--- /dev/null
+From 07a8b2499866c24bce2a87ca26d5291fc1363bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 21:00:38 +0800
+Subject: ALSA: hda: Reinstate runtime_allow() for all hda controllers
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 9fc149c3bce7bdbb94948a8e6bd025e3b3538603 ]
+
+The broken jack detection should be fixed by commit a6e7d0a4bdb0 ("ALSA:
+hda: fix jack detection with Realtek codecs when in D3"), let's try
+enabling runtime PM by default again.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20201027130038.16463-4-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_intel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index ab32d4811c9ef..192e580561efd 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2328,6 +2328,7 @@ static int azx_probe_continue(struct azx *chip)
+
+ if (azx_has_pm_runtime(chip)) {
+ pm_runtime_use_autosuspend(&pci->dev);
++ pm_runtime_allow(&pci->dev);
+ pm_runtime_put_autosuspend(&pci->dev);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c8c8c1d19b18d6952e172c719b58294c07aa5827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 21:00:37 +0800
+Subject: ALSA: hda: Separate runtime and system suspend
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit f5dac54d9d93826a776dffc848df76746f7135bb ]
+
+Both pm_runtime_force_suspend() and pm_runtime_force_resume() have
+some implicit checks, so it can make code flow more straightforward if
+we separate runtime and system suspend callbacks.
+
+High Definition Audio Specification, 4.5.9.3 Codec Wake From System S3
+states that codec can wake the system up from S3 if WAKEEN is toggled.
+Since HDA controller has different wakeup settings for runtime and
+system susend, we also need to explicitly disable direct-complete which
+can be enabled automatically by PCI core. In addition to that, avoid
+waking up codec if runtime resume is for system suspend, to not break
+direct-complete for codecs.
+
+While at it, also remove AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP, as the
+original bug commit a6630529aecb ("ALSA: hda: Workaround for spurious
+wakeups on some Intel platforms") solves doesn't happen with this
+patch.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20201027130038.16463-3-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.h | 3 +-
+ sound/pci/hda/hda_intel.c | 62 +++++++++++++++++++---------------
+ 2 files changed, 36 insertions(+), 29 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index a356fb0e57738..9da7a06d024f1 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -41,7 +41,7 @@
+ /* 24 unused */
+ #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */
+ #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */
+-#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27) /* Workaround for spurious wakeups after suspend */
++/* 27 unused */
+ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */
+ #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */
+ #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30) /* capture and playback use separate stream tag */
+@@ -143,6 +143,7 @@ struct azx {
+ unsigned int align_buffer_size:1;
+ unsigned int region_requested:1;
+ unsigned int disabled:1; /* disabled by vga_switcheroo */
++ unsigned int pm_prepared:1;
+
+ /* GTS present */
+ unsigned int gts_present:1;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 9a1968932b783..ab32d4811c9ef 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -295,8 +295,7 @@ enum {
+ /* PCH for HSW/BDW; with runtime PM */
+ /* no i915 binding for this as HSW/BDW has another controller for HDMI */
+ #define AZX_DCAPS_INTEL_PCH \
+- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
+- AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
++ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME)
+
+ /* HSW HDMI */
+ #define AZX_DCAPS_INTEL_HASWELL \
+@@ -984,7 +983,7 @@ static void __azx_runtime_suspend(struct azx *chip)
+ display_power(chip, false);
+ }
+
+-static void __azx_runtime_resume(struct azx *chip, bool from_rt)
++static void __azx_runtime_resume(struct azx *chip)
+ {
+ struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
+ struct hdac_bus *bus = azx_bus(chip);
+@@ -1001,7 +1000,8 @@ static void __azx_runtime_resume(struct azx *chip, bool from_rt)
+ azx_init_pci(chip);
+ hda_intel_init_chip(chip, true);
+
+- if (from_rt) {
++ /* Avoid codec resume if runtime resume is for system suspend */
++ if (!chip->pm_prepared) {
+ list_for_each_codec(codec, &chip->bus) {
+ if (codec->relaxed_resume)
+ continue;
+@@ -1017,6 +1017,29 @@ static void __azx_runtime_resume(struct azx *chip, bool from_rt)
+ }
+
+ #ifdef CONFIG_PM_SLEEP
++static int azx_prepare(struct device *dev)
++{
++ struct snd_card *card = dev_get_drvdata(dev);
++ struct azx *chip;
++
++ chip = card->private_data;
++ chip->pm_prepared = 1;
++
++ /* HDA controller always requires different WAKEEN for runtime suspend
++ * and system suspend, so don't use direct-complete here.
++ */
++ return 0;
++}
++
++static void azx_complete(struct device *dev)
++{
++ struct snd_card *card = dev_get_drvdata(dev);
++ struct azx *chip;
++
++ chip = card->private_data;
++ chip->pm_prepared = 0;
++}
++
+ static int azx_suspend(struct device *dev)
+ {
+ struct snd_card *card = dev_get_drvdata(dev);
+@@ -1028,15 +1051,7 @@ static int azx_suspend(struct device *dev)
+
+ chip = card->private_data;
+ bus = azx_bus(chip);
+- snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+- /* An ugly workaround: direct call of __azx_runtime_suspend() and
+- * __azx_runtime_resume() for old Intel platforms that suffer from
+- * spurious wakeups after S3 suspend
+- */
+- if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
+- __azx_runtime_suspend(chip);
+- else
+- pm_runtime_force_suspend(dev);
++ __azx_runtime_suspend(chip);
+ if (bus->irq >= 0) {
+ free_irq(bus->irq, chip);
+ bus->irq = -1;
+@@ -1064,11 +1079,7 @@ static int azx_resume(struct device *dev)
+ if (azx_acquire_irq(chip, 1) < 0)
+ return -EIO;
+
+- if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
+- __azx_runtime_resume(chip, false);
+- else
+- pm_runtime_force_resume(dev);
+- snd_power_change_state(card, SNDRV_CTL_POWER_D0);
++ __azx_runtime_resume(chip);
+
+ trace_azx_resume(chip);
+ return 0;
+@@ -1116,10 +1127,7 @@ static int azx_runtime_suspend(struct device *dev)
+ chip = card->private_data;
+
+ /* enable controller wake up event */
+- if (snd_power_get_state(card) == SNDRV_CTL_POWER_D0) {
+- azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) |
+- STATESTS_INT_MASK);
+- }
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) | STATESTS_INT_MASK);
+
+ __azx_runtime_suspend(chip);
+ trace_azx_runtime_suspend(chip);
+@@ -1130,18 +1138,14 @@ static int azx_runtime_resume(struct device *dev)
+ {
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip;
+- bool from_rt = snd_power_get_state(card) == SNDRV_CTL_POWER_D0;
+
+ if (!azx_is_pm_ready(card))
+ return 0;
+ chip = card->private_data;
+- __azx_runtime_resume(chip, from_rt);
++ __azx_runtime_resume(chip);
+
+ /* disable controller Wake Up event*/
+- if (from_rt) {
+- azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
+- ~STATESTS_INT_MASK);
+- }
++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & ~STATESTS_INT_MASK);
+
+ trace_azx_runtime_resume(chip);
+ return 0;
+@@ -1175,6 +1179,8 @@ static int azx_runtime_idle(struct device *dev)
+ static const struct dev_pm_ops azx_pm = {
+ SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume)
+ #ifdef CONFIG_PM_SLEEP
++ .prepare = azx_prepare,
++ .complete = azx_complete,
+ .freeze_noirq = azx_freeze_noirq,
+ .thaw_noirq = azx_thaw_noirq,
+ #endif
+--
+2.27.0
+
--- /dev/null
+From 86c2c5f0f17817bc48f391a649b737bb8bdea7d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 19:59:46 +0530
+Subject: amd/amdgpu: Disable VCN DPG mode for Picasso
+
+From: Veerabadhran Gopalakrishnan <veerabadhran.gopalakrishnan@amd.com>
+
+[ Upstream commit c6d2b0fbb893d5c7dda405aa0e7bcbecf1c75f98 ]
+
+Concurrent operation of VCN and JPEG decoder in DPG mode is
+causing ring timeout due to power state.
+
+Signed-off-by: Veerabadhran Gopalakrishnan <veerabadhran.gopalakrishnan@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index c086262cc181d..317aa257c06bb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -1144,8 +1144,7 @@ static int soc15_common_early_init(void *handle)
+
+ adev->pg_flags = AMD_PG_SUPPORT_SDMA |
+ AMD_PG_SUPPORT_MMHUB |
+- AMD_PG_SUPPORT_VCN |
+- AMD_PG_SUPPORT_VCN_DPG;
++ AMD_PG_SUPPORT_VCN;
+ } else {
+ adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG |
+ AMD_CG_SUPPORT_GFX_MGLS |
+--
+2.27.0
+
--- /dev/null
+From 8d538fd7b812a88fb925bd6d597ad3e22dfdcc65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 17:01:09 +0200
+Subject: ASoC: cs42l51: manage mclk shutdown delay
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+[ Upstream commit 20afe581c9b980848ad097c4d54dde9bec7593ef ]
+
+A delay must be introduced before the shutdown down of the mclk,
+as stated in CS42L51 datasheet. Otherwise the codec may
+produce some noise after the end of DAPM power down sequence.
+The delay between DAC and CLOCK_SUPPLY widgets is too short.
+Add a delay in mclk shutdown request to manage the shutdown delay
+explicitly. From experiments, at least 10ms delay is necessary.
+Set delay to 20ms as recommended in Documentation/timers/timers-howto.rst
+when using msleep().
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20201020150109.482-1-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l51.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
+index 55408c8fcb4e3..cdd7ae90c2b59 100644
+--- a/sound/soc/codecs/cs42l51.c
++++ b/sound/soc/codecs/cs42l51.c
+@@ -247,8 +247,28 @@ static const struct snd_soc_dapm_widget cs42l51_dapm_widgets[] = {
+ &cs42l51_adcr_mux_controls),
+ };
+
++static int mclk_event(struct snd_soc_dapm_widget *w,
++ struct snd_kcontrol *kcontrol, int event)
++{
++ struct snd_soc_component *comp = snd_soc_dapm_to_component(w->dapm);
++ struct cs42l51_private *cs42l51 = snd_soc_component_get_drvdata(comp);
++
++ switch (event) {
++ case SND_SOC_DAPM_PRE_PMU:
++ return clk_prepare_enable(cs42l51->mclk_handle);
++ case SND_SOC_DAPM_POST_PMD:
++ /* Delay mclk shutdown to fulfill power-down sequence requirements */
++ msleep(20);
++ clk_disable_unprepare(cs42l51->mclk_handle);
++ break;
++ }
++
++ return 0;
++}
++
+ static const struct snd_soc_dapm_widget cs42l51_dapm_mclk_widgets[] = {
+- SND_SOC_DAPM_CLOCK_SUPPLY("MCLK")
++ SND_SOC_DAPM_SUPPLY("MCLK", SND_SOC_NOPM, 0, 0, mclk_event,
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ };
+
+ static const struct snd_soc_dapm_route cs42l51_routes[] = {
+--
+2.27.0
+
--- /dev/null
+From c9baadb941b6cea4d8dfc671ef6ca74913eb4d70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 10:58:49 +0100
+Subject: ASoC: qcom: sdm845: set driver name correctly
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 3f48b6eba15ea342ef4cb420b580f5ed6605669f ]
+
+With the current state of code, we would endup with something like
+below in /proc/asound/cards for 2 machines based on this driver.
+
+Machine 1:
+ 0 [DB845c ]: DB845c - DB845c
+ DB845c
+Machine 2:
+ 0 [LenovoYOGAC6301]: Lenovo-YOGA-C63 - Lenovo-YOGA-C630-13Q50
+ LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216
+
+This is not very UCM friendly both w.r.t to common up configs and
+card identification, and UCM2 became totally not usefull with just
+one ucm sdm845.conf for two machines which have different setups
+w.r.t HDMI and other dais.
+
+Reasons for such thing is partly because Qualcomm machine drivers never
+cared to set driver_name.
+
+This patch sets up driver name for the this driver to sort out the
+UCM integration issues!
+
+after this patch contents of /proc/asound/cards:
+
+Machine 1:
+ 0 [DB845c ]: sdm845 - DB845c
+ DB845c
+Machine 2:
+ 0 [LenovoYOGAC6301]: sdm845 - Lenovo-YOGA-C630-13Q50
+ LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216
+
+with this its possible to align with what UCM2 expects and we can have
+sdm845/DB845.conf
+sdm845/LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216.conf
+... for board variants. This should scale much better!
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20201023095849.22894-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sdm845.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c
+index 7e6c41e63d8e1..23e1de61e92e4 100644
+--- a/sound/soc/qcom/sdm845.c
++++ b/sound/soc/qcom/sdm845.c
+@@ -16,6 +16,7 @@
+ #include "qdsp6/q6afe.h"
+ #include "../codecs/rt5663.h"
+
++#define DRIVER_NAME "sdm845"
+ #define DEFAULT_SAMPLE_RATE_48K 48000
+ #define DEFAULT_MCLK_RATE 24576000
+ #define TDM_BCLK_RATE 6144000
+@@ -407,6 +408,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev)
+ goto data_alloc_fail;
+ }
+
++ card->driver_name = DRIVER_NAME;
+ card->dapm_widgets = sdm845_snd_widgets;
+ card->num_dapm_widgets = ARRAY_SIZE(sdm845_snd_widgets);
+ card->dev = dev;
+--
+2.27.0
+
--- /dev/null
+From 8c952b414527738ec462d9a07589083da8243fa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 13:58:22 +0200
+Subject: cfg80211: initialize wdev data earlier
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 9bdaf3b91efd229dd272b228e13df10310c80d19 ]
+
+There's a race condition in the netdev registration in that
+NETDEV_REGISTER actually happens after the netdev is available,
+and so if we initialize things only there, we might get called
+with an uninitialized wdev through nl80211 - not using a wdev
+but using a netdev interface index.
+
+I found this while looking into a syzbot report, but it doesn't
+really seem to be related, and unfortunately there's no repro
+for it (yet). I can't (yet) explain how it managed to get into
+cfg80211_release_pmsr() from nl80211_netlink_notify() without
+the wdev having been initialized, as the latter only iterates
+the wdevs that are linked into the rdev, which even without the
+change here happened after init.
+
+However, looking at this, it seems fairly clear that the init
+needs to be done earlier, otherwise we might even re-init on a
+netns move, when data might still be pending.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20201009135821.fdcbba3aad65.Ie9201d91dbcb7da32318812effdc1561aeaf4cdc@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/core.c | 57 +++++++++++++++++++++++-------------------
+ net/wireless/core.h | 5 ++--
+ net/wireless/nl80211.c | 3 ++-
+ 3 files changed, 36 insertions(+), 29 deletions(-)
+
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index ee5bb8d8af04e..5d151e8f89320 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1224,8 +1224,7 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev,
+ }
+ EXPORT_SYMBOL(cfg80211_stop_iface);
+
+-void cfg80211_init_wdev(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev)
++void cfg80211_init_wdev(struct wireless_dev *wdev)
+ {
+ mutex_init(&wdev->mtx);
+ INIT_LIST_HEAD(&wdev->event_list);
+@@ -1236,6 +1235,30 @@ void cfg80211_init_wdev(struct cfg80211_registered_device *rdev,
+ spin_lock_init(&wdev->pmsr_lock);
+ INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
+
++#ifdef CONFIG_CFG80211_WEXT
++ wdev->wext.default_key = -1;
++ wdev->wext.default_mgmt_key = -1;
++ wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
++#endif
++
++ if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT)
++ wdev->ps = true;
++ else
++ wdev->ps = false;
++ /* allow mac80211 to determine the timeout */
++ wdev->ps_timeout = -1;
++
++ if ((wdev->iftype == NL80211_IFTYPE_STATION ||
++ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
++ wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
++ wdev->netdev->priv_flags |= IFF_DONT_BRIDGE;
++
++ INIT_WORK(&wdev->disconnect_wk, cfg80211_autodisconnect_wk);
++}
++
++void cfg80211_register_wdev(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev)
++{
+ /*
+ * We get here also when the interface changes network namespaces,
+ * as it's registered into the new one, but we don't want it to
+@@ -1269,6 +1292,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ switch (state) {
+ case NETDEV_POST_INIT:
+ SET_NETDEV_DEVTYPE(dev, &wiphy_type);
++ wdev->netdev = dev;
++ /* can only change netns with wiphy */
++ dev->features |= NETIF_F_NETNS_LOCAL;
++
++ cfg80211_init_wdev(wdev);
+ break;
+ case NETDEV_REGISTER:
+ /*
+@@ -1276,35 +1304,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ * called within code protected by it when interfaces
+ * are added with nl80211.
+ */
+- /* can only change netns with wiphy */
+- dev->features |= NETIF_F_NETNS_LOCAL;
+-
+ if (sysfs_create_link(&dev->dev.kobj, &rdev->wiphy.dev.kobj,
+ "phy80211")) {
+ pr_err("failed to add phy80211 symlink to netdev!\n");
+ }
+- wdev->netdev = dev;
+-#ifdef CONFIG_CFG80211_WEXT
+- wdev->wext.default_key = -1;
+- wdev->wext.default_mgmt_key = -1;
+- wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+-#endif
+-
+- if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT)
+- wdev->ps = true;
+- else
+- wdev->ps = false;
+- /* allow mac80211 to determine the timeout */
+- wdev->ps_timeout = -1;
+-
+- if ((wdev->iftype == NL80211_IFTYPE_STATION ||
+- wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
+- wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr)
+- dev->priv_flags |= IFF_DONT_BRIDGE;
+-
+- INIT_WORK(&wdev->disconnect_wk, cfg80211_autodisconnect_wk);
+
+- cfg80211_init_wdev(rdev, wdev);
++ cfg80211_register_wdev(rdev, wdev);
+ break;
+ case NETDEV_GOING_DOWN:
+ cfg80211_leave(rdev, wdev);
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index ed487e3245714..d83c8e009448a 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -210,8 +210,9 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
+ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
+ struct net *net);
+
+-void cfg80211_init_wdev(struct cfg80211_registered_device *rdev,
+- struct wireless_dev *wdev);
++void cfg80211_init_wdev(struct wireless_dev *wdev);
++void cfg80211_register_wdev(struct cfg80211_registered_device *rdev,
++ struct wireless_dev *wdev);
+
+ static inline void wdev_lock(struct wireless_dev *wdev)
+ __acquires(wdev)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 672b70730e898..dbac5c0995a0f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3654,7 +3654,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ * P2P Device and NAN do not have a netdev, so don't go
+ * through the netdev notifier and must be added here
+ */
+- cfg80211_init_wdev(rdev, wdev);
++ cfg80211_init_wdev(wdev);
++ cfg80211_register_wdev(rdev, wdev);
+ break;
+ default:
+ break;
+--
+2.27.0
+
--- /dev/null
+From 1752bcaf9d0f9c86f210899cf4d3079855e32416 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 15:02:15 +0800
+Subject: cfg80211: regulatory: Fix inconsistent format argument
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ]
+
+Fix follow warning:
+[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2)
+requires 'int' but the argument type is 'unsigned int'.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 20a8e6af88c45..0f3b57a73670b 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3405,7 +3405,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd)
+ power_rule = ®_rule->power_rule;
+
+ if (reg_rule->flags & NL80211_RRF_AUTO_BW)
+- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO",
++ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO",
+ freq_range->max_bandwidth_khz,
+ reg_get_max_bandwidth(rd, reg_rule));
+ else
+--
+2.27.0
+
--- /dev/null
+From 32d27e83085cc752021dab14b39ab430e64d4b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:24:18 +0800
+Subject: drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ]
+
+This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu:
+Fix bug where DPM is not enabled after hibernate and resume").
+It was intended to fix Hawaii S4(hibernation) issue but break S3. As
+ixFEATURE_STATUS is filled with garbage data on resume which can be
+only cleared by reloading smc firmware(but that will involve many
+changes). So, we will revert this S4 fix and seek a new way.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 0f4f27a89020d..42c8f8731a504 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2725,10 +2725,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)
+
+ static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
+ {
+- return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
+- CGS_IND_REG__SMC, FEATURE_STATUS,
+- VOLTAGE_CONTROLLER_ON))
+- ? true : false;
++ return ci_is_smc_ram_running(hwmgr);
+ }
+
+ static int ci_smu_init(struct pp_hwmgr *hwmgr)
+--
+2.27.0
+
--- /dev/null
+From 48b4a763291267b9b80d997b9afaa61d06269c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 10:45:26 +0800
+Subject: drm/amd/pm: perform SMC reset on suspend/hibernation
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ]
+
+So that the succeeding resume can be performed based on
+a clean state.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++
+ drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 +
+ drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++
+ .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++
+ drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++
+ 5 files changed, 39 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+index 35e6cbe805eb4..7cde55854b65c 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+@@ -1533,6 +1533,10 @@ int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to reset to default!", result = tmp_result);
+
++ tmp_result = smum_stop_smc(hwmgr);
++ PP_ASSERT_WITH_CODE((tmp_result == 0),
++ "Failed to stop smc!", result = tmp_result);
++
+ tmp_result = smu7_force_switch_to_arbf0(hwmgr);
+ PP_ASSERT_WITH_CODE((tmp_result == 0),
+ "Failed to force to switch arbf0!", result = tmp_result);
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+index 7bf9a14bfa0be..f6490a1284384 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+@@ -229,6 +229,7 @@ struct pp_smumgr_func {
+ bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr);
+ int (*update_dpm_settings)(struct pp_hwmgr *hwmgr, void *profile_setting);
+ int (*smc_table_manager)(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); /*rw: true for read, false for write */
++ int (*stop_smc)(struct pp_hwmgr *hwmgr);
+ };
+
+ struct pp_hwmgr_func {
+diff --git a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+index c5288831aa15c..05a55e850b5e0 100644
+--- a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
++++ b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h
+@@ -114,4 +114,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settin
+
+ extern int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw);
+
++extern int smum_stop_smc(struct pp_hwmgr *hwmgr);
++
+ #endif
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 09a3d8ae44491..0f4f27a89020d 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2936,6 +2936,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type)
+ return 0;
+ }
+
++static void ci_reset_smc(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_RESET_CNTL,
++ rst_reg, 1);
++}
++
++
++static void ci_stop_smc_clock(struct pp_hwmgr *hwmgr)
++{
++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC,
++ SMC_SYSCON_CLOCK_CNTL_0,
++ ck_disable, 1);
++}
++
++static int ci_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ ci_reset_smc(hwmgr);
++ ci_stop_smc_clock(hwmgr);
++
++ return 0;
++}
++
+ const struct pp_smumgr_func ci_smu_funcs = {
+ .name = "ci_smu",
+ .smu_init = ci_smu_init,
+@@ -2960,4 +2983,5 @@ const struct pp_smumgr_func ci_smu_funcs = {
+ .is_dpm_running = ci_is_dpm_running,
+ .update_dpm_settings = ci_update_dpm_settings,
+ .update_smc_table = ci_update_smc_table,
++ .stop_smc = ci_stop_smc,
+ };
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+index 4240aeec9000e..83d06f8e99ec2 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c
+@@ -217,3 +217,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tabl
+
+ return -EINVAL;
+ }
++
++int smum_stop_smc(struct pp_hwmgr *hwmgr)
++{
++ if (hwmgr->smumgr_funcs->stop_smc)
++ return hwmgr->smumgr_funcs->stop_smc(hwmgr);
++
++ return 0;
++}
+--
+2.27.0
+
--- /dev/null
+From d3c67374ef0ec8e9f07d358ce8b5913504899ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 15:29:59 +0800
+Subject: drm/amdgpu: perform srbm soft reset always on SDMA resume
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ]
+
+This can address the random SDMA hang after pci config reset
+seen on Hawaii.
+
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Tested-by: Sandeep Raghuraman <sandy.8925@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+index 4af9acc2dc4f9..450ad7d5e21a0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+@@ -1071,22 +1071,19 @@ static int cik_sdma_soft_reset(void *handle)
+ {
+ u32 srbm_soft_reset = 0;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+- u32 tmp = RREG32(mmSRBM_STATUS2);
++ u32 tmp;
+
+- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) {
+- /* sdma0 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
+- }
+- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) {
+- /* sdma1 */
+- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
+- tmp |= SDMA0_F32_CNTL__HALT_MASK;
+- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
+- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+- }
++ /* sdma0 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK;
++
++ /* sdma1 */
++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET);
++ tmp |= SDMA0_F32_CNTL__HALT_MASK;
++ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp);
++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK;
+
+ if (srbm_soft_reset) {
+ tmp = RREG32(mmSRBM_SOFT_RESET);
+--
+2.27.0
+
--- /dev/null
+From b70ad5f0aa21717b32a077ed536fe4ad85b958aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:10:02 -0500
+Subject: gfs2: Add missing truncate_inode_pages_final for sd_aspace
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit a9dd945ccef07a904e412f208f8de708a3d7159e ]
+
+Gfs2 creates an address space for its rgrps called sd_aspace, but it never
+called truncate_inode_pages_final on it. This confused vfs greatly which
+tried to reference the address space after gfs2 had freed the superblock
+that contained it.
+
+This patch adds a call to truncate_inode_pages_final for sd_aspace, thus
+avoiding the use-after-free.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 5935ce5ae5636..50c925d9c6103 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -689,6 +689,7 @@ restart:
+ gfs2_jindex_free(sdp);
+ /* Take apart glock structures and buffer lists */
+ gfs2_gl_hash_clear(sdp);
++ truncate_inode_pages_final(&sdp->sd_aspace);
+ gfs2_delete_debugfs_file(sdp);
+ /* Unmount the locking protocol */
+ gfs2_lm_unmount(sdp);
+--
+2.27.0
+
--- /dev/null
+From 2eba51950259338d2b1101efb1e2b74205eba8c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 13:42:18 -0500
+Subject: gfs2: check for live vs. read-only file system in gfs2_fitrim
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ]
+
+Before this patch, gfs2_fitrim was not properly checking for a "live" file
+system. If the file system had something to trim and the file system
+was read-only (or spectator) it would start the trim, but when it starts
+the transaction, gfs2_trans_begin returns -EROFS (read-only file system)
+and it errors out. However, if the file system was already trimmed so
+there's no work to do, it never called gfs2_trans_begin. That code is
+bypassed so it never returns the error. Instead, it returns a good
+return code with 0 work. All this makes for inconsistent behavior:
+The same fstrim command can return -EROFS in one case and 0 in another.
+This tripped up xfstests generic/537 which reports the error as:
+
+ +fstrim with unrecovered metadata just ate your filesystem
+
+This patch adds a check for a "live" (iow, active journal, iow, RW)
+file system, and if not, returns the error properly.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index e23735084ad17..3d5aa0c10a4c1 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1410,6 +1410,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags))
++ return -EROFS;
++
+ if (!blk_queue_discard(q))
+ return -EOPNOTSUPP;
+
+--
+2.27.0
+
--- /dev/null
+From 0adce68e15672f90c6fc722d26f763115286ea24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 10:10:01 -0500
+Subject: gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ]
+
+Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling
+return_all_reservations, but return_all_reservations still dereferences
+rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the
+call to return_all_reservations.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 2466bb44a23c5..e23735084ad17 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -736,9 +736,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+ }
+
+ gfs2_free_clones(rgd);
++ return_all_reservations(rgd);
+ kfree(rgd->rd_bits);
+ rgd->rd_bits = NULL;
+- return_all_reservations(rgd);
+ kmem_cache_free(gfs2_rgrpd_cachep, rgd);
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From b18ea27dc3e1f4b8db4f7ac4572c7bf1ff9d60b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 19:58:01 +0800
+Subject: i2c: mediatek: move dma reset before i2c reset
+
+From: Qii Wang <qii.wang@mediatek.com>
+
+[ Upstream commit aafced673c06b7c77040c1df42e2e965be5d0376 ]
+
+The i2c driver default do dma reset after i2c reset, but sometimes
+i2c reset will trigger dma tx2rx, then apdma write data to dram
+which has been i2c_put_dma_safe_msg_buf(kfree). Move dma reset
+before i2c reset in mtk_i2c_init_hw to fix it.
+
+Signed-off-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 2152ec5f535c1..5a9f0d17f52c8 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -389,6 +389,10 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
+ {
+ u16 control_reg;
+
++ writel(I2C_DMA_HARD_RST, i2c->pdmabase + OFFSET_RST);
++ udelay(50);
++ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST);
++
+ mtk_i2c_writew(i2c, I2C_SOFT_RST, OFFSET_SOFTRESET);
+
+ /* Set ioconfig */
+@@ -419,10 +423,6 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
+
+ mtk_i2c_writew(i2c, control_reg, OFFSET_CONTROL);
+ mtk_i2c_writew(i2c, I2C_DELAY_LEN, OFFSET_DELAY_LEN);
+-
+- writel(I2C_DMA_HARD_RST, i2c->pdmabase + OFFSET_RST);
+- udelay(50);
+- writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST);
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From ad70eee2c98fc3e28681fe257b1d02e837af9dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 17:59:50 +0200
+Subject: i2c: sh_mobile: implement atomic transfers
+
+From: Ulrich Hecht <uli+renesas@fpond.eu>
+
+[ Upstream commit a49cc1fe9d64a2dc4e19b599204f403e5d25f44b ]
+
+Implements atomic transfers to fix reboot/shutdown on r8a7790 Lager and
+similar boards.
+
+Signed-off-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+[wsa: some whitespace fixing]
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++++++++++++++++++-------
+ 1 file changed, 66 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
+index 8777af4c695e9..d5dd58c27ce5f 100644
+--- a/drivers/i2c/busses/i2c-sh_mobile.c
++++ b/drivers/i2c/busses/i2c-sh_mobile.c
+@@ -129,6 +129,7 @@ struct sh_mobile_i2c_data {
+ int sr;
+ bool send_stop;
+ bool stop_after_dma;
++ bool atomic_xfer;
+
+ struct resource *res;
+ struct dma_chan *dma_tx;
+@@ -333,13 +334,15 @@ static unsigned char i2c_op(struct sh_mobile_i2c_data *pd, enum sh_mobile_i2c_op
+ ret = iic_rd(pd, ICDR);
+ break;
+ case OP_RX_STOP: /* enable DTE interrupt, issue stop */
+- iic_wr(pd, ICIC,
+- ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
++ if (!pd->atomic_xfer)
++ iic_wr(pd, ICIC,
++ ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
+ iic_wr(pd, ICCR, ICCR_ICE | ICCR_RACK);
+ break;
+ case OP_RX_STOP_DATA: /* enable DTE interrupt, read data, issue stop */
+- iic_wr(pd, ICIC,
+- ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
++ if (!pd->atomic_xfer)
++ iic_wr(pd, ICIC,
++ ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE);
+ ret = iic_rd(pd, ICDR);
+ iic_wr(pd, ICCR, ICCR_ICE | ICCR_RACK);
+ break;
+@@ -435,7 +438,8 @@ static irqreturn_t sh_mobile_i2c_isr(int irq, void *dev_id)
+
+ if (wakeup) {
+ pd->sr |= SW_DONE;
+- wake_up(&pd->wait);
++ if (!pd->atomic_xfer)
++ wake_up(&pd->wait);
+ }
+
+ /* defeat write posting to avoid spurious WAIT interrupts */
+@@ -587,6 +591,9 @@ static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg,
+ pd->pos = -1;
+ pd->sr = 0;
+
++ if (pd->atomic_xfer)
++ return;
++
+ pd->dma_buf = i2c_get_dma_safe_msg_buf(pd->msg, 8);
+ if (pd->dma_buf)
+ sh_mobile_i2c_xfer_dma(pd);
+@@ -643,15 +650,13 @@ static int poll_busy(struct sh_mobile_i2c_data *pd)
+ return i ? 0 : -ETIMEDOUT;
+ }
+
+-static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
+- struct i2c_msg *msgs,
+- int num)
++static int sh_mobile_xfer(struct sh_mobile_i2c_data *pd,
++ struct i2c_msg *msgs, int num)
+ {
+- struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter);
+ struct i2c_msg *msg;
+ int err = 0;
+ int i;
+- long timeout;
++ long time_left;
+
+ /* Wake up device and enable clock */
+ pm_runtime_get_sync(pd->dev);
+@@ -668,15 +673,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
+ if (do_start)
+ i2c_op(pd, OP_START);
+
+- /* The interrupt handler takes care of the rest... */
+- timeout = wait_event_timeout(pd->wait,
+- pd->sr & (ICSR_TACK | SW_DONE),
+- adapter->timeout);
+-
+- /* 'stop_after_dma' tells if DMA transfer was complete */
+- i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma);
++ if (pd->atomic_xfer) {
++ unsigned long j = jiffies + pd->adap.timeout;
++
++ time_left = time_before_eq(jiffies, j);
++ while (time_left &&
++ !(pd->sr & (ICSR_TACK | SW_DONE))) {
++ unsigned char sr = iic_rd(pd, ICSR);
++
++ if (sr & (ICSR_AL | ICSR_TACK |
++ ICSR_WAIT | ICSR_DTE)) {
++ sh_mobile_i2c_isr(0, pd);
++ udelay(150);
++ } else {
++ cpu_relax();
++ }
++ time_left = time_before_eq(jiffies, j);
++ }
++ } else {
++ /* The interrupt handler takes care of the rest... */
++ time_left = wait_event_timeout(pd->wait,
++ pd->sr & (ICSR_TACK | SW_DONE),
++ pd->adap.timeout);
++
++ /* 'stop_after_dma' tells if DMA xfer was complete */
++ i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg,
++ pd->stop_after_dma);
++ }
+
+- if (!timeout) {
++ if (!time_left) {
+ dev_err(pd->dev, "Transfer request timed out\n");
+ if (pd->dma_direction != DMA_NONE)
+ sh_mobile_i2c_cleanup_dma(pd);
+@@ -702,14 +727,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
+ return err ?: num;
+ }
+
++static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter,
++ struct i2c_msg *msgs,
++ int num)
++{
++ struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter);
++
++ pd->atomic_xfer = false;
++ return sh_mobile_xfer(pd, msgs, num);
++}
++
++static int sh_mobile_i2c_xfer_atomic(struct i2c_adapter *adapter,
++ struct i2c_msg *msgs,
++ int num)
++{
++ struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter);
++
++ pd->atomic_xfer = true;
++ return sh_mobile_xfer(pd, msgs, num);
++}
++
+ static u32 sh_mobile_i2c_func(struct i2c_adapter *adapter)
+ {
+ return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
+ }
+
+ static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
+- .functionality = sh_mobile_i2c_func,
+- .master_xfer = sh_mobile_i2c_xfer,
++ .functionality = sh_mobile_i2c_func,
++ .master_xfer = sh_mobile_i2c_xfer,
++ .master_xfer_atomic = sh_mobile_i2c_xfer_atomic,
+ };
+
+ static const struct i2c_adapter_quirks sh_mobile_i2c_quirks = {
+--
+2.27.0
+
--- /dev/null
+From 51804898bd190b1c72d8c90caf5387ee93bf245d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 02:50:02 +0000
+Subject: iommu/amd: Increase interrupt remapping table limit to 512 entries
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ]
+
+Certain device drivers allocate IO queues on a per-cpu basis.
+On AMD EPYC platform, which can support up-to 256 cpu threads,
+this can exceed the current MAX_IRQ_PER_TABLE limit of 256,
+and result in the error message:
+
+ AMD-Vi: Failed to allocate IRTE
+
+This has been observed with certain NVME devices.
+
+AMD IOMMU hardware can actually support upto 512 interrupt
+remapping table entries. Therefore, update the driver to
+match the hardware limit.
+
+Please note that this also increases the size of interrupt remapping
+table to 8KB per device when using the 128-bit IRTE format.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Link: https://lore.kernel.org/r/20201015025002.87997-1-suravee.suthikulpanit@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_types.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 0679896b9e2e1..3ec090adcdae7 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -406,7 +406,11 @@ extern bool amd_iommu_np_cache;
+ /* Only true if all IOMMUs support device IOTLBs */
+ extern bool amd_iommu_iotlb_sup;
+
+-#define MAX_IRQS_PER_TABLE 256
++/*
++ * AMD IOMMU hardware only support 512 IRTEs despite
++ * the architectural limitation of 2048 entries.
++ */
++#define MAX_IRQS_PER_TABLE 512
+ #define IRQ_TABLE_ALIGNMENT 128
+
+ struct irq_remap_table {
+--
+2.27.0
+
--- /dev/null
+From 4651bb2a027c959b45ec3fe620db40baf47ad2f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:17:11 +0200
+Subject: mac80211: always wind down STA state
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ]
+
+When (for example) an IBSS station is pre-moved to AUTHORIZED
+before it's inserted, and then the insertion fails, we don't
+clean up the fast RX/TX states that might already have been
+created, since we don't go through all the state transitions
+again on the way down.
+
+Do that, if it hasn't been done already, when the station is
+freed. I considered only freeing the fast TX/RX state there,
+but we might add more state so it's more robust to wind down
+the state properly.
+
+Note that we warn if the station was ever inserted, it should
+have been properly cleaned up in that case, and the driver
+will probably not like things happening out of order.
+
+Reported-by: syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 4f14d8a06915a..38bb6d512b36d 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -244,6 +244,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
+ */
+ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
+ {
++ /*
++ * If we had used sta_info_pre_move_state() then we might not
++ * have gone through the state transitions down again, so do
++ * it here now (and warn if it's inserted).
++ *
++ * This will clear state such as fast TX/RX that may have been
++ * allocated during state transitions.
++ */
++ while (sta->sta_state > IEEE80211_STA_NONE) {
++ int ret;
++
++ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED));
++
++ ret = sta_info_move_state(sta, sta->sta_state - 1);
++ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret))
++ break;
++ }
++
+ if (sta->rate_ctrl)
+ rate_control_free_sta(sta);
+
+--
+2.27.0
+
--- /dev/null
+From f65876b1a827005a7032a9729175b956fda1d85b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 13:25:41 +0200
+Subject: mac80211: fix use of skb payload instead of header
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ]
+
+When ieee80211_skb_resize() is called from ieee80211_build_hdr()
+the skb has no 802.11 header yet, in fact it consist only of the
+payload as the ethernet frame is removed. As such, we're using
+the payload data for ieee80211_is_mgmt(), which is of course
+completely wrong. This didn't really hurt us because these are
+always data frames, so we could only have added more tailroom
+than we needed if we determined it was a management frame and
+sdata->crypto_tx_tailroom_needed_cnt was false.
+
+However, syzbot found that of course there need not be any payload,
+so we're using at best uninitialized memory for the check.
+
+Fix this to pass explicitly the kind of frame that we have instead
+of checking there, by replacing the "bool may_encrypt" argument
+with an argument that can carry the three possible states - it's
+not going to be encrypted, it's a management frame, or it's a data
+frame (and then we check sdata->crypto_tx_tailroom_needed_cnt).
+
+Reported-by: syzbot+32fd1a1bfe355e93f1e2@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20201009132538.e1fd7f802947.I799b288466ea2815f9d4c84349fae697dca2f189@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index f029e75ec815a..30a0c7c6224b3 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1944,19 +1944,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
+
+ /* device xmit handlers */
+
++enum ieee80211_encrypt {
++ ENCRYPT_NO,
++ ENCRYPT_MGMT,
++ ENCRYPT_DATA,
++};
++
+ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ struct sk_buff *skb,
+- int head_need, bool may_encrypt)
++ int head_need,
++ enum ieee80211_encrypt encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
+- struct ieee80211_hdr *hdr;
+ bool enc_tailroom;
+ int tail_need = 0;
+
+- hdr = (struct ieee80211_hdr *) skb->data;
+- enc_tailroom = may_encrypt &&
+- (sdata->crypto_tx_tailroom_needed_cnt ||
+- ieee80211_is_mgmt(hdr->frame_control));
++ enc_tailroom = encrypt == ENCRYPT_MGMT ||
++ (encrypt == ENCRYPT_DATA &&
++ sdata->crypto_tx_tailroom_needed_cnt);
+
+ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+@@ -1988,23 +1993,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+- struct ieee80211_hdr *hdr;
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+ int headroom;
+- bool may_encrypt;
++ enum ieee80211_encrypt encrypt;
+
+- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
++ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
++ encrypt = ENCRYPT_NO;
++ else if (ieee80211_is_mgmt(hdr->frame_control))
++ encrypt = ENCRYPT_MGMT;
++ else
++ encrypt = ENCRYPT_DATA;
+
+ headroom = local->tx_headroom;
+- if (may_encrypt)
++ if (encrypt != ENCRYPT_NO)
+ headroom += sdata->encrypt_headroom;
+ headroom -= skb_headroom(skb);
+ headroom = max_t(int, 0, headroom);
+
+- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
++ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ return;
+ }
+
++ /* reload after potential resize */
+ hdr = (struct ieee80211_hdr *) skb->data;
+ info->control.vif = &sdata->vif;
+
+@@ -2808,7 +2819,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
+ head_need += sdata->encrypt_headroom;
+ head_need += local->tx_headroom;
+ head_need = max_t(int, 0, head_need);
+- if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
++ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
+ ieee80211_free_txskb(&local->hw, skb);
+ skb = NULL;
+ return ERR_PTR(-ENOMEM);
+@@ -3482,7 +3493,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
+ if (unlikely(ieee80211_skb_resize(sdata, skb,
+ max_t(int, extra_head + hw_headroom -
+ skb_headroom(skb), 0),
+- false))) {
++ ENCRYPT_NO))) {
+ kfree_skb(skb);
+ return true;
+ }
+--
+2.27.0
+
--- /dev/null
+From 1f1eced0132dbd4ab374b8c9c8155bb8281b4c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:15:00 +0800
+Subject: nvme: introduce nvme_sync_io_queues
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit 04800fbff4764ab7b32c49d19628605a5d4cb85c ]
+
+Introduce sync io queues for some scenarios which just only need sync
+io queues not sync all queues.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 8 ++++++--
+ drivers/nvme/host/nvme.h | 1 +
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ce69aaea581a5..7a964271959d8 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -4226,8 +4226,7 @@ void nvme_start_queues(struct nvme_ctrl *ctrl)
+ }
+ EXPORT_SYMBOL_GPL(nvme_start_queues);
+
+-
+-void nvme_sync_queues(struct nvme_ctrl *ctrl)
++void nvme_sync_io_queues(struct nvme_ctrl *ctrl)
+ {
+ struct nvme_ns *ns;
+
+@@ -4235,7 +4234,12 @@ void nvme_sync_queues(struct nvme_ctrl *ctrl)
+ list_for_each_entry(ns, &ctrl->namespaces, list)
+ blk_sync_queue(ns->queue);
+ up_read(&ctrl->namespaces_rwsem);
++}
++EXPORT_SYMBOL_GPL(nvme_sync_io_queues);
+
++void nvme_sync_queues(struct nvme_ctrl *ctrl)
++{
++ nvme_sync_io_queues(ctrl);
+ if (ctrl->admin_q)
+ blk_sync_queue(ctrl->admin_q);
+ }
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index d7132d8cb7c5d..e392d6cd92ced 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -494,6 +494,7 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl);
+ void nvme_start_queues(struct nvme_ctrl *ctrl);
+ void nvme_kill_queues(struct nvme_ctrl *ctrl);
+ void nvme_sync_queues(struct nvme_ctrl *ctrl);
++void nvme_sync_io_queues(struct nvme_ctrl *ctrl);
+ void nvme_unfreeze(struct nvme_ctrl *ctrl);
+ void nvme_wait_freeze(struct nvme_ctrl *ctrl);
+ int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout);
+--
+2.27.0
+
--- /dev/null
+From 5079b52a1f25451faee29824852e64f60fad932f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:15:08 +0800
+Subject: nvme-rdma: avoid race between time out and tear down
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit 3017013dcc82a4862bd1e140f8b762cfc594008d ]
+
+Now use teardown_lock to serialize for time out and tear down. This may
+cause abnormal: first cancel all request in tear down, then time out may
+complete the request again, but the request may already be freed or
+restarted.
+
+To avoid race between time out and tear down, in tear down process,
+first we quiesce the queue, and then delete the timer and cancel
+the time out work for the queue. At the same time we need to delete
+teardown_lock.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index e957ad0a07f58..cfd437f7750e1 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -110,7 +110,6 @@ struct nvme_rdma_ctrl {
+ struct sockaddr_storage src_addr;
+
+ struct nvme_ctrl ctrl;
+- struct mutex teardown_lock;
+ bool use_inline_data;
+ u32 io_queues[HCTX_MAX_TYPES];
+ };
+@@ -933,8 +932,8 @@ out_free_io_queues:
+ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
+- mutex_lock(&ctrl->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
+ if (ctrl->ctrl.admin_tagset) {
+ blk_mq_tagset_busy_iter(ctrl->ctrl.admin_tagset,
+@@ -944,16 +943,15 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_destroy_admin_queue(ctrl, remove);
+- mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ bool remove)
+ {
+- mutex_lock(&ctrl->teardown_lock);
+ if (ctrl->ctrl.queue_count > 1) {
+ nvme_start_freeze(&ctrl->ctrl);
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+ if (ctrl->ctrl.tagset) {
+ blk_mq_tagset_busy_iter(ctrl->ctrl.tagset,
+@@ -964,7 +962,6 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl,
+ nvme_start_queues(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, remove);
+ }
+- mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
+@@ -1728,16 +1725,12 @@ static void nvme_rdma_complete_timed_out(struct request *rq)
+ {
+ struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
+ struct nvme_rdma_queue *queue = req->queue;
+- struct nvme_rdma_ctrl *ctrl = queue->ctrl;
+
+- /* fence other contexts that may complete the command */
+- mutex_lock(&ctrl->teardown_lock);
+ nvme_rdma_stop_queue(queue);
+ if (!blk_mq_request_completed(rq)) {
+ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
+ blk_mq_complete_request(rq);
+ }
+- mutex_unlock(&ctrl->teardown_lock);
+ }
+
+ static enum blk_eh_timer_return
+@@ -2029,7 +2022,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
+ return ERR_PTR(-ENOMEM);
+ ctrl->ctrl.opts = opts;
+ INIT_LIST_HEAD(&ctrl->list);
+- mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.27.0
+
--- /dev/null
+From ade56726ebeb13baea7b24f4f7e17cccfc00cac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:15:23 +0800
+Subject: nvme-rdma: avoid repeated request completion
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit fdf58e02adecbef4c7cbb2073d8ea225e6fd5f26 ]
+
+The request may be executed asynchronously, and rq->state may be
+changed to IDLE. To avoid repeated request completion, only
+MQ_RQ_COMPLETE of rq->state is checked in nvme_rdma_complete_timed_out.
+It is not safe, so need adding check IDLE for rq->state.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index cfd437f7750e1..8a62c2fe5a5ec 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -1727,7 +1727,7 @@ static void nvme_rdma_complete_timed_out(struct request *rq)
+ struct nvme_rdma_queue *queue = req->queue;
+
+ nvme_rdma_stop_queue(queue);
+- if (!blk_mq_request_completed(rq)) {
++ if (blk_mq_request_started(rq) && !blk_mq_request_completed(rq)) {
+ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
+ blk_mq_complete_request(rq);
+ }
+--
+2.27.0
+
--- /dev/null
+From 0a37adf823cda7969016271ac0dee0e160f9eca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:15:15 +0800
+Subject: nvme-tcp: avoid race between time out and tear down
+
+From: Chao Leng <lengchao@huawei.com>
+
+[ Upstream commit d6f66210f4b1aa2f5944f0e34e0f8db44f499f92 ]
+
+Now use teardown_lock to serialize for time out and tear down. This may
+cause abnormal: first cancel all request in tear down, then time out may
+complete the request again, but the request may already be freed or
+restarted.
+
+To avoid race between time out and tear down, in tear down process,
+first we quiesce the queue, and then delete the timer and cancel
+the time out work for the queue. At the same time we need to delete
+teardown_lock.
+
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index e159b78b5f3b4..76440f26c1453 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -110,7 +110,6 @@ struct nvme_tcp_ctrl {
+ struct sockaddr_storage src_addr;
+ struct nvme_ctrl ctrl;
+
+- struct mutex teardown_lock;
+ struct work_struct err_work;
+ struct delayed_work connect_work;
+ struct nvme_tcp_request async_req;
+@@ -1797,8 +1796,8 @@ out_free_queue:
+ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
+- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ blk_mq_quiesce_queue(ctrl->admin_q);
++ blk_sync_queue(ctrl->admin_q);
+ nvme_tcp_stop_queue(ctrl, 0);
+ if (ctrl->admin_tagset) {
+ blk_mq_tagset_busy_iter(ctrl->admin_tagset,
+@@ -1808,18 +1807,17 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl,
+ if (remove)
+ blk_mq_unquiesce_queue(ctrl->admin_q);
+ nvme_tcp_destroy_admin_queue(ctrl, remove);
+- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ bool remove)
+ {
+- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ if (ctrl->queue_count <= 1)
+- goto out;
++ return;
+ blk_mq_quiesce_queue(ctrl->admin_q);
+ nvme_start_freeze(ctrl);
+ nvme_stop_queues(ctrl);
++ nvme_sync_io_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+ if (ctrl->tagset) {
+ blk_mq_tagset_busy_iter(ctrl->tagset,
+@@ -1829,8 +1827,6 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl,
+ if (remove)
+ nvme_start_queues(ctrl);
+ nvme_tcp_destroy_io_queues(ctrl, remove);
+-out:
+- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl)
+@@ -2074,14 +2070,11 @@ static void nvme_tcp_complete_timed_out(struct request *rq)
+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
+ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
+
+- /* fence other contexts that may complete the command */
+- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue));
+ if (!blk_mq_request_completed(rq)) {
+ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
+ blk_mq_complete_request(rq);
+ }
+- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock);
+ }
+
+ static enum blk_eh_timer_return
+@@ -2344,7 +2337,6 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev,
+ nvme_tcp_reconnect_ctrl_work);
+ INIT_WORK(&ctrl->err_work, nvme_tcp_error_recovery_work);
+ INIT_WORK(&ctrl->ctrl.reset_work, nvme_reset_ctrl_work);
+- mutex_init(&ctrl->teardown_lock);
+
+ if (!(opts->mask & NVMF_OPT_TRSVCID)) {
+ opts->trsvcid =
+--
+2.27.0
+
--- /dev/null
+From b4874757afdcf07896d76dbdb4a62a0f1e10fbe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 10:15:31 +0800
+Subject: nvme-tcp: avoid repeated request completion
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0a8a2c85b83589a5c10bc5564b796836bf4b4984 ]
+
+The request may be executed asynchronously, and rq->state may be
+changed to IDLE. To avoid repeated request completion, only
+MQ_RQ_COMPLETE of rq->state is checked in nvme_tcp_complete_timed_out.
+It is not safe, so need adding check IDLE for rq->state.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Chao Leng <lengchao@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 76440f26c1453..a31c6e1f6063a 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -2071,7 +2071,7 @@ static void nvme_tcp_complete_timed_out(struct request *rq)
+ struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl;
+
+ nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue));
+- if (!blk_mq_request_completed(rq)) {
++ if (blk_mq_request_started(rq) && !blk_mq_request_completed(rq)) {
+ nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD;
+ blk_mq_complete_request(rq);
+ }
+--
+2.27.0
+
--- /dev/null
+From 1f5bb3d2eb3121226c01931b827110d1bf4d0b8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 12:26:08 +0530
+Subject: opp: Reduce the size of critical section in _opp_table_kref_release()
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit e0df59de670b48a923246fae1f972317b84b2764 ]
+
+There is a lot of stuff here which can be done outside of the big
+opp_table_lock, do that. This helps avoiding few circular dependency
+lockdeps around debugfs and interconnects.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Reported-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 8867bab72e171..088c93dc0085c 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -1046,6 +1046,10 @@ static void _opp_table_kref_release(struct kref *kref)
+ struct opp_table *opp_table = container_of(kref, struct opp_table, kref);
+ struct opp_device *opp_dev, *temp;
+
++ /* Drop the lock as soon as we can */
++ list_del(&opp_table->node);
++ mutex_unlock(&opp_table_lock);
++
+ _of_clear_opp_table(opp_table);
+
+ /* Release clk */
+@@ -1067,10 +1071,7 @@ static void _opp_table_kref_release(struct kref *kref)
+
+ mutex_destroy(&opp_table->genpd_virt_dev_lock);
+ mutex_destroy(&opp_table->lock);
+- list_del(&opp_table->node);
+ kfree(opp_table);
+-
+- mutex_unlock(&opp_table_lock);
+ }
+
+ void dev_pm_opp_put_opp_table(struct opp_table *opp_table)
+--
+2.27.0
+
--- /dev/null
+From 95ad39c76c425ccb088600b8ca80729ccfbb91eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 16:30:12 -0400
+Subject: riscv: Set text_offset correctly for M-Mode
+
+From: Sean Anderson <seanga2@gmail.com>
+
+[ Upstream commit 79605f1394261995c2b955c906a5a20fb27cdc84 ]
+
+M-Mode Linux is loaded at the start of RAM, not 2MB later. Perhaps this
+should be calculated based on PAGE_OFFSET somehow? Even better would be to
+deprecate text_offset and instead introduce something absolute.
+
+Signed-off-by: Sean Anderson <seanga2@gmail.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/head.S | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
+index 72f89b7590dd6..344793159b97d 100644
+--- a/arch/riscv/kernel/head.S
++++ b/arch/riscv/kernel/head.S
+@@ -26,12 +26,17 @@ ENTRY(_start)
+ /* reserved */
+ .word 0
+ .balign 8
++#ifdef CONFIG_RISCV_M_MODE
++ /* Image load offset (0MB) from start of RAM for M-mode */
++ .dword 0
++#else
+ #if __riscv_xlen == 64
+ /* Image load offset(2MB) from start of RAM */
+ .dword 0x200000
+ #else
+ /* Image load offset(4MB) from start of RAM */
+ .dword 0x400000
++#endif
+ #endif
+ /* Effective size of kernel image */
+ .dword _end - _start
+--
+2.27.0
+
--- /dev/null
+From d4a316a38e2eb2cdbbfc7392b6ac9c94e2852623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 14:27:42 -0400
+Subject: s390/smp: move rcu_cpu_starting() earlier
+
+From: Qian Cai <cai@redhat.com>
+
+[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ]
+
+The call to rcu_cpu_starting() in smp_init_secondary() is not early
+enough in the CPU-hotplug onlining process, which results in lockdep
+splats as follows:
+
+ WARNING: suspicious RCU usage
+ -----------------------------
+ kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!!
+
+ other info that might help us debug this:
+
+ RCU used illegally from offline CPU!
+ rcu_scheduler_active = 1, debug_locks = 1
+ no locks held by swapper/1/0.
+
+ Call Trace:
+ show_stack+0x158/0x1f0
+ dump_stack+0x1f2/0x238
+ __lock_acquire+0x2640/0x4dd0
+ lock_acquire+0x3a8/0xd08
+ _raw_spin_lock_irqsave+0xc0/0xf0
+ clockevents_register_device+0xa8/0x528
+ init_cpu_timer+0x33e/0x468
+ smp_init_secondary+0x11a/0x328
+ smp_start_secondary+0x82/0x88
+
+This is avoided by moving the call to rcu_cpu_starting up near the
+beginning of the smp_init_secondary() function. Note that the
+raw_smp_processor_id() is required in order to avoid calling into
+lockdep before RCU has declared the CPU to be watched for readers.
+
+Link: https://lore.kernel.org/lkml/160223032121.7002.1269740091547117869.tip-bot2@tip-bot2/
+Signed-off-by: Qian Cai <cai@redhat.com>
+Acked-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/smp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index ad426cc656e56..66d7ba61803c8 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -845,13 +845,14 @@ void __init smp_detect_cpus(void)
+
+ static void smp_init_secondary(void)
+ {
+- int cpu = smp_processor_id();
++ int cpu = raw_smp_processor_id();
+
+ S390_lowcore.last_update_clock = get_tod_clock();
+ restore_access_regs(S390_lowcore.access_regs_save_area);
+ set_cpu_flag(CIF_ASCE_PRIMARY);
+ set_cpu_flag(CIF_ASCE_SECONDARY);
+ cpu_init();
++ rcu_cpu_starting(cpu);
+ preempt_disable();
+ init_cpu_timer();
+ vtime_init();
+--
+2.27.0
+
--- /dev/null
+From 6ce73ca9f44e5c392ccbd64557a3e29d00037ae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 07:31:24 +0000
+Subject: scsi: hpsa: Fix memory leak in hpsa_init_one()
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ]
+
+When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is
+missing a free() in the error handler.
+
+Fix this by adding free() when hpsa_scsi_add_host() fails.
+
+Link: https://lore.kernel.org/r/20201027073125.14229-1-keitasuzuki.park@sslab.ics.keio.ac.jp
+Tested-by: Don Brace <don.brace@microchip.com>
+Acked-by: Don Brace <don.brace@microchip.com>
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hpsa.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index e67cb4561aace..bac705990a961 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -8854,7 +8854,7 @@ reinit_after_soft_reset:
+ /* hook into SCSI subsystem */
+ rc = hpsa_scsi_add_host(h);
+ if (rc)
+- goto clean7; /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ goto clean8; /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
+
+ /* Monitor the controller for firmware lockups */
+ h->heartbeat_sample_interval = HEARTBEAT_SAMPLE_INTERVAL;
+@@ -8869,6 +8869,8 @@ reinit_after_soft_reset:
+ HPSA_EVENT_MONITOR_INTERVAL);
+ return 0;
+
++clean8: /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */
++ kfree(h->lastlogicals);
+ clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */
+ hpsa_free_performant_mode(h);
+ h->access.set_intr_mask(h, HPSA_INTR_OFF);
+--
+2.27.0
+
--- /dev/null
+From 54ac739bffcd2cccc335dec4d43daaa7273c5153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 12:57:46 +0530
+Subject: scsi: mpt3sas: Fix timeouts observed while reenabling IRQ
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+[ Upstream commit 5feed64f9199ff90c4239971733f23f30aeb2484 ]
+
+While reenabling the IRQ after irq poll there may be small time window
+where HBA firmware has posted some replies and raise the interrupts but
+driver has not received the interrupts. So we may observe I/O timeouts as
+the driver has not processed the replies as interrupts got missed while
+reenabling the IRQ.
+
+To fix this issue the driver has to go for one more round of processing the
+reply descriptors from reply descriptor post queue after enabling the IRQ.
+
+Link: https://lore.kernel.org/r/20201102072746.27410-1-sreekanth.reddy@broadcom.com
+Reported-by: Tomas Henzl <thenzl@redhat.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 3d58d24de6b61..8be8c510fdf79 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -1641,6 +1641,13 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget)
+ reply_q->irq_poll_scheduled = false;
+ reply_q->irq_line_enable = true;
+ enable_irq(reply_q->os_irq);
++ /*
++ * Go for one more round of processing the
++ * reply descriptor post queue incase if HBA
++ * Firmware has posted some reply descriptors
++ * while reenabling the IRQ.
++ */
++ _base_process_reply_queue(reply_q);
+ }
+
+ return num_entries;
+--
+2.27.0
+
--- /dev/null
+From 1fd9615f43223c3877cb9e2a577b88d1b49b4700 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 12:45:59 +0200
+Subject: scsi: scsi_dh_alua: Avoid crash during alua_bus_detach()
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca ]
+
+alua_bus_detach() might be running concurrently with alua_rtpg_work(), so
+we might trip over h->sdev == NULL and call BUG_ON(). The correct way of
+handling it is to not set h->sdev to NULL in alua_bus_detach(), and call
+rcu_synchronize() before the final delete to ensure that all concurrent
+threads have left the critical section. Then we can get rid of the
+BUG_ON() and replace it with a simple if condition.
+
+Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com
+Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de
+Cc: Brian Bunker <brian@purestorage.com>
+Acked-by: Brian Bunker <brian@purestorage.com>
+Tested-by: Jitendra Khasdev <jitendra.khasdev@oracle.com>
+Reviewed-by: Jitendra Khasdev <jitendra.khasdev@oracle.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index f32da0ca529e0..308bda2e9c000 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -658,8 +658,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ rcu_read_lock();
+ list_for_each_entry_rcu(h,
+ &tmp_pg->dh_list, node) {
+- /* h->sdev should always be valid */
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state = desc[0];
+ }
+ rcu_read_unlock();
+@@ -705,7 +705,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ pg->expiry = 0;
+ rcu_read_lock();
+ list_for_each_entry_rcu(h, &pg->dh_list, node) {
+- BUG_ON(!h->sdev);
++ if (!h->sdev)
++ continue;
+ h->sdev->access_state =
+ (pg->state & SCSI_ACCESS_STATE_MASK);
+ if (pg->pref)
+@@ -1147,7 +1148,6 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ spin_lock(&h->pg_lock);
+ pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock));
+ rcu_assign_pointer(h->pg, NULL);
+- h->sdev = NULL;
+ spin_unlock(&h->pg_lock);
+ if (pg) {
+ spin_lock_irq(&pg->lock);
+@@ -1156,6 +1156,7 @@ static void alua_bus_detach(struct scsi_device *sdev)
+ kref_put(&pg->kref, release_port_group);
+ }
+ sdev->handler_data = NULL;
++ synchronize_rcu();
+ kfree(h);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From d5b8d5e54795d9bd4a040354d7d8a6c7edfd6342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Oct 2020 14:25:01 +0100
+Subject: selftests/ftrace: check for do_sys_openat2 in user-memory test
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e3e40312567087fbe6880f316cb2b0e1f3d8a82c ]
+
+More recent libc implementations are now using openat/openat2 system
+calls so also add do_sys_openat2 to the tracing so that the test
+passes on these systems because do_sys_open may not be called.
+
+Thanks to Masami Hiramatsu for the help on getting this fix to work
+correctly.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/kprobe/kprobe_args_user.tc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc
+index 0f60087583d8f..a753c73d869ab 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc
+@@ -11,12 +11,16 @@ grep -A10 "fetcharg:" README | grep -q '\[u\]<offset>' || exit_unsupported
+ :;: "user-memory access syntax and ustring working on user memory";:
+ echo 'p:myevent do_sys_open path=+0($arg2):ustring path2=+u0($arg2):string' \
+ > kprobe_events
++echo 'p:myevent2 do_sys_openat2 path=+0($arg2):ustring path2=+u0($arg2):string' \
++ >> kprobe_events
+
+ grep myevent kprobe_events | \
+ grep -q 'path=+0($arg2):ustring path2=+u0($arg2):string'
+ echo 1 > events/kprobes/myevent/enable
++echo 1 > events/kprobes/myevent2/enable
+ echo > /dev/null
+ echo 0 > events/kprobes/myevent/enable
++echo 0 > events/kprobes/myevent2/enable
+
+ grep myevent trace | grep -q 'path="/dev/null" path2="/dev/null"'
+
+--
+2.27.0
+
--- /dev/null
+From 141f39a53d14d387dee216040be0585ee5409699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 15:26:22 +0300
+Subject: selftests: pidfd: fix compilation errors due to wait.h
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+[ Upstream commit 1948172fdba5ad643529ddcd00a601c0caa913ed ]
+
+Drop unneeded <linux/wait.h> header inclusion to fix pidfd compilation
+errors seen in Fedora 32:
+
+In file included from pidfd_open_test.c:9:
+../../../../usr/include/linux/wait.h:17:16: error: expected identifier before numeric constant
+ 17 | #define P_ALL 0
+ | ^
+
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/pidfd/pidfd_open_test.c | 1 -
+ tools/testing/selftests/pidfd/pidfd_poll_test.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/tools/testing/selftests/pidfd/pidfd_open_test.c b/tools/testing/selftests/pidfd/pidfd_open_test.c
+index b9fe75fc3e517..8a59438ccc78b 100644
+--- a/tools/testing/selftests/pidfd/pidfd_open_test.c
++++ b/tools/testing/selftests/pidfd/pidfd_open_test.c
+@@ -6,7 +6,6 @@
+ #include <inttypes.h>
+ #include <limits.h>
+ #include <linux/types.h>
+-#include <linux/wait.h>
+ #include <sched.h>
+ #include <signal.h>
+ #include <stdbool.h>
+diff --git a/tools/testing/selftests/pidfd/pidfd_poll_test.c b/tools/testing/selftests/pidfd/pidfd_poll_test.c
+index 4b115444dfe90..6108112753573 100644
+--- a/tools/testing/selftests/pidfd/pidfd_poll_test.c
++++ b/tools/testing/selftests/pidfd/pidfd_poll_test.c
+@@ -3,7 +3,6 @@
+ #define _GNU_SOURCE
+ #include <errno.h>
+ #include <linux/types.h>
+-#include <linux/wait.h>
+ #include <poll.h>
+ #include <signal.h>
+ #include <stdbool.h>
+--
+2.27.0
+
--- /dev/null
+From 453d2b032a949dbb3910d5f4a1943ec31b2268be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 15:26:30 +0300
+Subject: selftests: proc: fix warning: _GNU_SOURCE redefined
+
+From: Tommi Rantala <tommi.t.rantala@nokia.com>
+
+[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ]
+
+Makefile already contains -D_GNU_SOURCE, so we can remove it from the
+*.c files.
+
+Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/proc/proc-loadavg-001.c | 1 -
+ tools/testing/selftests/proc/proc-self-syscall.c | 1 -
+ tools/testing/selftests/proc/proc-uptime-002.c | 1 -
+ 3 files changed, 3 deletions(-)
+
+diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c
+index 471e2aa280776..fb4fe9188806e 100644
+--- a/tools/testing/selftests/proc/proc-loadavg-001.c
++++ b/tools/testing/selftests/proc/proc-loadavg-001.c
+@@ -14,7 +14,6 @@
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+ /* Test that /proc/loadavg correctly reports last pid in pid namespace. */
+-#define _GNU_SOURCE
+ #include <errno.h>
+ #include <sched.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c
+index 9f6d000c02455..8511dcfe67c75 100644
+--- a/tools/testing/selftests/proc/proc-self-syscall.c
++++ b/tools/testing/selftests/proc/proc-self-syscall.c
+@@ -13,7 +13,6 @@
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+-#define _GNU_SOURCE
+ #include <unistd.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c
+index 30e2b78490898..e7ceabed7f51f 100644
+--- a/tools/testing/selftests/proc/proc-uptime-002.c
++++ b/tools/testing/selftests/proc/proc-uptime-002.c
+@@ -15,7 +15,6 @@
+ */
+ // Test that values in /proc/uptime increment monotonically
+ // while shifting across CPUs.
+-#define _GNU_SOURCE
+ #undef NDEBUG
+ #include <assert.h>
+ #include <unistd.h>
+--
+2.27.0
+
kvm-arm64-arm_smccc_arch_workaround_1-doesn-t-return-smccc_ret_not_required.patch
kvm-x86-don-t-expose-msr_ia32_umwait_control-uncondi.patch
ath9k_htc-use-appropriate-rs_datalen-type.patch
+asoc-qcom-sdm845-set-driver-name-correctly.patch
+asoc-cs42l51-manage-mclk-shutdown-delay.patch
+usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch
+opp-reduce-the-size-of-critical-section-in-_opp_tabl.patch
+usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch
+selftests-ftrace-check-for-do_sys_openat2-in-user-me.patch
+selftests-pidfd-fix-compilation-errors-due-to-wait.h.patch
+alsa-hda-separate-runtime-and-system-suspend.patch
+alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch
+gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch
+gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch
+gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch
+scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch
+drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch
+drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch
+drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch
+mac80211-fix-use-of-skb-payload-instead-of-header.patch
+cfg80211-initialize-wdev-data-earlier.patch
+mac80211-always-wind-down-sta-state.patch
+cfg80211-regulatory-fix-inconsistent-format-argument.patch
+tracing-fix-the-checking-of-stackidx-in-__ftrace_tra.patch
+scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch
+scsi-mpt3sas-fix-timeouts-observed-while-reenabling-.patch
+nvme-introduce-nvme_sync_io_queues.patch
+nvme-rdma-avoid-race-between-time-out-and-tear-down.patch
+nvme-tcp-avoid-race-between-time-out-and-tear-down.patch
+nvme-rdma-avoid-repeated-request-completion.patch
+nvme-tcp-avoid-repeated-request-completion.patch
+iommu-amd-increase-interrupt-remapping-table-limit-t.patch
+s390-smp-move-rcu_cpu_starting-earlier.patch
+vfio-platform-fix-reference-leak-in-vfio_platform_op.patch
+vfio-pci-bypass-igd-init-in-case-of-enodev.patch
+i2c-mediatek-move-dma-reset-before-i2c-reset.patch
+amd-amdgpu-disable-vcn-dpg-mode-for-picasso.patch
+selftests-proc-fix-warning-_gnu_source-redefined.patch
+riscv-set-text_offset-correctly-for-m-mode.patch
+i2c-sh_mobile-implement-atomic-transfers.patch
+tpm_tis-disable-interrupts-on-thinkpad-t490s.patch
--- /dev/null
+From dbe50d0e0df846713c8e411976db1507f83eb797 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:44:30 -0700
+Subject: tpm_tis: Disable interrupts on ThinkPad T490s
+
+From: Jerry Snitselaar <jsnitsel@redhat.com>
+
+[ Upstream commit b154ce11ead925de6a94feb3b0317fafeefa0ebc ]
+
+There is a misconfiguration in the bios of the gpio pin used for the
+interrupt in the T490s. When interrupts are enabled in the tpm_tis
+driver code this results in an interrupt storm. This was initially
+reported when we attempted to enable the interrupt code in the tpm_tis
+driver, which previously wasn't setting a flag to enable it. Due to
+the reports of the interrupt storm that code was reverted and we went back
+to polling instead of using interrupts. Now that we know the T490s problem
+is a firmware issue, add code to check if the system is a T490s and
+disable interrupts if that is the case. This will allow us to enable
+interrupts for everyone else. If the user has a fixed bios they can
+force the enabling of interrupts with tpm_tis.interrupts=1 on the
+kernel command line.
+
+Cc: Peter Huewe <peterhuewe@gmx.de>
+Cc: Jason Gunthorpe <jgg@ziepe.ca>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index e7df342a317d6..c722e3b3121a8 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -27,6 +27,7 @@
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+ #include <linux/kernel.h>
++#include <linux/dmi.h>
+ #include "tpm.h"
+ #include "tpm_tis_core.h"
+
+@@ -49,8 +50,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da
+ return container_of(data, struct tpm_tis_tcg_phy, priv);
+ }
+
+-static bool interrupts = true;
+-module_param(interrupts, bool, 0444);
++static int interrupts = -1;
++module_param(interrupts, int, 0444);
+ MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+ static bool itpm;
+@@ -63,6 +64,28 @@ module_param(force, bool, 0444);
+ MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry");
+ #endif
+
++static int tpm_tis_disable_irq(const struct dmi_system_id *d)
++{
++ if (interrupts == -1) {
++ pr_notice("tpm_tis: %s detected: disabling interrupts.\n", d->ident);
++ interrupts = 0;
++ }
++
++ return 0;
++}
++
++static const struct dmi_system_id tpm_tis_dmi_table[] = {
++ {
++ .callback = tpm_tis_disable_irq,
++ .ident = "ThinkPad T490s",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"),
++ },
++ },
++ {}
++};
++
+ #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
+ static int has_hid(struct acpi_device *dev, const char *hid)
+ {
+@@ -192,6 +215,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)
+ int irq = -1;
+ int rc;
+
++ dmi_check_system(tpm_tis_dmi_table);
++
+ rc = check_acpi_tpm2(dev);
+ if (rc)
+ return rc;
+--
+2.27.0
+
--- /dev/null
+From ece8e71c052fddbc075df14f77e50c2aecd3f947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Oct 2020 16:57:14 +0800
+Subject: tracing: Fix the checking of stackidx in __ftrace_trace_stack
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+[ Upstream commit 906695e59324635c62b5ae59df111151a546ca66 ]
+
+The array size is FTRACE_KSTACK_NESTING, so the index FTRACE_KSTACK_NESTING
+is illegal too. And fix two typos by the way.
+
+Link: https://lkml.kernel.org/r/20201031085714.2147-1-hqjagain@gmail.com
+
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 2a357bda45cf0..f7cac11a90055 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2510,7 +2510,7 @@ trace_event_buffer_lock_reserve(struct ring_buffer **current_rb,
+ /*
+ * If tracing is off, but we have triggers enabled
+ * we still need to look at the event data. Use the temp_buffer
+- * to store the trace event for the tigger to use. It's recusive
++ * to store the trace event for the trigger to use. It's recursive
+ * safe and will not be recorded anywhere.
+ */
+ if (!entry && trace_file->flags & EVENT_FILE_FL_TRIGGER_COND) {
+@@ -2832,7 +2832,7 @@ static void __ftrace_trace_stack(struct ring_buffer *buffer,
+ stackidx = __this_cpu_inc_return(ftrace_stack_reserve) - 1;
+
+ /* This should never happen. If it does, yell once and skip */
+- if (WARN_ON_ONCE(stackidx > FTRACE_KSTACK_NESTING))
++ if (WARN_ON_ONCE(stackidx >= FTRACE_KSTACK_NESTING))
+ goto out;
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 401d04db446b5215e4f45571133e71d66c3841c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Oct 2020 16:02:50 +0300
+Subject: usb: dwc3: pci: add support for the Intel Alder Lake-S
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ]
+
+This patch adds the necessary PCI ID for Intel Alder Lake-S
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index ba88039449e03..58b8801ce8816 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -40,6 +40,7 @@
+ #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee
+ #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
+ #define PCI_DEVICE_ID_INTEL_JSP 0x4dee
++#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -367,6 +368,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ (kernel_ulong_t) &dwc3_pci_amd_properties, },
+ { } /* Terminating Entry */
+--
+2.27.0
+
--- /dev/null
+From fd0d973a8d01dbc556fb56e402d120611f822164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Oct 2020 18:01:55 +0300
+Subject: usb: gadget: goku_udc: fix potential crashes in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ]
+
+goku_probe() goes to error label "err" and invokes goku_remove()
+in case of failures of pci_enable_device(), pci_resource_start()
+and ioremap(). goku_remove() gets a device from
+pci_get_drvdata(pdev) and works with it without any checks, in
+particular it dereferences a corresponding pointer. But
+goku_probe() did not set this device yet. So, one can expect
+various crashes. The patch moves setting the device just after
+allocation of memory for it.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Reported-by: Pavel Andrianov <andrianov@ispras.ru>
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/goku_udc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c
+index c3721225b61ed..b706ad3034bc1 100644
+--- a/drivers/usb/gadget/udc/goku_udc.c
++++ b/drivers/usb/gadget/udc/goku_udc.c
+@@ -1757,6 +1757,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto err;
+ }
+
++ pci_set_drvdata(pdev, dev);
+ spin_lock_init(&dev->lock);
+ dev->pdev = pdev;
+ dev->gadget.ops = &goku_ops;
+@@ -1790,7 +1791,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ }
+ dev->regs = (struct goku_udc_regs __iomem *) base;
+
+- pci_set_drvdata(pdev, dev);
+ INFO(dev, "%s\n", driver_desc);
+ INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
+ INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base);
+--
+2.27.0
+
--- /dev/null
+From c27f30ef965fffd06e517f10d2b00ea2d8f27a9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 02:01:20 +0800
+Subject: vfio/pci: Bypass IGD init in case of -ENODEV
+
+From: Fred Gao <fred.gao@intel.com>
+
+[ Upstream commit e4eccb853664de7bcf9518fb658f35e748bf1f68 ]
+
+Bypass the IGD initialization when -ENODEV returns,
+that should be the case if opregion is not available for IGD
+or within discrete graphics device's option ROM,
+or host/lpc bridge is not found.
+
+Then use of -ENODEV here means no special device resources found
+which needs special care for VFIO, but we still allow other normal
+device resource access.
+
+Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
+Cc: Xiong Zhang <xiong.y.zhang@intel.com>
+Cc: Hang Yuan <hang.yuan@linux.intel.com>
+Cc: Stuart Summers <stuart.summers@intel.com>
+Signed-off-by: Fred Gao <fred.gao@intel.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a72fd5309b09f..443a35dde7f52 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -334,7 +334,7 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev)
+ pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ IS_ENABLED(CONFIG_VFIO_PCI_IGD)) {
+ ret = vfio_pci_igd_init(vdev);
+- if (ret) {
++ if (ret && ret != -ENODEV) {
+ pci_warn(pdev, "Failed to setup Intel IGD regions\n");
+ goto disable_exit;
+ }
+--
+2.27.0
+
--- /dev/null
+From d4024935a80ce902663a5d4bddf32dedf3ecbcf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Oct 2020 11:03:53 +0800
+Subject: vfio: platform: fix reference leak in vfio_platform_open
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit bb742ad01961a3b9d1f9d19375487b879668b6b2 ]
+
+pm_runtime_get_sync() will increment pm usage counter even it
+failed. Forgetting to call pm_runtime_put will result in
+reference leak in vfio_platform_open, so we should fix it.
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/platform/vfio_platform_common.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c
+index e8f2bdbe05428..152e5188183ce 100644
+--- a/drivers/vfio/platform/vfio_platform_common.c
++++ b/drivers/vfio/platform/vfio_platform_common.c
+@@ -267,7 +267,7 @@ static int vfio_platform_open(void *device_data)
+
+ ret = pm_runtime_get_sync(vdev->device);
+ if (ret < 0)
+- goto err_pm;
++ goto err_rst;
+
+ ret = vfio_platform_call_reset(vdev, &extra_dbg);
+ if (ret && vdev->reset_required) {
+@@ -284,7 +284,6 @@ static int vfio_platform_open(void *device_data)
+
+ err_rst:
+ pm_runtime_put(vdev->device);
+-err_pm:
+ vfio_platform_irq_cleanup(vdev);
+ err_irq:
+ vfio_platform_regions_cleanup(vdev);
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
