--- /dev/null
+From bc902ead9768f6fec68cf0246a61f790918a13d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Aug 2020 15:46:30 +0800
+Subject: ALSA: echoaudio: Fix potential Oops in snd_echo_resume()
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5a25de6df789cc805a9b8ba7ab5deef5067af47e ]
+
+Freeing chip on error may lead to an Oops at the next time
+the system goes to resume. Fix this by removing all
+snd_echo_free() calls on error.
+
+Fixes: 47b5d028fdce8 ("ALSA: Echoaudio - Add suspend support #2")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20200813074632.17022-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/echoaudio/echoaudio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
+index 0941a7a17623a..456219a665a79 100644
+--- a/sound/pci/echoaudio/echoaudio.c
++++ b/sound/pci/echoaudio/echoaudio.c
+@@ -2158,7 +2158,6 @@ static int snd_echo_resume(struct device *dev)
+ if (err < 0) {
+ kfree(commpage_bak);
+ dev_err(dev, "resume init_hw err=%d\n", err);
+- snd_echo_free(chip);
+ return err;
+ }
+
+@@ -2185,7 +2184,6 @@ static int snd_echo_resume(struct device *dev)
+ if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
+ KBUILD_MODNAME, chip)) {
+ dev_err(chip->card->dev, "cannot grab irq\n");
+- snd_echo_free(chip);
+ return -EBUSY;
+ }
+ chip->irq = pci->irq;
+--
+2.25.1
+
--- /dev/null
+From 099979d02e7763629ff8a16ee62bf7e3149907ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 17:48:58 -0700
+Subject: bpf: selftests: Restore netns after each test
+
+From: Martin KaFai Lau <kafai@fb.com>
+
+[ Upstream commit 811d7e375d08312dba23f3b6bf7e58ec14aa5dcb ]
+
+It is common for networking tests creating its netns and making its own
+setting under this new netns (e.g. changing tcp sysctl). If the test
+forgot to restore to the original netns, it would affect the
+result of other tests.
+
+This patch saves the original netns at the beginning and then restores it
+after every test. Since the restore "setns()" is not expensive, it does it
+on all tests without tracking if a test has created a new netns or not.
+
+The new restore_netns() could also be done in test__end_subtest() such
+that each subtest will get an automatic netns reset. However,
+the individual test would lose flexibility to have total control
+on netns for its own subtests. In some cases, forcing a test to do
+unnecessary netns re-configure for each subtest is time consuming.
+e.g. In my vm, forcing netns re-configure on each subtest in sk_assign.c
+increased the runtime from 1s to 8s. On top of that, test_progs.c
+is also doing per-test (instead of per-subtest) cleanup for cgroup.
+Thus, this patch also does per-test restore_netns(). The only existing
+per-subtest cleanup is reset_affinity() and no test is depending on this.
+Thus, it is removed from test__end_subtest() to give a consistent
+expectation to the individual tests. test_progs.c only ensures
+any affinity/netns/cgroup change made by an earlier test does not
+affect the following tests.
+
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200702004858.2103728-1-kafai@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 23 +++++++++++++++++++++--
+ tools/testing/selftests/bpf/test_progs.h | 2 ++
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index da70a4f72f547..6218b2b5a3f62 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -121,6 +121,24 @@ static void reset_affinity() {
+ }
+ }
+
++static void save_netns(void)
++{
++ env.saved_netns_fd = open("/proc/self/ns/net", O_RDONLY);
++ if (env.saved_netns_fd == -1) {
++ perror("open(/proc/self/ns/net)");
++ exit(-1);
++ }
++}
++
++static void restore_netns(void)
++{
++ if (setns(env.saved_netns_fd, CLONE_NEWNET) == -1) {
++ stdio_restore();
++ perror("setns(CLONE_NEWNS)");
++ exit(-1);
++ }
++}
++
+ void test__end_subtest()
+ {
+ struct prog_test_def *test = env.test;
+@@ -138,8 +156,6 @@ void test__end_subtest()
+ test->test_num, test->subtest_num,
+ test->subtest_name, sub_error_cnt ? "FAIL" : "OK");
+
+- reset_affinity();
+-
+ free(test->subtest_name);
+ test->subtest_name = NULL;
+ }
+@@ -643,6 +659,7 @@ int main(int argc, char **argv)
+ return -1;
+ }
+
++ save_netns();
+ stdio_hijack();
+ for (i = 0; i < prog_test_cnt; i++) {
+ struct prog_test_def *test = &prog_test_defs[i];
+@@ -673,6 +690,7 @@ int main(int argc, char **argv)
+ test->error_cnt ? "FAIL" : "OK");
+
+ reset_affinity();
++ restore_netns();
+ if (test->need_cgroup_cleanup)
+ cleanup_cgroup_environment();
+ }
+@@ -686,6 +704,7 @@ int main(int argc, char **argv)
+ free_str_set(&env.subtest_selector.blacklist);
+ free_str_set(&env.subtest_selector.whitelist);
+ free(env.subtest_selector.num_set);
++ close(env.saved_netns_fd);
+
+ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0)
+ return EXIT_FAILURE;
+diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
+index f4503c926acad..b809246039181 100644
+--- a/tools/testing/selftests/bpf/test_progs.h
++++ b/tools/testing/selftests/bpf/test_progs.h
+@@ -78,6 +78,8 @@ struct test_env {
+ int sub_succ_cnt; /* successful sub-tests */
+ int fail_cnt; /* total failed tests + sub-tests */
+ int skip_cnt; /* skipped tests */
++
++ int saved_netns_fd;
+ };
+
+ extern struct test_env env;
+--
+2.25.1
+
--- /dev/null
+From 8b9a034799b7751acfd267ffc23cdbc116def3fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 20:05:07 +0300
+Subject: clk: actions: Fix h_clk for Actions S500 SoC
+
+From: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
+
+[ Upstream commit f47ee279d25fb0e010cae5d6e758e39b40eb6378 ]
+
+The h_clk clock in the Actions Semi S500 SoC clock driver has an
+invalid parent. Replace with the correct one.
+
+Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@gmail.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/c57e7ebabfa970014f073b92fe95b47d3e5a70b1.1593788312.git.cristian.ciocaltea@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/actions/owl-s500.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c
+index e2007ac4d235d..0eb83a0b70bcc 100644
+--- a/drivers/clk/actions/owl-s500.c
++++ b/drivers/clk/actions/owl-s500.c
+@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0);
+ static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0);
+
+ /* divider clocks */
+-static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0);
++static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0);
+ static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0);
+
+ /* factor clocks */
+--
+2.25.1
+
--- /dev/null
+From f3e4fb3b8f60aee4b3f98b9a52b49d99779d37ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 20:26:19 +0200
+Subject: clk: bcm2835: Do not use prediv with bcm2711's PLLs
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit f34e4651ce66a754f41203284acf09b28b9dd955 ]
+
+Contrary to previous SoCs, bcm2711 doesn't have a prescaler in the PLL
+feedback loop. Bypass it by zeroing fb_prediv_mask when running on
+bcm2711.
+
+Note that, since the prediv configuration bits were re-purposed, this
+was triggering miscalculations on all clocks hanging from the VPU clock,
+notably the aux UART, making its output unintelligible.
+
+Fixes: 42de9ad400af ("clk: bcm2835: Add BCM2711_CLOCK_EMMC2 support")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20200730182619.23246-1-nsaenzjulienne@suse.de
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/bcm/clk-bcm2835.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 6bb7efa12037b..011802f1a6df9 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -314,6 +314,7 @@ struct bcm2835_cprman {
+ struct device *dev;
+ void __iomem *regs;
+ spinlock_t regs_lock; /* spinlock for all clocks */
++ unsigned int soc;
+
+ /*
+ * Real names of cprman clock parents looked up through
+@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw)
+ A2W_PLL_CTRL_PRST_DISABLE;
+ }
+
++static u32 bcm2835_pll_get_prediv_mask(struct bcm2835_cprman *cprman,
++ const struct bcm2835_pll_data *data)
++{
++ /*
++ * On BCM2711 there isn't a pre-divisor available in the PLL feedback
++ * loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed
++ * for to for VCO RANGE bits.
++ */
++ if (cprman->soc & SOC_BCM2711)
++ return 0;
++
++ return data->ana->fb_prediv_mask;
++}
++
+ static void bcm2835_pll_choose_ndiv_and_fdiv(unsigned long rate,
+ unsigned long parent_rate,
+ u32 *ndiv, u32 *fdiv)
+@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw,
+ ndiv = (a2wctrl & A2W_PLL_CTRL_NDIV_MASK) >> A2W_PLL_CTRL_NDIV_SHIFT;
+ pdiv = (a2wctrl & A2W_PLL_CTRL_PDIV_MASK) >> A2W_PLL_CTRL_PDIV_SHIFT;
+ using_prediv = cprman_read(cprman, data->ana_reg_base + 4) &
+- data->ana->fb_prediv_mask;
++ bcm2835_pll_get_prediv_mask(cprman, data);
+
+ if (using_prediv) {
+ ndiv *= 2;
+@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw);
+ struct bcm2835_cprman *cprman = pll->cprman;
+ const struct bcm2835_pll_data *data = pll->data;
++ u32 prediv_mask = bcm2835_pll_get_prediv_mask(cprman, data);
+ bool was_using_prediv, use_fb_prediv, do_ana_setup_first;
+ u32 ndiv, fdiv, a2w_ctl;
+ u32 ana[4];
+@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ for (i = 3; i >= 0; i--)
+ ana[i] = cprman_read(cprman, data->ana_reg_base + i * 4);
+
+- was_using_prediv = ana[1] & data->ana->fb_prediv_mask;
++ was_using_prediv = ana[1] & prediv_mask;
+
+ ana[0] &= ~data->ana->mask0;
+ ana[0] |= data->ana->set0;
+@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw,
+ ana[3] |= data->ana->set3;
+
+ if (was_using_prediv && !use_fb_prediv) {
+- ana[1] &= ~data->ana->fb_prediv_mask;
++ ana[1] &= ~prediv_mask;
+ do_ana_setup_first = true;
+ } else if (!was_using_prediv && use_fb_prediv) {
+- ana[1] |= data->ana->fb_prediv_mask;
++ ana[1] |= prediv_mask;
+ do_ana_setup_first = false;
+ } else {
+ do_ana_setup_first = true;
+@@ -2238,6 +2254,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, cprman);
+
+ cprman->onecell.num = asize;
++ cprman->soc = pdata->soc;
+ hws = cprman->onecell.hws;
+
+ for (i = 0; i < asize; i++) {
+--
+2.25.1
+
--- /dev/null
+From 6751abb5858884dc6f232a0f1091c360852d755f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 03:21:43 +0000
+Subject: clk: clk-atlas6: fix return value check in atlas6_clk_init()
+
+From: Xu Wang <vulab@iscas.ac.cn>
+
+[ Upstream commit 12b90b40854a8461a02ef19f6f4474cc88d64b66 ]
+
+In case of error, the function clk_register() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check
+should be replaced with IS_ERR().
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20200713032143.21362-1-vulab@iscas.ac.cn
+Acked-by: Barry Song <baohua@kernel.org>
+Fixes: 7bf21bc81f28 ("clk: sirf: re-arch to make the codes support both prima2 and atlas6")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sirf/clk-atlas6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c
+index c84d5bab7ac28..b95483bb6a5ec 100644
+--- a/drivers/clk/sirf/clk-atlas6.c
++++ b/drivers/clk/sirf/clk-atlas6.c
+@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np)
+
+ for (i = pll1; i < maxclk; i++) {
+ atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]);
+- BUG_ON(!atlas6_clks[i]);
++ BUG_ON(IS_ERR(atlas6_clks[i]));
+ }
+ clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu");
+ clk_register_clkdev(atlas6_clks[io], NULL, "io");
+--
+2.25.1
+
--- /dev/null
+From 23a5e75c7edb8d1b961337184fc42de5967b54fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 10:48:35 +0200
+Subject: clk: hsdk: Fix bad dependency on IOMEM
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit bd8548d0dcdab514e08e35a3451667486d879dae ]
+
+CONFIG_IOMEM does not exist. The correct symbol to depend on is
+CONFIG_HAS_IOMEM.
+
+Fixes: 1e7468bd9d30a21e ("clk: Specify IOMEM dependency for HSDK pll driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20200803084835.21838-1-geert+renesas@glider.be
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
+index 326f91b2dda9f..5f952e111ab5a 100644
+--- a/drivers/clk/Kconfig
++++ b/drivers/clk/Kconfig
+@@ -50,7 +50,7 @@ source "drivers/clk/versatile/Kconfig"
+ config CLK_HSDK
+ bool "PLL Driver for HSDK platform"
+ depends on OF || COMPILE_TEST
+- depends on IOMEM
++ depends on HAS_IOMEM
+ help
+ This driver supports the HSDK core, system, ddr, tunnel and hdmi PLLs
+ control.
+--
+2.25.1
+
--- /dev/null
+From f8c3c05365f2b574d5a50dfc29e24b5842fa34db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 09:52:33 -0400
+Subject: clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit c8b9002f44e4a1d2771b2f59f6de900864b1f9d7 ]
+
+0x44 isn't a register offset, it is the value that goes into CAL_L_VAL.
+
+Fixes: 548a909597d5 ("clk: qcom: clk-alpha-pll: Add support for Trion PLLs")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20200709135251.643-3-jonathan@marek.ca
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index 9b2dfa08acb2a..1325139173c95 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -56,7 +56,6 @@
+ #define PLL_STATUS(p) ((p)->offset + (p)->regs[PLL_OFF_STATUS])
+ #define PLL_OPMODE(p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE])
+ #define PLL_FRAC(p) ((p)->offset + (p)->regs[PLL_OFF_FRAC])
+-#define PLL_CAL_VAL(p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL])
+
+ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = {
+ [CLK_ALPHA_PLL_TYPE_DEFAULT] = {
+@@ -115,7 +114,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = {
+ [PLL_OFF_STATUS] = 0x30,
+ [PLL_OFF_OPMODE] = 0x38,
+ [PLL_OFF_ALPHA_VAL] = 0x40,
+- [PLL_OFF_CAL_VAL] = 0x44,
+ },
+ [CLK_ALPHA_PLL_TYPE_LUCID] = {
+ [PLL_OFF_L_VAL] = 0x04,
+--
+2.25.1
+
--- /dev/null
+From aa8f70ddfaf2c9f9a37f6ae47fbc590bc1761439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 09:52:32 -0400
+Subject: clk: qcom: gcc: fix sm8150 GPU and NPU clocks
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 667f39b59b494d96ae70f4217637db2ebbee3df0 ]
+
+Fix the parents and set BRANCH_HALT_SKIP. From the downstream driver it
+should be a 500us delay and not skip, however this matches what was done
+for other clocks that had 500us delay in downstream.
+
+Fixes: f73a4230d5bb ("clk: qcom: gcc: Add GPU and NPU clocks for SM8150")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20200709135251.643-2-jonathan@marek.ca
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8150.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
+index 72524cf110487..55e9d6d75a0cd 100644
+--- a/drivers/clk/qcom/gcc-sm8150.c
++++ b/drivers/clk/qcom/gcc-sm8150.c
+@@ -1617,6 +1617,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = {
+ };
+
+ static struct clk_branch gcc_gpu_gpll0_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(15),
+@@ -1632,13 +1633,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = {
+ };
+
+ static struct clk_branch gcc_gpu_gpll0_div_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(16),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_gpu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+- &gcc_gpu_gpll0_clk_src.clkr.hw },
++ &gpll0_out_even.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+@@ -1729,6 +1731,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = {
+ };
+
+ static struct clk_branch gcc_npu_gpll0_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(18),
+@@ -1744,13 +1747,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = {
+ };
+
+ static struct clk_branch gcc_npu_gpll0_div_clk_src = {
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x52004,
+ .enable_mask = BIT(19),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_npu_gpll0_div_clk_src",
+ .parent_hws = (const struct clk_hw *[]){
+- &gcc_npu_gpll0_clk_src.clkr.hw },
++ &gpll0_out_even.clkr.hw },
+ .num_parents = 1,
+ .flags = CLK_SET_RATE_PARENT,
+ .ops = &clk_branch2_ops,
+--
+2.25.1
+
--- /dev/null
+From 8edec5cd29f9fb7726c3b76fd09266e883b9ffa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 13:12:05 +0200
+Subject: clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk
+
+From: Konrad Dybcio <konradybcio@gmail.com>
+
+[ Upstream commit 3386af51d3bcebcba3f7becdb1ef2e384abe90cf ]
+
+Add missing halt_check, hwcg_reg and hwcg_bit properties.
+These were likely omitted when porting the driver upstream.
+
+Signed-off-by: Konrad Dybcio <konradybcio@gmail.com>
+Link: https://lore.kernel.org/r/20200726111215.22361-9-konradybcio@gmail.com
+Fixes: f2a76a2955c0 ("clk: qcom: Add Global Clock controller (GCC) driver for SDM660")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sdm660.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c
+index bf5730832ef3d..c6fb57cd576f5 100644
+--- a/drivers/clk/qcom/gcc-sdm660.c
++++ b/drivers/clk/qcom/gcc-sdm660.c
+@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = {
+
+ static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = {
+ .halt_reg = 0x8a004,
++ .halt_check = BRANCH_HALT,
++ .hwcg_reg = 0x8a004,
++ .hwcg_bit = 1,
+ .clkr = {
+ .enable_reg = 0x8a004,
+ .enable_mask = BIT(0),
+--
+2.25.1
+
--- /dev/null
+From 4a549b036f27252f896b46266396ff40c4e0eb63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 13:32:21 +1000
+Subject: crypto: af_alg - Fix regression on empty requests
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 662bb52f50bca16a74fe92b487a14d7dccb85e1a ]
+
+Some user-space programs rely on crypto requests that have no
+control metadata. This broke when a check was added to require
+the presence of control metadata with the ctx->init flag.
+
+This patch fixes the regression by setting ctx->init as long as
+one sendmsg(2) has been made, with or without a control message.
+
+Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 9fcb91ea10c41..5882ed46f1adb 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -851,6 +851,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ err = -EINVAL;
+ goto unlock;
+ }
++ ctx->init = true;
+
+ if (init) {
+ ctx->enc = enc;
+@@ -858,7 +859,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ memcpy(ctx->iv, con.iv->iv, ivsize);
+
+ ctx->aead_assoclen = con.aead_assoclen;
+- ctx->init = true;
+ }
+
+ while (size) {
+--
+2.25.1
+
--- /dev/null
+From 1528f0710f33e5b4aa6a1ec9a80dac6fdf3fcae0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 14:58:25 +0200
+Subject: crypto: algif_aead - fix uninitialized ctx->init
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit 21dfbcd1f5cbff9cf2f9e7e43475aed8d072b0dd ]
+
+In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is
+cleared by memset() after allocation, so add such memset() also to
+aead_accept_parent_nokey() so that the new "init" field is also
+initialized to zero. Without that the initial ctx->init checks might
+randomly return true and cause errors.
+
+While there, also remove the redundant zero assignments in both
+functions.
+
+Found via libkcapi testsuite.
+
+Cc: Stephan Mueller <smueller@chronox.de>
+Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero")
+Suggested-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/algif_aead.c | 6 ------
+ crypto/algif_skcipher.c | 7 +------
+ 2 files changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index d48d2156e6210..43c6aa784858b 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk)
+
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+- ctx->used = 0;
+- atomic_set(&ctx->rcvused, 0);
+- ctx->more = 0;
+- ctx->merge = 0;
+- ctx->enc = 0;
+- ctx->aead_assoclen = 0;
+ crypto_init_wait(&ctx->wait);
+
+ ask->private = ctx;
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index a51ba22fef58f..81c4022285a7c 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+ ctx = sock_kmalloc(sk, len, GFP_KERNEL);
+ if (!ctx)
+ return -ENOMEM;
++ memset(ctx, 0, len);
+
+ ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm),
+ GFP_KERNEL);
+@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk)
+ sock_kfree_s(sk, ctx, len);
+ return -ENOMEM;
+ }
+-
+ memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm));
+
+ INIT_LIST_HEAD(&ctx->tsgl_list);
+ ctx->len = len;
+- ctx->used = 0;
+- atomic_set(&ctx->rcvused, 0);
+- ctx->more = 0;
+- ctx->merge = 0;
+- ctx->enc = 0;
+ crypto_init_wait(&ctx->wait);
+
+ ask->private = ctx;
+--
+2.25.1
+
--- /dev/null
+From 48891b327ce9d80ceac54ce1db0abcb7c8cbcc54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 May 2020 00:23:49 +1000
+Subject: crypto: algif_aead - Only wake up when ctx->more is zero
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit f3c802a1f30013f8f723b62d7fa49eb9e991da23 ]
+
+AEAD does not support partial requests so we must not wake up
+while ctx->more is set. In order to distinguish between the
+case of no data sent yet and a zero-length request, a new init
+flag has been added to ctx.
+
+SKCIPHER has also been modified to ensure that at least a block
+of data is available if there is more data to come.
+
+Fixes: 2d97591ef43d ("crypto: af_alg - consolidation of...")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 11 ++++++++---
+ crypto/algif_aead.c | 4 ++--
+ crypto/algif_skcipher.c | 4 ++--
+ include/crypto/if_alg.h | 4 +++-
+ 4 files changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 28fc323e3fe30..9fcb91ea10c41 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
+
+ if (!ctx->used)
+ ctx->merge = 0;
++ ctx->init = ctx->more;
+ }
+ EXPORT_SYMBOL_GPL(af_alg_pull_tsgl);
+
+@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup);
+ *
+ * @sk socket of connection to user space
+ * @flags If MSG_DONTWAIT is set, then only report if function would sleep
++ * @min Set to minimum request size if partial requests are allowed.
+ * @return 0 when writable memory is available, < 0 upon error
+ */
+-int af_alg_wait_for_data(struct sock *sk, unsigned flags)
++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min)
+ {
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ struct alg_sock *ask = alg_sk(sk);
+@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags)
+ if (signal_pending(current))
+ break;
+ timeout = MAX_SCHEDULE_TIMEOUT;
+- if (sk_wait_event(sk, &timeout, (ctx->used || !ctx->more),
++ if (sk_wait_event(sk, &timeout,
++ ctx->init && (!ctx->more ||
++ (min && ctx->used >= min)),
+ &wait)) {
+ err = 0;
+ break;
+@@ -843,7 +847,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ }
+
+ lock_sock(sk);
+- if (!ctx->more && ctx->used) {
++ if (ctx->init && (init || !ctx->more)) {
+ err = -EINVAL;
+ goto unlock;
+ }
+@@ -854,6 +858,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ memcpy(ctx->iv, con.iv->iv, ivsize);
+
+ ctx->aead_assoclen = con.aead_assoclen;
++ ctx->init = true;
+ }
+
+ while (size) {
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index 0ae000a61c7f5..d48d2156e6210 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
+ size_t usedpages = 0; /* [in] RX bufs to be used from user */
+ size_t processed = 0; /* [in] TX bufs to be consumed */
+
+- if (!ctx->used) {
+- err = af_alg_wait_for_data(sk, flags);
++ if (!ctx->init || ctx->more) {
++ err = af_alg_wait_for_data(sk, flags, 0);
+ if (err)
+ return err;
+ }
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index ec5567c87a6df..a51ba22fef58f 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
+ int err = 0;
+ size_t len = 0;
+
+- if (!ctx->used) {
+- err = af_alg_wait_for_data(sk, flags);
++ if (!ctx->init || (ctx->more && ctx->used < bs)) {
++ err = af_alg_wait_for_data(sk, flags, bs);
+ if (err)
+ return err;
+ }
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index 088c1ded27148..ee6412314f8f3 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -135,6 +135,7 @@ struct af_alg_async_req {
+ * SG?
+ * @enc: Cryptographic operation to be performed when
+ * recvmsg is invoked.
++ * @init: True if metadata has been sent.
+ * @len: Length of memory allocated for this data structure.
+ */
+ struct af_alg_ctx {
+@@ -151,6 +152,7 @@ struct af_alg_ctx {
+ bool more;
+ bool merge;
+ bool enc;
++ bool init;
+
+ unsigned int len;
+ };
+@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset);
+ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst,
+ size_t dst_offset);
+ void af_alg_wmem_wakeup(struct sock *sk);
+-int af_alg_wait_for_data(struct sock *sk, unsigned flags);
++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min);
+ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size,
+ unsigned int ivsize);
+ ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
+--
+2.25.1
+
--- /dev/null
+From 0f3f6872f13676a967879540d33ac9d32a330bf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 21:45:03 +1000
+Subject: crypto: caam - Remove broken arc4 support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit eeedb618378f8a09779546a3eeac16b000447d62 ]
+
+The arc4 algorithm requires storing state in the request context
+in order to allow more than one encrypt/decrypt operation. As this
+driver does not seem to do that, it means that using it for more
+than one operation is broken.
+
+Fixes: eaed71a44ad9 ("crypto: caam - add ecb(*) support")
+Link: https://lore.kernel.org/linux-crypto/CAMj1kXGvMe_A_iQ43Pmygg9xaAM-RLy=_M=v+eg--8xNmv9P+w@mail.gmail.com
+Link: https://lore.kernel.org/linux-crypto/20200702101947.682-1-ardb@kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamalg.c | 29 -----------------------------
+ drivers/crypto/caam/compat.h | 1 -
+ 2 files changed, 30 deletions(-)
+
+diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
+index bf90a4fcabd1f..8149ac4d6ef22 100644
+--- a/drivers/crypto/caam/caamalg.c
++++ b/drivers/crypto/caam/caamalg.c
+@@ -810,12 +810,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher,
+ return skcipher_setkey(skcipher, key, keylen, ctx1_iv_off);
+ }
+
+-static int arc4_skcipher_setkey(struct crypto_skcipher *skcipher,
+- const u8 *key, unsigned int keylen)
+-{
+- return skcipher_setkey(skcipher, key, keylen, 0);
+-}
+-
+ static int des_skcipher_setkey(struct crypto_skcipher *skcipher,
+ const u8 *key, unsigned int keylen)
+ {
+@@ -1967,21 +1961,6 @@ static struct caam_skcipher_alg driver_algs[] = {
+ },
+ .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB,
+ },
+- {
+- .skcipher = {
+- .base = {
+- .cra_name = "ecb(arc4)",
+- .cra_driver_name = "ecb-arc4-caam",
+- .cra_blocksize = ARC4_BLOCK_SIZE,
+- },
+- .setkey = arc4_skcipher_setkey,
+- .encrypt = skcipher_encrypt,
+- .decrypt = skcipher_decrypt,
+- .min_keysize = ARC4_MIN_KEY_SIZE,
+- .max_keysize = ARC4_MAX_KEY_SIZE,
+- },
+- .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB,
+- },
+ };
+
+ static struct caam_aead_alg driver_aeads[] = {
+@@ -3457,7 +3436,6 @@ int caam_algapi_init(struct device *ctrldev)
+ struct caam_drv_private *priv = dev_get_drvdata(ctrldev);
+ int i = 0, err = 0;
+ u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst;
+- u32 arc4_inst;
+ unsigned int md_limit = SHA512_DIGEST_SIZE;
+ bool registered = false, gcm_support;
+
+@@ -3477,8 +3455,6 @@ int caam_algapi_init(struct device *ctrldev)
+ CHA_ID_LS_DES_SHIFT;
+ aes_inst = cha_inst & CHA_ID_LS_AES_MASK;
+ md_inst = (cha_inst & CHA_ID_LS_MD_MASK) >> CHA_ID_LS_MD_SHIFT;
+- arc4_inst = (cha_inst & CHA_ID_LS_ARC4_MASK) >>
+- CHA_ID_LS_ARC4_SHIFT;
+ ccha_inst = 0;
+ ptha_inst = 0;
+
+@@ -3499,7 +3475,6 @@ int caam_algapi_init(struct device *ctrldev)
+ md_inst = mdha & CHA_VER_NUM_MASK;
+ ccha_inst = rd_reg32(&priv->ctrl->vreg.ccha) & CHA_VER_NUM_MASK;
+ ptha_inst = rd_reg32(&priv->ctrl->vreg.ptha) & CHA_VER_NUM_MASK;
+- arc4_inst = rd_reg32(&priv->ctrl->vreg.afha) & CHA_VER_NUM_MASK;
+
+ gcm_support = aesa & CHA_VER_MISC_AES_GCM;
+ }
+@@ -3522,10 +3497,6 @@ int caam_algapi_init(struct device *ctrldev)
+ if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES))
+ continue;
+
+- /* Skip ARC4 algorithms if not supported by device */
+- if (!arc4_inst && alg_sel == OP_ALG_ALGSEL_ARC4)
+- continue;
+-
+ /*
+ * Check support for AES modes not available
+ * on LP devices.
+diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h
+index 60e2a54c19f11..c3c22a8de4c00 100644
+--- a/drivers/crypto/caam/compat.h
++++ b/drivers/crypto/caam/compat.h
+@@ -43,7 +43,6 @@
+ #include <crypto/akcipher.h>
+ #include <crypto/scatterwalk.h>
+ #include <crypto/skcipher.h>
+-#include <crypto/arc4.h>
+ #include <crypto/internal/skcipher.h>
+ #include <crypto/internal/hash.h>
+ #include <crypto/internal/rsa.h>
+--
+2.25.1
+
--- /dev/null
+From 4bd2e21e61d76b804f680176a7322537fd489b29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:58:26 +0300
+Subject: devres: keep both device name and resource name in pretty name
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 35bd8c07db2ce8fd2834ef866240613a4ef982e7 ]
+
+Sometimes debugging a device is easiest using devmem on its register
+map, and that can be seen with /proc/iomem. But some device drivers have
+many memory regions. Take for example a networking switch. Its memory
+map used to look like this in /proc/iomem:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : sys
+ 1fc030000-1fc03ffff : rew
+ 1fc060000-1fc0603ff : s2
+ 1fc070000-1fc0701ff : devcpu_gcb
+ 1fc080000-1fc0800ff : qs
+ 1fc090000-1fc0900cb : ptp
+ 1fc100000-1fc10ffff : port0
+ 1fc110000-1fc11ffff : port1
+ 1fc120000-1fc12ffff : port2
+ 1fc130000-1fc13ffff : port3
+ 1fc140000-1fc14ffff : port4
+ 1fc150000-1fc15ffff : port5
+ 1fc200000-1fc21ffff : qsys
+ 1fc280000-1fc28ffff : ana
+
+But after the patch in Fixes: was applied, the information is now
+presented in a much more opaque way:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : 0000:00:00.5
+ 1fc030000-1fc03ffff : 0000:00:00.5
+ 1fc060000-1fc0603ff : 0000:00:00.5
+ 1fc070000-1fc0701ff : 0000:00:00.5
+ 1fc080000-1fc0800ff : 0000:00:00.5
+ 1fc090000-1fc0900cb : 0000:00:00.5
+ 1fc100000-1fc10ffff : 0000:00:00.5
+ 1fc110000-1fc11ffff : 0000:00:00.5
+ 1fc120000-1fc12ffff : 0000:00:00.5
+ 1fc130000-1fc13ffff : 0000:00:00.5
+ 1fc140000-1fc14ffff : 0000:00:00.5
+ 1fc150000-1fc15ffff : 0000:00:00.5
+ 1fc200000-1fc21ffff : 0000:00:00.5
+ 1fc280000-1fc28ffff : 0000:00:00.5
+
+That patch made a fair comment that /proc/iomem might be confusing when
+it shows resources without an associated device, but we can do better
+than just hide the resource name altogether. Namely, we can print the
+device name _and_ the resource name. Like this:
+
+1fc000000-1fc3fffff : pcie@1f0000000
+ 1fc000000-1fc3fffff : 0000:00:00.5
+ 1fc010000-1fc01ffff : 0000:00:00.5 sys
+ 1fc030000-1fc03ffff : 0000:00:00.5 rew
+ 1fc060000-1fc0603ff : 0000:00:00.5 s2
+ 1fc070000-1fc0701ff : 0000:00:00.5 devcpu_gcb
+ 1fc080000-1fc0800ff : 0000:00:00.5 qs
+ 1fc090000-1fc0900cb : 0000:00:00.5 ptp
+ 1fc100000-1fc10ffff : 0000:00:00.5 port0
+ 1fc110000-1fc11ffff : 0000:00:00.5 port1
+ 1fc120000-1fc12ffff : 0000:00:00.5 port2
+ 1fc130000-1fc13ffff : 0000:00:00.5 port3
+ 1fc140000-1fc14ffff : 0000:00:00.5 port4
+ 1fc150000-1fc15ffff : 0000:00:00.5 port5
+ 1fc200000-1fc21ffff : 0000:00:00.5 qsys
+ 1fc280000-1fc28ffff : 0000:00:00.5 ana
+
+Fixes: 8d84b18f5678 ("devres: always use dev_name() in devm_ioremap_resource()")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20200601095826.1757621-1-olteanv@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/devres.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/lib/devres.c b/lib/devres.c
+index 6ef51f159c54b..ca0d28727ccef 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -119,6 +119,7 @@ __devm_ioremap_resource(struct device *dev, const struct resource *res,
+ {
+ resource_size_t size;
+ void __iomem *dest_ptr;
++ char *pretty_name;
+
+ BUG_ON(!dev);
+
+@@ -129,7 +130,15 @@ __devm_ioremap_resource(struct device *dev, const struct resource *res,
+
+ size = resource_size(res);
+
+- if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) {
++ if (res->name)
++ pretty_name = devm_kasprintf(dev, GFP_KERNEL, "%s %s",
++ dev_name(dev), res->name);
++ else
++ pretty_name = devm_kstrdup(dev, dev_name(dev), GFP_KERNEL);
++ if (!pretty_name)
++ return IOMEM_ERR_PTR(-ENOMEM);
++
++ if (!devm_request_mem_region(dev, res->start, size, pretty_name)) {
+ dev_err(dev, "can't request region for resource %pR\n", res);
+ return IOMEM_ERR_PTR(-EBUSY);
+ }
+--
+2.25.1
+
--- /dev/null
+From d959b0ec0bcc0c257e9c098387677091f5ed5ebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jun 2020 16:42:14 +0800
+Subject: dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit e766668c6cd49d741cfb49eaeb38998ba34d27bc ]
+
+dm_stop_queue() only uses blk_mq_quiesce_queue() so it doesn't
+formally stop the blk-mq queue; therefore there is no point making the
+blk_mq_queue_stopped() check -- it will never be stopped.
+
+In addition, even though dm_stop_queue() actually tries to quiesce hw
+queues via blk_mq_quiesce_queue(), checking with blk_queue_quiesced()
+to avoid unnecessary queue quiesce isn't reliable because: the
+QUEUE_FLAG_QUIESCED flag is set before synchronize_rcu() and
+dm_stop_queue() may be called when synchronize_rcu() from another
+blk_mq_quiesce_queue() is in-progress.
+
+Fixes: 7b17c2f7292ba ("dm: Fix a race condition related to stopping and starting queues")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-rq.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 85e0daabad49c..20745e2e34b94 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q)
+
+ void dm_stop_queue(struct request_queue *q)
+ {
+- if (blk_mq_queue_stopped(q))
+- return;
+-
+ blk_mq_quiesce_queue(q);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 0275b31a20d93f46dff67882b3175dd99dded355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 18:51:29 +0800
+Subject: drm/amdgpu/debugfs: fix memory leak when pm_runtime_get_sync failed
+
+From: Chen Tao <chentao107@huawei.com>
+
+[ Upstream commit 3e4aeff36e9212a939290c0ca70d4931c4ad1950 ]
+
+Fix memory leak in amdgpu_debugfs_gpr_read not freeing data when
+pm_runtime_get_sync failed.
+
+Fixes: a9ffe2a983383 ("drm/amdgpu/debugfs: properly handle runtime pm")
+Signed-off-by: Chen Tao <chentao107@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index f87b225437fc3..bd5061fbe031e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -973,7 +973,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+
+ r = pm_runtime_get_sync(adev->ddev->dev);
+ if (r < 0)
+- return r;
++ goto err;
+
+ r = amdgpu_virt_enable_access_debugfs(adev);
+ if (r < 0)
+@@ -1003,7 +1003,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ value = data[result >> 2];
+ r = put_user(value, (uint32_t *)buf);
+ if (r) {
+- result = r;
++ amdgpu_virt_disable_access_debugfs(adev);
+ goto err;
+ }
+
+@@ -1012,11 +1012,14 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
+ size -= 4;
+ }
+
+-err:
+- pm_runtime_put_autosuspend(adev->ddev->dev);
+ kfree(data);
+ amdgpu_virt_disable_access_debugfs(adev);
+ return result;
++
++err:
++ pm_runtime_put_autosuspend(adev->ddev->dev);
++ kfree(data);
++ return r;
+ }
+
+ /**
+--
+2.25.1
+
--- /dev/null
+From c90b08b6b2e73fa01b7a6ff9a45d1158ada5a4da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 13:39:59 +0300
+Subject: drm/vmwgfx: Fix two list_for_each loop exit tests
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ]
+
+These if statements are supposed to be true if we ended the
+list_for_each_entry() loops without hitting a break statement but they
+don't work.
+
+In the first loop, we increment "i" after the "if (i == unit)" condition
+so we don't necessarily know that "i" is not equal to unit at the end of
+the loop.
+
+In the second loop we exit when mode is not pointing to a valid
+drm_display_mode struct so it doesn't make sense to check "mode->type".
+
+Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 04d66592f6050..b7a9cee69ea72 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -2578,7 +2578,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ ++i;
+ }
+
+- if (i != unit) {
++ if (&con->head == &dev_priv->dev->mode_config.connector_list) {
+ DRM_ERROR("Could not find initial display unit.\n");
+ ret = -EINVAL;
+ goto out_unlock;
+@@ -2602,13 +2602,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
+ break;
+ }
+
+- if (mode->type & DRM_MODE_TYPE_PREFERRED)
+- *p_mode = mode;
+- else {
++ if (&mode->head == &con->modes) {
+ WARN_ONCE(true, "Could not find initial preferred mode.\n");
+ *p_mode = list_first_entry(&con->modes,
+ struct drm_display_mode,
+ head);
++ } else {
++ *p_mode = mode;
+ }
+
+ out_unlock:
+--
+2.25.1
+
--- /dev/null
+From 67eddf7af39ca5b166e33fce8c0ff95ca295a46d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 13:34:37 +0300
+Subject: drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1d2c0c565bc0da25f5e899a862fb58e612b222df ]
+
+The "entry" pointer is an offset from the list head and it doesn't
+point to a valid vmw_legacy_display_unit struct. Presumably the
+intent was to point to the last entry.
+
+Also the "i++" wasn't used so I have removed that as well.
+
+Fixes: d7e1958dbe4a ("drm/vmwgfx: Support older hardware.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Roland Scheidegger <sroland@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+index 16dafff5cab19..009f1742bed51 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ struct vmw_legacy_display_unit *entry;
+ struct drm_framebuffer *fb = NULL;
+ struct drm_crtc *crtc = NULL;
+- int i = 0;
++ int i;
+
+ /* If there is no display topology the host just assumes
+ * that the guest will set the same layout as the host.
+@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
+ crtc = &entry->base.crtc;
+ w = max(w, crtc->x + crtc->mode.hdisplay);
+ h = max(h, crtc->y + crtc->mode.vdisplay);
+- i++;
+ }
+
+ if (crtc == NULL)
+ return 0;
+- fb = entry->base.crtc.primary->state->fb;
++ fb = crtc->primary->state->fb;
+
+ return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0],
+ fb->format->cpp[0] * 8,
+--
+2.25.1
+
--- /dev/null
+From ec5dd006eab28f7fdbc367116771af7e461b6dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 16:52:50 +0800
+Subject: f2fs: compress: fix to avoid memory leak on cc->cpages
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 02772fbfcba8597eef9d5c5f7f94087132d0c1d4 ]
+
+Memory allocated for storing compressed pages' poitner should be
+released after f2fs_write_compressed_pages(), otherwise it will
+cause memory leak issue.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 1e02a8c106b0a..f6fbe61b1251e 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1353,6 +1353,8 @@ int f2fs_write_multi_pages(struct compress_ctx *cc,
+ err = f2fs_write_compressed_pages(cc, submitted,
+ wbc, io_type);
+ cops->destroy_compress_ctx(cc);
++ kfree(cc->cpages);
++ cc->cpages = NULL;
+ if (!err)
+ return 0;
+ f2fs_bug_on(F2FS_I_SB(cc->inode), err != -EAGAIN);
+--
+2.25.1
+
--- /dev/null
+From 676b3372bced60f228333dbe46f6ac2c940657e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 18:21:36 +0800
+Subject: f2fs: compress: fix to update isize when overwriting compressed file
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 944dd22ea4475bd11180fd2f431a4a547ca4d8f5 ]
+
+We missed to update isize of compressed file in write_end() with
+below case:
+
+cluster size is 16KB
+
+- write 14KB data from offset 0
+- overwrite 16KB data from offset 0
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 326c63879ddc8..6e9017e6a8197 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -3432,6 +3432,10 @@ static int f2fs_write_end(struct file *file,
+ if (f2fs_compressed_file(inode) && fsdata) {
+ f2fs_compress_write_end(inode, fsdata, page->index, copied);
+ f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
++
++ if (pos + copied > i_size_read(inode) &&
++ !f2fs_verity_in_progress(inode))
++ f2fs_i_size_write(inode, pos + copied);
+ return copied;
+ }
+ #endif
+--
+2.25.1
+
--- /dev/null
+From 8adc8f50b35233cafaf9d01aac985af932cdc1cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:36 -0700
+Subject: fs/minix: fix block limit check for V1 filesystems
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0a12c4a8069607247cb8edc3b035a664e636fd9a ]
+
+The minix filesystem reads its maximum file size from its on-disk
+superblock. This value isn't necessarily a multiple of the block size.
+When it's not, the V1 block mapping code doesn't allow mapping the last
+possible block. Commit 6ed6a722f9ab ("minixfs: fix block limit check")
+fixed this in the V2 mapping code. Fix it in the V1 mapping code too.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-6-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/itree_v1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index c0d418209ead1..405573a79aab4 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) {
++ } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+--
+2.25.1
+
--- /dev/null
+From 5dbf5068c96439f96049d82cc2781f2e04d37e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:39 -0700
+Subject: fs/minix: remove expected error message in block_to_path()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f666f9fb9a36f1c833b9d18923572f0e4d304754 ]
+
+When truncating a file to a size within the last allowed logical block,
+block_to_path() is called with the *next* block. This exceeds the limit,
+causing the "block %ld too big" error message to be printed.
+
+This case isn't actually an error; there are just no more blocks past that
+point. So, remove this error message.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-7-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/itree_v1.c | 12 ++++++------
+ fs/minix/itree_v2.c | 12 ++++++------
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 405573a79aab4..1fed906042aa8 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, inode->i_sb->s_bdev);
+- } else if (block < 7) {
++ return 0;
++ }
++ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes)
++ return 0;
++
++ if (block < 7) {
+ offsets[n++] = block;
+ } else if ((block -= 7) < 512) {
+ offsets[n++] = 7;
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index ee8af2f9e2828..9d00f31a2d9d1 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -32,12 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, sb->s_bdev);
+- } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) {
+- if (printk_ratelimit())
+- printk("MINIX-fs: block_to_path: "
+- "block %ld too big on dev %pg\n",
+- block, sb->s_bdev);
+- } else if (block < DIRCOUNT) {
++ return 0;
++ }
++ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes)
++ return 0;
++
++ if (block < DIRCOUNT) {
+ offsets[n++] = block;
+ } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) {
+ offsets[n++] = DIRCOUNT;
+--
+2.25.1
+
--- /dev/null
+From 4033d88f5d69757e09f1ff2199ee75919b4b1e9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:33 -0700
+Subject: fs/minix: set s_maxbytes correctly
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 32ac86efff91a3e4ef8c3d1cadd4559e23c8e73a ]
+
+The minix filesystem leaves super_block::s_maxbytes at MAX_NON_LFS rather
+than setting it to the actual filesystem-specific limit. This is broken
+because it means userspace doesn't see the standard behavior like getting
+EFBIG and SIGXFSZ when exceeding the maximum file size.
+
+Fix this by setting s_maxbytes correctly.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Qiujun Huang <anenbupt@gmail.com>
+Link: http://lkml.kernel.org/r/20200628060846.682158-5-ebiggers@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/minix/inode.c | 12 +++++++-----
+ fs/minix/itree_v1.c | 2 +-
+ fs/minix/itree_v2.c | 3 +--
+ fs/minix/minix.h | 1 -
+ 4 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/fs/minix/inode.c b/fs/minix/inode.c
+index 0dd929346f3f3..7b09a9158e401 100644
+--- a/fs/minix/inode.c
++++ b/fs/minix/inode.c
+@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data)
+ return 0;
+ }
+
+-static bool minix_check_superblock(struct minix_sb_info *sbi)
++static bool minix_check_superblock(struct super_block *sb)
+ {
++ struct minix_sb_info *sbi = minix_sb(sb);
++
+ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
+ return false;
+
+@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi)
+ * of indirect blocks which places the limit well above U32_MAX.
+ */
+ if (sbi->s_version == MINIX_V1 &&
+- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
++ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE)
+ return false;
+
+ return true;
+@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = ms->s_zmap_blocks;
+ sbi->s_firstdatazone = ms->s_firstdatazone;
+ sbi->s_log_zone_size = ms->s_log_zone_size;
+- sbi->s_max_size = ms->s_max_size;
++ s->s_maxbytes = ms->s_max_size;
+ s->s_magic = ms->s_magic;
+ if (s->s_magic == MINIX_SUPER_MAGIC) {
+ sbi->s_version = MINIX_V1;
+@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ sbi->s_zmap_blocks = m3s->s_zmap_blocks;
+ sbi->s_firstdatazone = m3s->s_firstdatazone;
+ sbi->s_log_zone_size = m3s->s_log_zone_size;
+- sbi->s_max_size = m3s->s_max_size;
++ s->s_maxbytes = m3s->s_max_size;
+ sbi->s_ninodes = m3s->s_ninodes;
+ sbi->s_nzones = m3s->s_zones;
+ sbi->s_dirsize = 64;
+@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
+ } else
+ goto out_no_fs;
+
+- if (!minix_check_superblock(sbi))
++ if (!minix_check_superblock(s))
+ goto out_illegal_sb;
+
+ /*
+diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
+index 046cc96ee7adb..c0d418209ead1 100644
+--- a/fs/minix/itree_v1.c
++++ b/fs/minix/itree_v1.c
+@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, inode->i_sb->s_bdev);
+- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
++ } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
+index f7fc7eccccccd..ee8af2f9e2828 100644
+--- a/fs/minix/itree_v2.c
++++ b/fs/minix/itree_v2.c
+@@ -32,8 +32,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
+ if (block < 0) {
+ printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
+ block, sb->s_bdev);
+- } else if ((u64)block * (u64)sb->s_blocksize >=
+- minix_sb(sb)->s_max_size) {
++ } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) {
+ if (printk_ratelimit())
+ printk("MINIX-fs: block_to_path: "
+ "block %ld too big on dev %pg\n",
+diff --git a/fs/minix/minix.h b/fs/minix/minix.h
+index df081e8afcc3c..168d45d3de73e 100644
+--- a/fs/minix/minix.h
++++ b/fs/minix/minix.h
+@@ -32,7 +32,6 @@ struct minix_sb_info {
+ unsigned long s_zmap_blocks;
+ unsigned long s_firstdatazone;
+ unsigned long s_log_zone_size;
+- unsigned long s_max_size;
+ int s_dirsize;
+ int s_namelen;
+ struct buffer_head ** s_imap;
+--
+2.25.1
+
--- /dev/null
+From 5170f5de073bac949442420b2e996fb1c8eaf8a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:35:53 -0700
+Subject: fs/ufs: avoid potential u32 multiplication overflow
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ]
+
+The 64 bit ino is being compared to the product of two u32 values,
+however, the multiplication is being performed using a 32 bit multiply so
+there is a potential of an overflow. To be fully safe, cast uspi->s_ncg
+to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of
+overflow.
+
+Fixes: f3e2a520f5fb ("ufs: NFS support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Evgeniy Dushistov <dushistov@mail.ru>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com
+Addresses-Coverity: ("Unintentional integer overflow")
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ufs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ufs/super.c b/fs/ufs/super.c
+index 1da0be667409b..e3b69fb280e8c 100644
+--- a/fs/ufs/super.c
++++ b/fs/ufs/super.c
+@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene
+ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+ struct inode *inode;
+
+- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
+ return ERR_PTR(-ESTALE);
+
+ inode = ufs_iget(sb, ino);
+--
+2.25.1
+
--- /dev/null
+From 9f1918de69c005ebc1235af6e0aec6fc12944d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 15:40:37 -0700
+Subject: gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+[ Upstream commit 0f6245f42ce9b7e4d20f2cda8d5f12b55a44d7d1 ]
+
+Combine the rotate_irq() and norotate_irq() handlers into a single
+eof_irq() handler.
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-image-convert.c | 58 +++++++++-----------------
+ 1 file changed, 20 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index eeca50d9a1ee4..f8b031ded3cf2 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -1709,9 +1709,10 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run)
+ return IRQ_WAKE_THREAD;
+ }
+
+-static irqreturn_t norotate_irq(int irq, void *data)
++static irqreturn_t eof_irq(int irq, void *data)
+ {
+ struct ipu_image_convert_chan *chan = data;
++ struct ipu_image_convert_priv *priv = chan->priv;
+ struct ipu_image_convert_ctx *ctx;
+ struct ipu_image_convert_run *run;
+ unsigned long flags;
+@@ -1728,45 +1729,26 @@ static irqreturn_t norotate_irq(int irq, void *data)
+
+ ctx = run->ctx;
+
+- if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this is a rotation operation, just ignore */
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+- ret = do_irq(run);
+-out:
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return ret;
+-}
+-
+-static irqreturn_t rotate_irq(int irq, void *data)
+-{
+- struct ipu_image_convert_chan *chan = data;
+- struct ipu_image_convert_priv *priv = chan->priv;
+- struct ipu_image_convert_ctx *ctx;
+- struct ipu_image_convert_run *run;
+- unsigned long flags;
+- irqreturn_t ret;
+-
+- spin_lock_irqsave(&chan->irqlock, flags);
+-
+- /* get current run and its context */
+- run = chan->current_run;
+- if (!run) {
++ if (irq == chan->out_eof_irq) {
++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this is a rotation op, just ignore */
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else if (irq == chan->rot_out_eof_irq) {
++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
++ /* this was NOT a rotation op, shouldn't happen */
++ dev_err(priv->ipu->dev,
++ "Unexpected rotation interrupt\n");
++ ret = IRQ_HANDLED;
++ goto out;
++ }
++ } else {
++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
+ ret = IRQ_NONE;
+ goto out;
+ }
+
+- ctx = run->ctx;
+-
+- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this was NOT a rotation operation, shouldn't happen */
+- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n");
+- spin_unlock_irqrestore(&chan->irqlock, flags);
+- return IRQ_HANDLED;
+- }
+-
+ ret = do_irq(run);
+ out:
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+@@ -1859,7 +1841,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh,
++ ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+@@ -1872,7 +1854,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ chan->rotation_out_chan,
+ IPU_IRQ_EOF);
+
+- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh,
++ ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
+ 0, "ipu-ic", chan);
+ if (ret < 0) {
+ dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+--
+2.25.1
+
--- /dev/null
+From ba7f6ce4c90805844b65f73627725476d2f0e187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 11:13:37 -0700
+Subject: gpu: ipu-v3: image-convert: Wait for all EOFs before completing a
+ tile
+
+From: Steve Longerbeam <slongerbeam@gmail.com>
+
+[ Upstream commit dd81d821d0b3f77d949d0cac5c05c1f05b921d46 ]
+
+Use a bit-mask of EOF irqs to determine when all required idmac
+channel EOFs have been received for a tile conversion, and only do
+tile completion processing after all EOFs have been received. Otherwise
+it was found that a conversion would stall after the completion of a
+tile and the start of the next tile, because the input/read idmac
+channel had not completed and entered idle state, thus locking up the
+channel when attempting to re-start it for the next tile.
+
+Fixes: 0537db801bb01 ("gpu: ipu-v3: image-convert: reconfigure IC per tile")
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-image-convert.c | 109 +++++++++++++++++++------
+ 1 file changed, 82 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c
+index f8b031ded3cf2..aa1d4b6d278f7 100644
+--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
+@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx;
+ struct ipu_image_convert_chan;
+ struct ipu_image_convert_priv;
+
++enum eof_irq_mask {
++ EOF_IRQ_IN = BIT(0),
++ EOF_IRQ_ROT_IN = BIT(1),
++ EOF_IRQ_OUT = BIT(2),
++ EOF_IRQ_ROT_OUT = BIT(3),
++};
++
++#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT)
++#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \
++ EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT)
++
+ struct ipu_image_convert_ctx {
+ struct ipu_image_convert_chan *chan;
+
+@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx {
+ /* where to place converted tile in dest image */
+ unsigned int out_tile_map[MAX_TILES];
+
++ /* mask of completed EOF irqs at every tile conversion */
++ enum eof_irq_mask eof_mask;
++
+ struct list_head list;
+ };
+
+@@ -189,6 +203,8 @@ struct ipu_image_convert_chan {
+ struct ipuv3_channel *rotation_out_chan;
+
+ /* the IPU end-of-frame irqs */
++ int in_eof_irq;
++ int rot_in_eof_irq;
+ int out_eof_irq;
+ int rot_out_eof_irq;
+
+@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile)
+ dev_dbg(priv->ipu->dev, "%s: task %u: starting ctx %p run %p tile %u -> %u\n",
+ __func__, chan->ic_task, ctx, run, tile, dst_tile);
+
++ /* clear EOF irq mask */
++ ctx->eof_mask = 0;
++
+ if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+ /* swap width/height for resizer */
+ dest_width = d_image->tile[dst_tile].height;
+@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx)
+ }
+
+ /* hold irqlock when calling */
+-static irqreturn_t do_irq(struct ipu_image_convert_run *run)
++static irqreturn_t do_tile_complete(struct ipu_image_convert_run *run)
+ {
+ struct ipu_image_convert_ctx *ctx = run->ctx;
+ struct ipu_image_convert_chan *chan = ctx->chan;
+@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run)
+ ctx->cur_buf_num ^= 1;
+ }
+
++ ctx->eof_mask = 0; /* clear EOF irq mask for next tile */
+ ctx->next_tile++;
+ return IRQ_HANDLED;
+ done:
+@@ -1715,8 +1735,9 @@ static irqreturn_t eof_irq(int irq, void *data)
+ struct ipu_image_convert_priv *priv = chan->priv;
+ struct ipu_image_convert_ctx *ctx;
+ struct ipu_image_convert_run *run;
++ irqreturn_t ret = IRQ_HANDLED;
++ bool tile_complete = false;
+ unsigned long flags;
+- irqreturn_t ret;
+
+ spin_lock_irqsave(&chan->irqlock, flags);
+
+@@ -1729,27 +1750,33 @@ static irqreturn_t eof_irq(int irq, void *data)
+
+ ctx = run->ctx;
+
+- if (irq == chan->out_eof_irq) {
+- if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+- /* this is a rotation op, just ignore */
+- ret = IRQ_HANDLED;
+- goto out;
+- }
+- } else if (irq == chan->rot_out_eof_irq) {
++ if (irq == chan->in_eof_irq) {
++ ctx->eof_mask |= EOF_IRQ_IN;
++ } else if (irq == chan->out_eof_irq) {
++ ctx->eof_mask |= EOF_IRQ_OUT;
++ } else if (irq == chan->rot_in_eof_irq ||
++ irq == chan->rot_out_eof_irq) {
+ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+ /* this was NOT a rotation op, shouldn't happen */
+ dev_err(priv->ipu->dev,
+ "Unexpected rotation interrupt\n");
+- ret = IRQ_HANDLED;
+ goto out;
+ }
++ ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ?
++ EOF_IRQ_ROT_IN : EOF_IRQ_ROT_OUT;
+ } else {
+ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
+ ret = IRQ_NONE;
+ goto out;
+ }
+
+- ret = do_irq(run);
++ if (ipu_rot_mode_is_irt(ctx->rot_mode))
++ tile_complete = (ctx->eof_mask == EOF_IRQ_ROT_COMPLETE);
++ else
++ tile_complete = (ctx->eof_mask == EOF_IRQ_COMPLETE);
++
++ if (tile_complete)
++ ret = do_tile_complete(run);
+ out:
+ spin_unlock_irqrestore(&chan->irqlock, flags);
+ return ret;
+@@ -1783,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx)
+
+ static void release_ipu_resources(struct ipu_image_convert_chan *chan)
+ {
++ if (chan->in_eof_irq >= 0)
++ free_irq(chan->in_eof_irq, chan);
++ if (chan->rot_in_eof_irq >= 0)
++ free_irq(chan->rot_in_eof_irq, chan);
+ if (chan->out_eof_irq >= 0)
+ free_irq(chan->out_eof_irq, chan);
+ if (chan->rot_out_eof_irq >= 0)
+@@ -1801,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan)
+
+ chan->in_chan = chan->out_chan = chan->rotation_in_chan =
+ chan->rotation_out_chan = NULL;
+- chan->out_eof_irq = chan->rot_out_eof_irq = -1;
++ chan->in_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
++ chan->out_eof_irq = -1;
++ chan->rot_out_eof_irq = -1;
++}
++
++static int get_eof_irq(struct ipu_image_convert_chan *chan,
++ struct ipuv3_channel *channel)
++{
++ struct ipu_image_convert_priv *priv = chan->priv;
++ int ret, irq;
++
++ irq = ipu_idmac_channel_irq(priv->ipu, channel, IPU_IRQ_EOF);
++
++ ret = request_threaded_irq(irq, eof_irq, do_bh, 0, "ipu-ic", chan);
++ if (ret < 0) {
++ dev_err(priv->ipu->dev, "could not acquire irq %d\n", irq);
++ return ret;
++ }
++
++ return irq;
+ }
+
+ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+@@ -1837,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan)
+ }
+
+ /* acquire the EOF interrupts */
+- chan->out_eof_irq = ipu_idmac_channel_irq(priv->ipu,
+- chan->out_chan,
+- IPU_IRQ_EOF);
++ ret = get_eof_irq(chan, chan->in_chan);
++ if (ret < 0) {
++ chan->in_eof_irq = -1;
++ goto err;
++ }
++ chan->in_eof_irq = ret;
+
+- ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
+- 0, "ipu-ic", chan);
++ ret = get_eof_irq(chan, chan->rotation_in_chan);
+ if (ret < 0) {
+- dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+- chan->out_eof_irq);
+- chan->out_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
+ goto err;
+ }
++ chan->rot_in_eof_irq = ret;
+
+- chan->rot_out_eof_irq = ipu_idmac_channel_irq(priv->ipu,
+- chan->rotation_out_chan,
+- IPU_IRQ_EOF);
++ ret = get_eof_irq(chan, chan->out_chan);
++ if (ret < 0) {
++ chan->out_eof_irq = -1;
++ goto err;
++ }
++ chan->out_eof_irq = ret;
+
+- ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
+- 0, "ipu-ic", chan);
++ ret = get_eof_irq(chan, chan->rotation_out_chan);
+ if (ret < 0) {
+- dev_err(priv->ipu->dev, "could not acquire irq %d\n",
+- chan->rot_out_eof_irq);
+ chan->rot_out_eof_irq = -1;
+ goto err;
+ }
++ chan->rot_out_eof_irq = ret;
+
+ return 0;
+ err:
+@@ -2440,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev)
+ chan->ic_task = i;
+ chan->priv = priv;
+ chan->dma_ch = &image_convert_dma_chan[i];
++ chan->in_eof_irq = -1;
++ chan->rot_in_eof_irq = -1;
+ chan->out_eof_irq = -1;
+ chan->rot_out_eof_irq = -1;
+
+--
+2.25.1
+
--- /dev/null
+From 5c5380dac02ef9dcf658ec11dfb3ed59e4a9bb50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 17:42:40 -0700
+Subject: i2c: iproc: fix race between client unreg and isr
+
+From: Dhananjay Phadke <dphadke@linux.microsoft.com>
+
+[ Upstream commit b1eef236f50ba6afea680da039ef3a2ca9c43d11 ]
+
+When i2c client unregisters, synchronize irq before setting
+iproc_i2c->slave to NULL.
+
+(1) disable_irq()
+(2) Mask event enable bits in control reg
+(3) Erase slave address (avoid further writes to rx fifo)
+(4) Flush tx and rx FIFOs
+(5) Clear pending event (interrupt) bits in status reg
+(6) enable_irq()
+(7) Set client pointer to NULL
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000318
+
+[ 371.020421] pc : bcm_iproc_i2c_isr+0x530/0x11f0
+[ 371.025098] lr : __handle_irq_event_percpu+0x6c/0x170
+[ 371.030309] sp : ffff800010003e40
+[ 371.033727] x29: ffff800010003e40 x28: 0000000000000060
+[ 371.039206] x27: ffff800010ca9de0 x26: ffff800010f895df
+[ 371.044686] x25: ffff800010f18888 x24: ffff0008f7ff3600
+[ 371.050165] x23: 0000000000000003 x22: 0000000001600000
+[ 371.055645] x21: ffff800010f18888 x20: 0000000001600000
+[ 371.061124] x19: ffff0008f726f080 x18: 0000000000000000
+[ 371.066603] x17: 0000000000000000 x16: 0000000000000000
+[ 371.072082] x15: 0000000000000000 x14: 0000000000000000
+[ 371.077561] x13: 0000000000000000 x12: 0000000000000001
+[ 371.083040] x11: 0000000000000000 x10: 0000000000000040
+[ 371.088519] x9 : ffff800010f317c8 x8 : ffff800010f317c0
+[ 371.093999] x7 : ffff0008f805b3b0 x6 : 0000000000000000
+[ 371.099478] x5 : ffff0008f7ff36a4 x4 : ffff8008ee43d000
+[ 371.104957] x3 : 0000000000000000 x2 : ffff8000107d64c0
+[ 371.110436] x1 : 00000000c00000af x0 : 0000000000000000
+
+[ 371.115916] Call trace:
+[ 371.118439] bcm_iproc_i2c_isr+0x530/0x11f0
+[ 371.122754] __handle_irq_event_percpu+0x6c/0x170
+[ 371.127606] handle_irq_event_percpu+0x34/0x88
+[ 371.132189] handle_irq_event+0x40/0x120
+[ 371.136234] handle_fasteoi_irq+0xcc/0x1a0
+[ 371.140459] generic_handle_irq+0x24/0x38
+[ 371.144594] __handle_domain_irq+0x60/0xb8
+[ 371.148820] gic_handle_irq+0xc0/0x158
+[ 371.152687] el1_irq+0xb8/0x140
+[ 371.155927] arch_cpu_idle+0x10/0x18
+[ 371.159615] do_idle+0x204/0x290
+[ 371.162943] cpu_startup_entry+0x24/0x60
+[ 371.166990] rest_init+0xb0/0xbc
+[ 371.170322] arch_call_rest_init+0xc/0x14
+[ 371.174458] start_kernel+0x404/0x430
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+
+Signed-off-by: Dhananjay Phadke <dphadke@linux.microsoft.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 8a3c98866fb7e..688e928188214 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -1078,7 +1078,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ if (!iproc_i2c->slave)
+ return -EINVAL;
+
+- iproc_i2c->slave = NULL;
++ disable_irq(iproc_i2c->irq);
+
+ /* disable all slave interrupts */
+ tmp = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+@@ -1091,6 +1091,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT);
+ iproc_i2c_wr_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET, tmp);
+
++ /* flush TX/RX FIFOs */
++ tmp = (BIT(S_FIFO_RX_FLUSH_SHIFT) | BIT(S_FIFO_TX_FLUSH_SHIFT));
++ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, tmp);
++
++ /* clear all pending slave interrupts */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, ISR_MASK_SLAVE);
++
++ iproc_i2c->slave = NULL;
++
++ enable_irq(iproc_i2c->irq);
++
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From eabbe83f3996ad4a856cbcb806a9c70451168a57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 18:16:06 +0200
+Subject: i2c: rcar: avoid race when unregistering slave
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit c7c9e914f9a0478fba4dc6f227cfd69cf84a4063 ]
+
+Due to the lockless design of the driver, it is theoretically possible
+to access a NULL pointer, if a slave interrupt was running while we were
+unregistering the slave. To make this rock solid, disable the interrupt
+for a short time while we are clearing the interrupt_enable register.
+This patch is purely based on code inspection. The OOPS is super-hard to
+trigger because clearing SAR (the address) makes interrupts even more
+unlikely to happen as well. While here, reinit SCR to SDBS because this
+bit should always be set according to documentation. There is no effect,
+though, because the interface is disabled.
+
+Fixes: 7b814d852af6 ("i2c: rcar: avoid race when unregistering slave client")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 76c615be5acae..9e883474db8ce 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -866,12 +866,14 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
+- /* disable irqs and ensure none is running before clearing ptr */
++ /* ensure no irq is running before clearing ptr */
++ disable_irq(priv->irq);
+ rcar_i2c_write(priv, ICSIER, 0);
+- rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSSR, 0);
++ enable_irq(priv->irq);
++ rcar_i2c_write(priv, ICSCR, SDBS);
+ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+- synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+--
+2.25.1
+
--- /dev/null
+From 0f070a1f703f6e5570af8cd66b5ce81f0e38de11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 17:38:07 +0200
+Subject: i2c: rcar: slave: only send STOP event when we have been addressed
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ]
+
+When the SSR interrupt is activated, it will detect every STOP condition
+on the bus, not only the ones after we have been addressed. So, enable
+this interrupt only after we have been addressed, and disable it
+otherwise.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 2e3e1bb750134..76c615be5acae 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -583,13 +583,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
+ }
+
+- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff);
++ /* Clear SSR, too, because of old STOPs to other clients than us */
++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff);
+ }
+
+ /* master sent stop */
+ if (ssr_filtered & SSR) {
+ i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
+ }
+
+@@ -853,7 +854,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
+ priv->slave = slave;
+ rcar_i2c_write(priv, ICSAR, slave->addr);
+ rcar_i2c_write(priv, ICSSR, 0);
+- rcar_i2c_write(priv, ICSIER, SAR | SSR);
++ rcar_i2c_write(priv, ICSIER, SAR);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS);
+
+ return 0;
+--
+2.25.1
+
--- /dev/null
+From 07235882dd0127bbc700e94e5f97f21022148ab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 12:39:11 +0300
+Subject: IB/uverbs: Set IOVA on IB MR in uverbs layer
+
+From: Yishai Hadas <yishaih@mellanox.com>
+
+[ Upstream commit 04c0a5fcfcf65aade2fb238b6336445f1a99b646 ]
+
+Set IOVA on IB MR in uverbs layer to let all drivers have it, this
+includes both reg/rereg MR flows.
+As part of this change cleaned-up this setting from the drivers that
+already did it by themselves in their user flows.
+
+Fixes: e6f0330106f4 ("mlx4_ib: set user mr attributes in struct ib_mr")
+Link: https://lore.kernel.org/r/20200630093916.332097-3-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/uverbs_cmd.c | 4 ++++
+ drivers/infiniband/hw/cxgb4/mem.c | 1 -
+ drivers/infiniband/hw/mlx4/mr.c | 1 -
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index b48b3f6e632d4..557644dcc9237 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -770,6 +770,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs)
+ mr->uobject = uobj;
+ atomic_inc(&pd->usecnt);
+ mr->res.type = RDMA_RESTRACK_MR;
++ mr->iova = cmd.hca_va;
+ rdma_restrack_uadd(&mr->res);
+
+ uobj->object = mr;
+@@ -861,6 +862,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
+ atomic_dec(&old_pd->usecnt);
+ }
+
++ if (cmd.flags & IB_MR_REREG_TRANS)
++ mr->iova = cmd.hca_va;
++
+ memset(&resp, 0, sizeof(resp));
+ resp.lkey = mr->lkey;
+ resp.rkey = mr->rkey;
+diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
+index 962dc97a8ff2b..1e4f4e5255980 100644
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag)
+ mmid = stag >> 8;
+ mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+ mhp->ibmr.length = mhp->attr.len;
+- mhp->ibmr.iova = mhp->attr.va_fbo;
+ mhp->ibmr.page_size = 1U << (mhp->attr.page_size + 12);
+ pr_debug("mmid 0x%x mhp %p\n", mmid, mhp);
+ return xa_insert_irq(&mhp->rhp->mrs, mmid, mhp, GFP_KERNEL);
+diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
+index 7e0b205c05eb3..d7c78f841d2f5 100644
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+
+ mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
+ mr->ibmr.length = length;
+- mr->ibmr.iova = virt_addr;
+ mr->ibmr.page_size = 1U << shift;
+
+ return &mr->ibmr;
+--
+2.25.1
+
--- /dev/null
+From 1c1e42cdc53cf9f81a0f582a096a612c13a7b993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 01:19:06 -0500
+Subject: ima: Fail rule parsing when appraise_flag=blacklist is unsupportable
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit 5f3e92657bbfb63ad3109433d843c89996114b03 ]
+
+Verifying that a file hash is not blacklisted is currently only
+supported for files with appended signatures (modsig). In the future,
+this might change.
+
+For now, the "appraise_flag" option is only appropriate for appraise
+actions and its "blacklist" value is only appropriate when
+CONFIG_IMA_APPRAISE_MODSIG is enabled and "appraise_flag=blacklist" is
+only appropriate when "appraise_type=imasig|modsig" is also present.
+Make this clear at policy load so that IMA policy authors don't assume
+that other uses of "appraise_flag=blacklist" are supported.
+
+Fixes: 273df864cf74 ("ima: Check against blacklisted hashes for files with modsig")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reivewed-by: Nayna Jain <nayna@linux.ibm.com>
+Tested-by: Nayna Jain <nayna@linux.ibm.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_policy.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 3e3e568c81309..a59bf2f5b2d4f 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -1035,6 +1035,11 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)
+ return false;
+ }
+
++ /* Ensure that combinations of flags are compatible with each other */
++ if (entry->flags & IMA_CHECK_BLACKLIST &&
++ !(entry->flags & IMA_MODSIG_ALLOWED))
++ return false;
++
+ return true;
+ }
+
+@@ -1371,9 +1376,17 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ result = -EINVAL;
+ break;
+ case Opt_appraise_flag:
++ if (entry->action != APPRAISE) {
++ result = -EINVAL;
++ break;
++ }
++
+ ima_log_string(ab, "appraise_flag", args[0].from);
+- if (strstr(args[0].from, "blacklist"))
++ if (IS_ENABLED(CONFIG_IMA_APPRAISE_MODSIG) &&
++ strstr(args[0].from, "blacklist"))
+ entry->flags |= IMA_CHECK_BLACKLIST;
++ else
++ result = -EINVAL;
+ break;
+ case Opt_permit_directio:
+ entry->flags |= IMA_PERMIT_DIRECTIO;
+--
+2.25.1
+
--- /dev/null
+From f7fd22c0952a7f0fafd46299983ae6b7ee5d7105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 15:35:34 -0700
+Subject: Input: sentelic - fix error return when fsp_reg_write fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit ea38f06e0291986eb93beb6d61fd413607a30ca4 ]
+
+Currently when the call to fsp_reg_write fails -EIO is not being returned
+because the count is being returned instead of the return value in retval.
+Fix this by returning the value in retval instead of count.
+
+Addresses-Coverity: ("Unused value")
+Fixes: fc69f4a6af49 ("Input: add new driver for Sentelic Finger Sensing Pad")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200603141218.131663-1-colin.king@canonical.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/sentelic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
+index e99d9bf1a267d..e78c4c7eda34d 100644
+--- a/drivers/input/mouse/sentelic.c
++++ b/drivers/input/mouse/sentelic.c
+@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data,
+
+ fsp_reg_write_enable(psmouse, false);
+
+- return count;
++ return retval;
+ }
+
+ PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg);
+--
+2.25.1
+
--- /dev/null
+From a2fe1143b70b5b05707e576a881a09d52752e294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 20:22:11 +0100
+Subject: iommu/omap: Check for failure of a call to omap_iommu_dump_ctx
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dee9d154f40c58d02f69acdaa5cfd1eae6ebc28b ]
+
+It is possible for the call to omap_iommu_dump_ctx to return
+a negative error number, so check for the failure and return
+the error number rather than pass the negative value to
+simple_read_from_buffer.
+
+Fixes: 14e0e6796a0d ("OMAP: iommu: add initial debugfs support")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20200714192211.744776-1-colin.king@canonical.com
+Addresses-Coverity: ("Improper use of negative value")
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/omap-iommu-debug.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
+index 8e19bfa94121e..a99afb5d9011c 100644
+--- a/drivers/iommu/omap-iommu-debug.c
++++ b/drivers/iommu/omap-iommu-debug.c
+@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
+ mutex_lock(&iommu_debug_lock);
+
+ bytes = omap_iommu_dump_ctx(obj, p, count);
++ if (bytes < 0)
++ goto err;
+ bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes);
+
++err:
+ mutex_unlock(&iommu_debug_lock);
+ kfree(buf);
+
+--
+2.25.1
+
--- /dev/null
+From 7dc518b4ba67165ffd7ab5a12517073082fcff9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:49:20 +0800
+Subject: iommu/vt-d: Disable multiple GPASID-dev bind
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit d315e9e684d1efd4cb2e8cd70b8d71dec02fcf1f ]
+
+For the unlikely use case where multiple aux domains from the same pdev
+are attached to a single guest and then bound to a single process
+(thus same PASID) within that guest, we cannot easily support this case
+by refcounting the number of users. As there is only one SL page table
+per PASID while we have multiple aux domains thus multiple SL page tables
+for the same PASID.
+
+Extra unbinding guest PASID can happen due to race between normal and
+exception cases. Termination of one aux domain may affect others unless
+we actively track and switch aux domains to ensure the validity of SL
+page tables and TLB states in the shared PASID entry.
+
+Support for sharing second level PGDs across domains can reduce the
+complexity but this is not available due to the limitations on VFIO
+container architecture. We can revisit this decision once sharing PGDs
+are available.
+
+Overall, the complexity and potential glitch do not warrant this unlikely
+use case thereby removed by this patch.
+
+Fixes: 56722a4398a30 ("iommu/vt-d: Add bind guest PASID support")
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20200724014925.15523-8-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 6c87c807a0abb..d386853121a26 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -277,20 +277,16 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,
+ goto out;
+ }
+
++ /*
++ * Do not allow multiple bindings of the same device-PASID since
++ * there is only one SL page tables per PASID. We may revisit
++ * once sharing PGD across domains are supported.
++ */
+ for_each_svm_dev(sdev, svm, dev) {
+- /*
+- * For devices with aux domains, we should allow
+- * multiple bind calls with the same PASID and pdev.
+- */
+- if (iommu_dev_feature_enabled(dev,
+- IOMMU_DEV_FEAT_AUX)) {
+- sdev->users++;
+- } else {
+- dev_warn_ratelimited(dev,
+- "Already bound with PASID %u\n",
+- svm->pasid);
+- ret = -EBUSY;
+- }
++ dev_warn_ratelimited(dev,
++ "Already bound with PASID %u\n",
++ svm->pasid);
++ ret = -EBUSY;
+ goto out;
+ }
+ } else {
+--
+2.25.1
+
--- /dev/null
+From b07d9e8da30c802a2ceca13a3b9f86791099b227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:49:14 +0800
+Subject: iommu/vt-d: Enforce PASID devTLB field mask
+
+From: Liu Yi L <yi.l.liu@intel.com>
+
+[ Upstream commit 5f77d6ca5ca74e4b4a5e2e010f7ff50c45dea326 ]
+
+Set proper masks to avoid invalid input spillover to reserved bits.
+
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Link: https://lore.kernel.org/r/20200724014925.15523-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/intel-iommu.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 04bd9279c3fb3..711bdca975be3 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -381,8 +381,8 @@ enum {
+
+ #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK)
+ #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11)
+-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g)
+-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1)
++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32)
+ #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
+ #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
+ #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
+--
+2.25.1
+
--- /dev/null
+From 78b401b21e4b983e5bb11de4f332b0d2521b1081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:49:17 +0800
+Subject: iommu/vt-d: Handle non-page aligned address
+
+From: Liu Yi L <yi.l.liu@intel.com>
+
+[ Upstream commit 288d08e78008828416ffaa85ef274b4e29ef3dae ]
+
+Address information for device TLB invalidation comes from userspace
+when device is directly assigned to a guest with vIOMMU support.
+VT-d requires page aligned address. This patch checks and enforce
+address to be page aligned, otherwise reserved bits can be set in the
+invalidation descriptor. Unrecoverable fault will be reported due to
+non-zero value in the reserved bits.
+
+Fixes: 61a06a16e36d8 ("iommu/vt-d: Support flushing more translation cache types")
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Link: https://lore.kernel.org/r/20200724014925.15523-5-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/dmar.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index 16f47041f1bf5..ec23a2f0b5f8d 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1459,9 +1459,26 @@ void qi_flush_dev_iotlb_pasid(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ * Max Invs Pending (MIP) is set to 0 for now until we have DIT in
+ * ECAP.
+ */
+- desc.qw1 |= addr & ~mask;
+- if (size_order)
++ if (addr & GENMASK_ULL(size_order + VTD_PAGE_SHIFT, 0))
++ pr_warn_ratelimited("Invalidate non-aligned address %llx, order %d\n",
++ addr, size_order);
++
++ /* Take page address */
++ desc.qw1 = QI_DEV_EIOTLB_ADDR(addr);
++
++ if (size_order) {
++ /*
++ * Existing 0s in address below size_order may be the least
++ * significant bit, we must set them to 1s to avoid having
++ * smaller size than desired.
++ */
++ desc.qw1 |= GENMASK_ULL(size_order + VTD_PAGE_SHIFT - 1,
++ VTD_PAGE_SHIFT);
++ /* Clear size_order bit to indicate size */
++ desc.qw1 &= ~mask;
++ /* Set the S bit to indicate flushing more than 1 page */
+ desc.qw1 |= QI_DEV_EIOTLB_SIZE;
++ }
+
+ qi_submit_sync(iommu, &desc, 1, 0);
+ }
+--
+2.25.1
+
--- /dev/null
+From 673a8c72d6e84e8582264cb9b8fcf0bb71cb915f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jul 2020 09:49:19 +0800
+Subject: iommu/vt-d: Warn on out-of-range invalidation address
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 1ff00279655d95ae9c285c39878aedf9ff008d25 ]
+
+For guest requested IOTLB invalidation, address and mask are provided as
+part of the invalidation data. VT-d HW silently ignores any address bits
+below the mask. SW shall also allow such case but give warning if
+address does not align with the mask. This patch relax the fault
+handling from error to warning and proceed with invalidation request
+with the given mask.
+
+Fixes: 6ee1b77ba3ac0 ("iommu/vt-d: Add svm/sva invalidate function")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Link: https://lore.kernel.org/r/20200724014925.15523-7-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index e7bce09a9f735..04e82f1756010 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -5452,13 +5452,12 @@ intel_iommu_sva_invalidate(struct iommu_domain *domain, struct device *dev,
+
+ switch (BIT(cache_type)) {
+ case IOMMU_CACHE_INV_TYPE_IOTLB:
++ /* HW will ignore LSB bits based on address mask */
+ if (inv_info->granularity == IOMMU_INV_GRANU_ADDR &&
+ size &&
+ (inv_info->addr_info.addr & ((BIT(VTD_PAGE_SHIFT + size)) - 1))) {
+- pr_err_ratelimited("Address out of range, 0x%llx, size order %llu\n",
++ pr_err_ratelimited("User address not aligned, 0x%llx, size order %llu\n",
+ inv_info->addr_info.addr, size);
+- ret = -ERANGE;
+- goto out_unlock;
+ }
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 2c2a436b6ab65ca0d5a8ac7c7f2a9ef51d07c983 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 01:20:46 +0800
+Subject: kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 10de795a5addd1962406796a6e13ba6cc0fc6bee ]
+
+Fix compiler warning(as show below) for !CONFIG_KPROBES_ON_FTRACE.
+
+kernel/kprobes.c: In function 'kill_kprobe':
+kernel/kprobes.c:1116:33: warning: statement with no effect
+[-Wunused-value]
+ 1116 | #define disarm_kprobe_ftrace(p) (-ENODEV)
+ | ^
+kernel/kprobes.c:2154:3: note: in expansion of macro
+'disarm_kprobe_ftrace'
+ 2154 | disarm_kprobe_ftrace(p);
+
+Link: https://lore.kernel.org/r/20200805142136.0331f7ea@canb.auug.org.au
+Link: https://lkml.kernel.org/r/20200805172046.19066-1-songmuchun@bytedance.com
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: 0cb2f1372baa ("kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler")
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kprobes.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index f54d4a29fc26e..72af5d37e9ff1 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -1079,9 +1079,20 @@ static int disarm_kprobe_ftrace(struct kprobe *p)
+ ipmodify ? &kprobe_ipmodify_enabled : &kprobe_ftrace_enabled);
+ }
+ #else /* !CONFIG_KPROBES_ON_FTRACE */
+-#define prepare_kprobe(p) arch_prepare_kprobe(p)
+-#define arm_kprobe_ftrace(p) (-ENODEV)
+-#define disarm_kprobe_ftrace(p) (-ENODEV)
++static inline int prepare_kprobe(struct kprobe *p)
++{
++ return arch_prepare_kprobe(p);
++}
++
++static inline int arm_kprobe_ftrace(struct kprobe *p)
++{
++ return -ENODEV;
++}
++
++static inline int disarm_kprobe_ftrace(struct kprobe *p)
++{
++ return -ENODEV;
++}
+ #endif
+
+ /* Arm a kprobe with text_mutex */
+--
+2.25.1
+
--- /dev/null
+From f5391265cfe1abb929b724e8405d3f7d569eeb1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:34:47 -0700
+Subject: lib/test_lockup.c: fix return value of test_lockup_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 3adf3bae0d612357da516d39e1584f1547eb6e86 ]
+
+Since filp_open() returns an error pointer, we should use IS_ERR() to
+check the return value and then return PTR_ERR() if failed to get the
+actual return value instead of always -EINVAL.
+
+E.g. without this patch:
+
+[root@localhost loongson]# ls no_such_file
+ls: cannot access no_such_file: No such file or directory
+[root@localhost loongson]# modprobe test_lockup file_path=no_such_file lock_sb_umount time_secs=60 state=S
+modprobe: ERROR: could not insert 'test_lockup': Invalid argument
+[root@localhost loongson]# dmesg | tail -1
+[ 126.100596] test_lockup: cannot find file_path
+
+With this patch:
+
+[root@localhost loongson]# ls no_such_file
+ls: cannot access no_such_file: No such file or directory
+[root@localhost loongson]# modprobe test_lockup file_path=no_such_file lock_sb_umount time_secs=60 state=S
+modprobe: ERROR: could not insert 'test_lockup': Unknown symbol in module, or unknown parameter (see dmesg)
+[root@localhost loongson]# dmesg | tail -1
+[ 95.134362] test_lockup: failed to open no_such_file: -2
+
+Fixes: aecd42df6d39 ("lib/test_lockup.c: add parameters for locking generic vfs locks")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Cc: Kees Cook <keescook@chromium.org>
+Link: http://lkml.kernel.org/r/1595555407-29875-2-git-send-email-yangtiezhu@loongson.cn
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_lockup.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/test_lockup.c b/lib/test_lockup.c
+index bd7c7ff39f6be..e7202763a1688 100644
+--- a/lib/test_lockup.c
++++ b/lib/test_lockup.c
+@@ -512,8 +512,8 @@ static int __init test_lockup_init(void)
+ if (test_file_path[0]) {
+ test_file = filp_open(test_file_path, O_RDONLY, 0);
+ if (IS_ERR(test_file)) {
+- pr_err("cannot find file_path\n");
+- return -EINVAL;
++ pr_err("failed to open %s: %ld\n", test_file_path, PTR_ERR(test_file));
++ return PTR_ERR(test_file);
+ }
+ test_inode = file_inode(test_file);
+ } else if (test_lock_inode ||
+--
+2.25.1
+
--- /dev/null
+From fb3e0150fc7ccf4984a846c2ea82ebc3efe9c6cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:41:39 -0600
+Subject: libnvdimm/security: ensure sysfs poll thread woke up and fetch
+ updated attr
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit 7f674025d9f7321dea11b802cc0ab3f09cbe51c5 ]
+
+commit 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support")
+adds a sysfs_notify_dirent() to wake up userspace poll thread when the "overwrite"
+operation has completed. But the notification is issued before the internal
+dimm security state and flags have been updated, so the userspace poll thread
+wakes up and fetches the not-yet-updated attr and falls back to sleep, forever.
+But if user from another terminal issue "ndctl wait-overwrite nmemX" again,
+the command returns instantly.
+
+Link: https://lore.kernel.org/r/1596494499-9852-3-git-send-email-jane.chu@oracle.com
+Fixes: 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support")
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/security.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
+index 8f3971cf16541..4b80150e4afa7 100644
+--- a/drivers/nvdimm/security.c
++++ b/drivers/nvdimm/security.c
+@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
+ else
+ dev_dbg(&nvdimm->dev, "overwrite completed\n");
+
+- if (nvdimm->sec.overwrite_state)
+- sysfs_notify_dirent(nvdimm->sec.overwrite_state);
++ /*
++ * Mark the overwrite work done and update dimm security flags,
++ * then send a sysfs event notification to wake up userspace
++ * poll threads to picked up the changed state.
++ */
+ nvdimm->sec.overwrite_tmo = 0;
+ clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags);
+ clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
+- put_device(&nvdimm->dev);
+ nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
++ if (nvdimm->sec.overwrite_state)
++ sysfs_notify_dirent(nvdimm->sec.overwrite_state);
++ put_device(&nvdimm->dev);
+ }
+
+ void nvdimm_security_overwrite_query(struct work_struct *work)
+--
+2.25.1
+
--- /dev/null
+From fbcdc2e430a9853c99d8a0e954be298c18aeb8fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 16:41:37 -0600
+Subject: libnvdimm/security: fix a typo
+
+From: Jane Chu <jane.chu@oracle.com>
+
+[ Upstream commit dad42d17558f316e9e807698cd4207359b636084 ]
+
+commit d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute")
+introduced a typo, causing a 'nvdimm->sec.flags' update being overwritten
+by the subsequent update meant for 'nvdimm->sec.ext_flags'.
+
+Link: https://lore.kernel.org/r/1596494499-9852-1-git-send-email-jane.chu@oracle.com
+Fixes: d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute")
+Cc: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Jane Chu <jane.chu@oracle.com>
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/security.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
+index 4cef69bd3c1bd..8f3971cf16541 100644
+--- a/drivers/nvdimm/security.c
++++ b/drivers/nvdimm/security.c
+@@ -457,7 +457,7 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm)
+ clear_bit(NDD_WORK_PENDING, &nvdimm->flags);
+ put_device(&nvdimm->dev);
+ nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER);
+- nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
++ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER);
+ }
+
+ void nvdimm_security_overwrite_query(struct work_struct *work)
+--
+2.25.1
+
--- /dev/null
+From 2ebb2851d38d368f336d0ac0ff1d34dab2954932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 13:16:45 +0300
+Subject: md-cluster: Fix potential error pointer dereference in
+ resize_bitmaps()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e8abe1de43dac658dacbd04a4543e0c988a8d386 ]
+
+The error handling calls md_bitmap_free(bitmap) which checks for NULL
+but will Oops if we pass an error pointer. Let's set "bitmap" to NULL
+on this error path.
+
+Fixes: afd756286083 ("md-cluster/raid10: resize all the bitmaps before start reshape")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md-cluster.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index 73fd50e779754..d50737ec40394 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz
+ bitmap = get_bitmap_from_slot(mddev, i);
+ if (IS_ERR(bitmap)) {
+ pr_err("can't get bitmap from slot %d\n", i);
++ bitmap = NULL;
+ goto out;
+ }
+ counts = &bitmap->counts;
+--
+2.25.1
+
--- /dev/null
+From 8d42700707f722990a11bfc5ad2c93656ee59bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 18:42:44 +0200
+Subject: media: rockchip: rga: Introduce color fmt macros and refactor CSC
+ mode logic
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit ded874ece29d3fe2abd3775810a06056067eb68c ]
+
+This introduces two macros: RGA_COLOR_FMT_IS_YUV and RGA_COLOR_FMT_IS_RGB
+which allow quick checking of the colorspace familily of a RGA color format.
+
+These macros are then used to refactor the logic for CSC mode selection.
+The two nested tests for input colorspace are simplified into a single one,
+with a logical and, making the whole more readable.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga-hw.c | 23 +++++++++-----------
+ drivers/media/platform/rockchip/rga/rga-hw.h | 5 +++++
+ 2 files changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
+index 4be6dcf292fff..5607ee8d19176 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.c
++++ b/drivers/media/platform/rockchip/rga/rga-hw.c
+@@ -200,22 +200,19 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ dst_info.data.format = ctx->out.fmt->hw_format;
+ dst_info.data.swap = ctx->out.fmt->color_swap;
+
+- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
+- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) {
+- switch (ctx->in.colorspace) {
+- case V4L2_COLORSPACE_REC709:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT709_R0;
+- break;
+- default:
+- src_info.data.csc_mode =
+- RGA_SRC_CSC_MODE_BT601_R0;
+- break;
+- }
++ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
++ switch (ctx->in.colorspace) {
++ case V4L2_COLORSPACE_REC709:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
++ break;
++ default:
++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0;
++ break;
+ }
+ }
+
+- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
++ if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
+ switch (ctx->out.colorspace) {
+ case V4L2_COLORSPACE_REC709:
+ dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h
+index 96cb0314dfa70..e8917e5630a48 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.h
++++ b/drivers/media/platform/rockchip/rga/rga-hw.h
+@@ -95,6 +95,11 @@
+ #define RGA_COLOR_FMT_CP_8BPP 15
+ #define RGA_COLOR_FMT_MASK 15
+
++#define RGA_COLOR_FMT_IS_YUV(fmt) \
++ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP))
++#define RGA_COLOR_FMT_IS_RGB(fmt) \
++ ((fmt) < RGA_COLOR_FMT_YUV422SP)
++
+ #define RGA_COLOR_NONE_SWAP 0
+ #define RGA_COLOR_RB_SWAP 1
+ #define RGA_COLOR_ALPHA_SWAP 2
+--
+2.25.1
+
--- /dev/null
+From 2d9b6519d06d96c30b60698ac57b80389e47912d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 18:42:45 +0200
+Subject: media: rockchip: rga: Only set output CSC mode for RGB input
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 0f879bab72f47e8ba2421a984e7acfa763d3e84e ]
+
+Setting the output CSC mode is required for a YUV output, but must not
+be set when the input is also YUV. Doing this (as tested with a YUV420P
+to YUV420P conversion) results in wrong colors.
+
+Adapt the logic to only set the output CSC mode when the output is YUV and
+the input is RGB. Also add a comment to clarify the rationale.
+
+Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga-hw.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
+index 5607ee8d19176..aaa96f256356b 100644
+--- a/drivers/media/platform/rockchip/rga/rga-hw.c
++++ b/drivers/media/platform/rockchip/rga/rga-hw.c
+@@ -200,6 +200,11 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ dst_info.data.format = ctx->out.fmt->hw_format;
+ dst_info.data.swap = ctx->out.fmt->color_swap;
+
++ /*
++ * CSC mode must only be set when the colorspace families differ between
++ * input and output. It must remain unset (zeroed) if both are the same.
++ */
++
+ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
+ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
+ switch (ctx->in.colorspace) {
+@@ -212,7 +217,8 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
+ }
+ }
+
+- if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
++ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) &&
++ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
+ switch (ctx->out.colorspace) {
+ case V4L2_COLORSPACE_REC709:
+ dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+--
+2.25.1
+
--- /dev/null
+From 31263a69bcaee5184c55fedea1075e5fde3d1d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 13:35:16 +0200
+Subject: media: staging: rkisp1: remove macro RKISP1_DIR_SINK_SRC
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit b861d139a36a4593498932bfec957bdcc7d98eb3 ]
+
+The macro RKISP1_DIR_SINK_SRC is a mask of two flags.
+The macro hides the fact that it's a mask and the code
+is actually more clear if we replace it the with bitwise-or explicitly.
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-isp.c | 25 +++++++++++------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-isp.c b/drivers/staging/media/rkisp1/rkisp1-isp.c
+index dc2b59a0160a8..93ba2dd2fcda0 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-isp.c
++++ b/drivers/staging/media/rkisp1/rkisp1-isp.c
+@@ -25,7 +25,6 @@
+
+ #define RKISP1_DIR_SRC BIT(0)
+ #define RKISP1_DIR_SINK BIT(1)
+-#define RKISP1_DIR_SINK_SRC (RKISP1_DIR_SINK | RKISP1_DIR_SRC)
+
+ /*
+ * NOTE: MIPI controller and input MUX are also configured in this file.
+@@ -69,84 +68,84 @@ static const struct rkisp1_isp_mbus_info rkisp1_isp_formats[] = {
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SRGGB12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SRGGB8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK_SRC,
++ .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_YUYV8_1X16,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+--
+2.25.1
+
--- /dev/null
+From b6e33510f18e2e250126cc284df5faa95324183b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 13:35:17 +0200
+Subject: media: staging: rkisp1: rename macros 'RKISP1_DIR_*' to
+ 'RKISP1_ISP_SD_*'
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit c247818a873adcb8488021eed38c330ea8b288a3 ]
+
+The macros 'RKISP1_DIR_*' are flags that indicate on which
+pads of the isp subdevice the media bus code is supported. So the
+prefix RKISP1_ISP_SD_ is better.
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-isp.c | 46 +++++++++++------------
+ 1 file changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-isp.c b/drivers/staging/media/rkisp1/rkisp1-isp.c
+index 93ba2dd2fcda0..abfedb604303f 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-isp.c
++++ b/drivers/staging/media/rkisp1/rkisp1-isp.c
+@@ -23,8 +23,8 @@
+
+ #define RKISP1_ISP_DEV_NAME RKISP1_DRIVER_NAME "_isp"
+
+-#define RKISP1_DIR_SRC BIT(0)
+-#define RKISP1_DIR_SINK BIT(1)
++#define RKISP1_ISP_SD_SRC BIT(0)
++#define RKISP1_ISP_SD_SINK BIT(1)
+
+ /*
+ * NOTE: MIPI controller and input MUX are also configured in this file.
+@@ -61,119 +61,119 @@ static const struct rkisp1_isp_mbus_info rkisp1_isp_formats[] = {
+ {
+ .mbus_code = MEDIA_BUS_FMT_YUYV8_2X8,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+- .direction = RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SRGGB10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG10_1X10,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW10,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 10,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SRGGB12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG12_1X12,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW12,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 12,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SRGGB8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_RGGB,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SBGGR8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_BGGR,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGBRG8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_GBRG,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_SGRBG8_1X8,
+ .pixel_enc = V4L2_PIXEL_ENC_BAYER,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_RAW8,
+ .bayer_pat = RKISP1_RAW_GRBG,
+ .bus_width = 8,
+- .direction = RKISP1_DIR_SINK | RKISP1_DIR_SRC,
++ .direction = RKISP1_ISP_SD_SINK | RKISP1_ISP_SD_SRC,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_YUYV8_1X16,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_YUV422_8b,
+ .yuv_seq = RKISP1_CIF_ISP_ACQ_PROP_YCBYCR,
+ .bus_width = 16,
+- .direction = RKISP1_DIR_SINK,
++ .direction = RKISP1_ISP_SD_SINK,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_YVYU8_1X16,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_YUV422_8b,
+ .yuv_seq = RKISP1_CIF_ISP_ACQ_PROP_YCRYCB,
+ .bus_width = 16,
+- .direction = RKISP1_DIR_SINK,
++ .direction = RKISP1_ISP_SD_SINK,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_UYVY8_1X16,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_YUV422_8b,
+ .yuv_seq = RKISP1_CIF_ISP_ACQ_PROP_CBYCRY,
+ .bus_width = 16,
+- .direction = RKISP1_DIR_SINK,
++ .direction = RKISP1_ISP_SD_SINK,
+ }, {
+ .mbus_code = MEDIA_BUS_FMT_VYUY8_1X16,
+ .pixel_enc = V4L2_PIXEL_ENC_YUV,
+ .mipi_dt = RKISP1_CIF_CSI2_DT_YUV422_8b,
+ .yuv_seq = RKISP1_CIF_ISP_ACQ_PROP_CRYCBY,
+ .bus_width = 16,
+- .direction = RKISP1_DIR_SINK,
++ .direction = RKISP1_ISP_SD_SINK,
+ },
+ };
+
+@@ -573,9 +573,9 @@ static int rkisp1_isp_enum_mbus_code(struct v4l2_subdev *sd,
+ int pos = 0;
+
+ if (code->pad == RKISP1_ISP_PAD_SINK_VIDEO) {
+- dir = RKISP1_DIR_SINK;
++ dir = RKISP1_ISP_SD_SINK;
+ } else if (code->pad == RKISP1_ISP_PAD_SOURCE_VIDEO) {
+- dir = RKISP1_DIR_SRC;
++ dir = RKISP1_ISP_SD_SRC;
+ } else {
+ if (code->index > 0)
+ return -EINVAL;
+@@ -660,7 +660,7 @@ static void rkisp1_isp_set_src_fmt(struct rkisp1_isp *isp,
+
+ src_fmt->code = format->code;
+ mbus_info = rkisp1_isp_mbus_info_get(src_fmt->code);
+- if (!mbus_info || !(mbus_info->direction & RKISP1_DIR_SRC)) {
++ if (!mbus_info || !(mbus_info->direction & RKISP1_ISP_SD_SRC)) {
+ src_fmt->code = RKISP1_DEF_SRC_PAD_FMT;
+ mbus_info = rkisp1_isp_mbus_info_get(src_fmt->code);
+ }
+@@ -744,7 +744,7 @@ static void rkisp1_isp_set_sink_fmt(struct rkisp1_isp *isp,
+ which);
+ sink_fmt->code = format->code;
+ mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code);
+- if (!mbus_info || !(mbus_info->direction & RKISP1_DIR_SINK)) {
++ if (!mbus_info || !(mbus_info->direction & RKISP1_ISP_SD_SINK)) {
+ sink_fmt->code = RKISP1_DEF_SINK_PAD_FMT;
+ mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code);
+ }
+--
+2.25.1
+
--- /dev/null
+From 66fc19fb929661738b7e160d8d247af7c6ff3052 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jun 2020 13:35:18 +0200
+Subject: media: staging: rkisp1: rsz: set default format if the given format
+ is not RKISP1_ISP_SD_SRC
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 206003b18bb264521607440752814ccff59f91f3 ]
+
+When setting the sink format of the 'rkisp1_resizer'
+the format should be supported by 'rkisp1_isp' on
+the video source pad. This patch checks this condition
+and sets the format to default if the condition is false.
+
+Fixes: 56e3b29f9f6b "media: staging: rkisp1: add streaming paths"
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkisp1/rkisp1-common.h | 3 +++
+ drivers/staging/media/rkisp1/rkisp1-isp.c | 3 ---
+ drivers/staging/media/rkisp1/rkisp1-resizer.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/rkisp1/rkisp1-common.h b/drivers/staging/media/rkisp1/rkisp1-common.h
+index 0c4fe503adc90..12bd9d05050db 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-common.h
++++ b/drivers/staging/media/rkisp1/rkisp1-common.h
+@@ -22,6 +22,9 @@
+ #include "rkisp1-regs.h"
+ #include "uapi/rkisp1-config.h"
+
++#define RKISP1_ISP_SD_SRC BIT(0)
++#define RKISP1_ISP_SD_SINK BIT(1)
++
+ #define RKISP1_ISP_MAX_WIDTH 4032
+ #define RKISP1_ISP_MAX_HEIGHT 3024
+ #define RKISP1_ISP_MIN_WIDTH 32
+diff --git a/drivers/staging/media/rkisp1/rkisp1-isp.c b/drivers/staging/media/rkisp1/rkisp1-isp.c
+index abfedb604303f..b21a67aea433c 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-isp.c
++++ b/drivers/staging/media/rkisp1/rkisp1-isp.c
+@@ -23,9 +23,6 @@
+
+ #define RKISP1_ISP_DEV_NAME RKISP1_DRIVER_NAME "_isp"
+
+-#define RKISP1_ISP_SD_SRC BIT(0)
+-#define RKISP1_ISP_SD_SINK BIT(1)
+-
+ /*
+ * NOTE: MIPI controller and input MUX are also configured in this file.
+ * This is because ISP Subdev describes not only ISP submodule (input size,
+diff --git a/drivers/staging/media/rkisp1/rkisp1-resizer.c b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+index e188944941b58..a2b35961bc8b7 100644
+--- a/drivers/staging/media/rkisp1/rkisp1-resizer.c
++++ b/drivers/staging/media/rkisp1/rkisp1-resizer.c
+@@ -542,7 +542,7 @@ static void rkisp1_rsz_set_sink_fmt(struct rkisp1_resizer *rsz,
+ which);
+ sink_fmt->code = format->code;
+ mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code);
+- if (!mbus_info) {
++ if (!mbus_info || !(mbus_info->direction & RKISP1_ISP_SD_SRC)) {
+ sink_fmt->code = RKISP1_DEF_FMT;
+ mbus_info = rkisp1_isp_mbus_info_get(sink_fmt->code);
+ }
+--
+2.25.1
+
--- /dev/null
+From a3d36c853d633ab05c0f0aea04eb9fe6a85827de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 14:53:21 +0100
+Subject: mfd: arizona: Ensure 32k clock is put on driver unbind and error
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit ddff6c45b21d0437ce0c85f8ac35d7b5480513d7 ]
+
+Whilst it doesn't matter if the internal 32k clock register settings
+are cleaned up on exit, as the part will be turned off losing any
+settings, hence the driver hasn't historially bothered. The external
+clock should however be cleaned up, as it could cause clocks to be
+left on, and will at best generate a warning on unbind.
+
+Add clean up on both the probe error path and unbind for the 32k
+clock.
+
+Fixes: cdd8da8cc66b ("mfd: arizona: Add gating of external MCLKn clocks")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/arizona-core.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
+index f73cf76d1373d..a5e443110fc3d 100644
+--- a/drivers/mfd/arizona-core.c
++++ b/drivers/mfd/arizona-core.c
+@@ -1426,6 +1426,15 @@ int arizona_dev_init(struct arizona *arizona)
+ arizona_irq_exit(arizona);
+ err_pm:
+ pm_runtime_disable(arizona->dev);
++
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
+ err_reset:
+ arizona_enable_reset(arizona);
+ regulator_disable(arizona->dcvdd);
+@@ -1448,6 +1457,15 @@ int arizona_dev_exit(struct arizona *arizona)
+ regulator_disable(arizona->dcvdd);
+ regulator_put(arizona->dcvdd);
+
++ switch (arizona->pdata.clk32k_src) {
++ case ARIZONA_32KZ_MCLK1:
++ case ARIZONA_32KZ_MCLK2:
++ arizona_clk32k_disable(arizona);
++ break;
++ default:
++ break;
++ }
++
+ mfd_remove_devices(arizona->dev);
+ arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona);
+ arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona);
+--
+2.25.1
+
--- /dev/null
+From 9799ade5fa658034bcc1e9d861aa3dc3d8cab237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 16:02:46 +0300
+Subject: mfd: dln2: Run event handler loop under spinlock
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ]
+
+The event handler loop must be run with interrupts disabled.
+Otherwise we will have a warning:
+
+[ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts
+[ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170
+[ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170
+...
+[ 1970.946994] Call Trace:
+[ 1970.949446] <IRQ>
+[ 1970.951471] handle_irq_event_percpu+0x2c/0x80
+[ 1970.955921] handle_irq_event+0x23/0x43
+[ 1970.959766] handle_simple_irq+0x57/0x70
+[ 1970.963695] generic_handle_irq+0x42/0x50
+[ 1970.967717] dln2_rx+0xc1/0x210 [dln2]
+[ 1970.971479] ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0
+[ 1970.976362] __usb_hcd_giveback_urb+0x77/0xe0
+[ 1970.980727] usb_giveback_urb_bh+0x8e/0xe0
+[ 1970.984837] tasklet_action_common.isra.0+0x4a/0xe0
+...
+
+Recently xHCI driver switched to tasklets in the commit 36dc01657b49
+("usb: host: xhci: Support running urb giveback in tasklet context").
+
+The handle_irq_event_* functions are expected to be called with interrupts
+disabled and they rightfully complain here because we run in tasklet context
+with interrupts enabled.
+
+Use a event spinlock to protect event handler from being interrupted.
+
+Note, that there are only two users of this GPIO and ADC drivers and both of
+them are using generic_handle_irq() which makes above happen.
+
+Fixes: 338a12814297 ("mfd: Add support for Diolan DLN-2 devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/dln2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
+index 39276fa626d2b..83e676a096dc1 100644
+--- a/drivers/mfd/dln2.c
++++ b/drivers/mfd/dln2.c
+@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb)
+ len = urb->actual_length - sizeof(struct dln2_header);
+
+ if (handle == DLN2_HANDLE_EVENT) {
++ unsigned long flags;
++
++ spin_lock_irqsave(&dln2->event_cb_lock, flags);
+ dln2_run_event_callbacks(dln2, id, echo, data, len);
++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags);
+ } else {
+ /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */
+ if (dln2_transfer_complete(dln2, urb, handle, echo))
+--
+2.25.1
+
--- /dev/null
+From ab0c9dda686f7c9658eb914733ec5d33b78fd87c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 May 2020 16:01:05 +0900
+Subject: mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 2b26e34e9af3fa24fa1266e9ea2d66a1f7d62dc0 ]
+
+To add end() operation in the future, clean the code of
+renesas_sdhi_internal_dmac_complete_tasklet_fn(). No behavior change.
+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1590044466-28372-3-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index 47ac53e912411..201b8ed37f2e0 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg)
+ DTRAN_CTRL_DM_START);
+ }
+
+-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host)
+ {
+- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
+ enum dma_data_direction dir;
+
+- spin_lock_irq(&host->lock);
+-
+ if (!host->data)
+- goto out;
++ return false;
+
+ if (host->data->flags & MMC_DATA_READ)
+ dir = DMA_FROM_DEVICE;
+@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
+ if (dir == DMA_FROM_DEVICE)
+ clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
+
++ return true;
++}
++
++static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
++{
++ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
++
++ spin_lock_irq(&host->lock);
++ if (!renesas_sdhi_internal_dmac_complete(host))
++ goto out;
++
+ tmio_mmc_do_data_irq(host);
+ out:
+ spin_unlock_irq(&host->lock);
+--
+2.25.1
+
--- /dev/null
+From 8e38219a8dc9308c975269c6aff7ebbd1f77a37f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jun 2020 17:29:02 -0400
+Subject: mtd: rawnand: brcmnand: ECC error handling on EDU transfers
+
+From: Kamal Dasu <kdasu.kdev@gmail.com>
+
+[ Upstream commit 4551e78ad98add1f16b70cf286d5aad3ce7bcd4c ]
+
+Implement ECC correctable and uncorrectable error handling for EDU
+reads. If ECC correctable bitflips are encountered on EDU transfer,
+read page again using PIO. This is needed due to a NAND controller
+limitation where corrected data is not transferred to the DMA buffer
+on ECC error. This applies to ECC correctable errors that are reported
+by the controller hardware based on set number of bitflips threshold in
+the controller threshold register, bitflips below the threshold are
+corrected silently and are not reported by the controller hardware.
+
+Fixes: a5d53ad26a8b ("mtd: rawnand: brcmnand: Add support for flash-edu for dma transfers")
+Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200612212902.21347-3-kdasu.kdev@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 26 ++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index ac934a715a194..a4033d32a7103 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -1918,6 +1918,22 @@ static int brcmnand_edu_trans(struct brcmnand_host *host, u64 addr, u32 *buf,
+ edu_writel(ctrl, EDU_STOP, 0); /* force stop */
+ edu_readl(ctrl, EDU_STOP);
+
++ if (!ret && edu_cmd == EDU_CMD_READ) {
++ u64 err_addr = 0;
++
++ /*
++ * check for ECC errors here, subpage ECC errors are
++ * retained in ECC error address register
++ */
++ err_addr = brcmnand_get_uncorrecc_addr(ctrl);
++ if (!err_addr) {
++ err_addr = brcmnand_get_correcc_addr(ctrl);
++ if (err_addr)
++ ret = -EUCLEAN;
++ } else
++ ret = -EBADMSG;
++ }
++
+ return ret;
+ }
+
+@@ -2124,6 +2140,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ u64 err_addr = 0;
+ int err;
+ bool retry = true;
++ bool edu_err = false;
+
+ dev_dbg(ctrl->dev, "read %llx -> %p\n", (unsigned long long)addr, buf);
+
+@@ -2141,6 +2158,10 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ else
+ return -EIO;
+ }
++
++ if (has_edu(ctrl) && err_addr)
++ edu_err = true;
++
+ } else {
+ if (oob)
+ memset(oob, 0x99, mtd->oobsize);
+@@ -2188,6 +2209,11 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ if (mtd_is_bitflip(err)) {
+ unsigned int corrected = brcmnand_count_corrected(ctrl);
+
++ /* in case of EDU correctable error we read again using PIO */
++ if (edu_err)
++ err = brcmnand_read_by_pio(mtd, chip, addr, trans, buf,
++ oob, &err_addr);
++
+ dev_dbg(ctrl->dev, "corrected error at 0x%llx\n",
+ (unsigned long long)err_addr);
+ mtd->ecc_stats.corrected += corrected;
+--
+2.25.1
+
--- /dev/null
+From 14c5d69a3e3223bdf6f66a3554a1c4026ad86d70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 15:49:13 +0200
+Subject: mtd: rawnand: fsl_upm: Remove unused mtd var
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+[ Upstream commit ccc49eff77bee2885447a032948959a134029fe3 ]
+
+The mtd var in fun_wait_rnb() is now unused, let's get rid of it and
+fix the warning resulting from this unused var.
+
+Fixes: 50a487e7719c ("mtd: rawnand: Pass a nand_chip object to chip->dev_ready()")
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200603134922.1352340-2-boris.brezillon@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_upm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c
+index 627deb26db512..76d1032cd35e8 100644
+--- a/drivers/mtd/nand/raw/fsl_upm.c
++++ b/drivers/mtd/nand/raw/fsl_upm.c
+@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip)
+ static void fun_wait_rnb(struct fsl_upm_nand *fun)
+ {
+ if (fun->rnb_gpio[fun->mchip_number] >= 0) {
+- struct mtd_info *mtd = nand_to_mtd(&fun->chip);
+ int cnt = 1000000;
+
+ while (--cnt && !fun_chip_ready(&fun->chip))
+--
+2.25.1
+
--- /dev/null
+From a0a6e9e5449bd534f81e6135051e9d4801d9d4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 10:57:05 +0800
+Subject: net: qcom/emac: add missed clk_disable_unprepare in error path of
+ emac_clks_phase1_init
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 50caa777a3a24d7027748e96265728ce748b41ef ]
+
+Fix the missing clk_disable_unprepare() before return
+from emac_clks_phase1_init() in the error handling case.
+
+Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
+index 20b1b43a0e393..1166b98d8bb2c 100644
+--- a/drivers/net/ethernet/qualcomm/emac/emac.c
++++ b/drivers/net/ethernet/qualcomm/emac/emac.c
+@@ -474,13 +474,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev,
+
+ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]);
+ if (ret)
+- return ret;
++ goto disable_clk_axi;
+
+ ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000);
+ if (ret)
+- return ret;
++ goto disable_clk_cfg_ahb;
++
++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ if (ret)
++ goto disable_clk_cfg_ahb;
+
+- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
++ return 0;
++
++disable_clk_cfg_ahb:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]);
++disable_clk_axi:
++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]);
++
++ return ret;
+ }
+
+ /* Enable clocks; needs emac_clks_phase1_init to be called before */
+--
+2.25.1
+
--- /dev/null
+From 300fc89c580f54e38268b40ec4da69d9eebd582a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2020 07:10:38 -0400
+Subject: nfs: ensure correct writeback errors are returned on close()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit 67dd23f9e6fbaf163431912ef5599c5e0693476c ]
+
+nfs_wb_all() calls filemap_write_and_wait(), which uses
+filemap_check_errors() to determine the error to return.
+filemap_check_errors() only looks at the mapping->flags and will
+therefore only return either -ENOSPC or -EIO. To ensure that the
+correct error is returned on close(), nfs{,4}_file_flush() should call
+filemap_check_wb_err() which looks at the errseq value in
+mapping->wb_err without consuming it.
+
+Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with
+generic one")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/file.c | 5 ++++-
+ fs/nfs/nfs4file.c | 5 ++++-
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index f96367a2463e3..d72496efa17b0 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -140,6 +140,7 @@ static int
+ nfs_file_flush(struct file *file, fl_owner_t id)
+ {
+ struct inode *inode = file_inode(file);
++ errseq_t since;
+
+ dprintk("NFS: flush(%pD2)\n", file);
+
+@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id)
+ return 0;
+
+ /* Flush writes to the server and return any errors */
+- return nfs_wb_all(inode);
++ since = filemap_sample_wb_err(file->f_mapping);
++ nfs_wb_all(inode);
++ return filemap_check_wb_err(file->f_mapping, since);
+ }
+
+ ssize_t
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 8e5d6223ddd35..a339707654673 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -110,6 +110,7 @@ static int
+ nfs4_file_flush(struct file *file, fl_owner_t id)
+ {
+ struct inode *inode = file_inode(file);
++ errseq_t since;
+
+ dprintk("NFS: flush(%pD2)\n", file);
+
+@@ -125,7 +126,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id)
+ return filemap_fdatawrite(file->f_mapping);
+
+ /* Flush writes to the server and return any errors */
+- return nfs_wb_all(inode);
++ since = filemap_sample_wb_err(file->f_mapping);
++ nfs_wb_all(inode);
++ return filemap_check_wb_err(file->f_mapping, since);
+ }
+
+ #ifdef CONFIG_NFS_V4_2
+--
+2.25.1
+
--- /dev/null
+From 702ed90955098f2c90b28947abfc92676892e1fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 13:36:32 -0400
+Subject: NFS: Fix flexfiles read failover
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 563c53e73b8b6ec842828736f77e633f7b0911e9 ]
+
+The current mirrored read failover code is correctly resetting the mirror
+index between failed reads, however it is not able to actually flip the
+RPC call over to the next RPC client.
+The end result is that we keep resending the RPC call to the same client
+over and over.
+
+The fix is to use the pnfs_read_resend_pnfs() mechanism to schedule a
+new RPC call, but we need to add the ability to pass in a mirror
+index so that we always retry the next mirror in the list.
+
+Fixes: 166bd5b889ac ("pNFS/flexfiles: Fix layoutstats handling during read failovers")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 50 ++++++++++++++++++--------
+ fs/nfs/pnfs.c | 4 ++-
+ fs/nfs/pnfs.h | 2 +-
+ 3 files changed, 40 insertions(+), 16 deletions(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index de03e440b7eef..048272d60a165 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -790,6 +790,19 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
+ return ff_layout_choose_any_ds_for_read(lseg, start_idx, best_idx);
+ }
+
++static struct nfs4_pnfs_ds *
++ff_layout_get_ds_for_read(struct nfs_pageio_descriptor *pgio, int *best_idx)
++{
++ struct pnfs_layout_segment *lseg = pgio->pg_lseg;
++ struct nfs4_pnfs_ds *ds;
++
++ ds = ff_layout_choose_best_ds_for_read(lseg, pgio->pg_mirror_idx,
++ best_idx);
++ if (ds || !pgio->pg_mirror_idx)
++ return ds;
++ return ff_layout_choose_best_ds_for_read(lseg, 0, best_idx);
++}
++
+ static void
+ ff_layout_pg_get_read(struct nfs_pageio_descriptor *pgio,
+ struct nfs_page *req,
+@@ -840,7 +853,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
+ goto out_nolseg;
+ }
+
+- ds = ff_layout_choose_best_ds_for_read(pgio->pg_lseg, 0, &ds_idx);
++ ds = ff_layout_get_ds_for_read(pgio, &ds_idx);
+ if (!ds) {
+ if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
+ goto out_mds;
+@@ -1028,11 +1041,24 @@ static void ff_layout_reset_write(struct nfs_pgio_header *hdr, bool retry_pnfs)
+ }
+ }
+
++static void ff_layout_resend_pnfs_read(struct nfs_pgio_header *hdr)
++{
++ u32 idx = hdr->pgio_mirror_idx + 1;
++ int new_idx = 0;
++
++ if (ff_layout_choose_any_ds_for_read(hdr->lseg, idx + 1, &new_idx))
++ ff_layout_send_layouterror(hdr->lseg);
++ else
++ pnfs_error_mark_layout_for_return(hdr->inode, hdr->lseg);
++ pnfs_read_resend_pnfs(hdr, new_idx);
++}
++
+ static void ff_layout_reset_read(struct nfs_pgio_header *hdr)
+ {
+ struct rpc_task *task = &hdr->task;
+
+ pnfs_layoutcommit_inode(hdr->inode, false);
++ pnfs_error_mark_layout_for_return(hdr->inode, hdr->lseg);
+
+ if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
+ dprintk("%s Reset task %5u for i/o through MDS "
+@@ -1234,6 +1260,12 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
+ break;
+ case NFS4ERR_NXIO:
+ ff_layout_mark_ds_unreachable(lseg, idx);
++ /*
++ * Don't return the layout if this is a read and we still
++ * have layouts to try
++ */
++ if (opnum == OP_READ)
++ break;
+ /* Fallthrough */
+ default:
+ pnfs_error_mark_layout_for_return(lseg->pls_layout->plh_inode,
+@@ -1247,7 +1279,6 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,
+ static int ff_layout_read_done_cb(struct rpc_task *task,
+ struct nfs_pgio_header *hdr)
+ {
+- int new_idx = hdr->pgio_mirror_idx;
+ int err;
+
+ if (task->tk_status < 0) {
+@@ -1267,10 +1298,6 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
+ clear_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags);
+ switch (err) {
+ case -NFS4ERR_RESET_TO_PNFS:
+- if (ff_layout_choose_best_ds_for_read(hdr->lseg,
+- hdr->pgio_mirror_idx + 1,
+- &new_idx))
+- goto out_layouterror;
+ set_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags);
+ return task->tk_status;
+ case -NFS4ERR_RESET_TO_MDS:
+@@ -1281,10 +1308,6 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
+ }
+
+ return 0;
+-out_layouterror:
+- ff_layout_read_record_layoutstats_done(task, hdr);
+- ff_layout_send_layouterror(hdr->lseg);
+- hdr->pgio_mirror_idx = new_idx;
+ out_eagain:
+ rpc_restart_call_prepare(task);
+ return -EAGAIN;
+@@ -1411,10 +1434,9 @@ static void ff_layout_read_release(void *data)
+ struct nfs_pgio_header *hdr = data;
+
+ ff_layout_read_record_layoutstats_done(&hdr->task, hdr);
+- if (test_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags)) {
+- ff_layout_send_layouterror(hdr->lseg);
+- pnfs_read_resend_pnfs(hdr);
+- } else if (test_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags))
++ if (test_bit(NFS_IOHDR_RESEND_PNFS, &hdr->flags))
++ ff_layout_resend_pnfs_read(hdr);
++ else if (test_bit(NFS_IOHDR_RESEND_MDS, &hdr->flags))
+ ff_layout_reset_read(hdr);
+ pnfs_generic_rw_release(data);
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index d61dac48dff50..75e988caf3cd7 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2939,7 +2939,8 @@ pnfs_try_to_read_data(struct nfs_pgio_header *hdr,
+ }
+
+ /* Resend all requests through pnfs. */
+-void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr)
++void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr,
++ unsigned int mirror_idx)
+ {
+ struct nfs_pageio_descriptor pgio;
+
+@@ -2950,6 +2951,7 @@ void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr)
+
+ nfs_pageio_init_read(&pgio, hdr->inode, false,
+ hdr->completion_ops);
++ pgio.pg_mirror_idx = mirror_idx;
+ hdr->task.tk_status = nfs_pageio_resend(&pgio, hdr);
+ }
+ }
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 8e0ada581b92e..2661c44c62db4 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -311,7 +311,7 @@ int _pnfs_return_layout(struct inode *);
+ int pnfs_commit_and_return_layout(struct inode *);
+ void pnfs_ld_write_done(struct nfs_pgio_header *);
+ void pnfs_ld_read_done(struct nfs_pgio_header *);
+-void pnfs_read_resend_pnfs(struct nfs_pgio_header *);
++void pnfs_read_resend_pnfs(struct nfs_pgio_header *, unsigned int mirror_idx);
+ struct pnfs_layout_segment *pnfs_update_layout(struct inode *ino,
+ struct nfs_open_context *ctx,
+ loff_t pos,
+--
+2.25.1
+
--- /dev/null
+From 62c009c88c130424d89ac767cd8cbc89a3f96721 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 12:23:19 -0500
+Subject: nfs: Fix getxattr kernel panic and memory overflow
+
+From: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+
+[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ]
+
+Move the buffer size check to decode_attr_security_label() before memcpy()
+Only call memcpy() if the buffer is large enough
+
+Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS")
+Signed-off-by: Jeffrey Mitchell <jeffrey.mitchell@starlab.io>
+[Trond: clean up duplicate test of label->len != 0]
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 --
+ fs/nfs/nfs4xdr.c | 6 +++++-
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 2e2dac29a9e91..45e0585e0667c 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5845,8 +5845,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf,
+ return ret;
+ if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
+ return -ENOENT;
+- if (buflen < label.len)
+- return -ERANGE;
+ return 0;
+ }
+
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 47817ef0aadb1..4e0d8a3b89b67 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -4166,7 +4166,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap,
+ return -EIO;
+ if (len < NFS4_MAXLABELLEN) {
+ if (label) {
+- memcpy(label->label, p, len);
++ if (label->len) {
++ if (label->len < len)
++ return -ERANGE;
++ memcpy(label->label, p, len);
++ }
+ label->len = len;
+ label->pi = pi;
+ label->lfs = lfs;
+--
+2.25.1
+
--- /dev/null
+From 5120e12582e46e0cb23a318cba9d14efd2c1cca9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2020 07:10:39 -0400
+Subject: nfs: nfs_file_write() should check for writeback errors
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit ce368536dd614452407dc31e2449eb84681a06af ]
+
+The NFS_CONTEXT_ERROR_WRITE flag (as well as the check of said flag) was
+removed by commit 6fbda89b257f. The absence of an error check allows
+writes to be continually queued up for a server that may no longer be
+able to handle them. Fix it by adding an error check using the generic
+error reporting functions.
+
+Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with generic one")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/file.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index d72496efa17b0..63940a7a70be1 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -590,12 +590,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = {
+ .page_mkwrite = nfs_vm_page_mkwrite,
+ };
+
+-static int nfs_need_check_write(struct file *filp, struct inode *inode)
++static int nfs_need_check_write(struct file *filp, struct inode *inode,
++ int error)
+ {
+ struct nfs_open_context *ctx;
+
+ ctx = nfs_file_open_context(filp);
+- if (nfs_ctx_key_to_expire(ctx, inode))
++ if (nfs_error_is_fatal_on_server(error) ||
++ nfs_ctx_key_to_expire(ctx, inode))
+ return 1;
+ return 0;
+ }
+@@ -606,6 +608,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(file);
+ unsigned long written = 0;
+ ssize_t result;
++ errseq_t since;
++ int error;
+
+ result = nfs_key_timeout_notify(file, inode);
+ if (result)
+@@ -630,6 +634,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ if (iocb->ki_pos > i_size_read(inode))
+ nfs_revalidate_mapping(inode, file->f_mapping);
+
++ since = filemap_sample_wb_err(file->f_mapping);
+ nfs_start_io_write(inode);
+ result = generic_write_checks(iocb, from);
+ if (result > 0) {
+@@ -648,7 +653,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ goto out;
+
+ /* Return error values */
+- if (nfs_need_check_write(file, inode)) {
++ error = filemap_check_wb_err(file->f_mapping, since);
++ if (nfs_need_check_write(file, inode, error)) {
+ int err = nfs_wb_all(inode);
+ if (err < 0)
+ result = err;
+--
+2.25.1
+
--- /dev/null
+From da03192c5dc161ddc64cdb649f6ce6f82f870735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:32:19 -0700
+Subject: nvme: fix deadlock in disconnect during scan_work and/or ana_work
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit ecca390e80561debbfdb4dc96bf94595136889fa ]
+
+A deadlock happens in the following scenario with multipath:
+1) scan_work(nvme0) detects a new nsid while nvme0
+ is an optimized path to it, path nvme1 happens to be
+ inaccessible.
+
+2) Before scan_work is complete nvme0 disconnect is initiated
+ nvme_delete_ctrl_sync() sets nvme0 state to NVME_CTRL_DELETING
+
+3) scan_work(1) attempts to submit IO,
+ but nvme_path_is_optimized() observes nvme0 is not LIVE.
+ Since nvme1 is a possible path IO is requeued and scan_work hangs.
+
+--
+Workqueue: nvme-wq nvme_scan_work [nvme_core]
+kernel: Call Trace:
+kernel: __schedule+0x2b9/0x6c0
+kernel: schedule+0x42/0xb0
+kernel: io_schedule+0x16/0x40
+kernel: do_read_cache_page+0x438/0x830
+kernel: read_cache_page+0x12/0x20
+kernel: read_dev_sector+0x27/0xc0
+kernel: read_lba+0xc1/0x220
+kernel: efi_partition+0x1e6/0x708
+kernel: check_partition+0x154/0x244
+kernel: rescan_partitions+0xae/0x280
+kernel: __blkdev_get+0x40f/0x560
+kernel: blkdev_get+0x3d/0x140
+kernel: __device_add_disk+0x388/0x480
+kernel: device_add_disk+0x13/0x20
+kernel: nvme_mpath_set_live+0x119/0x140 [nvme_core]
+kernel: nvme_update_ns_ana_state+0x5c/0x60 [nvme_core]
+kernel: nvme_set_ns_ana_state+0x1e/0x30 [nvme_core]
+kernel: nvme_parse_ana_log+0xa1/0x180 [nvme_core]
+kernel: nvme_mpath_add_disk+0x47/0x90 [nvme_core]
+kernel: nvme_validate_ns+0x396/0x940 [nvme_core]
+kernel: nvme_scan_work+0x24f/0x380 [nvme_core]
+kernel: process_one_work+0x1db/0x380
+kernel: worker_thread+0x249/0x400
+kernel: kthread+0x104/0x140
+--
+
+4) Delete also hangs in flush_work(ctrl->scan_work)
+ from nvme_remove_namespaces().
+
+Similiarly a deadlock with ana_work may happen: if ana_work has started
+and calls nvme_mpath_set_live and device_add_disk, it will
+trigger I/O. When we trigger disconnect I/O will block because
+our accessible (optimized) path is disconnecting, but the alternate
+path is inaccessible, so I/O blocks. Then disconnect tries to flush
+the ana_work and hangs.
+
+[ 605.550896] Workqueue: nvme-wq nvme_ana_work [nvme_core]
+[ 605.552087] Call Trace:
+[ 605.552683] __schedule+0x2b9/0x6c0
+[ 605.553507] schedule+0x42/0xb0
+[ 605.554201] io_schedule+0x16/0x40
+[ 605.555012] do_read_cache_page+0x438/0x830
+[ 605.556925] read_cache_page+0x12/0x20
+[ 605.557757] read_dev_sector+0x27/0xc0
+[ 605.558587] amiga_partition+0x4d/0x4c5
+[ 605.561278] check_partition+0x154/0x244
+[ 605.562138] rescan_partitions+0xae/0x280
+[ 605.563076] __blkdev_get+0x40f/0x560
+[ 605.563830] blkdev_get+0x3d/0x140
+[ 605.564500] __device_add_disk+0x388/0x480
+[ 605.565316] device_add_disk+0x13/0x20
+[ 605.566070] nvme_mpath_set_live+0x5e/0x130 [nvme_core]
+[ 605.567114] nvme_update_ns_ana_state+0x2c/0x30 [nvme_core]
+[ 605.568197] nvme_update_ana_state+0xca/0xe0 [nvme_core]
+[ 605.569360] nvme_parse_ana_log+0xa1/0x180 [nvme_core]
+[ 605.571385] nvme_read_ana_log+0x76/0x100 [nvme_core]
+[ 605.572376] nvme_ana_work+0x15/0x20 [nvme_core]
+[ 605.573330] process_one_work+0x1db/0x380
+[ 605.574144] worker_thread+0x4d/0x400
+[ 605.574896] kthread+0x104/0x140
+[ 605.577205] ret_from_fork+0x35/0x40
+[ 605.577955] INFO: task nvme:14044 blocked for more than 120 seconds.
+[ 605.579239] Tainted: G OE 5.3.5-050305-generic #201910071830
+[ 605.580712] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 605.582320] nvme D 0 14044 14043 0x00000000
+[ 605.583424] Call Trace:
+[ 605.583935] __schedule+0x2b9/0x6c0
+[ 605.584625] schedule+0x42/0xb0
+[ 605.585290] schedule_timeout+0x203/0x2f0
+[ 605.588493] wait_for_completion+0xb1/0x120
+[ 605.590066] __flush_work+0x123/0x1d0
+[ 605.591758] __cancel_work_timer+0x10e/0x190
+[ 605.593542] cancel_work_sync+0x10/0x20
+[ 605.594347] nvme_mpath_stop+0x2f/0x40 [nvme_core]
+[ 605.595328] nvme_stop_ctrl+0x12/0x50 [nvme_core]
+[ 605.596262] nvme_do_delete_ctrl+0x3f/0x90 [nvme_core]
+[ 605.597333] nvme_sysfs_delete+0x5c/0x70 [nvme_core]
+[ 605.598320] dev_attr_store+0x17/0x30
+
+Fix this by introducing a new state: NVME_CTRL_DELETE_NOIO, which will
+indicate the phase of controller deletion where I/O cannot be allowed
+to access the namespace. NVME_CTRL_DELETING still allows mpath I/O to
+be issued to the bottom device, and only after we flush the ana_work
+and scan_work (after nvme_stop_ctrl and nvme_prep_remove_namespaces)
+we change the state to NVME_CTRL_DELETING_NOIO. Also we prevent ana_work
+from re-firing by aborting early if we are not LIVE, so we should be safe
+here.
+
+In addition, change the transport drivers to follow the updated state
+machine.
+
+Fixes: 0d0b660f214d ("nvme: add ANA support")
+Reported-by: Anton Eidelman <anton@lightbitslabs.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 15 +++++++++++++++
+ drivers/nvme/host/fabrics.c | 2 +-
+ drivers/nvme/host/fabrics.h | 3 ++-
+ drivers/nvme/host/fc.c | 1 +
+ drivers/nvme/host/multipath.c | 18 +++++++++++++++---
+ drivers/nvme/host/nvme.h | 1 +
+ drivers/nvme/host/rdma.c | 10 ++++++----
+ drivers/nvme/host/tcp.c | 15 +++++++++------
+ 8 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 4ee2330c603e7..f38548e6d55ec 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -362,6 +362,16 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ break;
+ }
+ break;
++ case NVME_CTRL_DELETING_NOIO:
++ switch (old_state) {
++ case NVME_CTRL_DELETING:
++ case NVME_CTRL_DEAD:
++ changed = true;
++ /* FALLTHRU */
++ default:
++ break;
++ }
++ break;
+ case NVME_CTRL_DEAD:
+ switch (old_state) {
+ case NVME_CTRL_DELETING:
+@@ -399,6 +409,7 @@ static bool nvme_state_terminal(struct nvme_ctrl *ctrl)
+ case NVME_CTRL_CONNECTING:
+ return false;
+ case NVME_CTRL_DELETING:
++ case NVME_CTRL_DELETING_NOIO:
+ case NVME_CTRL_DEAD:
+ return true;
+ default:
+@@ -3344,6 +3355,7 @@ static ssize_t nvme_sysfs_show_state(struct device *dev,
+ [NVME_CTRL_RESETTING] = "resetting",
+ [NVME_CTRL_CONNECTING] = "connecting",
+ [NVME_CTRL_DELETING] = "deleting",
++ [NVME_CTRL_DELETING_NOIO]= "deleting (no IO)",
+ [NVME_CTRL_DEAD] = "dead",
+ };
+
+@@ -3911,6 +3923,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
+ if (ctrl->state == NVME_CTRL_DEAD)
+ nvme_kill_queues(ctrl);
+
++ /* this is a no-op when called from the controller reset handler */
++ nvme_change_ctrl_state(ctrl, NVME_CTRL_DELETING_NOIO);
++
+ down_write(&ctrl->namespaces_rwsem);
+ list_splice_init(&ctrl->namespaces, &ns_list);
+ up_write(&ctrl->namespaces_rwsem);
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 2a6c8190eeb76..4ec4829d62334 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -547,7 +547,7 @@ static struct nvmf_transport_ops *nvmf_lookup_transport(
+ blk_status_t nvmf_fail_nonready_command(struct nvme_ctrl *ctrl,
+ struct request *rq)
+ {
+- if (ctrl->state != NVME_CTRL_DELETING &&
++ if (ctrl->state != NVME_CTRL_DELETING_NOIO &&
+ ctrl->state != NVME_CTRL_DEAD &&
+ !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH))
+ return BLK_STS_RESOURCE;
+diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
+index a0ec40ab62eeb..a9c1e3b4585ec 100644
+--- a/drivers/nvme/host/fabrics.h
++++ b/drivers/nvme/host/fabrics.h
+@@ -182,7 +182,8 @@ bool nvmf_ip_options_match(struct nvme_ctrl *ctrl,
+ static inline bool nvmf_check_ready(struct nvme_ctrl *ctrl, struct request *rq,
+ bool queue_live)
+ {
+- if (likely(ctrl->state == NVME_CTRL_LIVE))
++ if (likely(ctrl->state == NVME_CTRL_LIVE ||
++ ctrl->state == NVME_CTRL_DELETING))
+ return true;
+ return __nvmf_check_ready(ctrl, rq, queue_live);
+ }
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index e999a8c4b7e87..549f5b0fb0b4b 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -825,6 +825,7 @@ nvme_fc_ctrl_connectivity_loss(struct nvme_fc_ctrl *ctrl)
+ break;
+
+ case NVME_CTRL_DELETING:
++ case NVME_CTRL_DELETING_NOIO:
+ default:
+ /* no action to take - let it delete */
+ break;
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 57d51148e71b6..2672953233434 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -167,9 +167,18 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
+
+ static bool nvme_path_is_disabled(struct nvme_ns *ns)
+ {
+- return ns->ctrl->state != NVME_CTRL_LIVE ||
+- test_bit(NVME_NS_ANA_PENDING, &ns->flags) ||
+- test_bit(NVME_NS_REMOVING, &ns->flags);
++ /*
++ * We don't treat NVME_CTRL_DELETING as a disabled path as I/O should
++ * still be able to complete assuming that the controller is connected.
++ * Otherwise it will fail immediately and return to the requeue list.
++ */
++ if (ns->ctrl->state != NVME_CTRL_LIVE &&
++ ns->ctrl->state != NVME_CTRL_DELETING)
++ return true;
++ if (test_bit(NVME_NS_ANA_PENDING, &ns->flags) ||
++ test_bit(NVME_NS_REMOVING, &ns->flags))
++ return true;
++ return false;
+ }
+
+ static struct nvme_ns *__nvme_find_path(struct nvme_ns_head *head, int node)
+@@ -574,6 +583,9 @@ static void nvme_ana_work(struct work_struct *work)
+ {
+ struct nvme_ctrl *ctrl = container_of(work, struct nvme_ctrl, ana_work);
+
++ if (ctrl->state != NVME_CTRL_LIVE)
++ return;
++
+ nvme_read_ana_log(ctrl);
+ }
+
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 09ffc3246f60e..e268f1d7e1a0f 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -186,6 +186,7 @@ enum nvme_ctrl_state {
+ NVME_CTRL_RESETTING,
+ NVME_CTRL_CONNECTING,
+ NVME_CTRL_DELETING,
++ NVME_CTRL_DELETING_NOIO,
+ NVME_CTRL_DEAD,
+ };
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index af0cfd25ed7a4..876859cd14e86 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1082,11 +1082,12 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
+ changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
+ if (!changed) {
+ /*
+- * state change failure is ok if we're in DELETING state,
++ * state change failure is ok if we started ctrl delete,
+ * unless we're during creation of a new controller to
+ * avoid races with teardown flow.
+ */
+- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
++ WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING &&
++ ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO);
+ WARN_ON_ONCE(new);
+ ret = -EINVAL;
+ goto destroy_io;
+@@ -1139,8 +1140,9 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+
+ if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING)) {
+- /* state change failure is ok if we're in DELETING state */
+- WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING);
++ /* state change failure is ok if we started ctrl delete */
++ WARN_ON_ONCE(ctrl->ctrl.state != NVME_CTRL_DELETING &&
++ ctrl->ctrl.state != NVME_CTRL_DELETING_NOIO);
+ return;
+ }
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 83bb329d4113a..a6d2e3330a584 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1929,11 +1929,12 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new)
+
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_LIVE)) {
+ /*
+- * state change failure is ok if we're in DELETING state,
++ * state change failure is ok if we started ctrl delete,
+ * unless we're during creation of a new controller to
+ * avoid races with teardown flow.
+ */
+- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING);
++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING &&
++ ctrl->state != NVME_CTRL_DELETING_NOIO);
+ WARN_ON_ONCE(new);
+ ret = -EINVAL;
+ goto destroy_io;
+@@ -1989,8 +1990,9 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) {
+- /* state change failure is ok if we're in DELETING state */
+- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING);
++ /* state change failure is ok if we started ctrl delete */
++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING &&
++ ctrl->state != NVME_CTRL_DELETING_NOIO);
+ return;
+ }
+
+@@ -2025,8 +2027,9 @@ static void nvme_reset_ctrl_work(struct work_struct *work)
+ nvme_tcp_teardown_ctrl(ctrl, false);
+
+ if (!nvme_change_ctrl_state(ctrl, NVME_CTRL_CONNECTING)) {
+- /* state change failure is ok if we're in DELETING state */
+- WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING);
++ /* state change failure is ok if we started ctrl delete */
++ WARN_ON_ONCE(ctrl->state != NVME_CTRL_DELETING &&
++ ctrl->state != NVME_CTRL_DELETING_NOIO);
+ return;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From eb77afbc6dcc60d60ab0e3ecdaec0d8bc1263622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 20:53:21 -0700
+Subject: octeontx2-af: change (struct qmem)->entry_sz from u8 to u16
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 393415203f5c916b5907e0a7c89f4c2c5a9c5505 ]
+
+We need to increase TSO_HEADER_SIZE from 128 to 256.
+
+Since otx2_sq_init() calls qmem_alloc() with TSO_HEADER_SIZE,
+we need to change (struct qmem)->entry_sz to avoid truncation to 0.
+
+Fixes: 7a37245ef23f ("octeontx2-af: NPA block admin queue init")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+index cd33c2e6ca5fc..f48eb66ed021b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+@@ -43,7 +43,7 @@ struct qmem {
+ void *base;
+ dma_addr_t iova;
+ int alloc_sz;
+- u8 entry_sz;
++ u16 entry_sz;
+ u8 align;
+ u32 qsize;
+ };
+--
+2.25.1
+
--- /dev/null
+From 0b6a34ab1a251439b3ad7d16c5a96420e72099a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 06:19:46 +0900
+Subject: openrisc: Fix oops caused when dumping stack
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 57b8e277c33620e115633cdf700a260b55095460 ]
+
+When dumping a stack with 'cat /proc/#/stack' the kernel would oops.
+For example:
+
+ # cat /proc/690/stack
+ Unable to handle kernel access
+ at virtual address 0x7fc60f58
+
+ Oops#: 0000
+ CPU #: 0
+ PC: c00097fc SR: 0000807f SP: d6f09b9c
+ GPR00: 00000000 GPR01: d6f09b9c GPR02: d6f09bb8 GPR03: d6f09bc4
+ GPR04: 7fc60f5c GPR05: c00099b4 GPR06: 00000000 GPR07: d6f09ba3
+ GPR08: ffffff00 GPR09: c0009804 GPR10: d6f08000 GPR11: 00000000
+ GPR12: ffffe000 GPR13: dbb86000 GPR14: 00000001 GPR15: dbb86250
+ GPR16: 7fc60f63 GPR17: 00000f5c GPR18: d6f09bc4 GPR19: 00000000
+ GPR20: c00099b4 GPR21: ffffffc0 GPR22: 00000000 GPR23: 00000000
+ GPR24: 00000001 GPR25: 000002c6 GPR26: d78b6850 GPR27: 00000001
+ GPR28: 00000000 GPR29: dbb86000 GPR30: ffffffff GPR31: dbb862fc
+ RES: 00000000 oGPR11: ffffffff
+ Process cat (pid: 702, stackpage=d79d6000)
+
+ Stack:
+ Call trace:
+ [<598977f2>] save_stack_trace_tsk+0x40/0x74
+ [<95063f0e>] stack_trace_save_tsk+0x44/0x58
+ [<b557bfdd>] proc_pid_stack+0xd0/0x13c
+ [<a2df8eda>] proc_single_show+0x6c/0xf0
+ [<e5a737b7>] seq_read+0x1b4/0x688
+ [<2d6c7480>] do_iter_read+0x208/0x248
+ [<2182a2fb>] vfs_readv+0x64/0x90
+
+This was caused by the stack trace code in save_stack_trace_tsk using
+the wrong stack pointer. It was using the user stack pointer instead of
+the kernel stack pointer. Fix this by using the right stack.
+
+Also for good measure we add try_get_task_stack/put_task_stack to ensure
+the task is not lost while we are walking it's stack.
+
+Fixes: eecac38b0423a ("openrisc: support framepointers and STACKTRACE_SUPPORT")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/stacktrace.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c
+index 43f140a28bc72..54d38809e22cb 100644
+--- a/arch/openrisc/kernel/stacktrace.c
++++ b/arch/openrisc/kernel/stacktrace.c
+@@ -13,6 +13,7 @@
+ #include <linux/export.h>
+ #include <linux/sched.h>
+ #include <linux/sched/debug.h>
++#include <linux/sched/task_stack.h>
+ #include <linux/stacktrace.h>
+
+ #include <asm/processor.h>
+@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ {
+ unsigned long *sp = NULL;
+
++ if (!try_get_task_stack(tsk))
++ return;
++
+ if (tsk == current)
+ sp = (unsigned long *) &sp;
+- else
+- sp = (unsigned long *) KSTK_ESP(tsk);
++ else {
++ unsigned long ksp;
++
++ /* Locate stack from kernel context */
++ ksp = task_thread_info(tsk)->ksp;
++ ksp += STACK_FRAME_OVERHEAD; /* redzone */
++ ksp += sizeof(struct pt_regs);
++
++ sp = (unsigned long *) ksp;
++ }
+
+ unwind_stack(trace, sp, save_stack_address_nosched);
++
++ put_task_stack(tsk);
+ }
+ EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
+
+--
+2.25.1
+
--- /dev/null
+From 4bc5a33f76f0cd87d4e07f68bc5335e3501c4b4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 15:17:31 +0800
+Subject: PCI: hv: Fix a timing issue which causes kdump to fail occasionally
+
+From: Wei Hu <weh@microsoft.com>
+
+[ Upstream commit d6af2ed29c7c1c311b96dac989dcb991e90ee195 ]
+
+Kdump could fail sometime on Hyper-V guest because the retry in
+hv_pci_enter_d0() releases child device structures in hv_pci_bus_exit().
+
+Although there is a second asynchronous device relations message sending
+from the host, if this message arrives to the guest after
+hv_send_resource_allocated() is called, the retry would fail.
+
+Fix the problem by moving retry to hv_pci_probe() and start the retry
+from hv_pci_query_relations() call. This will cause a device relations
+message to arrive to the guest synchronously; the guest would then be
+able to rebuild the child device structures before calling
+hv_send_resource_allocated().
+
+Link: https://lore.kernel.org/r/20200727071731.18516-1-weh@microsoft.com
+Fixes: c81992e7f4aa ("PCI: hv: Retry PCI bus D0 entry on invalid device state")
+Signed-off-by: Wei Hu <weh@microsoft.com>
+[lorenzo.pieralisi@arm.com: fixed a comment and commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++--------------
+ 1 file changed, 37 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
+index bf40ff09c99d6..d0033ff6c1437 100644
+--- a/drivers/pci/controller/pci-hyperv.c
++++ b/drivers/pci/controller/pci-hyperv.c
+@@ -2759,10 +2759,8 @@ static int hv_pci_enter_d0(struct hv_device *hdev)
+ struct pci_bus_d0_entry *d0_entry;
+ struct hv_pci_compl comp_pkt;
+ struct pci_packet *pkt;
+- bool retry = true;
+ int ret;
+
+-enter_d0_retry:
+ /*
+ * Tell the host that the bus is ready to use, and moved into the
+ * powered-on state. This includes telling the host which region
+@@ -2789,38 +2787,6 @@ static int hv_pci_enter_d0(struct hv_device *hdev)
+ if (ret)
+ goto exit;
+
+- /*
+- * In certain case (Kdump) the pci device of interest was
+- * not cleanly shut down and resource is still held on host
+- * side, the host could return invalid device status.
+- * We need to explicitly request host to release the resource
+- * and try to enter D0 again.
+- */
+- if (comp_pkt.completion_status < 0 && retry) {
+- retry = false;
+-
+- dev_err(&hdev->device, "Retrying D0 Entry\n");
+-
+- /*
+- * Hv_pci_bus_exit() calls hv_send_resource_released()
+- * to free up resources of its child devices.
+- * In the kdump kernel we need to set the
+- * wslot_res_allocated to 255 so it scans all child
+- * devices to release resources allocated in the
+- * normal kernel before panic happened.
+- */
+- hbus->wslot_res_allocated = 255;
+-
+- ret = hv_pci_bus_exit(hdev, true);
+-
+- if (ret == 0) {
+- kfree(pkt);
+- goto enter_d0_retry;
+- }
+- dev_err(&hdev->device,
+- "Retrying D0 failed with ret %d\n", ret);
+- }
+-
+ if (comp_pkt.completion_status < 0) {
+ dev_err(&hdev->device,
+ "PCI Pass-through VSP failed D0 Entry with status %x\n",
+@@ -3058,6 +3024,7 @@ static int hv_pci_probe(struct hv_device *hdev,
+ struct hv_pcibus_device *hbus;
+ u16 dom_req, dom;
+ char *name;
++ bool enter_d0_retry = true;
+ int ret;
+
+ /*
+@@ -3178,11 +3145,47 @@ static int hv_pci_probe(struct hv_device *hdev,
+ if (ret)
+ goto free_fwnode;
+
++retry:
+ ret = hv_pci_query_relations(hdev);
+ if (ret)
+ goto free_irq_domain;
+
+ ret = hv_pci_enter_d0(hdev);
++ /*
++ * In certain case (Kdump) the pci device of interest was
++ * not cleanly shut down and resource is still held on host
++ * side, the host could return invalid device status.
++ * We need to explicitly request host to release the resource
++ * and try to enter D0 again.
++ * Since the hv_pci_bus_exit() call releases structures
++ * of all its child devices, we need to start the retry from
++ * hv_pci_query_relations() call, requesting host to send
++ * the synchronous child device relations message before this
++ * information is needed in hv_send_resources_allocated()
++ * call later.
++ */
++ if (ret == -EPROTO && enter_d0_retry) {
++ enter_d0_retry = false;
++
++ dev_err(&hdev->device, "Retrying D0 Entry\n");
++
++ /*
++ * Hv_pci_bus_exit() calls hv_send_resources_released()
++ * to free up resources of its child devices.
++ * In the kdump kernel we need to set the
++ * wslot_res_allocated to 255 so it scans all child
++ * devices to release resources allocated in the
++ * normal kernel before panic happened.
++ */
++ hbus->wslot_res_allocated = 255;
++ ret = hv_pci_bus_exit(hdev, true);
++
++ if (ret == 0)
++ goto retry;
++
++ dev_err(&hdev->device,
++ "Retrying D0 failed with ret %d\n", ret);
++ }
+ if (ret)
+ goto free_irq_domain;
+
+--
+2.25.1
+
--- /dev/null
+From b4383b17ecfacf073ff2fca408521a8de979de78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 15:34:04 +0200
+Subject: perf bench mem: Always memset source before memcpy
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 1beaef29c34154ccdcb3f1ae557f6883eda18840 ]
+
+For memcpy, the source pages are memset to zero only when --cycles is
+used. This leads to wildly different results with or without --cycles,
+since all sources pages are likely to be mapped to the same zero page
+without explicit writes.
+
+Before this fix:
+
+$ export cmd="./perf stat -e LLC-loads -- ./perf bench \
+ mem memcpy -s 1024MB -l 100 -f default"
+$ $cmd
+
+ 2,935,826 LLC-loads
+ 3.821677452 seconds time elapsed
+
+$ $cmd --cycles
+
+ 217,533,436 LLC-loads
+ 8.616725985 seconds time elapsed
+
+After this fix:
+
+$ $cmd
+
+ 214,459,686 LLC-loads
+ 8.674301124 seconds time elapsed
+
+$ $cmd --cycles
+
+ 214,758,651 LLC-loads
+ 8.644480006 seconds time elapsed
+
+Fixes: 47b5757bac03c338 ("perf bench mem: Move boilerplate memory allocation to the infrastructure")
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: kernel@axis.com
+Link: http://lore.kernel.org/lkml/20200810133404.30829-1-vincent.whitchurch@axis.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/mem-functions.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c
+index 9235b76501be8..19d45c377ac18 100644
+--- a/tools/perf/bench/mem-functions.c
++++ b/tools/perf/bench/mem-functions.c
+@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info *
+ return 0;
+ }
+
+-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst)
+ {
+- u64 cycle_start = 0ULL, cycle_end = 0ULL;
+- memcpy_t fn = r->fn.memcpy;
+- int i;
+-
+ /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */
+ memset(src, 0, size);
+
+@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo
+ * to not measure page fault overhead:
+ */
+ fn(dst, src, size);
++}
++
++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst)
++{
++ u64 cycle_start = 0ULL, cycle_end = 0ULL;
++ memcpy_t fn = r->fn.memcpy;
++ int i;
++
++ memcpy_prefault(fn, size, src, dst);
+
+ cycle_start = get_cycles();
+ for (i = 0; i < nr_loops; ++i)
+@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void
+ memcpy_t fn = r->fn.memcpy;
+ int i;
+
+- /*
+- * We prefault the freshly allocated memory range here,
+- * to not measure page fault overhead:
+- */
+- fn(dst, src, size);
++ memcpy_prefault(fn, size, src, dst);
+
+ BUG_ON(gettimeofday(&tv_start, NULL));
+ for (i = 0; i < nr_loops; ++i)
+--
+2.25.1
+
--- /dev/null
+From 0ff0c9e2c7b5095359f2c5bcc63a411c9ddb5ab7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 09:00:13 +0800
+Subject: perf evsel: Don't set sample_regs_intr/sample_regs_user for dummy
+ event
+
+From: Jin Yao <yao.jin@linux.intel.com>
+
+[ Upstream commit c4735d990268399da9133b0ad445e488ece009ad ]
+
+Since commit 0a892c1c9472 ("perf record: Add dummy event during system wide synthesis"),
+a dummy event is added to capture mmaps.
+
+But if we run perf-record as,
+
+ # perf record -e cycles:p -IXMM0 -a -- sleep 1
+ Error:
+ dummy:HG: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat'
+
+The issue is, if we enable the extended regs (-IXMM0), but the
+pmu->capabilities is not set with PERF_PMU_CAP_EXTENDED_REGS, the kernel
+will return -EOPNOTSUPP error.
+
+See following code:
+
+/* in kernel/events/core.c */
+static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
+
+{
+ ....
+ if (!(pmu->capabilities & PERF_PMU_CAP_EXTENDED_REGS) &&
+ has_extended_regs(event))
+ ret = -EOPNOTSUPP;
+ ....
+}
+
+For software dummy event, the PMU should not be set with
+PERF_PMU_CAP_EXTENDED_REGS. But unfortunately now, the dummy
+event has possibility to be set with PERF_REG_EXTENDED_MASK bit.
+
+In evsel__config, /* tools/perf/util/evsel.c */
+
+if (opts->sample_intr_regs) {
+ attr->sample_regs_intr = opts->sample_intr_regs;
+}
+
+If we use -IXMM0, the attr>sample_regs_intr will be set with
+PERF_REG_EXTENDED_MASK bit.
+
+It doesn't make sense to set attr->sample_regs_intr for a
+software dummy event.
+
+This patch adds dummy event checking before setting
+attr->sample_regs_intr and attr->sample_regs_user.
+
+After:
+ # ./perf record -e cycles:p -IXMM0 -a -- sleep 1
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.413 MB perf.data (45 samples) ]
+
+Committer notes:
+
+Adrian said this when providing his Acked-by:
+
+"
+This is fine. It will not break PT.
+
+no_aux_samples is useful for evsels that have been added by the code rather
+than requested by the user. For old kernels PT adds sched_switch tracepoint
+to track context switches (before the current context switch event was
+added) and having auxiliary sample information unnecessarily uses up space
+in the perf buffer.
+"
+
+Fixes: 0a892c1c9472 ("perf record: Add dummy event during system wide synthesis")
+Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jin Yao <yao.jin@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20200720010013.18238-1-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index ef802f6d40c17..6a79cfdf96cb6 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1014,12 +1014,14 @@ void evsel__config(struct evsel *evsel, struct record_opts *opts,
+ if (callchain && callchain->enabled && !evsel->no_aux_samples)
+ evsel__config_callchain(evsel, opts, callchain);
+
+- if (opts->sample_intr_regs && !evsel->no_aux_samples) {
++ if (opts->sample_intr_regs && !evsel->no_aux_samples &&
++ !evsel__is_dummy_event(evsel)) {
+ attr->sample_regs_intr = opts->sample_intr_regs;
+ evsel__set_sample_bit(evsel, REGS_INTR);
+ }
+
+- if (opts->sample_user_regs && !evsel->no_aux_samples) {
++ if (opts->sample_user_regs && !evsel->no_aux_samples &&
++ !evsel__is_dummy_event(evsel)) {
+ attr->sample_regs_user |= opts->sample_user_regs;
+ evsel__set_sample_bit(evsel, REGS_USER);
+ }
+--
+2.25.1
+
--- /dev/null
+From 198273644328e5837994a44bbfb24e4463039ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 10:29:37 +0800
+Subject: perf record: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not
+ set
+
+From: Jin Yao <yao.jin@linux.intel.com>
+
+[ Upstream commit 1101c872c8c7869c78dc106ae820040f36807eda ]
+
+We received an error report that perf-record caused 'Segmentation fault'
+on a newly system (e.g. on the new installed ubuntu).
+
+ (gdb) backtrace
+ #0 __read_once_size (size=4, res=<synthetic pointer>, p=0x14) at /root/0-jinyao/acme/tools/include/linux/compiler.h:139
+ #1 atomic_read (v=0x14) at /root/0-jinyao/acme/tools/include/asm/../../arch/x86/include/asm/atomic.h:28
+ #2 refcount_read (r=0x14) at /root/0-jinyao/acme/tools/include/linux/refcount.h:65
+ #3 perf_mmap__read_init (map=map@entry=0x0) at mmap.c:177
+ #4 0x0000561ce5c0de39 in perf_evlist__poll_thread (arg=0x561ce68584d0) at util/sideband_evlist.c:62
+ #5 0x00007fad78491609 in start_thread (arg=<optimized out>) at pthread_create.c:477
+ #6 0x00007fad7823c103 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
+
+The root cause is, evlist__add_bpf_sb_event() just returns 0 if
+HAVE_LIBBPF_SUPPORT is not defined (inline function path). So it will
+not create a valid evsel for side-band event.
+
+But perf-record still creates BPF side band thread to process the
+side-band event, then the error happpens.
+
+We can reproduce this issue by removing the libelf-dev. e.g.
+1. apt-get remove libelf-dev
+2. perf record -a -- sleep 1
+
+ root@test:~# ./perf record -a -- sleep 1
+ perf: Segmentation fault
+ Obtained 6 stack frames.
+ ./perf(+0x28eee8) [0x5562d6ef6ee8]
+ /lib/x86_64-linux-gnu/libc.so.6(+0x46210) [0x7fbfdc65f210]
+ ./perf(+0x342e74) [0x5562d6faae74]
+ ./perf(+0x257e39) [0x5562d6ebfe39]
+ /lib/x86_64-linux-gnu/libpthread.so.0(+0x9609) [0x7fbfdc990609]
+ /lib/x86_64-linux-gnu/libc.so.6(clone+0x43) [0x7fbfdc73b103]
+ Segmentation fault (core dumped)
+
+To fix this issue,
+
+1. We either install the missing libraries to let HAVE_LIBBPF_SUPPORT
+ be defined.
+ e.g. apt-get install libelf-dev and install other related libraries.
+
+2. Use this patch to skip the side-band event setup if HAVE_LIBBPF_SUPPORT
+ is not set.
+
+Committer notes:
+
+The side band thread is not used just with BPF, it is also used with
+--switch-output-event, so narrow the ifdef to the BPF specific part.
+
+Fixes: 23cbb41c939a ("perf record: Move side band evlist setup to separate routine")
+Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jin Yao <yao.jin@intel.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20200805022937.29184-1-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index a37e7910e9e90..23ea934f30b34 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -1489,7 +1489,7 @@ static int record__setup_sb_evlist(struct record *rec)
+ evlist__set_cb(rec->sb_evlist, record__process_signal_event, rec);
+ rec->thread_id = pthread_self();
+ }
+-
++#ifdef HAVE_LIBBPF_SUPPORT
+ if (!opts->no_bpf_event) {
+ if (rec->sb_evlist == NULL) {
+ rec->sb_evlist = evlist__new();
+@@ -1505,7 +1505,7 @@ static int record__setup_sb_evlist(struct record *rec)
+ return -1;
+ }
+ }
+-
++#endif
+ if (perf_evlist__start_sb_thread(rec->sb_evlist, &rec->opts.target)) {
+ pr_debug("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n");
+ opts->no_bpf_event = true;
+--
+2.25.1
+
--- /dev/null
+From e89510c4576d89d31d6cd8b0361d502d9f8196c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 09:52:44 +0200
+Subject: perf tools: Fix term parsing for raw syntax
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 4929e95a1400e45b4b5a87fd3ce10273444187d4 ]
+
+Jin Yao reported issue with possible conflict between raw events and
+term values in pmu event syntax.
+
+Currently following syntax is resolved as raw event with 0xead value:
+
+ uncore_imc_free_running/read/
+
+instead of using 'read' term from uncore_imc_free_running pmu, because
+'read' is correct raw event syntax with 0xead value.
+
+To solve this issue we do following:
+
+ - check existing terms during rXXXX syntax processing
+ and make them priority in case of conflict
+
+ - allow pmu/r0x1234/ syntax to be able to specify conflicting
+ raw event (implemented in previous patch)
+
+Also add automated tests for this and perf_pmu__parse_cleanup call to
+parse_events_terms, so the test gets properly cleaned up.
+
+Fixes: 3a6c51e4d66c ("perf parser: Add support to specify rXXX event with pmu")
+Reported-by: Jin Yao <yao.jin@linux.intel.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Jin Yao <yao.jin@linux.intel.com>
+Acked-by: Ian Rogers <irogers@google.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Michael Petlan <mpetlan@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Link: http://lore.kernel.org/lkml/20200726075244.1191481-2-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/parse-events.c | 37 ++++++++++++++++++++++++++++++++-
+ tools/perf/util/parse-events.c | 28 +++++++++++++++++++++++++
+ tools/perf/util/parse-events.h | 2 ++
+ tools/perf/util/parse-events.l | 19 ++++++++++-------
+ 4 files changed, 77 insertions(+), 9 deletions(-)
+
+diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
+index 895188b63f963..6a2ec6ec0d0ef 100644
+--- a/tools/perf/tests/parse-events.c
++++ b/tools/perf/tests/parse-events.c
+@@ -631,6 +631,34 @@ static int test__checkterms_simple(struct list_head *terms)
+ TEST_ASSERT_VAL("wrong val", term->val.num == 1);
+ TEST_ASSERT_VAL("wrong config", !strcmp(term->config, "umask"));
+
++ /*
++ * read
++ *
++ * The perf_pmu__test_parse_init injects 'read' term into
++ * perf_pmu_events_list, so 'read' is evaluated as read term
++ * and not as raw event with 'ead' hex value.
++ */
++ term = list_entry(term->list.next, struct parse_events_term, list);
++ TEST_ASSERT_VAL("wrong type term",
++ term->type_term == PARSE_EVENTS__TERM_TYPE_USER);
++ TEST_ASSERT_VAL("wrong type val",
++ term->type_val == PARSE_EVENTS__TERM_TYPE_NUM);
++ TEST_ASSERT_VAL("wrong val", term->val.num == 1);
++ TEST_ASSERT_VAL("wrong config", !strcmp(term->config, "read"));
++
++ /*
++ * r0xead
++ *
++ * To be still able to pass 'ead' value with 'r' syntax,
++ * we added support to parse 'r0xHEX' event.
++ */
++ term = list_entry(term->list.next, struct parse_events_term, list);
++ TEST_ASSERT_VAL("wrong type term",
++ term->type_term == PARSE_EVENTS__TERM_TYPE_CONFIG);
++ TEST_ASSERT_VAL("wrong type val",
++ term->type_val == PARSE_EVENTS__TERM_TYPE_NUM);
++ TEST_ASSERT_VAL("wrong val", term->val.num == 0xead);
++ TEST_ASSERT_VAL("wrong config", !term->config);
+ return 0;
+ }
+
+@@ -1776,7 +1804,7 @@ struct terms_test {
+
+ static struct terms_test test__terms[] = {
+ [0] = {
+- .str = "config=10,config1,config2=3,umask=1",
++ .str = "config=10,config1,config2=3,umask=1,read,r0xead",
+ .check = test__checkterms_simple,
+ },
+ };
+@@ -1836,6 +1864,13 @@ static int test_term(struct terms_test *t)
+
+ INIT_LIST_HEAD(&terms);
+
++ /*
++ * The perf_pmu__test_parse_init prepares perf_pmu_events_list
++ * which gets freed in parse_events_terms.
++ */
++ if (perf_pmu__test_parse_init())
++ return -1;
++
+ ret = parse_events_terms(&terms, t->str);
+ if (ret) {
+ pr_debug("failed to parse terms '%s', err %d\n",
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 3decbb203846a..4476de0e678aa 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -2017,6 +2017,32 @@ static void perf_pmu__parse_init(void)
+ perf_pmu__parse_cleanup();
+ }
+
++/*
++ * This function injects special term in
++ * perf_pmu_events_list so the test code
++ * can check on this functionality.
++ */
++int perf_pmu__test_parse_init(void)
++{
++ struct perf_pmu_event_symbol *list;
++
++ list = malloc(sizeof(*list) * 1);
++ if (!list)
++ return -ENOMEM;
++
++ list->type = PMU_EVENT_SYMBOL;
++ list->symbol = strdup("read");
++
++ if (!list->symbol) {
++ free(list);
++ return -ENOMEM;
++ }
++
++ perf_pmu_events_list = list;
++ perf_pmu_events_list_num = 1;
++ return 0;
++}
++
+ enum perf_pmu_event_symbol_type
+ perf_pmu__parse_check(const char *name)
+ {
+@@ -2078,6 +2104,8 @@ int parse_events_terms(struct list_head *terms, const char *str)
+ int ret;
+
+ ret = parse_events__scanner(str, &parse_state);
++ perf_pmu__parse_cleanup();
++
+ if (!ret) {
+ list_splice(parse_state.terms, terms);
+ zfree(&parse_state.terms);
+diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
+index 1fe23a2f9b36e..0b8cdb7270f04 100644
+--- a/tools/perf/util/parse-events.h
++++ b/tools/perf/util/parse-events.h
+@@ -253,4 +253,6 @@ static inline bool is_sdt_event(char *str __maybe_unused)
+ }
+ #endif /* HAVE_LIBELF_SUPPORT */
+
++int perf_pmu__test_parse_init(void);
++
+ #endif /* __PERF_PARSE_EVENTS_H */
+diff --git a/tools/perf/util/parse-events.l b/tools/perf/util/parse-events.l
+index 002802e17059e..7332d16cb4fc7 100644
+--- a/tools/perf/util/parse-events.l
++++ b/tools/perf/util/parse-events.l
+@@ -41,14 +41,6 @@ static int value(yyscan_t scanner, int base)
+ return __value(yylval, text, base, PE_VALUE);
+ }
+
+-static int raw(yyscan_t scanner)
+-{
+- YYSTYPE *yylval = parse_events_get_lval(scanner);
+- char *text = parse_events_get_text(scanner);
+-
+- return __value(yylval, text + 1, 16, PE_RAW);
+-}
+-
+ static int str(yyscan_t scanner, int token)
+ {
+ YYSTYPE *yylval = parse_events_get_lval(scanner);
+@@ -72,6 +64,17 @@ static int str(yyscan_t scanner, int token)
+ return token;
+ }
+
++static int raw(yyscan_t scanner)
++{
++ YYSTYPE *yylval = parse_events_get_lval(scanner);
++ char *text = parse_events_get_text(scanner);
++
++ if (perf_pmu__parse_check(text) == PMU_EVENT_SYMBOL)
++ return str(scanner, PE_NAME);
++
++ return __value(yylval, text + 1, 16, PE_RAW);
++}
++
+ static bool isbpf_suffix(char *text)
+ {
+ int len = strlen(text);
+--
+2.25.1
+
--- /dev/null
+From cbd075080dd1e865a57f80e1b212a0ea8f7e3bfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 23:31:47 +0800
+Subject: perf/x86/rapl: Fix missing psys sysfs attributes
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+[ Upstream commit 4bb5fcb97a5df0bbc0a27e0252b1e7ce140a8431 ]
+
+This fixes a problem introduced by commit:
+
+ 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface")
+
+that perf event sysfs attributes for psys RAPL domain are missing.
+
+Fixes: 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface")
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Reviewed-by: Len Brown <len.brown@intel.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20200811153149.12242-2-rui.zhang@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/rapl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c
+index 0f2bf59f43541..51ff9a3618c95 100644
+--- a/arch/x86/events/rapl.c
++++ b/arch/x86/events/rapl.c
+@@ -665,7 +665,7 @@ static const struct attribute_group *rapl_attr_update[] = {
+ &rapl_events_pkg_group,
+ &rapl_events_ram_group,
+ &rapl_events_gpu_group,
+- &rapl_events_gpu_group,
++ &rapl_events_psys_group,
+ NULL,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 3d09d5391f83c75d9f712417fa1482b2782bb4cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 22:16:08 -0500
+Subject: platform/chrome: cros_ec_ishtp: Fix a double-unlock issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit aaa3cbbac326c95308e315f1ab964a3369c4d07d ]
+
+In function cros_ec_ishtp_probe(), "up_write" is already called
+before function "cros_ec_dev_init". But "up_write" will be called
+again after the calling of the function "cros_ec_dev_init" failed.
+Thus add a call of the function “down_write” in this if branch
+for the completion of the exception handling.
+
+Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Tested-by: Mathew King <mathewk@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_ishtp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
+index ed794a7ddba9b..81364029af367 100644
+--- a/drivers/platform/chrome/cros_ec_ishtp.c
++++ b/drivers/platform/chrome/cros_ec_ishtp.c
+@@ -681,8 +681,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device)
+
+ /* Register croc_ec_dev mfd */
+ rv = cros_ec_dev_init(client_data);
+- if (rv)
++ if (rv) {
++ down_write(&init_lock);
+ goto end_cros_ec_dev_init_error;
++ }
+
+ return 0;
+
+--
+2.25.1
+
--- /dev/null
+From 0d8f627dd4d2e3fcdb313671d737b85cfc6df2db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 21:46:06 -0700
+Subject: pwm: bcm-iproc: handle clk_get_rate() return
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 6ced5ff0be8e94871ba846dfbddf69d21363f3d7 ]
+
+Handle clk_get_rate() returning 0 to avoid possible division by zero.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Signed-off-by: Scott Branden <scott.branden@broadcom.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index 1f829edd8ee70..d392a828fc493 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 tmp, multi, rate;
+ u32 value, prescale;
+
+- rate = clk_get_rate(ip->clk);
+-
+ value = readl(ip->base + IPROC_PWM_CTRL_OFFSET);
+
+ if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm)))
+@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+ else
+ state->polarity = PWM_POLARITY_INVERSED;
+
++ rate = clk_get_rate(ip->clk);
++ if (rate == 0) {
++ state->period = 0;
++ state->duty_cycle = 0;
++ return;
++ }
++
+ value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET);
+ prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm);
+ prescale &= IPROC_PWM_PRESCALE_MAX;
+--
+2.25.1
+
--- /dev/null
+From 33f40c0c2ed289fbb463cfd8f06e0a3e71a4921f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 11:29:33 +0300
+Subject: RDMA/counter: Allow manually bind QPs with different pids to same
+ counter
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit cbeb7d896c0f296451ffa7b67e7706786b8364c8 ]
+
+In manual mode allow bind user QPs with different pids to same counter,
+since this is allowed in auto mode.
+Bind kernel QPs and user QPs to the same counter are not allowed.
+
+Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support")
+Link: https://lore.kernel.org/r/20200702082933.424537-4-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/counters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
+index 6deb1901fbd02..417ebf4d8ba9b 100644
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -483,7 +483,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port,
+ goto err;
+ }
+
+- if (counter->res.task != qp->res.task) {
++ if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res)) {
+ ret = -EINVAL;
+ goto err_task;
+ }
+--
+2.25.1
+
--- /dev/null
+From 6a77bee021ce10bd81174d877ca4e300a8b492ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 11:29:32 +0300
+Subject: RDMA/counter: Only bind user QPs in auto mode
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit c9f557421e505f75da4234a6af8eff46bc08614b ]
+
+In auto mode only bind user QPs to a dynamic counter, since this feature
+is mainly used for system statistic and diagnostic purpose, while there's
+no need to counter kernel QPs so far.
+
+Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support")
+Link: https://lore.kernel.org/r/20200702082933.424537-3-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/counters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c
+index 738d1faf4bba5..6deb1901fbd02 100644
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -288,7 +288,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port)
+ struct rdma_counter *counter;
+ int ret;
+
+- if (!qp->res.valid)
++ if (!qp->res.valid || rdma_is_kernel_res(&qp->res))
+ return 0;
+
+ if (!rdma_is_port_valid(dev, port))
+--
+2.25.1
+
--- /dev/null
+From 76fbd441ddafc287520d8edc7fc10048cdb5ae50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 20:42:19 +0300
+Subject: RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah()
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 65936bf25f90fe440bb2d11624c7d10fab266639 ]
+
+ipoib_mcast_carrier_on_task() insanely open codes a rtnl_lock() such that
+the only time flush_workqueue() can be called is if it also clears
+IPOIB_FLAG_OPER_UP.
+
+Thus the flush inside ipoib_flush_ah() will deadlock if it gets unlucky
+enough, and lockdep doesn't help us to find it early:
+
+ CPU0 CPU1 CPU2
+ __ipoib_ib_dev_flush()
+ down_read(vlan_rwsem)
+
+ ipoib_vlan_add()
+ rtnl_trylock()
+ down_write(vlan_rwsem)
+
+ ipoib_mcast_carrier_on_task()
+ while (!rtnl_trylock())
+ msleep(20);
+
+ ipoib_flush_ah()
+ flush_workqueue(priv->wq)
+
+Clean up the ah_reaper related functions and lifecycle to make sense:
+
+ - Start/Stop of the reaper should only be done in open/stop NDOs, not in
+ any other places
+
+ - cancel and flush of the reaper should only happen in the stop NDO.
+ cancel is only functional when combined with IPOIB_STOP_REAPER.
+
+ - Non-stop places were flushing the AH's just need to flush out dead AH's
+ synchronously and ignore the background task completely. It is fully
+ locked and harmless to leave running.
+
+Which ultimately fixes the ABBA deadlock by removing the unnecessary
+flush_workqueue() from the problematic place under the vlan_rwsem.
+
+Fixes: efc82eeeae4e ("IB/ipoib: No longer use flush as a parameter")
+Link: https://lore.kernel.org/r/20200625174219.290842-1-kamalheib1@gmail.com
+Reported-by: Kamal Heib <kheib@redhat.com>
+Tested-by: Kamal Heib <kheib@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 65 ++++++++++-------------
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +
+ 2 files changed, 31 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 6ee64c25aaff4..494f413dc3c6c 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ return rc;
+ }
+
+-static void __ipoib_reap_ah(struct net_device *dev)
++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+ struct ipoib_ah *ah, *tah;
+ unsigned long flags;
+
+- netif_tx_lock_bh(dev);
++ netif_tx_lock_bh(priv->dev);
+ spin_lock_irqsave(&priv->lock, flags);
+
+ list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
+@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev)
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+- netif_tx_unlock_bh(dev);
++ netif_tx_unlock_bh(priv->dev);
+ }
+
+ void ipoib_reap_ah(struct work_struct *work)
+ {
+ struct ipoib_dev_priv *priv =
+ container_of(work, struct ipoib_dev_priv, ah_reap_task.work);
+- struct net_device *dev = priv->dev;
+
+- __ipoib_reap_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ if (!test_bit(IPOIB_STOP_REAPER, &priv->flags))
+ queue_delayed_work(priv->wq, &priv->ah_reap_task,
+ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_flush_ah(struct net_device *dev)
++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- cancel_delayed_work(&priv->ah_reap_task);
+- flush_workqueue(priv->wq);
+- ipoib_reap_ah(&priv->ah_reap_task.work);
++ clear_bit(IPOIB_STOP_REAPER, &priv->flags);
++ queue_delayed_work(priv->wq, &priv->ah_reap_task,
++ round_jiffies_relative(HZ));
+ }
+
+-static void ipoib_stop_ah(struct net_device *dev)
++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv)
+ {
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+ set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- ipoib_flush_ah(dev);
++ cancel_delayed_work(&priv->ah_reap_task);
++ /*
++ * After ipoib_stop_ah_reaper() we always go through
++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and
++ * does a final flush out of the dead_ah's list
++ */
+ }
+
+ static int recvs_pending(struct net_device *dev)
+@@ -846,16 +845,6 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ return 0;
+ }
+
+-void ipoib_ib_dev_stop(struct net_device *dev)
+-{
+- struct ipoib_dev_priv *priv = ipoib_priv(dev);
+-
+- priv->rn_ops->ndo_stop(dev);
+-
+- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_flush_ah(dev);
+-}
+-
+ int ipoib_ib_dev_open_default(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -899,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return -1;
+ }
+
+- clear_bit(IPOIB_STOP_REAPER, &priv->flags);
+- queue_delayed_work(priv->wq, &priv->ah_reap_task,
+- round_jiffies_relative(HZ));
+-
++ ipoib_start_ah_reaper(priv);
+ if (priv->rn_ops->ndo_open(dev)) {
+ pr_warn("%s: Failed to open dev\n", dev->name);
+ goto dev_stop;
+@@ -913,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev)
+ return 0;
+
+ dev_stop:
+- set_bit(IPOIB_STOP_REAPER, &priv->flags);
+- cancel_delayed_work(&priv->ah_reap_task);
+- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+- ipoib_ib_dev_stop(dev);
++ ipoib_stop_ah_reaper(priv);
+ return -1;
+ }
+
++void ipoib_ib_dev_stop(struct net_device *dev)
++{
++ struct ipoib_dev_priv *priv = ipoib_priv(dev);
++
++ priv->rn_ops->ndo_stop(dev);
++
++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
++ ipoib_stop_ah_reaper(priv);
++}
++
+ void ipoib_pkey_dev_check_presence(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+@@ -1230,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
+ ipoib_mcast_dev_flush(dev);
+ if (oper_up)
+ set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+- ipoib_flush_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+ }
+
+ if (level >= IPOIB_FLUSH_NORMAL)
+@@ -1305,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
+ * the neighbor garbage collection is stopped and reaped.
+ * That should all be done now, so make a final ah flush.
+ */
+- ipoib_stop_ah(dev);
++ ipoib_reap_dead_ahs(priv);
+
+ clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 3cfb682b91b0a..ef60e8e4ae67b 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1976,6 +1976,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
+
+ /* no more works over the priv->wq */
+ if (priv->wq) {
++ /* See ipoib_mcast_carrier_on_task() */
++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags));
+ flush_workqueue(priv->wq);
+ destroy_workqueue(priv->wq);
+ priv->wq = NULL;
+--
+2.25.1
+
--- /dev/null
+From a9d217921ece43887bcc79f0766638a156d5d186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jun 2020 13:52:36 +0300
+Subject: RDMA/ipoib: Return void from ipoib_ib_dev_stop()
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 95a5631f6c9f3045f26245e6045244652204dfdb ]
+
+The return value from ipoib_ib_dev_stop() is always 0 - change it to be
+void.
+
+Link: https://lore.kernel.org/r/20200623105236.18683-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib.h | 2 +-
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +---
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 9a3379c49541f..9ce6a36fe48ed 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev);
+
+ int ipoib_ib_dev_open_default(struct net_device *dev);
+ int ipoib_ib_dev_open(struct net_device *dev);
+-int ipoib_ib_dev_stop(struct net_device *dev);
++void ipoib_ib_dev_stop(struct net_device *dev);
+ void ipoib_ib_dev_up(struct net_device *dev);
+ void ipoib_ib_dev_down(struct net_device *dev);
+ int ipoib_ib_dev_stop_default(struct net_device *dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index da3c5315bbb51..6ee64c25aaff4 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -846,7 +846,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ return 0;
+ }
+
+-int ipoib_ib_dev_stop(struct net_device *dev)
++void ipoib_ib_dev_stop(struct net_device *dev)
+ {
+ struct ipoib_dev_priv *priv = ipoib_priv(dev);
+
+@@ -854,8 +854,6 @@ int ipoib_ib_dev_stop(struct net_device *dev)
+
+ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+ ipoib_flush_ah(dev);
+-
+- return 0;
+ }
+
+ int ipoib_ib_dev_open_default(struct net_device *dev)
+--
+2.25.1
+
--- /dev/null
+From 9b6e323bfb2ed34f92204e0515db313a18ea71c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 08:48:22 +0000
+Subject: recordmcount: Fix build failure on non arm64
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 3df14264ad9930733a8166e5bd0eccc1727564bb ]
+
+Commit ea0eada45632 leads to the following build failure on powerpc:
+
+ HOSTCC scripts/recordmcount
+scripts/recordmcount.c: In function 'arm64_is_fake_mcount':
+scripts/recordmcount.c:440: error: 'R_AARCH64_CALL26' undeclared (first use in this function)
+scripts/recordmcount.c:440: error: (Each undeclared identifier is reported only once
+scripts/recordmcount.c:440: error: for each function it appears in.)
+make[2]: *** [scripts/recordmcount] Error 1
+
+Make sure R_AARCH64_CALL26 is always defined.
+
+Fixes: ea0eada45632 ("recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Gregory Herrero <gregory.herrero@oracle.com>
+Cc: Gregory Herrero <gregory.herrero@oracle.com>
+Link: https://lore.kernel.org/r/5ca1be21fa6ebf73203b45fd9aadd2bafb5e6b15.1597049145.git.christophe.leroy@csgroup.eu
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/recordmcount.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index e59022b3f1254..b9c2ee7ab43fa 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -42,6 +42,8 @@
+ #define R_ARM_THM_CALL 10
+ #define R_ARM_CALL 28
+
++#define R_AARCH64_CALL26 283
++
+ static int fd_map; /* File descriptor for file being modified. */
+ static int mmap_failed; /* Boolean flag. */
+ static char gpfx; /* prefix for global symbol name (sometimes '_') */
+--
+2.25.1
+
--- /dev/null
+From 8efe783211695007a182e83786af78baa50d9b6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jun 2020 13:41:23 +0200
+Subject: rtc: cpcap: fix range
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 3180cfabf6fbf982ca6d1a6eb56334647cc1416b ]
+
+Unbreak CPCAP driver, which has one more bit in the day counter
+increasing the max. range from 2014 to 2058. The original commit
+introducing the range limit was obviously wrong, since the driver
+has only been written in 2017 (3 years after 14 bits would have
+run out).
+
+Fixes: d2377f8cc5a7 ("rtc: cpcap: set range")
+Reported-by: Sicelo A. Mhlongo <absicsz@gmail.com>
+Reported-by: Dev Null <devnull@uvos.xyz>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Tested-by: Merlijn Wajer <merlijn@wizzup.org>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Merlijn Wajer <merlijn@wizzup.org>
+Link: https://lore.kernel.org/r/20200629114123.27956-1-sebastian.reichel@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-cpcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-cpcap.c b/drivers/rtc/rtc-cpcap.c
+index a603f1f211250..800667d73a6fb 100644
+--- a/drivers/rtc/rtc-cpcap.c
++++ b/drivers/rtc/rtc-cpcap.c
+@@ -261,7 +261,7 @@ static int cpcap_rtc_probe(struct platform_device *pdev)
+ return PTR_ERR(rtc->rtc_dev);
+
+ rtc->rtc_dev->ops = &cpcap_rtc_ops;
+- rtc->rtc_dev->range_max = (1 << 14) * SECS_PER_DAY - 1;
++ rtc->rtc_dev->range_max = (timeu64_t) (DAY_MASK + 1) * SECS_PER_DAY - 1;
+
+ err = cpcap_get_vendor(dev, rtc->regmap, &rtc->vendor);
+ if (err)
+--
+2.25.1
+
--- /dev/null
+From 6d62ef9e3a1c3d88a2433624a40506c9a4ccf71a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 13:45:56 +0100
+Subject: rtc: pl031: fix set_alarm by adding back call to alarm_irq_enable
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 4df2ef85f0efe44505f511ca5e4455585f53a2da ]
+
+Commit c8ff5841a90b ("rtc: pl031: switch to rtc_time64_to_tm/rtc_tm_to_time64")
+seemed to have accidentally removed the call to pl031_alarm_irq_enable
+from pl031_set_alarm while switching to 64-bit apis.
+
+Let us add back the same to get the set alarm functionality back.
+
+Fixes: c8ff5841a90b ("rtc: pl031: switch to rtc_time64_to_tm/rtc_tm_to_time64")
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Tested-by: Valentin Schneider <valentin.schneider@arm.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20200714124556.20294-1-sudeep.holla@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pl031.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
+index 40d7450a1ce49..c6b89273feba8 100644
+--- a/drivers/rtc/rtc-pl031.c
++++ b/drivers/rtc/rtc-pl031.c
+@@ -275,6 +275,7 @@ static int pl031_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ struct pl031_local *ldata = dev_get_drvdata(dev);
+
+ writel(rtc_tm_to_time64(&alarm->time), ldata->base + RTC_MR);
++ pl031_alarm_irq_enable(dev, alarm->enabled);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From d02aa0d28866faf5e4dbdff429f707d046bab896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jun 2020 15:47:03 +0800
+Subject: rtw88: pci: disable aspm for platform inter-op with module parameter
+
+From: Yan-Hsuan Chuang <yhchuang@realtek.com>
+
+[ Upstream commit 68aa716b7dd36f55e080da9e27bc594346334c41 ]
+
+Some platforms cannot read the DBI register successfully for the
+ASPM settings. After the read failed, the bus could be unstable,
+and the device just became unavailable [1]. For those platforms,
+the ASPM should be disabled. But as the ASPM can help the driver
+to save the power consumption in power save mode, the ASPM is still
+needed. So, add a module parameter for them to disable it, then
+the device can still work, while others can benefit from the less
+power consumption that brings by ASPM enabled.
+
+[1] https://bugzilla.kernel.org/show_bug.cgi?id=206411
+[2] Note that my lenovo T430 is the same.
+
+Fixes: 3dff7c6e3749 ("rtw88: allows to enable/disable HCI link PS mechanism")
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200605074703.32726-1-yhchuang@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/pci.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
+index 8228db9a5fc86..3413973bc4750 100644
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -14,8 +14,11 @@
+ #include "debug.h"
+
+ static bool rtw_disable_msi;
++static bool rtw_pci_disable_aspm;
+ module_param_named(disable_msi, rtw_disable_msi, bool, 0644);
++module_param_named(disable_aspm, rtw_pci_disable_aspm, bool, 0644);
+ MODULE_PARM_DESC(disable_msi, "Set Y to disable MSI interrupt support");
++MODULE_PARM_DESC(disable_aspm, "Set Y to disable PCI ASPM support");
+
+ static u32 rtw_pci_tx_queue_idx_addr[] = {
+ [RTW_TX_QUEUE_BK] = RTK_PCI_TXBD_IDX_BKQ,
+@@ -1200,6 +1203,9 @@ static void rtw_pci_clkreq_set(struct rtw_dev *rtwdev, bool enable)
+ u8 value;
+ int ret;
+
++ if (rtw_pci_disable_aspm)
++ return;
++
+ ret = rtw_dbi_read8(rtwdev, RTK_PCIE_LINK_CFG, &value);
+ if (ret) {
+ rtw_err(rtwdev, "failed to read CLKREQ_L1, ret=%d", ret);
+@@ -1219,6 +1225,9 @@ static void rtw_pci_aspm_set(struct rtw_dev *rtwdev, bool enable)
+ u8 value;
+ int ret;
+
++ if (rtw_pci_disable_aspm)
++ return;
++
+ ret = rtw_dbi_read8(rtwdev, RTK_PCIE_LINK_CFG, &value);
+ if (ret) {
+ rtw_err(rtwdev, "failed to read ASPM, ret=%d", ret);
+--
+2.25.1
+
--- /dev/null
+From 4681d1a5212a4f127d70c000adc69ec3983454e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Aug 2020 17:50:53 +0200
+Subject: s390/Kconfig: add missing ZCRYPT dependency to VFIO_AP
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 929a343b858612100cb09443a8aaa20d4a4706d3 ]
+
+The VFIO_AP uses ap_driver_register() (and deregister) functions
+implemented in ap_bus.c (compiled into ap.o). However the ap.o will be
+built only if CONFIG_ZCRYPT is selected.
+
+This was not visible before commit e93a1695d7fb ("iommu: Enable compile
+testing for some of drivers") because the CONFIG_VFIO_AP depends on
+CONFIG_S390_AP_IOMMU which depends on the missing CONFIG_ZCRYPT. After
+adding COMPILE_TEST, it is possible to select a configuration with
+VFIO_AP and S390_AP_IOMMU but without the ZCRYPT.
+
+Add proper dependency to the VFIO_AP to fix build errors:
+
+ERROR: modpost: "ap_driver_register" [drivers/s390/crypto/vfio_ap.ko] undefined!
+ERROR: modpost: "ap_driver_unregister" [drivers/s390/crypto/vfio_ap.ko] undefined!
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: e93a1695d7fb ("iommu: Enable compile testing for some of drivers")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index c7d7ede6300c5..4907a5149a8a3 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -769,6 +769,7 @@ config VFIO_AP
+ def_tristate n
+ prompt "VFIO support for AP devices"
+ depends on S390_AP_IOMMU && VFIO_MDEV_DEVICE && KVM
++ depends on ZCRYPT
+ help
+ This driver grants access to Adjunct Processor (AP) devices
+ via the VFIO mediated device interface.
+--
+2.25.1
+
--- /dev/null
+From d854eafb2f6a6a4082031cc73afb782995b536b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jul 2020 14:36:02 +0800
+Subject: s390/test_unwind: fix possible memleak in test_unwind()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 75d3e7f4769d276a056efa1cc7f08de571fc9b4b ]
+
+test_unwind() misses to call kfree(bt) in an error path.
+Add the missed function call to fix it.
+
+Fixes: 0610154650f1 ("s390/test_unwind: print verbose unwinding results")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/lib/test_unwind.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/lib/test_unwind.c b/arch/s390/lib/test_unwind.c
+index 32b7a30b2485d..b0b12b46bc572 100644
+--- a/arch/s390/lib/test_unwind.c
++++ b/arch/s390/lib/test_unwind.c
+@@ -63,6 +63,7 @@ static noinline int test_unwind(struct task_struct *task, struct pt_regs *regs,
+ break;
+ if (state.reliable && !addr) {
+ pr_err("unwind state reliable but addr is 0\n");
++ kfree(bt);
+ return -EINVAL;
+ }
+ sprint_symbol(sym, addr);
+--
+2.25.1
+
--- /dev/null
+From 43f6b0499f3a0efd0c42ae8a2aaa9e84750827d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 12:03:47 +0100
+Subject: sched/uclamp: Fix a deadlock when enabling uclamp static key
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit e65855a52b479f98674998cb23b21ef5a8144b04 ]
+
+The following splat was caught when setting uclamp value of a task:
+
+ BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:49
+
+ cpus_read_lock+0x68/0x130
+ static_key_enable+0x1c/0x38
+ __sched_setscheduler+0x900/0xad8
+
+Fix by ensuring we enable the key outside of the critical section in
+__sched_setscheduler()
+
+Fixes: 46609ce22703 ("sched/uclamp: Protect uclamp fast path code with static key")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20200716110347.19553-4-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index db1e99756c400..f788cd61df212 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1248,6 +1248,15 @@ static int uclamp_validate(struct task_struct *p,
+ if (upper_bound > SCHED_CAPACITY_SCALE)
+ return -EINVAL;
+
++ /*
++ * We have valid uclamp attributes; make sure uclamp is enabled.
++ *
++ * We need to do that here, because enabling static branches is a
++ * blocking operation which obviously cannot be done while holding
++ * scheduler locks.
++ */
++ static_branch_enable(&sched_uclamp_used);
++
+ return 0;
+ }
+
+@@ -1278,8 +1287,6 @@ static void __setscheduler_uclamp(struct task_struct *p,
+ if (likely(!(attr->sched_flags & SCHED_FLAG_UTIL_CLAMP)))
+ return;
+
+- static_branch_enable(&sched_uclamp_used);
+-
+ if (attr->sched_flags & SCHED_FLAG_UTIL_CLAMP_MIN) {
+ uclamp_se_set(&p->uclamp_req[UCLAMP_MIN],
+ attr->sched_util_min, true);
+--
+2.25.1
+
--- /dev/null
+From 64d6d55ea8643eefece37ee0d34d7b99afb45c3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 12:21:23 +0100
+Subject: sched/uclamp: Protect uclamp fast path code with static key
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit 46609ce227039fd192e0ecc7d940bed587fd2c78 ]
+
+There is a report that when uclamp is enabled, a netperf UDP test
+regresses compared to a kernel compiled without uclamp.
+
+https://lore.kernel.org/lkml/20200529100806.GA3070@suse.de/
+
+While investigating the root cause, there were no sign that the uclamp
+code is doing anything particularly expensive but could suffer from bad
+cache behavior under certain circumstances that are yet to be
+understood.
+
+https://lore.kernel.org/lkml/20200616110824.dgkkbyapn3io6wik@e107158-lin/
+
+To reduce the pressure on the fast path anyway, add a static key that is
+by default will skip executing uclamp logic in the
+enqueue/dequeue_task() fast path until it's needed.
+
+As soon as the user start using util clamp by:
+
+ 1. Changing uclamp value of a task with sched_setattr()
+ 2. Modifying the default sysctl_sched_util_clamp_{min, max}
+ 3. Modifying the default cpu.uclamp.{min, max} value in cgroup
+
+We flip the static key now that the user has opted to use util clamp.
+Effectively re-introducing uclamp logic in the enqueue/dequeue_task()
+fast path. It stays on from that point forward until the next reboot.
+
+This should help minimize the effect of util clamp on workloads that
+don't need it but still allow distros to ship their kernels with uclamp
+compiled in by default.
+
+SCHED_WARN_ON() in uclamp_rq_dec_id() was removed since now we can end
+up with unbalanced call to uclamp_rq_dec_id() if we flip the key while
+a task is running in the rq. Since we know it is harmless we just
+quietly return if we attempt a uclamp_rq_dec_id() when
+rq->uclamp[].bucket[].tasks is 0.
+
+In schedutil, we introduce a new uclamp_is_enabled() helper which takes
+the static key into account to ensure RT boosting behavior is retained.
+
+The following results demonstrates how this helps on 2 Sockets Xeon E5
+2x10-Cores system.
+
+ nouclamp uclamp uclamp-static-key
+Hmean send-64 162.43 ( 0.00%) 157.84 * -2.82%* 163.39 * 0.59%*
+Hmean send-128 324.71 ( 0.00%) 314.78 * -3.06%* 326.18 * 0.45%*
+Hmean send-256 641.55 ( 0.00%) 628.67 * -2.01%* 648.12 * 1.02%*
+Hmean send-1024 2525.28 ( 0.00%) 2448.26 * -3.05%* 2543.73 * 0.73%*
+Hmean send-2048 4836.14 ( 0.00%) 4712.08 * -2.57%* 4867.69 * 0.65%*
+Hmean send-3312 7540.83 ( 0.00%) 7425.45 * -1.53%* 7621.06 * 1.06%*
+Hmean send-4096 9124.53 ( 0.00%) 8948.82 * -1.93%* 9276.25 * 1.66%*
+Hmean send-8192 15589.67 ( 0.00%) 15486.35 * -0.66%* 15819.98 * 1.48%*
+Hmean send-16384 26386.47 ( 0.00%) 25752.25 * -2.40%* 26773.74 * 1.47%*
+
+The perf diff between nouclamp and uclamp-static-key when uclamp is
+disabled in the fast path:
+
+ 8.73% -1.55% [kernel.kallsyms] [k] try_to_wake_up
+ 0.07% +0.04% [kernel.kallsyms] [k] deactivate_task
+ 0.13% -0.02% [kernel.kallsyms] [k] activate_task
+
+The diff between nouclamp and uclamp-static-key when uclamp is enabled
+in the fast path:
+
+ 8.73% -0.72% [kernel.kallsyms] [k] try_to_wake_up
+ 0.13% +0.39% [kernel.kallsyms] [k] activate_task
+ 0.07% +0.38% [kernel.kallsyms] [k] deactivate_task
+
+Fixes: 69842cba9ace ("sched/uclamp: Add CPU's clamp buckets refcounting")
+Reported-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: Lukasz Luba <lukasz.luba@arm.com>
+Link: https://lkml.kernel.org/r/20200630112123.12076-3-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 74 +++++++++++++++++++++++++++++++-
+ kernel/sched/cpufreq_schedutil.c | 2 +-
+ kernel/sched/sched.h | 47 +++++++++++++++++++-
+ 3 files changed, 119 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index c3cbdc436e2e4..db1e99756c400 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -794,6 +794,26 @@ unsigned int sysctl_sched_uclamp_util_max = SCHED_CAPACITY_SCALE;
+ /* All clamps are required to be less or equal than these values */
+ static struct uclamp_se uclamp_default[UCLAMP_CNT];
+
++/*
++ * This static key is used to reduce the uclamp overhead in the fast path. It
++ * primarily disables the call to uclamp_rq_{inc, dec}() in
++ * enqueue/dequeue_task().
++ *
++ * This allows users to continue to enable uclamp in their kernel config with
++ * minimum uclamp overhead in the fast path.
++ *
++ * As soon as userspace modifies any of the uclamp knobs, the static key is
++ * enabled, since we have an actual users that make use of uclamp
++ * functionality.
++ *
++ * The knobs that would enable this static key are:
++ *
++ * * A task modifying its uclamp value with sched_setattr().
++ * * An admin modifying the sysctl_sched_uclamp_{min, max} via procfs.
++ * * An admin modifying the cgroup cpu.uclamp.{min, max}
++ */
++DEFINE_STATIC_KEY_FALSE(sched_uclamp_used);
++
+ /* Integer rounded range for each bucket */
+ #define UCLAMP_BUCKET_DELTA DIV_ROUND_CLOSEST(SCHED_CAPACITY_SCALE, UCLAMP_BUCKETS)
+
+@@ -990,10 +1010,38 @@ static inline void uclamp_rq_dec_id(struct rq *rq, struct task_struct *p,
+
+ lockdep_assert_held(&rq->lock);
+
++ /*
++ * If sched_uclamp_used was enabled after task @p was enqueued,
++ * we could end up with unbalanced call to uclamp_rq_dec_id().
++ *
++ * In this case the uc_se->active flag should be false since no uclamp
++ * accounting was performed at enqueue time and we can just return
++ * here.
++ *
++ * Need to be careful of the following enqeueue/dequeue ordering
++ * problem too
++ *
++ * enqueue(taskA)
++ * // sched_uclamp_used gets enabled
++ * enqueue(taskB)
++ * dequeue(taskA)
++ * // Must not decrement bukcet->tasks here
++ * dequeue(taskB)
++ *
++ * where we could end up with stale data in uc_se and
++ * bucket[uc_se->bucket_id].
++ *
++ * The following check here eliminates the possibility of such race.
++ */
++ if (unlikely(!uc_se->active))
++ return;
++
+ bucket = &uc_rq->bucket[uc_se->bucket_id];
++
+ SCHED_WARN_ON(!bucket->tasks);
+ if (likely(bucket->tasks))
+ bucket->tasks--;
++
+ uc_se->active = false;
+
+ /*
+@@ -1021,6 +1069,15 @@ static inline void uclamp_rq_inc(struct rq *rq, struct task_struct *p)
+ {
+ enum uclamp_id clamp_id;
+
++ /*
++ * Avoid any overhead until uclamp is actually used by the userspace.
++ *
++ * The condition is constructed such that a NOP is generated when
++ * sched_uclamp_used is disabled.
++ */
++ if (!static_branch_unlikely(&sched_uclamp_used))
++ return;
++
+ if (unlikely(!p->sched_class->uclamp_enabled))
+ return;
+
+@@ -1036,6 +1093,15 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p)
+ {
+ enum uclamp_id clamp_id;
+
++ /*
++ * Avoid any overhead until uclamp is actually used by the userspace.
++ *
++ * The condition is constructed such that a NOP is generated when
++ * sched_uclamp_used is disabled.
++ */
++ if (!static_branch_unlikely(&sched_uclamp_used))
++ return;
++
+ if (unlikely(!p->sched_class->uclamp_enabled))
+ return;
+
+@@ -1144,8 +1210,10 @@ int sysctl_sched_uclamp_handler(struct ctl_table *table, int write,
+ update_root_tg = true;
+ }
+
+- if (update_root_tg)
++ if (update_root_tg) {
++ static_branch_enable(&sched_uclamp_used);
+ uclamp_update_root_tg();
++ }
+
+ /*
+ * We update all RUNNABLE tasks only when task groups are in use.
+@@ -1210,6 +1278,8 @@ static void __setscheduler_uclamp(struct task_struct *p,
+ if (likely(!(attr->sched_flags & SCHED_FLAG_UTIL_CLAMP)))
+ return;
+
++ static_branch_enable(&sched_uclamp_used);
++
+ if (attr->sched_flags & SCHED_FLAG_UTIL_CLAMP_MIN) {
+ uclamp_se_set(&p->uclamp_req[UCLAMP_MIN],
+ attr->sched_util_min, true);
+@@ -7442,6 +7512,8 @@ static ssize_t cpu_uclamp_write(struct kernfs_open_file *of, char *buf,
+ if (req.ret)
+ return req.ret;
+
++ static_branch_enable(&sched_uclamp_used);
++
+ mutex_lock(&uclamp_mutex);
+ rcu_read_lock();
+
+diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
+index 7fbaee24c824f..dc6835bc64907 100644
+--- a/kernel/sched/cpufreq_schedutil.c
++++ b/kernel/sched/cpufreq_schedutil.c
+@@ -210,7 +210,7 @@ unsigned long schedutil_cpu_util(int cpu, unsigned long util_cfs,
+ unsigned long dl_util, util, irq;
+ struct rq *rq = cpu_rq(cpu);
+
+- if (!IS_BUILTIN(CONFIG_UCLAMP_TASK) &&
++ if (!uclamp_is_used() &&
+ type == FREQUENCY_UTIL && rt_rq_is_runnable(&rq->rt)) {
+ return max;
+ }
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 877fb08eb1b04..c82857e2e288a 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -862,6 +862,8 @@ struct uclamp_rq {
+ unsigned int value;
+ struct uclamp_bucket bucket[UCLAMP_BUCKETS];
+ };
++
++DECLARE_STATIC_KEY_FALSE(sched_uclamp_used);
+ #endif /* CONFIG_UCLAMP_TASK */
+
+ /*
+@@ -2349,12 +2351,35 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {}
+ #ifdef CONFIG_UCLAMP_TASK
+ unsigned long uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id);
+
++/**
++ * uclamp_rq_util_with - clamp @util with @rq and @p effective uclamp values.
++ * @rq: The rq to clamp against. Must not be NULL.
++ * @util: The util value to clamp.
++ * @p: The task to clamp against. Can be NULL if you want to clamp
++ * against @rq only.
++ *
++ * Clamps the passed @util to the max(@rq, @p) effective uclamp values.
++ *
++ * If sched_uclamp_used static key is disabled, then just return the util
++ * without any clamping since uclamp aggregation at the rq level in the fast
++ * path is disabled, rendering this operation a NOP.
++ *
++ * Use uclamp_eff_value() if you don't care about uclamp values at rq level. It
++ * will return the correct effective uclamp value of the task even if the
++ * static key is disabled.
++ */
+ static __always_inline
+ unsigned long uclamp_rq_util_with(struct rq *rq, unsigned long util,
+ struct task_struct *p)
+ {
+- unsigned long min_util = READ_ONCE(rq->uclamp[UCLAMP_MIN].value);
+- unsigned long max_util = READ_ONCE(rq->uclamp[UCLAMP_MAX].value);
++ unsigned long min_util;
++ unsigned long max_util;
++
++ if (!static_branch_likely(&sched_uclamp_used))
++ return util;
++
++ min_util = READ_ONCE(rq->uclamp[UCLAMP_MIN].value);
++ max_util = READ_ONCE(rq->uclamp[UCLAMP_MAX].value);
+
+ if (p) {
+ min_util = max(min_util, uclamp_eff_value(p, UCLAMP_MIN));
+@@ -2371,6 +2396,19 @@ unsigned long uclamp_rq_util_with(struct rq *rq, unsigned long util,
+
+ return clamp(util, min_util, max_util);
+ }
++
++/*
++ * When uclamp is compiled in, the aggregation at rq level is 'turned off'
++ * by default in the fast path and only gets turned on once userspace performs
++ * an operation that requires it.
++ *
++ * Returns true if userspace opted-in to use uclamp and aggregation at rq level
++ * hence is active.
++ */
++static inline bool uclamp_is_used(void)
++{
++ return static_branch_likely(&sched_uclamp_used);
++}
+ #else /* CONFIG_UCLAMP_TASK */
+ static inline
+ unsigned long uclamp_rq_util_with(struct rq *rq, unsigned long util,
+@@ -2378,6 +2416,11 @@ unsigned long uclamp_rq_util_with(struct rq *rq, unsigned long util,
+ {
+ return util;
+ }
++
++static inline bool uclamp_is_used(void)
++{
++ return false;
++}
+ #endif /* CONFIG_UCLAMP_TASK */
+
+ #ifdef arch_scale_freq_capacity
+--
+2.25.1
+
--- /dev/null
+From e1c26e675ccec2398e3c59dd0d4baf69c5ff324a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jul 2020 19:10:11 -0400
+Subject: scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying
+ targetport
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+[ Upstream commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e ]
+
+We cannot wait on a completion object in the lpfc_nvme_targetport structure
+in the _destroy_targetport() code path because the NVMe/fc transport will
+free that structure immediately after the .targetport_delete() callback.
+This results in a use-after-free, and a crash if slub_debug=FZPU is
+enabled.
+
+An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8
+("scsi: lpfc: Correct localport timeout duration error") subsequently
+changed the code to reference the completion through a pointer in the
+object rather than the local stack variable. Fix this by using the stack
+variable directly.
+
+Link: https://lore.kernel.org/r/20200729231011.13240-1-emilne@redhat.com
+Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error")
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvmet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
+index 88760416a8cbd..fcd9d4c2f1ee0 100644
+--- a/drivers/scsi/lpfc/lpfc_nvmet.c
++++ b/drivers/scsi/lpfc/lpfc_nvmet.c
+@@ -2112,7 +2112,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
+ }
+ tgtp->tport_unreg_cmp = &tport_unreg_cmp;
+ nvmet_fc_unregister_targetport(phba->targetport);
+- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
++ if (!wait_for_completion_timeout(&tport_unreg_cmp,
+ msecs_to_jiffies(LPFC_NVMET_WAIT_TMO)))
+ lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+ "6179 Unreg targetport x%px timeout "
+--
+2.25.1
+
--- /dev/null
+From 8afc20a265d9bff6c79932758ec01c197c8e1a6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Aug 2020 20:30:57 -0700
+Subject: selftests/bpf: Fix silent Makefile output
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit d5ca590525cfbd87ca307dcf498a566e2e7c1767 ]
+
+99aacebecb75 ("selftests: do not use .ONESHELL") removed .ONESHELL, which
+changes how Makefile "silences" multi-command target recipes. selftests/bpf's
+Makefile relied (a somewhat unknowingly) on .ONESHELL behavior of silencing
+all commands within the recipe if the first command contains @ symbol.
+Removing .ONESHELL exposed this hack.
+
+This patch fixes the issue by explicitly silencing each command with $(Q).
+
+Also explicitly define fallback rule for building *.o from *.c, instead of
+relying on non-silent inherited rule. This was causing a non-silent output for
+bench.o object file.
+
+Fixes: 92f7440ecc93 ("selftests/bpf: More succinct Makefile output")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20200807033058.848677-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 44 +++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 20 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index dab182ffec320..4f322d5388757 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -102,7 +102,7 @@ endif
+ OVERRIDE_TARGETS := 1
+ override define CLEAN
+ $(call msg,CLEAN)
+- $(RM) -r $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(EXTRA_CLEAN)
++ $(Q)$(RM) -r $(TEST_GEN_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(EXTRA_CLEAN)
+ endef
+
+ include ../lib.mk
+@@ -122,17 +122,21 @@ $(notdir $(TEST_GEN_PROGS) \
+ $(TEST_GEN_PROGS_EXTENDED) \
+ $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ;
+
++$(OUTPUT)/%.o: %.c
++ $(call msg,CC,,$@)
++ $(Q)$(CC) $(CFLAGS) -c $(filter %.c,$^) $(LDLIBS) -o $@
++
+ $(OUTPUT)/%:%.c
+ $(call msg,BINARY,,$@)
+- $(LINK.c) $^ $(LDLIBS) -o $@
++ $(Q)$(LINK.c) $^ $(LDLIBS) -o $@
+
+ $(OUTPUT)/urandom_read: urandom_read.c
+ $(call msg,BINARY,,$@)
+- $(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id
++ $(Q)$(CC) $(LDFLAGS) -o $@ $< $(LDLIBS) -Wl,--build-id
+
+ $(OUTPUT)/test_stub.o: test_stub.c $(BPFOBJ)
+ $(call msg,CC,,$@)
+- $(CC) -c $(CFLAGS) -o $@ $<
++ $(Q)$(CC) -c $(CFLAGS) -o $@ $<
+
+ VMLINUX_BTF_PATHS := $(if $(O),$(O)/vmlinux) \
+ $(if $(KBUILD_OUTPUT),$(KBUILD_OUTPUT)/vmlinux) \
+@@ -180,11 +184,11 @@ $(BPFOBJ): $(wildcard $(BPFDIR)/*.[ch] $(BPFDIR)/Makefile) \
+
+ $(BUILD_DIR)/libbpf $(BUILD_DIR)/bpftool $(INCLUDE_DIR):
+ $(call msg,MKDIR,,$@)
+- mkdir -p $@
++ $(Q)mkdir -p $@
+
+ $(INCLUDE_DIR)/vmlinux.h: $(VMLINUX_BTF) | $(BPFTOOL) $(INCLUDE_DIR)
+ $(call msg,GEN,,$@)
+- $(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@
++ $(Q)$(BPFTOOL) btf dump file $(VMLINUX_BTF) format c > $@
+
+ # Get Clang's default includes on this system, as opposed to those seen by
+ # '-target bpf'. This fixes "missing" files on some architectures/distros,
+@@ -222,28 +226,28 @@ $(OUTPUT)/flow_dissector_load.o: flow_dissector_load.h
+ # $4 - LDFLAGS
+ define CLANG_BPF_BUILD_RULE
+ $(call msg,CLNG-LLC,$(TRUNNER_BINARY),$2)
+- ($(CLANG) $3 -O2 -target bpf -emit-llvm \
++ $(Q)($(CLANG) $3 -O2 -target bpf -emit-llvm \
+ -c $1 -o - || echo "BPF obj compilation failed") | \
+ $(LLC) -mattr=dwarfris -march=bpf -mcpu=v3 $4 -filetype=obj -o $2
+ endef
+ # Similar to CLANG_BPF_BUILD_RULE, but with disabled alu32
+ define CLANG_NOALU32_BPF_BUILD_RULE
+ $(call msg,CLNG-LLC,$(TRUNNER_BINARY),$2)
+- ($(CLANG) $3 -O2 -target bpf -emit-llvm \
++ $(Q)($(CLANG) $3 -O2 -target bpf -emit-llvm \
+ -c $1 -o - || echo "BPF obj compilation failed") | \
+ $(LLC) -march=bpf -mcpu=v2 $4 -filetype=obj -o $2
+ endef
+ # Similar to CLANG_BPF_BUILD_RULE, but using native Clang and bpf LLC
+ define CLANG_NATIVE_BPF_BUILD_RULE
+ $(call msg,CLNG-BPF,$(TRUNNER_BINARY),$2)
+- ($(CLANG) $3 -O2 -emit-llvm \
++ $(Q)($(CLANG) $3 -O2 -emit-llvm \
+ -c $1 -o - || echo "BPF obj compilation failed") | \
+ $(LLC) -march=bpf -mcpu=v3 $4 -filetype=obj -o $2
+ endef
+ # Build BPF object using GCC
+ define GCC_BPF_BUILD_RULE
+ $(call msg,GCC-BPF,$(TRUNNER_BINARY),$2)
+- $(BPF_GCC) $3 $4 -O2 -c $1 -o $2
++ $(Q)$(BPF_GCC) $3 $4 -O2 -c $1 -o $2
+ endef
+
+ SKEL_BLACKLIST := btf__% test_pinning_invalid.c test_sk_assign.c
+@@ -285,7 +289,7 @@ ifeq ($($(TRUNNER_OUTPUT)-dir),)
+ $(TRUNNER_OUTPUT)-dir := y
+ $(TRUNNER_OUTPUT):
+ $$(call msg,MKDIR,,$$@)
+- mkdir -p $$@
++ $(Q)mkdir -p $$@
+ endif
+
+ # ensure we set up BPF objects generation rule just once for a given
+@@ -305,7 +309,7 @@ $(TRUNNER_BPF_SKELS): $(TRUNNER_OUTPUT)/%.skel.h: \
+ $(TRUNNER_OUTPUT)/%.o \
+ | $(BPFTOOL) $(TRUNNER_OUTPUT)
+ $$(call msg,GEN-SKEL,$(TRUNNER_BINARY),$$@)
+- $$(BPFTOOL) gen skeleton $$< > $$@
++ $(Q)$$(BPFTOOL) gen skeleton $$< > $$@
+ endif
+
+ # ensure we set up tests.h header generation rule just once
+@@ -329,7 +333,7 @@ $(TRUNNER_TEST_OBJS): $(TRUNNER_OUTPUT)/%.test.o: \
+ $(TRUNNER_BPF_SKELS) \
+ $$(BPFOBJ) | $(TRUNNER_OUTPUT)
+ $$(call msg,TEST-OBJ,$(TRUNNER_BINARY),$$@)
+- cd $$(@D) && $$(CC) -I. $$(CFLAGS) -c $(CURDIR)/$$< $$(LDLIBS) -o $$(@F)
++ $(Q)cd $$(@D) && $$(CC) -I. $$(CFLAGS) -c $(CURDIR)/$$< $$(LDLIBS) -o $$(@F)
+
+ $(TRUNNER_EXTRA_OBJS): $(TRUNNER_OUTPUT)/%.o: \
+ %.c \
+@@ -337,20 +341,20 @@ $(TRUNNER_EXTRA_OBJS): $(TRUNNER_OUTPUT)/%.o: \
+ $(TRUNNER_TESTS_HDR) \
+ $$(BPFOBJ) | $(TRUNNER_OUTPUT)
+ $$(call msg,EXT-OBJ,$(TRUNNER_BINARY),$$@)
+- $$(CC) $$(CFLAGS) -c $$< $$(LDLIBS) -o $$@
++ $(Q)$$(CC) $$(CFLAGS) -c $$< $$(LDLIBS) -o $$@
+
+ # only copy extra resources if in flavored build
+ $(TRUNNER_BINARY)-extras: $(TRUNNER_EXTRA_FILES) | $(TRUNNER_OUTPUT)
+ ifneq ($2,)
+ $$(call msg,EXT-COPY,$(TRUNNER_BINARY),$(TRUNNER_EXTRA_FILES))
+- cp -a $$^ $(TRUNNER_OUTPUT)/
++ $(Q)cp -a $$^ $(TRUNNER_OUTPUT)/
+ endif
+
+ $(OUTPUT)/$(TRUNNER_BINARY): $(TRUNNER_TEST_OBJS) \
+ $(TRUNNER_EXTRA_OBJS) $$(BPFOBJ) \
+ | $(TRUNNER_BINARY)-extras
+ $$(call msg,BINARY,,$$@)
+- $$(CC) $$(CFLAGS) $$(filter %.a %.o,$$^) $$(LDLIBS) -o $$@
++ $(Q)$$(CC) $$(CFLAGS) $$(filter %.a %.o,$$^) $$(LDLIBS) -o $$@
+
+ endef
+
+@@ -403,17 +407,17 @@ verifier/tests.h: verifier/*.c
+ ) > verifier/tests.h)
+ $(OUTPUT)/test_verifier: test_verifier.c verifier/tests.h $(BPFOBJ) | $(OUTPUT)
+ $(call msg,BINARY,,$@)
+- $(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
++ $(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
+
+ # Make sure we are able to include and link libbpf against c++.
+ $(OUTPUT)/test_cpp: test_cpp.cpp $(OUTPUT)/test_core_extern.skel.h $(BPFOBJ)
+ $(call msg,CXX,,$@)
+- $(CXX) $(CFLAGS) $^ $(LDLIBS) -o $@
++ $(Q)$(CXX) $(CFLAGS) $^ $(LDLIBS) -o $@
+
+ # Benchmark runner
+ $(OUTPUT)/bench_%.o: benchs/bench_%.c bench.h
+ $(call msg,CC,,$@)
+- $(CC) $(CFLAGS) -c $(filter %.c,$^) $(LDLIBS) -o $@
++ $(Q)$(CC) $(CFLAGS) -c $(filter %.c,$^) $(LDLIBS) -o $@
+ $(OUTPUT)/bench_rename.o: $(OUTPUT)/test_overhead.skel.h
+ $(OUTPUT)/bench_trigger.o: $(OUTPUT)/trigger_bench.skel.h
+ $(OUTPUT)/bench_ringbufs.o: $(OUTPUT)/ringbuf_bench.skel.h \
+@@ -426,7 +430,7 @@ $(OUTPUT)/bench: $(OUTPUT)/bench.o $(OUTPUT)/testing_helpers.o \
+ $(OUTPUT)/bench_trigger.o \
+ $(OUTPUT)/bench_ringbufs.o
+ $(call msg,BINARY,,$@)
+- $(CC) $(LDFLAGS) -o $@ $(filter %.a %.o,$^) $(LDLIBS)
++ $(Q)$(CC) $(LDFLAGS) -o $@ $(filter %.a %.o,$^) $(LDLIBS)
+
+ EXTRA_CLEAN := $(TEST_CUSTOM_PROGS) $(SCRATCH_DIR) \
+ prog_tests/tests.h map_tests/tests.h verifier/tests.h \
+--
+2.25.1
+
--- /dev/null
+From 25eb10d85d1b794fa7f7c4fb4a289f7cb50e6dd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 17:47:57 -0700
+Subject: selftests/bpf: Prevent runqslower from racing on building bpftool
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 6bcaf41f9613278cd5897fc80ab93033bda8efaa ]
+
+runqslower's Makefile is building/installing bpftool into
+$(OUTPUT)/sbin/bpftool, which coincides with $(DEFAULT_BPFTOOL). In practice
+this means that often when building selftests from scratch (after `make
+clean`), selftests are racing with runqslower to simultaneously build bpftool
+and one of the two processes fail due to file being busy. Prevent this race by
+explicitly order-depending on $(BPFTOOL_DEFAULT).
+
+Fixes: a2c9652f751e ("selftests: Refactor build to remove tools/lib/bpf from include path")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200805004757.2960750-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/Makefile | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
+index 22aaec74ea0ab..dab182ffec320 100644
+--- a/tools/testing/selftests/bpf/Makefile
++++ b/tools/testing/selftests/bpf/Makefile
+@@ -141,7 +141,9 @@ VMLINUX_BTF_PATHS := $(if $(O),$(O)/vmlinux) \
+ /boot/vmlinux-$(shell uname -r)
+ VMLINUX_BTF := $(abspath $(firstword $(wildcard $(VMLINUX_BTF_PATHS))))
+
+-$(OUTPUT)/runqslower: $(BPFOBJ)
++DEFAULT_BPFTOOL := $(SCRATCH_DIR)/sbin/bpftool
++
++$(OUTPUT)/runqslower: $(BPFOBJ) | $(DEFAULT_BPFTOOL)
+ $(Q)$(MAKE) $(submake_extras) -C $(TOOLSDIR)/bpf/runqslower \
+ OUTPUT=$(SCRATCH_DIR)/ VMLINUX_BTF=$(VMLINUX_BTF) \
+ BPFOBJ=$(BPFOBJ) BPF_INCLUDE=$(INCLUDE_DIR) && \
+@@ -163,7 +165,6 @@ $(OUTPUT)/test_netcnt: cgroup_helpers.c
+ $(OUTPUT)/test_sock_fields: cgroup_helpers.c
+ $(OUTPUT)/test_sysctl: cgroup_helpers.c
+
+-DEFAULT_BPFTOOL := $(SCRATCH_DIR)/sbin/bpftool
+ BPFTOOL ?= $(DEFAULT_BPFTOOL)
+ $(DEFAULT_BPFTOOL): $(wildcard $(BPFTOOLDIR)/*.[ch] $(BPFTOOLDIR)/Makefile) \
+ $(BPFOBJ) | $(BUILD_DIR)/bpftool
+--
+2.25.1
+
--- /dev/null
+From 12a5a8e8161e28a8f06f3e67ca77cf18f16d6250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 09:12:25 +0200
+Subject: selftests/bpf: test_progs avoid minus shell exit codes
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit b8c50df0cb3eb9008f8372e4ff0317eee993b8d1 ]
+
+There are a number of places in test_progs that use minus-1 as the argument
+to exit(). This is confusing as a process exit status is masked to be a
+number between 0 and 255 as defined in man exit(3). Thus, users will see
+status 255 instead of minus-1.
+
+This patch use positive exit code 3 instead of minus-1. These cases are put
+in the same group of infrastructure setup errors.
+
+Fixes: fd27b1835e70 ("selftests/bpf: Reset process and thread affinity after each test/sub-test")
+Fixes: 811d7e375d08 ("bpf: selftests: Restore netns after each test")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/159410594499.1093222.11080787853132708654.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 0849735ebda8a..d498b6aa63a42 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -13,6 +13,7 @@
+ #include <execinfo.h> /* backtrace */
+
+ #define EXIT_NO_TEST 2
++#define EXIT_ERR_SETUP_INFRA 3
+
+ /* defined in test_progs.h */
+ struct test_env env = {};
+@@ -113,13 +114,13 @@ static void reset_affinity() {
+ if (err < 0) {
+ stdio_restore();
+ fprintf(stderr, "Failed to reset process affinity: %d!\n", err);
+- exit(-1);
++ exit(EXIT_ERR_SETUP_INFRA);
+ }
+ err = pthread_setaffinity_np(pthread_self(), sizeof(cpuset), &cpuset);
+ if (err < 0) {
+ stdio_restore();
+ fprintf(stderr, "Failed to reset thread affinity: %d!\n", err);
+- exit(-1);
++ exit(EXIT_ERR_SETUP_INFRA);
+ }
+ }
+
+@@ -128,7 +129,7 @@ static void save_netns(void)
+ env.saved_netns_fd = open("/proc/self/ns/net", O_RDONLY);
+ if (env.saved_netns_fd == -1) {
+ perror("open(/proc/self/ns/net)");
+- exit(-1);
++ exit(EXIT_ERR_SETUP_INFRA);
+ }
+ }
+
+@@ -137,7 +138,7 @@ static void restore_netns(void)
+ if (setns(env.saved_netns_fd, CLONE_NEWNET) == -1) {
+ stdio_restore();
+ perror("setns(CLONE_NEWNS)");
+- exit(-1);
++ exit(EXIT_ERR_SETUP_INFRA);
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 33be089e02dad5fb3161a45cc9c784c8c7f8abbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 23:44:07 +0200
+Subject: selftests/bpf: Test_progs indicate to shell on non-actions
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 6c92bd5cd4650c39dd929565ee172984c680fead ]
+
+When a user selects a non-existing test the summary is printed with
+indication 0 for all info types, and shell "success" (EXIT_SUCCESS) is
+indicated. This can be understood by a human end-user, but for shell
+scripting is it useful to indicate a shell failure (EXIT_FAILURE).
+
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/159363984736.930467.17956007131403952343.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 54fa5fa688ce9..da70a4f72f547 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -687,5 +687,8 @@ int main(int argc, char **argv)
+ free_str_set(&env.subtest_selector.whitelist);
+ free(env.subtest_selector.num_set);
+
++ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0)
++ return EXIT_FAILURE;
++
+ return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
+ }
+--
+2.25.1
+
--- /dev/null
+From 99493ea8b340ced105f1ed9a6ef6f097f8c0f8ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 09:12:19 +0200
+Subject: selftests/bpf: test_progs use another shell exit on non-actions
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 3220fb667842a9725cbb71656f406eadb03c094b ]
+
+This is a follow up adjustment to commit 6c92bd5cd465 ("selftests/bpf:
+Test_progs indicate to shell on non-actions"), that returns shell exit
+indication EXIT_FAILURE (value 1) when user selects a non-existing test.
+
+The problem with using EXIT_FAILURE is that a shell script cannot tell
+the difference between a non-existing test and the test failing.
+
+This patch uses value 2 as shell exit indication.
+(Aside note unrecognized option parameters use value 64).
+
+Fixes: 6c92bd5cd465 ("selftests/bpf: Test_progs indicate to shell on non-actions")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/159410593992.1093222.90072558386094370.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 6218b2b5a3f62..0849735ebda8a 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -12,6 +12,8 @@
+ #include <string.h>
+ #include <execinfo.h> /* backtrace */
+
++#define EXIT_NO_TEST 2
++
+ /* defined in test_progs.h */
+ struct test_env env = {};
+
+@@ -707,7 +709,7 @@ int main(int argc, char **argv)
+ close(env.saved_netns_fd);
+
+ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0)
+- return EXIT_FAILURE;
++ return EXIT_NO_TEST;
+
+ return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS;
+ }
+--
+2.25.1
+
--- /dev/null
+From ff6ebe44c420bcfa3ffe46d4f58dfe4681975d69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:45 +0530
+Subject: selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 3563b9bea0ca7f53e4218b5e268550341a49f333 ]
+
+With commit 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation
+must not change pkey registers") we are not updating UAMOR on key
+allocation. So don't update the expected uamor value in the test.
+
+Fixes: 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation must not change pkey registers")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-23-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index bc33d748d95b4..3694613f418f6 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -101,15 +101,20 @@ static int child(struct shared_info *info)
+ */
+ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
+
++ /*
++ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr
++ */
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+ else
+ info->expected_iamr &= ~(1ul << pkeyshift(pkey1));
+
+- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3));
++ /*
++ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits.
++ */
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey2));
++ info->expected_iamr &= ~(1ul << pkeyshift(pkey3));
+
+- info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+- 3ul << pkeyshift(pkey2);
+ /*
+ * Create an IAMR value different from expected value.
+ * Kernel will reject an IAMR and UAMOR change.
+--
+2.25.1
+
--- /dev/null
+From 3d0397ef07761b349678ced45fedd6c0b3a492cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:43 +0530
+Subject: selftests/powerpc: ptrace-pkey: Rename variables to make it easier to
+ follow code
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 9a11f12e0a6c374b3ef1ce81e32ce477d28eb1b8 ]
+
+Rename variable to indicate that they are invalid values which we will
+use to test ptrace update of pkeys.
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-21-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/powerpc/ptrace/ptrace-pkey.c | 26 +++++++++----------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index bdbbbe8431e03..f9216c7a1829e 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -44,7 +44,7 @@ struct shared_info {
+ unsigned long amr2;
+
+ /* AMR value that ptrace should refuse to write to the child. */
+- unsigned long amr3;
++ unsigned long invalid_amr;
+
+ /* IAMR value the parent expects to read from the child. */
+ unsigned long expected_iamr;
+@@ -57,8 +57,8 @@ struct shared_info {
+ * (even though they're valid ones) because userspace doesn't have
+ * access to those registers.
+ */
+- unsigned long new_iamr;
+- unsigned long new_uamor;
++ unsigned long invalid_iamr;
++ unsigned long invalid_uamor;
+ };
+
+ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+@@ -100,7 +100,7 @@ static int child(struct shared_info *info)
+
+ info->amr1 |= 3ul << pkeyshift(pkey1);
+ info->amr2 |= 3ul << pkeyshift(pkey2);
+- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3);
++ info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3);
+
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+@@ -111,8 +111,8 @@ static int child(struct shared_info *info)
+
+ info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+ 3ul << pkeyshift(pkey2);
+- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
+- info->new_uamor |= 3ul << pkeyshift(pkey1);
++ info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
++ info->invalid_uamor |= 3ul << pkeyshift(pkey1);
+
+ /*
+ * We won't use pkey3. We just want a plausible but invalid key to test
+@@ -196,9 +196,9 @@ static int parent(struct shared_info *info, pid_t pid)
+ PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- info->amr1 = info->amr2 = info->amr3 = regs[0];
+- info->expected_iamr = info->new_iamr = regs[1];
+- info->expected_uamor = info->new_uamor = regs[2];
++ info->amr1 = info->amr2 = info->invalid_amr = regs[0];
++ info->expected_iamr = info->invalid_iamr = regs[1];
++ info->expected_uamor = info->invalid_uamor = regs[2];
+
+ /* Wake up child so that it can set itself up. */
+ ret = prod_child(&info->child_sync);
+@@ -234,10 +234,10 @@ static int parent(struct shared_info *info, pid_t pid)
+ return ret;
+
+ /* Write invalid AMR value in child. */
+- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1);
++ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3);
++ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr);
+
+ /* Wake up child so that it can verify it didn't change. */
+ ret = prod_child(&info->child_sync);
+@@ -249,7 +249,7 @@ static int parent(struct shared_info *info, pid_t pid)
+
+ /* Try to write to IAMR. */
+ regs[0] = info->amr1;
+- regs[1] = info->new_iamr;
++ regs[1] = info->invalid_iamr;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
+@@ -257,7 +257,7 @@ static int parent(struct shared_info *info, pid_t pid)
+ ptrace_write_running, regs[0], regs[1]);
+
+ /* Try to write to IAMR and UAMOR. */
+- regs[2] = info->new_uamor;
++ regs[2] = info->invalid_uamor;
+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3);
+ PARENT_FAIL_IF(!ret, &info->child_sync);
+
+--
+2.25.1
+
--- /dev/null
+From ee80c2e69a3233edcf73356dd2e4f6c397b98532 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 08:59:44 +0530
+Subject: selftests/powerpc: ptrace-pkey: Update the test to mark an invalid
+ pkey correctly
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+
+[ Upstream commit 0eaa3b5ca7b5a76e3783639c828498343be66a01 ]
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200709032946.881753-22-aneesh.kumar@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/powerpc/ptrace/ptrace-pkey.c | 30 ++++++++-----------
+ 1 file changed, 12 insertions(+), 18 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+index f9216c7a1829e..bc33d748d95b4 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights)
+ return syscall(__NR_pkey_alloc, flags, init_access_rights);
+ }
+
+-static int sys_pkey_free(int pkey)
+-{
+- return syscall(__NR_pkey_free, pkey);
+-}
+-
+ static int child(struct shared_info *info)
+ {
+ unsigned long reg;
+@@ -100,7 +95,11 @@ static int child(struct shared_info *info)
+
+ info->amr1 |= 3ul << pkeyshift(pkey1);
+ info->amr2 |= 3ul << pkeyshift(pkey2);
+- info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3);
++ /*
++ * invalid amr value where we try to force write
++ * things which are deined by a uamor setting.
++ */
++ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
+
+ if (disable_execute)
+ info->expected_iamr |= 1ul << pkeyshift(pkey1);
+@@ -111,17 +110,12 @@ static int child(struct shared_info *info)
+
+ info->expected_uamor |= 3ul << pkeyshift(pkey1) |
+ 3ul << pkeyshift(pkey2);
+- info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
+- info->invalid_uamor |= 3ul << pkeyshift(pkey1);
+-
+ /*
+- * We won't use pkey3. We just want a plausible but invalid key to test
+- * whether ptrace will let us write to AMR bits we are not supposed to.
+- *
+- * This also tests whether the kernel restores the UAMOR permissions
+- * after a key is freed.
++ * Create an IAMR value different from expected value.
++ * Kernel will reject an IAMR and UAMOR change.
+ */
+- sys_pkey_free(pkey3);
++ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2));
++ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1));
+
+ printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n",
+ user_write, info->amr1, pkey1, pkey2, pkey3);
+@@ -196,9 +190,9 @@ static int parent(struct shared_info *info, pid_t pid)
+ PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
+ PARENT_FAIL_IF(ret, &info->child_sync);
+
+- info->amr1 = info->amr2 = info->invalid_amr = regs[0];
+- info->expected_iamr = info->invalid_iamr = regs[1];
+- info->expected_uamor = info->invalid_uamor = regs[2];
++ info->amr1 = info->amr2 = regs[0];
++ info->expected_iamr = regs[1];
++ info->expected_uamor = regs[2];
+
+ /* Wake up child so that it can set itself up. */
+ ret = prod_child(&info->child_sync);
+--
+2.25.1
+
libnvdimm-validate-command-family-indices.patch
drm-imx-imx-ldb-disable-both-channels-for-split-mode-in-enc-disable.patch
drm-ingenic-fix-incorrect-assumption-about-plane-index.patch
+crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch
+mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch
+octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch
+mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch
+mtd-rawnand-brcmnand-ecc-error-handling-on-edu-trans.patch
+platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch
+drm-amdgpu-debugfs-fix-memory-leak-when-pm_runtime_g.patch
+rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch
+rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch
+rtc-cpcap-fix-range.patch
+media-staging-rkisp1-remove-macro-rkisp1_dir_sink_sr.patch
+media-staging-rkisp1-rename-macros-rkisp1_dir_-to-rk.patch
+media-staging-rkisp1-rsz-set-default-format-if-the-g.patch
+media-rockchip-rga-introduce-color-fmt-macros-and-re.patch
+media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch
+ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch
+sched-uclamp-protect-uclamp-fast-path-code-with-stat.patch
+selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch
+bpf-selftests-restore-netns-after-each-test.patch
+selftests-bpf-test_progs-use-another-shell-exit-on-n.patch
+selftests-bpf-test_progs-avoid-minus-shell-exit-code.patch
+usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch
+usb-serial-ftdi_sio-clean-up-receive-processing.patch
+usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch
+crypto-af_alg-fix-regression-on-empty-requests.patch
+devres-keep-both-device-name-and-resource-name-in-pr.patch
+rdma-counter-only-bind-user-qps-in-auto-mode.patch
+rdma-counter-allow-manually-bind-qps-with-different-.patch
+mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch
+rtw88-pci-disable-aspm-for-platform-inter-op-with-mo.patch
+rtc-pl031-fix-set_alarm-by-adding-back-call-to-alarm.patch
+crypto-caam-remove-broken-arc4-support.patch
+gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch
+gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch
+dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch
+ima-fail-rule-parsing-when-appraise_flag-blacklist-i.patch
+f2fs-compress-fix-to-avoid-memory-leak-on-cc-cpages.patch
+clk-actions-fix-h_clk-for-actions-s500-soc.patch
+selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch
+selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch
+selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch
+iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch
+clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch
+clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch
+iommu-vt-d-handle-non-page-aligned-address.patch
+iommu-vt-d-enforce-pasid-devtlb-field-mask.patch
+iommu-vt-d-warn-on-out-of-range-invalidation-address.patch
+iommu-vt-d-disable-multiple-gpasid-dev-bind.patch
+i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch
+f2fs-compress-fix-to-update-isize-when-overwriting-c.patch
+pci-hv-fix-a-timing-issue-which-causes-kdump-to-fail.patch
+clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch
+clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch
+nvme-fix-deadlock-in-disconnect-during-scan_work-and.patch
+sched-uclamp-fix-a-deadlock-when-enabling-uclamp-sta.patch
+pwm-bcm-iproc-handle-clk_get_rate-return.patch
+perf-tools-fix-term-parsing-for-raw-syntax.patch
+tools-build-feature-use-cc-and-cxx-from-parent.patch
+i2c-rcar-avoid-race-when-unregistering-slave.patch
+nfs-ensure-correct-writeback-errors-are-returned-on-.patch
+ubi-fastmap-don-t-produce-the-initial-next-anchor-pe.patch
+ubi-fastmap-free-fastmap-next-anchor-peb-during-deta.patch
+ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch
+clk-hsdk-fix-bad-dependency-on-iomem.patch
+clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch
+libnvdimm-security-fix-a-typo.patch
+libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch
+openrisc-fix-oops-caused-when-dumping-stack.patch
+perf-evsel-don-t-set-sample_regs_intr-sample_regs_us.patch
+scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch
+nfs-nfs_file_write-should-check-for-writeback-errors.patch
+watchdog-initialize-device-before-misc_register.patch
+watchdog-rti-wdt-balance-pm-runtime-enable-calls.patch
+md-cluster-fix-potential-error-pointer-dereference-i.patch
+kprobes-fix-compiler-warning-for-config_kprobes_on_f.patch
+x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch
+x86-bugs-multihit-fix-mitigation-reporting-when-vmx-.patch
+selftests-bpf-prevent-runqslower-from-racing-on-buil.patch
+input-sentelic-fix-error-return-when-fsp_reg_write-f.patch
+perf-record-skip-side-band-event-setup-if-have_libbp.patch
+selftests-bpf-fix-silent-makefile-output.patch
+vdpa_sim-init-iommu-lock.patch
+recordmcount-fix-build-failure-on-non-arm64.patch
+vdpa-fix-pointer-math-bug-in-vdpasim_get_config.patch
+drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch
+drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch
+s390-test_unwind-fix-possible-memleak-in-test_unwind.patch
+s390-kconfig-add-missing-zcrypt-dependency-to-vfio_a.patch
+net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch
+nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch
+nfs-fix-flexfiles-read-failover.patch
+lib-test_lockup.c-fix-return-value-of-test_lockup_in.patch
+fs-minix-set-s_maxbytes-correctly.patch
+fs-minix-fix-block-limit-check-for-v1-filesystems.patch
+fs-minix-remove-expected-error-message-in-block_to_p.patch
+fs-ufs-avoid-potential-u32-multiplication-overflow.patch
+test_kmod-avoid-potential-double-free-in-trigger_con.patch
+i2c-iproc-fix-race-between-client-unreg-and-isr.patch
+mfd-dln2-run-event-handler-loop-under-spinlock.patch
+crypto-algif_aead-fix-uninitialized-ctx-init.patch
+alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch
+perf-bench-mem-always-memset-source-before-memcpy.patch
+tools-build-feature-quote-cc-and-cxx-for-their-argum.patch
+perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch
+sh-landisk-add-missing-initialization-of-sh_io_port_.patch
+sh-fault-fix-duplicate-printing-of-pc.patch
--- /dev/null
+From a87083bfb966b7c452ed8721429dd100e0c150d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jun 2020 16:36:31 +0200
+Subject: sh: fault: Fix duplicate printing of "PC:"
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 845d9156febcd6b3b20c0c2c8d73b461b48e844c ]
+
+Somewhere along the patch handling path, both the old "printk(KERN_ALERT
+....)" and the new "pr_alert(...)" were retained, leading to the
+duplicate printing of "PC:".
+
+Drop the old one.
+
+Fixes: eaabf98b0932a540 ("sh: fault: modernize printing of kernel messages")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/mm/fault.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/sh/mm/fault.c b/arch/sh/mm/fault.c
+index fbe1f2fe9a8c8..acd1c75994983 100644
+--- a/arch/sh/mm/fault.c
++++ b/arch/sh/mm/fault.c
+@@ -208,7 +208,6 @@ show_fault_oops(struct pt_regs *regs, unsigned long address)
+ if (!oops_may_print())
+ return;
+
+- printk(KERN_ALERT "PC:");
+ pr_alert("BUG: unable to handle kernel %s at %08lx\n",
+ address < PAGE_SIZE ? "NULL pointer dereference"
+ : "paging request",
+--
+2.25.1
+
--- /dev/null
+From a10ba70e78af445e32f3097325d755c26cfe71c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Aug 2020 14:42:45 +0200
+Subject: sh: landisk: Add missing initialization of sh_io_port_base
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ]
+
+The Landisk setup code maps the CF IDE area using ioremap_prot(), and
+passes the resulting virtual addresses to the pata_platform driver,
+disguising them as I/O port addresses. Hence the pata_platform driver
+translates them again using ioport_map().
+As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the
+SuperH-specific mapping code in arch/sh/kernel/ioport.c translates
+I/O port addresses to virtual addresses by adding sh_io_port_base, which
+defaults to -1, thus breaking the assumption of an identity mapping.
+
+Fix this by setting sh_io_port_base to zero.
+
+Fixes: 37b7a97884ba64bf ("sh: machvec IO death.")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/boards/mach-landisk/setup.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c
+index 16b4d8b0bb850..2c44b94f82fb2 100644
+--- a/arch/sh/boards/mach-landisk/setup.c
++++ b/arch/sh/boards/mach-landisk/setup.c
+@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup);
+
+ static void __init landisk_setup(char **cmdline_p)
+ {
++ /* I/O port identity mapping */
++ __set_io_port_base(0);
++
+ /* LED ON */
+ __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED);
+
+--
+2.25.1
+
--- /dev/null
+From 95b6817e3d032b73e65ba582446dfdc4f99a0bba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Aug 2020 18:36:16 -0700
+Subject: test_kmod: avoid potential double free in trigger_config_run_type()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 0776d1231bec0c7ab43baf440a3f5ef5f49dd795 ]
+
+Reset the member "test_fs" of the test configuration after a call of the
+function "kfree_const" to a null pointer so that a double memory release
+will not be performed.
+
+Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Christian Brauner <christian.brauner@ubuntu.com>
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Cc: David Howells <dhowells@redhat.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: James Morris <jmorris@namei.org>
+Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Cc: J. Bruce Fields <bfields@fieldses.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Josh Triplett <josh@joshtriplett.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Lars Ellenberg <lars.ellenberg@linbit.com>
+Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
+Cc: "Serge E. Hallyn" <serge@hallyn.com>
+Cc: Sergei Trofimovich <slyfox@gentoo.org>
+Cc: Sergey Kvachonok <ravenexp@gmail.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Tony Vroon <chainsaw@gentoo.org>
+Cc: Christoph Hellwig <hch@infradead.org>
+Link: http://lkml.kernel.org/r/20200610154923.27510-4-mcgrof@kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/test_kmod.c b/lib/test_kmod.c
+index e651c37d56dbd..eab52770070d6 100644
+--- a/lib/test_kmod.c
++++ b/lib/test_kmod.c
+@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev,
+ break;
+ case TEST_KMOD_FS_TYPE:
+ kfree_const(config->test_fs);
+- config->test_driver = NULL;
++ config->test_fs = NULL;
+ copied = config_copy_test_fs(config, test_str,
+ strlen(test_str));
+ break;
+--
+2.25.1
+
--- /dev/null
+From 7cf904cca17b3dfe125fb05861e4d3d471a42623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Aug 2020 17:15:17 -0500
+Subject: tools build feature: Quote CC and CXX for their arguments
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Díaz <daniel.diaz@linaro.org>
+
+[ Upstream commit fa5c893181ed2ca2f96552f50073786d2cfce6c0 ]
+
+When using a cross-compilation environment, such as OpenEmbedded,
+the CC an CXX variables are set to something more than just a
+command: there are arguments (such as --sysroot) that need to be
+passed on to the compiler so that the right set of headers and
+libraries are used.
+
+For the particular case that our systems detected, CC is set to
+the following:
+
+ export CC="aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/machine/perf/1.0-r9/recipe-sysroot"
+
+Without quotes, detection is as follows:
+
+ Auto-detecting system features:
+ ... dwarf: [ OFF ]
+ ... dwarf_getlocations: [ OFF ]
+ ... glibc: [ OFF ]
+ ... gtk2: [ OFF ]
+ ... libbfd: [ OFF ]
+ ... libcap: [ OFF ]
+ ... libelf: [ OFF ]
+ ... libnuma: [ OFF ]
+ ... numa_num_possible_cpus: [ OFF ]
+ ... libperl: [ OFF ]
+ ... libpython: [ OFF ]
+ ... libcrypto: [ OFF ]
+ ... libunwind: [ OFF ]
+ ... libdw-dwarf-unwind: [ OFF ]
+ ... zlib: [ OFF ]
+ ... lzma: [ OFF ]
+ ... get_cpuid: [ OFF ]
+ ... bpf: [ OFF ]
+ ... libaio: [ OFF ]
+ ... libzstd: [ OFF ]
+ ... disassembler-four-args: [ OFF ]
+
+ Makefile.config:414: *** No gnu/libc-version.h found, please install glibc-dev[el]. Stop.
+ Makefile.perf:230: recipe for target 'sub-make' failed
+ make[1]: *** [sub-make] Error 2
+ Makefile:69: recipe for target 'all' failed
+ make: *** [all] Error 2
+
+With CC and CXX quoted, some of those features are now detected.
+
+Fixes: e3232c2f39ac ("tools build feature: Use CC and CXX from parent")
+Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
+Reviewed-by: Thomas Hebb <tommyhebb@gmail.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: KP Singh <kpsingh@chromium.org>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lore.kernel.org/lkml/20200812221518.2869003-1-daniel.diaz@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Makefile.feature | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index 774f0b0ca28ac..e7818b44b48ee 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -8,7 +8,7 @@ endif
+
+ feature_check = $(eval $(feature_check_code))
+ define feature_check_code
+- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
+ endef
+
+ feature_set = $(eval $(feature_set_code))
+--
+2.25.1
+
--- /dev/null
+From 1ab1d1157b8c64f170814d40a4d55fb4bfeff4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jul 2020 21:08:14 -0700
+Subject: tools build feature: Use CC and CXX from parent
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit e3232c2f39acafd5a29128425bc30b9884642cfa ]
+
+commit c8c188679ccf ("tools build: Use the same CC for feature detection
+and actual build") changed these assignments from unconditional (:=) to
+conditional (?=) so that they wouldn't clobber values from the
+environment. However, conditional assignment does not work properly for
+variables that Make implicitly sets, among which are CC and CXX. To
+quote tools/scripts/Makefile.include, which handles this properly:
+
+ # Makefiles suck: This macro sets a default value of $(2) for the
+ # variable named by $(1), unless the variable has been set by
+ # environment or command line. This is necessary for CC and AR
+ # because make sets default values, so the simpler ?= approach
+ # won't work as expected.
+
+In other words, the conditional assignments will not run even if the
+variables are not overridden in the environment; Make will set CC to
+"cc" and CXX to "g++" when it starts[1], meaning the variables are not
+empty by the time the conditional assignments are evaluated. This breaks
+cross-compilation when CROSS_COMPILE is set but CC isn't, since "cc"
+gets used for feature detection instead of the cross compiler (and
+likewise for CXX).
+
+To fix the issue, just pass down the values of CC and CXX computed by
+the parent Makefile, which gets included by the Makefile that actually
+builds whatever we're detecting features for and so is guaranteed to
+have good values. This is a better solution anyway, since it means we
+aren't trying to replicate the logic of the parent build system and so
+don't risk it getting out of sync.
+
+Leave PKG_CONFIG alone, since 1) there's no common logic to compute it
+in Makefile.include, and 2) it's not an implicit variable, so
+conditional assignment works properly.
+
+[1] https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html
+
+Fixes: c8c188679ccf ("tools build: Use the same CC for feature detection and actual build")
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: David Carrillo-Cisneros <davidcc@google.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Igor Lubashev <ilubashe@akamai.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Quentin Monnet <quentin@isovalent.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: thomas hebb <tommyhebb@gmail.com>
+Link: http://lore.kernel.org/lkml/0a6e69d1736b0fa231a648f50b0cce5d8a6734ef.1595822871.git.tommyhebb@gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/build/Makefile.feature | 2 +-
+ tools/build/feature/Makefile | 2 --
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
+index cb152370fdefd..774f0b0ca28ac 100644
+--- a/tools/build/Makefile.feature
++++ b/tools/build/Makefile.feature
+@@ -8,7 +8,7 @@ endif
+
+ feature_check = $(eval $(feature_check_code))
+ define feature_check_code
+- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
+ endef
+
+ feature_set = $(eval $(feature_set_code))
+diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
+index b1f0321180f5c..93b590d81209c 100644
+--- a/tools/build/feature/Makefile
++++ b/tools/build/feature/Makefile
+@@ -74,8 +74,6 @@ FILES= \
+
+ FILES := $(addprefix $(OUTPUT),$(FILES))
+
+-CC ?= $(CROSS_COMPILE)gcc
+-CXX ?= $(CROSS_COMPILE)g++
+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
+ LLVM_CONFIG ?= llvm-config
+ CLANG ?= clang
+--
+2.25.1
+
--- /dev/null
+From 2a77b127d977e0793ec1859f2b842fa61c2a150a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 21:41:00 +0800
+Subject: ubi: fastmap: Don't produce the initial next anchor PEB when fastmap
+ is disabled
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 3b185255bb2f34fa6927619b9ef27f192a3d9f5a ]
+
+Following process triggers a memleak caused by forgetting to release the
+initial next anchor PEB (CONFIG_MTD_UBI_FASTMAP is disabled):
+1. attach -> __erase_worker -> produce the initial next anchor PEB
+2. detach -> ubi_fastmap_close (Do nothing, it should have released the
+ initial next anchor PEB)
+
+Don't produce the initial next anchor PEB in __erase_worker() when fastmap
+is disabled.
+
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Suggested-by: Sascha Hauer <s.hauer@pengutronix.de>
+Fixes: f9c34bb529975fe ("ubi: Fix producing anchor PEBs")
+Reported-by: syzbot+d9aab50b1154e3d163f5@syzkaller.appspotmail.com
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/wl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 27636063ed1bb..42cac572f82dc 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1086,7 +1086,8 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)
+ if (!err) {
+ spin_lock(&ubi->wl_lock);
+
+- if (!ubi->fm_next_anchor && e->pnum < UBI_FM_MAX_START) {
++ if (!ubi->fm_disabled && !ubi->fm_next_anchor &&
++ e->pnum < UBI_FM_MAX_START) {
+ /* Abort anchor production, if needed it will be
+ * enabled again in the wear leveling started below.
+ */
+--
+2.25.1
+
--- /dev/null
+From 2e2cda1919a2098db125cb32d9fce807042d4fac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 21:41:01 +0800
+Subject: ubi: fastmap: Free fastmap next anchor peb during detach
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit c3fc1a3919e35a9d8157ed3ae6fd0a478293ba2c ]
+
+ubi_wl_entry related with the fm_next_anchor PEB is not freed during
+detach, which causes a memory leak.
+Don't forget to release fm_next_anchor PEB while detaching ubi from
+mtd when CONFIG_MTD_UBI_FASTMAP is enabled.
+
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Fixes: 4b68bf9a69d22d ("ubi: Select fastmap anchor PEBs considering...")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/fastmap-wl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c
+index 83afc00e365a5..28f55f9cf7153 100644
+--- a/drivers/mtd/ubi/fastmap-wl.c
++++ b/drivers/mtd/ubi/fastmap-wl.c
+@@ -381,6 +381,11 @@ static void ubi_fastmap_close(struct ubi_device *ubi)
+ ubi->fm_anchor = NULL;
+ }
+
++ if (ubi->fm_next_anchor) {
++ return_unused_peb(ubi, ubi->fm_next_anchor);
++ ubi->fm_next_anchor = NULL;
++ }
++
+ if (ubi->fm) {
+ for (i = 0; i < ubi->fm->used_blocks; i++)
+ kfree(ubi->fm->e[i]);
+--
+2.25.1
+
--- /dev/null
+From 09268594d8fa2808610e512c162e298929270cdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jul 2020 20:51:40 +0800
+Subject: ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 094b6d1295474f338201b846a1f15e72eb0b12cf ]
+
+There a wrong orphan node deleting in error handling path in
+ubifs_jnl_update() and ubifs_jnl_rename(), which may cause
+following error msg:
+
+ UBIFS error (ubi0:0 pid 1522): ubifs_delete_orphan [ubifs]:
+ missing orphan ino 65
+
+Fix this by checking whether the node has been operated for
+adding to orphan list before being deleted,
+
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Fixes: 823838a486888cf484e ("ubifs: Add hashes to the tree node cache")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/journal.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
+index e5ec1afe1c668..2cf05f87565c2 100644
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ const struct fscrypt_name *nm, const struct inode *inode,
+ int deletion, int xent)
+ {
+- int err, dlen, ilen, len, lnum, ino_offs, dent_offs;
++ int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0;
+ int aligned_dlen, aligned_ilen, sync = IS_DIRSYNC(dir);
+ int last_reference = !!(deletion && inode->i_nlink == 0);
+ struct ubifs_inode *ui = ubifs_inode(inode);
+@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ goto out_finish;
+ }
+ ui->del_cmtno = c->cmt_no;
++ orphan_added = 1;
+ }
+
+ err = write_head(c, BASEHD, dent, len, &lnum, &dent_offs, sync);
+@@ -702,7 +703,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir,
+ kfree(dent);
+ out_ro:
+ ubifs_ro_mode(c, err);
+- if (last_reference)
++ if (orphan_added)
+ ubifs_delete_orphan(c, inode->i_ino);
+ finish_reservation(c);
+ return err;
+@@ -1218,7 +1219,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ void *p;
+ union ubifs_key key;
+ struct ubifs_dent_node *dent, *dent2;
+- int err, dlen1, dlen2, ilen, lnum, offs, len;
++ int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added = 0;
+ int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ;
+ int last_reference = !!(new_inode && new_inode->i_nlink == 0);
+ int move = (old_dir != new_dir);
+@@ -1334,6 +1335,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ goto out_finish;
+ }
+ new_ui->del_cmtno = c->cmt_no;
++ orphan_added = 1;
+ }
+
+ err = write_head(c, BASEHD, dent, len, &lnum, &offs, sync);
+@@ -1415,7 +1417,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir,
+ release_head(c, BASEHD);
+ out_ro:
+ ubifs_ro_mode(c, err);
+- if (last_reference)
++ if (orphan_added)
+ ubifs_delete_orphan(c, new_inode->i_ino);
+ out_finish:
+ finish_reservation(c);
+--
+2.25.1
+
--- /dev/null
+From a34f577a0f96e0448a4b595a42e17e60e14409d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:52 +0200
+Subject: USB: serial: ftdi_sio: clean up receive processing
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ce054039ba5e47b75a3be02a00274e52b06a6456 ]
+
+Clean up receive processing by dropping the character pointer and
+keeping the length argument unchanged throughout the function.
+
+Also make it more apparent that sysrq processing can consume a
+characters by adding an explicit continue.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 96b9e2768ac5c..33f1cca7eaa61 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2483,7 +2483,6 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
+ unsigned char status;
+- unsigned char *ch;
+ int i;
+ char flag;
+
+@@ -2526,8 +2525,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ else
+ priv->transmit_empty = 0;
+
+- len -= 2;
+- if (!len)
++ if (len == 2)
+ return 0; /* status only */
+
+ /*
+@@ -2556,19 +2554,20 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ }
+ }
+
+- port->icount.rx += len;
+- ch = buf + 2;
++ port->icount.rx += len - 2;
+
+ if (port->port.console && port->sysrq) {
+- for (i = 0; i < len; i++, ch++) {
+- if (!usb_serial_handle_sysrq_char(port, *ch))
+- tty_insert_flip_char(&port->port, *ch, flag);
++ for (i = 2; i < len; i++) {
++ if (usb_serial_handle_sysrq_char(port, buf[i]))
++ continue;
++ tty_insert_flip_char(&port->port, buf[i], flag);
+ }
+ } else {
+- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len);
++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag,
++ len - 2);
+ }
+
+- return len;
++ return len - 2;
+ }
+
+ static void ftdi_process_read_urb(struct urb *urb)
+--
+2.25.1
+
--- /dev/null
+From e0dbb32fa6b83068ebad42e7fd4a4bf6a7d894d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:53 +0200
+Subject: USB: serial: ftdi_sio: fix break and sysrq handling
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit 733fff67941dad64b8a630450b8372b1873edc41 ]
+
+Only the last NUL in a packet should be flagged as a break character,
+for example, to avoid dropping unrelated characters when IGNBRK is set.
+
+Also make sysrq work by consuming the break character instead of having
+it immediately cancel the sysrq request, and by not processing it
+prematurely to avoid triggering a sysrq based on an unrelated character
+received in the same packet (which was received *before* the break).
+
+Note that the break flag can be left set also for a packet received
+immediately following a break and that and an ending NUL in such a
+packet will continue to be reported as a break as there's no good way to
+tell it apart from an actual break.
+
+Tested on FT232R and FT232H.
+
+Fixes: 72fda3ca6fc1 ("USB: serial: ftd_sio: implement sysrq handling on break")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 33f1cca7eaa61..07b146d7033a6 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2483,6 +2483,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
+ unsigned char status;
++ bool brkint = false;
+ int i;
+ char flag;
+
+@@ -2534,13 +2535,17 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ */
+ flag = TTY_NORMAL;
+ if (buf[1] & FTDI_RS_ERR_MASK) {
+- /* Break takes precedence over parity, which takes precedence
+- * over framing errors */
+- if (buf[1] & FTDI_RS_BI) {
+- flag = TTY_BREAK;
++ /*
++ * Break takes precedence over parity, which takes precedence
++ * over framing errors. Note that break is only associated
++ * with the last character in the buffer and only when it's a
++ * NUL.
++ */
++ if (buf[1] & FTDI_RS_BI && buf[len - 1] == '\0') {
+ port->icount.brk++;
+- usb_serial_handle_break(port);
+- } else if (buf[1] & FTDI_RS_PE) {
++ brkint = true;
++ }
++ if (buf[1] & FTDI_RS_PE) {
+ flag = TTY_PARITY;
+ port->icount.parity++;
+ } else if (buf[1] & FTDI_RS_FE) {
+@@ -2556,8 +2561,13 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+
+ port->icount.rx += len - 2;
+
+- if (port->port.console && port->sysrq) {
++ if (brkint || (port->port.console && port->sysrq)) {
+ for (i = 2; i < len; i++) {
++ if (brkint && i == len - 1) {
++ if (usb_serial_handle_break(port))
++ return len - 3;
++ flag = TTY_BREAK;
++ }
+ if (usb_serial_handle_sysrq_char(port, buf[i]))
+ continue;
+ tty_insert_flip_char(&port->port, buf[i], flag);
+--
+2.25.1
+
--- /dev/null
+From 01ac98676889943e7a8df4d7c25f95ec5d4ba005 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 14:49:51 +0200
+Subject: USB: serial: ftdi_sio: make process-packet buffer unsigned
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ]
+
+Use an unsigned type for the process-packet buffer argument and give it
+a more apt name.
+
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 9ad44a96dfe3a..96b9e2768ac5c 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -2480,12 +2480,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port,
+ #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)
+
+ static int ftdi_process_packet(struct usb_serial_port *port,
+- struct ftdi_private *priv, char *packet, int len)
++ struct ftdi_private *priv, unsigned char *buf, int len)
+ {
++ unsigned char status;
++ unsigned char *ch;
+ int i;
+- char status;
+ char flag;
+- char *ch;
+
+ if (len < 2) {
+ dev_dbg(&port->dev, "malformed packet\n");
+@@ -2495,7 +2495,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ /* Compare new line status to the old one, signal if different/
+ N.B. packet may be processed more than once, but differences
+ are only processed once. */
+- status = packet[0] & FTDI_STATUS_B0_MASK;
++ status = buf[0] & FTDI_STATUS_B0_MASK;
+ if (status != priv->prev_status) {
+ char diff_status = status ^ priv->prev_status;
+
+@@ -2521,7 +2521,7 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ }
+
+ /* save if the transmitter is empty or not */
+- if (packet[1] & FTDI_RS_TEMT)
++ if (buf[1] & FTDI_RS_TEMT)
+ priv->transmit_empty = 1;
+ else
+ priv->transmit_empty = 0;
+@@ -2535,29 +2535,29 @@ static int ftdi_process_packet(struct usb_serial_port *port,
+ * data payload to avoid over-reporting.
+ */
+ flag = TTY_NORMAL;
+- if (packet[1] & FTDI_RS_ERR_MASK) {
++ if (buf[1] & FTDI_RS_ERR_MASK) {
+ /* Break takes precedence over parity, which takes precedence
+ * over framing errors */
+- if (packet[1] & FTDI_RS_BI) {
++ if (buf[1] & FTDI_RS_BI) {
+ flag = TTY_BREAK;
+ port->icount.brk++;
+ usb_serial_handle_break(port);
+- } else if (packet[1] & FTDI_RS_PE) {
++ } else if (buf[1] & FTDI_RS_PE) {
+ flag = TTY_PARITY;
+ port->icount.parity++;
+- } else if (packet[1] & FTDI_RS_FE) {
++ } else if (buf[1] & FTDI_RS_FE) {
+ flag = TTY_FRAME;
+ port->icount.frame++;
+ }
+ /* Overrun is special, not associated with a char */
+- if (packet[1] & FTDI_RS_OE) {
++ if (buf[1] & FTDI_RS_OE) {
+ port->icount.overrun++;
+ tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
+ }
+ }
+
+ port->icount.rx += len;
+- ch = packet + 2;
++ ch = buf + 2;
+
+ if (port->port.console && port->sysrq) {
+ for (i = 0; i < len; i++, ch++) {
+--
+2.25.1
+
--- /dev/null
+From 86cbbcdb8f5e796278b322c296a6431b04834c35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 17:45:52 +0300
+Subject: vdpa: Fix pointer math bug in vdpasim_get_config()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cf16fe9243bfa2863491026fc727618c7c593c84 ]
+
+If "offset" is non-zero then we end up copying from beyond the end of
+the config because of pointer math. We can fix this by casting the
+struct to a u8 pointer.
+
+Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200406144552.GF68494@mwanda
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+index 412fa85ba3653..67956db75013f 100644
+--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+@@ -522,7 +522,7 @@ static void vdpasim_get_config(struct vdpa_device *vdpa, unsigned int offset,
+ struct vdpasim *vdpasim = vdpa_to_sim(vdpa);
+
+ if (offset + len < sizeof(struct virtio_net_config))
+- memcpy(buf, &vdpasim->config + offset, len);
++ memcpy(buf, (u8 *)&vdpasim->config + offset, len);
+ }
+
+ static void vdpasim_set_config(struct vdpa_device *vdpa, unsigned int offset,
+--
+2.25.1
+
--- /dev/null
+From 783a956b8353d345cbd89caf5849c289d1ebe6ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 08:44:43 -0400
+Subject: vdpa_sim: init iommu lock
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 1e3e792650d2c0df8dd796906275b7c79e278664 ]
+
+The patch adding the iommu lock did not initialize it.
+The struct is zero-initialized so this is mostly a problem
+when using lockdep.
+
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Fixes: 0ea9ee430e74 ("vdpasim: protect concurrent access to iommu iotlb")
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_sim/vdpa_sim.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+index 8ac6f341dcc16..412fa85ba3653 100644
+--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
+@@ -331,6 +331,7 @@ static struct vdpasim *vdpasim_create(void)
+
+ INIT_WORK(&vdpasim->work, vdpasim_work);
+ spin_lock_init(&vdpasim->lock);
++ spin_lock_init(&vdpasim->iommu_lock);
+
+ dev = &vdpasim->vdpa.dev;
+ dev->coherent_dma_mask = DMA_BIT_MASK(64);
+--
+2.25.1
+
--- /dev/null
+From 30505af364143c1da701e3455e475fdc4331db9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 12:31:09 +0200
+Subject: watchdog: initialize device before misc_register
+
+From: Krzysztof Sobota <krzysztof.sobota@nokia.com>
+
+[ Upstream commit cb36e29bb0e4b0c33c3d5866a0a4aebace4c99b7 ]
+
+When watchdog device is being registered, it calls misc_register that
+makes watchdog available for systemd to open. This is a data race
+scenario, because when device is open it may still have device struct
+not initialized - this in turn causes a crash. This patch moves
+device initialization before misc_register call and it solves the
+problem printed below.
+
+------------[ cut here ]------------
+WARNING: CPU: 3 PID: 1 at lib/kobject.c:612 kobject_get+0x50/0x54
+kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called.
+Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6
+CPU: 3 PID: 1 Comm: systemd Tainted: G O 4.19.113-g2579778-fsm4_k2 #1
+Hardware name: Keystone
+[<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c)
+[<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8)
+[<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114)
+[<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74)
+[<c0221fd8>] (warn_slowpath_fmt) from [<c07fd394>] (kobject_get+0x50/0x54)
+[<c07fd394>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24)
+[<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0)
+[<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c)
+[<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8)
+[<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc)
+[<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148)
+[<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec)
+[<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4)
+[<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xd2ceffa8 to 0xd2cefff0)
+ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000
+ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78
+ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6
+---[ end trace 7b16eb105513974f ]---
+
+------------[ cut here ]------------
+WARNING: CPU: 3 PID: 1 at lib/refcount.c:153 kobject_get+0x24/0x54
+refcount_t: increment on 0; use-after-free.
+Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6
+CPU: 3 PID: 1 Comm: systemd Tainted: G W O 4.19.113-g2579778-fsm4_k2 #1
+Hardware name: Keystone
+[<c02126c4>] (unwind_backtrace) from [<c020da94>] (show_stack+0x18/0x1c)
+[<c020da94>] (show_stack) from [<c07f87d8>] (dump_stack+0xb4/0xe8)
+[<c07f87d8>] (dump_stack) from [<c0221f70>] (__warn+0xfc/0x114)
+[<c0221f70>] (__warn) from [<c0221fd8>] (warn_slowpath_fmt+0x50/0x74)
+[<c0221fd8>] (warn_slowpath_fmt) from [<c07fd368>] (kobject_get+0x24/0x54)
+[<c07fd368>] (kobject_get) from [<c0602ce8>] (get_device+0x1c/0x24)
+[<c0602ce8>] (get_device) from [<c06961e0>] (watchdog_open+0x90/0xf0)
+[<c06961e0>] (watchdog_open) from [<c06001dc>] (misc_open+0x130/0x17c)
+[<c06001dc>] (misc_open) from [<c0388228>] (chrdev_open+0xec/0x1a8)
+[<c0388228>] (chrdev_open) from [<c037fa98>] (do_dentry_open+0x204/0x3cc)
+[<c037fa98>] (do_dentry_open) from [<c0391e2c>] (path_openat+0x330/0x1148)
+[<c0391e2c>] (path_openat) from [<c0394518>] (do_filp_open+0x78/0xec)
+[<c0394518>] (do_filp_open) from [<c0381100>] (do_sys_open+0x130/0x1f4)
+[<c0381100>] (do_sys_open) from [<c0201000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xd2ceffa8 to 0xd2cefff0)
+ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000
+ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78
+ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6
+---[ end trace 7b16eb1055139750 ]---
+
+Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Krzysztof Sobota <krzysztof.sobota@nokia.com>
+Link: https://lore.kernel.org/r/20200717103109.14660-1-krzysztof.sobota@nokia.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_dev.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 7e4cd34a8c20e..b535f5fa279b9 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -994,6 +994,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ if (IS_ERR_OR_NULL(watchdog_kworker))
+ return -ENODEV;
+
++ device_initialize(&wd_data->dev);
++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
++ wd_data->dev.class = &watchdog_class;
++ wd_data->dev.parent = wdd->parent;
++ wd_data->dev.groups = wdd->groups;
++ wd_data->dev.release = watchdog_core_data_release;
++ dev_set_drvdata(&wd_data->dev, wdd);
++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
++
+ kthread_init_work(&wd_data->work, watchdog_ping_work);
+ hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
+ wd_data->timer.function = watchdog_timer_expired;
+@@ -1014,15 +1023,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ }
+ }
+
+- device_initialize(&wd_data->dev);
+- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
+- wd_data->dev.class = &watchdog_class;
+- wd_data->dev.parent = wdd->parent;
+- wd_data->dev.groups = wdd->groups;
+- wd_data->dev.release = watchdog_core_data_release;
+- dev_set_drvdata(&wd_data->dev, wdd);
+- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
+-
+ /* Fill in the data structures */
+ cdev_init(&wd_data->cdev, &watchdog_fops);
+
+--
+2.25.1
+
--- /dev/null
+From a783dff18357d0d4c43e5611a38f6208c4baf4bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 16:29:58 +0300
+Subject: watchdog: rti-wdt: balance pm runtime enable calls
+
+From: Tero Kristo <t-kristo@ti.com>
+
+[ Upstream commit d5b29c2c5ba2bd5bbdb5b744659984185d17d079 ]
+
+PM runtime should be disabled in the fail path of probe and when
+the driver is removed.
+
+Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support")
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20200717132958.14304-5-t-kristo@ti.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rti_wdt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c
+index d456dd72d99a0..c904496fff65e 100644
+--- a/drivers/watchdog/rti_wdt.c
++++ b/drivers/watchdog/rti_wdt.c
+@@ -211,6 +211,7 @@ static int rti_wdt_probe(struct platform_device *pdev)
+
+ err_iomap:
+ pm_runtime_put_sync(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
+
+ return ret;
+ }
+@@ -221,6 +222,7 @@ static int rti_wdt_remove(struct platform_device *pdev)
+
+ watchdog_unregister_device(&wdt->wdd);
+ pm_runtime_put(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From bfb76acaed9d810c58288b26263c06e92e0417ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 12:23:59 -0700
+Subject: x86/bugs/multihit: Fix mitigation reporting when VMX is not in use
+
+From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+
+[ Upstream commit f29dfa53cc8ae6ad93bae619bcc0bf45cab344f7 ]
+
+On systems that have virtualization disabled or unsupported, sysfs
+mitigation for X86_BUG_ITLB_MULTIHIT is reported incorrectly as:
+
+ $ cat /sys/devices/system/cpu/vulnerabilities/itlb_multihit
+ KVM: Vulnerable
+
+System is not vulnerable to DoS attack from a rogue guest when
+virtualization is disabled or unsupported in the hardware. Change the
+mitigation reporting for these cases.
+
+Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation")
+Reported-by: Nelson Dsouza <nelson.dsouza@linux.intel.com>
+Co-developed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/0ba029932a816179b9d14a30db38f0f11ef1f166.1594925782.git.pawan.kumar.gupta@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/hw-vuln/multihit.rst | 4 ++++
+ arch/x86/kernel/cpu/bugs.c | 8 +++++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/admin-guide/hw-vuln/multihit.rst b/Documentation/admin-guide/hw-vuln/multihit.rst
+index ba9988d8bce50..140e4cec38c33 100644
+--- a/Documentation/admin-guide/hw-vuln/multihit.rst
++++ b/Documentation/admin-guide/hw-vuln/multihit.rst
+@@ -80,6 +80,10 @@ The possible values in this file are:
+ - The processor is not vulnerable.
+ * - KVM: Mitigation: Split huge pages
+ - Software changes mitigate this issue.
++ * - KVM: Mitigation: VMX unsupported
++ - KVM is not vulnerable because Virtual Machine Extensions (VMX) is not supported.
++ * - KVM: Mitigation: VMX disabled
++ - KVM is not vulnerable because Virtual Machine Extensions (VMX) is disabled.
+ * - KVM: Vulnerable
+ - The processor is vulnerable, but no mitigation enabled
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 0b71970d2d3d2..b0802d45abd30 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -31,6 +31,7 @@
+ #include <asm/intel-family.h>
+ #include <asm/e820/api.h>
+ #include <asm/hypervisor.h>
++#include <asm/tlbflush.h>
+
+ #include "cpu.h"
+
+@@ -1556,7 +1557,12 @@ static ssize_t l1tf_show_state(char *buf)
+
+ static ssize_t itlb_multihit_show_state(char *buf)
+ {
+- if (itlb_multihit_kvm_mitigation)
++ if (!boot_cpu_has(X86_FEATURE_MSR_IA32_FEAT_CTL) ||
++ !boot_cpu_has(X86_FEATURE_VMX))
++ return sprintf(buf, "KVM: Mitigation: VMX unsupported\n");
++ else if (!(cr4_read_shadow() & X86_CR4_VMXE))
++ return sprintf(buf, "KVM: Mitigation: VMX disabled\n");
++ else if (itlb_multihit_kvm_mitigation)
+ return sprintf(buf, "KVM: Mitigation: Split huge pages\n");
+ else
+ return sprintf(buf, "KVM: Vulnerable\n");
+--
+2.25.1
+
--- /dev/null
+From e811254fae17b2226b2862900272c44e0641fc2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Aug 2020 15:56:36 +0800
+Subject: x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC
+
+From: Dilip Kota <eswara.kota@linux.intel.com>
+
+[ Upstream commit 7d98585860d845e36ee612832a5ff021f201dbaf ]
+
+Frequency descriptor of Lightning Mountain SoC doesn't have all the
+frequency entries so resulting in the below failure causing a kernel hang:
+
+ Error MSR_FSB_FREQ index 15 is unknown
+ tsc: Fast TSC calibration failed
+
+So, add all the frequency entries in the Lightning Mountain SoC frequency
+descriptor.
+
+Fixes: 0cc5359d8fd45 ("x86/cpu: Update init data for new Airmont CPU model")
+Fixes: 812c2d7506fd ("x86/tsc_msr: Use named struct initializers")
+Signed-off-by: Dilip Kota <eswara.kota@linux.intel.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/211c643ae217604b46cbec43a2c0423946dc7d2d.1596440057.git.eswara.kota@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tsc_msr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
+index 4fec6f3a1858b..a654a9b4b77c0 100644
+--- a/arch/x86/kernel/tsc_msr.c
++++ b/arch/x86/kernel/tsc_msr.c
+@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = {
+ .mask = 0x0f,
+ };
+
+-/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */
++/*
++ * 24 MHz crystal? : 24 * 13 / 4 = 78 MHz
++ * Frequency step for Lightning Mountain SoC is fixed to 78 MHz,
++ * so all the frequency entries are 78000.
++ */
+ static const struct freq_desc freq_desc_lgm = {
+ .use_msr_plat = true,
+- .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 },
++ .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000,
++ 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 },
+ .mask = 0x0f,
+ };
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
