--- /dev/null
+From 4ea7658373b5d14f9cf514914fc1eb4d3898bf8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 21:30:21 +0800
+Subject: bnxt_en: fix error return code in bnxt_init_board()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3383176efc0fb0c0900a191026468a58668b4214 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Link: https://lore.kernel.org/r/1605792621-6268-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 2da1c22946450..aff1a23078903 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5198,6 +5198,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ dev_err(&pdev->dev, "System does not support DMA, aborting\n");
++ rc = -EIO;
+ goto init_err_disable;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From b94b70ebf72ac03aa8b73790cfc855d7daa9ea2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 02:44:31 -0500
+Subject: bnxt_en: Release PCI regions when DMA mask setup fails during probe.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit c54bc3ced5106663c2f2b44071800621f505b00e ]
+
+Jump to init_err_release to cleanup. bnxt_unmap_bars() will also be
+called but it will do nothing if the BARs are not mapped yet.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/1605858271-8209-1-git-send-email-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index aff1a23078903..250ecbcca019f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5199,7 +5199,7 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+ rc = -EIO;
+- goto init_err_disable;
++ goto init_err_release;
+ }
+
+ pci_set_master(pdev);
+--
+2.27.0
+
--- /dev/null
+From 7023f93f7ffd4159d60cd6997a5f8bea289855ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 11:55:06 +0800
+Subject: dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size
+
+From: Sugar Zhang <sugar.zhang@rock-chips.com>
+
+[ Upstream commit e773ca7da8beeca7f17fe4c9d1284a2b66839cc1 ]
+
+Actually, burst size is equal to '1 << desc->rqcfg.brst_size'.
+we should use burst size, not desc->rqcfg.brst_size.
+
+dma memcpy performance on Rockchip RV1126
+@ 1512MHz A7, 1056MHz LPDDR3, 200MHz DMA:
+
+dmatest:
+
+/# echo dma0chan0 > /sys/module/dmatest/parameters/channel
+/# echo 4194304 > /sys/module/dmatest/parameters/test_buf_size
+/# echo 8 > /sys/module/dmatest/parameters/iterations
+/# echo y > /sys/module/dmatest/parameters/norandom
+/# echo y > /sys/module/dmatest/parameters/verbose
+/# echo 1 > /sys/module/dmatest/parameters/run
+
+dmatest: dma0chan0-copy0: result #1: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #2: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #3: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #4: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #5: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #6: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #7: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+dmatest: dma0chan0-copy0: result #8: 'test passed' with src_off=0x0 dst_off=0x0 len=0x400000
+
+Before:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 48 iops 200338 KB/s (0)
+
+After this patch:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 179 iops 734873 KB/s (0)
+
+After this patch and increase dma clk to 400MHz:
+
+ dmatest: dma0chan0-copy0: summary 8 tests, 0 failures 259 iops 1062929 KB/s (0)
+
+Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
+Link: https://lore.kernel.org/r/1605326106-55681-1-git-send-email-sugar.zhang@rock-chips.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/pl330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index 9aa57b37381a9..7f66ae1945b24 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2634,7 +2634,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ * If burst size is smaller than bus width then make sure we only
+ * transfer one at a time to avoid a burst stradling an MFIFO entry.
+ */
+- if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
++ if (burst * 8 < pl330->pcfg.data_bus_width)
+ desc->rqcfg.brst_len = 1;
+
+ desc->bytes_requested = len;
+--
+2.27.0
+
--- /dev/null
+From 1d7f4e4c5c37b3a3e26c35943e82ce4039103d6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 08:45:55 +0100
+Subject: efivarfs: revert "fix memory leak in efivarfs_create()"
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit ff04f3b6f2e27f8ae28a498416af2a8dd5072b43 ]
+
+The memory leak addressed by commit fe5186cf12e3 is a false positive:
+all allocations are recorded in a linked list, and freed when the
+filesystem is unmounted. This leads to double frees, and as reported
+by David, leads to crashes if SLUB is configured to self destruct when
+double frees occur.
+
+So drop the redundant kfree() again, and instead, mark the offending
+pointer variable so the allocation is ignored by kmemleak.
+
+Cc: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
+Fixes: fe5186cf12e3 ("efivarfs: fix memory leak in efivarfs_create()")
+Reported-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/inode.c | 2 ++
+ fs/efivarfs/super.c | 1 -
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index e2ab6d0497f2b..151884b95ee2f 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/ctype.h>
++#include <linux/kmemleak.h>
+ #include <linux/slab.h>
+
+ #include "internal.h"
+@@ -138,6 +139,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ var->var.VariableName[i] = '\0';
+
+ inode->i_private = var;
++ kmemleak_ignore(var);
+
+ efivar_entry_add(var, &efivarfs_list);
+ d_instantiate(dentry, inode);
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 0e4f20377d196..fca235020312d 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ clear_inode(inode);
+- kfree(inode->i_private);
+ }
+
+ static const struct super_operations efivarfs_ops = {
+--
+2.27.0
+
--- /dev/null
+From e8ee92886a03d98e056a5af94dc2905bd9bfd9ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Aug 2020 03:16:50 +0900
+Subject: HID: cypress: Support Varmilo Keyboards' media hotkeys
+
+From: Frank Yang <puilp0502@gmail.com>
+
+[ Upstream commit 652f3d00de523a17b0cebe7b90debccf13aa8c31 ]
+
+The Varmilo VA104M Keyboard (04b4:07b1, reported as Varmilo Z104M)
+exposes media control hotkeys as a USB HID consumer control device, but
+these keys do not work in the current (5.8-rc1) kernel due to the
+incorrect HID report descriptor. Fix the problem by modifying the
+internal HID report descriptor.
+
+More specifically, the keyboard report descriptor specifies the
+logical boundary as 572~10754 (0x023c ~ 0x2a02) while the usage
+boundary is specified as 0~10754 (0x00 ~ 0x2a02). This results in an
+incorrect interpretation of input reports, causing inputs to be ignored.
+By setting the Logical Minimum to zero, we align the logical boundary
+with the Usage ID boundary.
+
+Some notes:
+
+* There seem to be multiple variants of the VA104M keyboard. This
+ patch specifically targets 04b4:07b1 variant.
+
+* The device works out-of-the-box on Windows platform with the generic
+ consumer control device driver (hidserv.inf). This suggests that
+ Windows either ignores the Logical Minimum/Logical Maximum or
+ interprets the Usage ID assignment differently from the linux
+ implementation; Maybe there are other devices out there that only
+ works on Windows due to this problem?
+
+Signed-off-by: Frank Yang <puilp0502@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-cypress.c | 44 ++++++++++++++++++++++++++++++++++-----
+ drivers/hid/hid-ids.h | 2 ++
+ 2 files changed, 41 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
+index 1689568b597d4..12c5d7c96527a 100644
+--- a/drivers/hid/hid-cypress.c
++++ b/drivers/hid/hid-cypress.c
+@@ -26,19 +26,17 @@
+ #define CP_2WHEEL_MOUSE_HACK 0x02
+ #define CP_2WHEEL_MOUSE_HACK_ON 0x04
+
++#define VA_INVAL_LOGICAL_BOUNDARY 0x08
++
+ /*
+ * Some USB barcode readers from cypress have usage min and usage max in
+ * the wrong order
+ */
+-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ unsigned int i;
+
+- if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
+- return rdesc;
+-
+ if (*rsize < 4)
+ return rdesc;
+
+@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ return rdesc;
+ }
+
++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ /*
++ * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
++ * reports Logical Minimum of its Consumer Control device as 572
++ * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
++ */
++ if (*rsize == 25 &&
++ rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
++ rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
++ rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
++ rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
++ hid_info(hdev,
++ "fixing up varmilo VA104M consumer control report descriptor\n");
++ rdesc[12] = 0x00;
++ rdesc[13] = 0x00;
++ }
++ return rdesc;
++}
++
++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++ unsigned int *rsize)
++{
++ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++ if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
++ rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
++ if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
++ rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
++
++ return rdesc;
++}
++
+ static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = {
+ .driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
+ .driver_data = CP_2WHEEL_MOUSE_HACK },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
++ .driver_data = VA_INVAL_LOGICAL_BOUNDARY },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, cp_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 33d2b5948d7fc..773452c6edfab 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -279,6 +279,8 @@
+ #define USB_DEVICE_ID_CYPRESS_BARCODE_4 0xed81
+ #define USB_DEVICE_ID_CYPRESS_TRUETOUCH 0xc001
+
++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1 0X07b1
++
+ #define USB_VENDOR_ID_DATA_MODUL 0x7374
+ #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH 0x1201
+
+--
+2.27.0
+
--- /dev/null
+From 47422bff4169529cba1ff9aaf70cc4e900083aea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 19:29:39 -0500
+Subject: HID: hid-sensor-hub: Fix issue with devices with no report ID
+
+From: Pablo Ceballos <pceballos@google.com>
+
+[ Upstream commit 34a9fa2025d9d3177c99351c7aaf256c5f50691f ]
+
+Some HID devices don't use a report ID because they only have a single
+report. In those cases, the report ID in struct hid_report will be zero
+and the data for the report will start at the first byte, so don't skip
+over the first byte.
+
+Signed-off-by: Pablo Ceballos <pceballos@google.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-sensor-hub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index 8efaa88329aa3..83e45d5801a98 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -473,7 +473,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ return 1;
+
+ ptr = raw_data;
+- ptr++; /* Skip report id */
++ if (report->id)
++ ptr++; /* Skip report id */
+
+ spin_lock_irqsave(&pdata->lock, flags);
+
+--
+2.27.0
+
--- /dev/null
+From 3b69f2d1e159bcb3b2be810d604148a59aef6a3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:57:02 +0800
+Subject: IB/mthca: fix return value of error branch in mthca_init_cq()
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 6830ff853a5764c75e56750d59d0bbb6b26f1835 ]
+
+We return 'err' in the error branch, but this variable may be set as zero
+by the above code. Fix it by setting 'err' as a negative value before we
+goto the error label.
+
+Fixes: 74c2174e7be5 ("IB uverbs: add mthca user CQ support")
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/1605837422-42724-1-git-send-email-wangxiongfeng2@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cq.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index 40ba833381557..59e1f6ea2ede9 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -811,8 +811,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+- if (IS_ERR(mailbox))
++ if (IS_ERR(mailbox)) {
++ err = PTR_ERR(mailbox);
+ goto err_out_arm;
++ }
+
+ cq_context = mailbox->buf;
+
+@@ -854,9 +856,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ }
+
+ spin_lock_irq(&dev->cq_table.lock);
+- if (mthca_array_set(&dev->cq_table.cq,
+- cq->cqn & (dev->limits.num_cqs - 1),
+- cq)) {
++ err = mthca_array_set(&dev->cq_table.cq,
++ cq->cqn & (dev->limits.num_cqs - 1), cq);
++ if (err) {
+ spin_unlock_irq(&dev->cq_table.lock);
+ goto err_out_free_mr;
+ }
+--
+2.27.0
+
--- /dev/null
+From ed8d523fabcac31d93fc0213fa6df14c57258d65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 20:53:57 -0700
+Subject: Input: i8042 - allow insmod to succeed on devices without an i8042
+ controller
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b1884583fcd17d6a1b1bba94bbb5826e6b5c6e17 ]
+
+The i8042 module exports several symbols which may be used by other
+modules.
+
+Before this commit it would refuse to load (when built as a module itself)
+on systems without an i8042 controller.
+
+This is a problem specifically for the asus-nb-wmi module. Many Asus
+laptops support the Asus WMI interface. Some of them have an i8042
+controller and need to use i8042_install_filter() to filter some kbd
+events. Other models do not have an i8042 controller (e.g. they use an
+USB attached kbd).
+
+Before this commit the asus-nb-wmi driver could not be loaded on Asus
+models without an i8042 controller, when the i8042 code was built as
+a module (as Arch Linux does) because the module_init function of the
+i8042 module would fail with -ENODEV and thus the i8042_install_filter
+symbol could not be loaded.
+
+This commit fixes this by exiting from module_init with a return code
+of 0 if no controller is found. It also adds a i8042_present bool to
+make the module_exit function a no-op in this case and also adds a
+check for i8042_present to the exported i8042_command function.
+
+The latter i8042_present check should not really be necessary because
+when builtin that function can already be used on systems without
+an i8042 controller, but better safe then sorry.
+
+Reported-and-tested-by: Marius Iacob <themariusus@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20201008112628.3979-2-hdegoede@redhat.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index c84c685056b99..6b648339733fa 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
+ MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
+ #endif
+
++static bool i8042_present;
+ static bool i8042_bypass_aux_irq_test;
+ static char i8042_kbd_firmware_id[128];
+ static char i8042_aux_firmware_id[128];
+@@ -343,6 +344,9 @@ int i8042_command(unsigned char *param, int command)
+ unsigned long flags;
+ int retval;
+
++ if (!i8042_present)
++ return -1;
++
+ spin_lock_irqsave(&i8042_lock, flags);
+ retval = __i8042_command(param, command);
+ spin_unlock_irqrestore(&i8042_lock, flags);
+@@ -1597,12 +1601,15 @@ static int __init i8042_init(void)
+
+ err = i8042_platform_init();
+ if (err)
+- return err;
++ return (err == -ENODEV) ? 0 : err;
+
+ err = i8042_controller_check();
+ if (err)
+ goto err_platform_exit;
+
++ /* Set this before creating the dev to allow i8042_command to work right away */
++ i8042_present = true;
++
+ pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+ if (IS_ERR(pdev)) {
+ err = PTR_ERR(pdev);
+@@ -1621,6 +1628,9 @@ static int __init i8042_init(void)
+
+ static void __exit i8042_exit(void)
+ {
++ if (!i8042_present)
++ return;
++
+ platform_device_unregister(i8042_platform_device);
+ platform_driver_unregister(&i8042_driver);
+ i8042_platform_exit();
+--
+2.27.0
+
--- /dev/null
+From c87b6668dc6aea3f0feb79487c288e1e85102b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 17:23:51 +0100
+Subject: nfc: s3fwrn5: use signed integer for parsing GPIO numbers
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit d8f0a86795c69f5b697f7d9e5274c124da93c92d ]
+
+GPIOs - as returned by of_get_named_gpio() and used by the gpiolib - are
+signed integers, where negative number indicates error. The return
+value of of_get_named_gpio() should not be assigned to an unsigned int
+because in case of !CONFIG_GPIOLIB such number would be a valid GPIO.
+
+Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201123162351.209100-1-krzk@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/s3fwrn5/i2c.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
+index c61d8a308da45..779f7a76ecd3d 100644
+--- a/drivers/nfc/s3fwrn5/i2c.c
++++ b/drivers/nfc/s3fwrn5/i2c.c
+@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy {
+ struct i2c_client *i2c_dev;
+ struct nci_dev *ndev;
+
+- unsigned int gpio_en;
+- unsigned int gpio_fw_wake;
++ int gpio_en;
++ int gpio_fw_wake;
+
+ struct mutex mutex;
+
+--
+2.27.0
+
--- /dev/null
+From dbe27569734f46b05f35411716898e2d0644ee99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 14:48:46 +0900
+Subject: perf probe: Fix to die_entrypc() returns error correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit ab4200c17ba6fe71d2da64317aae8a8aa684624c ]
+
+Fix die_entrypc() to return error correctly if the DIE has no
+DW_AT_ranges attribute. Since dwarf_ranges() will treat the case as an
+empty ranges and return 0, we have to check it by ourselves.
+
+Fixes: 91e2f539eeda ("perf probe: Fix to show function entry line as probe-able")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Link: http://lore.kernel.org/lkml/160645612634.2824037.5284932731175079426.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/dwarf-aux.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index fd460aca36e55..40e4c933b3728 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -305,6 +305,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ {
+ Dwarf_Addr base, end;
++ Dwarf_Attribute attr;
+
+ if (!addr)
+ return -EINVAL;
+@@ -312,6 +313,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ if (dwarf_entrypc(dw_die, addr) == 0)
+ return 0;
+
++ /*
++ * Since the dwarf_ranges() will return 0 if there is no
++ * DW_AT_ranges attribute, we should check it first.
++ */
++ if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
++ return -ENOENT;
++
+ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 600c8523175b7bc6bcb0d57eeb8a43ef72d32d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 16:47:52 -0700
+Subject: proc: don't allow async path resolution of /proc/self components
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 8d4c3e76e3be11a64df95ddee52e99092d42fc19 ]
+
+If this is attempted by a kthread, then return -EOPNOTSUPP as we don't
+currently support that. Once we can get task_pid_ptr() doing the right
+thing, then this can go away again.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/self.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index 2dcc2558b3aa7..dffbe533d53fc 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -24,6 +24,13 @@ static const char *proc_self_follow_link(struct dentry *dentry, void **cookie)
+ pid_t tgid = task_tgid_nr_ns(current, ns);
+ char *name;
+
++ /*
++ * Not currently supported. Once we can inherit all of struct pid,
++ * we can allow this.
++ */
++ if (current->flags & PF_KTHREAD)
++ return ERR_PTR(-EOPNOTSUPP);
++
+ if (!tgid)
+ return ERR_PTR(-ENOENT);
+ /* 11 for max length of signed int in decimal + NULL term */
+--
+2.27.0
+
--- /dev/null
+From e2fc247f85fa0f3bf1412f4cf1b09395458199aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 11:33:17 -0800
+Subject: scsi: libiscsi: Fix NOP race condition
+
+From: Lee Duncan <lduncan@suse.com>
+
+[ Upstream commit fe0a8a95e7134d0b44cd407bc0085b9ba8d8fe31 ]
+
+iSCSI NOPs are sometimes "lost", mistakenly sent to the user-land iscsid
+daemon instead of handled in the kernel, as they should be, resulting in a
+message from the daemon like:
+
+ iscsid: Got nop in, but kernel supports nop handling.
+
+This can occur because of the new forward- and back-locks, and the fact
+that an iSCSI NOP response can occur before processing of the NOP send is
+complete. This can result in "conn->ping_task" being NULL in
+iscsi_nop_out_rsp(), when the pointer is actually in the process of being
+set.
+
+To work around this, we add a new state to the "ping_task" pointer. In
+addition to NULL (not assigned) and a pointer (assigned), we add the state
+"being set", which is signaled with an INVALID pointer (using "-1").
+
+Link: https://lore.kernel.org/r/20201106193317.16993-1-leeman.duncan@gmail.com
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libiscsi.c | 23 +++++++++++++++--------
+ include/scsi/libiscsi.h | 3 +++
+ 2 files changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index b4fbcf4cade8f..36e415487fe53 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -570,8 +570,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
+ if (conn->task == task)
+ conn->task = NULL;
+
+- if (conn->ping_task == task)
+- conn->ping_task = NULL;
++ if (READ_ONCE(conn->ping_task) == task)
++ WRITE_ONCE(conn->ping_task, NULL);
+
+ /* release get from queueing */
+ __iscsi_put_task(task);
+@@ -780,6 +780,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ task->conn->session->age);
+ }
+
++ if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
++ WRITE_ONCE(conn->ping_task, task);
++
+ if (!ihost->workq) {
+ if (iscsi_prep_mgmt_task(conn, task))
+ goto free_task;
+@@ -987,8 +990,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+ struct iscsi_nopout hdr;
+ struct iscsi_task *task;
+
+- if (!rhdr && conn->ping_task)
+- return -EINVAL;
++ if (!rhdr) {
++ if (READ_ONCE(conn->ping_task))
++ return -EINVAL;
++ WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
++ }
+
+ memset(&hdr, 0, sizeof(struct iscsi_nopout));
+ hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
+@@ -1003,11 +1009,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+
+ task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
+ if (!task) {
++ if (!rhdr)
++ WRITE_ONCE(conn->ping_task, NULL);
+ iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
+ return -EIO;
+ } else if (!rhdr) {
+ /* only track our nops */
+- conn->ping_task = task;
+ conn->last_ping = jiffies;
+ }
+
+@@ -1020,7 +1027,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
+ struct iscsi_conn *conn = task->conn;
+ int rc = 0;
+
+- if (conn->ping_task != task) {
++ if (READ_ONCE(conn->ping_task) != task) {
+ /*
+ * If this is not in response to one of our
+ * nops then it must be from userspace.
+@@ -1960,7 +1967,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
+ */
+ static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
+ {
+- if (conn->ping_task &&
++ if (READ_ONCE(conn->ping_task) &&
+ time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
+ (conn->ping_timeout * HZ), jiffies))
+ return 1;
+@@ -2095,7 +2102,7 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ * Checking the transport already or nop from a cmd timeout still
+ * running
+ */
+- if (conn->ping_task) {
++ if (READ_ONCE(conn->ping_task)) {
+ task->have_checked_conn = true;
+ rc = BLK_EH_RESET_TIMER;
+ goto done;
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index c7b1dc713cdd7..9c7f4aad6db66 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -144,6 +144,9 @@ struct iscsi_task {
+ void *dd_data; /* driver/transport data */
+ };
+
++/* invalid scsi_task pointer */
++#define INVALID_SCSI_TASK (struct iscsi_task *)-1l
++
+ static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
+ {
+ return task->unsol_r2t.data_length > task->unsol_r2t.sent;
+--
+2.27.0
+
--- /dev/null
+From ea87f28c8a2166a018533545da435b6108457a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 19:46:18 -0600
+Subject: scsi: target: iscsi: Fix cmd abort fabric stop race
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit f36199355c64a39fe82cfddc7623d827c7e050da ]
+
+Maurizio found a race where the abort and cmd stop paths can race as
+follows:
+
+ 1. thread1 runs iscsit_release_commands_from_conn and sets
+ CMD_T_FABRIC_STOP.
+
+ 2. thread2 runs iscsit_aborted_task and then does __iscsit_free_cmd. It
+ then returns from the aborted_task callout and we finish
+ target_handle_abort and do:
+
+ target_handle_abort -> transport_cmd_check_stop_to_fabric ->
+ lio_check_stop_free -> target_put_sess_cmd
+
+ The cmd is now freed.
+
+ 3. thread1 now finishes iscsit_release_commands_from_conn and runs
+ iscsit_free_cmd while accessing a command we just released.
+
+In __target_check_io_state we check for CMD_T_FABRIC_STOP and set the
+CMD_T_ABORTED if the driver is not cleaning up the cmd because of a session
+shutdown. However, iscsit_release_commands_from_conn only sets the
+CMD_T_FABRIC_STOP and does not check to see if the abort path has claimed
+completion ownership of the command.
+
+This adds a check in iscsit_release_commands_from_conn so only the abort or
+fabric stop path cleanup the command.
+
+Link: https://lore.kernel.org/r/1605318378-9269-1-git-send-email-michael.christie@oracle.com
+Reported-by: Maurizio Lombardi <mlombard@redhat.com>
+Reviewed-by: Maurizio Lombardi <mlombard@redhat.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index cbb4414edd71b..c48aca1360c89 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -493,8 +493,7 @@ static void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
+
+ spin_lock_bh(&conn->cmd_lock);
+- if (!list_empty(&cmd->i_conn_node) &&
+- !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
++ if (!list_empty(&cmd->i_conn_node))
+ list_del_init(&cmd->i_conn_node);
+ spin_unlock_bh(&conn->cmd_lock);
+
+@@ -4228,12 +4227,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ spin_lock_bh(&conn->cmd_lock);
+ list_splice_init(&conn->conn_cmd_list, &tmp_list);
+
+- list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+ if (se_cmd->se_tfo != NULL) {
+ spin_lock_irq(&se_cmd->t_state_lock);
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ /*
++ * LIO's abort path owns the cleanup for this,
++ * so put it back on the list and let
++ * aborted_task handle it.
++ */
++ list_move_tail(&cmd->i_conn_node,
++ &conn->conn_cmd_list);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++ }
+ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From 0716d918f38f6aa699df9b3032373c52e7a250e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 14:29:16 +0800
+Subject: scsi: ufs: Fix race between shutdown and runtime resume flow
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit e92643db514803c2c87d72caf5950b4c0a8faf4a ]
+
+If UFS host device is in runtime-suspended state while UFS shutdown
+callback is invoked, UFS device shall be resumed for register
+accesses. Currently only UFS local runtime resume function will be invoked
+to wake up the host. This is not enough because if someone triggers
+runtime resume from block layer, then race may happen between shutdown and
+runtime resume flow, and finally lead to unlocked register access.
+
+To fix this, in ufshcd_shutdown(), use pm_runtime_get_sync() instead of
+resuming UFS device by ufshcd_runtime_resume() "internally" to let runtime
+PM framework manage the whole resume flow.
+
+Link: https://lore.kernel.org/r/20201119062916.12931-1-stanley.chu@mediatek.com
+Fixes: 57d104c153d3 ("ufs: add UFS power management support")
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index d7a0a64f64536..e37f6db0dd156 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -5387,11 +5387,7 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ goto out;
+
+- if (pm_runtime_suspended(hba->dev)) {
+- ret = ufshcd_runtime_resume(hba);
+- if (ret)
+- goto out;
+- }
++ pm_runtime_get_sync(hba->dev);
+
+ ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM);
+ out:
+--
+2.27.0
+
btrfs-inode-verify-inode-mode-to-avoid-null-pointer-dereference.patch
kvm-x86-fix-split-irqchip-vs-interrupt-injection-window-request.patch
i2c-imx-fix-reset-of-i2sr_ial-flag.patch
+hid-cypress-support-varmilo-keyboards-media-hotkeys.patch
+input-i8042-allow-insmod-to-succeed-on-devices-witho.patch
+hid-hid-sensor-hub-fix-issue-with-devices-with-no-re.patch
+x86-xen-don-t-unbind-uninitialized-lock_kicker_irq.patch
+proc-don-t-allow-async-path-resolution-of-proc-self-.patch
+dmaengine-pl330-_prep_dma_memcpy-fix-wrong-burst-siz.patch
+scsi-libiscsi-fix-nop-race-condition.patch
+scsi-target-iscsi-fix-cmd-abort-fabric-stop-race.patch
+scsi-ufs-fix-race-between-shutdown-and-runtime-resum.patch
+bnxt_en-fix-error-return-code-in-bnxt_init_board.patch
+video-hyperv_fb-fix-the-cache-type-when-mapping-the-.patch
+bnxt_en-release-pci-regions-when-dma-mask-setup-fail.patch
+ib-mthca-fix-return-value-of-error-branch-in-mthca_i.patch
+nfc-s3fwrn5-use-signed-integer-for-parsing-gpio-numb.patch
+efivarfs-revert-fix-memory-leak-in-efivarfs_create.patch
+perf-probe-fix-to-die_entrypc-returns-error-correctl.patch
--- /dev/null
+From 9d6364e63754f8054b164612ef459a2ae125c370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 16:03:05 -0800
+Subject: video: hyperv_fb: Fix the cache type when mapping the VRAM
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 5f1251a48c17b54939d7477305e39679a565382c ]
+
+x86 Hyper-V used to essentially always overwrite the effective cache type
+of guest memory accesses to WB. This was problematic in cases where there
+is a physical device assigned to the VM, since that often requires that
+the VM should have control over cache types. Thus, on newer Hyper-V since
+2018, Hyper-V always honors the VM's cache type, but unexpectedly Linux VM
+users start to complain that Linux VM's VRAM becomes very slow, and it
+turns out that Linux VM should not map the VRAM uncacheable by ioremap().
+Fix this slowness issue by using ioremap_cache().
+
+On ARM64, ioremap_cache() is also required as the host also maps the VRAM
+cacheable, otherwise VM Connect can't display properly with ioremap() or
+ioremap_wc().
+
+With this change, the VRAM on new Hyper-V is as fast as regular RAM, so
+it's no longer necessary to use the hacks we added to mitigate the
+slowness, i.e. we no longer need to allocate physical memory and use
+it to back up the VRAM in Generation-1 VM, and we also no longer need to
+allocate physical memory to back up the framebuffer in a Generation-2 VM
+and copy the framebuffer to the real VRAM. A further big change will
+address these for v5.11.
+
+Fixes: 68a2d20b79b1 ("drivers/video: add Hyper-V Synthetic Video Frame Buffer Driver")
+Tested-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Link: https://lore.kernel.org/r/20201118000305.24797-1-decui@microsoft.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/hyperv_fb.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index e2451bdb4525d..299412abb1658 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ goto err1;
+ }
+
+- fb_virt = ioremap(par->mem->start, screen_fb_size);
++ /*
++ * Map the VRAM cacheable for performance. This is also required for
++ * VM Connect to display properly for ARM64 Linux VM, as the host also
++ * maps the VRAM cacheable.
++ */
++ fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+ if (!fb_virt)
+ goto err2;
+
+--
+2.27.0
+
--- /dev/null
+From 671668f0ff0aec89bfc81b7ad9717b7f7410ae76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 20:11:19 -0500
+Subject: x86/xen: don't unbind uninitialized lock_kicker_irq
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 65cae18882f943215d0505ddc7e70495877308e6 ]
+
+When booting a hyperthreaded system with the kernel parameter
+'mitigations=auto,nosmt', the following warning occurs:
+
+ WARNING: CPU: 0 PID: 1 at drivers/xen/events/events_base.c:1112 unbind_from_irqhandler+0x4e/0x60
+ ...
+ Hardware name: Xen HVM domU, BIOS 4.2.amazon 08/24/2006
+ ...
+ Call Trace:
+ xen_uninit_lock_cpu+0x28/0x62
+ xen_hvm_cpu_die+0x21/0x30
+ takedown_cpu+0x9c/0xe0
+ ? trace_suspend_resume+0x60/0x60
+ cpuhp_invoke_callback+0x9a/0x530
+ _cpu_up+0x11a/0x130
+ cpu_up+0x7e/0xc0
+ bringup_nonboot_cpus+0x48/0x50
+ smp_init+0x26/0x79
+ kernel_init_freeable+0xea/0x229
+ ? rest_init+0xaa/0xaa
+ kernel_init+0xa/0x106
+ ret_from_fork+0x35/0x40
+
+The secondary CPUs are not activated with the nosmt mitigations and only
+the primary thread on each CPU core is used. In this situation,
+xen_hvm_smp_prepare_cpus(), and more importantly xen_init_lock_cpu(), is
+not called, so the lock_kicker_irq is not initialized for the secondary
+CPUs. Let's fix this by exiting early in xen_uninit_lock_cpu() if the
+irq is not set to avoid the warning from above for each secondary CPU.
+
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Link: https://lore.kernel.org/r/20201107011119.631442-1-bmasney@redhat.com
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/spinlock.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 85872a08994a1..e9fc0f7df0da8 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -301,10 +301,20 @@ void xen_init_lock_cpu(int cpu)
+
+ void xen_uninit_lock_cpu(int cpu)
+ {
++ int irq;
++
+ if (!xen_pvspin)
+ return;
+
+- unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
++ /*
++ * When booting the kernel with 'mitigations=auto,nosmt', the secondary
++ * CPUs are not activated, and lock_kicker_irq is not initialized.
++ */
++ irq = per_cpu(lock_kicker_irq, cpu);
++ if (irq == -1)
++ return;
++
++ unbind_from_irqhandler(irq, NULL);
+ per_cpu(lock_kicker_irq, cpu) = -1;
+ kfree(per_cpu(irq_name, cpu));
+ per_cpu(irq_name, cpu) = NULL;
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
