--- /dev/null
+From 7e43ba0fa4084114e0a9d331af15896b2a8844c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 19:22:50 +0100
+Subject: afs: Add missing vnode validation checks
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3978d816523991dd86cf9aae88c295230a5ea3b2 ]
+
+afs_d_revalidate() should only be validating the directory entry it is
+given and the directory to which that belongs; it shouldn't be validating
+the inode/vnode to which that dentry points. Besides, validation need to
+be done even if we don't call afs_d_revalidate() - which might be the case
+if we're starting from a file descriptor.
+
+In order for afs_d_revalidate() to be fixed, validation points must be
+added in some other places. Certain directory operations, such as
+afs_unlink(), already check this, but not all and not all file operations
+either.
+
+Note that the validation of a vnode not only checks to see if the
+attributes we have are correct, but also gets a promise from the server to
+notify us if that file gets changed by a third party.
+
+Add the following checks:
+
+ - Check the vnode we're going to make a hard link to.
+ - Check the vnode we're going to move/rename.
+ - Check the vnode we're going to read from.
+ - Check the vnode we're going to write to.
+ - Check the vnode we're going to sync.
+ - Check the vnode we're going to make a mapped page writable for.
+
+Some of these aren't strictly necessary as we're going to perform a server
+operation that might get the attributes anyway from which we can determine
+if something changed - though it might not get us a callback promise.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
+cc: linux-afs@lists.infradead.org
+Link: https://lore.kernel.org/r/163111667354.283156.12720698333342917516.stgit@warthog.procyon.org.uk/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 11 +++++++++++
+ fs/afs/file.c | 16 +++++++++++++++-
+ fs/afs/write.c | 17 +++++++++++++++--
+ 3 files changed, 41 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 54ee54ae36bc..4579bbda4634 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -1760,6 +1760,10 @@ static int afs_link(struct dentry *from, struct inode *dir,
+ goto error;
+ }
+
++ ret = afs_validate(vnode, op->key);
++ if (ret < 0)
++ goto error_op;
++
+ afs_op_set_vnode(op, 0, dvnode);
+ afs_op_set_vnode(op, 1, vnode);
+ op->file[0].dv_delta = 1;
+@@ -1773,6 +1777,8 @@ static int afs_link(struct dentry *from, struct inode *dir,
+ op->create.reason = afs_edit_dir_for_link;
+ return afs_do_sync_operation(op);
+
++error_op:
++ afs_put_operation(op);
+ error:
+ d_drop(dentry);
+ _leave(" = %d", ret);
+@@ -1957,6 +1963,11 @@ static int afs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
+ if (IS_ERR(op))
+ return PTR_ERR(op);
+
++ ret = afs_validate(vnode, op->key);
++ op->error = ret;
++ if (ret < 0)
++ goto error;
++
+ afs_op_set_vnode(op, 0, orig_dvnode);
+ afs_op_set_vnode(op, 1, new_dvnode); /* May be same as orig_dvnode */
+ op->file[0].dv_delta = 1;
+diff --git a/fs/afs/file.c b/fs/afs/file.c
+index db035ae2a134..5efa1cf2a20a 100644
+--- a/fs/afs/file.c
++++ b/fs/afs/file.c
+@@ -24,12 +24,13 @@ static void afs_invalidatepage(struct page *page, unsigned int offset,
+ static int afs_releasepage(struct page *page, gfp_t gfp_flags);
+
+ static void afs_readahead(struct readahead_control *ractl);
++static ssize_t afs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter);
+
+ const struct file_operations afs_file_operations = {
+ .open = afs_open,
+ .release = afs_release,
+ .llseek = generic_file_llseek,
+- .read_iter = generic_file_read_iter,
++ .read_iter = afs_file_read_iter,
+ .write_iter = afs_file_write,
+ .mmap = afs_file_mmap,
+ .splice_read = generic_file_splice_read,
+@@ -502,3 +503,16 @@ static int afs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ vma->vm_ops = &afs_vm_ops;
+ return ret;
+ }
++
++static ssize_t afs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
++{
++ struct afs_vnode *vnode = AFS_FS_I(file_inode(iocb->ki_filp));
++ struct afs_file *af = iocb->ki_filp->private_data;
++ int ret;
++
++ ret = afs_validate(vnode, af->key);
++ if (ret < 0)
++ return ret;
++
++ return generic_file_read_iter(iocb, iter);
++}
+diff --git a/fs/afs/write.c b/fs/afs/write.c
+index e86f5a245514..2dfe3b3a53d6 100644
+--- a/fs/afs/write.c
++++ b/fs/afs/write.c
+@@ -807,6 +807,7 @@ int afs_writepages(struct address_space *mapping,
+ ssize_t afs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ {
+ struct afs_vnode *vnode = AFS_FS_I(file_inode(iocb->ki_filp));
++ struct afs_file *af = iocb->ki_filp->private_data;
+ ssize_t result;
+ size_t count = iov_iter_count(from);
+
+@@ -822,6 +823,10 @@ ssize_t afs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ if (!count)
+ return 0;
+
++ result = afs_validate(vnode, af->key);
++ if (result < 0)
++ return result;
++
+ result = generic_file_write_iter(iocb, from);
+
+ _leave(" = %zd", result);
+@@ -835,13 +840,18 @@ ssize_t afs_file_write(struct kiocb *iocb, struct iov_iter *from)
+ */
+ int afs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
+ {
+- struct inode *inode = file_inode(file);
+- struct afs_vnode *vnode = AFS_FS_I(inode);
++ struct afs_vnode *vnode = AFS_FS_I(file_inode(file));
++ struct afs_file *af = file->private_data;
++ int ret;
+
+ _enter("{%llx:%llu},{n=%pD},%d",
+ vnode->fid.vid, vnode->fid.vnode, file,
+ datasync);
+
++ ret = afs_validate(vnode, af->key);
++ if (ret < 0)
++ return ret;
++
+ return file_write_and_wait_range(file, start, end);
+ }
+
+@@ -855,11 +865,14 @@ vm_fault_t afs_page_mkwrite(struct vm_fault *vmf)
+ struct file *file = vmf->vma->vm_file;
+ struct inode *inode = file_inode(file);
+ struct afs_vnode *vnode = AFS_FS_I(inode);
++ struct afs_file *af = file->private_data;
+ unsigned long priv;
+ vm_fault_t ret = VM_FAULT_RETRY;
+
+ _enter("{{%llx:%llu}},{%lx}", vnode->fid.vid, vnode->fid.vnode, page->index);
+
++ afs_validate(vnode, af->key);
++
+ sb_start_pagefault(inode->i_sb);
+
+ /* Wait for the page to be written to the cache before we allow it to
+--
+2.33.0
+
--- /dev/null
+From 01323dd0b2e67b6d020b574bab90e293c48f1f9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 19:07:04 +0800
+Subject: block: don't call rq_qos_ops->done_bio if the bio isn't tracked
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit a647a524a46736786c95cdb553a070322ca096e3 ]
+
+rq_qos framework is only applied on request based driver, so:
+
+1) rq_qos_done_bio() needn't to be called for bio based driver
+
+2) rq_qos_done_bio() needn't to be called for bio which isn't tracked,
+such as bios ended from error handling code.
+
+Especially in bio_endio():
+
+1) request queue is referred via bio->bi_bdev->bd_disk->queue, which
+may be gone since request queue refcount may not be held in above two
+cases
+
+2) q->rq_qos may be freed in blk_cleanup_queue() when calling into
+__rq_qos_done_bio()
+
+Fix the potential kernel panic by not calling rq_qos_ops->done_bio if
+the bio isn't tracked. This way is safe because both ioc_rqos_done_bio()
+and blkcg_iolatency_done_bio() are nop if the bio isn't tracked.
+
+Reported-by: Yu Kuai <yukuai3@huawei.com>
+Cc: tj@kernel.org
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20210924110704.1541818-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/bio.c b/block/bio.c
+index d95e3456ba0c..52548c487883 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1396,7 +1396,7 @@ again:
+ if (!bio_integrity_endio(bio))
+ return;
+
+- if (bio->bi_bdev)
++ if (bio->bi_bdev && bio_flagged(bio, BIO_TRACKED))
+ rq_qos_done_bio(bio->bi_bdev->bd_disk->queue, bio);
+
+ if (bio->bi_bdev && bio_flagged(bio, BIO_TRACE_COMPLETION)) {
+--
+2.33.0
+
--- /dev/null
+From f1e0db076e807e5df11bca9cc88c60d96befad4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Sep 2021 19:05:44 +0100
+Subject: btrfs: fix mount failure due to past and transient device flush error
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 6b225baababf1e3d41a4250e802cbd193e1343fb ]
+
+When we get an error flushing one device, during a super block commit, we
+record the error in the device structure, in the field 'last_flush_error'.
+This is used to later check if we should error out the super block commit,
+depending on whether the number of flush errors is greater than or equals
+to the maximum tolerated device failures for a raid profile.
+
+However if we get a transient device flush error, unmount the filesystem
+and later try to mount it, we can fail the mount because we treat that
+past error as critical and consider the device is missing. Even if it's
+very likely that the error will happen again, as it's probably due to a
+hardware related problem, there may be cases where the error might not
+happen again. One example is during testing, and a test case like the
+new generic/648 from fstests always triggers this. The test cases
+generic/019 and generic/475 also trigger this scenario, but very
+sporadically.
+
+When this happens we get an error like this:
+
+ $ mount /dev/sdc /mnt
+ mount: /mnt wrong fs type, bad option, bad superblock on /dev/sdc, missing codepage or helper program, or other error.
+
+ $ dmesg
+ (...)
+ [12918.886926] BTRFS warning (device sdc): chunk 13631488 missing 1 devices, max tolerance is 0 for writable mount
+ [12918.888293] BTRFS warning (device sdc): writable mount is not allowed due to too many missing devices
+ [12918.890853] BTRFS error (device sdc): open_ctree failed
+
+The failure happens because when btrfs_check_rw_degradable() is called at
+mount time, or at remount from RO to RW time, is sees a non zero value in
+a device's ->last_flush_error attribute, and therefore considers that the
+device is 'missing'.
+
+Fix this by setting a device's ->last_flush_error to zero when we close a
+device, making sure the error is not seen on the next mount attempt. We
+only need to track flush errors during the current mount, so that we never
+commit a super block if such errors happened.
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 682416d4edef..19c780242e12 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1149,6 +1149,19 @@ static void btrfs_close_one_device(struct btrfs_device *device)
+ atomic_set(&device->dev_stats_ccnt, 0);
+ extent_io_tree_release(&device->alloc_state);
+
++ /*
++ * Reset the flush error record. We might have a transient flush error
++ * in this mount, and if so we aborted the current transaction and set
++ * the fs to an error state, guaranteeing no super blocks can be further
++ * committed. However that error might be transient and if we unmount the
++ * filesystem and mount it again, we should allow the mount to succeed
++ * (btrfs_check_rw_degradable() should not fail) - if after mounting the
++ * filesystem again we still get flush errors, then we will again abort
++ * any transaction and set the error state, guaranteeing no commits of
++ * unsafe super blocks.
++ */
++ device->last_flush_error = 0;
++
+ /* Verify the device is back in a pristine state */
+ ASSERT(!test_bit(BTRFS_DEV_STATE_FLUSH_SENT, &device->dev_state));
+ ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state));
+--
+2.33.0
+
--- /dev/null
+From 4f01fadd9d982316fb2b237a1befbfa39858bccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 07:55:40 +0800
+Subject: btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error
+ handling
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit bbc9a6eb5eec03dcafee266b19f56295e3b2aa8f ]
+
+There is a BUG_ON() in btrfs_csum_one_bio() to catch code logic error.
+It has indeed caught several bugs during subpage development.
+But the BUG_ON() itself will bring down the whole system which is
+an overkill.
+
+Replace it with a WARN() and exit gracefully, so that it won't crash the
+whole system while we can still catch the code logic error.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index df6631eefc65..5e8a56113b23 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -666,7 +666,18 @@ blk_status_t btrfs_csum_one_bio(struct btrfs_inode *inode, struct bio *bio,
+
+ if (!ordered) {
+ ordered = btrfs_lookup_ordered_extent(inode, offset);
+- BUG_ON(!ordered); /* Logic error */
++ /*
++ * The bio range is not covered by any ordered extent,
++ * must be a code logic error.
++ */
++ if (unlikely(!ordered)) {
++ WARN(1, KERN_WARNING
++ "no ordered extent for root %llu ino %llu offset %llu\n",
++ inode->root->root_key.objectid,
++ btrfs_ino(inode), offset);
++ kvfree(sums);
++ return BLK_STS_IOERR;
++ }
+ }
+
+ nr_sectors = BTRFS_BYTES_TO_BLKS(fs_info,
+--
+2.33.0
+
--- /dev/null
+From 477e39634dce9fa02387dbcdf026eb6609426855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 17:25:52 -0400
+Subject: drm/amdkfd: fix svm_migrate_fini warning
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 197ae17722e989942b36e33e044787877f158574 ]
+
+Device manager releases device-specific resources when a driver
+disconnects from a device, devm_memunmap_pages and
+devm_release_mem_region calls in svm_migrate_fini are redundant.
+
+It causes below warning trace after patch "drm/amdgpu: Split
+amdgpu_device_fini into early and late", so remove function
+svm_migrate_fini.
+
+BUG: https://gitlab.freedesktop.org/drm/amd/-/issues/1718
+
+WARNING: CPU: 1 PID: 3646 at drivers/base/devres.c:795
+devm_release_action+0x51/0x60
+Call Trace:
+ ? memunmap_pages+0x360/0x360
+ svm_migrate_fini+0x2d/0x60 [amdgpu]
+ kgd2kfd_device_exit+0x23/0xa0 [amdgpu]
+ amdgpu_amdkfd_device_fini_sw+0x1d/0x30 [amdgpu]
+ amdgpu_device_fini_sw+0x45/0x290 [amdgpu]
+ amdgpu_driver_release_kms+0x12/0x30 [amdgpu]
+ drm_dev_release+0x20/0x40 [drm]
+ release_nodes+0x196/0x1e0
+ device_release_driver_internal+0x104/0x1d0
+ driver_detach+0x47/0x90
+ bus_remove_driver+0x7a/0xd0
+ pci_unregister_driver+0x3d/0x90
+ amdgpu_exit+0x11/0x20 [amdgpu]
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 1 -
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 13 ++++---------
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.h | 5 -----
+ 3 files changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 5a872adcfdb9..5ba8a4f35344 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -922,7 +922,6 @@ out:
+ void kgd2kfd_device_exit(struct kfd_dev *kfd)
+ {
+ if (kfd->init_complete) {
+- svm_migrate_fini((struct amdgpu_device *)kfd->kgd);
+ device_queue_manager_uninit(kfd->dqm);
+ kfd_interrupt_exit(kfd);
+ kfd_topology_remove_device(kfd);
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index 165e0ebb619d..4a16e3c257b9 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -891,6 +891,10 @@ int svm_migrate_init(struct amdgpu_device *adev)
+ pgmap->ops = &svm_migrate_pgmap_ops;
+ pgmap->owner = SVM_ADEV_PGMAP_OWNER(adev);
+ pgmap->flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE;
++
++ /* Device manager releases device-specific resources, memory region and
++ * pgmap when driver disconnects from device.
++ */
+ r = devm_memremap_pages(adev->dev, pgmap);
+ if (IS_ERR(r)) {
+ pr_err("failed to register HMM device memory\n");
+@@ -911,12 +915,3 @@ int svm_migrate_init(struct amdgpu_device *adev)
+
+ return 0;
+ }
+-
+-void svm_migrate_fini(struct amdgpu_device *adev)
+-{
+- struct dev_pagemap *pgmap = &adev->kfd.dev->pgmap;
+-
+- devm_memunmap_pages(adev->dev, pgmap);
+- devm_release_mem_region(adev->dev, pgmap->range.start,
+- pgmap->range.end - pgmap->range.start + 1);
+-}
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
+index 0de76b5d4973..2f5b3394c9ed 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.h
+@@ -47,7 +47,6 @@ unsigned long
+ svm_migrate_addr_to_pfn(struct amdgpu_device *adev, unsigned long addr);
+
+ int svm_migrate_init(struct amdgpu_device *adev);
+-void svm_migrate_fini(struct amdgpu_device *adev);
+
+ #else
+
+@@ -55,10 +54,6 @@ static inline int svm_migrate_init(struct amdgpu_device *adev)
+ {
+ return 0;
+ }
+-static inline void svm_migrate_fini(struct amdgpu_device *adev)
+-{
+- /* empty */
+-}
+
+ #endif /* IS_ENABLED(CONFIG_HSA_AMD_SVM) */
+
+--
+2.33.0
+
--- /dev/null
+From 50f50059f55dd179ad6912026fdcebd2f908cfdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 14:32:14 -0400
+Subject: drm/amdkfd: handle svm migrate init error
+
+From: Philip Yang <Philip.Yang@amd.com>
+
+[ Upstream commit 7d6687200a939176847090bbde5cb79a82792a2f ]
+
+If svm migration init failed to create pgmap for device memory, set
+pgmap type to 0 to disable device SVM support capability.
+
+Signed-off-by: Philip Yang <Philip.Yang@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+index dab290a4d19d..165e0ebb619d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_migrate.c
+@@ -894,6 +894,9 @@ int svm_migrate_init(struct amdgpu_device *adev)
+ r = devm_memremap_pages(adev->dev, pgmap);
+ if (IS_ERR(r)) {
+ pr_err("failed to register HMM device memory\n");
++
++ /* Disable SVM support capability */
++ pgmap->type = 0;
+ devm_release_mem_region(adev->dev, res->start,
+ res->end - res->start + 1);
+ return PTR_ERR(r);
+--
+2.33.0
+
--- /dev/null
+From 4cc6a267fb672d31a8bd56e57817cd68d89f1915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 23:32:33 +0300
+Subject: ext2: fix sleeping in atomic bugs on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 372d1f3e1bfede719864d0d1fbf3146b1e638c88 ]
+
+The ext2_error() function syncs the filesystem so it sleeps. The caller
+is holding a spinlock so it's not allowed to sleep.
+
+ ext2_statfs() <- disables preempt
+ -> ext2_count_free_blocks()
+ -> ext2_get_group_desc()
+
+Fix this by using WARN() to print an error message and a stack trace
+instead of using ext2_error().
+
+Link: https://lore.kernel.org/r/20210921203233.GA16529@kili
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/balloc.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
+index 1f3f4326bf3c..c17ccc19b938 100644
+--- a/fs/ext2/balloc.c
++++ b/fs/ext2/balloc.c
+@@ -48,10 +48,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
+ struct ext2_sb_info *sbi = EXT2_SB(sb);
+
+ if (block_group >= sbi->s_groups_count) {
+- ext2_error (sb, "ext2_get_group_desc",
+- "block_group >= groups_count - "
+- "block_group = %d, groups_count = %lu",
+- block_group, sbi->s_groups_count);
++ WARN(1, "block_group >= groups_count - "
++ "block_group = %d, groups_count = %lu",
++ block_group, sbi->s_groups_count);
+
+ return NULL;
+ }
+@@ -59,10 +58,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
+ group_desc = block_group >> EXT2_DESC_PER_BLOCK_BITS(sb);
+ offset = block_group & (EXT2_DESC_PER_BLOCK(sb) - 1);
+ if (!sbi->s_group_desc[group_desc]) {
+- ext2_error (sb, "ext2_get_group_desc",
+- "Group descriptor not loaded - "
+- "block_group = %d, group_desc = %lu, desc = %lu",
+- block_group, group_desc, offset);
++ WARN(1, "Group descriptor not loaded - "
++ "block_group = %d, group_desc = %lu, desc = %lu",
++ block_group, group_desc, offset);
+ return NULL;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 3bcd4a98e25595eca07b7360e2687d269fa422b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 09:47:53 +0300
+Subject: habanalabs: fail collective wait when not supported
+
+From: Ofir Bitton <obitton@habana.ai>
+
+[ Upstream commit d09ff62c820b5950ab9958e77620a8498efe9386 ]
+
+As collective wait operation is required only when NIC ports are
+available, we disable the option to submit a CS in case all the ports
+are disabled, which is the current situation in the upstream driver.
+
+Signed-off-by: Ofir Bitton <obitton@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/command_submission.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c
+index 80c60fb41bbc..d249101106de 100644
+--- a/drivers/misc/habanalabs/common/command_submission.c
++++ b/drivers/misc/habanalabs/common/command_submission.c
+@@ -1727,6 +1727,15 @@ static int cs_ioctl_signal_wait(struct hl_fpriv *hpriv, enum hl_cs_type cs_type,
+ goto free_cs_chunk_array;
+ }
+
++ if (!hdev->nic_ports_mask) {
++ atomic64_inc(&ctx->cs_counters.validation_drop_cnt);
++ atomic64_inc(&cntr->validation_drop_cnt);
++ dev_err(hdev->dev,
++ "Collective operations not supported when NIC ports are disabled");
++ rc = -EINVAL;
++ goto free_cs_chunk_array;
++ }
++
+ collective_engine_id = chunk->collective_engine_id;
+ }
+
+--
+2.33.0
+
--- /dev/null
+From 2a54ce7cbc64f9a184c913fc562eab97ac84baef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Sep 2021 10:25:49 +0300
+Subject: habanalabs/gaudi: fix LBW RR configuration
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit 0a5ff77bf0a94468d541735f919a633f167787e9 ]
+
+Couple of fixes to the LBW RR configuration:
+
+1. Add missing configuration of the SM RR registers in the DMA_IF.
+2. Remove HBW range that doesn't belong.
+3. Add entire gap + DBG area, from end of TPC7 to end of entire
+ DBG space.
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../misc/habanalabs/gaudi/gaudi_security.c | 115 ++++++++++--------
+ 1 file changed, 67 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi_security.c b/drivers/misc/habanalabs/gaudi/gaudi_security.c
+index 0d3240f1f7d7..2b8bafda41bc 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi_security.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi_security.c
+@@ -8,16 +8,21 @@
+ #include "gaudiP.h"
+ #include "../include/gaudi/asic_reg/gaudi_regs.h"
+
+-#define GAUDI_NUMBER_OF_RR_REGS 24
+-#define GAUDI_NUMBER_OF_LBW_RANGES 12
++#define GAUDI_NUMBER_OF_LBW_RR_REGS 28
++#define GAUDI_NUMBER_OF_HBW_RR_REGS 24
++#define GAUDI_NUMBER_OF_LBW_RANGES 10
+
+-static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_HIT_WPROT,
+ mmDMA_IF_W_S_DMA0_HIT_WPROT,
+ mmDMA_IF_W_S_DMA1_HIT_WPROT,
++ mmDMA_IF_E_S_SOB_HIT_WPROT,
+ mmDMA_IF_E_S_DMA0_HIT_WPROT,
+ mmDMA_IF_E_S_DMA1_HIT_WPROT,
++ mmDMA_IF_W_N_SOB_HIT_WPROT,
+ mmDMA_IF_W_N_DMA0_HIT_WPROT,
+ mmDMA_IF_W_N_DMA1_HIT_WPROT,
++ mmDMA_IF_E_N_SOB_HIT_WPROT,
+ mmDMA_IF_E_N_DMA0_HIT_WPROT,
+ mmDMA_IF_E_N_DMA1_HIT_WPROT,
+ mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AW,
+@@ -38,13 +43,17 @@ static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AW,
+ };
+
+-static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_HIT_RPROT,
+ mmDMA_IF_W_S_DMA0_HIT_RPROT,
+ mmDMA_IF_W_S_DMA1_HIT_RPROT,
++ mmDMA_IF_E_S_SOB_HIT_RPROT,
+ mmDMA_IF_E_S_DMA0_HIT_RPROT,
+ mmDMA_IF_E_S_DMA1_HIT_RPROT,
++ mmDMA_IF_W_N_SOB_HIT_RPROT,
+ mmDMA_IF_W_N_DMA0_HIT_RPROT,
+ mmDMA_IF_W_N_DMA1_HIT_RPROT,
++ mmDMA_IF_E_N_SOB_HIT_RPROT,
+ mmDMA_IF_E_N_DMA0_HIT_RPROT,
+ mmDMA_IF_E_N_DMA1_HIT_RPROT,
+ mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AR,
+@@ -65,13 +74,17 @@ static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AR,
+ };
+
+-static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_MIN_WPROT_0,
+ mmDMA_IF_W_S_DMA0_MIN_WPROT_0,
+ mmDMA_IF_W_S_DMA1_MIN_WPROT_0,
++ mmDMA_IF_E_S_SOB_MIN_WPROT_0,
+ mmDMA_IF_E_S_DMA0_MIN_WPROT_0,
+ mmDMA_IF_E_S_DMA1_MIN_WPROT_0,
++ mmDMA_IF_W_N_SOB_MIN_WPROT_0,
+ mmDMA_IF_W_N_DMA0_MIN_WPROT_0,
+ mmDMA_IF_W_N_DMA1_MIN_WPROT_0,
++ mmDMA_IF_E_N_SOB_MIN_WPROT_0,
+ mmDMA_IF_E_N_DMA0_MIN_WPROT_0,
+ mmDMA_IF_E_N_DMA1_MIN_WPROT_0,
+ mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AW_0,
+@@ -92,13 +105,17 @@ static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AW_0,
+ };
+
+-static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_MAX_WPROT_0,
+ mmDMA_IF_W_S_DMA0_MAX_WPROT_0,
+ mmDMA_IF_W_S_DMA1_MAX_WPROT_0,
++ mmDMA_IF_E_S_SOB_MAX_WPROT_0,
+ mmDMA_IF_E_S_DMA0_MAX_WPROT_0,
+ mmDMA_IF_E_S_DMA1_MAX_WPROT_0,
++ mmDMA_IF_W_N_SOB_MAX_WPROT_0,
+ mmDMA_IF_W_N_DMA0_MAX_WPROT_0,
+ mmDMA_IF_W_N_DMA1_MAX_WPROT_0,
++ mmDMA_IF_E_N_SOB_MAX_WPROT_0,
+ mmDMA_IF_E_N_DMA0_MAX_WPROT_0,
+ mmDMA_IF_E_N_DMA1_MAX_WPROT_0,
+ mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AW_0,
+@@ -119,13 +136,17 @@ static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AW_0,
+ };
+
+-static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_MIN_RPROT_0,
+ mmDMA_IF_W_S_DMA0_MIN_RPROT_0,
+ mmDMA_IF_W_S_DMA1_MIN_RPROT_0,
++ mmDMA_IF_E_S_SOB_MIN_RPROT_0,
+ mmDMA_IF_E_S_DMA0_MIN_RPROT_0,
+ mmDMA_IF_E_S_DMA1_MIN_RPROT_0,
++ mmDMA_IF_W_N_SOB_MIN_RPROT_0,
+ mmDMA_IF_W_N_DMA0_MIN_RPROT_0,
+ mmDMA_IF_W_N_DMA1_MIN_RPROT_0,
++ mmDMA_IF_E_N_SOB_MIN_RPROT_0,
+ mmDMA_IF_E_N_DMA0_MIN_RPROT_0,
+ mmDMA_IF_E_N_DMA1_MIN_RPROT_0,
+ mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AR_0,
+@@ -146,13 +167,17 @@ static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AR_0,
+ };
+
+-static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
++ mmDMA_IF_W_S_SOB_MAX_RPROT_0,
+ mmDMA_IF_W_S_DMA0_MAX_RPROT_0,
+ mmDMA_IF_W_S_DMA1_MAX_RPROT_0,
++ mmDMA_IF_E_S_SOB_MAX_RPROT_0,
+ mmDMA_IF_E_S_DMA0_MAX_RPROT_0,
+ mmDMA_IF_E_S_DMA1_MAX_RPROT_0,
++ mmDMA_IF_W_N_SOB_MAX_RPROT_0,
+ mmDMA_IF_W_N_DMA0_MAX_RPROT_0,
+ mmDMA_IF_W_N_DMA1_MAX_RPROT_0,
++ mmDMA_IF_E_N_SOB_MAX_RPROT_0,
+ mmDMA_IF_E_N_DMA0_MAX_RPROT_0,
+ mmDMA_IF_E_N_DMA1_MAX_RPROT_0,
+ mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AR_0,
+@@ -173,7 +198,7 @@ static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AR_0,
+ };
+
+-static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AW,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AW,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AW,
+@@ -200,7 +225,7 @@ static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AW
+ };
+
+-static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AR,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AR,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AR,
+@@ -227,7 +252,7 @@ static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AR
+ };
+
+-static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AW_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
+@@ -254,7 +279,7 @@ static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AW_0
+ };
+
+-static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AW_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
+@@ -281,7 +306,7 @@ static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AW_0
+ };
+
+-static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AW_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
+@@ -308,7 +333,7 @@ static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AW_0
+ };
+
+-static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AW_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
+@@ -335,7 +360,7 @@ static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_HIGH_AW_0
+ };
+
+-static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AR_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
+@@ -362,7 +387,7 @@ static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AR_0
+ };
+
+-static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AR_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
+@@ -389,7 +414,7 @@ static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AR_0
+ };
+
+-static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AR_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
+@@ -416,7 +441,7 @@ static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+ mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AR_0
+ };
+
+-static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
++static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
+ mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
+ mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AR_0,
+ mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
+@@ -12841,50 +12866,44 @@ static void gaudi_init_range_registers_lbw(struct hl_device *hdev)
+ u32 lbw_rng_end[GAUDI_NUMBER_OF_LBW_RANGES];
+ int i, j;
+
+- lbw_rng_start[0] = (0xFBFE0000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[0] = (0xFBFFF000 & 0x3FFFFFF) + 1;
++ lbw_rng_start[0] = (0xFC0E8000 & 0x3FFFFFF) - 1; /* 0x000E7FFF */
++ lbw_rng_end[0] = (0xFC11FFFF & 0x3FFFFFF) + 1; /* 0x00120000 */
+
+- lbw_rng_start[1] = (0xFC0E8000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[1] = (0xFC120000 & 0x3FFFFFF) + 1;
++ lbw_rng_start[1] = (0xFC1E8000 & 0x3FFFFFF) - 1; /* 0x001E7FFF */
++ lbw_rng_end[1] = (0xFC48FFFF & 0x3FFFFFF) + 1; /* 0x00490000 */
+
+- lbw_rng_start[2] = (0xFC1E8000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[2] = (0xFC48FFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[2] = (0xFC600000 & 0x3FFFFFF) - 1; /* 0x005FFFFF */
++ lbw_rng_end[2] = (0xFCC48FFF & 0x3FFFFFF) + 1; /* 0x00C49000 */
+
+- lbw_rng_start[3] = (0xFC600000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[3] = (0xFCC48FFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[3] = (0xFCC4A000 & 0x3FFFFFF) - 1; /* 0x00C49FFF */
++ lbw_rng_end[3] = (0xFCCDFFFF & 0x3FFFFFF) + 1; /* 0x00CE0000 */
+
+- lbw_rng_start[4] = (0xFCC4A000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[4] = (0xFCCDFFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[4] = (0xFCCE4000 & 0x3FFFFFF) - 1; /* 0x00CE3FFF */
++ lbw_rng_end[4] = (0xFCD1FFFF & 0x3FFFFFF) + 1; /* 0x00D20000 */
+
+- lbw_rng_start[5] = (0xFCCE4000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[5] = (0xFCD1FFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[5] = (0xFCD24000 & 0x3FFFFFF) - 1; /* 0x00D23FFF */
++ lbw_rng_end[5] = (0xFCD5FFFF & 0x3FFFFFF) + 1; /* 0x00D60000 */
+
+- lbw_rng_start[6] = (0xFCD24000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[6] = (0xFCD5FFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[6] = (0xFCD64000 & 0x3FFFFFF) - 1; /* 0x00D63FFF */
++ lbw_rng_end[6] = (0xFCD9FFFF & 0x3FFFFFF) + 1; /* 0x00DA0000 */
+
+- lbw_rng_start[7] = (0xFCD64000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[7] = (0xFCD9FFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[7] = (0xFCDA4000 & 0x3FFFFFF) - 1; /* 0x00DA3FFF */
++ lbw_rng_end[7] = (0xFCDDFFFF & 0x3FFFFFF) + 1; /* 0x00DE0000 */
+
+- lbw_rng_start[8] = (0xFCDA4000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[8] = (0xFCDDFFFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[8] = (0xFCDE4000 & 0x3FFFFFF) - 1; /* 0x00DE3FFF */
++ lbw_rng_end[8] = (0xFCE05FFF & 0x3FFFFFF) + 1; /* 0x00E06000 */
+
+- lbw_rng_start[9] = (0xFCDE4000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[9] = (0xFCE05FFF & 0x3FFFFFF) + 1;
++ lbw_rng_start[9] = (0xFCFC9000 & 0x3FFFFFF) - 1; /* 0x00FC8FFF */
++ lbw_rng_end[9] = (0xFFFFFFFE & 0x3FFFFFF) + 1; /* 0x03FFFFFF */
+
+- lbw_rng_start[10] = (0xFEC43000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[10] = (0xFEC43FFF & 0x3FFFFFF) + 1;
+-
+- lbw_rng_start[11] = (0xFE484000 & 0x3FFFFFF) - 1;
+- lbw_rng_end[11] = (0xFE484FFF & 0x3FFFFFF) + 1;
+-
+- for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++ for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++) {
+ WREG32(gaudi_rr_lbw_hit_aw_regs[i],
+ (1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
+ WREG32(gaudi_rr_lbw_hit_ar_regs[i],
+ (1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
+ }
+
+- for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++)
++ for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++)
+ for (j = 0 ; j < GAUDI_NUMBER_OF_LBW_RANGES ; j++) {
+ WREG32(gaudi_rr_lbw_min_aw_regs[i] + (j << 2),
+ lbw_rng_start[j]);
+@@ -12931,12 +12950,12 @@ static void gaudi_init_range_registers_hbw(struct hl_device *hdev)
+ * 6th range is the host
+ */
+
+- for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++ for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
+ WREG32(gaudi_rr_hbw_hit_aw_regs[i], 0x1F);
+ WREG32(gaudi_rr_hbw_hit_ar_regs[i], 0x1D);
+ }
+
+- for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
++ for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
+ WREG32(gaudi_rr_hbw_base_low_aw_regs[i], dram_addr_lo);
+ WREG32(gaudi_rr_hbw_base_low_ar_regs[i], dram_addr_lo);
+
+--
+2.33.0
+
--- /dev/null
+From e0ca417ec987a16f1a43ad64fc148ad9d977c5c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 08:05:18 +0200
+Subject: habanalabs/gaudi: use direct MSI in single mode
+
+From: Omer Shpigelman <oshpigelman@habana.ai>
+
+[ Upstream commit 3e08f157c2587fc7ada93abed41aae19bcbf8a6b ]
+
+Due to FLR scenario when running inside a VM, we must not use indirect
+MSI because it might cause some issues on VM destroy.
+In a VM we use single MSI mode in contrary to multi MSI mode which is
+used in bare-metal.
+Hence direct MSI should be used in single MSI mode only.
+
+Signed-off-by: Omer Shpigelman <oshpigelman@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 9 ++++++---
+ .../misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h | 2 ++
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 409f05c962f2..8a9c4f0f37f9 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -5620,6 +5620,7 @@ static void gaudi_add_end_of_cb_packets(struct hl_device *hdev,
+ {
+ struct gaudi_device *gaudi = hdev->asic_specific;
+ struct packet_msg_prot *cq_pkt;
++ u64 msi_addr;
+ u32 tmp;
+
+ cq_pkt = kernel_address + len - (sizeof(struct packet_msg_prot) * 2);
+@@ -5641,10 +5642,12 @@ static void gaudi_add_end_of_cb_packets(struct hl_device *hdev,
+ cq_pkt->ctl = cpu_to_le32(tmp);
+ cq_pkt->value = cpu_to_le32(1);
+
+- if (!gaudi->multi_msi_mode)
+- msi_vec = 0;
++ if (gaudi->multi_msi_mode)
++ msi_addr = mmPCIE_MSI_INTR_0 + msi_vec * 4;
++ else
++ msi_addr = mmPCIE_CORE_MSI_REQ;
+
+- cq_pkt->addr = cpu_to_le64(CFG_BASE + mmPCIE_MSI_INTR_0 + msi_vec * 4);
++ cq_pkt->addr = cpu_to_le64(CFG_BASE + msi_addr);
+ }
+
+ static void gaudi_update_eq_ci(struct hl_device *hdev, u32 val)
+diff --git a/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h b/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
+index 5bb54b34a8ae..907644202b0c 100644
+--- a/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
++++ b/drivers/misc/habanalabs/include/gaudi/asic_reg/gaudi_regs.h
+@@ -305,6 +305,8 @@
+ #define mmPCIE_AUX_FLR_CTRL 0xC07394
+ #define mmPCIE_AUX_DBI 0xC07490
+
++#define mmPCIE_CORE_MSI_REQ 0xC04100
++
+ #define mmPSOC_PCI_PLL_NR 0xC72100
+ #define mmSRAM_W_PLL_NR 0x4C8100
+ #define mmPSOC_HBM_PLL_NR 0xC74100
+--
+2.33.0
+
--- /dev/null
+From cfcd1a38f6c74d200c718354da9be37da0875dfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 07:12:27 -0600
+Subject: io_uring: allow conditional reschedule for intensive iterators
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 8bab4c09f24ec8d4a7a78ab343620f89d3a24804 ]
+
+If we have a lot of threads and rings, the tctx list can get quite big.
+This is especially true if we keep creating new threads and rings.
+Likewise for the provided buffers list. Be nice and insert a conditional
+reschedule point while iterating the nodes for deletion.
+
+Link: https://lore.kernel.org/io-uring/00000000000064b6b405ccb41113@google.com/
+Reported-by: syzbot+111d2a03f51f5ae73775@syzkaller.appspotmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 699a08d724c2..675216f7022d 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8648,8 +8648,10 @@ static void io_destroy_buffers(struct io_ring_ctx *ctx)
+ struct io_buffer *buf;
+ unsigned long index;
+
+- xa_for_each(&ctx->io_buffers, index, buf)
++ xa_for_each(&ctx->io_buffers, index, buf) {
+ __io_remove_buffers(ctx, buf, index, -1U);
++ cond_resched();
++ }
+ }
+
+ static void io_req_cache_free(struct list_head *list, struct task_struct *tsk)
+@@ -9145,8 +9147,10 @@ static void io_uring_clean_tctx(struct io_uring_task *tctx)
+ struct io_tctx_node *node;
+ unsigned long index;
+
+- xa_for_each(&tctx->xa, index, node)
++ xa_for_each(&tctx->xa, index, node) {
+ io_uring_del_tctx_node(index);
++ cond_resched();
++ }
+ if (wq) {
+ /*
+ * Must be after io_uring_del_task_file() (removes nodes under
+--
+2.33.0
+
--- /dev/null
+From d894630db499a6c981460ebfa69aa220e8f99f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Sep 2021 18:29:25 +0100
+Subject: irqchip/gic: Work around broken Renesas integration
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit b78f26926b17cc289e4f16b63363abe0aa2e8efc ]
+
+Geert reported that the GIC driver locks up on a Renesas system
+since 005c34ae4b44f085 ("irqchip/gic: Atomically update affinity")
+fixed the driver to use writeb_relaxed() instead of writel_relaxed().
+
+As it turns out, the interconnect used on this system mandates
+32bit wide accesses for all MMIO transactions, even if the GIC
+architecture specifically mandates for some registers to be byte
+accessible. Gahhh...
+
+Work around the issue by crudly detecting the offending system,
+and falling back to an inefficient RMW+lock implementation.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/CAMuHMdV+Ev47K5NO8XHsanSq5YRMCHn2gWAQyV-q2LpJVy9HiQ@mail.gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic.c | 52 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index d329ec3d64d8..5f22c9d65e57 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -107,6 +107,8 @@ static DEFINE_RAW_SPINLOCK(cpu_map_lock);
+
+ #endif
+
++static DEFINE_STATIC_KEY_FALSE(needs_rmw_access);
++
+ /*
+ * The GIC mapping of CPU interfaces does not necessarily match
+ * the logical CPU numbering. Let's use a mapping as returned
+@@ -774,6 +776,25 @@ static int gic_pm_init(struct gic_chip_data *gic)
+ #endif
+
+ #ifdef CONFIG_SMP
++static void rmw_writeb(u8 bval, void __iomem *addr)
++{
++ static DEFINE_RAW_SPINLOCK(rmw_lock);
++ unsigned long offset = (unsigned long)addr & 3UL;
++ unsigned long shift = offset * 8;
++ unsigned long flags;
++ u32 val;
++
++ raw_spin_lock_irqsave(&rmw_lock, flags);
++
++ addr -= offset;
++ val = readl_relaxed(addr);
++ val &= ~GENMASK(shift + 7, shift);
++ val |= bval << shift;
++ writel_relaxed(val, addr);
++
++ raw_spin_unlock_irqrestore(&rmw_lock, flags);
++}
++
+ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ bool force)
+ {
+@@ -788,7 +809,10 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
+ return -EINVAL;
+
+- writeb_relaxed(gic_cpu_map[cpu], reg);
++ if (static_branch_unlikely(&needs_rmw_access))
++ rmw_writeb(gic_cpu_map[cpu], reg);
++ else
++ writeb_relaxed(gic_cpu_map[cpu], reg);
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
+ return IRQ_SET_MASK_OK_DONE;
+@@ -1375,6 +1399,30 @@ static bool gic_check_eoimode(struct device_node *node, void __iomem **base)
+ return true;
+ }
+
++static bool gic_enable_rmw_access(void *data)
++{
++ /*
++ * The EMEV2 class of machines has a broken interconnect, and
++ * locks up on accesses that are less than 32bit. So far, only
++ * the affinity setting requires it.
++ */
++ if (of_machine_is_compatible("renesas,emev2")) {
++ static_branch_enable(&needs_rmw_access);
++ return true;
++ }
++
++ return false;
++}
++
++static const struct gic_quirk gic_quirks[] = {
++ {
++ .desc = "broken byte access",
++ .compatible = "arm,pl390",
++ .init = gic_enable_rmw_access,
++ },
++ { },
++};
++
+ static int gic_of_setup(struct gic_chip_data *gic, struct device_node *node)
+ {
+ if (!gic || !node)
+@@ -1391,6 +1439,8 @@ static int gic_of_setup(struct gic_chip_data *gic, struct device_node *node)
+ if (of_property_read_u32(node, "cpu-offset", &gic->percpu_offset))
+ gic->percpu_offset = 0;
+
++ gic_enable_of_quirks(node, gic_quirks, gic);
++
+ return 0;
+
+ error:
+--
+2.33.0
+
--- /dev/null
+From e9b6e780a163c5f44cd54b03e84304c034027417 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 15:44:00 -0700
+Subject: kasan: always respect CONFIG_KASAN_STACK
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 19532869feb9b0a97d17ddc14609d1e53a5b60db ]
+
+Currently, the asan-stack parameter is only passed along if
+CFLAGS_KASAN_SHADOW is not empty, which requires KASAN_SHADOW_OFFSET to
+be defined in Kconfig so that the value can be checked. In RISC-V's
+case, KASAN_SHADOW_OFFSET is not defined in Kconfig, which means that
+asan-stack does not get disabled with clang even when CONFIG_KASAN_STACK
+is disabled, resulting in large stack warnings with allmodconfig:
+
+ drivers/video/fbdev/omap2/omapfb/displays/panel-lgphilips-lb035q02.c:117:12: error: stack frame size (14400) exceeds limit (2048) in function 'lb035q02_connect' [-Werror,-Wframe-larger-than]
+ static int lb035q02_connect(struct omap_dss_device *dssdev)
+ ^
+ 1 error generated.
+
+Ensure that the value of CONFIG_KASAN_STACK is always passed along to
+the compiler so that these warnings do not happen when
+CONFIG_KASAN_STACK is disabled.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/1453
+References: 6baec880d7a5 ("kasan: turn off asan-stack for clang-8 and earlier")
+Link: https://lkml.kernel.org/r/20210922205525.570068-1-nathan@kernel.org
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Marco Elver <elver@google.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.kasan | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/Makefile.kasan b/scripts/Makefile.kasan
+index 801c415bac59..b9e94c5e7097 100644
+--- a/scripts/Makefile.kasan
++++ b/scripts/Makefile.kasan
+@@ -33,10 +33,11 @@ else
+ CFLAGS_KASAN := $(CFLAGS_KASAN_SHADOW) \
+ $(call cc-param,asan-globals=1) \
+ $(call cc-param,asan-instrumentation-with-call-threshold=$(call_threshold)) \
+- $(call cc-param,asan-stack=$(stack_enable)) \
+ $(call cc-param,asan-instrument-allocas=1)
+ endif
+
++CFLAGS_KASAN += $(call cc-param,asan-stack=$(stack_enable))
++
+ endif # CONFIG_KASAN_GENERIC
+
+ ifdef CONFIG_KASAN_SW_TAGS
+--
+2.33.0
+
--- /dev/null
+From b0d85bfc39b2af2b76ab37c46922912204f70c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 12:11:00 +0900
+Subject: KVM: do not shrink halt_poll_ns below grow_start
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit ae232ea460888dc5a8b37e840c553b02521fbf18 ]
+
+grow_halt_poll_ns() ignores values between 0 and
+halt_poll_ns_grow_start (10000 by default). However,
+when we shrink halt_poll_ns we may fall way below
+halt_poll_ns_grow_start and endup with halt_poll_ns
+values that don't make a lot of sense: like 1 or 9,
+or 19.
+
+VCPU1 trace (halt_poll_ns_shrink equals 2):
+
+VCPU1 grow 10000
+VCPU1 shrink 5000
+VCPU1 shrink 2500
+VCPU1 shrink 1250
+VCPU1 shrink 625
+VCPU1 shrink 312
+VCPU1 shrink 156
+VCPU1 shrink 78
+VCPU1 shrink 39
+VCPU1 shrink 19
+VCPU1 shrink 9
+VCPU1 shrink 4
+
+Mirror what grow_halt_poll_ns() does and set halt_poll_ns
+to 0 as soon as new shrink-ed halt_poll_ns value falls
+below halt_poll_ns_grow_start.
+
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Message-Id: <20210902031100.252080-1-senozhatsky@chromium.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ virt/kvm/kvm_main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index b50dbe269f4b..1a11dcb670a3 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3053,15 +3053,19 @@ out:
+
+ static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
+ {
+- unsigned int old, val, shrink;
++ unsigned int old, val, shrink, grow_start;
+
+ old = val = vcpu->halt_poll_ns;
+ shrink = READ_ONCE(halt_poll_ns_shrink);
++ grow_start = READ_ONCE(halt_poll_ns_grow_start);
+ if (shrink == 0)
+ val = 0;
+ else
+ val /= shrink;
+
++ if (val < grow_start)
++ val = 0;
++
+ vcpu->halt_poll_ns = val;
+ trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
+ }
+--
+2.33.0
+
--- /dev/null
+From 8b8860870740aaabcdbf8f045ab767c8a1ace5b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 13:39:50 +0000
+Subject: kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[]
+
+From: Fares Mehanna <faresx@amazon.de>
+
+[ Upstream commit e1fc1553cd78292ab3521c94c9dd6e3e70e606a1 ]
+
+Intel PMU MSRs is in msrs_to_save_all[], so add AMD PMU MSRs to have a
+consistent behavior between Intel and AMD when using KVM_GET_MSRS,
+KVM_SET_MSRS or KVM_GET_MSR_INDEX_LIST.
+
+We have to add legacy and new MSRs to handle guests running without
+X86_FEATURE_PERFCTR_CORE.
+
+Signed-off-by: Fares Mehanna <faresx@amazon.de>
+Message-Id: <20210915133951.22389-1-faresx@amazon.de>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/x86.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 07d3d8aa50a9..4b0e866e9f08 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1327,6 +1327,13 @@ static const u32 msrs_to_save_all[] = {
+ MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13,
+ MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15,
+ MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17,
++
++ MSR_K7_EVNTSEL0, MSR_K7_EVNTSEL1, MSR_K7_EVNTSEL2, MSR_K7_EVNTSEL3,
++ MSR_K7_PERFCTR0, MSR_K7_PERFCTR1, MSR_K7_PERFCTR2, MSR_K7_PERFCTR3,
++ MSR_F15H_PERF_CTL0, MSR_F15H_PERF_CTL1, MSR_F15H_PERF_CTL2,
++ MSR_F15H_PERF_CTL3, MSR_F15H_PERF_CTL4, MSR_F15H_PERF_CTL5,
++ MSR_F15H_PERF_CTR0, MSR_F15H_PERF_CTR1, MSR_F15H_PERF_CTR2,
++ MSR_F15H_PERF_CTR3, MSR_F15H_PERF_CTR4, MSR_F15H_PERF_CTR5,
+ };
+
+ static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_all)];
+--
+2.33.0
+
--- /dev/null
+From 67e583ebcae484b2bc109132fe001754e4dfa1fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 18:48:12 +0300
+Subject: KVM: x86: nSVM: restore int_vector in svm_clear_vintr
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+[ Upstream commit aee77e1169c1900fe4248dc186962e745b479d9e ]
+
+In svm_clear_vintr we try to restore the virtual interrupt
+injection that might be pending, but we fail to restore
+the interrupt vector.
+
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Message-Id: <20210914154825.104886-2-mlevitsk@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index 69639f9624f5..19d6ffdd3f73 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -1601,6 +1601,8 @@ static void svm_clear_vintr(struct vcpu_svm *svm)
+
+ svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
+ V_IRQ_INJECTION_BITS_MASK;
++
++ svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
+ }
+
+ vmcb_mark_dirty(svm->vmcb, VMCB_INTR);
+--
+2.33.0
+
--- /dev/null
+From fa9f348a1816c17c93b90437895d0bb27c7fc971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Sep 2021 17:09:50 +0300
+Subject: KVM: x86: reset pdptrs_from_userspace when exiting smm
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+[ Upstream commit 37687c403a641f251cb2ef2e7830b88aa0647ba9 ]
+
+When exiting SMM, pdpts are loaded again from the guest memory.
+
+This fixes a theoretical bug, when exit from SMM triggers entry to the
+nested guest which re-uses some of the migration
+code which uses this flag as a workaround for a legacy userspace.
+
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Message-Id: <20210913140954.165665-4-mlevitsk@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/x86.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 6d5d6e93f5c4..07d3d8aa50a9 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7659,6 +7659,13 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu, bool entering_smm)
+
+ /* Process a latched INIT or SMI, if any. */
+ kvm_make_request(KVM_REQ_EVENT, vcpu);
++
++ /*
++ * Even if KVM_SET_SREGS2 loaded PDPTRs out of band,
++ * on SMM exit we still need to reload them from
++ * guest memory
++ */
++ vcpu->arch.pdptrs_from_userspace = false;
+ }
+
+ kvm_mmu_reset_context(vcpu);
+--
+2.33.0
+
--- /dev/null
+From 5a5764d9f7ba190bc44cbb119fb6e970bc0c42d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 16:34:32 +0300
+Subject: net: mdio: introduce a shutdown method to mdio device drivers
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit cf9579976f724ad517cc15b7caadea728c7e245c ]
+
+MDIO-attached devices might have interrupts and other things that might
+need quiesced when we kexec into a new kernel. Things are even more
+creepy when those interrupt lines are shared, and in that case it is
+absolutely mandatory to disable all interrupt sources.
+
+Moreover, MDIO devices might be DSA switches, and DSA needs its own
+shutdown method to unlink from the DSA master, which is a new
+requirement that appeared after commit 2f1e8ea726e9 ("net: dsa: link
+interfaces with the DSA master to get rid of lockdep warnings").
+
+So introduce a ->shutdown method in the MDIO device driver structure.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio_device.c | 11 +++++++++++
+ include/linux/mdio.h | 3 +++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
+index c94cb5382dc9..250742ffdfd9 100644
+--- a/drivers/net/phy/mdio_device.c
++++ b/drivers/net/phy/mdio_device.c
+@@ -179,6 +179,16 @@ static int mdio_remove(struct device *dev)
+ return 0;
+ }
+
++static void mdio_shutdown(struct device *dev)
++{
++ struct mdio_device *mdiodev = to_mdio_device(dev);
++ struct device_driver *drv = mdiodev->dev.driver;
++ struct mdio_driver *mdiodrv = to_mdio_driver(drv);
++
++ if (mdiodrv->shutdown)
++ mdiodrv->shutdown(mdiodev);
++}
++
+ /**
+ * mdio_driver_register - register an mdio_driver with the MDIO layer
+ * @drv: new mdio_driver to register
+@@ -193,6 +203,7 @@ int mdio_driver_register(struct mdio_driver *drv)
+ mdiodrv->driver.bus = &mdio_bus_type;
+ mdiodrv->driver.probe = mdio_probe;
+ mdiodrv->driver.remove = mdio_remove;
++ mdiodrv->driver.shutdown = mdio_shutdown;
+
+ retval = driver_register(&mdiodrv->driver);
+ if (retval) {
+diff --git a/include/linux/mdio.h b/include/linux/mdio.h
+index ffb787d5ebde..5e6dc38f418e 100644
+--- a/include/linux/mdio.h
++++ b/include/linux/mdio.h
+@@ -80,6 +80,9 @@ struct mdio_driver {
+
+ /* Clears up any memory if needed */
+ void (*remove)(struct mdio_device *mdiodev);
++
++ /* Quiesces the device on system shutdown, turns off interrupts etc */
++ void (*shutdown)(struct mdio_device *mdiodev);
+ };
+
+ static inline struct mdio_driver *
+--
+2.33.0
+
--- /dev/null
+From 5b8d14945fbe1c2253721b9b5dbf4d36fa83f644 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 14:22:12 -0400
+Subject: nfsd: back channel stuck in SEQ4_STATUS_CB_PATH_DOWN
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 02579b2ff8b0becfb51d85a975908ac4ab15fba8 ]
+
+When the back channel enters SEQ4_STATUS_CB_PATH_DOWN state, the client
+recovers by sending BIND_CONN_TO_SESSION but the server fails to recover
+the back channel and leaves it as NFSD4_CB_DOWN.
+
+Fix by enhancing nfsd4_bind_conn_to_session to probe the back channel
+by calling nfsd4_probe_callback.
+
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 3d805f5b1f5d..1c33a5255893 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3570,7 +3570,7 @@ static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_s
+ }
+
+ static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
+- struct nfsd4_session *session, u32 req)
++ struct nfsd4_session *session, u32 req, struct nfsd4_conn **conn)
+ {
+ struct nfs4_client *clp = session->se_client;
+ struct svc_xprt *xpt = rqst->rq_xprt;
+@@ -3593,6 +3593,8 @@ static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
+ else
+ status = nfserr_inval;
+ spin_unlock(&clp->cl_lock);
++ if (status == nfs_ok && conn)
++ *conn = c;
+ return status;
+ }
+
+@@ -3617,8 +3619,16 @@ __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
+ status = nfserr_wrong_cred;
+ if (!nfsd4_mach_creds_match(session->se_client, rqstp))
+ goto out;
+- status = nfsd4_match_existing_connection(rqstp, session, bcts->dir);
+- if (status == nfs_ok || status == nfserr_inval)
++ status = nfsd4_match_existing_connection(rqstp, session,
++ bcts->dir, &conn);
++ if (status == nfs_ok) {
++ if (bcts->dir == NFS4_CDFC4_FORE_OR_BOTH ||
++ bcts->dir == NFS4_CDFC4_BACK)
++ conn->cn_flags |= NFS4_CDFC4_BACK;
++ nfsd4_probe_callback(session->se_client);
++ goto out;
++ }
++ if (status == nfserr_inval)
+ goto out;
+ status = nfsd4_map_bcts_dir(&bcts->dir);
+ if (status)
+--
+2.33.0
+
--- /dev/null
+From 2acb2419a7220bf5cad1aa0e94b0101c5210985d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 11:20:07 +0200
+Subject: nvme-fc: avoid race between time out and tear down
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit e5445dae29d25d7b03e0a10d3d4277a1d0c8119b ]
+
+To avoid race between time out and tear down, in tear down process,
+first we quiesce the queue, and then delete the timer and cancel
+the time out work for the queue.
+
+This patch merges the admin and io sync ops into the queue teardown logic
+as shown in the RDMA patch 3017013dcc "nvme-rdma: avoid race between time
+out and tear down". There is no teardown_lock in nvme-fc.
+
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Tested-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index b5d9a5507de5..6ebe68396712 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -2487,6 +2487,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues)
+ */
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
+ blk_mq_tagset_busy_iter(&ctrl->tag_set,
+ nvme_fc_terminate_exchange, &ctrl->ctrl);
+ blk_mq_tagset_wait_completed_request(&ctrl->tag_set);
+@@ -2510,6 +2511,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues)
+ * clean up the admin queue. Same thing as above.
+ */
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
+ nvme_fc_terminate_exchange, &ctrl->ctrl);
+ blk_mq_tagset_wait_completed_request(&ctrl->admin_tag_set);
+--
+2.33.0
+
--- /dev/null
+From 1299bcb5549f1fdf002a3a642c04bdccfefd438c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Sep 2021 11:20:06 +0200
+Subject: nvme-fc: update hardware queues before using them
+
+From: Daniel Wagner <dwagner@suse.de>
+
+[ Upstream commit 555f66d0f8a38537456acc77043d0e4469fcbe8e ]
+
+In case the number of hardware queues changes, we need to update the
+tagset and the mapping of ctx to hctx first.
+
+If we try to create and connect the I/O queues first, this operation
+will fail (target will reject the connect call due to the wrong number
+of queues) and hence we bail out of the recreate function. Then we
+will to try the very same operation again, thus we don't make any
+progress.
+
+Signed-off-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fc.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index b08a61ca283f..b5d9a5507de5 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -2951,14 +2951,6 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
+ if (ctrl->ctrl.queue_count == 1)
+ return 0;
+
+- ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+- if (ret)
+- goto out_free_io_queues;
+-
+- ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+- if (ret)
+- goto out_delete_hw_queues;
+-
+ if (prior_ioq_cnt != nr_io_queues) {
+ dev_info(ctrl->ctrl.device,
+ "reconnect: revising io queue count from %d to %d\n",
+@@ -2968,6 +2960,14 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
+ nvme_unfreeze(&ctrl->ctrl);
+ }
+
++ ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
++ if (ret)
++ goto out_free_io_queues;
++
++ ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
++ if (ret)
++ goto out_delete_hw_queues;
++
+ return 0;
+
+ out_delete_hw_queues:
+--
+2.33.0
+
--- /dev/null
+From 76417a5933a37cee1051e03e9344292c1adca7af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 12:07:02 +0200
+Subject: platform/x86: gigabyte-wmi: add support for B550I Aorus Pro AX
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+
+[ Upstream commit 6f6aab1caf6c7fef46852aaab03f4e8250779e52 ]
+
+Tested with a AMD Ryzen 7 5800X.
+
+Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de>
+Acked-by: Thomas Weißschuh <thomas@weissschuh.net>
+Link: https://lore.kernel.org/r/20210921100702.3838-1-tjakobi@math.uni-bielefeld.de
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gigabyte-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/gigabyte-wmi.c b/drivers/platform/x86/gigabyte-wmi.c
+index 7f3a03f937f6..d53634c8a6e0 100644
+--- a/drivers/platform/x86/gigabyte-wmi.c
++++ b/drivers/platform/x86/gigabyte-wmi.c
+@@ -144,6 +144,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 AORUS ELITE V2"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550 GAMING X V2"),
++ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550I AORUS PRO AX"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550M AORUS PRO-P"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("B550M DS3H"),
+ DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z390 I AORUS PRO WIFI-CF"),
+--
+2.33.0
+
--- /dev/null
+From 2d7b7789f285429769df70a76ecb59d1148c8c55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 15:02:09 +0200
+Subject: platform/x86: touchscreen_dmi: Add info for the Chuwi HiBook (CWI514)
+ tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 3bf1669b0e033c885ebcb1ddc2334088dd125f2d ]
+
+Add touchscreen info for the Chuwi HiBook (CWI514) tablet. This includes
+info for getting the firmware directly from the UEFI, so that the user does
+not need to manually install the firmware in /lib/firmware/silead.
+
+This change will make the touchscreen on these devices work OOTB,
+without requiring any manual setup.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210905130210.32810-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/touchscreen_dmi.c | 37 ++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index 0e1451b1d9c6..1f9cb756b103 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -141,6 +141,33 @@ static const struct ts_dmi_data chuwi_hi10_pro_data = {
+ .properties = chuwi_hi10_pro_props,
+ };
+
++static const struct property_entry chuwi_hibook_props[] = {
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 30),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 4),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1892),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1276),
++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hibook.fw"),
++ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++ PROPERTY_ENTRY_BOOL("silead,home-button"),
++ { }
++};
++
++static const struct ts_dmi_data chuwi_hibook_data = {
++ .embedded_fw = {
++ .name = "silead/gsl1680-chuwi-hibook.fw",
++ .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
++ .length = 40392,
++ .sha256 = { 0xf7, 0xc0, 0xe8, 0x5a, 0x6c, 0xf2, 0xeb, 0x8d,
++ 0x12, 0xc4, 0x45, 0xbf, 0x55, 0x13, 0x4c, 0x1a,
++ 0x13, 0x04, 0x31, 0x08, 0x65, 0x73, 0xf7, 0xa8,
++ 0x1b, 0x7d, 0x59, 0xc9, 0xe6, 0x97, 0xf7, 0x38 },
++ },
++ .acpi_name = "MSSL0017:00",
++ .properties = chuwi_hibook_props,
++};
++
+ static const struct property_entry chuwi_vi8_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
+ PROPERTY_ENTRY_U32("touchscreen-min-y", 6),
+@@ -979,6 +1006,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+ },
+ },
++ {
++ /* Chuwi HiBook (CWI514) */
++ .driver_data = (void *)&chuwi_hibook_data,
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
++ DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ /* Above matches are too generic, add bios-date match */
++ DMI_MATCH(DMI_BIOS_DATE, "05/07/2016"),
++ },
++ },
+ {
+ /* Chuwi Vi8 (CWI506) */
+ .driver_data = (void *)&chuwi_vi8_data,
+--
+2.33.0
+
--- /dev/null
+From eeee7d491c186adc2573965b0e0a8b733cf504e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 15:02:10 +0200
+Subject: platform/x86: touchscreen_dmi: Update info for the Chuwi Hi10 Plus
+ (CWI527) tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 196159d278ae3b49e7bbb7c76822e6008fd89b97 ]
+
+Add info for getting the firmware directly from the UEFI for the Chuwi Hi10
+Plus (CWI527), so that the user does not need to manually install the
+firmware in /lib/firmware/silead.
+
+This change will make the touchscreen on these devices work OOTB,
+without requiring any manual setup.
+
+Also tweak the min and width/height values a bit for more accurate position
+reporting.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210905130210.32810-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/touchscreen_dmi.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index 1f9cb756b103..033f797861d8 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -100,10 +100,10 @@ static const struct ts_dmi_data chuwi_hi10_air_data = {
+ };
+
+ static const struct property_entry chuwi_hi10_plus_props[] = {
+- PROPERTY_ENTRY_U32("touchscreen-min-x", 0),
+- PROPERTY_ENTRY_U32("touchscreen-min-y", 5),
+- PROPERTY_ENTRY_U32("touchscreen-size-x", 1914),
+- PROPERTY_ENTRY_U32("touchscreen-size-y", 1283),
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 12),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 10),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1908),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1270),
+ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hi10plus.fw"),
+ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+ PROPERTY_ENTRY_BOOL("silead,home-button"),
+@@ -111,6 +111,15 @@ static const struct property_entry chuwi_hi10_plus_props[] = {
+ };
+
+ static const struct ts_dmi_data chuwi_hi10_plus_data = {
++ .embedded_fw = {
++ .name = "silead/gsl1680-chuwi-hi10plus.fw",
++ .prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
++ .length = 34056,
++ .sha256 = { 0xfd, 0x0a, 0x08, 0x08, 0x3c, 0xa6, 0x34, 0x4e,
++ 0x2c, 0x49, 0x9c, 0xcd, 0x7d, 0x44, 0x9d, 0x38,
++ 0x10, 0x68, 0xb5, 0xbd, 0xb7, 0x2a, 0x63, 0xb5,
++ 0x67, 0x0b, 0x96, 0xbd, 0x89, 0x67, 0x85, 0x09 },
++ },
+ .acpi_name = "MSSL0017:00",
+ .properties = chuwi_hi10_plus_props,
+ };
+--
+2.33.0
+
--- /dev/null
+From 946e4f971b313410b4ee4f6a2482a41eae6c68fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 09:52:25 -0700
+Subject: scsi: elx: efct: Do not hold lock while calling fc_vport_terminate()
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 450907424d9ebcc28fab42a065c3cddce49ee97d ]
+
+Smatch checker reported the following error:
+
+ drivers/base/power/sysfs.c:833 dpm_sysfs_remove()
+ warn: sleeping in atomic context
+
+With a calling sequence of:
+
+ efct_lio_npiv_drop_nport() <- disables preempt
+ -> fc_vport_terminate()
+ -> device_del()
+ -> dpm_sysfs_remove()
+
+Issue is efct_lio_npiv_drop_nport() is making the fc_vport_terminate() call
+while holding a lock w/ ipl raised.
+
+It is unnecessary to hold the lock over this call, shift where the lock is
+taken.
+
+Link: https://lore.kernel.org/r/20210907165225.10821-1-jsmart2021@gmail.com
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Co-developed-by: Ram Vegesna <ram.vegesna@broadcom.com>
+Signed-off-by: Ram Vegesna <ram.vegesna@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/elx/efct/efct_lio.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/elx/efct/efct_lio.c b/drivers/scsi/elx/efct/efct_lio.c
+index e0d798d6baee..f1d6fcfe12f0 100644
+--- a/drivers/scsi/elx/efct/efct_lio.c
++++ b/drivers/scsi/elx/efct/efct_lio.c
+@@ -880,11 +880,11 @@ efct_lio_npiv_drop_nport(struct se_wwn *wwn)
+ struct efct *efct = lio_vport->efct;
+ unsigned long flags = 0;
+
+- spin_lock_irqsave(&efct->tgt_efct.efct_lio_lock, flags);
+-
+ if (lio_vport->fc_vport)
+ fc_vport_terminate(lio_vport->fc_vport);
+
++ spin_lock_irqsave(&efct->tgt_efct.efct_lio_lock, flags);
++
+ list_for_each_entry_safe(vport, next_vport, &efct->tgt_efct.vport_list,
+ list_entry) {
+ if (vport->lio_vport == lio_vport) {
+--
+2.33.0
+
--- /dev/null
+From 85d5b265708c26759e7f4f2a61a8446ba37e40cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Sep 2021 17:01:12 +0800
+Subject: scsi: sd: Free scsi_disk device via put_device()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 265dfe8ebbabae7959060bd1c3f75c2473b697ed ]
+
+After a device is initialized via device_initialize() it should be freed
+via put_device(). sd_probe() currently gets this wrong, fix it up.
+
+Link: https://lore.kernel.org/r/20210906090112.531442-1-ming.lei@redhat.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sd.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index b8d55af763f9..134c7a8145ef 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -3441,15 +3441,16 @@ static int sd_probe(struct device *dev)
+ }
+
+ device_initialize(&sdkp->dev);
+- sdkp->dev.parent = dev;
++ sdkp->dev.parent = get_device(dev);
+ sdkp->dev.class = &sd_disk_class;
+ dev_set_name(&sdkp->dev, "%s", dev_name(dev));
+
+ error = device_add(&sdkp->dev);
+- if (error)
+- goto out_free_index;
++ if (error) {
++ put_device(&sdkp->dev);
++ goto out;
++ }
+
+- get_device(dev);
+ dev_set_drvdata(dev, sdkp);
+
+ gd->major = sd_major((index & 0xf0) >> 4);
+--
+2.33.0
+
--- /dev/null
+From 142ad785f2b9b0f4143b9a62b4422aa1becb6a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 22:24:21 -0500
+Subject: scsi: ses: Retry failed Send/Receive Diagnostic commands
+
+From: Wen Xiong <wenxiong@linux.ibm.com>
+
+[ Upstream commit fbdac19e642899455b4e64c63aafe2325df7aafa ]
+
+Setting SCSI logging level with error=3, we saw some errors from enclosues:
+
+[108017.360833] ses 0:0:9:0: tag#641 Done: NEEDS_RETRY Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s
+[108017.360838] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00
+[108017.427778] ses 0:0:9:0: Power-on or device reset occurred
+[108017.427784] ses 0:0:9:0: tag#641 Done: SUCCESS Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
+[108017.427788] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00
+[108017.427791] ses 0:0:9:0: tag#641 Sense Key : Unit Attention [current]
+[108017.427793] ses 0:0:9:0: tag#641 Add. Sense: Bus device reset function occurred
+[108017.427801] ses 0:0:9:0: Failed to get diagnostic page 0x1
+[108017.427804] ses 0:0:9:0: Failed to bind enclosure -19
+[108017.427895] ses 0:0:10:0: Attached Enclosure device
+[108017.427942] ses 0:0:10:0: Attached scsi generic sg18 type 13
+
+Retry if the Send/Receive Diagnostic commands complete with a transient
+error status (NOT_READY or UNIT_ATTENTION with ASC 0x29).
+
+Link: https://lore.kernel.org/r/1631849061-10210-2-git-send-email-wenxiong@linux.ibm.com
+Reviewed-by: Brian King <brking@linux.ibm.com>
+Reviewed-by: James Bottomley <jejb@linux.ibm.com>
+Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ses.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index c2afba2a5414..43e682297fd5 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -87,9 +87,16 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ 0
+ };
+ unsigned char recv_page_code;
++ unsigned int retries = SES_RETRIES;
++ struct scsi_sense_hdr sshdr;
++
++ do {
++ ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
++ &sshdr, SES_TIMEOUT, 1, NULL);
++ } while (ret > 0 && --retries && scsi_sense_valid(&sshdr) &&
++ (sshdr.sense_key == NOT_READY ||
++ (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+
+- ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+- NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+ if (unlikely(ret))
+ return ret;
+
+@@ -121,9 +128,16 @@ static int ses_send_diag(struct scsi_device *sdev, int page_code,
+ bufflen & 0xff,
+ 0
+ };
++ struct scsi_sense_hdr sshdr;
++ unsigned int retries = SES_RETRIES;
++
++ do {
++ result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
++ &sshdr, SES_TIMEOUT, 1, NULL);
++ } while (result > 0 && --retries && scsi_sense_valid(&sshdr) &&
++ (sshdr.sense_key == NOT_READY ||
++ (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
+
+- result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
+- NULL, SES_TIMEOUT, SES_RETRIES, NULL);
+ if (result)
+ sdev_printk(KERN_ERR, sdev, "SEND DIAGNOSTIC result: %8x\n",
+ result);
+--
+2.33.0
+
--- /dev/null
+From 383cd0de1c6b95d6406aca22c1ece4669fc235c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 21:45:54 +0800
+Subject: selftests: be sure to make khdr before other targets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Li Zhijian <lizhijian@cn.fujitsu.com>
+
+[ Upstream commit 8914a7a247e065438a0ec86a58c1c359223d2c9e ]
+
+LKP/0Day reported some building errors about kvm, and errors message
+are not always same:
+- lib/x86_64/processor.c:1083:31: error: ‘KVM_CAP_NESTED_STATE’ undeclared
+(first use in this function); did you mean ‘KVM_CAP_PIT_STATE2’?
+- lib/test_util.c:189:30: error: ‘MAP_HUGE_16KB’ undeclared (first use
+in this function); did you mean ‘MAP_HUGE_16GB’?
+
+Although kvm relies on the khdr, they still be built in parallel when -j
+is specified. In this case, it will cause compiling errors.
+
+Here we mark target khdr as NOTPARALLEL to make it be always built
+first.
+
+CC: Philip Li <philip.li@intel.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/lib.mk | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
+index fa2ac0e56b43..fe7ee2b0f29c 100644
+--- a/tools/testing/selftests/lib.mk
++++ b/tools/testing/selftests/lib.mk
+@@ -48,6 +48,7 @@ ARCH ?= $(SUBARCH)
+ # When local build is done, headers are installed in the default
+ # INSTALL_HDR_PATH usr/include.
+ .PHONY: khdr
++.NOTPARALLEL:
+ khdr:
+ ifndef KSFT_KHDR_INSTALL_DONE
+ ifeq (1,$(DEFAULT_INSTALL_HDR_PATH))
+--
+2.33.0
+
--- /dev/null
+From bfec4b4d8a9a6e3ee13523008a76ce9c71cf591c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Sep 2021 17:11:21 +0000
+Subject: selftests: KVM: Align SMCCC call with the spec in steal_time
+
+From: Oliver Upton <oupton@google.com>
+
+[ Upstream commit 01f91acb55be7aac3950b89c458bcea9ef6e4f49 ]
+
+The SMC64 calling convention passes a function identifier in w0 and its
+parameters in x1-x17. Given this, there are two deviations in the
+SMC64 call performed by the steal_time test: the function identifier is
+assigned to a 64 bit register and the parameter is only 32 bits wide.
+
+Align the call with the SMCCC by using a 32 bit register to handle the
+function identifier and increasing the parameter width to 64 bits.
+
+Suggested-by: Andrew Jones <drjones@redhat.com>
+Signed-off-by: Oliver Upton <oupton@google.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-Id: <20210921171121.2148982-3-oupton@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/steal_time.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/steal_time.c b/tools/testing/selftests/kvm/steal_time.c
+index 2172d65b85e4..62f2eb9ee3d5 100644
+--- a/tools/testing/selftests/kvm/steal_time.c
++++ b/tools/testing/selftests/kvm/steal_time.c
+@@ -116,12 +116,12 @@ struct st_time {
+ uint64_t st_time;
+ };
+
+-static int64_t smccc(uint32_t func, uint32_t arg)
++static int64_t smccc(uint32_t func, uint64_t arg)
+ {
+ unsigned long ret;
+
+ asm volatile(
+- "mov x0, %1\n"
++ "mov w0, %w1\n"
+ "mov x1, %2\n"
+ "hvc #0\n"
+ "mov %0, x0\n"
+--
+2.33.0
+
--- /dev/null
+From a22cb3b883e93537473c34f9f0cee00b8cb210fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:28:09 -0600
+Subject: selftests: kvm: fix get_run_delay() ignoring fscanf() return warn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit f5013d412a43662b63f3d5f3a804d63213acd471 ]
+
+Fix get_run_delay() to check fscanf() return value to get rid of the
+following warning. When fscanf() fails return MIN_RUN_DELAY_NS from
+get_run_delay(). Move MIN_RUN_DELAY_NS from steal_time.c to test_util.h
+so get_run_delay() and steal_time.c can use it.
+
+lib/test_util.c: In function ‘get_run_delay’:
+lib/test_util.c:316:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
+ 316 | fscanf(fp, "%ld %ld ", &val[0], &val[1]);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/include/test_util.h | 2 ++
+ tools/testing/selftests/kvm/lib/test_util.c | 4 +++-
+ tools/testing/selftests/kvm/steal_time.c | 1 -
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/include/test_util.h b/tools/testing/selftests/kvm/include/test_util.h
+index c7409b9b4e5b..451fed5ce8e7 100644
+--- a/tools/testing/selftests/kvm/include/test_util.h
++++ b/tools/testing/selftests/kvm/include/test_util.h
+@@ -95,6 +95,8 @@ struct vm_mem_backing_src_alias {
+ uint32_t flag;
+ };
+
++#define MIN_RUN_DELAY_NS 200000UL
++
+ bool thp_configured(void);
+ size_t get_trans_hugepagesz(void);
+ size_t get_def_hugetlb_pagesz(void);
+diff --git a/tools/testing/selftests/kvm/lib/test_util.c b/tools/testing/selftests/kvm/lib/test_util.c
+index f80dd38a38b2..a9107bfae402 100644
+--- a/tools/testing/selftests/kvm/lib/test_util.c
++++ b/tools/testing/selftests/kvm/lib/test_util.c
+@@ -313,7 +313,9 @@ long get_run_delay(void)
+
+ sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
+ fp = fopen(path, "r");
+- fscanf(fp, "%ld %ld ", &val[0], &val[1]);
++ /* Return MIN_RUN_DELAY_NS upon failure just to be safe */
++ if (fscanf(fp, "%ld %ld ", &val[0], &val[1]) < 2)
++ val[1] = MIN_RUN_DELAY_NS;
+ fclose(fp);
+
+ return val[1];
+diff --git a/tools/testing/selftests/kvm/steal_time.c b/tools/testing/selftests/kvm/steal_time.c
+index 51fe95a5c36a..2172d65b85e4 100644
+--- a/tools/testing/selftests/kvm/steal_time.c
++++ b/tools/testing/selftests/kvm/steal_time.c
+@@ -19,7 +19,6 @@
+
+ #define NR_VCPUS 4
+ #define ST_GPA_BASE (1 << 30)
+-#define MIN_RUN_DELAY_NS 200000UL
+
+ static void *st_gva[NR_VCPUS];
+ static uint64_t guest_stolen_time[NR_VCPUS];
+--
+2.33.0
+
--- /dev/null
+From c711a6e8706d04efa2eb5990e319124616dab6e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:28:07 -0600
+Subject: selftests:kvm: fix get_trans_hugepagesz() ignoring fscanf() return
+ warn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 3a4f0cc693cd3d80e66a255f0bff0e2c0461eef1 ]
+
+Fix get_trans_hugepagesz() to check fscanf() return value to get rid
+of the following warning:
+
+lib/test_util.c: In function ‘get_trans_hugepagesz’:
+lib/test_util.c:138:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
+ 138 | fscanf(f, "%ld", &size);
+ | ^~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/lib/test_util.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/kvm/lib/test_util.c b/tools/testing/selftests/kvm/lib/test_util.c
+index af1031fed97f..938cd423643e 100644
+--- a/tools/testing/selftests/kvm/lib/test_util.c
++++ b/tools/testing/selftests/kvm/lib/test_util.c
+@@ -129,13 +129,16 @@ size_t get_trans_hugepagesz(void)
+ {
+ size_t size;
+ FILE *f;
++ int ret;
+
+ TEST_ASSERT(thp_configured(), "THP is not configured in host kernel");
+
+ f = fopen("/sys/kernel/mm/transparent_hugepage/hpage_pmd_size", "r");
+ TEST_ASSERT(f != NULL, "Error in opening transparent_hugepage/hpage_pmd_size");
+
+- fscanf(f, "%ld", &size);
++ ret = fscanf(f, "%ld", &size);
++ ret = fscanf(f, "%ld", &size);
++ TEST_ASSERT(ret < 1, "Error reading transparent_hugepage/hpage_pmd_size");
+ fclose(f);
+
+ return size;
+--
+2.33.0
+
--- /dev/null
+From 23768beb84b31a4d0bb6b069223d07e1268c9130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:28:06 -0600
+Subject: selftests:kvm: fix get_warnings_count() ignoring fscanf() return warn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 39a71f712d8a13728febd8f3cb3f6db7e1fa7221 ]
+
+Fix get_warnings_count() to check fscanf() return value to get rid
+of the following warning:
+
+x86_64/mmio_warning_test.c: In function ‘get_warnings_count’:
+x86_64/mmio_warning_test.c:85:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
+ 85 | fscanf(f, "%d", &warnings);
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/x86_64/mmio_warning_test.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+index e6480fd5c4bd..8039e1eff938 100644
+--- a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
++++ b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+@@ -82,7 +82,8 @@ int get_warnings_count(void)
+ FILE *f;
+
+ f = popen("dmesg | grep \"WARNING:\" | wc -l", "r");
+- fscanf(f, "%d", &warnings);
++ if (fscanf(f, "%d", &warnings) < 1)
++ warnings = 0;
+ fclose(f);
+
+ return warnings;
+--
+2.33.0
+
--- /dev/null
+From 02235876c8bbb365f631aa590a0c02f0d5133466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Sep 2021 15:28:08 -0600
+Subject: selftests: kvm: move get_run_delay() into lib/test_util
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 20175d5eac5bb94a7a3719ef275337fc9abf26ac ]
+
+get_run_delay() is defined static in xen_shinfo_test and steal_time test.
+Move it to lib and remove code duplication.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/include/test_util.h | 1 +
+ tools/testing/selftests/kvm/lib/test_util.c | 15 +++++++++++++++
+ tools/testing/selftests/kvm/steal_time.c | 15 ---------------
+ .../selftests/kvm/x86_64/xen_shinfo_test.c | 15 ---------------
+ 4 files changed, 16 insertions(+), 30 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/include/test_util.h b/tools/testing/selftests/kvm/include/test_util.h
+index d79be15dd3d2..c7409b9b4e5b 100644
+--- a/tools/testing/selftests/kvm/include/test_util.h
++++ b/tools/testing/selftests/kvm/include/test_util.h
+@@ -102,6 +102,7 @@ const struct vm_mem_backing_src_alias *vm_mem_backing_src_alias(uint32_t i);
+ size_t get_backing_src_pagesz(uint32_t i);
+ void backing_src_help(void);
+ enum vm_mem_backing_src_type parse_backing_src_type(const char *type_name);
++long get_run_delay(void);
+
+ /*
+ * Whether or not the given source type is shared memory (as opposed to
+diff --git a/tools/testing/selftests/kvm/lib/test_util.c b/tools/testing/selftests/kvm/lib/test_util.c
+index 938cd423643e..f80dd38a38b2 100644
+--- a/tools/testing/selftests/kvm/lib/test_util.c
++++ b/tools/testing/selftests/kvm/lib/test_util.c
+@@ -11,6 +11,7 @@
+ #include <stdlib.h>
+ #include <time.h>
+ #include <sys/stat.h>
++#include <sys/syscall.h>
+ #include <linux/mman.h>
+ #include "linux/kernel.h"
+
+@@ -303,3 +304,17 @@ enum vm_mem_backing_src_type parse_backing_src_type(const char *type_name)
+ TEST_FAIL("Unknown backing src type: %s", type_name);
+ return -1;
+ }
++
++long get_run_delay(void)
++{
++ char path[64];
++ long val[2];
++ FILE *fp;
++
++ sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
++ fp = fopen(path, "r");
++ fscanf(fp, "%ld %ld ", &val[0], &val[1]);
++ fclose(fp);
++
++ return val[1];
++}
+diff --git a/tools/testing/selftests/kvm/steal_time.c b/tools/testing/selftests/kvm/steal_time.c
+index ecec30865a74..51fe95a5c36a 100644
+--- a/tools/testing/selftests/kvm/steal_time.c
++++ b/tools/testing/selftests/kvm/steal_time.c
+@@ -10,7 +10,6 @@
+ #include <sched.h>
+ #include <pthread.h>
+ #include <linux/kernel.h>
+-#include <sys/syscall.h>
+ #include <asm/kvm.h>
+ #include <asm/kvm_para.h>
+
+@@ -217,20 +216,6 @@ static void steal_time_dump(struct kvm_vm *vm, uint32_t vcpuid)
+
+ #endif
+
+-static long get_run_delay(void)
+-{
+- char path[64];
+- long val[2];
+- FILE *fp;
+-
+- sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
+- fp = fopen(path, "r");
+- fscanf(fp, "%ld %ld ", &val[0], &val[1]);
+- fclose(fp);
+-
+- return val[1];
+-}
+-
+ static void *do_steal_time(void *arg)
+ {
+ struct timespec ts, stop;
+diff --git a/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c b/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
+index 117bf49a3d79..eda0d2a51224 100644
+--- a/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
++++ b/tools/testing/selftests/kvm/x86_64/xen_shinfo_test.c
+@@ -14,7 +14,6 @@
+ #include <stdint.h>
+ #include <time.h>
+ #include <sched.h>
+-#include <sys/syscall.h>
+
+ #define VCPU_ID 5
+
+@@ -98,20 +97,6 @@ static void guest_code(void)
+ GUEST_DONE();
+ }
+
+-static long get_run_delay(void)
+-{
+- char path[64];
+- long val[2];
+- FILE *fp;
+-
+- sprintf(path, "/proc/%ld/schedstat", syscall(SYS_gettid));
+- fp = fopen(path, "r");
+- fscanf(fp, "%ld %ld ", &val[0], &val[1]);
+- fclose(fp);
+-
+- return val[1];
+-}
+-
+ static int cmp_timespec(struct timespec *a, struct timespec *b)
+ {
+ if (a->tv_sec > b->tv_sec)
+--
+2.33.0
+
--- /dev/null
+spi-rockchip-handle-zero-length-transfers-without-ti.patch
+afs-add-missing-vnode-validation-checks.patch
+platform-x86-touchscreen_dmi-add-info-for-the-chuwi-.patch
+platform-x86-touchscreen_dmi-update-info-for-the-chu.patch
+nfsd-back-channel-stuck-in-seq4_status_cb_path_down.patch
+btrfs-replace-bug_on-in-btrfs_csum_one_bio-with-prop.patch
+btrfs-fix-mount-failure-due-to-past-and-transient-de.patch
+net-mdio-introduce-a-shutdown-method-to-mdio-device-.patch
+xen-netback-correct-success-error-reporting-for-the-.patch
+sparc64-fix-pci_iounmap-when-config_pci-is-not-set.patch
+platform-x86-gigabyte-wmi-add-support-for-b550i-aoru.patch
+ext2-fix-sleeping-in-atomic-bugs-on-error.patch
+drm-amdkfd-handle-svm-migrate-init-error.patch
+drm-amdkfd-fix-svm_migrate_fini-warning.patch
+scsi-sd-free-scsi_disk-device-via-put_device.patch
+scsi-elx-efct-do-not-hold-lock-while-calling-fc_vpor.patch
+usb-testusb-fix-for-showing-the-connection-speed.patch
+usb-dwc2-check-return-value-after-calling-platform_g.patch
+habanalabs-gaudi-use-direct-msi-in-single-mode.patch
+habanalabs-fail-collective-wait-when-not-supported.patch
+habanalabs-gaudi-fix-lbw-rr-configuration.patch
+selftests-be-sure-to-make-khdr-before-other-targets.patch
+selftests-kvm-fix-get_warnings_count-ignoring-fscanf.patch
+selftests-kvm-fix-get_trans_hugepagesz-ignoring-fsca.patch
+selftests-kvm-move-get_run_delay-into-lib-test_util.patch
+selftests-kvm-fix-get_run_delay-ignoring-fscanf-retu.patch
+xen-gntdev-don-t-ignore-kernel-unmapping-error.patch
+swiotlb-xen-ensure-to-issue-well-formed-xenmem_excha.patch
+nvme-fc-update-hardware-queues-before-using-them.patch
+nvme-fc-avoid-race-between-time-out-and-tear-down.patch
+thermal-drivers-tsens-fix-wrong-check-for-tzd-in-irq.patch
+scsi-ses-retry-failed-send-receive-diagnostic-comman.patch
+irqchip-gic-work-around-broken-renesas-integration.patch
+smb3-correct-smb3-acl-security-descriptor.patch
+x86-insn-tools-x86-fix-undefined-behavior-due-to-pot.patch
+io_uring-allow-conditional-reschedule-for-intensive-.patch
+block-don-t-call-rq_qos_ops-done_bio-if-the-bio-isn-.patch
+tools-vm-page-types-remove-dependency-on-opt_file-fo.patch
+kasan-always-respect-config_kasan_stack.patch
+selftests-kvm-align-smccc-call-with-the-spec-in-stea.patch
+kvm-do-not-shrink-halt_poll_ns-below-grow_start.patch
+kvm-x86-reset-pdptrs_from_userspace-when-exiting-smm.patch
+kvm-x86-add-amd-pmu-msrs-to-msrs_to_save_all.patch
+kvm-x86-nsvm-restore-int_vector-in-svm_clear_vintr.patch
--- /dev/null
+From d7567375ade8df9bd41e9c780fbc9ac65b50df02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 16:00:31 -0500
+Subject: smb3: correct smb3 ACL security descriptor
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit b06d893ef2492245d0319b4136edb4c346b687a3 ]
+
+Address warning:
+
+ fs/smbfs_client/smb2pdu.c:2425 create_sd_buf()
+ warn: struct type mismatch 'smb3_acl vs cifs_acl'
+
+Pointed out by Dan Carpenter via smatch code analysis tool
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index b6d2e3591927..e1739d0135b4 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2398,7 +2398,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
+ buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+ /* Ship the ACL for now. we will copy it into buf later. */
+ aclptr = ptr;
+- ptr += sizeof(struct cifs_acl);
++ ptr += sizeof(struct smb3_acl);
+
+ /* create one ACE to hold the mode embedded in reserved special SID */
+ acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
+@@ -2423,7 +2423,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
+ acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */
+ acl.AclSize = cpu_to_le16(acl_size);
+ acl.AceCount = cpu_to_le16(ace_count);
+- memcpy(aclptr, &acl, sizeof(struct cifs_acl));
++ memcpy(aclptr, &acl, sizeof(struct smb3_acl));
+
+ buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
+ *len = roundup(ptr - (__u8 *)buf, 8);
+--
+2.33.0
+
--- /dev/null
+From fbe3fda7e327348e849789eb8bc35326c66ac540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Sep 2021 10:56:32 -0700
+Subject: sparc64: fix pci_iounmap() when CONFIG_PCI is not set
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit d8b1e10a2b8efaf71d151aa756052fbf2f3b6d57 ]
+
+Guenter reported [1] that the pci_iounmap() changes remain problematic,
+with sparc64 allnoconfig and tinyconfig still not building due to the
+header file changes and confusion with the arch-specific pci_iounmap()
+implementation.
+
+I'm pretty convinced that sparc should just use GENERIC_IOMAP instead of
+doing its own thing, since it turns out that the sparc64 version of
+pci_iounmap() is somewhat buggy (see [2]). But in the meantime, this
+just fixes the build by avoiding the trivial re-definition of the empty
+case.
+
+Link: https://lore.kernel.org/lkml/20210920134424.GA346531@roeck-us.net/ [1]
+Link: https://lore.kernel.org/lkml/CAHk-=wgheheFx9myQyy5osh79BAazvmvYURAtub2gQtMvLrhqQ@mail.gmail.com/ [2]
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Cc: David Miller <davem@davemloft.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/lib/iomap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/sparc/lib/iomap.c b/arch/sparc/lib/iomap.c
+index c9da9f139694..f3a8cd491ce0 100644
+--- a/arch/sparc/lib/iomap.c
++++ b/arch/sparc/lib/iomap.c
+@@ -19,8 +19,10 @@ void ioport_unmap(void __iomem *addr)
+ EXPORT_SYMBOL(ioport_map);
+ EXPORT_SYMBOL(ioport_unmap);
+
++#ifdef CONFIG_PCI
+ void pci_iounmap(struct pci_dev *dev, void __iomem * addr)
+ {
+ /* nothing to do */
+ }
+ EXPORT_SYMBOL(pci_iounmap);
++#endif
+--
+2.33.0
+
--- /dev/null
+From b7af367bf19005467fa6819176274c215d0dca16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 07:03:57 +0200
+Subject: spi: rockchip: handle zero length transfers without timing out
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+[ Upstream commit 5457773ef99f25fcc4b238ac76b68e28273250f4 ]
+
+Previously zero length transfers submitted to the Rokchip SPI driver would
+time out in the SPI layer. This happens because the SPI peripheral does
+not trigger a transfer completion interrupt for zero length transfers.
+
+Fix that by completing zero length transfers immediately at start of
+transfer.
+
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Link: https://lore.kernel.org/r/20210827050357.165409-1-t.schramm@manjaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-rockchip.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
+index 540861ca2ba3..553b6b9d0222 100644
+--- a/drivers/spi/spi-rockchip.c
++++ b/drivers/spi/spi-rockchip.c
+@@ -600,6 +600,12 @@ static int rockchip_spi_transfer_one(
+ int ret;
+ bool use_dma;
+
++ /* Zero length transfers won't trigger an interrupt on completion */
++ if (!xfer->len) {
++ spi_finalize_current_transfer(ctlr);
++ return 1;
++ }
++
+ WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
+ (readl_relaxed(rs->regs + ROCKCHIP_SPI_SR) & SR_BUSY));
+
+--
+2.33.0
+
--- /dev/null
+From 00dbb582bd5fb9075007522b835da45188b09931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 12:45:49 +0200
+Subject: swiotlb-xen: ensure to issue well-formed XENMEM_exchange requests
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 9074c79b62b6e0d91d7f716c6e4e9968eaf9e043 ]
+
+While the hypervisor hasn't been enforcing this, we would still better
+avoid issuing requests with GFNs not aligned to the requested order.
+Instead of altering the value also in the call to panic(), drop it
+there for being static and hence easy to determine without being part
+of the panic message.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
+Link: https://lore.kernel.org/r/7b3998e3-1233-4e5a-89ec-d740e77eb166@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/swiotlb-xen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index dbb18dc956f3..de4f55154d49 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -232,10 +232,11 @@ retry:
+ /*
+ * Get IO TLB memory from any location.
+ */
+- start = memblock_alloc(PAGE_ALIGN(bytes), PAGE_SIZE);
++ start = memblock_alloc(PAGE_ALIGN(bytes),
++ IO_TLB_SEGSIZE << IO_TLB_SHIFT);
+ if (!start)
+- panic("%s: Failed to allocate %lu bytes align=0x%lx\n",
+- __func__, PAGE_ALIGN(bytes), PAGE_SIZE);
++ panic("%s: Failed to allocate %lu bytes\n",
++ __func__, PAGE_ALIGN(bytes));
+
+ /*
+ * And replace that memory with pages under 4GB.
+--
+2.33.0
+
--- /dev/null
+From 376e97b79b09e554c9fe329a5886f30292368171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 23:25:42 +0200
+Subject: thermal/drivers/tsens: Fix wrong check for tzd in irq handlers
+
+From: Ansuel Smith <ansuelsmth@gmail.com>
+
+[ Upstream commit cf96921876dcee4d6ac07b9de470368a075ba9ad ]
+
+Some devices can have some thermal sensors disabled from the
+factory. The current two irq handler functions check all the sensor by
+default and the check if the sensor was actually registered is
+wrong. The tzd is actually never set if the registration fails hence
+the IS_ERR check is wrong.
+
+Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210907212543.20220-1-ansuelsmth@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
+index 4c7ebd1d3f9c..b1162e566a70 100644
+--- a/drivers/thermal/qcom/tsens.c
++++ b/drivers/thermal/qcom/tsens.c
+@@ -417,7 +417,7 @@ static irqreturn_t tsens_critical_irq_thread(int irq, void *data)
+ const struct tsens_sensor *s = &priv->sensor[i];
+ u32 hw_id = s->hw_id;
+
+- if (IS_ERR(s->tzd))
++ if (!s->tzd)
+ continue;
+ if (!tsens_threshold_violated(priv, hw_id, &d))
+ continue;
+@@ -467,7 +467,7 @@ static irqreturn_t tsens_irq_thread(int irq, void *data)
+ const struct tsens_sensor *s = &priv->sensor[i];
+ u32 hw_id = s->hw_id;
+
+- if (IS_ERR(s->tzd))
++ if (!s->tzd)
+ continue;
+ if (!tsens_threshold_violated(priv, hw_id, &d))
+ continue;
+--
+2.33.0
+
--- /dev/null
+From b92215e335c4ce1d40062a65aa9857c1a6e0a09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Sep 2021 15:43:41 -0700
+Subject: tools/vm/page-types: remove dependency on opt_file for idle page
+ tracking
+
+From: Changbin Du <changbin.du@gmail.com>
+
+[ Upstream commit ebaeab2fe87987cef28eb5ab174c42cd28594387 ]
+
+Idle page tracking can also be used for process address space, not only
+file mappings.
+
+Without this change, using with '-i' option for process address space
+encounters below errors reported.
+
+ $ sudo ./page-types -p $(pidof bash) -i
+ mark page idle: Bad file descriptor
+ mark page idle: Bad file descriptor
+ mark page idle: Bad file descriptor
+ mark page idle: Bad file descriptor
+ ...
+
+Link: https://lkml.kernel.org/r/20210917032826.10669-1-changbin.du@gmail.com
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/vm/page-types.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 0517c744b04e..f62f10c988db 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -1331,7 +1331,7 @@ int main(int argc, char *argv[])
+ if (opt_list && opt_list_mapcnt)
+ kpagecount_fd = checked_open(PROC_KPAGECOUNT, O_RDONLY);
+
+- if (opt_mark_idle && opt_file)
++ if (opt_mark_idle)
+ page_idle_fd = checked_open(SYS_KERNEL_MM_PAGE_IDLE, O_RDWR);
+
+ if (opt_list && opt_pid)
+--
+2.33.0
+
--- /dev/null
+From 85c4937070efaa9db643ac346241e95a7341f0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Aug 2021 16:42:36 +0800
+Subject: usb: dwc2: check return value after calling platform_get_resource()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 856e6e8e0f9300befa87dde09edb578555c99a82 ]
+
+It will cause null-ptr-deref if platform_get_resource() returns NULL,
+we need check the return value.
+
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20210831084236.1359677-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 2a7828971d05..a215ec9e172e 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5191,6 +5191,10 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
+ hcd->has_tt = 1;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ if (!res) {
++ retval = -EINVAL;
++ goto error1;
++ }
+ hcd->rsrc_start = res->start;
+ hcd->rsrc_len = resource_size(res);
+
+--
+2.33.0
+
--- /dev/null
+From 977b1b2fe4a968d14db7c88454849ac8b9c2f0b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 17:14:44 +0530
+Subject: usb: testusb: Fix for showing the connection speed
+
+From: Faizel K B <faizel.kb@dicortech.com>
+
+[ Upstream commit f81c08f897adafd2ed43f86f00207ff929f0b2eb ]
+
+testusb' application which uses 'usbtest' driver reports 'unknown speed'
+from the function 'find_testdev'. The variable 'entry->speed' was not
+updated from the application. The IOCTL mentioned in the FIXME comment can
+only report whether the connection is low speed or not. Speed is read using
+the IOCTL USBDEVFS_GET_SPEED which reports the proper speed grade. The
+call is implemented in the function 'handle_testdev' where the file
+descriptor was availble locally. Sample output is given below where 'high
+speed' is printed as the connected speed.
+
+sudo ./testusb -a
+high speed /dev/bus/usb/001/011 0
+/dev/bus/usb/001/011 test 0, 0.000015 secs
+/dev/bus/usb/001/011 test 1, 0.194208 secs
+/dev/bus/usb/001/011 test 2, 0.077289 secs
+/dev/bus/usb/001/011 test 3, 0.170604 secs
+/dev/bus/usb/001/011 test 4, 0.108335 secs
+/dev/bus/usb/001/011 test 5, 2.788076 secs
+/dev/bus/usb/001/011 test 6, 2.594610 secs
+/dev/bus/usb/001/011 test 7, 2.905459 secs
+/dev/bus/usb/001/011 test 8, 2.795193 secs
+/dev/bus/usb/001/011 test 9, 8.372651 secs
+/dev/bus/usb/001/011 test 10, 6.919731 secs
+/dev/bus/usb/001/011 test 11, 16.372687 secs
+/dev/bus/usb/001/011 test 12, 16.375233 secs
+/dev/bus/usb/001/011 test 13, 2.977457 secs
+/dev/bus/usb/001/011 test 14 --> 22 (Invalid argument)
+/dev/bus/usb/001/011 test 17, 0.148826 secs
+/dev/bus/usb/001/011 test 18, 0.068718 secs
+/dev/bus/usb/001/011 test 19, 0.125992 secs
+/dev/bus/usb/001/011 test 20, 0.127477 secs
+/dev/bus/usb/001/011 test 21 --> 22 (Invalid argument)
+/dev/bus/usb/001/011 test 24, 4.133763 secs
+/dev/bus/usb/001/011 test 27, 2.140066 secs
+/dev/bus/usb/001/011 test 28, 2.120713 secs
+/dev/bus/usb/001/011 test 29, 0.507762 secs
+
+Signed-off-by: Faizel K B <faizel.kb@dicortech.com>
+Link: https://lore.kernel.org/r/20210902114444.15106-1-faizel.kb@dicortech.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/usb/testusb.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
+index ee8208b2f946..69c3ead25313 100644
+--- a/tools/usb/testusb.c
++++ b/tools/usb/testusb.c
+@@ -265,12 +265,6 @@ nomem:
+ }
+
+ entry->ifnum = ifnum;
+-
+- /* FIXME update USBDEVFS_CONNECTINFO so it tells about high speed etc */
+-
+- fprintf(stderr, "%s speed\t%s\t%u\n",
+- speed(entry->speed), entry->name, entry->ifnum);
+-
+ entry->next = testdevs;
+ testdevs = entry;
+ return 0;
+@@ -299,6 +293,14 @@ static void *handle_testdev (void *arg)
+ return 0;
+ }
+
++ status = ioctl(fd, USBDEVFS_GET_SPEED, NULL);
++ if (status < 0)
++ fprintf(stderr, "USBDEVFS_GET_SPEED failed %d\n", status);
++ else
++ dev->speed = status;
++ fprintf(stderr, "%s speed\t%s\t%u\n",
++ speed(dev->speed), dev->name, dev->ifnum);
++
+ restart:
+ for (i = 0; i < TEST_CASES; i++) {
+ if (dev->test != -1 && dev->test != i)
+--
+2.33.0
+
--- /dev/null
+From d7f21698e56c5154e55baf991702fce94ca35bd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Sep 2021 09:18:43 -0700
+Subject: x86/insn, tools/x86: Fix undefined behavior due to potential
+ unaligned accesses
+
+From: Numfor Mbiziwo-Tiapo <nums@google.com>
+
+[ Upstream commit 5ba1071f7554c4027bdbd712a146111de57918de ]
+
+Don't perform unaligned loads in __get_next() and __peek_nbyte_next() as
+these are forms of undefined behavior:
+
+"A pointer to an object or incomplete type may be converted to a pointer
+to a different object or incomplete type. If the resulting pointer
+is not correctly aligned for the pointed-to type, the behavior is
+undefined."
+
+(from http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf)
+
+These problems were identified using the undefined behavior sanitizer
+(ubsan) with the tools version of the code and perf test.
+
+ [ bp: Massage commit message. ]
+
+Signed-off-by: Numfor Mbiziwo-Tiapo <nums@google.com>
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Link: https://lkml.kernel.org/r/20210923161843.751834-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/insn.c | 4 ++--
+ tools/arch/x86/lib/insn.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
+index 058f19b20465..c565def611e2 100644
+--- a/arch/x86/lib/insn.c
++++ b/arch/x86/lib/insn.c
+@@ -37,10 +37,10 @@
+ ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+
+ #define __get_next(t, insn) \
+- ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); leXX_to_cpu(t, r); })
++ ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += sizeof(t); leXX_to_cpu(t, r); })
+
+ #define __peek_nbyte_next(t, insn, n) \
+- ({ t r = *(t*)((insn)->next_byte + n); leXX_to_cpu(t, r); })
++ ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); leXX_to_cpu(t, r); })
+
+ #define get_next(t, insn) \
+ ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; __get_next(t, insn); })
+diff --git a/tools/arch/x86/lib/insn.c b/tools/arch/x86/lib/insn.c
+index c41f95815480..797699462cd8 100644
+--- a/tools/arch/x86/lib/insn.c
++++ b/tools/arch/x86/lib/insn.c
+@@ -37,10 +37,10 @@
+ ((insn)->next_byte + sizeof(t) + n <= (insn)->end_kaddr)
+
+ #define __get_next(t, insn) \
+- ({ t r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); leXX_to_cpu(t, r); })
++ ({ t r; memcpy(&r, insn->next_byte, sizeof(t)); insn->next_byte += sizeof(t); leXX_to_cpu(t, r); })
+
+ #define __peek_nbyte_next(t, insn, n) \
+- ({ t r = *(t*)((insn)->next_byte + n); leXX_to_cpu(t, r); })
++ ({ t r; memcpy(&r, (insn)->next_byte + n, sizeof(t)); leXX_to_cpu(t, r); })
+
+ #define get_next(t, insn) \
+ ({ if (unlikely(!validate_next(t, insn, 0))) goto err_out; __get_next(t, insn); })
+--
+2.33.0
+
--- /dev/null
+From 3d4c55d5508eeda39aaefde5f5c098f9307200f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 08:13:08 +0200
+Subject: Xen/gntdev: don't ignore kernel unmapping error
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit f28347cc66395e96712f5c2db0a302ee75bafce6 ]
+
+While working on XSA-361 and its follow-ups, I failed to spot another
+place where the kernel mapping part of an operation was not treated the
+same as the user space part. Detect and propagate errors and add a 2nd
+pr_debug().
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Link: https://lore.kernel.org/r/c2513395-74dc-aea3-9192-fd265aa44e35@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/gntdev.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index a3e7be96527d..23fd09a9bbaf 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -396,6 +396,14 @@ static int __unmap_grant_pages(struct gntdev_grant_map *map, int offset,
+ map->unmap_ops[offset+i].handle,
+ map->unmap_ops[offset+i].status);
+ map->unmap_ops[offset+i].handle = INVALID_GRANT_HANDLE;
++ if (use_ptemod) {
++ if (map->kunmap_ops[offset+i].status)
++ err = -EINVAL;
++ pr_debug("kunmap handle=%u st=%d\n",
++ map->kunmap_ops[offset+i].handle,
++ map->kunmap_ops[offset+i].status);
++ map->kunmap_ops[offset+i].handle = INVALID_GRANT_HANDLE;
++ }
+ }
+ return err;
+ }
+--
+2.33.0
+
--- /dev/null
+From 049613261d6af941d3979d4fe5cb063dfe0f904f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Sep 2021 08:27:10 +0200
+Subject: xen-netback: correct success/error reporting for the
+ SKB-with-fraglist case
+
+From: Jan Beulich <jbeulich@suse.com>
+
+[ Upstream commit 3ede7f84c7c21f93c5eac611d60eba3f2c765e0f ]
+
+When re-entering the main loop of xenvif_tx_check_gop() a 2nd time, the
+special considerations for the head of the SKB no longer apply. Don't
+mistakenly report ERROR to the frontend for the first entry in the list,
+even if - from all I can tell - this shouldn't matter much as the overall
+transmit will need to be considered failed anyway.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Paul Durrant <paul@xen.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/netback.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 39a01c2a3058..32d5bc4919d8 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -499,7 +499,7 @@ check_frags:
+ * the header's copy failed, and they are
+ * sharing a slot, send an error
+ */
+- if (i == 0 && sharedslot)
++ if (i == 0 && !first_shinfo && sharedslot)
+ xenvif_idx_release(queue, pending_idx,
+ XEN_NETIF_RSP_ERROR);
+ else
+--
+2.33.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
