 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -1709,9 +1709,10 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run)
+ return IRQ_WAKE_THREAD;
+ }
+
+-static irqreturn_t norotate_irq(int irq, void *data)
++static irqreturn_t eof_irq(int irq, void *data)
+ {
+ struct ipu_image_convert_chan *chan = data;
++ struct ipu_image_convert_priv *priv = chan->priv;
+ struct ipu_image_convert_ctx *ctx;
+ struct ipu_image_convert_run *run;
+ unsigned long flags;
+@@ -1728,45 +1729,26 @@ static irqreturn_t norotate_irq(int irq, void *data)
+
+ ctx = run->ctx;
+
+- if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this is a rotation operation, just ignore */
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+- ret = do_irq(run);
+-out:
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return ret;
+-}
+-
+-static irqreturn_t rotate_irq(int irq, void *data)
+-{
+- struct ipu_image_convert_chan *chan = data;
+- struct ipu_image_convert_priv *priv = chan->priv;
+- struct ipu_image_convert_ctx *ctx;
+- struct ipu_image_convert_run *run;
+- unsigned long flags;
+- irqreturn_t ret;
+-
+- spin_lock_irqsave(&chan->irqlock, flags);
+-
+- /* get current run and its context */
+- run = chan->current_run;
+- if (!run) {
++ if (irq == chan->out_eof_irq) {
++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this is a rotation op, just ignore */
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else if (irq == chan->rot_out_eof_irq) {
++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this was NOT a rotation op, shouldn't happen */
++ dev_err(priv->ipu->dev,
++ "Unexpected rotation interrupt\n");
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else {
++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
+ ret = IRQ_NONE;
+ goto out;
+ }
+
+- ctx = run->ctx;
+-
+- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this was NOT a rotation operation, shouldn't happen */
+- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n");
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+ ret = do_irq(run);
+ out:
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+@@ -1859,7 +1841,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh,
++ ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+@@ -1872,7 +1854,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->rotation_out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh,
++ ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+--
+2.25.1
+
--- /dev/null
+From e3e7955343c1c49c359fed594369e337ce35ce3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 11:13:37 -0700
+Subject: gpu: ipu-v3: image-convert: Wait for all EOFs before completing a
+ tile
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+[ Upstream commit dd81d821d0b3f77d949d0cac5c05c1f05b921d46 ]
+
+Use a bit-mask of EOF irqs to determine when all required idmac
+channel EOFs have been received for a tile conversion, and only do
+tile completion processing after all EOFs have been received. Otherwise
+it was found that a conversion would stall after the completion of a
+tile and the start of the next tile, because the input/read idmac
+channel had not completed and entered idle state, thus locking up the
+channel when attempting to re-start it for the next tile.
+
+Fixes: 0537db801bb01 ("gpu: ipu-v3: image-convert: reconfigure IC per tile")
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-image-convert.c | 109 +++++++++++++++++++------
+ 1 file changed, 82 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index f8b031ded3cf2..aa1d4b6d278f7 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx;
+ struct ipu_image_convert_chan;
+ struct ipu_image_convert_priv;
+
++enum eof_irq_mask {
++ EOF_IRQ_IN = BIT(0),
++ EOF_IRQ_ROT_IN = BIT(1),
++ EOF_IRQ_OUT = BIT(2),
++ EOF_IRQ_ROT_OUT = BIT(3),
++};
++
++#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT)
++#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \
++ EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT)
++
+ struct ipu_image_convert_ctx {
+ struct ipu_image_convert_chan *chan;
+
+@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx {
+ /* where to place converted tile in dest image */
+ unsigned int out_tile_map[MAX_TILES];
+
++ /* mask of completed EOF irqs at every tile conversion */
++ enum eof_irq_mask eof_mask;
++
+ struct list_head list;
+ };
+
+@@ -189,6 +203,8 @@ struct ipu_image_convert_chan {
+ struct ipuv3_channel *rotation_out_chan;
+
+ /* the IPU end-of-frame irqs */
++ int in_eof_irq;
++ int rot_in_eof_irq;
+ int out_eof_irq;
+ int rot_out_eof_irq;
+
+@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile)
+ dev_dbg(priv->ipu->dev, "%s: task %u: starting ctx %p run %p tile %u -> %u\n",
+ __func__, chan->ic_task, ctx, run, tile, dst_tile);
+
++ /* clear EOF irq mask */
++ ctx->eof_mask = 0;
++
+ if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+ /* swap width/height for resizer */
+ dest_width = d_image->tile[dst_tile].height;
+@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx)
+ }
+
+ /* hold irqlock when calling */
+-static irqreturn_t do_irq(struct ipu_image_convert_run *run)
++static irqreturn_t do_tile_complete(struct ipu_image_convert_run *run)
+ {
+ struct ipu_image_convert_ctx *ctx = run->ctx;
+ struct ipu_image_convert_chan *chan = ctx->chan;
+@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run)
+ ctx->cur_buf_num ^= 1;
+ }
+
++ ctx->eof_mask = 0; /* clear EOF irq mask for next tile */
+ ctx->next_tile++;
+ return IRQ_HANDLED;
+ done:
+@@ -1715,8 +1735,9 @@ static irqreturn_t eof_irq(int irq, void *data)
+ struct ipu_image_convert_priv *priv = chan->priv;
+ struct ipu_image_convert_ctx *ctx;
+ struct ipu_image_convert_run *run;
++ irqreturn_t ret = IRQ_HANDLED;
++ bool tile_complete = false;
+ unsigned long flags;
+- irqreturn_t ret;
+
+ spin_lock_irqsave(&chan->irqlock, flags);
+
+@@ -1729,27 +1750,33 @@ static irqreturn_t eof_irq(int irq, void *data)
+
+ ctx = run->ctx;
+
+- if (irq == chan->out_eof_irq) {
+- if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this is a rotation op, just ignore */
+- ret = IRQ_HANDLED;
+- goto out;
+- }
+- } else if (irq == chan->rot_out_eof_irq) {
++ if (irq == chan->in_eof_irq) {
++ ctx->eof_mask |= EOF_IRQ_IN;
++ } else if (irq == chan->out_eof_irq) {
++ ctx->eof_mask |= EOF_IRQ_OUT;
++ } else if (irq == chan->rot_in_eof_irq ||
++ irq == chan->rot_out_eof_irq) {
+ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+ /* this was NOT a rotation op, shouldn't happen */
+ dev_err(priv->ipu->dev,
+ "Unexpected rotation interrupt\n");
+- ret = IRQ_HANDLED;
+ goto out;
+ }
++ ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ?
++ EOF_IRQ_ROT_IN : EOF_IRQ_ROT_OUT;
+ } else {
+ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
+ ret = IRQ_NONE;
+ goto out;
+ }
+
+- ret = do_irq(run);
++ if (ipu_rot_mode_is_irt(ctx->rot_mode))
++ tile_complete = (ctx->eof_mask == EOF_IRQ_ROT_COMPLETE);
++ else
++ tile_complete = (ctx->eof_mask == EOF_IRQ_COMPLETE);
++
++ if (tile_complete)
++ ret = do_tile_complete(run);
+ out:
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+ return ret;
+@@ -1783,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx)
+
+ static void release_ipu_resources(struct ipu_image_convert_chan *chan)
+ {
++ if (chan->in_eof_irq >= 0)
++ free_irq(chan->in_eof_irq, chan);
++ if (chan->rot_in_eof_irq >= 0)
++ free_irq(chan->rot_in_eof_irq, chan);
+ if (chan->out_eof_irq >= 0)
+ free_irq(chan->out_eof_irq, chan);
+ if (chan->rot_out_eof_irq >= 0)
+@@ -1801,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan)
+
+ chan->in_chan = chan->out_chan = chan->rotation_in_chan =
+ chan->rotation_out_chan = NULL;
+- chan->out_eof_irq = chan->rot_out_eof_irq = -1;
++ chan->in_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
++ chan->out_eof_irq = -1;
++ chan->rot_out_eof_irq = -1;
++}
++
++static int get_eof_irq(struct ipu_image_convert_chan *chan,
++ struct ipuv3_channel *channel)
++{
++ struct ipu_image_convert_priv *priv = chan->priv;
++ int ret, irq;
++
++ irq = ipu_idmac_channel_irq(priv->ipu, channel, IPU_IRQ_EOF);
++
++ ret = request_threaded_irq(irq, eof_irq, do_bh, 0, "ipu-ic", chan);
++ if (ret < 0) {
++ dev_err(priv->ipu->dev, "could not acquire irq %d\n", irq);
++ return ret;
++ }
++
++ return irq;
+ }
+
+ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+@@ -1837,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ }
+
+ /* acquire the EOF interrupts */
+- chan->out_eof_irq = ipu_idmac_channel_irq(priv->ipu,
+- chan->out_chan,
+- IPU_IRQ_EOF);
++ ret = get_eof_irq(chan, chan->in_chan);
++ if (ret < 0) {
++ chan->in_eof_irq = -1;
++ goto err;
++ }
++ chan->in_eof_irq = ret;
+
+- ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
+- 0, "ipu-ic", chan);
++ ret = get_eof_irq(chan, chan->rotation_in_chan);
+ if (ret < 0) {
+- dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+- chan->out_eof_irq);
+- chan->out_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
+ goto err;
+ }
++ chan->rot_in_eof_irq = ret;
+
+- chan->rot_out_eof_irq = ipu_idmac_channel_irq(priv->ipu,
+- chan->rotation_out_chan,
+- IPU_IRQ_EOF);
++ ret = get_eof_irq(chan, chan->out_chan);
++ if (ret < 0) {
++ chan->out_eof_irq = -1;
++ goto err;
++ }
++ chan->out_eof_irq = ret;
+
+- ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
+- 0, "ipu-ic", chan);
++ ret = get_eof_irq(chan, chan->rotation_out_chan);
+ if (ret < 0) {
+- dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+- chan->rot_out_eof_irq);
+ chan->rot_out_eof_irq = -1;
+ goto err;
+ }
++ chan->rot_out_eof_irq = ret;
+
+ return 0;
+ err:
+@@ -2440,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev)
+ chan->ic_task = i;
+ chan->priv = priv;
+ chan->dma_ch = &image_convert_dma_chan[i];
++ chan->in_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
+ chan->out_eof_irq = -1;
+ chan->rot_out_eof_irq = -1;
+
+--
+2.25.1
+
--- /dev/null
+From ae76bf90f705ce3f239d90e3655b62ba5fa017be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 17:42:40 -0700
+Subject: i2c: iproc: fix race between client unreg and isr
+
+From: Dhananjay Phadke <dphadke@linux.microsoft.com>
+
+[ Upstream commit b1eef236f50ba6afea680da039ef3a2ca9c43d11 ]
+
+When i2c client unregisters, synchronize irq before setting
+iproc_i2c->slave to NULL.
+
+(1) disable_irq()
+(2) Mask event enable bits in control reg
+(3) Erase slave address (avoid further writes to rx fifo)
+(4) Flush tx and rx FIFOs
+(5) Clear pending event (interrupt) bits in status reg
+(6) enable_irq()
+(7) Set client pointer to NULL
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000318
+
+[ 371.020421] pc : bcm_iproc_i2c_isr+0x530/0x11f0
+[ 371.025098] lr : __handle_irq_event_percpu+0x6c/0x170
+[ 371.030309] sp : ffff800010003e40
+[ 371.033727] x29: ffff800010003e40 x28: 0000000000000060
+[ 371.039206] x27: ffff800010ca9de0 x26: ffff800010f895df
+[ 371.044686] x25: ffff800010f18888 x24: ffff0008f7ff3600
+[ 371.050165] x23: 0000000000000003 x22: 0000000001600000
+[ 371.055645] x21: ffff800010f18888 x20: 0000000001600000
+[ 371.061124] x19: ffff0008f726f080 x18: 0000000000000000
+[ 371.066603] x17: 0000000000000000 x16: 0000000000000000
+[ 371.072082] x15: 0000000000000000 x14: 0000000000000000
+[ 371.077561] x13: 0000000000000000 x12: 0000000000000001
+[ 371.083040] x11: 0000000000000000 x10: 0000000000000040
+[ 371.088519] x9 : ffff800010f317c8 x8 : ffff800010f317c0
+[ 371.093999] x7 : ffff0008f805b3b0 x6 : 0000000000000000
+[ 371.099478] x5 : ffff0008f7ff36a4 x4 : ffff8008ee43d000
+[ 371.104957] x3 : 0000000000000000 x2 : ffff8000107d64c0
+[ 371.110436] x1 : 00000000c00000af x0 : 0000000000000000
+
+[ 371.115916] Call trace:
+[ 371.118439] bcm_iproc_i2c_isr+0x530/0x11f0
+[ 371.122754] __handle_irq_event_percpu+0x6c/0x170
+[ 371.127606] handle_irq_event_percpu+0x34/0x88
+[ 371.132189] handle_irq_event+0x40/0x120
+[ 371.136234] handle_fasteoi_irq+0xcc/0x1a0
+[ 371.140459] generic_handle_irq+0x24/0x38
+[ 371.144594] __handle_domain_irq+0x60/0xb8
+[ 371.148820] gic_handle_irq+0xc0/0x158
+[ 371.152687] el1_irq+0xb8/0x140
+[ 371.155927] arch_cpu_idle+0x10/0x18
+[ 371.159615] do_idle+0x204/0x290
+[ 371.162943] cpu_startup_entry+0x24/0x60
+[ 371.166990] rest_init+0xb0/0xbc
+[ 371.170322] arch_call_rest_init+0xc/0x14
+[ 371.174458] start_kernel+0x404/0x430
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+
+Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 03475f1799730..dd9661c11782a 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -1037,7 +1037,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ if (!iproc_i2c->slave)
+ return -EINVAL;
+
+- iproc_i2c->slave = NULL;
++ disable_irq(iproc_i2c->irq);
+
+ /* disable all slave interrupts */
+ tmp = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+@@ -1050,6 +1050,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT);
+ iproc_i2c_wr_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET, tmp);
+
++ /* flush TX/RX FIFOs */
++ tmp = (BIT(S_FIFO_RX_FLUSH_SHIFT) | BIT(S_FIFO_TX_FLUSH_SHIFT));
++ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, tmp);
++
++ /* clear all pending slave interrupts */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, ISR_MASK_SLAVE);
++
++ iproc_i2c->slave = NULL;
++
++ enable_irq(iproc_i2c->irq);
++
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 3816fef6df1a58c0a2127bc7199b826ec64e225b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 18:16:06 +0200
+Subject: i2c: rcar: avoid race when unregistering slave
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit c7c9e914f9a0478fba4dc6f227cfd69cf84a4063 ]
+
+Due to the lockless design of the driver, it is theoretically possible
+to access a NULL pointer, if a slave interrupt was running while we were
+unregistering the slave. To make this rock solid, disable the interrupt
+for a short time while we are clearing the interrupt_enable register.
+This patch is purely based on code inspection. The OOPS is super-hard to
+trigger because clearing SAR (the address) makes interrupts even more
+unlikely to happen as well. While here, reinit SCR to SDBS because this
+bit should always be set according to documentation. There is no effect,
+though, because the interface is disabled.
+
+Fixes: 7b814d852af6 ("i2c: rcar: avoid race when unregistering slave client")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 3ea6013a3d68a..0b90aa0318df3 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -863,12 +863,14 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
+- /* disable irqs and ensure none is running before clearing ptr */
++ /* ensure no irq is running before clearing ptr */
++ disable_irq(priv->irq);
+ rcar_i2c_write(priv, ICSIER, 0);
+- rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSSR, 0);
++ enable_irq(priv->irq);
++ rcar_i2c_write(priv, ICSCR, SDBS);
+ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+- synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+--
+2.25.1
+
--- /dev/null
+From 389076f34d8afd3ebdc82d36770be462fb199783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 17:38:07 +0200
+Subject: i2c: rcar: slave: only send STOP event when we have been addressed
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ]
+
+When the SSR interrupt is activated, it will detect every STOP condition
+on the bus, not only the ones after we have been addressed. So, enable
+this interrupt only after we have been addressed, and disable it
+otherwise.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 36af8fdb66586..3ea6013a3d68a 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -580,13 +580,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+
+- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff);
++ /* Clear SSR, too, because of old STOPs to other clients than us */
++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff);
+ }
+
+ /* master sent stop */
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+@@ -850,7 +851,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
+ priv->slave = slave;
+ rcar_i2c_write(priv, ICSAR, slave->addr);
+ rcar_i2c_write(priv, ICSSR, 0);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From bf1a9020583551f8be9c8260cf75055a33f405b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 12:39:11 +0300
+Subject: IB/uverbs: Set IOVA on IB MR in uverbs layer
+
+From: Yishai Hadas <yishaih@mellanox.com>
+
+[ Upstream commit 04c0a5fcfcf65aade2fb238b6336445f1a99b646 ]
+
+Set IOVA on IB MR in uverbs layer to let all drivers have it, this
+includes both reg/rereg MR flows.
+As part of this change cleaned-up this setting from the drivers that
+already did it by themselves in their user flows.
+
+Fixes: e6f0330106f4 ("mlx4_ib: set user mr attributes in struct ib_mr")
+Link: https://lore.kernel.org/r/20200630093916.332097-3-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_cmd.c | 4 ++++
+ drivers/infiniband/hw/cxgb4/mem.c | 1 -
+ drivers/infiniband/hw/mlx4/mr.c | 1 -
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index e2ddcb0dc4ee3..c398d1a64614c 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -757,6 +757,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs)
+ mr->uobject = uobj;
+ atomic_inc(&pd->usecnt);
+ mr->res.type = RDMA_RESTRACK_MR;
++ mr->iova = cmd.hca_va;
+ rdma_restrack_uadd(&mr->res);
+
+ uobj->object = mr;
+@@ -847,6 +848,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
+ atomic_dec(&old_pd->usecnt);
+ }
+
++ if (cmd.flags & IB_MR_REREG_TRANS)
++ mr->iova = cmd.hca_va;
++
+ memset(&resp, 0, sizeof(resp));
+ resp.lkey = mr->lkey;
+ resp.rkey = mr->rkey;
+diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
+index 35c284af574da..dcb58cef336d9 100644
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag)
+ mmid = stag >> 8;
+ mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+ mhp->ibmr.length = mhp->attr.len;
+- mhp->ibmr.iova = mhp->attr.va_fbo;
+ mhp->ibmr.page_size = 1U << (mhp->attr.page_size + 12);
+ pr_debug("mmid 0x%x mhp %p\n", mmid, mhp);
+ return xa_insert_irq(&mhp->rhp->mrs, mmid, mhp, GFP_KERNEL);
+diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
+index 6ae503cfc5264..9114cb7307692 100644
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+
+ mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
+ mr->ibmr.length = length;
+- mr->ibmr.iova = virt_addr;
+ mr->ibmr.page_size = 1U << shift;
+
+ return &mr->ibmr;
+--
+2.25.1
+
--- /dev/null
+From 11c7fbb176ee4f984cf609ad7e96afec865430f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 15:35:34 -0700
+Subject: Input: sentelic - fix error return when fsp_reg_write fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit ea38f06e0291986eb93beb6d61fd413607a30ca4 ]
+
+Currently when the call to fsp_reg_write fails -EIO is not being returned
+because the count is being returned instead of the return value in retval.
+Fix this by returning the value in retval instead of count.
+
+Addresses-Coverity: ("Unused value")
+Fixes: fc69f4a6af49 ("Input: add new driver for Sentelic Finger Sensing Pad")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200603141218.131663-1-colin.king@canonical.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/sentelic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
+index e99d9bf1a267d..e78c4c7eda34d 100644
+--- a/drivers/input/mouse/sentelic.c
++++ b/drivers/input/mouse/sentelic.c
+@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data,
+
+ fsp_reg_write_enable(psmouse, false);
+
+- return count;
++ return retval;
+ }
+
+ PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg);
+--
+2.25.1
+
--- /dev/null
+From f0db7d7cbd94101ff8bf73dd1880a1d502831a21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 20:22:11 +0100
+Subject: iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dee9d154f40c58d02f69acdaa5cfd1eae6ebc28b ]
+
+It is possible for the call to omap_iommu_dump_ctx to return
+a negative error number, so check for the failure and return
+the error number rather than pass the negative value to
+simple_read_from_buffer.
+
+Fixes: 14e0e6796a0d ("OMAP: iommu: add initial debugfs support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200714192211.744776-1-colin.king@canonical.com
+Addresses-Coverity: ("Improper use of negative value")
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/omap-iommu-debug.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
+index 8e19bfa94121e..a99afb5d9011c 100644
+--- a/drivers/iommu/omap-iommu-debug.c
++++ b/drivers/iommu/omap-iommu-debug.c
+@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
+ mutex_lock(&iommu_debug_lock);
+
+ bytes = omap_iommu_dump_ctx(obj, p, count);
++ if (bytes < 0)
++ goto err;
+ bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes);
+
++err:
+ mutex_unlock(&iommu_debug_lock);
+ kfree(buf);
+
+--
+2.25.1
+
--- /dev/null
+From 4b2caa9f72ca85fce902df2565f66010b61eb028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:49:14 +0800
+Subject: iommu/vt-d: Enforce PASID devTLB field mask
+
+From: Liu Yi L <yi.l.liu@intel.com>
+
+[ Upstream commit 5f77d6ca5ca74e4b4a5e2e010f7ff50c45dea326 ]
+
+Set proper masks to avoid invalid input spillover to reserved bits.
+
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Link: https://lore.kernel.org/r/20200724014925.15523-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/intel-iommu.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 1e5dad8b8e59b..ed870da78326b 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -359,8 +359,8 @@ enum {
+
+ #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK)
+ #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11)
+-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g)
+-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1)
++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32)
+ #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+ #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
+--
+2.25.1
+
--- /dev/null
+From cc6eba97e16afcebd087da67baf341c4f5176b21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:41:39 -0600
+Subject: libnvdimm/security: ensure sysfs poll thread woke up and fetch
+ updated attr
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit 7f674025d9f7321dea11b802cc0ab3f09cbe51c5 ]
+
+commit 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support")
+adds a sysfs_notify_dirent() to wake up userspace poll thread when the "overwrite"
+operation has completed. But the notification is issued before the internal
+dimm security state and flags have been updated, so the userspace poll thread
+wakes up and fetches the not-yet-updated attr and falls back to sleep, forever.
+But if user from another terminal issue "ndctl wait-overwrite nmemX" again,
+the command returns instantly.
+
+Link: https://lore.kernel.org/r/1596494499-9852-3-git-send-email-jane.chu@oracle.com
+Fixes: 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support")
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/security.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
+index acfd211c01b9c..35d265014e1ec 100644
+--- a/drivers/nvdimm/security.c
++++ b/drivers/nvdimm/security.c
+@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
+ else
+ dev_dbg(&nvdimm->dev, "overwrite completed\n");
+
+- if (nvdimm->sec.overwrite_state)
+- sysfs_notify_dirent(nvdimm->sec.overwrite_state);
++ /*
++ * Mark the overwrite work done and update dimm security flags,
++ * then send a sysfs event notification to wake up userspace
++ * poll threads to picked up the changed state.
++ */
+ nvdimm->sec.overwrite_tmo = 0;
+ clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
+ clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
+- put_device(&nvdimm->dev);
+ nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
++ if (nvdimm->sec.overwrite_state)
++ sysfs_notify_dirent(nvdimm->sec.overwrite_state);
++ put_device(&nvdimm->dev);
+ }
+
+ void nvdimm_security_overwrite_query(struct work_struct *work)
+--
+2.25.1
+
--- /dev/null
+From 9ab043b0ee7d686e542e953a55016e25f6273476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:41:37 -0600
+Subject: libnvdimm/security: fix a typo
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit dad42d17558f316e9e807698cd4207359b636084 ]
+
+commit d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute")
+introduced a typo, causing a 'nvdimm->sec.flags' update being overwritten
+by the subsequent update meant for 'nvdimm->sec.ext_flags'.
+
+Link: https://lore.kernel.org/r/1596494499-9852-1-git-send-email-jane.chu@oracle.com
+Fixes: d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute")
+Cc: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/security.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
+index 89b85970912db..acfd211c01b9c 100644
+--- a/drivers/nvdimm/security.c
++++ b/drivers/nvdimm/security.c
+@@ -457,7 +457,7 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
+ clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
+ put_device(&nvdimm->dev);
+ nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+- nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
++ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
+ }
+
+ void nvdimm_security_overwrite_query(struct work_struct *work)
+--
+2.25.1
+
--- /dev/null
+From a84177aa6ea141f731879ec937ff113dd67f34a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 13:16:45 +0300
+Subject: md-cluster: Fix potential error pointer dereference in
+ resize_bitmaps()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e8abe1de43dac658dacbd04a4543e0c988a8d386 ]
+
+The error handling calls md_bitmap_free(bitmap) which checks for NULL
+but will Oops if we pass an error pointer. Let's set "bitmap" to NULL
+on this error path.
+
+Fixes: afd756286083 ("md-cluster/raid10: resize all the bitmaps before start reshape")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 73fd50e779754..d50737ec40394 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz
+ bitmap = get_bitmap_from_slot(mddev, i);
+ if (IS_ERR(bitmap)) {
+ pr_err("can't get bitmap from slot %d\n", i);
++ bitmap = NULL;
+ goto out;
+ }
+ counts = &bitmap->counts;
+--
+2.25.1
+
--- /dev/null
+From 8266091a903961242c26e4f09b27375e6e874a97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 18:42:44 +0200
+Subject: media: rockchip: rga: Introduce color fmt macros and refactor CSC
+ mode logic
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit ded874ece29d3fe2abd3775810a06056067eb68c ]
+
+This introduces two macros: RGA_COLOR_FMT_IS_YUV and RGA_COLOR_FMT_IS_RGB
+which allow quick checking of the colorspace familily of a RGA color format.
+
+These macros are then used to refactor the logic for CSC mode selection.
+The two nested tests for input colorspace are simplified into a single one,
+with a logical and, making the whole more readable.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga-hw.c | 23 +++++++++-----------
+ drivers/media/platform/rockchip/rga/rga-hw.h | 5 +++++
+ 2 files changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
+index 4be6dcf292fff..5607ee8d19176 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.c
++++ b/drivers/media/platform/rockchip/rga/rga-hw.c
+@@ -200,22 +200,19 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ dst_info.data.format = ctx->out.fmt->hw_format;
+ dst_info.data.swap = ctx->out.fmt->color_swap;
+
+- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
+- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) {
+- switch (ctx->in.colorspace) {
+- case V4L2_COLORSPACE_REC709:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT709_R0;
+- break;
+- default:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT601_R0;
+- break;
+- }
++ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
++ switch (ctx->in.colorspace) {
++ case V4L2_COLORSPACE_REC709:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
++ break;
++ default:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0;
++ break;
+ }
+ }
+
+- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
++ if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
+ switch (ctx->out.colorspace) {
+ case V4L2_COLORSPACE_REC709:
+ dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h
+index 96cb0314dfa70..e8917e5630a48 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.h
++++ b/drivers/media/platform/rockchip/rga/rga-hw.h
+@@ -95,6 +95,11 @@
+ #define RGA_COLOR_FMT_CP_8BPP 15
+ #define RGA_COLOR_FMT_MASK 15
+
++#define RGA_COLOR_FMT_IS_YUV(fmt) \
++ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP))
++#define RGA_COLOR_FMT_IS_RGB(fmt) \
++ ((fmt) < RGA_COLOR_FMT_YUV422SP)
++
+ #define RGA_COLOR_NONE_SWAP 0
+ #define RGA_COLOR_RB_SWAP 1
+ #define RGA_COLOR_ALPHA_SWAP 2
+--
+2.25.1
+
--- /dev/null
+From 782b3c4aa7c525fc234105c0d1807123a790cbb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 18:42:45 +0200
+Subject: media: rockchip: rga: Only set output CSC mode for RGB input
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 0f879bab72f47e8ba2421a984e7acfa763d3e84e ]
+
+Setting the output CSC mode is required for a YUV output, but must not
+be set when the input is also YUV. Doing this (as tested with a YUV420P
+to YUV420P conversion) results in wrong colors.
+
+Adapt the logic to only set the output CSC mode when the output is YUV and
+the input is RGB. Also add a comment to clarify the rationale.
+
+Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga-hw.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
+index 5607ee8d19176..aaa96f256356b 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.c
++++ b/drivers/media/platform/rockchip/rga/rga-hw.c
+@@ -200,6 +200,11 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ dst_info.data.format = ctx->out.fmt->hw_format;
+ dst_info.data.swap = ctx->out.fmt->color_swap;
+
++ /*
++ * CSC mode must only be set when the colorspace families differ between
++ * input and output. It must remain unset (zeroed) if both are the same.
++ */
++
+ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
+ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
+ switch (ctx->in.colorspace) {
+@@ -212,7 +217,8 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ }
+ }
+
+- if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
++ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
+ switch (ctx->out.colorspace) {
+ case V4L2_COLORSPACE_REC709:
+ dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+--
+2.25.1
+
--- /dev/null
+From ac46ee8e03aa575afeda55aa9e0a19b50340ea38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 14:53:21 +0100
+Subject: mfd: arizona: Ensure 32k clock is put on driver unbind and error
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ddff6c45b21d0437ce0c85f8ac35d7b5480513d7 ]
+
+Whilst it doesn't matter if the internal 32k clock register settings
+are cleaned up on exit, as the part will be turned off losing any
+settings, hence the driver hasn't historially bothered. The external
+clock should however be cleaned up, as it could cause clocks to be
+left on, and will at best generate a warning on unbind.
+
+Add clean up on both the probe error path and unbind for the 32k
+clock.
+
+Fixes: cdd8da8cc66b ("mfd: arizona: Add gating of external MCLKn clocks")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/arizona-core.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index 4a31907a4525f..3ff872c205eeb 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -1430,6 +1430,15 @@ int arizona_dev_init(struct arizona *arizona)
+ arizona_irq_exit(arizona);
+ err_pm:
+ pm_runtime_disable(arizona->dev);
++
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
+ err_reset:
+ arizona_enable_reset(arizona);
+ regulator_disable(arizona->dcvdd);
+@@ -1452,6 +1461,15 @@ int arizona_dev_exit(struct arizona *arizona)
+ regulator_disable(arizona->dcvdd);
+ regulator_put(arizona->dcvdd);
+
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
++
+ mfd_remove_devices(arizona->dev);
+ arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona);
+ arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona);
+--
+2.25.1
+
--- /dev/null
+From 935d7c79c137bc4c617142e5480849ddbff283d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 16:02:46 +0300
+Subject: mfd: dln2: Run event handler loop under spinlock
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ]
+
+The event handler loop must be run with interrupts disabled.
+Otherwise we will have a warning:
+
+[ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts
+[ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170
+[ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170
+...
+[ 1970.946994] Call Trace:
+[ 1970.949446] <IRQ>
+[ 1970.951471] handle_irq_event_percpu+0x2c/0x80
+[ 1970.955921] handle_irq_event+0x23/0x43
+[ 1970.959766] handle_simple_irq+0x57/0x70
+[ 1970.963695] generic_handle_irq+0x42/0x50
+[ 1970.967717] dln2_rx+0xc1/0x210 [dln2]
+[ 1970.971479] ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0
+[ 1970.976362] __usb_hcd_giveback_urb+0x77/0xe0
+[ 1970.980727] usb_giveback_urb_bh+0x8e/0xe0
+[ 1970.984837] tasklet_action_common.isra.0+0x4a/0xe0
+...
+
+Recently xHCI driver switched to tasklets in the commit 36dc01657b49
+("usb: host: xhci: Support running urb giveback in tasklet context").
+
+The handle_irq_event_* functions are expected to be called with interrupts
+disabled and they rightfully complain here because we run in tasklet context
+with interrupts enabled.
+
+Use a event spinlock to protect event handler from being interrupted.
+
+Note, that there are only two users of this GPIO and ADC drivers and both of
+them are using generic_handle_irq() which makes above happen.
+
+Fixes: 338a12814297 ("mfd: Add support for Diolan DLN-2 devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/dln2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index 4faa8d2e5d045..707f4287ab4a0 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb)
+ len = urb->actual_length - sizeof(struct dln2_header);
+
+ if (handle == DLN2_HANDLE_EVENT) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&dln2->event_cb_lock, flags);
+ dln2_run_event_callbacks(dln2, id, echo, data, len);
++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags);
+ } else {
+ /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */
+ if (dln2_transfer_complete(dln2, urb, handle, echo))
+--
+2.25.1
+
--- /dev/null
+From 4a4703e8729a91cb74f0507d86d19608080131a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 May 2020 16:01:05 +0900
+Subject: mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 2b26e34e9af3fa24fa1266e9ea2d66a1f7d62dc0 ]
+
+To add end() operation in the future, clean the code of
+renesas_sdhi_internal_dmac_complete_tasklet_fn(). No behavior change.
+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1590044466-28372-3-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index a66f8d6d61d1b..cb89f0578d425 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg)
+ DTRAN_CTRL_DM_START);
+ }
+
+-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host)
+ {
+- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
+ enum dma_data_direction dir;
+
+- spin_lock_irq(&host->lock);
+-
+ if (!host->data)
+- goto out;
++ return false;
+
+ if (host->data->flags & MMC_DATA_READ)
+ dir = DMA_FROM_DEVICE;
+@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
+ if (dir == DMA_FROM_DEVICE)
+ clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
+
++ return true;
++}
++
++static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++{
++ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
++
++ spin_lock_irq(&host->lock);
++ if (!renesas_sdhi_internal_dmac_complete(host))
++ goto out;
++
+ tmio_mmc_do_data_irq(host);
+ out:
+ spin_unlock_irq(&host->lock);
+--
+2.25.1
+
--- /dev/null
+From ea0ad38142469fb96c3a26d3d57a47b2b7302df5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 15:49:13 +0200
+Subject: mtd: rawnand: fsl_upm: Remove unused mtd var
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+[ Upstream commit ccc49eff77bee2885447a032948959a134029fe3 ]
+
+The mtd var in fun_wait_rnb() is now unused, let's get rid of it and
+fix the warning resulting from this unused var.
+
+Fixes: 50a487e7719c ("mtd: rawnand: Pass a nand_chip object to chip->dev_ready()")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200603134922.1352340-2-boris.brezillon@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_upm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c
+index 1054cc070747e..20b0ee174dc61 100644
+--- a/drivers/mtd/nand/raw/fsl_upm.c
++++ b/drivers/mtd/nand/raw/fsl_upm.c
+@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip)
+ static void fun_wait_rnb(struct fsl_upm_nand *fun)
+ {
+ if (fun->rnb_gpio[fun->mchip_number] >= 0) {
+- struct mtd_info *mtd = nand_to_mtd(&fun->chip);
+ int cnt = 1000000;
+
+ while (--cnt && !fun_chip_ready(&fun->chip))
+--
+2.25.1
+
--- /dev/null
+From b142e3804a1ad7ab6ebc92634314a48de48579b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 10:57:05 +0800
+Subject: net: qcom/emac: add missed clk_disable_unprepare in error path of
+ emac_clks_phase1_init
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 50caa777a3a24d7027748e96265728ce748b41ef ]
+
+Fix the missing clk_disable_unprepare() before return
+from emac_clks_phase1_init() in the error handling case.
+
+Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
+index c84ab052ef265..3eee8df359a12 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac.c
+@@ -485,13 +485,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev,
+
+ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]);
+ if (ret)
+- return ret;
++ goto disable_clk_axi;
+
+ ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000);
+ if (ret)
+- return ret;
++ goto disable_clk_cfg_ahb;
++
++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ if (ret)
++ goto disable_clk_cfg_ahb;
+
+- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ return 0;
++
++disable_clk_cfg_ahb:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]);
++disable_clk_axi:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]);
++
++ return ret;
+ }
+
+ /* Enable clocks; needs emac_clks_phase1_init to be called before */
+--
+2.25.1
+
--- /dev/null
+From 8676dce9f059378784f3da4ebef6368dbcb4970c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2020 07:10:38 -0400
+Subject: nfs: ensure correct writeback errors are returned on close()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 67dd23f9e6fbaf163431912ef5599c5e0693476c ]
+
+nfs_wb_all() calls filemap_write_and_wait(), which uses
+filemap_check_errors() to determine the error to return.
+filemap_check_errors() only looks at the mapping->flags and will
+therefore only return either -ENOSPC or -EIO. To ensure that the
+correct error is returned on close(), nfs{,4}_file_flush() should call
+filemap_check_wb_err() which looks at the errseq value in
+mapping->wb_err without consuming it.
+
+Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with
+generic one")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/file.c | 5 ++++-
+ fs/nfs/nfs4file.c | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 95dc90570786c..348f67c8f3224 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -140,6 +140,7 @@ static int
+ nfs_file_flush(struct file *file, fl_owner_t id)
+ {
+ struct inode *inode = file_inode(file);
++ errseq_t since;
+
+ dprintk("NFS: flush(%pD2)\n", file);
+
+@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)
+ return 0;
+
+ /* Flush writes to the server and return any errors */
+- return nfs_wb_all(inode);
++ since = filemap_sample_wb_err(file->f_mapping);
++ nfs_wb_all(inode);
++ return filemap_check_wb_err(file->f_mapping, since);
+ }
+
+ ssize_t
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index fb55c04cdc6bd..534b6fd70ffdb 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -109,6 +109,7 @@ static int
+ nfs4_file_flush(struct file *file, fl_owner_t id)
+ {
+ struct inode *inode = file_inode(file);
++ errseq_t since;
+
+ dprintk("NFS: flush(%pD2)\n", file);
+
+@@ -124,7 +125,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id)
+ return filemap_fdatawrite(file->f_mapping);
+
+ /* Flush writes to the server and return any errors */
+- return nfs_wb_all(inode);
++ since = filemap_sample_wb_err(file->f_mapping);
++ nfs_wb_all(inode);
++ return filemap_check_wb_err(file->f_mapping, since);
+ }
+
+ #ifdef CONFIG_NFS_V4_2
+--
+2.25.1
+
--- /dev/null
+From 62d8d570047fd8884e94e107322817f9b5bed1bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 12:23:19 -0500
+Subject: nfs: Fix getxattr kernel panic and memory overflow
+
+From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+
+[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]
+
+Move the buffer size check to decode_attr_security_label() before memcpy()
+Only call memcpy() if the buffer is large enough
+
+Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS")
+Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+[Trond: clean up duplicate test of label->len != 0]
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 --
+ fs/nfs/nfs4xdr.c | 6 +++++-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 1a1bd2fe6e98d..d0cb827b72cfa 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ return ret;
+ if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
+ return -ENOENT;
+- if (buflen < label.len)
+- return -ERANGE;
+ return 0;
+ }
+
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 7c0ff1a3b5914..677751bc3a334 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
+ return -EIO;
+ if (len < NFS4_MAXLABELLEN) {
+ if (label) {
+- memcpy(label->label, p, len);
++ if (label->len) {
++ if (label->len < len)
++ return -ERANGE;
++ memcpy(label->label, p, len);
++ }
+ label->len = len;
+ label->pi = pi;
+ label->lfs = lfs;
+--
+2.25.1
+
--- /dev/null
+From 2f28eb15462b43ebecb73b2437b1324bd2e8b90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2020 07:10:39 -0400
+Subject: nfs: nfs_file_write() should check for writeback errors
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit ce368536dd614452407dc31e2449eb84681a06af ]
+
+The NFS_CONTEXT_ERROR_WRITE flag (as well as the check of said flag) was
+removed by commit 6fbda89b257f. The absence of an error check allows
+writes to be continually queued up for a server that may no longer be
+able to handle them. Fix it by adding an error check using the generic
+error reporting functions.
+
+Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with generic one")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/file.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index 348f67c8f3224..387a2cfa7e172 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -583,12 +583,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = {
+ .page_mkwrite = nfs_vm_page_mkwrite,
+ };
+
+-static int nfs_need_check_write(struct file *filp, struct inode *inode)
++static int nfs_need_check_write(struct file *filp, struct inode *inode,
++ int error)
+ {
+ struct nfs_open_context *ctx;
+
+ ctx = nfs_file_open_context(filp);
+- if (nfs_ctx_key_to_expire(ctx, inode))
++ if (nfs_error_is_fatal_on_server(error) ||
++ nfs_ctx_key_to_expire(ctx, inode))
+ return 1;
+ return 0;
+ }
+@@ -599,6 +601,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(file);
+ unsigned long written = 0;
+ ssize_t result;
++ errseq_t since;
++ int error;
+
+ result = nfs_key_timeout_notify(file, inode);
+ if (result)
+@@ -623,6 +627,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos > i_size_read(inode))
+ nfs_revalidate_mapping(inode, file->f_mapping);
+
++ since = filemap_sample_wb_err(file->f_mapping);
+ nfs_start_io_write(inode);
+ result = generic_write_checks(iocb, from);
+ if (result > 0) {
+@@ -641,7 +646,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ goto out;
+
+ /* Return error values */
+- if (nfs_need_check_write(file, inode)) {
++ error = filemap_check_wb_err(file->f_mapping, since);
++ if (nfs_need_check_write(file, inode, error)) {
+ int err = nfs_wb_all(inode);
+ if (err < 0)
+ result = err;
+--
+2.25.1
+
--- /dev/null
+From 8ab55cdc4a46bf061e4f0cf00ed1a157b023ee28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 20:53:21 -0700
+Subject: octeontx2-af: change (struct qmem)->entry_sz from u8 to u16
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 393415203f5c916b5907e0a7c89f4c2c5a9c5505 ]
+
+We need to increase TSO_HEADER_SIZE from 128 to 256.
+
+Since otx2_sq_init() calls qmem_alloc() with TSO_HEADER_SIZE,
+we need to change (struct qmem)->entry_sz to avoid truncation to 0.
+
+Fixes: 7a37245ef23f ("octeontx2-af: NPA block admin queue init")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+index 413c3f254cf85..c881a573da662 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+@@ -43,7 +43,7 @@ struct qmem {
+ void *base;
+ dma_addr_t iova;
+ int alloc_sz;
+- u8 entry_sz;
++ u16 entry_sz;
+ u8 align;
+ u32 qsize;
+ };
+--
+2.25.1
+
--- /dev/null
+From 7fff7796cf4c308abfb495c0c45c629ee94b231f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 06:19:46 +0900
+Subject: openrisc: Fix oops caused when dumping stack
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 57b8e277c33620e115633cdf700a260b55095460 ]
+
+When dumping a stack with 'cat /proc/#/stack' the kernel would oops.
+For example:
+
+ # cat /proc/690/stack
+ Unable to handle kernel access
+ at virtual address 0x7fc60f58
+
+ Oops#: 0000
+ CPU #: 0
+ PC: c00097fc SR: 0000807f SP: d6f09b9c
+ GPR00: 00000000 GPR01: d6f09b9c GPR02: d6f09bb8 GPR03: d6f09bc4
+ GPR04: 7fc60f5c GPR05: c00099b4 GPR06: 00000000 GPR07: d6f09ba3
+ GPR08: ffffff00 GPR09: c0009804 GPR10: d6f08000 GPR11: 00000000
+ GPR12: ffffe000 GPR13: dbb86000 GPR14: 00000001 GPR15: dbb86250
+ GPR16: 7fc60f63 GPR17: 00000f5c GPR18: d6f09bc4 GPR19: 00000000
+ GPR20: c00099b4 GPR21: ffffffc0 GPR22: 00000000 GPR23: 00000000
+ GPR24: 00000001 GPR25: 000002c6 GPR26: d78b6850 GPR27: 00000001
+ GPR28: 00000000 GPR29: dbb86000 GPR30: ffffffff GPR31: dbb862fc
+ RES: 00000000 oGPR11: ffffffff
+ Process cat (pid: 702, stackpage=d79d6000)
+
+ Stack:
+ Call trace:
+ [<598977f2>] save_stack_trace_tsk+0x40/0x74
+ [<95063f0e>] stack_trace_save_tsk+0x44/0x58
+ [<b557bfdd>] proc_pid_stack+0xd0/0x13c
+ [<a2df8eda>] proc_single_show+0x6c/0xf0
+ [<e5a737b7>] seq_read+0x1b4/0x688
+ [<2d6c7480>] do_iter_read+0x208/0x248
+ [<2182a2fb>] vfs_readv+0x64/0x90
+
+This was caused by the stack trace code in save_stack_trace_tsk using
+the wrong stack pointer. It was using the user stack pointer instead of
+the kernel stack pointer. Fix this by using the right stack.
+
+Also for good measure we add try_get_task_stack/put_task_stack to ensure
+the task is not lost while we are walking it's stack.
+
+Fixes: eecac38b0423a ("openrisc: support framepointers and STACKTRACE_SUPPORT")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/stacktrace.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c
+index 43f140a28bc72..54d38809e22cb 100644
+--- a/arch/openrisc/kernel/stacktrace.c
++++ b/arch/openrisc/kernel/stacktrace.c
+@@ -13,6 +13,7 @@
+ #include <linux/export.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
++#include <linux/sched/task_stack.h>
+ #include <linux/stacktrace.h>
+
+ #include <asm/processor.h>
+@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ {
+ unsigned long *sp = NULL;
+
++ if (!try_get_task_stack(tsk))
++ return;
++
+ if (tsk == current)
+ sp = (unsigned long *) &sp;
+- else
+- sp = (unsigned long *) KSTK_ESP(tsk);
++ else {
++ unsigned long ksp;
++
++ /* Locate stack from kernel context */
++ ksp = task_thread_info(tsk)->ksp;
++ ksp += STACK_FRAME_OVERHEAD; /* redzone */
++ ksp += sizeof(struct pt_regs);
++
++ sp = (unsigned long *) ksp;
++ }
+
+ unwind_stack(trace, sp, save_stack_address_nosched);
++
++ put_task_stack(tsk);
+ }
+ EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
+
+--
+2.25.1
+
--- /dev/null
+From 69707e056115426c35f0a0ea28f8e2f9538d03ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 15:34:04 +0200
+Subject: perf bench mem: Always memset source before memcpy
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 1beaef29c34154ccdcb3f1ae557f6883eda18840 ]
+
+For memcpy, the source pages are memset to zero only when --cycles is
+used. This leads to wildly different results with or without --cycles,
+since all sources pages are likely to be mapped to the same zero page
+without explicit writes.
+
+Before this fix:
+
+$ export cmd="./perf stat -e LLC-loads -- ./perf bench \
+ mem memcpy -s 1024MB -l 100 -f default"
+$ $cmd
+
+ 2,935,826 LLC-loads
+ 3.821677452 seconds time elapsed
+
+$ $cmd --cycles
+
+ 217,533,436 LLC-loads
+ 8.616725985 seconds time elapsed
+
+After this fix:
+
+$ $cmd
+
+ 214,459,686 LLC-loads
+ 8.674301124 seconds time elapsed
+
+$ $cmd --cycles
+
+ 214,758,651 LLC-loads
+ 8.644480006 seconds time elapsed
+
+Fixes: 47b5757bac03c338 ("perf bench mem: Move boilerplate memory allocation to the infrastructure")
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: kernel@axis.com
+Link: http://lore.kernel.org/lkml/20200810133404.30829-1-vincent.whitchurch@axis.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/mem-functions.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c
+index 9235b76501be8..19d45c377ac18 100644
+--- a/tools/perf/bench/mem-functions.c
++++ b/tools/perf/bench/mem-functions.c
+@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info *
+ return 0;
+ }
+
+-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst)
+ {
+- u64 cycle_start = 0ULL, cycle_end = 0ULL;
+- memcpy_t fn = r->fn.memcpy;
+- int i;
+-
+ /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */
+ memset(src, 0, size);
+
+@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo
+ * to not measure page fault overhead:
+ */
+ fn(dst, src, size);
++}
++
++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++{
++ u64 cycle_start = 0ULL, cycle_end = 0ULL;
++ memcpy_t fn = r->fn.memcpy;
++ int i;
++
++ memcpy_prefault(fn, size, src, dst);
+
+ cycle_start = get_cycles();
+ for (i = 0; i < nr_loops; ++i)
+@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void
+ memcpy_t fn = r->fn.memcpy;
+ int i;
+
+- /*
+- * We prefault the freshly allocated memory range here,
+- * to not measure page fault overhead:
+- */
+- fn(dst, src, size);
++ memcpy_prefault(fn, size, src, dst);
+
+ BUG_ON(gettimeofday(&tv_start, NULL));
+ for (i = 0; i < nr_loops; ++i)
+--
+2.25.1
+
--- /dev/null
+From 99f6924c586b6e5a5adf60a57032cb04c6474e1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 23:31:47 +0800
+Subject: perf/x86/rapl: Fix missing psys sysfs attributes
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 4bb5fcb97a5df0bbc0a27e0252b1e7ce140a8431 ]
+
+This fixes a problem introduced by commit:
+
+ 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface")
+
+that perf event sysfs attributes for psys RAPL domain are missing.
+
+Fixes: 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface")
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Reviewed-by: Len Brown <len.brown@intel.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20200811153149.12242-2-rui.zhang@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/rapl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index 3c222d6fdee3b..187c72a58e69c 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -642,7 +642,7 @@ static const struct attribute_group *rapl_attr_update[] = {
+ &rapl_events_pkg_group,
+ &rapl_events_ram_group,
+ &rapl_events_gpu_group,
+- &rapl_events_gpu_group,
++ &rapl_events_psys_group,
+ NULL,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From fcf29ad069d0fcbc04d6b6e4ed3cb0e5165599c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 22:16:08 -0500
+Subject: platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit aaa3cbbac326c95308e315f1ab964a3369c4d07d ]
+
+In function cros_ec_ishtp_probe(), "up_write" is already called
+before function "cros_ec_dev_init". But "up_write" will be called
+again after the calling of the function "cros_ec_dev_init" failed.
+Thus add a call of the function “down_write” in this if branch
+for the completion of the exception handling.
+
+Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Tested-by: Mathew King <mathewk@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_ishtp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
+index 25ca2c894b4de..ab0662a33b41a 100644
+--- a/drivers/platform/chrome/cros_ec_ishtp.c
++++ b/drivers/platform/chrome/cros_ec_ishtp.c
+@@ -645,8 +645,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device)
+
+ /* Register croc_ec_dev mfd */
+ rv = cros_ec_dev_init(client_data);
+- if (rv)
++ if (rv) {
++ down_write(&init_lock);
+ goto end_cros_ec_dev_init_error;
++ }
+
+ return 0;
+
+--
+2.25.1
+
--- /dev/null
+From f82ea525251f1b21cedc733a0a8a7ac60b33fea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 21:46:06 -0700
+Subject: pwm: bcm-iproc: handle clk_get_rate() return
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 6ced5ff0be8e94871ba846dfbddf69d21363f3d7 ]
+
+Handle clk_get_rate() returning 0 to avoid possible division by zero.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Signed-off-by: Scott Branden <scott.branden@broadcom.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index 1f829edd8ee70..d392a828fc493 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 tmp, multi, rate;
+ u32 value, prescale;
+
+- rate = clk_get_rate(ip->clk);
+-
+ value = readl(ip->base + IPROC_PWM_CTRL_OFFSET);
+
+ if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm)))
+@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ else
+ state->polarity = PWM_POLARITY_INVERSED;
+
++ rate = clk_get_rate(ip->clk);
++ if (rate == 0) {
++ state->period = 0;
++ state->duty_cycle = 0;
++ return;
++ }
++
+ value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET);
+ prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm);
+ prescale &= IPROC_PWM_PRESCALE_MAX;
+--
+2.25.1
+
--- /dev/null
+From cfaa9c063f70947c187da88c328399a579daa451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 11:29:33 +0300
+Subject: RDMA/counter: Allow manually bind QPs with different pids to same
+ counter
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit cbeb7d896c0f296451ffa7b67e7706786b8364c8 ]
+
+In manual mode allow bind user QPs with different pids to same counter,
+since this is allowed in auto mode.
+Bind kernel QPs and user QPs to the same counter are not allowed.
+
+Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support")
+Link: https://lore.kernel.org/r/20200702082933.424537-4-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/counters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
+index 42809f612c2c4..f454d63008d69 100644
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -487,7 +487,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port,
+ goto err;
+ }
+
+- if (counter->res.task != qp->res.task) {
++ if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res)) {
+ ret = -EINVAL;
+ goto err_task;
+ }
+--
+2.25.1
+
--- /dev/null
+From d8f97d346638608cef4451f495e7d9a877b99a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 11:29:32 +0300
+Subject: RDMA/counter: Only bind user QPs in auto mode
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit c9f557421e505f75da4234a6af8eff46bc08614b ]
+
+In auto mode only bind user QPs to a dynamic counter, since this feature
+is mainly used for system statistic and diagnostic purpose, while there's
+no need to counter kernel QPs so far.
+
+Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support")
+Link: https://lore.kernel.org/r/20200702082933.424537-3-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/counters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
+index 11210bf7fd61b..42809f612c2c4 100644
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -284,7 +284,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port)
+ struct rdma_counter *counter;
+ int ret;
+
+- if (!qp->res.valid)
++ if (!qp->res.valid || rdma_is_kernel_res(&qp->res))
+ return 0;
+
+ if (!rdma_is_port_valid(dev, port))
+--
+2.25.1
+
--- /dev/null
+From e29e5e4276f57d26e6febba6350104801b10a668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 20:42:19 +0300
+Subject: RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 65936bf25f90fe440bb2d11624c7d10fab266639 ]
+
+ipoib_mcast_carrier_on_task() insanely open codes a rtnl_lock() such that
+the only time flush_workqueue() can be called is if it also clears
+IPOIB_FLAG_OPER_UP.
+
+Thus the flush inside ipoib_flush_ah() will deadlock if it gets unlucky
+enough, and lockdep doesn't help us to find it early:
+
+ CPU0 CPU1 CPU2
+ __ipoib_ib_dev_flush()
+ down_read(vlan_rwsem)
+
+ ipoib_vlan_add()
+ rtnl_trylock()
+ down_write(vlan_rwsem)
+
+ ipoib_mcast_carrier_on_task()
+ while (!rtnl_trylock())
+ msleep(20);
+
+ ipoib_flush_ah()
+ flush_workqueue(priv->wq)
+
+Clean up the ah_reaper related functions and lifecycle to make sense:
+
+ - Start/Stop of the reaper should only be done in open/stop NDOs, not in
+ any other places
+
+ - cancel and flush of the reaper should only happen in the stop NDO.
+ cancel is only functional when combined with IPOIB_STOP_REAPER.
+
+ - Non-stop places were flushing the AH's just need to flush out dead AH's
+ synchronously and ignore the background task completely. It is fully
+ locked and harmless to leave running.
+
+Which ultimately fixes the ABBA deadlock by removing the unnecessary
+flush_workqueue() from the problematic place under the vlan_rwsem.
+
+Fixes: efc82eeeae4e ("IB/ipoib: No longer use flush as a parameter")
+Link: https://lore.kernel.org/r/20200625174219.290842-1-kamalheib1@gmail.com
+Reported-by: Kamal Heib <kheib@redhat.com>
+Tested-by: Kamal Heib <kheib@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 65 ++++++++++-------------
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +
+ 2 files changed, 31 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 6ee64c25aaff4..494f413dc3c6c 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ return rc;
+ }
+
+-static void __ipoib_reap_ah(struct net_device *dev)
++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+ struct ipoib_ah *ah, *tah;
+ unsigned long flags;
+
+- netif_tx_lock_bh(dev);
++ netif_tx_lock_bh(priv->dev);
+ spin_lock_irqsave(&priv->lock, flags);
+
+ list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
+@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+- netif_tx_unlock_bh(dev);
++ netif_tx_unlock_bh(priv->dev);
+ }
+
+ void ipoib_reap_ah(struct work_struct *work)
+ {
+ struct ipoib_dev_priv *priv =
+ container_of(work, struct ipoib_dev_priv, ah_reap_task.work);
+- struct net_device *dev = priv->dev;
+
+- __ipoib_reap_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ if (!test_bit(IPOIB_STOP_REAPER, &priv->flags))
+ queue_delayed_work(priv->wq, &priv->ah_reap_task,
+ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_flush_ah(struct net_device *dev)
++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- cancel_delayed_work(&priv->ah_reap_task);
+- flush_workqueue(priv->wq);
+- ipoib_reap_ah(&priv->ah_reap_task.work);
++ clear_bit(IPOIB_STOP_REAPER, &priv->flags);
++ queue_delayed_work(priv->wq, &priv->ah_reap_task,
++ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_stop_ah(struct net_device *dev)
++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+ set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- ipoib_flush_ah(dev);
++ cancel_delayed_work(&priv->ah_reap_task);
++ /*
++ * After ipoib_stop_ah_reaper() we always go through
++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and
++ * does a final flush out of the dead_ah's list
++ */
+ }
+
+ static int recvs_pending(struct net_device *dev)
+@@ -846,16 +845,6 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ return 0;
+ }
+
+-void ipoib_ib_dev_stop(struct net_device *dev)
+-{
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- priv->rn_ops->ndo_stop(dev);
+-
+- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_flush_ah(dev);
+-}
+-
+ int ipoib_ib_dev_open_default(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -899,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return -1;
+ }
+
+- clear_bit(IPOIB_STOP_REAPER, &priv->flags);
+- queue_delayed_work(priv->wq, &priv->ah_reap_task,
+- round_jiffies_relative(HZ));
+-
++ ipoib_start_ah_reaper(priv);
+ if (priv->rn_ops->ndo_open(dev)) {
+ pr_warn("%s: Failed to open dev\n", dev->name);
+ goto dev_stop;
+@@ -913,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return 0;
+
+ dev_stop:
+- set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- cancel_delayed_work(&priv->ah_reap_task);
+- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_ib_dev_stop(dev);
++ ipoib_stop_ah_reaper(priv);
+ return -1;
+ }
+
++void ipoib_ib_dev_stop(struct net_device *dev)
++{
++ struct ipoib_dev_priv *priv = ipoib_priv(dev);
++
++ priv->rn_ops->ndo_stop(dev);
++
++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
++ ipoib_stop_ah_reaper(priv);
++}
++
+ void ipoib_pkey_dev_check_presence(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -1230,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
+ ipoib_mcast_dev_flush(dev);
+ if (oper_up)
+ set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+- ipoib_flush_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+ }
+
+ if (level >= IPOIB_FLUSH_NORMAL)
+@@ -1305,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
+ * the neighbor garbage collection is stopped and reaped.
+ * That should all be done now, so make a final ah flush.
+ */
+- ipoib_stop_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 4fd095fd63b6f..044bcacad6e48 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
+
+ /* no more works over the priv->wq */
+ if (priv->wq) {
++ /* See ipoib_mcast_carrier_on_task() */
++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags));
+ flush_workqueue(priv->wq);
+ destroy_workqueue(priv->wq);
+ priv->wq = NULL;
+--
+2.25.1
+
--- /dev/null
+From 3542cc9e0eceec5a3372f708e9c93a8a65c7f593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 13:52:36 +0300
+Subject: RDMA/ipoib: Return void from ipoib_ib_dev_stop()
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 95a5631f6c9f3045f26245e6045244652204dfdb ]
+
+The return value from ipoib_ib_dev_stop() is always 0 - change it to be
+void.
+
+Link: https://lore.kernel.org/r/20200623105236.18683-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib.h | 2 +-
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +---
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 0e5f27caf2b2d..50a3557386090 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev);
+
+ int ipoib_ib_dev_open_default(struct net_device *dev);
+ int ipoib_ib_dev_open(struct net_device *dev);
+-int ipoib_ib_dev_stop(struct net_device *dev);
++void ipoib_ib_dev_stop(struct net_device *dev);
+ void ipoib_ib_dev_up(struct net_device *dev);
+ void ipoib_ib_dev_down(struct net_device *dev);
+ int ipoib_ib_dev_stop_default(struct net_device *dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index da3c5315bbb51..6ee64c25aaff4 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -846,7 +846,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ return 0;
+ }
+
+-int ipoib_ib_dev_stop(struct net_device *dev)
++void ipoib_ib_dev_stop(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+
+@@ -854,8 +854,6 @@ int ipoib_ib_dev_stop(struct net_device *dev)
+
+ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+ ipoib_flush_ah(dev);
+-
+- return 0;
+ }
+
+ int ipoib_ib_dev_open_default(struct net_device *dev)
+--
+2.25.1
+
--- /dev/null
+From fe176a53c711231b88ed3c29fa551bc3b321de64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 08:48:22 +0000
+Subject: recordmcount: Fix build failure on non arm64
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 3df14264ad9930733a8166e5bd0eccc1727564bb ]
+
+Commit ea0eada45632 leads to the following build failure on powerpc:
+
+ HOSTCC scripts/recordmcount
+scripts/recordmcount.c: In function 'arm64_is_fake_mcount':
+scripts/recordmcount.c:440: error: 'R_AARCH64_CALL26' undeclared (first use in this function)
+scripts/recordmcount.c:440: error: (Each undeclared identifier is reported only once
+scripts/recordmcount.c:440: error: for each function it appears in.)
+make[2]: *** [scripts/recordmcount] Error 1
+
+Make sure R_AARCH64_CALL26 is always defined.
+
+Fixes: ea0eada45632 ("recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Gregory Herrero <gregory.herrero@oracle.com>
+Cc: Gregory Herrero <gregory.herrero@oracle.com>
+Link: https://lore.kernel.org/r/5ca1be21fa6ebf73203b45fd9aadd2bafb5e6b15.1597049145.git.christophe.leroy@csgroup.eu
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/recordmcount.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index e59022b3f1254..b9c2ee7ab43fa 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -42,6 +42,8 @@
+ #define R_ARM_THM_CALL 10
+ #define R_ARM_CALL 28
+
++#define R_AARCH64_CALL26 283
++
+ static int fd_map; /* File descriptor for file being modified. */
+ static int mmap_failed; /* Boolean flag. */
+ static char gpfx; /* prefix for global symbol name (sometimes '_') */
+--
+2.25.1
+
--- /dev/null
+From d286f494e9b9d5a4cea179ef1a57b411b1675312 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 19:10:11 -0400
+Subject: scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying
+ targetport
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+[ Upstream commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e ]
+
+We cannot wait on a completion object in the lpfc_nvme_targetport structure
+in the _destroy_targetport() code path because the NVMe/fc transport will
+free that structure immediately after the .targetport_delete() callback.
+This results in a use-after-free, and a crash if slub_debug=FZPU is
+enabled.
+
+An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8
+("scsi: lpfc: Correct localport timeout duration error") subsequently
+changed the code to reference the completion through a pointer in the
+object rather than the local stack variable. Fix this by using the stack
+variable directly.
+
+Link: https://lore.kernel.org/r/20200729231011.13240-1-emilne@redhat.com
+Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error")
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvmet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 9884228800a50..f14394ab0e037 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -1923,7 +1923,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ }
+ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
++ if (!wait_for_completion_timeout(&tport_unreg_cmp,
+ msecs_to_jiffies(LPFC_NVMET_WAIT_TMO)))
+ lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+ "6179 Unreg targetport x%px timeout "
+--
+2.25.1
+
--- /dev/null
+From 9b2ebe90a09121b2ec09311d33ecf69b00cd85b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 23:44:07 +0200
+Subject: selftests/bpf: Test_progs indicate to shell on non-actions
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 6c92bd5cd4650c39dd929565ee172984c680fead ]
+
+When a user selects a non-existing test the summary is printed with
+indication 0 for all info types, and shell "success" (EXIT_SUCCESS) is
+indicated. This can be understood by a human end-user, but for shell
+scripting is it useful to indicate a shell failure (EXIT_FAILURE).
+
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/159363984736.930467.17956007131403952343.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 8cb3469dd11f2..a7d06724c18c2 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -584,5 +584,8 @@ int main(int argc, char **argv)
+ free(env.test_selector.num_set);
+ free(env.subtest_selector.num_set);
+
++ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0)
++ return EXIT_FAILURE;
++
+ return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
+ }
+--
+2.25.1
+
--- /dev/null
+From 4f75316ba7fce51228ccdb28b316100c48ad373c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 09:12:19 +0200
+Subject: selftests/bpf: test_progs use another shell exit on non-actions
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 3220fb667842a9725cbb71656f406eadb03c094b ]
+
+This is a follow up adjustment to commit 6c92bd5cd465 ("selftests/bpf:
+Test_progs indicate to shell on non-actions"), that returns shell exit
+indication EXIT_FAILURE (value 1) when user selects a non-existing test.
+
+The problem with using EXIT_FAILURE is that a shell script cannot tell
+the difference between a non-existing test and the test failing.
+
+This patch uses value 2 as shell exit indication.
+(Aside note unrecognized option parameters use value 64).
+
+Fixes: 6c92bd5cd465 ("selftests/bpf: Test_progs indicate to shell on non-actions")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/159410593992.1093222.90072558386094370.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index a7d06724c18c2..48bbe8e0ce48d 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -7,6 +7,8 @@
+ #include <argp.h>
+ #include <string.h>
+
++#define EXIT_NO_TEST 2
++
+ /* defined in test_progs.h */
+ struct test_env env;
+
+@@ -585,7 +587,7 @@ int main(int argc, char **argv)
+ free(env.subtest_selector.num_set);
+
+ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0)
+- return EXIT_FAILURE;
++ return EXIT_NO_TEST;
+
+ return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
+ }
+--
+2.25.1
+
--- /dev/null
+From 3940d204f0f2517a725632aa3c2d9bf21115e4d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:45 +0530
+Subject: selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 3563b9bea0ca7f53e4218b5e268550341a49f333 ]
+
+With commit 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation
+must not change pkey registers") we are not updating UAMOR on key
+allocation. So don't update the expected uamor value in the test.
+
+Fixes: 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation must not change pkey registers")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-23-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index bc33d748d95b4..3694613f418f6 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -101,15 +101,20 @@ static int child(struct shared_info *info)
+ */
+ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
+
++ /*
++ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr
++ */
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+ else
+ info->expected_iamr &= ~(1ul << pkeyshift(pkey1));
+
+- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3));
++ /*
++ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits.
++ */
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey2));
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey3));
+
+- info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+- 3ul << pkeyshift(pkey2);
+ /*
+ * Create an IAMR value different from expected value.
+ * Kernel will reject an IAMR and UAMOR change.
+--
+2.25.1
+
--- /dev/null
+From 1e3705d3b126a8a6b6527c4d953806ef4b8f6ba5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:43 +0530
+Subject: selftests/powerpc: ptrace-pkey: Rename variables to make it easier to
+ follow code
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 9a11f12e0a6c374b3ef1ce81e32ce477d28eb1b8 ]
+
+Rename variable to indicate that they are invalid values which we will
+use to test ptrace update of pkeys.
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-21-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/powerpc/ptrace/ptrace-pkey.c | 26 +++++++++----------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index bdbbbe8431e03..f9216c7a1829e 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -44,7 +44,7 @@ struct shared_info {
+ unsigned long amr2;
+
+ /* AMR value that ptrace should refuse to write to the child. */
+- unsigned long amr3;
++ unsigned long invalid_amr;
+
+ /* IAMR value the parent expects to read from the child. */
+ unsigned long expected_iamr;
+@@ -57,8 +57,8 @@ struct shared_info {
+ * (even though they're valid ones) because userspace doesn't have
+ * access to those registers.
+ */
+- unsigned long new_iamr;
+- unsigned long new_uamor;
++ unsigned long invalid_iamr;
++ unsigned long invalid_uamor;
+ };
+
+ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+@@ -100,7 +100,7 @@ static int child(struct shared_info *info)
+
+ info->amr1 |= 3ul << pkeyshift(pkey1);
+ info->amr2 |= 3ul << pkeyshift(pkey2);
+- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3);
++ info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3);
+
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+@@ -111,8 +111,8 @@ static int child(struct shared_info *info)
+
+ info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+ 3ul << pkeyshift(pkey2);
+- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
+- info->new_uamor |= 3ul << pkeyshift(pkey1);
++ info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
++ info->invalid_uamor |= 3ul << pkeyshift(pkey1);
+
+ /*
+ * We won't use pkey3. We just want a plausible but invalid key to test
+@@ -196,9 +196,9 @@ static int parent(struct shared_info *info, pid_t pid)
+ PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- info->amr1 = info->amr2 = info->amr3 = regs[0];
+- info->expected_iamr = info->new_iamr = regs[1];
+- info->expected_uamor = info->new_uamor = regs[2];
++ info->amr1 = info->amr2 = info->invalid_amr = regs[0];
++ info->expected_iamr = info->invalid_iamr = regs[1];
++ info->expected_uamor = info->invalid_uamor = regs[2];
+
+ /* Wake up child so that it can set itself up. */
+ ret = prod_child(&info->child_sync);
+@@ -234,10 +234,10 @@ static int parent(struct shared_info *info, pid_t pid)
+ return ret;
+
+ /* Write invalid AMR value in child. */
+- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1);
++ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3);
++ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr);
+
+ /* Wake up child so that it can verify it didn't change. */
+ ret = prod_child(&info->child_sync);
+@@ -249,7 +249,7 @@ static int parent(struct shared_info *info, pid_t pid)
+
+ /* Try to write to IAMR. */
+ regs[0] = info->amr1;
+- regs[1] = info->new_iamr;
++ regs[1] = info->invalid_iamr;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
+@@ -257,7 +257,7 @@ static int parent(struct shared_info *info, pid_t pid)
+ ptrace_write_running, regs[0], regs[1]);
+
+ /* Try to write to IAMR and UAMOR. */
+- regs[2] = info->new_uamor;
++ regs[2] = info->invalid_uamor;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
+--
+2.25.1
+
--- /dev/null
+From 2b50dbb558164474a04451e9b8cdc105a7c313f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:44 +0530
+Subject: selftests/powerpc: ptrace-pkey: Update the test to mark an invalid
+ pkey correctly
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 0eaa3b5ca7b5a76e3783639c828498343be66a01 ]
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-22-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/powerpc/ptrace/ptrace-pkey.c | 30 ++++++++-----------
+ 1 file changed, 12 insertions(+), 18 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index f9216c7a1829e..bc33d748d95b4 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+ return syscall(__NR_pkey_alloc, flags, init_access_rights);
+ }
+
+-static int sys_pkey_free(int pkey)
+-{
+- return syscall(__NR_pkey_free, pkey);
+-}
+-
+ static int child(struct shared_info *info)
+ {
+ unsigned long reg;
+@@ -100,7 +95,11 @@ static int child(struct shared_info *info)
+
+ info->amr1 |= 3ul << pkeyshift(pkey1);
+ info->amr2 |= 3ul << pkeyshift(pkey2);
+- info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3);
++ /*
++ * invalid amr value where we try to force write
++ * things which are deined by a uamor setting.
++ */
++ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
+
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+@@ -111,17 +110,12 @@ static int child(struct shared_info *info)
+
+ info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+ 3ul << pkeyshift(pkey2);
+- info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
+- info->invalid_uamor |= 3ul << pkeyshift(pkey1);
+-
+ /*
+- * We won't use pkey3. We just want a plausible but invalid key to test
+- * whether ptrace will let us write to AMR bits we are not supposed to.
+- *
+- * This also tests whether the kernel restores the UAMOR permissions
+- * after a key is freed.
++ * Create an IAMR value different from expected value.
++ * Kernel will reject an IAMR and UAMOR change.
+ */
+- sys_pkey_free(pkey3);
++ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2));
++ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1));
+
+ printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n",
+ user_write, info->amr1, pkey1, pkey2, pkey3);
+@@ -196,9 +190,9 @@ static int parent(struct shared_info *info, pid_t pid)
+ PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- info->amr1 = info->amr2 = info->invalid_amr = regs[0];
+- info->expected_iamr = info->invalid_iamr = regs[1];
+- info->expected_uamor = info->invalid_uamor = regs[2];
++ info->amr1 = info->amr2 = regs[0];
++ info->expected_iamr = regs[1];
++ info->expected_uamor = regs[2];
+
+ /* Wake up child so that it can set itself up. */
+ ret = prod_child(&info->child_sync);
+--
+2.25.1
+
drm-imx-imx-ldb-disable-both-channels-for-split-mode-in-enc-disable.patch
orangefs-get-rid-of-knob-code.patch
pinctrl-ingenic-properly-detect-gpio-direction-when-configured-for-irq.patch
+crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch
+mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch
+octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch
+mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch
+platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch
+rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch
+rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch
+media-rockchip-rga-introduce-color-fmt-macros-and-re.patch
+media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch
+ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch
+selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch
+selftests-bpf-test_progs-use-another-shell-exit-on-n.patch
+usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch
+usb-serial-ftdi_sio-clean-up-receive-processing.patch
+usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch
+crypto-af_alg-fix-regression-on-empty-requests.patch
+devres-keep-both-device-name-and-resource-name-in-pr.patch
+rdma-counter-only-bind-user-qps-in-auto-mode.patch
+rdma-counter-allow-manually-bind-qps-with-different-.patch
+mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch
+crypto-caam-remove-broken-arc4-support.patch
+gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch
+gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch
+dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch
+clk-actions-fix-h_clk-for-actions-s500-soc.patch
+selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch
+selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch
+selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch
+iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch
+clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch
+clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch
+iommu-vt-d-enforce-pasid-devtlb-field-mask.patch
+i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch
+clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch
+clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch
+pwm-bcm-iproc-handle-clk_get_rate-return.patch
+tools-build-feature-use-cc-and-cxx-from-parent.patch
+i2c-rcar-avoid-race-when-unregistering-slave.patch
+nfs-ensure-correct-writeback-errors-are-returned-on-.patch
+ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch
+clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch
+libnvdimm-security-fix-a-typo.patch
+libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch
+openrisc-fix-oops-caused-when-dumping-stack.patch
+scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch
+nfs-nfs_file_write-should-check-for-writeback-errors.patch
+watchdog-initialize-device-before-misc_register.patch
+md-cluster-fix-potential-error-pointer-dereference-i.patch
+x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch
+input-sentelic-fix-error-return-when-fsp_reg_write-f.patch
+recordmcount-fix-build-failure-on-non-arm64.patch
+drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch
+drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch
+net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch
+nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch
+fs-minix-set-s_maxbytes-correctly.patch
+fs-minix-fix-block-limit-check-for-v1-filesystems.patch
+fs-minix-remove-expected-error-message-in-block_to_p.patch
+fs-ufs-avoid-potential-u32-multiplication-overflow.patch
+test_kmod-avoid-potential-double-free-in-trigger_con.patch
+i2c-iproc-fix-race-between-client-unreg-and-isr.patch
+mfd-dln2-run-event-handler-loop-under-spinlock.patch
+crypto-algif_aead-fix-uninitialized-ctx-init.patch
+alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch
+perf-bench-mem-always-memset-source-before-memcpy.patch
+tools-build-feature-quote-cc-and-cxx-for-their-argum.patch
+perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch
+sh-landisk-add-missing-initialization-of-sh_io_port_.patch
--- /dev/null
+From 9403d69266ff1326290c0a645c8ae2fbc6704501 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 14:42:45 +0200
+Subject: sh: landisk: Add missing initialization of sh_io_port_base
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ]
+
+The Landisk setup code maps the CF IDE area using ioremap_prot(), and
+passes the resulting virtual addresses to the pata_platform driver,
+disguising them as I/O port addresses. Hence the pata_platform driver
+translates them again using ioport_map().
+As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the
+SuperH-specific mapping code in arch/sh/kernel/ioport.c translates
+I/O port addresses to virtual addresses by adding sh_io_port_base, which
+defaults to -1, thus breaking the assumption of an identity mapping.
+
+Fix this by setting sh_io_port_base to zero.
+
+Fixes: 37b7a97884ba64bf ("sh: machvec IO death.")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/boards/mach-landisk/setup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c
+index 16b4d8b0bb850..2c44b94f82fb2 100644
+--- a/arch/sh/boards/mach-landisk/setup.c
++++ b/arch/sh/boards/mach-landisk/setup.c
+@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup);
+
+ static void __init landisk_setup(char **cmdline_p)
+ {
++ /* I/O port identity mapping */
++ __set_io_port_base(0);
++
+ /* LED ON */
+ __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED);
+
+--
+2.25.1
+
--- /dev/null
+From 0ff05e740be03784345c278c3399e09697e6afc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:36:16 -0700
+Subject: test_kmod: avoid potential double free in trigger_config_run_type()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 0776d1231bec0c7ab43baf440a3f5ef5f49dd795 ]
+
+Reset the member "test_fs" of the test configuration after a call of the
+function "kfree_const" to a null pointer so that a double memory release
+will not be performed.
+
+Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christian Brauner <christian.brauner@ubuntu.com>
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: James Morris <jmorris@namei.org>
+Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Cc: J. Bruce Fields <bfields@fieldses.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Josh Triplett <josh@joshtriplett.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Lars Ellenberg <lars.ellenberg@linbit.com>
+Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Cc: Sergei Trofimovich <slyfox@gentoo.org>
+Cc: Sergey Kvachonok <ravenexp@gmail.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Tony Vroon <chainsaw@gentoo.org>
+Cc: Christoph Hellwig <hch@infradead.org>
+Link: http://lkml.kernel.org/r/20200610154923.27510-4-mcgrof@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index 9cf77628fc913..87a0cc750ea23 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,
+ break;
+ case TEST_KMOD_FS_TYPE:
+ kfree_const(config->test_fs);
+- config->test_driver = NULL;
++ config->test_fs = NULL;
+ copied = config_copy_test_fs(config, test_str,
+ strlen(test_str));
+ break;
+--
+2.25.1
+
--- /dev/null
+From 3457977328e90c084be84ff8a5355b37202e6eb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 17:15:17 -0500
+Subject: tools build feature: Quote CC and CXX for their arguments
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Díaz <daniel.diaz@linaro.org>
+
+[ Upstream commit fa5c893181ed2ca2f96552f50073786d2cfce6c0 ]
+
+When using a cross-compilation environment, such as OpenEmbedded,
+the CC an CXX variables are set to something more than just a
+command: there are arguments (such as --sysroot) that need to be
+passed on to the compiler so that the right set of headers and
+libraries are used.
+
+For the particular case that our systems detected, CC is set to
+the following:
+
+ export CC="aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/machine/perf/1.0-r9/recipe-sysroot"
+
+Without quotes, detection is as follows:
+
+ Auto-detecting system features:
+ ... dwarf: [ OFF ]
+ ... dwarf_getlocations: [ OFF ]
+ ... glibc: [ OFF ]
+ ... gtk2: [ OFF ]
+ ... libbfd: [ OFF ]
+ ... libcap: [ OFF ]
+ ... libelf: [ OFF ]
+ ... libnuma: [ OFF ]
+ ... numa_num_possible_cpus: [ OFF ]
+ ... libperl: [ OFF ]
+ ... libpython: [ OFF ]
+ ... libcrypto: [ OFF ]
+ ... libunwind: [ OFF ]
+ ... libdw-dwarf-unwind: [ OFF ]
+ ... zlib: [ OFF ]
+ ... lzma: [ OFF ]
+ ... get_cpuid: [ OFF ]
+ ... bpf: [ OFF ]
+ ... libaio: [ OFF ]
+ ... libzstd: [ OFF ]
+ ... disassembler-four-args: [ OFF ]
+
+ Makefile.config:414: *** No gnu/libc-version.h found, please install glibc-dev[el]. Stop.
+ Makefile.perf:230: recipe for target 'sub-make' failed
+ make[1]: *** [sub-make] Error 2
+ Makefile:69: recipe for target 'all' failed
+ make: *** [all] Error 2
+
+With CC and CXX quoted, some of those features are now detected.
+
+Fixes: e3232c2f39ac ("tools build feature: Use CC and CXX from parent")
+Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
+Reviewed-by: Thomas Hebb <tommyhebb@gmail.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: KP Singh <kpsingh@chromium.org>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lore.kernel.org/lkml/20200812221518.2869003-1-daniel.diaz@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Makefile.feature | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index e80a1a8e287f8..8c6e1ea67f213 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -8,7 +8,7 @@ endif
+
+ feature_check = $(eval $(feature_check_code))
+ define feature_check_code
+- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
+ endef
+
+ feature_set = $(eval $(feature_set_code))
+--
+2.25.1
+
--- /dev/null
+From 1b5ff808c322cf3bcaa0350e6a0121ce5b1ee9d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 21:08:14 -0700
+Subject: tools build feature: Use CC and CXX from parent
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit e3232c2f39acafd5a29128425bc30b9884642cfa ]
+
+commit c8c188679ccf ("tools build: Use the same CC for feature detection
+and actual build") changed these assignments from unconditional (:=) to
+conditional (?=) so that they wouldn't clobber values from the
+environment. However, conditional assignment does not work properly for
+variables that Make implicitly sets, among which are CC and CXX. To
+quote tools/scripts/Makefile.include, which handles this properly:
+
+ # Makefiles suck: This macro sets a default value of $(2) for the
+ # variable named by $(1), unless the variable has been set by
+ # environment or command line. This is necessary for CC and AR
+ # because make sets default values, so the simpler ?= approach
+ # won't work as expected.
+
+In other words, the conditional assignments will not run even if the
+variables are not overridden in the environment; Make will set CC to
+"cc" and CXX to "g++" when it starts[1], meaning the variables are not
+empty by the time the conditional assignments are evaluated. This breaks
+cross-compilation when CROSS_COMPILE is set but CC isn't, since "cc"
+gets used for feature detection instead of the cross compiler (and
+likewise for CXX).
+
+To fix the issue, just pass down the values of CC and CXX computed by
+the parent Makefile, which gets included by the Makefile that actually
+builds whatever we're detecting features for and so is guaranteed to
+have good values. This is a better solution anyway, since it means we
+aren't trying to replicate the logic of the parent build system and so
+don't risk it getting out of sync.
+
+Leave PKG_CONFIG alone, since 1) there's no common logic to compute it
+in Makefile.include, and 2) it's not an implicit variable, so
+conditional assignment works properly.
+
+[1] https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
+
+Fixes: c8c188679ccf ("tools build: Use the same CC for feature detection and actual build")
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Carrillo-Cisneros <davidcc@google.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Igor Lubashev <ilubashe@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Quentin Monnet <quentin@isovalent.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: thomas hebb <tommyhebb@gmail.com>
+Link: http://lore.kernel.org/lkml/0a6e69d1736b0fa231a648f50b0cce5d8a6734ef.1595822871.git.tommyhebb@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Makefile.feature | 2 +-
+ tools/build/feature/Makefile | 2 --
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index 8a19753cc26aa..e80a1a8e287f8 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -8,7 +8,7 @@ endif
+
+ feature_check = $(eval $(feature_check_code))
+ define feature_check_code
+- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
+ endef
+
+ feature_set = $(eval $(feature_set_code))
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index 8499385365c02..054e09ab4a9e4 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -70,8 +70,6 @@ FILES= \
+
+ FILES := $(addprefix $(OUTPUT),$(FILES))
+
+-CC ?= $(CROSS_COMPILE)gcc
+-CXX ?= $(CROSS_COMPILE)g++
+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
+ LLVM_CONFIG ?= llvm-config
+
+--
+2.25.1
+
--- /dev/null
+From ee6f089268436b4a2ac77f64fc8e7baad2deea14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 20:51:40 +0800
+Subject: ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 094b6d1295474f338201b846a1f15e72eb0b12cf ]
+
+There a wrong orphan node deleting in error handling path in
+ubifs_jnl_update() and ubifs_jnl_rename(), which may cause
+following error msg:
+
+ UBIFS error (ubi0:0 pid 1522): ubifs_delete_orphan [ubifs]:
+ missing orphan ino 65
+
+Fix this by checking whether the node has been operated for
+adding to orphan list before being deleted,
+
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Fixes: 823838a486888cf484e ("ubifs: Add hashes to the tree node cache")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/journal.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index 826dad0243dcc..a6ae2428e4c96 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ const struct fscrypt_name *nm, const struct inode *inode,
+ int deletion, int xent)
+ {
+- int err, dlen, ilen, len, lnum, ino_offs, dent_offs;
++ int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0;
+ int aligned_dlen, aligned_ilen, sync = IS_DIRSYNC(dir);
+ int last_reference = !!(deletion && inode->i_nlink == 0);
+ struct ubifs_inode *ui = ubifs_inode(inode);
+@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ goto out_finish;
+ }
+ ui->del_cmtno = c->cmt_no;
++ orphan_added = 1;
+ }
+
+ err = write_head(c, BASEHD, dent, len, &lnum, &dent_offs, sync);
+@@ -702,7 +703,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ kfree(dent);
+ out_ro:
+ ubifs_ro_mode(c, err);
+- if (last_reference)
++ if (orphan_added)
+ ubifs_delete_orphan(c, inode->i_ino);
+ finish_reservation(c);
+ return err;
+@@ -1217,7 +1218,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ void *p;
+ union ubifs_key key;
+ struct ubifs_dent_node *dent, *dent2;
+- int err, dlen1, dlen2, ilen, lnum, offs, len;
++ int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added = 0;
+ int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ;
+ int last_reference = !!(new_inode && new_inode->i_nlink == 0);
+ int move = (old_dir != new_dir);
+@@ -1333,6 +1334,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ goto out_finish;
+ }
+ new_ui->del_cmtno = c->cmt_no;
++ orphan_added = 1;
+ }
+
+ err = write_head(c, BASEHD, dent, len, &lnum, &offs, sync);
+@@ -1414,7 +1416,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ release_head(c, BASEHD);
+ out_ro:
+ ubifs_ro_mode(c, err);
+- if (last_reference)
++ if (orphan_added)
+ ubifs_delete_orphan(c, new_inode->i_ino);
+ out_finish:
+ finish_reservation(c);
+--
+2.25.1
+
--- /dev/null
+From bc76f0d858ff877d5908a8e84c777d3cfd6dc5c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:52 +0200
+Subject: USB: serial: ftdi_sio: clean up receive processing
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ce054039ba5e47b75a3be02a00274e52b06a6456 ]
+
+Clean up receive processing by dropping the character pointer and
+keeping the length argument unchanged throughout the function.
+
+Also make it more apparent that sysrq processing can consume a
+characters by adding an explicit continue.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 96b9e2768ac5c..33f1cca7eaa61 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2483,7 +2483,6 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
+ unsigned char status;
+- unsigned char *ch;
+ int i;
+ char flag;
+
+@@ -2526,8 +2525,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ else
+ priv->transmit_empty = 0;
+
+- len -= 2;
+- if (!len)
++ if (len == 2)
+ return 0; /* status only */
+
+ /*
+@@ -2556,19 +2554,20 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ }
+ }
+
+- port->icount.rx += len;
+- ch = buf + 2;
++ port->icount.rx += len - 2;
+
+ if (port->port.console && port->sysrq) {
+- for (i = 0; i < len; i++, ch++) {
+- if (!usb_serial_handle_sysrq_char(port, *ch))
+- tty_insert_flip_char(&port->port, *ch, flag);
++ for (i = 2; i < len; i++) {
++ if (usb_serial_handle_sysrq_char(port, buf[i]))
++ continue;
++ tty_insert_flip_char(&port->port, buf[i], flag);
+ }
+ } else {
+- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len);
++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag,
++ len - 2);
+ }
+
+- return len;
++ return len - 2;
+ }
+
+ static void ftdi_process_read_urb(struct urb *urb)
+--
+2.25.1
+
--- /dev/null
+From 3b8d18c85b3304ff5e5b281c1ad216da1c105c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:53 +0200
+Subject: USB: serial: ftdi_sio: fix break and sysrq handling
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 733fff67941dad64b8a630450b8372b1873edc41 ]
+
+Only the last NUL in a packet should be flagged as a break character,
+for example, to avoid dropping unrelated characters when IGNBRK is set.
+
+Also make sysrq work by consuming the break character instead of having
+it immediately cancel the sysrq request, and by not processing it
+prematurely to avoid triggering a sysrq based on an unrelated character
+received in the same packet (which was received *before* the break).
+
+Note that the break flag can be left set also for a packet received
+immediately following a break and that and an ending NUL in such a
+packet will continue to be reported as a break as there's no good way to
+tell it apart from an actual break.
+
+Tested on FT232R and FT232H.
+
+Fixes: 72fda3ca6fc1 ("USB: serial: ftd_sio: implement sysrq handling on break")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 33f1cca7eaa61..07b146d7033a6 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2483,6 +2483,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
+ unsigned char status;
++ bool brkint = false;
+ int i;
+ char flag;
+
+@@ -2534,13 +2535,17 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ */
+ flag = TTY_NORMAL;
+ if (buf[1] & FTDI_RS_ERR_MASK) {
+- /* Break takes precedence over parity, which takes precedence
+- * over framing errors */
+- if (buf[1] & FTDI_RS_BI) {
+- flag = TTY_BREAK;
++ /*
++ * Break takes precedence over parity, which takes precedence
++ * over framing errors. Note that break is only associated
++ * with the last character in the buffer and only when it's a
++ * NUL.
++ */
++ if (buf[1] & FTDI_RS_BI && buf[len - 1] == '\0') {
+ port->icount.brk++;
+- usb_serial_handle_break(port);
+- } else if (buf[1] & FTDI_RS_PE) {
++ brkint = true;
++ }
++ if (buf[1] & FTDI_RS_PE) {
+ flag = TTY_PARITY;
+ port->icount.parity++;
+ } else if (buf[1] & FTDI_RS_FE) {
+@@ -2556,8 +2561,13 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+
+ port->icount.rx += len - 2;
+
+- if (port->port.console && port->sysrq) {
++ if (brkint || (port->port.console && port->sysrq)) {
+ for (i = 2; i < len; i++) {
++ if (brkint && i == len - 1) {
++ if (usb_serial_handle_break(port))
++ return len - 3;
++ flag = TTY_BREAK;
++ }
+ if (usb_serial_handle_sysrq_char(port, buf[i]))
+ continue;
+ tty_insert_flip_char(&port->port, buf[i], flag);
+--
+2.25.1
+
--- /dev/null
+From 63f197a419a92fb828ffe7d1308aff3cf482646e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:51 +0200
+Subject: USB: serial: ftdi_sio: make process-packet buffer unsigned
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ]
+
+Use an unsigned type for the process-packet buffer argument and give it
+a more apt name.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 9ad44a96dfe3a..96b9e2768ac5c 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2480,12 +2480,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port,
+ #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)
+
+ static int ftdi_process_packet(struct usb_serial_port *port,
+- struct ftdi_private *priv, char *packet, int len)
++ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
++ unsigned char status;
++ unsigned char *ch;
+ int i;
+- char status;
+ char flag;
+- char *ch;
+
+ if (len < 2) {
+ dev_dbg(&port->dev, "malformed packet\n");
+@@ -2495,7 +2495,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ /* Compare new line status to the old one, signal if different/
+ N.B. packet may be processed more than once, but differences
+ are only processed once. */
+- status = packet[0] & FTDI_STATUS_B0_MASK;
++ status = buf[0] & FTDI_STATUS_B0_MASK;
+ if (status != priv->prev_status) {
+ char diff_status = status ^ priv->prev_status;
+
+@@ -2521,7 +2521,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ }
+
+ /* save if the transmitter is empty or not */
+- if (packet[1] & FTDI_RS_TEMT)
++ if (buf[1] & FTDI_RS_TEMT)
+ priv->transmit_empty = 1;
+ else
+ priv->transmit_empty = 0;
+@@ -2535,29 +2535,29 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ * data payload to avoid over-reporting.
+ */
+ flag = TTY_NORMAL;
+- if (packet[1] & FTDI_RS_ERR_MASK) {
++ if (buf[1] & FTDI_RS_ERR_MASK) {
+ /* Break takes precedence over parity, which takes precedence
+ * over framing errors */
+- if (packet[1] & FTDI_RS_BI) {
++ if (buf[1] & FTDI_RS_BI) {
+ flag = TTY_BREAK;
+ port->icount.brk++;
+ usb_serial_handle_break(port);
+- } else if (packet[1] & FTDI_RS_PE) {
++ } else if (buf[1] & FTDI_RS_PE) {
+ flag = TTY_PARITY;
+ port->icount.parity++;
+- } else if (packet[1] & FTDI_RS_FE) {
++ } else if (buf[1] & FTDI_RS_FE) {
+ flag = TTY_FRAME;
+ port->icount.frame++;
+ }
+ /* Overrun is special, not associated with a char */
+- if (packet[1] & FTDI_RS_OE) {
++ if (buf[1] & FTDI_RS_OE) {
+ port->icount.overrun++;
+ tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
+ }
+ }
+
+ port->icount.rx += len;
+- ch = packet + 2;
++ ch = buf + 2;
+
+ if (port->port.console && port->sysrq) {
+ for (i = 0; i < len; i++, ch++) {
+--
+2.25.1
+
--- /dev/null
+From f7a8c1b4a5caf20af947f48218324838fb30e250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 12:31:09 +0200
+Subject: watchdog: initialize device before misc_register
+
+From: Krzysztof Sobota <krzysztof.sobota@nokia.com>
+
+[ Upstream commit cb36e29bb0e4b0c33c3d5866a0a4aebace4c99b7 ]
+
+When watchdog device is being registered, it calls misc_register that
+makes watchdog available for systemd to open. This is a data race
+scenario, because when device is open it may still have device struct
+not initialized - this in turn causes a crash. This patch moves
+device initialization before misc_register call and it solves the
+problem printed below.
+
+------------[ cut here ]------------
+WARNING: CPU: 3 PID: 1 at lib/kobject.c:612 kobject_get+0x50/0x54
+kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called.
+Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6
+CPU: 3 PID: 1 Comm: systemd Tainted: G O 4.19.113-g2579778-fsm4_k2 #1
+Hardware name: Keystone
+[<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c)
+[<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8)
+[<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114)
+[<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74)
+[<c0221fd8>] (warn_slowpath_fmt) from [<c07fd394>] (kobject_get+0x50/0x54)
+[<c07fd394>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24)
+[<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0)
+[<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c)
+[<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8)
+[<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc)
+[<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148)
+[<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec)
+[<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4)
+[<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xd2ceffa8 to 0xd2cefff0)
+ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000
+ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78
+ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6
+---[ end trace 7b16eb105513974f ]---
+
+------------[ cut here ]------------
+WARNING: CPU: 3 PID: 1 at lib/refcount.c:153 kobject_get+0x24/0x54
+refcount_t: increment on 0; use-after-free.
+Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6
+CPU: 3 PID: 1 Comm: systemd Tainted: G W O 4.19.113-g2579778-fsm4_k2 #1
+Hardware name: Keystone
+[<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c)
+[<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8)
+[<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114)
+[<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74)
+[<c0221fd8>] (warn_slowpath_fmt) from [<c07fd368>] (kobject_get+0x24/0x54)
+[<c07fd368>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24)
+[<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0)
+[<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c)
+[<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8)
+[<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc)
+[<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148)
+[<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec)
+[<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4)
+[<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xd2ceffa8 to 0xd2cefff0)
+ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000
+ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78
+ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6
+---[ end trace 7b16eb1055139750 ]---
+
+Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Krzysztof Sobota <krzysztof.sobota@nokia.com>
+Link: https://lore.kernel.org/r/20200717103109.14660-1-krzysztof.sobota@nokia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_dev.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index c4147e93aa7d4..3729f99fd8eca 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -974,6 +974,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ if (IS_ERR_OR_NULL(watchdog_kworker))
+ return -ENODEV;
+
++ device_initialize(&wd_data->dev);
++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
++ wd_data->dev.class = &watchdog_class;
++ wd_data->dev.parent = wdd->parent;
++ wd_data->dev.groups = wdd->groups;
++ wd_data->dev.release = watchdog_core_data_release;
++ dev_set_drvdata(&wd_data->dev, wdd);
++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
++
+ kthread_init_work(&wd_data->work, watchdog_ping_work);
+ hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
+ wd_data->timer.function = watchdog_timer_expired;
+@@ -994,15 +1003,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ }
+ }
+
+- device_initialize(&wd_data->dev);
+- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
+- wd_data->dev.class = &watchdog_class;
+- wd_data->dev.parent = wdd->parent;
+- wd_data->dev.groups = wdd->groups;
+- wd_data->dev.release = watchdog_core_data_release;
+- dev_set_drvdata(&wd_data->dev, wdd);
+- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
+-
+ /* Fill in the data structures */
+ cdev_init(&wd_data->cdev, &watchdog_fops);
+
+--
+2.25.1
+
--- /dev/null
+From 406c10dafaa29ae46900fb7b4fbc8178180cadfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 15:56:36 +0800
+Subject: x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
+
+From: Dilip Kota <eswara.kota@linux.intel.com>
+
+[ Upstream commit 7d98585860d845e36ee612832a5ff021f201dbaf ]
+
+Frequency descriptor of Lightning Mountain SoC doesn't have all the
+frequency entries so resulting in the below failure causing a kernel hang:
+
+ Error MSR_FSB_FREQ index 15 is unknown
+ tsc: Fast TSC calibration failed
+
+So, add all the frequency entries in the Lightning Mountain SoC frequency
+descriptor.
+
+Fixes: 0cc5359d8fd45 ("x86/cpu: Update init data for new Airmont CPU model")
+Fixes: 812c2d7506fd ("x86/tsc_msr: Use named struct initializers")
+Signed-off-by: Dilip Kota <eswara.kota@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/211c643ae217604b46cbec43a2c0423946dc7d2d.1596440057.git.eswara.kota@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tsc_msr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
+index c65adaf813848..41200706e6da1 100644
+--- a/arch/x86/kernel/tsc_msr.c
++++ b/arch/x86/kernel/tsc_msr.c
+@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = {
+ .mask = 0x0f,
+ };
+
+-/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */
++/*
++ * 24 MHz crystal? : 24 * 13 / 4 = 78 MHz
++ * Frequency step for Lightning Mountain SoC is fixed to 78 MHz,
++ * so all the frequency entries are 78000.
++ */
+ static const struct freq_desc freq_desc_lgm = {
+ .use_msr_plat = true,
+- .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 },
++ .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000,
++ 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 },
+ .mask = 0x0f,
+ };
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
