--- /dev/null
+From 0031766b3dea461b35c3cf1a5777648c6f2b2591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 15:12:11 +0100
+Subject: ARM: dts: dra76x: m_can: fix order of clocks
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 05d5de6ba7dbe490dd413b5ca11d0875bd2bc006 ]
+
+According to the bosch,m_can.yaml bindings the first clock shall be the "hclk",
+while the second clock "cclk".
+
+This patch fixes the order accordingly.
+
+Fixes: 0adbe832f21a ("ARM: dts: dra76x: Add MCAN node")
+Cc: Faiz Abbas <faiz_abbas@ti.com>
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: linux-omap@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dra76x.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dra76x.dtsi b/arch/arm/boot/dts/dra76x.dtsi
+index 216e1d1a69c7d..473d6721b7887 100644
+--- a/arch/arm/boot/dts/dra76x.dtsi
++++ b/arch/arm/boot/dts/dra76x.dtsi
+@@ -35,8 +35,8 @@
+ interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 68 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "int0", "int1";
+- clocks = <&mcan_clk>, <&l3_iclk_div>;
+- clock-names = "cclk", "hclk";
++ clocks = <&l3_iclk_div>, <&mcan_clk>;
++ clock-names = "hclk", "cclk";
+ bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>;
+ };
+ };
+--
+2.27.0
+
--- /dev/null
+From a82e181f7272630372bc6c2a1fe4ee56561829be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 10:30:04 +0000
+Subject: batman-adv: set .owner to THIS_MODULE
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 14a2e551faea53d45bc11629a9dac88f88950ca7 ]
+
+If THIS_MODULE is not set, the module would be removed while debugfs is
+being used.
+It eventually makes kernel panic.
+
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/log.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
+index 853773e45f792..837f67c9fad35 100644
+--- a/net/batman-adv/log.c
++++ b/net/batman-adv/log.c
+@@ -205,6 +205,7 @@ static const struct file_operations batadv_log_fops = {
+ .read = batadv_log_read,
+ .poll = batadv_log_poll,
+ .llseek = no_llseek,
++ .owner = THIS_MODULE,
+ };
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From bc4e8a2f69aa051cf144957010f9968cd4d31844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 21:30:21 +0800
+Subject: bnxt_en: fix error return code in bnxt_init_board()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3383176efc0fb0c0900a191026468a58668b4214 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 50732ab2c2bc9..913cabc06106f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8021,6 +8021,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ dev_err(&pdev->dev, "System does not support DMA, aborting\n");
++ rc = -EIO;
+ goto init_err_disable;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 57574c15261321993b26913d57599fba6439f4ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 20:17:31 +0800
+Subject: bnxt_en: fix error return code in bnxt_init_one()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit b5f796b62c98cd8c219c4b788ecb6e1218e648cb ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: c213eae8d3cd ("bnxt_en: Improve VF/PF link change logic.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Link: https://lore.kernel.org/r/1605701851-20270-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 01d28ede1fb20..50732ab2c2bc9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -9120,6 +9120,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ create_singlethread_workqueue("bnxt_pf_wq");
+ if (!bnxt_pf_wq) {
+ dev_err(&pdev->dev, "Unable to create workqueue.\n");
++ rc = -ENOMEM;
+ goto init_err_pci_clean;
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From b9011ac1a71f8018d83bd40461b4ca0355ccc2fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 02:44:31 -0500
+Subject: bnxt_en: Release PCI regions when DMA mask setup fails during probe.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit c54bc3ced5106663c2f2b44071800621f505b00e ]
+
+Jump to init_err_release to cleanup. bnxt_unmap_bars() will also be
+called but it will do nothing if the BARs are not mapped yet.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 913cabc06106f..db1a23b8d531d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8022,7 +8022,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+ rc = -EIO;
+- goto init_err_disable;
++ goto init_err_release;
+ }
+
+ pci_set_master(pdev);
+--
+2.27.0
+
--- /dev/null
+From 4a2d587e3e325bb9f0cd0b151d742666516d68e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 14:03:17 +0100
+Subject: can: gs_usb: fix endianess problem with candleLight firmware
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4ba1cb39fce4464151517a37ce0ac0a1a3f580d6 ]
+
+The firmware on the original USB2CAN by Geschwister Schneider Technologie
+Entwicklungs- und Vertriebs UG exchanges all data between the host and the
+device in host byte order. This is done with the struct
+gs_host_config::byte_order member, which is sent first to indicate the desired
+byte order.
+
+The widely used open source firmware candleLight doesn't support this feature
+and exchanges the data in little endian byte order. This breaks if a device
+with candleLight firmware is used on big endianess systems.
+
+To fix this problem, all u32 (but not the struct gs_host_frame::echo_id, which
+is a transparent cookie) are converted to __le32.
+
+Cc: Maximilian Schneider <max@schneidersoft.net>
+Cc: Hubert Denkmair <hubert@denkmair.de>
+Reported-by: Michael Rausch <mr@netadair.de>
+Link: https://lore.kernel.org/r/b58aace7-61f3-6df7-c6df-69fee2c66906@netadair.de
+Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Link: https://lore.kernel.org/r/20201120103818.3386964-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/gs_usb.c | 131 +++++++++++++++++++----------------
+ 1 file changed, 70 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index cc2e224661b30..6a57169c27158 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -71,21 +71,27 @@ enum gs_can_identify_mode {
+ };
+
+ /* data types passed between host and device */
++
++/* The firmware on the original USB2CAN by Geschwister Schneider
++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data
++ * between the host and the device in host byte order. This is done
++ * with the struct gs_host_config::byte_order member, which is sent
++ * first to indicate the desired byte order.
++ *
++ * The widely used open source firmware candleLight doesn't support
++ * this feature and exchanges the data in little endian byte order.
++ */
+ struct gs_host_config {
+- u32 byte_order;
++ __le32 byte_order;
+ } __packed;
+-/* All data exchanged between host and device is exchanged in host byte order,
+- * thanks to the struct gs_host_config byte_order member, which is sent first
+- * to indicate the desired byte order.
+- */
+
+ struct gs_device_config {
+ u8 reserved1;
+ u8 reserved2;
+ u8 reserved3;
+ u8 icount;
+- u32 sw_version;
+- u32 hw_version;
++ __le32 sw_version;
++ __le32 hw_version;
+ } __packed;
+
+ #define GS_CAN_MODE_NORMAL 0
+@@ -95,26 +101,26 @@ struct gs_device_config {
+ #define GS_CAN_MODE_ONE_SHOT BIT(3)
+
+ struct gs_device_mode {
+- u32 mode;
+- u32 flags;
++ __le32 mode;
++ __le32 flags;
+ } __packed;
+
+ struct gs_device_state {
+- u32 state;
+- u32 rxerr;
+- u32 txerr;
++ __le32 state;
++ __le32 rxerr;
++ __le32 txerr;
+ } __packed;
+
+ struct gs_device_bittiming {
+- u32 prop_seg;
+- u32 phase_seg1;
+- u32 phase_seg2;
+- u32 sjw;
+- u32 brp;
++ __le32 prop_seg;
++ __le32 phase_seg1;
++ __le32 phase_seg2;
++ __le32 sjw;
++ __le32 brp;
+ } __packed;
+
+ struct gs_identify_mode {
+- u32 mode;
++ __le32 mode;
+ } __packed;
+
+ #define GS_CAN_FEATURE_LISTEN_ONLY BIT(0)
+@@ -125,23 +131,23 @@ struct gs_identify_mode {
+ #define GS_CAN_FEATURE_IDENTIFY BIT(5)
+
+ struct gs_device_bt_const {
+- u32 feature;
+- u32 fclk_can;
+- u32 tseg1_min;
+- u32 tseg1_max;
+- u32 tseg2_min;
+- u32 tseg2_max;
+- u32 sjw_max;
+- u32 brp_min;
+- u32 brp_max;
+- u32 brp_inc;
++ __le32 feature;
++ __le32 fclk_can;
++ __le32 tseg1_min;
++ __le32 tseg1_max;
++ __le32 tseg2_min;
++ __le32 tseg2_max;
++ __le32 sjw_max;
++ __le32 brp_min;
++ __le32 brp_max;
++ __le32 brp_inc;
+ } __packed;
+
+ #define GS_CAN_FLAG_OVERFLOW 1
+
+ struct gs_host_frame {
+ u32 echo_id;
+- u32 can_id;
++ __le32 can_id;
+
+ u8 can_dlc;
+ u8 channel;
+@@ -337,13 +343,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ if (!skb)
+ return;
+
+- cf->can_id = hf->can_id;
++ cf->can_id = le32_to_cpu(hf->can_id);
+
+ cf->can_dlc = get_can_dlc(hf->can_dlc);
+ memcpy(cf->data, hf->data, 8);
+
+ /* ERROR frames tell us information about the controller */
+- if (hf->can_id & CAN_ERR_FLAG)
++ if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)
+ gs_update_state(dev, cf);
+
+ netdev->stats.rx_packets++;
+@@ -426,11 +432,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev)
+ if (!dbt)
+ return -ENOMEM;
+
+- dbt->prop_seg = bt->prop_seg;
+- dbt->phase_seg1 = bt->phase_seg1;
+- dbt->phase_seg2 = bt->phase_seg2;
+- dbt->sjw = bt->sjw;
+- dbt->brp = bt->brp;
++ dbt->prop_seg = cpu_to_le32(bt->prop_seg);
++ dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1);
++ dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2);
++ dbt->sjw = cpu_to_le32(bt->sjw);
++ dbt->brp = cpu_to_le32(bt->brp);
+
+ /* request bit timings */
+ rc = usb_control_msg(interface_to_usbdev(intf),
+@@ -511,7 +517,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
+
+ cf = (struct can_frame *)skb->data;
+
+- hf->can_id = cf->can_id;
++ hf->can_id = cpu_to_le32(cf->can_id);
+ hf->can_dlc = cf->can_dlc;
+ memcpy(hf->data, cf->data, cf->can_dlc);
+
+@@ -581,6 +587,7 @@ static int gs_can_open(struct net_device *netdev)
+ int rc, i;
+ struct gs_device_mode *dm;
+ u32 ctrlmode;
++ u32 flags = 0;
+
+ rc = open_candev(netdev);
+ if (rc)
+@@ -648,24 +655,24 @@ static int gs_can_open(struct net_device *netdev)
+
+ /* flags */
+ ctrlmode = dev->can.ctrlmode;
+- dm->flags = 0;
+
+ if (ctrlmode & CAN_CTRLMODE_LOOPBACK)
+- dm->flags |= GS_CAN_MODE_LOOP_BACK;
++ flags |= GS_CAN_MODE_LOOP_BACK;
+ else if (ctrlmode & CAN_CTRLMODE_LISTENONLY)
+- dm->flags |= GS_CAN_MODE_LISTEN_ONLY;
++ flags |= GS_CAN_MODE_LISTEN_ONLY;
+
+ /* Controller is not allowed to retry TX
+ * this mode is unavailable on atmels uc3c hardware
+ */
+ if (ctrlmode & CAN_CTRLMODE_ONE_SHOT)
+- dm->flags |= GS_CAN_MODE_ONE_SHOT;
++ flags |= GS_CAN_MODE_ONE_SHOT;
+
+ if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+- dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
++ flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+
+ /* finally start device */
+- dm->mode = GS_CAN_MODE_START;
++ dm->mode = cpu_to_le32(GS_CAN_MODE_START);
++ dm->flags = cpu_to_le32(flags);
+ rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0),
+ GS_USB_BREQ_MODE,
+@@ -745,9 +752,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
+ return -ENOMEM;
+
+ if (do_identify)
+- imode->mode = GS_CAN_IDENTIFY_ON;
++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON);
+ else
+- imode->mode = GS_CAN_IDENTIFY_OFF;
++ imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF);
+
+ rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ usb_sndctrlpipe(interface_to_usbdev(dev->iface),
+@@ -798,6 +805,7 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ struct net_device *netdev;
+ int rc;
+ struct gs_device_bt_const *bt_const;
++ u32 feature;
+
+ bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL);
+ if (!bt_const)
+@@ -838,14 +846,14 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+
+ /* dev settup */
+ strcpy(dev->bt_const.name, "gs_usb");
+- dev->bt_const.tseg1_min = bt_const->tseg1_min;
+- dev->bt_const.tseg1_max = bt_const->tseg1_max;
+- dev->bt_const.tseg2_min = bt_const->tseg2_min;
+- dev->bt_const.tseg2_max = bt_const->tseg2_max;
+- dev->bt_const.sjw_max = bt_const->sjw_max;
+- dev->bt_const.brp_min = bt_const->brp_min;
+- dev->bt_const.brp_max = bt_const->brp_max;
+- dev->bt_const.brp_inc = bt_const->brp_inc;
++ dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min);
++ dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max);
++ dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min);
++ dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max);
++ dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max);
++ dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min);
++ dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max);
++ dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc);
+
+ dev->udev = interface_to_usbdev(intf);
+ dev->iface = intf;
+@@ -862,28 +870,29 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+
+ /* can settup */
+ dev->can.state = CAN_STATE_STOPPED;
+- dev->can.clock.freq = bt_const->fclk_can;
++ dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
+ dev->can.bittiming_const = &dev->bt_const;
+ dev->can.do_set_bittiming = gs_usb_set_bittiming;
+
+ dev->can.ctrlmode_supported = 0;
+
+- if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY)
++ feature = le32_to_cpu(bt_const->feature);
++ if (feature & GS_CAN_FEATURE_LISTEN_ONLY)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;
+
+- if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK)
++ if (feature & GS_CAN_FEATURE_LOOP_BACK)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK;
+
+- if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
++ if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+
+- if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT)
++ if (feature & GS_CAN_FEATURE_ONE_SHOT)
+ dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT;
+
+ SET_NETDEV_DEV(netdev, &intf->dev);
+
+- if (dconf->sw_version > 1)
+- if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY)
++ if (le32_to_cpu(dconf->sw_version) > 1)
++ if (feature & GS_CAN_FEATURE_IDENTIFY)
+ netdev->ethtool_ops = &gs_usb_ethtool_ops;
+
+ kfree(bt_const);
+@@ -918,7 +927,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ if (!hconf)
+ return -ENOMEM;
+
+- hconf->byte_order = 0x0000beef;
++ hconf->byte_order = cpu_to_le32(0x0000beef);
+
+ /* send host config */
+ rc = usb_control_msg(interface_to_usbdev(intf),
+--
+2.27.0
+
--- /dev/null
+From a1b5144a39f149bd4a381ec90eb4f12f4ba5a4a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 19:47:38 +0100
+Subject: can: m_can: fix nominal bitiming tseg2 min for version >= 3.1
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit e3409e4192535fbcc86a84b7a65d9351f46039ec ]
+
+At lest the revision 3.3.0 of the bosch m_can IP core specifies that valid
+register values for "Nominal Time segment after sample point (NTSEG2)" are from
+1 to 127. As the hardware uses a value of one more than the programmed value,
+mean tseg2_min is 2.
+
+This patch fixes the tseg2_min value accordingly.
+
+Cc: Dan Murphy <dmurphy@ti.com>
+Cc: Mario Huettel <mario.huettel@gmx.net>
+Acked-by: Sriram Dash <sriram.dash@samsung.com>
+Link: https://lore.kernel.org/r/20201124190751.3972238-1-mkl@pengutronix.de
+Fixes: b03cfc5bb0e1 ("can: m_can: Enable M_CAN version dependent initialization")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index efaa342600c41..fbb970220c2d7 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -976,7 +976,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = {
+ .name = KBUILD_MODNAME,
+ .tseg1_min = 2, /* Time segment 1 = prop_seg + phase_seg1 */
+ .tseg1_max = 256,
+- .tseg2_min = 1, /* Time segment 2 = phase_seg2 */
++ .tseg2_min = 2, /* Time segment 2 = phase_seg2 */
+ .tseg2_max = 128,
+ .sjw_max = 128,
+ .brp_min = 1,
+--
+2.27.0
+
--- /dev/null
+From 825d67c9a0376428322225273ccd48f6c2223db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 20:02:13 +0530
+Subject: cxgb4: fix the panic caused by non smac rewrite
+
+From: Raju Rangoju <rajur@chelsio.com>
+
+[ Upstream commit bff453921ae105a8dbbad0ed7dd5f5ce424536e7 ]
+
+SMT entry is allocated only when loopback Source MAC
+rewriting is requested. Accessing SMT entry for non
+smac rewrite cases results in kernel panic.
+
+Fix the panic caused by non smac rewrite
+
+Fixes: 937d84205884 ("cxgb4: set up filter action after rewrites")
+Signed-off-by: Raju Rangoju <rajur@chelsio.com>
+Link: https://lore.kernel.org/r/20201118143213.13319-1-rajur@chelsio.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+index a62c96001761b..9160b44c68bbf 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c
+@@ -626,7 +626,8 @@ int set_filter_wr(struct adapter *adapter, int fidx)
+ FW_FILTER_WR_OVLAN_VLD_V(f->fs.val.ovlan_vld) |
+ FW_FILTER_WR_IVLAN_VLDM_V(f->fs.mask.ivlan_vld) |
+ FW_FILTER_WR_OVLAN_VLDM_V(f->fs.mask.ovlan_vld));
+- fwr->smac_sel = f->smt->idx;
++ if (f->fs.newsmac)
++ fwr->smac_sel = f->smt->idx;
+ fwr->rx_chan_rx_rpl_iq =
+ htons(FW_FILTER_WR_RX_CHAN_V(0) |
+ FW_FILTER_WR_RX_RPL_IQ_V(adapter->sge.fw_evtq.abs_id));
+--
+2.27.0
+
--- /dev/null
+From 23f9081ebcba0f812c6ea35c9a928707ea3082a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 11:55:06 +0800
+Subject: dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
+
+From: Sugar Zhang <sugar.zhang@rock-chips.com>
+
+[ Upstream commit e773ca7da8beeca7f17fe4c9d1284a2b66839cc1 ]
+
+Actually, burst size is equal to '1 << desc->rqcfg.brst_size'.
+we should use burst size, not desc->rqcfg.brst_size.
+
+dma memcpy performance on Rockchip RV1126
+@ 1512MHz A7, 1056MHz LPDDR3, 200MHz DMA:
+
+dmatest:
+
+/# echo dma0chan0 > /sys/module/dmatest/parameters/channel
+/# echo 4194304 > /sys/module/dmatest/parameters/test_buf_size
+/# echo 8 > /sys/module/dmatest/parameters/iterations
+/# echo y > /sys/module/dmatest/parameters/norandom
+/# echo y > /sys/module/dmatest/parameters/verbose
+/# echo 1 > /sys/module/dmatest/parameters/run
+
+dmatest: dma0chan0-copy0: result #1: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #2: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #3: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #4: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #5: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #6: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #7: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #8: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+
+Before:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 48 iops 200338 KB/s (0)
+
+After this patch:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 179 iops 734873 KB/s (0)
+
+After this patch and increase dma clk to 400MHz:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 259 iops 1062929 KB/s (0)
+
+Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
+Link: https://lore.kernel.org/r/1605326106-55681-1-git-send-email-sugar.zhang@rock-chips.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pl330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index c564df713efc3..15b30d2d8f7ed 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2774,7 +2774,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+ */
+- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
++ if (burst * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+ desc->bytes_requested = len;
+--
+2.27.0
+
--- /dev/null
+From dc5ec122c8a57114ab121dc13d77d7cca2df0b1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 12:30:04 +0530
+Subject: dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant
+
+From: Marc Ferland <ferlandm@amotus.ca>
+
+[ Upstream commit 0ba2df09f1500d3f27398a3382b86d39c3e6abe2 ]
+
+The xilinx_dma_poll_timeout macro is sometimes called while holding a
+spinlock (see xilinx_dma_issue_pending() for an example) this means we
+shouldn't sleep when polling the dma channel registers. To address it
+in xilinx poll timeout macro use readl_poll_timeout_atomic instead of
+readl_poll_timeout variant.
+
+Signed-off-by: Marc Ferland <ferlandm@amotus.ca>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Link: https://lore.kernel.org/r/1604473206-32573-2-git-send-email-radhey.shyam.pandey@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index d56b6b0e22a84..28592137fb67e 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -453,8 +453,8 @@ struct xilinx_dma_device {
+ #define to_dma_tx_descriptor(tx) \
+ container_of(tx, struct xilinx_dma_tx_descriptor, async_tx)
+ #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \
+- readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \
+- cond, delay_us, timeout_us)
++ readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \
++ val, cond, delay_us, timeout_us)
+
+ /* IO accessors */
+ static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg)
+--
+2.27.0
+
--- /dev/null
+From 98c0dc2694953bef823813c6fd4c6cf346afe535 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 08:45:55 +0100
+Subject: efivarfs: revert "fix memory leak in efivarfs_create()"
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ]
+
+The memory leak addressed by commit fe5186cf12e3 is a false positive:
+all allocations are recorded in a linked list, and freed when the
+filesystem is unmounted. This leads to double frees, and as reported
+by David, leads to crashes if SLUB is configured to self destruct when
+double frees occur.
+
+So drop the redundant kfree() again, and instead, mark the offending
+pointer variable so the allocation is ignored by kmemleak.
+
+Cc: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()")
+Reported-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/inode.c | 2 ++
+ fs/efivarfs/super.c | 1 -
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index 8c6ab6c95727e..7f40343b39b05 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/ctype.h>
++#include <linux/kmemleak.h>
+ #include <linux/slab.h>
+ #include <linux/uuid.h>
+
+@@ -106,6 +107,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ var->var.VariableName[i] = '\0';
+
+ inode->i_private = var;
++ kmemleak_ignore(var);
+
+ err = efivar_entry_add(var, &efivarfs_list);
+ if (err)
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 7808a26bd33fa..834615f13f3e3 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ clear_inode(inode);
+- kfree(inode->i_private);
+ }
+
+ static const struct super_operations efivarfs_ops = {
+--
+2.27.0
+
--- /dev/null
+From 5034b8e644ce0342c7ce6381771406aa65dd65d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Nov 2020 11:34:52 -0800
+Subject: HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices
+
+From: Chris Ye <lzye@google.com>
+
+[ Upstream commit f59ee399de4a8ca4d7d19cdcabb4b63e94867f09 ]
+
+Kernel 5.4 introduces HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE, devices need to
+be set explicitly with this flag.
+
+Signed-off-by: Chris Ye <lzye@google.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 4 ++++
+ drivers/hid/hid-quirks.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 4d2a1d540a821..ad079aca68898 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -444,6 +444,10 @@
+ #define USB_VENDOR_ID_FRUCTEL 0x25B6
+ #define USB_DEVICE_ID_GAMETEL_MT_MODE 0x0002
+
++#define USB_VENDOR_ID_GAMEVICE 0x27F8
++#define USB_DEVICE_ID_GAMEVICE_GV186 0x0BBE
++#define USB_DEVICE_ID_GAMEVICE_KISHI 0x0BBF
++
+ #define USB_VENDOR_ID_GAMERON 0x0810
+ #define USB_DEVICE_ID_GAMERON_DUAL_PSX_ADAPTOR 0x0001
+ #define USB_DEVICE_ID_GAMERON_DUAL_PCS_ADAPTOR 0x0002
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 493e2e7e12de0..10cb42a00fe87 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -87,6 +87,10 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_GV186),
++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
++ { HID_USB_DEVICE(USB_VENDOR_ID_GAMEVICE, USB_DEVICE_ID_GAMEVICE_KISHI),
++ HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+--
+2.27.0
+
--- /dev/null
+From a46044697d3659065b5a65611d1e4f7c2c5592fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 14:36:58 +0100
+Subject: HID: Add Logitech Dinovo Edge battery quirk
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 7940fb035abd88040d56be209962feffa33b03d0 ]
+
+The battery status is also being reported by the logitech-hidpp driver,
+so ignore the standard HID battery status to avoid reporting the same
+info twice.
+
+Note the logitech-hidpp battery driver provides more info, such as properly
+differentiating between charging and discharging. Also the standard HID
+battery info seems to be wrong, reporting a capacity of just 26% after
+fully charging the device.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-input.c | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ad079aca68898..6d118da1615d4 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -733,6 +733,7 @@
+ #define USB_VENDOR_ID_LOGITECH 0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+ #define USB_DEVICE_ID_LOGITECH_T651 0xb00c
++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD 0xb309
+ #define USB_DEVICE_ID_LOGITECH_C007 0xc007
+ #define USB_DEVICE_ID_LOGITECH_C077 0xc077
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER 0xc101
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 11bd2ca22a2e6..13deb9a676855 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -331,6 +331,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD),
+ HID_BATTERY_QUIRK_IGNORE },
++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
++ USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
++ HID_BATTERY_QUIRK_IGNORE },
+ {}
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 3d0658d3c5368cd2d24c424f4748e215676b27f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 22:52:31 +0200
+Subject: HID: add support for Sega Saturn
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+[ Upstream commit 1811977cb11354aef8cbd13e35ff50db716728a4 ]
+
+This device needs HID_QUIRK_MULTI_INPUT in order to be presented to userspace
+in a consistent way.
+
+Reported-and-tested-by: David Gámiz Jiménez <david.gamiz@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index e9155f7c8c51c..4d2a1d540a821 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -479,6 +479,7 @@
+ #define USB_DEVICE_ID_PENPOWER 0x00f4
+
+ #define USB_VENDOR_ID_GREENASIA 0x0e8f
++#define USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR 0x3010
+ #define USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD 0x3013
+
+ #define USB_VENDOR_ID_GRETAGMACBETH 0x0971
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 2d8d20a7f4574..493e2e7e12de0 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -85,6 +85,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY), HID_QUIRK_NO_INIT_REPORTS },
++ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_SAT_ADAPTOR), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD), HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+--
+2.27.0
+
--- /dev/null
+From 8957f2d13a00740605bc0981c504b6524f355c18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 03:16:50 +0900
+Subject: HID: cypress: Support Varmilo Keyboards' media hotkeys
+
+From: Frank Yang <puilp0502@gmail.com>
+
+[ Upstream commit 652f3d00de523a17b0cebe7b90debccf13aa8c31 ]
+
+The Varmilo VA104M Keyboard (04b4:07b1, reported as Varmilo Z104M)
+exposes media control hotkeys as a USB HID consumer control device, but
+these keys do not work in the current (5.8-rc1) kernel due to the
+incorrect HID report descriptor. Fix the problem by modifying the
+internal HID report descriptor.
+
+More specifically, the keyboard report descriptor specifies the
+logical boundary as 572~10754 (0x023c ~ 0x2a02) while the usage
+boundary is specified as 0~10754 (0x00 ~ 0x2a02). This results in an
+incorrect interpretation of input reports, causing inputs to be ignored.
+By setting the Logical Minimum to zero, we align the logical boundary
+with the Usage ID boundary.
+
+Some notes:
+
+* There seem to be multiple variants of the VA104M keyboard. This
+ patch specifically targets 04b4:07b1 variant.
+
+* The device works out-of-the-box on Windows platform with the generic
+ consumer control device driver (hidserv.inf). This suggests that
+ Windows either ignores the Logical Minimum/Logical Maximum or
+ interprets the Usage ID assignment differently from the linux
+ implementation; Maybe there are other devices out there that only
+ works on Windows due to this problem?
+
+Signed-off-by: Frank Yang <puilp0502@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-cypress.c | 44 ++++++++++++++++++++++++++++++++++-----
+ drivers/hid/hid-ids.h | 2 ++
+ 2 files changed, 41 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
+index 1689568b597d4..12c5d7c96527a 100644
+--- a/drivers/hid/hid-cypress.c
++++ b/drivers/hid/hid-cypress.c
+@@ -26,19 +26,17 @@
+ #define CP_2WHEEL_MOUSE_HACK 0x02
+ #define CP_2WHEEL_MOUSE_HACK_ON 0x04
+
++#define VA_INVAL_LOGICAL_BOUNDARY 0x08
++
+ /*
+ * Some USB barcode readers from cypress have usage min and usage max in
+ * the wrong order
+ */
+-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ unsigned int i;
+
+- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
+- return rdesc;
+-
+ if (*rsize < 4)
+ return rdesc;
+
+@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ return rdesc;
+ }
+
++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ /*
++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
++ * reports Logical Minimum of its Consumer Control device as 572
++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
++ */
++ if (*rsize == 25 &&
++ rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
++ rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
++ rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
++ hid_info(hdev,
++ "fixing up varmilo VA104M consumer control report descriptor\n");
++ rdesc[12] = 0x00;
++ rdesc[13] = 0x00;
++ }
++ return rdesc;
++}
++
++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
++
++ return rdesc;
++}
++
+ static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = {
+ .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
+ .driver_data = CP_2WHEEL_MOUSE_HACK },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, cp_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index e18d796d985f8..e9155f7c8c51c 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -330,6 +330,8 @@
+ #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81
+ #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001
+
++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1
++
+ #define USB_VENDOR_ID_DATA_MODUL 0x7374
+ #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201
+
+--
+2.27.0
+
--- /dev/null
+From e2f267222c435ffe5d5e7a8ef74335ad9d9c2c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 19:29:39 -0500
+Subject: HID: hid-sensor-hub: Fix issue with devices with no report ID
+
+From: Pablo Ceballos <pceballos@google.com>
+
+[ Upstream commit 34a9fa2025d9d3177c99351c7aaf256c5f50691f ]
+
+Some HID devices don't use a report ID because they only have a single
+report. In those cases, the report ID in struct hid_report will be zero
+and the data for the report will start at the first byte, so don't skip
+over the first byte.
+
+Signed-off-by: Pablo Ceballos <pceballos@google.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-sensor-hub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 4256fdc5cd6d5..21fbdcde1faa1 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -496,7 +496,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ return 1;
+
+ ptr = raw_data;
+- ptr++; /* Skip report id */
++ if (report->id)
++ ptr++; /* Skip report id */
+
+ spin_lock_irqsave(&pdata->lock, flags);
+
+--
+2.27.0
+
--- /dev/null
+From ce4f11174f33ad749275bbda5b3c5f0a57b6287c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:57:02 +0800
+Subject: IB/mthca: fix return value of error branch in mthca_init_cq()
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 6830ff853a5764c75e56750d59d0bbb6b26f1835 ]
+
+We return 'err' in the error branch, but this variable may be set as zero
+by the above code. Fix it by setting 'err' as a negative value before we
+goto the error label.
+
+Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index a6531ffe29a6f..a5694dec3f2ee 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -808,8 +808,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+- if (IS_ERR(mailbox))
++ if (IS_ERR(mailbox)) {
++ err = PTR_ERR(mailbox);
+ goto err_out_arm;
++ }
+
+ cq_context = mailbox->buf;
+
+@@ -851,9 +853,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ spin_lock_irq(&dev->cq_table.lock);
+- if (mthca_array_set(&dev->cq_table.cq,
+- cq->cqn & (dev->limits.num_cqs - 1),
+- cq)) {
++ err = mthca_array_set(&dev->cq_table.cq,
++ cq->cqn & (dev->limits.num_cqs - 1), cq);
++ if (err) {
+ spin_unlock_irq(&dev->cq_table.lock);
+ goto err_out_free_mr;
+ }
+--
+2.27.0
+
--- /dev/null
+From 68257f7240e711226e8e577cf2a4fe44b407f23c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 13:35:46 -0600
+Subject: ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 0e435befaea45f7ea58682eecab5e37e05b2ce65 ]
+
+crq->msgs could be NULL if the previous reset did not complete after
+freeing crq->msgs. Check for NULL before dereferencing them.
+
+Snippet of call trace:
+...
+ibmvnic 30000003 env3 (unregistering): Releasing sub-CRQ
+ibmvnic 30000003 env3 (unregistering): Releasing CRQ
+BUG: Kernel NULL pointer dereference on read at 0x00000000
+Faulting instruction address: 0xc0000000000c1a30
+Oops: Kernel access of bad area, sig: 11 [#1]
+LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
+Modules linked in: ibmvnic(E-) rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag tun raw_diag inet_diag unix_diag bridge af_packet_diag netlink_diag stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ibmvnic]
+CPU: 20 PID: 8426 Comm: kworker/20:0 Tainted: G E 5.10.0-rc1+ #12
+Workqueue: events __ibmvnic_reset [ibmvnic]
+NIP: c0000000000c1a30 LR: c008000001b00c18 CTR: 0000000000000400
+REGS: c00000000d05b7a0 TRAP: 0380 Tainted: G E (5.10.0-rc1+)
+MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 44002480 XER: 20040000
+CFAR: c0000000000c19ec IRQMASK: 0
+GPR00: 0000000000000400 c00000000d05ba30 c008000001b17c00 0000000000000000
+GPR04: 0000000000000000 0000000000000000 0000000000000000 00000000000001e2
+GPR08: 000000000001f400 ffffffffffffd950 0000000000000000 c008000001b0b280
+GPR12: c0000000000c19c8 c00000001ec72e00 c00000000019a778 c00000002647b440
+GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+GPR20: 0000000000000006 0000000000000001 0000000000000003 0000000000000002
+GPR24: 0000000000001000 c008000001b0d570 0000000000000005 c00000007ab5d550
+GPR28: c00000007ab5c000 c000000032fcf848 c00000007ab5cc00 c000000032fcf800
+NIP [c0000000000c1a30] memset+0x68/0x104
+LR [c008000001b00c18] ibmvnic_reset_crq+0x70/0x110 [ibmvnic]
+Call Trace:
+[c00000000d05ba30] [0000000000000800] 0x800 (unreliable)
+[c00000000d05bab0] [c008000001b0a930] do_reset.isra.40+0x224/0x634 [ibmvnic]
+[c00000000d05bb80] [c008000001b08574] __ibmvnic_reset+0x17c/0x3c0 [ibmvnic]
+[c00000000d05bc50] [c00000000018d9ac] process_one_work+0x2cc/0x800
+[c00000000d05bd20] [c00000000018df58] worker_thread+0x78/0x520
+[c00000000d05bdb0] [c00000000019a934] kthread+0x1c4/0x1d0
+[c00000000d05be20] [c00000000000d5d0] ret_from_kernel_thread+0x5c/0x6c
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2fc8f281c2766..2938ac440fb36 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4462,6 +4462,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
+ } while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+
+ /* Clean out the queue */
++ if (!crq->msgs)
++ return -EINVAL;
++
+ memset(crq->msgs, 0, PAGE_SIZE);
+ crq->cur = 0;
+ crq->active = false;
+--
+2.27.0
+
--- /dev/null
+From b2c90471a27b2e33eb0b410bd1b6dd432d7e636d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 13:35:45 -0600
+Subject: ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit a0faaa27c71608799e0dd765c5af38a089091802 ]
+
+adapter->tx_scrq and adapter->rx_scrq could be NULL if the previous reset
+did not complete after freeing sub crqs. Check for NULL before
+dereferencing them.
+
+Snippet of call trace:
+ibmvnic 30000006 env6: Releasing sub-CRQ
+ibmvnic 30000006 env6: Releasing CRQ
+...
+ibmvnic 30000006 env6: Got Control IP offload Response
+ibmvnic 30000006 env6: Re-setting tx_scrq[0]
+BUG: Kernel NULL pointer dereference on read at 0x00000000
+Faulting instruction address: 0xc008000003dea7cc
+Oops: Kernel access of bad area, sig: 11 [#1]
+LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
+Modules linked in: rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag tun bridge stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmvnic ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod
+CPU: 80 PID: 1856 Comm: kworker/80:2 Tainted: G W 5.8.0+ #4
+Workqueue: events __ibmvnic_reset [ibmvnic]
+NIP: c008000003dea7cc LR: c008000003dea7bc CTR: 0000000000000000
+REGS: c0000007ef7db860 TRAP: 0380 Tainted: G W (5.8.0+)
+MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28002422 XER: 0000000d
+CFAR: c000000000bd9520 IRQMASK: 0
+GPR00: c008000003dea7bc c0000007ef7dbaf0 c008000003df7400 c0000007fa26ec00
+GPR04: c0000007fcd0d008 c0000007fcd96350 0000000000000027 c0000007fcd0d010
+GPR08: 0000000000000023 0000000000000000 0000000000000000 0000000000000000
+GPR12: 0000000000002000 c00000001ec18e00 c0000000001982f8 c0000007bad6e840
+GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
+GPR20: 0000000000000000 0000000000000000 0000000000000000 fffffffffffffef7
+GPR24: 0000000000000402 c0000007fa26f3a8 0000000000000003 c00000016f8ec048
+GPR28: 0000000000000000 0000000000000000 0000000000000000 c0000007fa26ec00
+NIP [c008000003dea7cc] ibmvnic_reset_init+0x15c/0x258 [ibmvnic]
+LR [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic]
+Call Trace:
+[c0000007ef7dbaf0] [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic] (unreliable)
+[c0000007ef7dbb80] [c008000003de8860] __ibmvnic_reset+0x408/0x970 [ibmvnic]
+[c0000007ef7dbc50] [c00000000018b7cc] process_one_work+0x2cc/0x800
+[c0000007ef7dbd20] [c00000000018bd78] worker_thread+0x78/0x520
+[c0000007ef7dbdb0] [c0000000001984c4] kthread+0x1d4/0x1e0
+[c0000007ef7dbe20] [c00000000000cea8] ret_from_kernel_thread+0x5c/0x74
+
+Fixes: 57a49436f4e8 ("ibmvnic: Reset sub-crqs during driver reset")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index d8115a9333e05..2fc8f281c2766 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2560,6 +2560,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
+ {
+ int i, rc;
+
++ if (!adapter->tx_scrq || !adapter->rx_scrq)
++ return -EINVAL;
++
+ for (i = 0; i < adapter->req_tx_queues; i++) {
+ netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
+ rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
+--
+2.27.0
+
--- /dev/null
+From e3edb9f1e7cdce3e48eb65c3db8ff21e60fe714b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 20:53:57 -0700
+Subject: Input: i8042 - allow insmod to succeed on devices without an i8042
+ controller
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b1884583fcd17d6a1b1bba94bbb5826e6b5c6e17 ]
+
+The i8042 module exports several symbols which may be used by other
+modules.
+
+Before this commit it would refuse to load (when built as a module itself)
+on systems without an i8042 controller.
+
+This is a problem specifically for the asus-nb-wmi module. Many Asus
+laptops support the Asus WMI interface. Some of them have an i8042
+controller and need to use i8042_install_filter() to filter some kbd
+events. Other models do not have an i8042 controller (e.g. they use an
+USB attached kbd).
+
+Before this commit the asus-nb-wmi driver could not be loaded on Asus
+models without an i8042 controller, when the i8042 code was built as
+a module (as Arch Linux does) because the module_init function of the
+i8042 module would fail with -ENODEV and thus the i8042_install_filter
+symbol could not be loaded.
+
+This commit fixes this by exiting from module_init with a return code
+of 0 if no controller is found. It also adds a i8042_present bool to
+make the module_exit function a no-op in this case and also adds a
+check for i8042_present to the exported i8042_command function.
+
+The latter i8042_present check should not really be necessary because
+when builtin that function can already be used on systems without
+an i8042 controller, but better safe then sorry.
+
+Reported-and-tested-by: Marius Iacob <themariusus@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20201008112628.3979-2-hdegoede@redhat.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 95a78ccbd8470..fef3b4064f187 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
+ MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
+ #endif
+
++static bool i8042_present;
+ static bool i8042_bypass_aux_irq_test;
+ static char i8042_kbd_firmware_id[128];
+ static char i8042_aux_firmware_id[128];
+@@ -345,6 +346,9 @@ int i8042_command(unsigned char *param, int command)
+ unsigned long flags;
+ int retval;
+
++ if (!i8042_present)
++ return -1;
++
+ spin_lock_irqsave(&i8042_lock, flags);
+ retval = __i8042_command(param, command);
+ spin_unlock_irqrestore(&i8042_lock, flags);
+@@ -1613,12 +1617,15 @@ static int __init i8042_init(void)
+
+ err = i8042_platform_init();
+ if (err)
+- return err;
++ return (err == -ENODEV) ? 0 : err;
+
+ err = i8042_controller_check();
+ if (err)
+ goto err_platform_exit;
+
++ /* Set this before creating the dev to allow i8042_command to work right away */
++ i8042_present = true;
++
+ pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+ if (IS_ERR(pdev)) {
+ err = PTR_ERR(pdev);
+@@ -1637,6 +1644,9 @@ static int __init i8042_init(void)
+
+ static void __exit i8042_exit(void)
+ {
++ if (!i8042_present)
++ return;
++
+ platform_device_unregister(i8042_platform_device);
+ platform_driver_unregister(&i8042_driver);
+ i8042_platform_exit();
+--
+2.27.0
+
--- /dev/null
+From 254d384aa97678765c9d8793d24c3a9f907b579c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 21:08:58 +0200
+Subject: net: ena: set initial DMA width to avoid intel iommu issue
+
+From: Shay Agroskin <shayagr@amazon.com>
+
+[ Upstream commit 09323b3bca95181c0da79daebc8b0603e500f573 ]
+
+The ENA driver uses the readless mechanism, which uses DMA, to find
+out what the DMA mask is supposed to be.
+
+If DMA is used without setting the dma_mask first, it causes the
+Intel IOMMU driver to think that ENA is a 32-bit device and therefore
+disables IOMMU passthrough permanently.
+
+This patch sets the dma_mask to be ENA_MAX_PHYS_ADDR_SIZE_BITS=48
+before readless initialization in
+ena_device_init()->ena_com_mmio_reg_read_request_init(),
+which is large enough to workaround the intel_iommu issue.
+
+DMA mask is set again to the correct value after it's received from the
+device after readless is initialized.
+
+The patch also changes the driver to use dma_set_mask_and_coherent()
+function instead of the two pci_set_dma_mask() and
+pci_set_consistent_dma_mask() ones. Both methods achieve the same
+effect.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Mike Cui <mikecui@amazon.com>
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Shay Agroskin <shayagr@amazon.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 3c3222e2dcfcf..9aea4cf19d0c9 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2433,16 +2433,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev,
+ goto err_mmio_read_less;
+ }
+
+- rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width));
++ rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width));
+ if (rc) {
+- dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc);
+- goto err_mmio_read_less;
+- }
+-
+- rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width));
+- if (rc) {
+- dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n",
+- rc);
++ dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc);
+ goto err_mmio_read_less;
+ }
+
+@@ -3183,6 +3176,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ return rc;
+ }
+
++ rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS));
++ if (rc) {
++ dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc);
++ goto err_disable_device;
++ }
++
+ pci_set_master(pdev);
+
+ ena_dev = vzalloc(sizeof(*ena_dev));
+--
+2.27.0
+
--- /dev/null
+From b7b2ae7a619b726083bf66325c3f6d50e2930c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 17:23:51 +0100
+Subject: nfc: s3fwrn5: use signed integer for parsing GPIO numbers
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit d8f0a86795c69f5b697f7d9e5274c124da93c92d ]
+
+GPIOs - as returned by of_get_named_gpio() and used by the gpiolib - are
+signed integers, where negative number indicates error. The return
+value of of_get_named_gpio() should not be assigned to an unsigned int
+because in case of !CONFIG_GPIOLIB such number would be a valid GPIO.
+
+Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201123162351.209100-1-krzk@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/s3fwrn5/i2c.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
+index 4da409e77a72e..6c78529a8c89b 100644
+--- a/drivers/nfc/s3fwrn5/i2c.c
++++ b/drivers/nfc/s3fwrn5/i2c.c
+@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy {
+ struct i2c_client *i2c_dev;
+ struct nci_dev *ndev;
+
+- unsigned int gpio_en;
+- unsigned int gpio_fw_wake;
++ int gpio_en;
++ int gpio_fw_wake;
+
+ struct mutex mutex;
+
+--
+2.27.0
+
--- /dev/null
+From 93ff137a4d1c3491ce642daa52a145e18692f156 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 23:28:47 +0900
+Subject: nvme: free sq/cq dbbuf pointers when dbbuf set fails
+
+From: Minwoo Im <minwoo.im.dev@gmail.com>
+
+[ Upstream commit 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf ]
+
+If Doorbell Buffer Config command fails even 'dev->dbbuf_dbs != NULL'
+which means OACS indicates that NVME_CTRL_OACS_DBBUF_SUPP is set,
+nvme_dbbuf_update_and_check_event() will check event even it's not been
+successfully set.
+
+This patch fixes mismatch among dbbuf for sq/cqs in case that dbbuf
+command fails.
+
+Signed-off-by: Minwoo Im <minwoo.im.dev@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3c68a5b35ec1b..a52b2f15f372a 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -276,9 +276,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev,
+ nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)];
+ }
+
++static void nvme_dbbuf_free(struct nvme_queue *nvmeq)
++{
++ if (!nvmeq->qid)
++ return;
++
++ nvmeq->dbbuf_sq_db = NULL;
++ nvmeq->dbbuf_cq_db = NULL;
++ nvmeq->dbbuf_sq_ei = NULL;
++ nvmeq->dbbuf_cq_ei = NULL;
++}
++
+ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ {
+ struct nvme_command c;
++ unsigned int i;
+
+ if (!dev->dbbuf_dbs)
+ return;
+@@ -292,6 +304,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
+ /* Free memory and continue on */
+ nvme_dbbuf_dma_free(dev);
++
++ for (i = 1; i <= dev->online_queues; i++)
++ nvme_dbbuf_free(&dev->queues[i]);
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 5cf98be1b3b9f990a94ec3a5be90b663822668f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 15:06:04 +0000
+Subject: optee: add writeback to valid memory type
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+[ Upstream commit 853735e404244f5496cdb6188c5ed9a0f9627ee6 ]
+
+Only in smp systems the cache policy is setup as write alloc, in
+single cpu systems the cache policy is set as writeback and it is
+normal memory, so, it should pass the is_normal_memory check in the
+share memory registration.
+
+Add the right condition to make it work in no smp systems.
+
+Fixes: cdbcf83d29c1 ("tee: optee: check type of registered shared memory")
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/call.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index a5afbe6dee686..7cb7efe62b011 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -538,7 +538,8 @@ void optee_free_pages_list(void *list, size_t num_entries)
+ static bool is_normal_memory(pgprot_t p)
+ {
+ #if defined(CONFIG_ARM)
+- return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
++ return (((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC) ||
++ ((pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEBACK));
+ #elif defined(CONFIG_ARM64)
+ return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+ #else
+--
+2.27.0
+
--- /dev/null
+From 5dc798c13f480870f62debc76f3f0797b726dc9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 14:48:46 +0900
+Subject: perf probe: Fix to die_entrypc() returns error correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit ab4200c17ba6fe71d2da64317aae8a8aa684624c ]
+
+Fix die_entrypc() to return error correctly if the DIE has no
+DW_AT_ranges attribute. Since dwarf_ranges() will treat the case as an
+empty ranges and return 0, we have to check it by ourselves.
+
+Fixes: 91e2f539eeda ("perf probe: Fix to show function entry line as probe-able")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Link: http://lore.kernel.org/lkml/160645612634.2824037.5284932731175079426.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 29e75c051d045..230e94bf7775a 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -332,6 +332,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ {
+ Dwarf_Addr base, end;
++ Dwarf_Attribute attr;
+
+ if (!addr)
+ return -EINVAL;
+@@ -339,6 +340,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ if (dwarf_entrypc(dw_die, addr) == 0)
+ return 0;
+
++ /*
++ * Since the dwarf_ranges() will return 0 if there is no
++ * DW_AT_ranges attribute, we should check it first.
++ */
++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
++ return -ENOENT;
++
+ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8e28439ab1cc8f7f422bdfb9230f93b10c7d254b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 10:31:26 -0800
+Subject: perf/x86: fix sysfs type mismatches
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit ebd19fc372e3e78bf165f230e7c084e304441c08 ]
+
+This change switches rapl to use PMU_FORMAT_ATTR, and fixes two other
+macros to use device_attribute instead of kobj_attribute to avoid
+callback type mismatches that trip indirect call checking with Clang's
+Control-Flow Integrity (CFI).
+
+Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lkml.kernel.org/r/20201113183126.1239404-1-samitolvanen@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/cstate.c | 6 +++---
+ arch/x86/events/intel/rapl.c | 14 +-------------
+ arch/x86/events/intel/uncore.c | 4 ++--
+ arch/x86/events/intel/uncore.h | 12 ++++++------
+ 4 files changed, 12 insertions(+), 24 deletions(-)
+
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 4a650eb3d94a3..3b3cd12c06920 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -100,14 +100,14 @@
+ MODULE_LICENSE("GPL");
+
+ #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __cstate_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
++static ssize_t __cstate_##_var##_show(struct device *dev, \
++ struct device_attribute *attr, \
+ char *page) \
+ { \
+ BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+ return sprintf(page, _format "\n"); \
+ } \
+-static struct kobj_attribute format_attr_##_var = \
++static struct device_attribute format_attr_##_var = \
+ __ATTR(_name, 0444, __cstate_##_var##_show, NULL)
+
+ static ssize_t cstate_get_attr_cpumask(struct device *dev,
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
+index 2413169ce3627..bc348663da94d 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/intel/rapl.c
+@@ -115,18 +115,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = {
+ * any other bit is reserved
+ */
+ #define RAPL_EVENT_MASK 0xFFULL
+-
+-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __rapl_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
+- char *page) \
+-{ \
+- BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+- return sprintf(page, _format "\n"); \
+-} \
+-static struct kobj_attribute format_attr_##_var = \
+- __ATTR(_name, 0444, __rapl_##_var##_show, NULL)
+-
+ #define RAPL_CNTR_WIDTH 32
+
+ #define RAPL_EVENT_ATTR_STR(_name, v, str) \
+@@ -548,7 +536,7 @@ static struct attribute_group rapl_pmu_events_group = {
+ .attrs = NULL, /* patched at runtime */
+ };
+
+-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7");
++PMU_FORMAT_ATTR(event, "config:0-7");
+ static struct attribute *rapl_formats_attr[] = {
+ &format_attr_event.attr,
+ NULL,
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index 7098b9b05d566..2f4ed5aa08bad 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -90,8 +90,8 @@ end:
+ return map;
+ }
+
+-ssize_t uncore_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf)
++ssize_t uncore_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf)
+ {
+ struct uncore_event_desc *event =
+ container_of(attr, struct uncore_event_desc, attr);
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index 40e040ec31b50..0fc86ac73b511 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -133,7 +133,7 @@ struct intel_uncore_box {
+ #define UNCORE_BOX_FLAG_CTL_OFFS8 1 /* event config registers are 8-byte apart */
+
+ struct uncore_event_desc {
+- struct kobj_attribute attr;
++ struct device_attribute attr;
+ const char *config;
+ };
+
+@@ -153,8 +153,8 @@ struct pci2phy_map {
+
+ struct pci2phy_map *__find_pci2phy_map(int segment);
+
+-ssize_t uncore_event_show(struct kobject *kobj,
+- struct kobj_attribute *attr, char *buf);
++ssize_t uncore_event_show(struct device *dev,
++ struct device_attribute *attr, char *buf);
+
+ #define INTEL_UNCORE_EVENT_DESC(_name, _config) \
+ { \
+@@ -163,14 +163,14 @@ ssize_t uncore_event_show(struct kobject *kobj,
+ }
+
+ #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format) \
+-static ssize_t __uncore_##_var##_show(struct kobject *kobj, \
+- struct kobj_attribute *attr, \
++static ssize_t __uncore_##_var##_show(struct device *dev, \
++ struct device_attribute *attr, \
+ char *page) \
+ { \
+ BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE); \
+ return sprintf(page, _format "\n"); \
+ } \
+-static struct kobj_attribute format_attr_##_var = \
++static struct device_attribute format_attr_##_var = \
+ __ATTR(_name, 0444, __uncore_##_var##_show, NULL)
+
+ static inline bool uncore_pmc_fixed(int idx)
+--
+2.27.0
+
--- /dev/null
+From 3beb7572ee1cbea1f81121ee7268b779443953fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 10:58:20 +0100
+Subject: phy: tegra: xusb: Fix dangling pointer on probe failure
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit eb9c4dd9bdfdebaa13846c16a8c79b5b336066b6 ]
+
+If, for some reason, the xusb PHY fails to probe, it leaves
+a dangling pointer attached to the platform device structure.
+
+This would normally be harmless, but the Tegra XHCI driver then
+goes and extract that pointer from the PHY device. Things go
+downhill from there:
+
+ 8.752082] [004d554e5145533c] address between user and kernel address ranges
+[ 8.752085] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 8.752088] Modules linked in: max77620_regulator(E+) xhci_tegra(E+) sdhci_tegra(E+) xhci_hcd(E) sdhci_pltfm(E) cqhci(E) fixed(E) usbcore(E) scsi_mod(E) sdhci(E) host1x(E+)
+[ 8.752103] CPU: 4 PID: 158 Comm: systemd-udevd Tainted: G S W E 5.9.0-rc7-00298-gf6337624c4fe #1980
+[ 8.752105] Hardware name: NVIDIA Jetson TX2 Developer Kit (DT)
+[ 8.752108] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--)
+[ 8.752115] pc : kobject_put+0x1c/0x21c
+[ 8.752120] lr : put_device+0x20/0x30
+[ 8.752121] sp : ffffffc012eb3840
+[ 8.752122] x29: ffffffc012eb3840 x28: ffffffc010e82638
+[ 8.752125] x27: ffffffc008d56440 x26: 0000000000000000
+[ 8.752128] x25: ffffff81eb508200 x24: 0000000000000000
+[ 8.752130] x23: ffffff81eb538800 x22: 0000000000000000
+[ 8.752132] x21: 00000000fffffdfb x20: ffffff81eb538810
+[ 8.752134] x19: 3d4d554e51455300 x18: 0000000000000020
+[ 8.752136] x17: ffffffc008d00270 x16: ffffffc008d00c94
+[ 8.752138] x15: 0000000000000004 x14: ffffff81ebd4ae90
+[ 8.752140] x13: 0000000000000000 x12: ffffff81eb86a4e8
+[ 8.752142] x11: ffffff81eb86a480 x10: ffffff81eb862fea
+[ 8.752144] x9 : ffffffc01055fb28 x8 : ffffff81eb86a4a8
+[ 8.752146] x7 : 0000000000000001 x6 : 0000000000000001
+[ 8.752148] x5 : ffffff81dff8bc38 x4 : 0000000000000000
+[ 8.752150] x3 : 0000000000000001 x2 : 0000000000000001
+[ 8.752152] x1 : 0000000000000002 x0 : 3d4d554e51455300
+[ 8.752155] Call trace:
+[ 8.752157] kobject_put+0x1c/0x21c
+[ 8.752160] put_device+0x20/0x30
+[ 8.752164] tegra_xusb_padctl_put+0x24/0x3c
+[ 8.752170] tegra_xusb_probe+0x8b0/0xd10 [xhci_tegra]
+[ 8.752174] platform_drv_probe+0x60/0xb4
+[ 8.752176] really_probe+0xf0/0x504
+[ 8.752179] driver_probe_device+0x100/0x170
+[ 8.752181] device_driver_attach+0xcc/0xd4
+[ 8.752183] __driver_attach+0xb0/0x17c
+[ 8.752185] bus_for_each_dev+0x7c/0xd4
+[ 8.752187] driver_attach+0x30/0x3c
+[ 8.752189] bus_add_driver+0x154/0x250
+[ 8.752191] driver_register+0x84/0x140
+[ 8.752193] __platform_driver_register+0x54/0x60
+[ 8.752197] tegra_xusb_init+0x40/0x1000 [xhci_tegra]
+[ 8.752201] do_one_initcall+0x54/0x2d0
+[ 8.752205] do_init_module+0x68/0x29c
+[ 8.752207] load_module+0x2178/0x26c0
+[ 8.752209] __do_sys_finit_module+0xb0/0x120
+[ 8.752211] __arm64_sys_finit_module+0x2c/0x40
+[ 8.752215] el0_svc_common.constprop.0+0x80/0x240
+[ 8.752218] do_el0_svc+0x30/0xa0
+[ 8.752220] el0_svc+0x18/0x50
+[ 8.752223] el0_sync_handler+0x90/0x318
+[ 8.752225] el0_sync+0x158/0x180
+[ 8.752230] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (3940f000)
+[ 8.752232] ---[ end trace 90f6c89d62d85ff5 ]---
+
+Reset the pointer on probe failure fixes the issue.
+
+Fixes: 53d2a715c2403 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20201013095820.311376-1-maz@kernel.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index de1b4ebe4de28..39c01ef57d83c 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -899,6 +899,7 @@ remove_pads:
+ reset:
+ reset_control_assert(padctl->rst);
+ remove:
++ platform_set_drvdata(pdev, NULL);
+ soc->ops->remove(padctl);
+ return err;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4653c4724a3f55b91183ebeb8e1fdbbe6ca5821b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 14:21:57 +0100
+Subject: platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time
+
+From: Benjamin Berg <bberg@redhat.com>
+
+[ Upstream commit e40cc1b476d60f22628741e53cf3446a29e6e6b9 ]
+
+The lid state may change while the machine is suspended. As such, we may
+need to re-check the state at wake-up time (at least when waking up from
+hibernation).
+Add the appropriate call to the resume handler in order to sync the
+SW_TABLET_MODE switch state with the hardware state.
+
+Fixes: dda3ec0aa631 ("platform/x86: thinkpad_acpi: Implement tablet mode using GMMS method")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210269
+Signed-off-by: Benjamin Berg <bberg@redhat.com>
+Acked-by: Henrique de Moraes Holschuh <hnh@hmh.eng.br>
+Link: https://lore.kernel.org/r/20201123132157.866303-1-benjamin@sipsolutions.net
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 98bd8213b0378..8cc01857bc5c0 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -4251,6 +4251,7 @@ static void hotkey_resume(void)
+ pr_err("error while attempting to reset the event firmware interface\n");
+
+ tpacpi_send_radiosw_update();
++ tpacpi_input_send_tabletsw();
+ hotkey_tablet_mode_notify_change();
+ hotkey_wakeup_reason_notify_change();
+ hotkey_wakeup_hotunplug_complete_notify_change();
+--
+2.27.0
+
--- /dev/null
+From 6cee916a298ed58028b3022de244b7cbd8e4bb74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 13:49:37 +0800
+Subject: platform/x86: toshiba_acpi: Fix the wrong variable assignment
+
+From: Kaixu Xia <kaixuxia@tencent.com>
+
+[ Upstream commit 2a72c46ac4d665614faa25e267c3fb27fb729ed7 ]
+
+The commit 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up
+variable declaration") cleans up variable declaration in
+video_proc_write(). Seems it does the variable assignment in the
+wrong place, this results in dead code and changes the source code
+logic. Fix it by doing the assignment at the beginning of the funciton.
+
+Fixes: 78429e55e4057 ("platform/x86: toshiba_acpi: Clean up variable declaration")
+Reported-by: Tosk Robot <tencent_os_robot@tencent.com>
+Signed-off-by: Kaixu Xia <kaixuxia@tencent.com>
+Link: https://lore.kernel.org/r/1606024177-16481-1-git-send-email-kaixuxia@tencent.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/toshiba_acpi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index e366977bda418..8c3e9bac4754c 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -1497,7 +1497,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file));
+ char *buffer;
+ char *cmd;
+- int lcd_out, crt_out, tv_out;
++ int lcd_out = -1, crt_out = -1, tv_out = -1;
+ int remain = count;
+ int value;
+ int ret;
+@@ -1529,7 +1529,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+
+ kfree(cmd);
+
+- lcd_out = crt_out = tv_out = -1;
+ ret = get_video_status(dev, &video_out);
+ if (!ret) {
+ unsigned int new_video_out = video_out;
+--
+2.27.0
+
--- /dev/null
+From 5d1804a667bbe6b4fdbc05fa9c52ba1be925c811 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 16:47:52 -0700
+Subject: proc: don't allow async path resolution of /proc/self components
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 8d4c3e76e3be11a64df95ddee52e99092d42fc19 ]
+
+If this is attempted by a kthread, then return -EOPNOTSUPP as we don't
+currently support that. Once we can get task_pid_ptr() doing the right
+thing, then this can go away again.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/self.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index cc6d4253399d1..7922edf70ce1a 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -16,6 +16,13 @@ static const char *proc_self_get_link(struct dentry *dentry,
+ pid_t tgid = task_tgid_nr_ns(current, ns);
+ char *name;
+
++ /*
++ * Not currently supported. Once we can inherit all of struct pid,
++ * we can allow this.
++ */
++ if (current->flags & PF_KTHREAD)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ if (!tgid)
+ return ERR_PTR(-ENOENT);
+ /* max length of unsigned int in decimal + NULL term */
+--
+2.27.0
+
--- /dev/null
+From bb74443f2e8e7838064855ff309503ef5128cd8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 10:09:39 +0100
+Subject: s390/qeth: fix tear down of async TX buffers
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 7ed10e16e50daf74460f54bc922e27c6863c8d61 ]
+
+When qeth_iqd_tx_complete() detects that a TX buffer requires additional
+async completion via QAOB, it might fail to replace the queue entry's
+metadata (and ends up triggering recovery).
+
+Assume now that the device gets torn down, overruling the recovery.
+If the QAOB notification then arrives before the tear down has
+sufficiently progressed, the buffer state is changed to
+QETH_QDIO_BUF_HANDLED_DELAYED by qeth_qdio_handle_aob().
+
+The tear down code calls qeth_drain_output_queue(), where
+qeth_cleanup_handled_pending() will then attempt to replace such a
+buffer _again_. If it succeeds this time, the buffer ends up dangling in
+its replacement's ->next_pending list ... where it will never be freed,
+since there's no further call to qeth_cleanup_handled_pending().
+
+But the second attempt isn't actually needed, we can simply leave the
+buffer on the queue and re-use it after a potential recovery has
+completed. The qeth_clear_output_buffer() in qeth_drain_output_queue()
+will ensure that it's in a clean state again.
+
+Fixes: 72861ae792c2 ("qeth: recovery through asynchronous delivery")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core_main.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 5f59e2dfc7db9..d0aaef937b0fe 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -470,12 +470,6 @@ static void qeth_cleanup_handled_pending(struct qeth_qdio_out_q *q, int bidx,
+
+ }
+ }
+- if (forced_cleanup && (atomic_read(&(q->bufs[bidx]->state)) ==
+- QETH_QDIO_BUF_HANDLED_DELAYED)) {
+- /* for recovery situations */
+- qeth_init_qdio_out_buf(q, bidx);
+- QETH_CARD_TEXT(q->card, 2, "clprecov");
+- }
+ }
+
+
+--
+2.27.0
+
--- /dev/null
+From 6fa247038393f75eac107ef17440804a23944cec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 11:33:17 -0800
+Subject: scsi: libiscsi: Fix NOP race condition
+
+From: Lee Duncan <lduncan@suse.com>
+
+[ Upstream commit fe0a8a95e7134d0b44cd407bc0085b9ba8d8fe31 ]
+
+iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid
+daemon instead of handled in the kernel, as they should be, resulting in a
+message from the daemon like:
+
+ iscsid: Got nop in, but kernel supports nop handling.
+
+This can occur because of the new forward- and back-locks, and the fact
+that an iSCSI NOP response can occur before processing of the NOP send is
+complete. This can result in "conn->ping_task" being NULL in
+iscsi_nop_out_rsp(), when the pointer is actually in the process of being
+set.
+
+To work around this, we add a new state to the "ping_task" pointer. In
+addition to NULL (not assigned) and a pointer (assigned), we add the state
+"being set", which is signaled with an INVALID pointer (using "-1").
+
+Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 23 +++++++++++++++--------
+ include/scsi/libiscsi.h | 3 +++
+ 2 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 7a05c72717666..1c69515e870cb 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -571,8 +571,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
+ if (conn->task == task)
+ conn->task = NULL;
+
+- if (conn->ping_task == task)
+- conn->ping_task = NULL;
++ if (READ_ONCE(conn->ping_task) == task)
++ WRITE_ONCE(conn->ping_task, NULL);
+
+ /* release get from queueing */
+ __iscsi_put_task(task);
+@@ -781,6 +781,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ task->conn->session->age);
+ }
+
++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
++ WRITE_ONCE(conn->ping_task, task);
++
+ if (!ihost->workq) {
+ if (iscsi_prep_mgmt_task(conn, task))
+ goto free_task;
+@@ -988,8 +991,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+ struct iscsi_nopout hdr;
+ struct iscsi_task *task;
+
+- if (!rhdr && conn->ping_task)
+- return -EINVAL;
++ if (!rhdr) {
++ if (READ_ONCE(conn->ping_task))
++ return -EINVAL;
++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
++ }
+
+ memset(&hdr, 0, sizeof(struct iscsi_nopout));
+ hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
+@@ -1004,11 +1010,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+
+ task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
+ if (!task) {
++ if (!rhdr)
++ WRITE_ONCE(conn->ping_task, NULL);
+ iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
+ return -EIO;
+ } else if (!rhdr) {
+ /* only track our nops */
+- conn->ping_task = task;
+ conn->last_ping = jiffies;
+ }
+
+@@ -1021,7 +1028,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
+ struct iscsi_conn *conn = task->conn;
+ int rc = 0;
+
+- if (conn->ping_task != task) {
++ if (READ_ONCE(conn->ping_task) != task) {
+ /*
+ * If this is not in response to one of our
+ * nops then it must be from userspace.
+@@ -1961,7 +1968,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
+ */
+ static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
+ {
+- if (conn->ping_task &&
++ if (READ_ONCE(conn->ping_task) &&
+ time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
+ (conn->ping_timeout * HZ), jiffies))
+ return 1;
+@@ -2096,7 +2103,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ * Checking the transport already or nop from a cmd timeout still
+ * running
+ */
+- if (conn->ping_task) {
++ if (READ_ONCE(conn->ping_task)) {
+ task->have_checked_conn = true;
+ rc = BLK_EH_RESET_TIMER;
+ goto done;
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index c9bd935f4fd1c..1ee0f30ae190b 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -145,6 +145,9 @@ struct iscsi_task {
+ void *dd_data; /* driver/transport data */
+ };
+
++/* invalid scsi_task pointer */
++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l
++
+ static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
+ {
+ return task->unsol_r2t.data_length > task->unsol_r2t.sent;
+--
+2.27.0
+
--- /dev/null
+From 8cc2ffc37ff52bdbf1a3c76d40a2c55c5c043f70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 19:46:18 -0600
+Subject: scsi: target: iscsi: Fix cmd abort fabric stop race
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit f36199355c64a39fe82cfddc7623d827c7e050da ]
+
+Maurizio found a race where the abort and cmd stop paths can race as
+follows:
+
+ 1. thread1 runs iscsit_release_commands_from_conn and sets
+ CMD_T_FABRIC_STOP.
+
+ 2. thread2 runs iscsit_aborted_task and then does __iscsit_free_cmd. It
+ then returns from the aborted_task callout and we finish
+ target_handle_abort and do:
+
+ target_handle_abort -> transport_cmd_check_stop_to_fabric ->
+ lio_check_stop_free -> target_put_sess_cmd
+
+ The cmd is now freed.
+
+ 3. thread1 now finishes iscsit_release_commands_from_conn and runs
+ iscsit_free_cmd while accessing a command we just released.
+
+In __target_check_io_state we check for CMD_T_FABRIC_STOP and set the
+CMD_T_ABORTED if the driver is not cleaning up the cmd because of a session
+shutdown. However, iscsit_release_commands_from_conn only sets the
+CMD_T_FABRIC_STOP and does not check to see if the abort path has claimed
+completion ownership of the command.
+
+This adds a check in iscsit_release_commands_from_conn so only the abort or
+fabric stop path cleanup the command.
+
+Link: https://lore.kernel.org/r/1605318378-9269-1-git-send-email-michael.christie@oracle.com
+Reported-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 2602b57936d4b..58ccded1be857 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -492,8 +492,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp);
+ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ {
+ spin_lock_bh(&conn->cmd_lock);
+- if (!list_empty(&cmd->i_conn_node) &&
+- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
++ if (!list_empty(&cmd->i_conn_node))
+ list_del_init(&cmd->i_conn_node);
+ spin_unlock_bh(&conn->cmd_lock);
+
+@@ -4054,12 +4053,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ spin_lock_bh(&conn->cmd_lock);
+ list_splice_init(&conn->conn_cmd_list, &tmp_list);
+
+- list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ if (se_cmd->se_tfo != NULL) {
+ spin_lock_irq(&se_cmd->t_state_lock);
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ /*
++ * LIO's abort path owns the cleanup for this,
++ * so put it back on the list and let
++ * aborted_task handle it.
++ */
++ list_move_tail(&cmd->i_conn_node,
++ &conn->conn_cmd_list);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ }
+ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From f251a7f16032d917bbcff224d9e1e32e3fe00d4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 14:29:16 +0800
+Subject: scsi: ufs: Fix race between shutdown and runtime resume flow
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit e92643db514803c2c87d72caf5950b4c0a8faf4a ]
+
+If UFS host device is in runtime-suspended state while UFS shutdown
+callback is invoked, UFS device shall be resumed for register
+accesses. Currently only UFS local runtime resume function will be invoked
+to wake up the host. This is not enough because if someone triggers
+runtime resume from block layer, then race may happen between shutdown and
+runtime resume flow, and finally lead to unlocked register access.
+
+To fix this, in ufshcd_shutdown(), use pm_runtime_get_sync() instead of
+resuming UFS device by ufshcd_runtime_resume() "internally" to let runtime
+PM framework manage the whole resume flow.
+
+Link: https://lore.kernel.org/r/20201119062916.12931-1-stanley.chu@mediatek.com
+Fixes: 57d104c153d3 ("ufs: add UFS power management support")
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index a63119c35fde8..7e4e6e982055e 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7926,11 +7926,7 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ goto out;
+
+- if (pm_runtime_suspended(hba->dev)) {
+- ret = ufshcd_runtime_resume(hba);
+- if (ret)
+- goto out;
+- }
++ pm_runtime_get_sync(hba->dev);
+
+ ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM);
+ out:
+--
+2.27.0
+
drm-atomic_helper-stop-modesets-on-unregistered-connectors-harder.patch
i2c-imx-fix-reset-of-i2sr_ial-flag.patch
alsa-hda-hdmi-fix-incorrect-locking-in-hdmi_pcm_close.patch
+hid-cypress-support-varmilo-keyboards-media-hotkeys.patch
+hid-add-support-for-sega-saturn.patch
+input-i8042-allow-insmod-to-succeed-on-devices-witho.patch
+hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch
+hid-add-hid_quirk_increment_usage_on_duplicate-for-g.patch
+dmaengine-xilinx_dma-use-readl_poll_timeout_atomic-v.patch
+x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch
+hid-add-logitech-dinovo-edge-battery-quirk.patch
+proc-don-t-allow-async-path-resolution-of-proc-self-.patch
+nvme-free-sq-cq-dbbuf-pointers-when-dbbuf-set-fails.patch
+dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch
+scsi-libiscsi-fix-nop-race-condition.patch
+scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch
+perf-x86-fix-sysfs-type-mismatches.patch
+xtensa-uaccess-add-missing-__user-to-strncpy_from_us.patch
+phy-tegra-xusb-fix-dangling-pointer-on-probe-failure.patch
+batman-adv-set-.owner-to-this_module.patch
+arm-dts-dra76x-m_can-fix-order-of-clocks.patch
+scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch
+bnxt_en-fix-error-return-code-in-bnxt_init_one.patch
+bnxt_en-fix-error-return-code-in-bnxt_init_board.patch
+video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch
+bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch
+cxgb4-fix-the-panic-caused-by-non-smac-rewrite.patch
+s390-qeth-fix-tear-down-of-async-tx-buffers.patch
+ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch
+nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch
+net-ena-set-initial-dma-width-to-avoid-intel-iommu-i.patch
+ibmvnic-fix-null-pointer-dereference-in-reset_sub_cr.patch
+ibmvnic-fix-null-pointer-dereference-in-ibmvic_reset.patch
+optee-add-writeback-to-valid-memory-type.patch
+efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch
+can-gs_usb-fix-endianess-problem-with-candlelight-fi.patch
+platform-x86-thinkpad_acpi-send-tablet-mode-switch-a.patch
+platform-x86-toshiba_acpi-fix-the-wrong-variable-ass.patch
+can-m_can-fix-nominal-bitiming-tseg2-min-for-version.patch
+perf-probe-fix-to-die_entrypc-returns-error-correctl.patch
--- /dev/null
+From 9b229fb8221892972ed1ee879cb4cab20bf658fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 16:03:05 -0800
+Subject: video: hyperv_fb: Fix the cache type when mapping the VRAM
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 5f1251a48c17b54939d7477305e39679a565382c ]
+
+x86 Hyper-V used to essentially always overwrite the effective cache type
+of guest memory accesses to WB. This was problematic in cases where there
+is a physical device assigned to the VM, since that often requires that
+the VM should have control over cache types. Thus, on newer Hyper-V since
+2018, Hyper-V always honors the VM's cache type, but unexpectedly Linux VM
+users start to complain that Linux VM's VRAM becomes very slow, and it
+turns out that Linux VM should not map the VRAM uncacheable by ioremap().
+Fix this slowness issue by using ioremap_cache().
+
+On ARM64, ioremap_cache() is also required as the host also maps the VRAM
+cacheable, otherwise VM Connect can't display properly with ioremap() or
+ioremap_wc().
+
+With this change, the VRAM on new Hyper-V is as fast as regular RAM, so
+it's no longer necessary to use the hacks we added to mitigate the
+slowness, i.e. we no longer need to allocate physical memory and use
+it to back up the VRAM in Generation-1 VM, and we also no longer need to
+allocate physical memory to back up the framebuffer in a Generation-2 VM
+and copy the framebuffer to the real VRAM. A further big change will
+address these for v5.11.
+
+Fixes: 68a2d20b79b1 ("drivers/video: add Hyper-V Synthetic Video Frame Buffer Driver")
+Tested-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Link: https://lore.kernel.org/r/20201118000305.24797-1-decui@microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/hyperv_fb.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index 403d8cd3e5827..56e70f12c9960 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ goto err1;
+ }
+
+- fb_virt = ioremap(par->mem->start, screen_fb_size);
++ /*
++ * Map the VRAM cacheable for performance. This is also required for
++ * VM Connect to display properly for ARM64 Linux VM, as the host also
++ * maps the VRAM cacheable.
++ */
++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+ if (!fb_virt)
+ goto err2;
+
+--
+2.27.0
+
--- /dev/null
+From cc4dfff19da5aac18832aea9c18b258369b3248f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 20:11:19 -0500
+Subject: x86/xen: don't unbind uninitialized lock_kicker_irq
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 65cae18882f943215d0505ddc7e70495877308e6 ]
+
+When booting a hyperthreaded system with the kernel parameter
+'mitigations=auto,nosmt', the following warning occurs:
+
+ WARNING: CPU: 0 PID: 1 at drivers/xen/events/events_base.c:1112 unbind_from_irqhandler+0x4e/0x60
+ ...
+ Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006
+ ...
+ Call Trace:
+ xen_uninit_lock_cpu+0x28/0x62
+ xen_hvm_cpu_die+0x21/0x30
+ takedown_cpu+0x9c/0xe0
+ ? trace_suspend_resume+0x60/0x60
+ cpuhp_invoke_callback+0x9a/0x530
+ _cpu_up+0x11a/0x130
+ cpu_up+0x7e/0xc0
+ bringup_nonboot_cpus+0x48/0x50
+ smp_init+0x26/0x79
+ kernel_init_freeable+0xea/0x229
+ ? rest_init+0xaa/0xaa
+ kernel_init+0xa/0x106
+ ret_from_fork+0x35/0x40
+
+The secondary CPUs are not activated with the nosmt mitigations and only
+the primary thread on each CPU core is used. In this situation,
+xen_hvm_smp_prepare_cpus(), and more importantly xen_init_lock_cpu(), is
+not called, so the lock_kicker_irq is not initialized for the secondary
+CPUs. Let's fix this by exiting early in xen_uninit_lock_cpu() if the
+irq is not set to avoid the warning from above for each secondary CPU.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Link: https://lore.kernel.org/r/20201107011119.631442-1-bmasney@redhat.com
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/spinlock.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 717b4847b473f..6fffb86a32add 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -101,10 +101,20 @@ void xen_init_lock_cpu(int cpu)
+
+ void xen_uninit_lock_cpu(int cpu)
+ {
++ int irq;
++
+ if (!xen_pvspin)
+ return;
+
+- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
++ /*
++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary
++ * CPUs are not activated, and lock_kicker_irq is not initialized.
++ */
++ irq = per_cpu(lock_kicker_irq, cpu);
++ if (irq == -1)
++ return;
++
++ unbind_from_irqhandler(irq, NULL);
+ per_cpu(lock_kicker_irq, cpu) = -1;
+ kfree(per_cpu(irq_name, cpu));
+ per_cpu(irq_name, cpu) = NULL;
+--
+2.27.0
+
--- /dev/null
+From bf5620ee279d364e73dda0778abf155b9d7bcb7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 00:09:37 +0300
+Subject: xtensa: uaccess: Add missing __user to strncpy_from_user() prototype
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit dc293f2106903ab9c24e9cea18c276e32c394c33 ]
+
+When adding __user annotations in commit 2adf5352a34a, the
+strncpy_from_user() function declaration for the
+CONFIG_GENERIC_STRNCPY_FROM_USER case was missed. Fix it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Message-Id: <20200831210937.17938-1-laurent.pinchart@ideasonboard.com>
+Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/xtensa/include/asm/uaccess.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/xtensa/include/asm/uaccess.h b/arch/xtensa/include/asm/uaccess.h
+index f1158b4c629cf..da4effe270072 100644
+--- a/arch/xtensa/include/asm/uaccess.h
++++ b/arch/xtensa/include/asm/uaccess.h
+@@ -291,7 +291,7 @@ strncpy_from_user(char *dst, const char *src, long count)
+ return -EFAULT;
+ }
+ #else
+-long strncpy_from_user(char *dst, const char *src, long count);
++long strncpy_from_user(char *dst, const char __user *src, long count);
+ #endif
+
+ /*
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
