--- /dev/null
+From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 27 Oct 2020 15:01:17 -0700
+Subject: ARC: stack unwinding: avoid indefinite looping
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 328d2168ca524d501fc4b133d6be076142bd305c upstream.
+
+Currently stack unwinder is a while(1) loop which relies on the dwarf
+unwinder to signal termination, which in turn relies on dwarf info to do
+so. This in theory could cause an infinite loop if the dwarf info was
+somehow messed up or the register contents were etc.
+
+This fix thus detects the excessive looping and breaks the loop.
+
+| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached
+| CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq
+| Load average: 4.33 2.60 1.11 2/74 139
+| PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND
+| 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea]
+| 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea]
+| 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea]
+| 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri]
+| 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak]
+| 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf]
+| 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 138 115 root R 1464 0.1 2 0.1 top
+| 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak]
+| 115 1 root S 1472 0.1 1 0.0 -/bin/sh
+| 104 1 root S 1464 0.1 0 0.0 inetd
+| 1 0 root S 1456 0.1 2 0.0 init
+| 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages
+| 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta]
+| 10 2 root IW 0 0.0 1 0.0 [rcu_preempt]
+| 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve]
+| 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve]
+| 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve]
+| unwinder looping too long, aborting !
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/stacktrace.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -112,7 +112,7 @@ arc_unwind_core(struct task_struct *tsk,
+ int (*consumer_fn) (unsigned int, void *), void *arg)
+ {
+ #ifdef CONFIG_ARC_DW2_UNWIND
+- int ret = 0;
++ int ret = 0, cnt = 0;
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+@@ -132,6 +132,11 @@ arc_unwind_core(struct task_struct *tsk,
+ break;
+
+ frame_info.regs.r63 = frame_info.regs.r31;
++
++ if (cnt++ > 128) {
++ printk("unwinder looping too long, aborting !\n");
++ return 0;
++ }
+ }
+
+ return address; /* return the last address it saw */
--- /dev/null
+From 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Sun, 1 Nov 2020 18:40:16 +0100
+Subject: drm/panfrost: Fix a deadlock between the shrinker and madvise path
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d upstream.
+
+panfrost_ioctl_madvise() and panfrost_gem_purge() acquire the mappings
+and shmem locks in different orders, thus leading to a potential
+the mappings lock first.
+
+Fixes: bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept")
+Cc: <stable@vger.kernel.org>
+Cc: Christian Hewitt <christianshewitt@gmail.com>
+Reported-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201101174016.839110-1-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panfrost/panfrost_gem.c | 4 +---
+ drivers/gpu/drm/panfrost/panfrost_gem.h | 2 +-
+ drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c | 14 +++++++++++---
+ 3 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
+@@ -105,14 +105,12 @@ void panfrost_gem_mapping_put(struct pan
+ kref_put(&mapping->refcount, panfrost_gem_mapping_release);
+ }
+
+-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo)
++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo)
+ {
+ struct panfrost_gem_mapping *mapping;
+
+- mutex_lock(&bo->mappings.lock);
+ list_for_each_entry(mapping, &bo->mappings.list, node)
+ panfrost_gem_teardown_mapping(mapping);
+- mutex_unlock(&bo->mappings.lock);
+ }
+
+ int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv)
+--- a/drivers/gpu/drm/panfrost/panfrost_gem.h
++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h
+@@ -82,7 +82,7 @@ struct panfrost_gem_mapping *
+ panfrost_gem_mapping_get(struct panfrost_gem_object *bo,
+ struct panfrost_file_priv *priv);
+ void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping);
+-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo);
++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo);
+
+ void panfrost_gem_shrinker_init(struct drm_device *dev);
+ void panfrost_gem_shrinker_cleanup(struct drm_device *dev);
+--- a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c
+@@ -40,18 +40,26 @@ static bool panfrost_gem_purge(struct dr
+ {
+ struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
+ struct panfrost_gem_object *bo = to_panfrost_bo(obj);
++ bool ret = false;
+
+ if (atomic_read(&bo->gpu_usecount))
+ return false;
+
+- if (!mutex_trylock(&shmem->pages_lock))
++ if (!mutex_trylock(&bo->mappings.lock))
+ return false;
+
+- panfrost_gem_teardown_mappings(bo);
++ if (!mutex_trylock(&shmem->pages_lock))
++ goto unlock_mappings;
++
++ panfrost_gem_teardown_mappings_locked(bo);
+ drm_gem_shmem_purge_locked(obj);
++ ret = true;
+
+ mutex_unlock(&shmem->pages_lock);
+- return true;
++
++unlock_mappings:
++ mutex_unlock(&bo->mappings.lock);
++ return ret;
+ }
+
+ static unsigned long
--- /dev/null
+From b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 Mon Sep 17 00:00:00 2001
+From: Eddy Wu <itseddy0402@gmail.com>
+Date: Sat, 7 Nov 2020 14:47:22 +0800
+Subject: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
+
+From: Eddy Wu <itseddy0402@gmail.com>
+
+commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream.
+
+current->group_leader->exit_signal may change during copy_process() if
+current->real_parent exits.
+
+Move the assignment inside tasklist_lock to avoid the race.
+
+Signed-off-by: Eddy Wu <eddy_wu@trendmicro.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2100,14 +2100,9 @@ static __latent_entropy struct task_stru
+ /* ok, now we should be set up.. */
+ p->pid = pid_nr(pid);
+ if (clone_flags & CLONE_THREAD) {
+- p->exit_signal = -1;
+ p->group_leader = current->group_leader;
+ p->tgid = current->tgid;
+ } else {
+- if (clone_flags & CLONE_PARENT)
+- p->exit_signal = current->group_leader->exit_signal;
+- else
+- p->exit_signal = args->exit_signal;
+ p->group_leader = p;
+ p->tgid = p->pid;
+ }
+@@ -2152,9 +2147,14 @@ static __latent_entropy struct task_stru
+ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ p->real_parent = current->real_parent;
+ p->parent_exec_id = current->parent_exec_id;
++ if (clone_flags & CLONE_THREAD)
++ p->exit_signal = -1;
++ else
++ p->exit_signal = current->group_leader->exit_signal;
+ } else {
+ p->real_parent = current;
+ p->parent_exec_id = current->self_exec_id;
++ p->exit_signal = args->exit_signal;
+ }
+
+ klp_copy_process(p);
--- /dev/null
+From d6e36668598154820177bfd78c1621d8e6c580a2 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 21 Oct 2020 21:13:10 +0200
+Subject: PM: runtime: Drop pm_runtime_clean_up_links()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit d6e36668598154820177bfd78c1621d8e6c580a2 upstream.
+
+After commit d12544fb2aa9 ("PM: runtime: Remove link state checks in
+rpm_get/put_supplier()") nothing prevents the consumer device's
+runtime PM from acquiring additional references to the supplier
+device after pm_runtime_clean_up_links() has run (or even while it
+is running), so calling this function from __device_release_driver()
+may be pointless (or even harmful).
+
+Moreover, it ignores stateless device links, so the runtime PM
+handling of managed and stateless device links is inconsistent
+because of it, so better get rid of it entirely.
+
+Fixes: d12544fb2aa9 ("PM: runtime: Remove link state checks in rpm_get/put_supplier()")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c | 1 -
+ drivers/base/power/runtime.c | 36 ------------------------------------
+ include/linux/pm_runtime.h | 2 --
+ 3 files changed, 39 deletions(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -1121,7 +1121,6 @@ static void __device_release_driver(stru
+ }
+
+ pm_runtime_get_sync(dev);
+- pm_runtime_clean_up_links(dev);
+
+ driver_sysfs_remove(dev);
+
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1616,42 +1616,6 @@ void pm_runtime_remove(struct device *de
+ }
+
+ /**
+- * pm_runtime_clean_up_links - Prepare links to consumers for driver removal.
+- * @dev: Device whose driver is going to be removed.
+- *
+- * Check links from this device to any consumers and if any of them have active
+- * runtime PM references to the device, drop the usage counter of the device
+- * (as many times as needed).
+- *
+- * Links with the DL_FLAG_MANAGED flag unset are ignored.
+- *
+- * Since the device is guaranteed to be runtime-active at the point this is
+- * called, nothing else needs to be done here.
+- *
+- * Moreover, this is called after device_links_busy() has returned 'false', so
+- * the status of each link is guaranteed to be DL_STATE_SUPPLIER_UNBIND and
+- * therefore rpm_active can't be manipulated concurrently.
+- */
+-void pm_runtime_clean_up_links(struct device *dev)
+-{
+- struct device_link *link;
+- int idx;
+-
+- idx = device_links_read_lock();
+-
+- list_for_each_entry_rcu(link, &dev->links.consumers, s_node,
+- device_links_read_lock_held()) {
+- if (!(link->flags & DL_FLAG_MANAGED))
+- continue;
+-
+- while (refcount_dec_not_one(&link->rpm_active))
+- pm_runtime_put_noidle(dev);
+- }
+-
+- device_links_read_unlock(idx);
+-}
+-
+-/**
+ * pm_runtime_get_suppliers - Resume and reference-count supplier devices.
+ * @dev: Consumer device.
+ */
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -54,7 +54,6 @@ extern u64 pm_runtime_autosuspend_expira
+ extern void pm_runtime_update_max_time_suspended(struct device *dev,
+ s64 delta_ns);
+ extern void pm_runtime_set_memalloc_noio(struct device *dev, bool enable);
+-extern void pm_runtime_clean_up_links(struct device *dev);
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+@@ -173,7 +172,6 @@ static inline u64 pm_runtime_autosuspend
+ struct device *dev) { return 0; }
+ static inline void pm_runtime_set_memalloc_noio(struct device *dev,
+ bool enable){}
+-static inline void pm_runtime_clean_up_links(struct device *dev) {}
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
--- /dev/null
+From e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 21 Oct 2020 21:12:15 +0200
+Subject: PM: runtime: Drop runtime PM references to supplier on link removal
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 upstream.
+
+While removing a device link, drop the supplier device's runtime PM
+usage counter as many times as needed to drop all of the runtime PM
+references to it from the consumer in addition to dropping the
+consumer's link count.
+
+Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: 5.1+ <stable@vger.kernel.org> # 5.1+
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/core.c | 6 ++----
+ drivers/base/power/runtime.c | 21 ++++++++++++++++++++-
+ include/linux/pm_runtime.h | 4 ++--
+ 3 files changed, 24 insertions(+), 7 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -454,8 +454,7 @@ static void __device_link_del(struct kre
+ dev_dbg(link->consumer, "Dropping the link to %s\n",
+ dev_name(link->supplier));
+
+- if (link->flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_drop_link(link->consumer);
++ pm_runtime_drop_link(link);
+
+ list_del_rcu(&link->s_node);
+ list_del_rcu(&link->c_node);
+@@ -469,8 +468,7 @@ static void __device_link_del(struct kre
+ dev_info(link->consumer, "Dropping the link to %s\n",
+ dev_name(link->supplier));
+
+- if (link->flags & DL_FLAG_PM_RUNTIME)
+- pm_runtime_drop_link(link->consumer);
++ pm_runtime_drop_link(link);
+
+ list_del(&link->s_node);
+ list_del(&link->c_node);
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -1702,7 +1702,7 @@ void pm_runtime_new_link(struct device *
+ spin_unlock_irq(&dev->power.lock);
+ }
+
+-void pm_runtime_drop_link(struct device *dev)
++static void pm_runtime_drop_link_count(struct device *dev)
+ {
+ spin_lock_irq(&dev->power.lock);
+ WARN_ON(dev->power.links_count == 0);
+@@ -1710,6 +1710,25 @@ void pm_runtime_drop_link(struct device
+ spin_unlock_irq(&dev->power.lock);
+ }
+
++/**
++ * pm_runtime_drop_link - Prepare for device link removal.
++ * @link: Device link going away.
++ *
++ * Drop the link count of the consumer end of @link and decrement the supplier
++ * device's runtime PM usage counter as many times as needed to drop all of the
++ * PM runtime reference to it from the consumer.
++ */
++void pm_runtime_drop_link(struct device_link *link)
++{
++ if (!(link->flags & DL_FLAG_PM_RUNTIME))
++ return;
++
++ pm_runtime_drop_link_count(link->consumer);
++
++ while (refcount_dec_not_one(&link->rpm_active))
++ pm_runtime_put(link->supplier);
++}
++
+ static bool pm_runtime_need_not_resume(struct device *dev)
+ {
+ return atomic_read(&dev->power.usage_count) <= 1 &&
+--- a/include/linux/pm_runtime.h
++++ b/include/linux/pm_runtime.h
+@@ -58,7 +58,7 @@ extern void pm_runtime_clean_up_links(st
+ extern void pm_runtime_get_suppliers(struct device *dev);
+ extern void pm_runtime_put_suppliers(struct device *dev);
+ extern void pm_runtime_new_link(struct device *dev);
+-extern void pm_runtime_drop_link(struct device *dev);
++extern void pm_runtime_drop_link(struct device_link *link);
+
+ static inline void pm_suspend_ignore_children(struct device *dev, bool enable)
+ {
+@@ -177,7 +177,7 @@ static inline void pm_runtime_clean_up_l
+ static inline void pm_runtime_get_suppliers(struct device *dev) {}
+ static inline void pm_runtime_put_suppliers(struct device *dev) {}
+ static inline void pm_runtime_new_link(struct device *dev) {}
+-static inline void pm_runtime_drop_link(struct device *dev) {}
++static inline void pm_runtime_drop_link(struct device_link *link) {}
+
+ #endif /* !CONFIG_PM */
+
--- /dev/null
+From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 22 Oct 2020 17:38:22 +0200
+Subject: PM: runtime: Resume the device earlier in __device_release_driver()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream.
+
+Since the device is resumed from runtime-suspend in
+__device_release_driver() anyway, it is better to do that before
+looking for busy managed device links from it to consumers, because
+if there are any, device_links_unbind_consumers() will be called
+and it will cause the consumer devices' drivers to unbind, so the
+consumer devices will be runtime-resumed. In turn, resuming each
+consumer device will cause the supplier to be resumed and when the
+runtime PM references from the given consumer to it are dropped, it
+may be suspended. Then, the runtime-resume of the next consumer
+will cause the supplier to resume again and so on.
+
+Update the code accordingly.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
+Cc: All applicable <stable@vger.kernel.org> # All applicable
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -1105,6 +1105,8 @@ static void __device_release_driver(stru
+
+ drv = dev->driver;
+ if (drv) {
++ pm_runtime_get_sync(dev);
++
+ while (device_links_busy(dev)) {
+ __device_driver_unlock(dev, parent);
+
+@@ -1116,12 +1118,12 @@ static void __device_release_driver(stru
+ * have released the driver successfully while this one
+ * was waiting, so check for that.
+ */
+- if (dev->driver != drv)
++ if (dev->driver != drv) {
++ pm_runtime_put(dev);
+ return;
++ }
+ }
+
+- pm_runtime_get_sync(dev);
+-
+ driver_sysfs_remove(dev);
+
+ if (dev->bus)
--- /dev/null
+From 5b35047eb467c8cdd38a31beb9ac109221777843 Mon Sep 17 00:00:00 2001
+From: Harald Freudenberger <freude@linux.ibm.com>
+Date: Tue, 15 Sep 2020 11:00:17 +0200
+Subject: s390/pkey: fix paes selftest failure with paes and pkey static build
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+commit 5b35047eb467c8cdd38a31beb9ac109221777843 upstream.
+
+When both the paes and the pkey kernel module are statically build
+into the kernel, the paes cipher selftests run before the pkey
+kernel module is initialized. So a static variable set in the pkey
+init function and used in the pkey_clr2protkey function is not
+initialized when the paes cipher's selftests request to call pckmo for
+transforming a clear key value into a protected key.
+
+This patch moves the initial setup of the static variable into
+the function pck_clr2protkey. So it's possible, to use the function
+for transforming a clear to a protected key even before the pkey
+init function has been called and the paes selftests may run
+successful.
+
+Reported-by: Alexander Egorenkov <Alexander.Egorenkov@ibm.com>
+Cc: <stable@vger.kernel.org> # 4.20
+Fixes: f822ad2c2c03 ("s390/pkey: move pckmo subfunction available checks away from module init")
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/crypto/pkey_api.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/drivers/s390/crypto/pkey_api.c
++++ b/drivers/s390/crypto/pkey_api.c
+@@ -33,9 +33,6 @@ MODULE_DESCRIPTION("s390 protected key i
+ #define KEYBLOBBUFSIZE 8192 /* key buffer size used for internal processing */
+ #define MAXAPQNSINLIST 64 /* max 64 apqns within a apqn list */
+
+-/* mask of available pckmo subfunctions, fetched once at module init */
+-static cpacf_mask_t pckmo_functions;
+-
+ /*
+ * debug feature data and functions
+ */
+@@ -78,6 +75,9 @@ static int pkey_clr2protkey(u32 keytype,
+ const struct pkey_clrkey *clrkey,
+ struct pkey_protkey *protkey)
+ {
++ /* mask of available pckmo subfunctions */
++ static cpacf_mask_t pckmo_functions;
++
+ long fc;
+ int keysize;
+ u8 paramblock[64];
+@@ -101,11 +101,13 @@ static int pkey_clr2protkey(u32 keytype,
+ return -EINVAL;
+ }
+
+- /*
+- * Check if the needed pckmo subfunction is available.
+- * These subfunctions can be enabled/disabled by customers
+- * in the LPAR profile or may even change on the fly.
+- */
++ /* Did we already check for PCKMO ? */
++ if (!pckmo_functions.bytes[0]) {
++ /* no, so check now */
++ if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
++ return -ENODEV;
++ }
++ /* check for the pckmo subfunction we need now */
+ if (!cpacf_test_func(&pckmo_functions, fc)) {
+ DEBUG_ERR("%s pckmo functions not available\n", __func__);
+ return -ENODEV;
+@@ -1504,7 +1506,7 @@ static struct miscdevice pkey_dev = {
+ */
+ static int __init pkey_init(void)
+ {
+- cpacf_mask_t kmc_functions;
++ cpacf_mask_t func_mask;
+
+ /*
+ * The pckmo instruction should be available - even if we don't
+@@ -1512,15 +1514,15 @@ static int __init pkey_init(void)
+ * is also the minimum level for the kmc instructions which
+ * are able to work with protected keys.
+ */
+- if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
++ if (!cpacf_query(CPACF_PCKMO, &func_mask))
+ return -ENODEV;
+
+ /* check for kmc instructions available */
+- if (!cpacf_query(CPACF_KMC, &kmc_functions))
++ if (!cpacf_query(CPACF_KMC, &func_mask))
+ return -ENODEV;
+- if (!cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_128) ||
+- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_192) ||
+- !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_256))
++ if (!cpacf_test_func(&func_mask, CPACF_KMC_PAES_128) ||
++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_192) ||
++ !cpacf_test_func(&func_mask, CPACF_KMC_PAES_256))
+ return -ENODEV;
+
+ pkey_debug_init();
--- /dev/null
+From 912ab37c798770f21b182d656937072b58553378 Mon Sep 17 00:00:00 2001
+From: Claire Chang <tientzu@chromium.org>
+Date: Mon, 2 Nov 2020 20:07:49 +0800
+Subject: serial: 8250_mtk: Fix uart_get_baud_rate warning
+
+From: Claire Chang <tientzu@chromium.org>
+
+commit 912ab37c798770f21b182d656937072b58553378 upstream.
+
+Mediatek 8250 port supports speed higher than uartclk / 16. If the baud
+rates in both the new and the old termios setting are higher than
+uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered.
+Passing NULL as the old termios so uart_get_baud_rate() will use
+uartclk / 16 - 1 as the new baud rate which will be replaced by the
+original baud rate later by tty_termios_encode_baud_rate() in
+mtk8250_set_termios().
+
+Fixes: 551e553f0d4a ("serial: 8250_mtk: Fix high-speed baud rates clamping")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Link: https://lore.kernel.org/r/20201102120749.374458-1-tientzu@chromium.org
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_mtk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -316,7 +316,7 @@ mtk8250_set_termios(struct uart_port *po
+ */
+ baud = tty_termios_baud_rate(termios);
+
+- serial8250_do_set_termios(port, termios, old);
++ serial8250_do_set_termios(port, termios, NULL);
+
+ tty_termios_encode_baud_rate(termios, baud, baud);
+
--- /dev/null
+From 0c5fc92622ed5531ff324b20f014e9e3092f0187 Mon Sep 17 00:00:00 2001
+From: Qinglang Miao <miaoqinglang@huawei.com>
+Date: Tue, 3 Nov 2020 16:49:42 +0800
+Subject: serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream.
+
+Add the missing platform_driver_unregister() before return
+from serial_txx9_init in the error handling case when failed
+to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI
+defined.
+
+Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201103084942.109076-1-miaoqinglang@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial_txx9.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/serial/serial_txx9.c
++++ b/drivers/tty/serial/serial_txx9.c
+@@ -1283,6 +1283,9 @@ static int __init serial_txx9_init(void)
+
+ #ifdef ENABLE_SERIAL_TXX9_PCI
+ ret = pci_register_driver(&serial_txx9_pci_driver);
++ if (ret) {
++ platform_driver_unregister(&serial_txx9_plat_driver);
++ }
+ #endif
+ if (ret == 0)
+ goto out;
arm64-smp-move-rcu_cpu_starting-earlier.patch
revert-coresight-make-sysfs-functional-on-topologies.patch
vt-disable-kd_font_op_copy.patch
+fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch
+s390-pkey-fix-paes-selftest-failure-with-paes-and-pkey-static-build.patch
+serial-8250_mtk-fix-uart_get_baud_rate-warning.patch
+serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch
+usb-serial-cyberjack-fix-write-urb-completion-race.patch
+usb-serial-option-add-quectel-ec200t-module-support.patch
+usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch
+usb-serial-option-add-telit-fn980-composition-0x1055.patch
+tty-serial-fsl_lpuart-add-ls1028a-support.patch
+tty-serial-fsl_lpuart-ls1021a-has-a-fifo-size-of-16-words-like-ls1028a.patch
+usb-dwc3-ep0-fix-delay-status-handling.patch
+usb-add-no_lpm-quirk-for-kingston-flash-drive.patch
+usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch
+drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch
+arc-stack-unwinding-avoid-indefinite-looping.patch
+pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch
+pm-runtime-drop-pm_runtime_clean_up_links.patch
+pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch
+xfs-flush-for-older-xfs-specific-ioctls.patch
--- /dev/null
+From c2f448cff22a7ed09281f02bde084b0ce3bc61ed Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Fri, 6 Mar 2020 22:44:32 +0100
+Subject: tty: serial: fsl_lpuart: add LS1028A support
+
+From: Michael Walle <michael@walle.cc>
+
+commit c2f448cff22a7ed09281f02bde084b0ce3bc61ed upstream.
+
+The LS1028A uses little endian register access and has a different FIFO
+size encoding.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20200306214433.23215-4-michael@walle.cc
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -238,6 +238,7 @@ static DEFINE_IDA(fsl_lpuart_ida);
+ enum lpuart_type {
+ VF610_LPUART,
+ LS1021A_LPUART,
++ LS1028A_LPUART,
+ IMX7ULP_LPUART,
+ IMX8QXP_LPUART,
+ };
+@@ -282,11 +283,16 @@ static const struct lpuart_soc_data vf_d
+ .iotype = UPIO_MEM,
+ };
+
+-static const struct lpuart_soc_data ls_data = {
++static const struct lpuart_soc_data ls1021a_data = {
+ .devtype = LS1021A_LPUART,
+ .iotype = UPIO_MEM32BE,
+ };
+
++static const struct lpuart_soc_data ls1028a_data = {
++ .devtype = LS1028A_LPUART,
++ .iotype = UPIO_MEM32,
++};
++
+ static struct lpuart_soc_data imx7ulp_data = {
+ .devtype = IMX7ULP_LPUART,
+ .iotype = UPIO_MEM32,
+@@ -301,7 +307,8 @@ static struct lpuart_soc_data imx8qxp_da
+
+ static const struct of_device_id lpuart_dt_ids[] = {
+ { .compatible = "fsl,vf610-lpuart", .data = &vf_data, },
+- { .compatible = "fsl,ls1021a-lpuart", .data = &ls_data, },
++ { .compatible = "fsl,ls1021a-lpuart", .data = &ls1021a_data, },
++ { .compatible = "fsl,ls1028a-lpuart", .data = &ls1028a_data, },
+ { .compatible = "fsl,imx7ulp-lpuart", .data = &imx7ulp_data, },
+ { .compatible = "fsl,imx8qxp-lpuart", .data = &imx8qxp_data, },
+ { /* sentinel */ }
+@@ -311,6 +318,11 @@ MODULE_DEVICE_TABLE(of, lpuart_dt_ids);
+ /* Forward declare this for the dma callbacks*/
+ static void lpuart_dma_tx_complete(void *arg);
+
++static inline bool is_ls1028a_lpuart(struct lpuart_port *sport)
++{
++ return sport->devtype == LS1028A_LPUART;
++}
++
+ static inline bool is_imx8qxp_lpuart(struct lpuart_port *sport)
+ {
+ return sport->devtype == IMX8QXP_LPUART;
+@@ -1553,6 +1565,17 @@ static int lpuart32_startup(struct uart_
+ sport->rxfifo_size = UARTFIFO_DEPTH((temp >> UARTFIFO_RXSIZE_OFF) &
+ UARTFIFO_FIFOSIZE_MASK);
+
++ /*
++ * The LS1028A has a fixed length of 16 words. Although it supports the
++ * RX/TXSIZE fields their encoding is different. Eg the reference manual
++ * states 0b101 is 16 words.
++ */
++ if (is_ls1028a_lpuart(sport)) {
++ sport->rxfifo_size = 16;
++ sport->txfifo_size = 16;
++ sport->port.fifosize = sport->txfifo_size;
++ }
++
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ lpuart32_setup_watermark_enable(sport);
--- /dev/null
+From c97f2a6fb3dfbfbbc88edc8ea62ef2b944e18849 Mon Sep 17 00:00:00 2001
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+Date: Fri, 23 Oct 2020 04:34:29 +0300
+Subject: tty: serial: fsl_lpuart: LS1021A has a FIFO size of 16 words, like LS1028A
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+commit c97f2a6fb3dfbfbbc88edc8ea62ef2b944e18849 upstream.
+
+Prior to the commit that this one fixes, the FIFO size was derived from
+the read-only register LPUARTx_FIFO[TXFIFOSIZE] using the following
+formula:
+
+TX FIFO size = 2 ^ (LPUARTx_FIFO[TXFIFOSIZE] - 1)
+
+The documentation for LS1021A is a mess. Under chapter 26.1.3 LS1021A
+LPUART module special consideration, it mentions TXFIFO_SZ and RXFIFO_SZ
+being equal to 4, and in the register description for LPUARTx_FIFO, it
+shows the out-of-reset value of TXFIFOSIZE and RXFIFOSIZE fields as "011",
+even though these registers read as "101" in reality.
+
+And when LPUART on LS1021A was working, the "101" value did correspond
+to "16 datawords", by applying the formula above, even though the
+documentation is wrong again (!!!!) and says that "101" means 64 datawords
+(hint: it doesn't).
+
+So the "new" formula created by commit f77ebb241ce0 has all the premises
+of being wrong for LS1021A, because it relied only on false data and no
+actual experimentation.
+
+Interestingly, in commit c2f448cff22a ("tty: serial: fsl_lpuart: add
+LS1028A support"), Michael Walle applied a workaround to this by manually
+setting the FIFO widths for LS1028A. It looks like the same values are
+used by LS1021A as well, in fact.
+
+When the driver thinks that it has a deeper FIFO than it really has,
+getty (user space) output gets truncated.
+
+Many thanks to Michael for pointing out where to look.
+
+Fixes: f77ebb241ce0 ("tty: serial: fsl_lpuart: correct the FIFO depth size")
+Suggested-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20201023013429.3551026-1-vladimir.oltean@nxp.com
+Reviewed-by：Fugang Duan <fugang.duan@nxp.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/fsl_lpuart.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -318,9 +318,10 @@ MODULE_DEVICE_TABLE(of, lpuart_dt_ids);
+ /* Forward declare this for the dma callbacks*/
+ static void lpuart_dma_tx_complete(void *arg);
+
+-static inline bool is_ls1028a_lpuart(struct lpuart_port *sport)
++static inline bool is_layerscape_lpuart(struct lpuart_port *sport)
+ {
+- return sport->devtype == LS1028A_LPUART;
++ return (sport->devtype == LS1021A_LPUART ||
++ sport->devtype == LS1028A_LPUART);
+ }
+
+ static inline bool is_imx8qxp_lpuart(struct lpuart_port *sport)
+@@ -1566,11 +1567,11 @@ static int lpuart32_startup(struct uart_
+ UARTFIFO_FIFOSIZE_MASK);
+
+ /*
+- * The LS1028A has a fixed length of 16 words. Although it supports the
+- * RX/TXSIZE fields their encoding is different. Eg the reference manual
+- * states 0b101 is 16 words.
++ * The LS1021A and LS1028A have a fixed FIFO depth of 16 words.
++ * Although they support the RX/TXSIZE fields, their encoding is
++ * different. Eg the reference manual states 0b101 is 16 words.
+ */
+- if (is_ls1028a_lpuart(sport)) {
++ if (is_layerscape_lpuart(sport)) {
+ sport->rxfifo_size = 16;
+ sport->txfifo_size = 16;
+ sport->port.fifosize = sport->txfifo_size;
--- /dev/null
+From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 2 Nov 2020 09:58:21 -0500
+Subject: USB: Add NO_LPM quirk for Kingston flash drive
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.
+
+In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston
+flash drive spontaneously disconnects and reconnects, over and over.
+Testing revealed that disabling Link Power Management for the drive
+fixed the problem.
+
+This patch adds a quirk entry for that drive to turn off LPM permanently.
+
+CC: Hans de Goede <jwrdegoede@fedoraproject.org>
+CC: <stable@vger.kernel.org>
+Reported-and-tested-by: Julien Humbert <julroy67@gmail.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu
+ { USB_DEVICE(0x0926, 0x3333), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* Kingston DataTraveler 3.0 */
++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+
--- /dev/null
+From fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb Mon Sep 17 00:00:00 2001
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Date: Thu, 22 Oct 2020 15:44:59 -0700
+Subject: usb: dwc3: ep0: Fix delay status handling
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+commit fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb upstream.
+
+If we want to send a control status on our own time (through
+delayed_status), make sure to handle a case where we may queue the
+delayed status before the host requesting for it (when XferNotReady
+is generated). Otherwise, the driver won't send anything because it's
+not EP0_STATUS_PHASE yet. To resolve this, regardless whether
+dwc->ep0state is EP0_STATUS_PHASE, make sure to clear the
+dwc->delayed_status flag if dwc3_ep0_send_delayed_status() is called.
+The control status can be sent when the host requests it later.
+
+Cc: <stable@vger.kernel.org>
+Fixes: d97c78a1908e ("usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command")
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -1058,10 +1058,11 @@ void dwc3_ep0_send_delayed_status(struct
+ {
+ unsigned int direction = !dwc->ep0_expect_in;
+
++ dwc->delayed_status = false;
++
+ if (dwc->ep0state != EP0_STATUS_PHASE)
+ return;
+
+- dwc->delayed_status = false;
+ __dwc3_ep0_do_control_status(dwc, dwc->eps[direction]);
+ }
+
--- /dev/null
+From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Fri, 6 Nov 2020 13:54:29 +0800
+Subject: usb: mtu3: fix panic in mtu3_gadget_stop()
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream.
+
+This patch fixes a possible issue when mtu3_gadget_stop()
+already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
+
+[<ffffff9008161974>] notifier_call_chain+0xa4/0x128
+[<ffffff9008161fd4>] __atomic_notifier_call_chain+0x84/0x138
+[<ffffff9008162ec0>] notify_die+0xb0/0x120
+[<ffffff900809e340>] die+0x1f8/0x5d0
+[<ffffff90080d03b4>] __do_kernel_fault+0x19c/0x280
+[<ffffff90080d04dc>] do_bad_area+0x44/0x140
+[<ffffff90080d0f9c>] do_translation_fault+0x4c/0x90
+[<ffffff9008080a78>] do_mem_abort+0xb8/0x258
+[<ffffff90080849d0>] el1_da+0x24/0x3c
+[<ffffff9009bde01c>] mtu3_gadget_disconnect+0xac/0x128
+[<ffffff9009bd576c>] mtu3_irq+0x34c/0xc18
+[<ffffff90082ac03c>] __handle_irq_event_percpu+0x2ac/0xcd0
+[<ffffff90082acae0>] handle_irq_event_percpu+0x80/0x138
+[<ffffff90082acc44>] handle_irq_event+0xac/0x148
+[<ffffff90082b71cc>] handle_fasteoi_irq+0x234/0x568
+[<ffffff90082a8708>] generic_handle_irq+0x48/0x68
+[<ffffff90082a96ac>] __handle_domain_irq+0x264/0x1740
+[<ffffff90080819f4>] gic_handle_irq+0x14c/0x250
+[<ffffff9008084cec>] el1_irq+0xec/0x194
+[<ffffff90085b985c>] dma_pool_alloc+0x6e4/0xae0
+[<ffffff9008d7f890>] cmdq_mbox_pool_alloc_impl+0xb0/0x238
+[<ffffff9008d80904>] cmdq_pkt_alloc_buf+0x2dc/0x7c0
+[<ffffff9008d80f60>] cmdq_pkt_add_cmd_buffer+0x178/0x270
+[<ffffff9008d82320>] cmdq_pkt_perf_begin+0x108/0x148
+[<ffffff9008d824d8>] cmdq_pkt_create+0x178/0x1f0
+[<ffffff9008f96230>] mtk_crtc_config_default_path+0x328/0x7a0
+[<ffffff90090246cc>] mtk_drm_idlemgr_kick+0xa6c/0x1460
+[<ffffff9008f9bbb4>] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
+[<ffffff9008e8df9c>] drm_atomic_helper_commit_planes+0x154/0x878
+[<ffffff9008f2fb70>] mtk_atomic_complete.isra.16+0xe80/0x19c8
+[<ffffff9008f30910>] mtk_atomic_commit+0x258/0x898
+[<ffffff9008ef142c>] drm_atomic_commit+0xcc/0x108
+[<ffffff9008ef7cf0>] drm_mode_atomic_ioctl+0x1c20/0x2580
+[<ffffff9008ebc768>] drm_ioctl_kernel+0x118/0x1b0
+[<ffffff9008ebcde8>] drm_ioctl+0x5c0/0x920
+[<ffffff900863b030>] do_vfs_ioctl+0x188/0x1820
+[<ffffff900863c754>] SyS_ioctl+0x8c/0xa0
+
+Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/mtu3/mtu3_gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -587,6 +587,7 @@ static int mtu3_gadget_stop(struct usb_g
+
+ spin_unlock_irqrestore(&mtu->lock, flags);
+
++ synchronize_irq(mtu->irq);
+ return 0;
+ }
+
--- /dev/null
+From 985616f0457d9f555fff417d0da56174f70cc14f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Oct 2020 09:25:48 +0100
+Subject: USB: serial: cyberjack: fix write-URB completion race
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 985616f0457d9f555fff417d0da56174f70cc14f upstream.
+
+The write-URB busy flag was being cleared before the completion handler
+was done with the URB, something which could lead to corrupt transfers
+due to a racing write request if the URB is resubmitted.
+
+Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
+Cc: stable <stable@vger.kernel.org> # 2.6.13
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cyberjack.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cyberjack.c
++++ b/drivers/usb/serial/cyberjack.c
+@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callbac
+ struct device *dev = &port->dev;
+ int status = urb->status;
+ unsigned long flags;
++ bool resubmitted = false;
+
+- set_bit(0, &port->write_urbs_free);
+ if (status) {
+ dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
+ __func__, status);
++ set_bit(0, &port->write_urbs_free);
+ return;
+ }
+
+@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callbac
+ goto exit;
+ }
+
++ resubmitted = true;
++
+ dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent);
+ dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled);
+
+@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callbac
+
+ exit:
+ spin_unlock_irqrestore(&priv->lock, flags);
++ if (!resubmitted)
++ set_bit(0, &port->write_urbs_free);
+ usb_serial_port_softint(port);
+ }
+
--- /dev/null
+From 489979b4aab490b6b917c11dc02d81b4b742784a Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Sat, 31 Oct 2020 23:54:58 +0100
+Subject: USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream.
+
+Add following Telit LE910Cx compositions:
+
+0x1203: rndis, tty, adb, tty, tty, tty, tty
+0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty
+0x1231: rndis, tty, adb, audio, tty, tty, tty, tty
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com
+[ johan: add comments after entries ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1203,6 +1203,8 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(0) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1217,6 +1219,10 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */
++ .driver_info = NCTRL(2) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
--- /dev/null
+From a46b973bced1ba57420752bf38426acd9f6cbfa6 Mon Sep 17 00:00:00 2001
+From: Ziyi Cao <kernel@septs.pw>
+Date: Tue, 20 Oct 2020 00:08:06 +0800
+Subject: USB: serial: option: add Quectel EC200T module support
+
+From: Ziyi Cao <kernel@septs.pw>
+
+commit a46b973bced1ba57420752bf38426acd9f6cbfa6 upstream.
+
+Add usb product id of the Quectel EC200T module.
+
+Signed-off-by: Ziyi Cao <kernel@septs.pw>
+Link: https://lore.kernel.org/r/17f8a2a3-ce0f-4be7-8544-8fdf286907d0@www.fastmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -250,6 +250,7 @@ static void option_instat_callback(struc
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
+ #define QUECTEL_PRODUCT_RM500Q 0x0800
++#define QUECTEL_PRODUCT_EC200T 0x6026
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1117,6 +1118,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+ .driver_info = ZLP },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
--- /dev/null
+From db0362eeb22992502764e825c79b922d7467e0eb Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Tue, 3 Nov 2020 13:44:25 +0100
+Subject: USB: serial: option: add Telit FN980 composition 0x1055
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit db0362eeb22992502764e825c79b922d7467e0eb upstream.
+
+Add the following Telit FN980 composition:
+
+0x1055: tty, adb, tty, tty, tty, tty
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1191,6 +1191,8 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */
+ .driver_info = NCTRL(2) | RSVD(3) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */
++ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
--- /dev/null
+From astroh@amazon.com Mon Nov 9 11:33:21 2020
+From: Andy Strohman <astroh@amazon.com>
+Date: Thu, 5 Nov 2020 20:28:50 +0000
+Subject: xfs: flush for older, xfs specific ioctls
+To: <stable@vger.kernel.org>
+Cc: <dchinner@redhat.com>, <darrick.wong@oracle.com>, <astroh@amazon.com>
+Message-ID: <20201105202850.20216-1-astroh@amazon.com>
+
+From: Andy Strohman <astroh@amazon.com>
+
+837a6e7f5cdb ("fs: add generic UNRESVSP and ZERO_RANGE ioctl handlers") changed
+ioctls XFS_IOC_UNRESVSP XFS_IOC_UNRESVSP64 and XFS_IOC_ZERO_RANGE to be generic
+instead of xfs specific.
+
+Because of this change, 36f11775da75 ("xfs: properly serialise fallocate against
+AIO+DIO") needed adaptation, as 5.4 still uses the xfs specific ioctls.
+
+Without this, xfstests xfs/242 and xfs/290 fail. Both of these tests test
+XFS_IOC_ZERO_RANGE.
+
+Fixes: 36f11775da75 ("xfs: properly serialise fallocate against AIO+DIO")
+Tested-by: Andy Strohman <astroh@amazon.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_ioctl.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_ioctl.c
++++ b/fs/xfs/xfs_ioctl.c
+@@ -622,7 +622,6 @@ xfs_ioc_space(
+ error = xfs_break_layouts(inode, &iolock, BREAK_UNMAP);
+ if (error)
+ goto out_unlock;
+- inode_dio_wait(inode);
+
+ switch (bf->l_whence) {
+ case 0: /*SEEK_SET*/
+@@ -668,6 +667,31 @@ xfs_ioc_space(
+ goto out_unlock;
+ }
+
++ /*
++ * Must wait for all AIO to complete before we continue as AIO can
++ * change the file size on completion without holding any locks we
++ * currently hold. We must do this first because AIO can update both
++ * the on disk and in memory inode sizes, and the operations that follow
++ * require the in-memory size to be fully up-to-date.
++ */
++ inode_dio_wait(inode);
++
++ /*
++ * Now that AIO and DIO has drained we can flush and (if necessary)
++ * invalidate the cached range over the first operation we are about to
++ * run. We include zero range here because it starts with a hole punch
++ * over the target range.
++ */
++ switch (cmd) {
++ case XFS_IOC_ZERO_RANGE:
++ case XFS_IOC_UNRESVSP:
++ case XFS_IOC_UNRESVSP64:
++ error = xfs_flush_unmap_range(ip, bf->l_start, bf->l_len);
++ if (error)
++ goto out_unlock;
++ break;
++ }
++
+ switch (cmd) {
+ case XFS_IOC_ZERO_RANGE:
+ flags |= XFS_PREALLOC_SET;
projects / thirdparty / kernel / stable-queue.git / commitdiff
