--- /dev/null
+From 54f6761962480c5e5a9eaa5e6871b9a55c9b1b74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 23:32:12 +0100
+Subject: afs: Fix length of dump of bad YFSFetchStatus record
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3efe55b09a92a59ed8214db801683cf13c9742c4 ]
+
+Fix the length of the dump of a bad YFSFetchStatus record. The function
+was copied from the AFS version, but the YFS variant contains bigger fields
+and extra information, so expand the dump to match.
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/yfsclient.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c
+index 83b6d67325f6c..b5b45c57e1b1d 100644
+--- a/fs/afs/yfsclient.c
++++ b/fs/afs/yfsclient.c
+@@ -165,15 +165,15 @@ static void xdr_dump_bad(const __be32 *bp)
+ int i;
+
+ pr_notice("YFS XDR: Bad status record\n");
+- for (i = 0; i < 5 * 4 * 4; i += 16) {
++ for (i = 0; i < 6 * 4 * 4; i += 16) {
+ memcpy(x, bp, 16);
+ bp += 4;
+ pr_notice("%03x: %08x %08x %08x %08x\n",
+ i, ntohl(x[0]), ntohl(x[1]), ntohl(x[2]), ntohl(x[3]));
+ }
+
+- memcpy(x, bp, 4);
+- pr_notice("0x50: %08x\n", ntohl(x[0]));
++ memcpy(x, bp, 8);
++ pr_notice("0x60: %08x %08x\n", ntohl(x[0]), ntohl(x[1]));
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 683c6cbb59de2f1624dba5ef2e2f25ebfec6be44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Apr 2020 22:27:25 +0800
+Subject: ALSA: hda: call runtime_allow() for all hda controllers
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 9a6418487b566503c772cb6e7d3d44e652b019b0 ]
+
+Before the pci_driver->probe() is called, the pci subsystem calls
+runtime_forbid() and runtime_get_sync() on this pci dev, so only call
+runtime_put_autosuspend() is not enough to enable the runtime_pm on
+this device.
+
+For controllers with vgaswitcheroo feature, the pci/quirks.c will call
+runtime_allow() for this dev, then the controllers could enter
+rt_idle/suspend/resume, but for non-vgaswitcheroo controllers like
+Intel hda controllers, the runtime_pm is not enabled because the
+runtime_allow() is not called.
+
+Since it is no harm calling runtime_allow() twice, here let hda
+driver call runtime_allow() for all controllers. Then the runtime_pm
+is enabled on all controllers after the put_autosuspend() is called.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20200414142725.6020-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 4f6d8a4b38452..59b60b1f26f80 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2339,6 +2339,7 @@ static int azx_probe_continue(struct azx *chip)
+
+ if (azx_has_pm_runtime(chip)) {
+ pm_runtime_use_autosuspend(&pci->dev);
++ pm_runtime_allow(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 34ef61b082bdd8fa2d9be514437b34a1d62f42b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 10:20:34 +0200
+Subject: ALSA: hda: Explicitly permit using autosuspend if runtime PM is
+ supported
+
+From: Roy Spliet <nouveau@spliet.org>
+
+[ Upstream commit 3ba21113bd33d49f3c300a23fc08cf114c434995 ]
+
+This fixes runtime PM not working after a suspend-to-RAM cycle at least for
+the codec-less HDA device found on NVIDIA GPUs.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207043
+Signed-off-by: Roy Spliet <nouveau@spliet.org>
+Link: https://lore.kernel.org/r/20200413082034.25166-7-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index d69005e29975c..4f6d8a4b38452 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2337,8 +2337,10 @@ static int azx_probe_continue(struct azx *chip)
+
+ set_default_power_save(chip);
+
+- if (azx_has_pm_runtime(chip))
++ if (azx_has_pm_runtime(chip)) {
++ pm_runtime_use_autosuspend(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
++ }
+
+ out_free:
+ if (err < 0) {
+--
+2.20.1
+
--- /dev/null
+From 78a92b97f69ea98d6d928d8ce2ccead6fb58509c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 10:20:32 +0200
+Subject: ALSA: hda: Keep the controller initialization even if no codecs found
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 9479e75fca370a5220784f7596bf598c4dad0b9b ]
+
+Currently, when the HD-audio controller driver doesn't detect any
+codecs, it tries to abort the probe. But this abort happens at the
+delayed probe, i.e. the primary probe call already returned success,
+hence the driver is never unbound until user does so explicitly.
+As a result, it may leave the HD-audio device in the running state
+without the runtime PM. More badly, if the device is a HD-audio bus
+that is tied with a GPU, GPU cannot reach to the full power down and
+consumes unnecessarily much power.
+
+This patch changes the logic after no-codec situation; it continues
+probing without the further codec initialization but keep the
+controller driver running normally.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207043
+Tested-by: Roy Spliet <nouveau@spliet.org>
+Link: https://lore.kernel.org/r/20200413082034.25166-5-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 3047dc357b38b..d69005e29975c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2009,7 +2009,7 @@ static int azx_first_init(struct azx *chip)
+ /* codec detection */
+ if (!azx_bus(chip)->codec_mask) {
+ dev_err(card->dev, "no codecs found!\n");
+- return -ENODEV;
++ /* keep running the rest for the runtime PM */
+ }
+
+ if (azx_acquire_irq(chip, 0) < 0)
+@@ -2302,9 +2302,11 @@ static int azx_probe_continue(struct azx *chip)
+ #endif
+
+ /* create codec instances */
+- err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
+- if (err < 0)
+- goto out_free;
++ if (bus->codec_mask) {
++ err = azx_probe_codecs(chip, azx_max_codecs[chip->driver_type]);
++ if (err < 0)
++ goto out_free;
++ }
+
+ #ifdef CONFIG_SND_HDA_PATCH_LOADER
+ if (chip->fw) {
+@@ -2318,7 +2320,7 @@ static int azx_probe_continue(struct azx *chip)
+ #endif
+ }
+ #endif
+- if ((probe_only[dev] & 1) == 0) {
++ if (bus->codec_mask && !(probe_only[dev] & 1)) {
+ err = azx_codec_configure(chip);
+ if (err < 0)
+ goto out_free;
+--
+2.20.1
+
--- /dev/null
+From 12839c57b44033d62ca89003b0715e6f054a71c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 10:20:31 +0200
+Subject: ALSA: hda: Release resources at error in delayed probe
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2393e7555b531a534152ffe7bfd1862cacedaacb ]
+
+snd-hda-intel driver handles the most of its probe task in the delayed
+work (either via workqueue or via firmware loader). When an error
+happens in the later delayed probe, we can't deregister the device
+itself because the probe callback already returned success and the
+device was bound. So, for now, we set hda->init_failed flag and make
+the rest untouched until the device gets really unbound.
+However, this leaves the device up running, keeping the resources
+without any use that prevents other operations.
+
+In this patch, we release the resources at first when a probe error
+happens in the delayed probe stage, but keeps the top-level object, so
+that the PM and other ops can still refer to the object itself.
+
+Also for simplicity, snd_hda_intel object is allocated via devm, so
+that we can get rid of the explicit kfree calls.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207043
+Link: https://lore.kernel.org/r/20200413082034.25166-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 29 ++++++++++++++++-------------
+ sound/pci/hda/hda_intel.h | 1 +
+ 2 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index af21e9583c0d3..3047dc357b38b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1203,10 +1203,8 @@ static void azx_vs_set_state(struct pci_dev *pci,
+ if (!disabled) {
+ dev_info(chip->card->dev,
+ "Start delayed initialization\n");
+- if (azx_probe_continue(chip) < 0) {
++ if (azx_probe_continue(chip) < 0)
+ dev_err(chip->card->dev, "initialization error\n");
+- hda->init_failed = true;
+- }
+ }
+ } else {
+ dev_info(chip->card->dev, "%s via vga_switcheroo\n",
+@@ -1339,12 +1337,15 @@ static int register_vga_switcheroo(struct azx *chip)
+ /*
+ * destructor
+ */
+-static int azx_free(struct azx *chip)
++static void azx_free(struct azx *chip)
+ {
+ struct pci_dev *pci = chip->pci;
+ struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+ struct hdac_bus *bus = azx_bus(chip);
+
++ if (hda->freed)
++ return;
++
+ if (azx_has_pm_runtime(chip) && chip->running)
+ pm_runtime_get_noresume(&pci->dev);
+ chip->running = 0;
+@@ -1388,9 +1389,8 @@ static int azx_free(struct azx *chip)
+
+ if (chip->driver_caps & AZX_DCAPS_I915_COMPONENT)
+ snd_hdac_i915_exit(bus);
+- kfree(hda);
+
+- return 0;
++ hda->freed = 1;
+ }
+
+ static int azx_dev_disconnect(struct snd_device *device)
+@@ -1406,7 +1406,8 @@ static int azx_dev_disconnect(struct snd_device *device)
+
+ static int azx_dev_free(struct snd_device *device)
+ {
+- return azx_free(device->device_data);
++ azx_free(device->device_data);
++ return 0;
+ }
+
+ #ifdef SUPPORT_VGA_SWITCHEROO
+@@ -1773,7 +1774,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+ if (err < 0)
+ return err;
+
+- hda = kzalloc(sizeof(*hda), GFP_KERNEL);
++ hda = devm_kzalloc(&pci->dev, sizeof(*hda), GFP_KERNEL);
+ if (!hda) {
+ pci_disable_device(pci);
+ return -ENOMEM;
+@@ -1814,7 +1815,6 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+
+ err = azx_bus_init(chip, model[dev]);
+ if (err < 0) {
+- kfree(hda);
+ pci_disable_device(pci);
+ return err;
+ }
+@@ -2339,13 +2339,16 @@ static int azx_probe_continue(struct azx *chip)
+ pm_runtime_put_autosuspend(&pci->dev);
+
+ out_free:
+- if (err < 0 || !hda->need_i915_power)
++ if (err < 0) {
++ azx_free(chip);
++ return err;
++ }
++
++ if (!hda->need_i915_power)
+ display_power(chip, false);
+- if (err < 0)
+- hda->init_failed = 1;
+ complete_all(&hda->probe_wait);
+ to_hda_bus(bus)->bus_probing = 0;
+- return err;
++ return 0;
+ }
+
+ static void azx_remove(struct pci_dev *pci)
+diff --git a/sound/pci/hda/hda_intel.h b/sound/pci/hda/hda_intel.h
+index 2acfff3da1a04..3fb119f090408 100644
+--- a/sound/pci/hda/hda_intel.h
++++ b/sound/pci/hda/hda_intel.h
+@@ -27,6 +27,7 @@ struct hda_intel {
+ unsigned int use_vga_switcheroo:1;
+ unsigned int vga_switcheroo_registered:1;
+ unsigned int init_failed:1; /* delayed init failed */
++ unsigned int freed:1; /* resources already released */
+
+ bool need_i915_power:1; /* the hda controller needs i915 power */
+ };
+--
+2.20.1
+
--- /dev/null
+From fb7f7d792d09978b2f3f64fdb1df3a598e42c051 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Apr 2020 09:32:55 -0700
+Subject: arm64: Delete the space separator in __emit_inst
+
+From: Fangrui Song <maskray@google.com>
+
+[ Upstream commit c9a4ef66450145a356a626c833d3d7b1668b3ded ]
+
+In assembly, many instances of __emit_inst(x) expand to a directive. In
+a few places __emit_inst(x) is used as an assembler macro argument. For
+example, in arch/arm64/kvm/hyp/entry.S
+
+ ALTERNATIVE(nop, SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
+
+expands to the following by the C preprocessor:
+
+ alternative_insn nop, .inst (0xd500401f | ((0) << 16 | (4) << 5) | ((!!1) << 8)), 4, 1
+
+Both comma and space are separators, with an exception that content
+inside a pair of parentheses/quotes is not split, so the clang
+integrated assembler splits the arguments to:
+
+ nop, .inst, (0xd500401f | ((0) << 16 | (4) << 5) | ((!!1) << 8)), 4, 1
+
+GNU as preprocesses the input with do_scrub_chars(). Its arm64 backend
+(along with many other non-x86 backends) sees:
+
+ alternative_insn nop,.inst(0xd500401f|((0)<<16|(4)<<5)|((!!1)<<8)),4,1
+ # .inst(...) is parsed as one argument
+
+while its x86 backend sees:
+
+ alternative_insn nop,.inst (0xd500401f|((0)<<16|(4)<<5)|((!!1)<<8)),4,1
+ # The extra space before '(' makes the whole .inst (...) parsed as two arguments
+
+The non-x86 backend's behavior is considered unintentional
+(https://sourceware.org/bugzilla/show_bug.cgi?id=25750).
+So drop the space separator inside `.inst (...)` to make the clang
+integrated assembler work.
+
+Suggested-by: Ilie Halip <ilie.halip@gmail.com>
+Signed-off-by: Fangrui Song <maskray@google.com>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/939
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/sysreg.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
+index b91570ff9db14..931037500e83c 100644
+--- a/arch/arm64/include/asm/sysreg.h
++++ b/arch/arm64/include/asm/sysreg.h
+@@ -49,7 +49,9 @@
+ #ifndef CONFIG_BROKEN_GAS_INST
+
+ #ifdef __ASSEMBLY__
+-#define __emit_inst(x) .inst (x)
++// The space separator is omitted so that __emit_inst(x) can be parsed as
++// either an assembler directive or an assembler macro argument.
++#define __emit_inst(x) .inst(x)
+ #else
+ #define __emit_inst(x) ".inst " __stringify((x)) "\n\t"
+ #endif
+--
+2.20.1
+
--- /dev/null
+From a09fc3b669830604768140a6a8b7cd3290da24f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Apr 2020 19:18:51 +0800
+Subject: blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 5fe56de799ad03e92d794c7936bf363922b571df ]
+
+If in blk_mq_dispatch_rq_list() we find no budget, then we break of the
+dispatch loop, but the request may keep the driver tag, evaulated
+in 'nxt' in the previous loop iteration.
+
+Fix by putting the driver tag for that request.
+
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 37ff8dfb8ab9f..2c3a1b2e07537 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1205,8 +1205,10 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list,
+ rq = list_first_entry(list, struct request, queuelist);
+
+ hctx = rq->mq_hctx;
+- if (!got_budget && !blk_mq_get_dispatch_budget(hctx))
++ if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) {
++ blk_mq_put_driver_tag(rq);
+ break;
++ }
+
+ if (!blk_mq_get_driver_tag(rq)) {
+ /*
+--
+2.20.1
+
--- /dev/null
+From 0a5e094eb893de3f91f20fa9b4f7c212f931c320 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 15:38:44 +0800
+Subject: drm/amdgpu: fix wrong vram lost counter increment V2
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 028cfb2444b94d4f394a6fa4ca46182481236e91 ]
+
+Vram lost counter is wrongly increased by two during baco reset.
+
+V2: assumed vram lost for mode1 reset on all ASICs
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 20 ++++++++++++++++++--
+ drivers/gpu/drm/amd/amdgpu/cik.c | 2 --
+ drivers/gpu/drm/amd/amdgpu/nv.c | 4 ----
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 4 ----
+ drivers/gpu/drm/amd/amdgpu/vi.c | 2 --
+ 5 files changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index c8bf9cb3cebf2..f184cdca938de 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -1953,8 +1953,24 @@ static void amdgpu_device_fill_reset_magic(struct amdgpu_device *adev)
+ */
+ static bool amdgpu_device_check_vram_lost(struct amdgpu_device *adev)
+ {
+- return !!memcmp(adev->gart.ptr, adev->reset_magic,
+- AMDGPU_RESET_MAGIC_NUM);
++ if (memcmp(adev->gart.ptr, adev->reset_magic,
++ AMDGPU_RESET_MAGIC_NUM))
++ return true;
++
++ if (!adev->in_gpu_reset)
++ return false;
++
++ /*
++ * For all ASICs with baco/mode1 reset, the VRAM is
++ * always assumed to be lost.
++ */
++ switch (amdgpu_asic_reset_method(adev)) {
++ case AMD_RESET_METHOD_BACO:
++ case AMD_RESET_METHOD_MODE1:
++ return true;
++ default:
++ return false;
++ }
+ }
+
+ /**
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
+index 006f21ef7ddf0..62635e58e45ee 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik.c
+@@ -1358,8 +1358,6 @@ static int cik_asic_reset(struct amdgpu_device *adev)
+ int r;
+
+ if (cik_asic_reset_method(adev) == AMD_RESET_METHOD_BACO) {
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ r = amdgpu_dpm_baco_reset(adev);
+ } else {
+ r = cik_asic_pci_config_reset(adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
+index 2d1bebdf1603d..cc3a79029376b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -351,8 +351,6 @@ static int nv_asic_reset(struct amdgpu_device *adev)
+ struct smu_context *smu = &adev->smu;
+
+ if (nv_asic_reset_method(adev) == AMD_RESET_METHOD_BACO) {
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ ret = smu_baco_enter(smu);
+ if (ret)
+ return ret;
+@@ -360,8 +358,6 @@ static int nv_asic_reset(struct amdgpu_device *adev)
+ if (ret)
+ return ret;
+ } else {
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ ret = nv_asic_mode1_reset(adev);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index d8945c31b622c..132a67a041a24 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -569,14 +569,10 @@ static int soc15_asic_reset(struct amdgpu_device *adev)
+
+ switch (soc15_asic_reset_method(adev)) {
+ case AMD_RESET_METHOD_BACO:
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ return soc15_asic_baco_reset(adev);
+ case AMD_RESET_METHOD_MODE2:
+ return amdgpu_dpm_mode2_reset(adev);
+ default:
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ return soc15_asic_mode1_reset(adev);
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
+index 78b35901643bc..3ce10e05d0d6b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vi.c
++++ b/drivers/gpu/drm/amd/amdgpu/vi.c
+@@ -765,8 +765,6 @@ static int vi_asic_reset(struct amdgpu_device *adev)
+ int r;
+
+ if (vi_asic_reset_method(adev) == AMD_RESET_METHOD_BACO) {
+- if (!adev->in_suspend)
+- amdgpu_inc_vram_lost(adev);
+ r = amdgpu_dpm_baco_reset(adev);
+ } else {
+ r = vi_asic_pci_config_reset(adev);
+--
+2.20.1
+
--- /dev/null
+From 9ef43373df4915da7fcce2d483c6e828dab1a088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 23:33:05 -0400
+Subject: ext4: convert BUG_ON's to WARN_ON's in mballoc.c
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 907ea529fc4c3296701d2bfc8b831dd2a8121a34 ]
+
+If the in-core buddy bitmap gets corrupted (or out of sync with the
+block bitmap), issue a WARN_ON and try to recover. In most cases this
+involves skipping trying to allocate out of a particular block group.
+We can end up declaring the file system corrupted, which is fair,
+since the file system probably should be checked before we proceed any
+further.
+
+Link: https://lore.kernel.org/r/20200414035649.293164-1-tytso@mit.edu
+Google-Bug-Id: 34811296
+Google-Bug-Id: 34639169
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 51a78eb65f3cf..2f7aebee1a7b4 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1936,7 +1936,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
+ int free;
+
+ free = e4b->bd_info->bb_free;
+- BUG_ON(free <= 0);
++ if (WARN_ON(free <= 0))
++ return;
+
+ i = e4b->bd_info->bb_first_free;
+
+@@ -1959,7 +1960,8 @@ void ext4_mb_complex_scan_group(struct ext4_allocation_context *ac,
+ }
+
+ mb_find_extent(e4b, i, ac->ac_g_ex.fe_len, &ex);
+- BUG_ON(ex.fe_len <= 0);
++ if (WARN_ON(ex.fe_len <= 0))
++ break;
+ if (free < ex.fe_len) {
+ ext4_grp_locked_error(sb, e4b->bd_group, 0, 0,
+ "%d free clusters as per "
+--
+2.20.1
+
--- /dev/null
+From 84885de3b37d12d1dc05a5345b182d5bfae61999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 22:30:52 -0400
+Subject: ext4: increase wait time needed before reuse of deleted inode numbers
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit a17a9d935dc4a50acefaf319d58030f1da7f115a ]
+
+Current wait times have proven to be too short to protect against inode
+reuses that lead to metadata inconsistencies.
+
+Now that we will retry the inode allocation if we can't find any
+recently deleted inodes, it's a lot safer to increase the recently
+deleted time from 5 seconds to a minute.
+
+Link: https://lore.kernel.org/r/20200414023925.273867-1-tytso@mit.edu
+Google-Bug-Id: 36602237
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/ialloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index f95ee99091e4c..eab18b7b56e77 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -663,7 +663,7 @@ static int find_group_other(struct super_block *sb, struct inode *parent,
+ * block has been written back to disk. (Yes, these values are
+ * somewhat arbitrary...)
+ */
+-#define RECENTCY_MIN 5
++#define RECENTCY_MIN 60
+ #define RECENTCY_DIRTY 300
+
+ static int recently_deleted(struct super_block *sb, ext4_group_t group, int ino)
+--
+2.20.1
+
--- /dev/null
+From 17695e55cfdfd76143d0c98ade826685d4663974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2020 12:10:02 +0800
+Subject: ext4: use matching invalidatepage in ext4_writepage
+
+From: yangerkun <yangerkun@huawei.com>
+
+[ Upstream commit c2a559bc0e7ed5a715ad6b947025b33cb7c05ea7 ]
+
+Run generic/388 with journal data mode sometimes may trigger the warning
+in ext4_invalidatepage. Actually, we should use the matching invalidatepage
+in ext4_writepage.
+
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20200226041002.13914-1-yangerkun@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 37f65ad0d823d..4d3c81fd0902e 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1974,7 +1974,7 @@ static int ext4_writepage(struct page *page,
+ bool keep_towrite = false;
+
+ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) {
+- ext4_invalidatepage(page, 0, PAGE_SIZE);
++ inode->i_mapping->a_ops->invalidatepage(page, 0, PAGE_SIZE);
+ unlock_page(page);
+ return -EIO;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3f94f25dc8747cabbe77554243ac4b8a1bc50678 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Apr 2020 11:28:53 +0200
+Subject: hwmon: (jc42) Fix name to have no illegal characters
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit c843b382e61b5f28a3d917712c69a344f632387c ]
+
+The jc42 driver passes I2C client's name as hwmon device name. In case
+of device tree probed devices this ends up being part of the compatible
+string, "jc-42.4-temp". This name contains hyphens and the hwmon core
+doesn't like this:
+
+jc42 2-0018: hwmon: 'jc-42.4-temp' is not a valid name attribute, please fix
+
+This changes the name to "jc42" which doesn't have any illegal
+characters.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Link: https://lore.kernel.org/r/20200417092853.31206-1-s.hauer@pengutronix.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/jc42.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
+index f2d81b0558e56..e3f1ebee71306 100644
+--- a/drivers/hwmon/jc42.c
++++ b/drivers/hwmon/jc42.c
+@@ -506,7 +506,7 @@ static int jc42_probe(struct i2c_client *client, const struct i2c_device_id *id)
+ }
+ data->config = config;
+
+- hwmon_dev = devm_hwmon_device_register_with_info(dev, client->name,
++ hwmon_dev = devm_hwmon_device_register_with_info(dev, "jc42",
+ data, &jc42_chip_info,
+ NULL);
+ return PTR_ERR_OR_ZERO(hwmon_dev);
+--
+2.20.1
+
--- /dev/null
+From d3bac352cdc13e07aa6aea13ae46344c02afc83d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 11:13:26 +0100
+Subject: irqchip/gic-v4.1: Add support for VPENDBASER's Dirty+Valid signaling
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 96806229ca033f85310bc5c203410189f8a1d2ee ]
+
+When a vPE is made resident, the GIC starts parsing the virtual pending
+table to deliver pending interrupts. This takes place asynchronously,
+and can at times take a long while. Long enough that the vcpu enters
+the guest and hits WFI before any interrupt has been signaled yet.
+The vcpu then exits, blocks, and now gets a doorbell. Rince, repeat.
+
+In order to avoid the above, a (optional on GICv4, mandatory on v4.1)
+feature allows the GIC to feedback to the hypervisor whether it is
+done parsing the VPT by clearing the GICR_VPENDBASER.Dirty bit.
+The hypervisor can then wait until the GIC is ready before actually
+running the vPE.
+
+Plug the detection code as well as polling on vPE schedule. While
+at it, tidy-up the kernel message that displays the GICv4 optional
+features.
+
+Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++++
+ drivers/irqchip/irq-gic-v3.c | 11 +++++++----
+ include/linux/irqchip/arm-gic-v3.h | 2 ++
+ 3 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 7c8f65c9c32de..381513e053029 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -14,6 +14,7 @@
+ #include <linux/dma-iommu.h>
+ #include <linux/efi.h>
+ #include <linux/interrupt.h>
++#include <linux/iopoll.h>
+ #include <linux/irqdomain.h>
+ #include <linux/list.h>
+ #include <linux/log2.h>
+@@ -3516,6 +3517,20 @@ out:
+ return IRQ_SET_MASK_OK_DONE;
+ }
+
++static void its_wait_vpt_parse_complete(void)
++{
++ void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
++ u64 val;
++
++ if (!gic_rdists->has_vpend_valid_dirty)
++ return;
++
++ WARN_ON_ONCE(readq_relaxed_poll_timeout(vlpi_base + GICR_VPENDBASER,
++ val,
++ !(val & GICR_VPENDBASER_Dirty),
++ 10, 500));
++}
++
+ static void its_vpe_schedule(struct its_vpe *vpe)
+ {
+ void __iomem *vlpi_base = gic_data_rdist_vlpi_base();
+@@ -3546,6 +3561,8 @@ static void its_vpe_schedule(struct its_vpe *vpe)
+ val |= vpe->idai ? GICR_VPENDBASER_IDAI : 0;
+ val |= GICR_VPENDBASER_Valid;
+ gicr_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
++
++ its_wait_vpt_parse_complete();
+ }
+
+ static void its_vpe_deschedule(struct its_vpe *vpe)
+@@ -3752,6 +3769,8 @@ static void its_vpe_4_1_schedule(struct its_vpe *vpe,
+ val |= FIELD_PREP(GICR_VPENDBASER_4_1_VPEID, vpe->vpe_id);
+
+ gicr_write_vpendbaser(val, vlpi_base + GICR_VPENDBASER);
++
++ its_wait_vpt_parse_complete();
+ }
+
+ static void its_vpe_4_1_deschedule(struct its_vpe *vpe,
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 1eec9d4649d51..71a84f9c56965 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -866,6 +866,7 @@ static int __gic_update_rdist_properties(struct redist_region *region,
+ gic_data.rdists.has_rvpeid &= !!(typer & GICR_TYPER_RVPEID);
+ gic_data.rdists.has_direct_lpi &= (!!(typer & GICR_TYPER_DirectLPIS) |
+ gic_data.rdists.has_rvpeid);
++ gic_data.rdists.has_vpend_valid_dirty &= !!(typer & GICR_TYPER_DIRTY);
+
+ /* Detect non-sensical configurations */
+ if (WARN_ON_ONCE(gic_data.rdists.has_rvpeid && !gic_data.rdists.has_vlpis)) {
+@@ -886,10 +887,11 @@ static void gic_update_rdist_properties(void)
+ if (WARN_ON(gic_data.ppi_nr == UINT_MAX))
+ gic_data.ppi_nr = 0;
+ pr_info("%d PPIs implemented\n", gic_data.ppi_nr);
+- pr_info("%sVLPI support, %sdirect LPI support, %sRVPEID support\n",
+- !gic_data.rdists.has_vlpis ? "no " : "",
+- !gic_data.rdists.has_direct_lpi ? "no " : "",
+- !gic_data.rdists.has_rvpeid ? "no " : "");
++ if (gic_data.rdists.has_vlpis)
++ pr_info("GICv4 features: %s%s%s\n",
++ gic_data.rdists.has_direct_lpi ? "DirectLPI " : "",
++ gic_data.rdists.has_rvpeid ? "RVPEID " : "",
++ gic_data.rdists.has_vpend_valid_dirty ? "Valid+Dirty " : "");
+ }
+
+ /* Check whether it's single security state view */
+@@ -1614,6 +1616,7 @@ static int __init gic_init_bases(void __iomem *dist_base,
+ gic_data.rdists.has_rvpeid = true;
+ gic_data.rdists.has_vlpis = true;
+ gic_data.rdists.has_direct_lpi = true;
++ gic_data.rdists.has_vpend_valid_dirty = true;
+
+ if (WARN_ON(!gic_data.domain) || WARN_ON(!gic_data.rdists.rdist)) {
+ err = -ENOMEM;
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 83439bfb6c5b0..7613a84a2466b 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -241,6 +241,7 @@
+
+ #define GICR_TYPER_PLPIS (1U << 0)
+ #define GICR_TYPER_VLPIS (1U << 1)
++#define GICR_TYPER_DIRTY (1U << 2)
+ #define GICR_TYPER_DirectLPIS (1U << 3)
+ #define GICR_TYPER_LAST (1U << 4)
+ #define GICR_TYPER_RVPEID (1U << 7)
+@@ -665,6 +666,7 @@ struct rdists {
+ bool has_vlpis;
+ bool has_rvpeid;
+ bool has_direct_lpi;
++ bool has_vpend_valid_dirty;
+ };
+
+ struct irq_domain;
+--
+2.20.1
+
--- /dev/null
+From 13cffda15330753d34d95e861450c2f2f8ffca7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 08:52:07 +0100
+Subject: irqchip/meson-gpio: Fix HARDIRQ-safe -> HARDIRQ-unsafe lock order
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 0a66d6f90cf7d704c6a0f663f7058099eb8c97b0 ]
+
+Running a lockedp-enabled kernel on a vim3l board (Amlogic SM1)
+leads to the following splat:
+
+[ 13.557138] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
+[ 13.587485] ip/456 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
+[ 13.625922] ffff000059908cf0 (&irq_desc_lock_class){-.-.}-{2:2}, at: __setup_irq+0xf8/0x8d8
+[ 13.632273] which would create a new lock dependency:
+[ 13.637272] (&irq_desc_lock_class){-.-.}-{2:2} -> (&ctl->lock){+.+.}-{2:2}
+[ 13.644209]
+[ 13.644209] but this new dependency connects a HARDIRQ-irq-safe lock:
+[ 13.654122] (&irq_desc_lock_class){-.-.}-{2:2}
+[ 13.654125]
+[ 13.654125] ... which became HARDIRQ-irq-safe at:
+[ 13.664759] lock_acquire+0xec/0x368
+[ 13.666926] _raw_spin_lock+0x60/0x88
+[ 13.669979] handle_fasteoi_irq+0x30/0x178
+[ 13.674082] generic_handle_irq+0x38/0x50
+[ 13.678098] __handle_domain_irq+0x6c/0xc8
+[ 13.682209] gic_handle_irq+0x5c/0xb0
+[ 13.685872] el1_irq+0xd0/0x180
+[ 13.689010] arch_cpu_idle+0x40/0x220
+[ 13.692732] default_idle_call+0x54/0x60
+[ 13.696677] do_idle+0x23c/0x2e8
+[ 13.699903] cpu_startup_entry+0x30/0x50
+[ 13.703852] rest_init+0x1e0/0x2b4
+[ 13.707301] arch_call_rest_init+0x18/0x24
+[ 13.711449] start_kernel+0x4ec/0x51c
+[ 13.715167]
+[ 13.715167] to a HARDIRQ-irq-unsafe lock:
+[ 13.722426] (&ctl->lock){+.+.}-{2:2}
+[ 13.722430]
+[ 13.722430] ... which became HARDIRQ-irq-unsafe at:
+[ 13.732319] ...
+[ 13.732324] lock_acquire+0xec/0x368
+[ 13.735985] _raw_spin_lock+0x60/0x88
+[ 13.739452] meson_gpio_irq_domain_alloc+0xcc/0x290
+[ 13.744392] irq_domain_alloc_irqs_hierarchy+0x24/0x60
+[ 13.749586] __irq_domain_alloc_irqs+0x160/0x2f0
+[ 13.754254] irq_create_fwspec_mapping+0x118/0x320
+[ 13.759073] irq_create_of_mapping+0x78/0xa0
+[ 13.763360] of_irq_get+0x6c/0x80
+[ 13.766701] of_mdiobus_register_phy+0x10c/0x238 [of_mdio]
+[ 13.772227] of_mdiobus_register+0x158/0x380 [of_mdio]
+[ 13.777388] mdio_mux_init+0x180/0x2e8 [mdio_mux]
+[ 13.782128] g12a_mdio_mux_probe+0x290/0x398 [mdio_mux_meson_g12a]
+[ 13.788349] platform_drv_probe+0x5c/0xb0
+[ 13.792379] really_probe+0xe4/0x448
+[ 13.795979] driver_probe_device+0xe8/0x140
+[ 13.800189] __device_attach_driver+0x94/0x120
+[ 13.804639] bus_for_each_drv+0x84/0xd8
+[ 13.808474] __device_attach+0xe4/0x168
+[ 13.812361] device_initial_probe+0x1c/0x28
+[ 13.816592] bus_probe_device+0xa4/0xb0
+[ 13.820430] deferred_probe_work_func+0xa8/0x100
+[ 13.825064] process_one_work+0x264/0x688
+[ 13.829088] worker_thread+0x4c/0x458
+[ 13.832768] kthread+0x154/0x158
+[ 13.836018] ret_from_fork+0x10/0x18
+[ 13.839612]
+[ 13.839612] other info that might help us debug this:
+[ 13.839612]
+[ 13.850354] Possible interrupt unsafe locking scenario:
+[ 13.850354]
+[ 13.855720] CPU0 CPU1
+[ 13.858774] ---- ----
+[ 13.863242] lock(&ctl->lock);
+[ 13.866330] local_irq_disable();
+[ 13.872233] lock(&irq_desc_lock_class);
+[ 13.878705] lock(&ctl->lock);
+[ 13.884297] <Interrupt>
+[ 13.886857] lock(&irq_desc_lock_class);
+[ 13.891014]
+[ 13.891014] *** DEADLOCK ***
+
+The issue can occur when CPU1 is doing something like irq_set_type()
+and CPU0 performing an interrupt allocation, for example. Taking
+an interrupt (like the one being reconfigured) would lead to a deadlock.
+
+A solution to this is:
+
+- Reorder the locking so that meson_gpio_irq_update_bits takes the lock
+ itself at all times, instead of relying on the caller to lock or not,
+ hence making the RMW sequence atomic,
+
+- Rework the critical section in meson_gpio_irq_request_channel to only
+ cover the allocation itself, and let the gpio_irq_sel_pin callback
+ deal with its own locking if required,
+
+- Take the private spin-lock with interrupts disabled at all times
+
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-meson-gpio.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
+index ccc7f823911bd..bc7aebcc96e9c 100644
+--- a/drivers/irqchip/irq-meson-gpio.c
++++ b/drivers/irqchip/irq-meson-gpio.c
+@@ -144,12 +144,17 @@ struct meson_gpio_irq_controller {
+ static void meson_gpio_irq_update_bits(struct meson_gpio_irq_controller *ctl,
+ unsigned int reg, u32 mask, u32 val)
+ {
++ unsigned long flags;
+ u32 tmp;
+
++ spin_lock_irqsave(&ctl->lock, flags);
++
+ tmp = readl_relaxed(ctl->base + reg);
+ tmp &= ~mask;
+ tmp |= val;
+ writel_relaxed(tmp, ctl->base + reg);
++
++ spin_unlock_irqrestore(&ctl->lock, flags);
+ }
+
+ static void meson_gpio_irq_init_dummy(struct meson_gpio_irq_controller *ctl)
+@@ -196,14 +201,15 @@ meson_gpio_irq_request_channel(struct meson_gpio_irq_controller *ctl,
+ unsigned long hwirq,
+ u32 **channel_hwirq)
+ {
++ unsigned long flags;
+ unsigned int idx;
+
+- spin_lock(&ctl->lock);
++ spin_lock_irqsave(&ctl->lock, flags);
+
+ /* Find a free channel */
+ idx = find_first_zero_bit(ctl->channel_map, NUM_CHANNEL);
+ if (idx >= NUM_CHANNEL) {
+- spin_unlock(&ctl->lock);
++ spin_unlock_irqrestore(&ctl->lock, flags);
+ pr_err("No channel available\n");
+ return -ENOSPC;
+ }
+@@ -211,6 +217,8 @@ meson_gpio_irq_request_channel(struct meson_gpio_irq_controller *ctl,
+ /* Mark the channel as used */
+ set_bit(idx, ctl->channel_map);
+
++ spin_unlock_irqrestore(&ctl->lock, flags);
++
+ /*
+ * Setup the mux of the channel to route the signal of the pad
+ * to the appropriate input of the GIC
+@@ -225,8 +233,6 @@ meson_gpio_irq_request_channel(struct meson_gpio_irq_controller *ctl,
+ */
+ *channel_hwirq = &(ctl->channel_irqs[idx]);
+
+- spin_unlock(&ctl->lock);
+-
+ pr_debug("hwirq %lu assigned to channel %d - irq %u\n",
+ hwirq, idx, **channel_hwirq);
+
+@@ -287,13 +293,9 @@ static int meson_gpio_irq_type_setup(struct meson_gpio_irq_controller *ctl,
+ val |= REG_EDGE_POL_LOW(params, idx);
+ }
+
+- spin_lock(&ctl->lock);
+-
+ meson_gpio_irq_update_bits(ctl, REG_EDGE_POL,
+ REG_EDGE_POL_MASK(params, idx), val);
+
+- spin_unlock(&ctl->lock);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9497ab1fadb3e17eaaead92eb3489af7113a02ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Apr 2020 01:14:30 -0400
+Subject: libbpf: Initialize *nl_pid so gcc 10 is happy
+
+From: Jeremy Cline <jcline@redhat.com>
+
+[ Upstream commit 4734b0fefbbf98f8c119eb8344efa19dac82cd2c ]
+
+Builds of Fedora's kernel-tools package started to fail with "may be
+used uninitialized" warnings for nl_pid in bpf_set_link_xdp_fd() and
+bpf_get_link_xdp_info() on the s390 architecture.
+
+Although libbpf_netlink_open() always returns a negative number when it
+does not set *nl_pid, the compiler does not determine this and thus
+believes the variable might be used uninitialized. Assuage gcc's fears
+by explicitly initializing nl_pid.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1807781
+
+Signed-off-by: Jeremy Cline <jcline@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200404051430.698058-1-jcline@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/netlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index c364e4be5e6eb..c1a7fc1859401 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -141,7 +141,7 @@ int bpf_set_link_xdp_fd(int ifindex, int fd, __u32 flags)
+ struct ifinfomsg ifinfo;
+ char attrbuf[64];
+ } req;
+- __u32 nl_pid;
++ __u32 nl_pid = 0;
+
+ sock = libbpf_netlink_open(&nl_pid);
+ if (sock < 0)
+@@ -256,7 +256,7 @@ int bpf_get_link_xdp_info(int ifindex, struct xdp_link_info *info,
+ {
+ struct xdp_id_md xdp_id = {};
+ int sock, ret;
+- __u32 nl_pid;
++ __u32 nl_pid = 0;
+ __u32 mask;
+
+ if (flags & ~XDP_FLAGS_MASK || !info_size)
+--
+2.20.1
+
--- /dev/null
+From 0286e7c149c9b19033e3fb3b58f398086855c6d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Mar 2020 19:23:24 +0530
+Subject: mac80211: fix channel switch trigger from unknown mesh peer
+
+From: Tamizh chelvam <tamizhr@codeaurora.org>
+
+[ Upstream commit 93e2d04a1888668183f3fb48666e90b9b31d29e6 ]
+
+Previously mesh channel switch happens if beacon contains
+CSA IE without checking the mesh peer info. Due to that
+channel switch happens even if the beacon is not from
+its own mesh peer. Fixing that by checking if the CSA
+originated from the same mesh network before proceeding
+for channel switch.
+
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Link: https://lore.kernel.org/r/1585403604-29274-1-git-send-email-tamizhr@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index d09b3c789314d..36978a0e50001 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1257,15 +1257,15 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+ sdata->u.mesh.mshcfg.rssi_threshold < rx_status->signal)
+ mesh_neighbour_update(sdata, mgmt->sa, &elems,
+ rx_status);
++
++ if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
++ !sdata->vif.csa_active)
++ ieee80211_mesh_process_chnswitch(sdata, &elems, true);
+ }
+
+ if (ifmsh->sync_ops)
+ ifmsh->sync_ops->rx_bcn_presp(sdata,
+ stype, mgmt, &elems, rx_status);
+-
+- if (ifmsh->csa_role != IEEE80211_MESH_CSA_ROLE_INIT &&
+- !sdata->vif.csa_active)
+- ieee80211_mesh_process_chnswitch(sdata, &elems, true);
+ }
+
+ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
+@@ -1373,6 +1373,9 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
+ ieee802_11_parse_elems(pos, len - baselen, true, &elems,
+ mgmt->bssid, NULL);
+
++ if (!mesh_matches_local(sdata, &elems))
++ return;
++
+ ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
+ if (!--ifmsh->chsw_ttl)
+ fwd_csa = false;
+--
+2.20.1
+
--- /dev/null
+From 6a59e431ae93be5dfbdd2b391a8675a3d08c88f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Apr 2020 15:51:27 +0200
+Subject: net: fec: set GPR bit on suspend by DT configuration.
+
+From: Martin Fuzzey <martin.fuzzey@flowbird.group>
+
+[ Upstream commit da722186f6549d752ea5b5fbc18111833c81a133 ]
+
+On some SoCs, such as the i.MX6, it is necessary to set a bit
+in the SoC level GPR register before suspending for wake on lan
+to work.
+
+The fec platform callback sleep_mode_enable was intended to allow this
+but the platform implementation was NAK'd back in 2015 [1]
+
+This means that, currently, wake on lan is broken on mainline for
+the i.MX6 at least.
+
+So implement the required bit setting in the fec driver by itself
+by adding a new optional DT property indicating the GPR register
+and adding the offset and bit information to the driver.
+
+[1] https://www.spinics.net/lists/netdev/msg310922.html
+
+Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
+Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec.h | 7 +
+ drivers/net/ethernet/freescale/fec_main.c | 149 +++++++++++++++++-----
+ 2 files changed, 127 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
+index f79e57f735b39..d89568f810bc4 100644
+--- a/drivers/net/ethernet/freescale/fec.h
++++ b/drivers/net/ethernet/freescale/fec.h
+@@ -488,6 +488,12 @@ struct fec_enet_priv_rx_q {
+ struct sk_buff *rx_skbuff[RX_RING_SIZE];
+ };
+
++struct fec_stop_mode_gpr {
++ struct regmap *gpr;
++ u8 reg;
++ u8 bit;
++};
++
+ /* The FEC buffer descriptors track the ring buffers. The rx_bd_base and
+ * tx_bd_base always point to the base of the buffer descriptors. The
+ * cur_rx and cur_tx point to the currently available buffer.
+@@ -562,6 +568,7 @@ struct fec_enet_private {
+ int hwts_tx_en;
+ struct delayed_work time_keep;
+ struct regulator *reg_phy;
++ struct fec_stop_mode_gpr stop_gpr;
+
+ unsigned int tx_align;
+ unsigned int rx_align;
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 23c5fef2f1ad1..869efbb6c4d0b 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -62,6 +62,8 @@
+ #include <linux/if_vlan.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/prefetch.h>
++#include <linux/mfd/syscon.h>
++#include <linux/regmap.h>
+ #include <soc/imx/cpuidle.h>
+
+ #include <asm/cacheflush.h>
+@@ -84,6 +86,56 @@ static void fec_enet_itr_coal_init(struct net_device *ndev);
+ #define FEC_ENET_OPD_V 0xFFF0
+ #define FEC_MDIO_PM_TIMEOUT 100 /* ms */
+
++struct fec_devinfo {
++ u32 quirks;
++ u8 stop_gpr_reg;
++ u8 stop_gpr_bit;
++};
++
++static const struct fec_devinfo fec_imx25_info = {
++ .quirks = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR |
++ FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx27_info = {
++ .quirks = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx28_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME |
++ FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC |
++ FEC_QUIRK_HAS_FRREG,
++};
++
++static const struct fec_devinfo fec_imx6q_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358 |
++ FEC_QUIRK_HAS_RACC,
++ .stop_gpr_reg = 0x34,
++ .stop_gpr_bit = 27,
++};
++
++static const struct fec_devinfo fec_mvf600_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_RACC,
++};
++
++static const struct fec_devinfo fec_imx6x_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
++ FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE |
++ FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE,
++};
++
++static const struct fec_devinfo fec_imx6ul_info = {
++ .quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
++ FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
++ FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR007885 |
++ FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC |
++ FEC_QUIRK_HAS_COALESCE,
++};
++
+ static struct platform_device_id fec_devtype[] = {
+ {
+ /* keep it for coldfire */
+@@ -91,39 +143,25 @@ static struct platform_device_id fec_devtype[] = {
+ .driver_data = 0,
+ }, {
+ .name = "imx25-fec",
+- .driver_data = FEC_QUIRK_USE_GASKET | FEC_QUIRK_MIB_CLEAR |
+- FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx25_info,
+ }, {
+ .name = "imx27-fec",
+- .driver_data = FEC_QUIRK_MIB_CLEAR | FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx27_info,
+ }, {
+ .name = "imx28-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME |
+- FEC_QUIRK_SINGLE_MDIO | FEC_QUIRK_HAS_RACC |
+- FEC_QUIRK_HAS_FRREG,
++ .driver_data = (kernel_ulong_t)&fec_imx28_info,
+ }, {
+ .name = "imx6q-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR006358 |
+- FEC_QUIRK_HAS_RACC,
++ .driver_data = (kernel_ulong_t)&fec_imx6q_info,
+ }, {
+ .name = "mvf600-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_RACC,
++ .driver_data = (kernel_ulong_t)&fec_mvf600_info,
+ }, {
+ .name = "imx6sx-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
+- FEC_QUIRK_ERR007885 | FEC_QUIRK_BUG_CAPTURE |
+- FEC_QUIRK_HAS_RACC | FEC_QUIRK_HAS_COALESCE,
++ .driver_data = (kernel_ulong_t)&fec_imx6x_info,
+ }, {
+ .name = "imx6ul-fec",
+- .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
+- FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
+- FEC_QUIRK_HAS_VLAN | FEC_QUIRK_ERR007885 |
+- FEC_QUIRK_BUG_CAPTURE | FEC_QUIRK_HAS_RACC |
+- FEC_QUIRK_HAS_COALESCE,
++ .driver_data = (kernel_ulong_t)&fec_imx6ul_info,
+ }, {
+ /* sentinel */
+ }
+@@ -1092,11 +1130,28 @@ fec_restart(struct net_device *ndev)
+
+ }
+
++static void fec_enet_stop_mode(struct fec_enet_private *fep, bool enabled)
++{
++ struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
++ struct fec_stop_mode_gpr *stop_gpr = &fep->stop_gpr;
++
++ if (stop_gpr->gpr) {
++ if (enabled)
++ regmap_update_bits(stop_gpr->gpr, stop_gpr->reg,
++ BIT(stop_gpr->bit),
++ BIT(stop_gpr->bit));
++ else
++ regmap_update_bits(stop_gpr->gpr, stop_gpr->reg,
++ BIT(stop_gpr->bit), 0);
++ } else if (pdata && pdata->sleep_mode_enable) {
++ pdata->sleep_mode_enable(enabled);
++ }
++}
++
+ static void
+ fec_stop(struct net_device *ndev)
+ {
+ struct fec_enet_private *fep = netdev_priv(ndev);
+- struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
+ u32 rmii_mode = readl(fep->hwp + FEC_R_CNTRL) & (1 << 8);
+ u32 val;
+
+@@ -1125,9 +1180,7 @@ fec_stop(struct net_device *ndev)
+ val = readl(fep->hwp + FEC_ECNTRL);
+ val |= (FEC_ECR_MAGICEN | FEC_ECR_SLEEP);
+ writel(val, fep->hwp + FEC_ECNTRL);
+-
+- if (pdata && pdata->sleep_mode_enable)
+- pdata->sleep_mode_enable(true);
++ fec_enet_stop_mode(fep, true);
+ }
+ writel(fep->phy_speed, fep->hwp + FEC_MII_SPEED);
+
+@@ -3397,6 +3450,37 @@ static int fec_enet_get_irq_cnt(struct platform_device *pdev)
+ return irq_cnt;
+ }
+
++static int fec_enet_init_stop_mode(struct fec_enet_private *fep,
++ struct fec_devinfo *dev_info,
++ struct device_node *np)
++{
++ struct device_node *gpr_np;
++ int ret = 0;
++
++ if (!dev_info)
++ return 0;
++
++ gpr_np = of_parse_phandle(np, "gpr", 0);
++ if (!gpr_np)
++ return 0;
++
++ fep->stop_gpr.gpr = syscon_node_to_regmap(gpr_np);
++ if (IS_ERR(fep->stop_gpr.gpr)) {
++ dev_err(&fep->pdev->dev, "could not find gpr regmap\n");
++ ret = PTR_ERR(fep->stop_gpr.gpr);
++ fep->stop_gpr.gpr = NULL;
++ goto out;
++ }
++
++ fep->stop_gpr.reg = dev_info->stop_gpr_reg;
++ fep->stop_gpr.bit = dev_info->stop_gpr_bit;
++
++out:
++ of_node_put(gpr_np);
++
++ return ret;
++}
++
+ static int
+ fec_probe(struct platform_device *pdev)
+ {
+@@ -3412,6 +3496,7 @@ fec_probe(struct platform_device *pdev)
+ int num_rx_qs;
+ char irq_name[8];
+ int irq_cnt;
++ struct fec_devinfo *dev_info;
+
+ fec_enet_get_queue_num(pdev, &num_tx_qs, &num_rx_qs);
+
+@@ -3429,7 +3514,9 @@ fec_probe(struct platform_device *pdev)
+ of_id = of_match_device(fec_dt_ids, &pdev->dev);
+ if (of_id)
+ pdev->id_entry = of_id->data;
+- fep->quirks = pdev->id_entry->driver_data;
++ dev_info = (struct fec_devinfo *)pdev->id_entry->driver_data;
++ if (dev_info)
++ fep->quirks = dev_info->quirks;
+
+ fep->netdev = ndev;
+ fep->num_rx_queues = num_rx_qs;
+@@ -3463,6 +3550,10 @@ fec_probe(struct platform_device *pdev)
+ if (of_get_property(np, "fsl,magic-packet", NULL))
+ fep->wol_flag |= FEC_WOL_HAS_MAGIC_PACKET;
+
++ ret = fec_enet_init_stop_mode(fep, dev_info, np);
++ if (ret)
++ goto failed_stop_mode;
++
+ phy_node = of_parse_phandle(np, "phy-handle", 0);
+ if (!phy_node && of_phy_is_fixed_link(np)) {
+ ret = of_phy_register_fixed_link(np);
+@@ -3631,6 +3722,7 @@ failed_clk:
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(phy_node);
++failed_stop_mode:
+ failed_phy:
+ dev_id--;
+ failed_ioremap:
+@@ -3708,7 +3800,6 @@ static int __maybe_unused fec_resume(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct fec_enet_private *fep = netdev_priv(ndev);
+- struct fec_platform_data *pdata = fep->pdev->dev.platform_data;
+ int ret;
+ int val;
+
+@@ -3726,8 +3817,8 @@ static int __maybe_unused fec_resume(struct device *dev)
+ goto failed_clk;
+ }
+ if (fep->wol_flag & FEC_WOL_FLAG_ENABLE) {
+- if (pdata && pdata->sleep_mode_enable)
+- pdata->sleep_mode_enable(false);
++ fec_enet_stop_mode(fep, false);
++
+ val = readl(fep->hwp + FEC_ECNTRL);
+ val &= ~(FEC_ECR_MAGICEN | FEC_ECR_SLEEP);
+ writel(val, fep->hwp + FEC_ECNTRL);
+--
+2.20.1
+
--- /dev/null
+From 1fafc6ae90f2d5c02153976fb5c9719599fe5db9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Apr 2020 10:12:34 +0900
+Subject: net: stmmac: socfpga: Allow all RGMII modes
+
+From: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+
+[ Upstream commit a7a0d6269652846671312b29992143f56e2866b8 ]
+
+Allow all the RGMII modes to be used. (Not only "rgmii", "rgmii-id"
+but "rgmii-txid", "rgmii-rxid")
+
+Signed-off-by: Atsushi Nemoto <atsushi.nemoto@sord.co.jp>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+index e0212d2fc2a12..fa32cd5b418ef 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+@@ -241,6 +241,8 @@ static int socfpga_set_phy_mode_common(int phymode, u32 *val)
+ switch (phymode) {
+ case PHY_INTERFACE_MODE_RGMII:
+ case PHY_INTERFACE_MODE_RGMII_ID:
++ case PHY_INTERFACE_MODE_RGMII_RXID:
++ case PHY_INTERFACE_MODE_RGMII_TXID:
+ *val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII;
+ break;
+ case PHY_INTERFACE_MODE_MII:
+--
+2.20.1
+
--- /dev/null
+From 0ca1b560ff9fe7d157ad43bd7d43c79d30ab5c0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 13:23:25 -0500
+Subject: objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit bd841d6154f5f41f8a32d3c1b0bc229e326e640a ]
+
+CONFIG_UBSAN_TRAP causes GCC to emit a UD2 whenever it encounters an
+unreachable code path. This includes __builtin_unreachable(). Because
+the BUG() macro uses __builtin_unreachable() after it emits its own UD2,
+this results in a double UD2. In this case objtool rightfully detects
+that the second UD2 is unreachable:
+
+ init/main.o: warning: objtool: repair_env_string()+0x1c8: unreachable instruction
+
+We weren't able to figure out a way to get rid of the double UD2s, so
+just silence the warning.
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/6653ad73c6b59c049211bd7c11ed3809c20ee9f5.1585761021.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 2b765bbbef922..95c485d3d4d83 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2307,14 +2307,27 @@ static bool ignore_unreachable_insn(struct instruction *insn)
+ !strcmp(insn->sec->name, ".altinstr_aux"))
+ return true;
+
++ if (!insn->func)
++ return false;
++
++ /*
++ * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
++ * __builtin_unreachable(). The BUG() macro has an unreachable() after
++ * the UD2, which causes GCC's undefined trap logic to emit another UD2
++ * (or occasionally a JMP to UD2).
++ */
++ if (list_prev_entry(insn, list)->dead_end &&
++ (insn->type == INSN_BUG ||
++ (insn->type == INSN_JUMP_UNCONDITIONAL &&
++ insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
++ return true;
++
+ /*
+ * Check if this (or a subsequent) instruction is related to
+ * CONFIG_UBSAN or CONFIG_KASAN.
+ *
+ * End the search at 5 instructions to avoid going into the weeds.
+ */
+- if (!insn->func)
+- return false;
+ for (i = 0; i < 5; i++) {
+
+ if (is_kasan_insn(insn) || is_ubsan_insn(insn))
+--
+2.20.1
+
--- /dev/null
+From 6dfbced63a0ea31086dc092cdc29001e5a450d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 13:23:26 -0500
+Subject: objtool: Support Clang non-section symbols in ORC dump
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 8782e7cab51b6bf01a5a86471dd82228af1ac185 ]
+
+Historically, the relocation symbols for ORC entries have only been
+section symbols:
+
+ .text+0: sp:sp+8 bp:(und) type:call end:0
+
+However, the Clang assembler is aggressive about stripping section
+symbols. In that case we will need to use function symbols:
+
+ freezing_slow_path+0: sp:sp+8 bp:(und) type:call end:0
+
+In preparation for the generation of such entries in "objtool orc
+generate", add support for reading them in "objtool orc dump".
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/b811b5eb1a42602c3b523576dc5efab9ad1c174d.1585761021.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/orc_dump.c | 44 ++++++++++++++++++++++++----------------
+ 1 file changed, 27 insertions(+), 17 deletions(-)
+
+diff --git a/tools/objtool/orc_dump.c b/tools/objtool/orc_dump.c
+index 13ccf775a83a4..ba4cbb1cdd632 100644
+--- a/tools/objtool/orc_dump.c
++++ b/tools/objtool/orc_dump.c
+@@ -66,7 +66,7 @@ int orc_dump(const char *_objname)
+ char *name;
+ size_t nr_sections;
+ Elf64_Addr orc_ip_addr = 0;
+- size_t shstrtab_idx;
++ size_t shstrtab_idx, strtab_idx = 0;
+ Elf *elf;
+ Elf_Scn *scn;
+ GElf_Shdr sh;
+@@ -127,6 +127,8 @@ int orc_dump(const char *_objname)
+
+ if (!strcmp(name, ".symtab")) {
+ symtab = data;
++ } else if (!strcmp(name, ".strtab")) {
++ strtab_idx = i;
+ } else if (!strcmp(name, ".orc_unwind")) {
+ orc = data->d_buf;
+ orc_size = sh.sh_size;
+@@ -138,7 +140,7 @@ int orc_dump(const char *_objname)
+ }
+ }
+
+- if (!symtab || !orc || !orc_ip)
++ if (!symtab || !strtab_idx || !orc || !orc_ip)
+ return 0;
+
+ if (orc_size % sizeof(*orc) != 0) {
+@@ -159,21 +161,29 @@ int orc_dump(const char *_objname)
+ return -1;
+ }
+
+- scn = elf_getscn(elf, sym.st_shndx);
+- if (!scn) {
+- WARN_ELF("elf_getscn");
+- return -1;
+- }
+-
+- if (!gelf_getshdr(scn, &sh)) {
+- WARN_ELF("gelf_getshdr");
+- return -1;
+- }
+-
+- name = elf_strptr(elf, shstrtab_idx, sh.sh_name);
+- if (!name || !*name) {
+- WARN_ELF("elf_strptr");
+- return -1;
++ if (GELF_ST_TYPE(sym.st_info) == STT_SECTION) {
++ scn = elf_getscn(elf, sym.st_shndx);
++ if (!scn) {
++ WARN_ELF("elf_getscn");
++ return -1;
++ }
++
++ if (!gelf_getshdr(scn, &sh)) {
++ WARN_ELF("gelf_getshdr");
++ return -1;
++ }
++
++ name = elf_strptr(elf, shstrtab_idx, sh.sh_name);
++ if (!name) {
++ WARN_ELF("elf_strptr");
++ return -1;
++ }
++ } else {
++ name = elf_strptr(elf, strtab_idx, sym.st_name);
++ if (!name) {
++ WARN_ELF("elf_strptr");
++ return -1;
++ }
+ }
+
+ printf("%s+%llx:", name, (unsigned long long)rela.r_addend);
+--
+2.20.1
+
--- /dev/null
+From bd9762b06fc52aecd18a661e32323cb340ce61ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Apr 2020 18:35:17 -0400
+Subject: sched/isolation: Allow "isolcpus=" to skip unknown sub-parameters
+
+From: Peter Xu <peterx@redhat.com>
+
+[ Upstream commit 3662daf023500dc084fa3b96f68a6f46179ddc73 ]
+
+The "isolcpus=" parameter allows sub-parameters before the cpulist is
+specified, and if the parser detects an unknown sub-parameters the whole
+parameter will be ignored.
+
+This design is incompatible with itself when new sub-parameters are added.
+An older kernel will not recognize the new sub-parameter and will
+invalidate the whole parameter so the CPU isolation will not take
+effect. It emits a warning:
+
+ isolcpus: Error, unknown flag
+
+The better and compatible way is to allow "isolcpus=" to skip unknown
+sub-parameters, so that even if new sub-parameters are added an older
+kernel will still be able to behave as usual even if with the new
+sub-parameter specified on the command line.
+
+Ideally this should have been there when the first sub-parameter for
+"isolcpus=" was introduced.
+
+Suggested-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20200403223517.406353-1-peterx@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/isolation.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
+index 008d6ac2342b7..808244f3ddd98 100644
+--- a/kernel/sched/isolation.c
++++ b/kernel/sched/isolation.c
+@@ -149,6 +149,9 @@ __setup("nohz_full=", housekeeping_nohz_full_setup);
+ static int __init housekeeping_isolcpus_setup(char *str)
+ {
+ unsigned int flags = 0;
++ bool illegal = false;
++ char *par;
++ int len;
+
+ while (isalpha(*str)) {
+ if (!strncmp(str, "nohz,", 5)) {
+@@ -169,8 +172,22 @@ static int __init housekeeping_isolcpus_setup(char *str)
+ continue;
+ }
+
+- pr_warn("isolcpus: Error, unknown flag\n");
+- return 0;
++ /*
++ * Skip unknown sub-parameter and validate that it is not
++ * containing an invalid character.
++ */
++ for (par = str, len = 0; *str && *str != ','; str++, len++) {
++ if (!isalpha(*str) && *str != '_')
++ illegal = true;
++ }
++
++ if (illegal) {
++ pr_warn("isolcpus: Invalid flag %.*s\n", len, par);
++ return 0;
++ }
++
++ pr_info("isolcpus: Skipped unknown flag %.*s\n", len, par);
++ str++;
+ }
+
+ /* Default behaviour for isolcpus without flags */
+--
+2.20.1
+
--- /dev/null
+From 56d228de775e2de58b0b43a6360127ed5fac5fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 22:43:34 +0100
+Subject: sched/vtime: Work around an unitialized variable warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit e0d648f9d883ec1efab261af158d73aa30e9dd12 ]
+
+Work around this warning:
+
+ kernel/sched/cputime.c: In function ‘kcpustat_field’:
+ kernel/sched/cputime.c:1007:6: warning: ‘val’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+
+because GCC can't see that val is used only when err is 0.
+
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200327214334.GF8015@zn.tnic
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/cputime.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
+index dac9104d126f7..ff9435dee1df2 100644
+--- a/kernel/sched/cputime.c
++++ b/kernel/sched/cputime.c
+@@ -1003,12 +1003,12 @@ u64 kcpustat_field(struct kernel_cpustat *kcpustat,
+ enum cpu_usage_stat usage, int cpu)
+ {
+ u64 *cpustat = kcpustat->cpustat;
++ u64 val = cpustat[usage];
+ struct rq *rq;
+- u64 val;
+ int err;
+
+ if (!vtime_accounting_enabled_cpu(cpu))
+- return cpustat[usage];
++ return val;
+
+ rq = cpu_rq(cpu);
+
+--
+2.20.1
+
--- /dev/null
+From 3d4c2e2c49b50f2d3774fd85ed9b1a2d199cdc40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Apr 2020 15:26:10 +0200
+Subject: scsi: target: fix PR IN / READ FULL STATUS for FC
+
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+
+[ Upstream commit 8fed04eb79a74cbf471dfaa755900a51b37273ab ]
+
+Creation of the response to READ FULL STATUS fails for FC based
+reservations. Reason is the too high loop limit (< 24) in
+fc_get_pr_transport_id(). The string representation of FC WWPN is 23 chars
+long only ("11:22:33:44:55:66:77:88"). So when i is 23, the loop body is
+executed a last time for the ending '\0' of the string and thus hex2bin()
+reports an error.
+
+Link: https://lore.kernel.org/r/20200408132610.14623-3-bstroesser@ts.fujitsu.com
+Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Reviewed-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_fabric_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
+index 6b4b354c88aa0..b5c970faf5854 100644
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -63,7 +63,7 @@ static int fc_get_pr_transport_id(
+ * encoded TransportID.
+ */
+ ptr = &se_nacl->initiatorname[0];
+- for (i = 0; i < 24; ) {
++ for (i = 0; i < 23; ) {
+ if (!strncmp(&ptr[i], ":", 1)) {
+ i++;
+ continue;
+--
+2.20.1
+
--- /dev/null
+From a988563a328decbed0be25c2728e52acce3f26e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Apr 2020 12:10:26 +0200
+Subject: scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN
+
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+
+[ Upstream commit 066f79a5fd6d1b9a5cc57b5cd445b3e4bb68a5b2 ]
+
+In case command ring buffer becomes inconsistent, tcmu sets device flag
+TCMU_DEV_BIT_BROKEN. If the bit is set, tcmu rejects new commands from LIO
+core with TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE, and no longer processes
+completions from the ring. The reset_ring attribute can be used to
+completely clean up the command ring, so after reset_ring the ring no
+longer is inconsistent.
+
+Therefore reset_ring also should reset bit TCMU_DEV_BIT_BROKEN to allow
+normal processing.
+
+Link: https://lore.kernel.org/r/20200409101026.17872-1-bstroesser@ts.fujitsu.com
+Acked-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 0b9dfa6b17bc7..f769bb1e37356 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -2073,6 +2073,7 @@ static void tcmu_reset_ring(struct tcmu_dev *udev, u8 err_level)
+ mb->cmd_tail = 0;
+ mb->cmd_head = 0;
+ tcmu_flush_dcache_range(mb, sizeof(*mb));
++ clear_bit(TCMU_DEV_BIT_BROKEN, &udev->flags);
+
+ del_timer(&udev->cmd_timer);
+
+--
+2.20.1
+
selftests-bpf-fix-a-couple-of-broken-test_btf-cases.patch
mm-shmem-disable-interrupt-when-acquiring-info-lock-in-userfaultfd_copy-path.patch
xfs-clear-pf_memalloc-before-exiting-xfsaild-thread.patch
+libbpf-initialize-nl_pid-so-gcc-10-is-happy.patch
+net-fec-set-gpr-bit-on-suspend-by-dt-configuration.patch
+x86-hyperv-report-value-of-misc_features.patch
+signal-check-sig-before-setting-info-in-kill_pid_usb.patch
+afs-fix-length-of-dump-of-bad-yfsfetchstatus-record.patch
+xfs-fix-partially-uninitialized-structure-in-xfs_ref.patch
+alsa-hda-release-resources-at-error-in-delayed-probe.patch
+alsa-hda-keep-the-controller-initialization-even-if-.patch
+alsa-hda-explicitly-permit-using-autosuspend-if-runt.patch
+drm-amdgpu-fix-wrong-vram-lost-counter-increment-v2.patch
+scsi-target-fix-pr-in-read-full-status-for-fc.patch
+scsi-target-tcmu-reset_ring-should-reset-tcmu_dev_bi.patch
+objtool-fix-config_ubsan_trap-unreachable-warnings.patch
+objtool-support-clang-non-section-symbols-in-orc-dum.patch
+xen-xenbus-ensure-xenbus_map_ring_valloc-returns-pro.patch
+alsa-hda-call-runtime_allow-for-all-hda-controllers.patch
+net-stmmac-socfpga-allow-all-rgmii-modes.patch
+mac80211-fix-channel-switch-trigger-from-unknown-mes.patch
+sched-isolation-allow-isolcpus-to-skip-unknown-sub-p.patch
+sched-vtime-work-around-an-unitialized-variable-warn.patch
+arm64-delete-the-space-separator-in-__emit_inst.patch
+ext4-use-matching-invalidatepage-in-ext4_writepage.patch
+ext4-increase-wait-time-needed-before-reuse-of-delet.patch
+ext4-convert-bug_on-s-to-warn_on-s-in-mballoc.c.patch
+irqchip-gic-v4.1-add-support-for-vpendbaser-s-dirty-.patch
+blk-mq-put-driver-tag-in-blk_mq_dispatch_rq_list-whe.patch
+irqchip-meson-gpio-fix-hardirq-safe-hardirq-unsafe-l.patch
+hwmon-jc42-fix-name-to-have-no-illegal-characters.patch
--- /dev/null
+From 20e9e168a377b4129bc8f65bd91fd4cab481b107 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2020 10:18:33 +0800
+Subject: signal: check sig before setting info in kill_pid_usb_asyncio
+
+From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+
+[ Upstream commit eaec2b0bd30690575c581eebffae64bfb7f684ac ]
+
+In kill_pid_usb_asyncio, if signal is not valid, we do not need to
+set info struct.
+
+Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Link: https://lore.kernel.org/r/f525fd08-1cf7-fb09-d20c-4359145eb940@huawei.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/signal.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 7938c60e11dd2..9abf962bbde47 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1510,15 +1510,15 @@ int kill_pid_usb_asyncio(int sig, int errno, sigval_t addr,
+ unsigned long flags;
+ int ret = -EINVAL;
+
++ if (!valid_signal(sig))
++ return ret;
++
+ clear_siginfo(&info);
+ info.si_signo = sig;
+ info.si_errno = errno;
+ info.si_code = SI_ASYNCIO;
+ *((sigval_t *)&info.si_pid) = addr;
+
+- if (!valid_signal(sig))
+- return ret;
+-
+ rcu_read_lock();
+ p = pid_task(pid, PIDTYPE_PID);
+ if (!p) {
+--
+2.20.1
+
--- /dev/null
+From d70df66068639f8b9e47e15120bafb134d2915ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Apr 2020 19:27:39 +0200
+Subject: x86: hyperv: report value of misc_features
+
+From: Olaf Hering <olaf@aepfle.de>
+
+[ Upstream commit 97d9f1c43bedd400301d6f1eff54d46e8c636e47 ]
+
+A few kernel features depend on ms_hyperv.misc_features, but unlike its
+siblings ->features and ->hints, the value was never reported during boot.
+
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+Link: https://lore.kernel.org/r/20200407172739.31371-1-olaf@aepfle.de
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mshyperv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index 5e296a7e60363..ebf34c7bc8bc0 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -227,8 +227,8 @@ static void __init ms_hyperv_init_platform(void)
+ ms_hyperv.misc_features = cpuid_edx(HYPERV_CPUID_FEATURES);
+ ms_hyperv.hints = cpuid_eax(HYPERV_CPUID_ENLIGHTMENT_INFO);
+
+- pr_info("Hyper-V: features 0x%x, hints 0x%x\n",
+- ms_hyperv.features, ms_hyperv.hints);
++ pr_info("Hyper-V: features 0x%x, hints 0x%x, misc 0x%x\n",
++ ms_hyperv.features, ms_hyperv.hints, ms_hyperv.misc_features);
+
+ ms_hyperv.max_vp_index = cpuid_eax(HYPERV_CPUID_IMPLEMENT_LIMITS);
+ ms_hyperv.max_lp_index = cpuid_ebx(HYPERV_CPUID_IMPLEMENT_LIMITS);
+--
+2.20.1
+
--- /dev/null
+From 051f4d1462512e30134b79aab412ca98d6aa9308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 09:03:58 +0100
+Subject: xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant
+ status
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit 6b51fd3f65a22e3d1471b18a1d56247e246edd46 ]
+
+xenbus_map_ring_valloc() maps a ring page and returns the status of the
+used grant (0 meaning success).
+
+There are Xen hypervisors which might return the value 1 for the status
+of a failed grant mapping due to a bug. Some callers of
+xenbus_map_ring_valloc() test for errors by testing the returned status
+to be less than zero, resulting in no error detected and crashing later
+due to a not available ring page.
+
+Set the return value of xenbus_map_ring_valloc() to GNTST_general_error
+in case the grant status reported by Xen is greater than zero.
+
+This is part of XSA-316.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Wei Liu <wl@xen.org>
+Link: https://lore.kernel.org/r/20200326080358.1018-1-jgross@suse.com
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_client.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
+index e17ca81561713..a38292ef79f6d 100644
+--- a/drivers/xen/xenbus/xenbus_client.c
++++ b/drivers/xen/xenbus/xenbus_client.c
+@@ -448,7 +448,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn);
+ int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs,
+ unsigned int nr_grefs, void **vaddr)
+ {
+- return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
++ int err;
++
++ err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr);
++ /* Some hypervisors are buggy and can return 1. */
++ if (err > 0)
++ err = GNTST_general_error;
++
++ return err;
+ }
+ EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc);
+
+--
+2.20.1
+
--- /dev/null
+From 808f46e947737cafece749d8a36820b3dfd3004f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Apr 2020 13:11:11 -0700
+Subject: xfs: fix partially uninitialized structure in
+ xfs_reflink_remap_extent
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit c142932c29e533ee892f87b44d8abc5719edceec ]
+
+In the reflink extent remap function, it turns out that uirec (the block
+mapping corresponding only to the part of the passed-in mapping that got
+unmapped) was not fully initialized. Specifically, br_state was not
+being copied from the passed-in struct to the uirec. This could lead to
+unpredictable results such as the reflinked mapping being marked
+unwritten in the destination file.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_reflink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
+index b0ce04ffd3cd2..107bf2a2f3448 100644
+--- a/fs/xfs/xfs_reflink.c
++++ b/fs/xfs/xfs_reflink.c
+@@ -1051,6 +1051,7 @@ xfs_reflink_remap_extent(
+ uirec.br_startblock = irec->br_startblock + rlen;
+ uirec.br_startoff = irec->br_startoff + rlen;
+ uirec.br_blockcount = unmap_len - rlen;
++ uirec.br_state = irec->br_state;
+ unmap_len = rlen;
+
+ /* If this isn't a real mapping, we're done. */
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
