--- /dev/null
+From 5c3f848fc4fb4c0d0675dca460bbb4307087f9ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 23:11:36 +0100
+Subject: ARM: 9029/1: Make iwmmxt.S support Clang's integrated assembler
+
+From: Jian Cai <jiancai@google.com>
+
+commit 3c9f5708b7aed6a963e2aefccbd1854802de163e upstream.
+
+This patch replaces 6 IWMMXT instructions Clang's integrated assembler
+does not support in iwmmxt.S using macros, while making sure GNU
+assembler still emit the same instructions. This should be easier than
+providing full IWMMXT support in Clang. This is one of the last bits of
+kernel code that could be compiled but not assembled with clang. Once
+all of it works with IAS, we no longer need to special-case 32-bit Arm
+in Kbuild, or turn off CONFIG_IWMMXT when build-testing.
+
+"Intel Wireless MMX Technology - Developer Guide - August, 2002" should
+be referenced for the encoding schemes of these extensions.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/975
+
+Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
+Suggested-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Jian Cai <jiancai@google.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/iwmmxt.S | 89 ++++++++++++++++++++--------------------
+ arch/arm/kernel/iwmmxt.h | 47 +++++++++++++++++++++
+ 2 files changed, 92 insertions(+), 44 deletions(-)
+ create mode 100644 arch/arm/kernel/iwmmxt.h
+
+diff --git a/arch/arm/kernel/iwmmxt.S b/arch/arm/kernel/iwmmxt.S
+index 0dcae787b004..d2b4ac06e4ed 100644
+--- a/arch/arm/kernel/iwmmxt.S
++++ b/arch/arm/kernel/iwmmxt.S
+@@ -16,6 +16,7 @@
+ #include <asm/thread_info.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/assembler.h>
++#include "iwmmxt.h"
+
+ #if defined(CONFIG_CPU_PJ4) || defined(CONFIG_CPU_PJ4B)
+ #define PJ4(code...) code
+@@ -113,33 +114,33 @@ concan_save:
+
+ concan_dump:
+
+- wstrw wCSSF, [r1, #MMX_WCSSF]
+- wstrw wCASF, [r1, #MMX_WCASF]
+- wstrw wCGR0, [r1, #MMX_WCGR0]
+- wstrw wCGR1, [r1, #MMX_WCGR1]
+- wstrw wCGR2, [r1, #MMX_WCGR2]
+- wstrw wCGR3, [r1, #MMX_WCGR3]
++ wstrw wCSSF, r1, MMX_WCSSF
++ wstrw wCASF, r1, MMX_WCASF
++ wstrw wCGR0, r1, MMX_WCGR0
++ wstrw wCGR1, r1, MMX_WCGR1
++ wstrw wCGR2, r1, MMX_WCGR2
++ wstrw wCGR3, r1, MMX_WCGR3
+
+ 1: @ MUP? wRn
+ tst r2, #0x2
+ beq 2f
+
+- wstrd wR0, [r1, #MMX_WR0]
+- wstrd wR1, [r1, #MMX_WR1]
+- wstrd wR2, [r1, #MMX_WR2]
+- wstrd wR3, [r1, #MMX_WR3]
+- wstrd wR4, [r1, #MMX_WR4]
+- wstrd wR5, [r1, #MMX_WR5]
+- wstrd wR6, [r1, #MMX_WR6]
+- wstrd wR7, [r1, #MMX_WR7]
+- wstrd wR8, [r1, #MMX_WR8]
+- wstrd wR9, [r1, #MMX_WR9]
+- wstrd wR10, [r1, #MMX_WR10]
+- wstrd wR11, [r1, #MMX_WR11]
+- wstrd wR12, [r1, #MMX_WR12]
+- wstrd wR13, [r1, #MMX_WR13]
+- wstrd wR14, [r1, #MMX_WR14]
+- wstrd wR15, [r1, #MMX_WR15]
++ wstrd wR0, r1, MMX_WR0
++ wstrd wR1, r1, MMX_WR1
++ wstrd wR2, r1, MMX_WR2
++ wstrd wR3, r1, MMX_WR3
++ wstrd wR4, r1, MMX_WR4
++ wstrd wR5, r1, MMX_WR5
++ wstrd wR6, r1, MMX_WR6
++ wstrd wR7, r1, MMX_WR7
++ wstrd wR8, r1, MMX_WR8
++ wstrd wR9, r1, MMX_WR9
++ wstrd wR10, r1, MMX_WR10
++ wstrd wR11, r1, MMX_WR11
++ wstrd wR12, r1, MMX_WR12
++ wstrd wR13, r1, MMX_WR13
++ wstrd wR14, r1, MMX_WR14
++ wstrd wR15, r1, MMX_WR15
+
+ 2: teq r0, #0 @ anything to load?
+ reteq lr @ if not, return
+@@ -147,30 +148,30 @@ concan_dump:
+ concan_load:
+
+ @ Load wRn
+- wldrd wR0, [r0, #MMX_WR0]
+- wldrd wR1, [r0, #MMX_WR1]
+- wldrd wR2, [r0, #MMX_WR2]
+- wldrd wR3, [r0, #MMX_WR3]
+- wldrd wR4, [r0, #MMX_WR4]
+- wldrd wR5, [r0, #MMX_WR5]
+- wldrd wR6, [r0, #MMX_WR6]
+- wldrd wR7, [r0, #MMX_WR7]
+- wldrd wR8, [r0, #MMX_WR8]
+- wldrd wR9, [r0, #MMX_WR9]
+- wldrd wR10, [r0, #MMX_WR10]
+- wldrd wR11, [r0, #MMX_WR11]
+- wldrd wR12, [r0, #MMX_WR12]
+- wldrd wR13, [r0, #MMX_WR13]
+- wldrd wR14, [r0, #MMX_WR14]
+- wldrd wR15, [r0, #MMX_WR15]
++ wldrd wR0, r0, MMX_WR0
++ wldrd wR1, r0, MMX_WR1
++ wldrd wR2, r0, MMX_WR2
++ wldrd wR3, r0, MMX_WR3
++ wldrd wR4, r0, MMX_WR4
++ wldrd wR5, r0, MMX_WR5
++ wldrd wR6, r0, MMX_WR6
++ wldrd wR7, r0, MMX_WR7
++ wldrd wR8, r0, MMX_WR8
++ wldrd wR9, r0, MMX_WR9
++ wldrd wR10, r0, MMX_WR10
++ wldrd wR11, r0, MMX_WR11
++ wldrd wR12, r0, MMX_WR12
++ wldrd wR13, r0, MMX_WR13
++ wldrd wR14, r0, MMX_WR14
++ wldrd wR15, r0, MMX_WR15
+
+ @ Load wCx
+- wldrw wCSSF, [r0, #MMX_WCSSF]
+- wldrw wCASF, [r0, #MMX_WCASF]
+- wldrw wCGR0, [r0, #MMX_WCGR0]
+- wldrw wCGR1, [r0, #MMX_WCGR1]
+- wldrw wCGR2, [r0, #MMX_WCGR2]
+- wldrw wCGR3, [r0, #MMX_WCGR3]
++ wldrw wCSSF, r0, MMX_WCSSF
++ wldrw wCASF, r0, MMX_WCASF
++ wldrw wCGR0, r0, MMX_WCGR0
++ wldrw wCGR1, r0, MMX_WCGR1
++ wldrw wCGR2, r0, MMX_WCGR2
++ wldrw wCGR3, r0, MMX_WCGR3
+
+ @ clear CUP/MUP (only if r1 != 0)
+ teq r1, #0
+diff --git a/arch/arm/kernel/iwmmxt.h b/arch/arm/kernel/iwmmxt.h
+new file mode 100644
+index 000000000000..fb627286f5bb
+--- /dev/null
++++ b/arch/arm/kernel/iwmmxt.h
+@@ -0,0 +1,47 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef __IWMMXT_H__
++#define __IWMMXT_H__
++
++.irp b, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15
++.set .LwR\b, \b
++.set .Lr\b, \b
++.endr
++
++.set .LwCSSF, 0x2
++.set .LwCASF, 0x3
++.set .LwCGR0, 0x8
++.set .LwCGR1, 0x9
++.set .LwCGR2, 0xa
++.set .LwCGR3, 0xb
++
++.macro wldrd, reg:req, base:req, offset:req
++.inst 0xedd00100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2)
++.endm
++
++.macro wldrw, reg:req, base:req, offset:req
++.inst 0xfd900100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2)
++.endm
++
++.macro wstrd, reg:req, base:req, offset:req
++.inst 0xedc00100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2)
++.endm
++
++.macro wstrw, reg:req, base:req, offset:req
++.inst 0xfd800100 | (.L\reg << 12) | (.L\base << 16) | (\offset >> 2)
++.endm
++
++#ifdef __clang__
++
++#define wCon c1
++
++.macro tmrc, dest:req, control:req
++mrc p1, 0, \dest, \control, c0, 0
++.endm
++
++.macro tmcr, control:req, src:req
++mcr p1, 0, \src, \control, c0, 0
++.endm
++#endif
++
++#endif
+--
+2.30.1
+
--- /dev/null
+From 788a39e50131e640e6c6dfbbd7020c0bf10e629b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Sep 2020 11:23:39 +0300
+Subject: ARM: assembler: introduce adr_l, ldr_l and str_l macros
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 0b1674638a5c69cbace63278625c199100955490 upstream.
+
+Like arm64, ARM supports position independent code sequences that
+produce symbol references with a greater reach than the ordinary
+adr/ldr instructions. Since on ARM, the adrl pseudo-instruction is
+only supported in ARM mode (and not at all when using Clang), having
+a adr_l macro like we do on arm64 is useful, and increases symmetry
+as well.
+
+Currently, we use open coded instruction sequences involving literals
+and arithmetic operations. Instead, we can use movw/movt pairs on v7
+CPUs, circumventing the D-cache entirely.
+
+E.g., on v7+ CPUs, we can emit a PC-relative reference as follows:
+
+ movw <reg>, #:lower16:<sym> - (1f + 8)
+ movt <reg>, #:upper16:<sym> - (1f + 8)
+ 1: add <reg>, <reg>, pc
+
+For older CPUs, we can emit the literal into a subsection, allowing it
+to be emitted out of line while retaining the ability to perform
+arithmetic on label offsets.
+
+E.g., on pre-v7 CPUs, we can emit a PC-relative reference as follows:
+
+ ldr <reg>, 2f
+ 1: add <reg>, <reg>, pc
+ .subsection 1
+ 2: .long <sym> - (1b + 8)
+ .previous
+
+This is allowed by the assembler because, unlike ordinary sections,
+subsections are combined into a single section in the object file, and
+so the label references are not true cross-section references that are
+visible as relocations. (Subsections have been available in binutils
+since 2004 at least, so they should not cause any issues with older
+toolchains.)
+
+So use the above to implement the macros mov_l, adr_l, ldr_l and str_l,
+all of which will use movw/movt pairs on v7 and later CPUs, and use
+PC-relative literals otherwise.
+
+Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 84 ++++++++++++++++++++++++++++++++
+ 1 file changed, 84 insertions(+)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index feac2c8b86f2..72627c5fb3b2 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -494,4 +494,88 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ #define _ASM_NOKPROBE(entry)
+ #endif
+
++ .macro __adldst_l, op, reg, sym, tmp, c
++ .if __LINUX_ARM_ARCH__ < 7
++ ldr\c \tmp, .La\@
++ .subsection 1
++ .align 2
++.La\@: .long \sym - .Lpc\@
++ .previous
++ .else
++ .ifnb \c
++ THUMB( ittt \c )
++ .endif
++ movw\c \tmp, #:lower16:\sym - .Lpc\@
++ movt\c \tmp, #:upper16:\sym - .Lpc\@
++ .endif
++
++#ifndef CONFIG_THUMB2_KERNEL
++ .set .Lpc\@, . + 8 // PC bias
++ .ifc \op, add
++ add\c \reg, \tmp, pc
++ .else
++ \op\c \reg, [pc, \tmp]
++ .endif
++#else
++.Lb\@: add\c \tmp, \tmp, pc
++ /*
++ * In Thumb-2 builds, the PC bias depends on whether we are currently
++ * emitting into a .arm or a .thumb section. The size of the add opcode
++ * above will be 2 bytes when emitting in Thumb mode and 4 bytes when
++ * emitting in ARM mode, so let's use this to account for the bias.
++ */
++ .set .Lpc\@, . + (. - .Lb\@)
++
++ .ifnc \op, add
++ \op\c \reg, [\tmp]
++ .endif
++#endif
++ .endm
++
++ /*
++ * mov_l - move a constant value or [relocated] address into a register
++ */
++ .macro mov_l, dst:req, imm:req
++ .if __LINUX_ARM_ARCH__ < 7
++ ldr \dst, =\imm
++ .else
++ movw \dst, #:lower16:\imm
++ movt \dst, #:upper16:\imm
++ .endif
++ .endm
++
++ /*
++ * adr_l - adr pseudo-op with unlimited range
++ *
++ * @dst: destination register
++ * @sym: name of the symbol
++ * @cond: conditional opcode suffix
++ */
++ .macro adr_l, dst:req, sym:req, cond
++ __adldst_l add, \dst, \sym, \dst, \cond
++ .endm
++
++ /*
++ * ldr_l - ldr <literal> pseudo-op with unlimited range
++ *
++ * @dst: destination register
++ * @sym: name of the symbol
++ * @cond: conditional opcode suffix
++ */
++ .macro ldr_l, dst:req, sym:req, cond
++ __adldst_l ldr, \dst, \sym, \dst, \cond
++ .endm
++
++ /*
++ * str_l - str <literal> pseudo-op with unlimited range
++ *
++ * @src: source register
++ * @sym: name of the symbol
++ * @tmp: mandatory scratch register
++ * @cond: conditional opcode suffix
++ */
++ .macro str_l, src:req, sym:req, tmp:req, cond
++ __adldst_l str, \src, \sym, \tmp, \cond
++ .endm
++
+ #endif /* __ASM_ASSEMBLER_H__ */
+--
+2.30.1
+
--- /dev/null
+From cc0d8721f030921a8f0b5ebe0a2b88d0001d376b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Sep 2020 12:28:01 +0300
+Subject: ARM: efistub: replace adrl pseudo-op with adr_l macro invocation
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 67e3f828bd4bf5e4eb4214dc4eb227d8f1c8a877 upstream.
+
+The ARM 'adrl' pseudo instruction is a bit problematic, as it does not
+exist in Thumb mode, and it is not implemented by Clang either. Since
+the Thumb variant has a slightly bigger range, it is sometimes necessary
+to emit the 'adrl' variant in ARM mode where Thumb mode can use adr just
+fine. However, that still leaves the Clang issue, which does not appear
+to be supporting this any time soon.
+
+So let's switch to the adr_l macro, which works for both ARM and Thumb,
+and has unlimited range.
+
+Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index a0de09f994d8..247ce9055990 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1440,8 +1440,7 @@ ENTRY(efi_enter_kernel)
+ mov r4, r0 @ preserve image base
+ mov r8, r1 @ preserve DT pointer
+
+- ARM( adrl r0, call_cache_fn )
+- THUMB( adr r0, call_cache_fn )
++ adr_l r0, call_cache_fn
+ adr r1, 0f @ clean the region of code we
+ bl cache_clean_flush @ may run with the MMU off
+
+--
+2.30.1
+
--- /dev/null
+From 89ceb6955e89eb82b8bb84a629e644fc468f212e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 19:38:15 +0100
+Subject: clk: qcom: gdsc: Implement NO_RET_PERIPH flag
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 785c02eb35009a4be6dbc68f4f7d916e90b7177d ]
+
+In some rare occasions, we want to only set the RETAIN_MEM bit, but
+not the RETAIN_PERIPH one: this is seen on at least SDM630/636/660's
+GPU-GX GDSC, where unsetting and setting back the RETAIN_PERIPH bit
+will generate chaos and panics during GPU suspend time (mainly, the
+chaos is unaligned access).
+
+For this reason, introduce a new NO_RET_PERIPH flag to the GDSC
+driver to address this corner case.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210113183817.447866-8-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gdsc.c | 10 ++++++++--
+ drivers/clk/qcom/gdsc.h | 3 ++-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c
+index af26e0695b86..51ed640e527b 100644
+--- a/drivers/clk/qcom/gdsc.c
++++ b/drivers/clk/qcom/gdsc.c
+@@ -183,7 +183,10 @@ static inline int gdsc_assert_reset(struct gdsc *sc)
+ static inline void gdsc_force_mem_on(struct gdsc *sc)
+ {
+ int i;
+- u32 mask = RETAIN_MEM | RETAIN_PERIPH;
++ u32 mask = RETAIN_MEM;
++
++ if (!(sc->flags & NO_RET_PERIPH))
++ mask |= RETAIN_PERIPH;
+
+ for (i = 0; i < sc->cxc_count; i++)
+ regmap_update_bits(sc->regmap, sc->cxcs[i], mask, mask);
+@@ -192,7 +195,10 @@ static inline void gdsc_force_mem_on(struct gdsc *sc)
+ static inline void gdsc_clear_mem_on(struct gdsc *sc)
+ {
+ int i;
+- u32 mask = RETAIN_MEM | RETAIN_PERIPH;
++ u32 mask = RETAIN_MEM;
++
++ if (!(sc->flags & NO_RET_PERIPH))
++ mask |= RETAIN_PERIPH;
+
+ for (i = 0; i < sc->cxc_count; i++)
+ regmap_update_bits(sc->regmap, sc->cxcs[i], mask, 0);
+diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h
+index bd537438c793..5bb396b344d1 100644
+--- a/drivers/clk/qcom/gdsc.h
++++ b/drivers/clk/qcom/gdsc.h
+@@ -42,7 +42,7 @@ struct gdsc {
+ #define PWRSTS_ON BIT(2)
+ #define PWRSTS_OFF_ON (PWRSTS_OFF | PWRSTS_ON)
+ #define PWRSTS_RET_ON (PWRSTS_RET | PWRSTS_ON)
+- const u8 flags;
++ const u16 flags;
+ #define VOTABLE BIT(0)
+ #define CLAMP_IO BIT(1)
+ #define HW_CTRL BIT(2)
+@@ -51,6 +51,7 @@ struct gdsc {
+ #define POLL_CFG_GDSCR BIT(5)
+ #define ALWAYS_ON BIT(6)
+ #define RETAIN_FF_ENABLE BIT(7)
++#define NO_RET_PERIPH BIT(8)
+ struct reset_controller_dev *rcdev;
+ unsigned int *resets;
+ unsigned int reset_count;
+--
+2.30.1
+
--- /dev/null
+From c2d7bdb39dbcdbd8e7043a49e120bb53dd2ebb83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 23:10:58 +0100
+Subject: clk: qcom: gpucc-msm8998: Add resets, cxc, fix flags on gpu_gx_gdsc
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit a59c16c80bd791878cf81d1d5aae508eeb2e73f1 ]
+
+The GPU GX GDSC has GPU_GX_BCR reset and gfx3d_clk CXC, as stated
+on downstream kernels (and as verified upstream, because otherwise
+random lockups happen).
+Also, add PWRSTS_RET and NO_RET_PERIPH: also as found downstream,
+and also as verified here, to avoid GPU related lockups it is
+necessary to force retain mem, but *not* peripheral when enabling
+this GDSC (and, of course, the inverse on disablement).
+
+With this change, the GPU finally works flawlessly on my four
+different MSM8998 devices from two different manufacturers.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210114221059.483390-11-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gpucc-msm8998.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gpucc-msm8998.c b/drivers/clk/qcom/gpucc-msm8998.c
+index 9b3923af02a1..1a518c4915b4 100644
+--- a/drivers/clk/qcom/gpucc-msm8998.c
++++ b/drivers/clk/qcom/gpucc-msm8998.c
+@@ -253,12 +253,16 @@ static struct gdsc gpu_cx_gdsc = {
+ static struct gdsc gpu_gx_gdsc = {
+ .gdscr = 0x1094,
+ .clamp_io_ctrl = 0x130,
++ .resets = (unsigned int []){ GPU_GX_BCR },
++ .reset_count = 1,
++ .cxcs = (unsigned int []){ 0x1098 },
++ .cxc_count = 1,
+ .pd = {
+ .name = "gpu_gx",
+ },
+ .parent = &gpu_cx_gdsc.pd,
+- .pwrsts = PWRSTS_OFF_ON,
+- .flags = CLAMP_IO | AON_RESET,
++ .pwrsts = PWRSTS_OFF_ON | PWRSTS_RET,
++ .flags = CLAMP_IO | SW_RESET | AON_RESET | NO_RET_PERIPH,
+ };
+
+ static struct clk_regmap *gpucc_msm8998_clocks[] = {
+--
+2.30.1
+
--- /dev/null
+From afa558c12a9e708e99d4fbfb6044943246480a92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 13:45:27 +0100
+Subject: drivers/base: build kunit tests without structleak plugin
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 38009c766725a9877ea8866fc813a5460011817f ]
+
+The structleak plugin causes the stack frame size to grow immensely:
+
+drivers/base/test/property-entry-test.c: In function 'pe_test_reference':
+drivers/base/test/property-entry-test.c:481:1: error: the frame size of 2640 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
+ 481 | }
+ | ^
+drivers/base/test/property-entry-test.c: In function 'pe_test_uints':
+drivers/base/test/property-entry-test.c:99:1: error: the frame size of 2592 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
+
+Turn it off in this file.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210125124533.101339-3-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/test/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/test/Makefile b/drivers/base/test/Makefile
+index 3ca56367c84b..2f15fae8625f 100644
+--- a/drivers/base/test/Makefile
++++ b/drivers/base/test/Makefile
+@@ -2,3 +2,4 @@
+ obj-$(CONFIG_TEST_ASYNC_DRIVER_PROBE) += test_async_driver_probe.o
+
+ obj-$(CONFIG_KUNIT_DRIVER_PE_TEST) += property-entry-test.o
++CFLAGS_REMOVE_property-entry-test.o += -fplugin-arg-structleak_plugin-byref -fplugin-arg-structleak_plugin-byref-all
+--
+2.30.1
+
--- /dev/null
+From 218843846dfddea257fee5caa0898fd7b81a509b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:17:24 -0800
+Subject: drivers/base/memory: don't store phys_device in memory blocks
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit e9a2e48e8704c9d20a625c6f2357147d03ea7b97 ]
+
+No need to store the value for each and every memory block, as we can
+easily query the value at runtime. Reshuffle the members to optimize the
+memory layout. Also, let's clarify what the interface once was used for
+and why it's legacy nowadays.
+
+"phys_device" was used on s390x in older versions of lsmem[2]/chmem[3],
+back when they were still part of s390x-tools. They were later replaced
+by the variants in linux-utils. For example, RHEL6 and RHEL7 contain
+lsmem/chmem from s390-utils. RHEL8 switched to versions from util-linux
+on s390x [4].
+
+"phys_device" was added with sysfs support for memory hotplug in commit
+3947be1969a9 ("[PATCH] memory hotplug: sysfs and add/remove functions") in
+2005. It always returned 0.
+
+s390x started returning something != 0 on some setups (if sclp.rzm is set
+by HW) in 2010 via commit 57b552ba0b2f ("memory hotplug/s390: set
+phys_device").
+
+For s390x, it allowed for identifying which memory block devices belong to
+the same storage increment (RZM). Only if all memory block devices
+comprising a single storage increment were offline, the memory could
+actually be removed in the hypervisor.
+
+Since commit e5d709bb5fb7 ("s390/memory hotplug: provide
+memory_block_size_bytes() function") in 2013 a memory block device spans
+at least one storage increment - which is why the interface isn't really
+helpful/used anymore (except by old lsmem/chmem tools).
+
+There were once RFC patches to make use of "phys_device" in ACPI context;
+however, the underlying problem could be solved using different interfaces
+[1].
+
+[1] https://patchwork.kernel.org/patch/2163871/
+[2] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/lsmem
+[3] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/chmem
+[4] https://bugzilla.redhat.com/show_bug.cgi?id=1504134
+
+Link: https://lkml.kernel.org/r/20210201181347.13262-2-david@redhat.com
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Cc: Ilya Dryomov <idryomov@gmail.com>
+Cc: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Tom Rix <trix@redhat.com>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ABI/testing/sysfs-devices-memory | 5 ++--
+ .../admin-guide/mm/memory-hotplug.rst | 4 +--
+ drivers/base/memory.c | 25 +++++++------------
+ include/linux/memory.h | 3 +--
+ 4 files changed, 15 insertions(+), 22 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-devices-memory b/Documentation/ABI/testing/sysfs-devices-memory
+index 2da2b1fba2c1..16a727a611b1 100644
+--- a/Documentation/ABI/testing/sysfs-devices-memory
++++ b/Documentation/ABI/testing/sysfs-devices-memory
+@@ -26,8 +26,9 @@ Date: September 2008
+ Contact: Badari Pulavarty <pbadari@us.ibm.com>
+ Description:
+ The file /sys/devices/system/memory/memoryX/phys_device
+- is read-only and is designed to show the name of physical
+- memory device. Implementation is currently incomplete.
++ is read-only; it is a legacy interface only ever used on s390x
++ to expose the covered storage increment.
++Users: Legacy s390-tools lsmem/chmem
+
+ What: /sys/devices/system/memory/memoryX/phys_index
+ Date: September 2008
+diff --git a/Documentation/admin-guide/mm/memory-hotplug.rst b/Documentation/admin-guide/mm/memory-hotplug.rst
+index 5c4432c96c4b..245739f55ac7 100644
+--- a/Documentation/admin-guide/mm/memory-hotplug.rst
++++ b/Documentation/admin-guide/mm/memory-hotplug.rst
+@@ -160,8 +160,8 @@ Under each memory block, you can see 5 files:
+
+ "online_movable", "online", "offline" command
+ which will be performed on all sections in the block.
+-``phys_device`` read-only: designed to show the name of physical memory
+- device. This is not well implemented now.
++``phys_device`` read-only: legacy interface only ever used on s390x to
++ expose the covered storage increment.
+ ``removable`` read-only: contains an integer value indicating
+ whether the memory block is removable or not
+ removable. A value of 1 indicates that the memory
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index eef4ffb6122c..de058d15b33e 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -290,20 +290,20 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr,
+ }
+
+ /*
+- * phys_device is a bad name for this. What I really want
+- * is a way to differentiate between memory ranges that
+- * are part of physical devices that constitute
+- * a complete removable unit or fru.
+- * i.e. do these ranges belong to the same physical device,
+- * s.t. if I offline all of these sections I can then
+- * remove the physical device?
++ * Legacy interface that we cannot remove: s390x exposes the storage increment
++ * covered by a memory block, allowing for identifying which memory blocks
++ * comprise a storage increment. Since a memory block spans complete
++ * storage increments nowadays, this interface is basically unused. Other
++ * archs never exposed != 0.
+ */
+ static ssize_t phys_device_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct memory_block *mem = to_memory_block(dev);
++ unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
+
+- return sysfs_emit(buf, "%d\n", mem->phys_device);
++ return sysfs_emit(buf, "%d\n",
++ arch_get_memory_phys_device(start_pfn));
+ }
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+@@ -488,11 +488,7 @@ static DEVICE_ATTR_WO(soft_offline_page);
+ static DEVICE_ATTR_WO(hard_offline_page);
+ #endif
+
+-/*
+- * Note that phys_device is optional. It is here to allow for
+- * differentiation between which *physical* devices each
+- * section belongs to...
+- */
++/* See phys_device_show(). */
+ int __weak arch_get_memory_phys_device(unsigned long start_pfn)
+ {
+ return 0;
+@@ -574,7 +570,6 @@ int register_memory(struct memory_block *memory)
+ static int init_memory_block(unsigned long block_id, unsigned long state)
+ {
+ struct memory_block *mem;
+- unsigned long start_pfn;
+ int ret = 0;
+
+ mem = find_memory_block_by_id(block_id);
+@@ -588,8 +583,6 @@ static int init_memory_block(unsigned long block_id, unsigned long state)
+
+ mem->start_section_nr = block_id * sections_per_block;
+ mem->state = state;
+- start_pfn = section_nr_to_pfn(mem->start_section_nr);
+- mem->phys_device = arch_get_memory_phys_device(start_pfn);
+ mem->nid = NUMA_NO_NODE;
+
+ ret = register_memory(mem);
+diff --git a/include/linux/memory.h b/include/linux/memory.h
+index 439a89e758d8..4da95e684e20 100644
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -27,9 +27,8 @@ struct memory_block {
+ unsigned long start_section_nr;
+ unsigned long state; /* serialized by the dev->lock */
+ int online_type; /* for passing data to online routine */
+- int phys_device; /* to which fru does this belong? */
+- struct device dev;
+ int nid; /* NID for this memory block */
++ struct device dev;
+ };
+
+ int arch_get_memory_phys_device(unsigned long start_pfn);
+--
+2.30.1
+
--- /dev/null
+From c9ac3e9bd8317ab2fecb87ff4e587b6e89d152c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 12:33:20 -0500
+Subject: ext4: don't try to processed freed blocks until mballoc is
+ initialized
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 027f14f5357279655c3ebc6d14daff8368d4f53f ]
+
+If we try to make any changes via the journal between when the journal
+is initialized, but before the multi-block allocated is initialized,
+we will end up deferencing a NULL pointer when the journal commit
+callback function calls ext4_process_freed_data().
+
+The proximate cause of this failure was commit 2d01ddc86606 ("ext4:
+save error info to sb through journal if available") since file system
+corruption problems detected before the call to ext4_mb_init() would
+result in a journal commit before we aborted the mount of the file
+system.... and we would then trigger the NULL pointer deref.
+
+Link: https://lore.kernel.org/r/YAm8qH/0oo2ofSMR@mit.edu
+Reported-by: Murphy Zhou <jencce.kernel@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index ea5aefa23a20..e30bf8f342c2 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4876,7 +4876,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+
+- sbi->s_journal->j_commit_callback = ext4_journal_commit_callback;
+ sbi->s_journal->j_submit_inode_data_buffers =
+ ext4_journal_submit_inode_data_buffers;
+ sbi->s_journal->j_finish_inode_data_buffers =
+@@ -4993,6 +4992,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount5;
+ }
+
++ /*
++ * We can only set up the journal commit callback once
++ * mballoc is initialized
++ */
++ if (sbi->s_journal)
++ sbi->s_journal->j_commit_callback =
++ ext4_journal_commit_callback;
++
+ block = ext4_count_free_clusters(sb);
+ ext4_free_blocks_count_set(sbi->s_es,
+ EXT4_C2B(sbi, block));
+--
+2.30.1
+
--- /dev/null
+From 1efe1dfbaab030e9e618704e134e44b0dfae64af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 18:02:20 +0000
+Subject: HID: logitech-dj: add support for the new lightspeed connection
+ iteration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Filipe Laíns <lains@riseup.net>
+
+[ Upstream commit fab3a95654eea01d6b0204995be8b7492a00d001 ]
+
+This new connection type is the new iteration of the Lightspeed
+connection and will probably be used in some of the newer gaming
+devices. It is currently use in the G Pro X Superlight.
+
+This patch should be backported to older versions, as currently the
+driver will panic when seing the unsupported connection. This isn't
+an issue when using the receiver that came with the device, as Logitech
+has been using different PIDs when they change the connection type, but
+is an issue when using a generic receiver (well, generic Lightspeed
+receiver), which is the case of the one in the Powerplay mat. Currently,
+the only generic Ligthspeed receiver we support, and the only one that
+exists AFAIK, is ther Powerplay.
+
+As it stands, the driver will panic when seeing a G Pro X Superlight
+connected to the Powerplay receiver and won't send any input events to
+userspace! The kernel will warn about this so the issue should be easy
+to identify, but it is still very worrying how hard it will fail :(
+
+[915977.398471] logitech-djreceiver 0003:046D:C53A.0107: unusable device of type UNKNOWN (0x0f) connected on slot 1
+
+Signed-off-by: Filipe Laíns <lains@riseup.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index fcdc922bc973..271bd8d24339 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -995,7 +995,12 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev,
+ workitem.reports_supported |= STD_KEYBOARD;
+ break;
+ case 0x0d:
+- device_type = "eQUAD Lightspeed 1_1";
++ device_type = "eQUAD Lightspeed 1.1";
++ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
++ workitem.reports_supported |= STD_KEYBOARD;
++ break;
++ case 0x0f:
++ device_type = "eQUAD Lightspeed 1.2";
+ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
+ workitem.reports_supported |= STD_KEYBOARD;
+ break;
+--
+2.30.1
+
--- /dev/null
+From 294e988b143ebe5ad210f1d3cb61d4b195478b6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 18:21:51 +0100
+Subject: i2c: rcar: faster irq code to minimize HW race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit c7b514ec979e23a08c411f3d8ed39c7922751422 ]
+
+To avoid the HW race condition on R-Car Gen2 and earlier, we need to
+write to ICMCR as soon as possible in the interrupt handler. We can
+improve this by writing a static value instead of masking out bits.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 217def2d7cb4..824586d7ee56 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -91,7 +91,6 @@
+
+ #define RCAR_BUS_PHASE_START (MDBS | MIE | ESG)
+ #define RCAR_BUS_PHASE_DATA (MDBS | MIE)
+-#define RCAR_BUS_MASK_DATA (~(ESG | FSB) & 0xFF)
+ #define RCAR_BUS_PHASE_STOP (MDBS | MIE | FSB)
+
+ #define RCAR_IRQ_SEND (MNR | MAL | MST | MAT | MDE)
+@@ -621,7 +620,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ /*
+ * This driver has a lock-free design because there are IP cores (at least
+ * R-Car Gen2) which have an inherent race condition in their hardware design.
+- * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after
++ * There, we need to switch to RCAR_BUS_PHASE_DATA as soon as possible after
+ * the interrupt was generated, otherwise an unwanted repeated message gets
+ * generated. It turned out that taking a spinlock at the beginning of the ISR
+ * was already causing repeated messages. Thus, this driver was converted to
+@@ -630,13 +629,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
+ {
+ struct rcar_i2c_priv *priv = ptr;
+- u32 msr, val;
++ u32 msr;
+
+ /* Clear START or STOP immediately, except for REPSTART after read */
+- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) {
+- val = rcar_i2c_read(priv, ICMCR);
+- rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA);
+- }
++ if (likely(!(priv->flags & ID_P_REP_AFTER_RD)))
++ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA);
+
+ msr = rcar_i2c_read(priv, ICMSR);
+
+--
+2.30.1
+
--- /dev/null
+From 12052e3206f4d61a8d61ffcf5155a00b4518e106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 18:21:52 +0100
+Subject: i2c: rcar: optimize cacheline to minimize HW race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 25c2e0fb5fefb8d7847214cf114d94c7aad8e9ce ]
+
+'flags' and 'io' are needed first, so they should be at the beginning of
+the private struct.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 824586d7ee56..ad6630e3cc77 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -119,6 +119,7 @@ enum rcar_i2c_type {
+ };
+
+ struct rcar_i2c_priv {
++ u32 flags;
+ void __iomem *io;
+ struct i2c_adapter adap;
+ struct i2c_msg *msg;
+@@ -129,7 +130,6 @@ struct rcar_i2c_priv {
+
+ int pos;
+ u32 icccr;
+- u32 flags;
+ u8 recovery_icmcr; /* protected by adapter lock */
+ enum rcar_i2c_type devtype;
+ struct i2c_client *slave;
+--
+2.30.1
+
--- /dev/null
+From 694b2ccbab58c5250f25717a736df63cdff02240 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 07:14:30 +0000
+Subject: i40e: Fix memory leak in i40e_probe
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit 58cab46c622d6324e47bd1c533693c94498e4172 ]
+
+Struct i40e_veb is allocated in function i40e_setup_pf_switch, and
+stored to an array field veb inside struct i40e_pf. However when
+i40e_setup_misc_vector fails, this memory leaks.
+
+Fix this by calling exit and teardown functions.
+
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 59971f62e626..3e4a4d6f0419 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -15100,6 +15100,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (err) {
+ dev_info(&pdev->dev,
+ "setup of misc vector failed: %d\n", err);
++ i40e_cloud_filter_exit(pf);
++ i40e_fdir_teardown(pf);
+ goto err_vsis;
+ }
+ }
+--
+2.30.1
+
--- /dev/null
+From e8318a8ae5b97325e544a7ff3e561f05875ba48a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 11:10:51 -0800
+Subject: Input: applespi - don't wait for responses to commands indefinitely.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ronald Tschalär <ronald@innovation.ch>
+
+[ Upstream commit 0ce1ac23149c6da939a5926c098c270c58c317a0 ]
+
+The response to a command may never arrive or it may be corrupted (and
+hence dropped) for some reason. While exceedingly rare, when it did
+happen it blocked all further commands. One way to fix this was to
+do a suspend/resume. However, recovering automatically seems like a
+nicer option. Hence this puts a time limit (1 sec) on how long we're
+willing to wait for a response, after which we assume it got lost.
+
+Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
+Link: https://lore.kernel.org/r/20210217190718.11035-1-ronald@innovation.ch
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/applespi.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c
+index 14362ebab9a9..0b46bc014cde 100644
+--- a/drivers/input/keyboard/applespi.c
++++ b/drivers/input/keyboard/applespi.c
+@@ -48,6 +48,7 @@
+ #include <linux/efi.h>
+ #include <linux/input.h>
+ #include <linux/input/mt.h>
++#include <linux/ktime.h>
+ #include <linux/leds.h>
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
+@@ -400,7 +401,7 @@ struct applespi_data {
+ unsigned int cmd_msg_cntr;
+ /* lock to protect the above parameters and flags below */
+ spinlock_t cmd_msg_lock;
+- bool cmd_msg_queued;
++ ktime_t cmd_msg_queued;
+ enum applespi_evt_type cmd_evt_type;
+
+ struct led_classdev backlight_info;
+@@ -716,7 +717,7 @@ static void applespi_msg_complete(struct applespi_data *applespi,
+ wake_up_all(&applespi->drain_complete);
+
+ if (is_write_msg) {
+- applespi->cmd_msg_queued = false;
++ applespi->cmd_msg_queued = 0;
+ applespi_send_cmd_msg(applespi);
+ }
+
+@@ -758,8 +759,16 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi)
+ return 0;
+
+ /* check whether send is in progress */
+- if (applespi->cmd_msg_queued)
+- return 0;
++ if (applespi->cmd_msg_queued) {
++ if (ktime_ms_delta(ktime_get(), applespi->cmd_msg_queued) < 1000)
++ return 0;
++
++ dev_warn(&applespi->spi->dev, "Command %d timed out\n",
++ applespi->cmd_evt_type);
++
++ applespi->cmd_msg_queued = 0;
++ applespi->write_active = false;
++ }
+
+ /* set up packet */
+ memset(packet, 0, APPLESPI_PACKET_SIZE);
+@@ -856,7 +865,7 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi)
+ return sts;
+ }
+
+- applespi->cmd_msg_queued = true;
++ applespi->cmd_msg_queued = ktime_get_coarse();
+ applespi->write_active = true;
+
+ return 0;
+@@ -1908,7 +1917,7 @@ static int __maybe_unused applespi_resume(struct device *dev)
+ applespi->drain = false;
+ applespi->have_cl_led_on = false;
+ applespi->have_bl_level = 0;
+- applespi->cmd_msg_queued = false;
++ applespi->cmd_msg_queued = 0;
+ applespi->read_active = false;
+ applespi->write_active = false;
+
+--
+2.30.1
+
--- /dev/null
+From b379ad579a67d960da6383e12632c2f0213ea2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 06:27:12 -0600
+Subject: iommu/amd: Fix performance counter initialization
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 6778ff5b21bd8e78c8bd547fd66437cf2657fd9b ]
+
+Certain AMD platforms enable power gating feature for IOMMU PMC,
+which prevents the IOMMU driver from updating the counter while
+trying to validate the PMC functionality in the init_iommu_perf_ctr().
+This results in disabling PMC support and the following error message:
+
+ "AMD-Vi: Unable to read/write to IOMMU perf counter"
+
+To workaround this issue, disable power gating temporarily by programming
+the counter source to non-zero value while validating the counter,
+and restore the prior state afterward.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Tested-by: Tj (Elloe Linux) <ml.linux@elloe.vision>
+Link: https://lore.kernel.org/r/20210208122712.5048-1-suravee.suthikulpanit@amd.com
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201753
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 45 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index c842545368fd..3c215f0a6052 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -12,6 +12,7 @@
+ #include <linux/acpi.h>
+ #include <linux/list.h>
+ #include <linux/bitmap.h>
++#include <linux/delay.h>
+ #include <linux/slab.h>
+ #include <linux/syscore_ops.h>
+ #include <linux/interrupt.h>
+@@ -254,6 +255,8 @@ static enum iommu_init_state init_state = IOMMU_START_STATE;
+ static int amd_iommu_enable_interrupts(void);
+ static int __init iommu_go_to_state(enum iommu_init_state state);
+ static void init_device_table_dma(void);
++static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr,
++ u8 fxn, u64 *value, bool is_write);
+
+ static bool amd_iommu_pre_enabled = true;
+
+@@ -1717,13 +1720,11 @@ static int __init init_iommu_all(struct acpi_table_header *table)
+ return 0;
+ }
+
+-static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr,
+- u8 fxn, u64 *value, bool is_write);
+-
+-static void init_iommu_perf_ctr(struct amd_iommu *iommu)
++static void __init init_iommu_perf_ctr(struct amd_iommu *iommu)
+ {
++ int retry;
+ struct pci_dev *pdev = iommu->dev;
+- u64 val = 0xabcd, val2 = 0, save_reg = 0;
++ u64 val = 0xabcd, val2 = 0, save_reg, save_src;
+
+ if (!iommu_feature(iommu, FEATURE_PC))
+ return;
+@@ -1731,17 +1732,39 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu)
+ amd_iommu_pc_present = true;
+
+ /* save the value to restore, if writable */
+- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false))
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, false))
+ goto pc_false;
+
+- /* Check if the performance counters can be written to */
+- if ((iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true)) ||
+- (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false)) ||
+- (val != val2))
++ /*
++ * Disable power gating by programing the performance counter
++ * source to 20 (i.e. counts the reads and writes from/to IOMMU
++ * Reserved Register [MMIO Offset 1FF8h] that are ignored.),
++ * which never get incremented during this init phase.
++ * (Note: The event is also deprecated.)
++ */
++ val = 20;
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 8, &val, true))
+ goto pc_false;
+
++ /* Check if the performance counters can be written to */
++ val = 0xabcd;
++ for (retry = 5; retry; retry--) {
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false) ||
++ val2)
++ break;
++
++ /* Wait about 20 msec for power gating to disable and retry. */
++ msleep(20);
++ }
++
+ /* restore */
+- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true))
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, true))
++ goto pc_false;
++
++ if (val != val2)
+ goto pc_false;
+
+ pci_info(pdev, "IOMMU performance counters supported\n");
+--
+2.30.1
+
--- /dev/null
+From ac7a3d1373dcfe6cba1a9a61a468f446937bfd56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 16:07:29 +0800
+Subject: iommu/vt-d: Clear PRQ overflow only when PRQ is empty
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 28a77185f1cd0650b664f54614143aaaa3a7a615 ]
+
+It is incorrect to always clear PRO when it's set w/o first checking
+whether the overflow condition has been cleared. Current code assumes
+that if an overflow condition occurs it must have been cleared by earlier
+loop. However since the code runs in a threaded context, the overflow
+condition could occur even after setting the head to the tail under some
+extreme condition. To be sane, we should read both head/tail again when
+seeing a pending PRO and only clear PRO after all pending PRs have been
+handled.
+
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/linux-iommu/MWHPR11MB18862D2EA5BD432BF22D99A48CA09@MWHPR11MB1886.namprd11.prod.outlook.com/
+Link: https://lore.kernel.org/r/20210126080730.2232859-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 43f392d27d31..b200a3acc6ed 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -1079,8 +1079,17 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ * Clear the page request overflow bit and wake up all threads that
+ * are waiting for the completion of this handling.
+ */
+- if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO)
+- writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG);
++ if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) {
++ pr_info_ratelimited("IOMMU: %s: PRQ overflow detected\n",
++ iommu->name);
++ head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
++ tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
++ if (head == tail) {
++ writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG);
++ pr_info_ratelimited("IOMMU: %s: PRQ overflow cleared",
++ iommu->name);
++ }
++ }
+
+ if (!completion_done(&iommu->prq_complete))
+ complete(&iommu->prq_complete);
+--
+2.30.1
+
--- /dev/null
+From 49d11a413c892f839e501e6ad60d838992b06909 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:05:42 -0800
+Subject: kasan: fix memory corruption in kasan_bitops_tags test
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+[ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ]
+
+Since the hardware tag-based KASAN mode might not have a redzone that
+comes after an allocated object (when kasan.mode=prod is enabled), the
+kasan_bitops_tags() test ends up corrupting the next object in memory.
+
+Change the test so it always accesses the redzone that lies within the
+allocated object's boundaries.
+
+Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a
+Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Marco Elver <elver@google.com>
+Reviewed-by: Alexander Potapenko <glider@google.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Branislav Rankov <Branislav.Rankov@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Evgenii Stepanov <eugenis@google.com>
+Cc: Kevin Brodsky <kevin.brodsky@arm.com>
+Cc: Peter Collingbourne <pcc@google.com>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kasan.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/test_kasan.c b/lib/test_kasan.c
+index 662f862702fc..400507f1e5db 100644
+--- a/lib/test_kasan.c
++++ b/lib/test_kasan.c
+@@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test)
+ return;
+ }
+
+- /* Allocation size will be rounded to up granule size, which is 16. */
+- bits = kzalloc(sizeof(*bits), GFP_KERNEL);
++ /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */
++ bits = kzalloc(48, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
+
+- /* Do the accesses past the 16 allocated bytes. */
+- kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]);
+- kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]);
++ /* Do the accesses past the 48 allocated bytes, but within the redone. */
++ kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48);
++ kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48);
+
+ kfree(bits);
+ }
+--
+2.30.1
+
--- /dev/null
+From 1edaf6097c7bcc8869d3d281ea262d37c8417b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 22:50:32 -0500
+Subject: kbuild: clamp SUBLEVEL to 255
+
+[ Upstream commit 9b82f13e7ef316cdc0a8858f1349f4defce3f9e0 ]
+
+Right now if SUBLEVEL becomes larger than 255 it will overflow into the
+territory of PATCHLEVEL, causing havoc in userspace that tests for
+specific kernel version.
+
+While userspace code tests for MAJOR and PATCHLEVEL, it doesn't test
+SUBLEVEL at any point as ABI changes don't happen in the context of
+stable tree.
+
+Thus, to avoid overflows, simply clamp SUBLEVEL to it's maximum value in
+the context of LINUX_VERSION_CODE. This does not affect "make
+kernelversion" and such.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 7fdb78b48f55..56d375763b0d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1247,9 +1247,15 @@ define filechk_utsrelease.h
+ endef
+
+ define filechk_version.h
+- echo \#define LINUX_VERSION_CODE $(shell \
+- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \
+- echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))'
++ if [ $(SUBLEVEL) -gt 255 ]; then \
++ echo \#define LINUX_VERSION_CODE $(shell \
++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \
++ else \
++ echo \#define LINUX_VERSION_CODE $(shell \
++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \
++ fi; \
++ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + \
++ ((c) > 255 ? 255 : (c)))'
+ endef
+
+ $(version_h): FORCE
+--
+2.30.1
+
--- /dev/null
+From 101721af96b84d214769174d811c68d0d31a6d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 15:16:11 +0800
+Subject: mmc: mediatek: fix race condition between msdc_request_timeout and
+ irq
+
+From: Chaotian Jing <chaotian.jing@mediatek.com>
+
+[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ]
+
+when get request SW timeout, if CMD/DAT xfer done irq coming right now,
+then there is race between the msdc_request_timeout work and irq handler,
+and the host->cmd and host->data may set to NULL in irq handler. also,
+current flow ensure that only one path can go to msdc_request_done(), so
+no need check the return value of cancel_delayed_work().
+
+Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
+Link: https://lore.kernel.org/r/20201218071611.12276-1-chaotian.jing@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index 004fbfc23672..dc84e2dff408 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -1101,13 +1101,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,
+ static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)
+ {
+ unsigned long flags;
+- bool ret;
+
+- ret = cancel_delayed_work(&host->req_timeout);
+- if (!ret) {
+- /* delay work already running */
+- return;
+- }
++ /*
++ * No need check the return value of cancel_delayed_work, as only ONE
++ * path will go here!
++ */
++ cancel_delayed_work(&host->req_timeout);
++
+ spin_lock_irqsave(&host->lock, flags);
+ host->mrq = NULL;
+ spin_unlock_irqrestore(&host->lock, flags);
+@@ -1129,7 +1129,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+ bool done = false;
+ bool sbc_error;
+ unsigned long flags;
+- u32 *rsp = cmd->resp;
++ u32 *rsp;
+
+ if (mrq->sbc && cmd == mrq->cmd &&
+ (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
+@@ -1150,6 +1150,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+
+ if (done)
+ return true;
++ rsp = cmd->resp;
+
+ sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
+
+@@ -1337,7 +1338,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,
+ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+ struct mmc_request *mrq, struct mmc_data *data)
+ {
+- struct mmc_command *stop = data->stop;
++ struct mmc_command *stop;
+ unsigned long flags;
+ bool done;
+ unsigned int check_data = events &
+@@ -1353,6 +1354,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+
+ if (done)
+ return true;
++ stop = data->stop;
+
+ if (check_data || (stop && stop->error)) {
+ dev_dbg(host->dev, "DMA status: 0x%8X\n",
+--
+2.30.1
+
--- /dev/null
+From be306f22ebd2696e9717f9365614ed826345d80f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 21:35:27 +0100
+Subject: mmc: mxs-mmc: Fix a resource leak in an error handling path in
+ 'mxs_mmc_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ]
+
+If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()'
+call.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201208203527.49262-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mxs-mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
+index 75007f61df97..4fbbff03137c 100644
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -643,7 +643,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
+
+ ret = mmc_of_parse(mmc);
+ if (ret)
+- goto out_clk_disable;
++ goto out_free_dma;
+
+ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+--
+2.30.1
+
--- /dev/null
+From d3e1b2c32ee8fc39c2ee6cdb46841cc20a8c7f58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 18:04:06 -0600
+Subject: mmc: sdhci-iproc: Add ACPI bindings for the RPi
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit 4f9833d3ec8da34861cd0680b00c73e653877eb9 ]
+
+The RPi4 has an Arasan controller it carries over from the RPi3 and a newer
+eMMC2 controller. Because of a couple of quirks, it seems wiser to bind
+these controllers to the same driver that DT is using on this platform
+rather than the generic sdhci_acpi driver with PNP0D40.
+
+So, BCM2847 describes the older Arasan and BRCME88C describes the newer
+eMMC2. The older Arasan is reusing an existing ACPI _HID used by other OSes
+booting these tables on the RPi.
+
+With this change, Linux is capable of utilizing the SD card slot, and the
+Wi-Fi when booted with UEFI+ACPI on the RPi4.
+
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20210120000406.1843400-2-jeremy.linton@arm.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-iproc.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
+index c9434b461aab..ddeaf8e1f72f 100644
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -296,9 +296,27 @@ static const struct of_device_id sdhci_iproc_of_match[] = {
+ MODULE_DEVICE_TABLE(of, sdhci_iproc_of_match);
+
+ #ifdef CONFIG_ACPI
++/*
++ * This is a duplicate of bcm2835_(pltfrm_)data without caps quirks
++ * which are provided by the ACPI table.
++ */
++static const struct sdhci_pltfm_data sdhci_bcm_arasan_data = {
++ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
++ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
++ SDHCI_QUIRK_NO_HISPD_BIT,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .ops = &sdhci_iproc_32only_ops,
++};
++
++static const struct sdhci_iproc_data bcm_arasan_data = {
++ .pdata = &sdhci_bcm_arasan_data,
++};
++
+ static const struct acpi_device_id sdhci_iproc_acpi_ids[] = {
+ { .id = "BRCM5871", .driver_data = (kernel_ulong_t)&iproc_cygnus_data },
+ { .id = "BRCM5872", .driver_data = (kernel_ulong_t)&iproc_data },
++ { .id = "BCM2847", .driver_data = (kernel_ulong_t)&bcm_arasan_data },
++ { .id = "BRCME88C", .driver_data = (kernel_ulong_t)&bcm2711_data },
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(acpi, sdhci_iproc_acpi_ids);
+--
+2.30.1
+
--- /dev/null
+From c64cb6643a200be061534594e887a18fd4f97413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 17:38:31 -0600
+Subject: mmc: sdhci: Update firmware interface API
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit c5b1c6dc13daec60405ecd31eaa5379a9f798fa8 ]
+
+The device_* calls were added a few years ago to abstract
+DT/ACPI/fwnode firmware interfaces. Lets convert the two
+sdhci caps fields to use the generic calls rather than the OF
+specific ones. This has the side effect of allowing
+ACPI based devices to quirk themselves when the caps field
+is broken.
+
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Link: https://lore.kernel.org/r/20201120233831.447365-1-jeremy.linton@arm.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 3561ae8a481a..6edf9fffd934 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3994,10 +3994,10 @@ void __sdhci_read_caps(struct sdhci_host *host, const u16 *ver,
+ if (host->v4_mode)
+ sdhci_do_enable_v4_mode(host);
+
+- of_property_read_u64(mmc_dev(host->mmc)->of_node,
+- "sdhci-caps-mask", &dt_caps_mask);
+- of_property_read_u64(mmc_dev(host->mmc)->of_node,
+- "sdhci-caps", &dt_caps);
++ device_property_read_u64_array(mmc_dev(host->mmc),
++ "sdhci-caps-mask", &dt_caps_mask, 1);
++ device_property_read_u64_array(mmc_dev(host->mmc),
++ "sdhci-caps", &dt_caps, 1);
+
+ v = ver ? *ver : sdhci_readw(host, SDHCI_HOST_VERSION);
+ host->version = (v & SDHCI_SPEC_VER_MASK) >> SDHCI_SPEC_VER_SHIFT;
+--
+2.30.1
+
--- /dev/null
+From 3ad32979b8e2835e11278f42a962a94f2e5934d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 11:03:32 +0100
+Subject: PCI: Fix pci_register_io_range() memory leak
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit f6bda644fa3a7070621c3bf12cd657f69a42f170 ]
+
+Kmemleak reports:
+
+ unreferenced object 0xc328de40 (size 64):
+ comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................
+ 00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................
+
+ backtrace:
+ [<ad758d10>] pci_register_io_range+0x3c/0x80
+ [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0
+ [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac
+ [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8
+ [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64
+ [<e451ddb0>] rcar_pcie_probe+0x2c/0x644
+
+In case a PCI host driver's probe is deferred, the same I/O range may be
+allocated again, and be ignored, causing a memory leak.
+
+Fix this by (a) letting logic_pio_register_range() return -EEXIST if the
+passed range already exists, so pci_register_io_range() will free it, and
+by (b) making pci_register_io_range() not consider -EEXIST an error
+condition.
+
+Link: https://lore.kernel.org/r/20210202100332.829047-1-geert+renesas@glider.be
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 4 ++++
+ lib/logic_pio.c | 3 +++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 5c9345072510..9e971fffeb6a 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4010,6 +4010,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
+ ret = logic_pio_register_range(range);
+ if (ret)
+ kfree(range);
++
++ /* Ignore duplicates due to deferred probing */
++ if (ret == -EEXIST)
++ ret = 0;
+ #endif
+
+ return ret;
+diff --git a/lib/logic_pio.c b/lib/logic_pio.c
+index f32fe481b492..07b4b9a1f54b 100644
+--- a/lib/logic_pio.c
++++ b/lib/logic_pio.c
+@@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex);
+ * @new_range: pointer to the IO range to be registered.
+ *
+ * Returns 0 on success, the error code in case of failure.
++ * If the range already exists, -EEXIST will be returned, which should be
++ * considered a success.
+ *
+ * Register a new IO range node in the IO range list.
+ */
+@@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ list_for_each_entry(range, &io_range_list, list) {
+ if (range->fwnode == new_range->fwnode) {
+ /* range already there */
++ ret = -EEXIST;
+ goto end_register;
+ }
+ if (range->flags == LOGIC_PIO_CPU_MMIO &&
+--
+2.30.1
+
--- /dev/null
+From 181a968affdfa5fc4e59e5de1807355759d203f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 14:17:54 -0600
+Subject: PCI/LINK: Remove bandwidth notification
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit b4c7d2076b4e767dd2e075a2b3a9e57753fc67f5 ]
+
+The PCIe Bandwidth Change Notification feature logs messages when the link
+bandwidth changes. Some users have reported that these messages occur
+often enough to significantly reduce NVMe performance. GPUs also seem to
+generate these messages.
+
+We don't know why the link bandwidth changes, but in the reported cases
+there's no indication that it's caused by hardware failures.
+
+Remove the bandwidth change notifications for now. Hopefully we can add
+this back when we have a better understanding of why this happens and how
+we can make the messages useful instead of overwhelming.
+
+Link: https://lore.kernel.org/r/20200115221008.GA191037@google.com/
+Link: https://lore.kernel.org/r/155605909349.3575.13433421148215616375.stgit@gimli.home/
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206197
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/Kconfig | 8 --
+ drivers/pci/pcie/Makefile | 1 -
+ drivers/pci/pcie/bw_notification.c | 138 -----------------------------
+ drivers/pci/pcie/portdrv.h | 6 --
+ drivers/pci/pcie/portdrv_pci.c | 1 -
+ 5 files changed, 154 deletions(-)
+ delete mode 100644 drivers/pci/pcie/bw_notification.c
+
+diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
+index 3946555a6042..45a2ef702b45 100644
+--- a/drivers/pci/pcie/Kconfig
++++ b/drivers/pci/pcie/Kconfig
+@@ -133,14 +133,6 @@ config PCIE_PTM
+ This is only useful if you have devices that support PTM, but it
+ is safe to enable even if you don't.
+
+-config PCIE_BW
+- bool "PCI Express Bandwidth Change Notification"
+- depends on PCIEPORTBUS
+- help
+- This enables PCI Express Bandwidth Change Notification. If
+- you know link width or rate changes occur only to correct
+- unreliable links, you may answer Y.
+-
+ config PCIE_EDR
+ bool "PCI Express Error Disconnect Recover support"
+ depends on PCIE_DPC && ACPI
+diff --git a/drivers/pci/pcie/Makefile b/drivers/pci/pcie/Makefile
+index 68da9280ff11..9a7085668466 100644
+--- a/drivers/pci/pcie/Makefile
++++ b/drivers/pci/pcie/Makefile
+@@ -12,5 +12,4 @@ obj-$(CONFIG_PCIEAER_INJECT) += aer_inject.o
+ obj-$(CONFIG_PCIE_PME) += pme.o
+ obj-$(CONFIG_PCIE_DPC) += dpc.o
+ obj-$(CONFIG_PCIE_PTM) += ptm.o
+-obj-$(CONFIG_PCIE_BW) += bw_notification.o
+ obj-$(CONFIG_PCIE_EDR) += edr.o
+diff --git a/drivers/pci/pcie/bw_notification.c b/drivers/pci/pcie/bw_notification.c
+deleted file mode 100644
+index 565d23cccb8b..000000000000
+--- a/drivers/pci/pcie/bw_notification.c
++++ /dev/null
+@@ -1,138 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/*
+- * PCI Express Link Bandwidth Notification services driver
+- * Author: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+- *
+- * Copyright (C) 2019, Dell Inc
+- *
+- * The PCIe Link Bandwidth Notification provides a way to notify the
+- * operating system when the link width or data rate changes. This
+- * capability is required for all root ports and downstream ports
+- * supporting links wider than x1 and/or multiple link speeds.
+- *
+- * This service port driver hooks into the bandwidth notification interrupt
+- * and warns when links become degraded in operation.
+- */
+-
+-#define dev_fmt(fmt) "bw_notification: " fmt
+-
+-#include "../pci.h"
+-#include "portdrv.h"
+-
+-static bool pcie_link_bandwidth_notification_supported(struct pci_dev *dev)
+-{
+- int ret;
+- u32 lnk_cap;
+-
+- ret = pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnk_cap);
+- return (ret == PCIBIOS_SUCCESSFUL) && (lnk_cap & PCI_EXP_LNKCAP_LBNC);
+-}
+-
+-static void pcie_enable_link_bandwidth_notification(struct pci_dev *dev)
+-{
+- u16 lnk_ctl;
+-
+- pcie_capability_write_word(dev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS);
+-
+- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl);
+- lnk_ctl |= PCI_EXP_LNKCTL_LBMIE;
+- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
+-}
+-
+-static void pcie_disable_link_bandwidth_notification(struct pci_dev *dev)
+-{
+- u16 lnk_ctl;
+-
+- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl);
+- lnk_ctl &= ~PCI_EXP_LNKCTL_LBMIE;
+- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
+-}
+-
+-static irqreturn_t pcie_bw_notification_irq(int irq, void *context)
+-{
+- struct pcie_device *srv = context;
+- struct pci_dev *port = srv->port;
+- u16 link_status, events;
+- int ret;
+-
+- ret = pcie_capability_read_word(port, PCI_EXP_LNKSTA, &link_status);
+- events = link_status & PCI_EXP_LNKSTA_LBMS;
+-
+- if (ret != PCIBIOS_SUCCESSFUL || !events)
+- return IRQ_NONE;
+-
+- pcie_capability_write_word(port, PCI_EXP_LNKSTA, events);
+- pcie_update_link_speed(port->subordinate, link_status);
+- return IRQ_WAKE_THREAD;
+-}
+-
+-static irqreturn_t pcie_bw_notification_handler(int irq, void *context)
+-{
+- struct pcie_device *srv = context;
+- struct pci_dev *port = srv->port;
+- struct pci_dev *dev;
+-
+- /*
+- * Print status from downstream devices, not this root port or
+- * downstream switch port.
+- */
+- down_read(&pci_bus_sem);
+- list_for_each_entry(dev, &port->subordinate->devices, bus_list)
+- pcie_report_downtraining(dev);
+- up_read(&pci_bus_sem);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static int pcie_bandwidth_notification_probe(struct pcie_device *srv)
+-{
+- int ret;
+-
+- /* Single-width or single-speed ports do not have to support this. */
+- if (!pcie_link_bandwidth_notification_supported(srv->port))
+- return -ENODEV;
+-
+- ret = request_threaded_irq(srv->irq, pcie_bw_notification_irq,
+- pcie_bw_notification_handler,
+- IRQF_SHARED, "PCIe BW notif", srv);
+- if (ret)
+- return ret;
+-
+- pcie_enable_link_bandwidth_notification(srv->port);
+- pci_info(srv->port, "enabled with IRQ %d\n", srv->irq);
+-
+- return 0;
+-}
+-
+-static void pcie_bandwidth_notification_remove(struct pcie_device *srv)
+-{
+- pcie_disable_link_bandwidth_notification(srv->port);
+- free_irq(srv->irq, srv);
+-}
+-
+-static int pcie_bandwidth_notification_suspend(struct pcie_device *srv)
+-{
+- pcie_disable_link_bandwidth_notification(srv->port);
+- return 0;
+-}
+-
+-static int pcie_bandwidth_notification_resume(struct pcie_device *srv)
+-{
+- pcie_enable_link_bandwidth_notification(srv->port);
+- return 0;
+-}
+-
+-static struct pcie_port_service_driver pcie_bandwidth_notification_driver = {
+- .name = "pcie_bw_notification",
+- .port_type = PCIE_ANY_PORT,
+- .service = PCIE_PORT_SERVICE_BWNOTIF,
+- .probe = pcie_bandwidth_notification_probe,
+- .suspend = pcie_bandwidth_notification_suspend,
+- .resume = pcie_bandwidth_notification_resume,
+- .remove = pcie_bandwidth_notification_remove,
+-};
+-
+-int __init pcie_bandwidth_notification_init(void)
+-{
+- return pcie_port_service_register(&pcie_bandwidth_notification_driver);
+-}
+diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
+index af7cf237432a..2ff5724b8f13 100644
+--- a/drivers/pci/pcie/portdrv.h
++++ b/drivers/pci/pcie/portdrv.h
+@@ -53,12 +53,6 @@ int pcie_dpc_init(void);
+ static inline int pcie_dpc_init(void) { return 0; }
+ #endif
+
+-#ifdef CONFIG_PCIE_BW
+-int pcie_bandwidth_notification_init(void);
+-#else
+-static inline int pcie_bandwidth_notification_init(void) { return 0; }
+-#endif
+-
+ /* Port Type */
+ #define PCIE_ANY_PORT (~0)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 3a3ce40ae1ab..d4559cf88f79 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -248,7 +248,6 @@ static void __init pcie_init_services(void)
+ pcie_pme_init();
+ pcie_dpc_init();
+ pcie_hp_init();
+- pcie_bandwidth_notification_init();
+ }
+
+ static int __init pcie_portdrv_init(void)
+--
+2.30.1
+
--- /dev/null
+From e1649c758ddf4e6adc0a349a912efd71a9568191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 18:48:10 +0000
+Subject: PCI: mediatek: Add missing of_node_put() to fix reference leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczyński <kw@linux.com>
+
+[ Upstream commit 42814c438aac79746d310f413a27d5b0b959c5de ]
+
+The for_each_available_child_of_node helper internally makes use of the
+of_get_next_available_child() which performs an of_node_get() on each
+iteration when searching for next available child node.
+
+Should an available child node be found, then it would return a device
+node pointer with reference count incremented, thus early return from
+the middle of the loop requires an explicit of_node_put() to prevent
+reference count leak.
+
+To stop the reference leak, explicitly call of_node_put() before
+returning after an error occurred.
+
+Link: https://lore.kernel.org/r/20210120184810.3068794-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index cf4c18f0c25a..23548b517e4b 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -1035,14 +1035,14 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ err = of_pci_get_devfn(child);
+ if (err < 0) {
+ dev_err(dev, "failed to parse devfn: %d\n", err);
+- return err;
++ goto error_put_node;
+ }
+
+ slot = PCI_SLOT(err);
+
+ err = mtk_pcie_parse_port(pcie, child, slot);
+ if (err)
+- return err;
++ goto error_put_node;
+ }
+
+ err = mtk_pcie_subsys_powerup(pcie);
+@@ -1058,6 +1058,9 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ mtk_pcie_subsys_powerdown(pcie);
+
+ return 0;
++error_put_node:
++ of_node_put(child);
++ return err;
+ }
+
+ static int mtk_pcie_probe(struct platform_device *pdev)
+--
+2.30.1
+
--- /dev/null
+From 58c3e854aa9835fb4411398d06815443f87f3f0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 22:24:35 +0100
+Subject: PCI: xgene-msi: Fix race in installing chained irq handler
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit a93c00e5f975f23592895b7e83f35de2d36b7633 ]
+
+Fix a race where a pending interrupt could be received and the handler
+called before the handler's data has been setup, by converting to
+irq_set_chained_handler_and_data().
+
+See also 2cf5a03cb29d ("PCI/keystone: Fix race in installing chained IRQ
+handler").
+
+Based on the mail discussion, it seems ok to drop the error handling.
+
+Link: https://lore.kernel.org/r/20210115212435.19940-3-martin@kaiser.cx
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-xgene-msi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
+index 2470782cb01a..1c34c897a7e2 100644
+--- a/drivers/pci/controller/pci-xgene-msi.c
++++ b/drivers/pci/controller/pci-xgene-msi.c
+@@ -384,13 +384,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)
+ if (!msi_group->gic_irq)
+ continue;
+
+- irq_set_chained_handler(msi_group->gic_irq,
+- xgene_msi_isr);
+- err = irq_set_handler_data(msi_group->gic_irq, msi_group);
+- if (err) {
+- pr_err("failed to register GIC IRQ handler\n");
+- return -EINVAL;
+- }
++ irq_set_chained_handler_and_data(msi_group->gic_irq,
++ xgene_msi_isr, msi_group);
++
+ /*
+ * Statically allocate MSI GIC IRQs to each CPU core.
+ * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated
+--
+2.30.1
+
--- /dev/null
+From e9e9769c963ced096c9be69291e342d132203a15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 08:37:38 +0100
+Subject: Platform: OLPC: Fix probe error handling
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit cec551ea0d41c679ed11d758e1a386e20285b29d ]
+
+Reset ec_priv if probe ends unsuccessfully.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Link: https://lore.kernel.org/r/20210126073740.10232-2-lkundrak@v3.sk
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/olpc/olpc-ec.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
+index f64b82824db2..2db7113383fd 100644
+--- a/drivers/platform/olpc/olpc-ec.c
++++ b/drivers/platform/olpc/olpc-ec.c
+@@ -426,11 +426,8 @@ static int olpc_ec_probe(struct platform_device *pdev)
+
+ /* get the EC revision */
+ err = olpc_ec_cmd(EC_FIRMWARE_REV, NULL, 0, &ec->version, 1);
+- if (err) {
+- ec_priv = NULL;
+- kfree(ec);
+- return err;
+- }
++ if (err)
++ goto error;
+
+ config.dev = pdev->dev.parent;
+ config.driver_data = ec;
+@@ -440,12 +437,16 @@ static int olpc_ec_probe(struct platform_device *pdev)
+ if (IS_ERR(ec->dcon_rdev)) {
+ dev_err(&pdev->dev, "failed to register DCON regulator\n");
+ err = PTR_ERR(ec->dcon_rdev);
+- kfree(ec);
+- return err;
++ goto error;
+ }
+
+ ec->dbgfs_dir = olpc_ec_setup_debugfs();
+
++ return 0;
++
++error:
++ ec_priv = NULL;
++ kfree(ec);
+ return err;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 7cddb59b8ff3d7d10dc0bd55c851a1d47f6db52b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 00:59:20 +1100
+Subject: powerpc/64: Fix stack trace not displaying final frame
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit e3de1e291fa58a1ab0f471a4b458eff2514e4b5f ]
+
+In commit bf13718bc57a ("powerpc: show registers when unwinding
+interrupt frames") we changed our stack dumping logic to show the full
+registers whenever we find an interrupt frame on the stack.
+
+However we didn't notice that on 64-bit this doesn't show the final
+frame, ie. the interrupt that brought us in from userspace, whereas on
+32-bit it does.
+
+That is due to confusion about the size of that last frame. The code
+in show_stack() calls validate_sp(), passing it STACK_INT_FRAME_SIZE
+to check the sp is at least that far below the top of the stack.
+
+However on 64-bit that size is too large for the final frame, because
+it includes the red zone, but we don't allocate a red zone for the
+first frame.
+
+So add a new define that encodes the correct size for 32-bit and
+64-bit, and use it in show_stack().
+
+This results in the full trace being shown on 64-bit, eg:
+
+ sysrq: Trigger a crash
+ Kernel panic - not syncing: sysrq triggered crash
+ CPU: 0 PID: 83 Comm: sh Not tainted 5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty #649
+ Call Trace:
+ [c00000000a1c3ac0] [c000000000897b70] dump_stack+0xc4/0x114 (unreliable)
+ [c00000000a1c3b00] [c00000000014334c] panic+0x178/0x41c
+ [c00000000a1c3ba0] [c00000000094e600] sysrq_handle_crash+0x40/0x50
+ [c00000000a1c3c00] [c00000000094ef98] __handle_sysrq+0xd8/0x210
+ [c00000000a1c3ca0] [c00000000094f820] write_sysrq_trigger+0x100/0x188
+ [c00000000a1c3ce0] [c0000000005559dc] proc_reg_write+0x10c/0x1b0
+ [c00000000a1c3d10] [c000000000479950] vfs_write+0xf0/0x360
+ [c00000000a1c3d60] [c000000000479d9c] ksys_write+0x7c/0x140
+ [c00000000a1c3db0] [c00000000002bf5c] system_call_exception+0x19c/0x2c0
+ [c00000000a1c3e10] [c00000000000d35c] system_call_common+0xec/0x278
+ --- interrupt: c00 at 0x7fff9fbab428
+ NIP: 00007fff9fbab428 LR: 000000001000b724 CTR: 0000000000000000
+ REGS: c00000000a1c3e80 TRAP: 0c00 Not tainted (5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty)
+ MSR: 900000000280f033 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002884 XER: 00000000
+ IRQMASK: 0
+ GPR00: 0000000000000004 00007fffc3cb8960 00007fff9fc59900 0000000000000001
+ GPR04: 000000002a4b32d0 0000000000000002 0000000000000063 0000000000000063
+ GPR08: 000000002a4b32d0 0000000000000000 0000000000000000 0000000000000000
+ GPR12: 0000000000000000 00007fff9fcca9a0 0000000000000000 0000000000000000
+ GPR16: 0000000000000000 0000000000000000 0000000000000000 00000000100b8fd0
+ GPR20: 000000002a4b3485 00000000100b8f90 0000000000000000 0000000000000000
+ GPR24: 000000002a4b0440 00000000100e77b8 0000000000000020 000000002a4b32d0
+ GPR28: 0000000000000001 0000000000000002 000000002a4b32d0 0000000000000001
+ NIP [00007fff9fbab428] 0x7fff9fbab428
+ LR [000000001000b724] 0x1000b724
+ --- interrupt: c00
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210209141627.2898485-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ptrace.h | 3 +++
+ arch/powerpc/kernel/asm-offsets.c | 2 +-
+ arch/powerpc/kernel/process.c | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
+index e2c778c176a3..7bb064ad04d8 100644
+--- a/arch/powerpc/include/asm/ptrace.h
++++ b/arch/powerpc/include/asm/ptrace.h
+@@ -62,6 +62,9 @@ struct pt_regs
+ };
+ #endif
+
++
++#define STACK_FRAME_WITH_PT_REGS (STACK_FRAME_OVERHEAD + sizeof(struct pt_regs))
++
+ #ifdef __powerpc64__
+
+ /*
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index c2722ff36e98..5c125255571c 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -307,7 +307,7 @@ int main(void)
+
+ /* Interrupt register frame */
+ DEFINE(INT_FRAME_SIZE, STACK_INT_FRAME_SIZE);
+- DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_OVERHEAD + sizeof(struct pt_regs));
++ DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_WITH_PT_REGS);
+ STACK_PT_REGS_OFFSET(GPR0, gpr[0]);
+ STACK_PT_REGS_OFFSET(GPR1, gpr[1]);
+ STACK_PT_REGS_OFFSET(GPR2, gpr[2]);
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index d421a2c7f822..1a1d2657fe8d 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -2170,7 +2170,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack,
+ * See if this is an exception frame.
+ * We look for the "regshere" marker in the current frame.
+ */
+- if (validate_sp(sp, tsk, STACK_INT_FRAME_SIZE)
++ if (validate_sp(sp, tsk, STACK_FRAME_WITH_PT_REGS)
+ && stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
+ struct pt_regs *regs = (struct pt_regs *)
+ (sp + STACK_FRAME_OVERHEAD);
+--
+2.30.1
+
--- /dev/null
+From ee6e132a6b3ee9aff93c1e9542e045c78ea15a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 23:08:35 +1000
+Subject: powerpc: improve handling of unrecoverable system reset
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 11cb0a25f71818ca7ab4856548ecfd83c169aa4d ]
+
+If an unrecoverable system reset hits in process context, the system
+does not have to panic. Similar to machine check, call nmi_exit()
+before die().
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210130130852.2952424-26-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/traps.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 5006dcbe1d9f..77dffea3d537 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -509,8 +509,11 @@ void system_reset_exception(struct pt_regs *regs)
+ die("Unrecoverable nested System Reset", regs, SIGABRT);
+ #endif
+ /* Must die if the interrupt is not recoverable */
+- if (!(regs->msr & MSR_RI))
++ if (!(regs->msr & MSR_RI)) {
++ /* For the reason explained in die_mce, nmi_exit before die */
++ nmi_exit();
+ die("Unrecoverable System Reset", regs, SIGABRT);
++ }
+
+ if (saved_hsrrs) {
+ mtspr(SPRN_HSRR0, hsrr0);
+--
+2.30.1
+
--- /dev/null
+From 92ef382beecb48c2b076e4ceada5e3c58c44ba2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 15:35:06 +1100
+Subject: powerpc/pci: Add ppc_md.discover_phbs()
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 5537fcb319d016ce387f818dd774179bc03217f5 ]
+
+On many powerpc platforms the discovery and initalisation of
+pci_controllers (PHBs) happens inside of setup_arch(). This is very early
+in boot (pre-initcalls) and means that we're initialising the PHB long
+before many basic kernel services (slab allocator, debugfs, a real ioremap)
+are available.
+
+On PowerNV this causes an additional problem since we map the PHB registers
+with ioremap(). As of commit d538aadc2718 ("powerpc/ioremap: warn on early
+use of ioremap()") a warning is printed because we're using the "incorrect"
+API to setup and MMIO mapping in searly boot. The kernel does provide
+early_ioremap(), but that is not intended to create long-lived MMIO
+mappings and a seperate warning is printed by generic code if
+early_ioremap() mappings are "leaked."
+
+This is all fixable with dumb hacks like using early_ioremap() to setup
+the initial mapping then replacing it with a real ioremap later on in
+boot, but it does raise the question: Why the hell are we setting up the
+PHB's this early in boot?
+
+The old and wise claim it's due to "hysterical rasins." Aside from amused
+grapes there doesn't appear to be any real reason to maintain the current
+behaviour. Already most of the newer embedded platforms perform PHB
+discovery in an arch_initcall and between the end of setup_arch() and the
+start of initcalls none of the generic kernel code does anything PCI
+related. On powerpc scanning PHBs occurs in a subsys_initcall so it should
+be possible to move the PHB discovery to a core, postcore or arch initcall.
+
+This patch adds the ppc_md.discover_phbs hook and a core_initcall stub that
+calls it. The core_initcalls are the earliest to be called so this will
+any possibly issues with dependency between initcalls. This isn't just an
+academic issue either since on pseries and PowerNV EEH init occurs in an
+arch_initcall and depends on the pci_controllers being available, similarly
+the creation of pci_dns occurs at core_initcall_sync (i.e. between core and
+postcore initcalls). These problems need to be addressed seperately.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+[mpe: Make discover_phbs() static]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201103043523.916109-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/machdep.h | 3 +++
+ arch/powerpc/kernel/pci-common.c | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
+index 475687f24f4a..d319160d790c 100644
+--- a/arch/powerpc/include/asm/machdep.h
++++ b/arch/powerpc/include/asm/machdep.h
+@@ -59,6 +59,9 @@ struct machdep_calls {
+ int (*pcibios_root_bridge_prepare)(struct pci_host_bridge
+ *bridge);
+
++ /* finds all the pci_controllers present at boot */
++ void (*discover_phbs)(void);
++
+ /* To setup PHBs when using automatic OF platform driver for PCI */
+ int (*pci_setup_phb)(struct pci_controller *host);
+
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index be108616a721..7920559a1ca8 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -1625,3 +1625,13 @@ static void fixup_hide_host_resource_fsl(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MOTOROLA, PCI_ANY_ID, fixup_hide_host_resource_fsl);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, fixup_hide_host_resource_fsl);
++
++
++static int __init discover_phbs(void)
++{
++ if (ppc_md.discover_phbs)
++ ppc_md.discover_phbs();
++
++ return 0;
++}
++core_initcall(discover_phbs);
+--
+2.30.1
+
--- /dev/null
+From fe2cf9cc0ad4bd4c84b0aaf73df753f0a225681d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 04:14:52 -0500
+Subject: powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ]
+
+While sampling for marked events, currently we record the sample only
+if the SIAR valid bit of Sampled Instruction Event Register (SIER) is
+set. SIAR_VALID bit is used for fetching the instruction address from
+Sampled Instruction Address Register(SIAR). But there are some
+usecases, where the user is interested only in the PMU stats at each
+counter overflow and the exact IP of the overflow event is not
+required. Dropping SIAR invalid samples will fail to record some of
+the counter overflows in such cases.
+
+Example of such usecase is dumping the PMU stats (event counts) after
+some regular amount of instructions/events from the userspace (ex: via
+ptrace). Here counter overflow is indicated to userspace via signal
+handler, and captured by monitoring and enabling I/O signaling on the
+event file descriptor. In these cases, we expect to get
+sample/overflow indication after each specified sample_period.
+
+Perf event attribute will not have PERF_SAMPLE_IP set in the
+sample_type if exact IP of the overflow event is not requested. So
+while profiling if SAMPLE_IP is not set, just record the counter
+overflow irrespective of SIAR_VALID check.
+
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+[mpe: Reflow comment and if formatting]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1612516492-1428-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/core-book3s.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 426baa4de602..ded4a3efd3f0 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2112,7 +2112,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ left += period;
+ if (left <= 0)
+ left = period;
+- record = siar_valid(regs);
++
++ /*
++ * If address is not requested in the sample via
++ * PERF_SAMPLE_IP, just record that sample irrespective
++ * of SIAR valid check.
++ */
++ if (event->attr.sample_type & PERF_SAMPLE_IP)
++ record = siar_valid(regs);
++ else
++ record = 1;
++
+ event->hw.last_period = event->hw.sample_period;
+ }
+ if (left < 0x80000000LL)
+@@ -2130,9 +2140,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+ * these cases.
+ */
+- if (event->attr.exclude_kernel && record)
+- if (is_kernel_addr(mfspr(SPRN_SIAR)))
+- record = 0;
++ if (event->attr.exclude_kernel &&
++ (event->attr.sample_type & PERF_SAMPLE_IP) &&
++ is_kernel_addr(mfspr(SPRN_SIAR)))
++ record = 0;
+
+ /*
+ * Finally record data if requested.
+--
+2.30.1
+
--- /dev/null
+From b77c12805b02919e409eb7a4878223ad47cd1e28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 07:13:02 +0100
+Subject: s390/smp: __smp_rescan_cpus() - move cpumask away from stack
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ]
+
+Avoid a potentially large stack frame and overflow by making
+"cpumask_t avail" a static variable. There is no concurrent
+access due to the existing locking.
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 3a0d545f0ce8..791bc373418b 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -775,7 +775,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
+ static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
+ {
+ struct sclp_core_entry *core;
+- cpumask_t avail;
++ static cpumask_t avail;
+ bool configured;
+ u16 core_id;
+ int nr, i;
+--
+2.30.1
+
--- /dev/null
+From 195d940689a8ecc225e5076a0a65b59b8f96741b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Feb 2021 22:46:00 -0600
+Subject: scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit d28d48c699779973ab9a3bd0e5acfa112bd4fdef ]
+
+If iscsi_prep_scsi_cmd_pdu() fails we try to add it back to the cmdqueue,
+but we leave it partially setup. We don't have functions that can undo the
+pdu and init task setup. We only have cleanup_task which can clean up both
+parts. So this has us just fail the cmd and go through the standard cleanup
+routine and then have the SCSI midlayer retry it like is done when it fails
+in the queuecommand path.
+
+Link: https://lore.kernel.org/r/20210207044608.27585-2-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 5125a6c7f70e..41b8192d207d 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1532,14 +1532,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
+ }
+ rc = iscsi_prep_scsi_cmd_pdu(conn->task);
+ if (rc) {
+- if (rc == -ENOMEM || rc == -EACCES) {
+- spin_lock_bh(&conn->taskqueuelock);
+- list_add_tail(&conn->task->running,
+- &conn->cmdqueue);
+- conn->task = NULL;
+- spin_unlock_bh(&conn->taskqueuelock);
+- goto done;
+- } else
++ if (rc == -ENOMEM || rc == -EACCES)
++ fail_scsi_task(conn->task, DID_IMM_RETRY);
++ else
+ fail_scsi_task(conn->task, DID_ABORT);
+ spin_lock_bh(&conn->taskqueuelock);
+ continue;
+--
+2.30.1
+
--- /dev/null
+From 7e60977c48b4f3efe441023d484bd35c64e95732 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 10:22:01 +0300
+Subject: scsi: target: core: Add cmd length set before cmd complete
+
+From: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+
+[ Upstream commit 1c73e0c5e54d5f7d77f422a10b03ebe61eaed5ad ]
+
+TCM doesn't properly handle underflow case for service actions. One way to
+prevent it is to always complete command with
+target_complete_cmd_with_length(), however it requires access to data_sg,
+which is not always available.
+
+This change introduces target_set_cmd_data_length() function which allows
+to set command data length before completing it.
+
+Link: https://lore.kernel.org/r/20210209072202.41154-2-a.miloserdov@yadro.com
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
+Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_transport.c | 15 +++++++++++----
+ include/target/target_core_backend.h | 1 +
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index ff26ab0a5f60..484f0ba0a65b 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -873,11 +873,9 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
+ }
+ EXPORT_SYMBOL(target_complete_cmd);
+
+-void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++void target_set_cmd_data_length(struct se_cmd *cmd, int length)
+ {
+- if ((scsi_status == SAM_STAT_GOOD ||
+- cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) &&
+- length < cmd->data_length) {
++ if (length < cmd->data_length) {
+ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+ cmd->residual_count += cmd->data_length - length;
+ } else {
+@@ -887,6 +885,15 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
+
+ cmd->data_length = length;
+ }
++}
++EXPORT_SYMBOL(target_set_cmd_data_length);
++
++void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++{
++ if (scsi_status == SAM_STAT_GOOD ||
++ cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) {
++ target_set_cmd_data_length(cmd, length);
++ }
+
+ target_complete_cmd(cmd, scsi_status);
+ }
+diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
+index 6336780d83a7..ce2fba49c95d 100644
+--- a/include/target/target_core_backend.h
++++ b/include/target/target_core_backend.h
+@@ -72,6 +72,7 @@ int transport_backend_register(const struct target_backend_ops *);
+ void target_backend_unregister(const struct target_backend_ops *);
+
+ void target_complete_cmd(struct se_cmd *, u8);
++void target_set_cmd_data_length(struct se_cmd *, int);
+ void target_complete_cmd_with_length(struct se_cmd *, u8, int);
+
+ void transport_copy_sense_to_cmd(struct se_cmd *, unsigned char *);
+--
+2.30.1
+
--- /dev/null
+From f0e5c73199b6af81e14a51f3a9f6e204a7c7f4a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 10:22:02 +0300
+Subject: scsi: target: core: Prevent underflow for service actions
+
+From: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+
+[ Upstream commit 14d24e2cc77411301e906a8cf41884739de192de ]
+
+TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which
+might be considered an underflow in case of Data-In size being greater than
+8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow.
+
+Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
+Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_pr.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 5f79ea05f9b8..b42193c554fb 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3738,6 +3738,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd)
+ spin_unlock(&dev->t10_pr.registration_lock);
+
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+@@ -3756,7 +3757,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ struct t10_pr_registration *pr_reg;
+ unsigned char *buf;
+ u64 pr_res_key;
+- u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */
++ u32 add_len = 0;
+
+ if (cmd->data_length < 8) {
+ pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
+@@ -3774,8 +3775,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ pr_reg = dev->dev_pr_res_holder;
+ if (pr_reg) {
+ /*
+- * Set the hardcoded Additional Length
++ * Set the Additional Length to 16 when a reservation is held
+ */
++ add_len = 16;
+ put_unaligned_be32(add_len, &buf[4]);
+
+ if (cmd->data_length < 22)
+@@ -3811,6 +3813,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ (pr_reg->pr_res_type & 0x0f);
+ }
+
++ target_set_cmd_data_length(cmd, 8 + add_len);
++
+ err:
+ spin_unlock(&dev->dev_reservation_lock);
+ transport_kunmap_data_sg(cmd);
+@@ -3829,7 +3833,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ struct se_device *dev = cmd->se_dev;
+ struct t10_reservation *pr_tmpl = &dev->t10_pr;
+ unsigned char *buf;
+- u16 add_len = 8; /* Hardcoded to 8. */
++ u16 len = 8; /* Hardcoded to 8. */
+
+ if (cmd->data_length < 6) {
+ pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
+@@ -3841,7 +3845,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ if (!buf)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+
+- put_unaligned_be16(add_len, &buf[0]);
++ put_unaligned_be16(len, &buf[0]);
+ buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
+ buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
+ buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */
+@@ -3870,6 +3874,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
+ buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
+
++ target_set_cmd_data_length(cmd, len);
++
+ transport_kunmap_data_sg(cmd);
+
+ return 0;
+@@ -4030,6 +4036,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
+ * Set ADDITIONAL_LENGTH
+ */
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+--
+2.30.1
+
--- /dev/null
+From 48856783169f2e9037af1fec6a4ec4c95fdf33c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 01:59:27 -0800
+Subject: scsi: ufs: WB is only available on LUN #0 to #7
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit a2fca52ee640a04112ed9d9a137c940ea6ad288e ]
+
+Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from
+rpmb LUN. The reason is that the unit descriptor length is different per
+LU.
+
+The length of Normal LU is 45 while the one of rpmb LU is 35.
+
+int ufshcd_read_desc_param(struct ufs_hba *hba, ...)
+{
+ param_offset=41;
+ param_size=4;
+ buff_len=45;
+ ...
+ buff_len=35 by rpmb LU;
+
+ if (is_kmalloc) {
+ /* Make sure we don't copy more data than available */
+ if (param_offset + param_size > buff_len)
+ param_size = buff_len - param_offset;
+ --> param_size = 250;
+ memcpy(param_read_buf, &desc_buf[param_offset], param_size);
+ --> memcpy(param_read_buf, desc_buf+41, 250);
+
+[ 141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c
+ }
+}
+
+Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-sysfs.c | 3 ++-
+ drivers/scsi/ufs/ufs.h | 6 ++++--
+ drivers/scsi/ufs/ufshcd.c | 2 +-
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c
+index bdcd27faa054..34b424ad96a2 100644
+--- a/drivers/scsi/ufs/ufs-sysfs.c
++++ b/drivers/scsi/ufs/ufs-sysfs.c
+@@ -785,7 +785,8 @@ static ssize_t _pname##_show(struct device *dev, \
+ struct scsi_device *sdev = to_scsi_device(dev); \
+ struct ufs_hba *hba = shost_priv(sdev->host); \
+ u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun); \
+- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) \
++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, \
++ _duname##_DESC_PARAM##_puname)) \
+ return -EINVAL; \
+ return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \
+ lun, _duname##_DESC_PARAM##_puname, buf, _size); \
+diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
+index f8ab16f30fdc..07ca39008b84 100644
+--- a/drivers/scsi/ufs/ufs.h
++++ b/drivers/scsi/ufs/ufs.h
+@@ -551,13 +551,15 @@ struct ufs_dev_info {
+ * @return: true if the lun has a matching unit descriptor, false otherwise
+ */
+ static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info,
+- u8 lun)
++ u8 lun, u8 param_offset)
+ {
+ if (!dev_info || !dev_info->max_lu_supported) {
+ pr_err("Max General LU supported by UFS isn't initialized\n");
+ return false;
+ }
+-
++ /* WB is available only for the logical unit from 0 to 7 */
++ if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS)
++ return lun < UFS_UPIU_MAX_WB_LUN_ID;
+ return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported);
+ }
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 5a7cc2e42ffd..97d9d5d99adc 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3378,7 +3378,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba,
+ * Unit descriptors are only available for general purpose LUs (LUN id
+ * from 0 to 7) and RPMB Well known LU.
+ */
+- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))
++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset))
+ return -EOPNOTSUPP;
+
+ return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun,
+--
+2.30.1
+
ath11k-peer-delete-synchronization-with-firmware.patch
ath11k-start-vdev-if-a-bss-peer-is-already-created.patch
ath11k-fix-ap-mode-for-qca6390.patch
+i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch
+i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch
+scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch
+udf-fix-silent-aed-taglocation-corruption.patch
+iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch
+mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch
+mmc-mediatek-fix-race-condition-between-msdc_request.patch
+mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch
+platform-olpc-fix-probe-error-handling.patch
+powerpc-pci-add-ppc_md.discover_phbs.patch
+spi-stm32-make-spurious-and-overrun-interrupts-visib.patch
+powerpc-improve-handling-of-unrecoverable-system-res.patch
+powerpc-perf-record-counter-overflow-always-if-sampl.patch
+hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch
+powerpc-64-fix-stack-trace-not-displaying-final-fram.patch
+iommu-amd-fix-performance-counter-initialization.patch
+clk-qcom-gdsc-implement-no_ret_periph-flag.patch
+sparc32-limit-memblock-allocation-to-low-memory.patch
+sparc64-use-arch_validate_flags-to-validate-adi-flag.patch
+input-applespi-don-t-wait-for-responses-to-commands-.patch
+pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch
+pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch
+drivers-base-build-kunit-tests-without-structleak-pl.patch
+pci-link-remove-bandwidth-notification.patch
+ext4-don-t-try-to-processed-freed-blocks-until-mball.patch
+kbuild-clamp-sublevel-to-255.patch
+pci-fix-pci_register_io_range-memory-leak.patch
+i40e-fix-memory-leak-in-i40e_probe.patch
+kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch
+s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch
+drivers-base-memory-don-t-store-phys_device-in-memor.patch
+sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch
+scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch
+scsi-target-core-add-cmd-length-set-before-cmd-compl.patch
+scsi-target-core-prevent-underflow-for-service-actio.patch
+clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch
+mmc-sdhci-update-firmware-interface-api.patch
+arm-9029-1-make-iwmmxt.s-support-clang-s-integrated-.patch
+arm-assembler-introduce-adr_l-ldr_l-and-str_l-macros.patch
+arm-efistub-replace-adrl-pseudo-op-with-adr_l-macro-.patch
--- /dev/null
+From 38c6127c7ad10b46db9092d8e5ada94c6795d8ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 14:20:31 +0100
+Subject: sparc32: Limit memblock allocation to low memory
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit bda166930c37604ffa93f2425426af6921ec575a ]
+
+Commit cca079ef8ac29a7c02192d2bad2ffe4c0c5ffdd0 changed sparc32 to use
+memblocks instead of bootmem, but also made high memory available via
+memblock allocation which does not work together with e.g. phys_to_virt
+and can lead to kernel panic.
+
+This changes back to only low memory being allocatable in the early
+stages, now using memblock allocation.
+
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/mm/init_32.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
+index eb2946b1df8a..6139c5700ccc 100644
+--- a/arch/sparc/mm/init_32.c
++++ b/arch/sparc/mm/init_32.c
+@@ -197,6 +197,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
+ size = memblock_phys_mem_size() - memblock_reserved_size();
+ *pages_avail = (size >> PAGE_SHIFT) - high_pages;
+
++ /* Only allow low memory to be allocated via memblock allocation */
++ memblock_set_current_limit(max_low_pfn << PAGE_SHIFT);
++
+ return max_pfn;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From a95b471947a3304cec465bc67c548c12b1cf8a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 11:56:11 -0600
+Subject: sparc64: Use arch_validate_flags() to validate ADI flag
+
+From: Khalid Aziz <khalid.aziz@oracle.com>
+
+[ Upstream commit 147d8622f2a26ef34beacc60e1ed8b66c2fa457f ]
+
+When userspace calls mprotect() to enable ADI on an address range,
+do_mprotect_pkey() calls arch_validate_prot() to validate new
+protection flags. arch_validate_prot() for sparc looks at the first
+VMA associated with address range to verify if ADI can indeed be
+enabled on this address range. This has two issues - (1) Address
+range might cover multiple VMAs while arch_validate_prot() looks at
+only the first VMA, (2) arch_validate_prot() peeks at VMA without
+holding mmap lock which can result in race condition.
+
+arch_validate_flags() from commit c462ac288f2c ("mm: Introduce
+arch_validate_flags()") allows for VMA flags to be validated for all
+VMAs that cover the address range given by user while holding mmap
+lock. This patch updates sparc code to move the VMA check from
+arch_validate_prot() to arch_validate_flags() to fix above two
+issues.
+
+Suggested-by: Jann Horn <jannh@google.com>
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/mman.h | 54 +++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h
+index f94532f25db1..274217e7ed70 100644
+--- a/arch/sparc/include/asm/mman.h
++++ b/arch/sparc/include/asm/mman.h
+@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr)
+ {
+ if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI))
+ return 0;
+- if (prot & PROT_ADI) {
+- if (!adi_capable())
+- return 0;
++ return 1;
++}
+
+- if (addr) {
+- struct vm_area_struct *vma;
++#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags)
++/* arch_validate_flags() - Ensure combination of flags is valid for a
++ * VMA.
++ */
++static inline bool arch_validate_flags(unsigned long vm_flags)
++{
++ /* If ADI is being enabled on this VMA, check for ADI
++ * capability on the platform and ensure VMA is suitable
++ * for ADI
++ */
++ if (vm_flags & VM_SPARC_ADI) {
++ if (!adi_capable())
++ return false;
+
+- vma = find_vma(current->mm, addr);
+- if (vma) {
+- /* ADI can not be enabled on PFN
+- * mapped pages
+- */
+- if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
+- return 0;
++ /* ADI can not be enabled on PFN mapped pages */
++ if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
++ return false;
+
+- /* Mergeable pages can become unmergeable
+- * if ADI is enabled on them even if they
+- * have identical data on them. This can be
+- * because ADI enabled pages with identical
+- * data may still not have identical ADI
+- * tags on them. Disallow ADI on mergeable
+- * pages.
+- */
+- if (vma->vm_flags & VM_MERGEABLE)
+- return 0;
+- }
+- }
++ /* Mergeable pages can become unmergeable
++ * if ADI is enabled on them even if they
++ * have identical data on them. This can be
++ * because ADI enabled pages with identical
++ * data may still not have identical ADI
++ * tags on them. Disallow ADI on mergeable
++ * pages.
++ */
++ if (vm_flags & VM_MERGEABLE)
++ return false;
+ }
+- return 1;
++ return true;
+ }
+ #endif /* CONFIG_SPARC64 */
+
+--
+2.30.1
+
--- /dev/null
+From 01ce6b87adc47d2c3056ce618cc968bb78236ece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:59:32 +0100
+Subject: spi: stm32: make spurious and overrun interrupts visible
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit c64e7efe46b7de21937ef4b3594d9b1fc74f07df ]
+
+We do not expect to receive spurious interrupts so rise a warning
+if it happens.
+
+RX overrun is an error condition that signals a corrupted RX
+stream both in dma and in irq modes. Report the error and
+abort the transfer in either cases.
+
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1612551572-495-9-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 6eeb39669a86..53c4311cc6ab 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -928,8 +928,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ mask |= STM32H7_SPI_SR_RXP;
+
+ if (!(sr & mask)) {
+- dev_dbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
+- sr, ier);
++ dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
++ sr, ier);
+ spin_unlock_irqrestore(&spi->lock, flags);
+ return IRQ_NONE;
+ }
+@@ -956,15 +956,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ }
+
+ if (sr & STM32H7_SPI_SR_OVR) {
+- dev_warn(spi->dev, "Overrun: received value discarded\n");
+- if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+- stm32h7_spi_read_rxfifo(spi, false);
+- /*
+- * If overrun is detected while using DMA, it means that
+- * something went wrong, so stop the current transfer
+- */
+- if (spi->cur_usedma)
+- end = true;
++ dev_err(spi->dev, "Overrun: RX data lost\n");
++ end = true;
+ }
+
+ if (sr & STM32H7_SPI_SR_EOT) {
+--
+2.30.1
+
--- /dev/null
+From d4cf80e0bf2b6819446f8a4f131ea2776ad56571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:20:53 -0800
+Subject: sysctl.c: fix underflow value setting risk in vm_table
+
+From: Lin Feng <linf@wangsu.com>
+
+[ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ]
+
+Apart from subsystem specific .proc_handler handler, all ctl_tables with
+extra1 and extra2 members set should use proc_dointvec_minmax instead of
+proc_dointvec, or the limit set in extra* never work and potentially echo
+underflow values(negative numbers) is likely make system unstable.
+
+Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not
+a valid value, but we can set to them. And then kernel may crash.
+
+# echo -1 > /proc/sys/vm/vfs_cache_pressure
+
+Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com
+Signed-off-by: Lin Feng <linf@wangsu.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sysctl.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index afad085960b8..b9306d2bb426 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2951,7 +2951,7 @@ static struct ctl_table vm_table[] = {
+ .data = &block_dump,
+ .maxlen = sizeof(block_dump),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ {
+@@ -2959,7 +2959,7 @@ static struct ctl_table vm_table[] = {
+ .data = &sysctl_vfs_cache_pressure,
+ .maxlen = sizeof(sysctl_vfs_cache_pressure),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \
+@@ -2969,7 +2969,7 @@ static struct ctl_table vm_table[] = {
+ .data = &sysctl_legacy_va_layout,
+ .maxlen = sizeof(sysctl_legacy_va_layout),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ #endif
+@@ -2979,7 +2979,7 @@ static struct ctl_table vm_table[] = {
+ .data = &node_reclaim_mode,
+ .maxlen = sizeof(node_reclaim_mode),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ {
+--
+2.30.1
+
--- /dev/null
+From e578b4d9819f9bcc65e7103fe298a3dc0e61b547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 17:41:16 -0600
+Subject: udf: fix silent AED tagLocation corruption
+
+From: Steven J. Magnani <magnani@ieee.org>
+
+[ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ]
+
+When extending a file, udf_do_extend_file() may enter following empty
+indirect extent. At the end of udf_do_extend_file() we revert prev_epos
+to point to the last written extent. However if we end up not adding any
+further extent in udf_do_extend_file(), the reverting points prev_epos
+into the header area of the AED and following updates of the extents
+(in udf_update_extents()) will corrupt the header.
+
+Make sure that we do not follow indirect extent if we are not going to
+add any more extents so that returning back to the last written extent
+works correctly.
+
+Link: https://lore.kernel.org/r/20210107234116.6190-2-magnani@ieee.org
+Signed-off-by: Steven J. Magnani <magnani@ieee.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/inode.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index bb89c3e43212..0dd2f93ac048 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -544,11 +544,14 @@ static int udf_do_extend_file(struct inode *inode,
+
+ udf_write_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
++
+ /*
+- * We've rewritten the last extent but there may be empty
+- * indirect extent after it - enter it.
++ * We've rewritten the last extent. If we are going to add
++ * more extents, we may need to enter possible following
++ * empty indirect extent.
+ */
+- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
++ if (new_block_bytes || prealloc_len)
++ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+ }
+
+ /* Managed to do everything necessary? */
+--
+2.30.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
