--- /dev/null
+From bdbf9f5cba018b1fad9aa6894d19a26d528d586b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 22:49:56 +0100
+Subject: ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr()
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 8ade6d8b02b1ead741bd4f6c42921035caab6560 ]
+
+Some Bay Trail systems:
+1. Use a non CR version of the Bay Trail SoC
+2. Contain at least 6 interrupt resources so that the
+ platform_get_resource(pdev, IORESOURCE_IRQ, 5) check to workaround
+ non CR systems which list their IPC IRQ at index 0 despite being
+ non CR does not work
+3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5
+
+Add a DMI quirk table to check for the few known models with this issue,
+so that the right IPC IRQ index is used on these systems.
+
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210120214957.140232-5-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-intel-quirks.h | 25 +++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/sound/soc/intel/common/soc-intel-quirks.h b/sound/soc/intel/common/soc-intel-quirks.h
+index b07df3059926..a93987ab7f4d 100644
+--- a/sound/soc/intel/common/soc-intel-quirks.h
++++ b/sound/soc/intel/common/soc-intel-quirks.h
+@@ -11,6 +11,7 @@
+
+ #if IS_ENABLED(CONFIG_X86)
+
++#include <linux/dmi.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+ #include <asm/iosf_mbi.h>
+@@ -38,12 +39,36 @@ SOC_INTEL_IS_CPU(cml, KABYLAKE_L);
+
+ static inline bool soc_intel_is_byt_cr(struct platform_device *pdev)
+ {
++ /*
++ * List of systems which:
++ * 1. Use a non CR version of the Bay Trail SoC
++ * 2. Contain at least 6 interrupt resources so that the
++ * platform_get_resource(pdev, IORESOURCE_IRQ, 5) check below
++ * succeeds
++ * 3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5
++ *
++ * This needs to be here so that it can be shared between the SST and
++ * SOF drivers. We rely on the compiler to optimize this out in files
++ * where soc_intel_is_byt_cr is not used.
++ */
++ static const struct dmi_system_id force_bytcr_table[] = {
++ { /* Lenovo Yoga Tablet 2 series */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "YOGATablet2"),
++ },
++ },
++ {}
++ };
+ struct device *dev = &pdev->dev;
+ int status = 0;
+
+ if (!soc_intel_is_byt())
+ return false;
+
++ if (dmi_check_system(force_bytcr_table))
++ return true;
++
+ if (iosf_mbi_available()) {
+ u32 bios_status;
+
+--
+2.30.1
+
--- /dev/null
+From 75532fd7ff48215e09294c66372fa65d0479a0ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Jan 2021 22:01:17 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Add new BYT_RT5640_NO_SPEAKERS quirk-flag
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1851ccf9e155b2a6f6cca1a7bd49325f5efbd5d2 ]
+
+Some devices, like mini PCs/media/top-set boxes do not have any speakers
+at all, an example of the is the Mele PCG03 Mini PC.
+
+Add a new BYT_RT5640_NO_SPEAKERS quirk-flag which when sets does not add
+speaker routes and modifies the components and the (optional) long_name
+strings to reflect that there are no speakers.
+
+Cc: Rasmus Porsager <rasmus@beat.dk>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210109210119.159032-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index f790514a147d..db3633de9122 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -71,6 +71,7 @@ enum {
+ #define BYT_RT5640_SSP0_AIF2 BIT(21)
+ #define BYT_RT5640_MCLK_EN BIT(22)
+ #define BYT_RT5640_MCLK_25MHZ BIT(23)
++#define BYT_RT5640_NO_SPEAKERS BIT(24)
+
+ #define BYTCR_INPUT_DEFAULTS \
+ (BYT_RT5640_IN3_MAP | \
+@@ -132,6 +133,8 @@ static void log_quirks(struct device *dev)
+ dev_info(dev, "quirk JD_NOT_INV enabled\n");
+ if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER)
+ dev_info(dev, "quirk MONO_SPEAKER enabled\n");
++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS)
++ dev_info(dev, "quirk NO_SPEAKERS enabled\n");
+ if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC)
+ dev_info(dev, "quirk DIFF_MIC enabled\n");
+ if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) {
+@@ -934,7 +937,7 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
+ ret = snd_soc_dapm_add_routes(&card->dapm,
+ byt_rt5640_mono_spk_map,
+ ARRAY_SIZE(byt_rt5640_mono_spk_map));
+- } else {
++ } else if (!(byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS)) {
+ ret = snd_soc_dapm_add_routes(&card->dapm,
+ byt_rt5640_stereo_spk_map,
+ ARRAY_SIZE(byt_rt5640_stereo_spk_map));
+@@ -1179,6 +1182,7 @@ struct acpi_chan_package { /* ACPICA seems to require 64 bit integers */
+ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
+ {
+ static const char * const map_name[] = { "dmic1", "dmic2", "in1", "in3" };
++ __maybe_unused const char *spk_type;
+ const struct dmi_system_id *dmi_id;
+ struct byt_rt5640_private *priv;
+ struct snd_soc_acpi_mach *mach;
+@@ -1186,7 +1190,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
+ struct acpi_device *adev;
+ int ret_val = 0;
+ int dai_index = 0;
+- int i;
++ int i, cfg_spk;
+
+ is_bytcr = false;
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+@@ -1325,16 +1329,24 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
+ }
+ }
+
++ if (byt_rt5640_quirk & BYT_RT5640_NO_SPEAKERS) {
++ cfg_spk = 0;
++ spk_type = "none";
++ } else if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) {
++ cfg_spk = 1;
++ spk_type = "mono";
++ } else {
++ cfg_spk = 2;
++ spk_type = "stereo";
++ }
++
+ snprintf(byt_rt5640_components, sizeof(byt_rt5640_components),
+- "cfg-spk:%s cfg-mic:%s",
+- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ? "1" : "2",
++ "cfg-spk:%d cfg-mic:%s", cfg_spk,
+ map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]);
+ byt_rt5640_card.components = byt_rt5640_components;
+ #if !IS_ENABLED(CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES)
+ snprintf(byt_rt5640_long_name, sizeof(byt_rt5640_long_name),
+- "bytcr-rt5640-%s-spk-%s-mic",
+- (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) ?
+- "mono" : "stereo",
++ "bytcr-rt5640-%s-spk-%s-mic", spk_type,
+ map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]);
+ byt_rt5640_card.long_name = byt_rt5640_long_name;
+ #endif
+--
+2.30.1
+
--- /dev/null
+From 4b0831ef5254cc9775d5298e555a62e4d1ba68d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 22:35:55 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c58947af08aedbdee0fce5ea6e6bf3e488ae0e2c ]
+
+The Acer One S1002 tablet is using an analog mic on IN1 and has
+its jack-detect connected to JD2_IN4N, instead of using the default
+IN3 for its internal mic and JD1_IN4P for jack-detect.
+
+Note it is also using AIF2 instead of AIF1 which is somewhat unusual,
+this is correctly advertised in the ACPI CHAN package, so the speakers
+do work without the quirk.
+
+Add a quirk for the mic and jack-detect settings.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210216213555.36555-5-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 626677fa1b5c..3af4cb87032c 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -402,6 +402,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Acer One 10 S1002 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "One S1002"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF2 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+--
+2.30.1
+
--- /dev/null
+From 94de94a10c2a6001ba9dd6a59aa1bd4a62e2dbfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 22:35:52 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID
+ 7316R tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit bdea43fc0436c9e98fdfe151c2ed8a3fc7277404 ]
+
+The Estar Beauty HD MID 7316R tablet almost fully works with out default
+settings. The only problem is that it has only 1 speaker so any sounds
+only playing on the right channel get lost.
+
+Add a quirk for this model using the default settings + MONO_SPEAKER.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210216213555.36555-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index db3633de9122..be874d2a109b 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -515,6 +515,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Estar Beauty HD MID 7316R */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+--
+2.30.1
+
--- /dev/null
+From 7f66b717320daa2a67dec2d7354d1ea7f215b0af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 22:35:53 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit e1317cc9ca4ac20262895fddb065ffda4fc29cfb ]
+
+The Voyo Winpad A15 tablet uses a Bay Trail (non CR) SoC, so it is using
+SSP2 (AIF1) and it mostly works with the defaults. But instead of using
+DMIC1 it is using an analog mic on IN1, add a quirk for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210216213555.36555-3-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index be874d2a109b..626677fa1b5c 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -799,6 +799,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF2 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Voyo Winpad A15 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS date */
++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Catch-all for generic Insyde tablets, must be last */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+--
+2.30.1
+
--- /dev/null
+From d3c2bb7eccb849621f45341595d08e18ff05ebcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 22:35:54 +0100
+Subject: ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit df8359c512fa770ffa6b0b0309807d9b9825a47f ]
+
+Add a DMI quirk for the Jumper EZpad 7 tablet, this tablet has
+a jack-detect switch which reads 1/high when a jack is inserted,
+rather then using the standard active-low setup which most
+jack-detect switches use. All other settings are using the defaults.
+
+Add a DMI-quirk setting the defaults + the BYT_RT5651_JD_NOT_INV
+flags for this.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210216213555.36555-4-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5651.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 688b5e0a49e3..bf8b87d45cb0 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -435,6 +435,19 @@ static const struct dmi_system_id byt_rt5651_quirk_table[] = {
+ BYT_RT5651_SSP0_AIF1 |
+ BYT_RT5651_MONO_SPEAKER),
+ },
++ {
++ /* Jumper EZpad 7 */
++ .callback = byt_rt5651_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Jumper"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EZpad"),
++ /* Jumper12x.WJ2012.bsBKRCP05 with the version dropped */
++ DMI_MATCH(DMI_BIOS_VERSION, "Jumper12x.WJ2012.bsBKRCP"),
++ },
++ .driver_data = (void *)(BYT_RT5651_DEFAULT_QUIRKS |
++ BYT_RT5651_IN2_MAP |
++ BYT_RT5651_JD_NOT_INV),
++ },
+ {
+ /* KIANO SlimNote 14.2 */
+ .callback = byt_rt5651_quirk_cb,
+--
+2.30.1
+
--- /dev/null
+From d4348e4ad3ddf5656a18b55c1ec2cb1e800ba2be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 17:33:27 -0600
+Subject: ASoC: Intel: sof-sdw: indent and add quirks consistently
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 8caf37e2be761688c396c609880936a807af490f ]
+
+Use the same style for all quirks to avoid misses and errors
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210208233336.59449-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 07e72ca1dfbc..d441ef324c06 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -115,9 +115,10 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME,
+ "Tiger Lake Client Platform"),
+ },
+- .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 |
+- SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC |
+- SOF_SSP_PORT(SOF_I2S_SSP2)),
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_RT711_JD_SRC_JD1 |
++ SOF_SDW_PCH_DMIC |
++ SOF_SSP_PORT(SOF_I2S_SSP2)),
+ },
+ {
+ .callback = sof_sdw_quirk_cb,
+@@ -141,7 +142,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Volteer"),
+ },
+- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC |
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_SDW_PCH_DMIC |
+ SOF_SDW_FOUR_SPK),
+ },
+ {
+@@ -150,7 +152,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Ripto"),
+ },
+- .driver_data = (void *)(SOF_SDW_TGL_HDMI | SOF_SDW_PCH_DMIC |
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_SDW_PCH_DMIC |
+ SOF_SDW_FOUR_SPK),
+ },
+
+--
+2.30.1
+
--- /dev/null
+From b5e6b76d80bb208d9574e3a2af9a5933a547c484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 17:33:30 -0600
+Subject: ASoC: Intel: sof_sdw: detect DMIC number based on mach params
+
+From: Rander Wang <rander.wang@intel.com>
+
+[ Upstream commit f88dcb9b98d3f86ead04d2453475267910448bb8 ]
+
+Current driver create DMIC dai based on quirk for each platforms,
+so we need to add quirk for new platforms. Now driver reports DMIC
+number to machine driver and machine driver can create DMIC dai based
+on this information. The old check is reserved for some platforms
+may be failed to set the DMIC number in BIOS.
+
+Reviewed-by: Bard Liao <bard.liao@intel.com>
+Signed-off-by: Rander Wang <rander.wang@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210208233336.59449-6-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index d441ef324c06..0f1d845a0cca 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -925,7 +925,7 @@ static int sof_card_dai_links_create(struct device *dev,
+ ctx->idisp_codec = true;
+
+ /* enable dmic01 & dmic16k */
+- dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC) ? 2 : 0;
++ dmic_num = (sof_sdw_quirk & SOF_SDW_PCH_DMIC || mach_params->dmic_num) ? 2 : 0;
+ comp_num += dmic_num;
+
+ dev_dbg(dev, "sdw %d, ssp %d, dmic %d, hdmi %d", sdw_be_num, ssp_num,
+--
+2.30.1
+
--- /dev/null
+From 15b872660a06e7b8511207d5db7b65bbfde2dd8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Dec 2020 14:34:47 +0800
+Subject: ath10k: fix wmi mgmt tx queue full due to race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit b55379e343a3472c35f4a1245906db5158cab453 ]
+
+Failed to transmit wmi management frames:
+
+[84977.840894] ath10k_snoc a000000.wifi: wmi mgmt tx queue is full
+[84977.840913] ath10k_snoc a000000.wifi: failed to transmit packet, dropping: -28
+[84977.840924] ath10k_snoc a000000.wifi: failed to submit frame: -28
+[84977.840932] ath10k_snoc a000000.wifi: failed to transmit frame: -28
+
+This issue is caused by race condition between skb_dequeue and
+__skb_queue_tail. The queue of ‘wmi_mgmt_tx_queue’ is protected by a
+different lock: ar->data_lock vs list->lock, the result is no protection.
+So when ath10k_mgmt_over_wmi_tx_work() and ath10k_mac_tx_wmi_mgmt()
+running concurrently on different CPUs, there appear to be a rare corner
+cases when the queue length is 1,
+
+ CPUx (skb_deuque) CPUy (__skb_queue_tail)
+ next=list
+ prev=list
+ struct sk_buff *skb = skb_peek(list); WRITE_ONCE(newsk->next, next);
+ WRITE_ONCE(list->qlen, list->qlen - 1);WRITE_ONCE(newsk->prev, prev);
+ next = skb->next; WRITE_ONCE(next->prev, newsk);
+ prev = skb->prev; WRITE_ONCE(prev->next, newsk);
+ skb->next = skb->prev = NULL; list->qlen++;
+ WRITE_ONCE(next->prev, prev);
+ WRITE_ONCE(prev->next, next);
+
+If the instruction ‘next = skb->next’ is executed before
+‘WRITE_ONCE(prev->next, newsk)’, newsk will be lost, as CPUx get the
+old ‘next’ pointer, but the length is still added by one. The final
+result is the length of the queue will reach the maximum value but
+the queue is empty.
+
+So remove ar->data_lock, and use 'skb_queue_tail' instead of
+'__skb_queue_tail' to prevent the potential race condition. Also switch
+to use skb_queue_len_lockless, in case we queue a few SKBs simultaneously.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1.c2-00033-QCAHLSWMTPLZ-1
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1608618887-8857-1-git-send-email-miaoqing@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 4bc84cc5e824..f5c0f9bac840 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3763,23 +3763,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
+ static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
+ {
+ struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
+- int ret = 0;
+-
+- spin_lock_bh(&ar->data_lock);
+
+- if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
++ if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) {
+ ath10k_warn(ar, "wmi mgmt tx queue is full\n");
+- ret = -ENOSPC;
+- goto unlock;
++ return -ENOSPC;
+ }
+
+- __skb_queue_tail(q, skb);
++ skb_queue_tail(q, skb);
+ ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
+
+-unlock:
+- spin_unlock_bh(&ar->data_lock);
+-
+- return ret;
++ return 0;
+ }
+
+ static enum ath10k_mac_tx_path
+--
+2.30.1
+
--- /dev/null
+From 3f2f713cd144c0e1b4fc441bca7a5264bb4fcd58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 17:33:12 +0100
+Subject: Bluetooth: Add new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 219991e6be7f4a31d471611e265b72f75b2d0538 ]
+
+Some devices, e.g. the RTL8723BS bluetooth part, some USB attached devices,
+completely drop from the bus on a system-suspend. These devices will
+have their driver unbound and rebound on resume (when the dropping of
+the bus gets detected) and will show up as a new HCI after resume.
+
+These devices do not benefit from the suspend / resume handling work done
+by the hci_suspend_notifier. At best this unnecessarily adds some time to
+the suspend/resume time. But this may also actually cause problems, if the
+code doing the driver unbinding runs after the pm-notifier then the
+hci_suspend_notifier code will try to talk to a device which is now in
+an uninitialized state.
+
+This commit adds a new HCI_QUIRK_NO_SUSPEND_NOTIFIER quirk which allows
+drivers to opt-out of the hci_suspend_notifier when they know beforehand
+that their device will be fully re-initialized / reprobed on resume.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h | 8 ++++++++
+ net/bluetooth/hci_core.c | 18 +++++++++++-------
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index c8e67042a3b1..6da4b3c5dd55 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -238,6 +238,14 @@ enum {
+ * during the hdev->setup vendor callback.
+ */
+ HCI_QUIRK_BROKEN_ERR_DATA_REPORTING,
++
++ /*
++ * When this quirk is set, then the hci_suspend_notifier is not
++ * registered. This is intended for devices which drop completely
++ * from the bus on system-suspend and which will show up as a new
++ * HCI after resume.
++ */
++ HCI_QUIRK_NO_SUSPEND_NOTIFIER,
+ };
+
+ /* HCI device flags */
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 7a2f9559e99a..0152bc6b6796 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3785,10 +3785,12 @@ int hci_register_dev(struct hci_dev *hdev)
+ hci_sock_dev_event(hdev, HCI_DEV_REG);
+ hci_dev_hold(hdev);
+
+- hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
+- error = register_pm_notifier(&hdev->suspend_notifier);
+- if (error)
+- goto err_wqueue;
++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
++ hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
++ error = register_pm_notifier(&hdev->suspend_notifier);
++ if (error)
++ goto err_wqueue;
++ }
+
+ queue_work(hdev->req_workqueue, &hdev->power_on);
+
+@@ -3823,9 +3825,11 @@ void hci_unregister_dev(struct hci_dev *hdev)
+
+ cancel_work_sync(&hdev->power_on);
+
+- hci_suspend_clear_tasks(hdev);
+- unregister_pm_notifier(&hdev->suspend_notifier);
+- cancel_work_sync(&hdev->suspend_prepare);
++ if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
++ hci_suspend_clear_tasks(hdev);
++ unregister_pm_notifier(&hdev->suspend_notifier);
++ cancel_work_sync(&hdev->suspend_prepare);
++ }
+
+ hci_dev_do_close(hdev);
+
+--
+2.30.1
+
--- /dev/null
+From 8446ef959d6b920b5642013d5f8643e56da30a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 16:51:47 +0530
+Subject: Bluetooth: btusb: fix memory leak on suspend and resume
+
+From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+
+[ Upstream commit 5ff20cbe6752a5bc06ff58fee8aa11a0d5075819 ]
+
+kmemleak report:
+unreferenced object 0xffff9b1127f00500 (size 208):
+ comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 60 ed 05 11 9b ff ff 00 00 00 00 00 00 00 00 .`..............
+ backtrace:
+ [<000000006ab3fd59>] kmem_cache_alloc_node+0x17a/0x480
+ [<0000000051a5f6f9>] __alloc_skb+0x5b/0x1d0
+ [<0000000037e2d252>] hci_prepare_cmd+0x32/0xc0 [bluetooth]
+ [<0000000010b586d5>] hci_req_add_ev+0x84/0xe0 [bluetooth]
+ [<00000000d2deb520>] hci_req_clear_event_filter+0x42/0x70 [bluetooth]
+ [<00000000f864bd8c>] hci_req_prepare_suspend+0x84/0x470 [bluetooth]
+ [<000000001deb2cc4>] hci_prepare_suspend+0x31/0x40 [bluetooth]
+ [<000000002677dd79>] process_one_work+0x209/0x3b0
+ [<00000000aaa62b07>] worker_thread+0x34/0x400
+ [<00000000826d176c>] kthread+0x126/0x140
+ [<000000002305e558>] ret_from_fork+0x22/0x30
+unreferenced object 0xffff9b1125c6ee00 (size 512):
+ comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s)
+ hex dump (first 32 bytes):
+ 04 00 00 00 0d 00 00 00 05 0c 01 00 11 9b ff ff ................
+ 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<000000009f07c0cc>] slab_post_alloc_hook+0x59/0x270
+ [<0000000049431dc2>] __kmalloc_node_track_caller+0x15f/0x330
+ [<00000000027a42f6>] __kmalloc_reserve.isra.70+0x31/0x90
+ [<00000000e8e3e76a>] __alloc_skb+0x87/0x1d0
+ [<0000000037e2d252>] hci_prepare_cmd+0x32/0xc0 [bluetooth]
+ [<0000000010b586d5>] hci_req_add_ev+0x84/0xe0 [bluetooth]
+ [<00000000d2deb520>] hci_req_clear_event_filter+0x42/0x70 [bluetooth]
+ [<00000000f864bd8c>] hci_req_prepare_suspend+0x84/0x470 [bluetooth]
+ [<000000001deb2cc4>] hci_prepare_suspend+0x31/0x40 [bluetooth]
+ [<000000002677dd79>] process_one_work+0x209/0x3b0
+ [<00000000aaa62b07>] worker_thread+0x34/0x400
+ [<00000000826d176c>] kthread+0x126/0x140
+ [<000000002305e558>] ret_from_fork+0x22/0x30
+unreferenced object 0xffff9b112b395788 (size 8):
+ comm "kworker/u17:2", pid 500, jiffies 4294937470 (age 580.136s)
+ hex dump (first 8 bytes):
+ 20 00 00 00 00 00 04 00 .......
+ backtrace:
+ [<0000000052dc28d2>] kmem_cache_alloc_trace+0x15e/0x460
+ [<0000000046147591>] alloc_ctrl_urb+0x52/0xe0 [btusb]
+ [<00000000a2ed3e9e>] btusb_send_frame+0x91/0x100 [btusb]
+ [<000000001e66030e>] hci_send_frame+0x7e/0xf0 [bluetooth]
+ [<00000000bf6b7269>] hci_cmd_work+0xc5/0x130 [bluetooth]
+ [<000000002677dd79>] process_one_work+0x209/0x3b0
+ [<00000000aaa62b07>] worker_thread+0x34/0x400
+ [<00000000826d176c>] kthread+0x126/0x140
+ [<000000002305e558>] ret_from_fork+0x22/0x30
+
+In pm sleep-resume context, while the btusb device rebinds, it enters
+hci_unregister_dev(), whilst there is a possibility of hdev receiving
+PM_POST_SUSPEND suspend_notifier event, leading to generation of msg
+frames. When hci_unregister_dev() completes, i.e. hdev context is
+destroyed/freed, those intermittently sent msg frames cause memory
+leak.
+
+BUG details:
+Below is stack trace of thread that enters hci_unregister_dev(), marks
+the hdev flag HCI_UNREGISTER to 1, and then goes onto to wait on notifier
+lock - refer unregister_pm_notifier().
+
+ hci_unregister_dev+0xa5/0x320 [bluetoot]
+ btusb_disconnect+0x68/0x150 [btusb]
+ usb_unbind_interface+0x77/0x250
+ ? kernfs_remove_by_name_ns+0x75/0xa0
+ device_release_driver_internal+0xfe/0x1
+ device_release_driver+0x12/0x20
+ bus_remove_device+0xe1/0x150
+ device_del+0x192/0x3e0
+ ? usb_remove_ep_devs+0x1f/0x30
+ usb_disable_device+0x92/0x1b0
+ usb_disconnect+0xc2/0x270
+ hub_event+0x9f6/0x15d0
+ ? rpm_idle+0x23/0x360
+ ? rpm_idle+0x26b/0x360
+ process_one_work+0x209/0x3b0
+ worker_thread+0x34/0x400
+ ? process_one_work+0x3b0/0x3b0
+ kthread+0x126/0x140
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x22/0x30
+
+Below is stack trace of thread executing hci_suspend_notifier() which
+processes the PM_POST_SUSPEND event, while the unbinding thread is
+waiting on lock.
+
+ hci_suspend_notifier.cold.39+0x5/0x2b [bluetooth]
+ blocking_notifier_call_chain+0x69/0x90
+ pm_notifier_call_chain+0x1a/0x20
+ pm_suspend.cold.9+0x334/0x352
+ state_store+0x84/0xf0
+ kobj_attr_store+0x12/0x20
+ sysfs_kf_write+0x3b/0x40
+ kernfs_fop_write+0xda/0x1c0
+ vfs_write+0xbb/0x250
+ ksys_write+0x61/0xe0
+ __x64_sys_write+0x1a/0x20
+ do_syscall_64+0x37/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fix hci_suspend_notifer(), not to act on events when flag HCI_UNREGISTER
+is set.
+
+Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 555058270f11..7a2f9559e99a 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -3529,7 +3529,8 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
+ }
+
+ /* Suspend notifier should only act on events when powered. */
+- if (!hdev_is_powered(hdev))
++ if (!hdev_is_powered(hdev) ||
++ hci_dev_test_flag(hdev, HCI_UNREGISTER))
+ goto done;
+
+ if (action == PM_SUSPEND_PREPARE) {
+--
+2.30.1
+
--- /dev/null
+From c1f96cdfff9923a53574075499177ec179dc7195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 15:12:30 +0530
+Subject: Bluetooth: Fix null pointer dereference in
+ amp_read_loc_assoc_final_data
+
+From: Gopal Tiwari <gtiwari@redhat.com>
+
+[ Upstream commit e8bd76ede155fd54d8c41d045dda43cd3174d506 ]
+
+kernel panic trace looks like:
+
+ #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7
+ #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe
+ [exception RIP: amp_read_loc_assoc_final_data+63]
+ RIP: ffffffffc06ab54f RSP: ffffb9e08698fd68 RFLAGS: 00010246
+ RAX: 0000000000000000 RBX: ffff8c8845a5a000 RCX: 0000000000000004
+ RDX: 0000000000000000 RSI: ffff8c8b9153d000 RDI: ffff8c8845a5a000
+ RBP: ffffb9e08698fe40 R8: 00000000000330e0 R9: ffffffffc0675c94
+ R10: ffffb9e08698fe58 R11: 0000000000000001 R12: ffff8c8b9cbf6200
+ R13: 0000000000000000 R14: 0000000000000000 R15: ffff8c8b2026da0b
+ ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
+ #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth]
+ #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth]
+ #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7
+
+hcon->amp_mgr seems NULL triggered kernel panic in following line inside
+function amp_read_loc_assoc_final_data
+
+ set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
+
+Fixed by checking NULL for mgr.
+
+Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/amp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
+index 9c711f0dfae3..be2d469d6369 100644
+--- a/net/bluetooth/amp.c
++++ b/net/bluetooth/amp.c
+@@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+ struct hci_request req;
+ int err;
+
++ if (!mgr)
++ return;
++
+ cp.phy_handle = hcon->handle;
+ cp.len_so_far = cpu_to_le16(0);
+ cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+--
+2.30.1
+
--- /dev/null
+From b971210fe70b332684176cdb80687d96acd170c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 19:47:00 +0800
+Subject: Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl
+
+From: Claire Chang <tientzu@chromium.org>
+
+[ Upstream commit 7f9f2c3f7d99b8ae773459c74ac5e99a0dd46db9 ]
+
+Realtek Bluetooth controllers can do both LE scan and BR/EDR inquiry
+at once, need to set HCI_QUIRK_SIMULTANEOUS_DISCOVERY quirk.
+
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 78d635f1d156..996729e78105 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -906,6 +906,11 @@ static int h5_btrtl_setup(struct h5 *h5)
+ /* Give the device some time before the hci-core sends it a reset */
+ usleep_range(10000, 20000);
+
++ /* Enable controller to do both LE scan and BR/EDR inquiry
++ * simultaneously.
++ */
++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &h5->hu->hdev->quirks);
++
+ out_free:
+ btrtl_free(btrtl_dev);
+
+--
+2.30.1
+
--- /dev/null
+From b7cb8e9ac7cb1063d2c09e9b15a45d953c2df3a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 18:14:12 +0100
+Subject: brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit af4b3a6f36d6c2fc5fca026bccf45e0fdcabddd9 ]
+
+The Predia Basic tablet contains quite generic names in the sys_vendor and
+product_name DMI strings, without this patch brcmfmac will try to load:
+brcmfmac43340-sdio.Insyde-CherryTrail.txt as nvram file which is a bit
+too generic.
+
+Add a DMI quirk so that a unique and clearly identifiable nvram file name
+is used on the Predia Basic tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210129171413.139880-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+index 4aa2561934d7..824a79f24383 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -40,6 +40,10 @@ static const struct brcmf_dmi_data pov_tab_p1006w_data = {
+ BRCM_CC_43340_CHIP_ID, 2, "pov-tab-p1006w-data"
+ };
+
++static const struct brcmf_dmi_data predia_basic_data = {
++ BRCM_CC_43341_CHIP_ID, 2, "predia-basic"
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
+ /* ACEPC T8 Cherry Trail Z8350 mini PC */
+@@ -111,6 +115,16 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&pov_tab_p1006w_data,
+ },
++ {
++ /* Predia Basic tablet (+ with keyboard dock) */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
++ /* Mx.WT107.KUBNGEA02 with the version-nr dropped */
++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"),
++ },
++ .driver_data = (void *)&predia_basic_data,
++ },
+ {}
+ };
+
+--
+2.30.1
+
--- /dev/null
+From 5c269e5cce0c8cd802fba81e840a9469781eccae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 18:14:13 +0100
+Subject: brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a338c874d3d9d2463f031e89ae14942929b93db6 ]
+
+The Voyo winpad A15 tablet contains quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+rcmfmac4330-sdio.To be filled by O.E.M.-To be filled by O.E.M..txt
+as nvram file which is a bit too generic.
+
+Add a DMI quirk so that a unique and clearly identifiable nvram file name
+is used on the Voyo winpad A15 tablet.
+
+While preparing a matching linux-firmware update I noticed that the nvram
+is identical to the nvram used on the Prowise-PT301 tablet, so the new DMI
+quirk entry simply points to the already existing Prowise-PT301 nvram file.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210129171413.139880-2-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/dmi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+index 824a79f24383..6d5188b78f2d 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -44,6 +44,14 @@ static const struct brcmf_dmi_data predia_basic_data = {
+ BRCM_CC_43341_CHIP_ID, 2, "predia-basic"
+ };
+
++/* Note the Voyo winpad A15 tablet uses the same Ampak AP6330 module, with the
++ * exact same nvram file as the Prowise-PT301 tablet. Since the nvram for the
++ * Prowise-PT301 is already in linux-firmware we just point to that here.
++ */
++static const struct brcmf_dmi_data voyo_winpad_a15_data = {
++ BRCM_CC_4330_CHIP_ID, 4, "Prowise-PT301"
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
+ /* ACEPC T8 Cherry Trail Z8350 mini PC */
+@@ -125,6 +133,16 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&predia_basic_data,
+ },
++ {
++ /* Voyo winpad A15 tablet */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS date */
++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"),
++ },
++ .driver_data = (void *)&voyo_winpad_a15_data,
++ },
+ {}
+ };
+
+--
+2.30.1
+
--- /dev/null
+From 326d33cb66fe4c622d65b03b452e89a3cd65fc86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 09:53:23 -0500
+Subject: btrfs: fix error handling in commit_fs_roots
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 4f4317c13a40194940acf4a71670179c4faca2b5 ]
+
+While doing error injection I would sometimes get a corrupt file system.
+This is because I was injecting errors at btrfs_search_slot, but would
+only do it one time per stack. This uncovered a problem in
+commit_fs_roots, where if we get an error we would just break. However
+we're in a nested loop, the first loop being a loop to find all the
+dirty fs roots, and then subsequent root updates would succeed clearing
+the error value.
+
+This isn't likely to happen in real scenarios, however we could
+potentially get a random ENOMEM once and then not again, and we'd end up
+with a corrupted file system. Fix this by moving the error checking
+around a bit to the main loop, as this is the only place where something
+will fail, and return the error as soon as it occurs.
+
+With this patch my reproducer no longer corrupts the file system.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/transaction.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 96dbfc011f45..261a50708cb8 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1320,7 +1320,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ struct btrfs_root *gang[8];
+ int i;
+ int ret;
+- int err = 0;
+
+ spin_lock(&fs_info->fs_roots_radix_lock);
+ while (1) {
+@@ -1332,6 +1331,8 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ break;
+ for (i = 0; i < ret; i++) {
+ struct btrfs_root *root = gang[i];
++ int ret2;
++
+ radix_tree_tag_clear(&fs_info->fs_roots_radix,
+ (unsigned long)root->root_key.objectid,
+ BTRFS_ROOT_TRANS_TAG);
+@@ -1353,17 +1354,17 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ root->node);
+ }
+
+- err = btrfs_update_root(trans, fs_info->tree_root,
++ ret2 = btrfs_update_root(trans, fs_info->tree_root,
+ &root->root_key,
+ &root->root_item);
++ if (ret2)
++ return ret2;
+ spin_lock(&fs_info->fs_roots_radix_lock);
+- if (err)
+- break;
+ btrfs_qgroup_free_meta_all_pertrans(root);
+ }
+ }
+ spin_unlock(&fs_info->fs_roots_radix_lock);
+- return err;
++ return 0;
+ }
+
+ /*
+--
+2.30.1
+
--- /dev/null
+From ee8f8e92810dcc952833e4d423fd42c1378a3fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 15:34:41 +0100
+Subject: crypto: tcrypt - avoid signed overflow in byte count
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 303fd3e1c771077e32e96e5788817f025f0067e2 ]
+
+The signed long type used for printing the number of bytes processed in
+tcrypt benchmarks limits the range to -/+ 2 GiB, which is not sufficient
+to cover the performance of common accelerated ciphers such as AES-NI
+when benchmarked with sec=1. So switch to u64 instead.
+
+While at it, fix up a missing printk->pr_cont conversion in the AEAD
+benchmark.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tcrypt.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index eea0f453cfb6..8609174e036e 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -199,8 +199,8 @@ static int test_mb_aead_jiffies(struct test_mb_aead_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -469,8 +469,8 @@ static int test_aead_jiffies(struct aead_request *req, int enc,
+ return ret;
+ }
+
+- printk("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+@@ -760,8 +760,8 @@ static int test_mb_ahash_jiffies(struct test_mb_ahash_data *data, int blen,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1197,8 +1197,8 @@ static int test_mb_acipher_jiffies(struct test_mb_skcipher_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1435,8 +1435,8 @@ static int test_acipher_jiffies(struct skcipher_request *req, int enc,
+ return ret;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 46462e09f4651a5b5c3b0e2037e091a3d613f57a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 16:54:50 +0800
+Subject: drm/amd/amdgpu: add error handling to amdgpu_virt_read_pf2vf_data
+
+From: Jingwen Chen <Jingwen.Chen2@amd.com>
+
+[ Upstream commit 64dcf2f01d59cf9fad19b1a387bd39736a8f4d69 ]
+
+[Why]
+when vram lost happened in guest, try to write vram can lead to
+kernel stuck.
+
+[How]
+When the readback data is invalid, don't do write work, directly
+reschedule a new work.
+
+Signed-off-by: Jingwen Chen <Jingwen.Chen2@amd.com>
+Reviewed-by: Monk Liu<monk.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index d0aea5e39531..e7678ba8fdcf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -558,10 +558,14 @@ static int amdgpu_virt_write_vf2pf_data(struct amdgpu_device *adev)
+ void amdgpu_virt_update_vf2pf_work_item(struct work_struct *work)
+ {
+ struct amdgpu_device *adev = container_of(work, struct amdgpu_device, virt.vf2pf_work.work);
++ int ret;
+
+- amdgpu_virt_read_pf2vf_data(adev);
++ ret = amdgpu_virt_read_pf2vf_data(adev);
++ if (ret)
++ goto out;
+ amdgpu_virt_write_vf2pf_data(adev);
+
++out:
+ schedule_delayed_work(&(adev->virt.vf2pf_work), adev->virt.vf2pf_update_interval_ms);
+ }
+
+--
+2.30.1
+
--- /dev/null
+From a5d963fbf8a6c2d381b6ae6bfa574d3c9c0cfd57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 12:14:00 -0500
+Subject: drm/amd/display: Guard against NULL pointer deref when get_i2c_info
+ fails
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 44a09e3d95bd2b7b0c224100f78f335859c4e193 ]
+
+[Why]
+If the BIOS table is invalid or corrupt then get_i2c_info can fail
+and we dereference a NULL pointer.
+
+[How]
+Check that ddc_pin is not NULL before using it and log an error if it
+is because this is unexpected.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Reviewed-by: Eric Yang <eric.yang2@amd.com>
+Acked-by: Anson Jacob <anson.jacob@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index e1e5d81a5e43..21c7b642a8b4 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1454,6 +1454,11 @@ static bool dc_link_construct(struct dc_link *link,
+ goto ddc_create_fail;
+ }
+
++ if (!link->ddc->ddc_pin) {
++ DC_ERROR("Failed to get I2C info for connector!\n");
++ goto ddc_create_fail;
++ }
++
+ link->ddc_hw_inst =
+ dal_ddc_get_line(dal_ddc_service_get_ddc_pin(link->ddc));
+
+--
+2.30.1
+
--- /dev/null
+From 34b52c63a6875c8919205ad1e4b2741925f35669 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 00:06:39 +0800
+Subject: drm/amdgpu: Add check to prevent IH overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Defang Bo <bodefang@126.com>
+
+[ Upstream commit e4180c4253f3f2da09047f5139959227f5cf1173 ]
+
+Similar to commit <b82175750131>("drm/amdgpu: fix IH overflow on Vega10 v2").
+When an ring buffer overflow happens the appropriate bit is set in the WPTR
+register which is also written back to memory. But clearing the bit in the
+WPTR doesn't trigger another memory writeback.
+
+So what can happen is that we end up processing the buffer overflow over and
+over again because the bit is never cleared. Resulting in a random system
+lockup because of an infinite loop in an interrupt handler.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Defang Bo <bodefang@126.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cz_ih.c | 37 ++++++++++++++++---------
+ drivers/gpu/drm/amd/amdgpu/iceland_ih.c | 36 +++++++++++++++---------
+ drivers/gpu/drm/amd/amdgpu/tonga_ih.c | 37 ++++++++++++++++---------
+ 3 files changed, 71 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cz_ih.c b/drivers/gpu/drm/amd/amdgpu/cz_ih.c
+index 1dca0cabc326..13520d173296 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cz_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/cz_ih.c
+@@ -193,19 +193,30 @@ static u32 cz_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
+index a13dd9a51149..7d165f024f07 100644
+--- a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
+@@ -193,19 +193,29 @@ static u32 iceland_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
+index e40140bf6699..db0a3bda13fb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
+@@ -195,19 +195,30 @@ static u32 tonga_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 3b6fbfd6785ef4b4bb8dea412242e4ce94327f9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 12:12:34 +0100
+Subject: drm/amdgpu: enable only one high prio compute queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit 8c0225d79273968a65e73a4204fba023ae02714d ]
+
+For high priority compute to work properly we need to enable
+wave limiting on gfx pipe. Wave limiting is done through writing
+into mmSPI_WCL_PIPE_PERCENT_GFX register. Enable only one high
+priority compute queue to avoid race condition between multiple
+high priority compute queues writing that register simultaneously.
+
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 15 ++++++++-------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 2 +-
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 6 ++----
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 6 ++----
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 ++-----
+ 5 files changed, 15 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+index c485ec86804e..034a0f3b4c66 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -193,15 +193,16 @@ static bool amdgpu_gfx_is_multipipe_capable(struct amdgpu_device *adev)
+ }
+
+ bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
+- int pipe, int queue)
++ struct amdgpu_ring *ring)
+ {
+- bool multipipe_policy = amdgpu_gfx_is_multipipe_capable(adev);
+- int cond;
+- /* Policy: alternate between normal and high priority */
+- cond = multipipe_policy ? pipe : queue;
+-
+- return ((cond % 2) != 0);
++ /* Policy: use 1st queue as high priority compute queue if we
++ * have more than one compute queue.
++ */
++ if (adev->gfx.num_compute_rings > 1 &&
++ ring == &adev->gfx.compute_ring[0])
++ return true;
+
++ return false;
+ }
+
+ void amdgpu_gfx_compute_queue_acquire(struct amdgpu_device *adev)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+index f353a5b71804..6e0cba6f4bdc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h
+@@ -373,7 +373,7 @@ void amdgpu_queue_mask_bit_to_mec_queue(struct amdgpu_device *adev, int bit,
+ bool amdgpu_gfx_is_mec_queue_enabled(struct amdgpu_device *adev, int mec,
+ int pipe, int queue);
+ bool amdgpu_gfx_is_high_priority_compute_queue(struct amdgpu_device *adev,
+- int pipe, int queue);
++ struct amdgpu_ring *ring);
+ int amdgpu_gfx_me_queue_to_bit(struct amdgpu_device *adev, int me,
+ int pipe, int queue);
+ void amdgpu_gfx_bit_to_me_queue(struct amdgpu_device *adev, int bit,
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 4ebb43e09099..4cc83b399b66 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4334,8 +4334,7 @@ static int gfx_v10_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
+ + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ + ring->pipe;
+- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+- ring->queue) ?
++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ?
+ AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
+ /* type-2 packets are deprecated on MEC, use type-3 instead */
+ r = amdgpu_ring_init(adev, ring, 1024,
+@@ -6361,8 +6360,7 @@ static void gfx_v10_0_compute_mqd_set_priority(struct amdgpu_ring *ring, struct
+ struct amdgpu_device *adev = ring->adev;
+
+ if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+- if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+- ring->queue)) {
++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) {
+ mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ mqd->cp_hqd_queue_priority =
+ AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index c36258d56b44..f2f603fa0288 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -1915,8 +1915,7 @@ static int gfx_v8_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ + ring->pipe;
+
+- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+- ring->queue) ?
++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ?
+ AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_RING_PRIO_DEFAULT;
+ /* type-2 packets are deprecated on MEC, use type-3 instead */
+ r = amdgpu_ring_init(adev, ring, 1024,
+@@ -4434,8 +4433,7 @@ static void gfx_v8_0_mqd_set_priority(struct amdgpu_ring *ring, struct vi_mqd *m
+ struct amdgpu_device *adev = ring->adev;
+
+ if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+- if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+- ring->queue)) {
++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) {
+ mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ mqd->cp_hqd_queue_priority =
+ AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 957c12b72767..fa843bda70ba 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -2228,8 +2228,7 @@ static int gfx_v9_0_compute_ring_init(struct amdgpu_device *adev, int ring_id,
+ irq_type = AMDGPU_CP_IRQ_COMPUTE_MEC1_PIPE0_EOP
+ + ((ring->me - 1) * adev->gfx.mec.num_pipe_per_mec)
+ + ring->pipe;
+- hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring->pipe,
+- ring->queue) ?
++ hw_prio = amdgpu_gfx_is_high_priority_compute_queue(adev, ring) ?
+ AMDGPU_GFX_PIPE_PRIO_HIGH : AMDGPU_GFX_PIPE_PRIO_NORMAL;
+ /* type-2 packets are deprecated on MEC, use type-3 instead */
+ return amdgpu_ring_init(adev, ring, 1024,
+@@ -3384,9 +3383,7 @@ static void gfx_v9_0_mqd_set_priority(struct amdgpu_ring *ring, struct v9_mqd *m
+ struct amdgpu_device *adev = ring->adev;
+
+ if (ring->funcs->type == AMDGPU_RING_TYPE_COMPUTE) {
+- if (amdgpu_gfx_is_high_priority_compute_queue(adev,
+- ring->pipe,
+- ring->queue)) {
++ if (amdgpu_gfx_is_high_priority_compute_queue(adev, ring)) {
+ mqd->cp_hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_HIGH;
+ mqd->cp_hqd_queue_priority =
+ AMDGPU_GFX_QUEUE_PRIORITY_MAXIMUM;
+--
+2.30.1
+
--- /dev/null
+From 25b685cfbd0588d1bdbd73f7534d1bbc0b078e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 18:32:53 +0800
+Subject: drm/hisilicon: Fix use-after-free
+
+From: Tian Tao <tiantao6@hisilicon.com>
+
+[ Upstream commit c855af2f9c5c60760fd1bed7889a81bc37d2591d ]
+
+Fix the problem of dev being released twice.
+------------[ cut here ]------------
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 75 PID: 15700 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x150
+CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3
+Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
+pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)
+pc : refcount_warn_saturate+0xd4/0x150
+lr : refcount_warn_saturate+0xd4/0x150
+sp : ffff2028150cbc00
+x29: ffff2028150cbc00 x28: ffff2028150121c0
+x27: 0000000000000000 x26: 0000000000000000
+x25: 0000000000000000 x24: 0000000000000003
+x23: 0000000000000000 x22: ffff2028150cbc90
+x21: ffff2020038a30a8 x20: ffff2028150cbc90
+x19: ffff0020cd938020 x18: 0000000000000010
+x17: 0000000000000000 x16: 0000000000000000
+x15: ffffffffffffffff x14: ffff2028950cb88f
+x13: ffff2028150cb89d x12: 0000000000000000
+x11: 0000000005f5e0ff x10: ffff2028150cb800
+x9 : 00000000ffffffd0 x8 : 75203b776f6c6672
+x7 : ffff800011a6f7c8 x6 : 0000000000000001
+x5 : 0000000000000000 x4 : 0000000000000000
+x3 : 0000000000000000 x2 : ffff202ffe2f9dc0
+x1 : ffffa02fecf40000 x0 : 0000000000000026
+Call trace:
+ refcount_warn_saturate+0xd4/0x150
+ devm_drm_dev_init_release+0x50/0x70
+ devm_action_release+0x20/0x30
+ release_nodes+0x13c/0x218
+ devres_release_all+0x80/0x170
+ device_release_driver_internal+0x128/0x1f0
+ driver_detach+0x6c/0xe0
+ bus_remove_driver+0x74/0x100
+ driver_unregister+0x34/0x60
+ pci_unregister_driver+0x24/0xd8
+ hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
+ __arm64_sys_delete_module+0x1fc/0x2d0
+ el0_svc_common.constprop.3+0xa8/0x188
+ do_el0_svc+0x80/0xa0
+ el0_sync_handler+0x8c/0xb0
+ el0_sync+0x15c/0x180
+CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3
+Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
+Call trace:
+ dump_backtrace+0x0/0x208
+ show_stack+0x2c/0x40
+ dump_stack+0xd8/0x10c
+ __warn+0xac/0x128
+ report_bug+0xcc/0x180
+ bug_handler+0x24/0x78
+ call_break_hook+0x80/0xa0
+ brk_handler+0x28/0x68
+ do_debug_exception+0x9c/0x148
+ el1_sync_handler+0x7c/0x128
+ el1_sync+0x80/0x100
+ refcount_warn_saturate+0xd4/0x150
+ devm_drm_dev_init_release+0x50/0x70
+ devm_action_release+0x20/0x30
+ release_nodes+0x13c/0x218
+ devres_release_all+0x80/0x170
+ device_release_driver_internal+0x128/0x1f0
+ driver_detach+0x6c/0xe0
+ bus_remove_driver+0x74/0x100
+ driver_unregister+0x34/0x60
+ pci_unregister_driver+0x24/0xd8
+ hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
+ __arm64_sys_delete_module+0x1fc/0x2d0
+ el0_svc_common.constprop.3+0xa8/0x188
+ do_el0_svc+0x80/0xa0
+ el0_sync_handler+0x8c/0xb0
+ el0_sync+0x15c/0x180
+---[ end trace 00718630d6e5ff18 ]---
+
+Signed-off-by: Tian Tao <tiantao6@hisilicon.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/1607941973-32287-1-git-send-email-tiantao6@hisilicon.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+index 085d1b2fa8c0..d3485f742acc 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+@@ -368,7 +368,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev)
+
+ drm_dev_unregister(dev);
+ hibmc_unload(dev);
+- drm_dev_put(dev);
+ }
+
+ static struct pci_device_id hibmc_pci_table[] = {
+--
+2.30.1
+
--- /dev/null
+From eab2abf85b8d6255c47039e8f607f82797d8c1c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 15:20:28 +0100
+Subject: EDAC/amd64: Do not load on family 0x15, model 0x13
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit 6c13d7ff81e6d2f01f62ccbfa49d1b8d87f274d0 ]
+
+Those were only laptops and are very very unlikely to have ECC memory.
+Currently, when the driver attempts to load, it issues:
+
+ EDAC amd64: Error: F1 not found: device 0x1601 (broken BIOS?)
+
+because the PCI device is the wrong one (it uses the F15h default one).
+
+So do not load the driver on them as that is pointless.
+
+Reported-by: Don Curtis <bugrprt21882@online.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Don Curtis <bugrprt21882@online.de>
+Link: http://bugzilla.opensuse.org/show_bug.cgi?id=1179763
+Link: https://lkml.kernel.org/r/20201218160622.20146-1-bp@alien8.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/amd64_edac.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 620f7041db6b..b36d5879b91e 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -3350,10 +3350,13 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ fam_type = &family_types[F15_M60H_CPUS];
+ pvt->ops = &family_types[F15_M60H_CPUS].ops;
+ break;
++ /* Richland is only client */
++ } else if (pvt->model == 0x13) {
++ return NULL;
++ } else {
++ fam_type = &family_types[F15_CPUS];
++ pvt->ops = &family_types[F15_CPUS].ops;
+ }
+-
+- fam_type = &family_types[F15_CPUS];
+- pvt->ops = &family_types[F15_CPUS].ops;
+ break;
+
+ case 0x16:
+@@ -3547,6 +3550,7 @@ static int probe_one_instance(unsigned int nid)
+ pvt->mc_node_id = nid;
+ pvt->F3 = F3;
+
++ ret = -ENODEV;
+ fam_type = per_family_init(pvt);
+ if (!fam_type)
+ goto err_enable;
+--
+2.30.1
+
--- /dev/null
+From 73d1024a1520c187f151e36a2d077fe56525fce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 09:55:09 +0800
+Subject: f2fs: fix to set/clear I_LINKABLE under i_lock
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 46085f37fc9e12d5c3539fb768b5ad7951e72acf ]
+
+fsstress + fault injection test case reports a warning message as
+below:
+
+WARNING: CPU: 13 PID: 6226 at fs/inode.c:361 inc_nlink+0x32/0x40
+Call Trace:
+ f2fs_init_inode_metadata+0x25c/0x4a0 [f2fs]
+ f2fs_add_inline_entry+0x153/0x3b0 [f2fs]
+ f2fs_add_dentry+0x75/0x80 [f2fs]
+ f2fs_do_add_link+0x108/0x160 [f2fs]
+ f2fs_rename2+0x6ab/0x14f0 [f2fs]
+ vfs_rename+0x70c/0x940
+ do_renameat2+0x4d8/0x4f0
+ __x64_sys_renameat2+0x4b/0x60
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Following race case can cause this:
+Thread A Kworker
+- f2fs_rename
+ - f2fs_create_whiteout
+ - __f2fs_tmpfile
+ - f2fs_i_links_write
+ - f2fs_mark_inode_dirty_sync
+ - mark_inode_dirty_sync
+ - writeback_single_inode
+ - __writeback_single_inode
+ - spin_lock(&inode->i_lock)
+ - inode->i_state |= I_LINKABLE
+ - inode->i_state &= ~dirty
+ - spin_unlock(&inode->i_lock)
+ - f2fs_add_link
+ - f2fs_do_add_link
+ - f2fs_add_dentry
+ - f2fs_add_inline_entry
+ - f2fs_init_inode_metadata
+ - f2fs_i_links_write
+ - inc_nlink
+ - WARN_ON(!(inode->i_state & I_LINKABLE))
+
+Fix to add i_lock to avoid i_state update race condition.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 8fa37d1434de..5f7ab4f11322 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -854,7 +854,11 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++
++ spin_lock(&inode->i_lock);
+ inode->i_state |= I_LINKABLE;
++ spin_unlock(&inode->i_lock);
++
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -1040,7 +1044,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+ goto put_out_dir;
++
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state &= ~I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ iput(whiteout);
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 38c0cb81c18038aca51d7aa5b5e40fa50b766466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 11:44:25 -0800
+Subject: f2fs: handle unallocated section and zone on pinned/atgc
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 632faca72938f9f63049e48a8c438913828ac7a9 ]
+
+If we have large section/zone, unallocated segment makes them corrupted.
+
+E.g.,
+
+ - Pinned file: -1 119304647 119304647
+ - ATGC data: -1 119304647 119304647
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index e81eb0748e2a..229814b4f4a6 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -101,11 +101,11 @@ static inline void sanity_check_seg_type(struct f2fs_sb_info *sbi,
+ #define BLKS_PER_SEC(sbi) \
+ ((sbi)->segs_per_sec * (sbi)->blocks_per_seg)
+ #define GET_SEC_FROM_SEG(sbi, segno) \
+- ((segno) / (sbi)->segs_per_sec)
++ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno) \
+ ((secno) * (sbi)->segs_per_sec)
+ #define GET_ZONE_FROM_SEC(sbi, secno) \
+- ((secno) / (sbi)->secs_per_zone)
++ (((secno) == -1) ? -1: (secno) / (sbi)->secs_per_zone)
+ #define GET_ZONE_FROM_SEG(sbi, segno) \
+ GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno))
+
+--
+2.30.1
+
--- /dev/null
+From bc91344d576b50ebd0e50b30086ea94473be2d78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 09:19:08 -0700
+Subject: fs: make unlazy_walk() error handling consistent
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit e36cffed20a324e116f329a94061ae30dd26fb51 ]
+
+Most callers check for non-zero return, and assume it's -ECHILD (which
+it always will be). One caller uses the actual error return. Clean this
+up and make it fully consistent, by having unlazy_walk() return a bool
+instead. Rename it to try_to_unlazy() and return true on success, and
+failure on error. That's easier to read.
+
+No functional changes in this patch.
+
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namei.c | 43 +++++++++++++++++--------------------------
+ 1 file changed, 17 insertions(+), 26 deletions(-)
+
+diff --git a/fs/namei.c b/fs/namei.c
+index d4a6dd772303..7af66d5a0c1b 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -669,17 +669,17 @@ static bool legitimize_root(struct nameidata *nd)
+ */
+
+ /**
+- * unlazy_walk - try to switch to ref-walk mode.
++ * try_to_unlazy - try to switch to ref-walk mode.
+ * @nd: nameidata pathwalk data
+- * Returns: 0 on success, -ECHILD on failure
++ * Returns: true on success, false on failure
+ *
+- * unlazy_walk attempts to legitimize the current nd->path and nd->root
++ * try_to_unlazy attempts to legitimize the current nd->path and nd->root
+ * for ref-walk mode.
+ * Must be called from rcu-walk context.
+- * Nothing should touch nameidata between unlazy_walk() failure and
++ * Nothing should touch nameidata between try_to_unlazy() failure and
+ * terminate_walk().
+ */
+-static int unlazy_walk(struct nameidata *nd)
++static bool try_to_unlazy(struct nameidata *nd)
+ {
+ struct dentry *parent = nd->path.dentry;
+
+@@ -694,14 +694,14 @@ static int unlazy_walk(struct nameidata *nd)
+ goto out;
+ rcu_read_unlock();
+ BUG_ON(nd->inode != parent->d_inode);
+- return 0;
++ return true;
+
+ out1:
+ nd->path.mnt = NULL;
+ nd->path.dentry = NULL;
+ out:
+ rcu_read_unlock();
+- return -ECHILD;
++ return false;
+ }
+
+ /**
+@@ -792,7 +792,7 @@ static int complete_walk(struct nameidata *nd)
+ */
+ if (!(nd->flags & (LOOKUP_ROOT | LOOKUP_IS_SCOPED)))
+ nd->root.mnt = NULL;
+- if (unlikely(unlazy_walk(nd)))
++ if (!try_to_unlazy(nd))
+ return -ECHILD;
+ }
+
+@@ -1466,7 +1466,7 @@ static struct dentry *lookup_fast(struct nameidata *nd,
+ unsigned seq;
+ dentry = __d_lookup_rcu(parent, &nd->last, &seq);
+ if (unlikely(!dentry)) {
+- if (unlazy_walk(nd))
++ if (!try_to_unlazy(nd))
+ return ERR_PTR(-ECHILD);
+ return NULL;
+ }
+@@ -1567,10 +1567,8 @@ static inline int may_lookup(struct nameidata *nd)
+ {
+ if (nd->flags & LOOKUP_RCU) {
+ int err = inode_permission(nd->inode, MAY_EXEC|MAY_NOT_BLOCK);
+- if (err != -ECHILD)
++ if (err != -ECHILD || !try_to_unlazy(nd))
+ return err;
+- if (unlazy_walk(nd))
+- return -ECHILD;
+ }
+ return inode_permission(nd->inode, MAY_EXEC);
+ }
+@@ -1592,7 +1590,7 @@ static int reserve_stack(struct nameidata *nd, struct path *link, unsigned seq)
+ // unlazy even if we fail to grab the link - cleanup needs it
+ bool grabbed_link = legitimize_path(nd, link, seq);
+
+- if (unlazy_walk(nd) != 0 || !grabbed_link)
++ if (!try_to_unlazy(nd) != 0 || !grabbed_link)
+ return -ECHILD;
+
+ if (nd_alloc_stack(nd))
+@@ -1634,7 +1632,7 @@ static const char *pick_link(struct nameidata *nd, struct path *link,
+ touch_atime(&last->link);
+ cond_resched();
+ } else if (atime_needs_update(&last->link, inode)) {
+- if (unlikely(unlazy_walk(nd)))
++ if (!try_to_unlazy(nd))
+ return ERR_PTR(-ECHILD);
+ touch_atime(&last->link);
+ }
+@@ -1651,11 +1649,8 @@ static const char *pick_link(struct nameidata *nd, struct path *link,
+ get = inode->i_op->get_link;
+ if (nd->flags & LOOKUP_RCU) {
+ res = get(NULL, inode, &last->done);
+- if (res == ERR_PTR(-ECHILD)) {
+- if (unlikely(unlazy_walk(nd)))
+- return ERR_PTR(-ECHILD);
++ if (res == ERR_PTR(-ECHILD) && try_to_unlazy(nd))
+ res = get(link->dentry, inode, &last->done);
+- }
+ } else {
+ res = get(link->dentry, inode, &last->done);
+ }
+@@ -2193,7 +2188,7 @@ OK:
+ }
+ if (unlikely(!d_can_lookup(nd->path.dentry))) {
+ if (nd->flags & LOOKUP_RCU) {
+- if (unlazy_walk(nd))
++ if (!try_to_unlazy(nd))
+ return -ECHILD;
+ }
+ return -ENOTDIR;
+@@ -3127,7 +3122,6 @@ static const char *open_last_lookups(struct nameidata *nd,
+ struct inode *inode;
+ struct dentry *dentry;
+ const char *res;
+- int error;
+
+ nd->flags |= op->intent;
+
+@@ -3151,9 +3145,8 @@ static const char *open_last_lookups(struct nameidata *nd,
+ } else {
+ /* create side of things */
+ if (nd->flags & LOOKUP_RCU) {
+- error = unlazy_walk(nd);
+- if (unlikely(error))
+- return ERR_PTR(error);
++ if (!try_to_unlazy(nd))
++ return ERR_PTR(-ECHILD);
+ }
+ audit_inode(nd->name, dir, AUDIT_INODE_PARENT);
+ /* trailing slashes? */
+@@ -3162,9 +3155,7 @@ static const char *open_last_lookups(struct nameidata *nd,
+ }
+
+ if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
+- error = mnt_want_write(nd->path.mnt);
+- if (!error)
+- got_write = true;
++ got_write = !mnt_want_write(nd->path.mnt);
+ /*
+ * do _not_ fail yet - we might not need that or fail with
+ * a different error; let lookup_open() decide; we'll be
+--
+2.30.1
+
--- /dev/null
+From de8d065f79bdfdb3e62568e6b85c7fe683fa5e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 14:35:19 +0100
+Subject: media: uvcvideo: Allow entities with no pads
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 7532dad6634031d083df7af606fac655b8d08b5c ]
+
+Avoid an underflow while calculating the number of inputs for entities
+with zero pads.
+
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index ddb9eaa11be7..5ad528264135 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -1028,7 +1028,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int i;
+
+ extra_size = roundup(extra_size, sizeof(*entity->pads));
+- num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
++ if (num_pads)
++ num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
++ else
++ num_inputs = 0;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+ entity = kzalloc(size, GFP_KERNEL);
+@@ -1044,7 +1047,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+
+ for (i = 0; i < num_inputs; ++i)
+ entity->pads[i].flags = MEDIA_PAD_FL_SINK;
+- if (!UVC_ENTITY_IS_OTERM(entity))
++ if (!UVC_ENTITY_IS_OTERM(entity) && num_pads)
+ entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE;
+
+ entity->bNrInPins = num_inputs;
+--
+2.30.1
+
--- /dev/null
+From c5e5953011258061a4c755268bbe4a9f4011f60e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 02:51:38 +0800
+Subject: mt76: mt7615: reset token when mac_reset happens
+
+From: Ryder Lee <ryder.lee@mediatek.com>
+
+[ Upstream commit a6275e934605646ef81b02d8d1164f21343149c9 ]
+
+Reset token in mt7615_mac_reset_work() to avoid possible leakege.
+
+Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7615/mac.c | 20 +++++++++++++++++++
+ .../wireless/mediatek/mt76/mt7615/mt7615.h | 2 +-
+ .../wireless/mediatek/mt76/mt7615/pci_init.c | 12 +----------
+ 3 files changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+index 3d62fda067e4..f1f954ff4685 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -2098,6 +2098,23 @@ void mt7615_dma_reset(struct mt7615_dev *dev)
+ }
+ EXPORT_SYMBOL_GPL(mt7615_dma_reset);
+
++void mt7615_tx_token_put(struct mt7615_dev *dev)
++{
++ struct mt76_txwi_cache *txwi;
++ int id;
++
++ spin_lock_bh(&dev->token_lock);
++ idr_for_each_entry(&dev->token, txwi, id) {
++ mt7615_txp_skb_unmap(&dev->mt76, txwi);
++ if (txwi->skb)
++ dev_kfree_skb_any(txwi->skb);
++ mt76_put_txwi(&dev->mt76, txwi);
++ }
++ spin_unlock_bh(&dev->token_lock);
++ idr_destroy(&dev->token);
++}
++EXPORT_SYMBOL_GPL(mt7615_tx_token_put);
++
+ void mt7615_mac_reset_work(struct work_struct *work)
+ {
+ struct mt7615_phy *phy2;
+@@ -2141,6 +2158,9 @@ void mt7615_mac_reset_work(struct work_struct *work)
+
+ mt76_wr(dev, MT_MCU_INT_EVENT, MT_MCU_INT_EVENT_PDMA_STOPPED);
+
++ mt7615_tx_token_put(dev);
++ idr_init(&dev->token);
++
+ if (mt7615_wait_reset_state(dev, MT_MCU_CMD_RESET_DONE)) {
+ mt7615_dma_reset(dev);
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
+index 6a9f9187f76a..5b06294d654a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h
+@@ -619,7 +619,7 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ struct mt76_tx_info *tx_info);
+
+ void mt7615_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e);
+-
++void mt7615_tx_token_put(struct mt7615_dev *dev);
+ void mt7615_queue_rx_skb(struct mt76_dev *mdev, enum mt76_rxq_id q,
+ struct sk_buff *skb);
+ void mt7615_sta_ps(struct mt76_dev *mdev, struct ieee80211_sta *sta, bool ps);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+index 06a0f8f7bc89..7b81aef3684e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_init.c
+@@ -153,9 +153,7 @@ int mt7615_register_device(struct mt7615_dev *dev)
+
+ void mt7615_unregister_device(struct mt7615_dev *dev)
+ {
+- struct mt76_txwi_cache *txwi;
+ bool mcu_running;
+- int id;
+
+ mcu_running = mt7615_wait_for_mcu_init(dev);
+
+@@ -165,15 +163,7 @@ void mt7615_unregister_device(struct mt7615_dev *dev)
+ mt7615_mcu_exit(dev);
+ mt7615_dma_cleanup(dev);
+
+- spin_lock_bh(&dev->token_lock);
+- idr_for_each_entry(&dev->token, txwi, id) {
+- mt7615_txp_skb_unmap(&dev->mt76, txwi);
+- if (txwi->skb)
+- dev_kfree_skb_any(txwi->skb);
+- mt76_put_txwi(&dev->mt76, txwi);
+- }
+- spin_unlock_bh(&dev->token_lock);
+- idr_destroy(&dev->token);
++ mt7615_tx_token_put(dev);
+
+ tasklet_disable(&dev->irq_tasklet);
+
+--
+2.30.1
+
--- /dev/null
+From 23eeb3e2b573bc5d9cc2a2756d967a3f36f2e2bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 16:02:28 +0100
+Subject: net: sfp: add mode quirk for GPON module Ubiquiti U-Fiber Instant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit f0b4f847673299577c29b71d3f3acd3c313d81b7 ]
+
+The Ubiquiti U-Fiber Instant SFP GPON module has nonsensical information
+stored in its EEPROM. It claims to support all transceiver types including
+10G Ethernet. Clear all claimed modes and set only 1000baseX_Full, which is
+the only one supported.
+
+This module has also phys_id set to SFF, and the SFP subsystem currently
+does not allow to use SFP modules detected as SFFs. Add exception for this
+module so it can be detected as supported.
+
+This change finally allows to detect and use SFP GPON module Ubiquiti
+U-Fiber Instant on Linux system.
+
+EEPROM content of this SFP module is (where XX is serial number):
+
+00: 02 04 0b ff ff ff ff ff ff ff ff 03 0c 00 14 c8 ???........??.??
+10: 00 00 00 00 55 42 4e 54 20 20 20 20 20 20 20 20 ....UBNT
+20: 20 20 20 20 00 18 e8 29 55 46 2d 49 4e 53 54 41 .??)UF-INSTA
+30: 4e 54 20 20 20 20 20 20 34 20 20 20 05 1e 00 36 NT 4 ??.6
+40: 00 06 00 00 55 42 4e 54 XX XX XX XX XX XX XX XX .?..UBNTXXXXXXXX
+50: 20 20 20 20 31 34 30 31 32 33 20 20 60 80 02 41 140123 `??A
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp-bus.c | 15 +++++++++++++++
+ drivers/net/phy/sfp.c | 17 +++++++++++++++--
+ 2 files changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index 58014feedf6c..fb954e814180 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -44,6 +44,17 @@ static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id,
+ phylink_set(modes, 2500baseX_Full);
+ }
+
++static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,
++ unsigned long *modes)
++{
++ /* Ubiquiti U-Fiber Instant module claims that support all transceiver
++ * types including 10G Ethernet which is not truth. So clear all claimed
++ * modes and set only one mode which module supports: 1000baseX_Full.
++ */
++ phylink_zero(modes);
++ phylink_set(modes, 1000baseX_Full);
++}
++
+ static const struct sfp_quirk sfp_quirks[] = {
+ {
+ // Alcatel Lucent G-010S-P can operate at 2500base-X, but
+@@ -63,6 +74,10 @@ static const struct sfp_quirk sfp_quirks[] = {
+ .vendor = "HUAWEI",
+ .part = "MA5671A",
+ .modes = sfp_quirk_2500basex,
++ }, {
++ .vendor = "UBNT",
++ .part = "UF-INSTANT",
++ .modes = sfp_quirk_ubnt_uf_instant,
+ },
+ };
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 34aa196b7465..d8a809cf20c1 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -272,8 +272,21 @@ static const struct sff_data sff_data = {
+
+ static bool sfp_module_supported(const struct sfp_eeprom_id *id)
+ {
+- return id->base.phys_id == SFF8024_ID_SFP &&
+- id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP;
++ if (id->base.phys_id == SFF8024_ID_SFP &&
++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP)
++ return true;
++
++ /* SFP GPON module Ubiquiti U-Fiber Instant has in its EEPROM stored
++ * phys id SFF instead of SFP. Therefore mark this module explicitly
++ * as supported based on vendor name and pn match.
++ */
++ if (id->base.phys_id == SFF8024_ID_SFF_8472 &&
++ id->base.phys_ext_id == SFP_PHYS_EXT_ID_SFP &&
++ !memcmp(id->base.vendor_name, "UBNT ", 16) &&
++ !memcmp(id->base.vendor_pn, "UF-INSTANT ", 16))
++ return true;
++
++ return false;
+ }
+
+ static const struct sff_data sfp_data = {
+--
+2.30.1
+
--- /dev/null
+From a8d365131cc54cb3051ae6291d952dde8f08914c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 11:32:36 +0800
+Subject: nvme-core: add cancel tagset helpers
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit 2547906982e2e6a0d42f8957f55af5bb51a7e55f ]
+
+Add nvme_cancel_tagset and nvme_cancel_admin_tagset for tear down and
+reconnection error handling.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 20 ++++++++++++++++++++
+ drivers/nvme/host/nvme.h | 2 ++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 4ec5f05dabe1..e1e574ecf031 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -351,6 +351,26 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
+ }
+ EXPORT_SYMBOL_GPL(nvme_cancel_request);
+
++void nvme_cancel_tagset(struct nvme_ctrl *ctrl)
++{
++ if (ctrl->tagset) {
++ blk_mq_tagset_busy_iter(ctrl->tagset,
++ nvme_cancel_request, ctrl);
++ blk_mq_tagset_wait_completed_request(ctrl->tagset);
++ }
++}
++EXPORT_SYMBOL_GPL(nvme_cancel_tagset);
++
++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl)
++{
++ if (ctrl->admin_tagset) {
++ blk_mq_tagset_busy_iter(ctrl->admin_tagset,
++ nvme_cancel_request, ctrl);
++ blk_mq_tagset_wait_completed_request(ctrl->admin_tagset);
++ }
++}
++EXPORT_SYMBOL_GPL(nvme_cancel_admin_tagset);
++
+ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ enum nvme_ctrl_state new_state)
+ {
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 567f7ad18a91..f843540cc238 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -571,6 +571,8 @@ static inline bool nvme_is_aen_req(u16 qid, __u16 command_id)
+
+ void nvme_complete_rq(struct request *req);
+ bool nvme_cancel_request(struct request *req, void *data, bool reserved);
++void nvme_cancel_tagset(struct nvme_ctrl *ctrl);
++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl);
+ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ enum nvme_ctrl_state new_state);
+ bool nvme_wait_reset(struct nvme_ctrl *ctrl);
+--
+2.30.1
+
--- /dev/null
+From 8cab673b760f03a1ca5a64069b55b653d4fd4b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 11:32:37 +0800
+Subject: nvme-rdma: add clean action for failed reconnection
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit 958dc1d32c80566f58d18f05ef1f05bd32d172c1 ]
+
+A crash happens when inject failed reconnection.
+If reconnect failed after start io queues, the queues will be unquiesced
+and new requests continue to be delivered. Reconnection error handling
+process directly free queues without cancel suspend requests. The
+suppend request will time out, and then crash due to use the queue
+after free.
+
+Add sync queues and cancel suppend requests for reconnection error
+handling.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 4eb867804b6a..195703013272 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -919,12 +919,16 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
+
+ error = nvme_init_identify(&ctrl->ctrl);
+ if (error)
+- goto out_stop_queue;
++ goto out_quiesce_queue;
+
+ return 0;
+
++out_quiesce_queue:
++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ out_stop_queue:
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
++ nvme_cancel_admin_tagset(&ctrl->ctrl);
+ out_cleanup_queue:
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
+@@ -1001,8 +1005,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ out_wait_freeze_timed_out:
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
++ nvme_cancel_tagset(&ctrl->ctrl);
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.connect_q);
+ out_free_tag_set:
+@@ -1144,10 +1150,18 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
+ return 0;
+
+ destroy_io:
+- if (ctrl->ctrl.queue_count > 1)
++ if (ctrl->ctrl.queue_count > 1) {
++ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
++ nvme_cancel_tagset(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, new);
++ }
+ destroy_admin:
++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
++ nvme_cancel_admin_tagset(&ctrl->ctrl);
+ nvme_rdma_destroy_admin_queue(ctrl, new);
+ return ret;
+ }
+--
+2.30.1
+
--- /dev/null
+From 858b52f4e5d82337551f1eb6ada1484e7e6b4489 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 11:32:38 +0800
+Subject: nvme-tcp: add clean action for failed reconnection
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit 70a99574a79f1cd4dc7ad56ea37be40844bfb97b ]
+
+If reconnect failed after start io queues, the queues will be unquiesced
+and new requests continue to be delivered. Reconnection error handling
+process directly free queues without cancel suspend requests. The
+suppend request will time out, and then crash due to use the queue
+after free.
+
+Add sync queues and cancel suppend requests for reconnection error
+handling.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 6487b7897d1f..739ac7deccd9 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1815,8 +1815,10 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ out_wait_freeze_timed_out:
+ nvme_stop_queues(ctrl);
++ nvme_sync_io_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
++ nvme_cancel_tagset(ctrl);
+ if (new)
+ blk_cleanup_queue(ctrl->connect_q);
+ out_free_tag_set:
+@@ -1878,12 +1880,16 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
+
+ error = nvme_init_identify(ctrl);
+ if (error)
+- goto out_stop_queue;
++ goto out_quiesce_queue;
+
+ return 0;
+
++out_quiesce_queue:
++ blk_mq_quiesce_queue(ctrl->admin_q);
++ blk_sync_queue(ctrl->admin_q);
+ out_stop_queue:
+ nvme_tcp_stop_queue(ctrl, 0);
++ nvme_cancel_admin_tagset(ctrl);
+ out_cleanup_queue:
+ if (new)
+ blk_cleanup_queue(ctrl->admin_q);
+@@ -2003,10 +2009,18 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new)
+ return 0;
+
+ destroy_io:
+- if (ctrl->queue_count > 1)
++ if (ctrl->queue_count > 1) {
++ nvme_stop_queues(ctrl);
++ nvme_sync_io_queues(ctrl);
++ nvme_tcp_stop_io_queues(ctrl);
++ nvme_cancel_tagset(ctrl);
+ nvme_tcp_destroy_io_queues(ctrl, new);
++ }
+ destroy_admin:
++ blk_mq_quiesce_queue(ctrl->admin_q);
++ blk_sync_queue(ctrl->admin_q);
+ nvme_tcp_stop_queue(ctrl, 0);
++ nvme_cancel_admin_tagset(ctrl);
+ nvme_tcp_destroy_admin_queue(ctrl, new);
+ return ret;
+ }
+--
+2.30.1
+
--- /dev/null
+From 336f1e5e5af173b6480c5eacb472361c71582c58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 18:12:30 -0500
+Subject: parisc: Bump 64-bit IRQ stack size to 64 KB
+
+From: John David Anglin <dave.anglin@bell.net>
+
+[ Upstream commit 31680c1d1595a59e17c14ec036b192a95f8e5f4a ]
+
+Bump 64-bit IRQ stack size to 64 KB.
+
+I had a kernel IRQ stack overflow on the mx3210 debian buildd machine. This patch increases the
+64-bit IRQ stack size to 64 KB. The 64-bit stack size needs to be larger than the 32-bit stack
+size since registers are twice as big.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/irq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index e76c86619949..60f5829d476f 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -376,7 +376,11 @@ static inline int eirr_to_irq(unsigned long eirr)
+ /*
+ * IRQ STACK - used for irq handler
+ */
++#ifdef CONFIG_64BIT
++#define IRQ_STACK_SIZE (4096 << 4) /* 64k irq stack size */
++#else
+ #define IRQ_STACK_SIZE (4096 << 3) /* 32k irq stack size */
++#endif
+
+ union irq_stack_union {
+ unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)];
+--
+2.30.1
+
--- /dev/null
+From 15898b7fec61e34dc92c87e752a1250885251bcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 12:26:55 +0100
+Subject: PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit 907830b0fc9e374d00f3c83de5e426157b482c01 ]
+
+RX 5600 XT Pulse advertises support for BAR 0 being 256MB, 512MB,
+or 1GB, but it also supports 2GB, 4GB, and 8GB. Add a rebar
+size quirk so that the BAR 0 is big enough to cover complete VARM.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20210107175017.15893-5-nirmoy.das@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 6427cbd0a5be..5c9345072510 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3577,7 +3577,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)
+ return 0;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap);
+- return (cap & PCI_REBAR_CAP_SIZES) >> 4;
++ cap &= PCI_REBAR_CAP_SIZES;
++
++ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */
++ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f &&
++ bar == 0 && cap == 0x7000)
++ cap = 0x3f000;
++
++ return cap >> 4;
+ }
+
+ /**
+--
+2.30.1
+
--- /dev/null
+From 6835451fc2205173f2f482589717a165162ce079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 11:13:24 -0800
+Subject: perf/x86/kvm: Add Cascade Lake Xeon steppings to isolation_ucodes[]
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit b3c3361fe325074d4144c29d46daae4fc5a268d5 ]
+
+Cascade Lake Xeon parts have the same model number as Skylake Xeon
+parts, so they are tagged with the intel_pebs_isolation
+quirk. However, as with Skylake Xeon H0 stepping parts, the PEBS
+isolation issue is fixed in all microcode versions.
+
+Add the Cascade Lake Xeon steppings (5, 6, and 7) to the
+isolation_ucodes[] table so that these parts benefit from Andi's
+optimization in commit 9b545c04abd4f ("perf/x86/kvm: Avoid unnecessary
+work in guest filtering").
+
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Link: https://lkml.kernel.org/r/20210205191324.2889006-1-jmattson@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 7d4d89fa8647..aaa7bffdb20f 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4384,6 +4384,9 @@ static const struct x86_cpu_desc isolation_ucodes[] = {
+ INTEL_CPU_DESC(INTEL_FAM6_BROADWELL_X, 2, 0x0b000014),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 3, 0x00000021),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 4, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 5, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 6, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 7, 0x00000000),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_L, 3, 0x0000007c),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE, 3, 0x0000007c),
+ INTEL_CPU_DESC(INTEL_FAM6_KABYLAKE, 9, 0x0000004e),
+--
+2.30.1
+
--- /dev/null
+From a818d5b40b9abca9a4ae5a627b906c09b90383df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 20:42:29 +0800
+Subject: pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
+
+From: Di Zhu <zhudi21@huawei.com>
+
+[ Upstream commit 275b1e88cabb34dbcbe99756b67e9939d34a99b6 ]
+
+pktgen create threads for all online cpus and bond these threads to
+relevant cpu repecivtily. when this thread firstly be woken up, it
+will compare cpu currently running with the cpu specified at the time
+of creation and if the two cpus are not equal, BUG_ON() will take effect
+causing panic on the system.
+Notice that these threads could be migrated to other cpus before start
+running because of the cpu hotplug after these threads have created. so the
+BUG_ON() used here seems unreasonable and we can replace it with WARN_ON()
+to just printf a warning other than panic the system.
+
+Signed-off-by: Di Zhu <zhudi21@huawei.com>
+Link: https://lore.kernel.org/r/20210125124229.19334-1-zhudi21@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/pktgen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 105978604ffd..3fba429f1f57 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3464,7 +3464,7 @@ static int pktgen_thread_worker(void *arg)
+ struct pktgen_dev *pkt_dev = NULL;
+ int cpu = t->cpu;
+
+- BUG_ON(smp_processor_id() != cpu);
++ WARN_ON(smp_processor_id() != cpu);
+
+ init_waitqueue_head(&t->queue);
+ complete(&t->start_done);
+--
+2.30.1
+
--- /dev/null
+From f7eb9fd0e5f8c0aded23069f7c7293765e45e815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 08:35:53 +0100
+Subject: sched/features: Fix hrtick reprogramming
+
+From: Juri Lelli <juri.lelli@redhat.com>
+
+[ Upstream commit 156ec6f42b8d300dbbf382738ff35c8bad8f4c3a ]
+
+Hung tasks and RCU stall cases were reported on systems which were not
+100% busy. Investigation of such unexpected cases (no sign of potential
+starvation caused by tasks hogging the system) pointed out that the
+periodic sched tick timer wasn't serviced anymore after a certain point
+and that caused all machinery that depends on it (timers, RCU, etc.) to
+stop working as well. This issues was however only reproducible if
+HRTICK was enabled.
+
+Looking at core dumps it was found that the rbtree of the hrtimer base
+used also for the hrtick was corrupted (i.e. next as seen from the base
+root and actual leftmost obtained by traversing the tree are different).
+Same base is also used for periodic tick hrtimer, which might get "lost"
+if the rbtree gets corrupted.
+
+Much alike what described in commit 1f71addd34f4c ("tick/sched: Do not
+mess with an enqueued hrtimer") there is a race window between
+hrtimer_set_expires() in hrtick_start and hrtimer_start_expires() in
+__hrtick_restart() in which the former might be operating on an already
+queued hrtick hrtimer, which might lead to corruption of the base.
+
+Use hrtick_start() (which removes the timer before enqueuing it back) to
+ensure hrtick hrtimer reprogramming is entirely guarded by the base
+lock, so that no race conditions can occur.
+
+Signed-off-by: Juri Lelli <juri.lelli@redhat.com>
+Signed-off-by: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
+Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20210208073554.14629-2-juri.lelli@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 8 +++-----
+ kernel/sched/sched.h | 1 +
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 269165bf440a..3a150445e0cb 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -363,8 +363,9 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer)
+ static void __hrtick_restart(struct rq *rq)
+ {
+ struct hrtimer *timer = &rq->hrtick_timer;
++ ktime_t time = rq->hrtick_time;
+
+- hrtimer_start_expires(timer, HRTIMER_MODE_ABS_PINNED_HARD);
++ hrtimer_start(timer, time, HRTIMER_MODE_ABS_PINNED_HARD);
+ }
+
+ /*
+@@ -388,7 +389,6 @@ static void __hrtick_start(void *arg)
+ void hrtick_start(struct rq *rq, u64 delay)
+ {
+ struct hrtimer *timer = &rq->hrtick_timer;
+- ktime_t time;
+ s64 delta;
+
+ /*
+@@ -396,9 +396,7 @@ void hrtick_start(struct rq *rq, u64 delay)
+ * doesn't make sense and can cause timer DoS.
+ */
+ delta = max_t(s64, delay, 10000LL);
+- time = ktime_add_ns(timer->base->get_time(), delta);
+-
+- hrtimer_set_expires(timer, time);
++ rq->hrtick_time = ktime_add_ns(timer->base->get_time(), delta);
+
+ if (rq == this_rq())
+ __hrtick_restart(rq);
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index c122176c627e..fac1b121d113 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -1018,6 +1018,7 @@ struct rq {
+ call_single_data_t hrtick_csd;
+ #endif
+ struct hrtimer hrtick_timer;
++ ktime_t hrtick_time;
+ #endif
+
+ #ifdef CONFIG_SCHEDSTATS
+--
+2.30.1
+
rcu-nocb-trigger-self-ipi-on-late-deferred-wake-up-b.patch
entry-explicitly-flush-pending-rcuog-wakeup-before-l.patch
entry-kvm-explicitly-flush-pending-rcuog-wakeup-befo.patch
+edac-amd64-do-not-load-on-family-0x15-model-0x13.patch
+staging-fwserial-fix-error-handling-in-fwserial_crea.patch
+x86-reboot-add-zotac-zbox-ci327-nano-pci-reboot-quir.patch
+vt-consolemap-do-font-sum-unsigned.patch
+wlcore-fix-command-execute-failure-19-for-wl12xx.patch
+bluetooth-hci_h5-set-hci_quirk_simultaneous_discover.patch
+bluetooth-btusb-fix-memory-leak-on-suspend-and-resum.patch
+mt76-mt7615-reset-token-when-mac_reset-happens.patch
+pktgen-fix-misuse-of-bug_on-in-pktgen_thread_worker.patch
+ath10k-fix-wmi-mgmt-tx-queue-full-due-to-race-condit.patch
+net-sfp-add-mode-quirk-for-gpon-module-ubiquiti-u-fi.patch
+bluetooth-add-new-hci_quirk_no_suspend_notifier-quir.patch
+bluetooth-fix-null-pointer-dereference-in-amp_read_l.patch
+staging-most-sound-add-sanity-check-for-function-arg.patch
+staging-bcm2835-audio-replace-unsafe-strcpy-with-str.patch
+brcmfmac-add-dmi-nvram-filename-quirk-for-predia-bas.patch
+brcmfmac-add-dmi-nvram-filename-quirk-for-voyo-winpa.patch
+drm-hisilicon-fix-use-after-free.patch
+crypto-tcrypt-avoid-signed-overflow-in-byte-count.patch
+fs-make-unlazy_walk-error-handling-consistent.patch
+drm-amdgpu-add-check-to-prevent-ih-overflow.patch
+pci-add-a-rebar-size-quirk-for-sapphire-rx-5600-xt-p.patch
+asoc-intel-bytcr_rt5640-add-new-byt_rt5640_no_speake.patch
+drm-amd-display-guard-against-null-pointer-deref-whe.patch
+drm-amd-amdgpu-add-error-handling-to-amdgpu_virt_rea.patch
+media-uvcvideo-allow-entities-with-no-pads.patch
+f2fs-handle-unallocated-section-and-zone-on-pinned-a.patch
+f2fs-fix-to-set-clear-i_linkable-under-i_lock.patch
+nvme-core-add-cancel-tagset-helpers.patch
+nvme-rdma-add-clean-action-for-failed-reconnection.patch
+nvme-tcp-add-clean-action-for-failed-reconnection.patch
+asoc-intel-add-dmi-quirk-table-to-soc_intel_is_byt_c.patch
+btrfs-fix-error-handling-in-commit_fs_roots.patch
+drm-amdgpu-enable-only-one-high-prio-compute-queue.patch
+perf-x86-kvm-add-cascade-lake-xeon-steppings-to-isol.patch
+asoc-intel-sof-sdw-indent-and-add-quirks-consistentl.patch
+asoc-intel-sof_sdw-detect-dmic-number-based-on-mach-.patch
+parisc-bump-64-bit-irq-stack-size-to-64-kb.patch
+sched-features-fix-hrtick-reprogramming.patch
+asoc-intel-bytcr_rt5640-add-quirk-for-the-estar-beau.patch
+asoc-intel-bytcr_rt5640-add-quirk-for-the-voyo-winpa.patch
+asoc-intel-bytcr_rt5651-add-quirk-for-the-jumper-ezp.patch
+asoc-intel-bytcr_rt5640-add-quirk-for-the-acer-one-s.patch
--- /dev/null
+From 60f888c731d3838cc507408980f2922e554f5b6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 08:25:02 +0100
+Subject: staging: bcm2835-audio: Replace unsafe strcpy() with strscpy()
+
+From: Juerg Haefliger <juerg.haefliger@canonical.com>
+
+[ Upstream commit 4964a4300660d27907ceb655f219ac47e5941534 ]
+
+Replace strcpy() with strscpy() in bcm2835-audio/bcm2835.c to prevent the
+following when loading snd-bcm2835:
+
+[ 58.480634] ------------[ cut here ]------------
+[ 58.485321] kernel BUG at lib/string.c:1149!
+[ 58.489650] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+[ 58.495214] Modules linked in: snd_bcm2835(COE+) snd_pcm snd_timer snd dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua btsdio bluetooth ecdh_generic ecc bcm2835_v4l2(CE) bcm2835_codec(CE) brcmfmac bcm2835_isp(CE) bcm2835_mmal_vchiq(CE) brcmutil cfg80211 v4l2_mem2mem videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops raspberrypi_hwmon videobuf2_v4l2 videobuf2_common videodev bcm2835_gpiomem mc vc_sm_cma(CE) rpivid_mem uio_pdrv_genirq uio sch_fq_codel drm ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 multipath linear dwc2 roles spidev udc_core crct10dif_ce xhci_pci xhci_pci_renesas phy_generic aes_neon_bs aes_neon_blk crypto_simd cryptd
+[ 58.563787] CPU: 3 PID: 1959 Comm: insmod Tainted: G C OE 5.11.0-1001-raspi #1
+[ 58.572172] Hardware name: Raspberry Pi 4 Model B Rev 1.2 (DT)
+[ 58.578086] pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
+[ 58.584178] pc : fortify_panic+0x20/0x24
+[ 58.588161] lr : fortify_panic+0x20/0x24
+[ 58.592136] sp : ffff800010a83990
+[ 58.595491] x29: ffff800010a83990 x28: 0000000000000002
+[ 58.600879] x27: ffffb0b07cb72928 x26: 0000000000000000
+[ 58.606268] x25: ffff39e884973838 x24: ffffb0b07cb74190
+[ 58.611655] x23: ffffb0b07cb72030 x22: 0000000000000000
+[ 58.617042] x21: ffff39e884973014 x20: ffff39e88b793010
+[ 58.622428] x19: ffffb0b07cb72670 x18: 0000000000000030
+[ 58.627814] x17: 0000000000000000 x16: ffffb0b092ce2c1c
+[ 58.633200] x15: ffff39e88b901500 x14: 0720072007200720
+[ 58.638588] x13: 0720072007200720 x12: 0720072007200720
+[ 58.643979] x11: ffffb0b0936cbdf0 x10: 00000000fffff000
+[ 58.649366] x9 : ffffb0b09220cfa8 x8 : 0000000000000000
+[ 58.654752] x7 : ffffb0b093673df0 x6 : ffffb0b09364e000
+[ 58.660140] x5 : 0000000000000000 x4 : ffff39e93b7db948
+[ 58.665526] x3 : ffff39e93b7ebcf0 x2 : 0000000000000000
+[ 58.670913] x1 : 0000000000000000 x0 : 0000000000000022
+[ 58.676299] Call trace:
+[ 58.678775] fortify_panic+0x20/0x24
+[ 58.682402] snd_bcm2835_alsa_probe+0x5b8/0x7d8 [snd_bcm2835]
+[ 58.688247] platform_probe+0x74/0xe4
+[ 58.691963] really_probe+0xf0/0x510
+[ 58.695585] driver_probe_device+0xe0/0x100
+[ 58.699826] device_driver_attach+0xcc/0xd4
+[ 58.704068] __driver_attach+0xb0/0x17c
+[ 58.707956] bus_for_each_dev+0x7c/0xd4
+[ 58.711843] driver_attach+0x30/0x40
+[ 58.715467] bus_add_driver+0x154/0x250
+[ 58.719354] driver_register+0x84/0x140
+[ 58.723242] __platform_driver_register+0x34/0x40
+[ 58.728013] bcm2835_alsa_driver_init+0x30/0x1000 [snd_bcm2835]
+[ 58.734024] do_one_initcall+0x54/0x300
+[ 58.737914] do_init_module+0x60/0x280
+[ 58.741719] load_module+0x680/0x770
+[ 58.745344] __do_sys_finit_module+0xbc/0x130
+[ 58.749761] __arm64_sys_finit_module+0x2c/0x40
+[ 58.754356] el0_svc_common.constprop.0+0x88/0x220
+[ 58.759216] do_el0_svc+0x30/0xa0
+[ 58.762575] el0_svc+0x28/0x70
+[ 58.765669] el0_sync_handler+0x1a4/0x1b0
+[ 58.769732] el0_sync+0x178/0x180
+[ 58.773095] Code: aa0003e1 91366040 910003fd 97ffee21 (d4210000)
+[ 58.779275] ---[ end trace 29be5b17497bd898 ]---
+[ 58.783955] note: insmod[1959] exited with preempt_count 1
+[ 58.791921] ------------[ cut here ]------------
+
+For the sake of it, replace all the other occurences of strcpy() under
+bcm2835-audio/ as well.
+
+Signed-off-by: Juerg Haefliger <juergh@canonical.com>
+Link: https://lore.kernel.org/r/20210205072502.10907-1-juergh@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c | 6 +++---
+ drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c | 2 +-
+ drivers/staging/vc04_services/bcm2835-audio/bcm2835.c | 6 +++---
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+index 4c2cae99776b..3703409715da 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+@@ -224,7 +224,7 @@ int snd_bcm2835_new_ctl(struct bcm2835_chip *chip)
+ {
+ int err;
+
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ err = create_ctls(chip, ARRAY_SIZE(snd_bcm2835_ctl), snd_bcm2835_ctl);
+ if (err < 0)
+ return err;
+@@ -261,7 +261,7 @@ static const struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = {
+
+ int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip)
+ {
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_headphones_ctl),
+ snd_bcm2835_headphones_ctl);
+ }
+@@ -295,7 +295,7 @@ static const struct snd_kcontrol_new snd_bcm2835_hdmi[] = {
+
+ int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip)
+ {
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_hdmi),
+ snd_bcm2835_hdmi);
+ }
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+index f783b632141b..096f2c54258a 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+@@ -334,7 +334,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+
+ pcm->private_data = chip;
+ pcm->nonatomic = true;
+- strcpy(pcm->name, name);
++ strscpy(pcm->name, name, sizeof(pcm->name));
+ if (!spdif) {
+ chip->dest = route;
+ chip->volume = 0;
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+index cf5f80f5ca6b..c250fbef2fa3 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+@@ -185,9 +185,9 @@ static int snd_add_child_device(struct device *dev,
+ goto error;
+ }
+
+- strcpy(card->driver, audio_driver->driver.name);
+- strcpy(card->shortname, audio_driver->shortname);
+- strcpy(card->longname, audio_driver->longname);
++ strscpy(card->driver, audio_driver->driver.name, sizeof(card->driver));
++ strscpy(card->shortname, audio_driver->shortname, sizeof(card->shortname));
++ strscpy(card->longname, audio_driver->longname, sizeof(card->longname));
+
+ err = audio_driver->newpcm(chip, audio_driver->shortname,
+ audio_driver->route,
+--
+2.30.1
+
--- /dev/null
+From 1251b47e7c63373fe49c7c6c21dccb2d707f4490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 20:24:35 +0800
+Subject: staging: fwserial: Fix error handling in fwserial_create
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit f31559af97a0eabd467e4719253675b7dccb8a46 ]
+
+When fw_core_add_address_handler() fails, we need to destroy
+the port by tty_port_destroy(). Also we need to unregister
+the address handler by fw_core_remove_address_handler() on
+failure.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20201221122437.10274-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fwserial/fwserial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
+index db83d34cd677..c368082aae1a 100644
+--- a/drivers/staging/fwserial/fwserial.c
++++ b/drivers/staging/fwserial/fwserial.c
+@@ -2189,6 +2189,7 @@ static int fwserial_create(struct fw_unit *unit)
+ err = fw_core_add_address_handler(&port->rx_handler,
+ &fw_high_memory_region);
+ if (err) {
++ tty_port_destroy(&port->port);
+ kfree(port);
+ goto free_ports;
+ }
+@@ -2271,6 +2272,7 @@ unregister_ttys:
+
+ free_ports:
+ for (--i; i >= 0; --i) {
++ fw_core_remove_address_handler(&serial->ports[i]->rx_handler);
+ tty_port_destroy(&serial->ports[i]->port);
+ kfree(serial->ports[i]);
+ }
+--
+2.30.1
+
--- /dev/null
+From 590c1292a683094db39054360ad6585d64bc3ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:21:05 +0100
+Subject: staging: most: sound: add sanity check for function argument
+
+From: Christian Gromm <christian.gromm@microchip.com>
+
+[ Upstream commit 45b754ae5b82949dca2b6e74fa680313cefdc813 ]
+
+This patch checks the function parameter 'bytes' before doing the
+subtraction to prevent memory corruption.
+
+Signed-off-by: Christian Gromm <christian.gromm@microchip.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/1612282865-21846-1-git-send-email-christian.gromm@microchip.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/most/sound/sound.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c
+index 8a449ab9bdce..b7666a7b1760 100644
+--- a/drivers/staging/most/sound/sound.c
++++ b/drivers/staging/most/sound/sound.c
+@@ -96,6 +96,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
+ {
+ unsigned int i = 0;
+
++ if (bytes < 2)
++ return;
+ while (i < bytes - 2) {
+ dest[i] = source[i + 2];
+ dest[i + 1] = source[i + 1];
+--
+2.30.1
+
--- /dev/null
+From 8f2ea9940245a175c64a64613ded37636103536b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 13:02:34 +0100
+Subject: vt/consolemap: do font sum unsigned
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit 9777f8e60e718f7b022a94f2524f967d8def1931 ]
+
+The constant 20 makes the font sum computation signed which can lead to
+sign extensions and signed wraps. It's not much of a problem as we build
+with -fno-strict-overflow. But if we ever decide not to, be ready, so
+switch the constant to unsigned.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20210105120239.28031-7-jslaby@suse.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/consolemap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
+index 5d778c0aa009..8ba0dc51a1f1 100644
+--- a/drivers/tty/vt/consolemap.c
++++ b/drivers/tty/vt/consolemap.c
+@@ -495,7 +495,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
+
+ p2[unicode & 0x3f] = fontpos;
+
+- p->sum += (fontpos << 20) + unicode;
++ p->sum += (fontpos << 20U) + unicode;
+
+ return 0;
+ }
+--
+2.30.1
+
--- /dev/null
+From fdd86261ebe5047bbfc7333a5afe7cd8e6f38b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 08:56:13 +0200
+Subject: wlcore: Fix command execute failure 19 for wl12xx
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit cb88d01b67383a095e3f7caeb4cdade5a6cf0417 ]
+
+We can currently get a "command execute failure 19" error on beacon loss
+if the signal is weak:
+
+wlcore: Beacon loss detected. roles:0xff
+wlcore: Connection loss work (role_id: 0).
+...
+wlcore: ERROR command execute failure 19
+...
+WARNING: CPU: 0 PID: 1552 at drivers/net/wireless/ti/wlcore/main.c:803
+...
+(wl12xx_queue_recovery_work.part.0 [wlcore])
+(wl12xx_cmd_role_start_sta [wlcore])
+(wl1271_op_bss_info_changed [wlcore])
+(ieee80211_prep_connection [mac80211])
+
+Error 19 is defined as CMD_STATUS_WRONG_NESTING from the wlcore firmware,
+and seems to mean that the firmware no longer wants to see the quirk
+handling for WLCORE_QUIRK_START_STA_FAILS done.
+
+This quirk got added with commit 18eab430700d ("wlcore: workaround
+start_sta problem in wl12xx fw"), and it seems that this already got fixed
+in the firmware long time ago back in 2012 as wl18xx never had this quirk
+in place to start with.
+
+As we no longer even support firmware that early, to me it seems that it's
+safe to just drop WLCORE_QUIRK_START_STA_FAILS to fix the error. Looks
+like earlier firmware got disabled back in 2013 with commit 0e284c074ef9
+("wl12xx: increase minimum singlerole firmware version required").
+
+If it turns out we still need WLCORE_QUIRK_START_STA_FAILS with any
+firmware that the driver works with, we can simply revert this patch and
+add extra checks for firmware version used.
+
+With this fix wlcore reconnects properly after a beacon loss.
+
+Cc: Raz Bouganim <r-bouganim@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210115065613.7731-1-tony@atomide.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wl12xx/main.c | 3 ---
+ drivers/net/wireless/ti/wlcore/main.c | 15 +--------------
+ drivers/net/wireless/ti/wlcore/wlcore.h | 3 ---
+ 3 files changed, 1 insertion(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
+index 3c9c623bb428..9d7dbfe7fe0c 100644
+--- a/drivers/net/wireless/ti/wl12xx/main.c
++++ b/drivers/net/wireless/ti/wl12xx/main.c
+@@ -635,7 +635,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+ wl->mr_fw_name = WL127X_FW_NAME_MULTI;
+@@ -659,7 +658,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->plt_fw_name = WL127X_PLT_FW_NAME;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+@@ -688,7 +686,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+
+ wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER,
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 6863fd552d5e..6e402d62dbe4 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -2872,21 +2872,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+
+ if (is_ibss)
+ ret = wl12xx_cmd_role_start_ibss(wl, wlvif);
+- else {
+- if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) {
+- /*
+- * TODO: this is an ugly workaround for wl12xx fw
+- * bug - we are not able to tx/rx after the first
+- * start_sta, so make dummy start+stop calls,
+- * and then call start_sta again.
+- * this should be fixed in the fw.
+- */
+- wl12xx_cmd_role_start_sta(wl, wlvif);
+- wl12xx_cmd_role_stop_sta(wl, wlvif);
+- }
+-
++ else
+ ret = wl12xx_cmd_role_start_sta(wl, wlvif);
+- }
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
+index b7821311ac75..81c94d390623 100644
+--- a/drivers/net/wireless/ti/wlcore/wlcore.h
++++ b/drivers/net/wireless/ti/wlcore/wlcore.h
+@@ -547,9 +547,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
+ /* Each RX/TX transaction requires an end-of-transaction transfer */
+ #define WLCORE_QUIRK_END_OF_TRANSACTION BIT(0)
+
+-/* the first start_role(sta) sometimes doesn't work on wl12xx */
+-#define WLCORE_QUIRK_START_STA_FAILS BIT(1)
+-
+ /* wl127x and SPI don't support SDIO block size alignment */
+ #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN BIT(2)
+
+--
+2.30.1
+
--- /dev/null
+From 6c244c4e581485a3a6b1d01b9684990f2bd0db0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 12:39:57 +0100
+Subject: x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 4b2d8ca9208be636b30e924b1cbcb267b0740c93 ]
+
+On this system the M.2 PCIe WiFi card isn't detected after reboot, only
+after cold boot. reboot=pci fixes this behavior. In [0] the same issue
+is described, although on another system and with another Intel WiFi
+card. In case it's relevant, both systems have Celeron CPUs.
+
+Add a PCI reboot quirk on affected systems until a more generic fix is
+available.
+
+[0] https://bugzilla.kernel.org/show_bug.cgi?id=202399
+
+ [ bp: Massage commit message. ]
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/1524eafd-f89c-cfa4-ed70-0bde9e45eec9@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/reboot.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index efbaef8b4de9..b29657b76e3f 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -477,6 +477,15 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ },
+ },
+
++ { /* PCIe Wifi card isn't detected after reboot otherwise */
++ .callback = set_pci_reboot,
++ .ident = "Zotac ZBOX CI327 nano",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"),
++ },
++ },
++
+ /* Sony */
+ { /* Handle problems with rebooting on Sony VGN-Z540N */
+ .callback = set_bios_reboot,
+--
+2.30.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
