--- /dev/null
+From bace1fcd6a8a2859c4beedfe5b12c5c0c839278f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:59:27 -0800
+Subject: ARC: stack unwinding: don't assume non-current task is sleeping
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+[ Upstream commit e42404fa10fd11fe72d0a0e149a321d10e577715 ]
+
+To start stack unwinding (SP, PC and BLINK) are needed. When the
+explicit execution context (pt_regs etc) is not available, unwinder
+assumes the task is sleeping (in __switch_to()) and fetches SP and BLINK
+from kernel mode stack.
+
+But this assumption is not true, specially in a SMP system, when top
+runs on 1 core, there may be active running processes on all cores.
+
+So when unwinding non courrent tasks, ensure they are NOT running.
+
+And while at it, handle the self unwinding case explicitly.
+
+This came out of investigation of a customer reported hang with
+rcutorture+top
+
+Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/31
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/kernel/stacktrace.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index b23986f984509..b2557f581ea8c 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -38,15 +38,15 @@
+
+ #ifdef CONFIG_ARC_DW2_UNWIND
+
+-static void seed_unwind_frame_info(struct task_struct *tsk,
+- struct pt_regs *regs,
+- struct unwind_frame_info *frame_info)
++static int
++seed_unwind_frame_info(struct task_struct *tsk, struct pt_regs *regs,
++ struct unwind_frame_info *frame_info)
+ {
+ /*
+ * synchronous unwinding (e.g. dump_stack)
+ * - uses current values of SP and friends
+ */
+- if (tsk == NULL && regs == NULL) {
++ if (regs == NULL && (tsk == NULL || tsk == current)) {
+ unsigned long fp, sp, blink, ret;
+ frame_info->task = current;
+
+@@ -65,11 +65,15 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->call_frame = 0;
+ } else if (regs == NULL) {
+ /*
+- * Asynchronous unwinding of sleeping task
+- * - Gets SP etc from task's pt_regs (saved bottom of kernel
+- * mode stack of task)
++ * Asynchronous unwinding of a likely sleeping task
++ * - first ensure it is actually sleeping
++ * - if so, it will be in __switch_to, kernel mode SP of task
++ * is safe-kept and BLINK at a well known location in there
+ */
+
++ if (tsk->state == TASK_RUNNING)
++ return -1;
++
+ frame_info->task = tsk;
+
+ frame_info->regs.r27 = TSK_K_FP(tsk);
+@@ -103,6 +107,8 @@ static void seed_unwind_frame_info(struct task_struct *tsk,
+ frame_info->regs.r63 = regs->ret;
+ frame_info->call_frame = 0;
+ }
++
++ return 0;
+ }
+
+ #endif
+@@ -116,7 +122,8 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ unsigned int address;
+ struct unwind_frame_info frame_info;
+
+- seed_unwind_frame_info(tsk, regs, &frame_info);
++ if (seed_unwind_frame_info(tsk, regs, &frame_info))
++ return 0;
+
+ while (1) {
+ address = UNW_PC(&frame_info);
+--
+2.27.0
+
--- /dev/null
+From 77fa6601450d4af29ba843320039ba9aaac7d1d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 22:05:19 +0000
+Subject: arm-smmu-qcom: Ensure the qcom_scm driver has finished probing
+
+From: John Stultz <john.stultz@linaro.org>
+
+[ Upstream commit 72b55c96f3a5ae6e486c20b5dacf5114060ed042 ]
+
+Robin Murphy pointed out that if the arm-smmu driver probes before
+the qcom_scm driver, we may call qcom_scm_qsmmu500_wait_safe_toggle()
+before the __scm is initialized.
+
+Now, getting this to happen is a bit contrived, as in my efforts it
+required enabling asynchronous probing for both drivers, moving the
+firmware dts node to the end of the dtsi file, as well as forcing a
+long delay in the qcom_scm_probe function.
+
+With those tweaks we ran into the following crash:
+[ 2.631040] arm-smmu 15000000.iommu: Stage-1: 48-bit VA -> 48-bit IPA
+[ 2.633372] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+...
+[ 2.633402] [0000000000000000] user address but active_mm is swapper
+[ 2.633409] Internal error: Oops: 96000005 [#1] PREEMPT SMP
+[ 2.633415] Modules linked in:
+[ 2.633427] CPU: 5 PID: 117 Comm: kworker/u16:2 Tainted: G W 5.10.0-rc1-mainline-00025-g272a618fc36-dirty #3971
+[ 2.633430] Hardware name: Thundercomm Dragonboard 845c (DT)
+[ 2.633448] Workqueue: events_unbound async_run_entry_fn
+[ 2.633456] pstate: 80c00005 (Nzcv daif +PAN +UAO -TCO BTYPE=--)
+[ 2.633465] pc : qcom_scm_qsmmu500_wait_safe_toggle+0x78/0xb0
+[ 2.633473] lr : qcom_smmu500_reset+0x58/0x78
+[ 2.633476] sp : ffffffc0105a3b60
+...
+[ 2.633567] Call trace:
+[ 2.633572] qcom_scm_qsmmu500_wait_safe_toggle+0x78/0xb0
+[ 2.633576] qcom_smmu500_reset+0x58/0x78
+[ 2.633581] arm_smmu_device_reset+0x194/0x270
+[ 2.633585] arm_smmu_device_probe+0xc94/0xeb8
+[ 2.633592] platform_drv_probe+0x58/0xa8
+[ 2.633597] really_probe+0xec/0x398
+[ 2.633601] driver_probe_device+0x5c/0xb8
+[ 2.633606] __driver_attach_async_helper+0x64/0x88
+[ 2.633610] async_run_entry_fn+0x4c/0x118
+[ 2.633617] process_one_work+0x20c/0x4b0
+[ 2.633621] worker_thread+0x48/0x460
+[ 2.633628] kthread+0x14c/0x158
+[ 2.633634] ret_from_fork+0x10/0x18
+[ 2.633642] Code: a9034fa0 d0007f73 29107fa0 91342273 (f9400020)
+
+To avoid this, this patch adds a check on qcom_scm_is_available() in
+the qcom_smmu_impl_init() function, returning -EPROBE_DEFER if its
+not ready.
+
+This allows the driver to try to probe again later after qcom_scm has
+finished probing.
+
+Reported-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Andy Gross <agross@kernel.org>
+Cc: Maulik Shah <mkshah@codeaurora.org>
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: Saravana Kannan <saravanak@google.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Lina Iyer <ilina@codeaurora.org>
+Cc: iommu@lists.linux-foundation.org
+Cc: linux-arm-msm <linux-arm-msm@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201112220520.48159-1-john.stultz@linaro.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+index be4318044f96c..702fbaa6c9ada 100644
+--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
++++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+@@ -69,6 +69,10 @@ struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu)
+ {
+ struct qcom_smmu *qsmmu;
+
++ /* Check to make sure qcom_scm has finished probing */
++ if (!qcom_scm_is_available())
++ return ERR_PTR(-EPROBE_DEFER);
++
+ qsmmu = devm_kzalloc(smmu->dev, sizeof(*qsmmu), GFP_KERNEL);
+ if (!qsmmu)
+ return ERR_PTR(-ENOMEM);
+--
+2.27.0
+
--- /dev/null
+From 5bac1a6a1135acd54e375cce5d12be8069934937 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 17:08:32 +0800
+Subject: arm64: dts: broadcom: clear the warnings caused by empty dma-ranges
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 2013a4b684b6eb614ee5c9a3c07b0ae6f5ca96d9 ]
+
+The scripts/dtc/checks.c requires that the node have empty "dma-ranges"
+property must have the same "#address-cells" and "#size-cells" values as
+the parent node. Otherwise, the following warnings is reported:
+
+arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning \
+(dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but \
+its #address-cells (1) differs from / (2)
+arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi:7.3-14: Warning \
+(dma_ranges_format): /usb:dma-ranges: empty "dma-ranges" property but \
+its #size-cells (1) differs from / (2)
+
+Arnd Bergmann figured out why it's necessary:
+Also note that the #address-cells=<1> means that any device under
+this bus is assumed to only support 32-bit addressing, and DMA will
+have to go through a slow swiotlb in the absence of an IOMMU.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20201016090833.1892-2-thunder.leizhen@huawei.com'
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/broadcom/stingray/stingray-usb.dtsi | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
+index 55259f973b5a9..aef8f2b00778d 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi
+@@ -5,20 +5,20 @@
+ usb {
+ compatible = "simple-bus";
+ dma-ranges;
+- #address-cells = <1>;
+- #size-cells = <1>;
+- ranges = <0x0 0x0 0x68500000 0x00400000>;
++ #address-cells = <2>;
++ #size-cells = <2>;
++ ranges = <0x0 0x0 0x0 0x68500000 0x0 0x00400000>;
+
+ usbphy0: usb-phy@0 {
+ compatible = "brcm,sr-usb-combo-phy";
+- reg = <0x00000000 0x100>;
++ reg = <0x0 0x00000000 0x0 0x100>;
+ #phy-cells = <1>;
+ status = "disabled";
+ };
+
+ xhci0: usb@1000 {
+ compatible = "generic-xhci";
+- reg = <0x00001000 0x1000>;
++ reg = <0x0 0x00001000 0x0 0x1000>;
+ interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usbphy0 1>, <&usbphy0 0>;
+ phy-names = "phy0", "phy1";
+@@ -28,7 +28,7 @@
+
+ bdc0: usb@2000 {
+ compatible = "brcm,bdc-v0.16";
+- reg = <0x00002000 0x1000>;
++ reg = <0x0 0x00002000 0x0 0x1000>;
+ interrupts = <GIC_SPI 259 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usbphy0 0>, <&usbphy0 1>;
+ phy-names = "phy0", "phy1";
+@@ -38,21 +38,21 @@
+
+ usbphy1: usb-phy@10000 {
+ compatible = "brcm,sr-usb-combo-phy";
+- reg = <0x00010000 0x100>;
++ reg = <0x0 0x00010000 0x0 0x100>;
+ #phy-cells = <1>;
+ status = "disabled";
+ };
+
+ usbphy2: usb-phy@20000 {
+ compatible = "brcm,sr-usb-hs-phy";
+- reg = <0x00020000 0x100>;
++ reg = <0x0 0x00020000 0x0 0x100>;
+ #phy-cells = <0>;
+ status = "disabled";
+ };
+
+ xhci1: usb@11000 {
+ compatible = "generic-xhci";
+- reg = <0x00011000 0x1000>;
++ reg = <0x0 0x00011000 0x0 0x1000>;
+ interrupts = <GIC_SPI 263 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usbphy1 1>, <&usbphy2>, <&usbphy1 0>;
+ phy-names = "phy0", "phy1", "phy2";
+@@ -62,7 +62,7 @@
+
+ bdc1: usb@21000 {
+ compatible = "brcm,bdc-v0.16";
+- reg = <0x00021000 0x1000>;
++ reg = <0x0 0x00021000 0x0 0x1000>;
+ interrupts = <GIC_SPI 266 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usbphy2>;
+ phy-names = "phy0";
+--
+2.27.0
+
--- /dev/null
+From eeddc64913fdec6191aa70143d945e01bf3e2b48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:23:55 +0100
+Subject: arm64: dts: rockchip: Assign a fixed index to mmc devices on rk3399
+ boards.
+
+From: Markus Reichl <m.reichl@fivetechno.de>
+
+[ Upstream commit 0011c6d182774fc781fb9e115ebe8baa356029ae ]
+
+Recently introduced async probe on mmc devices can shuffle block IDs.
+Pin them to fixed values to ease booting in environments where UUIDs
+are not practical. Use newly introduced aliases for mmcblk devices from [1].
+
+[1]
+https://patchwork.kernel.org/patch/11747669/
+
+Signed-off-by: Markus Reichl <m.reichl@fivetechno.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20201104162356.1251-1-m.reichl@fivetechno.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+index ada724b12f014..7a9a7aca86c6a 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -29,6 +29,9 @@
+ i2c6 = &i2c6;
+ i2c7 = &i2c7;
+ i2c8 = &i2c8;
++ mmc0 = &sdio0;
++ mmc1 = &sdmmc;
++ mmc2 = &sdhci;
+ serial0 = &uart0;
+ serial1 = &uart1;
+ serial2 = &uart2;
+--
+2.27.0
+
--- /dev/null
+From 1d7d7ff59238b7cd712d03e3677fc70a75f48e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 20:16:29 +0200
+Subject: arm64: dts: rockchip: Remove system-power-controller from pmic on
+ Odroid Go Advance
+
+From: Maciej Matuszczyk <maccraft123mc@gmail.com>
+
+[ Upstream commit 01fe332800d0d2f94337b45c1973f4cf28ae6195 ]
+
+This fixes a poweroff issue when this is supposed to happen
+via PSCI.
+
+Signed-off-by: Maciej Matuszczyk <maccraft123mc@gmail.com>
+Link: https://lore.kernel.org/r/20201023181629.119727-1-maccraft123mc@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts b/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts
+index 35bd6b904b9c7..3376810385193 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts
+@@ -243,7 +243,6 @@
+ interrupts = <RK_PB2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pmic_int>;
+- rockchip,system-power-controller;
+ wakeup-source;
+ #clock-cells = <1>;
+ clock-output-names = "rk808-clkout1", "xin32k";
+--
+2.27.0
+
--- /dev/null
+From adf7bf75f95470420af58d11197da4a866228798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 20:29:31 +0100
+Subject: arm64: dts: rockchip: Reorder LED triggers from mmc devices on
+ rk3399-roc-pc.
+
+From: Markus Reichl <m.reichl@fivetechno.de>
+
+[ Upstream commit 7327c8b98e2e14c47021eea14d1ab268086a6408 ]
+
+After patch [1] SD-card becomes mmc1 and eMMC becomes mmc2.
+Correct trigger of LEDs accordingly.
+
+[1]
+https://patchwork.kernel.org/patch/11881427
+
+Signed-off-by: Markus Reichl <m.reichl@fivetechno.de>
+Link: https://lore.kernel.org/r/20201104192933.1001-1-m.reichl@fivetechno.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
+index b85ec31cd2835..78ef0037ad4b5 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi
+@@ -74,14 +74,14 @@
+ label = "red:diy";
+ gpios = <&gpio0 RK_PB5 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+- linux,default-trigger = "mmc1";
++ linux,default-trigger = "mmc2";
+ };
+
+ yellow_led: led-2 {
+ label = "yellow:yellow-led";
+ gpios = <&gpio0 RK_PA2 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+- linux,default-trigger = "mmc0";
++ linux,default-trigger = "mmc1";
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 6ad4b7b07502704548df4311339ec60c8874afa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 16:20:26 +0000
+Subject: arm64: tegra: Disable the ACONNECT for Jetson TX2
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit fb319496935b7475a863a00c76895e8bb3216704 ]
+
+Commit ff4c371d2bc0 ("arm64: defconfig: Build ADMA and ACONNECT driver")
+enable the Tegra ADMA and ACONNECT drivers and this is causing resume
+from system suspend to fail on Jetson TX2. Resume is failing because the
+ACONNECT driver is being resumed before the BPMP driver, and the ACONNECT
+driver is attempting to power on a power-domain that is provided by the
+BPMP. While a proper fix for the resume sequencing problem is identified,
+disable the ACONNECT for Jetson TX2 temporarily to avoid breaking system
+suspend.
+
+Please note that ACONNECT driver is used by the Audio Processing Engine
+(APE) on Tegra, but because there is no mainline support for APE on
+Jetson TX2 currently, disabling the ACONNECT does not disable any useful
+feature at the moment.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+index 802b8c52489ac..b5a23643db978 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+@@ -10,18 +10,6 @@
+ model = "NVIDIA Jetson TX2 Developer Kit";
+ compatible = "nvidia,p2771-0000", "nvidia,tegra186";
+
+- aconnect {
+- status = "okay";
+-
+- dma-controller@2930000 {
+- status = "okay";
+- };
+-
+- interrupt-controller@2a40000 {
+- status = "okay";
+- };
+- };
+-
+ i2c@3160000 {
+ power-monitor@42 {
+ compatible = "ti,ina3221";
+--
+2.27.0
+
--- /dev/null
+From 282453005d442d5fde7e0f319c58bf2a207998c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 13:15:15 +0100
+Subject: ASoC: Intel: bytcr_rt5640: Fix HP Pavilion x2 Detachable quirks
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit fbdae7d6d04d2db36c687723920f612e93b2cbda ]
+
+The HP Pavilion x2 Detachable line comes in many variants:
+
+1. Bay Trail SoC + AXP288 PMIC, Micro-USB charging (10-k010nz, ...)
+ DMI_SYS_VENDOR: "Hewlett-Packard"
+ DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable PC 10"
+ DMI_BOARD_NAME: "8021"
+
+2. Bay Trail SoC + AXP288 PMIC, Type-C charging (10-n000nd, 10-n010nl, ...)
+ DMI_SYS_VENDOR: "Hewlett-Packard"
+ DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable"
+ DMI_BOARD_NAME: "815D"
+
+3. Cherry Trail SoC + AXP288 PMIC, Type-C charging (10-n101ng, ...)
+ DMI_SYS_VENDOR: "HP"
+ DMI_PRODUCT_NAME: "HP Pavilion x2 Detachable"
+ DMI_BOARD_NAME: "813E"
+
+4. Cherry Trail SoC + TI PMIC, Type-C charging (10-p002nd, 10-p018wm, ...)
+ DMI_SYS_VENDOR: "HP"
+ DMI_PRODUCT_NAME: "HP x2 Detachable 10-p0XX"
+ DMI_BOARD_NAME: "827C"
+
+5. Cherry Trail SoC + TI PMIC, Type-C charging (x2-210-g2, ...)
+ DMI_SYS_VENDOR: "HP"
+ DMI_PRODUCT_NAME: "HP x2 210 G2"
+ DMI_BOARD_NAME: "82F4"
+
+Variant 1 needs the exact same quirk as variant 2, so relax the DMI check
+for the existing quirk a bit so that it matches both variant 1 and 2
+(note the other variants will still not match).
+
+Variant 2 already has an existing quirk (which now also matches variant 1)
+
+Variant 3 uses a cx2072x codec, so is not applicable here.
+
+Variant 4 almost works with the defaults, but it also needs a quirk to
+fix jack-detection, add a new quirk for this.
+
+Variant 5 does use a RT5640 codec (based on old dmesg output), but was
+otherwise not tested, keep using the defaults for this variant.
+
+Fixes: ec8e8418ff7d ("ASoC: Intel: bytcr_rt5640: Add quirks for various devices")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20201118121515.11441-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index fc202747ba837..b956e1675132a 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -521,10 +521,10 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
+ BYT_RT5640_MCLK_EN),
+ },
+- { /* HP Pavilion x2 10-n000nd */
++ { /* HP Pavilion x2 10-k0XX, 10-n0XX */
+ .matches = {
+- DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
+ },
+ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
+ BYT_RT5640_JD_SRC_JD2_IN4N |
+@@ -533,6 +533,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* HP Pavilion x2 10-p0XX */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
++ },
++ .driver_data = (void *)(BYT_RT5640_DMIC1_MAP |
++ BYT_RT5640_JD_SRC_JD1_IN4P |
++ BYT_RT5640_OVCD_TH_1500UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* HP Stream 7 */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+--
+2.27.0
+
--- /dev/null
+From c8cf511824480f337a76cbfba0da4a7d67a2dda3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 18:15:06 +0100
+Subject: batman-adv: Consider fragmentation for needed_headroom
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 4ca23e2c2074465bff55ea14221175fecdf63c5f ]
+
+If a batman-adv packets has to be fragmented, then the original batman-adv
+packet header is not stripped away. Instead, only a new header is added in
+front of the packet after it was split.
+
+This size must be considered to avoid cost intensive reallocations during
+the transmission through the various device layers.
+
+Fixes: 7bca68c7844b ("batman-adv: Add lower layer needed_(head|tail)room to own ones")
+Reported-by: Linus Lüssing <linus.luessing@c0d3.blue>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/hard-interface.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
+index fa06b51c0144d..d72c183919b44 100644
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -554,6 +554,9 @@ static void batadv_hardif_recalc_extra_skbroom(struct net_device *soft_iface)
+ needed_headroom = lower_headroom + (lower_header_len - ETH_HLEN);
+ needed_headroom += batadv_max_header_len();
+
++ /* fragmentation headers don't strip the unicast/... header */
++ needed_headroom += sizeof(struct batadv_frag_packet);
++
+ soft_iface->needed_headroom = needed_headroom;
+ soft_iface->needed_tailroom = lower_tailroom;
+ }
+--
+2.27.0
+
--- /dev/null
+From b4c5149c50b671712242cb27f5fd8f634cee1675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 18:24:49 +0100
+Subject: batman-adv: Don't always reallocate the fragmentation skb head
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 992b03b88e36254e26e9a4977ab948683e21bd9f ]
+
+When a packet is fragmented by batman-adv, the original batman-adv header
+is not modified. Only a new fragmentation is inserted between the original
+one and the ethernet header. The code must therefore make sure that it has
+a writable region of this size in the skbuff head.
+
+But it is not useful to always reallocate the skbuff by this size even when
+there would be more than enough headroom still in the skb. The reallocation
+is just to costly during in this codepath.
+
+Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/fragmentation.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index dbd913bac9dd1..b7169c4147f55 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -527,13 +527,14 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ frag_header.no++;
+ }
+
+- /* Make room for the fragment header. */
+- if (batadv_skb_head_push(skb, header_size) < 0 ||
+- pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
+- ret = -ENOMEM;
++ /* make sure that there is at least enough head for the fragmentation
++ * and ethernet headers
++ */
++ ret = skb_cow_head(skb, ETH_HLEN + header_size);
++ if (ret < 0)
+ goto put_primary_if;
+- }
+
++ skb_push(skb, header_size);
+ memcpy(skb->data, &frag_header, header_size);
+
+ /* Send the last fragment */
+--
+2.27.0
+
--- /dev/null
+From 80083c79bc21c3e238c543573723581b1a137bd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 13:16:43 +0100
+Subject: batman-adv: Reserve needed_*room for fragments
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit c5cbfc87558168ef4c3c27ce36eba6b83391db19 ]
+
+The batadv net_device is trying to propagate the needed_headroom and
+needed_tailroom from the lower devices. This is needed to avoid cost
+intensive reallocations using pskb_expand_head during the transmission.
+
+But the fragmentation code split the skb's without adding extra room at the
+end/beginning of the various fragments. This reduced the performance of
+transmissions over complex scenarios (batadv on vxlan on wireguard) because
+the lower devices had to perform the reallocations at least once.
+
+Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/batman-adv/fragmentation.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index 9fdbe30681537..dbd913bac9dd1 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -391,6 +391,7 @@ out:
+
+ /**
+ * batadv_frag_create() - create a fragment from skb
++ * @net_dev: outgoing device for fragment
+ * @skb: skb to create fragment from
+ * @frag_head: header to use in new fragment
+ * @fragment_size: size of new fragment
+@@ -401,22 +402,25 @@ out:
+ *
+ * Return: the new fragment, NULL on error.
+ */
+-static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
++static struct sk_buff *batadv_frag_create(struct net_device *net_dev,
++ struct sk_buff *skb,
+ struct batadv_frag_packet *frag_head,
+ unsigned int fragment_size)
+ {
++ unsigned int ll_reserved = LL_RESERVED_SPACE(net_dev);
++ unsigned int tailroom = net_dev->needed_tailroom;
+ struct sk_buff *skb_fragment;
+ unsigned int header_size = sizeof(*frag_head);
+ unsigned int mtu = fragment_size + header_size;
+
+- skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
++ skb_fragment = dev_alloc_skb(ll_reserved + mtu + tailroom);
+ if (!skb_fragment)
+ goto err;
+
+ skb_fragment->priority = skb->priority;
+
+ /* Eat the last mtu-bytes of the skb */
+- skb_reserve(skb_fragment, header_size + ETH_HLEN);
++ skb_reserve(skb_fragment, ll_reserved + header_size);
+ skb_split(skb, skb_fragment, skb->len - fragment_size);
+
+ /* Add the header */
+@@ -439,11 +443,12 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ struct batadv_orig_node *orig_node,
+ struct batadv_neigh_node *neigh_node)
+ {
++ struct net_device *net_dev = neigh_node->if_incoming->net_dev;
+ struct batadv_priv *bat_priv;
+ struct batadv_hard_iface *primary_if = NULL;
+ struct batadv_frag_packet frag_header;
+ struct sk_buff *skb_fragment;
+- unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
++ unsigned int mtu = net_dev->mtu;
+ unsigned int header_size = sizeof(frag_header);
+ unsigned int max_fragment_size, num_fragments;
+ int ret;
+@@ -503,7 +508,7 @@ int batadv_frag_send_packet(struct sk_buff *skb,
+ goto put_primary_if;
+ }
+
+- skb_fragment = batadv_frag_create(skb, &frag_header,
++ skb_fragment = batadv_frag_create(net_dev, skb, &frag_header,
+ max_fragment_size);
+ if (!skb_fragment) {
+ ret = -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 5b3ec815d2a348d3c7808441cdde5f985be7af2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 18:41:00 +0800
+Subject: bpftool: Fix error return value in build_btf_type_table
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 68878a5c5b852d17f5827ce8a0f6fbd8b4cdfada ]
+
+An appropriate return value should be set on the failed path.
+
+Fixes: 4d374ba0bf30 ("tools: bpftool: implement "bpftool btf show|list"")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20201124104100.491-1-thunder.leizhen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c
+index 8ab142ff5eac5..2afb7d5b1aca2 100644
+--- a/tools/bpf/bpftool/btf.c
++++ b/tools/bpf/bpftool/btf.c
+@@ -693,6 +693,7 @@ build_btf_type_table(struct btf_attach_table *tab, enum bpf_obj_type type,
+ obj_node = calloc(1, sizeof(*obj_node));
+ if (!obj_node) {
+ p_err("failed to allocate memory: %s", strerror(errno));
++ err = -ENOMEM;
+ goto err_free;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 16407b465d29f678d91a5f75fb36565735e33559 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:30:54 +0000
+Subject: btrfs: do nofs allocations when adding and removing qgroup relations
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 7aa6d359845a9dbf7ad90b0b1b6347ef4764621f ]
+
+When adding or removing a qgroup relation we are doing a GFP_KERNEL
+allocation which is not safe because we are holding a transaction
+handle open and that can make us deadlock if the allocator needs to
+recurse into the filesystem. So just surround those calls with a
+nofs context.
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 9205a88f2a881..15c38803576ce 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -11,6 +11,7 @@
+ #include <linux/slab.h>
+ #include <linux/workqueue.h>
+ #include <linux/btrfs.h>
++#include <linux/sched/mm.h>
+
+ #include "ctree.h"
+ #include "transaction.h"
+@@ -1324,13 +1325,17 @@ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans, u64 src,
+ struct btrfs_qgroup *member;
+ struct btrfs_qgroup_list *list;
+ struct ulist *tmp;
++ unsigned int nofs_flag;
+ int ret = 0;
+
+ /* Check the level of src and dst first */
+ if (btrfs_qgroup_level(src) >= btrfs_qgroup_level(dst))
+ return -EINVAL;
+
++ /* We hold a transaction handle open, must do a NOFS allocation. */
++ nofs_flag = memalloc_nofs_save();
+ tmp = ulist_alloc(GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!tmp)
+ return -ENOMEM;
+
+@@ -1387,10 +1392,14 @@ static int __del_qgroup_relation(struct btrfs_trans_handle *trans, u64 src,
+ struct btrfs_qgroup_list *list;
+ struct ulist *tmp;
+ bool found = false;
++ unsigned int nofs_flag;
+ int ret = 0;
+ int ret2;
+
++ /* We hold a transaction handle open, must do a NOFS allocation. */
++ nofs_flag = memalloc_nofs_save();
+ tmp = ulist_alloc(GFP_KERNEL);
++ memalloc_nofs_restore(nofs_flag);
+ if (!tmp)
+ return -ENOMEM;
+
+--
+2.27.0
+
--- /dev/null
+From a06b85bca42d520e9bd6c17ef9f174cf43780a38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:31:02 +0000
+Subject: btrfs: fix lockdep splat when enabling and disabling qgroups
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a855fbe69229078cd8aecd8974fb996a5ca651e6 ]
+
+When running test case btrfs/017 from fstests, lockdep reported the
+following splat:
+
+ [ 1297.067385] ======================================================
+ [ 1297.067708] WARNING: possible circular locking dependency detected
+ [ 1297.068022] 5.10.0-rc4-btrfs-next-73 #1 Not tainted
+ [ 1297.068322] ------------------------------------------------------
+ [ 1297.068629] btrfs/189080 is trying to acquire lock:
+ [ 1297.068929] ffff9f2725731690 (sb_internal#2){.+.+}-{0:0}, at: btrfs_quota_enable+0xaf/0xa70 [btrfs]
+ [ 1297.069274]
+ but task is already holding lock:
+ [ 1297.069868] ffff9f2702b61a08 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_quota_enable+0x3b/0xa70 [btrfs]
+ [ 1297.070219]
+ which lock already depends on the new lock.
+
+ [ 1297.071131]
+ the existing dependency chain (in reverse order) is:
+ [ 1297.071721]
+ -> #1 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}:
+ [ 1297.072375] lock_acquire+0xd8/0x490
+ [ 1297.072710] __mutex_lock+0xa3/0xb30
+ [ 1297.073061] btrfs_qgroup_inherit+0x59/0x6a0 [btrfs]
+ [ 1297.073421] create_subvol+0x194/0x990 [btrfs]
+ [ 1297.073780] btrfs_mksubvol+0x3fb/0x4a0 [btrfs]
+ [ 1297.074133] __btrfs_ioctl_snap_create+0x119/0x1a0 [btrfs]
+ [ 1297.074498] btrfs_ioctl_snap_create+0x58/0x80 [btrfs]
+ [ 1297.074872] btrfs_ioctl+0x1a90/0x36f0 [btrfs]
+ [ 1297.075245] __x64_sys_ioctl+0x83/0xb0
+ [ 1297.075617] do_syscall_64+0x33/0x80
+ [ 1297.075993] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ [ 1297.076380]
+ -> #0 (sb_internal#2){.+.+}-{0:0}:
+ [ 1297.077166] check_prev_add+0x91/0xc60
+ [ 1297.077572] __lock_acquire+0x1740/0x3110
+ [ 1297.077984] lock_acquire+0xd8/0x490
+ [ 1297.078411] start_transaction+0x3c5/0x760 [btrfs]
+ [ 1297.078853] btrfs_quota_enable+0xaf/0xa70 [btrfs]
+ [ 1297.079323] btrfs_ioctl+0x2c60/0x36f0 [btrfs]
+ [ 1297.079789] __x64_sys_ioctl+0x83/0xb0
+ [ 1297.080232] do_syscall_64+0x33/0x80
+ [ 1297.080680] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ [ 1297.081139]
+ other info that might help us debug this:
+
+ [ 1297.082536] Possible unsafe locking scenario:
+
+ [ 1297.083510] CPU0 CPU1
+ [ 1297.084005] ---- ----
+ [ 1297.084500] lock(&fs_info->qgroup_ioctl_lock);
+ [ 1297.084994] lock(sb_internal#2);
+ [ 1297.085485] lock(&fs_info->qgroup_ioctl_lock);
+ [ 1297.085974] lock(sb_internal#2);
+ [ 1297.086454]
+ *** DEADLOCK ***
+ [ 1297.087880] 3 locks held by btrfs/189080:
+ [ 1297.088324] #0: ffff9f2725731470 (sb_writers#14){.+.+}-{0:0}, at: btrfs_ioctl+0xa73/0x36f0 [btrfs]
+ [ 1297.088799] #1: ffff9f2702b60cc0 (&fs_info->subvol_sem){++++}-{3:3}, at: btrfs_ioctl+0x1f4d/0x36f0 [btrfs]
+ [ 1297.089284] #2: ffff9f2702b61a08 (&fs_info->qgroup_ioctl_lock){+.+.}-{3:3}, at: btrfs_quota_enable+0x3b/0xa70 [btrfs]
+ [ 1297.089771]
+ stack backtrace:
+ [ 1297.090662] CPU: 5 PID: 189080 Comm: btrfs Not tainted 5.10.0-rc4-btrfs-next-73 #1
+ [ 1297.091132] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ [ 1297.092123] Call Trace:
+ [ 1297.092629] dump_stack+0x8d/0xb5
+ [ 1297.093115] check_noncircular+0xff/0x110
+ [ 1297.093596] check_prev_add+0x91/0xc60
+ [ 1297.094076] ? kvm_clock_read+0x14/0x30
+ [ 1297.094553] ? kvm_sched_clock_read+0x5/0x10
+ [ 1297.095029] __lock_acquire+0x1740/0x3110
+ [ 1297.095510] lock_acquire+0xd8/0x490
+ [ 1297.095993] ? btrfs_quota_enable+0xaf/0xa70 [btrfs]
+ [ 1297.096476] start_transaction+0x3c5/0x760 [btrfs]
+ [ 1297.096962] ? btrfs_quota_enable+0xaf/0xa70 [btrfs]
+ [ 1297.097451] btrfs_quota_enable+0xaf/0xa70 [btrfs]
+ [ 1297.097941] ? btrfs_ioctl+0x1f4d/0x36f0 [btrfs]
+ [ 1297.098429] btrfs_ioctl+0x2c60/0x36f0 [btrfs]
+ [ 1297.098904] ? do_user_addr_fault+0x20c/0x430
+ [ 1297.099382] ? kvm_clock_read+0x14/0x30
+ [ 1297.099854] ? kvm_sched_clock_read+0x5/0x10
+ [ 1297.100328] ? sched_clock+0x5/0x10
+ [ 1297.100801] ? sched_clock_cpu+0x12/0x180
+ [ 1297.101272] ? __x64_sys_ioctl+0x83/0xb0
+ [ 1297.101739] __x64_sys_ioctl+0x83/0xb0
+ [ 1297.102207] do_syscall_64+0x33/0x80
+ [ 1297.102673] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ [ 1297.103148] RIP: 0033:0x7f773ff65d87
+
+This is because during the quota enable ioctl we lock first the mutex
+qgroup_ioctl_lock and then start a transaction, and starting a transaction
+acquires a fs freeze semaphore (at the VFS level). However, every other
+code path, except for the quota disable ioctl path, we do the opposite:
+we start a transaction and then lock the mutex.
+
+So fix this by making the quota enable and disable paths to start the
+transaction without having the mutex locked, and then, after starting the
+transaction, lock the mutex and check if some other task already enabled
+or disabled the quotas, bailing with success if that was the case.
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 5 ++++-
+ fs/btrfs/qgroup.c | 57 ++++++++++++++++++++++++++++++++++++++++-------
+ 2 files changed, 53 insertions(+), 9 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 2f5ab8c47f506..c2e38516a931d 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -869,7 +869,10 @@ struct btrfs_fs_info {
+ */
+ struct ulist *qgroup_ulist;
+
+- /* protect user change for quota operations */
++ /*
++ * Protect user change for quota operations. If a transaction is needed,
++ * it must be started before locking this lock.
++ */
+ struct mutex qgroup_ioctl_lock;
+
+ /* list of dirty qgroups to be written at next commit */
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 15c38803576ce..e6786f5d8457f 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -937,6 +937,7 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
+ struct btrfs_key found_key;
+ struct btrfs_qgroup *qgroup = NULL;
+ struct btrfs_trans_handle *trans = NULL;
++ struct ulist *ulist = NULL;
+ int ret = 0;
+ int slot;
+
+@@ -944,8 +945,8 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
+ if (fs_info->quota_root)
+ goto out;
+
+- fs_info->qgroup_ulist = ulist_alloc(GFP_KERNEL);
+- if (!fs_info->qgroup_ulist) {
++ ulist = ulist_alloc(GFP_KERNEL);
++ if (!ulist) {
+ ret = -ENOMEM;
+ goto out;
+ }
+@@ -953,6 +954,22 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
+ ret = btrfs_sysfs_add_qgroups(fs_info);
+ if (ret < 0)
+ goto out;
++
++ /*
++ * Unlock qgroup_ioctl_lock before starting the transaction. This is to
++ * avoid lock acquisition inversion problems (reported by lockdep) between
++ * qgroup_ioctl_lock and the vfs freeze semaphores, acquired when we
++ * start a transaction.
++ * After we started the transaction lock qgroup_ioctl_lock again and
++ * check if someone else created the quota root in the meanwhile. If so,
++ * just return success and release the transaction handle.
++ *
++ * Also we don't need to worry about someone else calling
++ * btrfs_sysfs_add_qgroups() after we unlock and getting an error because
++ * that function returns 0 (success) when the sysfs entries already exist.
++ */
++ mutex_unlock(&fs_info->qgroup_ioctl_lock);
++
+ /*
+ * 1 for quota root item
+ * 1 for BTRFS_QGROUP_STATUS item
+@@ -962,12 +979,20 @@ int btrfs_quota_enable(struct btrfs_fs_info *fs_info)
+ * would be a lot of overkill.
+ */
+ trans = btrfs_start_transaction(tree_root, 2);
++
++ mutex_lock(&fs_info->qgroup_ioctl_lock);
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
+ trans = NULL;
+ goto out;
+ }
+
++ if (fs_info->quota_root)
++ goto out;
++
++ fs_info->qgroup_ulist = ulist;
++ ulist = NULL;
++
+ /*
+ * initially create the quota tree
+ */
+@@ -1125,11 +1150,14 @@ out:
+ if (ret) {
+ ulist_free(fs_info->qgroup_ulist);
+ fs_info->qgroup_ulist = NULL;
+- if (trans)
+- btrfs_end_transaction(trans);
+ btrfs_sysfs_del_qgroups(fs_info);
+ }
+ mutex_unlock(&fs_info->qgroup_ioctl_lock);
++ if (ret && trans)
++ btrfs_end_transaction(trans);
++ else if (trans)
++ ret = btrfs_end_transaction(trans);
++ ulist_free(ulist);
+ return ret;
+ }
+
+@@ -1142,19 +1170,29 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
+ mutex_lock(&fs_info->qgroup_ioctl_lock);
+ if (!fs_info->quota_root)
+ goto out;
++ mutex_unlock(&fs_info->qgroup_ioctl_lock);
+
+ /*
+ * 1 For the root item
+ *
+ * We should also reserve enough items for the quota tree deletion in
+ * btrfs_clean_quota_tree but this is not done.
++ *
++ * Also, we must always start a transaction without holding the mutex
++ * qgroup_ioctl_lock, see btrfs_quota_enable().
+ */
+ trans = btrfs_start_transaction(fs_info->tree_root, 1);
++
++ mutex_lock(&fs_info->qgroup_ioctl_lock);
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
++ trans = NULL;
+ goto out;
+ }
+
++ if (!fs_info->quota_root)
++ goto out;
++
+ clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ btrfs_qgroup_wait_for_completion(fs_info, false);
+ spin_lock(&fs_info->qgroup_lock);
+@@ -1168,13 +1206,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
+ ret = btrfs_clean_quota_tree(trans, quota_root);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+- goto end_trans;
++ goto out;
+ }
+
+ ret = btrfs_del_root(trans, "a_root->root_key);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+- goto end_trans;
++ goto out;
+ }
+
+ list_del("a_root->dirty_list);
+@@ -1186,10 +1224,13 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)
+
+ btrfs_put_root(quota_root);
+
+-end_trans:
+- ret = btrfs_end_transaction(trans);
+ out:
+ mutex_unlock(&fs_info->qgroup_ioctl_lock);
++ if (ret && trans)
++ btrfs_end_transaction(trans);
++ else if (trans)
++ ret = btrfs_end_transaction(trans);
++
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From af9057ce5b04ac291f7aa733e0f98b8f5909dbc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 21:39:21 +0800
+Subject: can: c_can: c_can_power_up(): fix error handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 44cef0c0ffbd8d61143712ce874be68a273b7884 ]
+
+In the error handling in c_can_power_up(), there are two bugs:
+
+1) c_can_pm_runtime_get_sync() will increase usage counter if device is not
+ empty. Forgetting to call c_can_pm_runtime_put_sync() will result in a
+ reference leak here.
+
+2) c_can_reset_ram() operation will set start bit when enable is true. We
+ should clear it in the error handling.
+
+We fix it by adding c_can_pm_runtime_put_sync() for 1), and
+c_can_reset_ram(enable is false) for 2) in the error handling.
+
+Fixes: 8212003260c60 ("can: c_can: Add d_can suspend resume support")
+Fixes: 52cde85acc23f ("can: c_can: Add d_can raminit support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201128133922.3276973-2-zhangqilong3@huawei.com
+[mkl: return "0" instead of "ret"]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 8e9f5620c9a21..095505fa09de3 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -1304,12 +1304,22 @@ int c_can_power_up(struct net_device *dev)
+ time_after(time_out, jiffies))
+ cpu_relax();
+
+- if (time_after(jiffies, time_out))
+- return -ETIMEDOUT;
++ if (time_after(jiffies, time_out)) {
++ ret = -ETIMEDOUT;
++ goto err_out;
++ }
+
+ ret = c_can_start(dev);
+- if (!ret)
+- c_can_irq_control(priv, true);
++ if (ret)
++ goto err_out;
++
++ c_can_irq_control(priv, true);
++
++ return 0;
++
++err_out:
++ c_can_reset_ram(priv, false);
++ c_can_pm_runtime_put_sync(priv);
+
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From eb581ded4261f6724f3b578827ce09e2588231ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 21:39:22 +0800
+Subject: can: kvaser_pciefd: kvaser_pciefd_open(): fix error handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 13a84cf37a4cf1155a41684236c2314eb40cd65c ]
+
+If kvaser_pciefd_bus_on() failed, we should call close_candev() to avoid
+reference leak.
+
+Fixes: 26ad340e582d3 ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201128133922.3276973-3-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 72acd1ba162d2..43151dd6cb1c3 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -692,8 +692,10 @@ static int kvaser_pciefd_open(struct net_device *netdev)
+ return err;
+
+ err = kvaser_pciefd_bus_on(can);
+- if (err)
++ if (err) {
++ close_candev(netdev);
+ return err;
++ }
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 0f493c2d930d4048b507fe7e3c7e1ce044059815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 10:21:42 +0530
+Subject: can: m_can: m_can_dev_setup(): add support for bosch mcan version
+ 3.3.0
+
+From: Pankaj Sharma <pankj.sharma@samsung.com>
+
+[ Upstream commit 5c7d55bded77da6db7c5d249610e3a2eed730b3c ]
+
+Add support for mcan bit timing and control mode according to bosch mcan IP
+version 3.3.0. The mcan version read from the Core Release field of CREL
+register would be 33. Accordingly the properties are to be set for mcan v3.3.0
+
+Signed-off-by: Pankaj Sharma <pankj.sharma@samsung.com>
+Link: https://lore.kernel.org/r/1606366302-5520-1-git-send-email-pankj.sharma@samsung.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index d4030abad935d..61a93b1920379 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1385,6 +1385,8 @@ static int m_can_dev_setup(struct m_can_classdev *m_can_dev)
+ &m_can_data_bittiming_const_31X;
+ break;
+ case 32:
++ case 33:
++ /* Support both MCAN version v3.2.x and v3.3.0 */
+ m_can_dev->can.bittiming_const = m_can_dev->bit_timing ?
+ m_can_dev->bit_timing : &m_can_bittiming_const_31X;
+
+--
+2.27.0
+
--- /dev/null
+From 54b42b08d6cf869c4f79445e5f7747d949f4b7f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 16:17:11 +0100
+Subject: can: m_can: tcan4x5x_can_probe(): fix error path: remove erroneous
+ clk_disable_unprepare()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit ad1f5e826d91d6c27ecd36a607ad7c7f4d0b0733 ]
+
+The clocks mcan_class->cclk and mcan_class->hclk are not prepared by any call
+during tcan4x5x_can_probe(), so remove erroneous clk_disable_unprepare() on
+them.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Link: http://lore.kernel.org/r/20201130114252.215334-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/tcan4x5x.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index e5d7d85e0b6d1..7347ab39c5b65 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -489,18 +489,18 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+ spi->bits_per_word = 32;
+ ret = spi_setup(spi);
+ if (ret)
+- goto out_clk;
++ goto out_m_can_class_free_dev;
+
+ priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus,
+ &spi->dev, &tcan4x5x_regmap);
+ if (IS_ERR(priv->regmap)) {
+ ret = PTR_ERR(priv->regmap);
+- goto out_clk;
++ goto out_m_can_class_free_dev;
+ }
+
+ ret = tcan4x5x_power_enable(priv->power, 1);
+ if (ret)
+- goto out_clk;
++ goto out_m_can_class_free_dev;
+
+ ret = tcan4x5x_parse_config(mcan_class);
+ if (ret)
+@@ -519,11 +519,6 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+
+ out_power:
+ tcan4x5x_power_enable(priv->power, 0);
+-out_clk:
+- if (!IS_ERR(mcan_class->cclk)) {
+- clk_disable_unprepare(mcan_class->cclk);
+- clk_disable_unprepare(mcan_class->hclk);
+- }
+ out_m_can_class_free_dev:
+ m_can_class_free_dev(mcan_class->net);
+ dev_err(&spi->dev, "Probe failed, err=%d\n", ret);
+--
+2.27.0
+
--- /dev/null
+From 1f1c5c0721e5a6560487648e4eb5958830b89af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:59:38 +0100
+Subject: can: sja1000: sja1000_err(): don't count arbitration lose as an error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit bd0ccb92efb09c7da5b55162b283b42a93539ed7 ]
+
+Losing arbitration is normal in a CAN-bus network, it means that a higher
+priority frame is being send and the pending message will be retried later.
+Hence most driver only increment arbitration_lost, but the sja1000 driver also
+incremeants tx_error, causing errors to be reported on a normal functioning
+CAN-bus. So stop counting them as errors.
+
+Fixes: 8935f57e68c4 ("can: sja1000: fix network statistics update")
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Link: https://lore.kernel.org/r/20201127095941.21609-1-jhofstee@victronenergy.com
+[mkl: split into two seperate patches]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/sja1000/sja1000.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index 9f107798f904b..25a4d7d0b3498 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -474,7 +474,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)
+ netdev_dbg(dev, "arbitration lost interrupt\n");
+ alc = priv->read_reg(priv, SJA1000_ALC);
+ priv->can.can_stats.arbitration_lost++;
+- stats->tx_errors++;
+ cf->can_id |= CAN_ERR_LOSTARB;
+ cf->data[0] = alc & 0x1f;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4a89d74fdc639e50d66fb58196839cadc9c475ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:59:38 +0100
+Subject: can: sun4i_can: sun4i_can_err(): don't count arbitration lose as an
+ error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit c2d095eff797813461a426b97242e3ffc50e4134 ]
+
+Losing arbitration is normal in a CAN-bus network, it means that a higher
+priority frame is being send and the pending message will be retried later.
+Hence most driver only increment arbitration_lost, but the sun4i driver also
+incremeants tx_error, causing errors to be reported on a normal functioning
+CAN-bus. So stop counting them as errors.
+
+Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Link: https://lore.kernel.org/r/20201127095941.21609-1-jhofstee@victronenergy.com
+[mkl: split into two seperate patches]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/sun4i_can.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
+index e2c6cf4b2228f..b3f2f4fe5ee04 100644
+--- a/drivers/net/can/sun4i_can.c
++++ b/drivers/net/can/sun4i_can.c
+@@ -604,7 +604,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)
+ netdev_dbg(dev, "arbitration lost interrupt\n");
+ alc = readl(priv->base + SUN4I_REG_STA_ADDR);
+ priv->can.can_stats.arbitration_lost++;
+- stats->tx_errors++;
+ if (likely(skb)) {
+ cf->can_id |= CAN_ERR_LOSTARB;
+ cf->data[0] = (alc >> 8) & 0x1f;
+--
+2.27.0
+
--- /dev/null
+From 002f324b86f304d8137a22c1ccecad11343802d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 18:53:00 +0100
+Subject: drm/exynos: depend on COMMON_CLK to fix compile tests
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e2d3d2e904ad3d381753798dcd5cae03e3c47242 ]
+
+The Exynos DRM uses Common Clock Framework thus it cannot be built on
+platforms without it (e.g. compile test on MIPS with RALINK and
+SOC_RT305X):
+
+ /usr/bin/mips-linux-gnu-ld: drivers/gpu/drm/exynos/exynos_mixer.o: in function `mixer_bind':
+ exynos_mixer.c:(.text+0x958): undefined reference to `clk_set_parent'
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
+index 6417f374b923a..951d5f708e92b 100644
+--- a/drivers/gpu/drm/exynos/Kconfig
++++ b/drivers/gpu/drm/exynos/Kconfig
+@@ -1,7 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config DRM_EXYNOS
+ tristate "DRM Support for Samsung SoC Exynos Series"
+- depends on OF && DRM && (ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || ARCH_MULTIPLATFORM || COMPILE_TEST)
++ depends on OF && DRM && COMMON_CLK
++ depends on ARCH_S3C64XX || ARCH_S5PV210 || ARCH_EXYNOS || ARCH_MULTIPLATFORM || COMPILE_TEST
+ depends on MMU
+ select DRM_KMS_HELPER
+ select VIDEOMODE_HELPERS
+--
+2.27.0
+
--- /dev/null
+From 817a55352e50cbbdd3295469cd87e92cb38127cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 21:04:29 +0100
+Subject: drm/panel: sony-acx565akm: Fix race condition in probe
+
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+
+[ Upstream commit 7c4bada12d320d8648ba3ede6f9b6f9e10f1126a ]
+
+The probe routine acquires the reset GPIO using GPIOD_OUT_LOW. Directly
+afterwards it calls acx565akm_detect(), which sets the GPIO value to
+HIGH. If the bootloader initialized the GPIO to HIGH before the probe
+routine was called, there is only a very short time period of a few
+instructions where the reset signal is LOW. Exact time depends on
+compiler optimizations, kernel configuration and alignment of the stars,
+but I expect it to be always way less than 10us. There are no public
+datasheets for the panel, but acx565akm_power_on() has a comment with
+timings and reset period should be at least 10us. So this potentially
+brings the panel into a half-reset state.
+
+The result is, that panel may not work after boot and can get into a
+working state by re-enabling it (e.g. by blanking + unblanking), since
+that does a clean reset cycle. This bug has recently been hit by Ivaylo
+Dimitrov, but there are some older reports which are probably the same
+bug. At least Tony Lindgren, Peter Ujfalusi and Jarkko Nikula have
+experienced it in 2017 describing the blank/unblank procedure as
+possible workaround.
+
+Note, that the bug really goes back in time. It has originally been
+introduced in the predecessor of the omapfb driver in commit 3c45d05be382
+("OMAPDSS: acx565akm panel: handle gpios in panel driver") in 2012.
+That driver eventually got replaced by a newer one, which had the bug
+from the beginning in commit 84192742d9c2 ("OMAPDSS: Add Sony ACX565AKM
+panel driver") and still exists in fbdev world. That driver has later
+been copied to omapdrm and then was used as a basis for this driver.
+Last but not least the omapdrm specific driver has been removed in
+commit 45f16c82db7e ("drm/omap: displays: Remove unused panel drivers").
+
+Reported-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reported-by: Tony Lindgren <tony@atomide.com>
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Fixes: 1c8fc3f0c5d2 ("drm/panel: Add driver for the Sony ACX565AKM panel")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Tested-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201127200429.129868-1-sebastian.reichel@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-sony-acx565akm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-sony-acx565akm.c b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
+index fc6a7e451abef..304267f7849ac 100644
+--- a/drivers/gpu/drm/panel/panel-sony-acx565akm.c
++++ b/drivers/gpu/drm/panel/panel-sony-acx565akm.c
+@@ -629,7 +629,7 @@ static int acx565akm_probe(struct spi_device *spi)
+ lcd->spi = spi;
+ mutex_init(&lcd->mutex);
+
+- lcd->reset_gpio = devm_gpiod_get(&spi->dev, "reset", GPIOD_OUT_LOW);
++ lcd->reset_gpio = devm_gpiod_get(&spi->dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR(lcd->reset_gpio)) {
+ dev_err(&spi->dev, "failed to get reset GPIO\n");
+ return PTR_ERR(lcd->reset_gpio);
+--
+2.27.0
+
--- /dev/null
+From 3302cc98d0625e8542eb29b17787e7d7af0ba7e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 21:04:30 +0100
+Subject: drm/rockchip: Avoid uninitialized use of endpoint id in LVDS
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit aec9fe892812ed10d0bffcf309d2a8fc380d8ce6 ]
+
+In the Rockchip DRM LVDS component driver, the endpoint id provided to
+drm_of_find_panel_or_bridge is grabbed from the endpoint's reg property.
+
+However, the property may be missing in the case of a single endpoint.
+Initialize the endpoint_id variable to 0 to avoid using an
+uninitialized variable in that case.
+
+Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201110200430.1713467-1-paul.kocialkowski@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_lvds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index 63f967902c2d8..a29912f3b997e 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -544,7 +544,7 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ struct device_node *port, *endpoint;
+ int ret = 0, child_count = 0;
+ const char *name;
+- u32 endpoint_id;
++ u32 endpoint_id = 0;
+
+ lvds->drm_dev = drm_dev;
+ port = of_graph_get_port_by_id(dev->of_node, 1);
+--
+2.27.0
+
--- /dev/null
+From 04ba0de81bb5937edfba2ff254974bd2a137deec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 14:35:35 +0200
+Subject: habanalabs/gaudi: fix missing code in ECC handling
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit 652b44453ea953d3157f02a7f17e18e329952649 ]
+
+There is missing statement and missing "break;" in the ECC handling
+code in gaudi.c
+This will cause a wrong behavior upon certain ECC interrupts.
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 2e55890ad6a61..8da1720357a26 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -5416,6 +5416,8 @@ static void gaudi_handle_ecc_event(struct hl_device *hdev, u16 event_type,
+ params.num_memories = 33;
+ params.derr = true;
+ params.disable_clock_gating = true;
++ extract_info_from_fw = false;
++ break;
+ default:
+ return;
+ }
+--
+2.27.0
+
--- /dev/null
+From 0e3d0acbfeddb078962819fba9768f868c3e6a61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:26 -0600
+Subject: ibmvnic: avoid memset null scrq msgs
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit 9281cf2d584083a450fd65fd27cc5f0e692f6e30 ]
+
+scrq->msgs could be NULL during device reset, causing Linux to crash.
+So, check before memset scrq->msgs.
+
+Fixes: c8b2ad0a4a901 ("ibmvnic: Sanitize entire SCRQ buffer on reset")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 32fc0266d99b1..f892cb4a08f4e 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2857,15 +2857,26 @@ static int reset_one_sub_crq_queue(struct ibmvnic_adapter *adapter,
+ {
+ int rc;
+
++ if (!scrq) {
++ netdev_dbg(adapter->netdev,
++ "Invalid scrq reset. irq (%d) or msgs (%p).\n",
++ scrq->irq, scrq->msgs);
++ return -EINVAL;
++ }
++
+ if (scrq->irq) {
+ free_irq(scrq->irq, scrq);
+ irq_dispose_mapping(scrq->irq);
+ scrq->irq = 0;
+ }
+-
+- memset(scrq->msgs, 0, 4 * PAGE_SIZE);
+- atomic_set(&scrq->used, 0);
+- scrq->cur = 0;
++ if (scrq->msgs) {
++ memset(scrq->msgs, 0, 4 * PAGE_SIZE);
++ atomic_set(&scrq->used, 0);
++ scrq->cur = 0;
++ } else {
++ netdev_dbg(adapter->netdev, "Invalid scrq reset\n");
++ return -EINVAL;
++ }
+
+ rc = h_reg_sub_crq(adapter->vdev->unit_address, scrq->msg_token,
+ 4 * PAGE_SIZE, &scrq->crq_num, &scrq->hw_irq);
+--
+2.27.0
+
--- /dev/null
+From aa56b0dcf8791465b743e841d38eca6faf438319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:28 -0600
+Subject: ibmvnic: delay next reset if hard reset fails
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit f15fde9d47b887b406f5e76490d601cfc26643c9 ]
+
+If auto-priority failover is enabled, the backing device needs time
+to settle if hard resetting fails for any reason. Add a delay of 60
+seconds before retrying the hard-reset.
+
+Fixes: 2770a7984db5 ("ibmvnic: Introduce hard reset recovery")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index f892cb4a08f4e..006670f318bf1 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2243,6 +2243,14 @@ static void __ibmvnic_reset(struct work_struct *work)
+ rc = do_hard_reset(adapter, rwi, reset_state);
+ rtnl_unlock();
+ }
++ if (rc) {
++ /* give backing device time to settle down */
++ netdev_dbg(adapter->netdev,
++ "[S:%d] Hard reset failed, waiting 60 secs\n",
++ adapter->state);
++ set_current_state(TASK_UNINTERRUPTIBLE);
++ schedule_timeout(60 * HZ);
++ }
+ } else if (!(rwi->reset_reason == VNIC_RESET_FATAL &&
+ adapter->from_passive_init)) {
+ rc = do_reset(adapter, rwi, reset_state);
+--
+2.27.0
+
--- /dev/null
+From c73e1201d426b0e8715986897d20e19dc802b557 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:24 -0600
+Subject: ibmvnic: handle inconsistent login with reset
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit 31d6b4036098f6b59bcfa20375626b500c7d7417 ]
+
+Inconsistent login with the vnicserver is causing the device to be
+removed. This does not give the device a chance to recover from error
+state. This patch schedules a FATAL reset instead to bring the adapter
+up.
+
+Fixes: 032c5e82847a2 ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 3654be5772c85..85c54c061ed91 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -4400,7 +4400,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
+ adapter->req_rx_add_queues !=
+ be32_to_cpu(login_rsp->num_rxadd_subcrqs))) {
+ dev_err(dev, "FATAL: Inconsistent login and login rsp\n");
+- ibmvnic_remove(adapter->vdev);
++ ibmvnic_reset(adapter, VNIC_RESET_FATAL);
+ return -EIO;
+ }
+ release_login_buffer(adapter);
+--
+2.27.0
+
--- /dev/null
+From 1c8228830fe340ef030477b67302858bab027d3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:32 -0600
+Subject: ibmvnic: reduce wait for completion time
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit 98c41f04a67abf5e7f7191d55d286e905d1430ef ]
+
+Reduce the wait time for Command Response Queue response from 30 seconds
+to 20 seconds, as recommended by VIOS and Power Hypervisor teams.
+
+Fixes: bd0b672313941 ("ibmvnic: Move login and queue negotiation into ibmvnic_open")
+Fixes: 53da09e92910f ("ibmvnic: Add set_link_state routine for setting adapter link state")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index de25d1860f16f..a1556673300a0 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -846,7 +846,7 @@ static void release_napi(struct ibmvnic_adapter *adapter)
+ static int ibmvnic_login(struct net_device *netdev)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+- unsigned long timeout = msecs_to_jiffies(30000);
++ unsigned long timeout = msecs_to_jiffies(20000);
+ int retry_count = 0;
+ int retries = 10;
+ bool retry;
+@@ -950,7 +950,7 @@ static void release_resources(struct ibmvnic_adapter *adapter)
+ static int set_link_state(struct ibmvnic_adapter *adapter, u8 link_state)
+ {
+ struct net_device *netdev = adapter->netdev;
+- unsigned long timeout = msecs_to_jiffies(30000);
++ unsigned long timeout = msecs_to_jiffies(20000);
+ union ibmvnic_crq crq;
+ bool resend;
+ int rc;
+@@ -5081,7 +5081,7 @@ map_failed:
+ static int ibmvnic_reset_init(struct ibmvnic_adapter *adapter)
+ {
+ struct device *dev = &adapter->vdev->dev;
+- unsigned long timeout = msecs_to_jiffies(30000);
++ unsigned long timeout = msecs_to_jiffies(20000);
+ u64 old_num_rx_queues, old_num_tx_queues;
+ int rc;
+
+--
+2.27.0
+
--- /dev/null
+From 6aea5b02662c463358a7de7c881bb99d2c15cbd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:30 -0600
+Subject: ibmvnic: send_login should check for crq errors
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit c98d9cc4170da7e16a1012563d0f9fbe1c7cfe27 ]
+
+send_login() does not check for the result of ibmvnic_send_crq() of the
+login request. This results in the driver needlessly retrying the login
+10 times even when CRQ is no longer active. Check the return code and
+give up in case of errors in sending the CRQ.
+
+The only time we want to retry is if we get a PARITALSUCCESS response
+from the partner.
+
+Fixes: 032c5e82847a2 ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 9aa63b8b44368..de25d1860f16f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -862,10 +862,8 @@ static int ibmvnic_login(struct net_device *netdev)
+ adapter->init_done_rc = 0;
+ reinit_completion(&adapter->init_done);
+ rc = send_login(adapter);
+- if (rc) {
+- netdev_warn(netdev, "Unable to login\n");
++ if (rc)
+ return rc;
+- }
+
+ if (!wait_for_completion_timeout(&adapter->init_done,
+ timeout)) {
+@@ -3731,15 +3729,16 @@ static int send_login(struct ibmvnic_adapter *adapter)
+ struct ibmvnic_login_rsp_buffer *login_rsp_buffer;
+ struct ibmvnic_login_buffer *login_buffer;
+ struct device *dev = &adapter->vdev->dev;
++ struct vnic_login_client_data *vlcd;
+ dma_addr_t rsp_buffer_token;
+ dma_addr_t buffer_token;
+ size_t rsp_buffer_size;
+ union ibmvnic_crq crq;
++ int client_data_len;
+ size_t buffer_size;
+ __be64 *tx_list_p;
+ __be64 *rx_list_p;
+- int client_data_len;
+- struct vnic_login_client_data *vlcd;
++ int rc;
+ int i;
+
+ if (!adapter->tx_scrq || !adapter->rx_scrq) {
+@@ -3845,16 +3844,23 @@ static int send_login(struct ibmvnic_adapter *adapter)
+ crq.login.len = cpu_to_be32(buffer_size);
+
+ adapter->login_pending = true;
+- ibmvnic_send_crq(adapter, &crq);
++ rc = ibmvnic_send_crq(adapter, &crq);
++ if (rc) {
++ adapter->login_pending = false;
++ netdev_err(adapter->netdev, "Failed to send login, rc=%d\n", rc);
++ goto buf_rsp_map_failed;
++ }
+
+ return 0;
+
+ buf_rsp_map_failed:
+ kfree(login_rsp_buffer);
++ adapter->login_rsp_buf = NULL;
+ buf_rsp_alloc_failed:
+ dma_unmap_single(dev, buffer_token, buffer_size, DMA_TO_DEVICE);
+ buf_map_failed:
+ kfree(login_buffer);
++ adapter->login_buf = NULL;
+ buf_alloc_failed:
+ return -1;
+ }
+--
+2.27.0
+
--- /dev/null
+From 24be147ae15940da8ab9d209d9f59b3f885125a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:40:13 -0600
+Subject: ibmvnic: skip tx timeout reset while in resetting
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 855a631a4c11458a9cef1ab79c1530436aa95fae ]
+
+Sometimes it takes longer than 5 seconds (watchdog timeout) to complete
+failover, migration, and other resets. In stead of scheduling another
+timeout reset, we wait for the current one to complete.
+
+Suggested-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Reviewed-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index a1556673300a0..68aa9930d8187 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2358,6 +2358,12 @@ static void ibmvnic_tx_timeout(struct net_device *dev, unsigned int txqueue)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(dev);
+
++ if (test_bit(0, &adapter->resetting)) {
++ netdev_err(adapter->netdev,
++ "Adapter is resetting, skip timeout reset\n");
++ return;
++ }
++
+ ibmvnic_reset(adapter, VNIC_RESET_TIMEOUT);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From d71bb35530e5152185927317255cea3633350399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:25 -0600
+Subject: ibmvnic: stop free_all_rwi on failed reset
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit 18f141bf97d42f65abfdf17fd93fb3a0dac100e7 ]
+
+When ibmvnic fails to reset, it breaks out of the reset loop and frees
+all of the remaining resets from the workqueue. Doing so prevents the
+adapter from recovering if no reset is scheduled after that. Instead,
+have the driver continue to process resets on the workqueue.
+
+Remove the no longer need free_all_rwi().
+
+Fixes: ed651a10875f1 ("ibmvnic: Updated reset handling")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 22 +++-------------------
+ 1 file changed, 3 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 85c54c061ed91..32fc0266d99b1 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2186,17 +2186,6 @@ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ return rwi;
+ }
+
+-static void free_all_rwi(struct ibmvnic_adapter *adapter)
+-{
+- struct ibmvnic_rwi *rwi;
+-
+- rwi = get_next_rwi(adapter);
+- while (rwi) {
+- kfree(rwi);
+- rwi = get_next_rwi(adapter);
+- }
+-}
+-
+ static void __ibmvnic_reset(struct work_struct *work)
+ {
+ struct ibmvnic_rwi *rwi;
+@@ -2265,9 +2254,9 @@ static void __ibmvnic_reset(struct work_struct *work)
+ else
+ adapter->state = reset_state;
+ rc = 0;
+- } else if (rc && rc != IBMVNIC_INIT_FAILED &&
+- !adapter->force_reset_recovery)
+- break;
++ }
++ if (rc)
++ netdev_dbg(adapter->netdev, "Reset failed, rc=%d\n", rc);
+
+ rwi = get_next_rwi(adapter);
+
+@@ -2281,11 +2270,6 @@ static void __ibmvnic_reset(struct work_struct *work)
+ complete(&adapter->reset_done);
+ }
+
+- if (rc) {
+- netdev_dbg(adapter->netdev, "Reset failed\n");
+- free_all_rwi(adapter);
+- }
+-
+ clear_bit_unlock(0, &adapter->resetting);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 1e305a0b0eb41dc770f2aeb5eff22e054bcc349a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:29 -0600
+Subject: ibmvnic: track pending login
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit 76cdc5c5d99ce4856ad0ac38facc33b52fa64f77 ]
+
+If after ibmvnic sends a LOGIN it gets a FAILOVER, it is possible that
+the worker thread will start reset process and free the login response
+buffer before it gets a (now stale) LOGIN_RSP. The ibmvnic tasklet will
+then try to access the login response buffer and crash.
+
+Have ibmvnic track pending logins and discard any stale login responses.
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 17 +++++++++++++++++
+ drivers/net/ethernet/ibm/ibmvnic.h | 1 +
+ 2 files changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 006670f318bf1..9aa63b8b44368 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -3843,6 +3843,8 @@ static int send_login(struct ibmvnic_adapter *adapter)
+ crq.login.cmd = LOGIN;
+ crq.login.ioba = cpu_to_be32(buffer_token);
+ crq.login.len = cpu_to_be32(buffer_size);
++
++ adapter->login_pending = true;
+ ibmvnic_send_crq(adapter, &crq);
+
+ return 0;
+@@ -4374,6 +4376,15 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
+ struct ibmvnic_login_buffer *login = adapter->login_buf;
+ int i;
+
++ /* CHECK: Test/set of login_pending does not need to be atomic
++ * because only ibmvnic_tasklet tests/clears this.
++ */
++ if (!adapter->login_pending) {
++ netdev_warn(netdev, "Ignoring unexpected login response\n");
++ return 0;
++ }
++ adapter->login_pending = false;
++
+ dma_unmap_single(dev, adapter->login_buf_token, adapter->login_buf_sz,
+ DMA_TO_DEVICE);
+ dma_unmap_single(dev, adapter->login_rsp_buf_token,
+@@ -4721,6 +4732,11 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ case IBMVNIC_CRQ_INIT:
+ dev_info(dev, "Partner initialized\n");
+ adapter->from_passive_init = true;
++ /* Discard any stale login responses from prev reset.
++ * CHECK: should we clear even on INIT_COMPLETE?
++ */
++ adapter->login_pending = false;
++
+ if (!completion_done(&adapter->init_done)) {
+ complete(&adapter->init_done);
+ adapter->init_done_rc = -EIO;
+@@ -5188,6 +5204,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ dev_set_drvdata(&dev->dev, netdev);
+ adapter->vdev = dev;
+ adapter->netdev = netdev;
++ adapter->login_pending = false;
+
+ ether_addr_copy(adapter->mac_addr, mac_addr_p);
+ ether_addr_copy(netdev->dev_addr, adapter->mac_addr);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 31d604fc7bde7..77f43cbdb6dc4 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1084,6 +1084,7 @@ struct ibmvnic_adapter {
+ struct delayed_work ibmvnic_delayed_reset;
+ unsigned long resetting;
+ bool napi_enabled, from_passive_init;
++ bool login_pending;
+
+ bool failover_pending;
+ bool force_reset_recovery;
+--
+2.27.0
+
--- /dev/null
+From be39bc7040f611ecb040ef3548153cb321dceb45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 12:54:34 +0100
+Subject: intel_idle: Build fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 4d916140bf28ff027997144ea1bb4299e1536f87 ]
+
+Because CONFIG_ soup.
+
+Fixes: 6e1d2bc675bd ("intel_idle: Fix intel_idle() vs tracing")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20201130115402.GO3040@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/idle/intel_idle.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index cc6d1b12388e1..3a1617a3e5bf7 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -1136,6 +1136,20 @@ static bool __init intel_idle_max_cstate_reached(int cstate)
+ return false;
+ }
+
++static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state)
++{
++ unsigned long eax = flg2MWAIT(state->flags);
++
++ if (boot_cpu_has(X86_FEATURE_ARAT))
++ return false;
++
++ /*
++ * Switch over to one-shot tick broadcast if the target C-state
++ * is deeper than C1.
++ */
++ return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK);
++}
++
+ #ifdef CONFIG_ACPI_PROCESSOR_CSTATE
+ #include <acpi/processor.h>
+
+@@ -1206,20 +1220,6 @@ static bool __init intel_idle_acpi_cst_extract(void)
+ return false;
+ }
+
+-static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state)
+-{
+- unsigned long eax = flg2MWAIT(state->flags);
+-
+- if (boot_cpu_has(X86_FEATURE_ARAT))
+- return false;
+-
+- /*
+- * Switch over to one-shot tick broadcast if the target C-state
+- * is deeper than C1.
+- */
+- return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK);
+-}
+-
+ static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv)
+ {
+ int cstate, limit = min_t(int, CPUIDLE_STATE_MAX, acpi_state_table.count);
+--
+2.27.0
+
--- /dev/null
+From ac278af3b0306b43d407017d210b5f838085b147 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 11:28:35 +0100
+Subject: intel_idle: Fix intel_idle() vs tracing
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 6e1d2bc675bd57640f5658a4a657ae488db4c204 ]
+
+cpuidle->enter() callbacks should not call into tracing because RCU
+has already been disabled. Instead of doing the broadcast thing
+itself, simply advertise to the cpuidle core that those states stop
+the timer.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lkml.kernel.org/r/20201123143510.GR3021@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/idle/intel_idle.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index d09b807e1c3a1..cc6d1b12388e1 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -122,26 +122,9 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev,
+ struct cpuidle_state *state = &drv->states[index];
+ unsigned long eax = flg2MWAIT(state->flags);
+ unsigned long ecx = 1; /* break on interrupt flag */
+- bool tick;
+-
+- if (!static_cpu_has(X86_FEATURE_ARAT)) {
+- /*
+- * Switch over to one-shot tick broadcast if the target C-state
+- * is deeper than C1.
+- */
+- if ((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK) {
+- tick = true;
+- tick_broadcast_enter();
+- } else {
+- tick = false;
+- }
+- }
+
+ mwait_idle_with_hints(eax, ecx);
+
+- if (!static_cpu_has(X86_FEATURE_ARAT) && tick)
+- tick_broadcast_exit();
+-
+ return index;
+ }
+
+@@ -1223,6 +1206,20 @@ static bool __init intel_idle_acpi_cst_extract(void)
+ return false;
+ }
+
++static bool __init intel_idle_state_needs_timer_stop(struct cpuidle_state *state)
++{
++ unsigned long eax = flg2MWAIT(state->flags);
++
++ if (boot_cpu_has(X86_FEATURE_ARAT))
++ return false;
++
++ /*
++ * Switch over to one-shot tick broadcast if the target C-state
++ * is deeper than C1.
++ */
++ return !!((eax >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK);
++}
++
+ static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv)
+ {
+ int cstate, limit = min_t(int, CPUIDLE_STATE_MAX, acpi_state_table.count);
+@@ -1265,6 +1262,9 @@ static void __init intel_idle_init_cstates_acpi(struct cpuidle_driver *drv)
+ if (disabled_states_mask & BIT(cstate))
+ state->flags |= CPUIDLE_FLAG_OFF;
+
++ if (intel_idle_state_needs_timer_stop(state))
++ state->flags |= CPUIDLE_FLAG_TIMER_STOP;
++
+ state->enter = intel_idle;
+ state->enter_s2idle = intel_idle_s2idle;
+ }
+@@ -1503,6 +1503,9 @@ static void __init intel_idle_init_cstates_icpu(struct cpuidle_driver *drv)
+ !(cpuidle_state_table[cstate].flags & CPUIDLE_FLAG_ALWAYS_ENABLE)))
+ drv->states[drv->state_count].flags |= CPUIDLE_FLAG_OFF;
+
++ if (intel_idle_state_needs_timer_stop(&drv->states[drv->state_count]))
++ drv->states[drv->state_count].flags |= CPUIDLE_FLAG_TIMER_STOP;
++
+ drv->state_count++;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 368290bdeaa0a6394bafb15c4e647605b6426caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 12:51:40 +0200
+Subject: interconnect: qcom: msm8916: Remove rpm-ids from non-RPM nodes
+
+From: Georgi Djakov <georgi.djakov@linaro.org>
+
+[ Upstream commit c497f9322af947204c28292be6f20dd2d97483dd ]
+
+Some nodes are incorrectly marked as RPM-controlled (they have RPM
+master and slave ids assigned), but are actually controlled by the
+application CPU instead. The RPM complains when we send requests for
+resources that it can't control. Let's fix this by replacing the IDs,
+with the default "-1" in which case no requests are sent.
+
+Reviewed-by: Mike Tipton <mdtipton@codeaurora.org>
+Link: https://lore.kernel.org/r/20201112105140.10092-1-georgi.djakov@linaro.org
+Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/msm8916.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/msm8916.c b/drivers/interconnect/qcom/msm8916.c
+index 42c6c55816626..e8371d40ab8d8 100644
+--- a/drivers/interconnect/qcom/msm8916.c
++++ b/drivers/interconnect/qcom/msm8916.c
+@@ -182,7 +182,7 @@ DEFINE_QNODE(mas_pcnoc_sdcc_1, MSM8916_MASTER_SDCC_1, 8, -1, -1, MSM8916_PNOC_IN
+ DEFINE_QNODE(mas_pcnoc_sdcc_2, MSM8916_MASTER_SDCC_2, 8, -1, -1, MSM8916_PNOC_INT_1);
+ DEFINE_QNODE(mas_qdss_bam, MSM8916_MASTER_QDSS_BAM, 8, -1, -1, MSM8916_SNOC_QDSS_INT);
+ DEFINE_QNODE(mas_qdss_etr, MSM8916_MASTER_QDSS_ETR, 8, -1, -1, MSM8916_SNOC_QDSS_INT);
+-DEFINE_QNODE(mas_snoc_cfg, MSM8916_MASTER_SNOC_CFG, 4, 20, -1, MSM8916_SNOC_QDSS_INT);
++DEFINE_QNODE(mas_snoc_cfg, MSM8916_MASTER_SNOC_CFG, 4, -1, -1, MSM8916_SNOC_QDSS_INT);
+ DEFINE_QNODE(mas_spdm, MSM8916_MASTER_SPDM, 4, -1, -1, MSM8916_PNOC_MAS_0);
+ DEFINE_QNODE(mas_tcu0, MSM8916_MASTER_TCU0, 8, -1, -1, MSM8916_SLAVE_EBI_CH0, MSM8916_BIMC_SNOC_MAS, MSM8916_SLAVE_AMPSS_L2);
+ DEFINE_QNODE(mas_tcu1, MSM8916_MASTER_TCU1, 8, -1, -1, MSM8916_SLAVE_EBI_CH0, MSM8916_BIMC_SNOC_MAS, MSM8916_SLAVE_AMPSS_L2);
+@@ -208,14 +208,14 @@ DEFINE_QNODE(pcnoc_snoc_mas, MSM8916_PNOC_SNOC_MAS, 8, 29, -1, MSM8916_PNOC_SNOC
+ DEFINE_QNODE(pcnoc_snoc_slv, MSM8916_PNOC_SNOC_SLV, 8, -1, 45, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC, MSM8916_SNOC_INT_1);
+ DEFINE_QNODE(qdss_int, MSM8916_SNOC_QDSS_INT, 8, -1, -1, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC);
+ DEFINE_QNODE(slv_apps_l2, MSM8916_SLAVE_AMPSS_L2, 8, -1, -1, 0);
+-DEFINE_QNODE(slv_apss, MSM8916_SLAVE_APSS, 4, -1, 20, 0);
++DEFINE_QNODE(slv_apss, MSM8916_SLAVE_APSS, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_audio, MSM8916_SLAVE_LPASS, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_bimc_cfg, MSM8916_SLAVE_BIMC_CFG, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_blsp_1, MSM8916_SLAVE_BLSP_1, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_boot_rom, MSM8916_SLAVE_BOOT_ROM, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_camera_cfg, MSM8916_SLAVE_CAMERA_CFG, 4, -1, -1, 0);
+-DEFINE_QNODE(slv_cats_0, MSM8916_SLAVE_CATS_128, 16, -1, 106, 0);
+-DEFINE_QNODE(slv_cats_1, MSM8916_SLAVE_OCMEM_64, 8, -1, 107, 0);
++DEFINE_QNODE(slv_cats_0, MSM8916_SLAVE_CATS_128, 16, -1, -1, 0);
++DEFINE_QNODE(slv_cats_1, MSM8916_SLAVE_OCMEM_64, 8, -1, -1, 0);
+ DEFINE_QNODE(slv_clk_ctl, MSM8916_SLAVE_CLK_CTL, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_crypto_0_cfg, MSM8916_SLAVE_CRYPTO_0_CFG, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_dehr_cfg, MSM8916_SLAVE_DEHR_CFG, 4, -1, -1, 0);
+@@ -239,7 +239,7 @@ DEFINE_QNODE(slv_sdcc_2, MSM8916_SLAVE_SDCC_2, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_security, MSM8916_SLAVE_SECURITY, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_snoc_cfg, MSM8916_SLAVE_SNOC_CFG, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_spdm, MSM8916_SLAVE_SPDM, 4, -1, -1, 0);
+-DEFINE_QNODE(slv_srvc_snoc, MSM8916_SLAVE_SRVC_SNOC, 8, -1, 29, 0);
++DEFINE_QNODE(slv_srvc_snoc, MSM8916_SLAVE_SRVC_SNOC, 8, -1, -1, 0);
+ DEFINE_QNODE(slv_tcsr, MSM8916_SLAVE_TCSR, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_tlmm, MSM8916_SLAVE_TLMM, 4, -1, -1, 0);
+ DEFINE_QNODE(slv_usb_hs, MSM8916_SLAVE_USB_HS, 4, -1, -1, 0);
+@@ -249,7 +249,7 @@ DEFINE_QNODE(snoc_bimc_0_slv, MSM8916_SNOC_BIMC_0_SLV, 8, -1, 24, MSM8916_SLAVE_
+ DEFINE_QNODE(snoc_bimc_1_mas, MSM8916_SNOC_BIMC_1_MAS, 16, -1, -1, MSM8916_SNOC_BIMC_1_SLV);
+ DEFINE_QNODE(snoc_bimc_1_slv, MSM8916_SNOC_BIMC_1_SLV, 8, -1, -1, MSM8916_SLAVE_EBI_CH0);
+ DEFINE_QNODE(snoc_int_0, MSM8916_SNOC_INT_0, 8, 99, 130, MSM8916_SLAVE_QDSS_STM, MSM8916_SLAVE_IMEM, MSM8916_SNOC_PNOC_MAS);
+-DEFINE_QNODE(snoc_int_1, MSM8916_SNOC_INT_1, 8, 100, 131, MSM8916_SLAVE_APSS, MSM8916_SLAVE_CATS_128, MSM8916_SLAVE_OCMEM_64);
++DEFINE_QNODE(snoc_int_1, MSM8916_SNOC_INT_1, 8, -1, -1, MSM8916_SLAVE_APSS, MSM8916_SLAVE_CATS_128, MSM8916_SLAVE_OCMEM_64);
+ DEFINE_QNODE(snoc_int_bimc, MSM8916_SNOC_INT_BIMC, 8, 101, 132, MSM8916_SNOC_BIMC_0_MAS);
+ DEFINE_QNODE(snoc_pcnoc_mas, MSM8916_SNOC_PNOC_MAS, 8, -1, -1, MSM8916_SNOC_PNOC_SLV);
+ DEFINE_QNODE(snoc_pcnoc_slv, MSM8916_SNOC_PNOC_SLV, 8, -1, -1, MSM8916_PNOC_INT_0);
+--
+2.27.0
+
--- /dev/null
+From 95e9274e508cb41398c58b997084dc8b515af0e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 13:10:44 +0200
+Subject: interconnect: qcom: qcs404: Remove GPU and display RPM IDs
+
+From: Georgi Djakov <georgi.djakov@linaro.org>
+
+[ Upstream commit 7ab1e9117607485df977bb6e271be5c5ad649a4c ]
+
+The following errors are noticed during boot on a QCS404 board:
+[ 2.926647] qcom_icc_rpm_smd_send mas 6 error -6
+[ 2.934573] qcom_icc_rpm_smd_send mas 8 error -6
+
+These errors show when we try to configure the GPU and display nodes.
+Since these particular nodes aren't supported on RPM and are purely
+local, we should just change their mas_rpm_id to -1 to avoid any
+requests being sent for these master IDs.
+
+Reviewed-by: Mike Tipton <mdtipton@codeaurora.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20201118111044.26056-1-georgi.djakov@linaro.org
+Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/qcs404.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/qcs404.c b/drivers/interconnect/qcom/qcs404.c
+index d4769a5ea182e..9820709b43dbd 100644
+--- a/drivers/interconnect/qcom/qcs404.c
++++ b/drivers/interconnect/qcom/qcs404.c
+@@ -157,8 +157,8 @@ struct qcom_icc_desc {
+ }
+
+ DEFINE_QNODE(mas_apps_proc, QCS404_MASTER_AMPSS_M0, 8, 0, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
+-DEFINE_QNODE(mas_oxili, QCS404_MASTER_GRAPHICS_3D, 8, 6, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
+-DEFINE_QNODE(mas_mdp, QCS404_MASTER_MDP_PORT0, 8, 8, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
++DEFINE_QNODE(mas_oxili, QCS404_MASTER_GRAPHICS_3D, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
++DEFINE_QNODE(mas_mdp, QCS404_MASTER_MDP_PORT0, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
+ DEFINE_QNODE(mas_snoc_bimc_1, QCS404_SNOC_BIMC_1_MAS, 8, 76, -1, QCS404_SLAVE_EBI_CH0);
+ DEFINE_QNODE(mas_tcu_0, QCS404_MASTER_TCU_0, 8, -1, -1, QCS404_SLAVE_EBI_CH0, QCS404_BIMC_SNOC_SLV);
+ DEFINE_QNODE(mas_spdm, QCS404_MASTER_SPDM, 4, -1, -1, QCS404_PNOC_INT_3);
+--
+2.27.0
+
--- /dev/null
+From 120241689027d797012dfec2e58ce30f3e7dd144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 16:07:49 +0800
+Subject: ipvs: fix possible memory leak in ip_vs_control_net_init
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 4bc3c8dc9f5f1eff0d3bfa59491383ac11308b6b ]
+
+kmemleak report a memory leak as follows:
+
+BUG: memory leak
+unreferenced object 0xffff8880759ea000 (size 256):
+backtrace:
+[<00000000c0bf2deb>] kmem_cache_zalloc include/linux/slab.h:656 [inline]
+[<00000000c0bf2deb>] __proc_create+0x23d/0x7d0 fs/proc/generic.c:421
+[<000000009d718d02>] proc_create_reg+0x8e/0x140 fs/proc/generic.c:535
+[<0000000097bbfc4f>] proc_create_net_data+0x8c/0x1b0 fs/proc/proc_net.c:126
+[<00000000652480fc>] ip_vs_control_net_init+0x308/0x13a0 net/netfilter/ipvs/ip_vs_ctl.c:4169
+[<000000004c927ebe>] __ip_vs_init+0x211/0x400 net/netfilter/ipvs/ip_vs_core.c:2429
+[<00000000aa6b72d9>] ops_init+0xa8/0x3c0 net/core/net_namespace.c:151
+[<00000000153fd114>] setup_net+0x2de/0x7e0 net/core/net_namespace.c:341
+[<00000000be4e4f07>] copy_net_ns+0x27d/0x530 net/core/net_namespace.c:482
+[<00000000f1c23ec9>] create_new_namespaces+0x382/0xa30 kernel/nsproxy.c:110
+[<00000000098a5757>] copy_namespaces+0x2e6/0x3b0 kernel/nsproxy.c:179
+[<0000000026ce39e9>] copy_process+0x220a/0x5f00 kernel/fork.c:2072
+[<00000000b71f4efe>] _do_fork+0xc7/0xda0 kernel/fork.c:2428
+[<000000002974ee96>] __do_sys_clone3+0x18a/0x280 kernel/fork.c:2703
+[<0000000062ac0a4d>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
+[<0000000093f1ce2c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+In the error path of ip_vs_control_net_init(), remove_proc_entry() needs
+to be called to remove the added proc entry, otherwise a memory leak
+will occur.
+
+Also, add some '#ifdef CONFIG_PROC_FS' because proc_create_net* return NULL
+when PROC is not used.
+
+Fixes: b17fc9963f83 ("IPVS: netns, ip_vs_stats and its procfs")
+Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 8dbfd84322a88..f6b284a9c480e 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -4167,12 +4167,18 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
+
+ spin_lock_init(&ipvs->tot_stats.lock);
+
+- proc_create_net("ip_vs", 0, ipvs->net->proc_net, &ip_vs_info_seq_ops,
+- sizeof(struct ip_vs_iter));
+- proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
+- ip_vs_stats_show, NULL);
+- proc_create_net_single("ip_vs_stats_percpu", 0, ipvs->net->proc_net,
+- ip_vs_stats_percpu_show, NULL);
++#ifdef CONFIG_PROC_FS
++ if (!proc_create_net("ip_vs", 0, ipvs->net->proc_net,
++ &ip_vs_info_seq_ops, sizeof(struct ip_vs_iter)))
++ goto err_vs;
++ if (!proc_create_net_single("ip_vs_stats", 0, ipvs->net->proc_net,
++ ip_vs_stats_show, NULL))
++ goto err_stats;
++ if (!proc_create_net_single("ip_vs_stats_percpu", 0,
++ ipvs->net->proc_net,
++ ip_vs_stats_percpu_show, NULL))
++ goto err_percpu;
++#endif
+
+ if (ip_vs_control_net_init_sysctl(ipvs))
+ goto err;
+@@ -4180,6 +4186,17 @@ int __net_init ip_vs_control_net_init(struct netns_ipvs *ipvs)
+ return 0;
+
+ err:
++#ifdef CONFIG_PROC_FS
++ remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
++
++err_percpu:
++ remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
++
++err_stats:
++ remove_proc_entry("ip_vs", ipvs->net->proc_net);
++
++err_vs:
++#endif
+ free_percpu(ipvs->tot_stats.cpustats);
+ return -ENOMEM;
+ }
+@@ -4188,9 +4205,11 @@ void __net_exit ip_vs_control_net_cleanup(struct netns_ipvs *ipvs)
+ {
+ ip_vs_trash_cleanup(ipvs);
+ ip_vs_control_net_cleanup_sysctl(ipvs);
++#ifdef CONFIG_PROC_FS
+ remove_proc_entry("ip_vs_stats_percpu", ipvs->net->proc_net);
+ remove_proc_entry("ip_vs_stats", ipvs->net->proc_net);
+ remove_proc_entry("ip_vs", ipvs->net->proc_net);
++#endif
+ free_percpu(ipvs->tot_stats.cpustats);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 2f47c5539ccdeb4e13f2ea71cfc0ea4547b3ac77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:42:26 +0000
+Subject: irqchip/gic-v3-its: Unconditionally save/restore the ITS state on
+ suspend
+
+From: Xu Qiang <xuqiang36@huawei.com>
+
+[ Upstream commit 74cde1a53368aed4f2b4b54bf7030437f64a534b ]
+
+On systems without HW-based collections (i.e. anything except GIC-500),
+we rely on firmware to perform the ITS save/restore. This doesn't
+really work, as although FW can properly save everything, it cannot
+fully restore the state of the command queue (the read-side is reset
+to the head of the queue). This results in the ITS consuming previously
+processed commands, potentially corrupting the state.
+
+Instead, let's always save the ITS state on suspend, disabling it in the
+process, and restore the full state on resume. This saves us from broken
+FW as long as it doesn't enable the ITS by itself (for which we can't do
+anything).
+
+This amounts to simply dropping the ITS_FLAGS_SAVE_SUSPEND_STATE.
+
+Signed-off-by: Xu Qiang <xuqiang36@huawei.com>
+[maz: added warning on resume, rewrote commit message]
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20201107104226.14282-1-xuqiang36@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 548de7538632a..51b8743fdda03 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -42,7 +42,6 @@
+ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0)
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1)
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2)
+-#define ITS_FLAGS_SAVE_SUSPEND_STATE (1ULL << 3)
+
+ #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0)
+ #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1)
+@@ -4735,9 +4734,6 @@ static int its_save_disable(void)
+ list_for_each_entry(its, &its_nodes, entry) {
+ void __iomem *base;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+ its->ctlr_save = readl_relaxed(base + GITS_CTLR);
+ err = its_force_quiescent(base);
+@@ -4756,9 +4752,6 @@ err:
+ list_for_each_entry_continue_reverse(its, &its_nodes, entry) {
+ void __iomem *base;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+ writel_relaxed(its->ctlr_save, base + GITS_CTLR);
+ }
+@@ -4778,9 +4771,6 @@ static void its_restore_enable(void)
+ void __iomem *base;
+ int i;
+
+- if (!(its->flags & ITS_FLAGS_SAVE_SUSPEND_STATE))
+- continue;
+-
+ base = its->base;
+
+ /*
+@@ -4788,7 +4778,10 @@ static void its_restore_enable(void)
+ * don't restore it since writing to CBASER or BASER<n>
+ * registers is undefined according to the GIC v3 ITS
+ * Specification.
++ *
++ * Firmware resuming with the ITS enabled is terminally broken.
+ */
++ WARN_ON(readl_relaxed(base + GITS_CTLR) & GITS_CTLR_ENABLE);
+ ret = its_force_quiescent(base);
+ if (ret) {
+ pr_err("ITS@%pa: failed to quiesce on resume: %d\n",
+@@ -5068,9 +5061,6 @@ static int __init its_probe_one(struct resource *res,
+ ctlr |= GITS_CTLR_ImDe;
+ writel_relaxed(ctlr, its->base + GITS_CTLR);
+
+- if (GITS_TYPER_HCC(typer))
+- its->flags |= ITS_FLAGS_SAVE_SUSPEND_STATE;
+-
+ err = its_init_domain(handle, its);
+ if (err)
+ goto out_free_tables;
+--
+2.27.0
+
--- /dev/null
+From 6af1e7e698532a66e19b7bf4ceade07646e0f41f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:50:11 +0200
+Subject: iwlwifi: mvm: fix kernel panic in case of assert during CSA
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit fe56d05ee6c87f6a1a8c7267affd92c9438249cc ]
+
+During CSA, we briefly nullify the phy context, in __iwl_mvm_unassign_vif_chanctx.
+In case we have a FW assert right after it, it remains NULL though.
+We end up running into endless loop due to mac80211 trying repeatedly to
+move us to ASSOC state, and we keep returning -EINVAL. Later down the road
+we hit a kernel panic.
+
+Detect and avoid this endless loop.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d64de2c17bff.Iedd0d2afa20a2aacba5259a5cae31cb3a119a4eb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 34362dc0d4612..f2d65e8384105 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3057,7 +3057,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
+
+ /* this would be a mac80211 bug ... but don't crash */
+ if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
+- return -EINVAL;
++ return test_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, &mvm->status) ? 0 : -EINVAL;
+
+ /*
+ * If we are in a STA removal flow and in DQA mode:
+--
+2.27.0
+
--- /dev/null
+From 3e0b22900cb8c22e93c13a749e1c3ed7ab0b2f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 14:41:50 +0200
+Subject: iwlwifi: pcie: invert values of NO_160 device config entries
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 568d3434178b00274615190a19d29c3d235b4e6d ]
+
+The NO_160 flag specifies if the device doesn't have 160 MHz support,
+but we errorneously assumed the opposite. If the flag was set, we
+were considering that 160 MHz was supported, but it's actually the
+opposite. Fix it by inverting the bits, i.e. NO_160 is 0x1 and 160
+is 0x0.
+
+Fixes: d6f2134a3831 ("iwlwifi: add mac/rf types and 160MHz to the device tables")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201202143859.375bec857ccb.I83884286b688965293e9810381808039bd7eedae@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index e27c13263a232..44abe44c04632 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -488,8 +488,8 @@ struct iwl_cfg {
+ #define IWL_CFG_RF_ID_HR 0x7
+ #define IWL_CFG_RF_ID_HR1 0x4
+
+-#define IWL_CFG_NO_160 0x0
+-#define IWL_CFG_160 0x1
++#define IWL_CFG_NO_160 0x1
++#define IWL_CFG_160 0x0
+
+ #define IWL_CFG_CORES_BT 0x0
+ #define IWL_CFG_CORES_BT_GNSS 0x5
+--
+2.27.0
+
--- /dev/null
+From 945a6dd7c194c1b755f5b2745adf8ede923ec21f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 16:51:03 +0300
+Subject: iwlwifi: pcie: limit memory read spin time
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 04516706bb99889986ddfa3a769ed50d2dc7ac13 ]
+
+When we read device memory, we lock a spinlock, write the address we
+want to read from the device and then spin in a loop reading the data
+in 32-bit quantities from another register.
+
+As the description makes clear, this is rather inefficient, incurring
+a PCIe bus transaction for every read. In a typical device today, we
+want to read 786k SMEM if it crashes, leading to 192k register reads.
+Occasionally, we've seen the whole loop take over 20 seconds and then
+triggering the soft lockup detector.
+
+Clearly, it is unreasonable to spin here for such extended periods of
+time.
+
+To fix this, break the loop down into an outer and an inner loop, and
+break out of the inner loop if more than half a second elapsed. To
+avoid too much overhead, check for that only every 128 reads, though
+there's no particular reason for that number. Then, unlock and relock
+to obtain NIC access again, reprogram the start address and continue.
+
+This will keep (interrupt) latencies on the CPU down to a reasonable
+time.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201022165103.45878a7e49aa.I3b9b9c5a10002915072312ce75b68ed5b3dc6e14@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/trans.c | 36 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index e5160d6208688..6393e895f95c6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2155,18 +2155,36 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
+ void *buf, int dwords)
+ {
+ unsigned long flags;
+- int offs, ret = 0;
++ int offs = 0;
+ u32 *vals = buf;
+
+- if (iwl_trans_grab_nic_access(trans, &flags)) {
+- iwl_write32(trans, HBUS_TARG_MEM_RADDR, addr);
+- for (offs = 0; offs < dwords; offs++)
+- vals[offs] = iwl_read32(trans, HBUS_TARG_MEM_RDAT);
+- iwl_trans_release_nic_access(trans, &flags);
+- } else {
+- ret = -EBUSY;
++ while (offs < dwords) {
++ /* limit the time we spin here under lock to 1/2s */
++ ktime_t timeout = ktime_add_us(ktime_get(), 500 * USEC_PER_MSEC);
++
++ if (iwl_trans_grab_nic_access(trans, &flags)) {
++ iwl_write32(trans, HBUS_TARG_MEM_RADDR,
++ addr + 4 * offs);
++
++ while (offs < dwords) {
++ vals[offs] = iwl_read32(trans,
++ HBUS_TARG_MEM_RDAT);
++ offs++;
++
++ /* calling ktime_get is expensive so
++ * do it once in 128 reads
++ */
++ if (offs % 128 == 0 && ktime_after(ktime_get(),
++ timeout))
++ break;
++ }
++ iwl_trans_release_nic_access(trans, &flags);
++ } else {
++ return -EBUSY;
++ }
+ }
+- return ret;
++
++ return 0;
+ }
+
+ static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
+--
+2.27.0
+
--- /dev/null
+From 4d95bb9aa3050a83b3773b57b7275a5b33ef3f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:50:10 +0200
+Subject: iwlwifi: pcie: set LTR to avoid completion timeout
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit edb625208d84aef179e3f16590c1c582fc5fdae6 ]
+
+On some platforms, the preset values aren't correct and then we may
+get a completion timeout in the firmware. Change the LTR configuration
+to avoid that. The firmware will do some more complex reinit of this
+later, but for the boot process we use ~250usec.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201107104557.d83d591c05ba.I42885c9fb500bc08b9a4c07c4ff3d436cc7a3c84@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 10 ++++++++++
+ .../intel/iwlwifi/pcie/ctxt-info-gen3.c | 20 +++++++++++++++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+index cb9e8e189a1a4..1d48c7d7fffd4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-csr.h
+@@ -147,6 +147,16 @@
+ #define CSR_MAC_SHADOW_REG_CTL2 (CSR_BASE + 0x0AC)
+ #define CSR_MAC_SHADOW_REG_CTL2_RX_WAKE 0xFFFF
+
++/* LTR control (since IWL_DEVICE_FAMILY_22000) */
++#define CSR_LTR_LONG_VAL_AD (CSR_BASE + 0x0D4)
++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ 0x80000000
++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE 0x1c000000
++#define CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL 0x03ff0000
++#define CSR_LTR_LONG_VAL_AD_SNOOP_REQ 0x00008000
++#define CSR_LTR_LONG_VAL_AD_SNOOP_SCALE 0x00001c00
++#define CSR_LTR_LONG_VAL_AD_SNOOP_VAL 0x000003ff
++#define CSR_LTR_LONG_VAL_AD_SCALE_USEC 2
++
+ /* GIO Chicken Bits (PCI Express bus link power management) */
+ #define CSR_GIO_CHICKEN_BITS (CSR_BASE+0x100)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 1ab1366004159..0fc2a6e49f9ee 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -252,6 +252,26 @@ int iwl_pcie_ctxt_info_gen3_init(struct iwl_trans *trans,
+
+ iwl_set_bit(trans, CSR_CTXT_INFO_BOOT_CTRL,
+ CSR_AUTO_FUNC_BOOT_ENA);
++
++ if (trans->trans_cfg->device_family == IWL_DEVICE_FAMILY_AX210) {
++ /*
++ * The firmware initializes this again later (to a smaller
++ * value), but for the boot process initialize the LTR to
++ * ~250 usec.
++ */
++ u32 val = CSR_LTR_LONG_VAL_AD_NO_SNOOP_REQ |
++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_SCALE) |
++ u32_encode_bits(250,
++ CSR_LTR_LONG_VAL_AD_NO_SNOOP_VAL) |
++ CSR_LTR_LONG_VAL_AD_SNOOP_REQ |
++ u32_encode_bits(CSR_LTR_LONG_VAL_AD_SCALE_USEC,
++ CSR_LTR_LONG_VAL_AD_SNOOP_SCALE) |
++ u32_encode_bits(250, CSR_LTR_LONG_VAL_AD_SNOOP_VAL);
++
++ iwl_write32(trans, CSR_LTR_LONG_VAL_AD, val);
++ }
++
+ if (trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
+ iwl_write_umac_prph(trans, UREG_CPU_INIT_RUN, 1);
+ else
+--
+2.27.0
+
--- /dev/null
+From ed43675efaba3bab1b093afcbe7f4947418a86b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 10:50:06 +0200
+Subject: iwlwifi: sta: set max HE max A-MPDU according to HE capa
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit c8a2e7a29702fe4626b7aa81149b7b7164e20606 ]
+
+Currently, our max tpt is limited to max HT A-MPDU for LB,
+and max VHT A-MPDU for HB. Configure HE exponent value correctly to
+achieve HE max A-MPDU, both on LB and HB.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/iwlwifi.20201107104557.4486852ebb56.I9eb0d028e31f183597fb90120e7d4ca87e0dd6cb@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/fw/api/sta.h | 10 +++++-----
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 18 ++++++++++++++++++
+ 2 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h b/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h
+index c010e6febbf47..6a071b3c8118c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/sta.h
+@@ -5,10 +5,9 @@
+ *
+ * GPL LICENSE SUMMARY
+ *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012-2014, 2018 - 2020 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -28,10 +27,9 @@
+ *
+ * BSD LICENSE
+ *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012-2014, 2018 - 2020 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -128,7 +126,9 @@ enum iwl_sta_flags {
+ STA_FLG_MAX_AGG_SIZE_256K = (5 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+ STA_FLG_MAX_AGG_SIZE_512K = (6 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+ STA_FLG_MAX_AGG_SIZE_1024K = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+- STA_FLG_MAX_AGG_SIZE_MSK = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT),
++ STA_FLG_MAX_AGG_SIZE_2M = (8 << STA_FLG_MAX_AGG_SIZE_SHIFT),
++ STA_FLG_MAX_AGG_SIZE_4M = (9 << STA_FLG_MAX_AGG_SIZE_SHIFT),
++ STA_FLG_MAX_AGG_SIZE_MSK = (0xf << STA_FLG_MAX_AGG_SIZE_SHIFT),
+
+ STA_FLG_AGG_MPDU_DENS_SHIFT = 23,
+ STA_FLG_AGG_MPDU_DENS_2US = (4 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 9e124755a3cee..2158fd2eff736 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -196,6 +196,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ mpdu_dens = sta->ht_cap.ampdu_density;
+ }
+
++
+ if (sta->vht_cap.vht_supported) {
+ agg_size = sta->vht_cap.cap &
+ IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+@@ -205,6 +206,23 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ agg_size = sta->ht_cap.ampdu_factor;
+ }
+
++ /* D6.0 10.12.2 A-MPDU length limit rules
++ * A STA indicates the maximum length of the A-MPDU preEOF padding
++ * that it can receive in an HE PPDU in the Maximum A-MPDU Length
++ * Exponent field in its HT Capabilities, VHT Capabilities,
++ * and HE 6 GHz Band Capabilities elements (if present) and the
++ * Maximum AMPDU Length Exponent Extension field in its HE
++ * Capabilities element
++ */
++ if (sta->he_cap.has_he)
++ agg_size += u8_get_bits(sta->he_cap.he_cap_elem.mac_cap_info[3],
++ IEEE80211_HE_MAC_CAP3_MAX_AMPDU_LEN_EXP_MASK);
++
++ /* Limit to max A-MPDU supported by FW */
++ if (agg_size > (STA_FLG_MAX_AGG_SIZE_4M >> STA_FLG_MAX_AGG_SIZE_SHIFT))
++ agg_size = (STA_FLG_MAX_AGG_SIZE_4M >>
++ STA_FLG_MAX_AGG_SIZE_SHIFT);
++
+ add_sta_cmd.station_flags |=
+ cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT);
+ add_sta_cmd.station_flags |=
+--
+2.27.0
+
--- /dev/null
+From aa3bde419f7c6da26b03125be1bc336ac604d9c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 22:15:15 -0800
+Subject: mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
+
+From: Liu Zixian <liuzixian4@huawei.com>
+
+[ Upstream commit 309d08d9b3a3659ab3f239d27d4e38b670b08fc9 ]
+
+On success, mmap should return the begin address of newly mapped area,
+but patch "mm: mmap: merge vma after call_mmap() if possible" set
+vm_start of newly merged vma to return value addr. Users of mmap will
+get wrong address if vma is merged after call_mmap(). We fix this by
+moving the assignment to addr before merging vma.
+
+We have a driver which changes vm_flags, and this bug is found by our
+testcases.
+
+Fixes: d70cec898324 ("mm: mmap: merge vma after call_mmap() if possible")
+Signed-off-by: Liu Zixian <liuzixian4@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Cc: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Hongxiang Lou <louhongxiang@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Link: https://lkml.kernel.org/r/20201203085350.22624-1-liuzixian4@huawei.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/mmap.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 7a8987aa69962..c85a2875a9625 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1774,6 +1774,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+ if (error)
+ goto unmap_and_free_vma;
+
++ /* Can addr have changed??
++ *
++ * Answer: Yes, several device drivers can do it in their
++ * f_op->mmap method. -DaveM
++ * Bug: If addr is changed, prev, rb_link, rb_parent should
++ * be updated for vma_link()
++ */
++ WARN_ON_ONCE(addr != vma->vm_start);
++
++ addr = vma->vm_start;
++
+ /* If vm_flags changed after call_mmap(), we should try merge vma again
+ * as we may succeed this time.
+ */
+@@ -1788,25 +1799,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+ fput(vma->vm_file);
+ vm_area_free(vma);
+ vma = merge;
+- /* Update vm_flags and possible addr to pick up the change. We don't
+- * warn here if addr changed as the vma is not linked by vma_link().
+- */
+- addr = vma->vm_start;
++ /* Update vm_flags to pick up the change. */
+ vm_flags = vma->vm_flags;
+ goto unmap_writable;
+ }
+ }
+
+- /* Can addr have changed??
+- *
+- * Answer: Yes, several device drivers can do it in their
+- * f_op->mmap method. -DaveM
+- * Bug: If addr is changed, prev, rb_link, rb_parent should
+- * be updated for vma_link()
+- */
+- WARN_ON_ONCE(addr != vma->vm_start);
+-
+- addr = vma->vm_start;
+ vm_flags = vma->vm_flags;
+ } else if (vm_flags & VM_SHARED) {
+ error = shmem_zero_setup(vma);
+--
+2.27.0
+
--- /dev/null
+From db4e87c0d86d4dec0640372779843e6ce9804bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 23:08:43 -0800
+Subject: net: broadcom CNIC: requires MMU
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 14483cbf040fcb38113497161088a1ce8ce5d713 ]
+
+The CNIC kconfig symbol selects UIO and UIO depends on MMU.
+Since 'select' does not follow dependency chains, add the same MMU
+dependency to CNIC.
+
+Quietens this kconfig warning:
+
+WARNING: unmet direct dependencies detected for UIO
+ Depends on [n]: MMU [=n]
+ Selected by [m]:
+ - CNIC [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n)
+
+Fixes: adfc5217e9db ("broadcom: Move the Broadcom drivers")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Cc: Rasesh Mody <rmody@marvell.com>
+Cc: GR-Linux-NIC-Dev@marvell.com
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: netdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20201129070843.3859-1-rdunlap@infradead.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
+index 7fb42f388d591..7b79528d6eed2 100644
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -88,6 +88,7 @@ config BNX2
+ config CNIC
+ tristate "QLogic CNIC support"
+ depends on PCI && (IPV6 || IPV6=n)
++ depends on MMU
+ select BNX2
+ select UIO
+ help
+--
+2.27.0
+
--- /dev/null
+From d9f7e40fd01c66a9a089469c58bae9303a05c786 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:56:00 +0100
+Subject: net, xsk: Avoid taking multiple skbuff references
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 36ccdf85829a7dd6936dba5d02fa50138471f0d3 ]
+
+Commit 642e450b6b59 ("xsk: Do not discard packet when NETDEV_TX_BUSY")
+addressed the problem that packets were discarded from the Tx AF_XDP
+ring, when the driver returned NETDEV_TX_BUSY. Part of the fix was
+bumping the skbuff reference count, so that the buffer would not be
+freed by dev_direct_xmit(). A reference count larger than one means
+that the skbuff is "shared", which is not the case.
+
+If the "shared" skbuff is sent to the generic XDP receive path,
+netif_receive_generic_xdp(), and pskb_expand_head() is entered the
+BUG_ON(skb_shared(skb)) will trigger.
+
+This patch adds a variant to dev_direct_xmit(), __dev_direct_xmit(),
+where a user can select the skbuff free policy. This allows AF_XDP to
+avoid bumping the reference count, but still keep the NETDEV_TX_BUSY
+behavior.
+
+Fixes: 642e450b6b59 ("xsk: Do not discard packet when NETDEV_TX_BUSY")
+Reported-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201123175600.146255-1-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 14 +++++++++++++-
+ net/core/dev.c | 8 ++------
+ net/xdp/xsk.c | 8 +-------
+ 3 files changed, 16 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8fbdfae2c8c02..edc5fbd07c1ca 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -2778,9 +2778,21 @@ u16 dev_pick_tx_zero(struct net_device *dev, struct sk_buff *skb,
+ struct net_device *sb_dev);
+ u16 dev_pick_tx_cpu_id(struct net_device *dev, struct sk_buff *skb,
+ struct net_device *sb_dev);
++
+ int dev_queue_xmit(struct sk_buff *skb);
+ int dev_queue_xmit_accel(struct sk_buff *skb, struct net_device *sb_dev);
+-int dev_direct_xmit(struct sk_buff *skb, u16 queue_id);
++int __dev_direct_xmit(struct sk_buff *skb, u16 queue_id);
++
++static inline int dev_direct_xmit(struct sk_buff *skb, u16 queue_id)
++{
++ int ret;
++
++ ret = __dev_direct_xmit(skb, queue_id);
++ if (!dev_xmit_complete(ret))
++ kfree_skb(skb);
++ return ret;
++}
++
+ int register_netdevice(struct net_device *dev);
+ void unregister_netdevice_queue(struct net_device *dev, struct list_head *head);
+ void unregister_netdevice_many(struct list_head *head);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 010de57488ce7..4a6241c0534d2 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4176,7 +4176,7 @@ int dev_queue_xmit_accel(struct sk_buff *skb, struct net_device *sb_dev)
+ }
+ EXPORT_SYMBOL(dev_queue_xmit_accel);
+
+-int dev_direct_xmit(struct sk_buff *skb, u16 queue_id)
++int __dev_direct_xmit(struct sk_buff *skb, u16 queue_id)
+ {
+ struct net_device *dev = skb->dev;
+ struct sk_buff *orig_skb = skb;
+@@ -4205,17 +4205,13 @@ int dev_direct_xmit(struct sk_buff *skb, u16 queue_id)
+ dev_xmit_recursion_dec();
+
+ local_bh_enable();
+-
+- if (!dev_xmit_complete(ret))
+- kfree_skb(skb);
+-
+ return ret;
+ drop:
+ atomic_long_inc(&dev->tx_dropped);
+ kfree_skb_list(skb);
+ return NET_XMIT_DROP;
+ }
+-EXPORT_SYMBOL(dev_direct_xmit);
++EXPORT_SYMBOL(__dev_direct_xmit);
+
+ /*************************************************************************
+ * Receiver routines
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 6c5e09e7440a9..a1ec2c8fa70a9 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -377,11 +377,7 @@ static int xsk_generic_xmit(struct sock *sk)
+ skb_shinfo(skb)->destructor_arg = (void *)(long)desc.addr;
+ skb->destructor = xsk_destruct_skb;
+
+- /* Hinder dev_direct_xmit from freeing the packet and
+- * therefore completing it in the destructor
+- */
+- refcount_inc(&skb->users);
+- err = dev_direct_xmit(skb, xs->queue_id);
++ err = __dev_direct_xmit(skb, xs->queue_id);
+ if (err == NETDEV_TX_BUSY) {
+ /* Tell user-space to retry the send */
+ skb->destructor = sock_wfree;
+@@ -395,12 +391,10 @@ static int xsk_generic_xmit(struct sock *sk)
+ /* Ignore NET_XMIT_CN as packet might have been sent */
+ if (err == NET_XMIT_DROP) {
+ /* SKB completed but not sent */
+- kfree_skb(skb);
+ err = -EBUSY;
+ goto out;
+ }
+
+- consume_skb(skb);
+ sent_frame = true;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7885adbc5a6deaa1e8e67165f6ee2caeb49615eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 20:09:21 +0900
+Subject: perf/x86/intel: Fix a warning on x86_pmu_stop() with large PEBS
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 5debf02131227d39988e44adf5090fb796fa8466 ]
+
+The commit 3966c3feca3f ("x86/perf/amd: Remove need to check "running"
+bit in NMI handler") introduced this. It seems x86_pmu_stop can be
+called recursively (like when it losts some samples) like below:
+
+ x86_pmu_stop
+ intel_pmu_disable_event (x86_pmu_disable)
+ intel_pmu_pebs_disable
+ intel_pmu_drain_pebs_nhm (x86_pmu_drain_pebs_buffer)
+ x86_pmu_stop
+
+While commit 35d1ce6bec13 ("perf/x86/intel/ds: Fix x86_pmu_stop
+warning for large PEBS") fixed it for the normal cases, there's
+another path to call x86_pmu_stop() recursively when a PEBS error was
+detected (like two or more counters overflowed at the same time).
+
+Like in the Kan's previous fix, we can skip the interrupt accounting
+for large PEBS, so check the iregs which is set for PMI only.
+
+Fixes: 3966c3feca3f ("x86/perf/amd: Remove need to check "running" bit in NMI handler")
+Reported-by: John Sperbeck <jsperbeck@google.com>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20201126110922.317681-1-namhyung@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/ds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 404315df1e167..4c84b87904930 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -1937,7 +1937,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
+ if (error[bit]) {
+ perf_log_lost_samples(event, error[bit]);
+
+- if (perf_event_account_interrupt(event))
++ if (iregs && perf_event_account_interrupt(event))
+ x86_pmu_stop(event, 0);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 57263dd850887b3a0a196939b289a4b33132fb6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Oct 2020 15:01:15 -0400
+Subject: phy: usb: Fix incorrect clearing of tca_drv_sel bit in SETUP reg for
+ 7211
+
+From: Al Cooper <alcooperx@gmail.com>
+
+[ Upstream commit 209c805835b29495cf66cc705b206da8f4a68e6e ]
+
+The 7211a0 has a tca_drv_sel bit in the USB SETUP register that
+should never be enabled. This feature is only used if there is a
+USB Type-C PHY, and the 7211 does not have one. If the bit is
+enabled, the VBUS signal will never be asserted. In the 7211a0,
+the bit was incorrectly defaulted to on so the driver had to clear
+the bit. In the 7211c0 the state was inverted so the driver should
+no longer clear the bit. This hasn't been a problem because all
+current 7211 boards don't use the VBUS signal, but there are some
+future customer boards that may use it.
+
+Signed-off-by: Al Cooper <alcooperx@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201002190115.48017-1-alcooperx@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+index 456dc4a100c20..e63457e145c71 100644
+--- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
++++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
+@@ -270,11 +270,6 @@ static void usb_init_common_7211b0(struct brcm_usb_init_params *params)
+ reg |= params->mode << USB_PHY_UTMI_CTL_1_PHY_MODE_SHIFT;
+ brcm_usb_writel(reg, usb_phy + USB_PHY_UTMI_CTL_1);
+
+- /* Fix the incorrect default */
+- reg = brcm_usb_readl(ctrl + USB_CTRL_SETUP);
+- reg &= ~USB_CTRL_SETUP_tca_drv_sel_MASK;
+- brcm_usb_writel(reg, ctrl + USB_CTRL_SETUP);
+-
+ usb_init_common(params);
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 55c03eb61b7b19389c440e253a22bc4723b99222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Aug 2020 02:14:23 +0200
+Subject: platform/x86: acer-wmi: add automatic keyboard background light
+ toggle key as KEY_LIGHTS_TOGGLE
+
+From: Timo Witte <timo.witte@gmail.com>
+
+[ Upstream commit 9e7a005ad56aa7d6ea5830c5ffcc60bf35de380b ]
+
+Got a dmesg message on my AMD Renoir based Acer laptop:
+"acer_wmi: Unknown key number - 0x84" when toggling keyboard
+background light
+
+Signed-off-by: Timo Witte <timo.witte@gmail.com>
+Reviewed-by: "Lee, Chun-Yi" <jlee@suse.com>
+Link: https://lore.kernel.org/r/20200804001423.36778-1-timo.witte@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/acer-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index 49f4b73be513f..5592a929b5935 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -111,6 +111,7 @@ static const struct key_entry acer_wmi_keymap[] __initconst = {
+ {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
+ {KE_IGNORE, 0x81, {KEY_SLEEP} },
+ {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
++ {KE_IGNORE, 0x84, {KEY_KBDILLUMTOGGLE} }, /* Automatic Keyboard background light toggle */
+ {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
+ {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
+ {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
+--
+2.27.0
+
--- /dev/null
+From aa9f0adf4dce90fdaa8ef4e2a8717cd07d22795e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 15:16:52 +0200
+Subject: platform/x86: intel-vbtn: Support for tablet mode on HP Pavilion 13
+ x360 PC
+
+From: Max Verevkin <me@maxverevkin.tk>
+
+[ Upstream commit 8b205d3e1bf52ab31cdd5c55f87c87a227793d84 ]
+
+The Pavilion 13 x360 PC has a chassis-type which does not indicate it is
+a convertible, while it is actually a convertible. Add it to the
+dmi_switches_allow_list.
+
+Signed-off-by: Max Verevkin <me@maxverevkin.tk>
+Link: https://lore.kernel.org/r/20201124131652.11165-1-me@maxverevkin.tk
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel-vbtn.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index f5901b0b07cd8..0419c8001fe33 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -206,6 +206,12 @@ static const struct dmi_system_id dmi_switches_allow_list[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
+ },
+ },
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion 13 x360 PC"),
++ },
++ },
+ {} /* Array terminator */
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 0793c319c87ae6a9fcf5bbf3d98ce5254f883efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 11:35:50 +0100
+Subject: platform/x86: thinkpad_acpi: Add BAT1 is primary battery quirk for
+ Thinkpad Yoga 11e 4th gen
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c986a7024916c92a775fc8d853fba3cae1d5fde4 ]
+
+The Thinkpad Yoga 11e 4th gen with the N3450 / Celeron CPU only has
+one battery which is named BAT1 instead of the expected BAT0, add a
+quirk for this. This fixes not being able to set the charging tresholds
+on this model; and this alsoe fixes the following errors in dmesg:
+
+ACPI: \_SB_.PCI0.LPCB.EC__.HKEY: BCTG evaluated but flagged as error
+thinkpad_acpi: Error probing battery 2
+battery: extension failed to load: ThinkPad Battery Extension
+battery: extension unregistered: ThinkPad Battery Extension
+
+Note that the added quirk is for the "R0K" BIOS versions which are
+used on the Thinkpad Yoga 11e 4th gen's with a Celeron CPU, there
+is a separate "R0L" BIOS for the i3/i5 based versions. This may also
+need the same quirk, but if that really is necessary is unknown.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20201109103550.16265-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index cd7e782791c71..c7e9c0d29ed93 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -9704,6 +9704,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = {
+ TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */
+ TPACPI_Q_LNV3('R', '0', 'C', true), /* Thinkpad 13 */
+ TPACPI_Q_LNV3('R', '0', 'J', true), /* Thinkpad 13 gen 2 */
++ TPACPI_Q_LNV3('R', '0', 'K', true), /* Thinkpad 11e gen 4 celeron BIOS */
+ };
+
+ static int __init tpacpi_battery_init(struct ibm_init_struct *ibm)
+--
+2.27.0
+
--- /dev/null
+From 0f4236b64d307b35c7ebdb02185ea6017dfde437 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:25:56 +0300
+Subject: platform/x86: thinkpad_acpi: add P1 gen3 second fan support
+
+From: Iakov 'Jake' Kirilenko <jake.kirilenko@gmail.com>
+
+[ Upstream commit 15d89c9f6f4a186ade7aefbe77e7ede9746b6c47 ]
+
+Tested on my P1 gen3, works fine with `thinkfan`. Since thinkpad_acpi fan
+control is off by default, it is safe to add 2nd fan control for brave
+overclockers
+
+Signed-off-by: Iakov 'Jake' Kirilenko <jake.kirilenko@gmail.com>
+Link: https://lore.kernel.org/r/20201105152556.34073-1-jake.kirilenko@gmail.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 017f090a90f68..4a5bb86d341ee 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -8769,6 +8769,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
+ TPACPI_Q_LNV3('N', '2', 'C', TPACPI_FAN_2CTL), /* P52 / P72 */
+ TPACPI_Q_LNV3('N', '2', 'E', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (1st gen) */
+ TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */
++ TPACPI_Q_LNV3('N', '2', 'V', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (3nd gen) */
+ };
+
+ static int __init fan_init(struct ibm_init_struct *iibm)
+--
+2.27.0
+
--- /dev/null
+From 7ab3d71eba8f1c0edcd70eb52b7c358b67666a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 15:01:30 +0100
+Subject: platform/x86: thinkpad_acpi: Do not report SW_TABLET_MODE on Yoga 11e
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit f2eae1888cf22590c38764b8fa3c989c0283870e ]
+
+The Yoga 11e series has 2 accelerometers described by a BOSC0200 ACPI node.
+This setup relies on a Windows service which reads both accelerometers and
+then calculates the angle between the 2 halves to determine laptop / tent /
+tablet mode and then reports the calculated mode back to the EC by calling
+special ACPI methods on the BOSC0200 node.
+
+The bmc150 iio driver does not support this (it involves double
+calculations requiring sqrt and arccos so this really needs to be done
+in userspace), as a result of this on the Yoga 11e the thinkpad_acpi
+code always reports SW_TABLET_MODE=0, starting with GNOME 3.38 reporting
+SW_TABLET_MODE=0 causes GNOME to:
+
+1. Not show the onscreen keyboard when a text-input field is focussed
+ with the touchscreen.
+2. Disable accelerometer based auto display-rotation.
+
+This makes sense when in laptop-mode but not when in tablet-mode. But
+since for the Yoga 11e the thinkpad_acpi code always reports
+SW_TABLET_MODE=0, GNOME does not know when the device is in tablet-mode.
+
+Stop reporting the broken (always 0) SW_TABLET_MODE on Yoga 11e models
+to fix this.
+
+Note there are plans for userspace to support 360 degree hinges style
+2-in-1s with 2 accelerometers and figure out the mode by itself, see:
+https://gitlab.freedesktop.org/hadess/iio-sensor-proxy/-/issues/216
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20201106140130.46820-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 4a5bb86d341ee..cd7e782791c71 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3214,7 +3214,14 @@ static int hotkey_init_tablet_mode(void)
+
+ in_tablet_mode = hotkey_gmms_get_tablet_mode(res,
+ &has_tablet_mode);
+- if (has_tablet_mode)
++ /*
++ * The Yoga 11e series has 2 accelerometers described by a
++ * BOSC0200 ACPI node. This setup relies on a Windows service
++ * which calls special ACPI methods on this node to report
++ * the laptop/tent/tablet mode to the EC. The bmc150 iio driver
++ * does not support this, so skip the hotkey on these models.
++ */
++ if (has_tablet_mode && !acpi_dev_present("BOSC0200", "1", -1))
+ tp_features.hotkey_tablet = TP_HOTKEY_TABLET_USES_GMMS;
+ type = "GMMS";
+ } else if (acpi_evalf(hkey_handle, &res, "MHKG", "qd")) {
+--
+2.27.0
+
--- /dev/null
+From ea217ea5e4da8bf898a338df8f58b0baf4557397 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 18:04:16 -0600
+Subject: platform/x86: thinkpad_acpi: Whitelist P15 firmware for dual fan
+ control
+
+From: Matthias Maier <tamiko@43-1.org>
+
+[ Upstream commit 80a8c3185f5047dc7438ed226b72385bf93b4071 ]
+
+This commit enables dual fan control for the following new Lenovo
+models: P15, P15v.
+
+Signed-off-by: Matthias Maier <tamiko@43-1.org>
+Link: https://lore.kernel.org/r/20201126000416.2459645-2-tamiko-ibm-acpi-devel@43-1.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/thinkpad_acpi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index c7e9c0d29ed93..55a94a2dc562e 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -8777,6 +8777,7 @@ static const struct tpacpi_quirk fan_quirk_table[] __initconst = {
+ TPACPI_Q_LNV3('N', '2', 'E', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (1st gen) */
+ TPACPI_Q_LNV3('N', '2', 'O', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (2nd gen) */
+ TPACPI_Q_LNV3('N', '2', 'V', TPACPI_FAN_2CTL), /* P1 / X1 Extreme (3nd gen) */
++ TPACPI_Q_LNV3('N', '3', '0', TPACPI_FAN_2CTL), /* P15 (1st gen) / P15v (1st gen) */
+ };
+
+ static int __init fan_init(struct ibm_init_struct *iibm)
+--
+2.27.0
+
--- /dev/null
+From bdcc72d85db8c5f6d1403937194494b1ea31cf71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 12:04:54 +0100
+Subject: platform/x86: touchscreen_dmi: Add info for the Irbis TW118 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit c9aa128080cbce92f8715a9328f88d8ca3134279 ]
+
+Add touchscreen info for the Irbis TW118 tablet.
+
+Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20201124110454.114286-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index 26cbf7cc8129c..5783139d0a119 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -295,6 +295,21 @@ static const struct ts_dmi_data irbis_tw90_data = {
+ .properties = irbis_tw90_props,
+ };
+
++static const struct property_entry irbis_tw118_props[] = {
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 20),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 30),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1960),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1510),
++ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-irbis-tw118.fw"),
++ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++ { }
++};
++
++static const struct ts_dmi_data irbis_tw118_data = {
++ .acpi_name = "MSSL1680:00",
++ .properties = irbis_tw118_props,
++};
++
+ static const struct property_entry itworks_tw891_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-min-x", 1),
+ PROPERTY_ENTRY_U32("touchscreen-min-y", 5),
+@@ -953,6 +968,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "TW90"),
+ },
+ },
++ {
++ /* Irbis TW118 */
++ .driver_data = (void *)&irbis_tw118_data,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "IRBIS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "TW118"),
++ },
++ },
+ {
+ /* I.T.Works TW891 */
+ .driver_data = (void *)&itworks_tw891_data,
+--
+2.27.0
+
--- /dev/null
+From a341e7821ece23230f94a7eee096ecfe837927f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 21:49:49 +0200
+Subject: platform/x86: touchscreen_dmi: Add info for the Predia Basic tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 0f511edc6ac12f1ccf1c6c2d4412f5ed7ba426a6 ]
+
+Add touchscreen info for the Predia Basic tablet.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20201015194949.50566-1-hdegoede@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/touchscreen_dmi.c | 27 ++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
+index dda60f89c9512..26cbf7cc8129c 100644
+--- a/drivers/platform/x86/touchscreen_dmi.c
++++ b/drivers/platform/x86/touchscreen_dmi.c
+@@ -623,6 +623,23 @@ static const struct ts_dmi_data pov_mobii_wintab_p1006w_v10_data = {
+ .properties = pov_mobii_wintab_p1006w_v10_props,
+ };
+
++static const struct property_entry predia_basic_props[] = {
++ PROPERTY_ENTRY_U32("touchscreen-min-x", 3),
++ PROPERTY_ENTRY_U32("touchscreen-min-y", 10),
++ PROPERTY_ENTRY_U32("touchscreen-size-x", 1728),
++ PROPERTY_ENTRY_U32("touchscreen-size-y", 1144),
++ PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
++ PROPERTY_ENTRY_STRING("firmware-name", "gsl3680-predia-basic.fw"),
++ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
++ PROPERTY_ENTRY_BOOL("silead,home-button"),
++ { }
++};
++
++static const struct ts_dmi_data predia_basic_data = {
++ .acpi_name = "MSSL1680:00",
++ .properties = predia_basic_props,
++};
++
+ static const struct property_entry schneider_sct101ctm_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-size-x", 1715),
+ PROPERTY_ENTRY_U32("touchscreen-size-y", 1140),
+@@ -1109,6 +1126,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
+ DMI_MATCH(DMI_BIOS_DATE, "10/24/2014"),
+ },
+ },
++ {
++ /* Predia Basic tablet) */
++ .driver_data = (void *)&predia_basic_data,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
++ /* Above matches are too generic, add bios-version match */
++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"),
++ },
++ },
+ {
+ /* Point of View mobii wintab p800w (v2.1) */
+ .driver_data = (void *)&pov_mobii_wintab_p800w_v21_data,
+--
+2.27.0
+
--- /dev/null
+From 0694d1a107f7a2f422565ccb2705fa6032514f71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 20:25:27 +1000
+Subject: powerpc/64s: Fix hash ISA v3.0 TLBIEL instruction generation
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 5844cc25fd121074de7895181a2fa1ce100a0fdd ]
+
+A typo has the R field of the instruction assigned by lucky dip a la
+register allocator.
+
+Fixes: d4748276ae14c ("powerpc/64s: Improve local TLB flush for boot and MCE on POWER9")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201126102530.691335-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/book3s64/hash_native.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/book3s64/hash_native.c b/arch/powerpc/mm/book3s64/hash_native.c
+index cf20e5229ce1f..562094863e915 100644
+--- a/arch/powerpc/mm/book3s64/hash_native.c
++++ b/arch/powerpc/mm/book3s64/hash_native.c
+@@ -68,7 +68,7 @@ static __always_inline void tlbiel_hash_set_isa300(unsigned int set, unsigned in
+ rs = ((unsigned long)pid << PPC_BITLSHIFT(31));
+
+ asm volatile(PPC_TLBIEL(%0, %1, %2, %3, %4)
+- : : "r"(rb), "r"(rs), "i"(ric), "i"(prs), "r"(r)
++ : : "r"(rb), "r"(rs), "i"(ric), "i"(prs), "i"(r)
+ : "memory");
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 82dbe74f90afc90855f8acf35f249376d06d3554 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 23:09:13 +1100
+Subject: powerpc: Drop -me200 addition to build flags
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit e02152ba2810f7c88cb54e71cda096268dfa9241 ]
+
+Currently a build with CONFIG_E200=y will fail with:
+
+ Error: invalid switch -me200
+ Error: unrecognized option -me200
+
+Upstream binutils has never supported an -me200 option. Presumably it
+was supported at some point by either a fork or Freescale internal
+binutils.
+
+We can't support code that we can't even build test, so drop the
+addition of -me200 to the build flags, so we can at least build with
+CONFIG_E200=y.
+
+Reported-by: Németh Márton <nm127@freemail.hu>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Scott Wood <oss@buserror.net>
+Link: https://lore.kernel.org/r/20201116120913.165317-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 3e8da9cf2eb9d..e6643d5699fef 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -249,7 +249,6 @@ KBUILD_CFLAGS += $(call cc-option,-mno-string)
+ cpu-as-$(CONFIG_40x) += -Wa,-m405
+ cpu-as-$(CONFIG_44x) += -Wa,-m440
+ cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec)
+-cpu-as-$(CONFIG_E200) += -Wa,-me200
+ cpu-as-$(CONFIG_E500) += -Wa,-me500
+
+ # When using '-many -mpower4' gas will first try and find a matching power4
+--
+2.27.0
+
--- /dev/null
+From 618aaa35db3007da11f258c7c20f00621f7cd9da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:46:01 +0100
+Subject: s390: fix irq state tracing
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit b1cae1f84a0f609a34ebcaa087fbecef32f69882 ]
+
+With commit 58c644ba512c ("sched/idle: Fix arch_cpu_idle() vs
+tracing") common code calls arch_cpu_idle() with a lockdep state that
+tells irqs are on.
+
+This doesn't work very well for s390: psw_idle() will enable interrupts
+to wait for an interrupt. As soon as an interrupt occurs the interrupt
+handler will verify if the old context was psw_idle(). If that is the
+case the interrupt enablement bits in the old program status word will
+be cleared.
+
+A subsequent test in both the external as well as the io interrupt
+handler checks if in the old context interrupts were enabled. Due to
+the above patching of the old program status word it is assumed the
+old context had interrupts disabled, and therefore a call to
+TRACE_IRQS_OFF (aka trace_hardirqs_off_caller) is skipped. Which in
+turn makes lockdep incorrectly "think" that interrupts are enabled
+within the interrupt handler.
+
+Fix this by unconditionally calling TRACE_IRQS_OFF when entering
+interrupt handlers. Also call unconditionally TRACE_IRQS_ON when
+leaving interrupts handlers.
+
+This leaves the special psw_idle() case, which now returns with
+interrupts disabled, but has an "irqs on" lockdep state. So callers of
+psw_idle() must adjust the state on their own, if required. This is
+currently only __udelay_disabled().
+
+Fixes: 58c644ba512c ("sched/idle: Fix arch_cpu_idle() vs tracing")
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/entry.S | 15 ---------------
+ arch/s390/lib/delay.c | 5 ++---
+ 2 files changed, 2 insertions(+), 18 deletions(-)
+
+diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
+index ca55db0823534..dd5cb6204335d 100644
+--- a/arch/s390/kernel/entry.S
++++ b/arch/s390/kernel/entry.S
+@@ -765,12 +765,7 @@ ENTRY(io_int_handler)
+ xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
+ TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ
+ jo .Lio_restore
+-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS)
+- tmhh %r8,0x300
+- jz 1f
+ TRACE_IRQS_OFF
+-1:
+-#endif
+ xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
+ .Lio_loop:
+ lgr %r2,%r11 # pass pointer to pt_regs
+@@ -793,12 +788,7 @@ ENTRY(io_int_handler)
+ TSTMSK __LC_CPU_FLAGS,_CIF_WORK
+ jnz .Lio_work
+ .Lio_restore:
+-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS)
+- tm __PT_PSW(%r11),3
+- jno 0f
+ TRACE_IRQS_ON
+-0:
+-#endif
+ lg %r14,__LC_VDSO_PER_CPU
+ mvc __LC_RETURN_PSW(16),__PT_PSW(%r11)
+ tm __PT_PSW+1(%r11),0x01 # returning to user ?
+@@ -980,12 +970,7 @@ ENTRY(ext_int_handler)
+ xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
+ TSTMSK __LC_CPU_FLAGS,_CIF_IGNORE_IRQ
+ jo .Lio_restore
+-#if IS_ENABLED(CONFIG_TRACE_IRQFLAGS)
+- tmhh %r8,0x300
+- jz 1f
+ TRACE_IRQS_OFF
+-1:
+-#endif
+ xc __SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
+ lgr %r2,%r11 # pass pointer to pt_regs
+ lghi %r3,EXT_INTERRUPT
+diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
+index daca7bad66de3..8c0c68e7770ea 100644
+--- a/arch/s390/lib/delay.c
++++ b/arch/s390/lib/delay.c
+@@ -33,7 +33,7 @@ EXPORT_SYMBOL(__delay);
+
+ static void __udelay_disabled(unsigned long long usecs)
+ {
+- unsigned long cr0, cr0_new, psw_mask, flags;
++ unsigned long cr0, cr0_new, psw_mask;
+ struct s390_idle_data idle;
+ u64 end;
+
+@@ -45,9 +45,8 @@ static void __udelay_disabled(unsigned long long usecs)
+ psw_mask = __extract_psw() | PSW_MASK_EXT | PSW_MASK_WAIT;
+ set_clock_comparator(end);
+ set_cpu_flag(CIF_IGNORE_IRQ);
+- local_irq_save(flags);
+ psw_idle(&idle, psw_mask);
+- local_irq_restore(flags);
++ trace_hardirqs_off();
+ clear_cpu_flag(CIF_IGNORE_IRQ);
+ set_clock_comparator(S390_lowcore.clock_comparator);
+ __ctl_load(cr0, 0, 0);
+--
+2.27.0
+
--- /dev/null
+From dc0d0596553d6c685c893c1e8d9ab2e883e5b90d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 10:34:14 -0800
+Subject: samples/ftrace: Mark my_tramp[12]? global
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit 983df5f2699f83f78643b19d3399b160d1e64f5b ]
+
+my_tramp[12]? are declared as global functions in C, but they are not
+marked global in the inline assembly definition. This mismatch confuses
+Clang's Control-Flow Integrity checking. Fix the definitions by adding
+.globl.
+
+Link: https://lkml.kernel.org/r/20201113183414.1446671-1-samitolvanen@google.com
+
+Fixes: 9d907f1ae80b8 ("ftrace/samples: Add a sample module that implements modify_ftrace_direct()")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/ftrace/ftrace-direct-modify.c | 2 ++
+ samples/ftrace/ftrace-direct-too.c | 1 +
+ samples/ftrace/ftrace-direct.c | 1 +
+ 3 files changed, 4 insertions(+)
+
+diff --git a/samples/ftrace/ftrace-direct-modify.c b/samples/ftrace/ftrace-direct-modify.c
+index c13a5bc5095be..5b9a09957c6e0 100644
+--- a/samples/ftrace/ftrace-direct-modify.c
++++ b/samples/ftrace/ftrace-direct-modify.c
+@@ -21,6 +21,7 @@ static unsigned long my_ip = (unsigned long)schedule;
+ asm (
+ " .pushsection .text, \"ax\", @progbits\n"
+ " .type my_tramp1, @function\n"
++" .globl my_tramp1\n"
+ " my_tramp1:"
+ " pushq %rbp\n"
+ " movq %rsp, %rbp\n"
+@@ -29,6 +30,7 @@ asm (
+ " .size my_tramp1, .-my_tramp1\n"
+ " ret\n"
+ " .type my_tramp2, @function\n"
++" .globl my_tramp2\n"
+ " my_tramp2:"
+ " pushq %rbp\n"
+ " movq %rsp, %rbp\n"
+diff --git a/samples/ftrace/ftrace-direct-too.c b/samples/ftrace/ftrace-direct-too.c
+index d5c5022be6642..3f0079c9bd6fa 100644
+--- a/samples/ftrace/ftrace-direct-too.c
++++ b/samples/ftrace/ftrace-direct-too.c
+@@ -16,6 +16,7 @@ extern void my_tramp(void *);
+ asm (
+ " .pushsection .text, \"ax\", @progbits\n"
+ " .type my_tramp, @function\n"
++" .globl my_tramp\n"
+ " my_tramp:"
+ " pushq %rbp\n"
+ " movq %rsp, %rbp\n"
+diff --git a/samples/ftrace/ftrace-direct.c b/samples/ftrace/ftrace-direct.c
+index 63ca06d42c803..a2729d1ef17f5 100644
+--- a/samples/ftrace/ftrace-direct.c
++++ b/samples/ftrace/ftrace-direct.c
+@@ -14,6 +14,7 @@ extern void my_tramp(void *);
+ asm (
+ " .pushsection .text, \"ax\", @progbits\n"
+ " .type my_tramp, @function\n"
++" .globl my_tramp\n"
+ " my_tramp:"
+ " pushq %rbp\n"
+ " movq %rsp, %rbp\n"
+--
+2.27.0
+
--- /dev/null
+From 4f72b83a2b1be58453eab77c509d93b584136f4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 11:50:35 +0100
+Subject: sched/idle: Fix arch_cpu_idle() vs tracing
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 58c644ba512cfbc2e39b758dd979edd1d6d00e27 ]
+
+We call arch_cpu_idle() with RCU disabled, but then use
+local_irq_{en,dis}able(), which invokes tracing, which relies on RCU.
+
+Switch all arch_cpu_idle() implementations to use
+raw_local_irq_{en,dis}able() and carefully manage the
+lockdep,rcu,tracing state like we do in entry.
+
+(XXX: we really should change arch_cpu_idle() to not return with
+interrupts enabled)
+
+Reported-by: Sven Schnelle <svens@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lkml.kernel.org/r/20201120114925.594122626@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/alpha/kernel/process.c | 2 +-
+ arch/arm/kernel/process.c | 2 +-
+ arch/arm64/kernel/process.c | 2 +-
+ arch/csky/kernel/process.c | 2 +-
+ arch/h8300/kernel/process.c | 2 +-
+ arch/hexagon/kernel/process.c | 2 +-
+ arch/ia64/kernel/process.c | 2 +-
+ arch/microblaze/kernel/process.c | 2 +-
+ arch/mips/kernel/idle.c | 12 ++++++------
+ arch/nios2/kernel/process.c | 2 +-
+ arch/openrisc/kernel/process.c | 2 +-
+ arch/parisc/kernel/process.c | 2 +-
+ arch/powerpc/kernel/idle.c | 4 ++--
+ arch/riscv/kernel/process.c | 2 +-
+ arch/s390/kernel/idle.c | 6 +++---
+ arch/sh/kernel/idle.c | 2 +-
+ arch/sparc/kernel/leon_pmc.c | 4 ++--
+ arch/sparc/kernel/process_32.c | 2 +-
+ arch/sparc/kernel/process_64.c | 4 ++--
+ arch/um/kernel/process.c | 2 +-
+ arch/x86/include/asm/mwait.h | 2 --
+ arch/x86/kernel/process.c | 12 +++++++-----
+ kernel/sched/idle.c | 28 +++++++++++++++++++++++++++-
+ 23 files changed, 64 insertions(+), 38 deletions(-)
+
+diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
+index 7462a79110024..4c7b0414a3ff3 100644
+--- a/arch/alpha/kernel/process.c
++++ b/arch/alpha/kernel/process.c
+@@ -57,7 +57,7 @@ EXPORT_SYMBOL(pm_power_off);
+ void arch_cpu_idle(void)
+ {
+ wtint(0);
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ void arch_cpu_idle_dead(void)
+diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
+index 8e6ace03e960b..9f199b1e83839 100644
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -71,7 +71,7 @@ void arch_cpu_idle(void)
+ arm_pm_idle();
+ else
+ cpu_do_idle();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ void arch_cpu_idle_prepare(void)
+diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
+index 2da5f3f9d345f..f7c42a7d09b66 100644
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -124,7 +124,7 @@ void arch_cpu_idle(void)
+ * tricks
+ */
+ cpu_do_idle();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+diff --git a/arch/csky/kernel/process.c b/arch/csky/kernel/process.c
+index f730869e21eed..69af6bc87e647 100644
+--- a/arch/csky/kernel/process.c
++++ b/arch/csky/kernel/process.c
+@@ -102,6 +102,6 @@ void arch_cpu_idle(void)
+ #ifdef CONFIG_CPU_PM_STOP
+ asm volatile("stop\n");
+ #endif
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+ #endif
+diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c
+index 83ce3caf73139..a2961c7b2332c 100644
+--- a/arch/h8300/kernel/process.c
++++ b/arch/h8300/kernel/process.c
+@@ -57,7 +57,7 @@ asmlinkage void ret_from_kernel_thread(void);
+ */
+ void arch_cpu_idle(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+ __asm__("sleep");
+ }
+
+diff --git a/arch/hexagon/kernel/process.c b/arch/hexagon/kernel/process.c
+index dfd322c5ce83a..20962601a1b47 100644
+--- a/arch/hexagon/kernel/process.c
++++ b/arch/hexagon/kernel/process.c
+@@ -44,7 +44,7 @@ void arch_cpu_idle(void)
+ {
+ __vmwait();
+ /* interrupts wake us up, but irqs are still disabled */
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /*
+diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
+index f19cb97c00987..1b2769260688d 100644
+--- a/arch/ia64/kernel/process.c
++++ b/arch/ia64/kernel/process.c
+@@ -252,7 +252,7 @@ void arch_cpu_idle(void)
+ if (mark_idle)
+ (*mark_idle)(1);
+
+- safe_halt();
++ raw_safe_halt();
+
+ if (mark_idle)
+ (*mark_idle)(0);
+diff --git a/arch/microblaze/kernel/process.c b/arch/microblaze/kernel/process.c
+index a9e46e525cd0a..f99860771ff48 100644
+--- a/arch/microblaze/kernel/process.c
++++ b/arch/microblaze/kernel/process.c
+@@ -149,5 +149,5 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *fpregs)
+
+ void arch_cpu_idle(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+diff --git a/arch/mips/kernel/idle.c b/arch/mips/kernel/idle.c
+index 5bc3b04693c7d..18e69ebf5691d 100644
+--- a/arch/mips/kernel/idle.c
++++ b/arch/mips/kernel/idle.c
+@@ -33,19 +33,19 @@ static void __cpuidle r3081_wait(void)
+ {
+ unsigned long cfg = read_c0_conf();
+ write_c0_conf(cfg | R30XX_CONF_HALT);
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ static void __cpuidle r39xx_wait(void)
+ {
+ if (!need_resched())
+ write_c0_conf(read_c0_conf() | TX39_CONF_HALT);
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ void __cpuidle r4k_wait(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+ __r4k_wait();
+ }
+
+@@ -64,7 +64,7 @@ void __cpuidle r4k_wait_irqoff(void)
+ " .set arch=r4000 \n"
+ " wait \n"
+ " .set pop \n");
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /*
+@@ -84,7 +84,7 @@ static void __cpuidle rm7k_wait_irqoff(void)
+ " wait \n"
+ " mtc0 $1, $12 # stalls until W stage \n"
+ " .set pop \n");
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /*
+@@ -257,7 +257,7 @@ void arch_cpu_idle(void)
+ if (cpu_wait)
+ cpu_wait();
+ else
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ #ifdef CONFIG_CPU_IDLE
+diff --git a/arch/nios2/kernel/process.c b/arch/nios2/kernel/process.c
+index 88a4ec03edab4..f5cc55a88d310 100644
+--- a/arch/nios2/kernel/process.c
++++ b/arch/nios2/kernel/process.c
+@@ -33,7 +33,7 @@ EXPORT_SYMBOL(pm_power_off);
+
+ void arch_cpu_idle(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /*
+diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
+index 0ff391f00334c..3c98728cce249 100644
+--- a/arch/openrisc/kernel/process.c
++++ b/arch/openrisc/kernel/process.c
+@@ -79,7 +79,7 @@ void machine_power_off(void)
+ */
+ void arch_cpu_idle(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+ if (mfspr(SPR_UPR) & SPR_UPR_PMP)
+ mtspr(SPR_PMR, mfspr(SPR_PMR) | SPR_PMR_DME);
+ }
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index f196d96e2f9f5..a92a23d6acd93 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -169,7 +169,7 @@ void __cpuidle arch_cpu_idle_dead(void)
+
+ void __cpuidle arch_cpu_idle(void)
+ {
+- local_irq_enable();
++ raw_local_irq_enable();
+
+ /* nop on real hardware, qemu will idle sleep. */
+ asm volatile("or %%r10,%%r10,%%r10\n":::);
+diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
+index 422e31d2f5a2b..8df35f1329a42 100644
+--- a/arch/powerpc/kernel/idle.c
++++ b/arch/powerpc/kernel/idle.c
+@@ -60,9 +60,9 @@ void arch_cpu_idle(void)
+ * interrupts enabled, some don't.
+ */
+ if (irqs_disabled())
+- local_irq_enable();
++ raw_local_irq_enable();
+ } else {
+- local_irq_enable();
++ raw_local_irq_enable();
+ /*
+ * Go into low thread priority and possibly
+ * low power mode.
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 2b97c493427c9..308e1d95ecbf0 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -36,7 +36,7 @@ extern asmlinkage void ret_from_kernel_thread(void);
+ void arch_cpu_idle(void)
+ {
+ wait_for_interrupt();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ void show_regs(struct pt_regs *regs)
+diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c
+index f7f1e64e0d980..2b85096964f84 100644
+--- a/arch/s390/kernel/idle.c
++++ b/arch/s390/kernel/idle.c
+@@ -33,10 +33,10 @@ void enabled_wait(void)
+ PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK;
+ clear_cpu_flag(CIF_NOHZ_DELAY);
+
+- local_irq_save(flags);
++ raw_local_irq_save(flags);
+ /* Call the assembler magic in entry.S */
+ psw_idle(idle, psw_mask);
+- local_irq_restore(flags);
++ raw_local_irq_restore(flags);
+
+ /* Account time spent with enabled wait psw loaded as idle time. */
+ raw_write_seqcount_begin(&idle->seqcount);
+@@ -123,7 +123,7 @@ void arch_cpu_idle_enter(void)
+ void arch_cpu_idle(void)
+ {
+ enabled_wait();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ void arch_cpu_idle_exit(void)
+diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c
+index 0dc0f52f9bb8d..f59814983bd59 100644
+--- a/arch/sh/kernel/idle.c
++++ b/arch/sh/kernel/idle.c
+@@ -22,7 +22,7 @@ static void (*sh_idle)(void);
+ void default_idle(void)
+ {
+ set_bl_bit();
+- local_irq_enable();
++ raw_local_irq_enable();
+ /* Isn't this racy ? */
+ cpu_sleep();
+ clear_bl_bit();
+diff --git a/arch/sparc/kernel/leon_pmc.c b/arch/sparc/kernel/leon_pmc.c
+index 065e2d4b72908..396f46bca52eb 100644
+--- a/arch/sparc/kernel/leon_pmc.c
++++ b/arch/sparc/kernel/leon_pmc.c
+@@ -50,7 +50,7 @@ static void pmc_leon_idle_fixup(void)
+ register unsigned int address = (unsigned int)leon3_irqctrl_regs;
+
+ /* Interrupts need to be enabled to not hang the CPU */
+- local_irq_enable();
++ raw_local_irq_enable();
+
+ __asm__ __volatile__ (
+ "wr %%g0, %%asr19\n"
+@@ -66,7 +66,7 @@ static void pmc_leon_idle_fixup(void)
+ static void pmc_leon_idle(void)
+ {
+ /* Interrupts need to be enabled to not hang the CPU */
+- local_irq_enable();
++ raw_local_irq_enable();
+
+ /* For systems without power-down, this will be no-op */
+ __asm__ __volatile__ ("wr %g0, %asr19\n\t");
+diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
+index adfcaeab3ddc5..a023637359154 100644
+--- a/arch/sparc/kernel/process_32.c
++++ b/arch/sparc/kernel/process_32.c
+@@ -74,7 +74,7 @@ void arch_cpu_idle(void)
+ {
+ if (sparc_idle)
+ (*sparc_idle)();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /* XXX cli/sti -> local_irq_xxx here, check this works once SMP is fixed. */
+diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
+index a75093b993f9a..6f8c7822fc065 100644
+--- a/arch/sparc/kernel/process_64.c
++++ b/arch/sparc/kernel/process_64.c
+@@ -62,11 +62,11 @@ void arch_cpu_idle(void)
+ {
+ if (tlb_type != hypervisor) {
+ touch_nmi_watchdog();
+- local_irq_enable();
++ raw_local_irq_enable();
+ } else {
+ unsigned long pstate;
+
+- local_irq_enable();
++ raw_local_irq_enable();
+
+ /* The sun4v sleeping code requires that we have PSTATE.IE cleared over
+ * the cpu sleep hypervisor call.
+diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
+index 26b5e243d3fc0..495f101792b3d 100644
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -217,7 +217,7 @@ void arch_cpu_idle(void)
+ {
+ cpu_tasks[current_thread_info()->cpu].pid = os_getpid();
+ um_idle_sleep();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ int __cant_sleep(void) {
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index e039a933aca3c..29dd27b5a339d 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -88,8 +88,6 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
+
+ static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
+ {
+- trace_hardirqs_on();
+-
+ mds_idle_clear_cpu_buffers();
+ /* "mwait %eax, %ecx;" */
+ asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index ba4593a913fab..145a7ac0c19aa 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -685,7 +685,7 @@ void arch_cpu_idle(void)
+ */
+ void __cpuidle default_idle(void)
+ {
+- safe_halt();
++ raw_safe_halt();
+ }
+ #if defined(CONFIG_APM_MODULE) || defined(CONFIG_HALTPOLL_CPUIDLE_MODULE)
+ EXPORT_SYMBOL(default_idle);
+@@ -736,6 +736,8 @@ void stop_this_cpu(void *dummy)
+ /*
+ * AMD Erratum 400 aware idle routine. We handle it the same way as C3 power
+ * states (local apic timer and TSC stop).
++ *
++ * XXX this function is completely buggered vs RCU and tracing.
+ */
+ static void amd_e400_idle(void)
+ {
+@@ -757,9 +759,9 @@ static void amd_e400_idle(void)
+ * The switch back from broadcast mode needs to be called with
+ * interrupts disabled.
+ */
+- local_irq_disable();
++ raw_local_irq_disable();
+ tick_broadcast_exit();
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /*
+@@ -801,9 +803,9 @@ static __cpuidle void mwait_idle(void)
+ if (!need_resched())
+ __sti_mwait(0, 0);
+ else
+- local_irq_enable();
++ raw_local_irq_enable();
+ } else {
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+ __current_clr_polling();
+ }
+diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
+index f324dc36fc43d..dee807ffad11b 100644
+--- a/kernel/sched/idle.c
++++ b/kernel/sched/idle.c
+@@ -78,7 +78,7 @@ void __weak arch_cpu_idle_dead(void) { }
+ void __weak arch_cpu_idle(void)
+ {
+ cpu_idle_force_poll = 1;
+- local_irq_enable();
++ raw_local_irq_enable();
+ }
+
+ /**
+@@ -94,9 +94,35 @@ void __cpuidle default_idle_call(void)
+
+ trace_cpu_idle(1, smp_processor_id());
+ stop_critical_timings();
++
++ /*
++ * arch_cpu_idle() is supposed to enable IRQs, however
++ * we can't do that because of RCU and tracing.
++ *
++ * Trace IRQs enable here, then switch off RCU, and have
++ * arch_cpu_idle() use raw_local_irq_enable(). Note that
++ * rcu_idle_enter() relies on lockdep IRQ state, so switch that
++ * last -- this is very similar to the entry code.
++ */
++ trace_hardirqs_on_prepare();
++ lockdep_hardirqs_on_prepare(_THIS_IP_);
+ rcu_idle_enter();
++ lockdep_hardirqs_on(_THIS_IP_);
++
+ arch_cpu_idle();
++
++ /*
++ * OK, so IRQs are enabled here, but RCU needs them disabled to
++ * turn itself back on.. funny thing is that disabling IRQs
++ * will cause tracing, which needs RCU. Jump through hoops to
++ * make it 'work'.
++ */
++ raw_local_irq_disable();
++ lockdep_hardirqs_off(_THIS_IP_);
+ rcu_idle_exit();
++ lockdep_hardirqs_on(_THIS_IP_);
++ raw_local_irq_enable();
++
+ start_critical_timings();
+ trace_cpu_idle(PWR_EVENT_EXIT, smp_processor_id());
+ }
+--
+2.27.0
+
--- /dev/null
+From 189a5fce19c937db73870077ecc5e50201ef7df6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 11:02:06 +0800
+Subject: scsi: storvsc: Fix error return in storvsc_probe()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 6112ff4e8f393e7e297dff04eff0987f94d37fa1 ]
+
+Return -ENOMEM from the error handling case instead of 0.
+
+Link: https://lore.kernel.org/r/20201127030206.104616-1-jingxiangfeng@huawei.com
+Fixes: 436ad9413353 ("scsi: storvsc: Allow only one remove lun work item to be issued per lun")
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/storvsc_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 8f5f5dc863a4a..719f9ae6c97ae 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1952,8 +1952,10 @@ static int storvsc_probe(struct hv_device *device,
+ alloc_ordered_workqueue("storvsc_error_wq_%d",
+ WQ_MEM_RECLAIM,
+ host->host_no);
+- if (!host_dev->handle_error_wq)
++ if (!host_dev->handle_error_wq) {
++ ret = -ENOMEM;
+ goto err_out2;
++ }
+ INIT_WORK(&host_dev->host_scan_work, storvsc_host_scan);
+ /* Register the HBA and start the scsi bus scan */
+ ret = scsi_add_host(host, &device->device);
+--
+2.27.0
+
--- /dev/null
+From 5bb5d3a7a3dceaaec0f6df178c3577b23676c0e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 22:59:00 -0700
+Subject: scsi: ufs: Fix unexpected values from ufshcd_read_desc_param()
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 1699f980d87fb678a669490462cf0b9517c1fb47 ]
+
+WB-related sysfs entries can be accessed even when an UFS device does not
+support the feature. The descriptors which are not supported by the UFS
+device may be wrongly reported when they are accessed from their
+corrsponding sysfs entries. Fix it by adding a sanity check of parameter
+offset against the actual decriptor length.
+
+Link: https://lore.kernel.org/r/1603346348-14149-1-git-send-email-cang@codeaurora.org
+Reviewed-by: Asutosh Das <asutoshd@codeaurora.org>
+Acked-by: Daejun Park <daejun7.park@samsung.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 9dd32bb0ff2be..cbcdd79a1f76f 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3163,13 +3163,19 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
+ /* Get the length of descriptor */
+ ufshcd_map_desc_id_to_length(hba, desc_id, &buff_len);
+ if (!buff_len) {
+- dev_err(hba->dev, "%s: Failed to get desc length", __func__);
++ dev_err(hba->dev, "%s: Failed to get desc length\n", __func__);
++ return -EINVAL;
++ }
++
++ if (param_offset >= buff_len) {
++ dev_err(hba->dev, "%s: Invalid offset 0x%x in descriptor IDN 0x%x, length 0x%x\n",
++ __func__, param_offset, desc_id, buff_len);
+ return -EINVAL;
+ }
+
+ /* Check whether we need temp memory */
+ if (param_offset != 0 || param_size < buff_len) {
+- desc_buf = kmalloc(buff_len, GFP_KERNEL);
++ desc_buf = kzalloc(buff_len, GFP_KERNEL);
+ if (!desc_buf)
+ return -ENOMEM;
+ } else {
+@@ -3183,14 +3189,14 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
+ desc_buf, &buff_len);
+
+ if (ret) {
+- dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d",
++ dev_err(hba->dev, "%s: Failed reading descriptor. desc_id %d, desc_index %d, param_offset %d, ret %d\n",
+ __func__, desc_id, desc_index, param_offset, ret);
+ goto out;
+ }
+
+ /* Sanity check */
+ if (desc_buf[QUERY_DESC_DESC_TYPE_OFFSET] != desc_id) {
+- dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header",
++ dev_err(hba->dev, "%s: invalid desc_id %d in descriptor header\n",
+ __func__, desc_buf[QUERY_DESC_DESC_TYPE_OFFSET]);
+ ret = -EINVAL;
+ goto out;
+@@ -3200,12 +3206,12 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
+ buff_len = desc_buf[QUERY_DESC_LENGTH_OFFSET];
+ ufshcd_update_desc_length(hba, desc_id, desc_index, buff_len);
+
+- /* Check wherher we will not copy more data, than available */
+- if (is_kmalloc && (param_offset + param_size) > buff_len)
+- param_size = buff_len - param_offset;
+-
+- if (is_kmalloc)
++ if (is_kmalloc) {
++ /* Make sure we don't copy more data than available */
++ if (param_offset + param_size > buff_len)
++ param_size = buff_len - param_offset;
+ memcpy(param_read_buf, &desc_buf[param_offset], param_size);
++ }
+ out:
+ if (is_kmalloc)
+ kfree(desc_buf);
+--
+2.27.0
+
--- /dev/null
+From 74ad187a521c6c9cb8750d26bb8e08363254e633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 00:09:04 -0700
+Subject: scsi: ufs: Make sure clk scaling happens only when HBA is runtime
+ ACTIVE
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 73cc291c270248567245f084dcdf5078069af6b5 ]
+
+If someone plays with the UFS clk scaling devfreq governor through sysfs,
+ufshcd_devfreq_scale may be called even when HBA is not runtime ACTIVE.
+This can lead to unexpected error. We cannot just protect it by calling
+pm_runtime_get_sync() because that may cause a race condition since HBA
+runtime suspend ops need to suspend clk scaling. To fix this call
+pm_runtime_get_noresume() and check HBA's runtime status. Only proceed if
+HBA is runtime ACTIVE, otherwise just bail.
+
+governor_store
+ devfreq_performance_handler
+ update_devfreq
+ devfreq_set_target
+ ufshcd_devfreq_target
+ ufshcd_devfreq_scale
+
+Link: https://lore.kernel.org/r/1600758548-28576-1-git-send-email-cang@codeaurora.org
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index cbcdd79a1f76f..18326eb772aeb 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1279,8 +1279,15 @@ static int ufshcd_devfreq_target(struct device *dev,
+ }
+ spin_unlock_irqrestore(hba->host->host_lock, irq_flags);
+
++ pm_runtime_get_noresume(hba->dev);
++ if (!pm_runtime_active(hba->dev)) {
++ pm_runtime_put_noidle(hba->dev);
++ ret = -EAGAIN;
++ goto out;
++ }
+ start = ktime_get();
+ ret = ufshcd_devfreq_scale(hba, scale_up);
++ pm_runtime_put(hba->dev);
+
+ trace_ufshcd_profile_clk_scaling(dev_name(hba->dev),
+ (scale_up ? "up" : "down"),
+--
+2.27.0
+
mm-zsmalloc.c-drop-zsmalloc_pgtable_mapping.patch
kprobes-remove-nmi-context-check.patch
kprobes-tell-lockdep-about-kprobe-nesting.patch
+asoc-intel-bytcr_rt5640-fix-hp-pavilion-x2-detachabl.patch
+tools-bootconfig-fix-to-check-the-write-failure-corr.patch
+net-xsk-avoid-taking-multiple-skbuff-references.patch
+bpftool-fix-error-return-value-in-build_btf_type_tab.patch
+vhost-vdpa-fix-page-pinning-leakage-in-error-path-re.patch
+powerpc-64s-fix-hash-isa-v3.0-tlbiel-instruction-gen.patch
+batman-adv-consider-fragmentation-for-needed_headroo.patch
+batman-adv-reserve-needed_-room-for-fragments.patch
+batman-adv-don-t-always-reallocate-the-fragmentation.patch
+ipvs-fix-possible-memory-leak-in-ip_vs_control_net_i.patch
+ibmvnic-handle-inconsistent-login-with-reset.patch
+ibmvnic-stop-free_all_rwi-on-failed-reset.patch
+ibmvnic-avoid-memset-null-scrq-msgs.patch
+ibmvnic-delay-next-reset-if-hard-reset-fails.patch
+ibmvnic-track-pending-login.patch
+ibmvnic-send_login-should-check-for-crq-errors.patch
+ibmvnic-reduce-wait-for-completion-time.patch
+drm-rockchip-avoid-uninitialized-use-of-endpoint-id-.patch
+drm-panel-sony-acx565akm-fix-race-condition-in-probe.patch
+can-m_can-tcan4x5x_can_probe-fix-error-path-remove-e.patch
+can-sja1000-sja1000_err-don-t-count-arbitration-lose.patch
+can-sun4i_can-sun4i_can_err-don-t-count-arbitration-.patch
+can-c_can-c_can_power_up-fix-error-handling.patch
+can-kvaser_pciefd-kvaser_pciefd_open-fix-error-handl.patch
+samples-ftrace-mark-my_tramp-12-global.patch
+scsi-storvsc-fix-error-return-in-storvsc_probe.patch
+net-broadcom-cnic-requires-mmu.patch
+vdpa-mlx5-fix-vdpa-vhost-dependencies.patch
+iwlwifi-pcie-invert-values-of-no_160-device-config-e.patch
+perf-x86-intel-fix-a-warning-on-x86_pmu_stop-with-la.patch
+usb-ohci-omap-fix-descriptor-conversion.patch
+zlib-export-s390-symbols-for-zlib-modules.patch
+mm-mmap.c-fix-mmap-return-value-when-vma-is-merged-a.patch
+phy-usb-fix-incorrect-clearing-of-tca_drv_sel-bit-in.patch
+arm64-dts-rockchip-remove-system-power-controller-fr.patch
+iwlwifi-pcie-limit-memory-read-spin-time.patch
+arm64-dts-rockchip-assign-a-fixed-index-to-mmc-devic.patch
+arm64-dts-rockchip-reorder-led-triggers-from-mmc-dev.patch
+iwlwifi-sta-set-max-he-max-a-mpdu-according-to-he-ca.patch
+iwlwifi-pcie-set-ltr-to-avoid-completion-timeout.patch
+iwlwifi-mvm-fix-kernel-panic-in-case-of-assert-durin.patch
+powerpc-drop-me200-addition-to-build-flags.patch
+arm64-dts-broadcom-clear-the-warnings-caused-by-empt.patch
+arc-stack-unwinding-don-t-assume-non-current-task-is.patch
+scsi-ufs-fix-unexpected-values-from-ufshcd_read_desc.patch
+scsi-ufs-make-sure-clk-scaling-happens-only-when-hba.patch
+interconnect-qcom-msm8916-remove-rpm-ids-from-non-rp.patch
+interconnect-qcom-qcs404-remove-gpu-and-display-rpm-.patch
+ibmvnic-skip-tx-timeout-reset-while-in-resetting.patch
+irqchip-gic-v3-its-unconditionally-save-restore-the-.patch
+drm-exynos-depend-on-common_clk-to-fix-compile-tests.patch
+spi-spi-nxp-fspi-fix-fspi-panic-by-unexpected-interr.patch
+arm-smmu-qcom-ensure-the-qcom_scm-driver-has-finishe.patch
+habanalabs-gaudi-fix-missing-code-in-ecc-handling.patch
+btrfs-do-nofs-allocations-when-adding-and-removing-q.patch
+btrfs-fix-lockdep-splat-when-enabling-and-disabling-.patch
+soc-fsl-dpio-get-the-cpumask-through-cpumask_of-cpu.patch
+sched-idle-fix-arch_cpu_idle-vs-tracing.patch
+intel_idle-fix-intel_idle-vs-tracing.patch
+arm64-tegra-disable-the-aconnect-for-jetson-tx2.patch
+platform-x86-thinkpad_acpi-add-p1-gen3-second-fan-su.patch
+platform-x86-thinkpad_acpi-do-not-report-sw_tablet_m.patch
+platform-x86-thinkpad_acpi-add-bat1-is-primary-batte.patch
+platform-x86-thinkpad_acpi-whitelist-p15-firmware-fo.patch
+platform-x86-acer-wmi-add-automatic-keyboard-backgro.patch
+platform-x86-intel-vbtn-support-for-tablet-mode-on-h.patch
+platform-x86-touchscreen_dmi-add-info-for-the-predia.patch
+platform-x86-touchscreen_dmi-add-info-for-the-irbis-.patch
+can-m_can-m_can_dev_setup-add-support-for-bosch-mcan.patch
+s390-fix-irq-state-tracing.patch
+intel_idle-build-fix.patch
--- /dev/null
+From 3f1bfbf4e63c6231c1e0596bb617f508ba4c016e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 10:18:32 +0800
+Subject: soc: fsl: dpio: Get the cpumask through cpumask_of(cpu)
+
+From: Hao Si <si.hao@zte.com.cn>
+
+[ Upstream commit 2663b3388551230cbc4606a40fabf3331ceb59e4 ]
+
+The local variable 'cpumask_t mask' is in the stack memory, and its address
+is assigned to 'desc->affinity' in 'irq_set_affinity_hint()'.
+But the memory area where this variable is located is at risk of being
+modified.
+
+During LTP testing, the following error was generated:
+
+Unable to handle kernel paging request at virtual address ffff000012e9b790
+Mem abort info:
+ ESR = 0x96000007
+ Exception class = DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000007
+ CM = 0, WnR = 0
+swapper pgtable: 4k pages, 48-bit VAs, pgdp = 0000000075ac5e07
+[ffff000012e9b790] pgd=00000027dbffe003, pud=00000027dbffd003,
+pmd=00000027b6d61003, pte=0000000000000000
+Internal error: Oops: 96000007 [#1] PREEMPT SMP
+Modules linked in: xt_conntrack
+Process read_all (pid: 20171, stack limit = 0x0000000044ea4095)
+CPU: 14 PID: 20171 Comm: read_all Tainted: G B W
+Hardware name: NXP Layerscape LX2160ARDB (DT)
+pstate: 80000085 (Nzcv daIf -PAN -UAO)
+pc : irq_affinity_hint_proc_show+0x54/0xb0
+lr : irq_affinity_hint_proc_show+0x4c/0xb0
+sp : ffff00001138bc10
+x29: ffff00001138bc10 x28: 0000ffffd131d1e0
+x27: 00000000007000c0 x26: ffff8025b9480dc0
+x25: ffff8025b9480da8 x24: 00000000000003ff
+x23: ffff8027334f8300 x22: ffff80272e97d000
+x21: ffff80272e97d0b0 x20: ffff8025b9480d80
+x19: ffff000009a49000 x18: 0000000000000000
+x17: 0000000000000000 x16: 0000000000000000
+x15: 0000000000000000 x14: 0000000000000000
+x13: 0000000000000000 x12: 0000000000000040
+x11: 0000000000000000 x10: ffff802735b79b88
+x9 : 0000000000000000 x8 : 0000000000000000
+x7 : ffff000009a49848 x6 : 0000000000000003
+x5 : 0000000000000000 x4 : ffff000008157d6c
+x3 : ffff00001138bc10 x2 : ffff000012e9b790
+x1 : 0000000000000000 x0 : 0000000000000000
+Call trace:
+ irq_affinity_hint_proc_show+0x54/0xb0
+ seq_read+0x1b0/0x440
+ proc_reg_read+0x80/0xd8
+ __vfs_read+0x60/0x178
+ vfs_read+0x94/0x150
+ ksys_read+0x74/0xf0
+ __arm64_sys_read+0x24/0x30
+ el0_svc_common.constprop.0+0xd8/0x1a0
+ el0_svc_handler+0x34/0x88
+ el0_svc+0x10/0x14
+Code: f9001bbf 943e0732 f94066c2 b4000062 (f9400041)
+---[ end trace b495bdcb0b3b732b ]---
+Kernel panic - not syncing: Fatal exception
+SMP: stopping secondary CPUs
+SMP: failed to stop secondary CPUs 0,2-4,6,8,11,13-15
+Kernel Offset: disabled
+CPU features: 0x0,21006008
+Memory Limit: none
+---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Fix it by using 'cpumask_of(cpu)' to get the cpumask.
+
+Signed-off-by: Hao Si <si.hao@zte.com.cn>
+Signed-off-by: Lin Chen <chen.lin5@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/dpio/dpio-driver.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c
+index 7b642c330977f..7f397b4ad878d 100644
+--- a/drivers/soc/fsl/dpio/dpio-driver.c
++++ b/drivers/soc/fsl/dpio/dpio-driver.c
+@@ -95,7 +95,6 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ {
+ int error;
+ struct fsl_mc_device_irq *irq;
+- cpumask_t mask;
+
+ irq = dpio_dev->irqs[0];
+ error = devm_request_irq(&dpio_dev->dev,
+@@ -112,9 +111,7 @@ static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu)
+ }
+
+ /* set the affinity hint */
+- cpumask_clear(&mask);
+- cpumask_set_cpu(cpu, &mask);
+- if (irq_set_affinity_hint(irq->msi_desc->irq, &mask))
++ if (irq_set_affinity_hint(irq->msi_desc->irq, cpumask_of(cpu)))
+ dev_err(&dpio_dev->dev,
+ "irq_set_affinity failed irq %d cpu %d\n",
+ irq->msi_desc->irq, cpu);
+--
+2.27.0
+
--- /dev/null
+From cadf779754bbb936694297ef9d393e84a26a6d14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 10:57:15 +0800
+Subject: spi: spi-nxp-fspi: fix fspi panic by unexpected interrupts
+
+From: Ran Wang <ran.wang_1@nxp.com>
+
+[ Upstream commit 71d80563b0760a411cd90a3680536f5d887fff6b ]
+
+Given the case that bootloader(such as UEFI)'s FSPI driver might not
+handle all interrupts before loading kernel, those legacy interrupts
+would assert immidiately once kernel's FSPI driver enable them. Further,
+if it was FSPI_INTR_IPCMDDONE, the irq handler nxp_fspi_irq_handler()
+would call complete(&f->c) to notify others. However, f->c might not be
+initialized yet at that time, then cause kernel panic.
+
+Of cause, we should fix this issue within bootloader. But it would be
+better to have this pacth to make dirver more robust (by clearing all
+interrupt status bits before enabling interrupts).
+
+Suggested-by: Han Xu <han.xu@nxp.com>
+Signed-off-by: Ran Wang <ran.wang_1@nxp.com>
+Link: https://lore.kernel.org/r/20201123025715.14635-1-ran.wang_1@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-nxp-fspi.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/spi/spi-nxp-fspi.c b/drivers/spi/spi-nxp-fspi.c
+index 1ccda82da2063..158e09470898b 100644
+--- a/drivers/spi/spi-nxp-fspi.c
++++ b/drivers/spi/spi-nxp-fspi.c
+@@ -991,6 +991,7 @@ static int nxp_fspi_probe(struct platform_device *pdev)
+ struct resource *res;
+ struct nxp_fspi *f;
+ int ret;
++ u32 reg;
+
+ ctlr = spi_alloc_master(&pdev->dev, sizeof(*f));
+ if (!ctlr)
+@@ -1017,6 +1018,12 @@ static int nxp_fspi_probe(struct platform_device *pdev)
+ goto err_put_ctrl;
+ }
+
++ /* Clear potential interrupts */
++ reg = fspi_readl(f, f->iobase + FSPI_INTR);
++ if (reg)
++ fspi_writel(f, reg, f->iobase + FSPI_INTR);
++
++
+ /* find the resources - controller memory mapped space */
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "fspi_mmap");
+ if (!res) {
+--
+2.27.0
+
--- /dev/null
+From 35dec46128568a08832b2fb138819dcf089161e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 14:53:31 +0900
+Subject: tools/bootconfig: Fix to check the write failure correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit a995e6bc0524450adfd6181dfdcd9d0520cfaba5 ]
+
+Fix to check the write(2) failure including partial write
+correctly and try to rollback the partial write, because
+if there is no BOOTCONFIG_MAGIC string, we can not remove it.
+
+Link: https://lkml.kernel.org/r/160576521135.320071.3883101436675969998.stgit@devnote2
+
+Fixes: 85c46b78da58 ("bootconfig: Add bootconfig magic word for indicating bootconfig explicitly")
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bootconfig/main.c | 30 ++++++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
+index e0878f5f74b1b..ffd6a358925da 100644
+--- a/tools/bootconfig/main.c
++++ b/tools/bootconfig/main.c
+@@ -274,6 +274,7 @@ static void show_xbc_error(const char *data, const char *msg, int pos)
+
+ int apply_xbc(const char *path, const char *xbc_path)
+ {
++ struct stat stat;
+ u32 size, csum;
+ char *buf, *data;
+ int ret, fd;
+@@ -330,16 +331,26 @@ int apply_xbc(const char *path, const char *xbc_path)
+ return fd;
+ }
+ /* TODO: Ensure the @path is initramfs/initrd image */
++ if (fstat(fd, &stat) < 0) {
++ pr_err("Failed to get the size of %s\n", path);
++ goto out;
++ }
+ ret = write(fd, data, size + 8);
+- if (ret < 0) {
++ if (ret < size + 8) {
++ if (ret < 0)
++ ret = -errno;
+ pr_err("Failed to apply a boot config: %d\n", ret);
+- goto out;
++ if (ret < 0)
++ goto out;
++ goto out_rollback;
+ }
+ /* Write a magic word of the bootconfig */
+ ret = write(fd, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
+- if (ret < 0) {
++ if (ret < BOOTCONFIG_MAGIC_LEN) {
++ if (ret < 0)
++ ret = -errno;
+ pr_err("Failed to apply a boot config magic: %d\n", ret);
+- goto out;
++ goto out_rollback;
+ }
+ ret = 0;
+ out:
+@@ -347,6 +358,17 @@ out:
+ free(data);
+
+ return ret;
++
++out_rollback:
++ /* Map the partial write to -ENOSPC */
++ if (ret >= 0)
++ ret = -ENOSPC;
++ if (ftruncate(fd, stat.st_size) < 0) {
++ ret = -errno;
++ pr_err("Failed to rollback the write error: %d\n", ret);
++ pr_err("The initrd %s may be corrupted. Recommend to rebuild.\n", path);
++ }
++ goto out;
+ }
+
+ int usage(void)
+--
+2.27.0
+
--- /dev/null
+From 80dfb03ba864b7e51be54758016a899d622a75cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 09:30:33 +0100
+Subject: usb: ohci-omap: Fix descriptor conversion
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 45c5775460f32ed8cdb7c16986ae1a2c254346b3 ]
+
+There were a bunch of issues with the patch converting the
+OMAP1 OSK board to use descriptors for controlling the USB
+host:
+
+- The chip label was incorrect
+- The GPIO offset was off-by-one
+- The code should use sleeping accessors
+
+This patch tries to fix all issues at the same time.
+
+Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Fixes: 15d157e87443 ("usb: ohci-omap: Convert to use GPIO descriptors")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20201130083033.29435-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/board-osk.c | 2 +-
+ drivers/usb/host/ohci-omap.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/board-osk.c b/arch/arm/mach-omap1/board-osk.c
+index 144b9caa935c4..a720259099edf 100644
+--- a/arch/arm/mach-omap1/board-osk.c
++++ b/arch/arm/mach-omap1/board-osk.c
+@@ -288,7 +288,7 @@ static struct gpiod_lookup_table osk_usb_gpio_table = {
+ .dev_id = "ohci",
+ .table = {
+ /* Power GPIO on the I2C-attached TPS65010 */
+- GPIO_LOOKUP("i2c-tps65010", 1, "power", GPIO_ACTIVE_HIGH),
++ GPIO_LOOKUP("tps65010", 0, "power", GPIO_ACTIVE_HIGH),
+ GPIO_LOOKUP(OMAP_GPIO_LABEL, 9, "overcurrent",
+ GPIO_ACTIVE_HIGH),
+ },
+diff --git a/drivers/usb/host/ohci-omap.c b/drivers/usb/host/ohci-omap.c
+index 9ccdf2c216b51..6374501ba1390 100644
+--- a/drivers/usb/host/ohci-omap.c
++++ b/drivers/usb/host/ohci-omap.c
+@@ -91,14 +91,14 @@ static int omap_ohci_transceiver_power(struct ohci_omap_priv *priv, int on)
+ | ((1 << 5/*usb1*/) | (1 << 3/*usb2*/)),
+ INNOVATOR_FPGA_CAM_USB_CONTROL);
+ else if (priv->power)
+- gpiod_set_value(priv->power, 0);
++ gpiod_set_value_cansleep(priv->power, 0);
+ } else {
+ if (machine_is_omap_innovator() && cpu_is_omap1510())
+ __raw_writeb(__raw_readb(INNOVATOR_FPGA_CAM_USB_CONTROL)
+ & ~((1 << 5/*usb1*/) | (1 << 3/*usb2*/)),
+ INNOVATOR_FPGA_CAM_USB_CONTROL);
+ else if (priv->power)
+- gpiod_set_value(priv->power, 1);
++ gpiod_set_value_cansleep(priv->power, 1);
+ }
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 6a2d9bf8640b9e7a683469577df9c9d3d0b099a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 13:39:05 -0800
+Subject: vdpa: mlx5: fix vdpa/vhost dependencies
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 98701a2a861fa87a5055cf2809758e8725e8b146 ]
+
+drivers/vdpa/mlx5/ uses vhost_iotlb*() interfaces, so select
+VHOST_IOTLB to make them be built.
+
+However, if VHOST_IOTLB is the only VHOST symbol that is
+set/enabled, the object file still won't be built because
+drivers/Makefile won't descend into drivers/vhost/ to build it,
+so make drivers/Makefile build the needed binary whenever
+VHOST_IOTLB is set, like it does for VHOST_RING.
+
+Fixes these build errors:
+ERROR: modpost: "vhost_iotlb_itree_next" [drivers/vdpa/mlx5/mlx5_vdpa.ko] undefined!
+ERROR: modpost: "vhost_iotlb_itree_first" [drivers/vdpa/mlx5/mlx5_vdpa.ko] undefined!
+
+Fixes: 29064bfdabd5 ("vdpa/mlx5: Add support library for mlx5 VDPA implementation")
+Fixes: aff90770e54c ("vdpa/mlx5: Fix dependency on MLX5_CORE")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Eli Cohen <eli@mellanox.com>
+Cc: Parav Pandit <parav@mellanox.com>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: virtualization@lists.linux-foundation.org
+Cc: Saeed Mahameed <saeedm@nvidia.com>
+Cc: Leon Romanovsky <leonro@nvidia.com>
+Cc: netdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20201128213905.27409-1-rdunlap@infradead.org
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/Makefile | 1 +
+ drivers/vdpa/Kconfig | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/Makefile b/drivers/Makefile
+index c0cd1b9075e3d..5762280377186 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -145,6 +145,7 @@ obj-$(CONFIG_OF) += of/
+ obj-$(CONFIG_SSB) += ssb/
+ obj-$(CONFIG_BCMA) += bcma/
+ obj-$(CONFIG_VHOST_RING) += vhost/
++obj-$(CONFIG_VHOST_IOTLB) += vhost/
+ obj-$(CONFIG_VHOST) += vhost/
+ obj-$(CONFIG_VLYNQ) += vlynq/
+ obj-$(CONFIG_GREYBUS) += greybus/
+diff --git a/drivers/vdpa/Kconfig b/drivers/vdpa/Kconfig
+index 358f6048dd3ce..6caf539091e55 100644
+--- a/drivers/vdpa/Kconfig
++++ b/drivers/vdpa/Kconfig
+@@ -32,6 +32,7 @@ config IFCVF
+
+ config MLX5_VDPA
+ bool
++ select VHOST_IOTLB
+ help
+ Support library for Mellanox VDPA drivers. Provides code that is
+ common for all types of VDPA drivers. The following drivers are planned:
+--
+2.27.0
+
--- /dev/null
+From 7c342fd2254cdfce8804445a40a20116566656a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:26:33 -0500
+Subject: vhost-vdpa: fix page pinning leakage in error path (rework)
+
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+
+[ Upstream commit ad89653f79f1882d55d9df76c9b2b94f008c4e27 ]
+
+Pinned pages are not properly accounted particularly when
+mapping error occurs on IOTLB update. Clean up dangling
+pinned pages for the error path.
+
+The memory usage for bookkeeping pinned pages is reverted
+to what it was before: only one single free page is needed.
+This helps reduce the host memory demand for VM with a large
+amount of memory, or in the situation where host is running
+short of free memory.
+
+Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Link: https://lore.kernel.org/r/1604618793-4681-1-git-send-email-si-wei.liu@oracle.com
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 80 ++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 62 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 676175bd9a679..eed604fe4d215 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -567,6 +567,8 @@ static int vhost_vdpa_map(struct vhost_vdpa *v,
+
+ if (r)
+ vhost_iotlb_del_range(dev->iotlb, iova, iova + size - 1);
++ else
++ atomic64_add(size >> PAGE_SHIFT, &dev->mm->pinned_vm);
+
+ return r;
+ }
+@@ -598,14 +600,16 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
+ unsigned long list_size = PAGE_SIZE / sizeof(struct page *);
+ unsigned int gup_flags = FOLL_LONGTERM;
+ unsigned long npages, cur_base, map_pfn, last_pfn = 0;
+- unsigned long locked, lock_limit, pinned, i;
++ unsigned long lock_limit, sz2pin, nchunks, i;
+ u64 iova = msg->iova;
++ long pinned;
+ int ret = 0;
+
+ if (vhost_iotlb_itree_first(iotlb, msg->iova,
+ msg->iova + msg->size - 1))
+ return -EEXIST;
+
++ /* Limit the use of memory for bookkeeping */
+ page_list = (struct page **) __get_free_page(GFP_KERNEL);
+ if (!page_list)
+ return -ENOMEM;
+@@ -614,52 +618,75 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
+ gup_flags |= FOLL_WRITE;
+
+ npages = PAGE_ALIGN(msg->size + (iova & ~PAGE_MASK)) >> PAGE_SHIFT;
+- if (!npages)
+- return -EINVAL;
++ if (!npages) {
++ ret = -EINVAL;
++ goto free;
++ }
+
+ mmap_read_lock(dev->mm);
+
+- locked = atomic64_add_return(npages, &dev->mm->pinned_vm);
+ lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+-
+- if (locked > lock_limit) {
++ if (npages + atomic64_read(&dev->mm->pinned_vm) > lock_limit) {
+ ret = -ENOMEM;
+- goto out;
++ goto unlock;
+ }
+
+ cur_base = msg->uaddr & PAGE_MASK;
+ iova &= PAGE_MASK;
++ nchunks = 0;
+
+ while (npages) {
+- pinned = min_t(unsigned long, npages, list_size);
+- ret = pin_user_pages(cur_base, pinned,
+- gup_flags, page_list, NULL);
+- if (ret != pinned)
++ sz2pin = min_t(unsigned long, npages, list_size);
++ pinned = pin_user_pages(cur_base, sz2pin,
++ gup_flags, page_list, NULL);
++ if (sz2pin != pinned) {
++ if (pinned < 0) {
++ ret = pinned;
++ } else {
++ unpin_user_pages(page_list, pinned);
++ ret = -ENOMEM;
++ }
+ goto out;
++ }
++ nchunks++;
+
+ if (!last_pfn)
+ map_pfn = page_to_pfn(page_list[0]);
+
+- for (i = 0; i < ret; i++) {
++ for (i = 0; i < pinned; i++) {
+ unsigned long this_pfn = page_to_pfn(page_list[i]);
+ u64 csize;
+
+ if (last_pfn && (this_pfn != last_pfn + 1)) {
+ /* Pin a contiguous chunk of memory */
+ csize = (last_pfn - map_pfn + 1) << PAGE_SHIFT;
+- if (vhost_vdpa_map(v, iova, csize,
+- map_pfn << PAGE_SHIFT,
+- msg->perm))
++ ret = vhost_vdpa_map(v, iova, csize,
++ map_pfn << PAGE_SHIFT,
++ msg->perm);
++ if (ret) {
++ /*
++ * Unpin the pages that are left unmapped
++ * from this point on in the current
++ * page_list. The remaining outstanding
++ * ones which may stride across several
++ * chunks will be covered in the common
++ * error path subsequently.
++ */
++ unpin_user_pages(&page_list[i],
++ pinned - i);
+ goto out;
++ }
++
+ map_pfn = this_pfn;
+ iova += csize;
++ nchunks = 0;
+ }
+
+ last_pfn = this_pfn;
+ }
+
+- cur_base += ret << PAGE_SHIFT;
+- npages -= ret;
++ cur_base += pinned << PAGE_SHIFT;
++ npages -= pinned;
+ }
+
+ /* Pin the rest chunk */
+@@ -667,10 +694,27 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v,
+ map_pfn << PAGE_SHIFT, msg->perm);
+ out:
+ if (ret) {
++ if (nchunks) {
++ unsigned long pfn;
++
++ /*
++ * Unpin the outstanding pages which are yet to be
++ * mapped but haven't due to vdpa_map() or
++ * pin_user_pages() failure.
++ *
++ * Mapped pages are accounted in vdpa_map(), hence
++ * the corresponding unpinning will be handled by
++ * vdpa_unmap().
++ */
++ WARN_ON(!last_pfn);
++ for (pfn = map_pfn; pfn <= last_pfn; pfn++)
++ unpin_user_page(pfn_to_page(pfn));
++ }
+ vhost_vdpa_unmap(v, msg->iova, msg->size);
+- atomic64_sub(npages, &dev->mm->pinned_vm);
+ }
++unlock:
+ mmap_read_unlock(dev->mm);
++free:
+ free_page((unsigned long)page_list);
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From b6a70749fa81e1cc30dfa77823b8122797d61581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 22:14:38 -0800
+Subject: zlib: export S390 symbols for zlib modules
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 11fb479ff5d9872ddff02dd533c16d60372c86b2 ]
+
+Fix build errors when ZLIB_INFLATE=m and ZLIB_DEFLATE=m and ZLIB_DFLTCC=y
+by exporting the 2 needed symbols in dfltcc_inflate.c.
+
+Fixes these build errors:
+
+ ERROR: modpost: "dfltcc_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined!
+ ERROR: modpost: "dfltcc_can_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined!
+
+Fixes: 126196100063 ("lib/zlib: add s390 hardware support for kernel zlib_inflate")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Cc: Mikhail Zaslonko <zaslonko@linux.ibm.com>
+Cc: Heiko Carstens <hca@linux.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Cc: Christian Borntraeger <borntraeger@de.ibm.com>
+Link: https://lkml.kernel.org/r/20201123191712.4882-1-rdunlap@infradead.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/zlib_dfltcc/dfltcc_inflate.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/zlib_dfltcc/dfltcc_inflate.c b/lib/zlib_dfltcc/dfltcc_inflate.c
+index aa9ef23474df0..db107016d29b3 100644
+--- a/lib/zlib_dfltcc/dfltcc_inflate.c
++++ b/lib/zlib_dfltcc/dfltcc_inflate.c
+@@ -4,6 +4,7 @@
+ #include "dfltcc_util.h"
+ #include "dfltcc.h"
+ #include <asm/setup.h>
++#include <linux/export.h>
+ #include <linux/zutil.h>
+
+ /*
+@@ -29,6 +30,7 @@ int dfltcc_can_inflate(
+ return is_bit_set(dfltcc_state->af.fns, DFLTCC_XPND) &&
+ is_bit_set(dfltcc_state->af.fmts, DFLTCC_FMT0);
+ }
++EXPORT_SYMBOL(dfltcc_can_inflate);
+
+ static int dfltcc_was_inflate_used(
+ z_streamp strm
+@@ -147,3 +149,4 @@ dfltcc_inflate_action dfltcc_inflate(
+ return (cc == DFLTCC_CC_OP1_TOO_SHORT || cc == DFLTCC_CC_OP2_TOO_SHORT) ?
+ DFLTCC_INFLATE_BREAK : DFLTCC_INFLATE_CONTINUE;
+ }
++EXPORT_SYMBOL(dfltcc_inflate);
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
