--- /dev/null
+From 64ab3a0e2d5ffc06aa76f8d16cd7ba3f43d4712a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 19:35:25 +0800
+Subject: ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit ee61cfd955a64a58ed35cbcfc54068fcbd486945 ]
+
+It adds a stub acpi_create_platform_device() for !CONFIG_ACPI build, so
+that caller doesn't have to deal with !CONFIG_ACPI build issue.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/acpi.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 39263c6b52e1a..5b1dc1ad4fb32 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -885,6 +885,13 @@ static inline int acpi_device_modalias(struct device *dev,
+ return -ENODEV;
+ }
+
++static inline struct platform_device *
++acpi_create_platform_device(struct acpi_device *adev,
++ struct property_entry *properties)
++{
++ return NULL;
++}
++
+ static inline bool acpi_dma_supported(struct acpi_device *adev)
+ {
+ return false;
+--
+2.27.0
+
--- /dev/null
+From 3b7ac0fe76824cc774143bad184eb90510840f1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 04:36:54 +0900
+Subject: ARC: build: add boot_targets to PHONY
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 0cfccb3c04934cdef42ae26042139f16e805b5f7 ]
+
+The top-level boot_targets (uImage and uImage.*) should be phony
+targets. They just let Kbuild descend into arch/arc/boot/ and create
+files there.
+
+If a file exists in the top directory with the same name, the boot
+image will not be created.
+
+You can confirm it by the following steps:
+
+ $ export CROSS_COMPILE=<your-arc-compiler-prefix>
+ $ make -s ARCH=arc defconfig all # vmlinux will be built
+ $ touch uImage.gz
+ $ make ARCH=arc uImage.gz
+ CALL scripts/atomic/check-atomics.sh
+ CALL scripts/checksyscalls.sh
+ CHK include/generated/compile.h
+ # arch/arc/boot/uImage.gz is not created
+
+Specify the targets as PHONY to fix this.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 61a41123ad4c4..cf9da9aea12ac 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -104,6 +104,7 @@ boot := arch/arc/boot
+
+ boot_targets := uImage uImage.bin uImage.gz uImage.lzma
+
++PHONY += $(boot_targets)
+ $(boot_targets): vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
+--
+2.27.0
+
--- /dev/null
+From 2f405cc196e21a4f0064d1794b8747d35fb648e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 04:36:53 +0900
+Subject: ARC: build: add uImage.lzma to the top-level target
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit f2712ec76a5433e5ec9def2bd52a95df1f96d050 ]
+
+arch/arc/boot/Makefile supports uImage.lzma, but you cannot do
+'make uImage.lzma' because the corresponding target is missing
+in arch/arc/Makefile. Add it.
+
+I also changed the assignment operator '+=' to ':=' since this is the
+only place where we expect this variable to be set.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index acf99420e161d..61a41123ad4c4 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -102,7 +102,7 @@ libs-y += arch/arc/lib/ $(LIBGCC)
+
+ boot := arch/arc/boot
+
+-boot_targets += uImage uImage.bin uImage.gz
++boot_targets := uImage uImage.bin uImage.gz uImage.lzma
+
+ $(boot_targets): vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+--
+2.27.0
+
--- /dev/null
+From 959fb447e8b1c2830b2525dc1475295b172c6dca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 04:36:55 +0900
+Subject: ARC: build: move symlink creation to arch/arc/Makefile to avoid race
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit c5e6ae563c802c4d828d42e134af64004db2e58c ]
+
+If you run 'make uImage uImage.gz' with the parallel option, uImage.gz
+will be created by two threads simultaneously.
+
+This is because arch/arc/Makefile does not specify the dependency
+between uImage and uImage.gz. Hence, GNU Make assumes they can be
+built in parallel. One thread descends into arch/arc/boot/ to create
+uImage, and another to create uImage.gz.
+
+Please notice the same log is displayed twice in the following steps:
+
+ $ export CROSS_COMPILE=<your-arc-compiler-prefix>
+ $ make -s ARCH=arc defconfig
+ $ make -j$(nproc) ARCH=arc uImage uImage.gz
+ [ snip ]
+ LD vmlinux
+ SORTTAB vmlinux
+ SYSMAP System.map
+ OBJCOPY arch/arc/boot/vmlinux.bin
+ OBJCOPY arch/arc/boot/vmlinux.bin
+ GZIP arch/arc/boot/vmlinux.bin.gz
+ GZIP arch/arc/boot/vmlinux.bin.gz
+ UIMAGE arch/arc/boot/uImage.gz
+ UIMAGE arch/arc/boot/uImage.gz
+ Image Name: Linux-5.10.0-rc4-00003-g62f23044
+ Created: Sun Nov 22 02:52:26 2020
+ Image Type: ARC Linux Kernel Image (gzip compressed)
+ Data Size: 2109376 Bytes = 2059.94 KiB = 2.01 MiB
+ Load Address: 80000000
+ Entry Point: 80004000
+ Image arch/arc/boot/uImage is ready
+ Image Name: Linux-5.10.0-rc4-00003-g62f23044
+ Created: Sun Nov 22 02:52:26 2020
+ Image Type: ARC Linux Kernel Image (gzip compressed)
+ Data Size: 2815455 Bytes = 2749.47 KiB = 2.69 MiB
+ Load Address: 80000000
+ Entry Point: 80004000
+
+This is a race between the two threads trying to write to the same file
+arch/arc/boot/uImage.gz. This is a potential problem that can generate
+a broken file.
+
+I fixed a similar problem for ARM by commit 3939f3345050 ("ARM: 8418/1:
+add boot image dependencies to not generate invalid images").
+
+I highly recommend to avoid such build rules that cause a race condition.
+
+Move the uImage rule to arch/arc/Makefile.
+
+Another strangeness is that arch/arc/boot/Makefile compares the
+timestamps between $(obj)/uImage and $(obj)/uImage.*:
+
+ $(obj)/uImage: $(obj)/uImage.$(suffix-y)
+ @ln -sf $(notdir $<) $@
+ @echo ' Image $@ is ready'
+
+This does not work as expected since $(obj)/uImage is a symlink.
+The symlink should be created in a phony target rule.
+
+I used $(kecho) instead of echo to suppress the message
+'Image arch/arc/boot/uImage is ready' when the -s option is given.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/Makefile | 13 ++++++++++++-
+ arch/arc/boot/Makefile | 11 +----------
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index cf9da9aea12ac..578bdbbb0fa7f 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -102,11 +102,22 @@ libs-y += arch/arc/lib/ $(LIBGCC)
+
+ boot := arch/arc/boot
+
+-boot_targets := uImage uImage.bin uImage.gz uImage.lzma
++boot_targets := uImage.bin uImage.gz uImage.lzma
+
+ PHONY += $(boot_targets)
+ $(boot_targets): vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
+
++uimage-default-y := uImage.bin
++uimage-default-$(CONFIG_KERNEL_GZIP) := uImage.gz
++uimage-default-$(CONFIG_KERNEL_LZMA) := uImage.lzma
++
++PHONY += uImage
++uImage: $(uimage-default-y)
++ @ln -sf $< $(boot)/uImage
++ @$(kecho) ' Image $(boot)/uImage is ready'
++
++CLEAN_FILES += $(boot)/uImage
++
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+diff --git a/arch/arc/boot/Makefile b/arch/arc/boot/Makefile
+index 538b92f4dd253..3b1f8a69a89ef 100644
+--- a/arch/arc/boot/Makefile
++++ b/arch/arc/boot/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-targets := vmlinux.bin vmlinux.bin.gz uImage
++targets := vmlinux.bin vmlinux.bin.gz
+
+ # uImage build relies on mkimage being availble on your host for ARC target
+ # You will need to build u-boot for ARC, rename mkimage to arc-elf32-mkimage
+@@ -13,11 +13,6 @@ LINUX_START_TEXT = $$(readelf -h vmlinux | \
+ UIMAGE_LOADADDR = $(CONFIG_LINUX_LINK_BASE)
+ UIMAGE_ENTRYADDR = $(LINUX_START_TEXT)
+
+-suffix-y := bin
+-suffix-$(CONFIG_KERNEL_GZIP) := gz
+-suffix-$(CONFIG_KERNEL_LZMA) := lzma
+-
+-targets += uImage
+ targets += uImage.bin
+ targets += uImage.gz
+ targets += uImage.lzma
+@@ -42,7 +37,3 @@ $(obj)/uImage.gz: $(obj)/vmlinux.bin.gz FORCE
+
+ $(obj)/uImage.lzma: $(obj)/vmlinux.bin.lzma FORCE
+ $(call if_changed,uimage,lzma)
+-
+-$(obj)/uImage: $(obj)/uImage.$(suffix-y)
+- @ln -sf $(notdir $<) $@
+- @echo ' Image $@ is ready'
+--
+2.27.0
+
--- /dev/null
+From 7cc49fbc06b17fc4a0ca6f24cf5f1929a24dd1a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 04:36:52 +0900
+Subject: ARC: build: remove non-existing bootpImage from KBUILD_IMAGE
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 9836720911cfec25d3fbdead1c438bf87e0f2841 ]
+
+The deb-pkg builds for ARCH=arc fail.
+
+ $ export CROSS_COMPILE=<your-arc-compiler-prefix>
+ $ make -s ARCH=arc defconfig
+ $ make ARCH=arc bindeb-pkg
+ SORTTAB vmlinux
+ SYSMAP System.map
+ MODPOST Module.symvers
+ make KERNELRELEASE=5.10.0-rc4 ARCH=arc KBUILD_BUILD_VERSION=2 -f ./Makefile intdeb-pkg
+ sh ./scripts/package/builddeb
+ cp: cannot stat 'arch/arc/boot/bootpImage': No such file or directory
+ make[4]: *** [scripts/Makefile.package:87: intdeb-pkg] Error 1
+ make[3]: *** [Makefile:1527: intdeb-pkg] Error 2
+ make[2]: *** [debian/rules:13: binary-arch] Error 2
+ dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
+ make[1]: *** [scripts/Makefile.package:83: bindeb-pkg] Error 2
+ make: *** [Makefile:1527: bindeb-pkg] Error 2
+
+The reason is obvious; arch/arc/Makefile sets $(boot)/bootpImage as
+the default image, but there is no rule to build it.
+
+Remove the meaningless KBUILD_IMAGE assignment so it will fallback
+to the default vmlinux. With this change, you can build the deb package.
+
+I removed the 'bootpImage' target as well. At best, it provides
+'make bootpImage' as an alias of 'make vmlinux', but I do not see
+much sense in doing so.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/Makefile | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 0c6bf0d1df7ad..acf99420e161d 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -102,12 +102,6 @@ libs-y += arch/arc/lib/ $(LIBGCC)
+
+ boot := arch/arc/boot
+
+-#default target for make without any arguments.
+-KBUILD_IMAGE := $(boot)/bootpImage
+-
+-all: bootpImage
+-bootpImage: vmlinux
+-
+ boot_targets += uImage uImage.bin uImage.gz
+
+ $(boot_targets): vmlinux
+--
+2.27.0
+
--- /dev/null
+From 725d93ec1b5fa936fe3187c611ff07789f0e52b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 19:44:53 -0800
+Subject: arch/arc: add copy_user_page() to <asm/page.h> to fix build error on
+ ARC
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 8a48c0a3360bf2bf4f40c980d0ec216e770e58ee ]
+
+fs/dax.c uses copy_user_page() but ARC does not provide that interface,
+resulting in a build error.
+
+Provide copy_user_page() in <asm/page.h>.
+
+../fs/dax.c: In function 'copy_cow_page_dax':
+../fs/dax.c:702:2: error: implicit declaration of function 'copy_user_page'; did you mean 'copy_to_user_page'? [-Werror=implicit-function-declaration]
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Vineet Gupta <vgupta@synopsys.com>
+Cc: linux-snps-arc@lists.infradead.org
+Cc: Dan Williams <dan.j.williams@intel.com>
+#Acked-by: Vineet Gupta <vgupta@synopsys.com> # v1
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Jan Kara <jack@suse.cz>
+Cc: linux-fsdevel@vger.kernel.org
+Cc: linux-nvdimm@lists.01.org
+#Reviewed-by: Ira Weiny <ira.weiny@intel.com> # v2
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/page.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
+index b0dfed0f12be0..d9c264dc25fcb 100644
+--- a/arch/arc/include/asm/page.h
++++ b/arch/arc/include/asm/page.h
+@@ -10,6 +10,7 @@
+ #ifndef __ASSEMBLY__
+
+ #define clear_page(paddr) memset((paddr), 0, PAGE_SIZE)
++#define copy_user_page(to, from, vaddr, pg) copy_page(to, from)
+ #define copy_page(to, from) memcpy((to), (from), PAGE_SIZE)
+
+ struct vm_area_struct;
+--
+2.27.0
+
--- /dev/null
+From fd172fe81ebbb3ef03a165b98aee3f7343577cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 23:34:13 +0100
+Subject: ARM: dts: ux500/golden: Set display max brightness
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 7887cc89d5851cbdec49219e9614beec776af150 ]
+
+A too high brightness by default (default is max) makes the
+screen go blank. Set this to 15 as in the Vendor tree.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20201214223413.253893-1-linus.walleij@linaro.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ste-ux500-samsung-golden.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/ste-ux500-samsung-golden.dts b/arch/arm/boot/dts/ste-ux500-samsung-golden.dts
+index a1093cb37dc7a..aed1f2d5f2467 100644
+--- a/arch/arm/boot/dts/ste-ux500-samsung-golden.dts
++++ b/arch/arm/boot/dts/ste-ux500-samsung-golden.dts
+@@ -326,6 +326,7 @@
+ panel@0 {
+ compatible = "samsung,s6e63m0";
+ reg = <0>;
++ max-brightness = <15>;
+ vdd3-supply = <&panel_reg_3v0>;
+ vci-supply = <&panel_reg_1v8>;
+ reset-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>;
+--
+2.27.0
+
--- /dev/null
+From b46c47091566d566cffa17b8f4b82e4fe11913a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 20:58:01 +0100
+Subject: ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with
+ defaults on xt875
+
+From: Carl Philipp Klemm <philipp@uvos.xyz>
+
+[ Upstream commit c0bc969c176b10598b31d5d1a5edf9a5261f0a9f ]
+
+xt875 comes up with a iva voltage of 1375000 and android runs at this too. fix
+maximum voltage to be consistent with this.
+
+Signed-off-by: Carl Philipp Klemm <philipp@uvos.xyz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pmic-cpcap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/pmic-cpcap.c b/arch/arm/mach-omap2/pmic-cpcap.c
+index eab281a5fc9f7..09076ad0576d9 100644
+--- a/arch/arm/mach-omap2/pmic-cpcap.c
++++ b/arch/arm/mach-omap2/pmic-cpcap.c
+@@ -71,7 +71,7 @@ static struct omap_voltdm_pmic omap_cpcap_iva = {
+ .vp_vstepmin = OMAP4_VP_VSTEPMIN_VSTEPMIN,
+ .vp_vstepmax = OMAP4_VP_VSTEPMAX_VSTEPMAX,
+ .vddmin = 900000,
+- .vddmax = 1350000,
++ .vddmax = 1375000,
+ .vp_timeout_us = OMAP4_VP_VLIMITTO_TIMEOUT_US,
+ .i2c_slave_addr = 0x44,
+ .volt_reg_addr = 0x0,
+--
+2.27.0
+
--- /dev/null
+From bd7711f461d28f1adcad264c0b76bf6875171142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 16:20:05 +0100
+Subject: ARM: picoxcell: fix missing interrupt-parent properties
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bac717171971176b78c72d15a8b6961764ab197f ]
+
+dtc points out that the interrupts for some devices are not parsable:
+
+picoxcell-pc3x2.dtsi:45.19-49.5: Warning (interrupts_property): /paxi/gem@30000: Missing interrupt-parent
+picoxcell-pc3x2.dtsi:51.21-55.5: Warning (interrupts_property): /paxi/dmac@40000: Missing interrupt-parent
+picoxcell-pc3x2.dtsi:57.21-61.5: Warning (interrupts_property): /paxi/dmac@50000: Missing interrupt-parent
+picoxcell-pc3x2.dtsi:233.21-237.5: Warning (interrupts_property): /rwid-axi/axi2pico@c0000000: Missing interrupt-parent
+
+There are two VIC instances, so it's not clear which one needs to be
+used. I found the BSP sources that reference VIC0, so use that:
+
+https://github.com/r1mikey/meta-picoxcell/blob/master/recipes-kernel/linux/linux-picochip-3.0/0001-picoxcell-support-for-Picochip-picoXcell-SoC.patch
+
+Acked-by: Jamie Iles <jamie@jamieiles.com>
+Link: https://lore.kernel.org/r/20201230152010.3914962-1-arnd@kernel.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
+index c4c6c7e9e37b6..5898879a3038e 100644
+--- a/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
++++ b/arch/arm/boot/dts/picoxcell-pc3x2.dtsi
+@@ -45,18 +45,21 @@
+ emac: gem@30000 {
+ compatible = "cadence,gem";
+ reg = <0x30000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <31>;
+ };
+
+ dmac1: dmac@40000 {
+ compatible = "snps,dw-dmac";
+ reg = <0x40000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <25>;
+ };
+
+ dmac2: dmac@50000 {
+ compatible = "snps,dw-dmac";
+ reg = <0x50000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <26>;
+ };
+
+@@ -233,6 +236,7 @@
+ axi2pico@c0000000 {
+ compatible = "picochip,axi2pico-pc3x2";
+ reg = <0xc0000000 0x10000>;
++ interrupt-parent = <&vic0>;
+ interrupts = <13 14 15 16 17 18 19 20 21>;
+ };
+ };
+--
+2.27.0
+
--- /dev/null
+From ab0ca1b71da72c88fe55beaa6e46b70f6768e9d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 00:56:13 -0500
+Subject: ath11k: fix crash caused by NULL rx_channel
+
+From: Carl Huang <cjhuang@codeaurora.org>
+
+[ Upstream commit 3597010630d0aa96f5778901e691c6068bb86318 ]
+
+During connect and disconnect stress test, crashed happened
+because ar->rx_channel is NULL. Fix it by checking whether
+ar->rx_channel is NULL.
+
+Crash stack is as below:
+RIP: 0010:ath11k_dp_rx_h_ppdu+0x110/0x230 [ath11k]
+[ 5028.808963] ath11k_dp_rx_wbm_err+0x14a/0x360 [ath11k]
+[ 5028.808970] ath11k_dp_rx_process_wbm_err+0x41c/0x520 [ath11k]
+[ 5028.808978] ath11k_dp_service_srng+0x25e/0x2d0 [ath11k]
+[ 5028.808982] ath11k_pci_ext_grp_napi_poll+0x23/0x80 [ath11k_pci]
+[ 5028.808986] net_rx_action+0x27e/0x400
+[ 5028.808990] __do_softirq+0xfd/0x2bb
+[ 5028.808993] irq_exit+0xa6/0xb0
+[ 5028.808995] do_IRQ+0x56/0xe0
+[ 5028.808997] common_interrupt+0xf/0xf
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201211055613.9310-1-cjhuang@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/dp_rx.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
+index 01625327eef7c..3638501a09593 100644
+--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
++++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
+@@ -2272,6 +2272,7 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
+ {
+ u8 channel_num;
+ u32 center_freq;
++ struct ieee80211_channel *channel;
+
+ rx_status->freq = 0;
+ rx_status->rate_idx = 0;
+@@ -2292,9 +2293,12 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
+ rx_status->band = NL80211_BAND_5GHZ;
+ } else {
+ spin_lock_bh(&ar->data_lock);
+- rx_status->band = ar->rx_channel->band;
+- channel_num =
+- ieee80211_frequency_to_channel(ar->rx_channel->center_freq);
++ channel = ar->rx_channel;
++ if (channel) {
++ rx_status->band = channel->band;
++ channel_num =
++ ieee80211_frequency_to_channel(channel->center_freq);
++ }
+ spin_unlock_bh(&ar->data_lock);
+ ath11k_dbg_dump(ar->ab, ATH11K_DBG_DATA, NULL, "rx_desc: ",
+ rx_desc, sizeof(struct hal_rx_desc));
+--
+2.27.0
+
--- /dev/null
+From a31d0de20ab308df6bdc26f798eaa02f9dcd43e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 09:04:57 +0200
+Subject: ath11k: qmi: try to allocate a big block of DMA memory first
+
+From: Carl Huang <cjhuang@codeaurora.org>
+
+[ Upstream commit f6f92968e1e5a7a9d211faaebefc26ebe408dad7 ]
+
+Not all firmware versions support allocating DMA memory in smaller blocks so
+first try to allocate big block of DMA memory for QMI. If the allocation fails,
+let firmware request multiple blocks of DMA memory with smaller size.
+
+This also fixes an unnecessary error message seen during ath11k probe on
+QCA6390:
+
+ath11k_pci 0000:06:00.0: Respond mem req failed, result: 1, err: 0
+ath11k_pci 0000:06:00.0: qmi failed to respond fw mem req:-22
+
+Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
+
+Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1608127593-15192-1-git-send-email-kvalo@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/qmi.c | 24 ++++++++++++++++++++++--
+ drivers/net/wireless/ath/ath11k/qmi.h | 1 +
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
+index 99a88ca83deaa..2ae7c6bf091e9 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.c
++++ b/drivers/net/wireless/ath/ath11k/qmi.c
+@@ -1654,6 +1654,7 @@ static int ath11k_qmi_respond_fw_mem_request(struct ath11k_base *ab)
+ struct qmi_wlanfw_respond_mem_resp_msg_v01 resp;
+ struct qmi_txn txn = {};
+ int ret = 0, i;
++ bool delayed;
+
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+ if (!req)
+@@ -1666,11 +1667,13 @@ static int ath11k_qmi_respond_fw_mem_request(struct ath11k_base *ab)
+ * failure to FW and FW will then request mulitple blocks of small
+ * chunk size memory.
+ */
+- if (!ab->bus_params.fixed_mem_region && ab->qmi.mem_seg_count <= 2) {
++ if (!ab->bus_params.fixed_mem_region && ab->qmi.target_mem_delayed) {
++ delayed = true;
+ ath11k_dbg(ab, ATH11K_DBG_QMI, "qmi delays mem_request %d\n",
+ ab->qmi.mem_seg_count);
+ memset(req, 0, sizeof(*req));
+ } else {
++ delayed = false;
+ req->mem_seg_len = ab->qmi.mem_seg_count;
+
+ for (i = 0; i < req->mem_seg_len ; i++) {
+@@ -1702,6 +1705,12 @@ static int ath11k_qmi_respond_fw_mem_request(struct ath11k_base *ab)
+ }
+
+ if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
++ /* the error response is expected when
++ * target_mem_delayed is true.
++ */
++ if (delayed && resp.resp.error == 0)
++ goto out;
++
+ ath11k_warn(ab, "Respond mem req failed, result: %d, err: %d\n",
+ resp.resp.result, resp.resp.error);
+ ret = -EINVAL;
+@@ -1736,6 +1745,8 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab)
+ int i;
+ struct target_mem_chunk *chunk;
+
++ ab->qmi.target_mem_delayed = false;
++
+ for (i = 0; i < ab->qmi.mem_seg_count; i++) {
+ chunk = &ab->qmi.target_mem[i];
+ chunk->vaddr = dma_alloc_coherent(ab->dev,
+@@ -1743,6 +1754,15 @@ static int ath11k_qmi_alloc_target_mem_chunk(struct ath11k_base *ab)
+ &chunk->paddr,
+ GFP_KERNEL);
+ if (!chunk->vaddr) {
++ if (ab->qmi.mem_seg_count <= 2) {
++ ath11k_dbg(ab, ATH11K_DBG_QMI,
++ "qmi dma allocation failed (%d B type %u), will try later with small size\n",
++ chunk->size,
++ chunk->type);
++ ath11k_qmi_free_target_mem_chunk(ab);
++ ab->qmi.target_mem_delayed = true;
++ return 0;
++ }
+ ath11k_err(ab, "failed to alloc memory, size: 0x%x, type: %u\n",
+ chunk->size,
+ chunk->type);
+@@ -2467,7 +2487,7 @@ static void ath11k_qmi_msg_mem_request_cb(struct qmi_handle *qmi_hdl,
+ ret);
+ return;
+ }
+- } else if (msg->mem_seg_len > 2) {
++ } else {
+ ret = ath11k_qmi_alloc_target_mem_chunk(ab);
+ if (ret) {
+ ath11k_warn(ab, "qmi failed to alloc target memory: %d\n",
+diff --git a/drivers/net/wireless/ath/ath11k/qmi.h b/drivers/net/wireless/ath/ath11k/qmi.h
+index b0a818f0401b9..59f1452b3544c 100644
+--- a/drivers/net/wireless/ath/ath11k/qmi.h
++++ b/drivers/net/wireless/ath/ath11k/qmi.h
+@@ -121,6 +121,7 @@ struct ath11k_qmi {
+ struct target_mem_chunk target_mem[ATH11K_QMI_WLANFW_MAX_NUM_MEM_SEG_V01];
+ u32 mem_seg_count;
+ u32 target_mem_mode;
++ bool target_mem_delayed;
+ u8 cal_done;
+ struct target_info target;
+ struct m3_mem_region m3_mem;
+--
+2.27.0
+
--- /dev/null
+From 64d9125d5ae02f63a5f4a20a1026de5d6df5ed4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 10:44:33 +0100
+Subject: bfq: Fix computation of shallow depth
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 6d4d273588378c65915acaf7b2ee74e9dd9c130a ]
+
+BFQ computes number of tags it allows to be allocated for each request type
+based on tag bitmap. However it uses 1 << bitmap.shift as number of
+available tags which is wrong. 'shift' is just an internal bitmap value
+containing logarithm of how many bits bitmap uses in each bitmap word.
+Thus number of tags allowed for some request types can be far to low.
+Use proper bitmap.depth which has the number of tags instead.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 9e81d1052091f..9e4eb0fc1c16e 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -6332,13 +6332,13 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * limit 'something'.
+ */
+ /* no more than 50% of tags for async I/O */
+- bfqd->word_depths[0][0] = max((1U << bt->sb.shift) >> 1, 1U);
++ bfqd->word_depths[0][0] = max(bt->sb.depth >> 1, 1U);
+ /*
+ * no more than 75% of tags for sync writes (25% extra tags
+ * w.r.t. async I/O, to prevent async I/O from starving sync
+ * writes)
+ */
+- bfqd->word_depths[0][1] = max(((1U << bt->sb.shift) * 3) >> 2, 1U);
++ bfqd->word_depths[0][1] = max((bt->sb.depth * 3) >> 2, 1U);
+
+ /*
+ * In-word depths in case some bfq_queue is being weight-
+@@ -6348,9 +6348,9 @@ static unsigned int bfq_update_depths(struct bfq_data *bfqd,
+ * shortage.
+ */
+ /* no more than ~18% of tags for async I/O */
+- bfqd->word_depths[1][0] = max(((1U << bt->sb.shift) * 3) >> 4, 1U);
++ bfqd->word_depths[1][0] = max((bt->sb.depth * 3) >> 4, 1U);
+ /* no more than ~37% of tags for sync writes (~20% extra tags) */
+- bfqd->word_depths[1][1] = max(((1U << bt->sb.shift) * 6) >> 4, 1U);
++ bfqd->word_depths[1][1] = max((bt->sb.depth * 6) >> 4, 1U);
+
+ for (i = 0; i < 2; i++)
+ for (j = 0; j < 2; j++)
+--
+2.27.0
+
--- /dev/null
+From 7d10dfc4e455d775beb15b2c106b041ff48c80b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 15:56:20 +0000
+Subject: btrfs: fix async discard stall
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit ea9ed87c73e87e044b2c58d658eb4ba5216bc488 ]
+
+Might happen that bg->discard_eligible_time was changed without
+rescheduling, so btrfs_discard_workfn() wakes up earlier than that new
+time, peek_discard_list() returns NULL, and all work halts and goes to
+sleep without further rescheduling even there are block groups to
+discard.
+
+It happens pretty often, but not so visible from the userspace because
+after some time it usually will be kicked off anyway by someone else
+calling btrfs_discard_reschedule_work().
+
+Fix it by continue rescheduling if block group discard lists are not
+empty.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/discard.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c
+index 741c7e19c32f2..d1a5380e8827d 100644
+--- a/fs/btrfs/discard.c
++++ b/fs/btrfs/discard.c
+@@ -199,16 +199,15 @@ static struct btrfs_block_group *find_next_block_group(
+ static struct btrfs_block_group *peek_discard_list(
+ struct btrfs_discard_ctl *discard_ctl,
+ enum btrfs_discard_state *discard_state,
+- int *discard_index)
++ int *discard_index, u64 now)
+ {
+ struct btrfs_block_group *block_group;
+- const u64 now = ktime_get_ns();
+
+ spin_lock(&discard_ctl->lock);
+ again:
+ block_group = find_next_block_group(discard_ctl, now);
+
+- if (block_group && now > block_group->discard_eligible_time) {
++ if (block_group && now >= block_group->discard_eligible_time) {
+ if (block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED &&
+ block_group->used != 0) {
+ if (btrfs_is_block_group_data_only(block_group))
+@@ -222,12 +221,11 @@ again:
+ block_group->discard_state = BTRFS_DISCARD_EXTENTS;
+ }
+ discard_ctl->block_group = block_group;
++ }
++ if (block_group) {
+ *discard_state = block_group->discard_state;
+ *discard_index = block_group->discard_index;
+- } else {
+- block_group = NULL;
+ }
+-
+ spin_unlock(&discard_ctl->lock);
+
+ return block_group;
+@@ -429,13 +427,18 @@ static void btrfs_discard_workfn(struct work_struct *work)
+ int discard_index = 0;
+ u64 trimmed = 0;
+ u64 minlen = 0;
++ u64 now = ktime_get_ns();
+
+ discard_ctl = container_of(work, struct btrfs_discard_ctl, work.work);
+
+ block_group = peek_discard_list(discard_ctl, &discard_state,
+- &discard_index);
++ &discard_index, now);
+ if (!block_group || !btrfs_run_discard_work(discard_ctl))
+ return;
++ if (now < block_group->discard_eligible_time) {
++ btrfs_discard_schedule_work(discard_ctl, false);
++ return;
++ }
+
+ /* Perform discarding */
+ minlen = discard_minlen[discard_index];
+--
+2.27.0
+
--- /dev/null
+From a891167ddec54d6fcab271cc961cdd4e8ea21607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 10:10:45 +0000
+Subject: btrfs: fix transaction leak and crash after RO remount caused by
+ qgroup rescan
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit cb13eea3b49055bd78e6ddf39defd6340f7379fc ]
+
+If we remount a filesystem in RO mode while the qgroup rescan worker is
+running, we can end up having it still running after the remount is done,
+and at unmount time we may end up with an open transaction that ends up
+never getting committed. If that happens we end up with several memory
+leaks and can crash when hardware acceleration is unavailable for crc32c.
+Possibly it can lead to other nasty surprises too, due to use-after-free
+issues.
+
+The following steps explain how the problem happens.
+
+1) We have a filesystem mounted in RW mode and the qgroup rescan worker is
+ running;
+
+2) We remount the filesystem in RO mode, and never stop/pause the rescan
+ worker, so after the remount the rescan worker is still running. The
+ important detail here is that the rescan task is still running after
+ the remount operation committed any ongoing transaction through its
+ call to btrfs_commit_super();
+
+3) The rescan is still running, and after the remount completed, the
+ rescan worker started a transaction, after it finished iterating all
+ leaves of the extent tree, to update the qgroup status item in the
+ quotas tree. It does not commit the transaction, it only releases its
+ handle on the transaction;
+
+4) A filesystem unmount operation starts shortly after;
+
+5) The unmount task, at close_ctree(), stops the transaction kthread,
+ which had not had a chance to commit the open transaction since it was
+ sleeping and the commit interval (default of 30 seconds) has not yet
+ elapsed since the last time it committed a transaction;
+
+6) So after stopping the transaction kthread we still have the transaction
+ used to update the qgroup status item open. At close_ctree(), when the
+ filesystem is in RO mode and no transaction abort happened (or the
+ filesystem is in error mode), we do not expect to have any transaction
+ open, so we do not call btrfs_commit_super();
+
+7) We then proceed to destroy the work queues, free the roots and block
+ groups, etc. After that we drop the last reference on the btree inode
+ by calling iput() on it. Since there are dirty pages for the btree
+ inode, corresponding to the COWed extent buffer for the quotas btree,
+ btree_write_cache_pages() is invoked to flush those dirty pages. This
+ results in creating a bio and submitting it, which makes us end up at
+ btrfs_submit_metadata_bio();
+
+8) At btrfs_submit_metadata_bio() we end up at the if-then-else branch
+ that calls btrfs_wq_submit_bio(), because check_async_write() returned
+ a value of 1. This value of 1 is because we did not have hardware
+ acceleration available for crc32c, so BTRFS_FS_CSUM_IMPL_FAST was not
+ set in fs_info->flags;
+
+9) Then at btrfs_wq_submit_bio() we call btrfs_queue_work() against the
+ workqueue at fs_info->workers, which was already freed before by the
+ call to btrfs_stop_all_workers() at close_ctree(). This results in an
+ invalid memory access due to a use-after-free, leading to a crash.
+
+When this happens, before the crash there are several warnings triggered,
+since we have reserved metadata space in a block group, the delayed refs
+reservation, etc:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 4 PID: 1729896 at fs/btrfs/block-group.c:125 btrfs_put_block_group+0x63/0xa0 [btrfs]
+ Modules linked in: btrfs dm_snapshot dm_thin_pool (...)
+ CPU: 4 PID: 1729896 Comm: umount Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:btrfs_put_block_group+0x63/0xa0 [btrfs]
+ Code: f0 01 00 00 48 39 c2 75 (...)
+ RSP: 0018:ffffb270826bbdd8 EFLAGS: 00010206
+ RAX: 0000000000000001 RBX: ffff947ed73e4000 RCX: ffff947ebc8b29c8
+ RDX: 0000000000000001 RSI: ffffffffc0b150a0 RDI: ffff947ebc8b2800
+ RBP: ffff947ebc8b2800 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000001 R12: ffff947ed73e4110
+ R13: ffff947ed73e4160 R14: ffff947ebc8b2988 R15: dead000000000100
+ FS: 00007f15edfea840(0000) GS:ffff9481ad600000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f37e2893320 CR3: 0000000138f68001 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ btrfs_free_block_groups+0x17f/0x2f0 [btrfs]
+ close_ctree+0x2ba/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f15ee221ee7
+ Code: ff 0b 00 f7 d8 64 89 01 48 (...)
+ RSP: 002b:00007ffe9470f0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+ RAX: 0000000000000000 RBX: 00007f15ee347264 RCX: 00007f15ee221ee7
+ RDX: ffffffffffffff78 RSI: 0000000000000000 RDI: 000056169701d000
+ RBP: 0000561697018a30 R08: 0000000000000000 R09: 00007f15ee2e2be0
+ R10: 000056169701efe0 R11: 0000000000000246 R12: 0000000000000000
+ R13: 000056169701d000 R14: 0000561697018b40 R15: 0000561697018c60
+ irq event stamp: 0
+ hardirqs last enabled at (0): [<0000000000000000>] 0x0
+ hardirqs last disabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last enabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last disabled at (0): [<0000000000000000>] 0x0
+ ---[ end trace dd74718fef1ed5c6 ]---
+ ------------[ cut here ]------------
+ WARNING: CPU: 2 PID: 1729896 at fs/btrfs/block-rsv.c:459 btrfs_release_global_block_rsv+0x70/0xc0 [btrfs]
+ Modules linked in: btrfs dm_snapshot dm_thin_pool (...)
+ CPU: 2 PID: 1729896 Comm: umount Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:btrfs_release_global_block_rsv+0x70/0xc0 [btrfs]
+ Code: 48 83 bb b0 03 00 00 00 (...)
+ RSP: 0018:ffffb270826bbdd8 EFLAGS: 00010206
+ RAX: 000000000033c000 RBX: ffff947ed73e4000 RCX: 0000000000000000
+ RDX: 0000000000000001 RSI: ffffffffc0b0d8c1 RDI: 00000000ffffffff
+ RBP: ffff947ebc8b7000 R08: 0000000000000001 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000001 R12: ffff947ed73e4110
+ R13: ffff947ed73e5278 R14: dead000000000122 R15: dead000000000100
+ FS: 00007f15edfea840(0000) GS:ffff9481aca00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000561a79f76e20 CR3: 0000000138f68006 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ btrfs_free_block_groups+0x24c/0x2f0 [btrfs]
+ close_ctree+0x2ba/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f15ee221ee7
+ Code: ff 0b 00 f7 d8 64 89 01 (...)
+ RSP: 002b:00007ffe9470f0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+ RAX: 0000000000000000 RBX: 00007f15ee347264 RCX: 00007f15ee221ee7
+ RDX: ffffffffffffff78 RSI: 0000000000000000 RDI: 000056169701d000
+ RBP: 0000561697018a30 R08: 0000000000000000 R09: 00007f15ee2e2be0
+ R10: 000056169701efe0 R11: 0000000000000246 R12: 0000000000000000
+ R13: 000056169701d000 R14: 0000561697018b40 R15: 0000561697018c60
+ irq event stamp: 0
+ hardirqs last enabled at (0): [<0000000000000000>] 0x0
+ hardirqs last disabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last enabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last disabled at (0): [<0000000000000000>] 0x0
+ ---[ end trace dd74718fef1ed5c7 ]---
+ ------------[ cut here ]------------
+ WARNING: CPU: 2 PID: 1729896 at fs/btrfs/block-group.c:3377 btrfs_free_block_groups+0x25d/0x2f0 [btrfs]
+ Modules linked in: btrfs dm_snapshot dm_thin_pool (...)
+ CPU: 5 PID: 1729896 Comm: umount Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:btrfs_free_block_groups+0x25d/0x2f0 [btrfs]
+ Code: ad de 49 be 22 01 00 (...)
+ RSP: 0018:ffffb270826bbde8 EFLAGS: 00010206
+ RAX: ffff947ebeae1d08 RBX: ffff947ed73e4000 RCX: 0000000000000000
+ RDX: 0000000000000001 RSI: ffff947e9d823ae8 RDI: 0000000000000246
+ RBP: ffff947ebeae1d08 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000001 R12: ffff947ebeae1c00
+ R13: ffff947ed73e5278 R14: dead000000000122 R15: dead000000000100
+ FS: 00007f15edfea840(0000) GS:ffff9481ad200000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f1475d98ea8 CR3: 0000000138f68005 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ close_ctree+0x2ba/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f15ee221ee7
+ Code: ff 0b 00 f7 d8 64 89 (...)
+ RSP: 002b:00007ffe9470f0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+ RAX: 0000000000000000 RBX: 00007f15ee347264 RCX: 00007f15ee221ee7
+ RDX: ffffffffffffff78 RSI: 0000000000000000 RDI: 000056169701d000
+ RBP: 0000561697018a30 R08: 0000000000000000 R09: 00007f15ee2e2be0
+ R10: 000056169701efe0 R11: 0000000000000246 R12: 0000000000000000
+ R13: 000056169701d000 R14: 0000561697018b40 R15: 0000561697018c60
+ irq event stamp: 0
+ hardirqs last enabled at (0): [<0000000000000000>] 0x0
+ hardirqs last disabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last enabled at (0): [<ffffffff8bcae560>] copy_process+0x8a0/0x1d70
+ softirqs last disabled at (0): [<0000000000000000>] 0x0
+ ---[ end trace dd74718fef1ed5c8 ]---
+ BTRFS info (device sdc): space_info 4 has 268238848 free, is not full
+ BTRFS info (device sdc): space_info total=268435456, used=114688, pinned=0, reserved=16384, may_use=0, readonly=65536
+ BTRFS info (device sdc): global_block_rsv: size 0 reserved 0
+ BTRFS info (device sdc): trans_block_rsv: size 0 reserved 0
+ BTRFS info (device sdc): chunk_block_rsv: size 0 reserved 0
+ BTRFS info (device sdc): delayed_block_rsv: size 0 reserved 0
+ BTRFS info (device sdc): delayed_refs_rsv: size 524288 reserved 0
+
+And the crash, which only happens when we do not have crc32c hardware
+acceleration, produces the following trace immediately after those
+warnings:
+
+ stack segment: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI
+ CPU: 2 PID: 1749129 Comm: umount Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:btrfs_queue_work+0x36/0x190 [btrfs]
+ Code: 54 55 53 48 89 f3 (...)
+ RSP: 0018:ffffb27082443ae8 EFLAGS: 00010282
+ RAX: 0000000000000004 RBX: ffff94810ee9ad90 RCX: 0000000000000000
+ RDX: 0000000000000001 RSI: ffff94810ee9ad90 RDI: ffff947ed8ee75a0
+ RBP: a56b6b6b6b6b6b6b R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000007 R11: 0000000000000001 R12: ffff947fa9b435a8
+ R13: ffff94810ee9ad90 R14: 0000000000000000 R15: ffff947e93dc0000
+ FS: 00007f3cfe974840(0000) GS:ffff9481ac600000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f1b42995a70 CR3: 0000000127638003 CR4: 00000000003706e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ btrfs_wq_submit_bio+0xb3/0xd0 [btrfs]
+ btrfs_submit_metadata_bio+0x44/0xc0 [btrfs]
+ submit_one_bio+0x61/0x70 [btrfs]
+ btree_write_cache_pages+0x414/0x450 [btrfs]
+ ? kobject_put+0x9a/0x1d0
+ ? trace_hardirqs_on+0x1b/0xf0
+ ? _raw_spin_unlock_irqrestore+0x3c/0x60
+ ? free_debug_processing+0x1e1/0x2b0
+ do_writepages+0x43/0xe0
+ ? lock_acquired+0x199/0x490
+ __writeback_single_inode+0x59/0x650
+ writeback_single_inode+0xaf/0x120
+ write_inode_now+0x94/0xd0
+ iput+0x187/0x2b0
+ close_ctree+0x2c6/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f3cfebabee7
+ Code: ff 0b 00 f7 d8 64 89 01 (...)
+ RSP: 002b:00007ffc9c9a05f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+ RAX: 0000000000000000 RBX: 00007f3cfecd1264 RCX: 00007f3cfebabee7
+ RDX: ffffffffffffff78 RSI: 0000000000000000 RDI: 0000562b6b478000
+ RBP: 0000562b6b473a30 R08: 0000000000000000 R09: 00007f3cfec6cbe0
+ R10: 0000562b6b479fe0 R11: 0000000000000246 R12: 0000000000000000
+ R13: 0000562b6b478000 R14: 0000562b6b473b40 R15: 0000562b6b473c60
+ Modules linked in: btrfs dm_snapshot dm_thin_pool (...)
+ ---[ end trace dd74718fef1ed5cc ]---
+
+Finally when we remove the btrfs module (rmmod btrfs), there are several
+warnings about objects that were allocated from our slabs but were never
+freed, consequence of the transaction that was never committed and got
+leaked:
+
+ =============================================================================
+ BUG btrfs_delayed_ref_head (Tainted: G B W ): Objects remaining in btrfs_delayed_ref_head on __kmem_cache_shutdown()
+ -----------------------------------------------------------------------------
+
+ INFO: Slab 0x0000000094c2ae56 objects=24 used=2 fp=0x000000002bfa2521 flags=0x17fffc000010200
+ CPU: 5 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ slab_err+0xb7/0xdc
+ ? lock_acquired+0x199/0x490
+ __kmem_cache_shutdown+0x1ac/0x3c0
+ ? lock_release+0x20e/0x4c0
+ kmem_cache_destroy+0x55/0x120
+ btrfs_delayed_ref_exit+0x11/0x35 [btrfs]
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 f5 (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ INFO: Object 0x0000000050cbdd61 @offset=12104
+ INFO: Allocated in btrfs_add_delayed_tree_ref+0xbb/0x480 [btrfs] age=1894 cpu=6 pid=1729873
+ __slab_alloc.isra.0+0x109/0x1c0
+ kmem_cache_alloc+0x7bb/0x830
+ btrfs_add_delayed_tree_ref+0xbb/0x480 [btrfs]
+ btrfs_free_tree_block+0x128/0x360 [btrfs]
+ __btrfs_cow_block+0x489/0x5f0 [btrfs]
+ btrfs_cow_block+0xf7/0x220 [btrfs]
+ btrfs_search_slot+0x62a/0xc40 [btrfs]
+ btrfs_del_orphan_item+0x65/0xd0 [btrfs]
+ btrfs_find_orphan_roots+0x1bf/0x200 [btrfs]
+ open_ctree+0x125a/0x18a0 [btrfs]
+ btrfs_mount_root.cold+0x13/0xed [btrfs]
+ legacy_get_tree+0x30/0x60
+ vfs_get_tree+0x28/0xe0
+ fc_mount+0xe/0x40
+ vfs_kern_mount.part.0+0x71/0x90
+ btrfs_mount+0x13b/0x3e0 [btrfs]
+ INFO: Freed in __btrfs_run_delayed_refs+0x1117/0x1290 [btrfs] age=4292 cpu=2 pid=1729526
+ kmem_cache_free+0x34c/0x3c0
+ __btrfs_run_delayed_refs+0x1117/0x1290 [btrfs]
+ btrfs_run_delayed_refs+0x81/0x210 [btrfs]
+ commit_cowonly_roots+0xfb/0x300 [btrfs]
+ btrfs_commit_transaction+0x367/0xc40 [btrfs]
+ sync_filesystem+0x74/0x90
+ generic_shutdown_super+0x22/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ INFO: Object 0x0000000086e9b0ff @offset=12776
+ INFO: Allocated in btrfs_add_delayed_tree_ref+0xbb/0x480 [btrfs] age=1900 cpu=6 pid=1729873
+ __slab_alloc.isra.0+0x109/0x1c0
+ kmem_cache_alloc+0x7bb/0x830
+ btrfs_add_delayed_tree_ref+0xbb/0x480 [btrfs]
+ btrfs_alloc_tree_block+0x2bf/0x360 [btrfs]
+ alloc_tree_block_no_bg_flush+0x4f/0x60 [btrfs]
+ __btrfs_cow_block+0x12d/0x5f0 [btrfs]
+ btrfs_cow_block+0xf7/0x220 [btrfs]
+ btrfs_search_slot+0x62a/0xc40 [btrfs]
+ btrfs_del_orphan_item+0x65/0xd0 [btrfs]
+ btrfs_find_orphan_roots+0x1bf/0x200 [btrfs]
+ open_ctree+0x125a/0x18a0 [btrfs]
+ btrfs_mount_root.cold+0x13/0xed [btrfs]
+ legacy_get_tree+0x30/0x60
+ vfs_get_tree+0x28/0xe0
+ fc_mount+0xe/0x40
+ vfs_kern_mount.part.0+0x71/0x90
+ INFO: Freed in __btrfs_run_delayed_refs+0x1117/0x1290 [btrfs] age=3141 cpu=6 pid=1729803
+ kmem_cache_free+0x34c/0x3c0
+ __btrfs_run_delayed_refs+0x1117/0x1290 [btrfs]
+ btrfs_run_delayed_refs+0x81/0x210 [btrfs]
+ btrfs_write_dirty_block_groups+0x17d/0x3d0 [btrfs]
+ commit_cowonly_roots+0x248/0x300 [btrfs]
+ btrfs_commit_transaction+0x367/0xc40 [btrfs]
+ close_ctree+0x113/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ kmem_cache_destroy btrfs_delayed_ref_head: Slab cache still has objects
+ CPU: 5 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ kmem_cache_destroy+0x119/0x120
+ btrfs_delayed_ref_exit+0x11/0x35 [btrfs]
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 f5 0b (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ =============================================================================
+ BUG btrfs_delayed_tree_ref (Tainted: G B W ): Objects remaining in btrfs_delayed_tree_ref on __kmem_cache_shutdown()
+ -----------------------------------------------------------------------------
+
+ INFO: Slab 0x0000000011f78dc0 objects=37 used=2 fp=0x0000000032d55d91 flags=0x17fffc000010200
+ CPU: 3 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ slab_err+0xb7/0xdc
+ ? lock_acquired+0x199/0x490
+ __kmem_cache_shutdown+0x1ac/0x3c0
+ ? lock_release+0x20e/0x4c0
+ kmem_cache_destroy+0x55/0x120
+ btrfs_delayed_ref_exit+0x1d/0x35 [btrfs]
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 f5 (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ INFO: Object 0x000000001a340018 @offset=4408
+ INFO: Allocated in btrfs_add_delayed_tree_ref+0x9e/0x480 [btrfs] age=1917 cpu=6 pid=1729873
+ __slab_alloc.isra.0+0x109/0x1c0
+ kmem_cache_alloc+0x7bb/0x830
+ btrfs_add_delayed_tree_ref+0x9e/0x480 [btrfs]
+ btrfs_free_tree_block+0x128/0x360 [btrfs]
+ __btrfs_cow_block+0x489/0x5f0 [btrfs]
+ btrfs_cow_block+0xf7/0x220 [btrfs]
+ btrfs_search_slot+0x62a/0xc40 [btrfs]
+ btrfs_del_orphan_item+0x65/0xd0 [btrfs]
+ btrfs_find_orphan_roots+0x1bf/0x200 [btrfs]
+ open_ctree+0x125a/0x18a0 [btrfs]
+ btrfs_mount_root.cold+0x13/0xed [btrfs]
+ legacy_get_tree+0x30/0x60
+ vfs_get_tree+0x28/0xe0
+ fc_mount+0xe/0x40
+ vfs_kern_mount.part.0+0x71/0x90
+ btrfs_mount+0x13b/0x3e0 [btrfs]
+ INFO: Freed in __btrfs_run_delayed_refs+0x63d/0x1290 [btrfs] age=4167 cpu=4 pid=1729795
+ kmem_cache_free+0x34c/0x3c0
+ __btrfs_run_delayed_refs+0x63d/0x1290 [btrfs]
+ btrfs_run_delayed_refs+0x81/0x210 [btrfs]
+ btrfs_commit_transaction+0x60/0xc40 [btrfs]
+ create_subvol+0x56a/0x990 [btrfs]
+ btrfs_mksubvol+0x3fb/0x4a0 [btrfs]
+ __btrfs_ioctl_snap_create+0x119/0x1a0 [btrfs]
+ btrfs_ioctl_snap_create+0x58/0x80 [btrfs]
+ btrfs_ioctl+0x1a92/0x36f0 [btrfs]
+ __x64_sys_ioctl+0x83/0xb0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ INFO: Object 0x000000002b46292a @offset=13648
+ INFO: Allocated in btrfs_add_delayed_tree_ref+0x9e/0x480 [btrfs] age=1923 cpu=6 pid=1729873
+ __slab_alloc.isra.0+0x109/0x1c0
+ kmem_cache_alloc+0x7bb/0x830
+ btrfs_add_delayed_tree_ref+0x9e/0x480 [btrfs]
+ btrfs_alloc_tree_block+0x2bf/0x360 [btrfs]
+ alloc_tree_block_no_bg_flush+0x4f/0x60 [btrfs]
+ __btrfs_cow_block+0x12d/0x5f0 [btrfs]
+ btrfs_cow_block+0xf7/0x220 [btrfs]
+ btrfs_search_slot+0x62a/0xc40 [btrfs]
+ btrfs_del_orphan_item+0x65/0xd0 [btrfs]
+ btrfs_find_orphan_roots+0x1bf/0x200 [btrfs]
+ open_ctree+0x125a/0x18a0 [btrfs]
+ btrfs_mount_root.cold+0x13/0xed [btrfs]
+ legacy_get_tree+0x30/0x60
+ vfs_get_tree+0x28/0xe0
+ fc_mount+0xe/0x40
+ vfs_kern_mount.part.0+0x71/0x90
+ INFO: Freed in __btrfs_run_delayed_refs+0x63d/0x1290 [btrfs] age=3164 cpu=6 pid=1729803
+ kmem_cache_free+0x34c/0x3c0
+ __btrfs_run_delayed_refs+0x63d/0x1290 [btrfs]
+ btrfs_run_delayed_refs+0x81/0x210 [btrfs]
+ commit_cowonly_roots+0xfb/0x300 [btrfs]
+ btrfs_commit_transaction+0x367/0xc40 [btrfs]
+ close_ctree+0x113/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ kmem_cache_destroy btrfs_delayed_tree_ref: Slab cache still has objects
+ CPU: 5 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ kmem_cache_destroy+0x119/0x120
+ btrfs_delayed_ref_exit+0x1d/0x35 [btrfs]
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 f5 (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ =============================================================================
+ BUG btrfs_delayed_extent_op (Tainted: G B W ): Objects remaining in btrfs_delayed_extent_op on __kmem_cache_shutdown()
+ -----------------------------------------------------------------------------
+
+ INFO: Slab 0x00000000f145ce2f objects=22 used=1 fp=0x00000000af0f92cf flags=0x17fffc000010200
+ CPU: 5 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ slab_err+0xb7/0xdc
+ ? lock_acquired+0x199/0x490
+ __kmem_cache_shutdown+0x1ac/0x3c0
+ ? __mutex_unlock_slowpath+0x45/0x2a0
+ kmem_cache_destroy+0x55/0x120
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 f5 (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ INFO: Object 0x000000004cf95ea8 @offset=6264
+ INFO: Allocated in btrfs_alloc_tree_block+0x1e0/0x360 [btrfs] age=1931 cpu=6 pid=1729873
+ __slab_alloc.isra.0+0x109/0x1c0
+ kmem_cache_alloc+0x7bb/0x830
+ btrfs_alloc_tree_block+0x1e0/0x360 [btrfs]
+ alloc_tree_block_no_bg_flush+0x4f/0x60 [btrfs]
+ __btrfs_cow_block+0x12d/0x5f0 [btrfs]
+ btrfs_cow_block+0xf7/0x220 [btrfs]
+ btrfs_search_slot+0x62a/0xc40 [btrfs]
+ btrfs_del_orphan_item+0x65/0xd0 [btrfs]
+ btrfs_find_orphan_roots+0x1bf/0x200 [btrfs]
+ open_ctree+0x125a/0x18a0 [btrfs]
+ btrfs_mount_root.cold+0x13/0xed [btrfs]
+ legacy_get_tree+0x30/0x60
+ vfs_get_tree+0x28/0xe0
+ fc_mount+0xe/0x40
+ vfs_kern_mount.part.0+0x71/0x90
+ btrfs_mount+0x13b/0x3e0 [btrfs]
+ INFO: Freed in __btrfs_run_delayed_refs+0xabd/0x1290 [btrfs] age=3173 cpu=6 pid=1729803
+ kmem_cache_free+0x34c/0x3c0
+ __btrfs_run_delayed_refs+0xabd/0x1290 [btrfs]
+ btrfs_run_delayed_refs+0x81/0x210 [btrfs]
+ commit_cowonly_roots+0xfb/0x300 [btrfs]
+ btrfs_commit_transaction+0x367/0xc40 [btrfs]
+ close_ctree+0x113/0x2fa [btrfs]
+ generic_shutdown_super+0x6c/0x100
+ kill_anon_super+0x14/0x30
+ btrfs_kill_super+0x12/0x20 [btrfs]
+ deactivate_locked_super+0x31/0x70
+ cleanup_mnt+0x100/0x160
+ task_work_run+0x68/0xb0
+ exit_to_user_mode_prepare+0x1bb/0x1c0
+ syscall_exit_to_user_mode+0x4b/0x260
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ kmem_cache_destroy btrfs_delayed_extent_op: Slab cache still has objects
+ CPU: 3 PID: 1729921 Comm: rmmod Tainted: G B W 5.10.0-rc4-btrfs-next-73 #1
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x8d/0xb5
+ kmem_cache_destroy+0x119/0x120
+ exit_btrfs_fs+0xa/0x59 [btrfs]
+ __x64_sys_delete_module+0x194/0x260
+ ? fpregs_assert_state_consistent+0x1e/0x40
+ ? exit_to_user_mode_prepare+0x55/0x1c0
+ ? trace_hardirqs_on+0x1b/0xf0
+ do_syscall_64+0x33/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f693e305897
+ Code: 73 01 c3 48 8b 0d f9 (...)
+ RSP: 002b:00007ffcf73eb508 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+ RAX: ffffffffffffffda RBX: 0000559df504f760 RCX: 00007f693e305897
+ RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000559df504f7c8
+ RBP: 00007ffcf73eb568 R08: 0000000000000000 R09: 0000000000000000
+ R10: 00007f693e378ac0 R11: 0000000000000206 R12: 00007ffcf73eb740
+ R13: 00007ffcf73ec5a6 R14: 0000559df504f2a0 R15: 0000559df504f760
+ BTRFS: state leak: start 30408704 end 30425087 state 1 in tree 1 refs 1
+
+Fix this issue by having the remount path stop the qgroup rescan worker
+when we are remounting RO and teach the rescan worker to stop when a
+remount is in progress. If later a remount in RW mode happens, we are
+already resuming the qgroup rescan worker through the call to
+btrfs_qgroup_rescan_resume(), so we do not need to worry about that.
+
+Tested-by: Fabian Vogt <fvogt@suse.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/qgroup.c | 13 ++++++++++---
+ fs/btrfs/super.c | 8 ++++++++
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index faed0e96cec23..d504a9a207515 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -3224,6 +3224,12 @@ out:
+ return ret;
+ }
+
++static bool rescan_should_stop(struct btrfs_fs_info *fs_info)
++{
++ return btrfs_fs_closing(fs_info) ||
++ test_bit(BTRFS_FS_STATE_REMOUNTING, &fs_info->fs_state);
++}
++
+ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ {
+ struct btrfs_fs_info *fs_info = container_of(work, struct btrfs_fs_info,
+@@ -3232,6 +3238,7 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ struct btrfs_trans_handle *trans = NULL;
+ int err = -ENOMEM;
+ int ret = 0;
++ bool stopped = false;
+
+ path = btrfs_alloc_path();
+ if (!path)
+@@ -3244,7 +3251,7 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
+ path->skip_locking = 1;
+
+ err = 0;
+- while (!err && !btrfs_fs_closing(fs_info)) {
++ while (!err && !(stopped = rescan_should_stop(fs_info))) {
+ trans = btrfs_start_transaction(fs_info->fs_root, 0);
+ if (IS_ERR(trans)) {
+ err = PTR_ERR(trans);
+@@ -3287,7 +3294,7 @@ out:
+ }
+
+ mutex_lock(&fs_info->qgroup_rescan_lock);
+- if (!btrfs_fs_closing(fs_info))
++ if (!stopped)
+ fs_info->qgroup_flags &= ~BTRFS_QGROUP_STATUS_FLAG_RESCAN;
+ if (trans) {
+ ret = update_qgroup_status_item(trans);
+@@ -3306,7 +3313,7 @@ out:
+
+ btrfs_end_transaction(trans);
+
+- if (btrfs_fs_closing(fs_info)) {
++ if (stopped) {
+ btrfs_info(fs_info, "qgroup scan paused");
+ } else if (err >= 0) {
+ btrfs_info(fs_info, "qgroup scan completed%s",
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 8840a4fa81eb7..2663485c17cb8 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -1895,6 +1895,14 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data)
+ btrfs_scrub_cancel(fs_info);
+ btrfs_pause_balance(fs_info);
+
++ /*
++ * Pause the qgroup rescan worker if it is running. We don't want
++ * it to be still running after we are in RO mode, as after that,
++ * by the time we unmount, it might have left a transaction open,
++ * so we would leak the transaction and/or crash.
++ */
++ btrfs_qgroup_wait_for_completion(fs_info, false);
++
+ ret = btrfs_commit_super(fs_info);
+ if (ret)
+ goto restore;
+--
+2.27.0
+
--- /dev/null
+From 33f8a88f70b6c99727598bbee97f5cb3ad7d9c2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 15:56:22 +0000
+Subject: btrfs: merge critical sections of discard lock in workfn
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 8fc058597a283e9a37720abb0e8d68e342b9387d ]
+
+btrfs_discard_workfn() drops discard_ctl->lock just to take it again in
+a moment in btrfs_discard_schedule_work(). Avoid that and also reuse
+ktime.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/discard.c | 43 +++++++++++++++++++++++--------------------
+ 1 file changed, 23 insertions(+), 20 deletions(-)
+
+diff --git a/fs/btrfs/discard.c b/fs/btrfs/discard.c
+index d1a5380e8827d..9e1a06144e32d 100644
+--- a/fs/btrfs/discard.c
++++ b/fs/btrfs/discard.c
+@@ -328,28 +328,15 @@ void btrfs_discard_queue_work(struct btrfs_discard_ctl *discard_ctl,
+ btrfs_discard_schedule_work(discard_ctl, false);
+ }
+
+-/**
+- * btrfs_discard_schedule_work - responsible for scheduling the discard work
+- * @discard_ctl: discard control
+- * @override: override the current timer
+- *
+- * Discards are issued by a delayed workqueue item. @override is used to
+- * update the current delay as the baseline delay interval is reevaluated on
+- * transaction commit. This is also maxed with any other rate limit.
+- */
+-void btrfs_discard_schedule_work(struct btrfs_discard_ctl *discard_ctl,
+- bool override)
++static void __btrfs_discard_schedule_work(struct btrfs_discard_ctl *discard_ctl,
++ u64 now, bool override)
+ {
+ struct btrfs_block_group *block_group;
+- const u64 now = ktime_get_ns();
+-
+- spin_lock(&discard_ctl->lock);
+
+ if (!btrfs_run_discard_work(discard_ctl))
+- goto out;
+-
++ return;
+ if (!override && delayed_work_pending(&discard_ctl->work))
+- goto out;
++ return;
+
+ block_group = find_next_block_group(discard_ctl, now);
+ if (block_group) {
+@@ -382,7 +369,24 @@ void btrfs_discard_schedule_work(struct btrfs_discard_ctl *discard_ctl,
+ mod_delayed_work(discard_ctl->discard_workers,
+ &discard_ctl->work, delay);
+ }
+-out:
++}
++
++/*
++ * btrfs_discard_schedule_work - responsible for scheduling the discard work
++ * @discard_ctl: discard control
++ * @override: override the current timer
++ *
++ * Discards are issued by a delayed workqueue item. @override is used to
++ * update the current delay as the baseline delay interval is reevaluated on
++ * transaction commit. This is also maxed with any other rate limit.
++ */
++void btrfs_discard_schedule_work(struct btrfs_discard_ctl *discard_ctl,
++ bool override)
++{
++ const u64 now = ktime_get_ns();
++
++ spin_lock(&discard_ctl->lock);
++ __btrfs_discard_schedule_work(discard_ctl, now, override);
+ spin_unlock(&discard_ctl->lock);
+ }
+
+@@ -487,9 +491,8 @@ static void btrfs_discard_workfn(struct work_struct *work)
+
+ spin_lock(&discard_ctl->lock);
+ discard_ctl->block_group = NULL;
++ __btrfs_discard_schedule_work(discard_ctl, now, false);
+ spin_unlock(&discard_ctl->lock);
+-
+- btrfs_discard_schedule_work(discard_ctl, false);
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From a06fd00fab4cbadb63ca7111cc250aba03c093cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:20:45 +0100
+Subject: dmaengine: stm32-mdma: fix STM32_MDMA_VERY_HIGH_PRIORITY value
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit e1263f9277bad198c2acc8092a41aea1edbea0e4 ]
+
+STM32_MDMA_VERY_HIGH_PRIORITY is b11 not 0x11, so fix it with 0x3.
+
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Link: https://lore.kernel.org/r/20210104142045.25583-1-amelie.delaunay@foss.st.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/stm32-mdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/stm32-mdma.c b/drivers/dma/stm32-mdma.c
+index 08cfbfab837bb..ca97cbe433651 100644
+--- a/drivers/dma/stm32-mdma.c
++++ b/drivers/dma/stm32-mdma.c
+@@ -199,7 +199,7 @@
+ #define STM32_MDMA_MAX_CHANNELS 63
+ #define STM32_MDMA_MAX_REQUESTS 256
+ #define STM32_MDMA_MAX_BURST 128
+-#define STM32_MDMA_VERY_HIGH_PRIORITY 0x11
++#define STM32_MDMA_VERY_HIGH_PRIORITY 0x3
+
+ enum stm32_mdma_trigger_mode {
+ STM32_MDMA_BUFFER,
+--
+2.27.0
+
--- /dev/null
+From af89838fb9afa6ff0c9fc4b82dbd16f3825ec67c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Dec 2020 14:10:28 +0800
+Subject: drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer
+ issue
+
+From: Kevin Wang <kevin1.wang@amd.com>
+
+[ Upstream commit a7b5d9dd57298333e6e9f4c167f01385d922bbfb ]
+
+fix NULL pointer issue when read sysfs amdgpu_current_backlight_pwm sysfs node.
+
+Call Trace:
+[ 248.273833] BUG: kernel NULL pointer dereference, address: 0000000000000130
+[ 248.273930] #PF: supervisor read access in kernel mode
+[ 248.273993] #PF: error_code(0x0000) - not-present page
+[ 248.274054] PGD 0 P4D 0
+[ 248.274092] Oops: 0000 [#1] SMP PTI
+[ 248.274138] CPU: 2 PID: 1377 Comm: cat Tainted: G OE 5.9.0-rc5-drm-next-5.9+ #1
+[ 248.274233] Hardware name: System manufacturer System Product Name/Z170-A, BIOS 3802 03/15/2018
+[ 248.274641] RIP: 0010:dc_link_get_backlight_level+0x5/0x70 [amdgpu]
+[ 248.274718] Code: 67 ff ff ff 41 b9 03 00 00 00 e9 45 ff ff ff d1 ea e9 55 ff ff ff 0f 1f 44 00 00 66 2e
+0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 8b 87 30 01 00 00 48 8b 00 48 8b 88 88 03 00 00 48 8d 81 e8 01
+[ 248.274919] RSP: 0018:ffffb5ad809b3df0 EFLAGS: 00010203
+[ 248.274982] RAX: ffffa0f77d1c0010 RBX: ffffa0f793ae9168 RCX: 0000000000000001
+[ 248.275064] RDX: ffffa0f79753db00 RSI: 0000000000000001 RDI: 0000000000000000
+[ 248.275145] RBP: ffffb5ad809b3e00 R08: ffffb5ad809b3da0 R09: 0000000000000000
+[ 248.275225] R10: ffffb5ad809b3e68 R11: 0000000000000000 R12: ffffa0f793ae9190
+[ 248.275306] R13: ffffb5ad809b3ef0 R14: 0000000000000001 R15: ffffa0f793ae9168
+[ 248.275388] FS: 00007f5f1ec4d540(0000) GS:ffffa0f79ec80000(0000) knlGS:0000000000000000
+[ 248.275480] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 248.275547] CR2: 0000000000000130 CR3: 000000042a03c005 CR4: 00000000003706e0
+[ 248.275628] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 248.275708] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 248.275789] Call Trace:
+[ 248.276124] ? current_backlight_read+0x24/0x40 [amdgpu]
+[ 248.276194] seq_read+0xc3/0x3f0
+[ 248.276240] full_proxy_read+0x5c/0x90
+[ 248.276290] vfs_read+0xa7/0x190
+[ 248.276334] ksys_read+0xa7/0xe0
+[ 248.276379] __x64_sys_read+0x1a/0x20
+[ 248.276429] do_syscall_64+0x37/0x80
+[ 248.276477] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 248.276538] RIP: 0033:0x7f5f1e75c191
+[ 248.276585] Code: fe ff ff 48 8d 3d b7 9d 0a 00 48 83 ec 08 e8 46 4d 02 00 66 0f 1f 44 00 00 48 8d 05 71 07
+2e 00 8b 00 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53Hw
+[ 248.276784] RSP: 002b:00007ffcb1fc3f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[ 248.276872] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5f1e75c191
+[ 248.276953] RDX: 0000000000020000 RSI: 00007f5f1ec2b000 RDI: 0000000000000003
+[ 248.277034] RBP: 0000000000020000 R08: 00000000ffffffff R09: 0000000000000000
+[ 248.277115] R10: 0000000000000022 R11: 0000000000000246 R12: 00007f5f1ec2b000
+[ 248.277195] R13: 0000000000000003 R14: 00007f5f1ec2b00f R15: 0000000000020000
+[ 248.277279] Modules linked in: amdgpu(OE) iommu_v2 gpu_sched ttm(OE) drm_kms_helper cec drm
+i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs
+lockd grace fscache nls_iso8859_1 snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic
+ledtrig_audio intel_rapl_msr intel_rapl_common snd_hda_intel snd_intel_dspcfg x86_pkg_temp_thermal
+intel_powerclamp snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event mei_hdcp
+coretemp snd_rawmidi snd_seq kvm_intel kvm snd_seq_device snd_timer irqbypass joydev snd input_leds soundcore
+crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper rapl intel_cstate
+mac_hid mei_me serio_raw mei eeepc_wmi wmi_bmof asus_wmi mxm_wmi intel_wmi_thunderbolt acpi_pad sparse_keymap
+efi_pstore sch_fq_codel parport_pc ppdev lp parport sunrpc ip_tables x_tables autofs4 hid_logitech_hidpp
+hid_logitech_dj hid_generic usbhid hid e1000e psmouse ahci libahci wmi video
+[ 248.278211] CR2: 0000000000000130
+[ 248.278221] ---[ end trace 1fbe72fe6f91091d ]---
+[ 248.357226] RIP: 0010:dc_link_get_backlight_level+0x5/0x70 [amdgpu]
+[ 248.357272] Code: 67 ff ff ff 41 b9 03 00 00 00 e9 45 ff ff ff d1 ea e9 55 ff ff ff 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 8b 87 30 01 00 00 48 8b 00 48 8b 88 88 03 00 00 48 8d 81 e8 01
+
+Signed-off-by: Kevin Wang <kevin1.wang@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 5b0cedfa824a9..e1e5d81a5e438 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2471,9 +2471,14 @@ enum dc_status dc_link_validate_mode_timing(
+ static struct abm *get_abm_from_stream_res(const struct dc_link *link)
+ {
+ int i;
+- struct dc *dc = link->ctx->dc;
++ struct dc *dc = NULL;
+ struct abm *abm = NULL;
+
++ if (!link || !link->ctx)
++ return NULL;
++
++ dc = link->ctx->dc;
++
+ for (i = 0; i < MAX_PIPES; i++) {
+ struct pipe_ctx pipe_ctx = dc->current_state->res_ctx.pipe_ctx[i];
+ struct dc_stream_state *stream = pipe_ctx.stream;
+--
+2.27.0
+
--- /dev/null
+From 1cca09d321a7b2ddd4510917b7f40c4341267541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 18:08:23 +0800
+Subject: drm/amd/pm: fix the failure when change power profile for renoir
+
+From: Xiaojian Du <Xiaojian.Du@amd.com>
+
+[ Upstream commit 44cb39e19a05ca711bcb6e776e0a4399223204a0 ]
+
+This patch is to fix the failure when change power profile to
+"profile_peak" for renoir.
+
+Signed-off-by: Xiaojian Du <Xiaojian.Du@amd.com>
+Reviewed-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 1 +
+ drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
+index 66c1026489bee..425c48e100e4f 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
+@@ -188,6 +188,7 @@ static int renoir_get_dpm_clk_limited(struct smu_context *smu, enum smu_clk_type
+ return -EINVAL;
+ *freq = clk_table->SocClocks[dpm_level].Freq;
+ break;
++ case SMU_UCLK:
+ case SMU_MCLK:
+ if (dpm_level >= NUM_FCLK_DPM_LEVELS)
+ return -EINVAL;
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
+index 660f403d5770c..7907c9e0b5dec 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c
+@@ -222,6 +222,7 @@ int smu_v12_0_set_soft_freq_limited_range(struct smu_context *smu, enum smu_clk_
+ break;
+ case SMU_FCLK:
+ case SMU_MCLK:
++ case SMU_UCLK:
+ ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetHardMinFclkByFreq, min, NULL);
+ if (ret)
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From e7a09c97b548872be7c635dfb1e3a765e31bf360 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 19:45:15 +0800
+Subject: drm/amdgpu: fix a GPU hang issue when remove device
+
+From: Dennis Li <Dennis.Li@amd.com>
+
+[ Upstream commit 88e21af1b3f887d217f2fb14fc7e7d3cd87ebf57 ]
+
+When GFXOFF is enabled and GPU is idle, driver will fail to access some
+registers. Therefore change to disable power gating before all access
+registers with MMIO.
+
+Dmesg log is as following:
+amdgpu 0000:03:00.0: amdgpu: amdgpu: finishing device.
+amdgpu: cp queue pipe 4 queue 0 preemption failed
+amdgpu 0000:03:00.0: amdgpu: failed to write reg 2890 wait reg 28a2
+amdgpu 0000:03:00.0: amdgpu: failed to write reg 1a6f4 wait reg 1a706
+amdgpu 0000:03:00.0: amdgpu: failed to write reg 2890 wait reg 28a2
+amdgpu 0000:03:00.0: amdgpu: failed to write reg 1a6f4 wait reg 1a706
+
+Signed-off-by: Dennis Li <Dennis.Li@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 523fbef67591c..2ddbcfe0a72ff 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2524,11 +2524,11 @@ static int amdgpu_device_ip_fini(struct amdgpu_device *adev)
+ if (adev->gmc.xgmi.num_physical_nodes > 1)
+ amdgpu_xgmi_remove_device(adev);
+
+- amdgpu_amdkfd_device_fini(adev);
+-
+ amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
+ amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
+
++ amdgpu_amdkfd_device_fini(adev);
++
+ /* need to disable SMC first */
+ for (i = 0; i < adev->num_ip_blocks; i++) {
+ if (!adev->ip_blocks[i].status.hw)
+--
+2.27.0
+
--- /dev/null
+From 8f2ff8846fa6afa41cfdf71cd0168a3aedcf3321 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Dec 2020 20:35:33 +0800
+Subject: drm/amdgpu: fix potential memory leak during navi12 deinitialization
+
+From: Jiawei Gu <Jiawei.Gu@amd.com>
+
+[ Upstream commit e6d5c64efaa34aae3815a9afeb1314a976142e83 ]
+
+Navi12 HDCP & DTM deinitialization needs continue to free bo if already
+created though initialized flag is not set.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Jiawei Gu <Jiawei.Gu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+index a6dbe4b83533f..2f47f81a74a57 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+@@ -1283,8 +1283,12 @@ static int psp_hdcp_terminate(struct psp_context *psp)
+ if (amdgpu_sriov_vf(psp->adev))
+ return 0;
+
+- if (!psp->hdcp_context.hdcp_initialized)
+- return 0;
++ if (!psp->hdcp_context.hdcp_initialized) {
++ if (psp->hdcp_context.hdcp_shared_buf)
++ goto out;
++ else
++ return 0;
++ }
+
+ ret = psp_hdcp_unload(psp);
+ if (ret)
+@@ -1292,6 +1296,7 @@ static int psp_hdcp_terminate(struct psp_context *psp)
+
+ psp->hdcp_context.hdcp_initialized = false;
+
++out:
+ /* free hdcp shared memory */
+ amdgpu_bo_free_kernel(&psp->hdcp_context.hdcp_shared_bo,
+ &psp->hdcp_context.hdcp_shared_mc_addr,
+@@ -1430,8 +1435,12 @@ static int psp_dtm_terminate(struct psp_context *psp)
+ if (amdgpu_sriov_vf(psp->adev))
+ return 0;
+
+- if (!psp->dtm_context.dtm_initialized)
+- return 0;
++ if (!psp->dtm_context.dtm_initialized) {
++ if (psp->dtm_context.dtm_shared_buf)
++ goto out;
++ else
++ return 0;
++ }
+
+ ret = psp_dtm_unload(psp);
+ if (ret)
+@@ -1439,6 +1448,7 @@ static int psp_dtm_terminate(struct psp_context *psp)
+
+ psp->dtm_context.dtm_initialized = false;
+
++out:
+ /* free hdcp shared memory */
+ amdgpu_bo_free_kernel(&psp->dtm_context.dtm_shared_bo,
+ &psp->dtm_context.dtm_shared_mc_addr,
+--
+2.27.0
+
--- /dev/null
+From cb4921f335840200a7090dce906643ac2bd12608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 17:29:42 +0200
+Subject: drm/msm: Call msm_init_vram before binding the gpu
+
+From: Craig Tatlor <ctatlor97@gmail.com>
+
+[ Upstream commit d863f0c7b536288e2bd40cbc01c10465dd226b11 ]
+
+vram.size is needed when binding a gpu without an iommu and is defined
+in msm_init_vram(), so run that before binding it.
+
+Signed-off-by: Craig Tatlor <ctatlor97@gmail.com>
+Reviewed-by: Brian Masney <masneyb@onstation.org>
+Tested-by: Alexey Minnekhanov <alexeymin@postmarketos.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 49685571dc0ee..d556c353e5aea 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -444,14 +444,14 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)
+
+ drm_mode_config_init(ddev);
+
+- /* Bind all our sub-components: */
+- ret = component_bind_all(dev, ddev);
++ ret = msm_init_vram(ddev);
+ if (ret)
+ goto err_destroy_mdss;
+
+- ret = msm_init_vram(ddev);
++ /* Bind all our sub-components: */
++ ret = component_bind_all(dev, ddev);
+ if (ret)
+- goto err_msm_uninit;
++ goto err_destroy_mdss;
+
+ dma_set_max_seg_size(dev, UINT_MAX);
+
+--
+2.27.0
+
--- /dev/null
+From 6560b802214eeae9c5ea82bd2c8a299753252860 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 11:55:37 +0100
+Subject: ethernet: ucc_geth: fix definition and size of
+ ucc_geth_tx_global_pram
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+[ Upstream commit 887078de2a23689e29d6fa1b75d7cbc544c280be ]
+
+Table 8-53 in the QUICC Engine Reference manual shows definitions of
+fields up to a size of 192 bytes, not just 128. But in table 8-111,
+one does find the text
+
+ Base Address of the Global Transmitter Parameter RAM Page. [...]
+ The user needs to allocate 128 bytes for this page. The address must
+ be aligned to the page size.
+
+I've checked both rev. 7 (11/2015) and rev. 9 (05/2018) of the manual;
+they both have this inconsistency (and the table numbers are the
+same).
+
+Adding a bit of debug printing, on my board the struct
+ucc_geth_tx_global_pram is allocated at offset 0x880, while
+the (opaque) ucc_geth_thread_data_tx gets allocated immediately
+afterwards, at 0x900. So whatever the engine writes into the thread
+data overlaps with the tail of the global tx pram (and devmem says
+that something does get written during a simple ping).
+
+I haven't observed any failure that could be attributed to this, but
+it seems to be the kind of thing that would be extremely hard to
+debug. So extend the struct definition so that we do allocate 192
+bytes.
+
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
+index 3fe9039721952..c80bed2c995c1 100644
+--- a/drivers/net/ethernet/freescale/ucc_geth.h
++++ b/drivers/net/ethernet/freescale/ucc_geth.h
+@@ -575,7 +575,14 @@ struct ucc_geth_tx_global_pram {
+ u32 vtagtable[0x8]; /* 8 4-byte VLAN tags */
+ u32 tqptr; /* a base pointer to the Tx Queues Memory
+ Region */
+- u8 res2[0x80 - 0x74];
++ u8 res2[0x78 - 0x74];
++ u64 snums_en;
++ u32 l2l3baseptr; /* top byte consists of a few other bit fields */
++
++ u16 mtu[8];
++ u8 res3[0xa8 - 0x94];
++ u32 wrrtablebase; /* top byte is reserved */
++ u8 res4[0xc0 - 0xac];
+ } __packed;
+
+ /* structure representing Extended Filtering Global Parameters in PRAM */
+--
+2.27.0
+
--- /dev/null
+From 3c1d56cdf97dff3c21f163675717afe8bbee7938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 19:50:46 +0200
+Subject: habanalabs: adjust pci controller init to new firmware
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit 377182a3cc5ae6cc17fb04d06864c975f9f71c18 ]
+
+When the firmware security is enabled, the pcie_aux_dbi_reg_addr
+register in the PCI controller is blocked. Therefore, ignore
+the result of writing to this register and assume it worked. Also
+remove the prints on errors in the internal ELBI write function.
+
+If the security is enabled, the firmware is responsible for setting
+this register correctly so we won't have any problem.
+
+If the security is disabled, the write will work (unless something
+is totally broken at the PCI level and then the whole sequence
+will fail).
+
+In addition, remove a write to register pcie_aux_dbi_reg_addr+4,
+which was never actually needed.
+
+Moreover, PCIE_DBI registers are blocked to access from host when
+firmware security is enabled. Use a different register to flush the
+writes.
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/pci.c | 28 +++++++++++--------
+ drivers/misc/habanalabs/gaudi/gaudi.c | 4 +--
+ .../misc/habanalabs/gaudi/gaudi_coresight.c | 3 +-
+ 3 files changed, 21 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/common/pci.c b/drivers/misc/habanalabs/common/pci.c
+index 4327e5704ebb6..607f9a11fba1a 100644
+--- a/drivers/misc/habanalabs/common/pci.c
++++ b/drivers/misc/habanalabs/common/pci.c
+@@ -130,10 +130,8 @@ static int hl_pci_elbi_write(struct hl_device *hdev, u64 addr, u32 data)
+ if ((val & PCI_CONFIG_ELBI_STS_MASK) == PCI_CONFIG_ELBI_STS_DONE)
+ return 0;
+
+- if (val & PCI_CONFIG_ELBI_STS_ERR) {
+- dev_err(hdev->dev, "Error writing to ELBI\n");
++ if (val & PCI_CONFIG_ELBI_STS_ERR)
+ return -EIO;
+- }
+
+ if (!(val & PCI_CONFIG_ELBI_STS_MASK)) {
+ dev_err(hdev->dev, "ELBI write didn't finish in time\n");
+@@ -160,8 +158,12 @@ int hl_pci_iatu_write(struct hl_device *hdev, u32 addr, u32 data)
+
+ dbi_offset = addr & 0xFFF;
+
+- rc = hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0x00300000);
+- rc |= hl_pci_elbi_write(hdev, prop->pcie_dbi_base_address + dbi_offset,
++ /* Ignore result of writing to pcie_aux_dbi_reg_addr as it could fail
++ * in case the firmware security is enabled
++ */
++ hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0x00300000);
++
++ rc = hl_pci_elbi_write(hdev, prop->pcie_dbi_base_address + dbi_offset,
+ data);
+
+ if (rc)
+@@ -244,9 +246,11 @@ int hl_pci_set_inbound_region(struct hl_device *hdev, u8 region,
+
+ rc |= hl_pci_iatu_write(hdev, offset + 0x4, ctrl_reg_val);
+
+- /* Return the DBI window to the default location */
+- rc |= hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0);
+- rc |= hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr + 4, 0);
++ /* Return the DBI window to the default location
++ * Ignore result of writing to pcie_aux_dbi_reg_addr as it could fail
++ * in case the firmware security is enabled
++ */
++ hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0);
+
+ if (rc)
+ dev_err(hdev->dev, "failed to map bar %u to 0x%08llx\n",
+@@ -294,9 +298,11 @@ int hl_pci_set_outbound_region(struct hl_device *hdev,
+ /* Enable */
+ rc |= hl_pci_iatu_write(hdev, 0x004, 0x80000000);
+
+- /* Return the DBI window to the default location */
+- rc |= hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0);
+- rc |= hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr + 4, 0);
++ /* Return the DBI window to the default location
++ * Ignore result of writing to pcie_aux_dbi_reg_addr as it could fail
++ * in case the firmware security is enabled
++ */
++ hl_pci_elbi_write(hdev, prop->pcie_aux_dbi_reg_addr, 0);
+
+ return rc;
+ }
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 7ea6b4368a913..36f0bb7154ab9 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -2893,7 +2893,7 @@ static int gaudi_init_cpu_queues(struct hl_device *hdev, u32 cpu_timeout)
+ static void gaudi_pre_hw_init(struct hl_device *hdev)
+ {
+ /* Perform read from the device to make sure device is up */
+- RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
++ RREG32(mmHW_STATE);
+
+ /* Set the access through PCI bars (Linux driver only) as
+ * secured
+@@ -2996,7 +2996,7 @@ static int gaudi_hw_init(struct hl_device *hdev)
+ }
+
+ /* Perform read from the device to flush all configuration */
+- RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
++ RREG32(mmHW_STATE);
+
+ return 0;
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi_coresight.c b/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
+index 3d2b0f0f46507..283d37b76447e 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi_coresight.c
+@@ -9,6 +9,7 @@
+ #include "../include/gaudi/gaudi_coresight.h"
+ #include "../include/gaudi/asic_reg/gaudi_regs.h"
+ #include "../include/gaudi/gaudi_masks.h"
++#include "../include/gaudi/gaudi_reg_map.h"
+
+ #include <uapi/misc/habanalabs.h>
+ #include <linux/coresight.h>
+@@ -876,7 +877,7 @@ int gaudi_debug_coresight(struct hl_device *hdev, void *data)
+ }
+
+ /* Perform read from the device to flush all configuration */
+- RREG32(mmPCIE_DBI_DEVICE_ID_VENDOR_ID_REG);
++ RREG32(mmHW_STATE);
+
+ return rc;
+ }
+--
+2.27.0
+
--- /dev/null
+From 170de71780ac00bec3e56f2b026e7a0cae9f7714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 15:27:14 +0800
+Subject: habanalabs: Fix memleak in hl_device_reset
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit b000700d6db50c933ce8b661154e26cf4ad06dba ]
+
+When kzalloc() fails, we should execute hl_mmu_fini()
+to release the MMU module. It's the same when
+hl_ctx_init() fails.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c
+index 783bbdcb1e618..09c328ee65da8 100644
+--- a/drivers/misc/habanalabs/common/device.c
++++ b/drivers/misc/habanalabs/common/device.c
+@@ -1027,6 +1027,7 @@ again:
+ GFP_KERNEL);
+ if (!hdev->kernel_ctx) {
+ rc = -ENOMEM;
++ hl_mmu_fini(hdev);
+ goto out_err;
+ }
+
+@@ -1038,6 +1039,7 @@ again:
+ "failed to init kernel ctx in hard reset\n");
+ kfree(hdev->kernel_ctx);
+ hdev->kernel_ctx = NULL;
++ hl_mmu_fini(hdev);
+ goto out_err;
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From 8df752ee11ac1ef12295304c5119a9867b67fa49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 23:07:58 +0200
+Subject: habanalabs/gaudi: retry loading TPC f/w on -EINTR
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit 98e8781f008372057bd5cb059ca6b507371e473d ]
+
+If loading the firmware file for the TPC f/w was interrupted, try
+to do it again, up to 5 times.
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 36f0bb7154ab9..ed1bd41262ecd 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -754,11 +754,17 @@ static int gaudi_init_tpc_mem(struct hl_device *hdev)
+ size_t fw_size;
+ void *cpu_addr;
+ dma_addr_t dma_handle;
+- int rc;
++ int rc, count = 5;
+
++again:
+ rc = request_firmware(&fw, GAUDI_TPC_FW_FILE, hdev->dev);
++ if (rc == -EINTR && count-- > 0) {
++ msleep(50);
++ goto again;
++ }
++
+ if (rc) {
+- dev_err(hdev->dev, "Firmware file %s is not found!\n",
++ dev_err(hdev->dev, "Failed to load firmware file %s\n",
+ GAUDI_TPC_FW_FILE);
+ goto out;
+ }
+--
+2.27.0
+
--- /dev/null
+From bc0b3764fc29bd024f6215b955d0685e2987598a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 12:52:06 +0200
+Subject: habanalabs: register to pci shutdown callback
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit fcaebc7354188b0d708c79df4390fbabd4d9799d ]
+
+We need to make sure our device is idle when rebooting a virtual
+machine. This is done in the driver level.
+
+The firmware will later handle FLR but we want to be extra safe and
+stop the devices until the FLR is handled.
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/habanalabs_drv.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/habanalabs/common/habanalabs_drv.c b/drivers/misc/habanalabs/common/habanalabs_drv.c
+index f9067d3ef4376..3bcef64a677ae 100644
+--- a/drivers/misc/habanalabs/common/habanalabs_drv.c
++++ b/drivers/misc/habanalabs/common/habanalabs_drv.c
+@@ -528,6 +528,7 @@ static struct pci_driver hl_pci_driver = {
+ .id_table = ids,
+ .probe = hl_pci_probe,
+ .remove = hl_pci_remove,
++ .shutdown = hl_pci_remove,
+ .driver.pm = &hl_pm_ops,
+ .err_handler = &hl_pci_err_handler,
+ };
+--
+2.27.0
+
--- /dev/null
+From b35e3b8615da421a4aae993927262b06853ec92b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 10:20:30 +0100
+Subject: hwmon: (pwm-fan) Ensure that calculation doesn't discard big period
+ values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 1eda52334e6d13eb1a85f713ce06dd39342b5020 ]
+
+With MAX_PWM being defined to 255 the code
+
+ unsigned long period;
+ ...
+ period = ctx->pwm->args.period;
+ state.duty_cycle = DIV_ROUND_UP(pwm * (period - 1), MAX_PWM);
+
+calculates a too small value for duty_cycle if the configured period is
+big (either by discarding the 64 bit value ctx->pwm->args.period or by
+overflowing the multiplication). As this results in a too slow fan and
+so maybe an overheating machine better be safe than sorry and error out
+in .probe.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20201215092031.152243-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pwm-fan.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 1f63807c0399e..ec171f2b684a1 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -324,8 +324,18 @@ static int pwm_fan_probe(struct platform_device *pdev)
+
+ ctx->pwm_value = MAX_PWM;
+
+- /* Set duty cycle to maximum allowed and enable PWM output */
+ pwm_init_state(ctx->pwm, &state);
++ /*
++ * __set_pwm assumes that MAX_PWM * (period - 1) fits into an unsigned
++ * long. Check this here to prevent the fan running at a too low
++ * frequency.
++ */
++ if (state.period > ULONG_MAX / MAX_PWM + 1) {
++ dev_err(dev, "Configured period too big\n");
++ return -EINVAL;
++ }
++
++ /* Set duty cycle to maximum allowed and enable PWM output */
+ state.duty_cycle = ctx->pwm->args.period - 1;
+ state.enabled = true;
+
+--
+2.27.0
+
--- /dev/null
+From 1508b291566fb1356b867ce78888f2bda74d184a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 20:43:29 +0000
+Subject: io_uring: drop file refs after task cancel
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit de7f1d9e99d8b99e4e494ad8fcd91f0c4c5c9357 ]
+
+io_uring fds marked O_CLOEXEC and we explicitly cancel all requests
+before going through exec, so we don't want to leave task's file
+references to not our anymore io_uring instances.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index cab640c10bc0f..265aea2cd7bc8 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8821,6 +8821,15 @@ static void io_uring_attempt_task_drop(struct file *file)
+ io_uring_del_task_file(file);
+ }
+
++static void io_uring_remove_task_files(struct io_uring_task *tctx)
++{
++ struct file *file;
++ unsigned long index;
++
++ xa_for_each(&tctx->xa, index, file)
++ io_uring_del_task_file(file);
++}
++
+ void __io_uring_files_cancel(struct files_struct *files)
+ {
+ struct io_uring_task *tctx = current->io_uring;
+@@ -8829,16 +8838,12 @@ void __io_uring_files_cancel(struct files_struct *files)
+
+ /* make sure overflow events are dropped */
+ atomic_inc(&tctx->in_idle);
+-
+- xa_for_each(&tctx->xa, index, file) {
+- struct io_ring_ctx *ctx = file->private_data;
+-
+- io_uring_cancel_task_requests(ctx, files);
+- if (files)
+- io_uring_del_task_file(file);
+- }
+-
++ xa_for_each(&tctx->xa, index, file)
++ io_uring_cancel_task_requests(file->private_data, files);
+ atomic_dec(&tctx->in_idle);
++
++ if (files)
++ io_uring_remove_task_files(tctx);
+ }
+
+ static s64 tctx_inflight(struct io_uring_task *tctx)
+@@ -8901,6 +8906,8 @@ void __io_uring_task_cancel(void)
+
+ finish_wait(&tctx->wait, &wait);
+ atomic_dec(&tctx->in_idle);
++
++ io_uring_remove_task_files(tctx);
+ }
+
+ static int io_uring_flush(struct file *file, void *data)
+--
+2.27.0
+
--- /dev/null
+From 7e608fb1e6da94e6a259da884c0fe2132b114e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 08:53:23 +0800
+Subject: iommu/vt-d: Fix lockdep splat in sva bind()/unbind()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 420d42f6f9db27d88bc4f83e3e668fcdacbf7e29 ]
+
+Lock(&iommu->lock) without disabling irq causes lockdep warnings.
+
+========================================================
+WARNING: possible irq lock inversion dependency detected
+5.11.0-rc1+ #828 Not tainted
+--------------------------------------------------------
+kworker/0:1H/120 just changed the state of lock:
+ffffffffad9ea1b8 (device_domain_lock){..-.}-{2:2}, at:
+iommu_flush_dev_iotlb.part.0+0x32/0x120
+but this lock took another, SOFTIRQ-unsafe lock in the past:
+ (&iommu->lock){+.+.}-{2:2}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&iommu->lock);
+ local_irq_disable();
+ lock(device_domain_lock);
+ lock(&iommu->lock);
+ <Interrupt>
+ lock(device_domain_lock);
+
+ *** DEADLOCK ***
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20201231005323.2178523-5-baolu.lu@linux.intel.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 4a10c9ff368c5..e17cd94d1fd1f 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -281,6 +281,7 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,
+ struct dmar_domain *dmar_domain;
+ struct device_domain_info *info;
+ struct intel_svm *svm = NULL;
++ unsigned long iflags;
+ int ret = 0;
+
+ if (WARN_ON(!iommu) || !data)
+@@ -382,12 +383,12 @@ int intel_svm_bind_gpasid(struct iommu_domain *domain, struct device *dev,
+ * each bind of a new device even with an existing PASID, we need to
+ * call the nested mode setup function here.
+ */
+- spin_lock(&iommu->lock);
++ spin_lock_irqsave(&iommu->lock, iflags);
+ ret = intel_pasid_setup_nested(iommu, dev,
+ (pgd_t *)(uintptr_t)data->gpgd,
+ data->hpasid, &data->vendor.vtd, dmar_domain,
+ data->addr_width);
+- spin_unlock(&iommu->lock);
++ spin_unlock_irqrestore(&iommu->lock, iflags);
+ if (ret) {
+ dev_err_ratelimited(dev, "Failed to set up PASID %llu in nested mode, Err %d\n",
+ data->hpasid, ret);
+@@ -487,6 +488,7 @@ intel_svm_bind_mm(struct device *dev, unsigned int flags,
+ struct device_domain_info *info;
+ struct intel_svm_dev *sdev;
+ struct intel_svm *svm = NULL;
++ unsigned long iflags;
+ int pasid_max;
+ int ret;
+
+@@ -606,14 +608,14 @@ intel_svm_bind_mm(struct device *dev, unsigned int flags,
+ }
+ }
+
+- spin_lock(&iommu->lock);
++ spin_lock_irqsave(&iommu->lock, iflags);
+ ret = intel_pasid_setup_first_level(iommu, dev,
+ mm ? mm->pgd : init_mm.pgd,
+ svm->pasid, FLPT_DEFAULT_DID,
+ (mm ? 0 : PASID_FLAG_SUPERVISOR_MODE) |
+ (cpu_feature_enabled(X86_FEATURE_LA57) ?
+ PASID_FLAG_FL5LP : 0));
+- spin_unlock(&iommu->lock);
++ spin_unlock_irqrestore(&iommu->lock, iflags);
+ if (ret) {
+ if (mm)
+ mmu_notifier_unregister(&svm->notifier, mm);
+@@ -633,14 +635,14 @@ intel_svm_bind_mm(struct device *dev, unsigned int flags,
+ * Binding a new device with existing PASID, need to setup
+ * the PASID entry.
+ */
+- spin_lock(&iommu->lock);
++ spin_lock_irqsave(&iommu->lock, iflags);
+ ret = intel_pasid_setup_first_level(iommu, dev,
+ mm ? mm->pgd : init_mm.pgd,
+ svm->pasid, FLPT_DEFAULT_DID,
+ (mm ? 0 : PASID_FLAG_SUPERVISOR_MODE) |
+ (cpu_feature_enabled(X86_FEATURE_LA57) ?
+ PASID_FLAG_FL5LP : 0));
+- spin_unlock(&iommu->lock);
++ spin_unlock_irqrestore(&iommu->lock, iflags);
+ if (ret) {
+ kfree(sdev);
+ goto out;
+--
+2.27.0
+
--- /dev/null
+From cdc3bcb979e83a84071d7ce071b6ad91f5447a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 15:35:42 +0900
+Subject: kconfig: remove 'kvmconfig' and 'xenconfig' shorthands
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 9bba03d4473df0b707224d4d2067b62d1e1e2a77 ]
+
+Linux 5.10 is out. Remove the 'kvmconfig' and 'xenconfig' shorthands
+as previously announced.
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/Makefile | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
+index e46df0a2d4f9d..2c40e68853dde 100644
+--- a/scripts/kconfig/Makefile
++++ b/scripts/kconfig/Makefile
+@@ -94,16 +94,6 @@ configfiles=$(wildcard $(srctree)/kernel/configs/$@ $(srctree)/arch/$(SRCARCH)/c
+ $(Q)$(CONFIG_SHELL) $(srctree)/scripts/kconfig/merge_config.sh -m .config $(configfiles)
+ $(Q)$(MAKE) -f $(srctree)/Makefile olddefconfig
+
+-PHONY += kvmconfig
+-kvmconfig: kvm_guest.config
+- @echo >&2 "WARNING: 'make $@' will be removed after Linux 5.10"
+- @echo >&2 " Please use 'make $<' instead."
+-
+-PHONY += xenconfig
+-xenconfig: xen.config
+- @echo >&2 "WARNING: 'make $@' will be removed after Linux 5.10"
+- @echo >&2 " Please use 'make $<' instead."
+-
+ PHONY += tinyconfig
+ tinyconfig:
+ $(Q)$(MAKE) -f $(srctree)/Makefile allnoconfig tiny.config
+--
+2.27.0
+
--- /dev/null
+From 695eacff5f8258559b17e0a5bc3dc4f7ac64e661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 15:23:25 +0900
+Subject: lib/raid6: Let $(UNROLL) rules work with macOS userland
+
+From: John Millikin <john@john-millikin.com>
+
+[ Upstream commit 0c36d88cff4d72149f94809303c5180b6f716d39 ]
+
+Older versions of BSD awk are fussy about the order of '-v' and '-f'
+flags, and require a space after the flag name. This causes build
+failures on platforms with an old awk, such as macOS and NetBSD.
+
+Since GNU awk and modern versions of BSD awk (distributed with
+FreeBSD/OpenBSD) are fine with either form, the definition of
+'cmd_unroll' can be trivially tweaked to let the lib/raid6 Makefile
+work with both old and new awk flag dialects.
+
+Signed-off-by: John Millikin <john@john-millikin.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/raid6/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
+index b4c0df6d706dc..c770570bfe4f2 100644
+--- a/lib/raid6/Makefile
++++ b/lib/raid6/Makefile
+@@ -48,7 +48,7 @@ endif
+ endif
+
+ quiet_cmd_unroll = UNROLL $@
+- cmd_unroll = $(AWK) -f$(srctree)/$(src)/unroll.awk -vN=$* < $< > $@
++ cmd_unroll = $(AWK) -v N=$* -f $(srctree)/$(src)/unroll.awk < $< > $@
+
+ targets += int1.c int2.c int4.c int8.c int16.c int32.c
+ $(obj)/int%.c: $(src)/int.uc $(src)/unroll.awk FORCE
+--
+2.27.0
+
--- /dev/null
+From 3e62a56e487252cb7e54a30381e02423c4363102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 22:36:22 +0100
+Subject: misdn: dsp: select CONFIG_BITREVERSE
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 51049bd903a81307f751babe15a1df8d197884e8 ]
+
+Without this, we run into a link error
+
+arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o: in function `dsp_audio_generate_law_tables':
+(.text+0x30c): undefined reference to `byte_rev_table'
+arm-linux-gnueabi-ld: drivers/isdn/mISDN/dsp_audio.o:(.text+0x5e4): more undefined references to `byte_rev_table' follow
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/mISDN/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/isdn/mISDN/Kconfig b/drivers/isdn/mISDN/Kconfig
+index 26cf0ac9c4ad0..c9a53c2224728 100644
+--- a/drivers/isdn/mISDN/Kconfig
++++ b/drivers/isdn/mISDN/Kconfig
+@@ -13,6 +13,7 @@ if MISDN != n
+ config MISDN_DSP
+ tristate "Digital Audio Processing of transparent data"
+ depends on MISDN
++ select BITREVERSE
+ help
+ Enable support for digital audio processing capability.
+
+--
+2.27.0
+
--- /dev/null
+From ddd669d6fa03135d6959bdeb68b2f3fcdac7ad18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 20:15:15 +1100
+Subject: net: ethernet: fs_enet: Add missing MODULE_LICENSE
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 445c6198fe7be03b7d38e66fe8d4b3187bc251d4 ]
+
+Since commit 1d6cd3929360 ("modpost: turn missing MODULE_LICENSE()
+into error") the ppc32_allmodconfig build fails with:
+
+ ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-fec.o
+ ERROR: modpost: missing MODULE_LICENSE() in drivers/net/ethernet/freescale/fs_enet/mii-bitbang.o
+
+Add the missing MODULE_LICENSEs to fix the build. Both files include a
+copyright header indicating they are GPL v2.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 1 +
+ drivers/net/ethernet/freescale/fs_enet/mii-fec.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+index c8e5d889bd81f..21de56345503f 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c
+@@ -223,3 +223,4 @@ static struct platform_driver fs_enet_bb_mdio_driver = {
+ };
+
+ module_platform_driver(fs_enet_bb_mdio_driver);
++MODULE_LICENSE("GPL");
+diff --git a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+index 8b51ee142fa3c..152f4d83765aa 100644
+--- a/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
++++ b/drivers/net/ethernet/freescale/fs_enet/mii-fec.c
+@@ -224,3 +224,4 @@ static struct platform_driver fs_enet_fec_mdio_driver = {
+ };
+
+ module_platform_driver(fs_enet_fec_mdio_driver);
++MODULE_LICENSE("GPL");
+--
+2.27.0
+
--- /dev/null
+From bec64974ac3a2b1c74c9cf8c39b651136f3fe901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 11:53:40 +0300
+Subject: netfilter: ipset: fixes possible oops in mtype_resize
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 2b33d6ffa9e38f344418976b06057e2fc2aa9e2a ]
+
+currently mtype_resize() can cause oops
+
+ t = ip_set_alloc(htable_size(htable_bits));
+ if (!t) {
+ ret = -ENOMEM;
+ goto out;
+ }
+ t->hregion = ip_set_alloc(ahash_sizeof_regions(htable_bits));
+
+Increased htable_bits can force htable_size() to return 0.
+In own turn ip_set_alloc(0) returns not 0 but ZERO_SIZE_PTR,
+so follwoing access to t->hregion should trigger an OOPS.
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_gen.h | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
+index 7d01086b38f0f..7cd1d31fb2b88 100644
+--- a/net/netfilter/ipset/ip_set_hash_gen.h
++++ b/net/netfilter/ipset/ip_set_hash_gen.h
+@@ -630,7 +630,7 @@ mtype_resize(struct ip_set *set, bool retried)
+ struct htype *h = set->data;
+ struct htable *t, *orig;
+ u8 htable_bits;
+- size_t dsize = set->dsize;
++ size_t hsize, dsize = set->dsize;
+ #ifdef IP_SET_HASH_WITH_NETS
+ u8 flags;
+ struct mtype_elem *tmp;
+@@ -654,14 +654,12 @@ mtype_resize(struct ip_set *set, bool retried)
+ retry:
+ ret = 0;
+ htable_bits++;
+- if (!htable_bits) {
+- /* In case we have plenty of memory :-) */
+- pr_warn("Cannot increase the hashsize of set %s further\n",
+- set->name);
+- ret = -IPSET_ERR_HASH_FULL;
+- goto out;
+- }
+- t = ip_set_alloc(htable_size(htable_bits));
++ if (!htable_bits)
++ goto hbwarn;
++ hsize = htable_size(htable_bits);
++ if (!hsize)
++ goto hbwarn;
++ t = ip_set_alloc(hsize);
+ if (!t) {
+ ret = -ENOMEM;
+ goto out;
+@@ -803,6 +801,12 @@ cleanup:
+ if (ret == -EAGAIN)
+ goto retry;
+ goto out;
++
++hbwarn:
++ /* In case we have plenty of memory :-) */
++ pr_warn("Cannot increase the hashsize of set %s further\n", set->name);
++ ret = -IPSET_ERR_HASH_FULL;
++ goto out;
+ }
+
+ /* Get the current number of elements and ext_size in the set */
+--
+2.27.0
+
--- /dev/null
+From 88c7f9066d84e5f41a750c9357eff394fa573484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 14:09:00 -0800
+Subject: nvme: avoid possible double fetch in handling CQE
+
+From: Lalithambika Krishnakumar <lalithambika.krishnakumar@intel.com>
+
+[ Upstream commit 62df80165d7f197c9c0652e7416164f294a96661 ]
+
+While handling the completion queue, keep a local copy of the command id
+from the DMA-accessible completion entry. This silences a time-of-check
+to time-of-use (TOCTOU) warning from KF/x[1], with respect to a
+Thunderclap[2] vulnerability analysis. The double-read impact appears
+benign.
+
+There may be a theoretical window for @command_id to be used as an
+adversary-controlled array-index-value for mounting a speculative
+execution attack, but that mitigation is saved for a potential follow-on.
+A man-in-the-middle attack on the data payload is out of scope for this
+analysis and is hopefully mitigated by filesystem integrity mechanisms.
+
+[1] https://github.com/intel/kernel-fuzzer-for-xen-project
+[2] http://thunderclap.io/thunderclap-paper-ndss2019.pdf
+Signed-off-by: Lalithambika Krishna Kumar <lalithambika.krishnakumar@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 143f16a9f8d7e..a89d74c5cd1a7 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -967,6 +967,7 @@ static inline struct blk_mq_tags *nvme_queue_tagset(struct nvme_queue *nvmeq)
+ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ {
+ struct nvme_completion *cqe = &nvmeq->cqes[idx];
++ __u16 command_id = READ_ONCE(cqe->command_id);
+ struct request *req;
+
+ /*
+@@ -975,17 +976,17 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ * aborts. We don't even bother to allocate a struct request
+ * for them but rather special case them here.
+ */
+- if (unlikely(nvme_is_aen_req(nvmeq->qid, cqe->command_id))) {
++ if (unlikely(nvme_is_aen_req(nvmeq->qid, command_id))) {
+ nvme_complete_async_event(&nvmeq->dev->ctrl,
+ cqe->status, &cqe->result);
+ return;
+ }
+
+- req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), cqe->command_id);
++ req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), command_id);
+ if (unlikely(!req)) {
+ dev_warn(nvmeq->dev->ctrl.device,
+ "invalid id %d completed on queue %d\n",
+- cqe->command_id, le16_to_cpu(cqe->sq_id));
++ command_id, le16_to_cpu(cqe->sq_id));
+ return;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 73400ef1a30649780bbde47769c43ca34d5aa30f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 21:46:57 +0530
+Subject: nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN
+
+From: Gopal Tiwari <gtiwari@redhat.com>
+
+[ Upstream commit 7ee5c78ca3895d44e918c38332921983ed678be0 ]
+
+A system with more than one of these SSDs will only have one usable.
+Hence the kernel fails to detect nvme devices due to duplicate cntlids.
+
+[ 6.274554] nvme nvme1: Duplicate cntlid 33 with nvme0, rejecting
+[ 6.274566] nvme nvme1: Removing after probe failure status: -22
+
+Adding the NVME_QUIRK_IGNORE_DEV_SUBNQN quirk to resolves the issue.
+
+Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3be352403839a..143f16a9f8d7e 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3201,7 +3201,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ { PCI_DEVICE(0x144d, 0xa821), /* Samsung PM1725 */
+ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+ { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */
+- .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
++ .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY |
++ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ { PCI_DEVICE(0x1d1d, 0x1f1f), /* LighNVM qemu device */
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */
+--
+2.27.0
+
--- /dev/null
+From 4d4828aa45310377ce94e6258bd6fe0b7453feb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 10:46:54 +0200
+Subject: nvmet-rdma: Fix list_del corruption on queue establishment failure
+
+From: Israel Rukshin <israelr@nvidia.com>
+
+[ Upstream commit 9ceb7863537748c67fa43ac4f2f565819bbd36e4 ]
+
+When a queue is in NVMET_RDMA_Q_CONNECTING state, it may has some
+requests at rsp_wait_list. In case a disconnect occurs at this
+state, no one will empty this list and will return the requests to
+free_rsps list. Normally nvmet_rdma_queue_established() free those
+requests after moving the queue to NVMET_RDMA_Q_LIVE state, but in
+this case __nvmet_rdma_queue_disconnect() is called before. The
+crash happens at nvmet_rdma_free_rsps() when calling
+list_del(&rsp->free_list), because the request exists only at
+the wait list. To fix the issue, simply clear rsp_wait_list when
+destroying the queue.
+
+Signed-off-by: Israel Rukshin <israelr@nvidia.com>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/rdma.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
+index 5c1e7cb7fe0de..bdfc22eb2a10f 100644
+--- a/drivers/nvme/target/rdma.c
++++ b/drivers/nvme/target/rdma.c
+@@ -1641,6 +1641,16 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
+ spin_lock_irqsave(&queue->state_lock, flags);
+ switch (queue->state) {
+ case NVMET_RDMA_Q_CONNECTING:
++ while (!list_empty(&queue->rsp_wait_list)) {
++ struct nvmet_rdma_rsp *rsp;
++
++ rsp = list_first_entry(&queue->rsp_wait_list,
++ struct nvmet_rdma_rsp,
++ wait_list);
++ list_del(&rsp->wait_list);
++ nvmet_rdma_put_rsp(rsp);
++ }
++ fallthrough;
+ case NVMET_RDMA_Q_LIVE:
+ queue->state = NVMET_RDMA_Q_DISCONNECTING;
+ disconnect = true;
+--
+2.27.0
+
--- /dev/null
+From 0d9de2903c6c4fb45054b1788d49401cb7dd5a01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 09:43:54 -0800
+Subject: poll: fix performance regression due to out-of-line __put_user()
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit ef0ba05538299f1391cbe097de36895bb36ecfe6 ]
+
+The kernel test robot reported a -5.8% performance regression on the
+"poll2" test of will-it-scale, and bisected it to commit d55564cfc222
+("x86: Make __put_user() generate an out-of-line call").
+
+I didn't expect an out-of-line __put_user() to matter, because no normal
+core code should use that non-checking legacy version of user access any
+more. But I had overlooked the very odd poll() usage, which does a
+__put_user() to update the 'revents' values of the poll array.
+
+Now, Al Viro correctly points out that instead of updating just the
+'revents' field, it would be much simpler to just copy the _whole_
+pollfd entry, and then we could just use "copy_to_user()" on the whole
+array of entries, the same way we use "copy_from_user()" a few lines
+earlier to get the original values.
+
+But that is not what we've traditionally done, and I worry that threaded
+applications might be concurrently modifying the other fields of the
+pollfd array. So while Al's suggestion is simpler - and perhaps worth
+trying in the future - this instead keeps the "just update revents"
+model.
+
+To fix the performance regression, use the modern "unsafe_put_user()"
+instead of __put_user(), with the proper "user_write_access_begin()"
+guarding in place. This improves code generation enormously.
+
+Link: https://lore.kernel.org/lkml/20210107134723.GA28532@xsang-OptiPlex-9020/
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Tested-by: Oliver Sang <oliver.sang@intel.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: David Laight <David.Laight@aculab.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/select.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/fs/select.c b/fs/select.c
+index ebfebdfe5c69a..37aaa8317f3ae 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -1011,14 +1011,17 @@ static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ fdcount = do_poll(head, &table, end_time);
+ poll_freewait(&table);
+
++ if (!user_write_access_begin(ufds, nfds * sizeof(*ufds)))
++ goto out_fds;
++
+ for (walk = head; walk; walk = walk->next) {
+ struct pollfd *fds = walk->entries;
+ int j;
+
+- for (j = 0; j < walk->len; j++, ufds++)
+- if (__put_user(fds[j].revents, &ufds->revents))
+- goto out_fds;
++ for (j = walk->len; j; fds++, ufds++, j--)
++ unsafe_put_user(fds->revents, &ufds->revents, Efault);
+ }
++ user_write_access_end();
+
+ err = fdcount;
+ out_fds:
+@@ -1030,6 +1033,11 @@ out_fds:
+ }
+
+ return err;
++
++Efault:
++ user_write_access_end();
++ err = -EFAULT;
++ goto out_fds;
+ }
+
+ static long do_restart_poll(struct restart_block *restart_block)
+--
+2.27.0
+
--- /dev/null
+From 7558e8a1ca0376a06eef608fcdbbbe4b36e61613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 19:38:07 +0100
+Subject: regulator: bd718x7: Add enable times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guido Günther <agx@sigxcpu.org>
+
+[ Upstream commit 3b66e4a8e58a85af3212c7117d7a29c9ef6679a2 ]
+
+Use the typical startup times from the data sheet so boards get a
+reasonable default. Not setting any enable time can lead to board hangs
+when e.g. clocks are enabled too soon afterwards.
+
+This fixes gpu power domain resume on the Librem 5.
+
+[Moved #defines into driver, seems to be general agreement and avoids any
+cross tree issues -- broonie]
+
+Signed-off-by: Guido Günther <agx@sigxcpu.org>
+Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Link: https://lore.kernel.org/r/41fb2ed19f584f138336344e2297ae7301f72b75.1608316658.git.agx@sigxcpu.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd718x7-regulator.c | 57 +++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/drivers/regulator/bd718x7-regulator.c b/drivers/regulator/bd718x7-regulator.c
+index 0774467994fbe..3333b8905f1b7 100644
+--- a/drivers/regulator/bd718x7-regulator.c
++++ b/drivers/regulator/bd718x7-regulator.c
+@@ -15,6 +15,36 @@
+ #include <linux/regulator/of_regulator.h>
+ #include <linux/slab.h>
+
++/* Typical regulator startup times as per data sheet in uS */
++#define BD71847_BUCK1_STARTUP_TIME 144
++#define BD71847_BUCK2_STARTUP_TIME 162
++#define BD71847_BUCK3_STARTUP_TIME 162
++#define BD71847_BUCK4_STARTUP_TIME 240
++#define BD71847_BUCK5_STARTUP_TIME 270
++#define BD71847_BUCK6_STARTUP_TIME 200
++#define BD71847_LDO1_STARTUP_TIME 440
++#define BD71847_LDO2_STARTUP_TIME 370
++#define BD71847_LDO3_STARTUP_TIME 310
++#define BD71847_LDO4_STARTUP_TIME 400
++#define BD71847_LDO5_STARTUP_TIME 530
++#define BD71847_LDO6_STARTUP_TIME 400
++
++#define BD71837_BUCK1_STARTUP_TIME 160
++#define BD71837_BUCK2_STARTUP_TIME 180
++#define BD71837_BUCK3_STARTUP_TIME 180
++#define BD71837_BUCK4_STARTUP_TIME 180
++#define BD71837_BUCK5_STARTUP_TIME 160
++#define BD71837_BUCK6_STARTUP_TIME 240
++#define BD71837_BUCK7_STARTUP_TIME 220
++#define BD71837_BUCK8_STARTUP_TIME 200
++#define BD71837_LDO1_STARTUP_TIME 440
++#define BD71837_LDO2_STARTUP_TIME 370
++#define BD71837_LDO3_STARTUP_TIME 310
++#define BD71837_LDO4_STARTUP_TIME 400
++#define BD71837_LDO5_STARTUP_TIME 310
++#define BD71837_LDO6_STARTUP_TIME 400
++#define BD71837_LDO7_STARTUP_TIME 530
++
+ /*
+ * BD718(37/47/50) have two "enable control modes". ON/OFF can either be
+ * controlled by software - or by PMIC internal HW state machine. Whether
+@@ -613,6 +643,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD718XX_REG_BUCK1_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK1_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -646,6 +677,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD718XX_REG_BUCK2_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK2_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -680,6 +712,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .linear_range_selectors = bd71847_buck3_volt_range_sel,
+ .enable_reg = BD718XX_REG_1ST_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK3_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -706,6 +739,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_range_mask = BD71847_BUCK4_RANGE_MASK,
+ .linear_range_selectors = bd71847_buck4_volt_range_sel,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK4_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -727,6 +761,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = BD718XX_3RD_NODVS_BUCK_MASK,
+ .enable_reg = BD718XX_REG_3RD_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK5_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -750,6 +785,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = BD718XX_4TH_NODVS_BUCK_MASK,
+ .enable_reg = BD718XX_REG_4TH_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71847_BUCK6_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -775,6 +811,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .linear_range_selectors = bd718xx_ldo1_volt_range_sel,
+ .enable_reg = BD718XX_REG_LDO1_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO1_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -796,6 +833,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .n_voltages = ARRAY_SIZE(ldo_2_volts),
+ .enable_reg = BD718XX_REG_LDO2_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO2_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -818,6 +856,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = BD718XX_LDO3_MASK,
+ .enable_reg = BD718XX_REG_LDO3_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO3_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -840,6 +879,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = BD718XX_LDO4_MASK,
+ .enable_reg = BD718XX_REG_LDO4_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO4_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -865,6 +905,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .linear_range_selectors = bd71847_ldo5_volt_range_sel,
+ .enable_reg = BD718XX_REG_LDO5_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO5_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -889,6 +930,7 @@ static struct bd718xx_regulator_data bd71847_regulators[] = {
+ .vsel_mask = BD718XX_LDO6_MASK,
+ .enable_reg = BD718XX_REG_LDO6_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71847_LDO6_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -942,6 +984,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD718XX_REG_BUCK1_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK1_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -975,6 +1018,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD718XX_REG_BUCK2_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK2_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -1005,6 +1049,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD71837_REG_BUCK3_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK3_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -1033,6 +1078,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = DVS_BUCK_RUN_MASK,
+ .enable_reg = BD71837_REG_BUCK4_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK4_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ .of_parse_cb = buck_set_hw_dvs_levels,
+ },
+@@ -1065,6 +1111,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .linear_range_selectors = bd71837_buck5_volt_range_sel,
+ .enable_reg = BD718XX_REG_1ST_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK5_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1088,6 +1135,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD71837_BUCK6_MASK,
+ .enable_reg = BD718XX_REG_2ND_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK6_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1109,6 +1157,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD718XX_3RD_NODVS_BUCK_MASK,
+ .enable_reg = BD718XX_REG_3RD_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK7_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1132,6 +1181,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD718XX_4TH_NODVS_BUCK_MASK,
+ .enable_reg = BD718XX_REG_4TH_NODVS_BUCK_CTRL,
+ .enable_mask = BD718XX_BUCK_EN,
++ .enable_time = BD71837_BUCK8_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1157,6 +1207,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .linear_range_selectors = bd718xx_ldo1_volt_range_sel,
+ .enable_reg = BD718XX_REG_LDO1_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO1_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1178,6 +1229,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .n_voltages = ARRAY_SIZE(ldo_2_volts),
+ .enable_reg = BD718XX_REG_LDO2_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO2_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1200,6 +1252,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD718XX_LDO3_MASK,
+ .enable_reg = BD718XX_REG_LDO3_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO3_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1222,6 +1275,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD718XX_LDO4_MASK,
+ .enable_reg = BD718XX_REG_LDO4_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO4_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1246,6 +1300,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD71837_LDO5_MASK,
+ .enable_reg = BD718XX_REG_LDO5_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO5_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1272,6 +1327,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD718XX_LDO6_MASK,
+ .enable_reg = BD718XX_REG_LDO6_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO6_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+@@ -1296,6 +1352,7 @@ static struct bd718xx_regulator_data bd71837_regulators[] = {
+ .vsel_mask = BD71837_LDO7_MASK,
+ .enable_reg = BD71837_REG_LDO7_VOLT,
+ .enable_mask = BD718XX_LDO_EN,
++ .enable_time = BD71837_LDO7_STARTUP_TIME,
+ .owner = THIS_MODULE,
+ },
+ .init = {
+--
+2.27.0
+
--- /dev/null
+From 4e8b835f17e961f99803b691bf0abb5ad0b8bdfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 18:17:40 +0800
+Subject: selftests: fix the return value for UDP GRO test
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 3503ee6c0bec5f173d606359e6384a5ef85492fb ]
+
+The udpgro.sh will always return 0 (unless the bpf selftest was not
+build first) even if there are some failed sub test-cases.
+
+Therefore the kselftest framework will report this case is OK.
+
+Check and return the exit status of each test to make it easier to
+spot real failures.
+
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/udpgro.sh | 34 +++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/tools/testing/selftests/net/udpgro.sh b/tools/testing/selftests/net/udpgro.sh
+index ac2a30be9b325..f8a19f548ae9d 100755
+--- a/tools/testing/selftests/net/udpgro.sh
++++ b/tools/testing/selftests/net/udpgro.sh
+@@ -5,6 +5,14 @@
+
+ readonly PEER_NS="ns-peer-$(mktemp -u XXXXXX)"
+
++# set global exit status, but never reset nonzero one.
++check_err()
++{
++ if [ $ret -eq 0 ]; then
++ ret=$1
++ fi
++}
++
+ cleanup() {
+ local -r jobs="$(jobs -p)"
+ local -r ns="$(ip netns list|grep $PEER_NS)"
+@@ -44,7 +52,9 @@ run_one() {
+ # Hack: let bg programs complete the startup
+ sleep 0.1
+ ./udpgso_bench_tx ${tx_args}
++ ret=$?
+ wait $(jobs -p)
++ return $ret
+ }
+
+ run_test() {
+@@ -87,8 +97,10 @@ run_one_nat() {
+
+ sleep 0.1
+ ./udpgso_bench_tx ${tx_args}
++ ret=$?
+ kill -INT $pid
+ wait $(jobs -p)
++ return $ret
+ }
+
+ run_one_2sock() {
+@@ -110,7 +122,9 @@ run_one_2sock() {
+ sleep 0.1
+ # first UDP GSO socket should be closed at this point
+ ./udpgso_bench_tx ${tx_args}
++ ret=$?
+ wait $(jobs -p)
++ return $ret
+ }
+
+ run_nat_test() {
+@@ -131,36 +145,54 @@ run_all() {
+ local -r core_args="-l 4"
+ local -r ipv4_args="${core_args} -4 -D 192.168.1.1"
+ local -r ipv6_args="${core_args} -6 -D 2001:db8::1"
++ ret=0
+
+ echo "ipv4"
+ run_test "no GRO" "${ipv4_args} -M 10 -s 1400" "-4 -n 10 -l 1400"
++ check_err $?
+
+ # explicitly check we are not receiving UDP_SEGMENT cmsg (-S -1)
+ # when GRO does not take place
+ run_test "no GRO chk cmsg" "${ipv4_args} -M 10 -s 1400" "-4 -n 10 -l 1400 -S -1"
++ check_err $?
+
+ # the GSO packets are aggregated because:
+ # * veth schedule napi after each xmit
+ # * segmentation happens in BH context, veth napi poll is delayed after
+ # the transmission of the last segment
+ run_test "GRO" "${ipv4_args} -M 1 -s 14720 -S 0 " "-4 -n 1 -l 14720"
++ check_err $?
+ run_test "GRO chk cmsg" "${ipv4_args} -M 1 -s 14720 -S 0 " "-4 -n 1 -l 14720 -S 1472"
++ check_err $?
+ run_test "GRO with custom segment size" "${ipv4_args} -M 1 -s 14720 -S 500 " "-4 -n 1 -l 14720"
++ check_err $?
+ run_test "GRO with custom segment size cmsg" "${ipv4_args} -M 1 -s 14720 -S 500 " "-4 -n 1 -l 14720 -S 500"
++ check_err $?
+
+ run_nat_test "bad GRO lookup" "${ipv4_args} -M 1 -s 14720 -S 0" "-n 10 -l 1472"
++ check_err $?
+ run_2sock_test "multiple GRO socks" "${ipv4_args} -M 1 -s 14720 -S 0 " "-4 -n 1 -l 14720 -S 1472"
++ check_err $?
+
+ echo "ipv6"
+ run_test "no GRO" "${ipv6_args} -M 10 -s 1400" "-n 10 -l 1400"
++ check_err $?
+ run_test "no GRO chk cmsg" "${ipv6_args} -M 10 -s 1400" "-n 10 -l 1400 -S -1"
++ check_err $?
+ run_test "GRO" "${ipv6_args} -M 1 -s 14520 -S 0" "-n 1 -l 14520"
++ check_err $?
+ run_test "GRO chk cmsg" "${ipv6_args} -M 1 -s 14520 -S 0" "-n 1 -l 14520 -S 1452"
++ check_err $?
+ run_test "GRO with custom segment size" "${ipv6_args} -M 1 -s 14520 -S 500" "-n 1 -l 14520"
++ check_err $?
+ run_test "GRO with custom segment size cmsg" "${ipv6_args} -M 1 -s 14520 -S 500" "-n 1 -l 14520 -S 500"
++ check_err $?
+
+ run_nat_test "bad GRO lookup" "${ipv6_args} -M 1 -s 14520 -S 0" "-n 10 -l 1452"
++ check_err $?
+ run_2sock_test "multiple GRO socks" "${ipv6_args} -M 1 -s 14520 -S 0 " "-n 1 -l 14520 -S 1452"
++ check_err $?
++ return $ret
+ }
+
+ if [ ! -f ../bpf/xdp_dummy.o ]; then
+@@ -180,3 +212,5 @@ elif [[ $1 == "__subprocess_2sock" ]]; then
+ shift
+ run_one_2sock $@
+ fi
++
++exit $?
+--
+2.27.0
+
ext4-don-t-leak-old-mountpoint-samples.patch
io_uring-don-t-take-files-mm-for-a-dead-task.patch
io_uring-drop-mm-and-files-after-task_work_run.patch
+arc-build-remove-non-existing-bootpimage-from-kbuild.patch
+arc-build-add-uimage.lzma-to-the-top-level-target.patch
+arc-build-add-boot_targets-to-phony.patch
+arc-build-move-symlink-creation-to-arch-arc-makefile.patch
+arm-omap2-pmic-cpcap-fix-maximum-voltage-to-be-consi.patch
+ath11k-fix-crash-caused-by-null-rx_channel.patch
+netfilter-ipset-fixes-possible-oops-in-mtype_resize.patch
+ath11k-qmi-try-to-allocate-a-big-block-of-dma-memory.patch
+btrfs-fix-async-discard-stall.patch
+btrfs-merge-critical-sections-of-discard-lock-in-wor.patch
+btrfs-fix-transaction-leak-and-crash-after-ro-remoun.patch
+regulator-bd718x7-add-enable-times.patch
+ethernet-ucc_geth-fix-definition-and-size-of-ucc_get.patch
+arm-dts-ux500-golden-set-display-max-brightness.patch
+habanalabs-adjust-pci-controller-init-to-new-firmwar.patch
+habanalabs-gaudi-retry-loading-tpc-f-w-on-eintr.patch
+habanalabs-register-to-pci-shutdown-callback.patch
+staging-spmi-hisi-spmi-controller-fix-some-error-han.patch
+spi-altera-fix-return-value-for-altera_spi_txrx.patch
+habanalabs-fix-memleak-in-hl_device_reset.patch
+hwmon-pwm-fan-ensure-that-calculation-doesn-t-discar.patch
+lib-raid6-let-unroll-rules-work-with-macos-userland.patch
+kconfig-remove-kvmconfig-and-xenconfig-shorthands.patch
+spi-fix-the-divide-by-0-error-when-calculating-xfer-.patch
+dmaengine-stm32-mdma-fix-stm32_mdma_very_high_priori.patch
+io_uring-drop-file-refs-after-task-cancel.patch
+bfq-fix-computation-of-shallow-depth.patch
+arch-arc-add-copy_user_page-to-asm-page.h-to-fix-bui.patch
+misdn-dsp-select-config_bitreverse.patch
+net-ethernet-fs_enet-add-missing-module_license.patch
+selftests-fix-the-return-value-for-udp-gro-test.patch
+nvme-pci-mark-samsung-pm1725a-as-ignore_dev_subnqn.patch
+nvme-avoid-possible-double-fetch-in-handling-cqe.patch
+nvmet-rdma-fix-list_del-corruption-on-queue-establis.patch
+drm-amd-display-fix-sysfs-amdgpu_current_backlight_p.patch
+drm-amdgpu-fix-a-gpu-hang-issue-when-remove-device.patch
+drm-amd-pm-fix-the-failure-when-change-power-profile.patch
+drm-amdgpu-fix-potential-memory-leak-during-navi12-d.patch
+usb-typec-fix-copy-paste-error-for-nvidia-alt-mode-d.patch
+iommu-vt-d-fix-lockdep-splat-in-sva-bind-unbind.patch
+acpi-scan-add-stub-acpi_create_platform_device-for-c.patch
+drm-msm-call-msm_init_vram-before-binding-the-gpu.patch
+arm-picoxcell-fix-missing-interrupt-parent-propertie.patch
+poll-fix-performance-regression-due-to-out-of-line-_.patch
--- /dev/null
+From 5f1f3191c94cfbd19b7bcc63d62186d8b97712de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Dec 2020 13:27:41 +0800
+Subject: spi: altera: fix return value for altera_spi_txrx()
+
+From: Xu Yilun <yilun.xu@intel.com>
+
+[ Upstream commit ede090f5a438e97d0586f64067bbb956e30a2a31 ]
+
+This patch fixes the return value for altera_spi_txrx. It should return
+1 for interrupt transfer mode, and return 0 for polling transfer mode.
+
+The altera_spi_txrx() implements the spi_controller.transfer_one
+callback. According to the spi-summary.rst, the transfer_one should
+return 0 when transfer is finished, return 1 when transfer is still in
+progress.
+
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/1609219662-27057-2-git-send-email-yilun.xu@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-altera.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/spi/spi-altera.c b/drivers/spi/spi-altera.c
+index 809bfff3690ab..cbc4c28c1541c 100644
+--- a/drivers/spi/spi-altera.c
++++ b/drivers/spi/spi-altera.c
+@@ -189,24 +189,26 @@ static int altera_spi_txrx(struct spi_master *master,
+
+ /* send the first byte */
+ altera_spi_tx_word(hw);
+- } else {
+- while (hw->count < hw->len) {
+- altera_spi_tx_word(hw);
+
+- for (;;) {
+- altr_spi_readl(hw, ALTERA_SPI_STATUS, &val);
+- if (val & ALTERA_SPI_STATUS_RRDY_MSK)
+- break;
++ return 1;
++ }
++
++ while (hw->count < hw->len) {
++ altera_spi_tx_word(hw);
+
+- cpu_relax();
+- }
++ for (;;) {
++ altr_spi_readl(hw, ALTERA_SPI_STATUS, &val);
++ if (val & ALTERA_SPI_STATUS_RRDY_MSK)
++ break;
+
+- altera_spi_rx_word(hw);
++ cpu_relax();
+ }
+- spi_finalize_current_transfer(master);
++
++ altera_spi_rx_word(hw);
+ }
++ spi_finalize_current_transfer(master);
+
+- return t->len;
++ return 0;
+ }
+
+ static irqreturn_t altera_spi_irq(int irq, void *dev)
+--
+2.27.0
+
--- /dev/null
+From 0620cc0f69fc35ccac4c51b3536d9468520457b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 09:29:09 +0800
+Subject: spi: fix the divide by 0 error when calculating xfer waiting time
+
+From: Xu Yilun <yilun.xu@intel.com>
+
+[ Upstream commit 6170d077bf92c5b3dfbe1021688d3c0404f7c9e9 ]
+
+The xfer waiting time is the result of xfer->len / xfer->speed_hz. This
+patch makes the assumption of 100khz xfer speed if the xfer->speed_hz is
+not assigned and stays 0. This avoids the divide by 0 issue and ensures
+a reasonable tolerant waiting time.
+
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/1609723749-3557-1-git-send-email-yilun.xu@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 2eaa7dbb70108..7694e1ae5b0b2 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1100,6 +1100,7 @@ static int spi_transfer_wait(struct spi_controller *ctlr,
+ {
+ struct spi_statistics *statm = &ctlr->statistics;
+ struct spi_statistics *stats = &msg->spi->statistics;
++ u32 speed_hz = xfer->speed_hz;
+ unsigned long long ms;
+
+ if (spi_controller_is_slave(ctlr)) {
+@@ -1108,8 +1109,11 @@ static int spi_transfer_wait(struct spi_controller *ctlr,
+ return -EINTR;
+ }
+ } else {
++ if (!speed_hz)
++ speed_hz = 100000;
++
+ ms = 8LL * 1000LL * xfer->len;
+- do_div(ms, xfer->speed_hz);
++ do_div(ms, speed_hz);
+ ms += ms + 200; /* some tolerance */
+
+ if (ms > UINT_MAX)
+--
+2.27.0
+
--- /dev/null
+From a381aa5cdfe02c96ba96525d9de55d0ab4b6b32d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 16:11:05 +0100
+Subject: staging: spmi: hisi-spmi-controller: Fix some error handling paths
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 12b38ea040b3bb2a30eb9cd488376df5be7ea81f ]
+
+IN the probe function, if an error occurs after calling
+'spmi_controller_alloc()', it must be undone by a corresponding
+'spmi_controller_put() call.
+
+In the remove function, use 'spmi_controller_put(ctrl)' instead of
+'kfree(ctrl)'.
+
+While a it fix an error message
+(s/spmi_add_controller/spmi_controller_add/)
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201213151105.137731-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/hikey9xx/hisi-spmi-controller.c | 21 +++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/hikey9xx/hisi-spmi-controller.c b/drivers/staging/hikey9xx/hisi-spmi-controller.c
+index f831c43f4783f..29f226503668d 100644
+--- a/drivers/staging/hikey9xx/hisi-spmi-controller.c
++++ b/drivers/staging/hikey9xx/hisi-spmi-controller.c
+@@ -278,21 +278,24 @@ static int spmi_controller_probe(struct platform_device *pdev)
+ iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!iores) {
+ dev_err(&pdev->dev, "can not get resource!\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_put_controller;
+ }
+
+ spmi_controller->base = devm_ioremap(&pdev->dev, iores->start,
+ resource_size(iores));
+ if (!spmi_controller->base) {
+ dev_err(&pdev->dev, "can not remap base addr!\n");
+- return -EADDRNOTAVAIL;
++ ret = -EADDRNOTAVAIL;
++ goto err_put_controller;
+ }
+
+ ret = of_property_read_u32(pdev->dev.of_node, "spmi-channel",
+ &spmi_controller->channel);
+ if (ret) {
+ dev_err(&pdev->dev, "can not get channel\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_put_controller;
+ }
+
+ platform_set_drvdata(pdev, spmi_controller);
+@@ -309,9 +312,15 @@ static int spmi_controller_probe(struct platform_device *pdev)
+ ctrl->write_cmd = spmi_write_cmd;
+
+ ret = spmi_controller_add(ctrl);
+- if (ret)
+- dev_err(&pdev->dev, "spmi_add_controller failed with error %d!\n", ret);
++ if (ret) {
++ dev_err(&pdev->dev, "spmi_controller_add failed with error %d!\n", ret);
++ goto err_put_controller;
++ }
++
++ return 0;
+
++err_put_controller:
++ spmi_controller_put(ctrl);
+ return ret;
+ }
+
+@@ -320,7 +329,7 @@ static int spmi_del_controller(struct platform_device *pdev)
+ struct spmi_controller *ctrl = platform_get_drvdata(pdev);
+
+ spmi_controller_remove(ctrl);
+- kfree(ctrl);
++ spmi_controller_put(ctrl);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From dd9cba6d30e179a1a1cba905ce65f50c7403a5f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 00:16:05 +0000
+Subject: usb: typec: Fix copy paste error for NVIDIA alt-mode description
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 41952a66015466c3208aac96b14ffd92e0943589 ]
+
+The name of the module for the NVIDIA alt-mode is incorrect as it
+looks to be a copy-paste error from the entry above, update it to
+the correct typec_nvidia module name.
+
+Cc: Ajay Gupta <ajayg@nvidia.com>
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20210106001605.167917-1-pbrobinson@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/typec/altmodes/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/altmodes/Kconfig b/drivers/usb/typec/altmodes/Kconfig
+index 187690fd1a5bd..60d375e9c3c7c 100644
+--- a/drivers/usb/typec/altmodes/Kconfig
++++ b/drivers/usb/typec/altmodes/Kconfig
+@@ -20,6 +20,6 @@ config TYPEC_NVIDIA_ALTMODE
+ to enable support for VirtualLink devices with NVIDIA GPUs.
+
+ To compile this driver as a module, choose M here: the
+- module will be called typec_displayport.
++ module will be called typec_nvidia.
+
+ endmenu
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
