--- /dev/null
+From b44c018cdf748b96b676ba09fdbc5b34fc443ada Mon Sep 17 00:00:00 2001
+From: Song Liu <songliubraving@fb.com>
+Date: Mon, 5 Oct 2020 09:35:21 -0700
+Subject: md/raid5: fix oops during stripe resizing
+
+From: Song Liu <songliubraving@fb.com>
+
+commit b44c018cdf748b96b676ba09fdbc5b34fc443ada upstream.
+
+KoWei reported crash during raid5 reshape:
+
+[ 1032.252932] Oops: 0002 [#1] SMP PTI
+[...]
+[ 1032.252943] RIP: 0010:memcpy_erms+0x6/0x10
+[...]
+[ 1032.252947] RSP: 0018:ffffba1ac0c03b78 EFLAGS: 00010286
+[ 1032.252949] RAX: 0000784ac0000000 RBX: ffff91bec3d09740 RCX: 0000000000001000
+[ 1032.252951] RDX: 0000000000001000 RSI: ffff91be6781c000 RDI: 0000784ac0000000
+[ 1032.252953] RBP: ffffba1ac0c03bd8 R08: 0000000000001000 R09: ffffba1ac0c03bf8
+[ 1032.252954] R10: 0000000000000000 R11: 0000000000000000 R12: ffffba1ac0c03bf8
+[ 1032.252955] R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000000
+[ 1032.252958] FS: 0000000000000000(0000) GS:ffff91becf500000(0000) knlGS:0000000000000000
+[ 1032.252959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1032.252961] CR2: 0000784ac0000000 CR3: 000000031780a002 CR4: 00000000001606e0
+[ 1032.252962] Call Trace:
+[ 1032.252969] ? async_memcpy+0x179/0x1000 [async_memcpy]
+[ 1032.252977] ? raid5_release_stripe+0x8e/0x110 [raid456]
+[ 1032.252982] handle_stripe_expansion+0x15a/0x1f0 [raid456]
+[ 1032.252988] handle_stripe+0x592/0x1270 [raid456]
+[ 1032.252993] handle_active_stripes.isra.0+0x3cb/0x5a0 [raid456]
+[ 1032.252999] raid5d+0x35c/0x550 [raid456]
+[ 1032.253002] ? schedule+0x42/0xb0
+[ 1032.253006] ? schedule_timeout+0x10e/0x160
+[ 1032.253011] md_thread+0x97/0x160
+[ 1032.253015] ? wait_woken+0x80/0x80
+[ 1032.253019] kthread+0x104/0x140
+[ 1032.253022] ? md_start_sync+0x60/0x60
+[ 1032.253024] ? kthread_park+0x90/0x90
+[ 1032.253027] ret_from_fork+0x35/0x40
+
+This is because cache_size_mutex was unlocked too early in resize_stripes,
+which races with grow_one_stripe() that grow_one_stripe() allocates a
+stripe with wrong pool_size.
+
+Fix this issue by unlocking cache_size_mutex after updating pool_size.
+
+Cc: <stable@vger.kernel.org> # v4.4+
+Reported-by: KoWei Sung <winders@amazon.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid5.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2407,8 +2407,6 @@ static int resize_stripes(struct r5conf
+ } else
+ err = -ENOMEM;
+
+- mutex_unlock(&conf->cache_size_mutex);
+-
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+
+@@ -2431,6 +2429,8 @@ static int resize_stripes(struct r5conf
+
+ if (!err)
+ conf->pool_size = newsize;
++ mutex_unlock(&conf->cache_size_mutex);
++
+ return err;
+ }
+
--- /dev/null
+From f23cc3ba491af77395cea3f9d51204398729f26b Mon Sep 17 00:00:00 2001
+From: Raul E Rangel <rrangel@chromium.org>
+Date: Mon, 28 Sep 2020 15:59:20 -0600
+Subject: mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN
+
+From: Raul E Rangel <rrangel@chromium.org>
+
+commit f23cc3ba491af77395cea3f9d51204398729f26b upstream.
+
+This change fixes HS400 tuning for devices with invalid presets.
+
+SDHCI presets are not currently used for eMMC HS/HS200/HS400, but are
+used for DDR52. The HS400 retuning sequence is:
+
+ HS400->DDR52->HS->HS200->Perform Tuning->HS->HS400
+
+This means that when HS400 tuning happens, we transition through DDR52
+for a very brief period. This causes presets to be enabled
+unintentionally and stay enabled when transitioning back to HS200 or
+HS400. Some firmware has invalid presets, so we end up with driver
+strengths that can cause I/O problems.
+
+Fixes: 34597a3f60b1 ("mmc: sdhci-acpi: Add support for ACPI HID of AMD Controller with HS400")
+Signed-off-by: Raul E Rangel <rrangel@chromium.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200928154718.1.Icc21d4b2f354e83e26e57e270dc952f5fe0b0a40@changeid
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-acpi.c | 37 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -658,6 +658,43 @@ static int sdhci_acpi_emmc_amd_probe_slo
+ (host->mmc->caps & MMC_CAP_1_8V_DDR))
+ host->mmc->caps2 = MMC_CAP2_HS400_1_8V;
+
++ /*
++ * There are two types of presets out in the wild:
++ * 1) Default/broken presets.
++ * These presets have two sets of problems:
++ * a) The clock divisor for SDR12, SDR25, and SDR50 is too small.
++ * This results in clock frequencies that are 2x higher than
++ * acceptable. i.e., SDR12 = 25 MHz, SDR25 = 50 MHz, SDR50 =
++ * 100 MHz.x
++ * b) The HS200 and HS400 driver strengths don't match.
++ * By default, the SDR104 preset register has a driver strength of
++ * A, but the (internal) HS400 preset register has a driver
++ * strength of B. As part of initializing HS400, HS200 tuning
++ * needs to be performed. Having different driver strengths
++ * between tuning and operation is wrong. It results in different
++ * rise/fall times that lead to incorrect sampling.
++ * 2) Firmware with properly initialized presets.
++ * These presets have proper clock divisors. i.e., SDR12 => 12MHz,
++ * SDR25 => 25 MHz, SDR50 => 50 MHz. Additionally the HS200 and
++ * HS400 preset driver strengths match.
++ *
++ * Enabling presets for HS400 doesn't work for the following reasons:
++ * 1) sdhci_set_ios has a hard coded list of timings that are used
++ * to determine if presets should be enabled.
++ * 2) sdhci_get_preset_value is using a non-standard register to
++ * read out HS400 presets. The AMD controller doesn't support this
++ * non-standard register. In fact, it doesn't expose the HS400
++ * preset register anywhere in the SDHCI memory map. This results
++ * in reading a garbage value and using the wrong presets.
++ *
++ * Since HS400 and HS200 presets must be identical, we could
++ * instead use the the SDR104 preset register.
++ *
++ * If the above issues are resolved we could remove this quirk for
++ * firmware that that has valid presets (i.e., SDR12 <= 12 MHz).
++ */
++ host->quirks2 |= SDHCI_QUIRK2_PRESET_VALUE_BROKEN;
++
+ host->mmc_host_ops.select_drive_strength = amd_select_drive_strength;
+ host->mmc_host_ops.set_ios = amd_set_ios;
+ host->mmc_host_ops.execute_tuning = amd_sdhci_execute_tuning;
--- /dev/null
+From 46f4a69ec8ed6ab9f6a6172afe50df792c8bc1b6 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Tue, 18 Aug 2020 13:45:08 +0300
+Subject: mmc: sdhci: Add LTR support for some Intel BYT based controllers
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 46f4a69ec8ed6ab9f6a6172afe50df792c8bc1b6 upstream.
+
+Some Intel BYT based host controllers support the setting of latency
+tolerance. Accordingly, implement the PM QoS ->set_latency_tolerance()
+callback. The raw register values are also exposed via debugfs.
+
+Intel EHL controllers require this support.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: cb3a7d4a0aec4e ("mmc: sdhci-pci: Add support for Intel EHL")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200818104508.7149-1-adrian.hunter@intel.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pci-core.c | 154 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 154 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -24,6 +24,8 @@
+ #include <linux/iopoll.h>
+ #include <linux/gpio.h>
+ #include <linux/pm_runtime.h>
++#include <linux/pm_qos.h>
++#include <linux/debugfs.h>
+ #include <linux/mmc/slot-gpio.h>
+ #include <linux/mmc/sdhci-pci-data.h>
+ #include <linux/acpi.h>
+@@ -520,6 +522,8 @@ struct intel_host {
+ bool rpm_retune_ok;
+ u32 glk_rx_ctrl1;
+ u32 glk_tun_val;
++ u32 active_ltr;
++ u32 idle_ltr;
+ };
+
+ static const guid_t intel_dsm_guid =
+@@ -764,6 +768,108 @@ static int intel_execute_tuning(struct m
+ return 0;
+ }
+
++#define INTEL_ACTIVELTR 0x804
++#define INTEL_IDLELTR 0x808
++
++#define INTEL_LTR_REQ BIT(15)
++#define INTEL_LTR_SCALE_MASK GENMASK(11, 10)
++#define INTEL_LTR_SCALE_1US (2 << 10)
++#define INTEL_LTR_SCALE_32US (3 << 10)
++#define INTEL_LTR_VALUE_MASK GENMASK(9, 0)
++
++static void intel_cache_ltr(struct sdhci_pci_slot *slot)
++{
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ struct sdhci_host *host = slot->host;
++
++ intel_host->active_ltr = readl(host->ioaddr + INTEL_ACTIVELTR);
++ intel_host->idle_ltr = readl(host->ioaddr + INTEL_IDLELTR);
++}
++
++static void intel_ltr_set(struct device *dev, s32 val)
++{
++ struct sdhci_pci_chip *chip = dev_get_drvdata(dev);
++ struct sdhci_pci_slot *slot = chip->slots[0];
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ struct sdhci_host *host = slot->host;
++ u32 ltr;
++
++ pm_runtime_get_sync(dev);
++
++ /*
++ * Program latency tolerance (LTR) accordingly what has been asked
++ * by the PM QoS layer or disable it in case we were passed
++ * negative value or PM_QOS_LATENCY_ANY.
++ */
++ ltr = readl(host->ioaddr + INTEL_ACTIVELTR);
++
++ if (val == PM_QOS_LATENCY_ANY || val < 0) {
++ ltr &= ~INTEL_LTR_REQ;
++ } else {
++ ltr |= INTEL_LTR_REQ;
++ ltr &= ~INTEL_LTR_SCALE_MASK;
++ ltr &= ~INTEL_LTR_VALUE_MASK;
++
++ if (val > INTEL_LTR_VALUE_MASK) {
++ val >>= 5;
++ if (val > INTEL_LTR_VALUE_MASK)
++ val = INTEL_LTR_VALUE_MASK;
++ ltr |= INTEL_LTR_SCALE_32US | val;
++ } else {
++ ltr |= INTEL_LTR_SCALE_1US | val;
++ }
++ }
++
++ if (ltr == intel_host->active_ltr)
++ goto out;
++
++ writel(ltr, host->ioaddr + INTEL_ACTIVELTR);
++ writel(ltr, host->ioaddr + INTEL_IDLELTR);
++
++ /* Cache the values into lpss structure */
++ intel_cache_ltr(slot);
++out:
++ pm_runtime_put_autosuspend(dev);
++}
++
++static bool intel_use_ltr(struct sdhci_pci_chip *chip)
++{
++ switch (chip->pdev->device) {
++ case PCI_DEVICE_ID_INTEL_BYT_EMMC:
++ case PCI_DEVICE_ID_INTEL_BYT_EMMC2:
++ case PCI_DEVICE_ID_INTEL_BYT_SDIO:
++ case PCI_DEVICE_ID_INTEL_BYT_SD:
++ case PCI_DEVICE_ID_INTEL_BSW_EMMC:
++ case PCI_DEVICE_ID_INTEL_BSW_SDIO:
++ case PCI_DEVICE_ID_INTEL_BSW_SD:
++ return false;
++ default:
++ return true;
++ }
++}
++
++static void intel_ltr_expose(struct sdhci_pci_chip *chip)
++{
++ struct device *dev = &chip->pdev->dev;
++
++ if (!intel_use_ltr(chip))
++ return;
++
++ dev->power.set_latency_tolerance = intel_ltr_set;
++ dev_pm_qos_expose_latency_tolerance(dev);
++}
++
++static void intel_ltr_hide(struct sdhci_pci_chip *chip)
++{
++ struct device *dev = &chip->pdev->dev;
++
++ if (!intel_use_ltr(chip))
++ return;
++
++ dev_pm_qos_hide_latency_tolerance(dev);
++ dev->power.set_latency_tolerance = NULL;
++}
++
+ static void byt_probe_slot(struct sdhci_pci_slot *slot)
+ {
+ struct mmc_host_ops *ops = &slot->host->mmc_host_ops;
+@@ -778,6 +884,43 @@ static void byt_probe_slot(struct sdhci_
+ ops->start_signal_voltage_switch = intel_start_signal_voltage_switch;
+
+ device_property_read_u32(dev, "max-frequency", &mmc->f_max);
++
++ if (!mmc->slotno) {
++ slot->chip->slots[mmc->slotno] = slot;
++ intel_ltr_expose(slot->chip);
++ }
++}
++
++static void byt_add_debugfs(struct sdhci_pci_slot *slot)
++{
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ struct mmc_host *mmc = slot->host->mmc;
++ struct dentry *dir = mmc->debugfs_root;
++
++ if (!intel_use_ltr(slot->chip))
++ return;
++
++ debugfs_create_x32("active_ltr", 0444, dir, &intel_host->active_ltr);
++ debugfs_create_x32("idle_ltr", 0444, dir, &intel_host->idle_ltr);
++
++ intel_cache_ltr(slot);
++}
++
++static int byt_add_host(struct sdhci_pci_slot *slot)
++{
++ int ret = sdhci_add_host(slot->host);
++
++ if (!ret)
++ byt_add_debugfs(slot);
++ return ret;
++}
++
++static void byt_remove_slot(struct sdhci_pci_slot *slot, int dead)
++{
++ struct mmc_host *mmc = slot->host->mmc;
++
++ if (!mmc->slotno)
++ intel_ltr_hide(slot->chip);
+ }
+
+ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+@@ -859,6 +1002,8 @@ static int glk_emmc_add_host(struct sdhc
+ if (ret)
+ goto cleanup;
+
++ byt_add_debugfs(slot);
++
+ return 0;
+
+ cleanup:
+@@ -1036,6 +1181,8 @@ static const struct sdhci_pci_fixes sdhc
+ #endif
+ .allow_runtime_pm = true,
+ .probe_slot = byt_emmc_probe_slot,
++ .add_host = byt_add_host,
++ .remove_slot = byt_remove_slot,
+ .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC |
+ SDHCI_QUIRK_NO_LED,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+@@ -1049,6 +1196,7 @@ static const struct sdhci_pci_fixes sdhc
+ .allow_runtime_pm = true,
+ .probe_slot = glk_emmc_probe_slot,
+ .add_host = glk_emmc_add_host,
++ .remove_slot = byt_remove_slot,
+ #ifdef CONFIG_PM_SLEEP
+ .suspend = sdhci_cqhci_suspend,
+ .resume = sdhci_cqhci_resume,
+@@ -1079,6 +1227,8 @@ static const struct sdhci_pci_fixes sdhc
+ SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ .allow_runtime_pm = true,
+ .probe_slot = ni_byt_sdio_probe_slot,
++ .add_host = byt_add_host,
++ .remove_slot = byt_remove_slot,
+ .ops = &sdhci_intel_byt_ops,
+ .priv_size = sizeof(struct intel_host),
+ };
+@@ -1096,6 +1246,8 @@ static const struct sdhci_pci_fixes sdhc
+ SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ .allow_runtime_pm = true,
+ .probe_slot = byt_sdio_probe_slot,
++ .add_host = byt_add_host,
++ .remove_slot = byt_remove_slot,
+ .ops = &sdhci_intel_byt_ops,
+ .priv_size = sizeof(struct intel_host),
+ };
+@@ -1115,6 +1267,8 @@ static const struct sdhci_pci_fixes sdhc
+ .allow_runtime_pm = true,
+ .own_cd_for_runtime_pm = true,
+ .probe_slot = byt_sd_probe_slot,
++ .add_host = byt_add_host,
++ .remove_slot = byt_remove_slot,
+ .ops = &sdhci_intel_byt_ops,
+ .priv_size = sizeof(struct intel_host),
+ };
--- /dev/null
+From 680d69635005ba0e58fe3f4c52fc162b8fc743b0 Mon Sep 17 00:00:00 2001
+From: Kim Phillips <kim.phillips@amd.com>
+Date: Tue, 8 Sep 2020 16:47:37 -0500
+Subject: perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
+
+From: Kim Phillips <kim.phillips@amd.com>
+
+commit 680d69635005ba0e58fe3f4c52fc162b8fc743b0 upstream.
+
+get_ibs_op_count() adds hardware's current count (IbsOpCurCnt) bits
+to its count regardless of hardware's valid status.
+
+According to the PPR for AMD Family 17h Model 31h B0 55803 Rev 0.54,
+if the counter rolls over, valid status is set, and the lower 7 bits
+of IbsOpCurCnt are randomized by hardware.
+
+Don't include those bits in the driver's event count.
+
+Fixes: 8b1e13638d46 ("perf/x86-ibs: Fix usage of IBS op current count")
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/amd/ibs.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -335,11 +335,15 @@ static u64 get_ibs_op_count(u64 config)
+ {
+ u64 count = 0;
+
++ /*
++ * If the internal 27-bit counter rolled over, the count is MaxCnt
++ * and the lower 7 bits of CurCnt are randomized.
++ * Otherwise CurCnt has the full 27-bit current counter value.
++ */
+ if (config & IBS_OP_VAL)
+- count += (config & IBS_OP_MAX_CNT) << 4; /* cnt rolled over */
+-
+- if (ibs_caps & IBS_CAPS_RDWROPCNT)
+- count += (config & IBS_OP_CUR_CNT) >> 32;
++ count = (config & IBS_OP_MAX_CNT) << 4;
++ else if (ibs_caps & IBS_CAPS_RDWROPCNT)
++ count = (config & IBS_OP_CUR_CNT) >> 32;
+
+ return count;
+ }
--- /dev/null
+From 36e1be8ada994d509538b3b1d0af8b63c351e729 Mon Sep 17 00:00:00 2001
+From: Kim Phillips <kim.phillips@amd.com>
+Date: Tue, 8 Sep 2020 16:47:38 -0500
+Subject: perf/x86/amd/ibs: Fix raw sample data accumulation
+
+From: Kim Phillips <kim.phillips@amd.com>
+
+commit 36e1be8ada994d509538b3b1d0af8b63c351e729 upstream.
+
+Neither IbsBrTarget nor OPDATA4 are populated in IBS Fetch mode.
+Don't accumulate them into raw sample user data in that case.
+
+Also, in Fetch mode, add saving the IBS Fetch Control Extended MSR.
+
+Technically, there is an ABI change here with respect to the IBS raw
+sample data format, but I don't see any perf driver version information
+being included in perf.data file headers, but, existing users can detect
+whether the size of the sample record has reduced by 8 bytes to
+determine whether the IBS driver has this fix.
+
+Fixes: 904cb3677f3a ("perf/x86/amd/ibs: Update IBS MSRs and feature definitions")
+Reported-by: Stephane Eranian <stephane.eranian@google.com>
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20200908214740.18097-6-kim.phillips@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/amd/ibs.c | 26 ++++++++++++++++----------
+ arch/x86/include/asm/msr-index.h | 1 +
+ 2 files changed, 17 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/events/amd/ibs.c
++++ b/arch/x86/events/amd/ibs.c
+@@ -636,18 +636,24 @@ fail:
+ perf_ibs->offset_max,
+ offset + 1);
+ } while (offset < offset_max);
++ /*
++ * Read IbsBrTarget, IbsOpData4, and IbsExtdCtl separately
++ * depending on their availability.
++ * Can't add to offset_max as they are staggered
++ */
+ if (event->attr.sample_type & PERF_SAMPLE_RAW) {
+- /*
+- * Read IbsBrTarget and IbsOpData4 separately
+- * depending on their availability.
+- * Can't add to offset_max as they are staggered
+- */
+- if (ibs_caps & IBS_CAPS_BRNTRGT) {
+- rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++);
+- size++;
++ if (perf_ibs == &perf_ibs_op) {
++ if (ibs_caps & IBS_CAPS_BRNTRGT) {
++ rdmsrl(MSR_AMD64_IBSBRTARGET, *buf++);
++ size++;
++ }
++ if (ibs_caps & IBS_CAPS_OPDATA4) {
++ rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++);
++ size++;
++ }
+ }
+- if (ibs_caps & IBS_CAPS_OPDATA4) {
+- rdmsrl(MSR_AMD64_IBSOPDATA4, *buf++);
++ if (perf_ibs == &perf_ibs_fetch && (ibs_caps & IBS_CAPS_FETCHCTLEXTD)) {
++ rdmsrl(MSR_AMD64_ICIBSEXTDCTL, *buf++);
+ size++;
+ }
+ }
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -432,6 +432,7 @@
+ #define MSR_AMD64_IBSOP_REG_MASK ((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1)
+ #define MSR_AMD64_IBSCTL 0xc001103a
+ #define MSR_AMD64_IBSBRTARGET 0xc001103b
++#define MSR_AMD64_ICIBSEXTDCTL 0xc001103c
+ #define MSR_AMD64_IBSOPDATA4 0xc001103d
+ #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */
+ #define MSR_AMD64_SEV 0xc0010131
--- /dev/null
+From 010cb00265f150bf82b23c02ad1fb87ce5c781e1 Mon Sep 17 00:00:00 2001
+From: Kan Liang <kan.liang@linux.intel.com>
+Date: Mon, 28 Sep 2020 06:47:26 -0700
+Subject: perf/x86/intel: Fix Ice Lake event constraint table
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+commit 010cb00265f150bf82b23c02ad1fb87ce5c781e1 upstream.
+
+An error occues when sampling non-PEBS INST_RETIRED.PREC_DIST(0x01c0)
+event.
+
+ perf record -e cpu/event=0xc0,umask=0x01/ -- sleep 1
+ Error:
+ The sys_perf_event_open() syscall returned with 22 (Invalid argument)
+ for event (cpu/event=0xc0,umask=0x01/).
+ /bin/dmesg | grep -i perf may provide additional information.
+
+The idxmsk64 of the event is set to 0. The event never be successfully
+scheduled.
+
+The event should be limit to the fixed counter 0.
+
+Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
+Reported-by: Yi, Ammy <ammy.yi@intel.com>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20200928134726.13090-1-kan.liang@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/intel/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -243,7 +243,7 @@ static struct extra_reg intel_skl_extra_
+
+ static struct event_constraint intel_icl_event_constraints[] = {
+ FIXED_EVENT_CONSTRAINT(0x00c0, 0), /* INST_RETIRED.ANY */
+- INTEL_UEVENT_CONSTRAINT(0x1c0, 0), /* INST_RETIRED.PREC_DIST */
++ FIXED_EVENT_CONSTRAINT(0x01c0, 0), /* INST_RETIRED.PREC_DIST */
+ FIXED_EVENT_CONSTRAINT(0x003c, 1), /* CPU_CLK_UNHALTED.CORE */
+ FIXED_EVENT_CONSTRAINT(0x0300, 2), /* CPU_CLK_UNHALTED.REF */
+ FIXED_EVENT_CONSTRAINT(0x0400, 3), /* SLOTS */
--- /dev/null
+From dfe719fef03d752f1682fa8aeddf30ba501c8555 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Mon, 5 Oct 2020 03:44:01 +0200
+Subject: seccomp: Make duplicate listener detection non-racy
+
+From: Jann Horn <jannh@google.com>
+
+commit dfe719fef03d752f1682fa8aeddf30ba501c8555 upstream.
+
+Currently, init_listener() tries to prevent adding a filter with
+SECCOMP_FILTER_FLAG_NEW_LISTENER if one of the existing filters already
+has a listener. However, this check happens without holding any lock that
+would prevent another thread from concurrently installing a new filter
+(potentially with a listener) on top of the ones we already have.
+
+Theoretically, this is also a data race: The plain load from
+current->seccomp.filter can race with concurrent writes to the same
+location.
+
+Fix it by moving the check into the region that holds the siglock to guard
+against concurrent TSYNC.
+
+(The "Fixes" tag points to the commit that introduced the theoretical
+data race; concurrent installation of another filter with TSYNC only
+became possible later, in commit 51891498f2da ("seccomp: allow TSYNC and
+USER_NOTIF together").)
+
+Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace")
+Reviewed-by: Tycho Andersen <tycho@tycho.pizza>
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20201005014401.490175-1-jannh@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/seccomp.c | 38 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 31 insertions(+), 7 deletions(-)
+
+--- a/kernel/seccomp.c
++++ b/kernel/seccomp.c
+@@ -1219,13 +1219,7 @@ static const struct file_operations secc
+
+ static struct file *init_listener(struct seccomp_filter *filter)
+ {
+- struct file *ret = ERR_PTR(-EBUSY);
+- struct seccomp_filter *cur;
+-
+- for (cur = current->seccomp.filter; cur; cur = cur->prev) {
+- if (cur->notif)
+- goto out;
+- }
++ struct file *ret;
+
+ ret = ERR_PTR(-ENOMEM);
+ filter->notif = kzalloc(sizeof(*(filter->notif)), GFP_KERNEL);
+@@ -1252,6 +1246,31 @@ out:
+ return ret;
+ }
+
++/*
++ * Does @new_child have a listener while an ancestor also has a listener?
++ * If so, we'll want to reject this filter.
++ * This only has to be tested for the current process, even in the TSYNC case,
++ * because TSYNC installs @child with the same parent on all threads.
++ * Note that @new_child is not hooked up to its parent at this point yet, so
++ * we use current->seccomp.filter.
++ */
++static bool has_duplicate_listener(struct seccomp_filter *new_child)
++{
++ struct seccomp_filter *cur;
++
++ /* must be protected against concurrent TSYNC */
++ lockdep_assert_held(¤t->sighand->siglock);
++
++ if (!new_child->notif)
++ return false;
++ for (cur = current->seccomp.filter; cur; cur = cur->prev) {
++ if (cur->notif)
++ return true;
++ }
++
++ return false;
++}
++
+ /**
+ * seccomp_set_mode_filter: internal function for setting seccomp filter
+ * @flags: flags to change filter behavior
+@@ -1321,6 +1340,11 @@ static long seccomp_set_mode_filter(unsi
+ if (!seccomp_may_assign_mode(seccomp_mode))
+ goto out;
+
++ if (has_duplicate_listener(prepared)) {
++ ret = -EBUSY;
++ goto out;
++ }
++
+ ret = seccomp_attach_filter(flags, prepared);
+ if (ret)
+ goto out;
--- /dev/null
+From 1b9abd1755ad947d7c9913e92e7837b533124c90 Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 26 Aug 2020 10:00:46 -0700
+Subject: selftests/x86/fsgsbase: Test PTRACE_PEEKUSER for GSBASE with invalid LDT GS
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 1b9abd1755ad947d7c9913e92e7837b533124c90 upstream.
+
+This tests commit:
+
+ 8ab49526b53d ("x86/fsgsbase/64: Fix NULL deref in 86_fsgsbase_read_task")
+
+Unpatched kernels will OOPS.
+
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/c618ae86d1f757e01b1a8e79869f553cb88acf9a.1598461151.git.luto@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/x86/fsgsbase.c | 65 +++++++++++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+--- a/tools/testing/selftests/x86/fsgsbase.c
++++ b/tools/testing/selftests/x86/fsgsbase.c
+@@ -442,6 +442,68 @@ static void test_unexpected_base(void)
+
+ #define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
+
++static void test_ptrace_write_gs_read_base(void)
++{
++ int status;
++ pid_t child = fork();
++
++ if (child < 0)
++ err(1, "fork");
++
++ if (child == 0) {
++ printf("[RUN]\tPTRACE_POKE GS, read GSBASE back\n");
++
++ printf("[RUN]\tARCH_SET_GS to 1\n");
++ if (syscall(SYS_arch_prctl, ARCH_SET_GS, 1) != 0)
++ err(1, "ARCH_SET_GS");
++
++ if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
++ err(1, "PTRACE_TRACEME");
++
++ raise(SIGTRAP);
++ _exit(0);
++ }
++
++ wait(&status);
++
++ if (WSTOPSIG(status) == SIGTRAP) {
++ unsigned long base;
++ unsigned long gs_offset = USER_REGS_OFFSET(gs);
++ unsigned long base_offset = USER_REGS_OFFSET(gs_base);
++
++ /* Read the initial base. It should be 1. */
++ base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
++ if (base == 1) {
++ printf("[OK]\tGSBASE started at 1\n");
++ } else {
++ nerrs++;
++ printf("[FAIL]\tGSBASE started at 0x%lx\n", base);
++ }
++
++ printf("[RUN]\tSet GS = 0x7, read GSBASE\n");
++
++ /* Poke an LDT selector into GS. */
++ if (ptrace(PTRACE_POKEUSER, child, gs_offset, 0x7) != 0)
++ err(1, "PTRACE_POKEUSER");
++
++ /* And read the base. */
++ base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
++
++ if (base == 0 || base == 1) {
++ printf("[OK]\tGSBASE reads as 0x%lx with invalid GS\n", base);
++ } else {
++ nerrs++;
++ printf("[FAIL]\tGSBASE=0x%lx (should be 0 or 1)\n", base);
++ }
++ }
++
++ ptrace(PTRACE_CONT, child, NULL, NULL);
++
++ wait(&status);
++ if (!WIFEXITED(status))
++ printf("[WARN]\tChild didn't exit cleanly.\n");
++}
++
+ static void test_ptrace_write_gsbase(void)
+ {
+ int status;
+@@ -511,6 +573,9 @@ int main()
+ shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
+ MAP_ANONYMOUS | MAP_SHARED, -1, 0);
+
++ /* Do these tests before we have an LDT. */
++ test_ptrace_write_gs_read_base();
++
+ /* Probe FSGSBASE */
+ sethandler(SIGILL, sigill, 0);
+ if (sigsetjmp(jmpbuf, 1) == 0) {
nbd-make-the-config-put-is-called-before-the-notifyi.patch
sgl_alloc_order-fix-memory-leak.patch
nvme-rdma-fix-crash-when-connect-rejected.patch
+md-raid5-fix-oops-during-stripe-resizing.patch
+mmc-sdhci-add-ltr-support-for-some-intel-byt-based-controllers.patch
+mmc-sdhci-acpi-amdi0040-set-sdhci_quirk2_preset_value_broken.patch
+seccomp-make-duplicate-listener-detection-non-racy.patch
+selftests-x86-fsgsbase-test-ptrace_peekuser-for-gsbase-with-invalid-ldt-gs.patch
+perf-x86-intel-fix-ice-lake-event-constraint-table.patch
+perf-x86-amd-ibs-don-t-include-randomized-bits-in-get_ibs_op_count.patch
+perf-x86-amd-ibs-fix-raw-sample-data-accumulation.patch
+spi-sprd-release-dma-channel-also-on-probe-deferral.patch
--- /dev/null
+From 687a2e76186dcfa42f22c14b655c3fb159839e79 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Tue, 1 Sep 2020 17:27:03 +0200
+Subject: spi: sprd: Release DMA channel also on probe deferral
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit 687a2e76186dcfa42f22c14b655c3fb159839e79 upstream.
+
+If dma_request_chan() for TX channel fails with EPROBE_DEFER, the RX
+channel would not be released and on next re-probe it would be requested
+second time.
+
+Fixes: 386119bc7be9 ("spi: sprd: spi: sprd: Add DMA mode support")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Chunyan Zhang <zhang.lyra@gmail.com>
+Link: https://lore.kernel.org/r/20200901152713.18629-1-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-sprd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sprd.c
++++ b/drivers/spi/spi-sprd.c
+@@ -563,11 +563,11 @@ static int sprd_spi_dma_request(struct s
+
+ ss->dma.dma_chan[SPRD_SPI_TX] = dma_request_chan(ss->dev, "tx_chn");
+ if (IS_ERR_OR_NULL(ss->dma.dma_chan[SPRD_SPI_TX])) {
++ dma_release_channel(ss->dma.dma_chan[SPRD_SPI_RX]);
+ if (PTR_ERR(ss->dma.dma_chan[SPRD_SPI_TX]) == -EPROBE_DEFER)
+ return PTR_ERR(ss->dma.dma_chan[SPRD_SPI_TX]);
+
+ dev_err(ss->dev, "request TX DMA channel failed!\n");
+- dma_release_channel(ss->dma.dma_chan[SPRD_SPI_RX]);
+ return PTR_ERR(ss->dma.dma_chan[SPRD_SPI_TX]);
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
