--- /dev/null
+From e179c0acf8c5fdb6eb3919ea664bae9b0c8c228d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 14:28:19 -0700
+Subject: ACPI: Update Tiger Lake ACPI device IDs
+
+From: Gayatri Kammela <gayatri.kammela@intel.com>
+
+[ Upstream commit b62c770fee699a137359e1f1da9bf14a7f348567 ]
+
+Tiger Lake's new unique ACPI device IDs for DPTF and fan drivers are not
+valid as the IDs are missing 'C'. Fix the IDs by updating them.
+
+After the update, the new IDs should now look like
+INT1047 --> INTC1047
+INT1040 --> INTC1040
+INT1043 --> INTC1043
+INT1044 --> INTC1044
+
+Fixes: 55cfe6a5c582 ("ACPI: DPTF: Add Tiger Lake ACPI device IDs")
+Fixes: c248dfe7e0ca ("ACPI: fan: Add Tiger Lake ACPI device ID")
+Suggested-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
+Signed-off-by: Gayatri Kammela <gayatri.kammela@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/device_pm.c | 2 +-
+ drivers/acpi/dptf/dptf_power.c | 2 +-
+ drivers/acpi/dptf/int340x_thermal.c | 8 ++++----
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index b64c62bfcea56..b2263ec67b432 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -1321,8 +1321,8 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on)
+ */
+ static const struct acpi_device_id special_pm_ids[] = {
+ {"PNP0C0B", }, /* Generic ACPI fan */
+- {"INT1044", }, /* Fan for Tiger Lake generation */
+ {"INT3404", }, /* Fan */
++ {"INTC1044", }, /* Fan for Tiger Lake generation */
+ {}
+ };
+ struct acpi_device *adev = ACPI_COMPANION(dev);
+diff --git a/drivers/acpi/dptf/dptf_power.c b/drivers/acpi/dptf/dptf_power.c
+index 387f27ef3368b..e4e8b75d39f09 100644
+--- a/drivers/acpi/dptf/dptf_power.c
++++ b/drivers/acpi/dptf/dptf_power.c
+@@ -97,8 +97,8 @@ static int dptf_power_remove(struct platform_device *pdev)
+ }
+
+ static const struct acpi_device_id int3407_device_ids[] = {
+- {"INT1047", 0},
+ {"INT3407", 0},
++ {"INTC1047", 0},
+ {"", 0},
+ };
+ MODULE_DEVICE_TABLE(acpi, int3407_device_ids);
+diff --git a/drivers/acpi/dptf/int340x_thermal.c b/drivers/acpi/dptf/int340x_thermal.c
+index 1ec7b6900662c..bc71a6a603345 100644
+--- a/drivers/acpi/dptf/int340x_thermal.c
++++ b/drivers/acpi/dptf/int340x_thermal.c
+@@ -13,10 +13,6 @@
+
+ #define INT3401_DEVICE 0X01
+ static const struct acpi_device_id int340x_thermal_device_ids[] = {
+- {"INT1040"},
+- {"INT1043"},
+- {"INT1044"},
+- {"INT1047"},
+ {"INT3400"},
+ {"INT3401", INT3401_DEVICE},
+ {"INT3402"},
+@@ -28,6 +24,10 @@ static const struct acpi_device_id int340x_thermal_device_ids[] = {
+ {"INT3409"},
+ {"INT340A"},
+ {"INT340B"},
++ {"INTC1040"},
++ {"INTC1043"},
++ {"INTC1044"},
++ {"INTC1047"},
+ {""},
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 520b96de6bbf4398961f1d8c0c1921b158c29666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 15:21:09 -0700
+Subject: ACPICA: Fixes for acpiExec namespace init file
+
+From: Bob Moore <robert.moore@intel.com>
+
+[ Upstream commit 9a1ae80412dcaa67a29eecf19de44f32b5f1c357 ]
+
+This is the result of squashing the following ACPICA commit ID's:
+6803997e5b4f3635cea6610b51ff69e29d251de3
+f31cdf8bfda22fe265c1a176d0e33d311c82a7f7
+
+This change fixes several problems with the support for the
+acpi_exec namespace init file (-fi option). Specifically, it
+fixes AE_ALREADY_EXISTS errors, as well as various seg faults.
+
+Link: https://github.com/acpica/acpica/commit/f31cdf8b
+Link: https://github.com/acpica/acpica/commit/6803997e
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/acnamesp.h | 2 ++
+ drivers/acpi/acpica/dbinput.c | 16 +++++++---------
+ drivers/acpi/acpica/dswexec.c | 33 ++++++++++++++++++++++++++++++++
+ drivers/acpi/acpica/dswload.c | 2 --
+ drivers/acpi/acpica/dswload2.c | 35 ++++++++++++++++++++++++++++++++++
+ drivers/acpi/acpica/nsnames.c | 6 +-----
+ drivers/acpi/acpica/utdelete.c | 9 +++++----
+ 7 files changed, 83 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h
+index e618ddfab2fd1..40f6a3c33a150 100644
+--- a/drivers/acpi/acpica/acnamesp.h
++++ b/drivers/acpi/acpica/acnamesp.h
+@@ -256,6 +256,8 @@ u32
+ acpi_ns_build_normalized_path(struct acpi_namespace_node *node,
+ char *full_path, u32 path_size, u8 no_trailing);
+
++void acpi_ns_normalize_pathname(char *original_path);
++
+ char *acpi_ns_get_normalized_pathname(struct acpi_namespace_node *node,
+ u8 no_trailing);
+
+diff --git a/drivers/acpi/acpica/dbinput.c b/drivers/acpi/acpica/dbinput.c
+index aa71f65395d25..ee6a1b77af3f1 100644
+--- a/drivers/acpi/acpica/dbinput.c
++++ b/drivers/acpi/acpica/dbinput.c
+@@ -468,16 +468,14 @@ char *acpi_db_get_next_token(char *string,
+ return (NULL);
+ }
+
+- /* Remove any spaces at the beginning */
++ /* Remove any spaces at the beginning, ignore blank lines */
+
+- if (*string == ' ') {
+- while (*string && (*string == ' ')) {
+- string++;
+- }
++ while (*string && isspace(*string)) {
++ string++;
++ }
+
+- if (!(*string)) {
+- return (NULL);
+- }
++ if (!(*string)) {
++ return (NULL);
+ }
+
+ switch (*string) {
+@@ -570,7 +568,7 @@ char *acpi_db_get_next_token(char *string,
+
+ /* Find end of token */
+
+- while (*string && (*string != ' ')) {
++ while (*string && !isspace(*string)) {
+ string++;
+ }
+ break;
+diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c
+index 5e81a1ae44cff..1d4f8c81028c2 100644
+--- a/drivers/acpi/acpica/dswexec.c
++++ b/drivers/acpi/acpica/dswexec.c
+@@ -16,6 +16,9 @@
+ #include "acinterp.h"
+ #include "acnamesp.h"
+ #include "acdebug.h"
++#ifdef ACPI_EXEC_APP
++#include "aecommon.h"
++#endif
+
+ #define _COMPONENT ACPI_DISPATCHER
+ ACPI_MODULE_NAME("dswexec")
+@@ -329,6 +332,10 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state)
+ u32 op_class;
+ union acpi_parse_object *next_op;
+ union acpi_parse_object *first_arg;
++#ifdef ACPI_EXEC_APP
++ char *namepath;
++ union acpi_operand_object *obj_desc;
++#endif
+
+ ACPI_FUNCTION_TRACE_PTR(ds_exec_end_op, walk_state);
+
+@@ -537,6 +544,32 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state)
+
+ status =
+ acpi_ds_eval_buffer_field_operands(walk_state, op);
++ if (ACPI_FAILURE(status)) {
++ break;
++ }
++#ifdef ACPI_EXEC_APP
++ /*
++ * acpi_exec support for namespace initialization file (initialize
++ * buffer_fields in this code.)
++ */
++ namepath =
++ acpi_ns_get_external_pathname(op->common.node);
++ status = ae_lookup_init_file_entry(namepath, &obj_desc);
++ if (ACPI_SUCCESS(status)) {
++ status =
++ acpi_ex_write_data_to_field(obj_desc,
++ op->common.
++ node->object,
++ NULL);
++ if ACPI_FAILURE
++ (status) {
++ ACPI_EXCEPTION((AE_INFO, status,
++ "While writing to buffer field"));
++ }
++ }
++ ACPI_FREE(namepath);
++ status = AE_OK;
++#endif
+ break;
+
+ case AML_TYPE_CREATE_OBJECT:
+diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
+index 697974e37edfb..27069325b6de0 100644
+--- a/drivers/acpi/acpica/dswload.c
++++ b/drivers/acpi/acpica/dswload.c
+@@ -14,7 +14,6 @@
+ #include "acdispat.h"
+ #include "acinterp.h"
+ #include "acnamesp.h"
+-
+ #ifdef ACPI_ASL_COMPILER
+ #include "acdisasm.h"
+ #endif
+@@ -399,7 +398,6 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state)
+ union acpi_parse_object *op;
+ acpi_object_type object_type;
+ acpi_status status = AE_OK;
+-
+ #ifdef ACPI_ASL_COMPILER
+ u8 param_count;
+ #endif
+diff --git a/drivers/acpi/acpica/dswload2.c b/drivers/acpi/acpica/dswload2.c
+index b31457ca926cc..edadbe1465069 100644
+--- a/drivers/acpi/acpica/dswload2.c
++++ b/drivers/acpi/acpica/dswload2.c
+@@ -15,6 +15,9 @@
+ #include "acinterp.h"
+ #include "acnamesp.h"
+ #include "acevents.h"
++#ifdef ACPI_EXEC_APP
++#include "aecommon.h"
++#endif
+
+ #define _COMPONENT ACPI_DISPATCHER
+ ACPI_MODULE_NAME("dswload2")
+@@ -373,6 +376,10 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
+ struct acpi_namespace_node *new_node;
+ u32 i;
+ u8 region_space;
++#ifdef ACPI_EXEC_APP
++ union acpi_operand_object *obj_desc;
++ char *namepath;
++#endif
+
+ ACPI_FUNCTION_TRACE(ds_load2_end_op);
+
+@@ -466,6 +473,11 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
+ * be evaluated later during the execution phase
+ */
+ status = acpi_ds_create_buffer_field(op, walk_state);
++ if (ACPI_FAILURE(status)) {
++ ACPI_EXCEPTION((AE_INFO, status,
++ "CreateBufferField failure"));
++ goto cleanup;
++ }
+ break;
+
+ case AML_TYPE_NAMED_FIELD:
+@@ -604,6 +616,29 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state)
+ case AML_NAME_OP:
+
+ status = acpi_ds_create_node(walk_state, node, op);
++ if (ACPI_FAILURE(status)) {
++ goto cleanup;
++ }
++#ifdef ACPI_EXEC_APP
++ /*
++ * acpi_exec support for namespace initialization file (initialize
++ * Name opcodes in this code.)
++ */
++ namepath = acpi_ns_get_external_pathname(node);
++ status = ae_lookup_init_file_entry(namepath, &obj_desc);
++ if (ACPI_SUCCESS(status)) {
++
++ /* Detach any existing object, attach new object */
++
++ if (node->object) {
++ acpi_ns_detach_object(node);
++ }
++ acpi_ns_attach_object(node, obj_desc,
++ obj_desc->common.type);
++ }
++ ACPI_FREE(namepath);
++ status = AE_OK;
++#endif
+ break;
+
+ case AML_METHOD_OP:
+diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c
+index 370bbc8677453..c717fff7d9b57 100644
+--- a/drivers/acpi/acpica/nsnames.c
++++ b/drivers/acpi/acpica/nsnames.c
+@@ -13,9 +13,6 @@
+ #define _COMPONENT ACPI_NAMESPACE
+ ACPI_MODULE_NAME("nsnames")
+
+-/* Local Prototypes */
+-static void acpi_ns_normalize_pathname(char *original_path);
+-
+ /*******************************************************************************
+ *
+ * FUNCTION: acpi_ns_get_external_pathname
+@@ -30,7 +27,6 @@ static void acpi_ns_normalize_pathname(char *original_path);
+ * for error and debug statements.
+ *
+ ******************************************************************************/
+-
+ char *acpi_ns_get_external_pathname(struct acpi_namespace_node *node)
+ {
+ char *name_buffer;
+@@ -411,7 +407,7 @@ char *acpi_ns_build_prefixed_pathname(union acpi_generic_state *prefix_scope,
+ *
+ ******************************************************************************/
+
+-static void acpi_ns_normalize_pathname(char *original_path)
++void acpi_ns_normalize_pathname(char *original_path)
+ {
+ char *input_path = original_path;
+ char *new_path_buffer;
+diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
+index eee263cb7beb0..c365faf4e6cd4 100644
+--- a/drivers/acpi/acpica/utdelete.c
++++ b/drivers/acpi/acpica/utdelete.c
+@@ -452,13 +452,13 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action)
+ *
+ * FUNCTION: acpi_ut_update_object_reference
+ *
+- * PARAMETERS: object - Increment ref count for this object
+- * and all sub-objects
++ * PARAMETERS: object - Increment or decrement the ref count for
++ * this object and all sub-objects
+ * action - Either REF_INCREMENT or REF_DECREMENT
+ *
+ * RETURN: Status
+ *
+- * DESCRIPTION: Increment the object reference count
++ * DESCRIPTION: Increment or decrement the object reference count
+ *
+ * Object references are incremented when:
+ * 1) An object is attached to a Node (namespace object)
+@@ -492,7 +492,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ }
+
+ /*
+- * All sub-objects must have their reference count incremented
++ * All sub-objects must have their reference count updated
+ * also. Different object types have different subobjects.
+ */
+ switch (object->common.type) {
+@@ -559,6 +559,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
+ break;
+ }
+ }
++
+ next_object = NULL;
+ break;
+
+--
+2.20.1
+
--- /dev/null
+From 15937473690b2107641dc36dd71d5184761c5c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Mar 2020 18:46:47 +0100
+Subject: ARM: dts: rockchip: fix lvds-encoder ports subnode for
+ rk3188-bqedison2qc
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 1a7e99599dffd836fcb720cdc0eaf3cd43d7af4a ]
+
+A test with the command below gives this error:
+
+arch/arm/boot/dts/rk3188-bqedison2qc.dt.yaml: lvds-encoder:
+'ports' is a required property
+
+Fix error by adding a ports wrapper for port@0 and port@1
+inside the 'lvds-encoder' node for rk3188-bqedison2qc.
+
+make ARCH=arm dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/display/
+bridge/lvds-codec.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200316174647.5598-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-bqedison2qc.dts | 27 ++++++++++++++----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+index 8afb2fd5d9f1b..66a0ff196eb1f 100644
+--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts
++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+@@ -58,20 +58,25 @@
+
+ lvds-encoder {
+ compatible = "ti,sn75lvds83", "lvds-encoder";
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+- port@0 {
+- reg = <0>;
+- lvds_in_vop0: endpoint {
+- remote-endpoint = <&vop0_out_lvds>;
++ ports {
++ #address-cells = <1>;
++ #size-cells = <0>;
++
++ port@0 {
++ reg = <0>;
++
++ lvds_in_vop0: endpoint {
++ remote-endpoint = <&vop0_out_lvds>;
++ };
+ };
+- };
+
+- port@1 {
+- reg = <1>;
+- lvds_out_panel: endpoint {
+- remote-endpoint = <&panel_in_lvds>;
++ port@1 {
++ reg = <1>;
++
++ lvds_out_panel: endpoint {
++ remote-endpoint = <&panel_in_lvds>;
++ };
+ };
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 738b180f2f10a34b6a199b1e3c1bfd9b683d49e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Mar 2020 14:48:37 +0100
+Subject: ARM: dts: rockchip: fix vqmmc-supply property name for
+ rk3188-bqedison2qc
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 9cd568dc588c5d168615bf34f325fabe33b2c9a0 ]
+
+A test with the command below does not detect all errors
+in combination with 'additionalProperties: false' and
+allOf:
+ - $ref: "synopsys-dw-mshc-common.yaml#"
+allOf:
+ - $ref: "mmc-controller.yaml#"
+
+'additionalProperties' applies to all properties that are not
+accounted-for by 'properties' or 'patternProperties' in
+the immediate schema.
+
+First when we combine rockchip-dw-mshc.yaml,
+synopsys-dw-mshc-common.yaml and mmc-controller.yaml it gives
+this error:
+
+arch/arm/boot/dts/rk3188-bqedison2qc.dt.yaml: mmc@10218000:
+'vmmcq-supply' does not match any of the regexes:
+'^.*@[0-9]+$',
+'^clk-phase-(legacy|sd-hs|mmc-(hs|hs[24]00|ddr52)|
+uhs-(sdr(12|25|50|104)|ddr50))$',
+'pinctrl-[0-9]+'
+
+'vmmcq-supply' is not a valid property name for mmc nodes.
+Fix this error by renaming it to 'vqmmc-supply'.
+
+make ARCH=arm dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200307134841.13803-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-bqedison2qc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+index ad1afd403052a..8afb2fd5d9f1b 100644
+--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts
++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+@@ -465,7 +465,7 @@
+ non-removable;
+ pinctrl-names = "default";
+ pinctrl-0 = <&sd1_clk>, <&sd1_cmd>, <&sd1_bus4>;
+- vmmcq-supply = <&vccio_wl>;
++ vqmmc-supply = <&vccio_wl>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+ status = "okay";
+--
+2.20.1
+
--- /dev/null
+From e65c2528c99685229c6dac1a5e4d5e73bb305935 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 00:20:10 +0100
+Subject: arm64: dts: allwinner: a64: Fix display clock register range
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 3e9a1a8b7f811de3eb1445d72f68766b704ad17c ]
+
+Register range of display clocks is 0x10000, as it can be seen from
+DE2 documentation.
+
+Fix it.
+
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Fixes: 2c796fc8f5dbd ("arm64: dts: allwinner: a64: add necessary device tree nodes for DE2 CCU")
+[wens@csie.org: added fixes tag]
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 862b47dc9dc90..baa6f08dc1087 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -264,7 +264,7 @@
+
+ display_clocks: clock@0 {
+ compatible = "allwinner,sun50i-a64-de2-clk";
+- reg = <0x0 0x100000>;
++ reg = <0x0 0x10000>;
+ clocks = <&ccu CLK_BUS_DE>,
+ <&ccu CLK_DE>;
+ clock-names = "bus",
+--
+2.20.1
+
--- /dev/null
+From 4cfdc0b50581486d1d0d64e6bc35a6759d57a1d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 11:45:12 +0000
+Subject: arm64: dts: clearfog-gt-8k: set gigabit PHY reset deassert delay
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 46f94c7818e7ab82758fca74935ef3d454340b4e ]
+
+If the mv88e6xxx DSA driver is built as a module, it causes the
+ethernet driver to re-probe when it's loaded. This in turn causes
+the gigabit PHY to be momentarily reset and reprogrammed. However,
+we attempt to reprogram the PHY immediately after deasserting reset,
+and the PHY ignores the writes.
+
+This results in the PHY operating in the wrong mode, and the copper
+link states down.
+
+Set a reset deassert delay of 10ms for the gigabit PHY to avoid this.
+
+Fixes: babc5544c293 ("arm64: dts: clearfog-gt-8k: 1G eth PHY reset signal")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Acked-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
+index a211a046b2f2f..b90d78a5724b2 100644
+--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
++++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
+@@ -367,6 +367,7 @@
+ pinctrl-0 = <&cp0_copper_eth_phy_reset>;
+ reset-gpios = <&cp0_gpio2 11 GPIO_ACTIVE_LOW>;
+ reset-assert-us = <10000>;
++ reset-deassert-us = <10000>;
+ };
+
+ switch0: switch0@4 {
+--
+2.20.1
+
--- /dev/null
+From 35472088293dd16d45889bf738756659291d4369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 17:52:32 +0100
+Subject: arm64: dts: marvell: espressobin: add ethernet alias
+
+From: Tomasz Maciej Nowak <tmn505@gmail.com>
+
+[ Upstream commit 5253cb8c00a6f4356760efb38bca0e0393aa06de ]
+
+The maker of this board and its variants, stores MAC address in U-Boot
+environment. Add alias for bootloader to recognise, to which ethernet
+node inject the factory MAC address.
+
+Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi
+index 53b8ac55a7f3d..e5262dab28f58 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi
+@@ -13,6 +13,12 @@
+ #include "armada-372x.dtsi"
+
+ / {
++ aliases {
++ ethernet0 = ð0;
++ serial0 = &uart0;
++ serial1 = &uart1;
++ };
++
+ chosen {
+ stdout-path = "serial0:115200n8";
+ };
+--
+2.20.1
+
--- /dev/null
+From 426660198c2030561a9c22a6459b043a2bce0e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 03:30:15 +0530
+Subject: arm64: dts: marvell: Fix cpu compatible for AP807-quad
+
+From: Amit Kucheria <amit.kucheria@linaro.org>
+
+[ Upstream commit d136d2588b21b1a07515632ed61120c9f262909b ]
+
+make -k ARCH=arm64 dtbs_check shows the following errors. Fix them by
+removing the "arm,armv8" compatible.
+
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@0: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long CHECK
+arch/arm64/boot/dts/renesas/r8a774a1-hihope-rzg2m-ex.dt.yaml
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@1: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@100: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@101: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml:
+cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@0: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@1: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@100: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@101: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml:
+cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@0: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@1: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@100: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@101: compatible: Additional items are not allowed ('arm,armv8' was
+unexpected)
+/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml:
+cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long
+
+Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi b/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi
+index 840466e143b47..68782f161f122 100644
+--- a/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi
+@@ -17,7 +17,7 @@
+
+ cpu0: cpu@0 {
+ device_type = "cpu";
+- compatible = "arm,cortex-a72", "arm,armv8";
++ compatible = "arm,cortex-a72";
+ reg = <0x000>;
+ enable-method = "psci";
+ #cooling-cells = <2>;
+@@ -32,7 +32,7 @@
+ };
+ cpu1: cpu@1 {
+ device_type = "cpu";
+- compatible = "arm,cortex-a72", "arm,armv8";
++ compatible = "arm,cortex-a72";
+ reg = <0x001>;
+ enable-method = "psci";
+ #cooling-cells = <2>;
+@@ -47,7 +47,7 @@
+ };
+ cpu2: cpu@100 {
+ device_type = "cpu";
+- compatible = "arm,cortex-a72", "arm,armv8";
++ compatible = "arm,cortex-a72";
+ reg = <0x100>;
+ enable-method = "psci";
+ #cooling-cells = <2>;
+@@ -62,7 +62,7 @@
+ };
+ cpu3: cpu@101 {
+ device_type = "cpu";
+- compatible = "arm,cortex-a72", "arm,armv8";
++ compatible = "arm,cortex-a72";
+ reg = <0x101>;
+ enable-method = "psci";
+ #cooling-cells = <2>;
+--
+2.20.1
+
--- /dev/null
+From f4d8b06a8f5eaf8d51f1342b9964c49d086d669a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 23:40:50 +0530
+Subject: arm64: tegra: Add PCIe endpoint controllers nodes for Tegra194
+
+From: Vidya Sagar <vidyas@nvidia.com>
+
+[ Upstream commit 0c988b731e6430f0081991fdb4f63f7fc837df9a ]
+
+Add endpoint mode controllers nodes for the dual mode PCIe controllers
+present in Tegra194 SoC.
+
+Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 99 ++++++++++++++++++++++++
+ 1 file changed, 99 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index ccac43be12acc..844e7fac30c58 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -1481,6 +1481,105 @@
+ 0x82000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xc0000000>; /* non-prefetchable memory (3GB) */
+ };
+
++ pcie_ep@14160000 {
++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
++ reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */
++ 0x00 0x36040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
++ 0x00 0x36080000 0x0 0x00040000 /* DBI reg space (256K) */
++ 0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
++
++ status = "disabled";
++
++ num-lanes = <4>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
++
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>;
++ clock-names = "core";
++
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_4>;
++ reset-names = "apb", "core";
++
++ interrupts = <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
++
++ nvidia,bpmp = <&bpmp 4>;
++
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++ };
++
++ pcie_ep@14180000 {
++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
++ reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */
++ 0x00 0x38040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
++ 0x00 0x38080000 0x0 0x00040000 /* DBI reg space (256K) */
++ 0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
++
++ status = "disabled";
++
++ num-lanes = <8>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
++
++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>;
++ clock-names = "core";
++
++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>,
++ <&bpmp TEGRA194_RESET_PEX0_CORE_0>;
++ reset-names = "apb", "core";
++
++ interrupts = <GIC_SPI 72 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
++
++ nvidia,bpmp = <&bpmp 0>;
++
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++ };
++
++ pcie_ep@141a0000 {
++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
++ reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */
++ 0x00 0x3a040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */
++ 0x00 0x3a080000 0x0 0x00040000 /* DBI reg space (256K) */
++ 0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */
++ reg-names = "appl", "atu_dma", "dbi", "addr_space";
++
++ status = "disabled";
++
++ num-lanes = <8>;
++ num-ib-windows = <2>;
++ num-ob-windows = <8>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&clkreq_c5_bi_dir_state>;
++
++ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>;
++ clock-names = "core";
++
++ resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>,
++ <&bpmp TEGRA194_RESET_PEX1_CORE_5>;
++ reset-names = "apb", "core";
++
++ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; /* controller interrupt */
++ interrupt-names = "intr";
++
++ nvidia,bpmp = <&bpmp 5>;
++
++ nvidia,aspm-cmrt-us = <60>;
++ nvidia,aspm-pwr-on-t-us = <20>;
++ nvidia,aspm-l0s-entrance-latency-us = <3>;
++ };
++
+ sysram@40000000 {
+ compatible = "nvidia,tegra194-sysram", "mmio-sram";
+ reg = <0x0 0x40000000 0x0 0x50000>;
+--
+2.20.1
+
--- /dev/null
+From 359388f61af037925311983963d05c7b7728db56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 13:53:53 +0000
+Subject: arm64: tegra: Fix Tegra194 PCIe compatible string
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit f9f711efd441ad0d22874be49986d92121862335 ]
+
+If the kernel configuration option CONFIG_PCIE_DW_PLAT_HOST is enabled
+then this can cause the kernel to incorrectly probe the generic
+designware PCIe platform driver instead of the Tegra194 designware PCIe
+driver. This causes a boot failure on Tegra194 because the necessary
+configuration to access the hardware is not performed.
+
+The order in which the compatible strings are populated in Device-Tree
+is not relevant in this case, because the kernel will attempt to probe
+the device as soon as a driver is loaded and if the generic designware
+PCIe driver is loaded first, then this driver will be probed first.
+Therefore, to fix this problem, remove the "snps,dw-pcie" string from
+the compatible string as we never want this driver to be probe on
+Tegra194.
+
+Fixes: 2602c32f15e7 ("arm64: tegra: Add P2U and PCIe controller nodes to Tegra194 DT")
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/pci/nvidia,tegra194-pcie.txt | 2 +-
+ arch/arm64/boot/dts/nvidia/tegra194.dtsi | 12 ++++++------
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt b/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt
+index b739f92da58e5..1f90eb39870be 100644
+--- a/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt
++++ b/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt
+@@ -118,7 +118,7 @@ Tegra194:
+ --------
+
+ pcie@14180000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
+ reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x38000000 0x0 0x00040000 /* configuration space (256K) */
+diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+index 844e7fac30c58..a8f024662e60e 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+@@ -1208,7 +1208,7 @@
+ };
+
+ pcie@14100000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+ reg = <0x00 0x14100000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x30000000 0x0 0x00040000 /* configuration space (256K) */
+@@ -1253,7 +1253,7 @@
+ };
+
+ pcie@14120000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+ reg = <0x00 0x14120000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x32000000 0x0 0x00040000 /* configuration space (256K) */
+@@ -1298,7 +1298,7 @@
+ };
+
+ pcie@14140000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>;
+ reg = <0x00 0x14140000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x34000000 0x0 0x00040000 /* configuration space (256K) */
+@@ -1343,7 +1343,7 @@
+ };
+
+ pcie@14160000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
+ reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x36000000 0x0 0x00040000 /* configuration space (256K) */
+@@ -1388,7 +1388,7 @@
+ };
+
+ pcie@14180000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
+ reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x38000000 0x0 0x00040000 /* configuration space (256K) */
+@@ -1433,7 +1433,7 @@
+ };
+
+ pcie@141a0000 {
+- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie";
++ compatible = "nvidia,tegra194-pcie";
+ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
+ reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */
+ 0x00 0x3a000000 0x0 0x00040000 /* configuration space (256K) */
+--
+2.20.1
+
--- /dev/null
+From 83fd2490448accf3e116fca47511305a32533e3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Mar 2020 00:10:43 -0800
+Subject: bpf: Reliably preserve btf_trace_xxx types
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit 441420a1f0b3031f228453697406c86f110e59d4 ]
+
+btf_trace_xxx types, crucial for tp_btf BPF programs (raw tracepoint with
+verifier-checked direct memory access), have to be preserved in kernel BTF to
+allow verifier do its job and enforce type/memory safety. It was reported
+([0]) that for kernels built with Clang current type-casting approach doesn't
+preserve these types.
+
+This patch fixes it by declaring an anonymous union for each registered
+tracepoint, capturing both struct bpf_raw_event_map information, as well as
+recording btf_trace_##call type reliably. Structurally, it's still the same
+content as for a plain struct bpf_raw_event_map, so no other changes are
+necessary.
+
+ [0] https://github.com/iovisor/bcc/issues/2770#issuecomment-591007692
+
+Fixes: e8c423fb31fa ("bpf: Add typecast to raw_tracepoints to help BTF generation")
+Reported-by: Wenbo Zhang <ethercflow@gmail.com>
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20200301081045.3491005-2-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/bpf_probe.h | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
+index b04c292709730..1ce3be63add1f 100644
+--- a/include/trace/bpf_probe.h
++++ b/include/trace/bpf_probe.h
+@@ -75,13 +75,17 @@ static inline void bpf_test_probe_##call(void) \
+ check_trace_callback_type_##call(__bpf_trace_##template); \
+ } \
+ typedef void (*btf_trace_##call)(void *__data, proto); \
+-static struct bpf_raw_event_map __used \
+- __attribute__((section("__bpf_raw_tp_map"))) \
+-__bpf_trace_tp_map_##call = { \
+- .tp = &__tracepoint_##call, \
+- .bpf_func = (void *)(btf_trace_##call)__bpf_trace_##template, \
+- .num_args = COUNT_ARGS(args), \
+- .writable_size = size, \
++static union { \
++ struct bpf_raw_event_map event; \
++ btf_trace_##call handler; \
++} __bpf_trace_tp_map_##call __used \
++__attribute__((section("__bpf_raw_tp_map"))) = { \
++ .event = { \
++ .tp = &__tracepoint_##call, \
++ .bpf_func = __bpf_trace_##template, \
++ .num_args = COUNT_ARGS(args), \
++ .writable_size = size, \
++ }, \
+ };
+
+ #define FIRST(x, ...) x
+--
+2.20.1
+
--- /dev/null
+From fe9d2d4b67bf8818840c9c40c1f3f93cbc0b64d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 12:22:43 +0530
+Subject: btrfs: add RCU locks around block group initialization
+
+From: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+
+[ Upstream commit 29566c9c773456467933ee22bbca1c2b72a3506c ]
+
+The space_info list is normally RCU protected and should be traversed
+with rcu_read_lock held. There's a warning
+
+ [29.104756] WARNING: suspicious RCU usage
+ [29.105046] 5.6.0-rc4-next-20200305 #1 Not tainted
+ [29.105231] -----------------------------
+ [29.105401] fs/btrfs/block-group.c:2011 RCU-list traversed in non-reader section!!
+
+pointing out that the locking is missing in btrfs_read_block_groups.
+However this is not necessary as the list traversal happens at mount
+time when there's no other thread potentially accessing the list.
+
+To fix the warning and for consistency let's add the RCU lock/unlock,
+the code won't be affected much as it's doing some lightweight
+operations.
+
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/block-group.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index 7f09147872dc7..c9a3bbc8c6afb 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1987,6 +1987,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
+ btrfs_release_path(path);
+ }
+
++ rcu_read_lock();
+ list_for_each_entry_rcu(space_info, &info->space_info, list) {
+ if (!(btrfs_get_alloc_profile(info, space_info->flags) &
+ (BTRFS_BLOCK_GROUP_RAID10 |
+@@ -2007,6 +2008,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info)
+ list)
+ inc_block_group_ro(cache, 1);
+ }
++ rcu_read_unlock();
+
+ btrfs_init_global_block_rsv(info);
+ ret = check_chunk_block_group_mappings(info);
+--
+2.20.1
+
--- /dev/null
+From dd4b3d14f01fdd5bcefdf924887b76c5aef0bc6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2020 13:44:32 +0000
+Subject: ceph: re-org copy_file_range and fix some error paths
+
+From: Luis Henriques <lhenriques@suse.com>
+
+[ Upstream commit 1b0c3b9f91f0df03088d293fc9e62743fd789ad2 ]
+
+This patch re-organizes copy_file_range, trying to fix a few issues in the
+error handling. Here's the summary:
+
+- Abort copy if initial do_splice_direct() returns fewer bytes than
+ requested.
+
+- Move the 'size' initialization (with i_size_read()) further down in the
+ code, after the initial call to do_splice_direct(). This avoids issues
+ with a possibly stale value if a manual copy is done.
+
+- Move the object copy loop into a separate function. This makes it
+ easier to handle errors (e.g, dirtying caps and updating the MDS
+ metadata if only some objects have been copied before an error has
+ occurred).
+
+- Added calls to ceph_oloc_destroy() to avoid leaking memory with src_oloc
+ and dst_oloc
+
+- After the object copy loop, the new file size to be reported to the MDS
+ (if there's file size change) is now the actual file size, and not the
+ size after an eventual extra manual copy.
+
+- Added a few dout() to show the number of bytes copied in the two manual
+ copies and in the object copy loop.
+
+Signed-off-by: Luis Henriques <lhenriques@suse.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/file.c | 173 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 100 insertions(+), 73 deletions(-)
+
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 5a478cd06e113..7f8c4e3083018 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -1944,6 +1944,71 @@ static int is_file_size_ok(struct inode *src_inode, struct inode *dst_inode,
+ return 0;
+ }
+
++static ssize_t ceph_do_objects_copy(struct ceph_inode_info *src_ci, u64 *src_off,
++ struct ceph_inode_info *dst_ci, u64 *dst_off,
++ struct ceph_fs_client *fsc,
++ size_t len, unsigned int flags)
++{
++ struct ceph_object_locator src_oloc, dst_oloc;
++ struct ceph_object_id src_oid, dst_oid;
++ size_t bytes = 0;
++ u64 src_objnum, src_objoff, dst_objnum, dst_objoff;
++ u32 src_objlen, dst_objlen;
++ u32 object_size = src_ci->i_layout.object_size;
++ int ret;
++
++ src_oloc.pool = src_ci->i_layout.pool_id;
++ src_oloc.pool_ns = ceph_try_get_string(src_ci->i_layout.pool_ns);
++ dst_oloc.pool = dst_ci->i_layout.pool_id;
++ dst_oloc.pool_ns = ceph_try_get_string(dst_ci->i_layout.pool_ns);
++
++ while (len >= object_size) {
++ ceph_calc_file_object_mapping(&src_ci->i_layout, *src_off,
++ object_size, &src_objnum,
++ &src_objoff, &src_objlen);
++ ceph_calc_file_object_mapping(&dst_ci->i_layout, *dst_off,
++ object_size, &dst_objnum,
++ &dst_objoff, &dst_objlen);
++ ceph_oid_init(&src_oid);
++ ceph_oid_printf(&src_oid, "%llx.%08llx",
++ src_ci->i_vino.ino, src_objnum);
++ ceph_oid_init(&dst_oid);
++ ceph_oid_printf(&dst_oid, "%llx.%08llx",
++ dst_ci->i_vino.ino, dst_objnum);
++ /* Do an object remote copy */
++ ret = ceph_osdc_copy_from(&fsc->client->osdc,
++ src_ci->i_vino.snap, 0,
++ &src_oid, &src_oloc,
++ CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL |
++ CEPH_OSD_OP_FLAG_FADVISE_NOCACHE,
++ &dst_oid, &dst_oloc,
++ CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL |
++ CEPH_OSD_OP_FLAG_FADVISE_DONTNEED,
++ dst_ci->i_truncate_seq,
++ dst_ci->i_truncate_size,
++ CEPH_OSD_COPY_FROM_FLAG_TRUNCATE_SEQ);
++ if (ret) {
++ if (ret == -EOPNOTSUPP) {
++ fsc->have_copy_from2 = false;
++ pr_notice("OSDs don't support copy-from2; disabling copy offload\n");
++ }
++ dout("ceph_osdc_copy_from returned %d\n", ret);
++ if (!bytes)
++ bytes = ret;
++ goto out;
++ }
++ len -= object_size;
++ bytes += object_size;
++ *src_off += object_size;
++ *dst_off += object_size;
++ }
++
++out:
++ ceph_oloc_destroy(&src_oloc);
++ ceph_oloc_destroy(&dst_oloc);
++ return bytes;
++}
++
+ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ struct file *dst_file, loff_t dst_off,
+ size_t len, unsigned int flags)
+@@ -1954,14 +2019,11 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ struct ceph_inode_info *dst_ci = ceph_inode(dst_inode);
+ struct ceph_cap_flush *prealloc_cf;
+ struct ceph_fs_client *src_fsc = ceph_inode_to_client(src_inode);
+- struct ceph_object_locator src_oloc, dst_oloc;
+- struct ceph_object_id src_oid, dst_oid;
+- loff_t endoff = 0, size;
+- ssize_t ret = -EIO;
++ loff_t size;
++ ssize_t ret = -EIO, bytes;
+ u64 src_objnum, dst_objnum, src_objoff, dst_objoff;
+- u32 src_objlen, dst_objlen, object_size;
++ u32 src_objlen, dst_objlen;
+ int src_got = 0, dst_got = 0, err, dirty;
+- bool do_final_copy = false;
+
+ if (src_inode->i_sb != dst_inode->i_sb) {
+ struct ceph_fs_client *dst_fsc = ceph_inode_to_client(dst_inode);
+@@ -2039,22 +2101,14 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ if (ret < 0)
+ goto out_caps;
+
+- size = i_size_read(dst_inode);
+- endoff = dst_off + len;
+-
+ /* Drop dst file cached pages */
+ ret = invalidate_inode_pages2_range(dst_inode->i_mapping,
+ dst_off >> PAGE_SHIFT,
+- endoff >> PAGE_SHIFT);
++ (dst_off + len) >> PAGE_SHIFT);
+ if (ret < 0) {
+ dout("Failed to invalidate inode pages (%zd)\n", ret);
+ ret = 0; /* XXX */
+ }
+- src_oloc.pool = src_ci->i_layout.pool_id;
+- src_oloc.pool_ns = ceph_try_get_string(src_ci->i_layout.pool_ns);
+- dst_oloc.pool = dst_ci->i_layout.pool_id;
+- dst_oloc.pool_ns = ceph_try_get_string(dst_ci->i_layout.pool_ns);
+-
+ ceph_calc_file_object_mapping(&src_ci->i_layout, src_off,
+ src_ci->i_layout.object_size,
+ &src_objnum, &src_objoff, &src_objlen);
+@@ -2073,6 +2127,8 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ * starting at the src_off
+ */
+ if (src_objoff) {
++ dout("Initial partial copy of %u bytes\n", src_objlen);
++
+ /*
+ * we need to temporarily drop all caps as we'll be calling
+ * {read,write}_iter, which will get caps again.
+@@ -2080,8 +2136,9 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ put_rd_wr_caps(src_ci, src_got, dst_ci, dst_got);
+ ret = do_splice_direct(src_file, &src_off, dst_file,
+ &dst_off, src_objlen, flags);
+- if (ret < 0) {
+- dout("do_splice_direct returned %d\n", err);
++ /* Abort on short copies or on error */
++ if (ret < src_objlen) {
++ dout("Failed partial copy (%zd)\n", ret);
+ goto out;
+ }
+ len -= ret;
+@@ -2094,62 +2151,29 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ if (err < 0)
+ goto out_caps;
+ }
+- object_size = src_ci->i_layout.object_size;
+- while (len >= object_size) {
+- ceph_calc_file_object_mapping(&src_ci->i_layout, src_off,
+- object_size, &src_objnum,
+- &src_objoff, &src_objlen);
+- ceph_calc_file_object_mapping(&dst_ci->i_layout, dst_off,
+- object_size, &dst_objnum,
+- &dst_objoff, &dst_objlen);
+- ceph_oid_init(&src_oid);
+- ceph_oid_printf(&src_oid, "%llx.%08llx",
+- src_ci->i_vino.ino, src_objnum);
+- ceph_oid_init(&dst_oid);
+- ceph_oid_printf(&dst_oid, "%llx.%08llx",
+- dst_ci->i_vino.ino, dst_objnum);
+- /* Do an object remote copy */
+- err = ceph_osdc_copy_from(
+- &src_fsc->client->osdc,
+- src_ci->i_vino.snap, 0,
+- &src_oid, &src_oloc,
+- CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL |
+- CEPH_OSD_OP_FLAG_FADVISE_NOCACHE,
+- &dst_oid, &dst_oloc,
+- CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL |
+- CEPH_OSD_OP_FLAG_FADVISE_DONTNEED,
+- dst_ci->i_truncate_seq, dst_ci->i_truncate_size,
+- CEPH_OSD_COPY_FROM_FLAG_TRUNCATE_SEQ);
+- if (err) {
+- if (err == -EOPNOTSUPP) {
+- src_fsc->have_copy_from2 = false;
+- pr_notice("OSDs don't support copy-from2; disabling copy offload\n");
+- }
+- dout("ceph_osdc_copy_from returned %d\n", err);
+- if (!ret)
+- ret = err;
+- goto out_caps;
+- }
+- len -= object_size;
+- src_off += object_size;
+- dst_off += object_size;
+- ret += object_size;
+- }
+
+- if (len)
+- /* We still need one final local copy */
+- do_final_copy = true;
++ size = i_size_read(dst_inode);
++ bytes = ceph_do_objects_copy(src_ci, &src_off, dst_ci, &dst_off,
++ src_fsc, len, flags);
++ if (bytes <= 0) {
++ if (!ret)
++ ret = bytes;
++ goto out_caps;
++ }
++ dout("Copied %zu bytes out of %zu\n", bytes, len);
++ len -= bytes;
++ ret += bytes;
+
+ file_update_time(dst_file);
+ inode_inc_iversion_raw(dst_inode);
+
+- if (endoff > size) {
++ if (dst_off > size) {
+ int caps_flags = 0;
+
+ /* Let the MDS know about dst file size change */
+- if (ceph_quota_is_max_bytes_approaching(dst_inode, endoff))
++ if (ceph_quota_is_max_bytes_approaching(dst_inode, dst_off))
+ caps_flags |= CHECK_CAPS_NODELAY;
+- if (ceph_inode_set_size(dst_inode, endoff))
++ if (ceph_inode_set_size(dst_inode, dst_off))
+ caps_flags |= CHECK_CAPS_AUTHONLY;
+ if (caps_flags)
+ ceph_check_caps(dst_ci, caps_flags, NULL);
+@@ -2165,15 +2189,18 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off,
+ out_caps:
+ put_rd_wr_caps(src_ci, src_got, dst_ci, dst_got);
+
+- if (do_final_copy) {
+- err = do_splice_direct(src_file, &src_off, dst_file,
+- &dst_off, len, flags);
+- if (err < 0) {
+- dout("do_splice_direct returned %d\n", err);
+- goto out;
+- }
+- len -= err;
+- ret += err;
++ /*
++ * Do the final manual copy if we still have some bytes left, unless
++ * there were errors in remote object copies (len >= object_size).
++ */
++ if (len && (len < src_ci->i_layout.object_size)) {
++ dout("Final partial copy of %zu bytes\n", len);
++ bytes = do_splice_direct(src_file, &src_off, dst_file,
++ &dst_off, len, flags);
++ if (bytes > 0)
++ ret += bytes;
++ else
++ dout("Failed partial copy (%zd)\n", bytes);
+ }
+
+ out:
+--
+2.20.1
+
--- /dev/null
+From 851d2d8ac583131b5c30c6d51122c81c9e482515 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 22:09:20 -0700
+Subject: cifs: Allocate encryption header through kmalloc
+
+From: Long Li <longli@microsoft.com>
+
+[ Upstream commit 3946d0d04bb360acca72db5efe9ae8440012d9dc ]
+
+When encryption is used, smb2_transform_hdr is defined on the stack and is
+passed to the transport. This doesn't work with RDMA as the buffer needs to
+be DMA'ed.
+
+Fix it by using kmalloc.
+
+Signed-off-by: Long Li <longli@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/transport.c | 28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index cb3ee916f5275..c97570eb2c180 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -466,7 +466,7 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ struct smb_rqst *rqst, int flags)
+ {
+ struct kvec iov;
+- struct smb2_transform_hdr tr_hdr;
++ struct smb2_transform_hdr *tr_hdr;
+ struct smb_rqst cur_rqst[MAX_COMPOUND];
+ int rc;
+
+@@ -476,28 +476,34 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
+ if (num_rqst > MAX_COMPOUND - 1)
+ return -ENOMEM;
+
+- memset(&cur_rqst[0], 0, sizeof(cur_rqst));
+- memset(&iov, 0, sizeof(iov));
+- memset(&tr_hdr, 0, sizeof(tr_hdr));
+-
+- iov.iov_base = &tr_hdr;
+- iov.iov_len = sizeof(tr_hdr);
+- cur_rqst[0].rq_iov = &iov;
+- cur_rqst[0].rq_nvec = 1;
+-
+ if (!server->ops->init_transform_rq) {
+ cifs_server_dbg(VFS, "Encryption requested but transform "
+ "callback is missing\n");
+ return -EIO;
+ }
+
++ tr_hdr = kmalloc(sizeof(*tr_hdr), GFP_NOFS);
++ if (!tr_hdr)
++ return -ENOMEM;
++
++ memset(&cur_rqst[0], 0, sizeof(cur_rqst));
++ memset(&iov, 0, sizeof(iov));
++ memset(tr_hdr, 0, sizeof(*tr_hdr));
++
++ iov.iov_base = tr_hdr;
++ iov.iov_len = sizeof(*tr_hdr);
++ cur_rqst[0].rq_iov = &iov;
++ cur_rqst[0].rq_nvec = 1;
++
+ rc = server->ops->init_transform_rq(server, num_rqst + 1,
+ &cur_rqst[0], rqst);
+ if (rc)
+- return rc;
++ goto out;
+
+ rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]);
+ smb3_free_compound_rqst(num_rqst, &cur_rqst[1]);
++out:
++ kfree(tr_hdr);
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 03bfd25c82cb6d0118b1c00d12d02620e8e8b7a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 13:36:46 +0200
+Subject: clk: at91: usb: continue if clk_hw_round_rate() return zero
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit b0ecf1c6c6e82da4847900fad0272abfd014666d ]
+
+clk_hw_round_rate() may call round rate function of its parents. In case
+of SAM9X60 two of USB parrents are PLLA and UPLL. These clocks are
+controlled by clk-sam9x60-pll.c driver. The round rate function for this
+driver is sam9x60_pll_round_rate() which call in turn
+sam9x60_pll_get_best_div_mul(). In case the requested rate is not in the
+proper range (rate < characteristics->output[0].min &&
+rate > characteristics->output[0].max) the sam9x60_pll_round_rate() will
+return a negative number to its caller (called by
+clk_core_round_rate_nolock()). clk_hw_round_rate() will return zero in
+case a negative number is returned by clk_core_round_rate_nolock(). With
+this, the USB clock will continue its rate computation even caller of
+clk_hw_round_rate() returned an error. With this, the USB clock on SAM9X60
+may not chose the best parent. I detected this after a suspend/resume
+cycle on SAM9X60.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lkml.kernel.org/r/1579261009-4573-2-git-send-email-claudiu.beznea@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c
+index bda92980e0155..c0895c993cce2 100644
+--- a/drivers/clk/at91/clk-usb.c
++++ b/drivers/clk/at91/clk-usb.c
+@@ -75,6 +75,9 @@ static int at91sam9x5_clk_usb_determine_rate(struct clk_hw *hw,
+ tmp_parent_rate = req->rate * div;
+ tmp_parent_rate = clk_hw_round_rate(parent,
+ tmp_parent_rate);
++ if (!tmp_parent_rate)
++ continue;
++
+ tmp_rate = DIV_ROUND_CLOSEST(tmp_parent_rate, div);
+ if (tmp_rate < req->rate)
+ tmp_diff = req->rate - tmp_rate;
+--
+2.20.1
+
--- /dev/null
+From c33f3bb815df1ff63e56f6358423a61da746f5ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 15:27:59 -0800
+Subject: clk: Don't cache errors from clk_ops::get_phase()
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit f21cf9c77ee82ef8adfeb2143adfacf21ec1d5cc ]
+
+We don't check for errors from clk_ops::get_phase() before storing away
+the result into the clk_core::phase member. This can lead to some fairly
+confusing debugfs information if these ops do return an error. Let's
+skip the store when this op fails to fix this. While we're here, move
+the locking outside of clk_core_get_phase() to simplify callers from
+the debugfs side.
+
+Cc: Douglas Anderson <dianders@chromium.org>
+Cc: Heiko Stuebner <heiko@sntech.de>
+Cc: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20200205232802.29184-2-sboyd@kernel.org
+Acked-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 48 +++++++++++++++++++++++++++++++----------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 95adf6c6db3db..305544b68b8a7 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -2660,12 +2660,14 @@ static int clk_core_get_phase(struct clk_core *core)
+ {
+ int ret;
+
+- clk_prepare_lock();
++ lockdep_assert_held(&prepare_lock);
++ if (!core->ops->get_phase)
++ return 0;
++
+ /* Always try to update cached phase if possible */
+- if (core->ops->get_phase)
+- core->phase = core->ops->get_phase(core->hw);
+- ret = core->phase;
+- clk_prepare_unlock();
++ ret = core->ops->get_phase(core->hw);
++ if (ret >= 0)
++ core->phase = ret;
+
+ return ret;
+ }
+@@ -2679,10 +2681,16 @@ static int clk_core_get_phase(struct clk_core *core)
+ */
+ int clk_get_phase(struct clk *clk)
+ {
++ int ret;
++
+ if (!clk)
+ return 0;
+
+- return clk_core_get_phase(clk->core);
++ clk_prepare_lock();
++ ret = clk_core_get_phase(clk->core);
++ clk_prepare_unlock();
++
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(clk_get_phase);
+
+@@ -2896,13 +2904,21 @@ static struct hlist_head *orphan_list[] = {
+ static void clk_summary_show_one(struct seq_file *s, struct clk_core *c,
+ int level)
+ {
+- seq_printf(s, "%*s%-*s %7d %8d %8d %11lu %10lu %5d %6d\n",
++ int phase;
++
++ seq_printf(s, "%*s%-*s %7d %8d %8d %11lu %10lu ",
+ level * 3 + 1, "",
+ 30 - level * 3, c->name,
+ c->enable_count, c->prepare_count, c->protect_count,
+- clk_core_get_rate(c), clk_core_get_accuracy(c),
+- clk_core_get_phase(c),
+- clk_core_get_scaled_duty_cycle(c, 100000));
++ clk_core_get_rate(c), clk_core_get_accuracy(c));
++
++ phase = clk_core_get_phase(c);
++ if (phase >= 0)
++ seq_printf(s, "%5d", phase);
++ else
++ seq_puts(s, "-----");
++
++ seq_printf(s, " %6d\n", clk_core_get_scaled_duty_cycle(c, 100000));
+ }
+
+ static void clk_summary_show_subtree(struct seq_file *s, struct clk_core *c,
+@@ -2939,6 +2955,7 @@ DEFINE_SHOW_ATTRIBUTE(clk_summary);
+
+ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
+ {
++ int phase;
+ unsigned long min_rate, max_rate;
+
+ clk_core_get_boundaries(c, &min_rate, &max_rate);
+@@ -2952,7 +2969,9 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
+ seq_printf(s, "\"min_rate\": %lu,", min_rate);
+ seq_printf(s, "\"max_rate\": %lu,", max_rate);
+ seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
+- seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c));
++ phase = clk_core_get_phase(c);
++ if (phase >= 0)
++ seq_printf(s, "\"phase\": %d,", phase);
+ seq_printf(s, "\"duty_cycle\": %u",
+ clk_core_get_scaled_duty_cycle(c, 100000));
+ }
+@@ -3434,14 +3453,11 @@ static int __clk_core_init(struct clk_core *core)
+ core->accuracy = 0;
+
+ /*
+- * Set clk's phase.
++ * Set clk's phase by clk_core_get_phase() caching the phase.
+ * Since a phase is by definition relative to its parent, just
+ * query the current clock phase, or just assume it's in phase.
+ */
+- if (core->ops->get_phase)
+- core->phase = core->ops->get_phase(core->hw);
+- else
+- core->phase = 0;
++ clk_core_get_phase(core);
+
+ /*
+ * Set clk's duty cycle.
+--
+2.20.1
+
--- /dev/null
+From 66e4460c58770f837e643a2e5ea95d4d13e77e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 14:50:49 +0800
+Subject: clk: imx: pll14xx: Add new frequency entries for pll1443x table
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 57795654fb553a78f07a9f92d87fb2582379cd93 ]
+
+Add new frequency entries to pll1443x table to meet different
+display settings requirement.
+
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-pll14xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c
+index 5b0519a81a7af..37e311e1d0586 100644
+--- a/drivers/clk/imx/clk-pll14xx.c
++++ b/drivers/clk/imx/clk-pll14xx.c
+@@ -55,8 +55,10 @@ static const struct imx_pll14xx_rate_table imx_pll1416x_tbl[] = {
+ };
+
+ static const struct imx_pll14xx_rate_table imx_pll1443x_tbl[] = {
++ PLL_1443X_RATE(1039500000U, 173, 2, 1, 16384),
+ PLL_1443X_RATE(650000000U, 325, 3, 2, 0),
+ PLL_1443X_RATE(594000000U, 198, 2, 2, 0),
++ PLL_1443X_RATE(519750000U, 173, 2, 2, 16384),
+ PLL_1443X_RATE(393216000U, 262, 2, 3, 9437),
+ PLL_1443X_RATE(361267200U, 361, 3, 3, 17511),
+ };
+--
+2.20.1
+
--- /dev/null
+From 59fb84dda858df2e5fb9e9b889309461ec57bea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 23:24:09 -0800
+Subject: clk: tegra: Fix Tegra PMC clock out parents
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 6fe38aa8cac3a5db38154331742835a4d9740788 ]
+
+Tegra PMC clocks clk_out_1, clk_out_2, and clk_out_3 supported parents
+are osc, osc_div2, osc_div4 and extern clock.
+
+Clock driver is using incorrect parents clk_m, clk_m_div2, clk_m_div4
+for PMC clocks.
+
+This patch fixes this.
+
+Tested-by: Dmitry Osipenko <digetx@gmail.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-tegra-pmc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-tegra-pmc.c b/drivers/clk/tegra/clk-tegra-pmc.c
+index bec3e008335f3..5e044ba1ae364 100644
+--- a/drivers/clk/tegra/clk-tegra-pmc.c
++++ b/drivers/clk/tegra/clk-tegra-pmc.c
+@@ -49,16 +49,16 @@ struct pmc_clk_init_data {
+
+ static DEFINE_SPINLOCK(clk_out_lock);
+
+-static const char *clk_out1_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern1",
++static const char *clk_out1_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern1",
+ };
+
+-static const char *clk_out2_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern2",
++static const char *clk_out2_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern2",
+ };
+
+-static const char *clk_out3_parents[] = { "clk_m", "clk_m_div2",
+- "clk_m_div4", "extern3",
++static const char *clk_out3_parents[] = { "osc", "osc_div2",
++ "osc_div4", "extern3",
+ };
+
+ static struct pmc_clk_init_data pmc_clks[] = {
+--
+2.20.1
+
--- /dev/null
+From bf73285e0e6a5a9d3ff9904c10f8106bf9668d61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 20:09:37 -0700
+Subject: compiler.h: fix error in BUILD_BUG_ON() reporting
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+[ Upstream commit af9c5d2e3b355854ff0e4acfbfbfadcd5198a349 ]
+
+compiletime_assert() uses __LINE__ to create a unique function name. This
+means that if you have more than one BUILD_BUG_ON() in the same source
+line (which can happen if they appear e.g. in a macro), then the error
+message from the compiler might output the wrong condition.
+
+For this source file:
+
+ #include <linux/build_bug.h>
+
+ #define macro() \
+ BUILD_BUG_ON(1); \
+ BUILD_BUG_ON(0);
+
+ void foo()
+ {
+ macro();
+ }
+
+gcc would output:
+
+./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_9' declared with attribute error: BUILD_BUG_ON failed: 0
+ _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
+
+However, it was not the BUILD_BUG_ON(0) that failed, so it should say 1
+instead of 0. With this patch, we use __COUNTER__ instead of __LINE__, so
+each BUILD_BUG_ON() gets a different function name and the correct
+condition is printed:
+
+./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_0' declared with attribute error: BUILD_BUG_ON failed: 1
+ _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Reviewed-by: Daniel Santos <daniel.santos@pobox.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Ian Abbott <abbotti@mev.co.uk>
+Cc: Joe Perches <joe@perches.com>
+Link: http://lkml.kernel.org/r/20200331112637.25047-1-vegard.nossum@oracle.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/compiler.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/compiler.h b/include/linux/compiler.h
+index 5e88e7e33abec..034b0a644efcc 100644
+--- a/include/linux/compiler.h
++++ b/include/linux/compiler.h
+@@ -347,7 +347,7 @@ static inline void *offset_to_ptr(const int *off)
+ * compiler has support to do so.
+ */
+ #define compiletime_assert(condition, msg) \
+- _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
++ _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
+
+ #define compiletime_assert_atomic_type(t) \
+ compiletime_assert(__native_word(t), \
+--
+2.20.1
+
--- /dev/null
+From 49b79b680c7c481d49f788cd386fe7a151e29072 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 12:02:25 -0300
+Subject: crypto: qce - use cryptlen when adding extra sgl
+
+From: Eneas U de Queiroz <cotequeiroz@gmail.com>
+
+[ Upstream commit d6364b8128439a8c0e381f80c38667de9f15eef8 ]
+
+The qce crypto driver appends an extra entry to the dst sgl, to maintain
+private state information.
+
+When the gcm driver sends requests to the ctr skcipher, it passes the
+authentication tag after the actual crypto payload, but it must not be
+touched.
+
+Commit 1336c2221bee ("crypto: qce - save a sg table slot for result
+buf") limited the destination sgl to avoid overwriting the
+authentication tag but it assumed the tag would be in a separate sgl
+entry.
+
+This is not always the case, so it is better to limit the length of the
+destination buffer to req->cryptlen before appending the result buf.
+
+Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qce/dma.c | 11 ++++++-----
+ drivers/crypto/qce/dma.h | 2 +-
+ drivers/crypto/qce/skcipher.c | 5 +++--
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/qce/dma.c b/drivers/crypto/qce/dma.c
+index 7da893dc00e73..46db5bf366b44 100644
+--- a/drivers/crypto/qce/dma.c
++++ b/drivers/crypto/qce/dma.c
+@@ -48,9 +48,10 @@ void qce_dma_release(struct qce_dma_data *dma)
+
+ struct scatterlist *
+ qce_sgtable_add(struct sg_table *sgt, struct scatterlist *new_sgl,
+- int max_ents)
++ unsigned int max_len)
+ {
+ struct scatterlist *sg = sgt->sgl, *sg_last = NULL;
++ unsigned int new_len;
+
+ while (sg) {
+ if (!sg_page(sg))
+@@ -61,13 +62,13 @@ qce_sgtable_add(struct sg_table *sgt, struct scatterlist *new_sgl,
+ if (!sg)
+ return ERR_PTR(-EINVAL);
+
+- while (new_sgl && sg && max_ents) {
+- sg_set_page(sg, sg_page(new_sgl), new_sgl->length,
+- new_sgl->offset);
++ while (new_sgl && sg && max_len) {
++ new_len = new_sgl->length > max_len ? max_len : new_sgl->length;
++ sg_set_page(sg, sg_page(new_sgl), new_len, new_sgl->offset);
+ sg_last = sg;
+ sg = sg_next(sg);
+ new_sgl = sg_next(new_sgl);
+- max_ents--;
++ max_len -= new_len;
+ }
+
+ return sg_last;
+diff --git a/drivers/crypto/qce/dma.h b/drivers/crypto/qce/dma.h
+index ed25a0d9829e5..7864021693608 100644
+--- a/drivers/crypto/qce/dma.h
++++ b/drivers/crypto/qce/dma.h
+@@ -43,6 +43,6 @@ void qce_dma_issue_pending(struct qce_dma_data *dma);
+ int qce_dma_terminate_all(struct qce_dma_data *dma);
+ struct scatterlist *
+ qce_sgtable_add(struct sg_table *sgt, struct scatterlist *sg_add,
+- int max_ents);
++ unsigned int max_len);
+
+ #endif /* _DMA_H_ */
+diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c
+index 4217b745f1242..63ae75809cb70 100644
+--- a/drivers/crypto/qce/skcipher.c
++++ b/drivers/crypto/qce/skcipher.c
+@@ -97,13 +97,14 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req)
+
+ sg_init_one(&rctx->result_sg, qce->dma.result_buf, QCE_RESULT_BUF_SZ);
+
+- sg = qce_sgtable_add(&rctx->dst_tbl, req->dst, rctx->dst_nents - 1);
++ sg = qce_sgtable_add(&rctx->dst_tbl, req->dst, req->cryptlen);
+ if (IS_ERR(sg)) {
+ ret = PTR_ERR(sg);
+ goto error_free;
+ }
+
+- sg = qce_sgtable_add(&rctx->dst_tbl, &rctx->result_sg, 1);
++ sg = qce_sgtable_add(&rctx->dst_tbl, &rctx->result_sg,
++ QCE_RESULT_BUF_SZ);
+ if (IS_ERR(sg)) {
+ ret = PTR_ERR(sg);
+ goto error_free;
+--
+2.20.1
+
--- /dev/null
+From cd3f03aa17db0d02b4ea1c07ea408d522f3b955c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Mar 2020 19:14:37 +0800
+Subject: csky: Fixup cpu speculative execution to IO area
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit aefd9461d34a1b0a2acad0750c43216c1c27b9d4 ]
+
+For the memory size ( > 512MB, < 1GB), the MSA setting is:
+
+ - SSEG0: PHY_START , PHY_START + 512MB
+ - SSEG1: PHY_START + 512MB, PHY_START + 1GB
+
+But the real memory is no more than 1GB, there is a gap between the
+end size of memory and border of 1GB. CPU could speculatively
+execute to that gap and if the gap of the bus couldn't respond to
+the CPU request, then the crash will happen.
+
+Now make the setting with:
+
+ - SSEG0: PHY_START , PHY_START + 512MB (no change)
+ - SSEG1: Disabled (We use highmem to use the memory of 512MB~1GB)
+
+We also deprecated zhole_szie[] settings, it's only used by arm
+style CPUs. All memory gap should use Reserved setting of dts in
+csky system.
+
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/abiv1/inc/abi/entry.h | 5 +--
+ arch/csky/abiv2/inc/abi/entry.h | 7 ++--
+ arch/csky/kernel/head.S | 5 +++
+ arch/csky/kernel/setup.c | 63 ++++++++-------------------------
+ arch/csky/kernel/smp.c | 3 ++
+ 5 files changed, 25 insertions(+), 58 deletions(-)
+
+diff --git a/arch/csky/abiv1/inc/abi/entry.h b/arch/csky/abiv1/inc/abi/entry.h
+index f35a9f3315ee6..5056ebb902d18 100644
+--- a/arch/csky/abiv1/inc/abi/entry.h
++++ b/arch/csky/abiv1/inc/abi/entry.h
+@@ -172,10 +172,7 @@
+ addi r6, 0xe
+ cpwcr r6, cpcr30
+
+- lsri r6, 28
+- addi r6, 2
+- lsli r6, 28
+- addi r6, 0xe
++ movi r6, 0
+ cpwcr r6, cpcr31
+ .endm
+
+diff --git a/arch/csky/abiv2/inc/abi/entry.h b/arch/csky/abiv2/inc/abi/entry.h
+index 94a7a58765dff..111973c6c713f 100644
+--- a/arch/csky/abiv2/inc/abi/entry.h
++++ b/arch/csky/abiv2/inc/abi/entry.h
+@@ -230,11 +230,8 @@
+ addi r6, 0x1ce
+ mtcr r6, cr<30, 15> /* Set MSA0 */
+
+- lsri r6, 28
+- addi r6, 2
+- lsli r6, 28
+- addi r6, 0x1ce
+- mtcr r6, cr<31, 15> /* Set MSA1 */
++ movi r6, 0
++ mtcr r6, cr<31, 15> /* Clr MSA1 */
+
+ /* enable MMU */
+ mfcr r6, cr18
+diff --git a/arch/csky/kernel/head.S b/arch/csky/kernel/head.S
+index 61989f9241c02..17ed9d2504807 100644
+--- a/arch/csky/kernel/head.S
++++ b/arch/csky/kernel/head.S
+@@ -21,6 +21,11 @@ END(_start)
+ ENTRY(_start_smp_secondary)
+ SETUP_MMU
+
++ /* copy msa1 from CPU0 */
++ lrw r6, secondary_msa1
++ ld.w r6, (r6, 0)
++ mtcr r6, cr<31, 15>
++
+ /* set stack point */
+ lrw r6, secondary_stack
+ ld.w r6, (r6, 0)
+diff --git a/arch/csky/kernel/setup.c b/arch/csky/kernel/setup.c
+index 3821e55742f46..819a9a7bf786d 100644
+--- a/arch/csky/kernel/setup.c
++++ b/arch/csky/kernel/setup.c
+@@ -24,26 +24,9 @@ struct screen_info screen_info = {
+ };
+ #endif
+
+-phys_addr_t __init_memblock memblock_end_of_REG0(void)
+-{
+- return (memblock.memory.regions[0].base +
+- memblock.memory.regions[0].size);
+-}
+-
+-phys_addr_t __init_memblock memblock_start_of_REG1(void)
+-{
+- return memblock.memory.regions[1].base;
+-}
+-
+-size_t __init_memblock memblock_size_of_REG1(void)
+-{
+- return memblock.memory.regions[1].size;
+-}
+-
+ static void __init csky_memblock_init(void)
+ {
+ unsigned long zone_size[MAX_NR_ZONES];
+- unsigned long zhole_size[MAX_NR_ZONES];
+ signed long size;
+
+ memblock_reserve(__pa(_stext), _end - _stext);
+@@ -54,54 +37,36 @@ static void __init csky_memblock_init(void)
+ memblock_dump_all();
+
+ memset(zone_size, 0, sizeof(zone_size));
+- memset(zhole_size, 0, sizeof(zhole_size));
+
+ min_low_pfn = PFN_UP(memblock_start_of_DRAM());
+- max_pfn = PFN_DOWN(memblock_end_of_DRAM());
+-
+- max_low_pfn = PFN_UP(memblock_end_of_REG0());
+- if (max_low_pfn == 0)
+- max_low_pfn = max_pfn;
++ max_low_pfn = max_pfn = PFN_DOWN(memblock_end_of_DRAM());
+
+ size = max_pfn - min_low_pfn;
+
+- if (memblock.memory.cnt > 1) {
+- zone_size[ZONE_NORMAL] =
+- PFN_DOWN(memblock_start_of_REG1()) - min_low_pfn;
+- zhole_size[ZONE_NORMAL] =
+- PFN_DOWN(memblock_start_of_REG1()) - max_low_pfn;
++ if (size <= PFN_DOWN(SSEG_SIZE - PHYS_OFFSET_OFFSET))
++ zone_size[ZONE_NORMAL] = size;
++ else if (size < PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET)) {
++ zone_size[ZONE_NORMAL] =
++ PFN_DOWN(SSEG_SIZE - PHYS_OFFSET_OFFSET);
++ max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL];
+ } else {
+- if (size <= PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET))
+- zone_size[ZONE_NORMAL] = max_pfn - min_low_pfn;
+- else {
+- zone_size[ZONE_NORMAL] =
++ zone_size[ZONE_NORMAL] =
+ PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET);
+- max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL];
+- }
++ max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL];
++ write_mmu_msa1(read_mmu_msa0() + SSEG_SIZE);
+ }
+
+ #ifdef CONFIG_HIGHMEM
+- size = 0;
+- if (memblock.memory.cnt > 1) {
+- size = PFN_DOWN(memblock_size_of_REG1());
+- highstart_pfn = PFN_DOWN(memblock_start_of_REG1());
+- } else {
+- size = max_pfn - min_low_pfn -
+- PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET);
+- highstart_pfn = min_low_pfn +
+- PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET);
+- }
+-
+- if (size > 0)
+- zone_size[ZONE_HIGHMEM] = size;
++ zone_size[ZONE_HIGHMEM] = max_pfn - max_low_pfn;
+
+- highend_pfn = max_pfn;
++ highstart_pfn = max_low_pfn;
++ highend_pfn = max_pfn;
+ #endif
+ memblock_set_current_limit(PFN_PHYS(max_low_pfn));
+
+ dma_contiguous_reserve(0);
+
+- free_area_init_node(0, zone_size, min_low_pfn, zhole_size);
++ free_area_init_node(0, zone_size, min_low_pfn, NULL);
+ }
+
+ void __init setup_arch(char **cmdline_p)
+diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c
+index 0bb0954d55709..de61feb4b6df2 100644
+--- a/arch/csky/kernel/smp.c
++++ b/arch/csky/kernel/smp.c
+@@ -156,6 +156,8 @@ volatile unsigned int secondary_hint;
+ volatile unsigned int secondary_ccr;
+ volatile unsigned int secondary_stack;
+
++unsigned long secondary_msa1;
++
+ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
+ {
+ unsigned long mask = 1 << cpu;
+@@ -164,6 +166,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
+ (unsigned int) task_stack_page(tidle) + THREAD_SIZE - 8;
+ secondary_hint = mfcr("cr31");
+ secondary_ccr = mfcr("cr18");
++ secondary_msa1 = read_mmu_msa1();
+
+ /*
+ * Because other CPUs are in reset status, we must flush data
+--
+2.20.1
+
--- /dev/null
+From a9250b1ecb33e5b9250c1be299f9e272c3df4fa5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2020 23:45:52 +0800
+Subject: csky: Fixup get wrong psr value from phyical reg
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit 9c0e343d7654a329d1f9b53d253cbf7fb6eff85d ]
+
+We should get psr value from regs->psr in stack, not directly get
+it from phyiscal register then save the vector number in
+tsk->trap_no.
+
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/include/asm/processor.h | 1 +
+ arch/csky/kernel/traps.c | 11 ++++++++++-
+ arch/csky/mm/fault.c | 7 +++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/arch/csky/include/asm/processor.h b/arch/csky/include/asm/processor.h
+index 21e0bd5293dde..c6bcd7f7c720b 100644
+--- a/arch/csky/include/asm/processor.h
++++ b/arch/csky/include/asm/processor.h
+@@ -43,6 +43,7 @@ extern struct cpuinfo_csky cpu_data[];
+ struct thread_struct {
+ unsigned long ksp; /* kernel stack pointer */
+ unsigned long sr; /* saved status register */
++ unsigned long trap_no; /* saved status register */
+
+ /* FPU regs */
+ struct user_fp __aligned(16) user_fp;
+diff --git a/arch/csky/kernel/traps.c b/arch/csky/kernel/traps.c
+index b057480e7463c..63715cb90ee99 100644
+--- a/arch/csky/kernel/traps.c
++++ b/arch/csky/kernel/traps.c
+@@ -115,8 +115,9 @@ asmlinkage void trap_c(struct pt_regs *regs)
+ int sig;
+ unsigned long vector;
+ siginfo_t info;
++ struct task_struct *tsk = current;
+
+- vector = (mfcr("psr") >> 16) & 0xff;
++ vector = (regs->sr >> 16) & 0xff;
+
+ switch (vector) {
+ case VEC_ZERODIV:
+@@ -129,6 +130,7 @@ asmlinkage void trap_c(struct pt_regs *regs)
+ sig = SIGTRAP;
+ break;
+ case VEC_ILLEGAL:
++ tsk->thread.trap_no = vector;
+ die_if_kernel("Kernel mode ILLEGAL", regs, vector);
+ #ifndef CONFIG_CPU_NO_USER_BKPT
+ if (*(uint16_t *)instruction_pointer(regs) != USR_BKPT)
+@@ -146,16 +148,20 @@ asmlinkage void trap_c(struct pt_regs *regs)
+ sig = SIGTRAP;
+ break;
+ case VEC_ACCESS:
++ tsk->thread.trap_no = vector;
+ return buserr(regs);
+ #ifdef CONFIG_CPU_NEED_SOFTALIGN
+ case VEC_ALIGN:
++ tsk->thread.trap_no = vector;
+ return csky_alignment(regs);
+ #endif
+ #ifdef CONFIG_CPU_HAS_FPU
+ case VEC_FPE:
++ tsk->thread.trap_no = vector;
+ die_if_kernel("Kernel mode FPE", regs, vector);
+ return fpu_fpe(regs);
+ case VEC_PRIV:
++ tsk->thread.trap_no = vector;
+ die_if_kernel("Kernel mode PRIV", regs, vector);
+ if (fpu_libc_helper(regs))
+ return;
+@@ -164,5 +170,8 @@ asmlinkage void trap_c(struct pt_regs *regs)
+ sig = SIGSEGV;
+ break;
+ }
++
++ tsk->thread.trap_no = vector;
++
+ send_sig(sig, current, 0);
+ }
+diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c
+index f76618b630f91..562c7f7087490 100644
+--- a/arch/csky/mm/fault.c
++++ b/arch/csky/mm/fault.c
+@@ -179,11 +179,14 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write,
+ bad_area_nosemaphore:
+ /* User mode accesses just cause a SIGSEGV */
+ if (user_mode(regs)) {
++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff;
+ force_sig_fault(SIGSEGV, si_code, (void __user *)address);
+ return;
+ }
+
+ no_context:
++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff;
++
+ /* Are we prepared to handle this kernel fault? */
+ if (fixup_exception(regs))
+ return;
+@@ -198,6 +201,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write,
+ die_if_kernel("Oops", regs, write);
+
+ out_of_memory:
++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff;
++
+ /*
+ * We ran out of memory, call the OOM killer, and return the userspace
+ * (which will retry the fault, or kill us if we got oom-killed).
+@@ -206,6 +211,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write,
+ return;
+
+ do_sigbus:
++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff;
++
+ up_read(&mm->mmap_sem);
+
+ /* Kernel mode? Handle exceptions or die */
+--
+2.20.1
+
--- /dev/null
+From 8246c54d288092002b1f7eb13ad63a0aeba073ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2020 10:23:26 +0800
+Subject: csky: Fixup init_fpu compile warning with __init
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit 12879bda3c2a974b7e4fe199a9c21f0c5f6bca04 ]
+
+WARNING: vmlinux.o(.text+0x2366): Section mismatch in reference from the
+function csky_start_secondary() to the function .init.text:init_fpu()
+
+The function csky_start_secondary() references
+the function __init init_fpu().
+This is often because csky_start_secondary lacks a __init
+annotation or the annotation of init_fpu is wrong.
+
+Reported-by: Lu Chongzhi <chongzhi.lcz@alibaba-inc.com>
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/abiv2/fpu.c | 5 -----
+ arch/csky/abiv2/inc/abi/fpu.h | 3 ++-
+ arch/csky/kernel/smp.c | 3 +++
+ 3 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/arch/csky/abiv2/fpu.c b/arch/csky/abiv2/fpu.c
+index 86d187d4e5af1..5acc5c2e544e1 100644
+--- a/arch/csky/abiv2/fpu.c
++++ b/arch/csky/abiv2/fpu.c
+@@ -10,11 +10,6 @@
+ #define MTCR_DIST 0xC0006420
+ #define MFCR_DIST 0xC0006020
+
+-void __init init_fpu(void)
+-{
+- mtcr("cr<1, 2>", 0);
+-}
+-
+ /*
+ * fpu_libc_helper() is to help libc to excute:
+ * - mfcr %a, cr<1, 2>
+diff --git a/arch/csky/abiv2/inc/abi/fpu.h b/arch/csky/abiv2/inc/abi/fpu.h
+index 22ca3cf2794a1..09e2700a36936 100644
+--- a/arch/csky/abiv2/inc/abi/fpu.h
++++ b/arch/csky/abiv2/inc/abi/fpu.h
+@@ -9,7 +9,8 @@
+
+ int fpu_libc_helper(struct pt_regs *regs);
+ void fpu_fpe(struct pt_regs *regs);
+-void __init init_fpu(void);
++
++static inline void init_fpu(void) { mtcr("cr<1, 2>", 0); }
+
+ void save_to_user_fp(struct user_fp *user_fp);
+ void restore_from_user_fp(struct user_fp *user_fp);
+diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c
+index de61feb4b6df2..b5c5bc3afeb5c 100644
+--- a/arch/csky/kernel/smp.c
++++ b/arch/csky/kernel/smp.c
+@@ -22,6 +22,9 @@
+ #include <asm/sections.h>
+ #include <asm/mmu_context.h>
+ #include <asm/pgalloc.h>
++#ifdef CONFIG_CPU_HAS_FPU
++#include <abi/fpu.h>
++#endif
+
+ struct ipi_data_struct {
+ unsigned long bits ____cacheline_aligned;
+--
+2.20.1
+
--- /dev/null
+From c4e43d5be322b16b4d59000da8967138c1b6c87a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 15:41:45 +0000
+Subject: dma-coherent: fix integer overflow in the reserved-memory dma
+ allocation
+
+From: Kevin Grandemange <kevin.grandemange@allegrodvt.com>
+
+[ Upstream commit 286c21de32b904131f8cf6a36ce40b8b0c9c5da3 ]
+
+pageno is an int and the PAGE_SHIFT shift is done on an int,
+overflowing if the memory is bigger than 2G
+
+This can be reproduced using for example a reserved-memory of 4G
+
+reserved-memory {
+ #address-cells = <2>;
+ #size-cells = <2>;
+ ranges;
+
+ reserved_dma: buffer@0 {
+ compatible = "shared-dma-pool";
+ no-map;
+ reg = <0x5 0x00000000 0x1 0x0>;
+ };
+};
+
+Signed-off-by: Kevin Grandemange <kevin.grandemange@allegrodvt.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/coherent.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
+index 551b0eb7028a3..2a0c4985f38e4 100644
+--- a/kernel/dma/coherent.c
++++ b/kernel/dma/coherent.c
+@@ -134,7 +134,7 @@ static void *__dma_alloc_from_coherent(struct device *dev,
+
+ spin_lock_irqsave(&mem->spinlock, flags);
+
+- if (unlikely(size > (mem->size << PAGE_SHIFT)))
++ if (unlikely(size > ((dma_addr_t)mem->size << PAGE_SHIFT)))
+ goto err;
+
+ pageno = bitmap_find_free_region(mem->bitmap, mem->size, order);
+@@ -144,8 +144,9 @@ static void *__dma_alloc_from_coherent(struct device *dev,
+ /*
+ * Memory was found in the coherent area.
+ */
+- *dma_handle = dma_get_device_base(dev, mem) + (pageno << PAGE_SHIFT);
+- ret = mem->virt_base + (pageno << PAGE_SHIFT);
++ *dma_handle = dma_get_device_base(dev, mem) +
++ ((dma_addr_t)pageno << PAGE_SHIFT);
++ ret = mem->virt_base + ((dma_addr_t)pageno << PAGE_SHIFT);
+ spin_unlock_irqrestore(&mem->spinlock, flags);
+ memset(ret, 0, size);
+ return ret;
+@@ -194,7 +195,7 @@ static int __dma_release_from_coherent(struct dma_coherent_mem *mem,
+ int order, void *vaddr)
+ {
+ if (mem && vaddr >= mem->virt_base && vaddr <
+- (mem->virt_base + (mem->size << PAGE_SHIFT))) {
++ (mem->virt_base + ((dma_addr_t)mem->size << PAGE_SHIFT))) {
+ int page = (vaddr - mem->virt_base) >> PAGE_SHIFT;
+ unsigned long flags;
+
+@@ -238,10 +239,10 @@ static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem,
+ struct vm_area_struct *vma, void *vaddr, size_t size, int *ret)
+ {
+ if (mem && vaddr >= mem->virt_base && vaddr + size <=
+- (mem->virt_base + (mem->size << PAGE_SHIFT))) {
++ (mem->virt_base + ((dma_addr_t)mem->size << PAGE_SHIFT))) {
+ unsigned long off = vma->vm_pgoff;
+ int start = (vaddr - mem->virt_base) >> PAGE_SHIFT;
+- int user_count = vma_pages(vma);
++ unsigned long user_count = vma_pages(vma);
+ int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
+
+ *ret = -ENXIO;
+--
+2.20.1
+
--- /dev/null
+From 47398bc5cbf86a1ffbf4bb81881e2261a0b97505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2020 10:50:30 -0700
+Subject: dmaengine: idxd: reflect shadow copy of traffic class programming
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit a1fcaf07ec718bb1f11e29e952c9a4cb733d57a5 ]
+
+The traffic class are set to -1 at initialization until the user programs
+them. If the user choose not to, the driver will program appropriate
+defaults. The driver also needs to update the shadowed copies of the values
+after doing the programming.
+
+Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver")
+Reported-by: Yixin Zhang <yixin.zhang@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/158386263076.10898.4586509576813094559.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index ada69e722f84a..f6f49f0f6fae2 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -584,11 +584,11 @@ static void idxd_group_flags_setup(struct idxd_device *idxd)
+ struct idxd_group *group = &idxd->groups[i];
+
+ if (group->tc_a == -1)
+- group->grpcfg.flags.tc_a = 0;
++ group->tc_a = group->grpcfg.flags.tc_a = 0;
+ else
+ group->grpcfg.flags.tc_a = group->tc_a;
+ if (group->tc_b == -1)
+- group->grpcfg.flags.tc_b = 1;
++ group->tc_b = group->grpcfg.flags.tc_b = 1;
+ else
+ group->grpcfg.flags.tc_b = group->tc_b;
+ group->grpcfg.flags.use_token_limit = group->use_token_limit;
+--
+2.20.1
+
--- /dev/null
+From 20af7062a303b99d9afefc237d627554a5c50eba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 18:07:01 +0530
+Subject: drivers: thermal: tsens: Release device in success path
+
+From: Amit Kucheria <amit.kucheria@linaro.org>
+
+[ Upstream commit f22a3bf0d2225fba438c46a25d3ab8823585a5e0 ]
+
+We don't currently call put_device in case of successfully initialising
+the device. So we hold the reference and keep the device pinned forever.
+
+Allow control to fall through so we can use same code for success and
+error paths to put_device.
+
+As a part of this fixup, change devm_ioremap_resource to act on the same
+device pointer as that used to allocate regmap memory. That ensures that
+we are free to release op->dev after examining its resources.
+
+Signed-off-by: Amit Kucheria <amit.kucheria@linaro.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/d3996667e9f976bb30e97e301585cb1023be422e.1584015867.git.amit.kucheria@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/qcom/tsens-common.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/thermal/qcom/tsens-common.c b/drivers/thermal/qcom/tsens-common.c
+index c8d57ee0a5bb2..2cc276cdfcdb1 100644
+--- a/drivers/thermal/qcom/tsens-common.c
++++ b/drivers/thermal/qcom/tsens-common.c
+@@ -602,7 +602,7 @@ int __init init_common(struct tsens_priv *priv)
+ /* DT with separate SROT and TM address space */
+ priv->tm_offset = 0;
+ res = platform_get_resource(op, IORESOURCE_MEM, 1);
+- srot_base = devm_ioremap_resource(&op->dev, res);
++ srot_base = devm_ioremap_resource(dev, res);
+ if (IS_ERR(srot_base)) {
+ ret = PTR_ERR(srot_base);
+ goto err_put_device;
+@@ -620,7 +620,7 @@ int __init init_common(struct tsens_priv *priv)
+ }
+
+ res = platform_get_resource(op, IORESOURCE_MEM, 0);
+- tm_base = devm_ioremap_resource(&op->dev, res);
++ tm_base = devm_ioremap_resource(dev, res);
+ if (IS_ERR(tm_base)) {
+ ret = PTR_ERR(tm_base);
+ goto err_put_device;
+@@ -687,8 +687,6 @@ int __init init_common(struct tsens_priv *priv)
+ tsens_enable_irq(priv);
+ tsens_debug_init(op);
+
+- return 0;
+-
+ err_put_device:
+ put_device(&op->dev);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 9c69b00062b064184b62702d0fc8ff21524d80b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2020 13:29:46 -0400
+Subject: drm/amd/display: Don't try hdcp1.4 when content_type is set to type1
+
+From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+
+[ Upstream commit c2850c125d919efbb3a9ab46410d23912934f585 ]
+
+[Why]
+When content type property is set to 1. We should enable hdcp2.2 and if we cant
+then stop. Currently the way it works in DC is that if we fail hdcp2, we will
+try hdcp1 after.
+
+[How]
+Use link config to force disable hdcp1.4 when type1 is set.
+
+Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+index 0acd3409dd6ce..3abeff7722e3d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+@@ -113,10 +113,13 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work,
+
+ if (enable_encryption) {
+ display->adjust.disable = 0;
+- if (content_type == DRM_MODE_HDCP_CONTENT_TYPE0)
++ if (content_type == DRM_MODE_HDCP_CONTENT_TYPE0) {
++ hdcp_w->link.adjust.hdcp1.disable = 0;
+ hdcp_w->link.adjust.hdcp2.force_type = MOD_HDCP_FORCE_TYPE_0;
+- else if (content_type == DRM_MODE_HDCP_CONTENT_TYPE1)
++ } else if (content_type == DRM_MODE_HDCP_CONTENT_TYPE1) {
++ hdcp_w->link.adjust.hdcp1.disable = 1;
+ hdcp_w->link.adjust.hdcp2.force_type = MOD_HDCP_FORCE_TYPE_1;
++ }
+
+ schedule_delayed_work(&hdcp_w->property_validate_dwork,
+ msecs_to_jiffies(DRM_HDCP_CHECK_PERIOD_MS));
+@@ -334,6 +337,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config)
+ link->dp.rev = aconnector->dc_link->dpcd_caps.dpcd_rev.raw;
+ display->adjust.disable = 1;
+ link->adjust.auth_delay = 2;
++ link->adjust.hdcp1.disable = 0;
+
+ hdcp_update_display(hdcp_work, link_index, aconnector, DRM_MODE_HDCP_CONTENT_TYPE0, false);
+ }
+--
+2.20.1
+
--- /dev/null
+From d9708acc3b788fb6f9c72a3c47752dfba285bbe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 20:06:58 +0800
+Subject: drm/amdkfd: kfree the wrong pointer
+
+From: Jack Zhang <Jack.Zhang1@amd.com>
+
+[ Upstream commit 3148a6a0ef3cf93570f30a477292768f7eb5d3c3 ]
+
+Originally, it kfrees the wrong pointer for mem_obj.
+It would cause memory leak under stress test.
+
+Signed-off-by: Jack Zhang <Jack.Zhang1@amd.com>
+Acked-by: Nirmoy Das <nirmoy.das@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 2a9e401317353..0d70cb2248fe9 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -1104,9 +1104,9 @@ int kfd_gtt_sa_allocate(struct kfd_dev *kfd, unsigned int size,
+ return 0;
+
+ kfd_gtt_no_free_chunk:
+- pr_debug("Allocation failed with mem_obj = %p\n", mem_obj);
++ pr_debug("Allocation failed with mem_obj = %p\n", *mem_obj);
+ mutex_unlock(&kfd->gtt_sa_lock);
+- kfree(mem_obj);
++ kfree(*mem_obj);
+ return -ENOMEM;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8605c0687b615177e06f8a1ae4eaefbf17dd09c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2020 16:08:44 +1000
+Subject: drm/nouveau/gr/gp107,gp108: implement workaround for HW hanging
+ during init
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 028a12f5aa829b4ba6ac011530b815eda4960e89 ]
+
+Certain boards with GP107/GP108 chipsets hang (often, but randomly) for
+unknown reasons during GR initialisation.
+
+The first tell-tale symptom of this issue is:
+
+nouveau 0000:01:00.0: bus: MMIO read of 00000000 FAULT at 409800 [ TIMEOUT ]
+
+appearing in dmesg, likely followed by many other failures being logged.
+
+Karol found this WAR for the issue a while back, but efforts to isolate
+the root cause and proper fix have not yielded success so far. I've
+modified the original patch to include a few more details, limit it to
+GP107/GP108 by default, and added a config option to override this choice.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 26 +++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+index dd8f85b8b3a7e..f2f5636efac45 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1981,8 +1981,34 @@ gf100_gr_init_(struct nvkm_gr *base)
+ {
+ struct gf100_gr *gr = gf100_gr(base);
+ struct nvkm_subdev *subdev = &base->engine.subdev;
++ struct nvkm_device *device = subdev->device;
++ bool reset = device->chipset == 0x137 || device->chipset == 0x138;
+ u32 ret;
+
++ /* On certain GP107/GP108 boards, we trigger a weird issue where
++ * GR will stop responding to PRI accesses after we've asked the
++ * SEC2 RTOS to boot the GR falcons. This happens with far more
++ * frequency when cold-booting a board (ie. returning from D3).
++ *
++ * The root cause for this is not known and has proven difficult
++ * to isolate, with many avenues being dead-ends.
++ *
++ * A workaround was discovered by Karol, whereby putting GR into
++ * reset for an extended period right before initialisation
++ * prevents the problem from occuring.
++ *
++ * XXX: As RM does not require any such workaround, this is more
++ * of a hack than a true fix.
++ */
++ reset = nvkm_boolopt(device->cfgopt, "NvGrResetWar", reset);
++ if (reset) {
++ nvkm_mask(device, 0x000200, 0x00001000, 0x00000000);
++ nvkm_rd32(device, 0x000200);
++ msleep(50);
++ nvkm_mask(device, 0x000200, 0x00001000, 0x00001000);
++ nvkm_rd32(device, 0x000200);
++ }
++
+ nvkm_pmu_pgob(gr->base.engine.subdev.device->pmu, false);
+
+ ret = nvkm_falcon_get(&gr->fecs.falcon, subdev);
+--
+2.20.1
+
--- /dev/null
+From 80a217f24685373cb2995b87e1559aef2ad48a73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 16:13:37 -0800
+Subject: drm/nouveau/svm: check for SVM initialized before migrating
+
+From: Ralph Campbell <rcampbell@nvidia.com>
+
+[ Upstream commit 822cab6150d3002952407a8297ff5a0d32bb7b54 ]
+
+When migrating system memory to GPU memory, check that SVM has been
+enabled. Even though most errors can be ignored since migration is
+a performance optimization, return an error because this is a violation
+of the API.
+
+Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_svm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
+index df9bf1fd1bc0b..3ec5da025bea7 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
+@@ -171,6 +171,11 @@ nouveau_svmm_bind(struct drm_device *dev, void *data,
+ mm = get_task_mm(current);
+ down_read(&mm->mmap_sem);
+
++ if (!cli->svm.svmm) {
++ up_read(&mm->mmap_sem);
++ return -EINVAL;
++ }
++
+ for (addr = args->va_start, end = args->va_start + size; addr < end;) {
+ struct vm_area_struct *vma;
+ unsigned long next;
+--
+2.20.1
+
--- /dev/null
+From c50ea0f018047f42c2dcea1a66dc0cb7a910a328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 16:13:36 -0800
+Subject: drm/nouveau/svm: fix vma range check for migration
+
+From: Ralph Campbell <rcampbell@nvidia.com>
+
+[ Upstream commit b92103b559c77abc5f8b7bec269230a219c880b7 ]
+
+find_vma_intersection(mm, start, end) only guarantees that end is greater
+than or equal to vma->vm_start but doesn't guarantee that start is
+greater than or equal to vma->vm_start. The calculation for the
+intersecting range in nouveau_svmm_bind() isn't accounting for this and
+can call migrate_vma_setup() with a starting address less than
+vma->vm_start. This results in migrate_vma_setup() returning -EINVAL for
+the range instead of nouveau skipping that part of the range and migrating
+the rest.
+
+Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_svm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
+index 3ec5da025bea7..c567526b75b83 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
+@@ -184,6 +184,7 @@ nouveau_svmm_bind(struct drm_device *dev, void *data,
+ if (!vma)
+ break;
+
++ addr = max(addr, vma->vm_start);
+ next = min(vma->vm_end, end);
+ /* This is a best effort so we ignore errors */
+ nouveau_dmem_migrate_vma(cli->drm, vma, addr, next);
+--
+2.20.1
+
--- /dev/null
+From 08775902d8d3f4894d243259cbe7fdcc6f3e48ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2020 21:29:23 +0100
+Subject: drm/nouveau: workaround runpm fail by disabling PCI power management
+ on certain intel bridges
+
+From: Karol Herbst <kherbst@redhat.com>
+
+[ Upstream commit 434fdb51513bf3057ac144d152e6f2f2b509e857 ]
+
+Fixes the infamous 'runtime PM' bug many users are facing on Laptops with
+Nvidia Pascal GPUs by skipping said PCI power state changes on the GPU.
+
+Depending on the used kernel there might be messages like those in demsg:
+
+"nouveau 0000:01:00.0: Refused to change power state, currently in D3"
+"nouveau 0000:01:00.0: can't change power state from D3cold to D0 (config
+space inaccessible)"
+followed by backtraces of kernel crashes or timeouts within nouveau.
+
+It's still unkown why this issue exists, but this is a reliable workaround
+and solves a very annoying issue for user having to choose between a
+crashing kernel or higher power consumption of their Laptops.
+
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
+Cc: Mika Westerberg <mika.westerberg@intel.com>
+Cc: linux-pci@vger.kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: nouveau@lists.freedesktop.org
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205623
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_drm.c | 63 +++++++++++++++++++++++++++
+ drivers/gpu/drm/nouveau/nouveau_drv.h | 2 +
+ 2 files changed, 65 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index b65ae817eabf5..2d4c899e1f8b9 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -618,6 +618,64 @@ nouveau_drm_device_fini(struct drm_device *dev)
+ kfree(drm);
+ }
+
++/*
++ * On some Intel PCIe bridge controllers doing a
++ * D0 -> D3hot -> D3cold -> D0 sequence causes Nvidia GPUs to not reappear.
++ * Skipping the intermediate D3hot step seems to make it work again. This is
++ * probably caused by not meeting the expectation the involved AML code has
++ * when the GPU is put into D3hot state before invoking it.
++ *
++ * This leads to various manifestations of this issue:
++ * - AML code execution to power on the GPU hits an infinite loop (as the
++ * code waits on device memory to change).
++ * - kernel crashes, as all PCI reads return -1, which most code isn't able
++ * to handle well enough.
++ *
++ * In all cases dmesg will contain at least one line like this:
++ * 'nouveau 0000:01:00.0: Refused to change power state, currently in D3'
++ * followed by a lot of nouveau timeouts.
++ *
++ * In the \_SB.PCI0.PEG0.PG00._OFF code deeper down writes bit 0x80 to the not
++ * documented PCI config space register 0x248 of the Intel PCIe bridge
++ * controller (0x1901) in order to change the state of the PCIe link between
++ * the PCIe port and the GPU. There are alternative code paths using other
++ * registers, which seem to work fine (executed pre Windows 8):
++ * - 0xbc bit 0x20 (publicly available documentation claims 'reserved')
++ * - 0xb0 bit 0x10 (link disable)
++ * Changing the conditions inside the firmware by poking into the relevant
++ * addresses does resolve the issue, but it seemed to be ACPI private memory
++ * and not any device accessible memory at all, so there is no portable way of
++ * changing the conditions.
++ * On a XPS 9560 that means bits [0,3] on \CPEX need to be cleared.
++ *
++ * The only systems where this behavior can be seen are hybrid graphics laptops
++ * with a secondary Nvidia Maxwell, Pascal or Turing GPU. It's unclear whether
++ * this issue only occurs in combination with listed Intel PCIe bridge
++ * controllers and the mentioned GPUs or other devices as well.
++ *
++ * documentation on the PCIe bridge controller can be found in the
++ * "7th Generation Intel® Processor Families for H Platforms Datasheet Volume 2"
++ * Section "12 PCI Express* Controller (x16) Registers"
++ */
++
++static void quirk_broken_nv_runpm(struct pci_dev *pdev)
++{
++ struct drm_device *dev = pci_get_drvdata(pdev);
++ struct nouveau_drm *drm = nouveau_drm(dev);
++ struct pci_dev *bridge = pci_upstream_bridge(pdev);
++
++ if (!bridge || bridge->vendor != PCI_VENDOR_ID_INTEL)
++ return;
++
++ switch (bridge->device) {
++ case 0x1901:
++ drm->old_pm_cap = pdev->pm_cap;
++ pdev->pm_cap = 0;
++ NV_INFO(drm, "Disabling PCI power management to avoid bug\n");
++ break;
++ }
++}
++
+ static int nouveau_drm_probe(struct pci_dev *pdev,
+ const struct pci_device_id *pent)
+ {
+@@ -699,6 +757,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
+ if (ret)
+ goto fail_drm_dev_init;
+
++ quirk_broken_nv_runpm(pdev);
+ return 0;
+
+ fail_drm_dev_init:
+@@ -734,7 +793,11 @@ static void
+ nouveau_drm_remove(struct pci_dev *pdev)
+ {
+ struct drm_device *dev = pci_get_drvdata(pdev);
++ struct nouveau_drm *drm = nouveau_drm(dev);
+
++ /* revert our workaround */
++ if (drm->old_pm_cap)
++ pdev->pm_cap = drm->old_pm_cap;
+ nouveau_drm_device_remove(dev);
+ pci_disable_device(pdev);
+ }
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
+index c2c332fbde979..2a6519737800c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
++++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
+@@ -140,6 +140,8 @@ struct nouveau_drm {
+
+ struct list_head clients;
+
++ u8 old_pm_cap;
++
+ struct {
+ struct agp_bridge_data *bridge;
+ u32 base;
+--
+2.20.1
+
--- /dev/null
+From ab5406a9824df841617ed006abb8e0999f52701e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 14:07:45 +0800
+Subject: drm/ttm: flush the fence on the bo after we individualize the
+ reservation object
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: xinhui pan <xinhui.pan@amd.com>
+
+[ Upstream commit 1bbcf69e42fe7fd49b6f4339c970729d0e343753 ]
+
+As we move the ttm_bo_individualize_resv() upwards, we need flush the
+copied fence too. Otherwise the driver keeps waiting for fence.
+
+run&Kill kfdtest, then perf top.
+
+ 25.53% [ttm] [k] ttm_bo_delayed_delete
+ 24.29% [kernel] [k] dma_resv_test_signaled_rcu
+ 19.72% [kernel] [k] ww_mutex_lock
+
+Fix: 378e2d5b("drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more")
+Signed-off-by: xinhui pan <xinhui.pan@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/series/72339/
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_bo.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
+index 5df596fb0280c..fe420ca454e0a 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -498,8 +498,10 @@ static void ttm_bo_cleanup_refs_or_queue(struct ttm_buffer_object *bo)
+
+ dma_resv_unlock(bo->base.resv);
+ }
+- if (bo->base.resv != &bo->base._resv)
++ if (bo->base.resv != &bo->base._resv) {
++ ttm_bo_flush_all_fences(bo);
+ dma_resv_unlock(&bo->base._resv);
++ }
+
+ error:
+ kref_get(&bo->list_kref);
+--
+2.20.1
+
--- /dev/null
+From bcfffca23b4508cee5431be8d8ccc587e09f99e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 13:20:01 +0100
+Subject: drm/vc4: Fix HDMI mode validation
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit b1e7396a1d0e6af6806337fdaaa44098d6b3343c ]
+
+Current mode validation impedes setting up some video modes which should
+be supported otherwise. Namely 1920x1200@60Hz.
+
+Fix this by lowering the minimum HDMI state machine clock to pixel clock
+ratio allowed.
+
+Fixes: 32e823c63e90 ("drm/vc4: Reject HDMI modes with too high of clocks.")
+Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
+Suggested-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200326122001.22215-1-nsaenzjulienne@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index cea18dc15f77c..340719238753d 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -681,11 +681,23 @@ static enum drm_mode_status
+ vc4_hdmi_encoder_mode_valid(struct drm_encoder *crtc,
+ const struct drm_display_mode *mode)
+ {
+- /* HSM clock must be 108% of the pixel clock. Additionally,
+- * the AXI clock needs to be at least 25% of pixel clock, but
+- * HSM ends up being the limiting factor.
++ /*
++ * As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must
++ * be faster than pixel clock, infinitesimally faster, tested in
++ * simulation. Otherwise, exact value is unimportant for HDMI
++ * operation." This conflicts with bcm2835's vc4 documentation, which
++ * states HSM's clock has to be at least 108% of the pixel clock.
++ *
++ * Real life tests reveal that vc4's firmware statement holds up, and
++ * users are able to use pixel clocks closer to HSM's, namely for
++ * 1920x1200@60Hz. So it was decided to have leave a 1% margin between
++ * both clocks. Which, for RPi0-3 implies a maximum pixel clock of
++ * 162MHz.
++ *
++ * Additionally, the AXI clock needs to be at least 25% of
++ * pixel clock, but HSM ends up being the limiting factor.
+ */
+- if (mode->clock > HSM_CLOCK_FREQ / (1000 * 108 / 100))
++ if (mode->clock > HSM_CLOCK_FREQ / (1000 * 101 / 100))
+ return MODE_CLOCK_HIGH;
+
+ return MODE_OK;
+--
+2.20.1
+
--- /dev/null
+From 9dc587bb8f957d68c9c961e60aa01d75c87a0e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2020 12:05:12 -0600
+Subject: dt-bindings: thermal: tsens: Fix nvmem-cell-names schema
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit b9589def9f9af93d9d4c5969c9a6c166f070e36e ]
+
+There's a typo 'nvmem-cells-names' in the schema which means the correct
+'nvmem-cell-names' in the examples are not checked. The possible values
+are wrong too both in that the 2nd entry is not specified correctly and the
+values are just wrong based on the dts files in the kernel.
+
+Fixes: a877e768f655 ("dt-bindings: thermal: tsens: Convert over to a yaml schema")
+Cc: Andy Gross <agross@kernel.org>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Amit Kucheria <amit.kucheria@linaro.org>
+Cc: Zhang Rui <rui.zhang@intel.com>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: linux-arm-msm@vger.kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: devicetree@vger.kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Amit Kucheria <amit.kucheria@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/thermal/qcom-tsens.yaml | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml b/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml
+index eef13b9446a87..a4df53228122a 100644
+--- a/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml
++++ b/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml
+@@ -53,13 +53,12 @@ properties:
+ description:
+ Reference to an nvmem node for the calibration data
+
+- nvmem-cells-names:
++ nvmem-cell-names:
+ minItems: 1
+ maxItems: 2
+ items:
+- - enum:
+- - caldata
+- - calsel
++ - const: calib
++ - const: calib_sel
+
+ "#qcom,sensors":
+ allOf:
+@@ -125,7 +124,7 @@ examples:
+ <0x4a8000 0x1000>; /* SROT */
+
+ nvmem-cells = <&tsens_caldata>, <&tsens_calsel>;
+- nvmem-cell-names = "caldata", "calsel";
++ nvmem-cell-names = "calib", "calib_sel";
+
+ interrupts = <GIC_SPI 184 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "uplow";
+--
+2.20.1
+
--- /dev/null
+From 90d169c0a412a21d13bafbcefb2714135b9a5271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2020 12:40:02 +0100
+Subject: ext2: fix debug reference to ext2_xattr_cache
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 32302085a8d90859c40cf1a5e8313f575d06ec75 ]
+
+Fix a debug-only build error in ext2/xattr.c:
+
+When building without extra debugging, (and with another patch that uses
+no_printk() instead of <empty> for the ext2-xattr debug-print macros,
+this build error happens:
+
+../fs/ext2/xattr.c: In function ‘ext2_xattr_cache_insert’:
+../fs/ext2/xattr.c:869:18: error: ‘ext2_xattr_cache’ undeclared (first use in
+this function); did you mean ‘ext2_xattr_list’?
+ atomic_read(&ext2_xattr_cache->c_entry_count));
+
+Fix the problem by removing cached entry count from the debug message
+since otherwise we'd have to export the mbcache structure just for that.
+
+Fixes: be0726d33cb8 ("ext2: convert to mbcache2")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/xattr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index b91f99d9482e9..62acbe27d8bf4 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -865,8 +865,7 @@ ext2_xattr_cache_insert(struct mb_cache *cache, struct buffer_head *bh)
+ true);
+ if (error) {
+ if (error == -EBUSY) {
+- ea_bdebug(bh, "already in cache (%d cache entries)",
+- atomic_read(&ext2_xattr_cache->c_entry_count));
++ ea_bdebug(bh, "already in cache");
+ error = 0;
+ }
+ } else
+--
+2.20.1
+
--- /dev/null
+From 4b48c1d4c7619a648caabe6c9600e593d454e0ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2020 19:45:41 -0700
+Subject: ext2: fix empty body warnings when -Wextra is used
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 44a52022e7f15cbaab957df1c14f7a4f527ef7cf ]
+
+When EXT2_ATTR_DEBUG is not defined, modify the 2 debug macros
+to use the no_printk() macro instead of <nothing>.
+This fixes gcc warnings when -Wextra is used:
+
+../fs/ext2/xattr.c:252:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]
+../fs/ext2/xattr.c:258:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]
+../fs/ext2/xattr.c:330:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body]
+../fs/ext2/xattr.c:872:45: warning: suggest braces around empty body in an ‘else’ statement [-Wempty-body]
+
+I have verified that the only object code change (with gcc 7.5.0) is
+the reversal of some instructions from 'cmp a,b' to 'cmp b,a'.
+
+Link: https://lore.kernel.org/r/e18a7395-61fb-2093-18e8-ed4f8cf56248@infradead.org
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jan Kara <jack@suse.com>
+Cc: linux-ext4@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/xattr.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index 0456bc990b5ee..b91f99d9482e9 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -56,6 +56,7 @@
+
+ #include <linux/buffer_head.h>
+ #include <linux/init.h>
++#include <linux/printk.h>
+ #include <linux/slab.h>
+ #include <linux/mbcache.h>
+ #include <linux/quotaops.h>
+@@ -84,8 +85,8 @@
+ printk("\n"); \
+ } while (0)
+ #else
+-# define ea_idebug(f...)
+-# define ea_bdebug(f...)
++# define ea_idebug(inode, f...) no_printk(f)
++# define ea_bdebug(bh, f...) no_printk(f)
+ #endif
+
+ static int ext2_xattr_set2(struct inode *, struct buffer_head *,
+--
+2.20.1
+
--- /dev/null
+From d116dc9e9a4936c8f614826094199ba98cb29a83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2020 14:19:38 -0500
+Subject: ext4: do not commit super on read-only bdev
+
+From: Eric Sandeen <sandeen@redhat.com>
+
+[ Upstream commit c96e2b8564adfb8ac14469ebc51ddc1bfecb3ae2 ]
+
+Under some circumstances we may encounter a filesystem error on a
+read-only block device, and if we try to save the error info to the
+superblock and commit it, we'll wind up with a noisy error and
+backtrace, i.e.:
+
+[ 3337.146838] EXT4-fs error (device pmem1p2): ext4_get_journal_inode:4634: comm mount: inode #0: comm mount: iget: illegal inode #
+------------[ cut here ]------------
+generic_make_request: Trying to write to read-only block-device pmem1p2 (partno 2)
+WARNING: CPU: 107 PID: 115347 at block/blk-core.c:788 generic_make_request_checks+0x6b4/0x7d0
+...
+
+To avoid this, commit the error info in the superblock only if the
+block device is writable.
+
+Reported-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Reviewed-by: Andreas Dilger <adilger@dilger.ca>
+Link: https://lore.kernel.org/r/4b6e774d-cc00-3469-7abb-108eb151071a@sandeen.net
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a985b2c585d24..16da3b3481a4d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -372,7 +372,8 @@ static void save_error_info(struct super_block *sb, const char *func,
+ unsigned int line)
+ {
+ __save_error_info(sb, func, line);
+- ext4_commit_super(sb, 1);
++ if (!bdev_read_only(sb->s_bdev))
++ ext4_commit_super(sb, 1);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 4a9e6dfb2cf659378f1f964c745e42f58e223420 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 19:59:26 +0530
+Subject: f2fs: Add a new CP flag to help fsck fix resize SPO issues
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit c84ef3c5e65ccf99a7a91a4d731ebb5d6331a178 ]
+
+Add and set a new CP flag CP_RESIZEFS_FLAG during
+online resize FS to help fsck fix the metadata mismatch
+that may happen due to SPO during resize, where SB
+got updated but CP data couldn't be written yet.
+
+fsck errors -
+Info: CKPT version = 6ed7bccb
+ Wrong user_block_count(2233856)
+[f2fs_do_mount:3365] Checkpoint is polluted
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/checkpoint.c | 8 ++++++--
+ include/linux/f2fs_fs.h | 1 +
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 9c88fb3d255a2..79aaf06004f65 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -1301,10 +1301,14 @@ static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc)
+ else
+ __clear_ckpt_flags(ckpt, CP_ORPHAN_PRESENT_FLAG);
+
+- if (is_sbi_flag_set(sbi, SBI_NEED_FSCK) ||
+- is_sbi_flag_set(sbi, SBI_IS_RESIZEFS))
++ if (is_sbi_flag_set(sbi, SBI_NEED_FSCK))
+ __set_ckpt_flags(ckpt, CP_FSCK_FLAG);
+
++ if (is_sbi_flag_set(sbi, SBI_IS_RESIZEFS))
++ __set_ckpt_flags(ckpt, CP_RESIZEFS_FLAG);
++ else
++ __clear_ckpt_flags(ckpt, CP_RESIZEFS_FLAG);
++
+ if (is_sbi_flag_set(sbi, SBI_CP_DISABLED))
+ __set_ckpt_flags(ckpt, CP_DISABLED_FLAG);
+ else
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index ac3f4888b3dfa..3c383ddd92ddd 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -125,6 +125,7 @@ struct f2fs_super_block {
+ /*
+ * For checkpoint
+ */
++#define CP_RESIZEFS_FLAG 0x00004000
+ #define CP_DISABLED_QUICK_FLAG 0x00002000
+ #define CP_DISABLED_FLAG 0x00001000
+ #define CP_QUOTA_NEED_FSCK_FLAG 0x00000800
+--
+2.20.1
+
--- /dev/null
+From 711788372890342fd0043f7e5517f1ef346305ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 16:57:06 +0800
+Subject: f2fs: compress: fix to call missing destroy_compress_ctx()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 09ff48011e220e2b4f1d9ce2f472ecb63645cbfc ]
+
+Otherwise, it will cause memory leak.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 927db1205bd81..1a86e483b0907 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -395,6 +395,8 @@ static int f2fs_compress_pages(struct compress_ctx *cc)
+ cc->cpages[i] = NULL;
+ }
+
++ cops->destroy_compress_ctx(cc);
++
+ cc->nr_cpages = nr_cpages;
+
+ trace_f2fs_compress_pages_end(cc->inode, cc->cluster_idx,
+--
+2.20.1
+
--- /dev/null
+From b8f3ff8ea69110817bd03b642858dda3edc4b4a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 20:50:37 -0800
+Subject: f2fs: fix leaking uninitialized memory in compressed clusters
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 7fa6d59816e7d81cfd4f854468c477c12b85c789 ]
+
+When the compressed data of a cluster doesn't end on a page boundary,
+the remainder of the last page must be zeroed in order to avoid leaking
+uninitialized memory to disk.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 11b13b881ada5..837e14b7ef523 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -385,11 +385,15 @@ static int f2fs_compress_pages(struct compress_ctx *cc)
+ for (i = 0; i < COMPRESS_DATA_RESERVED_SIZE; i++)
+ cc->cbuf->reserved[i] = cpu_to_le32(0);
+
++ nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE);
++
++ /* zero out any unused part of the last page */
++ memset(&cc->cbuf->cdata[cc->clen], 0,
++ (nr_cpages * PAGE_SIZE) - (cc->clen + COMPRESS_HEADER_SIZE));
++
+ vunmap(cc->cbuf);
+ vunmap(cc->rbuf);
+
+- nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE);
+-
+ for (i = nr_cpages; i < cc->nr_cpages; i++) {
+ f2fs_put_compressed_page(cc->cpages[i]);
+ cc->cpages[i] = NULL;
+--
+2.20.1
+
--- /dev/null
+From 461b9c13d0975d6ae5f25854aaaece87b8acd752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 19:59:25 +0530
+Subject: f2fs: Fix mount failure due to SPO after a successful online resize
+ FS
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit 682756827501dc52593bf490f2d437c65ec9efcb ]
+
+Even though online resize is successfully done, a SPO immediately
+after resize, still causes below error in the next mount.
+
+[ 11.294650] F2FS-fs (sda8): Wrong user_block_count: 2233856
+[ 11.300272] F2FS-fs (sda8): Failed to get valid F2FS checkpoint
+
+This is because after FS metadata is updated in update_fs_metadata()
+if the SBI_IS_DIRTY is not dirty, then CP will not be done to reflect
+the new user_block_count.
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 9cff2502e3bc6..2f645c591a000 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1579,11 +1579,17 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count)
+ goto out;
+ }
+
++ mutex_lock(&sbi->cp_mutex);
+ update_fs_metadata(sbi, -secs);
+ clear_sbi_flag(sbi, SBI_IS_RESIZEFS);
++ set_sbi_flag(sbi, SBI_IS_DIRTY);
++ mutex_unlock(&sbi->cp_mutex);
++
+ err = f2fs_sync_fs(sbi->sb, 1);
+ if (err) {
++ mutex_lock(&sbi->cp_mutex);
+ update_fs_metadata(sbi, secs);
++ mutex_unlock(&sbi->cp_mutex);
+ update_sb_metadata(sbi, secs);
+ f2fs_commit_super(sbi, false);
+ }
+--
+2.20.1
+
--- /dev/null
+From cdf72acee5d87dca8afe89041ecb15df504dd815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 17:43:04 +0800
+Subject: f2fs: fix NULL pointer dereference in f2fs_verity_work()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 79bbefb19f1359fb2cbd144d5a054649e7e583be ]
+
+If both compression and fsverity feature is on, generic/572 will
+report below NULL pointer dereference bug.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000018
+ RIP: 0010:f2fs_verity_work+0x60/0x90 [f2fs]
+ #PF: supervisor read access in kernel mode
+ Workqueue: fsverity_read_queue f2fs_verity_work [f2fs]
+ RIP: 0010:f2fs_verity_work+0x60/0x90 [f2fs]
+ Call Trace:
+ process_one_work+0x16c/0x3f0
+ worker_thread+0x4c/0x440
+ ? rescuer_thread+0x350/0x350
+ kthread+0xf8/0x130
+ ? kthread_unpark+0x70/0x70
+ ret_from_fork+0x35/0x40
+
+There are two issue in f2fs_verity_work():
+- it needs to traverse and verify all pages in bio.
+- if pages in bio belong to non-compressed cluster, accessing
+decompress IO context stored in page private will cause NULL
+pointer dereference.
+
+Fix them.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 ++
+ fs/f2fs/data.c | 35 ++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 1a86e483b0907..eb84c13c1182c 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -476,6 +476,8 @@ void f2fs_decompress_pages(struct bio *bio, struct page *page, bool verity)
+ out_vunmap_rbuf:
+ vunmap(dic->rbuf);
+ out_free_dic:
++ if (verity)
++ refcount_add(dic->nr_cpages - 1, &dic->ref);
+ if (!verity)
+ f2fs_decompress_end_io(dic->rpages, dic->cluster_size,
+ ret, false);
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index b27b721079116..34990866cfe96 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -191,12 +191,37 @@ static void f2fs_verify_pages(struct page **rpages, unsigned int cluster_size)
+
+ static void f2fs_verify_bio(struct bio *bio)
+ {
+- struct page *page = bio_first_page_all(bio);
+- struct decompress_io_ctx *dic =
+- (struct decompress_io_ctx *)page_private(page);
++ struct bio_vec *bv;
++ struct bvec_iter_all iter_all;
++
++ bio_for_each_segment_all(bv, bio, iter_all) {
++ struct page *page = bv->bv_page;
++ struct decompress_io_ctx *dic;
++
++ dic = (struct decompress_io_ctx *)page_private(page);
++
++ if (dic) {
++ if (refcount_dec_not_one(&dic->ref))
++ continue;
++ f2fs_verify_pages(dic->rpages,
++ dic->cluster_size);
++ f2fs_free_dic(dic);
++ continue;
++ }
++
++ if (bio->bi_status || PageError(page))
++ goto clear_uptodate;
+
+- f2fs_verify_pages(dic->rpages, dic->cluster_size);
+- f2fs_free_dic(dic);
++ if (fsverity_verify_page(page)) {
++ SetPageUptodate(page);
++ goto unlock;
++ }
++clear_uptodate:
++ ClearPageUptodate(page);
++ ClearPageError(page);
++unlock:
++ unlock_page(page);
++ }
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From cf36e3a860fc9c96e48d57ea09b66a9e6c86f146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2020 19:58:00 +0800
+Subject: f2fs: fix NULL pointer dereference in f2fs_write_begin()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 62f63eea291b50a5677ae7503ac128803174698a ]
+
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+RIP: 0010:f2fs_write_begin+0x823/0xb90 [f2fs]
+Call Trace:
+ f2fs_quota_write+0x139/0x1d0 [f2fs]
+ write_blk+0x36/0x80 [quota_tree]
+ get_free_dqblk+0x42/0xa0 [quota_tree]
+ do_insert_tree+0x235/0x4a0 [quota_tree]
+ do_insert_tree+0x26e/0x4a0 [quota_tree]
+ do_insert_tree+0x26e/0x4a0 [quota_tree]
+ do_insert_tree+0x26e/0x4a0 [quota_tree]
+ qtree_write_dquot+0x70/0x190 [quota_tree]
+ v2_write_dquot+0x43/0x90 [quota_v2]
+ dquot_acquire+0x77/0x100
+ f2fs_dquot_acquire+0x2f/0x60 [f2fs]
+ dqget+0x310/0x450
+ dquot_transfer+0x7e/0x120
+ f2fs_setattr+0x11a/0x4a0 [f2fs]
+ notify_change+0x349/0x480
+ chown_common+0x168/0x1c0
+ do_fchownat+0xbc/0xf0
+ __x64_sys_fchownat+0x20/0x30
+ do_syscall_64+0x5f/0x220
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Passing fsdata parameter to .write_{begin,end} in f2fs_quota_write(),
+so that if quota file is compressed one, we can avoid above NULL
+pointer dereference when updating quota content.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 3669f060b6257..8deb0a260d928 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1929,6 +1929,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ int offset = off & (sb->s_blocksize - 1);
+ size_t towrite = len;
+ struct page *page;
++ void *fsdata = NULL;
+ char *kaddr;
+ int err = 0;
+ int tocopy;
+@@ -1938,7 +1939,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ towrite);
+ retry:
+ err = a_ops->write_begin(NULL, mapping, off, tocopy, 0,
+- &page, NULL);
++ &page, &fsdata);
+ if (unlikely(err)) {
+ if (err == -ENOMEM) {
+ congestion_wait(BLK_RW_ASYNC, HZ/50);
+@@ -1954,7 +1955,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ flush_dcache_page(page);
+
+ a_ops->write_end(NULL, mapping, off, tocopy, tocopy,
+- page, NULL);
++ page, fsdata);
+ offset = 0;
+ towrite -= tocopy;
+ off += tocopy;
+--
+2.20.1
+
--- /dev/null
+From 3b2769e4930a0ebc4c195f885305251b80943794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 11:18:07 +0800
+Subject: f2fs: fix potential .flags overflow on 32bit architecture
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 7653b9d87516ed65e112d2273c65eca6f97d0a27 ]
+
+f2fs_inode_info.flags is unsigned long variable, it has 32 bits
+in 32bit architecture, since we introduced FI_MMAP_FILE flag
+when we support data compression, we may access memory cross
+the border of .flags field, corrupting .i_sem field, result in
+below deadlock.
+
+To fix this issue, let's expand .flags as an array to grab enough
+space to store new flags.
+
+Call Trace:
+ __schedule+0x8d0/0x13fc
+ ? mark_held_locks+0xac/0x100
+ schedule+0xcc/0x260
+ rwsem_down_write_slowpath+0x3ab/0x65d
+ down_write+0xc7/0xe0
+ f2fs_drop_nlink+0x3d/0x600 [f2fs]
+ f2fs_delete_inline_entry+0x300/0x440 [f2fs]
+ f2fs_delete_entry+0x3a1/0x7f0 [f2fs]
+ f2fs_unlink+0x500/0x790 [f2fs]
+ vfs_unlink+0x211/0x490
+ do_unlinkat+0x483/0x520
+ sys_unlink+0x4a/0x70
+ do_fast_syscall_32+0x12b/0x683
+ entry_SYSENTER_32+0xaa/0x102
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Tested-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 99 ++++++++++++++++++++++++-------------------------
+ fs/f2fs/inode.c | 2 +-
+ 2 files changed, 50 insertions(+), 51 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 64caa46f0c8bd..71801a1709f0f 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -676,6 +676,44 @@ enum {
+ MAX_GC_FAILURE
+ };
+
++/* used for f2fs_inode_info->flags */
++enum {
++ FI_NEW_INODE, /* indicate newly allocated inode */
++ FI_DIRTY_INODE, /* indicate inode is dirty or not */
++ FI_AUTO_RECOVER, /* indicate inode is recoverable */
++ FI_DIRTY_DIR, /* indicate directory has dirty pages */
++ FI_INC_LINK, /* need to increment i_nlink */
++ FI_ACL_MODE, /* indicate acl mode */
++ FI_NO_ALLOC, /* should not allocate any blocks */
++ FI_FREE_NID, /* free allocated nide */
++ FI_NO_EXTENT, /* not to use the extent cache */
++ FI_INLINE_XATTR, /* used for inline xattr */
++ FI_INLINE_DATA, /* used for inline data*/
++ FI_INLINE_DENTRY, /* used for inline dentry */
++ FI_APPEND_WRITE, /* inode has appended data */
++ FI_UPDATE_WRITE, /* inode has in-place-update data */
++ FI_NEED_IPU, /* used for ipu per file */
++ FI_ATOMIC_FILE, /* indicate atomic file */
++ FI_ATOMIC_COMMIT, /* indicate the state of atomical committing */
++ FI_VOLATILE_FILE, /* indicate volatile file */
++ FI_FIRST_BLOCK_WRITTEN, /* indicate #0 data block was written */
++ FI_DROP_CACHE, /* drop dirty page cache */
++ FI_DATA_EXIST, /* indicate data exists */
++ FI_INLINE_DOTS, /* indicate inline dot dentries */
++ FI_DO_DEFRAG, /* indicate defragment is running */
++ FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */
++ FI_NO_PREALLOC, /* indicate skipped preallocated blocks */
++ FI_HOT_DATA, /* indicate file is hot */
++ FI_EXTRA_ATTR, /* indicate file has extra attribute */
++ FI_PROJ_INHERIT, /* indicate file inherits projectid */
++ FI_PIN_FILE, /* indicate file should not be gced */
++ FI_ATOMIC_REVOKE_REQUEST, /* request to drop atomic data */
++ FI_VERITY_IN_PROGRESS, /* building fs-verity Merkle tree */
++ FI_COMPRESSED_FILE, /* indicate file's data can be compressed */
++ FI_MMAP_FILE, /* indicate file was mmapped */
++ FI_MAX, /* max flag, never be used */
++};
++
+ struct f2fs_inode_info {
+ struct inode vfs_inode; /* serve a vfs inode */
+ unsigned long i_flags; /* keep an inode flags for ioctl */
+@@ -688,7 +726,7 @@ struct f2fs_inode_info {
+ umode_t i_acl_mode; /* keep file acl mode temporarily */
+
+ /* Use below internally in f2fs*/
+- unsigned long flags; /* use to pass per-file flags */
++ unsigned long flags[BITS_TO_LONGS(FI_MAX)]; /* use to pass per-file flags */
+ struct rw_semaphore i_sem; /* protect fi info */
+ atomic_t dirty_pages; /* # of dirty pages */
+ f2fs_hash_t chash; /* hash value of given file name */
+@@ -2498,43 +2536,6 @@ static inline __u32 f2fs_mask_flags(umode_t mode, __u32 flags)
+ return flags & F2FS_OTHER_FLMASK;
+ }
+
+-/* used for f2fs_inode_info->flags */
+-enum {
+- FI_NEW_INODE, /* indicate newly allocated inode */
+- FI_DIRTY_INODE, /* indicate inode is dirty or not */
+- FI_AUTO_RECOVER, /* indicate inode is recoverable */
+- FI_DIRTY_DIR, /* indicate directory has dirty pages */
+- FI_INC_LINK, /* need to increment i_nlink */
+- FI_ACL_MODE, /* indicate acl mode */
+- FI_NO_ALLOC, /* should not allocate any blocks */
+- FI_FREE_NID, /* free allocated nide */
+- FI_NO_EXTENT, /* not to use the extent cache */
+- FI_INLINE_XATTR, /* used for inline xattr */
+- FI_INLINE_DATA, /* used for inline data*/
+- FI_INLINE_DENTRY, /* used for inline dentry */
+- FI_APPEND_WRITE, /* inode has appended data */
+- FI_UPDATE_WRITE, /* inode has in-place-update data */
+- FI_NEED_IPU, /* used for ipu per file */
+- FI_ATOMIC_FILE, /* indicate atomic file */
+- FI_ATOMIC_COMMIT, /* indicate the state of atomical committing */
+- FI_VOLATILE_FILE, /* indicate volatile file */
+- FI_FIRST_BLOCK_WRITTEN, /* indicate #0 data block was written */
+- FI_DROP_CACHE, /* drop dirty page cache */
+- FI_DATA_EXIST, /* indicate data exists */
+- FI_INLINE_DOTS, /* indicate inline dot dentries */
+- FI_DO_DEFRAG, /* indicate defragment is running */
+- FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */
+- FI_NO_PREALLOC, /* indicate skipped preallocated blocks */
+- FI_HOT_DATA, /* indicate file is hot */
+- FI_EXTRA_ATTR, /* indicate file has extra attribute */
+- FI_PROJ_INHERIT, /* indicate file inherits projectid */
+- FI_PIN_FILE, /* indicate file should not be gced */
+- FI_ATOMIC_REVOKE_REQUEST, /* request to drop atomic data */
+- FI_VERITY_IN_PROGRESS, /* building fs-verity Merkle tree */
+- FI_COMPRESSED_FILE, /* indicate file's data can be compressed */
+- FI_MMAP_FILE, /* indicate file was mmapped */
+-};
+-
+ static inline void __mark_inode_dirty_flag(struct inode *inode,
+ int flag, bool set)
+ {
+@@ -2556,20 +2557,18 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,
+
+ static inline void set_inode_flag(struct inode *inode, int flag)
+ {
+- if (!test_bit(flag, &F2FS_I(inode)->flags))
+- set_bit(flag, &F2FS_I(inode)->flags);
++ test_and_set_bit(flag, F2FS_I(inode)->flags);
+ __mark_inode_dirty_flag(inode, flag, true);
+ }
+
+ static inline int is_inode_flag_set(struct inode *inode, int flag)
+ {
+- return test_bit(flag, &F2FS_I(inode)->flags);
++ return test_bit(flag, F2FS_I(inode)->flags);
+ }
+
+ static inline void clear_inode_flag(struct inode *inode, int flag)
+ {
+- if (test_bit(flag, &F2FS_I(inode)->flags))
+- clear_bit(flag, &F2FS_I(inode)->flags);
++ test_and_clear_bit(flag, F2FS_I(inode)->flags);
+ __mark_inode_dirty_flag(inode, flag, false);
+ }
+
+@@ -2660,19 +2659,19 @@ static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri)
+ struct f2fs_inode_info *fi = F2FS_I(inode);
+
+ if (ri->i_inline & F2FS_INLINE_XATTR)
+- set_bit(FI_INLINE_XATTR, &fi->flags);
++ set_bit(FI_INLINE_XATTR, fi->flags);
+ if (ri->i_inline & F2FS_INLINE_DATA)
+- set_bit(FI_INLINE_DATA, &fi->flags);
++ set_bit(FI_INLINE_DATA, fi->flags);
+ if (ri->i_inline & F2FS_INLINE_DENTRY)
+- set_bit(FI_INLINE_DENTRY, &fi->flags);
++ set_bit(FI_INLINE_DENTRY, fi->flags);
+ if (ri->i_inline & F2FS_DATA_EXIST)
+- set_bit(FI_DATA_EXIST, &fi->flags);
++ set_bit(FI_DATA_EXIST, fi->flags);
+ if (ri->i_inline & F2FS_INLINE_DOTS)
+- set_bit(FI_INLINE_DOTS, &fi->flags);
++ set_bit(FI_INLINE_DOTS, fi->flags);
+ if (ri->i_inline & F2FS_EXTRA_ATTR)
+- set_bit(FI_EXTRA_ATTR, &fi->flags);
++ set_bit(FI_EXTRA_ATTR, fi->flags);
+ if (ri->i_inline & F2FS_PIN_FILE)
+- set_bit(FI_PIN_FILE, &fi->flags);
++ set_bit(FI_PIN_FILE, fi->flags);
+ }
+
+ static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri)
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index 78c3f1d70f1dc..901e9f4ce12b5 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -345,7 +345,7 @@ static int do_read_inode(struct inode *inode)
+ fi->i_flags = le32_to_cpu(ri->i_flags);
+ if (S_ISREG(inode->i_mode))
+ fi->i_flags &= ~F2FS_PROJINHERIT_FL;
+- fi->flags = 0;
++ bitmap_zero(fi->flags, FI_MAX);
+ fi->i_advise = ri->i_advise;
+ fi->i_pino = le32_to_cpu(ri->i_pino);
+ fi->i_dir_level = ri->i_dir_level;
+--
+2.20.1
+
--- /dev/null
+From 310f693b9def7c94052404088ce829f7e2dc27c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2020 18:14:31 +0800
+Subject: f2fs: fix potential deadlock on compressed quota file
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 466357dc9b5ff555d16b7f9a0ff264eb9d5d908b ]
+
+generic/232 reports below deadlock:
+
+fsstress D 0 96980 96969 0x00084000
+Call Trace:
+ schedule+0x4a/0xb0
+ io_schedule+0x12/0x40
+ __lock_page+0x127/0x1d0
+ pagecache_get_page+0x1d8/0x250
+ prepare_compress_overwrite+0xe0/0x490 [f2fs]
+ f2fs_prepare_compress_overwrite+0x5d/0x80 [f2fs]
+ f2fs_write_begin+0x833/0xb90 [f2fs]
+ f2fs_quota_write+0x145/0x1e0 [f2fs]
+ write_blk+0x36/0x80 [quota_tree]
+ do_insert_tree+0x2ac/0x4a0 [quota_tree]
+ do_insert_tree+0x26e/0x4a0 [quota_tree]
+ qtree_write_dquot+0x70/0x190 [quota_tree]
+ v2_write_dquot+0x43/0x90 [quota_v2]
+ dquot_acquire+0x77/0x100
+ f2fs_dquot_acquire+0x2f/0x60 [f2fs]
+ dqget+0x310/0x450
+ dquot_transfer+0xb2/0x120
+ f2fs_setattr+0x11a/0x4a0 [f2fs]
+ notify_change+0x349/0x480
+ chown_common+0x168/0x1c0
+ do_fchownat+0xbc/0xf0
+ __x64_sys_lchown+0x21/0x30
+ do_syscall_64+0x5f/0x220
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ task PC stack pid father
+kworker/u256:0 D 0 103444 2 0x80084000
+Workqueue: writeback wb_workfn (flush-251:1)
+Call Trace:
+ schedule+0x4a/0xb0
+ schedule_timeout+0x15e/0x2f0
+ io_schedule_timeout+0x19/0x40
+ congestion_wait+0x7e/0x120
+ f2fs_write_multi_pages+0x12a/0x840 [f2fs]
+ f2fs_write_cache_pages+0x48f/0x790 [f2fs]
+ f2fs_write_data_pages+0x2db/0x330 [f2fs]
+ do_writepages+0x1a/0x60
+ __writeback_single_inode+0x3d/0x340
+ writeback_sb_inodes+0x225/0x4a0
+ wb_writeback+0xf7/0x320
+ wb_workfn+0xba/0x470
+ process_one_work+0x16c/0x3f0
+ worker_thread+0x4c/0x440
+ kthread+0xf8/0x130
+ ret_from_fork+0x35/0x40
+
+fsstress D 0 5277 5266 0x00084000
+Call Trace:
+ schedule+0x4a/0xb0
+ rwsem_down_write_slowpath+0x29d/0x540
+ block_operations+0x105/0x360 [f2fs]
+ f2fs_write_checkpoint+0x101/0x1010 [f2fs]
+ f2fs_sync_fs+0xa8/0x130 [f2fs]
+ f2fs_do_sync_file+0x1ad/0x890 [f2fs]
+ do_fsync+0x38/0x60
+ __x64_sys_fdatasync+0x13/0x20
+ do_syscall_64+0x5f/0x220
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+The root cause is there is potential deadlock between quota data
+update and writeback.
+
+Kworker Thread B Thread C
+- f2fs_write_cache_pages
+ - lock whole cluster --- A
+ - f2fs_write_multi_pages
+ - f2fs_write_raw_pages
+ - f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+ - f2fs_setattr
+ - f2fs_lock_op --- B
+ - f2fs_write_checkpoint
+ - block_operations
+ - f2fs_lock_all --- B
+ - dquot_transfer
+ - f2fs_quota_write
+ - f2fs_prepare_compress_overwrite
+ - pagecache_get_page --- A
+ - f2fs_trylock_op failed --- B
+ - congestion_wait
+ - goto rewrite
+
+To fix this issue, during quota file writeback, just redirty all pages
+left in cluster rather holding pages' lock in cluster and looping retrying
+lock cp_rwsem.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index eb84c13c1182c..ad8e25a1fbc26 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -988,6 +988,15 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ unlock_page(cc->rpages[i]);
+ ret = 0;
+ } else if (ret == -EAGAIN) {
++ /*
++ * for quota file, just redirty left pages to
++ * avoid deadlock caused by cluster update race
++ * from foreground operation.
++ */
++ if (IS_NOQUOTA(cc->inode)) {
++ err = 0;
++ goto out_err;
++ }
+ ret = 0;
+ cond_resched();
+ congestion_wait(BLK_RW_ASYNC, HZ/50);
+@@ -996,16 +1005,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ goto retry_write;
+ }
+ err = ret;
+- goto out_fail;
++ goto out_err;
+ }
+
+ *submitted += _submitted;
+ }
+ return 0;
+-
+-out_fail:
+- /* TODO: revoke partially updated block addresses */
+- BUG_ON(compr_blocks);
+ out_err:
+ for (++i; i < cc->cluster_size; i++) {
+ if (!cc->rpages[i])
+--
+2.20.1
+
--- /dev/null
+From e1233817c8379fc55d545a79d64a2913a2c14285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Feb 2020 09:19:07 +0530
+Subject: f2fs: fix the panic in do_checkpoint()
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit bf22c3cc8ce71454dddd772284773306a68031d8 ]
+
+There could be a scenario where f2fs_sync_meta_pages() will not
+ensure that all F2FS_DIRTY_META pages are submitted for IO. Thus,
+resulting in the below panic in do_checkpoint() -
+
+f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) &&
+ !f2fs_cp_error(sbi));
+
+This can happen in a low-memory condition, where shrinker could
+also be doing the writepage operation (stack shown below)
+at the same time when checkpoint is running on another core.
+
+schedule
+down_write
+f2fs_submit_page_write -> by this time, this page in page cache is tagged
+ as PAGECACHE_TAG_WRITEBACK and PAGECACHE_TAG_DIRTY
+ is cleared, due to which f2fs_sync_meta_pages()
+ cannot sync this page in do_checkpoint() path.
+f2fs_do_write_meta_page
+__f2fs_write_meta_page
+f2fs_write_meta_page
+shrink_page_list
+shrink_inactive_list
+shrink_node_memcg
+shrink_node
+kswapd
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/checkpoint.c | 16 +++++++---------
+ fs/f2fs/f2fs.h | 2 +-
+ fs/f2fs/super.c | 2 +-
+ 3 files changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index 44e84ac5c9411..9c88fb3d255a2 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -1250,20 +1250,20 @@ static void unblock_operations(struct f2fs_sb_info *sbi)
+ f2fs_unlock_all(sbi);
+ }
+
+-void f2fs_wait_on_all_pages_writeback(struct f2fs_sb_info *sbi)
++void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type)
+ {
+ DEFINE_WAIT(wait);
+
+ for (;;) {
+ prepare_to_wait(&sbi->cp_wait, &wait, TASK_UNINTERRUPTIBLE);
+
+- if (!get_pages(sbi, F2FS_WB_CP_DATA))
++ if (!get_pages(sbi, type))
+ break;
+
+ if (unlikely(f2fs_cp_error(sbi)))
+ break;
+
+- io_schedule_timeout(5*HZ);
++ io_schedule_timeout(HZ/50);
+ }
+ finish_wait(&sbi->cp_wait, &wait);
+ }
+@@ -1384,8 +1384,6 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
+
+ /* Flush all the NAT/SIT pages */
+ f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_CP_META_IO);
+- f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) &&
+- !f2fs_cp_error(sbi));
+
+ /*
+ * modify checkpoint
+@@ -1493,11 +1491,11 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
+
+ /* Here, we have one bio having CP pack except cp pack 2 page */
+ f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_CP_META_IO);
+- f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) &&
+- !f2fs_cp_error(sbi));
++ /* Wait for all dirty meta pages to be submitted for IO */
++ f2fs_wait_on_all_pages(sbi, F2FS_DIRTY_META);
+
+ /* wait for previous submitted meta pages writeback */
+- f2fs_wait_on_all_pages_writeback(sbi);
++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA);
+
+ /* flush all device cache */
+ err = f2fs_flush_device_cache(sbi);
+@@ -1506,7 +1504,7 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
+
+ /* barrier and flush checkpoint cp pack 2 page if it can */
+ commit_checkpoint(sbi, ckpt, start_blk);
+- f2fs_wait_on_all_pages_writeback(sbi);
++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA);
+
+ /*
+ * invalidate intermediate page cache borrowed from meta inode which are
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 5355be6b6755c..d39f5de114208 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3308,7 +3308,7 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi);
+ void f2fs_update_dirty_page(struct inode *inode, struct page *page);
+ void f2fs_remove_dirty_inode(struct inode *inode);
+ int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type);
+-void f2fs_wait_on_all_pages_writeback(struct f2fs_sb_info *sbi);
++void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type);
+ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc);
+ void f2fs_init_ino_entry_info(struct f2fs_sb_info *sbi);
+ int __init f2fs_create_checkpoint_caches(void);
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 65a7a432dfee2..686f5402660ed 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1172,7 +1172,7 @@ static void f2fs_put_super(struct super_block *sb)
+ /* our cp_error case, we can wait for any writeback page */
+ f2fs_flush_merged_writes(sbi);
+
+- f2fs_wait_on_all_pages_writeback(sbi);
++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA);
+
+ f2fs_bug_on(sbi, sbi->fsync_node_num);
+
+--
+2.20.1
+
--- /dev/null
+From f84b1177fc36f5fea4cddc6830816f166b4c0fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 10:45:29 +0800
+Subject: f2fs: fix to account compressed blocks in f2fs_compressed_blocks()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 1a67cbe141cf991af252a88143d0fd975be2d9e7 ]
+
+por_fsstress reports inconsistent status in orphan inode, the root cause
+of this is in f2fs_write_raw_pages() we decrease i_compr_blocks incorrectly
+due to wrong calculation in f2fs_compressed_blocks().
+
+So this patch exposes below two functions based on __f2fs_cluster_blocks:
+- f2fs_compressed_blocks: get count of compressed blocks in compressed cluster
+- f2fs_cluster_blocks: get count of valid blocks (including reserved blocks)
+in compressed cluster.
+
+Then use f2fs_compress_blocks() to get correct compressed blocks count in
+f2fs_write_raw_pages().
+
+sanity_check_inode: inode (ino=ad80) hash inconsistent i_compr_blocks:2, i_blocks:1, run fsck to fix
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 28 ++++++++++++++++++++++------
+ 1 file changed, 22 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index ad8e25a1fbc26..11b13b881ada5 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -536,8 +536,7 @@ static bool __cluster_may_compress(struct compress_ctx *cc)
+ return true;
+ }
+
+-/* return # of compressed block addresses */
+-static int f2fs_compressed_blocks(struct compress_ctx *cc)
++static int __f2fs_cluster_blocks(struct compress_ctx *cc, bool compr)
+ {
+ struct dnode_of_data dn;
+ int ret;
+@@ -560,8 +559,13 @@ static int f2fs_compressed_blocks(struct compress_ctx *cc)
+
+ blkaddr = datablock_addr(dn.inode,
+ dn.node_page, dn.ofs_in_node + i);
+- if (blkaddr != NULL_ADDR)
+- ret++;
++ if (compr) {
++ if (__is_valid_data_blkaddr(blkaddr))
++ ret++;
++ } else {
++ if (blkaddr != NULL_ADDR)
++ ret++;
++ }
+ }
+ }
+ fail:
+@@ -569,6 +573,18 @@ static int f2fs_compressed_blocks(struct compress_ctx *cc)
+ return ret;
+ }
+
++/* return # of compressed blocks in compressed cluster */
++static int f2fs_compressed_blocks(struct compress_ctx *cc)
++{
++ return __f2fs_cluster_blocks(cc, true);
++}
++
++/* return # of valid blocks in compressed cluster */
++static int f2fs_cluster_blocks(struct compress_ctx *cc, bool compr)
++{
++ return __f2fs_cluster_blocks(cc, false);
++}
++
+ int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index)
+ {
+ struct compress_ctx cc = {
+@@ -578,7 +594,7 @@ int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index)
+ .cluster_idx = index >> F2FS_I(inode)->i_log_cluster_size,
+ };
+
+- return f2fs_compressed_blocks(&cc);
++ return f2fs_cluster_blocks(&cc, false);
+ }
+
+ static bool cluster_may_compress(struct compress_ctx *cc)
+@@ -627,7 +643,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc,
+ bool prealloc;
+
+ retry:
+- ret = f2fs_compressed_blocks(cc);
++ ret = f2fs_cluster_blocks(cc, false);
+ if (ret <= 0)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 10abb1cc9256b38c7a968be92eaf93ceb40b870c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2020 19:20:16 +0800
+Subject: f2fs: fix to avoid potential deadlock
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit df77fbd8c5b222c680444801ffd20e8bbc90a56e ]
+
+Using f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential
+deadlock like we did in f2fs_write_single_data_page().
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index d8a64be90a501..c847523ab4a2e 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -772,7 +772,6 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ .encrypted_page = NULL,
+ .compressed_page = NULL,
+ .submitted = false,
+- .need_lock = LOCK_RETRY,
+ .io_type = io_type,
+ .io_wbc = wbc,
+ .encrypted = f2fs_encrypted_file(cc->inode),
+@@ -785,9 +784,10 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ loff_t psize;
+ int i, err;
+
+- set_new_dnode(&dn, cc->inode, NULL, NULL, 0);
++ if (!f2fs_trylock_op(sbi))
++ return -EAGAIN;
+
+- f2fs_lock_op(sbi);
++ set_new_dnode(&dn, cc->inode, NULL, NULL, 0);
+
+ err = f2fs_get_dnode_of_data(&dn, start_idx, LOOKUP_NODE);
+ if (err)
+--
+2.20.1
+
--- /dev/null
+From cf5bff02dc4bef560b6b7cc347fc841b4f2b94b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2020 18:08:46 +0800
+Subject: f2fs: fix to avoid use-after-free in f2fs_write_multi_pages()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 95978caa138948054e06d00bfc3432b518699f1b ]
+
+In compress cluster, if physical block number is less than logic
+page number, race condition will cause use-after-free issue as
+described below:
+
+- f2fs_write_compressed_pages
+ - fio.page = cic->rpages[0];
+ - f2fs_outplace_write_data
+ - f2fs_compress_write_end_io
+ - kfree(cic->rpages);
+ - kfree(cic);
+ - fio.page = cic->rpages[1];
+
+f2fs_write_multi_pages+0xfd0/0x1a98
+f2fs_write_data_pages+0x74c/0xb5c
+do_writepages+0x64/0x108
+__writeback_single_inode+0xdc/0x4b8
+writeback_sb_inodes+0x4d0/0xa68
+__writeback_inodes_wb+0x88/0x178
+wb_writeback+0x1f0/0x424
+wb_workfn+0x2f4/0x574
+process_one_work+0x210/0x48c
+worker_thread+0x2e8/0x44c
+kthread+0x110/0x120
+ret_from_fork+0x10/0x18
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index c847523ab4a2e..927db1205bd81 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -845,7 +845,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+
+ blkaddr = datablock_addr(dn.inode, dn.node_page,
+ dn.ofs_in_node);
+- fio.page = cic->rpages[i];
++ fio.page = cc->rpages[i];
+ fio.old_blkaddr = blkaddr;
+
+ /* cluster header */
+--
+2.20.1
+
--- /dev/null
+From 8c6e05e0ce92fb5c817e177cf9ca2327164153f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 17:45:11 +0800
+Subject: f2fs: fix to show norecovery mount option
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit a9117eca1de6b738e713d2142126db2cfbf6fb36 ]
+
+Previously, 'norecovery' mount option will be shown as
+'disable_roll_forward', fix to show original option name correctly.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 1 +
+ fs/f2fs/super.c | 7 +++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index d39f5de114208..64caa46f0c8bd 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -100,6 +100,7 @@ extern const char *f2fs_fault_name[FAULT_MAX];
+ #define F2FS_MOUNT_INLINE_XATTR_SIZE 0x00800000
+ #define F2FS_MOUNT_RESERVE_ROOT 0x01000000
+ #define F2FS_MOUNT_DISABLE_CHECKPOINT 0x02000000
++#define F2FS_MOUNT_NORECOVERY 0x04000000
+
+ #define F2FS_OPTION(sbi) ((sbi)->mount_opt)
+ #define clear_opt(sbi, option) (F2FS_OPTION(sbi).opt &= ~F2FS_MOUNT_##option)
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 686f5402660ed..3669f060b6257 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -446,7 +446,7 @@ static int parse_options(struct super_block *sb, char *options)
+ break;
+ case Opt_norecovery:
+ /* this option mounts f2fs with ro */
+- set_opt(sbi, DISABLE_ROLL_FORWARD);
++ set_opt(sbi, NORECOVERY);
+ if (!f2fs_readonly(sb))
+ return -EINVAL;
+ break;
+@@ -1446,6 +1446,8 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root)
+ }
+ if (test_opt(sbi, DISABLE_ROLL_FORWARD))
+ seq_puts(seq, ",disable_roll_forward");
++ if (test_opt(sbi, NORECOVERY))
++ seq_puts(seq, ",norecovery");
+ if (test_opt(sbi, DISCARD))
+ seq_puts(seq, ",discard");
+ else
+@@ -3598,7 +3600,8 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent)
+ goto reset_checkpoint;
+
+ /* recover fsynced data */
+- if (!test_opt(sbi, DISABLE_ROLL_FORWARD)) {
++ if (!test_opt(sbi, DISABLE_ROLL_FORWARD) &&
++ !test_opt(sbi, NORECOVERY)) {
+ /*
+ * mount should be failed, when device has readonly mode, and
+ * previous checkpoint was not done by clean system shutdown.
+--
+2.20.1
+
--- /dev/null
+From 63e8d996a7eada2d6f1272a087be48ed78242d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 20:09:25 +0800
+Subject: f2fs: fix to update f2fs_super_block fields under sb_lock
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit a4ba5dfc5c88e49bb03385abfdd28c5a0acfbb54 ]
+
+Fields in struct f2fs_super_block should be updated under coverage
+of sb_lock, fix to adjust update_sb_metadata() for that rule.
+
+Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index db8725d473b52..9cff2502e3bc6 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1434,12 +1434,19 @@ static int free_segment_range(struct f2fs_sb_info *sbi, unsigned int start,
+ static void update_sb_metadata(struct f2fs_sb_info *sbi, int secs)
+ {
+ struct f2fs_super_block *raw_sb = F2FS_RAW_SUPER(sbi);
+- int section_count = le32_to_cpu(raw_sb->section_count);
+- int segment_count = le32_to_cpu(raw_sb->segment_count);
+- int segment_count_main = le32_to_cpu(raw_sb->segment_count_main);
+- long long block_count = le64_to_cpu(raw_sb->block_count);
++ int section_count;
++ int segment_count;
++ int segment_count_main;
++ long long block_count;
+ int segs = secs * sbi->segs_per_sec;
+
++ down_write(&sbi->sb_lock);
++
++ section_count = le32_to_cpu(raw_sb->section_count);
++ segment_count = le32_to_cpu(raw_sb->segment_count);
++ segment_count_main = le32_to_cpu(raw_sb->segment_count_main);
++ block_count = le64_to_cpu(raw_sb->block_count);
++
+ raw_sb->section_count = cpu_to_le32(section_count + secs);
+ raw_sb->segment_count = cpu_to_le32(segment_count + segs);
+ raw_sb->segment_count_main = cpu_to_le32(segment_count_main + segs);
+@@ -1453,6 +1460,8 @@ static void update_sb_metadata(struct f2fs_sb_info *sbi, int secs)
+ raw_sb->devs[last_dev].total_segments =
+ cpu_to_le32(dev_segs + segs);
+ }
++
++ up_write(&sbi->sb_lock);
+ }
+
+ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs)
+--
+2.20.1
+
--- /dev/null
+From c5432f9f90f2fa52e573d9d4a5d84ccb2159dde3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 17:45:12 +0800
+Subject: f2fs: fix to wait all node page writeback
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit dc5a941223edd803f476a153abd950cc3a83c3e1 ]
+
+There is a race condition that we may miss to wait for all node pages
+writeback, fix it.
+
+- fsync() - shrink
+ - f2fs_do_sync_file
+ - __write_node_page
+ - set_page_writeback(page#0)
+ : remove DIRTY/TOWRITE flag
+ - f2fs_fsync_node_pages
+ : won't find page #0 as TOWRITE flag was removeD
+ - f2fs_wait_on_node_pages_writeback
+ : wont' wait page #0 writeback as it was not in fsync_node_list list.
+ - f2fs_add_fsync_node_entry
+
+Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 9d02cdcdbb073..e58c4c6288346 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1562,15 +1562,16 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ if (atomic && !test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+
+- set_page_writeback(page);
+- ClearPageError(page);
+-
++ /* should add to global list before clearing PAGECACHE status */
+ if (f2fs_in_warm_node_list(sbi, page)) {
+ seq = f2fs_add_fsync_node_entry(sbi, page);
+ if (seq_id)
+ *seq_id = seq;
+ }
+
++ set_page_writeback(page);
++ ClearPageError(page);
++
+ fio.old_blkaddr = ni.blk_addr;
+ f2fs_do_write_node_page(nid, &fio);
+ set_node_addr(sbi, &ni, fio.new_blkaddr, is_fsync_dnode(page));
+--
+2.20.1
+
--- /dev/null
+From 4c8bafa1f14a19ebbbaeef9f5aaaefd9f9b938a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Mar 2020 15:20:26 -0800
+Subject: f2fs: fix wrong check on F2FS_IOC_FSSETXATTR
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 99eabb914e0f870445d065e83e857507f9728a33 ]
+
+This fixes the incorrect failure when enabling project quota on casefold-enabled
+file.
+
+Cc: Daniel Rosenberg <drosen@google.com>
+Cc: kernel-team@android.com
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 0d4da644df3bc..a41c633ac6cfe 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1787,12 +1787,15 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)
+ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
+ {
+ struct f2fs_inode_info *fi = F2FS_I(inode);
++ u32 masked_flags = fi->i_flags & mask;
++
++ f2fs_bug_on(F2FS_I_SB(inode), (iflags & ~mask));
+
+ /* Is it quota file? Do not allow user to mess with it */
+ if (IS_NOQUOTA(inode))
+ return -EPERM;
+
+- if ((iflags ^ fi->i_flags) & F2FS_CASEFOLD_FL) {
++ if ((iflags ^ masked_flags) & F2FS_CASEFOLD_FL) {
+ if (!f2fs_sb_has_casefold(F2FS_I_SB(inode)))
+ return -EOPNOTSUPP;
+ if (!f2fs_empty_dir(inode))
+@@ -1806,9 +1809,9 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
+ return -EINVAL;
+ }
+
+- if ((iflags ^ fi->i_flags) & F2FS_COMPR_FL) {
++ if ((iflags ^ masked_flags) & F2FS_COMPR_FL) {
+ if (S_ISREG(inode->i_mode) &&
+- (fi->i_flags & F2FS_COMPR_FL || i_size_read(inode) ||
++ (masked_flags & F2FS_COMPR_FL || i_size_read(inode) ||
+ F2FS_HAS_BLOCKS(inode)))
+ return -EINVAL;
+ if (iflags & F2FS_NOCOMP_FL)
+@@ -1825,8 +1828,8 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
+ set_compress_context(inode);
+ }
+ }
+- if ((iflags ^ fi->i_flags) & F2FS_NOCOMP_FL) {
+- if (fi->i_flags & F2FS_COMPR_FL)
++ if ((iflags ^ masked_flags) & F2FS_NOCOMP_FL) {
++ if (masked_flags & F2FS_COMPR_FL)
+ return -EINVAL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 82e617c6cf65afb618cc96a4c37db23b83c0b389 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Feb 2020 13:23:28 -0800
+Subject: f2fs: skip GC when section is full
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 2bac07635ddf9ed59268e61e415d8de9c5eaded7 ]
+
+This fixes skipping GC when segment is full in large section.
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 2f645c591a000..3cced15efebc2 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1018,8 +1018,8 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
+ * race condition along with SSR block allocation.
+ */
+ if ((gc_type == BG_GC && has_not_enough_free_secs(sbi, 0, 0)) ||
+- get_valid_blocks(sbi, segno, false) ==
+- sbi->blocks_per_seg)
++ get_valid_blocks(sbi, segno, true) ==
++ BLKS_PER_SEC(sbi))
+ return submitted;
+
+ if (check_valid_map(sbi, segno, off) == 0)
+--
+2.20.1
+
--- /dev/null
+From bcc8a109c6cb36e6e20d66043fc41131d54ae9a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:47:09 -0600
+Subject: gfs2: clear ail1 list when gfs2 withdraws
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit 30fe70a85a909a23dcbc2c628ca6655b2c85e7a1 ]
+
+This patch fixes a bug in which function gfs2_log_flush can get into
+an infinite loop when a gfs2 file system is withdrawn. The problem
+is the infinite loop "for (;;)" in gfs2_log_flush which would never
+finish because the io error and subsequent withdraw prevented the
+items from being taken off the ail list.
+
+This patch tries to clean up the mess by allowing withdraw situations
+to move not-in-flight buffer_heads to the ail2 list, where they will
+be dealt with later.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/log.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
+index 08dd6a4302344..60d911e293e68 100644
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -104,16 +104,22 @@ __acquires(&sdp->sd_ail_lock)
+ gfs2_assert(sdp, bd->bd_tr == tr);
+
+ if (!buffer_busy(bh)) {
+- if (!buffer_uptodate(bh) &&
+- !test_and_set_bit(SDF_AIL1_IO_ERROR,
++ if (buffer_uptodate(bh)) {
++ list_move(&bd->bd_ail_st_list,
++ &tr->tr_ail2_list);
++ continue;
++ }
++ if (!test_and_set_bit(SDF_AIL1_IO_ERROR,
+ &sdp->sd_flags)) {
+ gfs2_io_error_bh(sdp, bh);
+ *withdraw = true;
+ }
+- list_move(&bd->bd_ail_st_list, &tr->tr_ail2_list);
+- continue;
+ }
+
++ if (gfs2_withdrawn(sdp)) {
++ gfs2_remove_from_ail(bd);
++ continue;
++ }
+ if (!buffer_dirty(bh))
+ continue;
+ if (gl == bd->bd_gl)
+@@ -862,6 +868,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
+ if (gfs2_ail1_empty(sdp))
+ break;
+ }
++ if (gfs2_withdrawn(sdp))
++ goto out;
+ atomic_dec(&sdp->sd_log_blks_free); /* Adjust for unreserved buffer */
+ trace_gfs2_log_blocks(sdp, -1);
+ log_write_header(sdp, flags);
+@@ -874,6 +882,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
+ atomic_set(&sdp->sd_freeze_state, SFS_FROZEN);
+ }
+
++out:
+ trace_gfs2_log_flush(sdp, 0, flags);
+ up_write(&sdp->sd_log_flush_lock);
+
+--
+2.20.1
+
--- /dev/null
+From 3e37e37d0b8657b7905c2a13362bbbb14de72e8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 08:22:15 -0700
+Subject: hibernate: Allow uswsusp to write to swap
+
+From: Domenico Andreoli <domenico.andreoli@linux.com>
+
+[ Upstream commit 56939e014a6c212b317414faa307029e2e80c3b9 ]
+
+It turns out that there is one use case for programs being able to
+write to swap devices, and that is the userspace hibernation code.
+
+Quick fix: disable the S_SWAPFILE check if hibernation is configured.
+
+Fixes: dc617f29dbe5 ("vfs: don't allow writes to swap files")
+Reported-by: Domenico Andreoli <domenico.andreoli@linux.com>
+Reported-by: Marian Klein <mkleinsoft@gmail.com>
+Signed-off-by: Domenico Andreoli <domenico.andreoli@linux.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/block_dev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 69bf2fb6f7cda..84fe0162ff13e 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -34,6 +34,7 @@
+ #include <linux/task_io_accounting_ops.h>
+ #include <linux/falloc.h>
+ #include <linux/uaccess.h>
++#include <linux/suspend.h>
+ #include "internal.h"
+
+ struct bdev_inode {
+@@ -2001,7 +2002,8 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ if (bdev_read_only(I_BDEV(bd_inode)))
+ return -EPERM;
+
+- if (IS_SWAPFILE(bd_inode))
++ /* uswsusp needs write permission to the swap */
++ if (IS_SWAPFILE(bd_inode) && !hibernation_available())
+ return -ETXTBSY;
+
+ if (!iov_iter_count(from))
+--
+2.20.1
+
--- /dev/null
+From 7fc57824335df6d9b2d5672fd29db07cd08cf6ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 20:08:43 -0700
+Subject: include/linux/swapops.h: correct guards for non_swap_entry()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit 3f3673d7d324d872d9d8ddb73b3e5e47fbf12e0d ]
+
+If CONFIG_DEVICE_PRIVATE is defined, but neither CONFIG_MEMORY_FAILURE nor
+CONFIG_MIGRATION, then non_swap_entry() will return 0, meaning that the
+condition (non_swap_entry(entry) && is_device_private_entry(entry)) in
+zap_pte_range() will never be true even if the entry is a device private
+one.
+
+Equally any other code depending on non_swap_entry() will not function as
+expected.
+
+I originally spotted this just by looking at the code, I haven't actually
+observed any problems.
+
+Looking a bit more closely it appears that actually this situation
+(currently at least) cannot occur:
+
+DEVICE_PRIVATE depends on ZONE_DEVICE
+ZONE_DEVICE depends on MEMORY_HOTREMOVE
+MEMORY_HOTREMOVE depends on MIGRATION
+
+Fixes: 5042db43cc26 ("mm/ZONE_DEVICE: new type of ZONE_DEVICE for unaddressable memory")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Jérôme Glisse <jglisse@redhat.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: John Hubbard <jhubbard@nvidia.com>
+Link: http://lkml.kernel.org/r/20200305130550.22693-1-steven.price@arm.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swapops.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/swapops.h b/include/linux/swapops.h
+index 877fd239b6fff..3208a520d0be3 100644
+--- a/include/linux/swapops.h
++++ b/include/linux/swapops.h
+@@ -348,7 +348,8 @@ static inline void num_poisoned_pages_inc(void)
+ }
+ #endif
+
+-#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION)
++#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION) || \
++ defined(CONFIG_DEVICE_PRIVATE)
+ static inline int non_swap_entry(swp_entry_t entry)
+ {
+ return swp_type(entry) >= MAX_SWAPFILES;
+--
+2.20.1
+
--- /dev/null
+From 16302da3a8c8fda2827597c8d88dedb0b95daca4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 18:44:51 +0800
+Subject: iommu/amd: Fix the configuration of GCR3 table root pointer
+
+From: Adrian Huang <ahuang12@lenovo.com>
+
+[ Upstream commit c20f36534666e37858a14e591114d93cc1be0d34 ]
+
+The SPA of the GCR3 table root pointer[51:31] masks 20 bits. However,
+this requires 21 bits (Please see the AMD IOMMU specification).
+This leads to the potential failure when the bit 51 of SPA of
+the GCR3 table root pointer is 1'.
+
+Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
+Fixes: 52815b75682e2 ("iommu/amd: Add support for IOMMUv2 domain mode")
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_types.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index f8d01d6b00da7..ca8c4522045b3 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -348,7 +348,7 @@
+
+ #define DTE_GCR3_VAL_A(x) (((x) >> 12) & 0x00007ULL)
+ #define DTE_GCR3_VAL_B(x) (((x) >> 15) & 0x0ffffULL)
+-#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0xfffffULL)
++#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0x1fffffULL)
+
+ #define DTE_GCR3_INDEX_A 0
+ #define DTE_GCR3_INDEX_B 1
+--
+2.20.1
+
--- /dev/null
+From 046b899467692ad67de9206ddcc9817b30298821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 10:35:57 +0100
+Subject: iommu/virtio: Fix freeing of incomplete domains
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 7062af3ed2ba451029e3733d9f677c68f5ea9e77 ]
+
+Calling viommu_domain_free() on a domain that hasn't been finalised (not
+attached to any device, for example) can currently cause an Oops,
+because we attempt to call ida_free() on ID 0, which may either be
+unallocated or used by another domain.
+
+Only initialise the vdomain->viommu pointer, which denotes a finalised
+domain, at the end of a successful viommu_domain_finalise().
+
+Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver")
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/20200326093558.2641019-3-jean-philippe@linaro.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/virtio-iommu.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
+index cce329d71fbad..5eed75cd121f1 100644
+--- a/drivers/iommu/virtio-iommu.c
++++ b/drivers/iommu/virtio-iommu.c
+@@ -613,18 +613,20 @@ static int viommu_domain_finalise(struct viommu_dev *viommu,
+ int ret;
+ struct viommu_domain *vdomain = to_viommu_domain(domain);
+
+- vdomain->viommu = viommu;
+- vdomain->map_flags = viommu->map_flags;
++ ret = ida_alloc_range(&viommu->domain_ids, viommu->first_domain,
++ viommu->last_domain, GFP_KERNEL);
++ if (ret < 0)
++ return ret;
++
++ vdomain->id = (unsigned int)ret;
+
+ domain->pgsize_bitmap = viommu->pgsize_bitmap;
+ domain->geometry = viommu->geometry;
+
+- ret = ida_alloc_range(&viommu->domain_ids, viommu->first_domain,
+- viommu->last_domain, GFP_KERNEL);
+- if (ret >= 0)
+- vdomain->id = (unsigned int)ret;
++ vdomain->map_flags = viommu->map_flags;
++ vdomain->viommu = viommu;
+
+- return ret > 0 ? 0 : ret;
++ return 0;
+ }
+
+ static void viommu_domain_free(struct iommu_domain *domain)
+--
+2.20.1
+
--- /dev/null
+From aa610fd9b90f29eb87346efc7f7302694f6ac462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2020 21:32:31 -0700
+Subject: iommu/vt-d: Add build dependency on IOASID
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 4a663dae47316ae8b97d5b77025fe7dfd9d3487f ]
+
+IOASID code is needed by VT-d scalable mode for PASID allocation.
+Add explicit dependency such that IOASID is built-in whenever Intel
+IOMMU is enabled.
+Otherwise, aux domain code will fail when IOMMU is built-in and IOASID
+is compiled as a module.
+
+Fixes: 59a623374dc38 ("iommu/vt-d: Replace Intel specific PASID allocator with IOASID")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
+index d2fade9849997..25149544d57c9 100644
+--- a/drivers/iommu/Kconfig
++++ b/drivers/iommu/Kconfig
+@@ -188,6 +188,7 @@ config INTEL_IOMMU
+ select NEED_DMA_MAP_STATE
+ select DMAR_TABLE
+ select SWIOTLB
++ select IOASID
+ help
+ DMA remapping (DMAR) devices support enables independent address
+ translations for Direct Memory Access (DMA) from devices.
+--
+2.20.1
+
--- /dev/null
+From 9bc47c3557d907cefae8fe6bc011112b328a6f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2020 21:32:30 -0700
+Subject: iommu/vt-d: Fix mm reference leak
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 902baf61adf6b187f0a6b789e70d788ea71ff5bc ]
+
+Move canonical address check before mmget_not_zero() to avoid mm
+reference leak.
+
+Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if address is canonical.")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index d7f2a53589002..fc7d78876e021 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -611,14 +611,15 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ * any faults on kernel addresses. */
+ if (!svm->mm)
+ goto bad_req;
+- /* If the mm is already defunct, don't handle faults. */
+- if (!mmget_not_zero(svm->mm))
+- goto bad_req;
+
+ /* If address is not canonical, return invalid response */
+ if (!is_canonical_address(address))
+ goto bad_req;
+
++ /* If the mm is already defunct, don't handle faults. */
++ if (!mmget_not_zero(svm->mm))
++ goto bad_req;
++
+ down_read(&svm->mm->mmap_sem);
+ vma = find_extend_vma(svm->mm, address);
+ if (!vma || address < vma->vm_start)
+--
+2.20.1
+
--- /dev/null
+From 52f502a3fb169f028fcfbbf8c8a15c3e375229ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2020 09:10:18 +0800
+Subject: iommu/vt-d: Fix page request descriptor size
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 52355fb1919ef7ed9a38e0f3de6e928de1f57217 ]
+
+Intel VT-d might support PRS (Page Reqest Support) when it's
+running in the scalable mode. Each page request descriptor
+occupies 32 bytes and is 32-bytes aligned. The page request
+descriptor offset mask should be 32-bytes aligned.
+
+Fixes: 5b438f4ba315d ("iommu/vt-d: Support page request in scalable mode")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index fc7d78876e021..2998418f0a383 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -531,7 +531,7 @@ struct page_req_dsc {
+ u64 priv_data[2];
+ };
+
+-#define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x10)
++#define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x20)
+
+ static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req)
+ {
+--
+2.20.1
+
--- /dev/null
+From a36363f6d8deb3c1f3d41daa3eccdefc2204fa8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2020 11:03:26 -0400
+Subject: iommu/vt-d: Silence RCU-list debugging warning in dmar_find_atsr()
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit c6f4ebdeba4cff590594df931ff1ee610c426431 ]
+
+dmar_find_atsr() calls list_for_each_entry_rcu() outside of an RCU read
+side critical section but with dmar_global_lock held. Silence this
+false positive.
+
+ drivers/iommu/intel-iommu.c:4504 RCU-list traversed in non-reader section!!
+ 1 lock held by swapper/0/1:
+ #0: ffffffff9755bee8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x1a6/0xe19
+
+ Call Trace:
+ dump_stack+0xa4/0xfe
+ lockdep_rcu_suspicious+0xeb/0xf5
+ dmar_find_atsr+0x1ab/0x1c0
+ dmar_parse_one_atsr+0x64/0x220
+ dmar_walk_remapping_entries+0x130/0x380
+ dmar_table_init+0x166/0x243
+ intel_iommu_init+0x1ab/0xe19
+ pci_iommu_init+0x1a/0x44
+ do_one_initcall+0xae/0x4d0
+ kernel_init_freeable+0x412/0x4c5
+ kernel_init+0x19/0x193
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 4be5494786918..ef0a5246700e5 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4501,7 +4501,8 @@ static struct dmar_atsr_unit *dmar_find_atsr(struct acpi_dmar_atsr *atsr)
+ struct dmar_atsr_unit *atsru;
+ struct acpi_dmar_atsr *tmp;
+
+- list_for_each_entry_rcu(atsru, &dmar_atsr_units, list) {
++ list_for_each_entry_rcu(atsru, &dmar_atsr_units, list,
++ dmar_rcu_check()) {
+ tmp = (struct acpi_dmar_atsr *)atsru->hdr;
+ if (atsr->segment != tmp->segment)
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 0d9384a74bb34c050547d0a182530d7a227331b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2020 16:11:28 -0500
+Subject: KVM: PPC: Book3S HV: Fix H_CEDE return code for nested guests
+
+From: Michael Roth <mdroth@linux.vnet.ibm.com>
+
+[ Upstream commit 1f50cc1705350a4697923203fedd7d8fb1087fe2 ]
+
+The h_cede_tm kvm-unit-test currently fails when run inside an L1 guest
+via the guest/nested hypervisor.
+
+ ./run-tests.sh -v
+ ...
+ TESTNAME=h_cede_tm TIMEOUT=90s ACCEL= ./powerpc/run powerpc/tm.elf -smp 2,threads=2 -machine cap-htm=on -append "h_cede_tm"
+ FAIL h_cede_tm (2 tests, 1 unexpected failures)
+
+While the test relates to transactional memory instructions, the actual
+failure is due to the return code of the H_CEDE hypercall, which is
+reported as 224 instead of 0. This happens even when no TM instructions
+are issued.
+
+224 is the value placed in r3 to execute a hypercall for H_CEDE, and r3
+is where the caller expects the return code to be placed upon return.
+
+In the case of guest running under a nested hypervisor, issuing H_CEDE
+causes a return from H_ENTER_NESTED. In this case H_CEDE is
+specially-handled immediately rather than later in
+kvmppc_pseries_do_hcall() as with most other hcalls, but we forget to
+set the return code for the caller, hence why kvm-unit-test sees the
+224 return code and reports an error.
+
+Guest kernels generally don't check the return value of H_CEDE, so
+that likely explains why this hasn't caused issues outside of
+kvm-unit-tests so far.
+
+Fix this by setting r3 to 0 after we finish processing the H_CEDE.
+
+RHBZ: 1778556
+
+Fixes: 4bad77799fed ("KVM: PPC: Book3S HV: Handle hypercalls correctly when nested")
+Cc: linuxppc-dev@ozlabs.org
+Cc: David Gibson <david@gibson.dropbear.id.au>
+Cc: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 2cefd071b8483..c0c43a7338304 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -3616,6 +3616,7 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
+ if (trap == BOOK3S_INTERRUPT_SYSCALL && !vcpu->arch.nested &&
+ kvmppc_get_gpr(vcpu, 3) == H_CEDE) {
+ kvmppc_nested_cede(vcpu);
++ kvmppc_set_gpr(vcpu, 3, 0);
+ trap = 0;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From ecbe46c08b436b5a63867be78a13928ef78a887e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Apr 2020 17:30:48 +0200
+Subject: KVM: s390: vsie: Fix possible race when shadowing region 3 tables
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit 1493e0f944f3c319d11e067c185c904d01c17ae5 ]
+
+We have to properly retry again by returning -EINVAL immediately in case
+somebody else instantiated the table concurrently. We missed to add the
+goto in this function only. The code now matches the other, similar
+shadowing functions.
+
+We are overwriting an existing region 2 table entry. All allocated pages
+are added to the crst_list to be freed later, so they are not lost
+forever. However, when unshadowing the region 2 table, we wouldn't trigger
+unshadowing of the original shadowed region 3 table that we replaced. It
+would get unshadowed when the original region 3 table is modified. As it's
+not connected to the page table hierarchy anymore, it's not going to get
+used anymore. However, for a limited time, this page table will stick
+around, so it's in some sense a temporary memory leak.
+
+Identified by manual code inspection. I don't think this classifies as
+stable material.
+
+Fixes: 998f637cc4b9 ("s390/mm: avoid races on region/segment/page table shadowing")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Link: https://lore.kernel.org/r/20200403153050.20569-4-david@redhat.com
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/gmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
+index 9d9ab77d02dd3..364e3a89c0969 100644
+--- a/arch/s390/mm/gmap.c
++++ b/arch/s390/mm/gmap.c
+@@ -1844,6 +1844,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t,
+ goto out_free;
+ } else if (*table & _REGION_ENTRY_ORIGIN) {
+ rc = -EAGAIN; /* Race with shadow */
++ goto out_free;
+ }
+ crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY);
+ /* mark as invalid as long as the parent table is not protected */
+--
+2.20.1
+
--- /dev/null
+From 7c196dcfe77dc2e2d91d030782057be935cf3cce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 11:51:47 +0200
+Subject: leds: core: Fix warning message when init_data
+
+From: Ricardo Ribalda Delgado <ribalda@kernel.org>
+
+[ Upstream commit 64ed6588c2ea618d3f9ca9d8b365ae4c19f76225 ]
+
+The warning message when a led is renamed due to name collition can fail
+to show proper original name if init_data is used. Eg:
+
+[ 9.073996] leds-gpio a0040000.leds_0: Led (null) renamed to red_led_1 due to name collision
+
+Fixes: bb4e9af0348d ("leds: core: Add support for composing LED class device names")
+Signed-off-by: Ricardo Ribalda Delgado <ribalda@kernel.org>
+Acked-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/led-class.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 1fc40e8af75eb..3363a6551a708 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -376,7 +376,7 @@ int led_classdev_register_ext(struct device *parent,
+
+ if (ret)
+ dev_warn(parent, "Led %s renamed to %s due to name collision",
+- led_cdev->name, dev_name(led_cdev->dev));
++ proposed_name, dev_name(led_cdev->dev));
+
+ if (led_cdev->flags & LED_BRIGHT_HW_CHANGED) {
+ ret = led_add_brightness_hw_changed(led_cdev);
+--
+2.20.1
+
--- /dev/null
+From a9bde710ab2c3b63d7df0454b2cffe2702c41769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 19:20:56 +0300
+Subject: libnvdimm: Out of bounds read in __nd_ioctl()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f84afbdd3a9e5e10633695677b95422572f920dc ]
+
+The "cmd" comes from the user and it can be up to 255. It it's more
+than the number of bits in long, it results out of bounds read when we
+check test_bit(cmd, &cmd_mask). The highest valid value for "cmd" is
+ND_CMD_CALL (10) so I added a compare against that.
+
+Fixes: 62232e45f4a2 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200225162055.amtosfy7m35aivxg@kili.mountain
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/bus.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index a8b5159685699..09087c38fabdc 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -1042,8 +1042,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ return -EFAULT;
+ }
+
+- if (!desc || (desc->out_num + desc->in_num == 0) ||
+- !test_bit(cmd, &cmd_mask))
++ if (!desc ||
++ (desc->out_num + desc->in_num == 0) ||
++ cmd > ND_CMD_CALL ||
++ !test_bit(cmd, &cmd_mask))
+ return -ENOTTY;
+
+ /* fail write commands (when read-only) */
+--
+2.20.1
+
--- /dev/null
+From 72215742296de24811ce59f8395c479cc2b57400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 11:38:29 +0200
+Subject: macsec: fix NULL dereference in macsec_upd_offload()
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+[ Upstream commit aa81700cf2326e288c9ca1fe7b544039617f1fc2 ]
+
+macsec_upd_offload() gets the value of MACSEC_OFFLOAD_ATTR_TYPE
+without checking its presence in the request message, and this causes
+a NULL dereference. Fix it rejecting any configuration that does not
+include this attribute.
+
+Reported-and-tested-by: syzbot+7022ab7c383875c17eff@syzkaller.appspotmail.com
+Fixes: dcb780fb2795 ("net: macsec: add nla support for changing the offloading selection")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/macsec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 061aada4748a7..9b4ae5c36da6b 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -2398,6 +2398,9 @@ static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info)
+ return PTR_ERR(dev);
+ macsec = macsec_priv(dev);
+
++ if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE])
++ return -EINVAL;
++
+ offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]);
+ if (macsec->offload == offload)
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 522a7713b99fb6a8bb2eefecf43265c71e8d17be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 02:58:34 +0300
+Subject: memory: tegra: Correct debugfs clk rate-range on Tegra20
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 2243af41115d0e36e6414df6dd2a0386e022d9f8 ]
+
+Correctly set clk rate-range if number of available timings is zero.
+This fixes noisy "invalid range [4294967295, 0]" error messages during
+boot.
+
+Fixes: 8209eefa3d37 ("memory: tegra: Implement EMC debugfs interface on Tegra20")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra20-emc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c
+index 8ae474d9bfb90..b16715e9515d0 100644
+--- a/drivers/memory/tegra/tegra20-emc.c
++++ b/drivers/memory/tegra/tegra20-emc.c
+@@ -628,6 +628,11 @@ static void tegra_emc_debugfs_init(struct tegra_emc *emc)
+ emc->debugfs.max_rate = emc->timings[i].rate;
+ }
+
++ if (!emc->num_timings) {
++ emc->debugfs.min_rate = clk_get_rate(emc->clk);
++ emc->debugfs.max_rate = emc->debugfs.min_rate;
++ }
++
+ err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate,
+ emc->debugfs.max_rate);
+ if (err < 0) {
+--
+2.20.1
+
--- /dev/null
+From f62d285a8597cb63943f0c7392e85dae75a872aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 02:58:35 +0300
+Subject: memory: tegra: Correct debugfs clk rate-range on Tegra30
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit a53670e1a734ba56fac84cf2b93b838bd4a6b835 ]
+
+Correctly set clk rate-range if number of available timings is zero.
+This fixes noisy "invalid range [4294967295, 0]" error messages during
+boot.
+
+Fixes: 8cee32b40040 ("memory: tegra: Implement EMC debugfs interface on Tegra30")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra30-emc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/memory/tegra/tegra30-emc.c b/drivers/memory/tegra/tegra30-emc.c
+index e3efd9529506e..b42bdb667e853 100644
+--- a/drivers/memory/tegra/tegra30-emc.c
++++ b/drivers/memory/tegra/tegra30-emc.c
+@@ -1256,6 +1256,11 @@ static void tegra_emc_debugfs_init(struct tegra_emc *emc)
+ emc->debugfs.max_rate = emc->timings[i].rate;
+ }
+
++ if (!emc->num_timings) {
++ emc->debugfs.min_rate = clk_get_rate(emc->clk);
++ emc->debugfs.max_rate = emc->debugfs.min_rate;
++ }
++
+ err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate,
+ emc->debugfs.max_rate);
+ if (err < 0) {
+--
+2.20.1
+
--- /dev/null
+From 9100d0c1be2fc7372e63d7f8f0b3fb4317a2e90a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 02:58:36 +0300
+Subject: memory: tegra: Correct debugfs clk rate-range on Tegra124
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 141267bffd1dc19a76e4d50e3e4829f85a806875 ]
+
+Correctly set clk rate-range if number of available timings is zero.
+This fixes noisy "invalid range [4294967295, 0]" error messages during
+boot.
+
+Fixes: 6b9acd935546 ("memory: tegra: Refashion EMC debugfs interface on Tegra124")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra124-emc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/memory/tegra/tegra124-emc.c b/drivers/memory/tegra/tegra124-emc.c
+index 21f05240682b8..33b8216bac30c 100644
+--- a/drivers/memory/tegra/tegra124-emc.c
++++ b/drivers/memory/tegra/tegra124-emc.c
+@@ -1158,6 +1158,11 @@ static void emc_debugfs_init(struct device *dev, struct tegra_emc *emc)
+ emc->debugfs.max_rate = emc->timings[i].rate;
+ }
+
++ if (!emc->num_timings) {
++ emc->debugfs.min_rate = clk_get_rate(emc->clk);
++ emc->debugfs.max_rate = emc->debugfs.min_rate;
++ }
++
+ err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate,
+ emc->debugfs.max_rate);
+ if (err < 0) {
+--
+2.20.1
+
--- /dev/null
+From c6970ae579843a658e28334e4ba3d2b224222afc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2020 11:06:24 -0800
+Subject: mfd: cros_ec: Check DT node for usbpd-notify add
+
+From: Prashant Malani <pmalani@chromium.org>
+
+[ Upstream commit f8db89d14efb770dd59aa0ca74386e5de68310d5 ]
+
+Add a check to ensure there is indeed an EC device tree entry before
+adding the cros-usbpd-notify device. This covers configs where both
+CONFIG_ACPI and CONFIG_OF are defined, but the EC device is defined
+using device tree and not in ACPI.
+
+Fixes: 4602dce0361e ("mfd: cros_ec: Add cros-usbpd-notify subdevice")
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cros_ec_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c
+index 39e6116950536..32c2b912b58b2 100644
+--- a/drivers/mfd/cros_ec_dev.c
++++ b/drivers/mfd/cros_ec_dev.c
+@@ -211,7 +211,7 @@ static int ec_device_probe(struct platform_device *pdev)
+ * explicitly added on platforms that don't have the PD notifier ACPI
+ * device entry defined.
+ */
+- if (IS_ENABLED(CONFIG_OF)) {
++ if (IS_ENABLED(CONFIG_OF) && ec->ec_dev->dev->of_node) {
+ if (cros_ec_check_features(ec, EC_FEATURE_USB_PD)) {
+ retval = mfd_add_hotplug_devices(ec->dev,
+ cros_usbpd_notify_cells,
+--
+2.20.1
+
--- /dev/null
+From c9bc640f1b485f754c05c3cccce2d760a6a5e2f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 22:06:31 +0100
+Subject: MIPS: DTS: CI20: add DT node for IR sensor
+
+From: Alex Smith <alex.smith@imgtec.com>
+
+[ Upstream commit f5e8fcf85a25bac26c32a0000dbab5857ead9113 ]
+
+The infrared sensor on the CI20 board is connected to a GPIO and can
+be operated by using the gpio-ir-recv driver. Add a DT node for the
+sensor to allow that driver to be used.
+
+Signed-off-by: Alex Smith <alex.smith@imgtec.com>
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Reviewed-by: Paul Cercueil <paul@crapouillou.net>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/ingenic/ci20.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts
+index c340f947baa03..fc4e64200c3d5 100644
+--- a/arch/mips/boot/dts/ingenic/ci20.dts
++++ b/arch/mips/boot/dts/ingenic/ci20.dts
+@@ -62,6 +62,11 @@
+ enable-active-high;
+ };
+
++ ir: ir {
++ compatible = "gpio-ir-receiver";
++ gpios = <&gpe 3 GPIO_ACTIVE_LOW>;
++ };
++
+ wlan0_power: fixedregulator@1 {
+ compatible = "regulator-fixed";
+ regulator-name = "wlan0_power";
+--
+2.20.1
+
--- /dev/null
+From f993aaa7ec8acf916e9b443a5aeb6189bbd57831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2020 21:11:54 -0700
+Subject: mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit bb297bb2de517e41199185021f043bbc5d75b377 ]
+
+When CONFIG_HUGETLB_PAGE is set but not CONFIG_HUGETLBFS, the following
+build failure is encoutered:
+
+ In file included from arch/powerpc/mm/fault.c:33:0:
+ include/linux/hugetlb.h: In function 'hstate_inode':
+ include/linux/hugetlb.h:477:9: error: implicit declaration of function 'HUGETLBFS_SB' [-Werror=implicit-function-declaration]
+ return HUGETLBFS_SB(i->i_sb)->hstate;
+ ^
+ include/linux/hugetlb.h:477:30: error: invalid type argument of '->' (have 'int')
+ return HUGETLBFS_SB(i->i_sb)->hstate;
+ ^
+
+Gate hstate_inode() with CONFIG_HUGETLBFS instead of CONFIG_HUGETLB_PAGE.
+
+Fixes: a137e1cc6d6e ("hugetlbfs: per mount huge page sizes")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Nishanth Aravamudan <nacc@us.ibm.com>
+Cc: Nick Piggin <npiggin@suse.de>
+Cc: Adam Litke <agl@us.ibm.com>
+Cc: Andi Kleen <ak@suse.de>
+Link: http://lkml.kernel.org/r/7e8c3a3c9a587b9cd8a2f146df32a421b961f3a2.1584432148.git.christophe.leroy@c-s.fr
+Link: https://patchwork.ozlabs.org/patch/1255548/#2386036
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/hugetlb.h | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 1e897e4168ac1..dafb3d70ff819 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -390,7 +390,10 @@ static inline bool is_file_hugepages(struct file *file)
+ return is_file_shm_hugepages(file);
+ }
+
+-
++static inline struct hstate *hstate_inode(struct inode *i)
++{
++ return HUGETLBFS_SB(i->i_sb)->hstate;
++}
+ #else /* !CONFIG_HUGETLBFS */
+
+ #define is_file_hugepages(file) false
+@@ -402,6 +405,10 @@ hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag,
+ return ERR_PTR(-ENOSYS);
+ }
+
++static inline struct hstate *hstate_inode(struct inode *i)
++{
++ return NULL;
++}
+ #endif /* !CONFIG_HUGETLBFS */
+
+ #ifdef HAVE_ARCH_HUGETLB_UNMAPPED_AREA
+@@ -472,11 +479,6 @@ extern unsigned int default_hstate_idx;
+
+ #define default_hstate (hstates[default_hstate_idx])
+
+-static inline struct hstate *hstate_inode(struct inode *i)
+-{
+- return HUGETLBFS_SB(i->i_sb)->hstate;
+-}
+-
+ static inline struct hstate *hstate_file(struct file *f)
+ {
+ return hstate_inode(file_inode(f));
+@@ -729,11 +731,6 @@ static inline struct hstate *hstate_vma(struct vm_area_struct *vma)
+ return NULL;
+ }
+
+-static inline struct hstate *hstate_inode(struct inode *i)
+-{
+- return NULL;
+-}
+-
+ static inline struct hstate *page_hstate(struct page *page)
+ {
+ return NULL;
+--
+2.20.1
+
--- /dev/null
+From f39d13ce7f0a0160640c20a9841fcc6a6a87b021 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Feb 2020 14:32:49 -0800
+Subject: net/mlx5e: Enforce setting of a single FEC mode
+
+From: Aya Levin <ayal@mellanox.com>
+
+[ Upstream commit 4bd9d5070b92da012f2715cf8e4859acb78b8f35 ]
+
+Ethtool command allow setting of several FEC modes in a single set
+command. The driver can only set a single FEC mode at a time. With this
+patch driver will reply not-supported on setting several FEC modes.
+
+Signed-off-by: Aya Levin <ayal@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index d2cfa247abc86..9710cdecb63af 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1535,6 +1535,10 @@ static int mlx5e_set_fecparam(struct net_device *netdev,
+ int mode;
+ int err;
+
++ if (bitmap_weight((unsigned long *)&fecparam->fec,
++ ETHTOOL_FEC_BASER_BIT + 1) > 1)
++ return -EOPNOTSUPP;
++
+ for (mode = 0; mode < ARRAY_SIZE(pplm_fec_2_ethtool); mode++) {
+ if (!(pplm_fec_2_ethtool[mode] & fecparam->fec))
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 25adca27052e2e3fb46f7b5a375c93d7d24d4e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 19:32:49 -0500
+Subject: NFS: alloc_nfs_open_context() must use the file cred when available
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 1d179d6bd67369a52edea8562154b31ee20be1cc ]
+
+If we're creating a nfs_open_context() for a specific file pointer,
+we must use the cred assigned to that file.
+
+Fixes: a52458b48af1 ("NFS/NFSD/SUNRPC: replace generic creds with 'struct cred'.")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/inode.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 11bf15800ac99..a10fb87c6ac33 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -959,16 +959,16 @@ struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry,
+ struct file *filp)
+ {
+ struct nfs_open_context *ctx;
+- const struct cred *cred = get_current_cred();
+
+ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+- if (!ctx) {
+- put_cred(cred);
++ if (!ctx)
+ return ERR_PTR(-ENOMEM);
+- }
+ nfs_sb_active(dentry->d_sb);
+ ctx->dentry = dget(dentry);
+- ctx->cred = cred;
++ if (filp)
++ ctx->cred = get_cred(filp->f_cred);
++ else
++ ctx->cred = get_current_cred();
+ ctx->ll_cred = NULL;
+ ctx->state = NULL;
+ ctx->mode = f_mode;
+--
+2.20.1
+
--- /dev/null
+From d41093d8bd8874f5f5dcfc513c461b2bcc0e1e6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 17:01:22 +0900
+Subject: NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context
+ fails
+
+From: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+
+[ Upstream commit 8605cf0e852af3b2c771c18417499dc4ceed03d5 ]
+
+When dreq is allocated by nfs_direct_req_alloc(), dreq->kref is
+initialized to 2. Therefore we need to call nfs_direct_req_release()
+twice to release the allocated dreq. Usually it is called in
+nfs_file_direct_{read, write}() and nfs_direct_complete().
+
+However, current code only calls nfs_direct_req_relese() once if
+nfs_get_lock_context() fails in nfs_file_direct_{read, write}().
+So, that case would result in memory leak.
+
+Fix this by adding the missing call.
+
+Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/direct.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index b768a0b42e82e..ade2435551c89 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -571,6 +571,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter)
+ l_ctx = nfs_get_lock_context(dreq->ctx);
+ if (IS_ERR(l_ctx)) {
+ result = PTR_ERR(l_ctx);
++ nfs_direct_req_release(dreq);
+ goto out_release;
+ }
+ dreq->l_ctx = l_ctx;
+@@ -990,6 +991,7 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter)
+ l_ctx = nfs_get_lock_context(dreq->ctx);
+ if (IS_ERR(l_ctx)) {
+ result = PTR_ERR(l_ctx);
++ nfs_direct_req_release(dreq);
+ goto out_release;
+ }
+ dreq->l_ctx = l_ctx;
+--
+2.20.1
+
--- /dev/null
+From 66c224b4384e3caf62564b45a3f90ed913502076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2020 20:06:45 -0400
+Subject: NFS: Fix memory leaks in nfs_pageio_stop_mirroring()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 862f35c94730c9270833f3ad05bd758a29f204ed ]
+
+If we just set the mirror count to 1 without first clearing out
+the mirrors, we can leak queued up requests.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pagelist.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 8b7c525dbbf7c..b736912098eee 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -886,15 +886,6 @@ static void nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio,
+ pgio->pg_mirror_count = mirror_count;
+ }
+
+-/*
+- * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1)
+- */
+-void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio)
+-{
+- pgio->pg_mirror_count = 1;
+- pgio->pg_mirror_idx = 0;
+-}
+-
+ static void nfs_pageio_cleanup_mirroring(struct nfs_pageio_descriptor *pgio)
+ {
+ pgio->pg_mirror_count = 1;
+@@ -1320,6 +1311,14 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index)
+ }
+ }
+
++/*
++ * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1)
++ */
++void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio)
++{
++ nfs_pageio_complete(pgio);
++}
++
+ int __init nfs_init_nfspagecache(void)
+ {
+ nfs_page_cachep = kmem_cache_create("nfs_page",
+--
+2.20.1
+
--- /dev/null
+From 12bea344f2639f180f6ab420c7d21e37895b2766 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Mar 2020 11:50:13 +0800
+Subject: nfsroot: set tcp as the default transport protocol
+
+From: Liwei Song <liwei.song@windriver.com>
+
+[ Upstream commit 89c8023fd46167a41246a56b31d1b3c9a20b6970 ]
+
+UDP is disabled by default in commit b24ee6c64ca7 ("NFS: allow
+deprecation of NFS UDP protocol"), but the default mount options
+is still udp, change it to tcp to avoid the "Unsupported transport
+protocol udp" error if no protocol is specified when mount nfs.
+
+Fixes: b24ee6c64ca7 ("NFS: allow deprecation of NFS UDP protocol")
+Signed-off-by: Liwei Song <liwei.song@windriver.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfsroot.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
+index effaa4247b912..8d32788056022 100644
+--- a/fs/nfs/nfsroot.c
++++ b/fs/nfs/nfsroot.c
+@@ -88,7 +88,7 @@
+ #define NFS_ROOT "/tftpboot/%s"
+
+ /* Default NFSROOT mount options. */
+-#define NFS_DEF_OPTIONS "vers=2,udp,rsize=4096,wsize=4096"
++#define NFS_DEF_OPTIONS "vers=2,tcp,rsize=4096,wsize=4096"
+
+ /* Parameters passed from the kernel command line */
+ static char nfs_root_parms[NFS_MAXPATHLEN + 1] __initdata = "";
+--
+2.20.1
+
--- /dev/null
+From 2f905e59c2158a611067ca35638d714755914a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 11:01:12 -0500
+Subject: NFSv4/pnfs: Return valid stateids in
+ nfs_layout_find_inode_by_stateid()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d911c57a19551c6bef116a3b55c6b089901aacb0 ]
+
+Make sure to test the stateid for validity so that we catch instances
+where the server may have been reusing stateids in
+nfs_layout_find_inode_by_stateid().
+
+Fixes: 7b410d9ce460 ("pNFS: Delay getting the layout header in CB_LAYOUTRECALL handlers")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/callback_proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index cd4c6bc81caed..40d31024b72d1 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -128,6 +128,8 @@ static struct inode *nfs_layout_find_inode_by_stateid(struct nfs_client *clp,
+
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry(lo, &server->layouts, plh_layouts) {
++ if (!pnfs_layout_is_valid(lo))
++ continue;
+ if (stateid != NULL &&
+ !nfs4_stateid_match_other(stateid, &lo->plh_stateid))
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 965ad70d5163824db3506ce0f45bb3fd87a4cade Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 22:34:09 +0800
+Subject: NFSv4.2: error out when relink swapfile
+
+From: Murphy Zhou <jencce.kernel@gmail.com>
+
+[ Upstream commit f5fdf1243fb750598b46305dd03c553949cfa14f ]
+
+This fixes xfstests generic/356 failure on NFSv4.2.
+
+Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4file.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index 1297919e0fce3..8e5d6223ddd35 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -252,6 +252,9 @@ static loff_t nfs42_remap_file_range(struct file *src_file, loff_t src_off,
+ if (remap_flags & ~REMAP_FILE_ADVISORY)
+ return -EINVAL;
+
++ if (IS_SWAPFILE(dst_inode) || IS_SWAPFILE(src_inode))
++ return -ETXTBSY;
++
+ /* check alignment w.r.t. clone_blksize */
+ ret = -EINVAL;
+ if (bs) {
+--
+2.20.1
+
--- /dev/null
+From d1e3f721471b2a48d5529e836b336dfcf4b708aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2020 20:10:25 -0700
+Subject: percpu_counter: fix a data race at vm_committed_as
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 7e2345200262e4a6056580f0231cccdaffc825f3 ]
+
+"vm_committed_as.count" could be accessed concurrently as reported by
+KCSAN,
+
+ BUG: KCSAN: data-race in __vm_enough_memory / percpu_counter_add_batch
+
+ write to 0xffffffff9451c538 of 8 bytes by task 65879 on cpu 35:
+ percpu_counter_add_batch+0x83/0xd0
+ percpu_counter_add_batch at lib/percpu_counter.c:91
+ __vm_enough_memory+0xb9/0x260
+ dup_mm+0x3a4/0x8f0
+ copy_process+0x2458/0x3240
+ _do_fork+0xaa/0x9f0
+ __do_sys_clone+0x125/0x160
+ __x64_sys_clone+0x70/0x90
+ do_syscall_64+0x91/0xb05
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+ read to 0xffffffff9451c538 of 8 bytes by task 66773 on cpu 19:
+ __vm_enough_memory+0x199/0x260
+ percpu_counter_read_positive at include/linux/percpu_counter.h:81
+ (inlined by) __vm_enough_memory at mm/util.c:839
+ mmap_region+0x1b2/0xa10
+ do_mmap+0x45c/0x700
+ vm_mmap_pgoff+0xc0/0x130
+ ksys_mmap_pgoff+0x6e/0x300
+ __x64_sys_mmap+0x33/0x40
+ do_syscall_64+0x91/0xb05
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The read is outside percpu_counter::lock critical section which results in
+a data race. Fix it by adding a READ_ONCE() in
+percpu_counter_read_positive() which could also service as the existing
+compiler memory barrier.
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Marco Elver <elver@google.com>
+Link: http://lkml.kernel.org/r/1582302724-2804-1-git-send-email-cai@lca.pw
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/percpu_counter.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/percpu_counter.h b/include/linux/percpu_counter.h
+index 4f052496cdfd7..0a4f54dd4737b 100644
+--- a/include/linux/percpu_counter.h
++++ b/include/linux/percpu_counter.h
+@@ -78,9 +78,9 @@ static inline s64 percpu_counter_read(struct percpu_counter *fbc)
+ */
+ static inline s64 percpu_counter_read_positive(struct percpu_counter *fbc)
+ {
+- s64 ret = fbc->count;
++ /* Prevent reloads of fbc->count */
++ s64 ret = READ_ONCE(fbc->count);
+
+- barrier(); /* Prevent reloads of fbc->count */
+ if (ret >= 0)
+ return ret;
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From ce08c17e77b5bf793a036bf94c6d4314a7baa36d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 15:52:41 +0900
+Subject: phy: uniphier-usb3ss: Add Pro5 support
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 9376fa634afc207a3ce99e0957e04948c34d6510 ]
+
+Pro5 SoC has same scheme of USB3 ss-phy as Pro4, so the data for Pro5 is
+equivalent to Pro4.
+
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/socionext/phy-uniphier-usb3ss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/socionext/phy-uniphier-usb3ss.c b/drivers/phy/socionext/phy-uniphier-usb3ss.c
+index ec231e40ef2ac..a7577e316baf5 100644
+--- a/drivers/phy/socionext/phy-uniphier-usb3ss.c
++++ b/drivers/phy/socionext/phy-uniphier-usb3ss.c
+@@ -314,6 +314,10 @@ static const struct of_device_id uniphier_u3ssphy_match[] = {
+ .compatible = "socionext,uniphier-pro4-usb3-ssphy",
+ .data = &uniphier_pro4_data,
+ },
++ {
++ .compatible = "socionext,uniphier-pro5-usb3-ssphy",
++ .data = &uniphier_pro4_data,
++ },
+ {
+ .compatible = "socionext,uniphier-pxs2-usb3-ssphy",
+ .data = &uniphier_pxs2_data,
+--
+2.20.1
+
--- /dev/null
+From a96ca4750bb0d998a3be24007461abaf0b5c5b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 14:53:56 -0800
+Subject: platform/chrome: cros_ec: Query EC protocol version if EC transitions
+ between RO/RW
+
+From: Yicheng Li <yichengli@chromium.org>
+
+[ Upstream commit 42cd0ab476e2daffc23982c37822a78f9a53cdd5 ]
+
+RO and RW of EC may have different EC protocol version. If EC transitions
+between RO and RW, but AP does not reboot (this is true for fingerprint
+microcontroller / cros_fp, but not true for main ec / cros_ec), the AP
+still uses the protocol version queried before transition, which can
+cause problems. In the case of fingerprint microcontroller, this causes
+AP to send the wrong version of EC_CMD_GET_NEXT_EVENT to RO in the
+interrupt handler, which in turn prevents RO to clear the interrupt
+line to AP, in an infinite loop.
+
+Once an EC_HOST_EVENT_INTERFACE_READY is received, we know that there
+might have been a transition between RO and RW, so re-query the protocol.
+
+Signed-off-by: Yicheng Li <yichengli@chromium.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Gwendal Grignou <gwendal@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec.c | 30 +++++++++++++++++++++
+ include/linux/platform_data/cros_ec_proto.h | 4 +++
+ 2 files changed, 34 insertions(+)
+
+diff --git a/drivers/platform/chrome/cros_ec.c b/drivers/platform/chrome/cros_ec.c
+index 6fc8f2c3ac517..7ee43b2e0654a 100644
+--- a/drivers/platform/chrome/cros_ec.c
++++ b/drivers/platform/chrome/cros_ec.c
+@@ -138,6 +138,24 @@ static int cros_ec_sleep_event(struct cros_ec_device *ec_dev, u8 sleep_event)
+ return ret;
+ }
+
++static int cros_ec_ready_event(struct notifier_block *nb,
++ unsigned long queued_during_suspend,
++ void *_notify)
++{
++ struct cros_ec_device *ec_dev = container_of(nb, struct cros_ec_device,
++ notifier_ready);
++ u32 host_event = cros_ec_get_host_event(ec_dev);
++
++ if (host_event & EC_HOST_EVENT_MASK(EC_HOST_EVENT_INTERFACE_READY)) {
++ mutex_lock(&ec_dev->lock);
++ cros_ec_query_all(ec_dev);
++ mutex_unlock(&ec_dev->lock);
++ return NOTIFY_OK;
++ }
++
++ return NOTIFY_DONE;
++}
++
+ /**
+ * cros_ec_register() - Register a new ChromeOS EC, using the provided info.
+ * @ec_dev: Device to register.
+@@ -237,6 +255,18 @@ int cros_ec_register(struct cros_ec_device *ec_dev)
+ dev_dbg(ec_dev->dev, "Error %d clearing sleep event to ec",
+ err);
+
++ if (ec_dev->mkbp_event_supported) {
++ /*
++ * Register the notifier for EC_HOST_EVENT_INTERFACE_READY
++ * event.
++ */
++ ec_dev->notifier_ready.notifier_call = cros_ec_ready_event;
++ err = blocking_notifier_chain_register(&ec_dev->event_notifier,
++ &ec_dev->notifier_ready);
++ if (err)
++ return err;
++ }
++
+ dev_info(dev, "Chrome EC device registered\n");
+
+ return 0;
+diff --git a/include/linux/platform_data/cros_ec_proto.h b/include/linux/platform_data/cros_ec_proto.h
+index ba59147701918..3832433266762 100644
+--- a/include/linux/platform_data/cros_ec_proto.h
++++ b/include/linux/platform_data/cros_ec_proto.h
+@@ -125,6 +125,9 @@ struct cros_ec_command {
+ * @host_event_wake_mask: Mask of host events that cause wake from suspend.
+ * @last_event_time: exact time from the hard irq when we got notified of
+ * a new event.
++ * @notifier_ready: The notifier_block to let the kernel re-query EC
++ * communication protocol when the EC sends
++ * EC_HOST_EVENT_INTERFACE_READY.
+ * @ec: The platform_device used by the mfd driver to interface with the
+ * main EC.
+ * @pd: The platform_device used by the mfd driver to interface with the
+@@ -166,6 +169,7 @@ struct cros_ec_device {
+ u32 host_event_wake_mask;
+ u32 last_resume_result;
+ ktime_t last_event_time;
++ struct notifier_block notifier_ready;
+
+ /* The platform devices used by the mfd driver */
+ struct platform_device *ec;
+--
+2.20.1
+
--- /dev/null
+From 9c7b68a86307fc425d21b96f018bdf6c2b4c1825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Mar 2020 14:28:20 -0700
+Subject: platform/x86: intel-hid: fix: Update Tiger Lake ACPI device ID
+
+From: Gayatri Kammela <gayatri.kammela@intel.com>
+
+[ Upstream commit d5764dc597467664a1a70ab66a2314a011aeccd4 ]
+
+Tiger Lake's new unique ACPI device IDs for intel-hid driver is not
+valid because of missing 'C' in the ID. Fix the ID by updating it.
+
+After the update, the new ID should now look like
+INT1051 --> INTC1051
+
+Fixes: bdd11b654035 ("platform/x86: intel-hid: Add Tiger Lake ACPI device ID")
+Suggested-by: Srinivas Pandruvada <srinivas.pandruvada@intel.com>
+Signed-off-by: Gayatri Kammela <gayatri.kammela@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 43d590250228c..9c0e6e0fabdff 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -19,8 +19,8 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Alex Hung");
+
+ static const struct acpi_device_id intel_hid_ids[] = {
+- {"INT1051", 0},
+ {"INT33D5", 0},
++ {"INTC1051", 0},
+ {"", 0},
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 8e8d0e56c7bf037443f8e012f0538d32ea35ed69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 16:59:41 -0600
+Subject: power: supply: axp288_fuel_gauge: Broaden vendor check for Intel
+ Compute Sticks.
+
+From: Jeffery Miller <jmiller@neverware.com>
+
+[ Upstream commit e42fe5b29ac07210297e75f36deefe54edbdbf80 ]
+
+The Intel Compute Stick `STK1A32SC` can have a system vendor of
+"Intel(R) Client Systems".
+Broaden the Intel Compute Stick DMI checks so that they match "Intel
+Corporation" as well as "Intel(R) Client Systems".
+
+This fixes an issue where the STK1A32SC compute sticks were still
+exposing a battery with the existing blacklist entry.
+
+Signed-off-by: Jeffery Miller <jmiller@neverware.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp288_fuel_gauge.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
+index e1bc4e6e6f30e..f40fa0e63b6e5 100644
+--- a/drivers/power/supply/axp288_fuel_gauge.c
++++ b/drivers/power/supply/axp288_fuel_gauge.c
+@@ -706,14 +706,14 @@ static const struct dmi_system_id axp288_fuel_gauge_blacklist[] = {
+ {
+ /* Intel Cherry Trail Compute Stick, Windows version */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "STK1AW32SC"),
+ },
+ },
+ {
+ /* Intel Cherry Trail Compute Stick, version without an OS */
+ .matches = {
+- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "STK1A32SC"),
+ },
+ },
+--
+2.20.1
+
--- /dev/null
+From 637c7c18d7b8107af93135d21bd66b020872a31e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Mar 2020 00:51:43 +0300
+Subject: power: supply: bq27xxx_battery: Silence deferred-probe error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 583b53ece0b0268c542a1eafadb62e3d4b0aab8c ]
+
+The driver fails to probe with -EPROBE_DEFER if battery's power supply
+(charger driver) isn't ready yet and this results in a bit noisy error
+message in KMSG during kernel's boot up. Let's silence the harmless
+error message.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Reviewed-by: Andrew F. Davis <afd@ti.com>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq27xxx_battery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c
+index 195c18c2f426e..664e50103eaaf 100644
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -1885,7 +1885,10 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di)
+
+ di->bat = power_supply_register_no_ws(di->dev, psy_desc, &psy_cfg);
+ if (IS_ERR(di->bat)) {
+- dev_err(di->dev, "failed to register battery\n");
++ if (PTR_ERR(di->bat) == -EPROBE_DEFER)
++ dev_dbg(di->dev, "failed to register battery, deferring probe\n");
++ else
++ dev_err(di->dev, "failed to register battery\n");
+ return PTR_ERR(di->bat);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 60c90371ebcb8cfa7452eb9f090688b99b41716f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 15:27:29 -0700
+Subject: powerpc/maple: Fix declaration made after definition
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit af6cf95c4d003fccd6c2ecc99a598fb854b537e7 ]
+
+When building ppc64 defconfig, Clang errors (trimmed for brevity):
+
+ arch/powerpc/platforms/maple/setup.c:365:1: error: attribute declaration
+ must precede definition [-Werror,-Wignored-attributes]
+ machine_device_initcall(maple, maple_cpc925_edac_setup);
+ ^
+
+machine_device_initcall expands to __define_machine_initcall, which in
+turn has the macro machine_is used in it, which declares mach_##name
+with an __attribute__((weak)). define_machine actually defines
+mach_##name, which in this file happens before the declaration, hence
+the warning.
+
+To fix this, move define_machine after machine_device_initcall so that
+the declaration occurs before the definition, which matches how
+machine_device_initcall and define_machine work throughout
+arch/powerpc.
+
+While we're here, remove some spaces before tabs.
+
+Fixes: 8f101a051ef0 ("edac: cpc925 MC platform device setup")
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Suggested-by: Ilie Halip <ilie.halip@gmail.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200323222729.15365-1-natechancellor@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/maple/setup.c | 34 ++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
+index 6f019df37916f..15b2c6eb506d0 100644
+--- a/arch/powerpc/platforms/maple/setup.c
++++ b/arch/powerpc/platforms/maple/setup.c
+@@ -291,23 +291,6 @@ static int __init maple_probe(void)
+ return 1;
+ }
+
+-define_machine(maple) {
+- .name = "Maple",
+- .probe = maple_probe,
+- .setup_arch = maple_setup_arch,
+- .init_IRQ = maple_init_IRQ,
+- .pci_irq_fixup = maple_pci_irq_fixup,
+- .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq,
+- .restart = maple_restart,
+- .halt = maple_halt,
+- .get_boot_time = maple_get_boot_time,
+- .set_rtc_time = maple_set_rtc_time,
+- .get_rtc_time = maple_get_rtc_time,
+- .calibrate_decr = generic_calibrate_decr,
+- .progress = maple_progress,
+- .power_save = power4_idle,
+-};
+-
+ #ifdef CONFIG_EDAC
+ /*
+ * Register a platform device for CPC925 memory controller on
+@@ -364,3 +347,20 @@ static int __init maple_cpc925_edac_setup(void)
+ }
+ machine_device_initcall(maple, maple_cpc925_edac_setup);
+ #endif
++
++define_machine(maple) {
++ .name = "Maple",
++ .probe = maple_probe,
++ .setup_arch = maple_setup_arch,
++ .init_IRQ = maple_init_IRQ,
++ .pci_irq_fixup = maple_pci_irq_fixup,
++ .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq,
++ .restart = maple_restart,
++ .halt = maple_halt,
++ .get_boot_time = maple_get_boot_time,
++ .set_rtc_time = maple_set_rtc_time,
++ .get_rtc_time = maple_get_rtc_time,
++ .calibrate_decr = generic_calibrate_decr,
++ .progress = maple_progress,
++ .power_save = power4_idle,
++};
+--
+2.20.1
+
--- /dev/null
+From 90f1cadb06695a05b73bfe35a8109c8732f9f5e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 18:44:04 +1100
+Subject: powerpc/prom_init: Pass the "os-term" message to hypervisor
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 74bb84e5117146fa73eb9d01305975c53022b3c3 ]
+
+The "os-term" RTAS calls has one argument with a message address of OS
+termination cause. rtas_os_term() already passes it but the recently
+added prom_init's version of that missed it; it also does not fill
+args correctly.
+
+This passes the message address and initializes the number of arguments.
+
+Fixes: 6a9c930bd775 ("powerpc/prom_init: Add the ESM call to prom_init")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200312074404.87293-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index 577345382b23f..673f13b87db13 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -1773,6 +1773,9 @@ static void __init prom_rtas_os_term(char *str)
+ if (token == 0)
+ prom_panic("Could not get token for ibm,os-term\n");
+ os_term_args.token = cpu_to_be32(token);
++ os_term_args.nargs = cpu_to_be32(1);
++ os_term_args.nret = cpu_to_be32(1);
++ os_term_args.args[0] = cpu_to_be32(__pa(str));
+ prom_rtas_hcall((uint64_t)&os_term_args);
+ }
+ #endif /* CONFIG_PPC_SVM */
+--
+2.20.1
+
--- /dev/null
+From f3bc1c7a7c61d3473b987e67815441084eb6de8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 23:39:51 +0100
+Subject: rtc: 88pm860x: fix possible race condition
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 9cf4789e6e4673d0b2c96fa6bb0c35e81b43111a ]
+
+The RTC IRQ is requested before the struct rtc_device is allocated,
+this may lead to a NULL pointer dereference in the IRQ handler.
+
+To fix this issue, allocating the rtc_device struct before requesting
+the RTC IRQ using devm_rtc_allocate_device, and use rtc_register_device
+to register the RTC device.
+
+Also remove the unnecessary error message as the core already prints the
+info.
+
+Link: https://lore.kernel.org/r/20200311223956.51352-1-alexandre.belloni@bootlin.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm860x.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 4743b16a8d849..1526402e126b2 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -336,6 +336,10 @@ static int pm860x_rtc_probe(struct platform_device *pdev)
+ info->dev = &pdev->dev;
+ dev_set_drvdata(&pdev->dev, info);
+
++ info->rtc_dev = devm_rtc_allocate_device(&pdev->dev);
++ if (IS_ERR(info->rtc_dev))
++ return PTR_ERR(info->rtc_dev);
++
+ ret = devm_request_threaded_irq(&pdev->dev, info->irq, NULL,
+ rtc_update_handler, IRQF_ONESHOT, "rtc",
+ info);
+@@ -377,13 +381,11 @@ static int pm860x_rtc_probe(struct platform_device *pdev)
+ }
+ }
+
+- info->rtc_dev = devm_rtc_device_register(&pdev->dev, "88pm860x-rtc",
+- &pm860x_rtc_ops, THIS_MODULE);
+- ret = PTR_ERR(info->rtc_dev);
+- if (IS_ERR(info->rtc_dev)) {
+- dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret);
++ info->rtc_dev->ops = &pm860x_rtc_ops;
++
++ ret = rtc_register_device(info->rtc_dev);
++ if (ret)
+ return ret;
+- }
+
+ /*
+ * enable internal XO instead of internal 3.25MHz clock since it can
+--
+2.20.1
+
--- /dev/null
+From 3a4b8e4f9f02d60660b31137bf0c10011cbfdf7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Mar 2020 12:39:55 +0100
+Subject: s390/cpuinfo: fix wrong output when CPU0 is offline
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 872f27103874a73783aeff2aac2b41a489f67d7c ]
+
+/proc/cpuinfo should not print information about CPU 0 when it is offline.
+
+Fixes: 281eaa8cb67c ("s390/cpuinfo: simplify locking and skip offline cpus early")
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+[heiko.carstens@de.ibm.com: shortened commit message]
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/processor.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
+index 6ebc2117c66c7..91b9b3f73de6e 100644
+--- a/arch/s390/kernel/processor.c
++++ b/arch/s390/kernel/processor.c
+@@ -165,8 +165,9 @@ static void show_cpu_mhz(struct seq_file *m, unsigned long n)
+ static int show_cpuinfo(struct seq_file *m, void *v)
+ {
+ unsigned long n = (unsigned long) v - 1;
++ unsigned long first = cpumask_first(cpu_online_mask);
+
+- if (!n)
++ if (n == first)
+ show_cpu_summary(m, v);
+ if (!machine_has_cpu_mhz)
+ return 0;
+@@ -179,6 +180,8 @@ static inline void *c_update(loff_t *pos)
+ {
+ if (*pos)
+ *pos = cpumask_next(*pos - 1, cpu_online_mask);
++ else
++ *pos = cpumask_first(cpu_online_mask);
+ return *pos < nr_cpu_ids ? (void *)*pos + 1 : NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 907744331898564c1a5953e3a64df3cd71fb7008 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2020 11:09:07 +0100
+Subject: s390/cpum_sf: Fix wrong page count in error message
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 4141b6a5e9f171325effc36a22eb92bf961e7a5c ]
+
+When perf record -e SF_CYCLES_BASIC_DIAG runs with very high
+frequency, the samples arrive faster than the perf process can
+save them to file. Eventually, for longer running processes, this
+leads to the siutation where the trace buffers allocated by perf
+slowly fills up. At one point the auxiliary trace buffer is full
+and the CPU Measurement sampling facility is turned off. Furthermore
+a warning is printed to the kernel log buffer:
+
+cpum_sf: The AUX buffer with 0 pages for the diagnostic-sampling
+ mode is full
+
+The number of allocated pages for the auxiliary trace buffer is shown
+as zero pages. That is wrong.
+
+Fix this by saving the number of allocated pages before entering the
+work loop in the interrupt handler. When the interrupt handler processes
+the samples, it may detect the buffer full condition and stop sampling,
+reducing the buffer size to zero.
+Print the correct value in the error message:
+
+cpum_sf: The AUX buffer with 256 pages for the diagnostic-sampling
+ mode is full
+
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_cpum_sf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index b095b1c78987d..05b908b3a6b38 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1576,6 +1576,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
+ unsigned long range = 0, size;
+ unsigned long long overflow = 0;
+ struct perf_output_handle *handle = &cpuhw->handle;
++ unsigned long num_sdb;
+
+ aux = perf_get_aux(handle);
+ if (WARN_ON_ONCE(!aux))
+@@ -1587,13 +1588,14 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw)
+ size >> PAGE_SHIFT);
+ perf_aux_output_end(handle, size);
+
++ num_sdb = aux->sfb.num_sdb;
+ while (!done) {
+ /* Get an output handle */
+ aux = perf_aux_output_begin(handle, cpuhw->event);
+ if (handle->size == 0) {
+ pr_err("The AUX buffer with %lu pages for the "
+ "diagnostic-sampling mode is full\n",
+- aux->sfb.num_sdb);
++ num_sdb);
+ debug_sprintf_event(sfdbg, 1,
+ "%s: AUX buffer used up\n",
+ __func__);
+--
+2.20.1
+
--- /dev/null
+From 9dfbd3c16667a0f5371a3debc4a6c20515543ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 15:34:30 +0100
+Subject: s390/crypto: explicitly memzero stack key material in aes_s390.c
+
+From: Torsten Duwe <duwe@suse.de>
+
+[ Upstream commit 4a559cd15dbc79958fa9b18ad4e8afe4a0bf4744 ]
+
+aes_s390.c has several functions which allocate space for key material on
+the stack and leave the used keys there. It is considered good practice
+to clean these locations before the function returns.
+
+Link: https://lkml.kernel.org/r/20200221165511.GB6928@lst.de
+Signed-off-by: Torsten Duwe <duwe@suse.de>
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/crypto/aes_s390.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index 1c23d84a9097d..73044634d3427 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -342,6 +342,7 @@ static int cbc_aes_crypt(struct skcipher_request *req, unsigned long modifier)
+ memcpy(walk.iv, param.iv, AES_BLOCK_SIZE);
+ ret = skcipher_walk_done(&walk, nbytes - n);
+ }
++ memzero_explicit(¶m, sizeof(param));
+ return ret;
+ }
+
+@@ -470,6 +471,8 @@ static int xts_aes_crypt(struct skcipher_request *req, unsigned long modifier)
+ walk.dst.virt.addr, walk.src.virt.addr, n);
+ ret = skcipher_walk_done(&walk, nbytes - n);
+ }
++ memzero_explicit(&pcc_param, sizeof(pcc_param));
++ memzero_explicit(&xts_param, sizeof(xts_param));
+ return ret;
+ }
+
+--
+2.20.1
+
block-bfq-turn-put_queue-into-release_process_ref-in-__bfq_bic_change_cgroup.patch
block-bfq-make-reparent_leaf_entity-actually-work-only-on-leaf-entities.patch
block-bfq-invoke-flush_idle_tree-after-reparent_active_queues-in-pd_offline.patch
+drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch
+gfs2-clear-ail1-list-when-gfs2-withdraws.patch
+clk-don-t-cache-errors-from-clk_ops-get_phase.patch
+clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch
+clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch
+crypto-qce-use-cryptlen-when-adding-extra-sgl.patch
+net-mlx5e-enforce-setting-of-a-single-fec-mode.patch
+s390-crypto-explicitly-memzero-stack-key-material-in.patch
+f2fs-fix-to-avoid-potential-deadlock.patch
+f2fs-fix-the-panic-in-do_checkpoint.patch
+bpf-reliably-preserve-btf_trace_xxx-types.patch
+xfs-fix-iclog-release-error-check-race-with-shutdown.patch
+f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch
+f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch
+arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch
+dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch
+memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch
+memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042
+memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140
+arm64-dts-allwinner-a64-fix-display-clock-register-r.patch
+power-supply-bq27xxx_battery-silence-deferred-probe-.patch
+clk-tegra-fix-tegra-pmc-clock-out-parents.patch
+arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch
+arm64-tegra-fix-tegra194-pcie-compatible-string.patch
+xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch
+xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch
+arm64-dts-marvell-espressobin-add-ethernet-alias.patch
+arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch
+arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch
+soc-imx-gpc-fix-power-up-sequencing.patch
+dma-coherent-fix-integer-overflow-in-the-reserved-me.patch
+rtc-88pm860x-fix-possible-race-condition.patch
+nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch
+nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch
+nfsv4.2-error-out-when-relink-swapfile.patch
+arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch
+xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch
+kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch
+f2fs-fix-to-show-norecovery-mount-option.patch
+drivers-thermal-tsens-release-device-in-success-path.patch
+phy-uniphier-usb3ss-add-pro5-support.patch
+nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch
+f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch
+f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch
+f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch
+s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch
+mips-dts-ci20-add-dt-node-for-ir-sensor.patch
+thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch
+hibernate-allow-uswsusp-to-write-to-swap.patch
+btrfs-add-rcu-locks-around-block-group-initializatio.patch
+powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch
+powerpc-maple-fix-declaration-made-after-definition.patch
+s390-cpum_sf-fix-wrong-page-count-in-error-message.patch
+nfsroot-set-tcp-as-the-default-transport-protocol.patch
+ext4-do-not-commit-super-on-read-only-bdev.patch
+um-ubd-prevent-buffer-overrun-on-command-completion.patch
+cifs-allocate-encryption-header-through-kmalloc.patch
+x86-xen-make-the-boot-cpu-idle-task-reliable.patch
+drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch
+dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch
+platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch
+mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch
+macsec-fix-null-dereference-in-macsec_upd_offload.patch
+drm-nouveau-svm-check-for-svm-initialized-before-mig.patch
+drm-nouveau-svm-fix-vma-range-check-for-migration.patch
+include-linux-swapops.h-correct-guards-for-non_swap_.patch
+percpu_counter-fix-a-data-race-at-vm_committed_as.patch
+compiler.h-fix-error-in-build_bug_on-reporting.patch
+kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch
+drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch
+leds-core-fix-warning-message-when-init_data.patch
+x86-acpi-fix-cpu-hotplug-deadlock.patch
+csky-fixup-cpu-speculative-execution-to-io-area.patch
+drm-amdkfd-kfree-the-wrong-pointer.patch
+nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch
+acpi-update-tiger-lake-acpi-device-ids.patch
+csky-fixup-get-wrong-psr-value-from-phyical-reg.patch
+f2fs-compress-fix-to-call-missing-destroy_compress_c.patch
+f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch
+f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch
+f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch
+f2fs-fix-potential-deadlock-on-compressed-quota-file.patch
+acpica-fixes-for-acpiexec-namespace-init-file.patch
+ceph-re-org-copy_file_range-and-fix-some-error-paths.patch
+mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch
+um-falloc.h-needs-to-be-directly-included-for-older-.patch
+drm-vc4-fix-hdmi-mode-validation.patch
+iommu-virtio-fix-freeing-of-incomplete-domains.patch
+iommu-vt-d-add-build-dependency-on-ioasid.patch
+iommu-vt-d-fix-mm-reference-leak.patch
+sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch
+virtio-balloon-switch-back-to-oom-handler-for-virtio.patch
+ext2-fix-empty-body-warnings-when-wextra-is-used.patch
+f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch
+f2fs-skip-gc-when-section-is-full.patch
+iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch
+iommu-vt-d-fix-page-request-descriptor-size.patch
+ext2-fix-debug-reference-to-ext2_xattr_cache.patch
+sunrpc-fix-gss_unwrap_resp_integ-again.patch
+thermal-qoriq-fix-a-compiling-issue.patch
+csky-fixup-init_fpu-compile-warning-with-__init.patch
+power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch
+libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch
+iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch
+f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch
+f2fs-fix-to-wait-all-node-page-writeback.patch
+platform-chrome-cros_ec-query-ec-protocol-version-if.patch
+drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch
--- /dev/null
+From a582783f61a6a9b82242176dea184807b853a02f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Mar 2020 11:09:12 +0100
+Subject: soc: imx: gpc: fix power up sequencing
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit e0ea2d11f8a08ba7066ff897e16c5217215d1e68 ]
+
+Currently we wait only until the PGC inverts the isolation setting
+before disabling the peripheral clocks. This doesn't ensure that the
+reset is properly propagated through the peripheral devices in the
+power domain.
+
+Wait until the PGC signals that the power up request is done and
+wait a bit for resets to propagate before disabling the clocks.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/gpc.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index 98b9d9a902ae3..90a8b2c0676ff 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -87,8 +87,8 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd)
+ static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd)
+ {
+ struct imx_pm_domain *pd = to_imx_pm_domain(genpd);
+- int i, ret, sw, sw2iso;
+- u32 val;
++ int i, ret;
++ u32 val, req;
+
+ if (pd->supply) {
+ ret = regulator_enable(pd->supply);
+@@ -107,17 +107,18 @@ static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd)
+ regmap_update_bits(pd->regmap, pd->reg_offs + GPC_PGC_CTRL_OFFS,
+ 0x1, 0x1);
+
+- /* Read ISO and ISO2SW power up delays */
+- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val);
+- sw = val & 0x3f;
+- sw2iso = (val >> 8) & 0x3f;
+-
+ /* Request GPC to power up domain */
+- val = BIT(pd->cntr_pdn_bit + 1);
+- regmap_update_bits(pd->regmap, GPC_CNTR, val, val);
++ req = BIT(pd->cntr_pdn_bit + 1);
++ regmap_update_bits(pd->regmap, GPC_CNTR, req, req);
+
+- /* Wait ISO + ISO2SW IPG clock cycles */
+- udelay(DIV_ROUND_UP(sw + sw2iso, pd->ipg_rate_mhz));
++ /* Wait for the PGC to handle the request */
++ ret = regmap_read_poll_timeout(pd->regmap, GPC_CNTR, val, !(val & req),
++ 1, 50);
++ if (ret)
++ pr_err("powerup request on domain %s timed out\n", genpd->name);
++
++ /* Wait for reset to propagate through peripherals */
++ usleep_range(5, 10);
+
+ /* Disable reset clocks for all devices in the domain */
+ for (i = 0; i < pd->num_clks; i++)
+@@ -343,6 +344,7 @@ static const struct regmap_config imx_gpc_regmap_config = {
+ .rd_table = &access_table,
+ .wr_table = &access_table,
+ .max_register = 0x2ac,
++ .fast_io = true,
+ };
+
+ static struct generic_pm_domain *imx_gpc_onecell_domains[] = {
+--
+2.20.1
+
--- /dev/null
+From 0d64f63ef34a928b13e005a80249122cf4db98b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 11:21:07 -0400
+Subject: sunrpc: Fix gss_unwrap_resp_integ() again
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 4047aa909c4a40fceebc36fff708d465a4d3c6e2 ]
+
+xdr_buf_read_mic() tries to find unused contiguous space in a
+received xdr_buf in order to linearize the checksum for the call
+to gss_verify_mic. However, the corner cases in this code are
+numerous and we seem to keep missing them. I've just hit yet
+another buffer overrun related to it.
+
+This overrun is at the end of xdr_buf_read_mic():
+
+1284 if (buf->tail[0].iov_len != 0)
+1285 mic->data = buf->tail[0].iov_base + buf->tail[0].iov_len;
+1286 else
+1287 mic->data = buf->head[0].iov_base + buf->head[0].iov_len;
+1288 __read_bytes_from_xdr_buf(&subbuf, mic->data, mic->len);
+1289 return 0;
+
+This logic assumes the transport has set the length of the tail
+based on the size of the received message. base + len is then
+supposed to be off the end of the message but still within the
+actual buffer.
+
+In fact, the length of the tail is set by the upper layer when the
+Call is encoded so that the end of the tail is actually the end of
+the allocated buffer itself. This causes the logic above to set
+mic->data to point past the end of the receive buffer.
+
+The "mic->data = head" arm of this if statement is no less fragile.
+
+As near as I can tell, this has been a problem forever. I'm not sure
+that minimizing au_rslack recently changed this pathology much.
+
+So instead, let's use a more straightforward approach: kmalloc a
+separate buffer to linearize the checksum. This is similar to
+how gss_validate() currently works.
+
+Coming back to this code, I had some trouble understanding what
+was going on. So I've cleaned up the variable naming and added
+a few comments that point back to the XDR definition in RFC 2203
+to help guide future spelunkers, including myself.
+
+As an added clean up, the functionality that was in
+xdr_buf_read_mic() is folded directly into gss_unwrap_resp_integ(),
+as that is its only caller.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/auth_gss.c | 77 +++++++++++++++++++++++++---------
+ 1 file changed, 58 insertions(+), 19 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index d6cd2a519d9fb..2dc740acb3bf3 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1935,35 +1935,69 @@ gss_unwrap_resp_auth(struct rpc_cred *cred)
+ return 0;
+ }
+
++/*
++ * RFC 2203, Section 5.3.2.2
++ *
++ * struct rpc_gss_integ_data {
++ * opaque databody_integ<>;
++ * opaque checksum<>;
++ * };
++ *
++ * struct rpc_gss_data_t {
++ * unsigned int seq_num;
++ * proc_req_arg_t arg;
++ * };
++ */
+ static int
+ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
+ struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp,
+ struct xdr_stream *xdr)
+ {
+- struct xdr_buf integ_buf, *rcv_buf = &rqstp->rq_rcv_buf;
+- u32 data_offset, mic_offset, integ_len, maj_stat;
++ struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf;
+ struct rpc_auth *auth = cred->cr_auth;
++ u32 len, offset, seqno, maj_stat;
+ struct xdr_netobj mic;
+- __be32 *p;
++ int ret;
+
+- p = xdr_inline_decode(xdr, 2 * sizeof(*p));
+- if (unlikely(!p))
++ ret = -EIO;
++ mic.data = NULL;
++
++ /* opaque databody_integ<>; */
++ if (xdr_stream_decode_u32(xdr, &len))
+ goto unwrap_failed;
+- integ_len = be32_to_cpup(p++);
+- if (integ_len & 3)
++ if (len & 3)
+ goto unwrap_failed;
+- data_offset = (u8 *)(p) - (u8 *)rcv_buf->head[0].iov_base;
+- mic_offset = integ_len + data_offset;
+- if (mic_offset > rcv_buf->len)
++ offset = rcv_buf->len - xdr_stream_remaining(xdr);
++ if (xdr_stream_decode_u32(xdr, &seqno))
+ goto unwrap_failed;
+- if (be32_to_cpup(p) != rqstp->rq_seqno)
++ if (seqno != rqstp->rq_seqno)
+ goto bad_seqno;
++ if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len))
++ goto unwrap_failed;
+
+- if (xdr_buf_subsegment(rcv_buf, &integ_buf, data_offset, integ_len))
++ /*
++ * The xdr_stream now points to the beginning of the
++ * upper layer payload, to be passed below to
++ * rpcauth_unwrap_resp_decode(). The checksum, which
++ * follows the upper layer payload in @rcv_buf, is
++ * located and parsed without updating the xdr_stream.
++ */
++
++ /* opaque checksum<>; */
++ offset += len;
++ if (xdr_decode_word(rcv_buf, offset, &len))
++ goto unwrap_failed;
++ offset += sizeof(__be32);
++ if (offset + len > rcv_buf->len)
+ goto unwrap_failed;
+- if (xdr_buf_read_mic(rcv_buf, &mic, mic_offset))
++ mic.len = len;
++ mic.data = kmalloc(len, GFP_NOFS);
++ if (!mic.data)
++ goto unwrap_failed;
++ if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len))
+ goto unwrap_failed;
+- maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic);
++
++ maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic);
+ if (maj_stat == GSS_S_CONTEXT_EXPIRED)
+ clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
+ if (maj_stat != GSS_S_COMPLETE)
+@@ -1971,16 +2005,21 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred,
+
+ auth->au_rslack = auth->au_verfsize + 2 + 1 + XDR_QUADLEN(mic.len);
+ auth->au_ralign = auth->au_verfsize + 2;
+- return 0;
++ ret = 0;
++
++out:
++ kfree(mic.data);
++ return ret;
++
+ unwrap_failed:
+ trace_rpcgss_unwrap_failed(task);
+- return -EIO;
++ goto out;
+ bad_seqno:
+- trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(p));
+- return -EIO;
++ trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno);
++ goto out;
+ bad_mic:
+ trace_rpcgss_verify_mic(task, maj_stat);
+- return -EIO;
++ goto out;
+ }
+
+ static int
+--
+2.20.1
+
--- /dev/null
+From 197c9d0b44d0fe21b1aaedcab7fb06a23892d116 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 10:24:51 -0400
+Subject: SUNRPC: fix krb5p mount to provide large enough buffer in rq_rcvsize
+
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+
+[ Upstream commit df513a7711712758b9cb1a48d86712e7e1ee03f4 ]
+
+Ever since commit 2c94b8eca1a2 ("SUNRPC: Use au_rslack when computing
+reply buffer size"). It changed how "req->rq_rcvsize" is calculated. It
+used to use au_cslack value which was nice and large and changed it to
+au_rslack value which turns out to be too small.
+
+Since 5.1, v3 mount with sec=krb5p fails against an Ontap server
+because client's receive buffer it too small.
+
+For gss krb5p, we need to account for the mic token in the verifier,
+and the wrap token in the wrap token.
+
+RFC 4121 defines:
+mic token
+Octet no Name Description
+ --------------------------------------------------------------
+ 0..1 TOK_ID Identification field. Tokens emitted by
+ GSS_GetMIC() contain the hex value 04 04
+ expressed in big-endian order in this
+ field.
+ 2 Flags Attributes field, as described in section
+ 4.2.2.
+ 3..7 Filler Contains five octets of hex value FF.
+ 8..15 SND_SEQ Sequence number field in clear text,
+ expressed in big-endian order.
+ 16..last SGN_CKSUM Checksum of the "to-be-signed" data and
+ octet 0..15, as described in section 4.2.4.
+
+that's 16bytes (GSS_KRB5_TOK_HDR_LEN) + chksum
+
+wrap token
+Octet no Name Description
+ --------------------------------------------------------------
+ 0..1 TOK_ID Identification field. Tokens emitted by
+ GSS_Wrap() contain the hex value 05 04
+ expressed in big-endian order in this
+ field.
+ 2 Flags Attributes field, as described in section
+ 4.2.2.
+ 3 Filler Contains the hex value FF.
+ 4..5 EC Contains the "extra count" field, in big-
+ endian order as described in section 4.2.3.
+ 6..7 RRC Contains the "right rotation count" in big-
+ endian order, as described in section
+ 4.2.5.
+ 8..15 SND_SEQ Sequence number field in clear text,
+ expressed in big-endian order.
+ 16..last Data Encrypted data for Wrap tokens with
+ confidentiality, or plaintext data followed
+ by the checksum for Wrap tokens without
+ confidentiality, as described in section
+ 4.2.4.
+
+Also 16bytes of header (GSS_KRB5_TOK_HDR_LEN), encrypted data, and cksum
+(other things like padding)
+
+RFC 3961 defines known cksum sizes:
+Checksum type sumtype checksum section or
+ value size reference
+ ---------------------------------------------------------------------
+ CRC32 1 4 6.1.3
+ rsa-md4 2 16 6.1.2
+ rsa-md4-des 3 24 6.2.5
+ des-mac 4 16 6.2.7
+ des-mac-k 5 8 6.2.8
+ rsa-md4-des-k 6 16 6.2.6
+ rsa-md5 7 16 6.1.1
+ rsa-md5-des 8 24 6.2.4
+ rsa-md5-des3 9 24 ??
+ sha1 (unkeyed) 10 20 ??
+ hmac-sha1-des3-kd 12 20 6.3
+ hmac-sha1-des3 13 20 ??
+ sha1 (unkeyed) 14 20 ??
+ hmac-sha1-96-aes128 15 20 [KRB5-AES]
+ hmac-sha1-96-aes256 16 20 [KRB5-AES]
+ [reserved] 0x8003 ? [GSS-KRB5]
+
+Linux kernel now mainly supports type 15,16 so max cksum size is 20bytes.
+(GSS_KRB5_MAX_CKSUM_LEN)
+
+Re-use already existing define of GSS_KRB5_MAX_SLACK_NEEDED that's used
+for encoding the gss_wrap tokens (same tokens are used in reply).
+
+Fixes: 2c94b8eca1a2 ("SUNRPC: Use au_rslack when computing reply buffer size")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/auth_gss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 24ca861815b1d..d6cd2a519d9fb 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -20,6 +20,7 @@
+ #include <linux/sunrpc/clnt.h>
+ #include <linux/sunrpc/auth.h>
+ #include <linux/sunrpc/auth_gss.h>
++#include <linux/sunrpc/gss_krb5.h>
+ #include <linux/sunrpc/svcauth_gss.h>
+ #include <linux/sunrpc/gss_err.h>
+ #include <linux/workqueue.h>
+@@ -1050,7 +1051,7 @@ gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
+ goto err_put_mech;
+ auth = &gss_auth->rpc_auth;
+ auth->au_cslack = GSS_CRED_SLACK >> 2;
+- auth->au_rslack = GSS_VERF_SLACK >> 2;
++ auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2;
+ auth->au_verfsize = GSS_VERF_SLACK >> 2;
+ auth->au_ralign = GSS_VERF_SLACK >> 2;
+ auth->au_flags = 0;
+--
+2.20.1
+
--- /dev/null
+From 9342f7ff93c798a12e8836efe7a2bda4f6d9709d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Mar 2020 09:27:40 +0000
+Subject: thermal/drivers/cpufreq_cooling: Fix return of cpufreq_set_cur_state
+
+From: Willy Wolff <willy.mh.wolff.ml@gmail.com>
+
+[ Upstream commit ff44f672d74178b3be19d41a169b98b3e391d4ce ]
+
+When setting the cooling device current state from userspace via sysfs,
+the operation fails by returning an -EINVAL.
+
+It appears the recent changes with the per-policy frequency QoS
+introduced a regression as reported by:
+
+ https://lkml.org/lkml/2020/3/20/599
+
+The function freq_qos_update_request returns 0 or 1 describing update
+effectiveness, and a negative error code on failure. However,
+cpufreq_set_cur_state returns 0 on success or an error code otherwise.
+
+Consider the QoS update as successful if the function does not return
+an error.
+
+Fixes: 3000ce3c52f8b ("cpufreq: Use per-policy frequency QoS")
+Signed-off-by: Willy Wolff <willy.mh.wolff.ml@gmail.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200321092740.7vvwfxsebcrznydh@macmini.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpufreq_cooling.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c
+index fe83d7a210d47..af55ac08e1bd5 100644
+--- a/drivers/thermal/cpufreq_cooling.c
++++ b/drivers/thermal/cpufreq_cooling.c
+@@ -431,6 +431,7 @@ static int cpufreq_set_cur_state(struct thermal_cooling_device *cdev,
+ unsigned long state)
+ {
+ struct cpufreq_cooling_device *cpufreq_cdev = cdev->devdata;
++ int ret;
+
+ /* Request state should be less than max_level */
+ if (WARN_ON(state > cpufreq_cdev->max_level))
+@@ -442,8 +443,9 @@ static int cpufreq_set_cur_state(struct thermal_cooling_device *cdev,
+
+ cpufreq_cdev->cpufreq_state = state;
+
+- return freq_qos_update_request(&cpufreq_cdev->qos_req,
+- get_state_freq(cpufreq_cdev, state));
++ ret = freq_qos_update_request(&cpufreq_cdev->qos_req,
++ get_state_freq(cpufreq_cdev, state));
++ return ret < 0 ? ret : 0;
+ }
+
+ /* Bind cpufreq callbacks to thermal cooling device ops */
+--
+2.20.1
+
--- /dev/null
+From f7664afb0f6061d78e13b397a665380efda3d8ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 16:46:41 +0800
+Subject: thermal: qoriq: Fix a compiling issue
+
+From: Yuantian Tang <andy.tang@nxp.com>
+
+[ Upstream commit cbe259fd80b7b02fba0dad79d8fdda8b70a8b963 ]
+
+Qoriq thermal driver is used by both PowerPC and ARM architecture.
+When built for PowerPC architecture, it reports error:
+undefined reference to `.__devm_regmap_init_mmio_clk'
+To fix it, select config REGMAP_MMIO.
+
+Fixes: 4316237bd627 (thermal: qoriq: Convert driver to use regmap API)
+Signed-off-by: Yuantian Tang <andy.tang@nxp.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200303084641.35687-1-andy.tang@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
+index 5a05db5438d60..5a0df0e54ce3e 100644
+--- a/drivers/thermal/Kconfig
++++ b/drivers/thermal/Kconfig
+@@ -265,6 +265,7 @@ config QORIQ_THERMAL
+ tristate "QorIQ Thermal Monitoring Unit"
+ depends on THERMAL_OF
+ depends on HAS_IOMEM
++ select REGMAP_MMIO
+ help
+ Support for Thermal Monitoring Unit (TMU) found on QorIQ platforms.
+ It supports one critical trip point and one passive trip point. The
+--
+2.20.1
+
--- /dev/null
+From f808df4bf46a7e3b4bfcc75e6cb0e16d1ead1600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2020 17:35:34 +0000
+Subject: um: falloc.h needs to be directly included for older libc
+
+From: Alan Maguire <alan.maguire@oracle.com>
+
+[ Upstream commit 35f3401317a3b26aa01fde8facfd320f2628fdcc ]
+
+When building UML with glibc 2.17 installed, compilation
+of arch/um/os-Linux/file.c fails due to failure to find
+FALLOC_FL_PUNCH_HOLE and FALLOC_FL_KEEP_SIZE definitions.
+
+It appears that /usr/include/bits/fcntl-linux.h (indirectly
+included by /usr/include/fcntl.h) does not include falloc.h
+with an older glibc, whereas a more up-to-date version
+does.
+
+Adding the direct include to file.c resolves the issue
+and does not cause problems for more recent glibc.
+
+Fixes: 50109b5a03b4 ("um: Add support for DISCARD in the UBD Driver")
+Cc: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
+Reviewed-by: Brendan Higgins <brendanhiggins@google.com>
+Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/file.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c
+index fbda10535dab0..5c819f89b8c21 100644
+--- a/arch/um/os-Linux/file.c
++++ b/arch/um/os-Linux/file.c
+@@ -8,6 +8,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ #include <signal.h>
++#include <linux/falloc.h>
+ #include <sys/ioctl.h>
+ #include <sys/mount.h>
+ #include <sys/socket.h>
+--
+2.20.1
+
--- /dev/null
+From e3335a72b855988cf18937a0c0cea6775d26e272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Mar 2020 20:45:06 -0400
+Subject: um: ubd: Prevent buffer overrun on command completion
+
+From: Gabriel Krisman Bertazi <krisman@collabora.com>
+
+[ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ]
+
+On the hypervisor side, when completing commands and the pipe is full,
+we retry writing only the entries that failed, by offsetting
+io_req_buffer, but we don't reduce the number of bytes written, which
+can cause a buffer overrun of io_req_buffer, and write garbage to the
+pipe.
+
+Cc: Martyn Welch <martyn.welch@collabora.com>
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/ubd_kern.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
+index 247f95da057b5..eca45ad2166c9 100644
+--- a/arch/um/drivers/ubd_kern.c
++++ b/arch/um/drivers/ubd_kern.c
+@@ -1607,7 +1607,9 @@ int io_thread(void *arg)
+ written = 0;
+
+ do {
+- res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n);
++ res = os_write_file(kernel_fd,
++ ((char *) io_req_buffer) + written,
++ n - written);
+ if (res >= 0) {
+ written += res;
+ }
+--
+2.20.1
+
--- /dev/null
+From e5093a70dd4ed006eaa7c0472a108794d03a5957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 17:34:02 +0100
+Subject: virtio-balloon: Switch back to OOM handler for
+ VIRTIO_BALLOON_F_DEFLATE_ON_OOM
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit 5a6b4cc5b7a1892a8d7f63d6cbac6e0ae2a9d031 ]
+
+Commit 71994620bb25 ("virtio_balloon: replace oom notifier with shrinker")
+changed the behavior when deflation happens automatically. Instead of
+deflating when called by the OOM handler, the shrinker is used.
+
+However, the balloon is not simply some slab cache that should be
+shrunk when under memory pressure. The shrinker does not have a concept of
+priorities, so this behavior cannot be configured.
+
+There was a report that this results in undesired side effects when
+inflating the balloon to shrink the page cache. [1]
+ "When inflating the balloon against page cache (i.e. no free memory
+ remains) vmscan.c will both shrink page cache, but also invoke the
+ shrinkers -- including the balloon's shrinker. So the balloon
+ driver allocates memory which requires reclaim, vmscan gets this
+ memory by shrinking the balloon, and then the driver adds the
+ memory back to the balloon. Basically a busy no-op."
+
+The name "deflate on OOM" makes it pretty clear when deflation should
+happen - after other approaches to reclaim memory failed, not while
+reclaiming. This allows to minimize the footprint of a guest - memory
+will only be taken out of the balloon when really needed.
+
+Especially, a drop_slab() will result in the whole balloon getting
+deflated - undesired. While handling it via the OOM handler might not be
+perfect, it keeps existing behavior. If we want a different behavior, then
+we need a new feature bit and document it properly (although, there should
+be a clear use case and the intended effects should be well described).
+
+Keep using the shrinker for VIRTIO_BALLOON_F_FREE_PAGE_HINT, because
+this has no such side effects. Always register the shrinker with
+VIRTIO_BALLOON_F_FREE_PAGE_HINT now. We are always allowed to reuse free
+pages that are still to be processed by the guest. The hypervisor takes
+care of identifying and resolving possible races between processing a
+hinting request and the guest reusing a page.
+
+In contrast to pre commit 71994620bb25 ("virtio_balloon: replace oom
+notifier with shrinker"), don't add a moodule parameter to configure the
+number of pages to deflate on OOM. Can be re-added if really needed.
+Also, pay attention that leak_balloon() returns the number of 4k pages -
+convert it properly in virtio_balloon_oom_notify().
+
+Note1: using the OOM handler is frowned upon, but it really is what we
+ need for this feature.
+
+Note2: without VIRTIO_BALLOON_F_MUST_TELL_HOST (iow, always with QEMU) we
+ could actually skip sending deflation requests to our hypervisor,
+ making the OOM path *very* simple. Besically freeing pages and
+ updating the balloon. If the communication with the host ever
+ becomes a problem on this call path.
+
+[1] https://www.spinics.net/lists/linux-virtualization/msg40863.html
+
+Test report by Tyler Sanderson:
+
+Test setup: VM with 16 CPU, 64GB RAM. Running Debian 10. We have a 42
+GB file full of random bytes that we continually cat to /dev/null.
+This fills the page cache as the file is read. Meanwhile we trigger
+the balloon to inflate, with a target size of 53 GB. This setup causes
+the balloon inflation to pressure the page cache as the page cache is
+also trying to grow. Afterwards we shrink the balloon back to zero (so
+total deflate = total inflate).
+
+Without patch (kernel 4.19.0-5):
+Inflation never reaches the target until we stop the "cat file >
+/dev/null" process. Total inflation time was 542 seconds. The longest
+period that made no net forward progress was 315 seconds (see attached
+graph).
+Result of "grep balloon /proc/vmstat" after the test:
+balloon_inflate 154828377
+balloon_deflate 154828377
+
+With patch (kernel 5.6.0-rc4+):
+Total inflation duration was 63 seconds. No deflate-queue activity
+occurs when pressuring the page-cache.
+Result of "grep balloon /proc/vmstat" after the test:
+balloon_inflate 12968539
+balloon_deflate 12968539
+
+Conclusion: This patch fixes the issue. In the test it reduced
+inflate/deflate activity by 12x, and reduced inflation time by 8.6x.
+But more importantly, if we hadn't killed the "grep balloon
+/proc/vmstat" process then, without the patch, the inflation process
+would never reach the target.
+
+Attached [1] is a png of a graph showing the problematic behavior without
+this patch. It shows deflate-queue activity increasing linearly while
+balloon size stays constant over the course of more than 8 minutes of
+the test.
+
+[1] https://lore.kernel.org/linux-mm/CAJuQAmphPcfew1v_EOgAdSFiprzjiZjmOf3iJDmFX0gD6b9TYQ@mail.gmail.com/2-without_patch.png
+
+Full test report and discussion [2]:
+
+[2] https://lore.kernel.org/r/CAJuQAmphPcfew1v_EOgAdSFiprzjiZjmOf3iJDmFX0gD6b9TYQ@mail.gmail.com
+
+Tested-by: Tyler Sanderson <tysand@google.com>
+Reported-by: Tyler Sanderson <tysand@google.com>
+Cc: Michael S. Tsirkin <mst@redhat.com>
+Cc: Wei Wang <wei.w.wang@intel.com>
+Cc: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Nadav Amit <namit@vmware.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Link: https://lore.kernel.org/r/20200205163402.42627-4-david@redhat.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_balloon.c | 107 +++++++++++++-------------------
+ 1 file changed, 44 insertions(+), 63 deletions(-)
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 341458fd95ca4..44375a22307b3 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -14,6 +14,7 @@
+ #include <linux/slab.h>
+ #include <linux/module.h>
+ #include <linux/balloon_compaction.h>
++#include <linux/oom.h>
+ #include <linux/wait.h>
+ #include <linux/mm.h>
+ #include <linux/mount.h>
+@@ -27,7 +28,9 @@
+ */
+ #define VIRTIO_BALLOON_PAGES_PER_PAGE (unsigned)(PAGE_SIZE >> VIRTIO_BALLOON_PFN_SHIFT)
+ #define VIRTIO_BALLOON_ARRAY_PFNS_MAX 256
+-#define VIRTBALLOON_OOM_NOTIFY_PRIORITY 80
++/* Maximum number of (4k) pages to deflate on OOM notifications. */
++#define VIRTIO_BALLOON_OOM_NR_PAGES 256
++#define VIRTIO_BALLOON_OOM_NOTIFY_PRIORITY 80
+
+ #define VIRTIO_BALLOON_FREE_PAGE_ALLOC_FLAG (__GFP_NORETRY | __GFP_NOWARN | \
+ __GFP_NOMEMALLOC)
+@@ -112,8 +115,11 @@ struct virtio_balloon {
+ /* Memory statistics */
+ struct virtio_balloon_stat stats[VIRTIO_BALLOON_S_NR];
+
+- /* To register a shrinker to shrink memory upon memory pressure */
++ /* Shrinker to return free pages - VIRTIO_BALLOON_F_FREE_PAGE_HINT */
+ struct shrinker shrinker;
++
++ /* OOM notifier to deflate on OOM - VIRTIO_BALLOON_F_DEFLATE_ON_OOM */
++ struct notifier_block oom_nb;
+ };
+
+ static struct virtio_device_id id_table[] = {
+@@ -788,50 +794,13 @@ static unsigned long shrink_free_pages(struct virtio_balloon *vb,
+ return blocks_freed * VIRTIO_BALLOON_HINT_BLOCK_PAGES;
+ }
+
+-static unsigned long leak_balloon_pages(struct virtio_balloon *vb,
+- unsigned long pages_to_free)
+-{
+- return leak_balloon(vb, pages_to_free * VIRTIO_BALLOON_PAGES_PER_PAGE) /
+- VIRTIO_BALLOON_PAGES_PER_PAGE;
+-}
+-
+-static unsigned long shrink_balloon_pages(struct virtio_balloon *vb,
+- unsigned long pages_to_free)
+-{
+- unsigned long pages_freed = 0;
+-
+- /*
+- * One invocation of leak_balloon can deflate at most
+- * VIRTIO_BALLOON_ARRAY_PFNS_MAX balloon pages, so we call it
+- * multiple times to deflate pages till reaching pages_to_free.
+- */
+- while (vb->num_pages && pages_freed < pages_to_free)
+- pages_freed += leak_balloon_pages(vb,
+- pages_to_free - pages_freed);
+-
+- update_balloon_size(vb);
+-
+- return pages_freed;
+-}
+-
+ static unsigned long virtio_balloon_shrinker_scan(struct shrinker *shrinker,
+ struct shrink_control *sc)
+ {
+- unsigned long pages_to_free, pages_freed = 0;
+ struct virtio_balloon *vb = container_of(shrinker,
+ struct virtio_balloon, shrinker);
+
+- pages_to_free = sc->nr_to_scan;
+-
+- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
+- pages_freed = shrink_free_pages(vb, pages_to_free);
+-
+- if (pages_freed >= pages_to_free)
+- return pages_freed;
+-
+- pages_freed += shrink_balloon_pages(vb, pages_to_free - pages_freed);
+-
+- return pages_freed;
++ return shrink_free_pages(vb, sc->nr_to_scan);
+ }
+
+ static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker,
+@@ -839,26 +808,22 @@ static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker,
+ {
+ struct virtio_balloon *vb = container_of(shrinker,
+ struct virtio_balloon, shrinker);
+- unsigned long count;
+-
+- count = vb->num_pages / VIRTIO_BALLOON_PAGES_PER_PAGE;
+- count += vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES;
+
+- return count;
++ return vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES;
+ }
+
+-static void virtio_balloon_unregister_shrinker(struct virtio_balloon *vb)
++static int virtio_balloon_oom_notify(struct notifier_block *nb,
++ unsigned long dummy, void *parm)
+ {
+- unregister_shrinker(&vb->shrinker);
+-}
++ struct virtio_balloon *vb = container_of(nb,
++ struct virtio_balloon, oom_nb);
++ unsigned long *freed = parm;
+
+-static int virtio_balloon_register_shrinker(struct virtio_balloon *vb)
+-{
+- vb->shrinker.scan_objects = virtio_balloon_shrinker_scan;
+- vb->shrinker.count_objects = virtio_balloon_shrinker_count;
+- vb->shrinker.seeks = DEFAULT_SEEKS;
++ *freed += leak_balloon(vb, VIRTIO_BALLOON_OOM_NR_PAGES) /
++ VIRTIO_BALLOON_PAGES_PER_PAGE;
++ update_balloon_size(vb);
+
+- return register_shrinker(&vb->shrinker);
++ return NOTIFY_OK;
+ }
+
+ static int virtballoon_probe(struct virtio_device *vdev)
+@@ -935,22 +900,35 @@ static int virtballoon_probe(struct virtio_device *vdev)
+ virtio_cwrite(vb->vdev, struct virtio_balloon_config,
+ poison_val, &poison_val);
+ }
+- }
+- /*
+- * We continue to use VIRTIO_BALLOON_F_DEFLATE_ON_OOM to decide if a
+- * shrinker needs to be registered to relieve memory pressure.
+- */
+- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) {
+- err = virtio_balloon_register_shrinker(vb);
++
++ /*
++ * We're allowed to reuse any free pages, even if they are
++ * still to be processed by the host.
++ */
++ vb->shrinker.scan_objects = virtio_balloon_shrinker_scan;
++ vb->shrinker.count_objects = virtio_balloon_shrinker_count;
++ vb->shrinker.seeks = DEFAULT_SEEKS;
++ err = register_shrinker(&vb->shrinker);
+ if (err)
+ goto out_del_balloon_wq;
+ }
++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) {
++ vb->oom_nb.notifier_call = virtio_balloon_oom_notify;
++ vb->oom_nb.priority = VIRTIO_BALLOON_OOM_NOTIFY_PRIORITY;
++ err = register_oom_notifier(&vb->oom_nb);
++ if (err < 0)
++ goto out_unregister_shrinker;
++ }
++
+ virtio_device_ready(vdev);
+
+ if (towards_target(vb))
+ virtballoon_changed(vdev);
+ return 0;
+
++out_unregister_shrinker:
++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
++ unregister_shrinker(&vb->shrinker);
+ out_del_balloon_wq:
+ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
+ destroy_workqueue(vb->balloon_wq);
+@@ -989,8 +967,11 @@ static void virtballoon_remove(struct virtio_device *vdev)
+ {
+ struct virtio_balloon *vb = vdev->priv;
+
+- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
+- virtio_balloon_unregister_shrinker(vb);
++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM))
++ unregister_oom_notifier(&vb->oom_nb);
++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT))
++ unregister_shrinker(&vb->shrinker);
++
+ spin_lock_irq(&vb->stop_update_lock);
+ vb->stop_update = true;
+ spin_unlock_irq(&vb->stop_update_lock);
+--
+2.20.1
+
--- /dev/null
+From 4caa0c97c8e5c498468d44949bbc5954b5dc288d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Apr 2020 10:03:45 -0400
+Subject: x86: ACPI: fix CPU hotplug deadlock
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 696ac2e3bf267f5a2b2ed7d34e64131f2287d0ad ]
+
+Similar to commit 0266d81e9bf5 ("acpi/processor: Prevent cpu hotplug
+deadlock") except this is for acpi_processor_ffh_cstate_probe():
+
+"The problem is that the work is scheduled on the current CPU from the
+hotplug thread associated with that CPU.
+
+It's not required to invoke these functions via the workqueue because
+the hotplug thread runs on the target CPU already.
+
+Check whether current is a per cpu thread pinned on the target CPU and
+invoke the function directly to avoid the workqueue."
+
+ WARNING: possible circular locking dependency detected
+ ------------------------------------------------------
+ cpuhp/1/15 is trying to acquire lock:
+ ffffc90003447a28 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: __flush_work+0x4c6/0x630
+
+ but task is already holding lock:
+ ffffffffafa1c0e8 (cpuidle_lock){+.+.}-{3:3}, at: cpuidle_pause_and_lock+0x17/0x20
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (cpu_hotplug_lock){++++}-{0:0}:
+ cpus_read_lock+0x3e/0xc0
+ irq_calc_affinity_vectors+0x5f/0x91
+ __pci_enable_msix_range+0x10f/0x9a0
+ pci_alloc_irq_vectors_affinity+0x13e/0x1f0
+ pci_alloc_irq_vectors_affinity at drivers/pci/msi.c:1208
+ pqi_ctrl_init+0x72f/0x1618 [smartpqi]
+ pqi_pci_probe.cold.63+0x882/0x892 [smartpqi]
+ local_pci_probe+0x7a/0xc0
+ work_for_cpu_fn+0x2e/0x50
+ process_one_work+0x57e/0xb90
+ worker_thread+0x363/0x5b0
+ kthread+0x1f4/0x220
+ ret_from_fork+0x27/0x50
+
+ -> #0 ((work_completion)(&wfc.work)){+.+.}-{0:0}:
+ __lock_acquire+0x2244/0x32a0
+ lock_acquire+0x1a2/0x680
+ __flush_work+0x4e6/0x630
+ work_on_cpu+0x114/0x160
+ acpi_processor_ffh_cstate_probe+0x129/0x250
+ acpi_processor_evaluate_cst+0x4c8/0x580
+ acpi_processor_get_power_info+0x86/0x740
+ acpi_processor_hotplug+0xc3/0x140
+ acpi_soft_cpu_online+0x102/0x1d0
+ cpuhp_invoke_callback+0x197/0x1120
+ cpuhp_thread_fun+0x252/0x2f0
+ smpboot_thread_fn+0x255/0x440
+ kthread+0x1f4/0x220
+ ret_from_fork+0x27/0x50
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ (work_completion)(&wfc.work) --> cpuhp_state-up --> cpuidle_lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(cpuidle_lock);
+ lock(cpuhp_state-up);
+ lock(cpuidle_lock);
+ lock((work_completion)(&wfc.work));
+
+ *** DEADLOCK ***
+
+ 3 locks held by cpuhp/1/15:
+ #0: ffffffffaf51ab10 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x69/0x2f0
+ #1: ffffffffaf51ad40 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x69/0x2f0
+ #2: ffffffffafa1c0e8 (cpuidle_lock){+.+.}-{3:3}, at: cpuidle_pause_and_lock+0x17/0x20
+
+ Call Trace:
+ dump_stack+0xa0/0xea
+ print_circular_bug.cold.52+0x147/0x14c
+ check_noncircular+0x295/0x2d0
+ __lock_acquire+0x2244/0x32a0
+ lock_acquire+0x1a2/0x680
+ __flush_work+0x4e6/0x630
+ work_on_cpu+0x114/0x160
+ acpi_processor_ffh_cstate_probe+0x129/0x250
+ acpi_processor_evaluate_cst+0x4c8/0x580
+ acpi_processor_get_power_info+0x86/0x740
+ acpi_processor_hotplug+0xc3/0x140
+ acpi_soft_cpu_online+0x102/0x1d0
+ cpuhp_invoke_callback+0x197/0x1120
+ cpuhp_thread_fun+0x252/0x2f0
+ smpboot_thread_fn+0x255/0x440
+ kthread+0x1f4/0x220
+ ret_from_fork+0x27/0x50
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Tested-by: Borislav Petkov <bp@suse.de>
+[ rjw: Subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/acpi/cstate.c | 3 ++-
+ drivers/acpi/processor_throttling.c | 7 -------
+ include/acpi/processor.h | 8 ++++++++
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
+index caf2edccbad2e..49ae4e1ac9cd8 100644
+--- a/arch/x86/kernel/acpi/cstate.c
++++ b/arch/x86/kernel/acpi/cstate.c
+@@ -161,7 +161,8 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+
+ /* Make sure we are running on right CPU */
+
+- retval = work_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx);
++ retval = call_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx,
++ false);
+ if (retval == 0) {
+ /* Use the hint in CST */
+ percpu_entry->states[cx->index].eax = cx->address;
+diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
+index 532a1ae3595a7..a0bd56ece3ff5 100644
+--- a/drivers/acpi/processor_throttling.c
++++ b/drivers/acpi/processor_throttling.c
+@@ -897,13 +897,6 @@ static long __acpi_processor_get_throttling(void *data)
+ return pr->throttling.acpi_processor_get_throttling(pr);
+ }
+
+-static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct)
+-{
+- if (direct || (is_percpu_thread() && cpu == smp_processor_id()))
+- return fn(arg);
+- return work_on_cpu(cpu, fn, arg);
+-}
+-
+ static int acpi_processor_get_throttling(struct acpi_processor *pr)
+ {
+ if (!pr)
+diff --git a/include/acpi/processor.h b/include/acpi/processor.h
+index 47805172e73d8..683e124ad517d 100644
+--- a/include/acpi/processor.h
++++ b/include/acpi/processor.h
+@@ -297,6 +297,14 @@ static inline void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx
+ }
+ #endif
+
++static inline int call_on_cpu(int cpu, long (*fn)(void *), void *arg,
++ bool direct)
++{
++ if (direct || (is_percpu_thread() && cpu == smp_processor_id()))
++ return fn(arg);
++ return work_on_cpu(cpu, fn, arg);
++}
++
+ /* in processor_perflib.c */
+
+ #ifdef CONFIG_CPU_FREQ
+--
+2.20.1
+
--- /dev/null
+From 8f8d2ac966ef634df023ffd0bc89f7a9a350c038 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2020 10:26:02 +0100
+Subject: x86/xen: Make the boot CPU idle task reliable
+
+From: Miroslav Benes <mbenes@suse.cz>
+
+[ Upstream commit 2f62f36e62daec43aa7b9633ef7f18e042a80bed ]
+
+The unwinder reports the boot CPU idle task's stack on XEN PV as
+unreliable, which affects at least live patching. There are two reasons
+for this. First, the task does not follow the x86 convention that its
+stack starts at the offset right below saved pt_regs. It allows the
+unwinder to easily detect the end of the stack and verify it. Second,
+startup_xen() function does not store the return address before jumping
+to xen_start_kernel() which confuses the unwinder.
+
+Amend both issues by moving the starting point of initial stack in
+startup_xen() and storing the return address before the jump, which is
+exactly what call instruction does.
+
+Signed-off-by: Miroslav Benes <mbenes@suse.cz>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/xen-head.S | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
+index 1d0cee3163e41..d63806e1ff7ae 100644
+--- a/arch/x86/xen/xen-head.S
++++ b/arch/x86/xen/xen-head.S
+@@ -35,7 +35,11 @@ SYM_CODE_START(startup_xen)
+ rep __ASM_SIZE(stos)
+
+ mov %_ASM_SI, xen_start_info
+- mov $init_thread_union+THREAD_SIZE, %_ASM_SP
++#ifdef CONFIG_X86_64
++ mov initial_stack(%rip), %rsp
++#else
++ mov pa(initial_stack), %esp
++#endif
+
+ #ifdef CONFIG_X86_64
+ /* Set up %gs.
+@@ -51,7 +55,7 @@ SYM_CODE_START(startup_xen)
+ wrmsr
+ #endif
+
+- jmp xen_start_kernel
++ call xen_start_kernel
+ SYM_CODE_END(startup_xen)
+ __FINIT
+ #endif
+--
+2.20.1
+
--- /dev/null
+From d63faea6c3e865cb29ca494fb69502dc028c2fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Feb 2020 07:36:24 -0800
+Subject: xfs: fix iclog release error check race with shutdown
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit 6b789c337a5963ae57cbc7fe9e41488c40a9b014 ]
+
+Prior to commit df732b29c8 ("xfs: call xlog_state_release_iclog with
+l_icloglock held"), xlog_state_release_iclog() always performed a
+locked check of the iclog error state before proceeding into the
+sync state processing code. As of this commit, part of
+xlog_state_release_iclog() was open-coded into
+xfs_log_release_iclog() and as a result the locked error state check
+was lost.
+
+The lockless check still exists, but this doesn't account for the
+possibility of a race with a shutdown being performed by another
+task causing the iclog state to change while the original task waits
+on ->l_icloglock. This has reproduced very rarely via generic/475
+and manifests as an assert failure in __xlog_state_release_iclog()
+due to an unexpected iclog state.
+
+Restore the locked error state check in xlog_state_release_iclog()
+to ensure that an iclog state update via shutdown doesn't race with
+the iclog release state processing code.
+
+Fixes: df732b29c807 ("xfs: call xlog_state_release_iclog with l_icloglock held")
+Reported-by: Zorro Lang <zlang@redhat.com>
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_log.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index f6006d94a581e..796ff37d5bb5b 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -605,18 +605,23 @@ xfs_log_release_iclog(
+ struct xlog *log = mp->m_log;
+ bool sync;
+
+- if (iclog->ic_state == XLOG_STATE_IOERROR) {
+- xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR);
+- return -EIO;
+- }
++ if (iclog->ic_state == XLOG_STATE_IOERROR)
++ goto error;
+
+ if (atomic_dec_and_lock(&iclog->ic_refcnt, &log->l_icloglock)) {
++ if (iclog->ic_state == XLOG_STATE_IOERROR) {
++ spin_unlock(&log->l_icloglock);
++ goto error;
++ }
+ sync = __xlog_state_release_iclog(log, iclog);
+ spin_unlock(&log->l_icloglock);
+ if (sync)
+ xlog_sync(log, iclog);
+ }
+ return 0;
++error:
++ xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR);
++ return -EIO;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 8c325c74b828ee324c968456c9cb4d8c3b3c6dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Mar 2020 13:57:58 -0700
+Subject: xfs: fix incorrect test in xfs_alloc_ag_vextent_lastblock
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 77ca1eed5a7d2bf0905562eb1a15aac76bc19fe4 ]
+
+When I lifted the code in xfs_alloc_ag_vextent_lastblock out of a loop,
+I forgot to convert all the accesses to len to be pointer dereferences.
+
+Coverity-id: 1457918
+Fixes: 5113f8ec3753ed ("xfs: clean up weird while loop in xfs_alloc_ag_vextent_near")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index d8053bc96c4d2..5a130409f173e 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -1515,7 +1515,7 @@ xfs_alloc_ag_vextent_lastblock(
+ * maxlen, go to the start of this block, and skip all those smaller
+ * than minlen.
+ */
+- if (len || args->alignment > 1) {
++ if (*len || args->alignment > 1) {
+ acur->cnt->bc_ptrs[0] = 1;
+ do {
+ error = xfs_alloc_get_rec(acur->cnt, bno, len, &i);
+--
+2.20.1
+
--- /dev/null
+From 9579941a0f10210c5fb9718b84d2bffcdda79cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2020 07:43:53 -0700
+Subject: xfs: fix regression in "cleanup xfs_dir2_block_getdents"
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+[ Upstream commit 3d28e7e278913a267b1de360efcd5e5274065ce2 ]
+
+Commit 263dde869bd09 ("xfs: cleanup xfs_dir2_block_getdents") introduced
+a getdents regression, when it converted the pointer arithmetics to
+offset calculations: offset is updated in the loop already for the next
+iteration, but the updated offset value is used incorrectly in two
+places, where we should have used the not-yet-updated value.
+
+This caused for example "git clean -ffdx" failures to cleanup certain
+directory structures when running in a container.
+
+Fix the regression by making sure we use proper offset in the loop body.
+Thanks to Christoph Hellwig for suggestion how to best fix the code.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: 263dde869bd09 ("xfs: cleanup xfs_dir2_block_getdents")
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_dir2_readdir.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
+index 0d3b640cf1cce..871ec22c9aee9 100644
+--- a/fs/xfs/xfs_dir2_readdir.c
++++ b/fs/xfs/xfs_dir2_readdir.c
+@@ -147,7 +147,7 @@ xfs_dir2_block_getdents(
+ xfs_off_t cook;
+ struct xfs_da_geometry *geo = args->geo;
+ int lock_mode;
+- unsigned int offset;
++ unsigned int offset, next_offset;
+ unsigned int end;
+
+ /*
+@@ -173,9 +173,10 @@ xfs_dir2_block_getdents(
+ * Loop over the data portion of the block.
+ * Each object is a real entry (dep) or an unused one (dup).
+ */
+- offset = geo->data_entry_offset;
+ end = xfs_dir3_data_end_offset(geo, bp->b_addr);
+- while (offset < end) {
++ for (offset = geo->data_entry_offset;
++ offset < end;
++ offset = next_offset) {
+ struct xfs_dir2_data_unused *dup = bp->b_addr + offset;
+ struct xfs_dir2_data_entry *dep = bp->b_addr + offset;
+ uint8_t filetype;
+@@ -184,14 +185,15 @@ xfs_dir2_block_getdents(
+ * Unused, skip it.
+ */
+ if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) {
+- offset += be16_to_cpu(dup->length);
++ next_offset = offset + be16_to_cpu(dup->length);
+ continue;
+ }
+
+ /*
+ * Bump pointer for the next iteration.
+ */
+- offset += xfs_dir2_data_entsize(dp->i_mount, dep->namelen);
++ next_offset = offset +
++ xfs_dir2_data_entsize(dp->i_mount, dep->namelen);
+
+ /*
+ * The entry is before the desired starting point, skip it.
+--
+2.20.1
+
--- /dev/null
+From 174beb50a0d1873fd5a87e4ebdcfa451b2b1a696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 10:37:53 -0700
+Subject: xfs: fix use-after-free when aborting corrupt attr inactivation
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 496b9bcd62b0b3a160be61e3265a086f97adcbd3 ]
+
+Log the corrupt buffer before we release the buffer.
+
+Fixes: a5155b870d687 ("xfs: always log corruption errors")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_attr_inactive.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
+index bbfa6ba84dcd7..fe8f60b59ec4d 100644
+--- a/fs/xfs/xfs_attr_inactive.c
++++ b/fs/xfs/xfs_attr_inactive.c
+@@ -145,8 +145,8 @@ xfs_attr3_node_inactive(
+ * Since this code is recursive (gasp!) we must protect ourselves.
+ */
+ if (level > XFS_DA_NODE_MAXDEPTH) {
+- xfs_trans_brelse(*trans, bp); /* no locks for later trans */
+ xfs_buf_corruption_error(bp);
++ xfs_trans_brelse(*trans, bp); /* no locks for later trans */
+ return -EFSCORRUPTED;
+ }
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
