--- /dev/null
+From bc97256bc924a13b3882d5f4338a9bbf1dc22856 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 19:38:15 +0100
+Subject: clk: qcom: gdsc: Implement NO_RET_PERIPH flag
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 785c02eb35009a4be6dbc68f4f7d916e90b7177d ]
+
+In some rare occasions, we want to only set the RETAIN_MEM bit, but
+not the RETAIN_PERIPH one: this is seen on at least SDM630/636/660's
+GPU-GX GDSC, where unsetting and setting back the RETAIN_PERIPH bit
+will generate chaos and panics during GPU suspend time (mainly, the
+chaos is unaligned access).
+
+For this reason, introduce a new NO_RET_PERIPH flag to the GDSC
+driver to address this corner case.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210113183817.447866-8-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gdsc.c | 10 ++++++++--
+ drivers/clk/qcom/gdsc.h | 3 ++-
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/gdsc.c b/drivers/clk/qcom/gdsc.c
+index af26e0695b86..51ed640e527b 100644
+--- a/drivers/clk/qcom/gdsc.c
++++ b/drivers/clk/qcom/gdsc.c
+@@ -183,7 +183,10 @@ static inline int gdsc_assert_reset(struct gdsc *sc)
+ static inline void gdsc_force_mem_on(struct gdsc *sc)
+ {
+ int i;
+- u32 mask = RETAIN_MEM | RETAIN_PERIPH;
++ u32 mask = RETAIN_MEM;
++
++ if (!(sc->flags & NO_RET_PERIPH))
++ mask |= RETAIN_PERIPH;
+
+ for (i = 0; i < sc->cxc_count; i++)
+ regmap_update_bits(sc->regmap, sc->cxcs[i], mask, mask);
+@@ -192,7 +195,10 @@ static inline void gdsc_force_mem_on(struct gdsc *sc)
+ static inline void gdsc_clear_mem_on(struct gdsc *sc)
+ {
+ int i;
+- u32 mask = RETAIN_MEM | RETAIN_PERIPH;
++ u32 mask = RETAIN_MEM;
++
++ if (!(sc->flags & NO_RET_PERIPH))
++ mask |= RETAIN_PERIPH;
+
+ for (i = 0; i < sc->cxc_count; i++)
+ regmap_update_bits(sc->regmap, sc->cxcs[i], mask, 0);
+diff --git a/drivers/clk/qcom/gdsc.h b/drivers/clk/qcom/gdsc.h
+index bd537438c793..5bb396b344d1 100644
+--- a/drivers/clk/qcom/gdsc.h
++++ b/drivers/clk/qcom/gdsc.h
+@@ -42,7 +42,7 @@ struct gdsc {
+ #define PWRSTS_ON BIT(2)
+ #define PWRSTS_OFF_ON (PWRSTS_OFF | PWRSTS_ON)
+ #define PWRSTS_RET_ON (PWRSTS_RET | PWRSTS_ON)
+- const u8 flags;
++ const u16 flags;
+ #define VOTABLE BIT(0)
+ #define CLAMP_IO BIT(1)
+ #define HW_CTRL BIT(2)
+@@ -51,6 +51,7 @@ struct gdsc {
+ #define POLL_CFG_GDSCR BIT(5)
+ #define ALWAYS_ON BIT(6)
+ #define RETAIN_FF_ENABLE BIT(7)
++#define NO_RET_PERIPH BIT(8)
+ struct reset_controller_dev *rcdev;
+ unsigned int *resets;
+ unsigned int reset_count;
+--
+2.30.1
+
--- /dev/null
+From 6df490921b7650fd9b79df556aa485551a74e9b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 23:10:58 +0100
+Subject: clk: qcom: gpucc-msm8998: Add resets, cxc, fix flags on gpu_gx_gdsc
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit a59c16c80bd791878cf81d1d5aae508eeb2e73f1 ]
+
+The GPU GX GDSC has GPU_GX_BCR reset and gfx3d_clk CXC, as stated
+on downstream kernels (and as verified upstream, because otherwise
+random lockups happen).
+Also, add PWRSTS_RET and NO_RET_PERIPH: also as found downstream,
+and also as verified here, to avoid GPU related lockups it is
+necessary to force retain mem, but *not* peripheral when enabling
+this GDSC (and, of course, the inverse on disablement).
+
+With this change, the GPU finally works flawlessly on my four
+different MSM8998 devices from two different manufacturers.
+
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210114221059.483390-11-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gpucc-msm8998.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gpucc-msm8998.c b/drivers/clk/qcom/gpucc-msm8998.c
+index 9b3923af02a1..1a518c4915b4 100644
+--- a/drivers/clk/qcom/gpucc-msm8998.c
++++ b/drivers/clk/qcom/gpucc-msm8998.c
+@@ -253,12 +253,16 @@ static struct gdsc gpu_cx_gdsc = {
+ static struct gdsc gpu_gx_gdsc = {
+ .gdscr = 0x1094,
+ .clamp_io_ctrl = 0x130,
++ .resets = (unsigned int []){ GPU_GX_BCR },
++ .reset_count = 1,
++ .cxcs = (unsigned int []){ 0x1098 },
++ .cxc_count = 1,
+ .pd = {
+ .name = "gpu_gx",
+ },
+ .parent = &gpu_cx_gdsc.pd,
+- .pwrsts = PWRSTS_OFF_ON,
+- .flags = CLAMP_IO | AON_RESET,
++ .pwrsts = PWRSTS_OFF_ON | PWRSTS_RET,
++ .flags = CLAMP_IO | SW_RESET | AON_RESET | NO_RET_PERIPH,
+ };
+
+ static struct clk_regmap *gpucc_msm8998_clocks[] = {
+--
+2.30.1
+
--- /dev/null
+From 3725688731715223a20a2bc954be40aa5cff9d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 13:45:27 +0100
+Subject: drivers/base: build kunit tests without structleak plugin
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 38009c766725a9877ea8866fc813a5460011817f ]
+
+The structleak plugin causes the stack frame size to grow immensely:
+
+drivers/base/test/property-entry-test.c: In function 'pe_test_reference':
+drivers/base/test/property-entry-test.c:481:1: error: the frame size of 2640 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
+ 481 | }
+ | ^
+drivers/base/test/property-entry-test.c: In function 'pe_test_uints':
+drivers/base/test/property-entry-test.c:99:1: error: the frame size of 2592 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
+
+Turn it off in this file.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210125124533.101339-3-arnd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/test/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/base/test/Makefile b/drivers/base/test/Makefile
+index 3ca56367c84b..2f15fae8625f 100644
+--- a/drivers/base/test/Makefile
++++ b/drivers/base/test/Makefile
+@@ -2,3 +2,4 @@
+ obj-$(CONFIG_TEST_ASYNC_DRIVER_PROBE) += test_async_driver_probe.o
+
+ obj-$(CONFIG_KUNIT_DRIVER_PE_TEST) += property-entry-test.o
++CFLAGS_REMOVE_property-entry-test.o += -fplugin-arg-structleak_plugin-byref -fplugin-arg-structleak_plugin-byref-all
+--
+2.30.1
+
--- /dev/null
+From 5fbc817ab5365e966d78c7d1888565eb0ce709bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:17:24 -0800
+Subject: drivers/base/memory: don't store phys_device in memory blocks
+
+From: David Hildenbrand <david@redhat.com>
+
+[ Upstream commit e9a2e48e8704c9d20a625c6f2357147d03ea7b97 ]
+
+No need to store the value for each and every memory block, as we can
+easily query the value at runtime. Reshuffle the members to optimize the
+memory layout. Also, let's clarify what the interface once was used for
+and why it's legacy nowadays.
+
+"phys_device" was used on s390x in older versions of lsmem[2]/chmem[3],
+back when they were still part of s390x-tools. They were later replaced
+by the variants in linux-utils. For example, RHEL6 and RHEL7 contain
+lsmem/chmem from s390-utils. RHEL8 switched to versions from util-linux
+on s390x [4].
+
+"phys_device" was added with sysfs support for memory hotplug in commit
+3947be1969a9 ("[PATCH] memory hotplug: sysfs and add/remove functions") in
+2005. It always returned 0.
+
+s390x started returning something != 0 on some setups (if sclp.rzm is set
+by HW) in 2010 via commit 57b552ba0b2f ("memory hotplug/s390: set
+phys_device").
+
+For s390x, it allowed for identifying which memory block devices belong to
+the same storage increment (RZM). Only if all memory block devices
+comprising a single storage increment were offline, the memory could
+actually be removed in the hypervisor.
+
+Since commit e5d709bb5fb7 ("s390/memory hotplug: provide
+memory_block_size_bytes() function") in 2013 a memory block device spans
+at least one storage increment - which is why the interface isn't really
+helpful/used anymore (except by old lsmem/chmem tools).
+
+There were once RFC patches to make use of "phys_device" in ACPI context;
+however, the underlying problem could be solved using different interfaces
+[1].
+
+[1] https://patchwork.kernel.org/patch/2163871/
+[2] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/lsmem
+[3] https://github.com/ibm-s390-tools/s390-tools/blob/v2.1.0/zconf/chmem
+[4] https://bugzilla.redhat.com/show_bug.cgi?id=1504134
+
+Link: https://lkml.kernel.org/r/20210201181347.13262-2-david@redhat.com
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Oscar Salvador <osalvador@suse.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Cc: Ilya Dryomov <idryomov@gmail.com>
+Cc: Vaibhav Jain <vaibhav@linux.ibm.com>
+Cc: Tom Rix <trix@redhat.com>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ABI/testing/sysfs-devices-memory | 5 ++--
+ .../admin-guide/mm/memory-hotplug.rst | 4 +--
+ drivers/base/memory.c | 25 +++++++------------
+ include/linux/memory.h | 3 +--
+ 4 files changed, 15 insertions(+), 22 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-devices-memory b/Documentation/ABI/testing/sysfs-devices-memory
+index 246a45b96d22..58dbc592bc57 100644
+--- a/Documentation/ABI/testing/sysfs-devices-memory
++++ b/Documentation/ABI/testing/sysfs-devices-memory
+@@ -26,8 +26,9 @@ Date: September 2008
+ Contact: Badari Pulavarty <pbadari@us.ibm.com>
+ Description:
+ The file /sys/devices/system/memory/memoryX/phys_device
+- is read-only and is designed to show the name of physical
+- memory device. Implementation is currently incomplete.
++ is read-only; it is a legacy interface only ever used on s390x
++ to expose the covered storage increment.
++Users: Legacy s390-tools lsmem/chmem
+
+ What: /sys/devices/system/memory/memoryX/phys_index
+ Date: September 2008
+diff --git a/Documentation/admin-guide/mm/memory-hotplug.rst b/Documentation/admin-guide/mm/memory-hotplug.rst
+index 5c4432c96c4b..245739f55ac7 100644
+--- a/Documentation/admin-guide/mm/memory-hotplug.rst
++++ b/Documentation/admin-guide/mm/memory-hotplug.rst
+@@ -160,8 +160,8 @@ Under each memory block, you can see 5 files:
+
+ "online_movable", "online", "offline" command
+ which will be performed on all sections in the block.
+-``phys_device`` read-only: designed to show the name of physical memory
+- device. This is not well implemented now.
++``phys_device`` read-only: legacy interface only ever used on s390x to
++ expose the covered storage increment.
+ ``removable`` read-only: contains an integer value indicating
+ whether the memory block is removable or not
+ removable. A value of 1 indicates that the memory
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index eef4ffb6122c..de058d15b33e 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -290,20 +290,20 @@ static ssize_t state_store(struct device *dev, struct device_attribute *attr,
+ }
+
+ /*
+- * phys_device is a bad name for this. What I really want
+- * is a way to differentiate between memory ranges that
+- * are part of physical devices that constitute
+- * a complete removable unit or fru.
+- * i.e. do these ranges belong to the same physical device,
+- * s.t. if I offline all of these sections I can then
+- * remove the physical device?
++ * Legacy interface that we cannot remove: s390x exposes the storage increment
++ * covered by a memory block, allowing for identifying which memory blocks
++ * comprise a storage increment. Since a memory block spans complete
++ * storage increments nowadays, this interface is basically unused. Other
++ * archs never exposed != 0.
+ */
+ static ssize_t phys_device_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct memory_block *mem = to_memory_block(dev);
++ unsigned long start_pfn = section_nr_to_pfn(mem->start_section_nr);
+
+- return sysfs_emit(buf, "%d\n", mem->phys_device);
++ return sysfs_emit(buf, "%d\n",
++ arch_get_memory_phys_device(start_pfn));
+ }
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+@@ -488,11 +488,7 @@ static DEVICE_ATTR_WO(soft_offline_page);
+ static DEVICE_ATTR_WO(hard_offline_page);
+ #endif
+
+-/*
+- * Note that phys_device is optional. It is here to allow for
+- * differentiation between which *physical* devices each
+- * section belongs to...
+- */
++/* See phys_device_show(). */
+ int __weak arch_get_memory_phys_device(unsigned long start_pfn)
+ {
+ return 0;
+@@ -574,7 +570,6 @@ int register_memory(struct memory_block *memory)
+ static int init_memory_block(unsigned long block_id, unsigned long state)
+ {
+ struct memory_block *mem;
+- unsigned long start_pfn;
+ int ret = 0;
+
+ mem = find_memory_block_by_id(block_id);
+@@ -588,8 +583,6 @@ static int init_memory_block(unsigned long block_id, unsigned long state)
+
+ mem->start_section_nr = block_id * sections_per_block;
+ mem->state = state;
+- start_pfn = section_nr_to_pfn(mem->start_section_nr);
+- mem->phys_device = arch_get_memory_phys_device(start_pfn);
+ mem->nid = NUMA_NO_NODE;
+
+ ret = register_memory(mem);
+diff --git a/include/linux/memory.h b/include/linux/memory.h
+index 439a89e758d8..4da95e684e20 100644
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -27,9 +27,8 @@ struct memory_block {
+ unsigned long start_section_nr;
+ unsigned long state; /* serialized by the dev->lock */
+ int online_type; /* for passing data to online routine */
+- int phys_device; /* to which fru does this belong? */
+- struct device dev;
+ int nid; /* NID for this memory block */
++ struct device dev;
+ };
+
+ int arch_get_memory_phys_device(unsigned long start_pfn);
+--
+2.30.1
+
--- /dev/null
+From 144c3aa759dd8a4d633f4533eeb628ac08696ce6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 12:33:20 -0500
+Subject: ext4: don't try to processed freed blocks until mballoc is
+ initialized
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 027f14f5357279655c3ebc6d14daff8368d4f53f ]
+
+If we try to make any changes via the journal between when the journal
+is initialized, but before the multi-block allocated is initialized,
+we will end up deferencing a NULL pointer when the journal commit
+callback function calls ext4_process_freed_data().
+
+The proximate cause of this failure was commit 2d01ddc86606 ("ext4:
+save error info to sb through journal if available") since file system
+corruption problems detected before the call to ext4_mb_init() would
+result in a journal commit before we aborted the mount of the file
+system.... and we would then trigger the NULL pointer deref.
+
+Link: https://lore.kernel.org/r/YAm8qH/0oo2ofSMR@mit.edu
+Reported-by: Murphy Zhou <jencce.kernel@gmail.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 9a6f9875aa34..2ae0af1c88c7 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4875,7 +4875,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+
+- sbi->s_journal->j_commit_callback = ext4_journal_commit_callback;
+ sbi->s_journal->j_submit_inode_data_buffers =
+ ext4_journal_submit_inode_data_buffers;
+ sbi->s_journal->j_finish_inode_data_buffers =
+@@ -4987,6 +4986,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ goto failed_mount5;
+ }
+
++ /*
++ * We can only set up the journal commit callback once
++ * mballoc is initialized
++ */
++ if (sbi->s_journal)
++ sbi->s_journal->j_commit_callback =
++ ext4_journal_commit_callback;
++
+ block = ext4_count_free_clusters(sb);
+ ext4_free_blocks_count_set(sbi->s_es,
+ EXT4_C2B(sbi, block));
+--
+2.30.1
+
--- /dev/null
+From 8966d270210dd1527ac3f15982c9487067e0de94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 18:02:20 +0000
+Subject: HID: logitech-dj: add support for the new lightspeed connection
+ iteration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Filipe Laíns <lains@riseup.net>
+
+[ Upstream commit fab3a95654eea01d6b0204995be8b7492a00d001 ]
+
+This new connection type is the new iteration of the Lightspeed
+connection and will probably be used in some of the newer gaming
+devices. It is currently use in the G Pro X Superlight.
+
+This patch should be backported to older versions, as currently the
+driver will panic when seing the unsupported connection. This isn't
+an issue when using the receiver that came with the device, as Logitech
+has been using different PIDs when they change the connection type, but
+is an issue when using a generic receiver (well, generic Lightspeed
+receiver), which is the case of the one in the Powerplay mat. Currently,
+the only generic Ligthspeed receiver we support, and the only one that
+exists AFAIK, is ther Powerplay.
+
+As it stands, the driver will panic when seeing a G Pro X Superlight
+connected to the Powerplay receiver and won't send any input events to
+userspace! The kernel will warn about this so the issue should be easy
+to identify, but it is still very worrying how hard it will fail :(
+
+[915977.398471] logitech-djreceiver 0003:046D:C53A.0107: unusable device of type UNKNOWN (0x0f) connected on slot 1
+
+Signed-off-by: Filipe Laíns <lains@riseup.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index fcdc922bc973..271bd8d24339 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -995,7 +995,12 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev,
+ workitem.reports_supported |= STD_KEYBOARD;
+ break;
+ case 0x0d:
+- device_type = "eQUAD Lightspeed 1_1";
++ device_type = "eQUAD Lightspeed 1.1";
++ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
++ workitem.reports_supported |= STD_KEYBOARD;
++ break;
++ case 0x0f:
++ device_type = "eQUAD Lightspeed 1.2";
+ logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem);
+ workitem.reports_supported |= STD_KEYBOARD;
+ break;
+--
+2.30.1
+
--- /dev/null
+From 9dc6645eae4020bbaeb7b18b34672d72fde77482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 18:21:51 +0100
+Subject: i2c: rcar: faster irq code to minimize HW race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit c7b514ec979e23a08c411f3d8ed39c7922751422 ]
+
+To avoid the HW race condition on R-Car Gen2 and earlier, we need to
+write to ICMCR as soon as possible in the interrupt handler. We can
+improve this by writing a static value instead of masking out bits.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 217def2d7cb4..824586d7ee56 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -91,7 +91,6 @@
+
+ #define RCAR_BUS_PHASE_START (MDBS | MIE | ESG)
+ #define RCAR_BUS_PHASE_DATA (MDBS | MIE)
+-#define RCAR_BUS_MASK_DATA (~(ESG | FSB) & 0xFF)
+ #define RCAR_BUS_PHASE_STOP (MDBS | MIE | FSB)
+
+ #define RCAR_IRQ_SEND (MNR | MAL | MST | MAT | MDE)
+@@ -621,7 +620,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ /*
+ * This driver has a lock-free design because there are IP cores (at least
+ * R-Car Gen2) which have an inherent race condition in their hardware design.
+- * There, we need to clear RCAR_BUS_MASK_DATA bits as soon as possible after
++ * There, we need to switch to RCAR_BUS_PHASE_DATA as soon as possible after
+ * the interrupt was generated, otherwise an unwanted repeated message gets
+ * generated. It turned out that taking a spinlock at the beginning of the ISR
+ * was already causing repeated messages. Thus, this driver was converted to
+@@ -630,13 +629,11 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
+ {
+ struct rcar_i2c_priv *priv = ptr;
+- u32 msr, val;
++ u32 msr;
+
+ /* Clear START or STOP immediately, except for REPSTART after read */
+- if (likely(!(priv->flags & ID_P_REP_AFTER_RD))) {
+- val = rcar_i2c_read(priv, ICMCR);
+- rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA);
+- }
++ if (likely(!(priv->flags & ID_P_REP_AFTER_RD)))
++ rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA);
+
+ msr = rcar_i2c_read(priv, ICMSR);
+
+--
+2.30.1
+
--- /dev/null
+From 8f850e5d7e56339e59eb9c298d7351ccf2d04b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 18:21:52 +0100
+Subject: i2c: rcar: optimize cacheline to minimize HW race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 25c2e0fb5fefb8d7847214cf114d94c7aad8e9ce ]
+
+'flags' and 'io' are needed first, so they should be at the beginning of
+the private struct.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 824586d7ee56..ad6630e3cc77 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -119,6 +119,7 @@ enum rcar_i2c_type {
+ };
+
+ struct rcar_i2c_priv {
++ u32 flags;
+ void __iomem *io;
+ struct i2c_adapter adap;
+ struct i2c_msg *msg;
+@@ -129,7 +130,6 @@ struct rcar_i2c_priv {
+
+ int pos;
+ u32 icccr;
+- u32 flags;
+ u8 recovery_icmcr; /* protected by adapter lock */
+ enum rcar_i2c_type devtype;
+ struct i2c_client *slave;
+--
+2.30.1
+
--- /dev/null
+From 702ca35f1ccca1f9aa9013fb0f0ade5c6ffc1a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 07:14:30 +0000
+Subject: i40e: Fix memory leak in i40e_probe
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit 58cab46c622d6324e47bd1c533693c94498e4172 ]
+
+Struct i40e_veb is allocated in function i40e_setup_pf_switch, and
+stored to an array field veb inside struct i40e_pf. However when
+i40e_setup_misc_vector fails, this memory leaks.
+
+Fix this by calling exit and teardown functions.
+
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index fcd6f623f2fd..4a2d03cada01 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -15100,6 +15100,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (err) {
+ dev_info(&pdev->dev,
+ "setup of misc vector failed: %d\n", err);
++ i40e_cloud_filter_exit(pf);
++ i40e_fdir_teardown(pf);
+ goto err_vsis;
+ }
+ }
+--
+2.30.1
+
--- /dev/null
+From 827815c4aabcb29e89c345b9149de4ae8cb19d77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 11:10:51 -0800
+Subject: Input: applespi - don't wait for responses to commands indefinitely.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ronald Tschalär <ronald@innovation.ch>
+
+[ Upstream commit 0ce1ac23149c6da939a5926c098c270c58c317a0 ]
+
+The response to a command may never arrive or it may be corrupted (and
+hence dropped) for some reason. While exceedingly rare, when it did
+happen it blocked all further commands. One way to fix this was to
+do a suspend/resume. However, recovering automatically seems like a
+nicer option. Hence this puts a time limit (1 sec) on how long we're
+willing to wait for a response, after which we assume it got lost.
+
+Signed-off-by: Ronald Tschalär <ronald@innovation.ch>
+Link: https://lore.kernel.org/r/20210217190718.11035-1-ronald@innovation.ch
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/applespi.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/applespi.c
+index d22223154177..27e87c45edf2 100644
+--- a/drivers/input/keyboard/applespi.c
++++ b/drivers/input/keyboard/applespi.c
+@@ -48,6 +48,7 @@
+ #include <linux/efi.h>
+ #include <linux/input.h>
+ #include <linux/input/mt.h>
++#include <linux/ktime.h>
+ #include <linux/leds.h>
+ #include <linux/module.h>
+ #include <linux/spinlock.h>
+@@ -409,7 +410,7 @@ struct applespi_data {
+ unsigned int cmd_msg_cntr;
+ /* lock to protect the above parameters and flags below */
+ spinlock_t cmd_msg_lock;
+- bool cmd_msg_queued;
++ ktime_t cmd_msg_queued;
+ enum applespi_evt_type cmd_evt_type;
+
+ struct led_classdev backlight_info;
+@@ -729,7 +730,7 @@ static void applespi_msg_complete(struct applespi_data *applespi,
+ wake_up_all(&applespi->drain_complete);
+
+ if (is_write_msg) {
+- applespi->cmd_msg_queued = false;
++ applespi->cmd_msg_queued = 0;
+ applespi_send_cmd_msg(applespi);
+ }
+
+@@ -771,8 +772,16 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi)
+ return 0;
+
+ /* check whether send is in progress */
+- if (applespi->cmd_msg_queued)
+- return 0;
++ if (applespi->cmd_msg_queued) {
++ if (ktime_ms_delta(ktime_get(), applespi->cmd_msg_queued) < 1000)
++ return 0;
++
++ dev_warn(&applespi->spi->dev, "Command %d timed out\n",
++ applespi->cmd_evt_type);
++
++ applespi->cmd_msg_queued = 0;
++ applespi->write_active = false;
++ }
+
+ /* set up packet */
+ memset(packet, 0, APPLESPI_PACKET_SIZE);
+@@ -869,7 +878,7 @@ static int applespi_send_cmd_msg(struct applespi_data *applespi)
+ return sts;
+ }
+
+- applespi->cmd_msg_queued = true;
++ applespi->cmd_msg_queued = ktime_get_coarse();
+ applespi->write_active = true;
+
+ return 0;
+@@ -1921,7 +1930,7 @@ static int __maybe_unused applespi_resume(struct device *dev)
+ applespi->drain = false;
+ applespi->have_cl_led_on = false;
+ applespi->have_bl_level = 0;
+- applespi->cmd_msg_queued = false;
++ applespi->cmd_msg_queued = 0;
+ applespi->read_active = false;
+ applespi->write_active = false;
+
+--
+2.30.1
+
--- /dev/null
+From 2a82e6c76597cfde1a6e394e0ed0c0120413876e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 06:27:12 -0600
+Subject: iommu/amd: Fix performance counter initialization
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 6778ff5b21bd8e78c8bd547fd66437cf2657fd9b ]
+
+Certain AMD platforms enable power gating feature for IOMMU PMC,
+which prevents the IOMMU driver from updating the counter while
+trying to validate the PMC functionality in the init_iommu_perf_ctr().
+This results in disabling PMC support and the following error message:
+
+ "AMD-Vi: Unable to read/write to IOMMU perf counter"
+
+To workaround this issue, disable power gating temporarily by programming
+the counter source to non-zero value while validating the counter,
+and restore the prior state afterward.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Tested-by: Tj (Elloe Linux) <ml.linux@elloe.vision>
+Link: https://lore.kernel.org/r/20210208122712.5048-1-suravee.suthikulpanit@amd.com
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201753
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 45 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 83d8ab2aed9f..01da76dc1caa 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -12,6 +12,7 @@
+ #include <linux/acpi.h>
+ #include <linux/list.h>
+ #include <linux/bitmap.h>
++#include <linux/delay.h>
+ #include <linux/slab.h>
+ #include <linux/syscore_ops.h>
+ #include <linux/interrupt.h>
+@@ -254,6 +255,8 @@ static enum iommu_init_state init_state = IOMMU_START_STATE;
+ static int amd_iommu_enable_interrupts(void);
+ static int __init iommu_go_to_state(enum iommu_init_state state);
+ static void init_device_table_dma(void);
++static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr,
++ u8 fxn, u64 *value, bool is_write);
+
+ static bool amd_iommu_pre_enabled = true;
+
+@@ -1712,13 +1715,11 @@ static int __init init_iommu_all(struct acpi_table_header *table)
+ return 0;
+ }
+
+-static int iommu_pc_get_set_reg(struct amd_iommu *iommu, u8 bank, u8 cntr,
+- u8 fxn, u64 *value, bool is_write);
+-
+-static void init_iommu_perf_ctr(struct amd_iommu *iommu)
++static void __init init_iommu_perf_ctr(struct amd_iommu *iommu)
+ {
++ int retry;
+ struct pci_dev *pdev = iommu->dev;
+- u64 val = 0xabcd, val2 = 0, save_reg = 0;
++ u64 val = 0xabcd, val2 = 0, save_reg, save_src;
+
+ if (!iommu_feature(iommu, FEATURE_PC))
+ return;
+@@ -1726,17 +1727,39 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu)
+ amd_iommu_pc_present = true;
+
+ /* save the value to restore, if writable */
+- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false))
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, false) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, false))
+ goto pc_false;
+
+- /* Check if the performance counters can be written to */
+- if ((iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true)) ||
+- (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false)) ||
+- (val != val2))
++ /*
++ * Disable power gating by programing the performance counter
++ * source to 20 (i.e. counts the reads and writes from/to IOMMU
++ * Reserved Register [MMIO Offset 1FF8h] that are ignored.),
++ * which never get incremented during this init phase.
++ * (Note: The event is also deprecated.)
++ */
++ val = 20;
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 8, &val, true))
+ goto pc_false;
+
++ /* Check if the performance counters can be written to */
++ val = 0xabcd;
++ for (retry = 5; retry; retry--) {
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &val, true) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 0, &val2, false) ||
++ val2)
++ break;
++
++ /* Wait about 20 msec for power gating to disable and retry. */
++ msleep(20);
++ }
++
+ /* restore */
+- if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true))
++ if (iommu_pc_get_set_reg(iommu, 0, 0, 0, &save_reg, true) ||
++ iommu_pc_get_set_reg(iommu, 0, 0, 8, &save_src, true))
++ goto pc_false;
++
++ if (val != val2)
+ goto pc_false;
+
+ pci_info(pdev, "IOMMU performance counters supported\n");
+--
+2.30.1
+
--- /dev/null
+From 5908cf154f68db93f7ce7225ab48ec747fe52a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 16:07:29 +0800
+Subject: iommu/vt-d: Clear PRQ overflow only when PRQ is empty
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 28a77185f1cd0650b664f54614143aaaa3a7a615 ]
+
+It is incorrect to always clear PRO when it's set w/o first checking
+whether the overflow condition has been cleared. Current code assumes
+that if an overflow condition occurs it must have been cleared by earlier
+loop. However since the code runs in a threaded context, the overflow
+condition could occur even after setting the head to the tail under some
+extreme condition. To be sane, we should read both head/tail again when
+seeing a pending PRO and only clear PRO after all pending PRs have been
+handled.
+
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/linux-iommu/MWHPR11MB18862D2EA5BD432BF22D99A48CA09@MWHPR11MB1886.namprd11.prod.outlook.com/
+Link: https://lore.kernel.org/r/20210126080730.2232859-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/svm.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 18a9f05df407..b3bcd6dec93e 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -1079,8 +1079,17 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ * Clear the page request overflow bit and wake up all threads that
+ * are waiting for the completion of this handling.
+ */
+- if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO)
+- writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG);
++ if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) {
++ pr_info_ratelimited("IOMMU: %s: PRQ overflow detected\n",
++ iommu->name);
++ head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
++ tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
++ if (head == tail) {
++ writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG);
++ pr_info_ratelimited("IOMMU: %s: PRQ overflow cleared",
++ iommu->name);
++ }
++ }
+
+ if (!completion_done(&iommu->prq_complete))
+ complete(&iommu->prq_complete);
+--
+2.30.1
+
--- /dev/null
+From 84fc4b093aacbab0634a402b781c6cd2e9e65556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:05:42 -0800
+Subject: kasan: fix memory corruption in kasan_bitops_tags test
+
+From: Andrey Konovalov <andreyknvl@google.com>
+
+[ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ]
+
+Since the hardware tag-based KASAN mode might not have a redzone that
+comes after an allocated object (when kasan.mode=prod is enabled), the
+kasan_bitops_tags() test ends up corrupting the next object in memory.
+
+Change the test so it always accesses the redzone that lies within the
+allocated object's boundaries.
+
+Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a
+Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com
+Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
+Reviewed-by: Marco Elver <elver@google.com>
+Reviewed-by: Alexander Potapenko <glider@google.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Branislav Rankov <Branislav.Rankov@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Evgenii Stepanov <eugenis@google.com>
+Cc: Kevin Brodsky <kevin.brodsky@arm.com>
+Cc: Peter Collingbourne <pcc@google.com>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_kasan.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/test_kasan.c b/lib/test_kasan.c
+index 2947274cc2d3..5a2f104ca13f 100644
+--- a/lib/test_kasan.c
++++ b/lib/test_kasan.c
+@@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test)
+ return;
+ }
+
+- /* Allocation size will be rounded to up granule size, which is 16. */
+- bits = kzalloc(sizeof(*bits), GFP_KERNEL);
++ /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */
++ bits = kzalloc(48, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
+
+- /* Do the accesses past the 16 allocated bytes. */
+- kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]);
+- kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]);
++ /* Do the accesses past the 48 allocated bytes, but within the redone. */
++ kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48);
++ kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48);
+
+ kfree(bits);
+ }
+--
+2.30.1
+
--- /dev/null
+From 1ef9a96606191f4408ade33d02bfe3f967a36e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 22:50:32 -0500
+Subject: kbuild: clamp SUBLEVEL to 255
+
+[ Upstream commit 9b82f13e7ef316cdc0a8858f1349f4defce3f9e0 ]
+
+Right now if SUBLEVEL becomes larger than 255 it will overflow into the
+territory of PATCHLEVEL, causing havoc in userspace that tests for
+specific kernel version.
+
+While userspace code tests for MAJOR and PATCHLEVEL, it doesn't test
+SUBLEVEL at any point as ABI changes don't happen in the context of
+stable tree.
+
+Thus, to avoid overflows, simply clamp SUBLEVEL to it's maximum value in
+the context of LINUX_VERSION_CODE. This does not affect "make
+kernelversion" and such.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 472136a7881e..80d166cadaa3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1246,9 +1246,15 @@ define filechk_utsrelease.h
+ endef
+
+ define filechk_version.h
+- echo \#define LINUX_VERSION_CODE $(shell \
+- expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 0$(SUBLEVEL)); \
+- echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))'
++ if [ $(SUBLEVEL) -gt 255 ]; then \
++ echo \#define LINUX_VERSION_CODE $(shell \
++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + 255); \
++ else \
++ echo \#define LINUX_VERSION_CODE $(shell \
++ expr $(VERSION) \* 65536 + 0$(PATCHLEVEL) \* 256 + $(SUBLEVEL)); \
++ fi; \
++ echo '#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + \
++ ((c) > 255 ? 255 : (c)))'
+ endef
+
+ $(version_h): FORCE
+--
+2.30.1
+
--- /dev/null
+From 85a16a55b72ccffa4b3014783e16d84ccf58f96d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 15:16:11 +0800
+Subject: mmc: mediatek: fix race condition between msdc_request_timeout and
+ irq
+
+From: Chaotian Jing <chaotian.jing@mediatek.com>
+
+[ Upstream commit 0354ca6edd464a2cf332f390581977b8699ed081 ]
+
+when get request SW timeout, if CMD/DAT xfer done irq coming right now,
+then there is race between the msdc_request_timeout work and irq handler,
+and the host->cmd and host->data may set to NULL in irq handler. also,
+current flow ensure that only one path can go to msdc_request_done(), so
+no need check the return value of cancel_delayed_work().
+
+Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
+Link: https://lore.kernel.org/r/20201218071611.12276-1-chaotian.jing@mediatek.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mtk-sd.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
+index de09c6347524..898ed1b023df 100644
+--- a/drivers/mmc/host/mtk-sd.c
++++ b/drivers/mmc/host/mtk-sd.c
+@@ -1127,13 +1127,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,
+ static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)
+ {
+ unsigned long flags;
+- bool ret;
+
+- ret = cancel_delayed_work(&host->req_timeout);
+- if (!ret) {
+- /* delay work already running */
+- return;
+- }
++ /*
++ * No need check the return value of cancel_delayed_work, as only ONE
++ * path will go here!
++ */
++ cancel_delayed_work(&host->req_timeout);
++
+ spin_lock_irqsave(&host->lock, flags);
+ host->mrq = NULL;
+ spin_unlock_irqrestore(&host->lock, flags);
+@@ -1155,7 +1155,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+ bool done = false;
+ bool sbc_error;
+ unsigned long flags;
+- u32 *rsp = cmd->resp;
++ u32 *rsp;
+
+ if (mrq->sbc && cmd == mrq->cmd &&
+ (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
+@@ -1176,6 +1176,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int events,
+
+ if (done)
+ return true;
++ rsp = cmd->resp;
+
+ sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
+
+@@ -1363,7 +1364,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,
+ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+ struct mmc_request *mrq, struct mmc_data *data)
+ {
+- struct mmc_command *stop = data->stop;
++ struct mmc_command *stop;
+ unsigned long flags;
+ bool done;
+ unsigned int check_data = events &
+@@ -1379,6 +1380,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
+
+ if (done)
+ return true;
++ stop = data->stop;
+
+ if (check_data || (stop && stop->error)) {
+ dev_dbg(host->dev, "DMA status: 0x%8X\n",
+--
+2.30.1
+
--- /dev/null
+From f82c546e93ffbffdffa4730e1d1843f1ba49708b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 21:35:27 +0100
+Subject: mmc: mxs-mmc: Fix a resource leak in an error handling path in
+ 'mxs_mmc_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 0bb7e560f821c7770973a94e346654c4bdccd42c ]
+
+If 'mmc_of_parse()' fails, we must undo the previous 'dma_request_chan()'
+call.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201208203527.49262-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/mxs-mmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
+index 56bbc6cd9c84..947581de7860 100644
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -628,7 +628,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
+
+ ret = mmc_of_parse(mmc);
+ if (ret)
+- goto out_clk_disable;
++ goto out_free_dma;
+
+ mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+--
+2.30.1
+
--- /dev/null
+From 732a404e142e6dcec12ac94e35c396fbf6ce7896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 18:04:06 -0600
+Subject: mmc: sdhci-iproc: Add ACPI bindings for the RPi
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+[ Upstream commit 4f9833d3ec8da34861cd0680b00c73e653877eb9 ]
+
+The RPi4 has an Arasan controller it carries over from the RPi3 and a newer
+eMMC2 controller. Because of a couple of quirks, it seems wiser to bind
+these controllers to the same driver that DT is using on this platform
+rather than the generic sdhci_acpi driver with PNP0D40.
+
+So, BCM2847 describes the older Arasan and BRCME88C describes the newer
+eMMC2. The older Arasan is reusing an existing ACPI _HID used by other OSes
+booting these tables on the RPi.
+
+With this change, Linux is capable of utilizing the SD card slot, and the
+Wi-Fi when booted with UEFI+ACPI on the RPi4.
+
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20210120000406.1843400-2-jeremy.linton@arm.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-iproc.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
+index c9434b461aab..ddeaf8e1f72f 100644
+--- a/drivers/mmc/host/sdhci-iproc.c
++++ b/drivers/mmc/host/sdhci-iproc.c
+@@ -296,9 +296,27 @@ static const struct of_device_id sdhci_iproc_of_match[] = {
+ MODULE_DEVICE_TABLE(of, sdhci_iproc_of_match);
+
+ #ifdef CONFIG_ACPI
++/*
++ * This is a duplicate of bcm2835_(pltfrm_)data without caps quirks
++ * which are provided by the ACPI table.
++ */
++static const struct sdhci_pltfm_data sdhci_bcm_arasan_data = {
++ .quirks = SDHCI_QUIRK_BROKEN_CARD_DETECTION |
++ SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
++ SDHCI_QUIRK_NO_HISPD_BIT,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++ .ops = &sdhci_iproc_32only_ops,
++};
++
++static const struct sdhci_iproc_data bcm_arasan_data = {
++ .pdata = &sdhci_bcm_arasan_data,
++};
++
+ static const struct acpi_device_id sdhci_iproc_acpi_ids[] = {
+ { .id = "BRCM5871", .driver_data = (kernel_ulong_t)&iproc_cygnus_data },
+ { .id = "BRCM5872", .driver_data = (kernel_ulong_t)&iproc_data },
++ { .id = "BCM2847", .driver_data = (kernel_ulong_t)&bcm_arasan_data },
++ { .id = "BRCME88C", .driver_data = (kernel_ulong_t)&bcm2711_data },
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(acpi, sdhci_iproc_acpi_ids);
+--
+2.30.1
+
--- /dev/null
+From f5306be39340057c76153cb3b33c9873a5bbd47c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:02:58 -0800
+Subject: PCI/ERR: Retain status from error notification
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 387c72cdd7fb6bef650fb078d0f6ae9682abf631 ]
+
+Overwriting the frozen detected status with the result of the link reset
+loses the NEED_RESET result that drivers are depending on for error
+handling to report the .slot_reset() callback. Retain this status so
+that subsequent error handling has the correct flow.
+
+Link: https://lore.kernel.org/r/20210104230300.1277180-4-kbusch@kernel.org
+Reported-by: Hinko Kocevar <hinko.kocevar@ess.eu>
+Tested-by: Hedi Berriche <hedi.berriche@hpe.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Sean V Kelley <sean.v.kelley@intel.com>
+Acked-by: Hedi Berriche <hedi.berriche@hpe.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/err.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index 510f31f0ef6d..4798bd6de97d 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -198,8 +198,7 @@ pci_ers_result_t pcie_do_recovery(struct pci_dev *dev,
+ pci_dbg(bridge, "broadcast error_detected message\n");
+ if (state == pci_channel_io_frozen) {
+ pci_walk_bridge(bridge, report_frozen_detected, &status);
+- status = reset_subordinates(bridge);
+- if (status != PCI_ERS_RESULT_RECOVERED) {
++ if (reset_subordinates(bridge) != PCI_ERS_RESULT_RECOVERED) {
+ pci_warn(bridge, "subordinate device reset failed\n");
+ goto failed;
+ }
+--
+2.30.1
+
--- /dev/null
+From 0d4d1bb431575434bc3bb549adf8a20c16b72cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 11:03:32 +0100
+Subject: PCI: Fix pci_register_io_range() memory leak
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit f6bda644fa3a7070621c3bf12cd657f69a42f170 ]
+
+Kmemleak reports:
+
+ unreferenced object 0xc328de40 (size 64):
+ comm "kworker/1:1", pid 21, jiffies 4294938212 (age 1484.670s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 e0 d8 fc eb 00 00 00 00 ................
+ 00 00 10 fe 00 00 00 00 00 00 00 00 00 00 00 00 ................
+
+ backtrace:
+ [<ad758d10>] pci_register_io_range+0x3c/0x80
+ [<2c7f139e>] of_pci_range_to_resource+0x48/0xc0
+ [<f079ecc8>] devm_of_pci_get_host_bridge_resources.constprop.0+0x2ac/0x3ac
+ [<e999753b>] devm_of_pci_bridge_init+0x60/0x1b8
+ [<a895b229>] devm_pci_alloc_host_bridge+0x54/0x64
+ [<e451ddb0>] rcar_pcie_probe+0x2c/0x644
+
+In case a PCI host driver's probe is deferred, the same I/O range may be
+allocated again, and be ignored, causing a memory leak.
+
+Fix this by (a) letting logic_pio_register_range() return -EEXIST if the
+passed range already exists, so pci_register_io_range() will free it, and
+by (b) making pci_register_io_range() not consider -EEXIST an error
+condition.
+
+Link: https://lore.kernel.org/r/20210202100332.829047-1-geert+renesas@glider.be
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 4 ++++
+ lib/logic_pio.c | 3 +++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index ba791165ed19..9449dfde2841 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4029,6 +4029,10 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,
+ ret = logic_pio_register_range(range);
+ if (ret)
+ kfree(range);
++
++ /* Ignore duplicates due to deferred probing */
++ if (ret == -EEXIST)
++ ret = 0;
+ #endif
+
+ return ret;
+diff --git a/lib/logic_pio.c b/lib/logic_pio.c
+index f32fe481b492..07b4b9a1f54b 100644
+--- a/lib/logic_pio.c
++++ b/lib/logic_pio.c
+@@ -28,6 +28,8 @@ static DEFINE_MUTEX(io_range_mutex);
+ * @new_range: pointer to the IO range to be registered.
+ *
+ * Returns 0 on success, the error code in case of failure.
++ * If the range already exists, -EEXIST will be returned, which should be
++ * considered a success.
+ *
+ * Register a new IO range node in the IO range list.
+ */
+@@ -51,6 +53,7 @@ int logic_pio_register_range(struct logic_pio_hwaddr *new_range)
+ list_for_each_entry(range, &io_range_list, list) {
+ if (range->fwnode == new_range->fwnode) {
+ /* range already there */
++ ret = -EEXIST;
+ goto end_register;
+ }
+ if (range->flags == LOGIC_PIO_CPU_MMIO &&
+--
+2.30.1
+
--- /dev/null
+From 1ea53433ea4381ff21336d3a67792fed692b665f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 14:17:54 -0600
+Subject: PCI/LINK: Remove bandwidth notification
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit b4c7d2076b4e767dd2e075a2b3a9e57753fc67f5 ]
+
+The PCIe Bandwidth Change Notification feature logs messages when the link
+bandwidth changes. Some users have reported that these messages occur
+often enough to significantly reduce NVMe performance. GPUs also seem to
+generate these messages.
+
+We don't know why the link bandwidth changes, but in the reported cases
+there's no indication that it's caused by hardware failures.
+
+Remove the bandwidth change notifications for now. Hopefully we can add
+this back when we have a better understanding of why this happens and how
+we can make the messages useful instead of overwhelming.
+
+Link: https://lore.kernel.org/r/20200115221008.GA191037@google.com/
+Link: https://lore.kernel.org/r/155605909349.3575.13433421148215616375.stgit@gimli.home/
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206197
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/Kconfig | 8 --
+ drivers/pci/pcie/Makefile | 1 -
+ drivers/pci/pcie/bw_notification.c | 138 -----------------------------
+ drivers/pci/pcie/portdrv.h | 6 --
+ drivers/pci/pcie/portdrv_pci.c | 1 -
+ 5 files changed, 154 deletions(-)
+ delete mode 100644 drivers/pci/pcie/bw_notification.c
+
+diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
+index 3946555a6042..45a2ef702b45 100644
+--- a/drivers/pci/pcie/Kconfig
++++ b/drivers/pci/pcie/Kconfig
+@@ -133,14 +133,6 @@ config PCIE_PTM
+ This is only useful if you have devices that support PTM, but it
+ is safe to enable even if you don't.
+
+-config PCIE_BW
+- bool "PCI Express Bandwidth Change Notification"
+- depends on PCIEPORTBUS
+- help
+- This enables PCI Express Bandwidth Change Notification. If
+- you know link width or rate changes occur only to correct
+- unreliable links, you may answer Y.
+-
+ config PCIE_EDR
+ bool "PCI Express Error Disconnect Recover support"
+ depends on PCIE_DPC && ACPI
+diff --git a/drivers/pci/pcie/Makefile b/drivers/pci/pcie/Makefile
+index d9697892fa3e..b2980db88cc0 100644
+--- a/drivers/pci/pcie/Makefile
++++ b/drivers/pci/pcie/Makefile
+@@ -12,5 +12,4 @@ obj-$(CONFIG_PCIEAER_INJECT) += aer_inject.o
+ obj-$(CONFIG_PCIE_PME) += pme.o
+ obj-$(CONFIG_PCIE_DPC) += dpc.o
+ obj-$(CONFIG_PCIE_PTM) += ptm.o
+-obj-$(CONFIG_PCIE_BW) += bw_notification.o
+ obj-$(CONFIG_PCIE_EDR) += edr.o
+diff --git a/drivers/pci/pcie/bw_notification.c b/drivers/pci/pcie/bw_notification.c
+deleted file mode 100644
+index 565d23cccb8b..000000000000
+--- a/drivers/pci/pcie/bw_notification.c
++++ /dev/null
+@@ -1,138 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/*
+- * PCI Express Link Bandwidth Notification services driver
+- * Author: Alexandru Gagniuc <mr.nuke.me@gmail.com>
+- *
+- * Copyright (C) 2019, Dell Inc
+- *
+- * The PCIe Link Bandwidth Notification provides a way to notify the
+- * operating system when the link width or data rate changes. This
+- * capability is required for all root ports and downstream ports
+- * supporting links wider than x1 and/or multiple link speeds.
+- *
+- * This service port driver hooks into the bandwidth notification interrupt
+- * and warns when links become degraded in operation.
+- */
+-
+-#define dev_fmt(fmt) "bw_notification: " fmt
+-
+-#include "../pci.h"
+-#include "portdrv.h"
+-
+-static bool pcie_link_bandwidth_notification_supported(struct pci_dev *dev)
+-{
+- int ret;
+- u32 lnk_cap;
+-
+- ret = pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &lnk_cap);
+- return (ret == PCIBIOS_SUCCESSFUL) && (lnk_cap & PCI_EXP_LNKCAP_LBNC);
+-}
+-
+-static void pcie_enable_link_bandwidth_notification(struct pci_dev *dev)
+-{
+- u16 lnk_ctl;
+-
+- pcie_capability_write_word(dev, PCI_EXP_LNKSTA, PCI_EXP_LNKSTA_LBMS);
+-
+- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl);
+- lnk_ctl |= PCI_EXP_LNKCTL_LBMIE;
+- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
+-}
+-
+-static void pcie_disable_link_bandwidth_notification(struct pci_dev *dev)
+-{
+- u16 lnk_ctl;
+-
+- pcie_capability_read_word(dev, PCI_EXP_LNKCTL, &lnk_ctl);
+- lnk_ctl &= ~PCI_EXP_LNKCTL_LBMIE;
+- pcie_capability_write_word(dev, PCI_EXP_LNKCTL, lnk_ctl);
+-}
+-
+-static irqreturn_t pcie_bw_notification_irq(int irq, void *context)
+-{
+- struct pcie_device *srv = context;
+- struct pci_dev *port = srv->port;
+- u16 link_status, events;
+- int ret;
+-
+- ret = pcie_capability_read_word(port, PCI_EXP_LNKSTA, &link_status);
+- events = link_status & PCI_EXP_LNKSTA_LBMS;
+-
+- if (ret != PCIBIOS_SUCCESSFUL || !events)
+- return IRQ_NONE;
+-
+- pcie_capability_write_word(port, PCI_EXP_LNKSTA, events);
+- pcie_update_link_speed(port->subordinate, link_status);
+- return IRQ_WAKE_THREAD;
+-}
+-
+-static irqreturn_t pcie_bw_notification_handler(int irq, void *context)
+-{
+- struct pcie_device *srv = context;
+- struct pci_dev *port = srv->port;
+- struct pci_dev *dev;
+-
+- /*
+- * Print status from downstream devices, not this root port or
+- * downstream switch port.
+- */
+- down_read(&pci_bus_sem);
+- list_for_each_entry(dev, &port->subordinate->devices, bus_list)
+- pcie_report_downtraining(dev);
+- up_read(&pci_bus_sem);
+-
+- return IRQ_HANDLED;
+-}
+-
+-static int pcie_bandwidth_notification_probe(struct pcie_device *srv)
+-{
+- int ret;
+-
+- /* Single-width or single-speed ports do not have to support this. */
+- if (!pcie_link_bandwidth_notification_supported(srv->port))
+- return -ENODEV;
+-
+- ret = request_threaded_irq(srv->irq, pcie_bw_notification_irq,
+- pcie_bw_notification_handler,
+- IRQF_SHARED, "PCIe BW notif", srv);
+- if (ret)
+- return ret;
+-
+- pcie_enable_link_bandwidth_notification(srv->port);
+- pci_info(srv->port, "enabled with IRQ %d\n", srv->irq);
+-
+- return 0;
+-}
+-
+-static void pcie_bandwidth_notification_remove(struct pcie_device *srv)
+-{
+- pcie_disable_link_bandwidth_notification(srv->port);
+- free_irq(srv->irq, srv);
+-}
+-
+-static int pcie_bandwidth_notification_suspend(struct pcie_device *srv)
+-{
+- pcie_disable_link_bandwidth_notification(srv->port);
+- return 0;
+-}
+-
+-static int pcie_bandwidth_notification_resume(struct pcie_device *srv)
+-{
+- pcie_enable_link_bandwidth_notification(srv->port);
+- return 0;
+-}
+-
+-static struct pcie_port_service_driver pcie_bandwidth_notification_driver = {
+- .name = "pcie_bw_notification",
+- .port_type = PCIE_ANY_PORT,
+- .service = PCIE_PORT_SERVICE_BWNOTIF,
+- .probe = pcie_bandwidth_notification_probe,
+- .suspend = pcie_bandwidth_notification_suspend,
+- .resume = pcie_bandwidth_notification_resume,
+- .remove = pcie_bandwidth_notification_remove,
+-};
+-
+-int __init pcie_bandwidth_notification_init(void)
+-{
+- return pcie_port_service_register(&pcie_bandwidth_notification_driver);
+-}
+diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
+index af7cf237432a..2ff5724b8f13 100644
+--- a/drivers/pci/pcie/portdrv.h
++++ b/drivers/pci/pcie/portdrv.h
+@@ -53,12 +53,6 @@ int pcie_dpc_init(void);
+ static inline int pcie_dpc_init(void) { return 0; }
+ #endif
+
+-#ifdef CONFIG_PCIE_BW
+-int pcie_bandwidth_notification_init(void);
+-#else
+-static inline int pcie_bandwidth_notification_init(void) { return 0; }
+-#endif
+-
+ /* Port Type */
+ #define PCIE_ANY_PORT (~0)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 0b250bc5f405..8bd4992a4f32 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -255,7 +255,6 @@ static void __init pcie_init_services(void)
+ pcie_pme_init();
+ pcie_dpc_init();
+ pcie_hp_init();
+- pcie_bandwidth_notification_init();
+ }
+
+ static int __init pcie_portdrv_init(void)
+--
+2.30.1
+
--- /dev/null
+From 45406070364a70da2ae95b4b7a40978a50dcc277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 18:48:10 +0000
+Subject: PCI: mediatek: Add missing of_node_put() to fix reference leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczyński <kw@linux.com>
+
+[ Upstream commit 42814c438aac79746d310f413a27d5b0b959c5de ]
+
+The for_each_available_child_of_node helper internally makes use of the
+of_get_next_available_child() which performs an of_node_get() on each
+iteration when searching for next available child node.
+
+Should an available child node be found, then it would return a device
+node pointer with reference count incremented, thus early return from
+the middle of the loop requires an explicit of_node_put() to prevent
+reference count leak.
+
+To stop the reference leak, explicitly call of_node_put() before
+returning after an error occurred.
+
+Link: https://lore.kernel.org/r/20210120184810.3068794-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index cf4c18f0c25a..23548b517e4b 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -1035,14 +1035,14 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ err = of_pci_get_devfn(child);
+ if (err < 0) {
+ dev_err(dev, "failed to parse devfn: %d\n", err);
+- return err;
++ goto error_put_node;
+ }
+
+ slot = PCI_SLOT(err);
+
+ err = mtk_pcie_parse_port(pcie, child, slot);
+ if (err)
+- return err;
++ goto error_put_node;
+ }
+
+ err = mtk_pcie_subsys_powerup(pcie);
+@@ -1058,6 +1058,9 @@ static int mtk_pcie_setup(struct mtk_pcie *pcie)
+ mtk_pcie_subsys_powerdown(pcie);
+
+ return 0;
++error_put_node:
++ of_node_put(child);
++ return err;
+ }
+
+ static int mtk_pcie_probe(struct platform_device *pdev)
+--
+2.30.1
+
--- /dev/null
+From be29e2b19f63c1c6e6eb04c3436395936728e89c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 22:24:35 +0100
+Subject: PCI: xgene-msi: Fix race in installing chained irq handler
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit a93c00e5f975f23592895b7e83f35de2d36b7633 ]
+
+Fix a race where a pending interrupt could be received and the handler
+called before the handler's data has been setup, by converting to
+irq_set_chained_handler_and_data().
+
+See also 2cf5a03cb29d ("PCI/keystone: Fix race in installing chained IRQ
+handler").
+
+Based on the mail discussion, it seems ok to drop the error handling.
+
+Link: https://lore.kernel.org/r/20210115212435.19940-3-martin@kaiser.cx
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-xgene-msi.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-xgene-msi.c b/drivers/pci/controller/pci-xgene-msi.c
+index 2470782cb01a..1c34c897a7e2 100644
+--- a/drivers/pci/controller/pci-xgene-msi.c
++++ b/drivers/pci/controller/pci-xgene-msi.c
+@@ -384,13 +384,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)
+ if (!msi_group->gic_irq)
+ continue;
+
+- irq_set_chained_handler(msi_group->gic_irq,
+- xgene_msi_isr);
+- err = irq_set_handler_data(msi_group->gic_irq, msi_group);
+- if (err) {
+- pr_err("failed to register GIC IRQ handler\n");
+- return -EINVAL;
+- }
++ irq_set_chained_handler_and_data(msi_group->gic_irq,
++ xgene_msi_isr, msi_group);
++
+ /*
+ * Statically allocate MSI GIC IRQs to each CPU core.
+ * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated
+--
+2.30.1
+
--- /dev/null
+From 87dd1b0c3069bf3d9b634142bd764eebc7943f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 08:37:38 +0100
+Subject: Platform: OLPC: Fix probe error handling
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit cec551ea0d41c679ed11d758e1a386e20285b29d ]
+
+Reset ec_priv if probe ends unsuccessfully.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Link: https://lore.kernel.org/r/20210126073740.10232-2-lkundrak@v3.sk
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/olpc/olpc-ec.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
+index f64b82824db2..2db7113383fd 100644
+--- a/drivers/platform/olpc/olpc-ec.c
++++ b/drivers/platform/olpc/olpc-ec.c
+@@ -426,11 +426,8 @@ static int olpc_ec_probe(struct platform_device *pdev)
+
+ /* get the EC revision */
+ err = olpc_ec_cmd(EC_FIRMWARE_REV, NULL, 0, &ec->version, 1);
+- if (err) {
+- ec_priv = NULL;
+- kfree(ec);
+- return err;
+- }
++ if (err)
++ goto error;
+
+ config.dev = pdev->dev.parent;
+ config.driver_data = ec;
+@@ -440,12 +437,16 @@ static int olpc_ec_probe(struct platform_device *pdev)
+ if (IS_ERR(ec->dcon_rdev)) {
+ dev_err(&pdev->dev, "failed to register DCON regulator\n");
+ err = PTR_ERR(ec->dcon_rdev);
+- kfree(ec);
+- return err;
++ goto error;
+ }
+
+ ec->dbgfs_dir = olpc_ec_setup_debugfs();
+
++ return 0;
++
++error:
++ ec_priv = NULL;
++ kfree(ec);
+ return err;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From 9a4c05588bd533ee523f2bd14fc6f932d769e600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 20:50:05 -0800
+Subject: platform/x86: amd-pmc: put device on error paths
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 745ed17a04f966406c8c27c8f992544336c06013 ]
+
+Put the PCI device rdev on error paths to fix potential reference count
+leaks.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210121045005.73342-1-bianpan2016@163.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd-pmc.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/amd-pmc.c b/drivers/platform/x86/amd-pmc.c
+index ef8342572463..b9da58ee9b1e 100644
+--- a/drivers/platform/x86/amd-pmc.c
++++ b/drivers/platform/x86/amd-pmc.c
+@@ -210,31 +210,39 @@ static int amd_pmc_probe(struct platform_device *pdev)
+ dev->dev = &pdev->dev;
+
+ rdev = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0, 0));
+- if (!rdev || !pci_match_id(pmc_pci_ids, rdev))
++ if (!rdev || !pci_match_id(pmc_pci_ids, rdev)) {
++ pci_dev_put(rdev);
+ return -ENODEV;
++ }
+
+ dev->cpu_id = rdev->device;
+ err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_LO);
+ if (err) {
+ dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS);
++ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
+ }
+
+ err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val);
+- if (err)
++ if (err) {
++ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
++ }
+
+ base_addr_lo = val & AMD_PMC_BASE_ADDR_HI_MASK;
+
+ err = pci_write_config_dword(rdev, AMD_PMC_SMU_INDEX_ADDRESS, AMD_PMC_BASE_ADDR_HI);
+ if (err) {
+ dev_err(dev->dev, "error writing to 0x%x\n", AMD_PMC_SMU_INDEX_ADDRESS);
++ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
+ }
+
+ err = pci_read_config_dword(rdev, AMD_PMC_SMU_INDEX_DATA, &val);
+- if (err)
++ if (err) {
++ pci_dev_put(rdev);
+ return pcibios_err_to_errno(err);
++ }
+
+ base_addr_hi = val & AMD_PMC_BASE_ADDR_LO_MASK;
+ pci_dev_put(rdev);
+--
+2.30.1
+
--- /dev/null
+From a77b7e24e476729f84728010152acc01d436b08f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 00:59:20 +1100
+Subject: powerpc/64: Fix stack trace not displaying final frame
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit e3de1e291fa58a1ab0f471a4b458eff2514e4b5f ]
+
+In commit bf13718bc57a ("powerpc: show registers when unwinding
+interrupt frames") we changed our stack dumping logic to show the full
+registers whenever we find an interrupt frame on the stack.
+
+However we didn't notice that on 64-bit this doesn't show the final
+frame, ie. the interrupt that brought us in from userspace, whereas on
+32-bit it does.
+
+That is due to confusion about the size of that last frame. The code
+in show_stack() calls validate_sp(), passing it STACK_INT_FRAME_SIZE
+to check the sp is at least that far below the top of the stack.
+
+However on 64-bit that size is too large for the final frame, because
+it includes the red zone, but we don't allocate a red zone for the
+first frame.
+
+So add a new define that encodes the correct size for 32-bit and
+64-bit, and use it in show_stack().
+
+This results in the full trace being shown on 64-bit, eg:
+
+ sysrq: Trigger a crash
+ Kernel panic - not syncing: sysrq triggered crash
+ CPU: 0 PID: 83 Comm: sh Not tainted 5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty #649
+ Call Trace:
+ [c00000000a1c3ac0] [c000000000897b70] dump_stack+0xc4/0x114 (unreliable)
+ [c00000000a1c3b00] [c00000000014334c] panic+0x178/0x41c
+ [c00000000a1c3ba0] [c00000000094e600] sysrq_handle_crash+0x40/0x50
+ [c00000000a1c3c00] [c00000000094ef98] __handle_sysrq+0xd8/0x210
+ [c00000000a1c3ca0] [c00000000094f820] write_sysrq_trigger+0x100/0x188
+ [c00000000a1c3ce0] [c0000000005559dc] proc_reg_write+0x10c/0x1b0
+ [c00000000a1c3d10] [c000000000479950] vfs_write+0xf0/0x360
+ [c00000000a1c3d60] [c000000000479d9c] ksys_write+0x7c/0x140
+ [c00000000a1c3db0] [c00000000002bf5c] system_call_exception+0x19c/0x2c0
+ [c00000000a1c3e10] [c00000000000d35c] system_call_common+0xec/0x278
+ --- interrupt: c00 at 0x7fff9fbab428
+ NIP: 00007fff9fbab428 LR: 000000001000b724 CTR: 0000000000000000
+ REGS: c00000000a1c3e80 TRAP: 0c00 Not tainted (5.11.0-rc2-gcc-8.2.0-00188-g571abcb96b10-dirty)
+ MSR: 900000000280f033 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002884 XER: 00000000
+ IRQMASK: 0
+ GPR00: 0000000000000004 00007fffc3cb8960 00007fff9fc59900 0000000000000001
+ GPR04: 000000002a4b32d0 0000000000000002 0000000000000063 0000000000000063
+ GPR08: 000000002a4b32d0 0000000000000000 0000000000000000 0000000000000000
+ GPR12: 0000000000000000 00007fff9fcca9a0 0000000000000000 0000000000000000
+ GPR16: 0000000000000000 0000000000000000 0000000000000000 00000000100b8fd0
+ GPR20: 000000002a4b3485 00000000100b8f90 0000000000000000 0000000000000000
+ GPR24: 000000002a4b0440 00000000100e77b8 0000000000000020 000000002a4b32d0
+ GPR28: 0000000000000001 0000000000000002 000000002a4b32d0 0000000000000001
+ NIP [00007fff9fbab428] 0x7fff9fbab428
+ LR [000000001000b724] 0x1000b724
+ --- interrupt: c00
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210209141627.2898485-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ptrace.h | 3 +++
+ arch/powerpc/kernel/asm-offsets.c | 2 +-
+ arch/powerpc/kernel/process.c | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h
+index 58f9dc060a7b..8236c5e749e4 100644
+--- a/arch/powerpc/include/asm/ptrace.h
++++ b/arch/powerpc/include/asm/ptrace.h
+@@ -70,6 +70,9 @@ struct pt_regs
+ };
+ #endif
+
++
++#define STACK_FRAME_WITH_PT_REGS (STACK_FRAME_OVERHEAD + sizeof(struct pt_regs))
++
+ #ifdef __powerpc64__
+
+ /*
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index b12d7c049bfe..989006b5ad0f 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -309,7 +309,7 @@ int main(void)
+
+ /* Interrupt register frame */
+ DEFINE(INT_FRAME_SIZE, STACK_INT_FRAME_SIZE);
+- DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_OVERHEAD + sizeof(struct pt_regs));
++ DEFINE(SWITCH_FRAME_SIZE, STACK_FRAME_WITH_PT_REGS);
+ STACK_PT_REGS_OFFSET(GPR0, gpr[0]);
+ STACK_PT_REGS_OFFSET(GPR1, gpr[1]);
+ STACK_PT_REGS_OFFSET(GPR2, gpr[2]);
+diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
+index a66f435dabbf..b65a73e4d642 100644
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -2176,7 +2176,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack,
+ * See if this is an exception frame.
+ * We look for the "regshere" marker in the current frame.
+ */
+- if (validate_sp(sp, tsk, STACK_INT_FRAME_SIZE)
++ if (validate_sp(sp, tsk, STACK_FRAME_WITH_PT_REGS)
+ && stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
+ struct pt_regs *regs = (struct pt_regs *)
+ (sp + STACK_FRAME_OVERHEAD);
+--
+2.30.1
+
--- /dev/null
+From 6fcb0c6dca70384e18a1b0764556d2bb5ea79ed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 23:08:35 +1000
+Subject: powerpc: improve handling of unrecoverable system reset
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 11cb0a25f71818ca7ab4856548ecfd83c169aa4d ]
+
+If an unrecoverable system reset hits in process context, the system
+does not have to panic. Similar to machine check, call nmi_exit()
+before die().
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210130130852.2952424-26-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/traps.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 3ec7b443fe6b..4be05517f2db 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -503,8 +503,11 @@ void system_reset_exception(struct pt_regs *regs)
+ die("Unrecoverable nested System Reset", regs, SIGABRT);
+ #endif
+ /* Must die if the interrupt is not recoverable */
+- if (!(regs->msr & MSR_RI))
++ if (!(regs->msr & MSR_RI)) {
++ /* For the reason explained in die_mce, nmi_exit before die */
++ nmi_exit();
+ die("Unrecoverable System Reset", regs, SIGABRT);
++ }
+
+ if (saved_hsrrs) {
+ mtspr(SPRN_HSRR0, hsrr0);
+--
+2.30.1
+
--- /dev/null
+From 6e1d3983663b962b104b251176c96d88e4a353ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 15:35:06 +1100
+Subject: powerpc/pci: Add ppc_md.discover_phbs()
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 5537fcb319d016ce387f818dd774179bc03217f5 ]
+
+On many powerpc platforms the discovery and initalisation of
+pci_controllers (PHBs) happens inside of setup_arch(). This is very early
+in boot (pre-initcalls) and means that we're initialising the PHB long
+before many basic kernel services (slab allocator, debugfs, a real ioremap)
+are available.
+
+On PowerNV this causes an additional problem since we map the PHB registers
+with ioremap(). As of commit d538aadc2718 ("powerpc/ioremap: warn on early
+use of ioremap()") a warning is printed because we're using the "incorrect"
+API to setup and MMIO mapping in searly boot. The kernel does provide
+early_ioremap(), but that is not intended to create long-lived MMIO
+mappings and a seperate warning is printed by generic code if
+early_ioremap() mappings are "leaked."
+
+This is all fixable with dumb hacks like using early_ioremap() to setup
+the initial mapping then replacing it with a real ioremap later on in
+boot, but it does raise the question: Why the hell are we setting up the
+PHB's this early in boot?
+
+The old and wise claim it's due to "hysterical rasins." Aside from amused
+grapes there doesn't appear to be any real reason to maintain the current
+behaviour. Already most of the newer embedded platforms perform PHB
+discovery in an arch_initcall and between the end of setup_arch() and the
+start of initcalls none of the generic kernel code does anything PCI
+related. On powerpc scanning PHBs occurs in a subsys_initcall so it should
+be possible to move the PHB discovery to a core, postcore or arch initcall.
+
+This patch adds the ppc_md.discover_phbs hook and a core_initcall stub that
+calls it. The core_initcalls are the earliest to be called so this will
+any possibly issues with dependency between initcalls. This isn't just an
+academic issue either since on pseries and PowerNV EEH init occurs in an
+arch_initcall and depends on the pci_controllers being available, similarly
+the creation of pci_dns occurs at core_initcall_sync (i.e. between core and
+postcore initcalls). These problems need to be addressed seperately.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+[mpe: Make discover_phbs() static]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201103043523.916109-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/machdep.h | 3 +++
+ arch/powerpc/kernel/pci-common.c | 10 ++++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/machdep.h b/arch/powerpc/include/asm/machdep.h
+index cf6ebbc16cb4..764f2732a821 100644
+--- a/arch/powerpc/include/asm/machdep.h
++++ b/arch/powerpc/include/asm/machdep.h
+@@ -59,6 +59,9 @@ struct machdep_calls {
+ int (*pcibios_root_bridge_prepare)(struct pci_host_bridge
+ *bridge);
+
++ /* finds all the pci_controllers present at boot */
++ void (*discover_phbs)(void);
++
+ /* To setup PHBs when using automatic OF platform driver for PCI */
+ int (*pci_setup_phb)(struct pci_controller *host);
+
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index 2b555997b295..001e90cd8948 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -1699,3 +1699,13 @@ static void fixup_hide_host_resource_fsl(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MOTOROLA, PCI_ANY_ID, fixup_hide_host_resource_fsl);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_FREESCALE, PCI_ANY_ID, fixup_hide_host_resource_fsl);
++
++
++static int __init discover_phbs(void)
++{
++ if (ppc_md.discover_phbs)
++ ppc_md.discover_phbs();
++
++ return 0;
++}
++core_initcall(discover_phbs);
+--
+2.30.1
+
--- /dev/null
+From 04482554d14b978b984f1676d2a76d2aca8e0de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 04:14:52 -0500
+Subject: powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
+
+From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+
+[ Upstream commit d137845c973147a22622cc76c7b0bc16f6206323 ]
+
+While sampling for marked events, currently we record the sample only
+if the SIAR valid bit of Sampled Instruction Event Register (SIER) is
+set. SIAR_VALID bit is used for fetching the instruction address from
+Sampled Instruction Address Register(SIAR). But there are some
+usecases, where the user is interested only in the PMU stats at each
+counter overflow and the exact IP of the overflow event is not
+required. Dropping SIAR invalid samples will fail to record some of
+the counter overflows in such cases.
+
+Example of such usecase is dumping the PMU stats (event counts) after
+some regular amount of instructions/events from the userspace (ex: via
+ptrace). Here counter overflow is indicated to userspace via signal
+handler, and captured by monitoring and enabling I/O signaling on the
+event file descriptor. In these cases, we expect to get
+sample/overflow indication after each specified sample_period.
+
+Perf event attribute will not have PERF_SAMPLE_IP set in the
+sample_type if exact IP of the overflow event is not requested. So
+while profiling if SAMPLE_IP is not set, just record the counter
+overflow irrespective of SIAR_VALID check.
+
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
+[mpe: Reflow comment and if formatting]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1612516492-1428-1-git-send-email-atrajeev@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/core-book3s.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index a4908652242e..51f413521fde 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -2149,7 +2149,17 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ left += period;
+ if (left <= 0)
+ left = period;
+- record = siar_valid(regs);
++
++ /*
++ * If address is not requested in the sample via
++ * PERF_SAMPLE_IP, just record that sample irrespective
++ * of SIAR valid check.
++ */
++ if (event->attr.sample_type & PERF_SAMPLE_IP)
++ record = siar_valid(regs);
++ else
++ record = 1;
++
+ event->hw.last_period = event->hw.sample_period;
+ }
+ if (left < 0x80000000LL)
+@@ -2167,9 +2177,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val,
+ * MMCR2. Check attr.exclude_kernel and address to drop the sample in
+ * these cases.
+ */
+- if (event->attr.exclude_kernel && record)
+- if (is_kernel_addr(mfspr(SPRN_SIAR)))
+- record = 0;
++ if (event->attr.exclude_kernel &&
++ (event->attr.sample_type & PERF_SAMPLE_IP) &&
++ is_kernel_addr(mfspr(SPRN_SIAR)))
++ record = 0;
+
+ /*
+ * Finally record data if requested.
+--
+2.30.1
+
--- /dev/null
+From e2e545c28c669ed44e182e000c625f8c27276be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 07:13:02 +0100
+Subject: s390/smp: __smp_rescan_cpus() - move cpumask away from stack
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit 62c8dca9e194326802b43c60763f856d782b225c ]
+
+Avoid a potentially large stack frame and overflow by making
+"cpumask_t avail" a static variable. There is no concurrent
+access due to the existing locking.
+
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/smp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 27c763014114..1bae4a65416b 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -770,7 +770,7 @@ static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
+ static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
+ {
+ struct sclp_core_entry *core;
+- cpumask_t avail;
++ static cpumask_t avail;
+ bool configured;
+ u16 core_id;
+ int nr, i;
+--
+2.30.1
+
--- /dev/null
+From 8a8a844d3cd5700f14b83335ee282941d66cca6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Feb 2021 22:46:00 -0600
+Subject: scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit d28d48c699779973ab9a3bd0e5acfa112bd4fdef ]
+
+If iscsi_prep_scsi_cmd_pdu() fails we try to add it back to the cmdqueue,
+but we leave it partially setup. We don't have functions that can undo the
+pdu and init task setup. We only have cleanup_task which can clean up both
+parts. So this has us just fail the cmd and go through the standard cleanup
+routine and then have the SCSI midlayer retry it like is done when it fails
+in the queuecommand path.
+
+Link: https://lore.kernel.org/r/20210207044608.27585-2-michael.christie@oracle.com
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 1851015299b3..af40de7e51e7 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1532,14 +1532,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
+ }
+ rc = iscsi_prep_scsi_cmd_pdu(conn->task);
+ if (rc) {
+- if (rc == -ENOMEM || rc == -EACCES) {
+- spin_lock_bh(&conn->taskqueuelock);
+- list_add_tail(&conn->task->running,
+- &conn->cmdqueue);
+- conn->task = NULL;
+- spin_unlock_bh(&conn->taskqueuelock);
+- goto done;
+- } else
++ if (rc == -ENOMEM || rc == -EACCES)
++ fail_scsi_task(conn->task, DID_IMM_RETRY);
++ else
+ fail_scsi_task(conn->task, DID_ABORT);
+ spin_lock_bh(&conn->taskqueuelock);
+ continue;
+--
+2.30.1
+
--- /dev/null
+From 53584b926e4b3bfb2f611d1aba3defca70e0f227 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Jan 2021 18:08:45 +0530
+Subject: scsi: pm80xx: Fix missing tag_free in NVMD DATA req
+
+From: akshatzen <akshatzen@google.com>
+
+[ Upstream commit 5d28026891c7041deec08cc5ddd8f3abd90195e1 ]
+
+Tag was not freed in NVMD get/set data request failure scenario. This
+caused a tag leak each time a request failed.
+
+Link: https://lore.kernel.org/r/20210109123849.17098-5-Viswas.G@microchip.com
+Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: akshatzen <akshatzen@google.com>
+Signed-off-by: Viswas G <Viswas.G@microchip.com>
+Signed-off-by: Ruksar Devadi <Ruksar.devadi@microchip.com>
+Signed-off-by: Radha Ramachandran <radha@google.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_hwi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index dd15246d5b03..ea43dff40a85 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -3038,8 +3038,8 @@ void pm8001_mpi_set_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ complete(pm8001_ha->nvmd_completion);
+ pm8001_dbg(pm8001_ha, MSG, "Set nvm data complete!\n");
+ if ((dlen_status & NVMD_STAT) != 0) {
+- pm8001_dbg(pm8001_ha, FAIL, "Set nvm data error!\n");
+- return;
++ pm8001_dbg(pm8001_ha, FAIL, "Set nvm data error %x\n",
++ dlen_status);
+ }
+ ccb->task = NULL;
+ ccb->ccb_tag = 0xFFFFFFFF;
+@@ -3062,11 +3062,17 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+
+ pm8001_dbg(pm8001_ha, MSG, "Get nvm data complete!\n");
+ if ((dlen_status & NVMD_STAT) != 0) {
+- pm8001_dbg(pm8001_ha, FAIL, "Get nvm data error!\n");
++ pm8001_dbg(pm8001_ha, FAIL, "Get nvm data error %x\n",
++ dlen_status);
+ complete(pm8001_ha->nvmd_completion);
++ /* We should free tag during failure also, the tag is not being
++ * freed by requesting path anywhere.
++ */
++ ccb->task = NULL;
++ ccb->ccb_tag = 0xFFFFFFFF;
++ pm8001_tag_free(pm8001_ha, tag);
+ return;
+ }
+-
+ if (ir_tds_bn_dps_das_nvm & IPMode) {
+ /* indirect mode - IR bit set */
+ pm8001_dbg(pm8001_ha, MSG, "Get NVMD success, IR=1\n");
+--
+2.30.1
+
--- /dev/null
+From 5f2eacde4b5f72641e634f703789fd7c0c7eb7a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 10:22:01 +0300
+Subject: scsi: target: core: Add cmd length set before cmd complete
+
+From: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+
+[ Upstream commit 1c73e0c5e54d5f7d77f422a10b03ebe61eaed5ad ]
+
+TCM doesn't properly handle underflow case for service actions. One way to
+prevent it is to always complete command with
+target_complete_cmd_with_length(), however it requires access to data_sg,
+which is not always available.
+
+This change introduces target_set_cmd_data_length() function which allows
+to set command data length before completing it.
+
+Link: https://lore.kernel.org/r/20210209072202.41154-2-a.miloserdov@yadro.com
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
+Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_transport.c | 15 +++++++++++----
+ include/target/target_core_backend.h | 1 +
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index fca4bd079d02..8a4d58fdc9fe 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -879,11 +879,9 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
+ }
+ EXPORT_SYMBOL(target_complete_cmd);
+
+-void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++void target_set_cmd_data_length(struct se_cmd *cmd, int length)
+ {
+- if ((scsi_status == SAM_STAT_GOOD ||
+- cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) &&
+- length < cmd->data_length) {
++ if (length < cmd->data_length) {
+ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
+ cmd->residual_count += cmd->data_length - length;
+ } else {
+@@ -893,6 +891,15 @@ void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int len
+
+ cmd->data_length = length;
+ }
++}
++EXPORT_SYMBOL(target_set_cmd_data_length);
++
++void target_complete_cmd_with_length(struct se_cmd *cmd, u8 scsi_status, int length)
++{
++ if (scsi_status == SAM_STAT_GOOD ||
++ cmd->se_cmd_flags & SCF_TREAT_READ_AS_NORMAL) {
++ target_set_cmd_data_length(cmd, length);
++ }
+
+ target_complete_cmd(cmd, scsi_status);
+ }
+diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
+index 6336780d83a7..ce2fba49c95d 100644
+--- a/include/target/target_core_backend.h
++++ b/include/target/target_core_backend.h
+@@ -72,6 +72,7 @@ int transport_backend_register(const struct target_backend_ops *);
+ void target_backend_unregister(const struct target_backend_ops *);
+
+ void target_complete_cmd(struct se_cmd *, u8);
++void target_set_cmd_data_length(struct se_cmd *, int);
+ void target_complete_cmd_with_length(struct se_cmd *, u8, int);
+
+ void transport_copy_sense_to_cmd(struct se_cmd *, unsigned char *);
+--
+2.30.1
+
--- /dev/null
+From 7b890f8bd779097716f922106c32ff9a2c8950bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 10:22:02 +0300
+Subject: scsi: target: core: Prevent underflow for service actions
+
+From: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+
+[ Upstream commit 14d24e2cc77411301e906a8cf41884739de192de ]
+
+TCM buffer length doesn't necessarily equal 8 + ADDITIONAL LENGTH which
+might be considered an underflow in case of Data-In size being greater than
+8 + ADDITIONAL LENGTH. So truncate buffer length to prevent underflow.
+
+Link: https://lore.kernel.org/r/20210209072202.41154-3-a.miloserdov@yadro.com
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
+Signed-off-by: Aleksandr Miloserdov <a.miloserdov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_pr.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
+index 14db5e568f22..d4cc43afe05b 100644
+--- a/drivers/target/target_core_pr.c
++++ b/drivers/target/target_core_pr.c
+@@ -3739,6 +3739,7 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd)
+ spin_unlock(&dev->t10_pr.registration_lock);
+
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+@@ -3757,7 +3758,7 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ struct t10_pr_registration *pr_reg;
+ unsigned char *buf;
+ u64 pr_res_key;
+- u32 add_len = 16; /* Hardcoded to 16 when a reservation is held. */
++ u32 add_len = 0;
+
+ if (cmd->data_length < 8) {
+ pr_err("PRIN SA READ_RESERVATIONS SCSI Data Length: %u"
+@@ -3775,8 +3776,9 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ pr_reg = dev->dev_pr_res_holder;
+ if (pr_reg) {
+ /*
+- * Set the hardcoded Additional Length
++ * Set the Additional Length to 16 when a reservation is held
+ */
++ add_len = 16;
+ put_unaligned_be32(add_len, &buf[4]);
+
+ if (cmd->data_length < 22)
+@@ -3812,6 +3814,8 @@ core_scsi3_pri_read_reservation(struct se_cmd *cmd)
+ (pr_reg->pr_res_type & 0x0f);
+ }
+
++ target_set_cmd_data_length(cmd, 8 + add_len);
++
+ err:
+ spin_unlock(&dev->dev_reservation_lock);
+ transport_kunmap_data_sg(cmd);
+@@ -3830,7 +3834,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ struct se_device *dev = cmd->se_dev;
+ struct t10_reservation *pr_tmpl = &dev->t10_pr;
+ unsigned char *buf;
+- u16 add_len = 8; /* Hardcoded to 8. */
++ u16 len = 8; /* Hardcoded to 8. */
+
+ if (cmd->data_length < 6) {
+ pr_err("PRIN SA REPORT_CAPABILITIES SCSI Data Length:"
+@@ -3842,7 +3846,7 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ if (!buf)
+ return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+
+- put_unaligned_be16(add_len, &buf[0]);
++ put_unaligned_be16(len, &buf[0]);
+ buf[2] |= 0x10; /* CRH: Compatible Reservation Hanlding bit. */
+ buf[2] |= 0x08; /* SIP_C: Specify Initiator Ports Capable bit */
+ buf[2] |= 0x04; /* ATP_C: All Target Ports Capable bit */
+@@ -3871,6 +3875,8 @@ core_scsi3_pri_report_capabilities(struct se_cmd *cmd)
+ buf[4] |= 0x02; /* PR_TYPE_WRITE_EXCLUSIVE */
+ buf[5] |= 0x01; /* PR_TYPE_EXCLUSIVE_ACCESS_ALLREG */
+
++ target_set_cmd_data_length(cmd, len);
++
+ transport_kunmap_data_sg(cmd);
+
+ return 0;
+@@ -4031,6 +4037,7 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
+ * Set ADDITIONAL_LENGTH
+ */
+ put_unaligned_be32(add_len, &buf[4]);
++ target_set_cmd_data_length(cmd, 8 + add_len);
+
+ transport_kunmap_data_sg(cmd);
+
+--
+2.30.1
+
--- /dev/null
+From 06b8078591095ce959651df49513d8f377ea43bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 02:04:21 -0800
+Subject: scsi: ufs: Protect some contexts from unexpected clock scaling
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 0e9d4ca43ba8112821397f56a26d20682001c011 ]
+
+In contexts like suspend, shutdown, and error handling we need to
+suspend devfreq to make sure these contexts won't be disturbed by
+clock scaling. However, suspending devfreq is not enough since users
+can still trigger a clock scaling by manipulating the devfreq sysfs
+nodes like min/max_freq and governor even after devfreq is
+suspended. Moreover, mere suspending devfreq cannot synchroinze a
+clock scaling which has already been invoked through these sysfs
+nodes. Add one more flag in struct clk_scaling and wrap the entire
+func ufshcd_devfreq_scale() with the clk_scaling_lock, so that we can
+use this flag and clk_scaling_lock to control and synchronize clock
+scaling invoked through devfreq sysfs nodes.
+
+Link: https://lore.kernel.org/r/1611137065-14266-2-git-send-email-cang@codeaurora.org
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 80 ++++++++++++++++++++++++---------------
+ drivers/scsi/ufs/ufshcd.h | 6 ++-
+ 2 files changed, 54 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index a568f7ae0566..16e1bd1aa49d 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1184,19 +1184,30 @@ static int ufshcd_clock_scaling_prepare(struct ufs_hba *hba)
+ */
+ ufshcd_scsi_block_requests(hba);
+ down_write(&hba->clk_scaling_lock);
+- if (ufshcd_wait_for_doorbell_clr(hba, DOORBELL_CLR_TOUT_US)) {
++
++ if (!hba->clk_scaling.is_allowed ||
++ ufshcd_wait_for_doorbell_clr(hba, DOORBELL_CLR_TOUT_US)) {
+ ret = -EBUSY;
+ up_write(&hba->clk_scaling_lock);
+ ufshcd_scsi_unblock_requests(hba);
++ goto out;
+ }
+
++ /* let's not get into low power until clock scaling is completed */
++ ufshcd_hold(hba, false);
++
++out:
+ return ret;
+ }
+
+-static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba)
++static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba, bool writelock)
+ {
+- up_write(&hba->clk_scaling_lock);
++ if (writelock)
++ up_write(&hba->clk_scaling_lock);
++ else
++ up_read(&hba->clk_scaling_lock);
+ ufshcd_scsi_unblock_requests(hba);
++ ufshcd_release(hba);
+ }
+
+ /**
+@@ -1211,13 +1222,11 @@ static void ufshcd_clock_scaling_unprepare(struct ufs_hba *hba)
+ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up)
+ {
+ int ret = 0;
+-
+- /* let's not get into low power until clock scaling is completed */
+- ufshcd_hold(hba, false);
++ bool is_writelock = true;
+
+ ret = ufshcd_clock_scaling_prepare(hba);
+ if (ret)
+- goto out;
++ return ret;
+
+ /* scale down the gear before scaling down clocks */
+ if (!scale_up) {
+@@ -1243,14 +1252,12 @@ static int ufshcd_devfreq_scale(struct ufs_hba *hba, bool scale_up)
+ }
+
+ /* Enable Write Booster if we have scaled up else disable it */
+- up_write(&hba->clk_scaling_lock);
++ downgrade_write(&hba->clk_scaling_lock);
++ is_writelock = false;
+ ufshcd_wb_ctrl(hba, scale_up);
+- down_write(&hba->clk_scaling_lock);
+
+ out_unprepare:
+- ufshcd_clock_scaling_unprepare(hba);
+-out:
+- ufshcd_release(hba);
++ ufshcd_clock_scaling_unprepare(hba, is_writelock);
+ return ret;
+ }
+
+@@ -1524,7 +1531,7 @@ static ssize_t ufshcd_clkscale_enable_show(struct device *dev,
+ {
+ struct ufs_hba *hba = dev_get_drvdata(dev);
+
+- return snprintf(buf, PAGE_SIZE, "%d\n", hba->clk_scaling.is_allowed);
++ return snprintf(buf, PAGE_SIZE, "%d\n", hba->clk_scaling.is_enabled);
+ }
+
+ static ssize_t ufshcd_clkscale_enable_store(struct device *dev,
+@@ -1538,7 +1545,7 @@ static ssize_t ufshcd_clkscale_enable_store(struct device *dev,
+ return -EINVAL;
+
+ value = !!value;
+- if (value == hba->clk_scaling.is_allowed)
++ if (value == hba->clk_scaling.is_enabled)
+ goto out;
+
+ pm_runtime_get_sync(hba->dev);
+@@ -1547,7 +1554,7 @@ static ssize_t ufshcd_clkscale_enable_store(struct device *dev,
+ cancel_work_sync(&hba->clk_scaling.suspend_work);
+ cancel_work_sync(&hba->clk_scaling.resume_work);
+
+- hba->clk_scaling.is_allowed = value;
++ hba->clk_scaling.is_enabled = value;
+
+ if (value) {
+ ufshcd_resume_clkscaling(hba);
+@@ -1885,8 +1892,6 @@ static void ufshcd_init_clk_scaling(struct ufs_hba *hba)
+ snprintf(wq_name, sizeof(wq_name), "ufs_clkscaling_%d",
+ hba->host->host_no);
+ hba->clk_scaling.workq = create_singlethread_workqueue(wq_name);
+-
+- ufshcd_clkscaling_init_sysfs(hba);
+ }
+
+ static void ufshcd_exit_clk_scaling(struct ufs_hba *hba)
+@@ -1894,6 +1899,8 @@ static void ufshcd_exit_clk_scaling(struct ufs_hba *hba)
+ if (!ufshcd_is_clkscaling_supported(hba))
+ return;
+
++ if (hba->clk_scaling.enable_attr.attr.name)
++ device_remove_file(hba->dev, &hba->clk_scaling.enable_attr);
+ destroy_workqueue(hba->clk_scaling.workq);
+ ufshcd_devfreq_remove(hba);
+ }
+@@ -1958,7 +1965,7 @@ static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba)
+ if (!hba->clk_scaling.active_reqs++)
+ queue_resume_work = true;
+
+- if (!hba->clk_scaling.is_allowed || hba->pm_op_in_progress)
++ if (!hba->clk_scaling.is_enabled || hba->pm_op_in_progress)
+ return;
+
+ if (queue_resume_work)
+@@ -5744,18 +5751,24 @@ static void ufshcd_err_handling_prepare(struct ufs_hba *hba)
+ ufshcd_vops_resume(hba, pm_op);
+ } else {
+ ufshcd_hold(hba, false);
+- if (hba->clk_scaling.is_allowed) {
++ if (hba->clk_scaling.is_enabled) {
+ cancel_work_sync(&hba->clk_scaling.suspend_work);
+ cancel_work_sync(&hba->clk_scaling.resume_work);
+ ufshcd_suspend_clkscaling(hba);
+ }
++ down_write(&hba->clk_scaling_lock);
++ hba->clk_scaling.is_allowed = false;
++ up_write(&hba->clk_scaling_lock);
+ }
+ }
+
+ static void ufshcd_err_handling_unprepare(struct ufs_hba *hba)
+ {
+ ufshcd_release(hba);
+- if (hba->clk_scaling.is_allowed)
++ down_write(&hba->clk_scaling_lock);
++ hba->clk_scaling.is_allowed = true;
++ up_write(&hba->clk_scaling_lock);
++ if (hba->clk_scaling.is_enabled)
+ ufshcd_resume_clkscaling(hba);
+ pm_runtime_put(hba->dev);
+ }
+@@ -7741,12 +7754,14 @@ static int ufshcd_add_lus(struct ufs_hba *hba)
+ sizeof(struct ufs_pa_layer_attr));
+ hba->clk_scaling.saved_pwr_info.is_valid = true;
+ if (!hba->devfreq) {
++ hba->clk_scaling.is_allowed = true;
+ ret = ufshcd_devfreq_init(hba);
+ if (ret)
+ goto out;
+- }
+
+- hba->clk_scaling.is_allowed = true;
++ hba->clk_scaling.is_enabled = true;
++ ufshcd_clkscaling_init_sysfs(hba);
++ }
+ }
+
+ ufs_bsg_probe(hba);
+@@ -8661,11 +8676,14 @@ static int ufshcd_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ ufshcd_hold(hba, false);
+ hba->clk_gating.is_suspended = true;
+
+- if (hba->clk_scaling.is_allowed) {
++ if (hba->clk_scaling.is_enabled) {
+ cancel_work_sync(&hba->clk_scaling.suspend_work);
+ cancel_work_sync(&hba->clk_scaling.resume_work);
+ ufshcd_suspend_clkscaling(hba);
+ }
++ down_write(&hba->clk_scaling_lock);
++ hba->clk_scaling.is_allowed = false;
++ up_write(&hba->clk_scaling_lock);
+
+ if (req_dev_pwr_mode == UFS_ACTIVE_PWR_MODE &&
+ req_link_state == UIC_LINK_ACTIVE_STATE) {
+@@ -8762,8 +8780,6 @@ static int ufshcd_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ goto out;
+
+ set_link_active:
+- if (hba->clk_scaling.is_allowed)
+- ufshcd_resume_clkscaling(hba);
+ ufshcd_vreg_set_hpm(hba);
+ /*
+ * Device hardware reset is required to exit DeepSleep. Also, for
+@@ -8787,7 +8803,10 @@ static int ufshcd_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ if (!ufshcd_set_dev_pwr_mode(hba, UFS_ACTIVE_PWR_MODE))
+ ufshcd_disable_auto_bkops(hba);
+ enable_gating:
+- if (hba->clk_scaling.is_allowed)
++ down_write(&hba->clk_scaling_lock);
++ hba->clk_scaling.is_allowed = true;
++ up_write(&hba->clk_scaling_lock);
++ if (hba->clk_scaling.is_enabled)
+ ufshcd_resume_clkscaling(hba);
+ hba->clk_gating.is_suspended = false;
+ hba->dev_info.b_rpm_dev_flush_capable = false;
+@@ -8891,7 +8910,10 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+
+ hba->clk_gating.is_suspended = false;
+
+- if (hba->clk_scaling.is_allowed)
++ down_write(&hba->clk_scaling_lock);
++ hba->clk_scaling.is_allowed = true;
++ up_write(&hba->clk_scaling_lock);
++ if (hba->clk_scaling.is_enabled)
+ ufshcd_resume_clkscaling(hba);
+
+ /* Enable Auto-Hibernate if configured */
+@@ -8917,8 +8939,6 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ ufshcd_vreg_set_lpm(hba);
+ disable_irq_and_vops_clks:
+ ufshcd_disable_irq(hba);
+- if (hba->clk_scaling.is_allowed)
+- ufshcd_suspend_clkscaling(hba);
+ ufshcd_setup_clocks(hba, false);
+ if (ufshcd_is_clkgating_allowed(hba)) {
+ hba->clk_gating.state = CLKS_OFF;
+@@ -9155,8 +9175,6 @@ void ufshcd_remove(struct ufs_hba *hba)
+
+ ufshcd_exit_clk_scaling(hba);
+ ufshcd_exit_clk_gating(hba);
+- if (ufshcd_is_clkscaling_supported(hba))
+- device_remove_file(hba->dev, &hba->clk_scaling.enable_attr);
+ ufshcd_hba_exit(hba);
+ }
+ EXPORT_SYMBOL_GPL(ufshcd_remove);
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 1885ec9126c4..7d0b00f23761 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -419,7 +419,10 @@ struct ufs_saved_pwr_info {
+ * @suspend_work: worker to suspend devfreq
+ * @resume_work: worker to resume devfreq
+ * @min_gear: lowest HS gear to scale down to
+- * @is_allowed: tracks if scaling is currently allowed or not
++ * @is_enabled: tracks if scaling is currently enabled or not, controlled by
++ clkscale_enable sysfs node
++ * @is_allowed: tracks if scaling is currently allowed or not, used to block
++ clock scaling which is not invoked from devfreq governor
+ * @is_busy_started: tracks if busy period has started or not
+ * @is_suspended: tracks if devfreq is suspended or not
+ */
+@@ -434,6 +437,7 @@ struct ufs_clk_scaling {
+ struct work_struct suspend_work;
+ struct work_struct resume_work;
+ u32 min_gear;
++ bool is_enabled;
+ bool is_allowed;
+ bool is_busy_started;
+ bool is_suspended;
+--
+2.30.1
+
--- /dev/null
+From de8ecf5d3d492273be65b0054e357128566bdd55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 01:59:27 -0800
+Subject: scsi: ufs: WB is only available on LUN #0 to #7
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit a2fca52ee640a04112ed9d9a137c940ea6ad288e ]
+
+Kernel stack violation when getting unit_descriptor/wb_buf_alloc_units from
+rpmb LUN. The reason is that the unit descriptor length is different per
+LU.
+
+The length of Normal LU is 45 while the one of rpmb LU is 35.
+
+int ufshcd_read_desc_param(struct ufs_hba *hba, ...)
+{
+ param_offset=41;
+ param_size=4;
+ buff_len=45;
+ ...
+ buff_len=35 by rpmb LU;
+
+ if (is_kmalloc) {
+ /* Make sure we don't copy more data than available */
+ if (param_offset + param_size > buff_len)
+ param_size = buff_len - param_offset;
+ --> param_size = 250;
+ memcpy(param_read_buf, &desc_buf[param_offset], param_size);
+ --> memcpy(param_read_buf, desc_buf+41, 250);
+
+[ 141.868974][ T9174] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: wb_buf_alloc_units_show+0x11c/0x11c
+ }
+}
+
+Link: https://lore.kernel.org/r/20210111095927.1830311-1-jaegeuk@kernel.org
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-sysfs.c | 3 ++-
+ drivers/scsi/ufs/ufs.h | 6 ++++--
+ drivers/scsi/ufs/ufshcd.c | 2 +-
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufs-sysfs.c b/drivers/scsi/ufs/ufs-sysfs.c
+index 08e72b7eef6a..50e90416262b 100644
+--- a/drivers/scsi/ufs/ufs-sysfs.c
++++ b/drivers/scsi/ufs/ufs-sysfs.c
+@@ -792,7 +792,8 @@ static ssize_t _pname##_show(struct device *dev, \
+ struct scsi_device *sdev = to_scsi_device(dev); \
+ struct ufs_hba *hba = shost_priv(sdev->host); \
+ u8 lun = ufshcd_scsi_to_upiu_lun(sdev->lun); \
+- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun)) \
++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, \
++ _duname##_DESC_PARAM##_puname)) \
+ return -EINVAL; \
+ return ufs_sysfs_read_desc_param(hba, QUERY_DESC_IDN_##_duname, \
+ lun, _duname##_DESC_PARAM##_puname, buf, _size); \
+diff --git a/drivers/scsi/ufs/ufs.h b/drivers/scsi/ufs/ufs.h
+index 14dfda735adf..580aa56965d0 100644
+--- a/drivers/scsi/ufs/ufs.h
++++ b/drivers/scsi/ufs/ufs.h
+@@ -552,13 +552,15 @@ struct ufs_dev_info {
+ * @return: true if the lun has a matching unit descriptor, false otherwise
+ */
+ static inline bool ufs_is_valid_unit_desc_lun(struct ufs_dev_info *dev_info,
+- u8 lun)
++ u8 lun, u8 param_offset)
+ {
+ if (!dev_info || !dev_info->max_lu_supported) {
+ pr_err("Max General LU supported by UFS isn't initialized\n");
+ return false;
+ }
+-
++ /* WB is available only for the logical unit from 0 to 7 */
++ if (param_offset == UNIT_DESC_PARAM_WB_BUF_ALLOC_UNITS)
++ return lun < UFS_UPIU_MAX_WB_LUN_ID;
+ return lun == UFS_UPIU_RPMB_WLUN || (lun < dev_info->max_lu_supported);
+ }
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 428b9e0ac47e..a568f7ae0566 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -3427,7 +3427,7 @@ static inline int ufshcd_read_unit_desc_param(struct ufs_hba *hba,
+ * Unit descriptors are only available for general purpose LUs (LUN id
+ * from 0 to 7) and RPMB Well known LU.
+ */
+- if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun))
++ if (!ufs_is_valid_unit_desc_lun(&hba->dev_info, lun, param_offset))
+ return -EOPNOTSUPP;
+
+ return ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT, lun,
+--
+2.30.1
+
mips-kernel-reserve-exception-base-early-to-prevent-.patch
mptcp-always-graft-subflow-socket-to-parent.patch
mptcp-reset-last_snd-on-subflow-close.patch
+i2c-rcar-faster-irq-code-to-minimize-hw-race-conditi.patch
+i2c-rcar-optimize-cacheline-to-minimize-hw-race-cond.patch
+scsi-pm80xx-fix-missing-tag_free-in-nvmd-data-req.patch
+scsi-ufs-wb-is-only-available-on-lun-0-to-7.patch
+scsi-ufs-protect-some-contexts-from-unexpected-clock.patch
+udf-fix-silent-aed-taglocation-corruption.patch
+iommu-vt-d-clear-prq-overflow-only-when-prq-is-empty.patch
+mmc-mxs-mmc-fix-a-resource-leak-in-an-error-handling.patch
+mmc-mediatek-fix-race-condition-between-msdc_request.patch
+mmc-sdhci-iproc-add-acpi-bindings-for-the-rpi.patch
+platform-x86-amd-pmc-put-device-on-error-paths.patch
+platform-olpc-fix-probe-error-handling.patch
+powerpc-pci-add-ppc_md.discover_phbs.patch
+spi-stm32-make-spurious-and-overrun-interrupts-visib.patch
+powerpc-improve-handling-of-unrecoverable-system-res.patch
+powerpc-perf-record-counter-overflow-always-if-sampl.patch
+hid-logitech-dj-add-support-for-the-new-lightspeed-c.patch
+powerpc-64-fix-stack-trace-not-displaying-final-fram.patch
+iommu-amd-fix-performance-counter-initialization.patch
+clk-qcom-gdsc-implement-no_ret_periph-flag.patch
+sparc32-limit-memblock-allocation-to-low-memory.patch
+sparc64-use-arch_validate_flags-to-validate-adi-flag.patch
+input-applespi-don-t-wait-for-responses-to-commands-.patch
+pci-xgene-msi-fix-race-in-installing-chained-irq-han.patch
+pci-mediatek-add-missing-of_node_put-to-fix-referenc.patch
+drivers-base-build-kunit-tests-without-structleak-pl.patch
+pci-link-remove-bandwidth-notification.patch
+ext4-don-t-try-to-processed-freed-blocks-until-mball.patch
+kbuild-clamp-sublevel-to-255.patch
+pci-fix-pci_register_io_range-memory-leak.patch
+i40e-fix-memory-leak-in-i40e_probe.patch
+pci-err-retain-status-from-error-notification.patch
+kasan-fix-memory-corruption-in-kasan_bitops_tags-tes.patch
+s390-smp-__smp_rescan_cpus-move-cpumask-away-from-st.patch
+drivers-base-memory-don-t-store-phys_device-in-memor.patch
+sysctl.c-fix-underflow-value-setting-risk-in-vm_tabl.patch
+scsi-libiscsi-fix-iscsi_prep_scsi_cmd_pdu-error-hand.patch
+scsi-target-core-add-cmd-length-set-before-cmd-compl.patch
+scsi-target-core-prevent-underflow-for-service-actio.patch
+clk-qcom-gpucc-msm8998-add-resets-cxc-fix-flags-on-g.patch
--- /dev/null
+From 0ad4bd3b84faf49b8a967ef06f8118557bb57b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 14:20:31 +0100
+Subject: sparc32: Limit memblock allocation to low memory
+
+From: Andreas Larsson <andreas@gaisler.com>
+
+[ Upstream commit bda166930c37604ffa93f2425426af6921ec575a ]
+
+Commit cca079ef8ac29a7c02192d2bad2ffe4c0c5ffdd0 changed sparc32 to use
+memblocks instead of bootmem, but also made high memory available via
+memblock allocation which does not work together with e.g. phys_to_virt
+and can lead to kernel panic.
+
+This changes back to only low memory being allocatable in the early
+stages, now using memblock allocation.
+
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/mm/init_32.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
+index eb2946b1df8a..6139c5700ccc 100644
+--- a/arch/sparc/mm/init_32.c
++++ b/arch/sparc/mm/init_32.c
+@@ -197,6 +197,9 @@ unsigned long __init bootmem_init(unsigned long *pages_avail)
+ size = memblock_phys_mem_size() - memblock_reserved_size();
+ *pages_avail = (size >> PAGE_SHIFT) - high_pages;
+
++ /* Only allow low memory to be allocated via memblock allocation */
++ memblock_set_current_limit(max_low_pfn << PAGE_SHIFT);
++
+ return max_pfn;
+ }
+
+--
+2.30.1
+
--- /dev/null
+From b5ae0d188f235760b3edc6e40a2375bffb53e580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 11:56:11 -0600
+Subject: sparc64: Use arch_validate_flags() to validate ADI flag
+
+From: Khalid Aziz <khalid.aziz@oracle.com>
+
+[ Upstream commit 147d8622f2a26ef34beacc60e1ed8b66c2fa457f ]
+
+When userspace calls mprotect() to enable ADI on an address range,
+do_mprotect_pkey() calls arch_validate_prot() to validate new
+protection flags. arch_validate_prot() for sparc looks at the first
+VMA associated with address range to verify if ADI can indeed be
+enabled on this address range. This has two issues - (1) Address
+range might cover multiple VMAs while arch_validate_prot() looks at
+only the first VMA, (2) arch_validate_prot() peeks at VMA without
+holding mmap lock which can result in race condition.
+
+arch_validate_flags() from commit c462ac288f2c ("mm: Introduce
+arch_validate_flags()") allows for VMA flags to be validated for all
+VMAs that cover the address range given by user while holding mmap
+lock. This patch updates sparc code to move the VMA check from
+arch_validate_prot() to arch_validate_flags() to fix above two
+issues.
+
+Suggested-by: Jann Horn <jannh@google.com>
+Suggested-by: Christoph Hellwig <hch@infradead.org>
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
+Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/mman.h | 54 +++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h
+index f94532f25db1..274217e7ed70 100644
+--- a/arch/sparc/include/asm/mman.h
++++ b/arch/sparc/include/asm/mman.h
+@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr)
+ {
+ if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI))
+ return 0;
+- if (prot & PROT_ADI) {
+- if (!adi_capable())
+- return 0;
++ return 1;
++}
+
+- if (addr) {
+- struct vm_area_struct *vma;
++#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags)
++/* arch_validate_flags() - Ensure combination of flags is valid for a
++ * VMA.
++ */
++static inline bool arch_validate_flags(unsigned long vm_flags)
++{
++ /* If ADI is being enabled on this VMA, check for ADI
++ * capability on the platform and ensure VMA is suitable
++ * for ADI
++ */
++ if (vm_flags & VM_SPARC_ADI) {
++ if (!adi_capable())
++ return false;
+
+- vma = find_vma(current->mm, addr);
+- if (vma) {
+- /* ADI can not be enabled on PFN
+- * mapped pages
+- */
+- if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
+- return 0;
++ /* ADI can not be enabled on PFN mapped pages */
++ if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
++ return false;
+
+- /* Mergeable pages can become unmergeable
+- * if ADI is enabled on them even if they
+- * have identical data on them. This can be
+- * because ADI enabled pages with identical
+- * data may still not have identical ADI
+- * tags on them. Disallow ADI on mergeable
+- * pages.
+- */
+- if (vma->vm_flags & VM_MERGEABLE)
+- return 0;
+- }
+- }
++ /* Mergeable pages can become unmergeable
++ * if ADI is enabled on them even if they
++ * have identical data on them. This can be
++ * because ADI enabled pages with identical
++ * data may still not have identical ADI
++ * tags on them. Disallow ADI on mergeable
++ * pages.
++ */
++ if (vm_flags & VM_MERGEABLE)
++ return false;
+ }
+- return 1;
++ return true;
+ }
+ #endif /* CONFIG_SPARC64 */
+
+--
+2.30.1
+
--- /dev/null
+From 6196cd54a8aee30a7c5af13cb0d6c738e326d4a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:59:32 +0100
+Subject: spi: stm32: make spurious and overrun interrupts visible
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit c64e7efe46b7de21937ef4b3594d9b1fc74f07df ]
+
+We do not expect to receive spurious interrupts so rise a warning
+if it happens.
+
+RX overrun is an error condition that signals a corrupted RX
+stream both in dma and in irq modes. Report the error and
+abort the transfer in either cases.
+
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1612551572-495-9-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 6eeb39669a86..53c4311cc6ab 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -928,8 +928,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ mask |= STM32H7_SPI_SR_RXP;
+
+ if (!(sr & mask)) {
+- dev_dbg(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
+- sr, ier);
++ dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
++ sr, ier);
+ spin_unlock_irqrestore(&spi->lock, flags);
+ return IRQ_NONE;
+ }
+@@ -956,15 +956,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id)
+ }
+
+ if (sr & STM32H7_SPI_SR_OVR) {
+- dev_warn(spi->dev, "Overrun: received value discarded\n");
+- if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0)))
+- stm32h7_spi_read_rxfifo(spi, false);
+- /*
+- * If overrun is detected while using DMA, it means that
+- * something went wrong, so stop the current transfer
+- */
+- if (spi->cur_usedma)
+- end = true;
++ dev_err(spi->dev, "Overrun: RX data lost\n");
++ end = true;
+ }
+
+ if (sr & STM32H7_SPI_SR_EOT) {
+--
+2.30.1
+
--- /dev/null
+From 2608b811853e4ea2ed4f1decb7879628341fe65c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:20:53 -0800
+Subject: sysctl.c: fix underflow value setting risk in vm_table
+
+From: Lin Feng <linf@wangsu.com>
+
+[ Upstream commit 3b3376f222e3ab58367d9dd405cafd09d5e37b7c ]
+
+Apart from subsystem specific .proc_handler handler, all ctl_tables with
+extra1 and extra2 members set should use proc_dointvec_minmax instead of
+proc_dointvec, or the limit set in extra* never work and potentially echo
+underflow values(negative numbers) is likely make system unstable.
+
+Especially vfs_cache_pressure and zone_reclaim_mode, -1 is apparently not
+a valid value, but we can set to them. And then kernel may crash.
+
+# echo -1 > /proc/sys/vm/vfs_cache_pressure
+
+Link: https://lkml.kernel.org/r/20201223105535.2875-1-linf@wangsu.com
+Signed-off-by: Lin Feng <linf@wangsu.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sysctl.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index c9fbdd848138..62fbd09b5dc1 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2962,7 +2962,7 @@ static struct ctl_table vm_table[] = {
+ .data = &block_dump,
+ .maxlen = sizeof(block_dump),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ {
+@@ -2970,7 +2970,7 @@ static struct ctl_table vm_table[] = {
+ .data = &sysctl_vfs_cache_pressure,
+ .maxlen = sizeof(sysctl_vfs_cache_pressure),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ #if defined(HAVE_ARCH_PICK_MMAP_LAYOUT) || \
+@@ -2980,7 +2980,7 @@ static struct ctl_table vm_table[] = {
+ .data = &sysctl_legacy_va_layout,
+ .maxlen = sizeof(sysctl_legacy_va_layout),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ #endif
+@@ -2990,7 +2990,7 @@ static struct ctl_table vm_table[] = {
+ .data = &node_reclaim_mode,
+ .maxlen = sizeof(node_reclaim_mode),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ },
+ {
+--
+2.30.1
+
--- /dev/null
+From 56e633468c4e0b396617b37f82704b5968dd6631 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 17:41:16 -0600
+Subject: udf: fix silent AED tagLocation corruption
+
+From: Steven J. Magnani <magnani@ieee.org>
+
+[ Upstream commit 63c9e47a1642fc817654a1bc18a6ec4bbcc0f056 ]
+
+When extending a file, udf_do_extend_file() may enter following empty
+indirect extent. At the end of udf_do_extend_file() we revert prev_epos
+to point to the last written extent. However if we end up not adding any
+further extent in udf_do_extend_file(), the reverting points prev_epos
+into the header area of the AED and following updates of the extents
+(in udf_update_extents()) will corrupt the header.
+
+Make sure that we do not follow indirect extent if we are not going to
+add any more extents so that returning back to the last written extent
+works correctly.
+
+Link: https://lore.kernel.org/r/20210107234116.6190-2-magnani@ieee.org
+Signed-off-by: Steven J. Magnani <magnani@ieee.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/inode.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index bb89c3e43212..0dd2f93ac048 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -544,11 +544,14 @@ static int udf_do_extend_file(struct inode *inode,
+
+ udf_write_aext(inode, last_pos, &last_ext->extLocation,
+ last_ext->extLength, 1);
++
+ /*
+- * We've rewritten the last extent but there may be empty
+- * indirect extent after it - enter it.
++ * We've rewritten the last extent. If we are going to add
++ * more extents, we may need to enter possible following
++ * empty indirect extent.
+ */
+- udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
++ if (new_block_bytes || prealloc_len)
++ udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+ }
+
+ /* Managed to do everything necessary? */
+--
+2.30.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
