--- /dev/null
+From 60f4e6696a1294b339b9f8ea86b77109e6ea0d79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Mar 2021 09:10:03 -0500
+Subject: ALSA: hda: ignore invalid NHLT table
+
+From: Mark Pearson <markpearson@lenovo.com>
+
+[ Upstream commit a14a6219996ee6f6e858d83b11affc7907633687 ]
+
+On some Lenovo systems if the microphone is disabled in the BIOS
+only the NHLT table header is created, with no data. This means
+the endpoints field is not correctly set to zero - leading to an
+unintialised variable and hence invalid descriptors are parsed
+leading to page faults.
+
+The Lenovo firmware team is addressing this, but adding a check
+preventing invalid tables being parsed is worthwhile.
+
+Tested on a Lenovo T14.
+
+Tested-by: Philipp Leskovitz <philipp.leskovitz@secunet.com>
+Reported-by: Philipp Leskovitz <philipp.leskovitz@secunet.com>
+Signed-off-by: Mark Pearson <markpearson@lenovo.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210302141003.7342-1-markpearson@lenovo.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/hda/intel-nhlt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c
+index d053beccfaec..e2237239d922 100644
+--- a/sound/hda/intel-nhlt.c
++++ b/sound/hda/intel-nhlt.c
+@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt)
+ if (!nhlt)
+ return 0;
+
++ if (nhlt->header.length <= sizeof(struct acpi_table_header)) {
++ dev_warn(dev, "Invalid DMIC description table\n");
++ return 0;
++ }
++
+ for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++,
+ epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) {
+
+--
+2.30.1
+
--- /dev/null
+From 9761c2a83b46e583bb95962e8d5a0d7b30bd9b6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Feb 2021 16:15:06 -0500
+Subject: atm: eni: dont release is never initialized
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]
+
+label err_eni_release is reachable when eni_start() fail.
+In eni_start() it calls dev->phy->start() in the last step, if start()
+fail we don't need to call phy->stop(), if start() is never called, we
+neither need to call phy->stop(), otherwise null-ptr-deref will happen.
+
+In order to fix this issue, don't call phy->stop() in label err_eni_release
+
+[ 4.875714] ==================================================================
+[ 4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni]
+[ 4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95
+[ 4.876778]
+[ 4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2
+[ 4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94
+[ 4.877876] Call Trace:
+[ 4.878009] dump_stack+0x7d/0xa3
+[ 4.878191] kasan_report.cold+0x10c/0x10e
+[ 4.878410] ? __slab_free+0x2f0/0x340
+[ 4.878612] ? suni_stop+0x47/0x100 [suni]
+[ 4.878832] suni_stop+0x47/0x100 [suni]
+[ 4.879043] eni_do_release+0x3b/0x70 [eni]
+[ 4.879269] eni_init_one.cold+0x1152/0x1747 [eni]
+[ 4.879528] ? _raw_spin_lock_irqsave+0x7b/0xd0
+[ 4.879768] ? eni_ioctl+0x270/0x270 [eni]
+[ 4.879990] ? __mutex_lock_slowpath+0x10/0x10
+[ 4.880226] ? eni_ioctl+0x270/0x270 [eni]
+[ 4.880448] local_pci_probe+0x6f/0xb0
+[ 4.880650] pci_device_probe+0x171/0x240
+[ 4.880864] ? pci_device_remove+0xe0/0xe0
+[ 4.881086] ? kernfs_create_link+0xb6/0x110
+[ 4.881315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
+[ 4.881594] really_probe+0x161/0x420
+[ 4.881791] driver_probe_device+0x6d/0xd0
+[ 4.882010] device_driver_attach+0x82/0x90
+[ 4.882233] ? device_driver_attach+0x90/0x90
+[ 4.882465] __driver_attach+0x60/0x100
+[ 4.882671] ? device_driver_attach+0x90/0x90
+[ 4.882903] bus_for_each_dev+0xe1/0x140
+[ 4.883114] ? subsys_dev_iter_exit+0x10/0x10
+[ 4.883346] ? klist_node_init+0x61/0x80
+[ 4.883557] bus_add_driver+0x254/0x2a0
+[ 4.883764] driver_register+0xd3/0x150
+[ 4.883971] ? 0xffffffffc0038000
+[ 4.884149] do_one_initcall+0x84/0x250
+[ 4.884355] ? trace_event_raw_event_initcall_finish+0x150/0x150
+[ 4.884674] ? unpoison_range+0xf/0x30
+[ 4.884875] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
+[ 4.885150] ? unpoison_range+0xf/0x30
+[ 4.885352] ? unpoison_range+0xf/0x30
+[ 4.885557] do_init_module+0xf8/0x350
+[ 4.885760] load_module+0x3fe6/0x4340
+[ 4.885960] ? vm_unmap_ram+0x1d0/0x1d0
+[ 4.886166] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
+[ 4.886441] ? module_frob_arch_sections+0x20/0x20
+[ 4.886697] ? __do_sys_finit_module+0x108/0x170
+[ 4.886941] __do_sys_finit_module+0x108/0x170
+[ 4.887178] ? __ia32_sys_init_module+0x40/0x40
+[ 4.887419] ? file_open_root+0x200/0x200
+[ 4.887634] ? do_sys_open+0x85/0xe0
+[ 4.887826] ? filp_open+0x50/0x50
+[ 4.888009] ? fpregs_assert_state_consistent+0x4d/0x60
+[ 4.888287] ? exit_to_user_mode_prepare+0x2f/0x130
+[ 4.888547] do_syscall_64+0x33/0x40
+[ 4.888739] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 4.889010] RIP: 0033:0x7ff62fcf1cf7
+[ 4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71
+[ 4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[ 4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7
+[ 4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003
+[ 4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
+[ 4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0
+[ 4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001
+[ 4.892439] ==================================================================
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/eni.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index 316a9947541f..b574cce98dc3 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2260,7 +2260,8 @@ static int eni_init_one(struct pci_dev *pci_dev,
+ return rc;
+
+ err_eni_release:
+- eni_do_release(dev);
++ dev->phy = NULL;
++ iounmap(ENI_DEV(dev)->ioaddr);
+ err_unregister:
+ atm_dev_deregister(dev);
+ err_free_consistent:
+--
+2.30.1
+
--- /dev/null
+From 490966c4086e99c0843c28402cde2d93d8152cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 22:25:30 -0500
+Subject: atm: idt77252: fix null-ptr-dereference
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]
+
+this one is similar to the phy_data allocation fix in uPD98402, the
+driver allocate the idt77105_priv and store to dev_data but later
+dereference using dev->dev_data, which will cause null-ptr-dereference.
+
+fix this issue by changing dev_data to phy_data so that PRIV(dev) can
+work correctly.
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/idt77105.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
+index 3c081b6171a8..bfca7b8a6f31 100644
+--- a/drivers/atm/idt77105.c
++++ b/drivers/atm/idt77105.c
+@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev)
+ {
+ unsigned long flags;
+
+- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
++ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
+ return -ENOMEM;
+ PRIV(dev)->dev = dev;
+ spin_lock_irqsave(&idt77105_priv_lock, flags);
+@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev)
+ else
+ idt77105_all = walk->next;
+ dev->phy = NULL;
+- dev->dev_data = NULL;
++ dev->phy_data = NULL;
+ kfree(walk);
+ break;
+ }
+--
+2.30.1
+
--- /dev/null
+From 4bec22f2409ab6e5049086ce93e435d8a00bd280 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Feb 2021 22:55:50 -0500
+Subject: atm: lanai: dont run lanai_dev_close if not open
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
+
+lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the
+pci device is disabled. The caller, lanai_init_one(), then tries to run
+atm_dev_deregister(). This will subsequently call lanai_dev_close() and
+use the already released MMIO area.
+
+To fix this issue, set the lanai->base to NULL if open fail,
+and test the flag in lanai_dev_close().
+
+[ 8.324153] lanai: lanai_start() failed, err=19
+[ 8.324819] lanai(itf 0): shutting down interface
+[ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024
+[ 8.325781] #PF: supervisor write access in kernel mode
+[ 8.326215] #PF: error_code(0x0002) - not-present page
+[ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0
+[ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI
+[ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12
+[ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4
+[ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
+[ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
+[ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
+[ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
+[ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
+[ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
+[ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
+[ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
+[ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
+[ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
+[ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 8.334932] Call Trace:
+[ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm]
+[ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai]
+[ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai]
+[ 8.335831] local_pci_probe+0x6f/0xb0
+[ 8.336039] pci_device_probe+0x171/0x240
+[ 8.336255] ? pci_device_remove+0xe0/0xe0
+[ 8.336475] ? kernfs_create_link+0xb6/0x110
+[ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
+[ 8.336983] really_probe+0x161/0x420
+[ 8.337181] driver_probe_device+0x6d/0xd0
+[ 8.337401] device_driver_attach+0x82/0x90
+[ 8.337626] ? device_driver_attach+0x90/0x90
+[ 8.337859] __driver_attach+0x60/0x100
+[ 8.338065] ? device_driver_attach+0x90/0x90
+[ 8.338298] bus_for_each_dev+0xe1/0x140
+[ 8.338511] ? subsys_dev_iter_exit+0x10/0x10
+[ 8.338745] ? klist_node_init+0x61/0x80
+[ 8.338956] bus_add_driver+0x254/0x2a0
+[ 8.339164] driver_register+0xd3/0x150
+[ 8.339370] ? 0xffffffffc0028000
+[ 8.339550] do_one_initcall+0x84/0x250
+[ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150
+[ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0
+[ 8.340329] ? unpoison_range+0xf/0x30
+[ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
+[ 8.340806] ? unpoison_range+0xf/0x30
+[ 8.341014] ? unpoison_range+0xf/0x30
+[ 8.341217] do_init_module+0xf8/0x350
+[ 8.341419] load_module+0x3fe6/0x4340
+[ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0
+[ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
+[ 8.342101] ? module_frob_arch_sections+0x20/0x20
+[ 8.342358] ? __do_sys_finit_module+0x108/0x170
+[ 8.342604] __do_sys_finit_module+0x108/0x170
+[ 8.342841] ? __ia32_sys_init_module+0x40/0x40
+[ 8.343083] ? file_open_root+0x200/0x200
+[ 8.343298] ? do_sys_open+0x85/0xe0
+[ 8.343491] ? filp_open+0x50/0x50
+[ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130
+[ 8.343935] do_syscall_64+0x33/0x40
+[ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 8.344401] RIP: 0033:0x7f08eb887cf7
+[ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41
+[ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7
+[ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003
+[ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
+[ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0
+[ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001
+[ 8.347836] Modules linked in: lanai(+) atm
+[ 8.348065] CR2: ffffc90000180024
+[ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]---
+[ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
+[ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
+[ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
+[ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
+[ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
+[ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
+[ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
+[ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
+[ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
+[ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
+[ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/lanai.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
+index d7277c26e423..32d7aa141d96 100644
+--- a/drivers/atm/lanai.c
++++ b/drivers/atm/lanai.c
+@@ -2233,6 +2233,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ conf1_write(lanai);
+ #endif
+ iounmap(lanai->base);
++ lanai->base = NULL;
+ error_pci:
+ pci_disable_device(lanai->pci);
+ error:
+@@ -2245,6 +2246,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
+ static void lanai_dev_close(struct atm_dev *atmdev)
+ {
+ struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
++ if (lanai->base==NULL)
++ return;
+ printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
+ lanai->number);
+ lanai_timed_poll_stop(lanai);
+@@ -2552,7 +2555,7 @@ static int lanai_init_one(struct pci_dev *pci,
+ struct atm_dev *atmdev;
+ int result;
+
+- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
++ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
+ if (lanai == NULL) {
+ printk(KERN_ERR DEV_LABEL
+ ": couldn't allocate dev_data structure!\n");
+--
+2.30.1
+
--- /dev/null
+From c16f106640dfa756e014186d123607ca2ee0d3f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 22:25:29 -0500
+Subject: atm: uPD98402: fix incorrect allocation
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ]
+
+dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this
+dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock
+(i.e dev->phy_data->lock) will result in a null-ptr-dereference.
+
+I believe this is a typo and what it actually want to do is to allocate
+phy_data instead of dev_data.
+
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/uPD98402.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
+index 7850758b5bb8..239852d85558 100644
+--- a/drivers/atm/uPD98402.c
++++ b/drivers/atm/uPD98402.c
+@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev)
+ static int uPD98402_start(struct atm_dev *dev)
+ {
+ DPRINTK("phy_start\n");
+- if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
++ if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL)))
+ return -ENOMEM;
+ spin_lock_init(&PRIV(dev)->lock);
+ memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats));
+--
+2.30.1
+
--- /dev/null
+From 128922884b3598bd8021f22fd0cf9fec17dd427f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 16:13:27 +0800
+Subject: blk-cgroup: Fix the recursive blkg rwstat
+
+From: Xunlei Pang <xlpang@linux.alibaba.com>
+
+[ Upstream commit 4f44657d74873735e93a50eb25014721a66aac19 ]
+
+The current blkio.throttle.io_service_bytes_recursive doesn't
+work correctly.
+
+As an example, for the following blkcg hierarchy:
+ (Made 1GB READ in test1, 512MB READ in test2)
+ test
+ / \
+ test1 test2
+
+$ head -n 1 test/test1/blkio.throttle.io_service_bytes_recursive
+8:0 Read 1073684480
+$ head -n 1 test/test2/blkio.throttle.io_service_bytes_recursive
+8:0 Read 537448448
+$ head -n 1 test/blkio.throttle.io_service_bytes_recursive
+8:0 Read 537448448
+
+Clearly, above data of "test" reflects "test2" not "test1"+"test2".
+
+Do the correct summary in blkg_rwstat_recursive_sum().
+
+Signed-off-by: Xunlei Pang <xlpang@linux.alibaba.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup-rwstat.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-cgroup-rwstat.c b/block/blk-cgroup-rwstat.c
+index 85d5790ac49b..3304e841df7c 100644
+--- a/block/blk-cgroup-rwstat.c
++++ b/block/blk-cgroup-rwstat.c
+@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol,
+
+ lockdep_assert_held(&blkg->q->queue_lock);
+
++ memset(sum, 0, sizeof(*sum));
+ rcu_read_lock();
+ blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) {
+ struct blkg_rwstat *rwstat;
+@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol,
+ rwstat = (void *)pos_blkg + off;
+
+ for (i = 0; i < BLKG_RWSTAT_NR; i++)
+- sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i);
++ sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i);
+ }
+ rcu_read_unlock();
+ }
+--
+2.30.1
+
--- /dev/null
+From 9461e2dc000d40cd870421267bc0cf8570c5bb93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 18:09:19 +0900
+Subject: block: Fix REQ_OP_ZONE_RESET_ALL handling
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+[ Upstream commit faa44c69daf9ccbd5b8a1aee13e0e0d037c0be17 ]
+
+Similarly to a single zone reset operation (REQ_OP_ZONE_RESET), execute
+REQ_OP_ZONE_RESET_ALL operations with REQ_SYNC set.
+
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-zoned.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-zoned.c b/block/blk-zoned.c
+index df0ecf6790d3..fc925f73d694 100644
+--- a/block/blk-zoned.c
++++ b/block/blk-zoned.c
+@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op,
+ */
+ if (op == REQ_OP_ZONE_RESET &&
+ blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) {
+- bio->bi_opf = REQ_OP_ZONE_RESET_ALL;
++ bio->bi_opf = REQ_OP_ZONE_RESET_ALL | REQ_SYNC;
+ break;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 2878b7c51a72f1f81c0d011a69481c12b08d7716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 16:19:17 +0100
+Subject: block: Suppress uevent for hidden device when removed
+
+From: Daniel Wagner <dwagner@suse.de>
+
+[ Upstream commit 9ec491447b90ad6a4056a9656b13f0b3a1e83043 ]
+
+register_disk() suppress uevents for devices with the GENHD_FL_HIDDEN
+but enables uevents at the end again in order to announce disk after
+possible partitions are created.
+
+When the device is removed the uevents are still on and user land sees
+'remove' messages for devices which were never 'add'ed to the system.
+
+ KERNEL[95481.571887] remove /devices/virtual/nvme-fabrics/ctl/nvme5/nvme0c5n1 (block)
+
+Let's suppress the uevents for GENHD_FL_HIDDEN by not enabling the
+uevents at all.
+
+Signed-off-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Link: https://lore.kernel.org/r/20210311151917.136091-1-dwagner@suse.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 07a0ef741de1..12940cfa68af 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -658,10 +658,8 @@ static void register_disk(struct device *parent, struct gendisk *disk,
+ kobject_create_and_add("holders", &ddev->kobj);
+ disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj);
+
+- if (disk->flags & GENHD_FL_HIDDEN) {
+- dev_set_uevent_suppress(ddev, 0);
++ if (disk->flags & GENHD_FL_HIDDEN)
+ return;
+- }
+
+ disk_scan_partitions(disk);
+
+--
+2.30.1
+
--- /dev/null
+From 29ee30e19ce8539656d505ea3e9798c9b01dc59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 17:51:48 +0000
+Subject: cifs: ask for more credit on async read/write code paths
+
+From: Aurelien Aptel <aaptel@suse.com>
+
+[ Upstream commit 88fd98a2306755b965e4f4567f84e73db3b6738c ]
+
+When doing a large read or write workload we only
+very gradually increase the number of credits
+which can cause problems with parallelizing large i/o
+(I/O ramps up more slowly than it should for large
+read/write workloads) especially with multichannel
+when the number of credits on the secondary channels
+starts out low (e.g. less than about 130) or when
+recovering after server throttled back the number
+of credit.
+
+Signed-off-by: Aurelien Aptel <aaptel@suse.com>
+Reviewed-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 794fc3b68b4f..6a1af5545f67 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -4033,8 +4033,7 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ if (rdata->credits.value > 0) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest =
+- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
+
+ rc = adjust_credits(server, &rdata->credits, rdata->bytes);
+ if (rc)
+@@ -4340,8 +4339,7 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ if (wdata->credits.value > 0) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest =
+- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8);
+
+ rc = adjust_credits(server, &wdata->credits, wdata->bytes);
+ if (rc)
+--
+2.30.1
+
--- /dev/null
+From 4b74de75d1103a7216183f831f8150cbaaad687c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 12:00:48 -0300
+Subject: cifs: change noisy error message to FYI
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit e3d100eae44b42f309c1366efb8397368f1cf8ed ]
+
+A customer has reported that their dmesg were being flooded by
+
+ CIFS: VFS: \\server Cancelling wait for mid xxx cmd: a
+ CIFS: VFS: \\server Cancelling wait for mid yyy cmd: b
+ CIFS: VFS: \\server Cancelling wait for mid zzz cmd: c
+
+because some processes that were performing statfs(2) on the share had
+been interrupted due to their automount setup when certain users
+logged in and out.
+
+Change it to FYI as they should be mostly informative rather than
+error messages.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 64fccb8809ec..13d685f0ac8e 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -1185,7 +1185,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ }
+ if (rc != 0) {
+ for (; i < num_rqst; i++) {
+- cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n",
++ cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
+ midQ[i]->mid, le16_to_cpu(midQ[i]->command));
+ send_cancel(server, &rqst[i], midQ[i]);
+ spin_lock(&GlobalMid_Lock);
+--
+2.30.1
+
--- /dev/null
+From 3a397a1671f3c6ed090d26a38dab17a03cc1a6ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 22:23:26 +0000
+Subject: cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit fbb31cb805fd3574d3be7defc06a7fd2fd9af7d2 ]
+
+Add "arm,vexpress" to cpufreq-dt-platdev blacklist since the actual
+scaling is handled by the firmware cpufreq drivers(scpi, scmi and
+vexpress-spc).
+
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/cpufreq-dt-platdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
+index bd2db0188cbb..91e6a0c10dbf 100644
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = {
+ static const struct of_device_id blacklist[] __initconst = {
+ { .compatible = "allwinner,sun50i-h6", },
+
++ { .compatible = "arm,vexpress", },
++
+ { .compatible = "calxeda,highbank", },
+ { .compatible = "calxeda,ecx-2000", },
+
+--
+2.30.1
+
--- /dev/null
+From 7db99053dddafe352a8f5b1535e17b76f6a892eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 17:17:50 -0500
+Subject: drm/amd/display: Enable pflip interrupt upon pipe enable
+
+From: Qingqing Zhuo <qingqing.zhuo@amd.com>
+
+[ Upstream commit 7afa0033d6f7fb8a84798ef99d1117661c4e696c ]
+
+[Why]
+pflip interrupt would not be enabled promptly if a pipe is disabled
+and re-enabled, causing flip_done timeout error during DP
+compliance tests
+
+[How]
+Enable pflip interrupt upon pipe enablement
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas@amd.com>
+Acked-by: Eryk Brol <eryk.brol@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dc.h | 1 +
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c | 11 +++++++++++
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h | 6 ++++++
+ .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++++
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 6 ++++++
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c | 1 +
+ drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h | 2 ++
+ 10 files changed, 37 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 1d26e82602f7..ad4afbc37d51 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4616,6 +4616,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev,
+ dc_plane_state->global_alpha_value = plane_info.global_alpha_value;
+ dc_plane_state->dcc = plane_info.dcc;
+ dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0
++ dc_plane_state->flip_int_enabled = true;
+
+ /*
+ * Always set input transfer function, since plane state is refreshed
+diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
+index 3aedadb34548..414b44b4ced4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc.h
++++ b/drivers/gpu/drm/amd/display/dc/dc.h
+@@ -889,6 +889,7 @@ struct dc_plane_state {
+ int layer_index;
+
+ union surface_update_flags update_flags;
++ bool flip_int_enabled;
+ /* private to DC core */
+ struct dc_plane_status status;
+ struct dc_context *ctx;
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+index 9e796dfeac20..714c71a5fbde 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c
+@@ -1257,6 +1257,16 @@ void hubp1_soft_reset(struct hubp *hubp, bool reset)
+ REG_UPDATE(DCHUBP_CNTL, HUBP_DISABLE, reset ? 1 : 0);
+ }
+
++void hubp1_set_flip_int(struct hubp *hubp)
++{
++ struct dcn10_hubp *hubp1 = TO_DCN10_HUBP(hubp);
++
++ REG_UPDATE(DCSURF_SURFACE_FLIP_INTERRUPT,
++ SURFACE_FLIP_INT_MASK, 1);
++
++ return;
++}
++
+ void hubp1_init(struct hubp *hubp)
+ {
+ //do nothing
+@@ -1290,6 +1300,7 @@ static const struct hubp_funcs dcn10_hubp_funcs = {
+ .dmdata_load = NULL,
+ .hubp_soft_reset = hubp1_soft_reset,
+ .hubp_in_blank = hubp1_in_blank,
++ .hubp_set_flip_int = hubp1_set_flip_int,
+ };
+
+ /*****************************************/
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h
+index a9a6ed7f4f99..e2f2f6995935 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.h
+@@ -74,6 +74,7 @@
+ SRI(DCSURF_SURFACE_EARLIEST_INUSE_C, HUBPREQ, id),\
+ SRI(DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C, HUBPREQ, id),\
+ SRI(DCSURF_SURFACE_CONTROL, HUBPREQ, id),\
++ SRI(DCSURF_SURFACE_FLIP_INTERRUPT, HUBPREQ, id),\
+ SRI(HUBPRET_CONTROL, HUBPRET, id),\
+ SRI(DCN_EXPANSION_MODE, HUBPREQ, id),\
+ SRI(DCHUBP_REQ_SIZE_CONFIG, HUBP, id),\
+@@ -183,6 +184,7 @@
+ uint32_t DCSURF_SURFACE_EARLIEST_INUSE_C; \
+ uint32_t DCSURF_SURFACE_EARLIEST_INUSE_HIGH_C; \
+ uint32_t DCSURF_SURFACE_CONTROL; \
++ uint32_t DCSURF_SURFACE_FLIP_INTERRUPT; \
+ uint32_t HUBPRET_CONTROL; \
+ uint32_t DCN_EXPANSION_MODE; \
+ uint32_t DCHUBP_REQ_SIZE_CONFIG; \
+@@ -332,6 +334,7 @@
+ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_META_SURFACE_TMZ_C, mask_sh),\
+ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_EN, mask_sh),\
+ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_CONTROL, SECONDARY_SURFACE_DCC_IND_64B_BLK, mask_sh),\
++ HUBP_SF(HUBPREQ0_DCSURF_SURFACE_FLIP_INTERRUPT, SURFACE_FLIP_INT_MASK, mask_sh),\
+ HUBP_SF(HUBPRET0_HUBPRET_CONTROL, DET_BUF_PLANE1_BASE_ADDRESS, mask_sh),\
+ HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CB_B, mask_sh),\
+ HUBP_SF(HUBPRET0_HUBPRET_CONTROL, CROSSBAR_SRC_CR_R, mask_sh),\
+@@ -531,6 +534,7 @@
+ type PRIMARY_SURFACE_DCC_IND_64B_BLK;\
+ type SECONDARY_SURFACE_DCC_EN;\
+ type SECONDARY_SURFACE_DCC_IND_64B_BLK;\
++ type SURFACE_FLIP_INT_MASK;\
+ type DET_BUF_PLANE1_BASE_ADDRESS;\
+ type CROSSBAR_SRC_CB_B;\
+ type CROSSBAR_SRC_CR_R;\
+@@ -777,4 +781,6 @@ void hubp1_read_state_common(struct hubp *hubp);
+ bool hubp1_in_blank(struct hubp *hubp);
+ void hubp1_soft_reset(struct hubp *hubp, bool reset);
+
++void hubp1_set_flip_int(struct hubp *hubp);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index 017b67b830e6..3e86e042de0d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -2195,6 +2195,13 @@ static void dcn10_enable_plane(
+ if (dc->debug.sanity_checks) {
+ hws->funcs.verify_allow_pstate_change_high(dc);
+ }
++
++ if (!pipe_ctx->top_pipe
++ && pipe_ctx->plane_state
++ && pipe_ctx->plane_state->flip_int_enabled
++ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int)
++ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp);
++
+ }
+
+ void dcn10_program_gamut_remap(struct pipe_ctx *pipe_ctx)
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
+index 0df0da2e6a4d..bec7059f6d5d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
+@@ -1597,6 +1597,7 @@ static struct hubp_funcs dcn20_hubp_funcs = {
+ .validate_dml_output = hubp2_validate_dml_output,
+ .hubp_in_blank = hubp1_in_blank,
+ .hubp_soft_reset = hubp1_soft_reset,
++ .hubp_set_flip_int = hubp1_set_flip_int,
+ };
+
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index 09b9732424e1..077ba9cf69c5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1146,6 +1146,12 @@ void dcn20_enable_plane(
+ pipe_ctx->plane_res.hubp->funcs->hubp_set_vm_system_aperture_settings(pipe_ctx->plane_res.hubp, &apt);
+ }
+
++ if (!pipe_ctx->top_pipe
++ && pipe_ctx->plane_state
++ && pipe_ctx->plane_state->flip_int_enabled
++ && pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int)
++ pipe_ctx->plane_res.hubp->funcs->hubp_set_flip_int(pipe_ctx->plane_res.hubp);
++
+ // if (dc->debug.sanity_checks) {
+ // dcn10_verify_allow_pstate_change_high(dc);
+ // }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
+index f9045852728f..b0c9180b808f 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c
+@@ -838,6 +838,7 @@ static struct hubp_funcs dcn21_hubp_funcs = {
+ .hubp_set_flip_control_surface_gsl = hubp2_set_flip_control_surface_gsl,
+ .hubp_init = hubp21_init,
+ .validate_dml_output = hubp21_validate_dml_output,
++ .hubp_set_flip_int = hubp1_set_flip_int,
+ };
+
+ bool hubp21_construct(
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
+index 88ffa9ff1ed1..f24612523248 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hubp.c
+@@ -511,6 +511,7 @@ static struct hubp_funcs dcn30_hubp_funcs = {
+ .hubp_init = hubp3_init,
+ .hubp_in_blank = hubp1_in_blank,
+ .hubp_soft_reset = hubp1_soft_reset,
++ .hubp_set_flip_int = hubp1_set_flip_int,
+ };
+
+ bool hubp3_construct(
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h
+index 22f3f643ed1b..346dcd87dc10 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/hubp.h
+@@ -191,6 +191,8 @@ struct hubp_funcs {
+ bool (*hubp_in_blank)(struct hubp *hubp);
+ void (*hubp_soft_reset)(struct hubp *hubp, bool reset);
+
++ void (*hubp_set_flip_int)(struct hubp *hubp);
++
+ };
+
+ #endif
+--
+2.30.1
+
--- /dev/null
+From 5f33b46209e2ba6b5328575b080b0bb96a8ce040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 18:15:30 -0500
+Subject: drm/amd/display: Enabled pipe harvesting in dcn30
+
+From: Dillon Varone <dillon.varone@amd.com>
+
+[ Upstream commit d2c91285958a3e77db99c352c136af4243f8f529 ]
+
+[Why & How]
+Ported logic from dcn21 for reading in pipe fusing to dcn30.
+Supported configurations are 1 and 6 pipes. Invalid fusing
+will revert to 1 pipe being enabled.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Dillon Varone <dillon.varone@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Eryk Brol <eryk.brol@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/dcn30/dcn30_resource.c | 31 +++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+index 5e126fdf6ec1..7ec8936346b2 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+@@ -2601,6 +2601,19 @@ static const struct resource_funcs dcn30_res_pool_funcs = {
+ .patch_unknown_plane_state = dcn20_patch_unknown_plane_state,
+ };
+
++#define CTX ctx
++
++#define REG(reg_name) \
++ (DCN_BASE.instance[0].segment[mm ## reg_name ## _BASE_IDX] + mm ## reg_name)
++
++static uint32_t read_pipe_fuses(struct dc_context *ctx)
++{
++ uint32_t value = REG_READ(CC_DC_PIPE_DIS);
++ /* Support for max 6 pipes */
++ value = value & 0x3f;
++ return value;
++}
++
+ static bool dcn30_resource_construct(
+ uint8_t num_virtual_links,
+ struct dc *dc,
+@@ -2610,6 +2623,15 @@ static bool dcn30_resource_construct(
+ struct dc_context *ctx = dc->ctx;
+ struct irq_service_init_data init_data;
+ struct ddc_service_init_data ddc_init_data;
++ uint32_t pipe_fuses = read_pipe_fuses(ctx);
++ uint32_t num_pipes = 0;
++
++ if (!(pipe_fuses == 0 || pipe_fuses == 0x3e)) {
++ BREAK_TO_DEBUGGER();
++ dm_error("DC: Unexpected fuse recipe for navi2x !\n");
++ /* fault to single pipe */
++ pipe_fuses = 0x3e;
++ }
+
+ DC_FP_START();
+
+@@ -2739,6 +2761,15 @@ static bool dcn30_resource_construct(
+ /* PP Lib and SMU interfaces */
+ init_soc_bounding_box(dc, pool);
+
++ num_pipes = dcn3_0_ip.max_num_dpp;
++
++ for (i = 0; i < dcn3_0_ip.max_num_dpp; i++)
++ if (pipe_fuses & 1 << i)
++ num_pipes--;
++
++ dcn3_0_ip.max_num_dpp = num_pipes;
++ dcn3_0_ip.max_num_otg = num_pipes;
++
+ dml_init_instance(&dc->dml, &dcn3_0_soc, &dcn3_0_ip, DML_PROJECT_DCN30);
+
+ /* IRQ */
+--
+2.30.1
+
--- /dev/null
+From 9a9bd89885cf3f214e4ca89dc278bef519b8a855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 13:20:43 -0500
+Subject: drm/amd/display: Revert dram_clock_change_latency for DCN2.1
+
+From: Sung Lee <sung.lee@amd.com>
+
+[ Upstream commit b0075d114c33580f5c9fa9cee8e13d06db41471b ]
+
+[WHY & HOW]
+Using values provided by DF for latency may cause hangs in
+multi display configurations. Revert change to previous value.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Sung Lee <sung.lee@amd.com>
+Reviewed-by: Haonan Wang <Haonan.Wang2@amd.com>
+Acked-by: Eryk Brol <eryk.brol@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+index 4caeab6a09b3..4a3df13c9e49 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c
+@@ -296,7 +296,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = {
+ .num_banks = 8,
+ .num_chans = 4,
+ .vmm_page_size_bytes = 4096,
+- .dram_clock_change_latency_us = 11.72,
++ .dram_clock_change_latency_us = 23.84,
+ .return_bus_width_bytes = 64,
+ .dispclk_dppclk_vco_speed_mhz = 3600,
+ .xfc_bus_transport_time_us = 4,
+--
+2.30.1
+
--- /dev/null
+From 4d8b93b89183015ce571870ead1065e062943da4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 20:28:22 -0500
+Subject: drm/amdgpu/display: Use wm_table.entries for dcn301 calculate_wm
+
+From: Zhan Liu <zhan.liu@amd.com>
+
+[ Upstream commit eda29602f1a8b2b32d8c8c354232d9d1ee1c064d ]
+
+[Why]
+For DGPU Navi, the wm_table.nv_entries are used. These entires are not
+populated for DCN301 Vangogh APU, but instead wm_table.entries are.
+
+[How]
+Use DCN21 Renoir style wm calculations.
+
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Zhan Liu <zhan.liu@amd.com>
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Zhan Liu <zhan.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/dcn301/dcn301_resource.c | 96 ++++++++++++++++++-
+ 1 file changed, 95 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
+index 35f5bf08ae96..23bc208cbfa4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c
+@@ -1722,12 +1722,106 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b
+ dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30);
+ }
+
++static void calculate_wm_set_for_vlevel(
++ int vlevel,
++ struct wm_range_table_entry *table_entry,
++ struct dcn_watermarks *wm_set,
++ struct display_mode_lib *dml,
++ display_e2e_pipe_params_st *pipes,
++ int pipe_cnt)
++{
++ double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us;
++
++ ASSERT(vlevel < dml->soc.num_states);
++ /* only pipe 0 is read for voltage and dcf/soc clocks */
++ pipes[0].clks_cfg.voltage = vlevel;
++ pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz;
++ pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz;
++
++ dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us;
++ dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us;
++ dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us;
++
++ wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000;
++ wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000;
++ wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000;
++ wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000;
++ wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000;
++ wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000;
++ wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000;
++ wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000;
++ dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached;
++
++}
++
++static void dcn301_calculate_wm_and_dlg(
++ struct dc *dc, struct dc_state *context,
++ display_e2e_pipe_params_st *pipes,
++ int pipe_cnt,
++ int vlevel_req)
++{
++ int i, pipe_idx;
++ int vlevel, vlevel_max;
++ struct wm_range_table_entry *table_entry;
++ struct clk_bw_params *bw_params = dc->clk_mgr->bw_params;
++
++ ASSERT(bw_params);
++
++ vlevel_max = bw_params->clk_table.num_entries - 1;
++
++ /* WM Set D */
++ table_entry = &bw_params->wm_table.entries[WM_D];
++ if (table_entry->wm_type == WM_TYPE_RETRAINING)
++ vlevel = 0;
++ else
++ vlevel = vlevel_max;
++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d,
++ &context->bw_ctx.dml, pipes, pipe_cnt);
++ /* WM Set C */
++ table_entry = &bw_params->wm_table.entries[WM_C];
++ vlevel = min(max(vlevel_req, 2), vlevel_max);
++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c,
++ &context->bw_ctx.dml, pipes, pipe_cnt);
++ /* WM Set B */
++ table_entry = &bw_params->wm_table.entries[WM_B];
++ vlevel = min(max(vlevel_req, 1), vlevel_max);
++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b,
++ &context->bw_ctx.dml, pipes, pipe_cnt);
++
++ /* WM Set A */
++ table_entry = &bw_params->wm_table.entries[WM_A];
++ vlevel = min(vlevel_req, vlevel_max);
++ calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a,
++ &context->bw_ctx.dml, pipes, pipe_cnt);
++
++ for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
++ if (!context->res_ctx.pipe_ctx[i].stream)
++ continue;
++
++ pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt);
++ pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
++
++ if (dc->config.forced_clocks) {
++ pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz;
++ pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz;
++ }
++ if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000)
++ pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0;
++ if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000)
++ pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0;
++
++ pipe_idx++;
++ }
++
++ dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel);
++}
++
+ static struct resource_funcs dcn301_res_pool_funcs = {
+ .destroy = dcn301_destroy_resource_pool,
+ .link_enc_create = dcn301_link_encoder_create,
+ .panel_cntl_create = dcn301_panel_cntl_create,
+ .validate_bandwidth = dcn30_validate_bandwidth,
+- .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg,
++ .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg,
+ .populate_dml_pipes = dcn30_populate_dml_pipes_from_context,
+ .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer,
+ .add_stream_to_ctx = dcn30_add_stream_to_ctx,
+--
+2.30.1
+
--- /dev/null
+From cd7593d6f67b69ef51faa24ae1305b90b0b82766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 15:22:22 +0100
+Subject: drm/amdgpu: fb BO should be ttm_bo_type_device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit 521f04f9e3ffc73ef96c776035f8a0a31b4cdd81 ]
+
+FB BO should not be ttm_bo_type_kernel type and
+amdgpufb_create_pinned_object() pins the FB BO anyway.
+
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+index 0bf7d36c6686..5b716404eee1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev,
+ size = mode_cmd->pitches[0] * height;
+ aligned_size = ALIGN(size, PAGE_SIZE);
+ ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags,
+- ttm_bo_type_kernel, NULL, &gobj);
++ ttm_bo_type_device, NULL, &gobj);
+ if (ret) {
+ pr_err("failed to allocate framebuffer (%d)\n", aligned_size);
+ return -ENOMEM;
+--
+2.30.1
+
--- /dev/null
+From ccaa124269591d58e234cbfa155220d82dbeb001 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 19:22:13 +0100
+Subject: drm/radeon: fix AGP dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit cba2afb65cb05c3d197d17323fee4e3c9edef9cd ]
+
+When AGP is compiled as module radeon must be compiled as module as
+well.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
+index af6c6d214d91..f0c0ccdc8a10 100644
+--- a/drivers/gpu/drm/Kconfig
++++ b/drivers/gpu/drm/Kconfig
+@@ -232,6 +232,7 @@ source "drivers/gpu/drm/arm/Kconfig"
+ config DRM_RADEON
+ tristate "ATI Radeon"
+ depends on DRM && PCI && MMU
++ depends on AGP || !AGP
+ select FW_LOADER
+ select DRM_KMS_HELPER
+ select DRM_TTM
+--
+2.30.1
+
--- /dev/null
+From 2e11f352b5ae952e622d0e39b0836f605c9002f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 11:11:09 -0500
+Subject: gfs2: fix use-after-free in trans_drain
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 1a5a2cfd34c17db73c53ef127272c8c1ae220485 ]
+
+This patch adds code to function trans_drain to remove drained
+bd elements from the ail lists, if queued, before freeing the bd.
+If we don't remove the bd from the ail, function ail_drain will
+try to reference the bd after it has been freed by trans_drain.
+
+Thanks to Andy Price for his analysis of the problem.
+
+Reported-by: Andy Price <anprice@redhat.com>
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/log.c | 4 ++++
+ fs/gfs2/trans.c | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 2e9314091c81..1955dea999f7 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr)
+ while (!list_empty(head)) {
+ bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
+ list_del_init(&bd->bd_list);
++ if (!list_empty(&bd->bd_ail_st_list))
++ gfs2_remove_from_ail(bd);
+ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ }
+ head = &tr->tr_databuf;
+ while (!list_empty(head)) {
+ bd = list_first_entry(head, struct gfs2_bufdata, bd_list);
+ list_del_init(&bd->bd_list);
++ if (!list_empty(&bd->bd_ail_st_list))
++ gfs2_remove_from_ail(bd);
+ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ }
+ }
+diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c
+index 6d4bf7ea7b3b..7f850ff6a05d 100644
+--- a/fs/gfs2/trans.c
++++ b/fs/gfs2/trans.c
+@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl,
+ bd->bd_bh = bh;
+ bd->bd_gl = gl;
+ INIT_LIST_HEAD(&bd->bd_list);
++ INIT_LIST_HEAD(&bd->bd_ail_st_list);
++ INIT_LIST_HEAD(&bd->bd_ail_gl_list);
+ bh->b_private = bd;
+ return bd;
+ }
+--
+2.30.1
+
--- /dev/null
+From 1c9e92fbd8691b17abd1b46f89f03b30376dd728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 20:52:52 +0100
+Subject: gianfar: fix jumbo packets+napi+rx overrun crash
+
+From: Michael Braun <michael-dev@fami-braun.de>
+
+[ Upstream commit d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f ]
+
+When using jumbo packets and overrunning rx queue with napi enabled,
+the following sequence is observed in gfar_add_rx_frag:
+
+ | lstatus | | skb |
+t | lstatus, size, flags | first | len, data_len, *ptr |
+---+--------------------------------------+-------+-----------------------+
+13 | 18002348, 9032, INTERRUPT LAST | 0 | 9600, 8000, f554c12e |
+12 | 10000640, 1600, INTERRUPT | 0 | 8000, 6400, f554c12e |
+11 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, f554c12e |
+10 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, f554c12e |
+09 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, f554c12e |
+08 | 14000640, 1600, INTERRUPT FIRST | 0 | 1600, 0, f554c12e |
+07 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, f554c12e |
+06 | 1c000080, 128, INTERRUPT LAST FIRST | 1 | 0, 0, abf3bd6e |
+05 | 18002348, 9032, INTERRUPT LAST | 0 | 8000, 6400, c5a57780 |
+04 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, c5a57780 |
+03 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, c5a57780 |
+02 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, c5a57780 |
+01 | 10000640, 1600, INTERRUPT | 0 | 1600, 0, c5a57780 |
+00 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, c5a57780 |
+
+So at t=7 a new packets is started but not finished, probably due to rx
+overrun - but rx overrun is not indicated in the flags. Instead a new
+packets starts at t=8. This results in skb->len to exceed size for the LAST
+fragment at t=13 and thus a negative fragment size added to the skb.
+
+This then crashes:
+
+kernel BUG at include/linux/skbuff.h:2277!
+Oops: Exception in kernel mode, sig: 5 [#1]
+...
+NIP [c04689f4] skb_pull+0x2c/0x48
+LR [c03f62ac] gfar_clean_rx_ring+0x2e4/0x844
+Call Trace:
+[ec4bfd38] [c06a84c4] _raw_spin_unlock_irqrestore+0x60/0x7c (unreliable)
+[ec4bfda8] [c03f6a44] gfar_poll_rx_sq+0x48/0xe4
+[ec4bfdc8] [c048d504] __napi_poll+0x54/0x26c
+[ec4bfdf8] [c048d908] net_rx_action+0x138/0x2c0
+[ec4bfe68] [c06a8f34] __do_softirq+0x3a4/0x4fc
+[ec4bfed8] [c0040150] run_ksoftirqd+0x58/0x70
+[ec4bfee8] [c0066ecc] smpboot_thread_fn+0x184/0x1cc
+[ec4bff08] [c0062718] kthread+0x140/0x144
+[ec4bff38] [c0012350] ret_from_kernel_thread+0x14/0x1c
+
+This patch fixes this by checking for computed LAST fragment size, so a
+negative sized fragment is never added.
+In order to prevent the newer rx frame from getting corrupted, the FIRST
+flag is checked to discard the incomplete older frame.
+
+Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index d391a45cebb6..4fab2ee5bbf5 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
+ if (lstatus & BD_LFLAG(RXBD_LAST))
+ size -= skb->len;
+
++ WARN(size < 0, "gianfar: rx fragment size underflow");
++ if (size < 0)
++ return false;
++
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+ rxb->page_offset + RXBUF_ALIGNMENT,
+ size, GFAR_RXB_TRUESIZE);
+@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue,
+ if (lstatus & BD_LFLAG(RXBD_EMPTY))
+ break;
+
++ /* lost RXBD_LAST descriptor due to overrun */
++ if (skb &&
++ (lstatus & BD_LFLAG(RXBD_FIRST))) {
++ /* discard faulty buffer */
++ dev_kfree_skb(skb);
++ skb = NULL;
++ rx_queue->stats.rx_dropped++;
++
++ /* can continue normally */
++ }
++
+ /* order rx buffer descriptor reads */
+ rmb();
+
+--
+2.30.1
+
--- /dev/null
+From 1ec83cb98c02794c2437ce09356cd8ea32e21d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 16:35:58 +0800
+Subject: gpiolib: acpi: Add missing IRQF_ONESHOT
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 6e5d5791730b55a1f987e1db84b078b91eb49e99 ]
+
+fixed the following coccicheck:
+./drivers/gpio/gpiolib-acpi.c:176:7-27: ERROR: Threaded IRQ with no
+primary handler requested without IRQF_ONESHOT
+
+Make sure threaded IRQs without a primary handler are always request
+with IRQF_ONESHOT
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
+index 495f779b2ab9..1aacd2a5a1fd 100644
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio,
+ int ret, value;
+
+ ret = request_threaded_irq(event->irq, NULL, event->handler,
+- event->irqflags, "ACPI:Event", event);
++ event->irqflags | IRQF_ONESHOT, "ACPI:Event", event);
+ if (ret) {
+ dev_err(acpi_gpio->chip->parent,
+ "Failed to setup interrupt handler for %d\n",
+--
+2.30.1
+
--- /dev/null
+From bcfc1480c49d6eb278a85e942dde4364b4c92ede Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 14:05:33 +0200
+Subject: habanalabs: Call put_pid() when releasing control device
+
+From: Tomer Tayar <ttayar@habana.ai>
+
+[ Upstream commit 27ac5aada024e0821c86540ad18f37edadd77d5e ]
+
+The refcount of the "hl_fpriv" structure is not used for the control
+device, and thus hl_hpriv_put() is not called when releasing this
+device.
+This results with no call to put_pid(), so add it explicitly in
+hl_device_release_ctrl().
+
+Signed-off-by: Tomer Tayar <ttayar@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
+index 69d04eca767f..6785329eee27 100644
+--- a/drivers/misc/habanalabs/common/device.c
++++ b/drivers/misc/habanalabs/common/device.c
+@@ -117,6 +117,8 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)
+ list_del(&hpriv->dev_node);
+ mutex_unlock(&hdev->fpriv_list_lock);
+
++ put_pid(hpriv->taskpid);
++
+ kfree(hpriv);
+
+ return 0;
+--
+2.30.1
+
--- /dev/null
+From 49c59e9e8685a4081f0b4c8abb5931354f405ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 19:44:34 +0200
+Subject: habanalabs: Disable file operations after device is removed
+
+From: Tomer Tayar <ttayar@habana.ai>
+
+[ Upstream commit ffd123fe839700366ea79b19ac3683bf56817372 ]
+
+A device can be removed from the PCI subsystem while a process holds the
+file descriptor opened.
+In such a case, the driver attempts to kill the process, but as it is
+still possible that the process will be alive after this step, the
+device removal will complete, and we will end up with a process object
+that points to a device object which was already released.
+
+To prevent the usage of this released device object, disable the
+following file operations for this process object, and avoid the cleanup
+steps when the file descriptor is eventually closed.
+The latter is just a best effort, as memory leak will occur.
+
+Signed-off-by: Tomer Tayar <ttayar@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/device.c | 40 ++++++++++++++++---
+ .../misc/habanalabs/common/habanalabs_ioctl.c | 12 ++++++
+ 2 files changed, 46 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
+index 6785329eee27..82c0306a9210 100644
+--- a/drivers/misc/habanalabs/common/device.c
++++ b/drivers/misc/habanalabs/common/device.c
+@@ -93,12 +93,19 @@ void hl_hpriv_put(struct hl_fpriv *hpriv)
+ static int hl_device_release(struct inode *inode, struct file *filp)
+ {
+ struct hl_fpriv *hpriv = filp->private_data;
++ struct hl_device *hdev = hpriv->hdev;
++
++ filp->private_data = NULL;
++
++ if (!hdev) {
++ pr_crit("Closing FD after device was removed. Memory leak will occur and it is advised to reboot.\n");
++ put_pid(hpriv->taskpid);
++ return 0;
++ }
+
+ hl_cb_mgr_fini(hpriv->hdev, &hpriv->cb_mgr);
+ hl_ctx_mgr_fini(hpriv->hdev, &hpriv->ctx_mgr);
+
+- filp->private_data = NULL;
+-
+ hl_hpriv_put(hpriv);
+
+ return 0;
+@@ -107,16 +114,19 @@ static int hl_device_release(struct inode *inode, struct file *filp)
+ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)
+ {
+ struct hl_fpriv *hpriv = filp->private_data;
+- struct hl_device *hdev;
++ struct hl_device *hdev = hpriv->hdev;
+
+ filp->private_data = NULL;
+
+- hdev = hpriv->hdev;
++ if (!hdev) {
++ pr_err("Closing FD after device was removed\n");
++ goto out;
++ }
+
+ mutex_lock(&hdev->fpriv_list_lock);
+ list_del(&hpriv->dev_node);
+ mutex_unlock(&hdev->fpriv_list_lock);
+-
++out:
+ put_pid(hpriv->taskpid);
+
+ kfree(hpriv);
+@@ -136,8 +146,14 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp)
+ static int hl_mmap(struct file *filp, struct vm_area_struct *vma)
+ {
+ struct hl_fpriv *hpriv = filp->private_data;
++ struct hl_device *hdev = hpriv->hdev;
+ unsigned long vm_pgoff;
+
++ if (!hdev) {
++ pr_err_ratelimited("Trying to mmap after device was removed! Please close FD\n");
++ return -ENODEV;
++ }
++
+ vm_pgoff = vma->vm_pgoff;
+ vma->vm_pgoff = HL_MMAP_OFFSET_VALUE_GET(vm_pgoff);
+
+@@ -884,6 +900,16 @@ static int device_kill_open_processes(struct hl_device *hdev, u32 timeout)
+ return -EBUSY;
+ }
+
++static void device_disable_open_processes(struct hl_device *hdev)
++{
++ struct hl_fpriv *hpriv;
++
++ mutex_lock(&hdev->fpriv_list_lock);
++ list_for_each_entry(hpriv, &hdev->fpriv_list, dev_node)
++ hpriv->hdev = NULL;
++ mutex_unlock(&hdev->fpriv_list_lock);
++}
++
+ /*
+ * hl_device_reset - reset the device
+ *
+@@ -1538,8 +1564,10 @@ void hl_device_fini(struct hl_device *hdev)
+ HL_PENDING_RESET_LONG_SEC);
+
+ rc = device_kill_open_processes(hdev, HL_PENDING_RESET_LONG_SEC);
+- if (rc)
++ if (rc) {
+ dev_crit(hdev->dev, "Failed to kill all open processes\n");
++ device_disable_open_processes(hdev);
++ }
+
+ hl_cb_pool_fini(hdev);
+
+diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/misc/habanalabs/common/habanalabs_ioctl.c
+index d25892d61ec9..0805e1173d54 100644
+--- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c
++++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c
+@@ -5,6 +5,8 @@
+ * All Rights Reserved.
+ */
+
++#define pr_fmt(fmt) "habanalabs: " fmt
++
+ #include <uapi/misc/habanalabs.h>
+ #include "habanalabs.h"
+
+@@ -667,6 +669,11 @@ long hl_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ const struct hl_ioctl_desc *ioctl = NULL;
+ unsigned int nr = _IOC_NR(cmd);
+
++ if (!hdev) {
++ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n");
++ return -ENODEV;
++ }
++
+ if ((nr >= HL_COMMAND_START) && (nr < HL_COMMAND_END)) {
+ ioctl = &hl_ioctls[nr];
+ } else {
+@@ -685,6 +692,11 @@ long hl_ioctl_control(struct file *filep, unsigned int cmd, unsigned long arg)
+ const struct hl_ioctl_desc *ioctl = NULL;
+ unsigned int nr = _IOC_NR(cmd);
+
++ if (!hdev) {
++ pr_err_ratelimited("Sending ioctl after device was removed! Please close FD\n");
++ return -ENODEV;
++ }
++
+ if (nr == _IOC_NR(HL_IOCTL_INFO)) {
+ ioctl = &hl_ioctls_control[nr];
+ } else {
+--
+2.30.1
+
--- /dev/null
+From 605aae66eceaf5f9d5fca2a2636b364af5f3c1ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 21:08:23 -0800
+Subject: ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
+
+From: Sergei Trofimovich <slyfox@gentoo.org>
+
+[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ]
+
+In https://bugs.gentoo.org/769614 Dmitry noticed that
+`ptrace(PTRACE_GET_SYSCALL_INFO)` does not work for syscalls called via
+glibc's syscall() wrapper.
+
+ia64 has two ways to call syscalls from userspace: via `break` and via
+`eps` instructions.
+
+The difference is in stack layout:
+
+1. `eps` creates simple stack frame: no locals, in{0..7} == out{0..8}
+2. `break` uses userspace stack frame: may be locals (glibc provides
+ one), in{0..7} == out{0..8}.
+
+Both work fine in syscall handling cde itself.
+
+But `ptrace(PTRACE_GET_SYSCALL_INFO)` uses unwind mechanism to
+re-extract syscall arguments but it does not account for locals.
+
+The change always skips locals registers. It should not change `eps`
+path as kernel's handler already enforces locals=0 and fixes `break`.
+
+Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
+
+Link: https://lkml.kernel.org/r/20210221002554.333076-1-slyfox@gentoo.org
+Link: https://bugs.gentoo.org/769614
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Reported-by: Dmitry V. Levin <ldv@altlinux.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
+index c3490ee2daa5..e14f5653393a 100644
+--- a/arch/ia64/kernel/ptrace.c
++++ b/arch/ia64/kernel/ptrace.c
+@@ -2013,27 +2013,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data)
+ {
+ struct syscall_get_set_args *args = data;
+ struct pt_regs *pt = args->regs;
+- unsigned long *krbs, cfm, ndirty;
++ unsigned long *krbs, cfm, ndirty, nlocals, nouts;
+ int i, count;
+
+ if (unw_unwind_to_user(info) < 0)
+ return;
+
++ /*
++ * We get here via a few paths:
++ * - break instruction: cfm is shared with caller.
++ * syscall args are in out= regs, locals are non-empty.
++ * - epsinstruction: cfm is set by br.call
++ * locals don't exist.
++ *
++ * For both cases argguments are reachable in cfm.sof - cfm.sol.
++ * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ]
++ */
+ cfm = pt->cr_ifs;
++ nlocals = (cfm >> 7) & 0x7f; /* aka sol */
++ nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */
+ krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8;
+ ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19));
+
+ count = 0;
+ if (in_syscall(pt))
+- count = min_t(int, args->n, cfm & 0x7f);
++ count = min_t(int, args->n, nouts);
+
++ /* Iterate over outs. */
+ for (i = 0; i < count; i++) {
++ int j = ndirty + nlocals + i + args->i;
+ if (args->rw)
+- *ia64_rse_skip_regs(krbs, ndirty + i + args->i) =
+- args->args[i];
++ *ia64_rse_skip_regs(krbs, j) = args->args[i];
+ else
+- args->args[i] = *ia64_rse_skip_regs(krbs,
+- ndirty + i + args->i);
++ args->args[i] = *ia64_rse_skip_regs(krbs, j);
+ }
+
+ if (!args->rw) {
+--
+2.30.1
+
--- /dev/null
+From 0fac16da35a1b9b835b7f48a5cd01ae2b7e7f550 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 21:08:27 -0800
+Subject: ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
+
+From: Sergei Trofimovich <slyfox@gentoo.org>
+
+[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ]
+
+In https://bugs.gentoo.org/769614 Dmitry noticed that
+`ptrace(PTRACE_GET_SYSCALL_INFO)` does not return error sign properly.
+
+The bug is in mismatch between get/set errors:
+
+static inline long syscall_get_error(struct task_struct *task,
+ struct pt_regs *regs)
+{
+ return regs->r10 == -1 ? regs->r8:0;
+}
+
+static inline long syscall_get_return_value(struct task_struct *task,
+ struct pt_regs *regs)
+{
+ return regs->r8;
+}
+
+static inline void syscall_set_return_value(struct task_struct *task,
+ struct pt_regs *regs,
+ int error, long val)
+{
+ if (error) {
+ /* error < 0, but ia64 uses > 0 return value */
+ regs->r8 = -error;
+ regs->r10 = -1;
+ } else {
+ regs->r8 = val;
+ regs->r10 = 0;
+ }
+}
+
+Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
+
+Link: https://lkml.kernel.org/r/20210221002554.333076-2-slyfox@gentoo.org
+Link: https://bugs.gentoo.org/769614
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Reported-by: Dmitry V. Levin <ldv@altlinux.org>
+Reviewed-by: Dmitry V. Levin <ldv@altlinux.org>
+Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/include/asm/syscall.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h
+index 6c6f16e409a8..0d23c0049301 100644
+--- a/arch/ia64/include/asm/syscall.h
++++ b/arch/ia64/include/asm/syscall.h
+@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task,
+ static inline long syscall_get_error(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- return regs->r10 == -1 ? regs->r8:0;
++ return regs->r10 == -1 ? -regs->r8:0;
+ }
+
+ static inline long syscall_get_return_value(struct task_struct *task,
+--
+2.30.1
+
--- /dev/null
+From 2c41f6ad6b6f16844f6578c5e1d1936b385d8151 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 23:29:35 +0000
+Subject: io_uring: cancel deferred requests in try_cancel
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit e1915f76a8981f0a750cf56515df42582a37c4b0 ]
+
+As io_uring_cancel_files() and others let SQO to run between
+io_uring_try_cancel_requests(), SQO may generate new deferred requests,
+so it's safer to try to cancel them in it.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index ef078182e7ca..c3cfaa367138 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8861,11 +8861,11 @@ static bool io_cancel_task_cb(struct io_wq_work *work, void *data)
+ return ret;
+ }
+
+-static void io_cancel_defer_files(struct io_ring_ctx *ctx,
++static bool io_cancel_defer_files(struct io_ring_ctx *ctx,
+ struct task_struct *task,
+ struct files_struct *files)
+ {
+- struct io_defer_entry *de = NULL;
++ struct io_defer_entry *de;
+ LIST_HEAD(list);
+
+ spin_lock_irq(&ctx->completion_lock);
+@@ -8876,6 +8876,8 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx,
+ }
+ }
+ spin_unlock_irq(&ctx->completion_lock);
++ if (list_empty(&list))
++ return false;
+
+ while (!list_empty(&list)) {
+ de = list_first_entry(&list, struct io_defer_entry, list);
+@@ -8885,6 +8887,7 @@ static void io_cancel_defer_files(struct io_ring_ctx *ctx,
+ io_req_complete(de->req, -ECANCELED);
+ kfree(de);
+ }
++ return true;
+ }
+
+ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
+@@ -8912,6 +8915,7 @@ static void io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
+ }
+ }
+
++ ret |= io_cancel_defer_files(ctx, task, files);
+ ret |= io_poll_remove_all(ctx, task, files);
+ ret |= io_kill_timeouts(ctx, task, files);
+ ret |= io_run_task_work();
+@@ -8992,8 +8996,6 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
+ io_sq_thread_park(ctx->sq_data);
+ }
+
+- io_cancel_defer_files(ctx, task, files);
+-
+ io_uring_cancel_files(ctx, task, files);
+ if (!files)
+ io_uring_try_cancel_requests(ctx, task, NULL);
+--
+2.30.1
+
--- /dev/null
+From 35d3dcbc3b822b2dd531bbea276b40cbb8a9b665 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 17:20:14 +0000
+Subject: irqchip/ingenic: Add support for the JZ4760
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 5fbecd2389f48e1415799c63130d0cdce1cf3f60 ]
+
+Add support for the interrupt controller found in the JZ4760 SoC, which
+works exactly like the one in the JZ4770.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210307172014.73481-2-paul@crapouillou.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ingenic-tcu.c | 1 +
+ drivers/irqchip/irq-ingenic.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c
+index 7a7222d4c19c..b938d1d04d96 100644
+--- a/drivers/irqchip/irq-ingenic-tcu.c
++++ b/drivers/irqchip/irq-ingenic-tcu.c
+@@ -179,5 +179,6 @@ static int __init ingenic_tcu_irq_init(struct device_node *np,
+ }
+ IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init);
++IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init);
+ IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init);
+diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c
+index b61a8901ef72..ea36bb00be80 100644
+--- a/drivers/irqchip/irq-ingenic.c
++++ b/drivers/irqchip/irq-ingenic.c
+@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node,
+ {
+ return ingenic_intc_of_init(node, 2);
+ }
++IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init);
+ IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init);
+--
+2.30.1
+
--- /dev/null
+From 5237d8db6bfe84d9a9084547aab4b7f496dee2cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 16:08:42 +0800
+Subject: ixgbe: Fix memleak in ixgbe_configure_clsu32
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 7a766381634da19fc837619b0a34590498d9d29a ]
+
+When ixgbe_fdir_write_perfect_filter_82599() fails,
+input allocated by kzalloc() has not been freed,
+which leads to memleak.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 393d1c2cd853..e9c2d28efc81 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter,
+ ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask);
+ err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter,
+ input->sw_idx, queue);
+- if (!err)
+- ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
++ if (err)
++ goto err_out_w_lock;
++
++ ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx);
+ spin_unlock(&adapter->fdir_perfect_lock);
+
+ if ((uhtid != 0x800) && (adapter->jump_tables[uhtid]))
+--
+2.30.1
+
--- /dev/null
+From 0c8154e4fe0d18474e7c0d2307ad0ddaf4029f7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Feb 2021 15:10:25 +0900
+Subject: kbuild: add image_name to no-sync-config-targets
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 993bdde94547887faaad4a97f0b0480a6da271c3 ]
+
+'make image_name' needs include/config/auto.conf to show the correct
+output because KBUILD_IMAGE depends on CONFIG options, but should not
+attempt to resync the configuration.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 824d15c14be0..ace7d6131fa1 100644
+--- a/Makefile
++++ b/Makefile
+@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \
+ $(version_h) headers headers_% archheaders archscripts \
+ %asm-generic kernelversion %src-pkg dt_binding_check \
+ outputmakefile
+-no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease
++no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \
++ image_name
+ single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/
+
+ config-build :=
+--
+2.30.1
+
--- /dev/null
+From 902d23b3eafe8d25b7816071df3d2ed2270973fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:43:14 +0100
+Subject: kbuild: dummy-tools: fix inverted tests for gcc
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit b3d9fc1436808a4ef9927e558b3415e728e710c5 ]
+
+There is a test in Kconfig which takes inverted value of a compiler
+check:
+* config CC_HAS_INT128
+ def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0)
+
+This results in CC_HAS_INT128 not being in super-config generated by
+dummy-tools. So take this into account in the gcc script.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/dummy-tools/gcc | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/scripts/dummy-tools/gcc b/scripts/dummy-tools/gcc
+index 5c113cad5601..0d0589cf8184 100755
+--- a/scripts/dummy-tools/gcc
++++ b/scripts/dummy-tools/gcc
+@@ -85,3 +85,8 @@ if arg_contain -print-file-name=plugin "$@"; then
+ echo $plugin_dir
+ exit 0
+ fi
++
++# inverted return value
++if arg_contain -D__SIZEOF_INT128__=0 "$@"; then
++ exit 1
++fi
+--
+2.30.1
+
--- /dev/null
+From 5d67551e96e43c8356eace800aa01e744f9c57e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Mar 2021 19:03:04 +0000
+Subject: kselftest: arm64: Fix exit code of sve-ptrace
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 07e644885bf6727a48db109fad053cb43f3c9859 ]
+
+We track if sve-ptrace encountered a failure in a variable but don't
+actually use that value when we exit the program, do so.
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210309190304.39169-1-broonie@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+index b2282be6f938..612d3899614a 100644
+--- a/tools/testing/selftests/arm64/fp/sve-ptrace.c
++++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c
+@@ -332,5 +332,5 @@ int main(void)
+
+ ksft_print_cnts();
+
+- return 0;
++ return ret;
+ }
+--
+2.30.1
+
--- /dev/null
+From c2883ede5c48119cb20175d1c7af7758b4bed9df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 21:07:15 -0800
+Subject: mm/fork: clear PASID for new mm
+
+From: Fenghua Yu <fenghua.yu@intel.com>
+
+[ Upstream commit 82e69a121be4b1597ce758534816a8ee04c8b761 ]
+
+When a new mm is created, its PASID should be cleared, i.e. the PASID is
+initialized to its init state 0 on both ARM and X86.
+
+This patch was part of the series introducing mm->pasid, but got lost
+along the way [1]. It still makes sense to have it, because each address
+space has a different PASID. And the IOMMU code in
+iommu_sva_alloc_pasid() expects the pasid field of a new mm struct to be
+cleared.
+
+[1] https://lore.kernel.org/linux-iommu/YDgh53AcQHT+T3L0@otcwcpicx3.sc.intel.com/
+
+Link: https://lkml.kernel.org/r/20210302103837.2562625-1-jean-philippe@linaro.org
+Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm_types.h | 1 +
+ kernel/fork.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 07d9acb5b19c..61c77cfff8c2 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -23,6 +23,7 @@
+ #endif
+ #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1))
+
++#define INIT_PASID 0
+
+ struct address_space;
+ struct mem_cgroup;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index d66cd1014211..808af2cc8ab6 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -994,6 +994,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
+ #endif
+ }
+
++static void mm_init_pasid(struct mm_struct *mm)
++{
++#ifdef CONFIG_IOMMU_SUPPORT
++ mm->pasid = INIT_PASID;
++#endif
++}
++
+ static void mm_init_uprobes_state(struct mm_struct *mm)
+ {
+ #ifdef CONFIG_UPROBES
+@@ -1024,6 +1031,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
+ mm_init_cpumask(mm);
+ mm_init_aio(mm);
+ mm_init_owner(mm, p);
++ mm_init_pasid(mm);
+ RCU_INIT_POINTER(mm->exe_file, NULL);
+ mmu_notifier_subscriptions_init(mm);
+ init_tlb_flush_pending(mm);
+--
+2.30.1
+
--- /dev/null
+From 7fadd90f571388dc091525f2f077a64831d69488 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 14:51:18 +0100
+Subject: mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit ae064fc0e32a4d28389086d9f4b260a0c157cfee ]
+
+When running out of room in the tx queue after calling drv->tx_prepare_skb,
+the buffer list will already have been modified on MT7615 and newer drivers.
+This can leak a DMA mapping and will show up as swiotlb allocation failures
+on x86.
+
+Fix this by moving the queue length check further up. This is less accurate,
+since it can overestimate the needed room in the queue on MT7615 and newer,
+but the difference is small enough to not matter in practice.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210216135119.23809-1-nbd@nbd.name
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
+index 9bf13994c036..680c899a96d7 100644
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -345,7 +345,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+ };
+ struct ieee80211_hw *hw;
+ int len, n = 0, ret = -ENOMEM;
+- struct mt76_queue_entry e;
+ struct mt76_txwi_cache *t;
+ struct sk_buff *iter;
+ dma_addr_t addr;
+@@ -387,6 +386,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+ }
+ tx_info.nbuf = n;
+
++ if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
++ ret = -ENOMEM;
++ goto unmap;
++ }
++
+ dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size,
+ DMA_TO_DEVICE);
+ ret = dev->drv->tx_prepare_skb(dev, txwi, q->qid, wcid, sta, &tx_info);
+@@ -395,11 +399,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+ if (ret < 0)
+ goto unmap;
+
+- if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) {
+- ret = -ENOMEM;
+- goto unmap;
+- }
+-
+ return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf,
+ tx_info.info, tx_info.skb, t);
+
+@@ -415,9 +414,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, struct mt76_queue *q,
+ dev->test.tx_done--;
+ #endif
+
+- e.skb = tx_info.skb;
+- e.txwi = t;
+- dev->drv->tx_complete_skb(dev, &e);
++ dev_kfree_skb(tx_info.skb);
+ mt76_put_txwi(dev, t);
+ return ret;
+ }
+--
+2.30.1
+
--- /dev/null
+From 03d79797a7fde94e74e9addf6305b9cef31bf2dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 14:51:19 +0100
+Subject: mt76: mt7915: only modify tx buffer list after allocating tx token id
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 94f0e6256c2ab6803c935634aa1f653174c94879 ]
+
+Modifying the tx buffer list too early can leak DMA mappings
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210216135119.23809-2-nbd@nbd.name
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+index 1b4d65310b88..c9dd6867e125 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c
+@@ -957,11 +957,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ }
+ txp->nbuf = nbuf;
+
+- /* pass partial skb header to fw */
+- tx_info->buf[1].len = MT_CT_PARSE_LEN;
+- tx_info->buf[1].skip_unmap = true;
+- tx_info->nbuf = MT_CT_DMA_BUF_NUM;
+-
+ txp->flags = cpu_to_le16(MT_CT_INFO_APPLY_TXD | MT_CT_INFO_FROM_HOST);
+
+ if (!key)
+@@ -999,6 +994,11 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ txp->rept_wds_wcid = cpu_to_le16(0x3ff);
+ tx_info->skb = DMA_DUMMY_DATA;
+
++ /* pass partial skb header to fw */
++ tx_info->buf[1].len = MT_CT_PARSE_LEN;
++ tx_info->buf[1].skip_unmap = true;
++ tx_info->nbuf = MT_CT_DMA_BUF_NUM;
++
+ return 0;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From f3e4a6aac8bbf635c9965f628fa58a317980fdbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 13:17:49 +0000
+Subject: net: davicom: Use platform_get_irq_optional()
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 2e2696223676d56db1a93acfca722c1b96cd552d ]
+
+The second IRQ line really is optional, so use
+platform_get_irq_optional() to obtain it.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index a95e95ce9438..252adfa5d837 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1507,7 +1507,7 @@ dm9000_probe(struct platform_device *pdev)
+ goto out;
+ }
+
+- db->irq_wake = platform_get_irq(pdev, 1);
++ db->irq_wake = platform_get_irq_optional(pdev, 1);
+ if (db->irq_wake >= 0) {
+ dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake);
+
+--
+2.30.1
+
--- /dev/null
+From 84c36ee7abe0594b4ec82db6a3c343a9530aeb75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 15:23:38 +0200
+Subject: net: enetc: set MAC RX FIFO to recommended value
+
+From: Alex Marginean <alexandru.marginean@nxp.com>
+
+[ Upstream commit 1b2395dfff5bb40228a187f21f577cd90673d344 ]
+
+On LS1028A, the MAC RX FIFO defaults to the value 2, which is too high
+and may lead to RX lock-up under traffic at a rate higher than 6 Gbps.
+Set it to 1 instead, as recommended by the hardware design team and by
+later versions of the ENETC block guide.
+
+Signed-off-by: Alex Marginean <alexandru.marginean@nxp.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Reviewed-by: Jason Liu <jason.hui.liu@nxp.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_hw.h | 2 ++
+ drivers/net/ethernet/freescale/enetc/enetc_pf.c | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+index de0d20b0f489..00938f7960a4 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX};
+ #define ENETC_PM0_MAXFRM 0x8014
+ #define ENETC_SET_TX_MTU(val) ((val) << 16)
+ #define ENETC_SET_MAXFRM(val) ((val) & 0xffff)
++#define ENETC_PM0_RX_FIFO 0x801c
++#define ENETC_PM0_RX_FIFO_VAL 1
+
+ #define ENETC_PM_IMDIO_BASE 0x8030
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index ca02f033bea2..224fc37a6757 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw)
+
+ enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN |
+ ENETC_PM0_CMD_TXP | ENETC_PM0_PROMISC);
++
++ /* On LS1028A, the MAC RX FIFO defaults to 2, which is too high
++ * and may lead to RX lock-up under traffic. Set it to 1 instead,
++ * as recommended by the hardware team.
++ */
++ enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL);
+ }
+
+ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)
+--
+2.30.1
+
--- /dev/null
+From 4a9223f09721e5d4837bc23c5fc94d6c24d4a44a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 22:15:16 +0100
+Subject: net: fec: ptp: avoid register access when ipg clock is disabled
+
+From: Heiko Thiery <heiko.thiery@gmail.com>
+
+[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ]
+
+When accessing the timecounter register on an i.MX8MQ the kernel hangs.
+This is only the case when the interface is down. This can be reproduced
+by reading with 'phc_ctrl eth0 get'.
+
+Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900
+the igp clock is disabled when the interface is down and leads to a
+system hang.
+
+So we check if the ptp clock status before reading the timecounter
+register.
+
+Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Link: https://lore.kernel.org/r/20210225211514.9115-1-heiko.thiery@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
+index 2e344aada4c6..1753807cbf97 100644
+--- a/drivers/net/ethernet/freescale/fec_ptp.c
++++ b/drivers/net/ethernet/freescale/fec_ptp.c
+@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)
+ u64 ns;
+ unsigned long flags;
+
++ mutex_lock(&adapter->ptp_clk_mutex);
++ /* Check the ptp clock */
++ if (!adapter->ptp_clk_on) {
++ mutex_unlock(&adapter->ptp_clk_mutex);
++ return -EINVAL;
++ }
+ spin_lock_irqsave(&adapter->tmreg_lock, flags);
+ ns = timecounter_read(&adapter->tc);
+ spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
++ mutex_unlock(&adapter->ptp_clk_mutex);
+
+ *ts = ns_to_timespec64(ns);
+
+--
+2.30.1
+
--- /dev/null
+From 2302338c32d2bcf0415d4810d417b11b0dd8618d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 00:40:12 -0800
+Subject: net: hisilicon: hns: fix error return code of
+ hns_nic_clear_all_rx_fetch()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 143c253f42bad20357e7e4432087aca747c43384 ]
+
+When hns_assemble_skb() returns NULL to skb, no error return code of
+hns_nic_clear_all_rx_fetch() is assigned.
+To fix this bug, ret is assigned with -ENOMEM in this case.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 858cb293152a..8bce5f1510be 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev)
+ for (j = 0; j < fetch_num; j++) {
+ /* alloc one skb and init */
+ skb = hns_assemble_skb(ndev);
+- if (!skb)
++ if (!skb) {
++ ret = -ENOMEM;
+ goto out;
++ }
+ rd = &tx_ring_data(priv, skb->queue_mapping);
+ hns_nic_net_xmit_hw(ndev, skb, rd);
+
+--
+2.30.1
+
--- /dev/null
+From 03a4946f8f6a722e6f190f836f61347f9fa72801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 19:10:10 -0800
+Subject: net: intel: iavf: fix error return code of iavf_init_get_resources()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 6650d31f21b8a0043613ae0a4a2e42e49dc20b2d ]
+
+When iavf_process_config() fails, no error return code of
+iavf_init_get_resources() is assigned.
+To fix this bug, err is assigned with the return value of
+iavf_process_config(), and then err is checked.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 0a867d64d467..dc5b3c06d1e0 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter)
+ goto err_alloc;
+ }
+
+- if (iavf_process_config(adapter))
++ err = iavf_process_config(adapter);
++ if (err)
+ goto err_alloc;
+ adapter->current_op = VIRTCHNL_OP_UNKNOWN;
+
+--
+2.30.1
+
--- /dev/null
+From afa68f8379ab8326879da1bbb16e3380c5caded7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:01:12 +0800
+Subject: net: stmmac: fix dma physical address of descriptor when display ring
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+[ Upstream commit bfaf91ca848e758ed7be99b61fd936d03819fa56 ]
+
+Driver uses dma_alloc_coherent to allocate dma memory for descriptors,
+dma_alloc_coherent will return both the virtual address and physical
+address. AFAIK, virt_to_phys could not convert virtual address to
+physical address, for which memory is allocated by dma_alloc_coherent.
+
+dwmac4_display_ring() function is broken for various descriptor, it only
+support normal descriptor(struct dma_desc) now, this patch also extends to
+support all descriptor types.
+
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/stmicro/stmmac/dwmac4_descs.c | 50 +++++++++++++---
+ .../net/ethernet/stmicro/stmmac/enh_desc.c | 9 ++-
+ drivers/net/ethernet/stmicro/stmmac/hwif.h | 3 +-
+ .../net/ethernet/stmicro/stmmac/norm_desc.c | 9 ++-
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 57 ++++++++++++-------
+ 5 files changed, 94 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+index 2ecd3a8a690c..cbf4429fb1d2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p)
+ p->des2 |= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION);
+ }
+
+-static void dwmac4_display_ring(void *head, unsigned int size, bool rx)
++static void dwmac4_display_ring(void *head, unsigned int size, bool rx,
++ dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+- struct dma_desc *p = (struct dma_desc *)head;
++ dma_addr_t dma_addr;
+ int i;
+
+ pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
+
+- for (i = 0; i < size; i++) {
+- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+- i, (unsigned int)virt_to_phys(p),
+- le32_to_cpu(p->des0), le32_to_cpu(p->des1),
+- le32_to_cpu(p->des2), le32_to_cpu(p->des3));
+- p++;
++ if (desc_size == sizeof(struct dma_desc)) {
++ struct dma_desc *p = (struct dma_desc *)head;
++
++ for (i = 0; i < size; i++) {
++ dma_addr = dma_rx_phy + i * sizeof(*p);
++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
++ le32_to_cpu(p->des0), le32_to_cpu(p->des1),
++ le32_to_cpu(p->des2), le32_to_cpu(p->des3));
++ p++;
++ }
++ } else if (desc_size == sizeof(struct dma_extended_desc)) {
++ struct dma_extended_desc *extp = (struct dma_extended_desc *)head;
++
++ for (i = 0; i < size; i++) {
++ dma_addr = dma_rx_phy + i * sizeof(*extp);
++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
++ le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1),
++ le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3),
++ le32_to_cpu(extp->des4), le32_to_cpu(extp->des5),
++ le32_to_cpu(extp->des6), le32_to_cpu(extp->des7));
++ extp++;
++ }
++ } else if (desc_size == sizeof(struct dma_edesc)) {
++ struct dma_edesc *ep = (struct dma_edesc *)head;
++
++ for (i = 0; i < size; i++) {
++ dma_addr = dma_rx_phy + i * sizeof(*ep);
++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
++ le32_to_cpu(ep->des4), le32_to_cpu(ep->des5),
++ le32_to_cpu(ep->des6), le32_to_cpu(ep->des7),
++ le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1),
++ le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3));
++ ep++;
++ }
++ } else {
++ pr_err("unsupported descriptor!");
+ }
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index d02cec296f51..6650edfab5bc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc,
+ }
+ }
+
+-static void enh_desc_display_ring(void *head, unsigned int size, bool rx)
++static void enh_desc_display_ring(void *head, unsigned int size, bool rx,
++ dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+ struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
++ dma_addr_t dma_addr;
+ int i;
+
+ pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX");
+
+ for (i = 0; i < size; i++) {
+ u64 x;
++ dma_addr = dma_rx_phy + i * sizeof(*ep);
+
+ x = *(u64 *)ep;
+- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+- i, (unsigned int)virt_to_phys(ep),
++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
+ (unsigned int)x, (unsigned int)(x >> 32),
+ ep->basic.des2, ep->basic.des3);
+ ep++;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+index 15d7b8261189..979ac9fca23c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
+@@ -78,7 +78,8 @@ struct stmmac_desc_ops {
+ /* get rx timestamp status */
+ int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats);
+ /* Display ring */
+- void (*display_ring)(void *head, unsigned int size, bool rx);
++ void (*display_ring)(void *head, unsigned int size, bool rx,
++ dma_addr_t dma_rx_phy, unsigned int desc_size);
+ /* set MSS via context descriptor */
+ void (*set_mss)(struct dma_desc *p, unsigned int mss);
+ /* get descriptor skbuff address */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index f083360e4ba6..98ef43f35802 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats)
+ return 1;
+ }
+
+-static void ndesc_display_ring(void *head, unsigned int size, bool rx)
++static void ndesc_display_ring(void *head, unsigned int size, bool rx,
++ dma_addr_t dma_rx_phy, unsigned int desc_size)
+ {
+ struct dma_desc *p = (struct dma_desc *)head;
++ dma_addr_t dma_addr;
+ int i;
+
+ pr_info("%s descriptor ring:\n", rx ? "RX" : "TX");
+
+ for (i = 0; i < size; i++) {
+ u64 x;
++ dma_addr = dma_rx_phy + i * sizeof(*p);
+
+ x = *(u64 *)p;
+- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x",
+- i, (unsigned int)virt_to_phys(p),
++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x",
++ i, &dma_addr,
+ (unsigned int)x, (unsigned int)(x >> 32),
+ p->des2, p->des3);
+ p++;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index e87961432a79..4749bd0af160 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1133,6 +1133,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv)
+ static void stmmac_display_rx_rings(struct stmmac_priv *priv)
+ {
+ u32 rx_cnt = priv->plat->rx_queues_to_use;
++ unsigned int desc_size;
+ void *head_rx;
+ u32 queue;
+
+@@ -1142,19 +1143,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv)
+
+ pr_info("\tRX Queue %u rings\n", queue);
+
+- if (priv->extend_desc)
++ if (priv->extend_desc) {
+ head_rx = (void *)rx_q->dma_erx;
+- else
++ desc_size = sizeof(struct dma_extended_desc);
++ } else {
+ head_rx = (void *)rx_q->dma_rx;
++ desc_size = sizeof(struct dma_desc);
++ }
+
+ /* Display RX ring */
+- stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true);
++ stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true,
++ rx_q->dma_rx_phy, desc_size);
+ }
+ }
+
+ static void stmmac_display_tx_rings(struct stmmac_priv *priv)
+ {
+ u32 tx_cnt = priv->plat->tx_queues_to_use;
++ unsigned int desc_size;
+ void *head_tx;
+ u32 queue;
+
+@@ -1164,14 +1170,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv)
+
+ pr_info("\tTX Queue %d rings\n", queue);
+
+- if (priv->extend_desc)
++ if (priv->extend_desc) {
+ head_tx = (void *)tx_q->dma_etx;
+- else if (tx_q->tbs & STMMAC_TBS_AVAIL)
++ desc_size = sizeof(struct dma_extended_desc);
++ } else if (tx_q->tbs & STMMAC_TBS_AVAIL) {
+ head_tx = (void *)tx_q->dma_entx;
+- else
++ desc_size = sizeof(struct dma_edesc);
++ } else {
+ head_tx = (void *)tx_q->dma_tx;
++ desc_size = sizeof(struct dma_desc);
++ }
+
+- stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false);
++ stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false,
++ tx_q->dma_tx_phy, desc_size);
+ }
+ }
+
+@@ -3740,18 +3751,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ unsigned int count = 0, error = 0, len = 0;
+ int status = 0, coe = priv->hw->rx_csum;
+ unsigned int next_entry = rx_q->cur_rx;
++ unsigned int desc_size;
+ struct sk_buff *skb = NULL;
+
+ if (netif_msg_rx_status(priv)) {
+ void *rx_head;
+
+ netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__);
+- if (priv->extend_desc)
++ if (priv->extend_desc) {
+ rx_head = (void *)rx_q->dma_erx;
+- else
++ desc_size = sizeof(struct dma_extended_desc);
++ } else {
+ rx_head = (void *)rx_q->dma_rx;
++ desc_size = sizeof(struct dma_desc);
++ }
+
+- stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true);
++ stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true,
++ rx_q->dma_rx_phy, desc_size);
+ }
+ while (count < limit) {
+ unsigned int buf1_len = 0, buf2_len = 0;
+@@ -4319,24 +4335,27 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
+ static struct dentry *stmmac_fs_dir;
+
+ static void sysfs_display_ring(void *head, int size, int extend_desc,
+- struct seq_file *seq)
++ struct seq_file *seq, dma_addr_t dma_phy_addr)
+ {
+ int i;
+ struct dma_extended_desc *ep = (struct dma_extended_desc *)head;
+ struct dma_desc *p = (struct dma_desc *)head;
++ dma_addr_t dma_addr;
+
+ for (i = 0; i < size; i++) {
+ if (extend_desc) {
+- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+- i, (unsigned int)virt_to_phys(ep),
++ dma_addr = dma_phy_addr + i * sizeof(*ep);
++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
+ le32_to_cpu(ep->basic.des0),
+ le32_to_cpu(ep->basic.des1),
+ le32_to_cpu(ep->basic.des2),
+ le32_to_cpu(ep->basic.des3));
+ ep++;
+ } else {
+- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
+- i, (unsigned int)virt_to_phys(p),
++ dma_addr = dma_phy_addr + i * sizeof(*p);
++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n",
++ i, &dma_addr,
+ le32_to_cpu(p->des0), le32_to_cpu(p->des1),
+ le32_to_cpu(p->des2), le32_to_cpu(p->des3));
+ p++;
+@@ -4364,11 +4383,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v)
+ if (priv->extend_desc) {
+ seq_printf(seq, "Extended descriptor ring:\n");
+ sysfs_display_ring((void *)rx_q->dma_erx,
+- priv->dma_rx_size, 1, seq);
++ priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy);
+ } else {
+ seq_printf(seq, "Descriptor ring:\n");
+ sysfs_display_ring((void *)rx_q->dma_rx,
+- priv->dma_rx_size, 0, seq);
++ priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy);
+ }
+ }
+
+@@ -4380,11 +4399,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v)
+ if (priv->extend_desc) {
+ seq_printf(seq, "Extended descriptor ring:\n");
+ sysfs_display_ring((void *)tx_q->dma_etx,
+- priv->dma_tx_size, 1, seq);
++ priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy);
+ } else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) {
+ seq_printf(seq, "Descriptor ring:\n");
+ sysfs_display_ring((void *)tx_q->dma_tx,
+- priv->dma_tx_size, 0, seq);
++ priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy);
+ }
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 67e6d60c0c5c0e3de03323310a7a15ce61a5f3bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 18:06:48 -0800
+Subject: net: tehuti: fix error return code in bdx_probe()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ]
+
+When bdx_read_mac() fails, no error return code of bdx_probe()
+is assigned.
+To fix this bug, err is assigned with -EFAULT as error return code.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/tehuti/tehuti.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
+index b8f4f419173f..d054c6e83b1c 100644
+--- a/drivers/net/ethernet/tehuti/tehuti.c
++++ b/drivers/net/ethernet/tehuti/tehuti.c
+@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ /*bdx_hw_reset(priv); */
+ if (bdx_read_mac(priv)) {
+ pr_err("load MAC address failed\n");
++ err = -EFAULT;
+ goto err_out_iomap;
+ }
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+--
+2.30.1
+
--- /dev/null
+From 603d20e1061aa6a620bd122cfc0a692b3fd9f1a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Mar 2021 01:12:56 -0800
+Subject: net: wan: fix error return code of uhdlc_init()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 62765d39553cfd1ad340124fe1e280450e8c89e2 ]
+
+When priv->rx_skbuff or priv->tx_skbuff is NULL, no error return code of
+uhdlc_init() is assigned.
+To fix this bug, ret is assigned with -ENOMEM in these cases.
+
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index dca97cd7c4e7..7eac6a3e1cde 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ priv->rx_skbuff = kcalloc(priv->rx_ring_size,
+ sizeof(*priv->rx_skbuff),
+ GFP_KERNEL);
+- if (!priv->rx_skbuff)
++ if (!priv->rx_skbuff) {
++ ret = -ENOMEM;
+ goto free_ucc_pram;
++ }
+
+ priv->tx_skbuff = kcalloc(priv->tx_ring_size,
+ sizeof(*priv->tx_skbuff),
+ GFP_KERNEL);
+- if (!priv->tx_skbuff)
++ if (!priv->tx_skbuff) {
++ ret = -ENOMEM;
+ goto free_rx_skbuff;
++ }
+
+ priv->skb_curtx = 0;
+ priv->skb_dirtytx = 0;
+--
+2.30.1
+
--- /dev/null
+From 4116276a718a1d76172bf73b097224c59b96b9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 12:12:13 -0600
+Subject: NFS: Correct size calculation for create reply length
+
+From: Frank Sorenson <sorenson@redhat.com>
+
+[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ]
+
+CREATE requests return a post_op_fh3, rather than nfs_fh3. The
+post_op_fh3 includes an extra word to indicate 'handle_follows'.
+
+Without that additional word, create fails when full 64-byte
+filehandles are in use.
+
+Add NFS3_post_op_fh_sz, and correct the size calculation for
+NFS3_createres_sz.
+
+Signed-off-by: Frank Sorenson <sorenson@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs3xdr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index ca10072644ff..ed1c83738c30 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -36,6 +36,7 @@
+ #define NFS3_pagepad_sz (1) /* Page padding */
+ #define NFS3_fhandle_sz (1+16)
+ #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */
++#define NFS3_post_op_fh_sz (1+NFS3_fh_sz)
+ #define NFS3_sattr_sz (15)
+ #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2))
+ #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2))
+@@ -73,7 +74,7 @@
+ #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1+NFS3_pagepad_sz)
+ #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3+NFS3_pagepad_sz)
+ #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4)
+-#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
++#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz))
+ #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)
+ #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2+NFS3_pagepad_sz)
+--
+2.30.1
+
--- /dev/null
+From 8d90d5939882479c536cbdff1f2b42fd4014f138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 15:19:01 +0100
+Subject: nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
+
+From: Timo Rothenpieler <timo@rothenpieler.org>
+
+[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ]
+
+This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13.
+With the default being m, it's impossible to build the module into the
+kernel.
+
+Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
+index e2a488d403a6..14a72224b657 100644
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -127,7 +127,7 @@ config PNFS_BLOCK
+ config PNFS_FLEXFILE_LAYOUT
+ tristate
+ depends on NFS_V4_1 && NFS_V3
+- default m
++ default NFS_V4
+
+ config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN
+ string "NFSv4.1 Implementation ID Domain"
+--
+2.30.1
+
--- /dev/null
+From 5a62863b2bb0d5a83be2ec6bc4a781665ed94701 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 17:36:38 -0500
+Subject: nfs: we don't support removing system.nfs4_acl
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ]
+
+The NFSv4 protocol doesn't have any notion of reomoving an attribute, so
+removexattr(path,"system.nfs4_acl") doesn't make sense.
+
+There's no documented return value. Arguably it could be EOPNOTSUPP but
+I'm a little worried an application might take that to mean that we
+don't support ACLs or xattrs. How about EINVAL?
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 7eb44f37558c..95d3b8540f8e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5896,6 +5896,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl
+ unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE);
+ int ret, i;
+
++ /* You can't remove system.nfs4_acl: */
++ if (buflen == 0)
++ return -EINVAL;
+ if (!nfs4_server_supports_acls(server))
+ return -EOPNOTSUPP;
+ if (npages > ARRAY_SIZE(pages))
+--
+2.30.1
+
--- /dev/null
+From e7ae50b2ae3c253cb41864bf8fa263ef8593c2cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 08:17:26 +0100
+Subject: nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit d3589381987ec879b03f8ce3039df57e87f05901 ]
+
+NVME_REQ_CANCELLED is translated into -EINTR in nvme_submit_sync_cmd(),
+so we should be setting this flags during nvme_cancel_request() to
+ensure that the callers to nvme_submit_sync_cmd() will get the correct
+error code when the controller is reset.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chao Leng <lengchao@huawei.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index a0f169a2d96f..206bf0a50487 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -366,6 +366,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
+ return true;
+
+ nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD;
++ nvme_req(req)->flags |= NVME_REQ_CANCELLED;
+ blk_mq_complete_request(req);
+ return true;
+ }
+--
+2.30.1
+
--- /dev/null
+From 27617fcbda6da43932092727740f6e3a99c77eab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 20:58:21 -0800
+Subject: nvme-core: check ctrl css before setting up zns
+
+From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+
+[ Upstream commit 0ec84df4953bd42c6583a555773f1d4996a061eb ]
+
+Ensure multiple Command Sets are supported before starting to setup a
+ZNS namespace.
+
+Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+[hch: move the check around a bit]
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 206bf0a50487..c611a17e83f0 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4069,6 +4069,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid)
+ nsid);
+ break;
+ }
++ if (!nvme_multi_css(ctrl)) {
++ dev_warn(ctrl->device,
++ "command set not reported for nsid: %d\n",
++ ns->head->ns_id);
++ break;
++ }
+ nvme_alloc_ns(ctrl, nsid, &ids);
+ break;
+ default:
+--
+2.30.1
+
--- /dev/null
+From db249eb7cc3ff6a022344f7466d3ae7f9507b168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 08:17:28 +0100
+Subject: nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been
+ aborted
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit ae3afe6308b43bbf49953101d4ba2c1c481133a8 ]
+
+When a command has been aborted we should return NVME_SC_HOST_ABORTED_CMD
+to be consistent with the other transports.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 0ddd2514b401..ca75338f2367 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req)
+ sizeof(op->rsp_iu), DMA_FROM_DEVICE);
+
+ if (opstate == FCPOP_STATE_ABORTED)
+- status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
++ status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1);
+ else if (freq->status) {
+ status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1);
+ dev_info(ctrl->ctrl.device,
+--
+2.30.1
+
--- /dev/null
+From dbe0e1fd4b58690acde1d140a363c45047cffe85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 08:17:27 +0100
+Subject: nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 3c7aafbc8d3d4d90430dfa126847a796c3e4ecfc ]
+
+nvme_fc_terminate_exchange() is being called when exchanges are
+being deleted, and as such we should be setting the NVME_REQ_CANCELLED
+flag to have identical behaviour on all transports.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 7ec6869b3e5b..0ddd2514b401 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved)
+ struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
+ struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req);
+
++ op->nreq.flags |= NVME_REQ_CANCELLED;
+ __nvme_fc_abort_op(ctrl, op);
+ return true;
+ }
+--
+2.30.1
+
--- /dev/null
+From a9a7e972762c576b5ac72a8ec16522e5510acacb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 12:06:41 +0000
+Subject: nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
+
+From: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
+
+[ Upstream commit abbb5f5929ec6c52574c430c5475c158a65c2a8c ]
+
+This adds a quirk for Samsung PM1725a drive which fixes timeouts and
+I/O errors due to the fact that the controller does not properly
+handle the Write Zeroes command, dmesg log:
+
+nvme nvme0: I/O 528 QID 10 timeout, aborting
+nvme nvme0: I/O 529 QID 10 timeout, aborting
+nvme nvme0: I/O 530 QID 10 timeout, aborting
+nvme nvme0: I/O 531 QID 10 timeout, aborting
+nvme nvme0: I/O 532 QID 10 timeout, aborting
+nvme nvme0: I/O 533 QID 10 timeout, aborting
+nvme nvme0: I/O 534 QID 10 timeout, aborting
+nvme nvme0: I/O 535 QID 10 timeout, aborting
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: Abort status: 0x0
+nvme nvme0: I/O 528 QID 10 timeout, reset controller
+nvme nvme0: controller is down; will reset: CSTS=0x3, PCI_STATUS=0x10
+nvme nvme0: Device not ready; aborting reset, CSTS=0x3
+nvme nvme0: Device not ready; aborting reset, CSTS=0x3
+nvme nvme0: Removing after probe failure status: -19
+nvme0n1: detected capacity change from 6251233968 to 0
+blk_update_request: I/O error, dev nvme0n1, sector 32776 op 0x1:(WRITE) flags 0x3000 phys_seg 6 prio class 0
+blk_update_request: I/O error, dev nvme0n1, sector 113319936 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 1, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113319680 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 2, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113319424 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 3, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113319168 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 4, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113318912 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 5, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113318656 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+Buffer I/O error on dev nvme0n1p2, logical block 6, lost async page write
+blk_update_request: I/O error, dev nvme0n1, sector 113318400 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+blk_update_request: I/O error, dev nvme0n1, sector 113318144 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+blk_update_request: I/O error, dev nvme0n1, sector 113317888 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0
+
+Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 806a5d071ef6..514dfd630035 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3242,6 +3242,7 @@ static const struct pci_device_id nvme_id_table[] = {
+ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+ { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */
+ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
++ NVME_QUIRK_DISABLE_WRITE_ZEROES|
+ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */
+ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+--
+2.30.1
+
--- /dev/null
+From 6b6ba0436e77af754db782ed4f1bdecf479bc621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Mar 2021 21:44:13 -0800
+Subject: nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit abec6561fc4e0fbb19591a0b35676d8c783b5493 ]
+
+In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by
+nvmet_rdma_release_rsp(). But after that, pr_info() used the freed
+chunk's member object and could leak the freed chunk address with
+wc->wr_cqe by computing the offset.
+
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/rdma.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index 06b6b742bb21..6c1f3ab7649c 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc)
+ nvmet_req_uninit(&rsp->req);
+ nvmet_rdma_release_rsp(rsp);
+ if (wc->status != IB_WC_WR_FLUSH_ERR) {
+- pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n",
+- wc->wr_cqe, ib_wc_status_msg(wc->status),
+- wc->status);
++ pr_info("RDMA WRITE for CQE failed with status %s (%d).\n",
++ ib_wc_status_msg(wc->status), wc->status);
+ nvmet_rdma_error_comp(queue);
+ }
+ return;
+--
+2.30.1
+
--- /dev/null
+From 7f4798855dd73a0022df654c6194a8dc396b02e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Feb 2021 08:17:25 +0100
+Subject: nvme: simplify error logic in nvme_validate_ns()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit d95c1f4179a7f3ea8aa728ed00252a8ed0f8158f ]
+
+We only should remove namespaces when we get fatal error back from
+the device or when the namespace IDs have changed.
+So instead of painfully masking out error numbers which might indicate
+that the error should be ignored we could use an NVME status code
+to indicated when the namespace should be removed.
+That simplifies the final logic and makes it less error-prone.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index f848ba16427e..a0f169a2d96f 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1425,7 +1425,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid,
+ goto out_free_id;
+ }
+
+- error = -ENODEV;
++ error = NVME_SC_INVALID_NS | NVME_SC_DNR;
+ if ((*id)->ncap == 0) /* namespace not allocated or attached */
+ goto out_free_id;
+
+@@ -4011,7 +4011,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid)
+ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ {
+ struct nvme_id_ns *id;
+- int ret = -ENODEV;
++ int ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
+
+ if (test_bit(NVME_NS_DEAD, &ns->flags))
+ goto out;
+@@ -4020,7 +4020,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ if (ret)
+ goto out;
+
+- ret = -ENODEV;
++ ret = NVME_SC_INVALID_NS | NVME_SC_DNR;
+ if (!nvme_ns_ids_equal(&ns->head->ids, ids)) {
+ dev_err(ns->ctrl->device,
+ "identifiers changed for nsid %d\n", ns->head->ns_id);
+@@ -4038,7 +4038,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids)
+ *
+ * TODO: we should probably schedule a delayed retry here.
+ */
+- if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR)))
++ if (ret > 0 && (ret & NVME_SC_DNR))
+ nvme_ns_remove(ns);
+ }
+
+--
+2.30.1
+
--- /dev/null
+From b27d21974700740fd4c07a1225f3e6ccd9c03b91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 23:30:58 +1100
+Subject: powerpc/4xx: Fix build errors from mfdcr()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ]
+
+lkp reported a build error in fsp2.o:
+
+ CC arch/powerpc/platforms/44x/fsp2.o
+ {standard input}:577: Error: unsupported relocation against base
+
+Which comes from:
+
+ pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0));
+
+Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and
+passing that to the assembler, which obviously doesn't work.
+
+The mfdcr() macro already checks that the argument is constant using
+__builtin_constant_p(), and if not calls the out-of-line version of
+mfdcr(). But in this case GCC is smart enough to notice that "base +
+PLB4OPB_GESR0" will be constant, even though it's not something we can
+immediately stringify into a register number.
+
+Segher pointed out that passing the register number to the inline asm
+as a constant would be better, and in fact it fixes the build error,
+presumably because it gives GCC a chance to resolve the value.
+
+While we're at it, change mtdcr() similarly.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Feng Tang <feng.tang@intel.com>
+Link: https://lore.kernel.org/r/20210218123058.748882-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/dcr-native.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h
+index 7141ccea8c94..a92059964579 100644
+--- a/arch/powerpc/include/asm/dcr-native.h
++++ b/arch/powerpc/include/asm/dcr-native.h
+@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mfdcr(rn) \
+ ({unsigned int rval; \
+ if (__builtin_constant_p(rn) && rn < 1024) \
+- asm volatile("mfdcr %0," __stringify(rn) \
+- : "=r" (rval)); \
++ asm volatile("mfdcr %0, %1" : "=r" (rval) \
++ : "n" (rn)); \
+ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
+ rval = mfdcrx(rn); \
+ else \
+@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)
+ #define mtdcr(rn, v) \
+ do { \
+ if (__builtin_constant_p(rn) && rn < 1024) \
+- asm volatile("mtdcr " __stringify(rn) ",%0" \
+- : : "r" (v)); \
++ asm volatile("mtdcr %0, %1" \
++ : : "n" (rn), "r" (v)); \
+ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \
+ mtdcrx(rn, v); \
+ else \
+--
+2.30.1
+
--- /dev/null
+From 54701c2fa0756a7c3eec9d1f7e89c1f62110aa1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 14:03:08 +0530
+Subject: regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck
+
+From: satya priya <skakit@codeaurora.org>
+
+[ Upstream commit e610e072c87a30658479a7b4c51e1801cb3f450c ]
+
+Correct the REGULATOR_LINEAR_RANGE and n_voltges for
+pmic5_hfsmps515 buck.
+
+Signed-off-by: satya priya <skakit@codeaurora.org>
+Link: https://lore.kernel.org/r/1614155592-14060-4-git-send-email-skakit@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index 37a2abbe85c7..2351a232d90e 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = {
+ static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = {
+ .regulator_type = VRM,
+ .ops = &rpmh_regulator_vrm_ops,
+- .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000),
+- .n_voltages = 5,
++ .voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000),
++ .n_voltages = 236,
+ .pmic_mode_map = pmic_mode_map_pmic5_smps,
+ .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+ };
+--
+2.30.1
+
--- /dev/null
+From 4de7d988d466325f4ea53353b48f2fc3db17f194 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 14:03:11 +0530
+Subject: regulator: qcom-rpmh: Use correct buck for S1C regulator
+
+From: satya priya <skakit@codeaurora.org>
+
+[ Upstream commit dfe03bca8db4957d4b60614ff7df4d136ba90f37 ]
+
+Use correct buck, that is, pmic5_hfsmps515 for S1C regulator
+of PM8350C PMIC.
+
+Signed-off-by: satya priya <skakit@codeaurora.org>
+Link: https://lore.kernel.org/r/1614155592-14060-7-git-send-email-skakit@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index 2351a232d90e..0fd3da36f62e 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -901,7 +901,7 @@ static const struct rpmh_vreg_init_data pm8350_vreg_data[] = {
+ };
+
+ static const struct rpmh_vreg_init_data pm8350c_vreg_data[] = {
+- RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps510, "vdd-s1"),
++ RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps515, "vdd-s1"),
+ RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"),
+ RPMH_VREG("smps3", "smp%s3", &pmic5_ftsmps510, "vdd-s3"),
+ RPMH_VREG("smps4", "smp%s4", &pmic5_ftsmps510, "vdd-s4"),
+--
+2.30.1
+
--- /dev/null
+From 61b8e517b59bbc0b8f6f863f1a3d7632fef7b29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 16:39:47 +0800
+Subject: Revert "r8152: adjust the settings about MAC clock speed down for
+ RTL8153"
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 4b5dc1a94d4f92b5845e98bd9ae344b26d933aad ]
+
+This reverts commit 134f98bcf1b898fb9d6f2b91bc85dd2e5478b4b8.
+
+The r8153_mac_clk_spd() is used for RTL8153A only, because the register
+table of RTL8153B is different from RTL8153A. However, this function would
+be called when RTL8153B calls r8153_first_init() and r8153_enter_oob().
+That causes RTL8153B becomes unstable when suspending and resuming. The
+worst case may let the device stop working.
+
+Besides, revert this commit to disable MAC clock speed down for RTL8153A.
+It would avoid the known issue when enabling U1. The data of the first
+control transfer may be wrong when exiting U1.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 35 ++++++-----------------------------
+ 1 file changed, 6 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 67cd6986634f..fd5ca11c4cbb 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3016,29 +3016,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts)
+ device_set_wakeup_enable(&tp->udev->dev, false);
+ }
+
+-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable)
+-{
+- /* MAC clock speed down */
+- if (enable) {
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL,
+- ALDPS_SPDWN_RATIO);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2,
+- EEE_SPDWN_RATIO);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3,
+- PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN |
+- U1U2_SPDWN_EN | L1_SPDWN_EN);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4,
+- PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN |
+- TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN |
+- TP1000_SPDWN_EN);
+- } else {
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
+- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
+- }
+-}
+-
+ static void r8153_u1u2en(struct r8152 *tp, bool enable)
+ {
+ u8 u1u2[8];
+@@ -3338,11 +3315,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable)
+ if (enable) {
+ r8153_u1u2en(tp, false);
+ r8153_u2p3en(tp, false);
+- r8153_mac_clk_spd(tp, true);
+ rtl_runtime_suspend_enable(tp, true);
+ } else {
+ rtl_runtime_suspend_enable(tp, false);
+- r8153_mac_clk_spd(tp, false);
+
+ switch (tp->version) {
+ case RTL_VER_03:
+@@ -4678,7 +4653,6 @@ static void r8153_first_init(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- r8153_mac_clk_spd(tp, false);
+ rxdy_gated_en(tp, true);
+ r8153_teredo_off(tp);
+
+@@ -4729,8 +4703,6 @@ static void r8153_enter_oob(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- r8153_mac_clk_spd(tp, true);
+-
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
+ ocp_data &= ~NOW_IS_OOB;
+ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data);
+@@ -5456,10 +5428,15 @@ static void r8153_init(struct r8152 *tp)
+
+ ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001);
+
++ /* MAC clock speed down */
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
++
+ r8153_power_cut_en(tp, false);
+ rtl_runtime_suspend_enable(tp, false);
+ r8153_u1u2en(tp, true);
+- r8153_mac_clk_spd(tp, false);
+ usb_enable_lpm(tp->udev);
+
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
+--
+2.30.1
+
--- /dev/null
+From a8790279b9d881dc0f493712d41ae49144009cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 21:36:48 -0800
+Subject: scsi: ufs: ufs-qcom: Disable interrupt in reset path
+
+From: Nitin Rawat <nitirawa@codeaurora.org>
+
+[ Upstream commit 4a791574a0ccf36eb3a0a46fbd71d2768df3eef9 ]
+
+Disable interrupt in reset path to flush pending IRQ handler in order to
+avoid possible NoC issues.
+
+Link: https://lore.kernel.org/r/1614145010-36079-3-git-send-email-cang@codeaurora.org
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Nitin Rawat <nitirawa@codeaurora.org>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-qcom.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index 2206b1e4b774..e55201f64c10 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba)
+ {
+ int ret = 0;
+ struct ufs_qcom_host *host = ufshcd_get_variant(hba);
++ bool reenable_intr = false;
+
+ if (!host->core_reset) {
+ dev_warn(hba->dev, "%s: reset control not set\n", __func__);
+ goto out;
+ }
+
++ reenable_intr = hba->is_irq_enabled;
++ disable_irq(hba->irq);
++ hba->is_irq_enabled = false;
++
+ ret = reset_control_assert(host->core_reset);
+ if (ret) {
+ dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n",
+@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba)
+
+ usleep_range(1000, 1100);
+
++ if (reenable_intr) {
++ enable_irq(hba->irq);
++ hba->is_irq_enabled = true;
++ }
++
+ out:
+ return ret;
+ }
+--
+2.30.1
+
--- /dev/null
+mt76-fix-tx-skb-error-handling-in-mt76_dma_tx_queue_.patch
+mt76-mt7915-only-modify-tx-buffer-list-after-allocat.patch
+net-stmmac-fix-dma-physical-address-of-descriptor-wh.patch
+net-fec-ptp-avoid-register-access-when-ipg-clock-is-.patch
+powerpc-4xx-fix-build-errors-from-mfdcr.patch
+atm-eni-dont-release-is-never-initialized.patch
+atm-lanai-dont-run-lanai_dev_close-if-not-open.patch
+revert-r8152-adjust-the-settings-about-mac-clock-spe.patch
+alsa-hda-ignore-invalid-nhlt-table.patch
+ixgbe-fix-memleak-in-ixgbe_configure_clsu32.patch
+scsi-ufs-ufs-qcom-disable-interrupt-in-reset-path.patch
+blk-cgroup-fix-the-recursive-blkg-rwstat.patch
+net-tehuti-fix-error-return-code-in-bdx_probe.patch
+net-intel-iavf-fix-error-return-code-of-iavf_init_ge.patch
+sun-niu-fix-wrong-rxmac_bc_frm_cnt_count-count.patch
+gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch
+cifs-ask-for-more-credit-on-async-read-write-code-pa.patch
+gfs2-fix-use-after-free-in-trans_drain.patch
+cpufreq-blacklist-arm-vexpress-platforms-in-cpufreq-.patch
+gpiolib-acpi-add-missing-irqf_oneshot.patch
+nfs-fix-pnfs_flexfile_layout-kconfig-default.patch
+nfs-correct-size-calculation-for-create-reply-length.patch
+net-hisilicon-hns-fix-error-return-code-of-hns_nic_c.patch
+net-wan-fix-error-return-code-of-uhdlc_init.patch
+net-davicom-use-platform_get_irq_optional.patch
+net-enetc-set-mac-rx-fifo-to-recommended-value.patch
+atm-upd98402-fix-incorrect-allocation.patch
+atm-idt77252-fix-null-ptr-dereference.patch
+cifs-change-noisy-error-message-to-fyi.patch
+irqchip-ingenic-add-support-for-the-jz4760.patch
+kbuild-add-image_name-to-no-sync-config-targets.patch
+kbuild-dummy-tools-fix-inverted-tests-for-gcc.patch
+umem-fix-error-return-code-in-mm_pci_probe.patch
+sparc64-fix-opcode-filtering-in-handling-of-no-fault.patch
+habanalabs-call-put_pid-when-releasing-control-devic.patch
+habanalabs-disable-file-operations-after-device-is-r.patch
+staging-rtl8192e-fix-kconfig-dependency-on-crypto.patch
+u64_stats-lockdep-fix-u64_stats_init-vs-lockdep.patch
+kselftest-arm64-fix-exit-code-of-sve-ptrace.patch
+regulator-qcom-rpmh-correct-the-pmic5_hfsmps515-buck.patch
+regulator-qcom-rpmh-use-correct-buck-for-s1c-regulat.patch
+block-fix-req_op_zone_reset_all-handling.patch
+drm-amd-display-enable-pflip-interrupt-upon-pipe-ena.patch
+drm-amd-display-revert-dram_clock_change_latency-for.patch
+drm-amd-display-enabled-pipe-harvesting-in-dcn30.patch
+drm-amdgpu-display-use-wm_table.entries-for-dcn301-c.patch
+drm-amdgpu-fb-bo-should-be-ttm_bo_type_device.patch
+drm-radeon-fix-agp-dependency.patch
+nvme-simplify-error-logic-in-nvme_validate_ns.patch
+nvme-add-nvme_req_cancelled-flag-in-nvme_cancel_requ.patch
+nvme-fc-set-nvme_req_cancelled-in-nvme_fc_terminate_.patch
+nvme-fc-return-nvme_sc_host_aborted_cmd-when-a-comma.patch
+nvme-core-check-ctrl-css-before-setting-up-zns.patch
+nvme-rdma-fix-a-use-after-free-in-nvmet_rdma_write_d.patch
+nvme-pci-add-the-disable_write_zeroes-quirk-for-a-sa.patch
+nfs-we-don-t-support-removing-system.nfs4_acl.patch
+block-suppress-uevent-for-hidden-device-when-removed.patch
+io_uring-cancel-deferred-requests-in-try_cancel.patch
+mm-fork-clear-pasid-for-new-mm.patch
+ia64-fix-ia64_syscall_get_set_arguments-for-break-ba.patch
+ia64-fix-ptrace-ptrace_syscall_info_exit-sign.patch
--- /dev/null
+From dd108e3cd5ed813519680e23268db704816b1a90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Feb 2021 22:48:16 -0700
+Subject: sparc64: Fix opcode filtering in handling of no fault loads
+
+From: Rob Gardner <rob.gardner@oracle.com>
+
+[ Upstream commit e5e8b80d352ec999d2bba3ea584f541c83f4ca3f ]
+
+is_no_fault_exception() has two bugs which were discovered via random
+opcode testing with stress-ng. Both are caused by improper filtering
+of opcodes.
+
+The first bug can be triggered by a floating point store with a no-fault
+ASI, for instance "sta %f0, [%g0] #ASI_PNF", opcode C1A01040.
+
+The code first tests op3[5] (0x1000000), which denotes a floating
+point instruction, and then tests op3[2] (0x200000), which denotes a
+store instruction. But these bits are not mutually exclusive, and the
+above mentioned opcode has both bits set. The intent is to filter out
+stores, so the test for stores must be done first in order to have
+any effect.
+
+The second bug can be triggered by a floating point load with one of
+the invalid ASI values 0x8e or 0x8f, which pass this check in
+is_no_fault_exception():
+ if ((asi & 0xf2) == ASI_PNF)
+
+An example instruction is "ldqa [%l7 + %o7] #ASI 0x8f, %f38",
+opcode CF95D1EF. Asi values greater than 0x8b (ASI_SNFL) are fatal
+in handle_ldf_stq(), and is_no_fault_exception() must not allow these
+invalid asi values to make it that far.
+
+In both of these cases, handle_ldf_stq() reacts by calling
+sun4v_data_access_exception() or spitfire_data_access_exception(),
+which call is_no_fault_exception() and results in an infinite
+recursion.
+
+Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
+Tested-by: Anatoly Pugachev <matorola@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/traps_64.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index d92e5eaa4c1d..a850dccd78ea 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs)
+ asi = (regs->tstate >> 24); /* saved %asi */
+ else
+ asi = (insn >> 5); /* immediate asi */
+- if ((asi & 0xf2) == ASI_PNF) {
+- if (insn & 0x1000000) { /* op3[5:4]=3 */
+- handle_ldf_stq(insn, regs);
+- return true;
+- } else if (insn & 0x200000) { /* op3[2], stores */
++ if ((asi & 0xf6) == ASI_PNF) {
++ if (insn & 0x200000) /* op3[2], stores */
+ return false;
+- }
+- handle_ld_nf(insn, regs);
++ if (insn & 0x1000000) /* op3[5:4]=3 (fp) */
++ handle_ldf_stq(insn, regs);
++ else
++ handle_ld_nf(insn, regs);
+ return true;
+ }
+ }
+--
+2.30.1
+
--- /dev/null
+From 41355194da87f76a38d6256601cc90c33a793b98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 13:06:07 -0500
+Subject: staging: rtl8192e: fix kconfig dependency on CRYPTO
+
+From: Julian Braha <julianbraha@gmail.com>
+
+[ Upstream commit 7c36194558cf49a86a53b5f60db8046c5e3013ae ]
+
+When RTLLIB_CRYPTO_TKIP is enabled and CRYPTO is disabled,
+Kbuild gives the following warning:
+
+WARNING: unmet direct dependencies detected for CRYPTO_MICHAEL_MIC
+ Depends on [n]: CRYPTO [=n]
+ Selected by [m]:
+ - RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m]
+
+WARNING: unmet direct dependencies detected for CRYPTO_LIB_ARC4
+ Depends on [n]: CRYPTO [=n]
+ Selected by [m]:
+ - RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m]
+ - RTLLIB_CRYPTO_WEP [=m] && STAGING [=y] && RTLLIB [=m]
+
+This is because RTLLIB_CRYPTO_TKIP selects CRYPTO_MICHAEL_MIC and
+CRYPTO_LIB_ARC4, without depending on or selecting CRYPTO,
+despite those config options being subordinate to CRYPTO.
+
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Julian Braha <julianbraha@gmail.com>
+Link: https://lore.kernel.org/r/20210222180607.399753-1-julianbraha@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192e/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8192e/Kconfig b/drivers/staging/rtl8192e/Kconfig
+index 03fcc23516fd..6e7d84ac06f5 100644
+--- a/drivers/staging/rtl8192e/Kconfig
++++ b/drivers/staging/rtl8192e/Kconfig
+@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP
+ config RTLLIB_CRYPTO_TKIP
+ tristate "Support for rtllib TKIP crypto"
+ depends on RTLLIB
++ select CRYPTO
+ select CRYPTO_LIB_ARC4
+ select CRYPTO_MICHAEL_MIC
+ default y
+--
+2.30.1
+
--- /dev/null
+From 583eee19dae23c96e7090059d4fb74efff9035a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 20:02:12 +0300
+Subject: sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
+
+From: Denis Efremov <efremov@linux.com>
+
+[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ]
+
+RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row
+in niu_xmac_interrupt(). Remove the second addition.
+
+Signed-off-by: Denis Efremov <efremov@linux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sun/niu.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 68695d4afacd..707ccdd03b19 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np)
+ mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT;
+ if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+ mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+- if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP)
+- mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT;
+ if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP)
+ mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT;
+ if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP)
+--
+2.30.1
+
--- /dev/null
+From cf4bf940f43975a1005dfee75c7d2c41155c49ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 09:38:12 +0100
+Subject: u64_stats,lockdep: Fix u64_stats_init() vs lockdep
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ]
+
+Jakub reported that:
+
+ static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
+ {
+ ...
+ u64_stats_init(&tp->rx_stats.syncp);
+ u64_stats_init(&tp->tx_stats.syncp);
+ ...
+ }
+
+results in lockdep getting confused between the RX and TX stats lock.
+This is because u64_stats_init() is an inline calling seqcount_init(),
+which is a macro using a static variable to generate a lockdep class.
+
+By wrapping that in an inline, we negate the effect of the macro and
+fold the static key variable, hence the confusion.
+
+Fix by also making u64_stats_init() a macro for the case where it
+matters, leaving the other case an inline for argument validation
+etc.
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Debugged-by: "Ahmed S. Darwish" <a.darwish@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: "Erhard F." <erhard_f@mailbox.org>
+Link: https://lkml.kernel.org/r/YEXicy6+9MksdLZh@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/u64_stats_sync.h | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h
+index c6abb79501b3..e81856c0ba13 100644
+--- a/include/linux/u64_stats_sync.h
++++ b/include/linux/u64_stats_sync.h
+@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p)
+ }
+ #endif
+
++#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
++#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq)
++#else
+ static inline void u64_stats_init(struct u64_stats_sync *syncp)
+ {
+-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP)
+- seqcount_init(&syncp->seq);
+-#endif
+ }
++#endif
+
+ static inline void u64_stats_update_begin(struct u64_stats_sync *syncp)
+ {
+--
+2.30.1
+
--- /dev/null
+From a519bda2f9d4ba5fe636a56b11f3eddf57e30c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Mar 2021 12:35:01 +0000
+Subject: umem: fix error return code in mm_pci_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit eeb05595d22c19c8f814ff893dcf88ec277a2365 ]
+
+Fix to return negative error code -ENOMEM from the blk_alloc_queue()
+and dma_alloc_coherent() error handling cases instead of 0, as done
+elsewhere in this function.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20210308123501.2573816-1-weiyongjun1@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/umem.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/umem.c b/drivers/block/umem.c
+index 2b95d7b33b91..5eb44e4a91ee 100644
+--- a/drivers/block/umem.c
++++ b/drivers/block/umem.c
+@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ if (card->mm_pages[0].desc == NULL ||
+ card->mm_pages[1].desc == NULL) {
+ dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n");
++ ret = -ENOMEM;
+ goto failed_alloc;
+ }
+ reset_page(&card->mm_pages[0]);
+@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ spin_lock_init(&card->lock);
+
+ card->queue = blk_alloc_queue(NUMA_NO_NODE);
+- if (!card->queue)
++ if (!card->queue) {
++ ret = -ENOMEM;
+ goto failed_alloc;
++ }
+
+ tasklet_init(&card->tasklet, process_page, (unsigned long)card);
+
+--
+2.30.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
