[openchrome-devel] drm-openchrome: Branch 'drm-next-5.9' - 654 commits - arch/arm64/boot arch/arm64/include arch/arm64/kernel arch/arm64/kvm arch/arm64/Makefile arch/arm/boot arch/arm/include arch/arm/kernel arch/arm/mm arch/parisc/include arch/parisc/lib arch/powerpc/kernel arch/powerpc/mm arch/powerpc/perf arch/riscv/mm arch/s390/kernel arch/sh/include arch/sh/kernel arch/x86/include arch/x86/kernel arch/x86/kvm arch/xtensa/include Documentation/ABI/testing Documentation/devicetree/bindings Documentation/driver-api/ptp.rst Documentation/networking/bareudp.rst Documentation/networking/devlink drivers/android/binder_alloc.c drivers/atm/atmtcp.c drivers/base/property.c drivers/bus/ti-sysc.c drivers/char/mem.c drivers/char/random.c drivers/clocksource/timer-ti-dm-systimer.c drivers/crypto/chelsio drivers/firmware/efi drivers/firmware/qemu_fw_cfg.c drivers/fpga/dfl-afu-main.c drivers/fpga/dfl-pci.c drivers/gpu/drm drivers/gpu/vga drivers/i2c/busses drivers/i2c/i2c-core-slave.c drivers/infiniband/ core drivers/infiniband/hw drivers/infiniband/sw drivers/interconnect/core.c drivers/interconnect/qcom drivers/iommu/qcom_iommu.c drivers/md/dm.c drivers/md/dm-integrity.c drivers/misc/habanalabs drivers/mmc/host drivers/net/bareudp.c drivers/net/bonding drivers/net/dsa drivers/net/ethernet drivers/net/geneve.c drivers/net/hippi drivers/net/ieee802154 drivers/net/netdevsim drivers/net/phy drivers/net/usb drivers/net/vxlan.c drivers/net/wan drivers/net/wireless drivers/net/xen-netfront.c drivers/nfc/s3fwrn5 drivers/nvme/host drivers/pci/pci.c drivers/pci/quirks.c drivers/pinctrl/qcom drivers/scsi/scsi_lib.c drivers/staging/comedi drivers/staging/media drivers/staging/wlan-ng drivers/tty/serial drivers/tty/vt drivers/usb/host drivers/vfio/pci drivers/vhost/scsi.c drivers/video/fbdev drivers/virtio/Kconfig drivers/virtio/virtio_balloon.c drivers/virtio/virtio_mmio.c fs/btrfs/backref.c fs/btrfs/extent_io.c fs/btrfs/inode.c fs/btrfs/volumes.c fs/cifs/inode.c fs/efivarfs/super.c fs/exfat/ dir.c fs/exfat/exfat_fs.h fs/exfat/file.c fs/exfat/nls.c fs/io_uring.c fs/nfsd/nfs4state.c fs/squashfs/block.c fs/zonefs/super.c include/asm-generic/io.h include/asm-generic/vmlinux.lds.h include/drm/drm_mode_config.h include/linux/device-mapper.h include/linux/efi.h include/linux/fb.h include/linux/i2c.h include/linux/io-mapping.h include/linux/mlx5 include/linux/random.h include/linux/rhashtable.h include/linux/tcp.h include/linux/vgaarb.h include/linux/xattr.h include/net/addrconf.h include/net/devlink.h include/net/flow_offload.h include/net/xfrm.h include/rdma/rdmavt_qp.h include/sound/rt5670.h include/sound/soc-dai.h include/sound/soc.h include/uapi/drm kernel/audit.c kernel/audit.h kernel/auditsc.c kernel/bpf/btf.c kernel/bpf/hashtab.c kernel/events/uprobes.c kernel/sched/core.c kernel/signal.c kernel/time/timer.c lib/random32.c lib/rhashtable.c .mailmap MAINTAINERS Makefile mm/hugetlb.c mm/khugepaged.c mm/memcontrol.c mm/memory.c mm/mmap.c mm/shmem.c mm/slab_common.c net/9p/ trans_fd.c net/ax25/af_ax25.c net/bluetooth/hci_event.c net/bpfilter/bpfilter_kern.c net/compat.c net/core/dev.c net/core/devlink.c net/core/flow_offload.c net/core/net-sysfs.c net/core/rtnetlink.c net/core/sock_reuseport.c net/hsr/hsr_forward.c net/hsr/hsr_framereg.c net/ipv4/fib_trie.c net/ipv4/tcp_input.c net/ipv4/tcp_output.c net/ipv4/udp.c net/ipv6/anycast.c net/ipv6/esp6.c net/ipv6/ip6_gre.c net/ipv6/ipv6_sockglue.c net/ipv6/route.c net/ipv6/udp.c net/key/af_key.c net/mac80211/cfg.c net/mac80211/mesh.c net/mac80211/mesh_pathtbl.c net/mac80211/sta_info.c net/mac80211/tx.c net/mac80211/util.c net/mptcp/protocol.c net/netfilter/ipvs net/netfilter/nf_tables_api.c net/nfc/nci net/qrtr/qrtr.c net/rds/recv.c net/rxrpc/call_object.c net/rxrpc/conn_object.c net/rxrpc/recvmsg.c net/rxrpc/sendmsg.c net/sched/act_ct.c net/sched/cls_api.c net/sctp/stream.c net/smc/af_smc.c net/smc/smc_cdc.c net/smc/smc_core.c net/smc/smc_core.h net/smc/smc_ib.c net/smc/smc_ib.h net/smc/smc_llc.c net/smc/sm c_llc.h net/tipc/link.c net/vmw_vsock/virtio_transport.c net/wireless/nl80211.c net/xfrm/espintcp.c net/xfrm/xfrm_policy.c net/xfrm/xfrm_user.c scripts/decode_stacktrace.sh scripts/gdb/linux scripts/kconfig/.gitignore scripts/kconfig/Makefile scripts/kconfig/qconf.cc scripts/kconfig/qconf.h scripts/Makefile.modpost scripts/mod/modpost.c sound/core/info.c sound/pci/hda sound/soc/amd sound/soc/codecs sound/soc/generic sound/soc/intel sound/soc/qcom sound/soc/rockchip sound/soc/soc-core.c sound/soc/soc-dai.c sound/soc/soc-devres.c sound/soc/soc-generic-dmaengine-pcm.c sound/soc/soc-topology.c sound/soc/sof sound/usb/pcm.c tools/lib/traceevent tools/perf/arch tools/perf/pmu-events tools/perf/tests tools/testing/selftests

Kevin Brace kevinbrace at kemper.freedesktop.org
Thu Aug 13 02:13:49 UTC 2020


 .mailmap                                                                      |    3 
 Documentation/ABI/testing/debugfs-driver-habanalabs                           |   11 
 Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml |    3 
 Documentation/devicetree/bindings/sound/simple-card.yaml                      |   17 
 Documentation/driver-api/ptp.rst                                              |   12 
 Documentation/networking/bareudp.rst                                          |   24 
 Documentation/networking/devlink/devlink-trap.rst                             |    4 
 MAINTAINERS                                                                   |   28 
 Makefile                                                                      |    6 
 arch/arm/boot/dts/armada-38x.dtsi                                             |    3 
 arch/arm/boot/dts/imx6qdl-icore.dtsi                                          |    3 
 arch/arm/boot/dts/imx6sx-sabreauto.dts                                        |    2 
 arch/arm/boot/dts/imx6sx-sdb.dtsi                                             |    2 
 arch/arm/boot/dts/keystone-k2g-evm.dts                                        |    2 
 arch/arm/boot/dts/sun4i-a10.dtsi                                              |    2 
 arch/arm/boot/dts/sun5i.dtsi                                                  |    2 
 arch/arm/boot/dts/sun7i-a20.dtsi                                              |    2 
 arch/arm/include/asm/percpu.h                                                 |    2 
 arch/arm/kernel/hw_breakpoint.c                                               |   27 
 arch/arm/kernel/vdso.c                                                        |    1 
 arch/arm/mm/mmu.c                                                             |    2 
 arch/arm64/Makefile                                                           |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi                                  |    1 
 arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts                    |    5 
 arch/arm64/include/asm/alternative.h                                          |    4 
 arch/arm64/include/asm/checksum.h                                             |    5 
 arch/arm64/include/asm/kvm_host.h                                             |   11 
 arch/arm64/include/asm/smp.h                                                  |    1 
 arch/arm64/kernel/vdso32/Makefile                                             |    2 
 arch/arm64/kvm/mmu.c                                                          |   11 
 arch/parisc/include/asm/atomic.h                                              |    2 
 arch/parisc/include/asm/cmpxchg.h                                             |    2 
 arch/parisc/lib/bitops.c                                                      |   12 
 arch/powerpc/kernel/exceptions-64s.S                                          |   14 
 arch/powerpc/mm/book3s64/hash_utils.c                                         |   25 
 arch/powerpc/perf/core-book3s.c                                               |    6 
 arch/riscv/mm/init.c                                                          |   66 -
 arch/riscv/mm/kasan_init.c                                                    |    4 
 arch/s390/kernel/perf_cpum_cf_events.c                                        |    4 
 arch/sh/include/asm/pgalloc.h                                                 |   10 
 arch/sh/kernel/entry-common.S                                                 |    6 
 arch/x86/include/asm/iosf_mbi.h                                               |    1 
 arch/x86/kernel/dumpstack.c                                                   |   27 
 arch/x86/kernel/fpu/xstate.c                                                  |    2 
 arch/x86/kernel/i8259.c                                                       |    2 
 arch/x86/kernel/stacktrace.c                                                  |    5 
 arch/x86/kernel/unwind_orc.c                                                  |    8 
 arch/x86/kernel/vmlinux.lds.S                                                 |    1 
 arch/x86/kvm/lapic.c                                                          |    2 
 arch/x86/kvm/svm/svm.c                                                        |    9 
 arch/x86/kvm/vmx/nested.c                                                     |   16 
 arch/x86/kvm/vmx/nested.h                                                     |    5 
 arch/xtensa/include/asm/checksum.h                                            |    2 
 drivers/android/binder_alloc.c                                                |    2 
 drivers/atm/atmtcp.c                                                          |   10 
 drivers/base/property.c                                                       |    2 
 drivers/bus/ti-sysc.c                                                         |   22 
 drivers/char/mem.c                                                            |   10 
 drivers/char/random.c                                                         |    1 
 drivers/clocksource/timer-ti-dm-systimer.c                                    |   46 
 drivers/crypto/chelsio/chtls/chtls_cm.c                                       |    2 
 drivers/crypto/chelsio/chtls/chtls_io.c                                       |    7 
 drivers/firmware/efi/efi-pstore.c                                             |    5 
 drivers/firmware/efi/efi.c                                                    |   12 
 drivers/firmware/efi/efivars.c                                                |    5 
 drivers/firmware/efi/libstub/Makefile                                         |    3 
 drivers/firmware/efi/libstub/alignedmem.c                                     |    2 
 drivers/firmware/efi/libstub/efi-stub.c                                       |   17 
 drivers/firmware/efi/libstub/efistub.h                                        |   16 
 drivers/firmware/efi/libstub/x86-stub.c                                       |    8 
 drivers/firmware/efi/vars.c                                                   |    6 
 drivers/firmware/qemu_fw_cfg.c                                                |    7 
 drivers/fpga/dfl-afu-main.c                                                   |    3 
 drivers/fpga/dfl-pci.c                                                        |    3 
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c                                    |    4 
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c                                       |    3 
 drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c                                        |    6 
 drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c                                       |   37 
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c                                       |    5 
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c                                        |    7 
 drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c                                        |    9 
 drivers/gpu/drm/amd/amdgpu/nv.c                                               |   56 -
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c                                         |    2 
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c                             |   66 +
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c                     |   11 
 drivers/gpu/drm/amd/display/dc/bios/bios_parser.c                             |    2 
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c                            |   81 +
 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c                    |   69 +
 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c                  |    7 
 drivers/gpu/drm/amd/display/dc/core/dc.c                                      |   18 
 drivers/gpu/drm/amd/display/dc/core/dc_link.c                                 |   12 
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c                              |   65 -
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c                               |   18 
 drivers/gpu/drm/amd/display/dc/dc_bios_types.h                                |    4 
 drivers/gpu/drm/amd/display/dc/dc_stream.h                                    |    4 
 drivers/gpu/drm/amd/display/dc/dc_types.h                                     |   14 
 drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h                         |    4 
 drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c                                 |    2 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c                     |    4 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h                     |   10 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c                              |    2 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c                            |   27 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.h                            |    5 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_init.c                             |    3 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c                     |   14 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.h                     |    5 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c                         |   53 
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_init.c                             |    3 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c                 |   53 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h                 |    2 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_init.c                             |    5 
 drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c                         |   17 
 drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h                         |    7 
 drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h                      |    3 
 drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h                                   |    2 
 drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h                             |    5 
 drivers/gpu/drm/amd/display/include/link_service_types.h                      |    2 
 drivers/gpu/drm/amd/display/modules/freesync/freesync.c                       |    5 
 drivers/gpu/drm/amd/include/atomfirmware.h                                    |   54 -
 drivers/gpu/drm/amd/powerplay/amdgpu_smu.c                                    |  144 ++
 drivers/gpu/drm/amd/powerplay/arcturus_ppt.c                                  |   18 
 drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h                                |    6 
 drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if_sienna_cichlid.h            |   21 
 drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h                                 |    4 
 drivers/gpu/drm/amd/powerplay/navi10_ppt.c                                    |   22 
 drivers/gpu/drm/amd/powerplay/renoir_ppt.c                                    |    8 
 drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c                            |  103 -
 drivers/gpu/drm/amd/powerplay/smu_cmn.c                                       |   10 
 drivers/gpu/drm/amd/powerplay/smu_internal.h                                  |    3 
 drivers/gpu/drm/amd/powerplay/smu_v11_0.c                                     |    1 
 drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c                              |    5 
 drivers/gpu/drm/bochs/bochs_kms.c                                             |    1 
 drivers/gpu/drm/bridge/adv7511/adv7511_drv.c                                  |    1 
 drivers/gpu/drm/bridge/nwl-dsi.c                                              |    5 
 drivers/gpu/drm/drm_dp_mst_topology.c                                         |    7 
 drivers/gpu/drm/drm_drv.c                                                     |    3 
 drivers/gpu/drm/drm_fb_helper.c                                               |    6 
 drivers/gpu/drm/drm_gem.c                                                     |    7 
 drivers/gpu/drm/drm_mipi_dbi.c                                                |    2 
 drivers/gpu/drm/drm_of.c                                                      |    4 
 drivers/gpu/drm/drm_panel_orientation_quirks.c                                |    6 
 drivers/gpu/drm/lima/lima_pp.c                                                |    2 
 drivers/gpu/drm/mcde/mcde_display.c                                           |   11 
 drivers/gpu/drm/nouveau/dispnv50/disp.c                                       |    4 
 drivers/gpu/drm/nouveau/nouveau_display.c                                     |   27 
 drivers/gpu/drm/nouveau/nouveau_fbcon.c                                       |    3 
 drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c                               |   30 
 drivers/gpu/drm/omapdrm/dss/dispc.c                                           |    1 
 drivers/gpu/drm/omapdrm/dss/dsi.c                                             |    1 
 drivers/gpu/drm/omapdrm/dss/dss.c                                             |    1 
 drivers/gpu/drm/omapdrm/dss/venc.c                                            |    1 
 drivers/gpu/drm/omapdrm/omap_connector.c                                      |    2 
 drivers/gpu/drm/openchrome/openchrome_drv.h                                   |    4 
 drivers/gpu/drm/openchrome/openchrome_ioctl.c                                 |   16 
 drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c                                |    6 
 drivers/gpu/drm/panel/panel-simple.c                                          |   16 
 drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c                                        |    2 
 drivers/gpu/drm/tidss/tidss_kms.c                                             |    2 
 drivers/gpu/drm/ttm/ttm_bo.c                                                  |   37 
 drivers/gpu/drm/ttm/ttm_bo_util.c                                             |    7 
 drivers/gpu/drm/ttm/ttm_bo_vm.c                                               |    9 
 drivers/gpu/drm/ttm/ttm_tt.c                                                  |    4 
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c                                       |    2 
 drivers/gpu/drm/vmwgfx/vmwgfx_kms.c                                           |   10 
 drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c                                           |   13 
 drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c                                          |    9 
 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c                                          |    9 
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c                                       |    2 
 drivers/gpu/drm/xlnx/zynqmp_dp.c                                              |   33 
 drivers/gpu/vga/vgaarb.c                                                      |    3 
 drivers/i2c/busses/i2c-cadence.c                                              |   28 
 drivers/i2c/busses/i2c-qcom-geni.c                                            |    6 
 drivers/i2c/busses/i2c-rcar.c                                                 |    3 
 drivers/i2c/i2c-core-slave.c                                                  |    7 
 drivers/infiniband/core/cm.c                                                  |    2 
 drivers/infiniband/core/cq.c                                                  |   14 
 drivers/infiniband/core/rdma_core.c                                           |    6 
 drivers/infiniband/core/ucma.c                                                |    4 
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c                                    |   34 
 drivers/infiniband/hw/hns/hns_roce_mr.c                                       |    2 
 drivers/infiniband/hw/mlx5/odp.c                                              |   27 
 drivers/infiniband/hw/mlx5/qp.c                                               |   29 
 drivers/infiniband/hw/mlx5/srq_cmd.c                                          |    4 
 drivers/infiniband/sw/rdmavt/qp.c                                             |   33 
 drivers/infiniband/sw/rdmavt/rc.c                                             |    4 
 drivers/interconnect/core.c                                                   |   12 
 drivers/interconnect/qcom/msm8916.c                                           |   14 
 drivers/iommu/qcom_iommu.c                                                    |   37 
 drivers/md/dm-integrity.c                                                     |    4 
 drivers/md/dm.c                                                               |   17 
 drivers/misc/habanalabs/command_submission.c                                  |   14 
 drivers/misc/habanalabs/debugfs.c                                             |   23 
 drivers/misc/habanalabs/device.c                                              |    2 
 drivers/misc/habanalabs/firmware_if.c                                         |   10 
 drivers/misc/habanalabs/gaudi/gaudi.c                                         |  123 +-
 drivers/misc/habanalabs/goya/goya.c                                           |   20 
 drivers/misc/habanalabs/habanalabs.h                                          |   19 
 drivers/misc/habanalabs/habanalabs_drv.c                                      |    2 
 drivers/misc/habanalabs/hwmon.c                                               |   19 
 drivers/misc/habanalabs/sysfs.c                                               |   11 
 drivers/mmc/host/sdhci-of-aspeed.c                                            |    2 
 drivers/net/bareudp.c                                                         |   29 
 drivers/net/bonding/bond_main.c                                               |   10 
 drivers/net/bonding/bond_netlink.c                                            |    3 
 drivers/net/dsa/microchip/ksz9477.c                                           |   42 
 drivers/net/dsa/microchip/ksz_common.c                                        |    2 
 drivers/net/dsa/microchip/ksz_common.h                                        |    2 
 drivers/net/dsa/mv88e6xxx/chip.c                                              |   22 
 drivers/net/dsa/mv88e6xxx/chip.h                                              |    1 
 drivers/net/ethernet/aquantia/atlantic/aq_hw.h                                |    1 
 drivers/net/ethernet/aquantia/atlantic/aq_nic.c                               |    9 
 drivers/net/ethernet/aquantia/atlantic/aq_nic.h                               |    2 
 drivers/net/ethernet/aquantia/atlantic/aq_phy.c                               |   29 
 drivers/net/ethernet/aquantia/atlantic/aq_phy.h                               |    8 
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c                     |   26 
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.h                     |   10 
 drivers/net/ethernet/atheros/ag71xx.c                                         |    3 
 drivers/net/ethernet/broadcom/bnxt/bnxt.c                                     |   22 
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c                             |    5 
 drivers/net/ethernet/broadcom/genet/bcmgenet.c                                |  144 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.h                                |    1 
 drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c                            |   22 
 drivers/net/ethernet/cadence/macb_main.c                                      |    2 
 drivers/net/ethernet/chelsio/cxgb4/sge.c                                      |    1 
 drivers/net/ethernet/cortina/gemini.c                                         |    5 
 drivers/net/ethernet/freescale/dpaa/dpaa_eth.c                                |    2 
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c                              |    2 
 drivers/net/ethernet/freescale/enetc/enetc_pf.c                               |    1 
 drivers/net/ethernet/freescale/fec.h                                          |    1 
 drivers/net/ethernet/freescale/fec_main.c                                     |   23 
 drivers/net/ethernet/freescale/fec_ptp.c                                      |   12 
 drivers/net/ethernet/freescale/gianfar.c                                      |    6 
 drivers/net/ethernet/hisilicon/hns3/hnae3.h                                   |    1 
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c                               |   42 
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h                               |    2 
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c                       |   84 -
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h                       |    3 
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c                     |   38 
 drivers/net/ethernet/ibm/ibmvnic.c                                            |    2 
 drivers/net/ethernet/intel/e1000e/ich8lan.c                                   |    4 
 drivers/net/ethernet/intel/igb/igb_main.c                                     |    9 
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c                          |    3 
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c                          |    2 
 drivers/net/ethernet/mediatek/mtk_eth_soc.c                                   |   21 
 drivers/net/ethernet/mellanox/mlx4/main.c                                     |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c                         |    7 
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c                           |   30 
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c                    |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gre.c                       |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c                     |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c                             |   31 
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.c                              |    3 
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c                               |    1 
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c                             |   27 
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h                             |    2 
 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c                    |   19 
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c                             |   28 
 drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c                           |   78 +
 drivers/net/ethernet/mellanox/mlxsw/core.c                                    |   11 
 drivers/net/ethernet/mellanox/mlxsw/core_env.c                                |   48 
 drivers/net/ethernet/mellanox/mlxsw/reg.h                                     |    1 
 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c                         |   59 -
 drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c                           |   14 
 drivers/net/ethernet/mscc/ocelot.c                                            |   10 
 drivers/net/ethernet/neterion/vxge/vxge-main.c                                |    2 
 drivers/net/ethernet/ni/nixge.c                                               |    8 
 drivers/net/ethernet/pensando/ionic/ionic_ethtool.c                           |    7 
 drivers/net/ethernet/pensando/ionic/ionic_lif.c                               |   46 
 drivers/net/ethernet/pensando/ionic/ionic_lif.h                               |    8 
 drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c                         |   29 
 drivers/net/ethernet/pensando/ionic/ionic_txrx.c                              |    6 
 drivers/net/ethernet/qlogic/qed/qed_cxt.c                                     |    4 
 drivers/net/ethernet/qlogic/qed/qed_dev.c                                     |    2 
 drivers/net/ethernet/qlogic/qed/qed_int.c                                     |   53 
 drivers/net/ethernet/qlogic/qed/qed_int.h                                     |    4 
 drivers/net/ethernet/renesas/ravb_main.c                                      |   26 
 drivers/net/ethernet/smsc/smc91x.c                                            |    4 
 drivers/net/ethernet/socionext/sni_ave.c                                      |    2 
 drivers/net/ethernet/ti/am65-cpsw-nuss.c                                      |    3 
 drivers/net/geneve.c                                                          |    2 
 drivers/net/hippi/rrunner.c                                                   |    2 
 drivers/net/ieee802154/adf7242.c                                              |    6 
 drivers/net/netdevsim/netdev.c                                                |    4 
 drivers/net/phy/dp83640.c                                                     |    4 
 drivers/net/usb/ax88172a.c                                                    |    1 
 drivers/net/usb/hso.c                                                         |   10 
 drivers/net/usb/lan78xx.c                                                     |  113 --
 drivers/net/vxlan.c                                                           |   16 
 drivers/net/wan/hdlc_x25.c                                                    |    4 
 drivers/net/wan/lapbether.c                                                   |    8 
 drivers/net/wan/x25_asy.c                                                     |   21 
 drivers/net/wireless/ath/ath10k/ahb.c                                         |    2 
 drivers/net/wireless/ath/ath10k/pci.c                                         |   78 -
 drivers/net/wireless/ath/ath9k/hif_usb.c                                      |    4 
 drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c                              |   16 
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c                                  |    8 
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c                                 |    2 
 drivers/net/wireless/mediatek/mt76/mt76.h                                     |    1 
 drivers/net/wireless/mediatek/mt76/mt7603/main.c                              |    2 
 drivers/net/wireless/mediatek/mt76/mt7615/debugfs.c                           |    9 
 drivers/net/wireless/mediatek/mt76/mt7615/dma.c                               |    9 
 drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c                            |    3 
 drivers/net/wireless/mediatek/mt76/mt7615/eeprom.h                            |    2 
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c                               |   20 
 drivers/net/wireless/mediatek/mt76/mt7615/mac.h                               |   15 
 drivers/net/wireless/mediatek/mt76/mt7615/main.c                              |    4 
 drivers/net/wireless/mediatek/mt76/mt7615/mmio.c                              |    2 
 drivers/net/wireless/mediatek/mt76/mt7615/mt7615.h                            |   30 
 drivers/net/wireless/mediatek/mt76/mt7615/usb.c                               |   13 
 drivers/net/wireless/mediatek/mt76/mt76x02_mmio.c                             |    5 
 drivers/net/wireless/mediatek/mt76/mt7915/main.c                              |    3 
 drivers/net/wireless/mediatek/mt76/tx.c                                       |    7 
 drivers/net/wireless/mediatek/mt76/usb.c                                      |   39 
 drivers/net/xen-netfront.c                                                    |   64 -
 drivers/nfc/s3fwrn5/core.c                                                    |    1 
 drivers/nvme/host/core.c                                                      |   15 
 drivers/nvme/host/nvme.h                                                      |    7 
 drivers/nvme/host/pci.c                                                       |    4 
 drivers/nvme/host/tcp.c                                                       |    3 
 drivers/pci/pci.c                                                             |   30 
 drivers/pci/quirks.c                                                          |   13 
 drivers/pinctrl/qcom/Kconfig                                                  |    2 
 drivers/pinctrl/qcom/pinctrl-msm.c                                            |   74 +
 drivers/pinctrl/qcom/pinctrl-msm.h                                            |    4 
 drivers/pinctrl/qcom/pinctrl-sc7180.c                                         |    1 
 drivers/scsi/scsi_lib.c                                                       |   16 
 drivers/staging/comedi/drivers/addi_apci_1032.c                               |   20 
 drivers/staging/comedi/drivers/addi_apci_1500.c                               |   24 
 drivers/staging/comedi/drivers/addi_apci_1564.c                               |   20 
 drivers/staging/comedi/drivers/ni_6527.c                                      |    2 
 drivers/staging/media/atomisp/Kconfig                                         |    2 
 drivers/staging/media/atomisp/Makefile                                        |    6 
 drivers/staging/media/atomisp/i2c/atomisp-ov2680.c                            |    6 
 drivers/staging/media/atomisp/i2c/ov5693/atomisp-ov5693.c                     |    6 
 drivers/staging/media/atomisp/include/linux/atomisp_platform.h                |    1 
 drivers/staging/media/atomisp/pci/atomisp-regs.h                              |    3 
 drivers/staging/media/atomisp/pci/atomisp_acc.c                               |    4 
 drivers/staging/media/atomisp/pci/atomisp_cmd.c                               |   59 -
 drivers/staging/media/atomisp/pci/atomisp_cmd.h                               |    4 
 drivers/staging/media/atomisp/pci/atomisp_compat.h                            |    2 
 drivers/staging/media/atomisp/pci/atomisp_compat_css20.c                      |   70 -
 drivers/staging/media/atomisp/pci/atomisp_compat_css20.h                      |    2 
 drivers/staging/media/atomisp/pci/atomisp_drvfs.c                             |   14 
 drivers/staging/media/atomisp/pci/atomisp_drvfs.h                             |    2 
 drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c                     |  537 ++++++----
 drivers/staging/media/atomisp/pci/atomisp_internal.h                          |    2 
 drivers/staging/media/atomisp/pci/atomisp_ioctl.c                             |   19 
 drivers/staging/media/atomisp/pci/atomisp_v4l2.c                              |  285 ++---
 drivers/staging/media/atomisp/pci/base/refcount/src/refcount.c                |   28 
 drivers/staging/media/atomisp/pci/hive_types.h                                |   24 
 drivers/staging/media/atomisp/pci/hmm/hmm.c                                   |   10 
 drivers/staging/media/atomisp/pci/isp2400_system_global.h                     |  302 -----
 drivers/staging/media/atomisp/pci/isp2400_system_local.h                      |  321 -----
 drivers/staging/media/atomisp/pci/isp2401_system_global.h                     |  410 -------
 drivers/staging/media/atomisp/pci/isp2401_system_local.h                      |  402 -------
 drivers/staging/media/atomisp/pci/sh_css.c                                    |    9 
 drivers/staging/media/atomisp/pci/system_global.h                             |  395 +++++++
 drivers/staging/media/atomisp/pci/system_local.c                              |  179 +++
 drivers/staging/media/atomisp/pci/system_local.h                              |  104 +
 drivers/staging/wlan-ng/prism2usb.c                                           |   16 
 drivers/tty/serial/8250/8250_core.c                                           |    2 
 drivers/tty/serial/8250/8250_exar.c                                           |   12 
 drivers/tty/serial/8250/8250_mtk.c                                            |   18 
 drivers/tty/serial/serial-tegra.c                                             |   16 
 drivers/tty/serial/xilinx_uartps.c                                            |    8 
 drivers/tty/vt/vt.c                                                           |   29 
 drivers/usb/host/xhci-mtk-sch.c                                               |    4 
 drivers/usb/host/xhci-pci.c                                                   |    3 
 drivers/usb/host/xhci-tegra.c                                                 |    2 
 drivers/vfio/pci/vfio_pci.c                                                   |    5 
 drivers/vhost/scsi.c                                                          |    2 
 drivers/video/fbdev/core/bitblit.c                                            |    4 
 drivers/video/fbdev/core/fbcon_ccw.c                                          |    4 
 drivers/video/fbdev/core/fbcon_cw.c                                           |    4 
 drivers/video/fbdev/core/fbcon_ud.c                                           |    4 
 drivers/video/fbdev/core/fbmem.c                                              |    8 
 drivers/video/fbdev/core/fbsysfs.c                                            |    4 
 drivers/video/fbdev/ps3fb.c                                                   |    5 
 drivers/virtio/Kconfig                                                        |    2 
 drivers/virtio/virtio_balloon.c                                               |   11 
 drivers/virtio/virtio_mmio.c                                                  |    4 
 fs/btrfs/backref.c                                                            |    1 
 fs/btrfs/extent_io.c                                                          |    3 
 fs/btrfs/inode.c                                                              |   23 
 fs/btrfs/volumes.c                                                            |    8 
 fs/cifs/inode.c                                                               |   10 
 fs/efivarfs/super.c                                                           |    6 
 fs/exfat/dir.c                                                                |    2 
 fs/exfat/exfat_fs.h                                                           |    2 
 fs/exfat/file.c                                                               |    2 
 fs/exfat/nls.c                                                                |    8 
 fs/io_uring.c                                                                 |   68 -
 fs/nfsd/nfs4state.c                                                           |   20 
 fs/squashfs/block.c                                                           |    2 
 fs/zonefs/super.c                                                             |   18 
 include/asm-generic/io.h                                                      |    4 
 include/asm-generic/vmlinux.lds.h                                             |    5 
 include/drm/drm_mode_config.h                                                 |   12 
 include/linux/device-mapper.h                                                 |    1 
 include/linux/efi.h                                                           |    1 
 include/linux/fb.h                                                            |    2 
 include/linux/i2c.h                                                           |    4 
 include/linux/io-mapping.h                                                    |    5 
 include/linux/mlx5/mlx5_ifc.h                                                 |    1 
 include/linux/random.h                                                        |    3 
 include/linux/rhashtable.h                                                    |   71 -
 include/linux/tcp.h                                                           |    6 
 include/linux/vgaarb.h                                                        |    6 
 include/linux/xattr.h                                                         |    3 
 include/net/addrconf.h                                                        |    1 
 include/net/devlink.h                                                         |    3 
 include/net/flow_offload.h                                                    |    1 
 include/net/xfrm.h                                                            |   15 
 include/rdma/rdmavt_qp.h                                                      |   19 
 include/sound/rt5670.h                                                        |    1 
 include/sound/soc-dai.h                                                       |    1 
 include/sound/soc.h                                                           |    2 
 include/uapi/drm/drm_fourcc.h                                                 |    2 
 include/uapi/drm/openchrome_drm.h                                             |    6 
 kernel/audit.c                                                                |    1 
 kernel/audit.h                                                                |    8 
 kernel/auditsc.c                                                              |    3 
 kernel/bpf/btf.c                                                              |    5 
 kernel/bpf/hashtab.c                                                          |   12 
 kernel/events/uprobes.c                                                       |    2 
 kernel/sched/core.c                                                           |   25 
 kernel/signal.c                                                               |    2 
 kernel/time/timer.c                                                           |    8 
 lib/random32.c                                                                |    2 
 lib/rhashtable.c                                                              |   35 
 mm/hugetlb.c                                                                  |   15 
 mm/khugepaged.c                                                               |    3 
 mm/memcontrol.c                                                               |   13 
 mm/memory.c                                                                   |    2 
 mm/mmap.c                                                                     |   16 
 mm/shmem.c                                                                    |    2 
 mm/slab_common.c                                                              |   35 
 net/9p/trans_fd.c                                                             |   39 
 net/ax25/af_ax25.c                                                            |   10 
 net/bluetooth/hci_event.c                                                     |   26 
 net/bpfilter/bpfilter_kern.c                                                  |    2 
 net/compat.c                                                                  |    2 
 net/core/dev.c                                                                |    2 
 net/core/devlink.c                                                            |   25 
 net/core/flow_offload.c                                                       |    1 
 net/core/net-sysfs.c                                                          |    2 
 net/core/rtnetlink.c                                                          |    3 
 net/core/sock_reuseport.c                                                     |    1 
 net/hsr/hsr_forward.c                                                         |   18 
 net/hsr/hsr_framereg.c                                                        |    3 
 net/ipv4/fib_trie.c                                                           |    2 
 net/ipv4/tcp_input.c                                                          |   11 
 net/ipv4/tcp_output.c                                                         |   13 
 net/ipv4/udp.c                                                                |   17 
 net/ipv6/anycast.c                                                            |   17 
 net/ipv6/esp6.c                                                               |   13 
 net/ipv6/ip6_gre.c                                                            |   11 
 net/ipv6/ipv6_sockglue.c                                                      |    1 
 net/ipv6/route.c                                                              |    8 
 net/ipv6/udp.c                                                                |   17 
 net/key/af_key.c                                                              |   11 
 net/mac80211/cfg.c                                                            |    1 
 net/mac80211/mesh.c                                                           |   13 
 net/mac80211/mesh_pathtbl.c                                                   |    1 
 net/mac80211/sta_info.c                                                       |    4 
 net/mac80211/tx.c                                                             |    7 
 net/mac80211/util.c                                                           |    4 
 net/mptcp/protocol.c                                                          |    2 
 net/netfilter/ipvs/ip_vs_sync.c                                               |   12 
 net/netfilter/nf_tables_api.c                                                 |   41 
 net/nfc/nci/core.c                                                            |    5 
 net/qrtr/qrtr.c                                                               |    1 
 net/rds/recv.c                                                                |    3 
 net/rxrpc/call_object.c                                                       |   27 
 net/rxrpc/conn_object.c                                                       |    8 
 net/rxrpc/recvmsg.c                                                           |    4 
 net/rxrpc/sendmsg.c                                                           |    5 
 net/sched/act_ct.c                                                            |   20 
 net/sched/cls_api.c                                                           |    1 
 net/sctp/stream.c                                                             |   27 
 net/smc/af_smc.c                                                              |   12 
 net/smc/smc_cdc.c                                                             |    6 
 net/smc/smc_core.c                                                            |  109 --
 net/smc/smc_core.h                                                            |    5 
 net/smc/smc_ib.c                                                              |   16 
 net/smc/smc_ib.h                                                              |    1 
 net/smc/smc_llc.c                                                             |  127 +-
 net/smc/smc_llc.h                                                             |    2 
 net/tipc/link.c                                                               |    2 
 net/vmw_vsock/virtio_transport.c                                              |    2 
 net/wireless/nl80211.c                                                        |    6 
 net/xfrm/espintcp.c                                                           |   62 -
 net/xfrm/xfrm_policy.c                                                        |   43 
 net/xfrm/xfrm_user.c                                                          |   18 
 scripts/Makefile.modpost                                                      |    3 
 scripts/decode_stacktrace.sh                                                  |    4 
 scripts/gdb/linux/symbols.py                                                  |    2 
 scripts/kconfig/.gitignore                                                    |    2 
 scripts/kconfig/Makefile                                                      |   13 
 scripts/kconfig/qconf.cc                                                      |   23 
 scripts/kconfig/qconf.h                                                       |    4 
 scripts/mod/modpost.c                                                         |   13 
 sound/core/info.c                                                             |    4 
 sound/pci/hda/hda_codec.c                                                     |    8 
 sound/pci/hda/hda_controller.h                                                |    2 
 sound/pci/hda/hda_intel.c                                                     |   17 
 sound/pci/hda/patch_hdmi.c                                                    |    2 
 sound/pci/hda/patch_realtek.c                                                 |   37 
 sound/soc/amd/raven/pci-acp3x.c                                               |    4 
 sound/soc/codecs/max98373.c                                                   |    8 
 sound/soc/codecs/rt286.c                                                      |    8 
 sound/soc/codecs/rt5670.c                                                     |   75 +
 sound/soc/codecs/rt5670.h                                                     |    2 
 sound/soc/codecs/rt5682.c                                                     |   46 
 sound/soc/codecs/wm8974.c                                                     |    6 
 sound/soc/generic/audio-graph-card.c                                          |    4 
 sound/soc/generic/simple-card.c                                               |    4 
 sound/soc/intel/boards/bdw-rt5677.c                                           |    1 
 sound/soc/intel/boards/bytcht_es8316.c                                        |    4 
 sound/soc/intel/boards/cht_bsw_rt5672.c                                       |   23 
 sound/soc/qcom/Kconfig                                                        |    2 
 sound/soc/rockchip/rk3399_gru_sound.c                                         |   13 
 sound/soc/soc-core.c                                                          |   27 
 sound/soc/soc-dai.c                                                           |   38 
 sound/soc/soc-devres.c                                                        |    8 
 sound/soc/soc-generic-dmaengine-pcm.c                                         |    2 
 sound/soc/soc-topology.c                                                      |   24 
 sound/soc/sof/core.c                                                          |   10 
 sound/soc/sof/imx/imx8.c                                                      |    8 
 sound/soc/sof/imx/imx8m.c                                                     |    8 
 sound/usb/pcm.c                                                               |    1 
 tools/lib/traceevent/event-parse.c                                            |    1 
 tools/lib/traceevent/plugins/Makefile                                         |    2 
 tools/perf/arch/arm/util/auxtrace.c                                           |    8 
 tools/perf/pmu-events/arch/s390/cf_z15/extended.json                          |    2 
 tools/perf/tests/shell/record+zstd_comp_decomp.sh                             |    3 
 tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c                       |  124 ++
 tools/testing/selftests/bpf/test_offload.py                                   |    3 
 tools/testing/selftests/bpf/verifier/event_output.c                           |    1 
 tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c                |   42 
 tools/testing/selftests/net/fib_nexthop_multiprefix.sh                        |    2 
 tools/testing/selftests/net/forwarding/ethtool.sh                             |    2 
 tools/testing/selftests/net/ip_defrag.sh                                      |    2 
 tools/testing/selftests/net/psock_fanout.c                                    |    3 
 tools/testing/selftests/net/rxtimestamp.c                                     |    3 
 tools/testing/selftests/net/so_txtime.c                                       |    2 
 tools/testing/selftests/net/tcp_mmap.c                                        |    6 
 tools/testing/selftests/net/txtimestamp.sh                                    |    2 
 548 files changed, 5787 insertions(+), 4243 deletions(-)

New commits:
commit 1f28fa3d000f6f0faff9227969dd7753c3355de5
Author: Kevin Brace <kevinbrace at gmx.com>
Date:   Wed Aug 12 18:10:42 2020 -0700

    drm/openchrome: Version bumped to 3.3.0
    
    Added a new OpenChrome DRM uAPI service (DRM_OPENCHROME_GEM_UNMAP), so
    the OpenChrome DRM minor version number will have to be incremented by 1.
    
    Signed-off-by: Kevin Brace <kevinbrace at gmx.com>

diff --git a/drivers/gpu/drm/openchrome/openchrome_drv.h b/drivers/gpu/drm/openchrome/openchrome_drv.h
index d16d392a5dca..891a52cce787 100644
--- a/drivers/gpu/drm/openchrome/openchrome_drv.h
+++ b/drivers/gpu/drm/openchrome/openchrome_drv.h
@@ -60,11 +60,11 @@
 
 
 #define DRIVER_MAJOR		3
-#define DRIVER_MINOR		2
+#define DRIVER_MINOR		3
 #define DRIVER_PATCHLEVEL	0
 #define DRIVER_NAME		"openchrome"
 #define DRIVER_DESC		"OpenChrome DRM for VIA Technologies Chrome IGP"
-#define DRIVER_DATE		"20200810"
+#define DRIVER_DATE		"20200812"
 #define DRIVER_AUTHOR		"OpenChrome Project"
 
 
commit 9da86319e21156f2d733d1a81832fd011de18c4c
Author: Kevin Brace <kevinbrace at gmx.com>
Date:   Wed Aug 12 18:01:14 2020 -0700

    drm/openchrome: Add DRM_OPENCHROME_GEM_UNMAP OpenChrome DRM uAPI call
    
    Signed-off-by: Kevin Brace <kevinbrace at gmx.com>

diff --git a/drivers/gpu/drm/openchrome/openchrome_ioctl.c b/drivers/gpu/drm/openchrome/openchrome_ioctl.c
index 17fb2ae5ee32..d3e12df3322a 100644
--- a/drivers/gpu/drm/openchrome/openchrome_ioctl.c
+++ b/drivers/gpu/drm/openchrome/openchrome_ioctl.c
@@ -101,10 +101,26 @@ exit:
 	return ret;
 }
 
+static int openchrome_gem_unmap(struct drm_device *dev,
+				void *data,
+				struct drm_file *file_priv)
+{
+	struct drm_openchrome_gem_unmap *args = data;
+	int ret;
+
+	DRM_DEBUG_KMS("Entered %s.\n", __func__);
+
+	ret = drm_gem_handle_delete(file_priv, args->handle);
+
+	DRM_DEBUG_KMS("Exiting %s.\n", __func__);
+	return ret;
+}
+
 
 const struct drm_ioctl_desc openchrome_ioctls[] = {
 	DRM_IOCTL_DEF_DRV(OPENCHROME_GEM_CREATE, openchrome_gem_create, DRM_AUTH | DRM_UNLOCKED),
 	DRM_IOCTL_DEF_DRV(OPENCHROME_GEM_MAP, openchrome_gem_map, DRM_AUTH | DRM_UNLOCKED),
+	DRM_IOCTL_DEF_DRV(OPENCHROME_GEM_UNMAP, openchrome_gem_unmap, DRM_AUTH | DRM_UNLOCKED),
 };
 
 
diff --git a/include/uapi/drm/openchrome_drm.h b/include/uapi/drm/openchrome_drm.h
index 06f7f2ababda..e640ad3fd15b 100644
--- a/include/uapi/drm/openchrome_drm.h
+++ b/include/uapi/drm/openchrome_drm.h
@@ -42,10 +42,12 @@ extern "C" {
 
 #define DRM_OPENCHROME_GEM_CREATE	0x00
 #define DRM_OPENCHROME_GEM_MAP		0x01
+#define DRM_OPENCHROME_GEM_UNMAP	0x02
 
 
 #define DRM_IOCTL_OPENCHROME_GEM_CREATE DRM_IOWR(DRM_COMMAND_BASE + DRM_OPENCHROME_GEM_CREATE, struct drm_openchrome_gem_create)
 #define DRM_IOCTL_OPENCHROME_GEM_MAP    DRM_IOWR(DRM_COMMAND_BASE + DRM_OPENCHROME_GEM_MAP, struct drm_openchrome_gem_map)
+#define DRM_IOCTL_OPENCHROME_GEM_UNMAP  DRM_IOR(DRM_COMMAND_BASE + DRM_OPENCHROME_GEM_MAP, struct drm_openchrome_gem_unmap)
 
 
 struct drm_openchrome_gem_create {
@@ -61,6 +63,10 @@ struct drm_openchrome_gem_map {
 	uint64_t map_offset;
 };
 
+struct drm_openchrome_gem_unmap {
+	uint32_t handle;
+};
+
 
 #if defined(__cplusplus)
 }
commit fd8da54319104ccf0d572f10f3f152138c91c14e
Merge: 33ce41f27b78 62975d27d647
Author: Kevin Brace <kevinbrace at gmx.com>
Date:   Wed Aug 12 17:58:23 2020 -0700

    Merge tag 'drm-next-2020-08-12' of git://anongit.freedesktop.org/drm/drm into drm-next-5.9
    
    drm fixes for 5.9-rc1
    
    core:
    - Fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    - Remove null check for kfree in drm_dev_release.
    - Fix DRM_FORMAT_MOD_AMLOGIC_FBC definition.
    - re-added docs for drm_gem_flink_ioctl()
    - add orientation quirk for ASUS T103HAF
    
    ttm:
    - ttm: fix page-offset calculation within TTM
    - revert patch causing vmwgfx regressions
    
    fbcon:
    - Fix a fbcon OOB read in fbdev, found by syzbot.
    
    vga:
    - Mark vga_tryget static as it's not used elsewhere.
    
    amdgpu:
    - Re-add spelling typo fix
    - Sienna Cichlid fixes
    - Navy Flounder fixes
    - DC fixes
    - SMU i2c fix
    - Power fixes
    
    vmwgfx:
    - regression fixes for modesetting crashes
    - misc fixes
    
    xlnx:
    - Small fixes to xlnx.
    
    omap:
    - Fix mode initialization in omap_connector_mode_valid().
    - force runtime PM suspend on system suspend
    
    tidss:
    - fix modeset init for DPI panels

commit 62975d27d647a40c58d3b96c29b911fc4f33c310
Author: Christian König <ckoenig.leichtzumerken at gmail.com>
Date:   Wed Aug 12 13:03:49 2020 +1000

    drm/ttm: revert "drm/ttm: make TT creation purely optional v3"
    
    This reverts commit 2ddef17678bc2ea1d20517dd2b4ed4aa967ffa8b.
    
    As it turned out VMWGFX needs a much wider audit to fix this.
    
    Signed-off-by: Christian König <christian.koenig at amd.com>
    Reviewed-by: Dave Airlie <airlied at redhat.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200811092400.188124-1-christian.koenig@amd.com

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index f297fd5e02d4..cc6a4e7551e3 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -287,11 +287,12 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 	 */
 
 	if (!(new_man->flags & TTM_MEMTYPE_FLAG_FIXED)) {
-		bool zero = !(old_man->flags & TTM_MEMTYPE_FLAG_FIXED);
-
-		ret = ttm_tt_create(bo, zero);
-		if (ret)
-			goto out_err;
+		if (bo->ttm == NULL) {
+			bool zero = !(old_man->flags & TTM_MEMTYPE_FLAG_FIXED);
+			ret = ttm_tt_create(bo, zero);
+			if (ret)
+				goto out_err;
+		}
 
 		ret = ttm_tt_set_placement_caching(bo->ttm, mem->placement);
 		if (ret)
@@ -652,8 +653,13 @@ static int ttm_bo_evict(struct ttm_buffer_object *bo,
 	placement.num_busy_placement = 0;
 	bdev->driver->evict_flags(bo, &placement);
 
-	if (!placement.num_placement && !placement.num_busy_placement)
-		return ttm_bo_pipeline_gutting(bo);
+	if (!placement.num_placement && !placement.num_busy_placement) {
+		ret = ttm_bo_pipeline_gutting(bo);
+		if (ret)
+			return ret;
+
+		return ttm_tt_create(bo, false);
+	}
 
 	evict_mem = bo->mem;
 	evict_mem.mm_node = NULL;
@@ -1192,8 +1198,13 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
 	/*
 	 * Remove the backing store if no placement is given.
 	 */
-	if (!placement->num_placement && !placement->num_busy_placement)
-		return ttm_bo_pipeline_gutting(bo);
+	if (!placement->num_placement && !placement->num_busy_placement) {
+		ret = ttm_bo_pipeline_gutting(bo);
+		if (ret)
+			return ret;
+
+		return ttm_tt_create(bo, false);
+	}
 
 	/*
 	 * Check whether we need to move buffer.
@@ -1210,6 +1221,14 @@ int ttm_bo_validate(struct ttm_buffer_object *bo,
 		ttm_flag_masked(&bo->mem.placement, new_flags,
 				~TTM_PL_MASK_MEMTYPE);
 	}
+	/*
+	 * We might need to add a TTM.
+	 */
+	if (bo->mem.mem_type == TTM_PL_SYSTEM && bo->ttm == NULL) {
+		ret = ttm_tt_create(bo, true);
+		if (ret)
+			return ret;
+	}
 	return 0;
 }
 EXPORT_SYMBOL(ttm_bo_validate);
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7fb3e0bcbab4..e6c8bd254055 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -531,15 +531,12 @@ static int ttm_bo_kmap_ttm(struct ttm_buffer_object *bo,
 		.interruptible = false,
 		.no_wait_gpu = false
 	};
-	struct ttm_tt *ttm;
+	struct ttm_tt *ttm = bo->ttm;
 	pgprot_t prot;
 	int ret;
 
-	ret = ttm_tt_create(bo, true);
-	if (ret)
-		return ret;
+	BUG_ON(!ttm);
 
-	ttm = bo->ttm;
 	ret = ttm_tt_populate(ttm, &ctx);
 	if (ret)
 		return ret;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index dd60b96b7522..33526c5df0e8 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -351,11 +351,6 @@ vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf,
 
 		};
 
-		if (ttm_tt_create(bo, true)) {
-			ret = VM_FAULT_OOM;
-			goto out_io_unlock;
-		}
-
 		ttm = bo->ttm;
 		if (ttm_tt_populate(bo->ttm, &ctx)) {
 			ret = VM_FAULT_OOM;
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 9d1c7177384c..3437711ddb43 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -50,9 +50,6 @@ int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc)
 
 	dma_resv_assert_held(bo->base.resv);
 
-	if (bo->ttm)
-		return 0;
-
 	if (bdev->need_dma32)
 		page_flags |= TTM_PAGE_FLAG_DMA32;
 
@@ -70,6 +67,7 @@ int ttm_tt_create(struct ttm_buffer_object *bo, bool zero_alloc)
 		page_flags |= TTM_PAGE_FLAG_SG;
 		break;
 	default:
+		bo->ttm = NULL;
 		pr_err("Illegal buffer object type\n");
 		return -EINVAL;
 	}
commit 312d100c01e174a5528ecf9e454472f84da37533
Merge: 16e6eea29d7b e97644ebcdc8
Author: Dave Airlie <airlied at redhat.com>
Date:   Wed Aug 12 12:58:19 2020 +1000

    Merge branch 'vmwgfx-next-5.9' of git://people.freedesktop.org/~sroland/linux into drm-next
    
    The drm_mode_config_reset patches are very important fixing a recently
    introduced kernel crash, the others fix various older issues which are
    a bit less serious in practice.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: "Roland Scheidegger (VMware)" <rscheidegger.oss at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200812005941.19465-1-rscheidegger.oss@gmail.com

commit 16e6eea29d7bc62ae23a4918e971415d21078d6e
Merge: 15f9d8b8cf66 f87812284172
Author: Dave Airlie <airlied at redhat.com>
Date:   Tue Aug 11 13:08:44 2020 +1000

    Merge tag 'amd-drm-fixes-5.9-2020-08-07' of git://people.freedesktop.org/~agd5f/linux into drm-next
    
    amd-drm-fixes-5.9-2020-08-07:
    
    amdgpu:
    - Re-add spelling typo fix
    - Sienna Cichlid fixes
    - Navy Flounder fixes
    - DC fixes
    - SMU i2c fix
    - Power fixes
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: Alex Deucher <alexdeucher at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200807222843.3909-1-alexander.deucher@amd.com

commit 15f9d8b8cf668f24c59322020d267500c48d7383
Merge: c44264f9f729 b5ac98cbb8e5
Author: Dave Airlie <airlied at redhat.com>
Date:   Tue Aug 11 11:59:19 2020 +1000

    Merge tag 'drm-misc-fixes-2020-08-04' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
    
     * backmerge from drm-fixes at v5.8-rc7
     * add orientation quirk for ASUS T103HAF
     * drm/omap: force runtime PM suspend on system suspend
     * drm/tidss: fix modeset init for DPI panels
     * re-added docs for drm_gem_flink_ioctl()
     * ttm: fix page-offset calculation within TTM
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    
    From: Thomas Zimmermann <tzimmermann at suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200804125510.GA29670@linux-uq9g

commit c44264f9f729fd63bd6a81a6ac5cd6cd49af09e5
Merge: ca457ab59086 bcf876870b95
Author: Dave Airlie <airlied at redhat.com>
Date:   Tue Aug 11 11:58:31 2020 +1000

    Merge tag 'v5.8' into drm-next
    
    I need to backmerge 5.8 as I've got a bunch of fixes sitting
    on an rc7 base that I want to land.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

diff --cc drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index f45cdca9cce5,648eb23d0784..a0d392c338da
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@@ -1280,9 -1223,8 +1280,10 @@@ static int adv7511_probe(struct i2c_cli
  		goto err_unregister_cec;
  
  	adv7511->bridge.funcs = &adv7511_bridge_funcs;
 +	adv7511->bridge.ops = DRM_BRIDGE_OP_DETECT | DRM_BRIDGE_OP_EDID
 +			    | DRM_BRIDGE_OP_HPD;
  	adv7511->bridge.of_node = dev->of_node;
+ 	adv7511->bridge.type = DRM_MODE_CONNECTOR_HDMIA;
  
  	drm_bridge_add(&adv7511->bridge);
  
diff --cc drivers/gpu/drm/drm_gem.c
index a57f5379fc08,ee2058ad482c..d4e7c8370565
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@@ -913,7 -901,9 +909,9 @@@ drm_gem_open_ioctl(struct drm_device *d
  	args->handle = handle;
  	args->size = obj->size;
  
- 	return 0;
+ err:
 -	drm_gem_object_put_unlocked(obj);
++	drm_gem_object_put(obj);
+ 	return ret;
  }
  
  /**
commit e97644ebcdc83854e6e29e96285b25042445c28c
Author: Colin Ian King <colin.king at canonical.com>
Date:   Mon Aug 10 11:04:01 2020 +0100

    drm/vmwgfx: fix spelling mistake "Cant" -> "Can't"
    
    There is a spelling mistake in a DRM_ERROR message. Fix it.
    
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 6e9a6135533a..312ed0881a99 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -186,7 +186,7 @@ void vmw_kms_cursor_snoop(struct vmw_surface *srf,
 		/* TODO handle none page aligned offsets */
 		/* TODO handle more dst & src != 0 */
 		/* TODO handle more then one copy */
-		DRM_ERROR("Cant snoop dma request for cursor!\n");
+		DRM_ERROR("Can't snoop dma request for cursor!\n");
 		DRM_ERROR("(%u, %u, %u) (%u, %u, %u) (%ux%ux%u) %u %u\n",
 			  box->srcx, box->srcy, box->srcz,
 			  box->x, box->y, box->z,
commit 1ae96fce3e4dfe769515350b7f142b3bca1e0bb6
Author: Colin Ian King <colin.king at canonical.com>
Date:   Wed Aug 5 12:31:55 2020 +0100

    drm/vmwgfx: fix spelling mistake "Cound" -> "Could"
    
    There is a spelling mistake in a DRM_ERROR message. Fix it.
    
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 4284c4bd444d..e67e2e8f6e6f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3037,7 +3037,7 @@ static int vmw_cmd_dx_bind_streamoutput(struct vmw_private *dev_priv,
 	res = vmw_dx_streamoutput_lookup(vmw_context_res_man(ctx_node->ctx),
 					 cmd->body.soid);
 	if (IS_ERR(res)) {
-		DRM_ERROR("Cound not find streamoutput to bind.\n");
+		DRM_ERROR("Could not find streamoutput to bind.\n");
 		return PTR_ERR(res);
 	}
 
commit 981243371a5d832af5bc572071172e955d02fe88
Author: Roland Scheidegger <sroland at vmware.com>
Date:   Fri Aug 7 22:04:33 2020 +0200

    drm/vmwgfx/ldu: Use drm_mode_config_reset
    
    Same problem as in stdu, same fix.
    
    Fixes: 51f644b40b4b ("drm/atomic-helper: reset vblank on crtc reset")
    Acked-by: Charmaine Lee <charmainel at vmware.com>
    Reviewed-by: Zack Rusin <zackr at vmware.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 009f1742bed5..c4017c7a24db 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -387,8 +387,6 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 	ldu->base.is_implicit = true;
 
 	/* Initialize primary plane */
-	vmw_du_plane_reset(primary);
-
 	ret = drm_universal_plane_init(dev, &ldu->base.primary,
 				       0, &vmw_ldu_plane_funcs,
 				       vmw_primary_plane_formats,
@@ -402,8 +400,6 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 	drm_plane_helper_add(primary, &vmw_ldu_primary_plane_helper_funcs);
 
 	/* Initialize cursor plane */
-	vmw_du_plane_reset(cursor);
-
 	ret = drm_universal_plane_init(dev, &ldu->base.cursor,
 			0, &vmw_ldu_cursor_funcs,
 			vmw_cursor_plane_formats,
@@ -417,7 +413,6 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 
 	drm_plane_helper_add(cursor, &vmw_ldu_cursor_plane_helper_funcs);
 
-	vmw_du_connector_reset(connector);
 	ret = drm_connector_init(dev, connector, &vmw_legacy_connector_funcs,
 				 DRM_MODE_CONNECTOR_VIRTUAL);
 	if (ret) {
@@ -445,7 +440,6 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 		goto err_free_encoder;
 	}
 
-	vmw_du_crtc_reset(crtc);
 	ret = drm_crtc_init_with_planes(dev, crtc, &ldu->base.primary,
 					&ldu->base.cursor,
 					&vmw_legacy_crtc_funcs, NULL);
@@ -520,6 +514,8 @@ int vmw_kms_ldu_init_display(struct vmw_private *dev_priv)
 
 	dev_priv->active_display_unit = vmw_du_legacy;
 
+	drm_mode_config_reset(dev);
+
 	DRM_INFO("Legacy Display Unit initialized\n");
 
 	return 0;
commit 1338441cf166e2ef789af5915b961d4e13a4ec31
Author: Roland Scheidegger <sroland at vmware.com>
Date:   Fri Aug 7 22:03:42 2020 +0200

    drm/vmwgfx/sou: Use drm_mode_config_reset
    
    Same problem as in stdu, same fix.
    
    Fixes: 51f644b40b4b ("drm/atomic-helper: reset vblank on crtc reset")
    Acked-by: Charmaine Lee <charmainel at vmware.com>
    Reviewed-by: Zack Rusin <zackr at vmware.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
index 32a22e4eddb1..4bf0f5ec4fc2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c
@@ -859,8 +859,6 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
 	sou->base.is_implicit = false;
 
 	/* Initialize primary plane */
-	vmw_du_plane_reset(primary);
-
 	ret = drm_universal_plane_init(dev, &sou->base.primary,
 				       0, &vmw_sou_plane_funcs,
 				       vmw_primary_plane_formats,
@@ -875,8 +873,6 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
 	drm_plane_enable_fb_damage_clips(primary);
 
 	/* Initialize cursor plane */
-	vmw_du_plane_reset(cursor);
-
 	ret = drm_universal_plane_init(dev, &sou->base.cursor,
 			0, &vmw_sou_cursor_funcs,
 			vmw_cursor_plane_formats,
@@ -890,7 +886,6 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
 
 	drm_plane_helper_add(cursor, &vmw_sou_cursor_plane_helper_funcs);
 
-	vmw_du_connector_reset(connector);
 	ret = drm_connector_init(dev, connector, &vmw_sou_connector_funcs,
 				 DRM_MODE_CONNECTOR_VIRTUAL);
 	if (ret) {
@@ -918,8 +913,6 @@ static int vmw_sou_init(struct vmw_private *dev_priv, unsigned unit)
 		goto err_free_encoder;
 	}
 
-
-	vmw_du_crtc_reset(crtc);
 	ret = drm_crtc_init_with_planes(dev, crtc, &sou->base.primary,
 					&sou->base.cursor,
 					&vmw_screen_object_crtc_funcs, NULL);
@@ -973,6 +966,8 @@ int vmw_kms_sou_init_display(struct vmw_private *dev_priv)
 
 	dev_priv->active_display_unit = vmw_du_screen_object;
 
+	drm_mode_config_reset(dev);
+
 	DRM_INFO("Screen Objects Display Unit initialized\n");
 
 	return 0;
commit 68745d1edf1700a668c15ecbed466d18f14c7e9b
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Thu Aug 6 17:42:27 2020 +0200

    drm/vmwgfx/stdu: Use drm_mode_config_reset
    
    When converting to atomic the state reset was done by directly calling
    the functions, and before the modeset object was fully initialized.
    This means the various ->dev pointers weren't set up.
    
    After
    
    commit 51f644b40b4b794b28b982fdd5d0dd8ee63f9272
    Author: Daniel Vetter <daniel.vetter at ffwll.ch>
    Date:   Fri Jun 12 18:00:49 2020 +0200
    
        drm/atomic-helper: reset vblank on crtc reset
    
    this started to oops because now we're trying to derefence
    drm_crtc->dev. Fix this up by entirely switching over to
    drm_mode_config_reset, called once everything is set up.
    
    Fixes: 51f644b40b4b ("drm/atomic-helper: reset vblank on crtc reset")
    Reported-by: Tetsuo Handa <penguin-kernel at i-love.sakura.ne.jp>
    Cc: Tetsuo Handa <penguin-kernel at i-love.sakura.ne.jp>
    Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
    Tested-by: Roland Scheidegger <sroland at vmware.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
index 16b385629688..cf3aafd00837 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1738,8 +1738,6 @@ static int vmw_stdu_init(struct vmw_private *dev_priv, unsigned unit)
 	stdu->base.is_implicit = false;
 
 	/* Initialize primary plane */
-	vmw_du_plane_reset(primary);
-
 	ret = drm_universal_plane_init(dev, primary,
 				       0, &vmw_stdu_plane_funcs,
 				       vmw_primary_plane_formats,
@@ -1754,8 +1752,6 @@ static int vmw_stdu_init(struct vmw_private *dev_priv, unsigned unit)
 	drm_plane_enable_fb_damage_clips(primary);
 
 	/* Initialize cursor plane */
-	vmw_du_plane_reset(cursor);
-
 	ret = drm_universal_plane_init(dev, cursor,
 			0, &vmw_stdu_cursor_funcs,
 			vmw_cursor_plane_formats,
@@ -1769,8 +1765,6 @@ static int vmw_stdu_init(struct vmw_private *dev_priv, unsigned unit)
 
 	drm_plane_helper_add(cursor, &vmw_stdu_cursor_plane_helper_funcs);
 
-	vmw_du_connector_reset(connector);
-
 	ret = drm_connector_init(dev, connector, &vmw_stdu_connector_funcs,
 				 DRM_MODE_CONNECTOR_VIRTUAL);
 	if (ret) {
@@ -1798,7 +1792,6 @@ static int vmw_stdu_init(struct vmw_private *dev_priv, unsigned unit)
 		goto err_free_encoder;
 	}
 
-	vmw_du_crtc_reset(crtc);
 	ret = drm_crtc_init_with_planes(dev, crtc, &stdu->base.primary,
 					&stdu->base.cursor,
 					&vmw_stdu_crtc_funcs, NULL);
@@ -1894,6 +1887,8 @@ int vmw_kms_stdu_init_display(struct vmw_private *dev_priv)
 		}
 	}
 
+	drm_mode_config_reset(dev);
+
 	DRM_INFO("Screen Target Display device initialized\n");
 
 	return 0;
commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date:   Fri Jun 26 13:39:59 2020 +0300

    drm/vmwgfx: Fix two list_for_each loop exit tests
    
    These if statements are supposed to be true if we ended the
    list_for_each_entry() loops without hitting a break statement but they
    don't work.
    
    In the first loop, we increment "i" after the "if (i == unit)" condition
    so we don't necessarily know that "i" is not equal to unit at the end of
    the loop.
    
    In the second loop we exit when mode is not pointing to a valid
    drm_display_mode struct so it doesn't make sense to check "mode->type".
    
    Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2")
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Reviewed-by: Roland Scheidegger <sroland at vmware.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index bbce45d142aa..6e9a6135533a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2575,7 +2575,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
 		++i;
 	}
 
-	if (i != unit) {
+	if (&con->head == &dev_priv->dev->mode_config.connector_list) {
 		DRM_ERROR("Could not find initial display unit.\n");
 		ret = -EINVAL;
 		goto out_unlock;
@@ -2599,13 +2599,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
 			break;
 	}
 
-	if (mode->type & DRM_MODE_TYPE_PREFERRED)
-		*p_mode = mode;
-	else {
+	if (&mode->head == &con->modes) {
 		WARN_ONCE(true, "Could not find initial preferred mode.\n");
 		*p_mode = list_first_entry(&con->modes,
 					   struct drm_display_mode,
 					   head);
+	} else {
+		*p_mode = mode;
 	}
 
  out_unlock:
commit 1d2c0c565bc0da25f5e899a862fb58e612b222df
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date:   Fri Jun 26 13:34:37 2020 +0300

    drm/vmwgfx: Use correct vmw_legacy_display_unit pointer
    
    The "entry" pointer is an offset from the list head and it doesn't
    point to a valid vmw_legacy_display_unit struct.  Presumably the
    intent was to point to the last entry.
    
    Also the "i++" wasn't used so I have removed that as well.
    
    Fixes: d7e1958dbe4a ("drm/vmwgfx: Support older hardware.")
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Reviewed-by: Roland Scheidegger <sroland at vmware.com>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 16dafff5cab1..009f1742bed5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
 	struct vmw_legacy_display_unit *entry;
 	struct drm_framebuffer *fb = NULL;
 	struct drm_crtc *crtc = NULL;
-	int i = 0;
+	int i;
 
 	/* If there is no display topology the host just assumes
 	 * that the guest will set the same layout as the host.
@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
 			crtc = &entry->base.crtc;
 			w = max(w, crtc->x + crtc->mode.hdisplay);
 			h = max(h, crtc->y + crtc->mode.vdisplay);
-			i++;
 		}
 
 		if (crtc == NULL)
 			return 0;
-		fb = entry->base.crtc.primary->state->fb;
+		fb = crtc->primary->state->fb;
 
 		return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0],
 					  fb->format->cpp[0] * 8,
commit 4f88b4ccb7036ce523b3c031d1226d6eda36417b
Author: Gustavo A. R. Silva <gustavoars at kernel.org>
Date:   Wed Jun 17 16:51:44 2020 -0500

    drm/vmwgfx: Use struct_size() helper
    
    Make use of the struct_size() helper instead of an open-coded version
    in order to avoid any potential type mistakes.
    
    This code was detected with the help of Coccinelle and, audited and
    fixed manually.
    
    Signed-off-by: Gustavo A. R. Silva <gustavoars at kernel.org>
    Signed-off-by: Roland Scheidegger <sroland at vmware.com>

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 126f93c0b0b8..3914bfee0533 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1969,7 +1969,7 @@ static int vmw_surface_dirty_alloc(struct vmw_resource *res)
 		num_mip = 1;
 
 	num_subres = num_layers * num_mip;
-	dirty_size = sizeof(*dirty) + num_subres * sizeof(dirty->boxes[0]);
+	dirty_size = struct_size(dirty, boxes, num_subres);
 	acc_size = ttm_round_pot(dirty_size);
 	ret = ttm_mem_global_alloc(vmw_mem_glob(res->dev_priv),
 				   acc_size, &ctx);
commit ca457ab5908603b36be903e73977afde1ba03c84
Merge: dc100bc8fae5 a34a0a632dd9
Author: Dave Airlie <airlied at redhat.com>
Date:   Tue Aug 11 10:56:11 2020 +1000

    Merge tag 'drm-misc-next-fixes-2020-08-05' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
    
    drm-misc-next-fixes for v5.9-rc1:
    - Fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    - Fix a fbcon OOB read in fbdev, found by syzbot.
    - Mark vga_tryget static as it's not used elsewhere.
    - Small fixes to xlnx.
    - Remove null check for kfree in drm_dev_release.
    - Fix DRM_FORMAT_MOD_AMLOGIC_FBC definition.
    - Fix mode initialization in omap_connector_mode_valid().
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    
    From: Maarten Lankhorst <maarten.lankhorst at linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/b2043dad-f118-bd19-54a6-f23bf6264007@linux.intel.com

commit f87812284172a9809820d10143b573d833cd3f75
Author: Sandeep Raghuraman <sandy.8925 at gmail.com>
Date:   Thu Aug 6 22:52:20 2020 +0530

    drm/amdgpu: Fix bug where DPM is not enabled after hibernate and resume
    
    Reproducing bug report here:
    After hibernating and resuming, DPM is not enabled. This remains the case
    even if you test hibernate using the steps here:
    https://www.kernel.org/doc/html/latest/power/basic-pm-debugging.html
    
    I debugged the problem, and figured out that in the file hardwaremanager.c,
    in the function, phm_enable_dynamic_state_management(), the check
    'if (!hwmgr->pp_one_vf && smum_is_dpm_running(hwmgr) && !amdgpu_passthrough(adev) && adev->in_suspend)'
    returns true for the hibernate case, and false for the suspend case.
    
    This means that for the hibernate case, the AMDGPU driver doesn't enable DPM
    (even though it should) and simply returns from that function.
    In the suspend case, it goes ahead and enables DPM, even though it doesn't need to.
    
    I debugged further, and found out that in the case of suspend, for the
    CIK/Hawaii GPUs, smum_is_dpm_running(hwmgr) returns false, while in the case of
    hibernate, smum_is_dpm_running(hwmgr) returns true.
    
    For CIK, the ci_is_dpm_running() function calls the ci_is_smc_ram_running() function,
    which is ultimately used to determine if DPM is currently enabled or not,
    and this seems to provide the wrong answer.
    
    I've changed the ci_is_dpm_running() function to instead use the same method that
    some other AMD GPU chips do (e.g Fiji), which seems to read the voltage controller.
    I've tested on my R9 390 and it seems to work correctly for both suspend and
    hibernate use cases, and has been stable so far.
    
    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=208839
    Signed-off-by: Sandeep Raghuraman <sandy.8925 at gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
index 02159ca29fa2..c18169aa59ce 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr)
 
 static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
 {
-	return ci_is_smc_ram_running(hwmgr);
+	return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
+					     CGS_IND_REG__SMC, FEATURE_STATUS,
+					     VOLTAGE_CONTROLLER_ON))
+		? true : false;
 }
 
 static int ci_smu_init(struct pp_hwmgr *hwmgr)
commit 7fb133cf65558955b5fdac2458f9690dfd12a794
Author: Evan Quan <evan.quan at amd.com>
Date:   Wed Aug 5 17:24:41 2020 +0800

    drm/amd/powerplay: put VCN/JPEG into PG ungate state before dpm table setup(V3)
    
    As VCN related dpm table setup needs VCN be in PG ungate state. Same logics
    applies to JPEG.
    
    V2: fix paste typo
    V3: code cosmetic
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Tested-by: Matt Coffin <mcoffin13 at gmail.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 70a4e6dab166..0826625573dc 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -133,8 +133,8 @@ int smu_get_dpm_freq_range(struct smu_context *smu,
 	return ret;
 }
 
-static int smu_dpm_set_vcn_enable(struct smu_context *smu,
-				  bool enable)
+static int smu_dpm_set_vcn_enable_locked(struct smu_context *smu,
+					 bool enable)
 {
 	struct smu_power_context *smu_power = &smu->smu_power;
 	struct smu_power_gate *power_gate = &smu_power->power_gate;
@@ -143,23 +143,34 @@ static int smu_dpm_set_vcn_enable(struct smu_context *smu,
 	if (!smu->ppt_funcs->dpm_set_vcn_enable)
 		return 0;
 
-	mutex_lock(&power_gate->vcn_gate_lock);
-
 	if (atomic_read(&power_gate->vcn_gated) ^ enable)
-		goto out;
+		return 0;
 
 	ret = smu->ppt_funcs->dpm_set_vcn_enable(smu, enable);
 	if (!ret)
 		atomic_set(&power_gate->vcn_gated, !enable);
 
-out:
+	return ret;
+}
+
+static int smu_dpm_set_vcn_enable(struct smu_context *smu,
+				  bool enable)
+{
+	struct smu_power_context *smu_power = &smu->smu_power;
+	struct smu_power_gate *power_gate = &smu_power->power_gate;
+	int ret = 0;
+
+	mutex_lock(&power_gate->vcn_gate_lock);
+
+	ret = smu_dpm_set_vcn_enable_locked(smu, enable);
+
 	mutex_unlock(&power_gate->vcn_gate_lock);
 
 	return ret;
 }
 
-static int smu_dpm_set_jpeg_enable(struct smu_context *smu,
-				   bool enable)
+static int smu_dpm_set_jpeg_enable_locked(struct smu_context *smu,
+					  bool enable)
 {
 	struct smu_power_context *smu_power = &smu->smu_power;
 	struct smu_power_gate *power_gate = &smu_power->power_gate;
@@ -168,16 +179,27 @@ static int smu_dpm_set_jpeg_enable(struct smu_context *smu,
 	if (!smu->ppt_funcs->dpm_set_jpeg_enable)
 		return 0;
 
-	mutex_lock(&power_gate->jpeg_gate_lock);
-
 	if (atomic_read(&power_gate->jpeg_gated) ^ enable)
-		goto out;
+		return 0;
 
 	ret = smu->ppt_funcs->dpm_set_jpeg_enable(smu, enable);
 	if (!ret)
 		atomic_set(&power_gate->jpeg_gated, !enable);
 
-out:
+	return ret;
+}
+
+static int smu_dpm_set_jpeg_enable(struct smu_context *smu,
+				   bool enable)
+{
+	struct smu_power_context *smu_power = &smu->smu_power;
+	struct smu_power_gate *power_gate = &smu_power->power_gate;
+	int ret = 0;
+
+	mutex_lock(&power_gate->jpeg_gate_lock);
+
+	ret = smu_dpm_set_jpeg_enable_locked(smu, enable);
+
 	mutex_unlock(&power_gate->jpeg_gate_lock);
 
 	return ret;
@@ -403,6 +425,45 @@ static int smu_early_init(void *handle)
 	return smu_set_funcs(adev);
 }
 
+static int smu_set_default_dpm_table(struct smu_context *smu)
+{
+	struct smu_power_context *smu_power = &smu->smu_power;
+	struct smu_power_gate *power_gate = &smu_power->power_gate;
+	int vcn_gate, jpeg_gate;
+	int ret = 0;
+
+	if (!smu->ppt_funcs->set_default_dpm_table)
+		return 0;
+
+	mutex_lock(&power_gate->vcn_gate_lock);
+	mutex_lock(&power_gate->jpeg_gate_lock);
+
+	vcn_gate = atomic_read(&power_gate->vcn_gated);
+	jpeg_gate = atomic_read(&power_gate->jpeg_gated);
+
+	ret = smu_dpm_set_vcn_enable_locked(smu, true);
+	if (ret)
+		goto err0_out;
+
+	ret = smu_dpm_set_jpeg_enable_locked(smu, true);
+	if (ret)
+		goto err1_out;
+
+	ret = smu->ppt_funcs->set_default_dpm_table(smu);
+	if (ret)
+		dev_err(smu->adev->dev,
+			"Failed to setup default dpm clock tables!\n");
+
+	smu_dpm_set_jpeg_enable_locked(smu, !jpeg_gate);
+err1_out:
+	smu_dpm_set_vcn_enable_locked(smu, !vcn_gate);
+err0_out:
+	mutex_unlock(&power_gate->jpeg_gate_lock);
+	mutex_unlock(&power_gate->vcn_gate_lock);
+
+	return ret;
+}
+
 static int smu_late_init(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
diff --git a/drivers/gpu/drm/amd/powerplay/smu_internal.h b/drivers/gpu/drm/amd/powerplay/smu_internal.h
index f1d8f247e589..264073d4e263 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_internal.h
+++ b/drivers/gpu/drm/amd/powerplay/smu_internal.h
@@ -60,7 +60,6 @@
 #define smu_disable_all_features_with_exception(smu, mask)		smu_ppt_funcs(disable_all_features_with_exception, 0, smu, mask)
 #define smu_is_dpm_running(smu)						smu_ppt_funcs(is_dpm_running, 0 , smu)
 #define smu_notify_display_change(smu)					smu_ppt_funcs(notify_display_change, 0, smu)
-#define smu_set_default_dpm_table(smu)					smu_ppt_funcs(set_default_dpm_table, 0, smu)
 #define smu_populate_umd_state_clk(smu)					smu_ppt_funcs(populate_umd_state_clk, 0, smu)
 #define smu_set_default_od8_settings(smu)				smu_ppt_funcs(set_default_od8_settings, 0, smu)
 #define smu_enable_thermal_alert(smu)					smu_ppt_funcs(enable_thermal_alert, 0, smu)
commit 2c34c960cee0dfdfe33ddf1b3835c250a9503ef6
Author: Evan Quan <evan.quan at amd.com>
Date:   Mon Aug 3 11:15:14 2020 +0800

    drm/amd/powerplay: update swSMU VCN/JPEG PG logics
    
    Add lock protections and avoid unnecessary actions
    if the PG state is already the same as required.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Tested-by: Matt Coffin <mcoffin13 at gmail.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index ceef149d3410..70a4e6dab166 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -133,6 +133,56 @@ int smu_get_dpm_freq_range(struct smu_context *smu,
 	return ret;
 }
 
+static int smu_dpm_set_vcn_enable(struct smu_context *smu,
+				  bool enable)
+{
+	struct smu_power_context *smu_power = &smu->smu_power;
+	struct smu_power_gate *power_gate = &smu_power->power_gate;
+	int ret = 0;
+
+	if (!smu->ppt_funcs->dpm_set_vcn_enable)
+		return 0;
+
+	mutex_lock(&power_gate->vcn_gate_lock);
+
+	if (atomic_read(&power_gate->vcn_gated) ^ enable)
+		goto out;
+
+	ret = smu->ppt_funcs->dpm_set_vcn_enable(smu, enable);
+	if (!ret)
+		atomic_set(&power_gate->vcn_gated, !enable);
+
+out:
+	mutex_unlock(&power_gate->vcn_gate_lock);
+
+	return ret;
+}
+
+static int smu_dpm_set_jpeg_enable(struct smu_context *smu,
+				   bool enable)
+{
+	struct smu_power_context *smu_power = &smu->smu_power;
+	struct smu_power_gate *power_gate = &smu_power->power_gate;
+	int ret = 0;
+
+	if (!smu->ppt_funcs->dpm_set_jpeg_enable)
+		return 0;
+
+	mutex_lock(&power_gate->jpeg_gate_lock);
+
+	if (atomic_read(&power_gate->jpeg_gated) ^ enable)
+		goto out;
+
+	ret = smu->ppt_funcs->dpm_set_jpeg_enable(smu, enable);
+	if (!ret)
+		atomic_set(&power_gate->jpeg_gated, !enable);
+
+out:
+	mutex_unlock(&power_gate->jpeg_gate_lock);
+
+	return ret;
+}
+
 /**
  * smu_dpm_set_power_gate - power gate/ungate the specific IP block
  *
@@ -649,6 +699,11 @@ static int smu_sw_init(void *handle)
 	smu->power_profile_mode = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT;
 	smu->default_power_profile_mode = PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT;
 
+	atomic_set(&smu->smu_power.power_gate.vcn_gated, 1);
+	atomic_set(&smu->smu_power.power_gate.jpeg_gated, 1);
+	mutex_init(&smu->smu_power.power_gate.vcn_gate_lock);
+	mutex_init(&smu->smu_power.power_gate.jpeg_gate_lock);
+
 	smu->workload_mask = 1 << smu->workload_prority[PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT];
 	smu->workload_prority[PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT] = 0;
 	smu->workload_prority[PP_SMC_POWER_PROFILE_FULLSCREEN3D] = 1;
@@ -1973,7 +2028,7 @@ int smu_read_sensor(struct smu_context *smu,
 		*size = 4;
 		break;
 	case AMDGPU_PP_SENSOR_VCN_POWER_STATE:
-		*(uint32_t *)data = smu->smu_power.power_gate.vcn_gated ? 0 : 1;
+		*(uint32_t *)data = atomic_read(&smu->smu_power.power_gate.vcn_gated) ? 0: 1;
 		*size = 4;
 		break;
 	case AMDGPU_PP_SENSOR_MIN_FAN_RPM:
diff --git a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
index 3b2ecb52a36f..6c991de8f371 100644
--- a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
@@ -1849,8 +1849,6 @@ static bool arcturus_is_dpm_running(struct smu_context *smu)
 
 static int arcturus_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -1861,7 +1859,6 @@ static int arcturus_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 				return ret;
 			}
 		}
-		power_gate->vcn_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_VCN_PG_BIT)) {
 			ret = smu_cmn_feature_set_enabled(smu, SMU_FEATURE_VCN_PG_BIT, 0);
@@ -1870,7 +1867,6 @@ static int arcturus_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 				return ret;
 			}
 		}
-		power_gate->vcn_gated = true;
 	}
 
 	return ret;
diff --git a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
index 28312d6dc187..074458eb5407 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/amdgpu_smu.h
@@ -292,8 +292,10 @@ struct smu_dpm_context {
 struct smu_power_gate {
 	bool uvd_gated;
 	bool vce_gated;
-	bool vcn_gated;
-	bool jpeg_gated;
+	atomic_t vcn_gated;
+	atomic_t jpeg_gated;
+	struct mutex vcn_gate_lock;
+	struct mutex jpeg_gate_lock;
 };
 
 struct smu_power_context {
diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
index c33bdc6747f2..9f62af9abd23 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
@@ -785,8 +785,6 @@ static int navi10_set_default_dpm_table(struct smu_context *smu)
 
 static int navi10_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -796,14 +794,12 @@ static int navi10_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 			if (ret)
 				return ret;
 		}
-		power_gate->vcn_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_VCN_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg(smu, SMU_MSG_PowerDownVcn, NULL);
 			if (ret)
 				return ret;
 		}
-		power_gate->vcn_gated = true;
 	}
 
 	return ret;
@@ -811,8 +807,6 @@ static int navi10_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 
 static int navi10_dpm_set_jpeg_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -821,14 +815,12 @@ static int navi10_dpm_set_jpeg_enable(struct smu_context *smu, bool enable)
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_JPEG_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg(smu, SMU_MSG_PowerDownJpeg, NULL);
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = true;
 	}
 
 	return ret;
diff --git a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
index 575ae4be98a2..dbb676c482fd 100644
--- a/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/renoir_ppt.c
@@ -459,8 +459,6 @@ static enum amd_pm_state_type renoir_get_current_power_state(struct smu_context
 
 static int renoir_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -470,14 +468,12 @@ static int renoir_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 			if (ret)
 				return ret;
 		}
-		power_gate->vcn_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_VCN_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg(smu, SMU_MSG_PowerDownVcn, NULL);
 			if (ret)
 				return ret;
 		}
-		power_gate->vcn_gated = true;
 	}
 
 	return ret;
@@ -485,8 +481,6 @@ static int renoir_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 
 static int renoir_dpm_set_jpeg_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -495,14 +489,12 @@ static int renoir_dpm_set_jpeg_enable(struct smu_context *smu, bool enable)
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_JPEG_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_PowerDownJpeg, 0, NULL);
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = true;
 	}
 
 	return ret;
diff --git a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
index f373e2d0d31c..3865dbed5f93 100644
--- a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
@@ -766,10 +766,7 @@ static int sienna_cichlid_set_default_dpm_table(struct smu_context *smu)
 
 static int sienna_cichlid_dpm_set_vcn_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	struct amdgpu_device *adev = smu->adev;
-
 	int ret = 0;
 
 	if (enable) {
@@ -785,7 +782,6 @@ static int sienna_cichlid_dpm_set_vcn_enable(struct smu_context *smu, bool enabl
 					return ret;
 			}
 		}
-		power_gate->vcn_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_MM_DPM_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_PowerDownVcn, 0, NULL);
@@ -798,7 +794,6 @@ static int sienna_cichlid_dpm_set_vcn_enable(struct smu_context *smu, bool enabl
 					return ret;
 			}
 		}
-		power_gate->vcn_gated = true;
 	}
 
 	return ret;
@@ -806,8 +801,6 @@ static int sienna_cichlid_dpm_set_vcn_enable(struct smu_context *smu, bool enabl
 
 static int sienna_cichlid_dpm_set_jpeg_enable(struct smu_context *smu, bool enable)
 {
-	struct smu_power_context *smu_power = &smu->smu_power;
-	struct smu_power_gate *power_gate = &smu_power->power_gate;
 	int ret = 0;
 
 	if (enable) {
@@ -816,14 +809,12 @@ static int sienna_cichlid_dpm_set_jpeg_enable(struct smu_context *smu, bool enab
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = false;
 	} else {
 		if (smu_cmn_feature_is_enabled(smu, SMU_FEATURE_MM_DPM_PG_BIT)) {
 			ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_PowerDownJpeg, 0, NULL);
 			if (ret)
 				return ret;
 		}
-		power_gate->jpeg_gated = true;
 	}
 
 	return ret;
diff --git a/drivers/gpu/drm/amd/powerplay/smu_internal.h b/drivers/gpu/drm/amd/powerplay/smu_internal.h
index d0deaefd3feb..f1d8f247e589 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_internal.h
+++ b/drivers/gpu/drm/amd/powerplay/smu_internal.h
@@ -77,8 +77,6 @@
 #define smu_get_dal_power_level(smu, clocks)				smu_ppt_funcs(get_dal_power_level, 0, smu, clocks)
 #define smu_get_perf_level(smu, designation, level)			smu_ppt_funcs(get_perf_level, 0, smu, designation, level)
 #define smu_get_current_shallow_sleep_clocks(smu, clocks)		smu_ppt_funcs(get_current_shallow_sleep_clocks, 0, smu, clocks)
-#define smu_dpm_set_vcn_enable(smu, enable)				smu_ppt_funcs(dpm_set_vcn_enable, 0, smu, enable)
-#define smu_dpm_set_jpeg_enable(smu, enable)				smu_ppt_funcs(dpm_set_jpeg_enable, 0, smu, enable)
 #define smu_set_watermarks_table(smu, clock_ranges)			smu_ppt_funcs(set_watermarks_table, 0, smu, clock_ranges)
 #define smu_thermal_temperature_range_update(smu, range, rw)		smu_ppt_funcs(thermal_temperature_range_update, 0, smu, range, rw)
 #define smu_register_irq_handler(smu)					smu_ppt_funcs(register_irq_handler, 0, smu)
commit f2e2573c0823c07dc8aac4a8e0947881af2340bd
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Thu Aug 6 17:37:28 2020 +0800

    drm/amdgpu: use mode1 reset by default for sienna_cichlid
    
    Swith default gpu reset method for sienna_cichlid to MODE1 reset.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
index 74d02d270d34..da8024c2826e 100644
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -362,10 +362,15 @@ nv_asic_reset_method(struct amdgpu_device *adev)
 		dev_warn(adev->dev, "Specified reset method:%d isn't supported, using AUTO instead.\n",
 				  amdgpu_reset_method);
 
-	if (smu_baco_is_support(smu))
-		return AMD_RESET_METHOD_BACO;
-	else
+	switch (adev->asic_type) {
+	case CHIP_SIENNA_CICHLID:
 		return AMD_RESET_METHOD_MODE1;
+	default:
+		if (smu_baco_is_support(smu))
+			return AMD_RESET_METHOD_BACO;
+		else
+			return AMD_RESET_METHOD_MODE1;
+	}
 }
 
 static int nv_asic_reset(struct amdgpu_device *adev)
commit 95a2687687f832a7f8fa32bdfe42a530796b71a2
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Thu Jul 30 15:21:33 2020 -0400

    drm/amdgpu/smu: rework i2c adpater registration
    
    The i2c init/fini functions just register the i2c adapter.
    There is no need to call them during hw init/fini.  They only
    need to be called once per driver init/fini.  The previous
    behavior broke runtime pm because we unregistered the i2c
    adapter during suspend.
    
    Tested-by: Tom St Denis <tom.stdenis at amd.com>
    Reviewed-by: Kevin Wang <kevin1.wang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 8c624f1f33ba..ceef149d3410 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -579,6 +579,10 @@ static int smu_smc_table_sw_init(struct smu_context *smu)
 	if (ret)
 		return ret;
 
+	ret = smu_i2c_init(smu, &smu->adev->pm.smu_i2c);
+	if (ret)
+		return ret;
+
 	return 0;
 }
 
@@ -586,6 +590,8 @@ static int smu_smc_table_sw_fini(struct smu_context *smu)
 {
 	int ret;
 
+	smu_i2c_fini(smu, &smu->adev->pm.smu_i2c);
+
 	ret = smu_free_memory_pool(smu);
 	if (ret)
 		return ret;
@@ -844,10 +850,6 @@ static int smu_smc_hw_setup(struct smu_context *smu)
 		return ret;
 	}
 
-	ret = smu_i2c_init(smu, &adev->pm.smu_i2c);
-	if (ret)
-		return ret;
-
 	ret = smu_disable_umc_cdr_12gbps_workaround(smu);
 	if (ret) {
 		dev_err(adev->dev, "Workaround failed to disable UMC CDR feature on 12Gbps SKU!\n");
@@ -1046,8 +1048,6 @@ static int smu_smc_hw_cleanup(struct smu_context *smu)
 	struct amdgpu_device *adev = smu->adev;
 	int ret = 0;
 
-	smu_i2c_fini(smu, &adev->pm.smu_i2c);
-
 	cancel_work_sync(&smu->throttling_logging_work);
 
 	ret = smu_disable_thermal_alert(smu);
diff --git a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
index 3b9182c8c53f..3b2ecb52a36f 100644
--- a/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/arcturus_ppt.c
@@ -2080,22 +2080,11 @@ static const struct i2c_algorithm arcturus_i2c_algo = {
 	.functionality = arcturus_i2c_func,
 };
 
-static bool arcturus_i2c_adapter_is_added(struct i2c_adapter *control)
-{
-	struct amdgpu_device *adev = to_amdgpu_device(control);
-
-	return control->dev.parent == &adev->pdev->dev;
-}
-
 static int arcturus_i2c_control_init(struct smu_context *smu, struct i2c_adapter *control)
 {
 	struct amdgpu_device *adev = to_amdgpu_device(control);
 	int res;
 
-	/* smu_i2c_eeprom_init may be called twice in sriov */
-	if (arcturus_i2c_adapter_is_added(control))
-		return 0;
-
 	control->owner = THIS_MODULE;
 	control->class = I2C_CLASS_SPD;
 	control->dev.parent = &adev->pdev->dev;
@@ -2111,9 +2100,6 @@ static int arcturus_i2c_control_init(struct smu_context *smu, struct i2c_adapter
 
 static void arcturus_i2c_control_fini(struct smu_context *smu, struct i2c_adapter *control)
 {
-	if (!arcturus_i2c_adapter_is_added(control))
-		return;
-
 	i2c_del_adapter(control);
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
index 6aaf483858a0..c33bdc6747f2 100644
--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
@@ -2457,22 +2457,11 @@ static const struct i2c_algorithm navi10_i2c_algo = {
 	.functionality = navi10_i2c_func,
 };
 
-static bool navi10_i2c_adapter_is_added(struct i2c_adapter *control)
-{
-	struct amdgpu_device *adev = to_amdgpu_device(control);
-
-	return control->dev.parent == &adev->pdev->dev;
-}
-
 static int navi10_i2c_control_init(struct smu_context *smu, struct i2c_adapter *control)
 {
 	struct amdgpu_device *adev = to_amdgpu_device(control);
 	int res;
 
-	/* smu_i2c_eeprom_init may be called twice in sriov */
-	if (navi10_i2c_adapter_is_added(control))
-		return 0;
-
 	control->owner = THIS_MODULE;
 	control->class = I2C_CLASS_SPD;
 	control->dev.parent = &adev->pdev->dev;
@@ -2488,9 +2477,6 @@ static int navi10_i2c_control_init(struct smu_context *smu, struct i2c_adapter *
 
 static void navi10_i2c_control_fini(struct smu_context *smu, struct i2c_adapter *control)
 {
-	if (!navi10_i2c_adapter_is_added(control))
-		return;
-
 	i2c_del_adapter(control);
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
index f64a1be94cb8..f373e2d0d31c 100644
--- a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
@@ -2630,22 +2630,11 @@ static const struct i2c_algorithm sienna_cichlid_i2c_algo = {
 	.functionality = sienna_cichlid_i2c_func,
 };
 
-static bool sienna_cichlid_i2c_adapter_is_added(struct i2c_adapter *control)
-{
-	struct amdgpu_device *adev = to_amdgpu_device(control);
-
-	return control->dev.parent == &adev->pdev->dev;
-}
-
 static int sienna_cichlid_i2c_control_init(struct smu_context *smu, struct i2c_adapter *control)
 {
 	struct amdgpu_device *adev = to_amdgpu_device(control);
 	int res;
 
-	/* smu_i2c_eeprom_init may be called twice in sriov */
-	if (sienna_cichlid_i2c_adapter_is_added(control))
-		return 0;
-
 	control->owner = THIS_MODULE;
 	control->class = I2C_CLASS_SPD;
 	control->dev.parent = &adev->pdev->dev;
@@ -2661,9 +2650,6 @@ static int sienna_cichlid_i2c_control_init(struct smu_context *smu, struct i2c_a
 
 static void sienna_cichlid_i2c_control_fini(struct smu_context *smu, struct i2c_adapter *control)
 {
-	if (!sienna_cichlid_i2c_adapter_is_added(control))
-		return;
-
 	i2c_del_adapter(control);
 }
 
commit d6a4e5e9fed072702a03f45584df7e74a8ba79ee
Author: Igor Kravchenko <Igor.Kravchenko at amd.com>
Date:   Fri Jul 24 11:10:40 2020 -0400

    drm/amd/display: Display goes blank after inst
    
    [why]
    Display goes blank after driver installation.
    Aux tuning parameters must be used for 2.x only.
    Wrong dc_golden_table offset was used.
    
    [How]
    Implement a new enc3_hw_init function without VBIOS constants usage to
    be called for 3.x
    Calculate dc_golden_table offset using sum of
    base dce_info offset and golden table offset
    
    Signed-off-by: Igor Kravchenko <Igor.Kravchenko at amd.com>
    Reviewed-by: Aric Cyr <Aric.Cyr at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
index f8db92fed9cf..078b7e344185 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -2101,7 +2101,7 @@ static struct atom_dc_golden_table_v1 *bios_get_golden_table(
 									DATA_TABLES(dce_info));
 			if (!disp_cntl_tbl_4_4)
 				return NULL;
-			dc_golden_offset = disp_cntl_tbl_4_4->dc_golden_table_offset;
+			dc_golden_offset = DATA_TABLES(dce_info) + disp_cntl_tbl_4_4->dc_golden_table_offset;
 			*dc_golden_table_ver = disp_cntl_tbl_4_4->dc_golden_table_ver;
 			break;
 		}
@@ -2115,7 +2115,7 @@ static struct atom_dc_golden_table_v1 *bios_get_golden_table(
 		return NULL;
 
 	return GET_IMAGE(struct atom_dc_golden_table_v1,
-					 dc_golden_offset);
+			dc_golden_offset);
 }
 
 static enum bp_result bios_get_atom_dc_golden_table(
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
index c29326e9856a..2ae159e2dd6e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
@@ -62,7 +62,7 @@ static const struct link_encoder_funcs dcn30_link_enc_funcs = {
 	.read_state = link_enc2_read_state,
 	.validate_output_with_stream =
 			dcn30_link_encoder_validate_output_with_stream,
-	.hw_init = enc2_hw_init,
+	.hw_init = enc3_hw_init,
 	.setup = dcn10_link_encoder_setup,
 	.enable_tmds_output = dcn10_link_encoder_enable_tmds_output,
 	.enable_dp_output = dcn20_link_encoder_enable_dp_output,
@@ -203,3 +203,54 @@ void dcn30_link_encoder_construct(
 		enc10->base.features.flags.bits.HDMI_6GB_EN = 0;
 	}
 }
+
+#define AUX_REG(reg)\
+	(enc10->aux_regs->reg)
+
+#define AUX_REG_READ(reg_name) \
+		dm_read_reg(CTX, AUX_REG(reg_name))
+
+#define AUX_REG_WRITE(reg_name, val) \
+			dm_write_reg(CTX, AUX_REG(reg_name), val)
+void enc3_hw_init(struct link_encoder *enc)
+{
+	struct dcn10_link_encoder *enc10 = TO_DCN10_LINK_ENC(enc);
+
+/*
+	00 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__1to2 : 1/2
+	01 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__3to4 : 3/4
+	02 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__7to8 : 7/8
+	03 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__15to16 : 15/16
+	04 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__31to32 : 31/32
+	05 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__63to64 : 63/64
+	06 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__127to128 : 127/128
+	07 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__255to256 : 255/256
+*/
+
+/*
+	AUX_REG_UPDATE_5(AUX_DPHY_RX_CONTROL0,
+	AUX_RX_START_WINDOW = 1 [6:4]
+	AUX_RX_RECEIVE_WINDOW = 1 default is 2 [10:8]
+	AUX_RX_HALF_SYM_DETECT_LEN  = 1 [13:12] default is 1
+	AUX_RX_TRANSITION_FILTER_EN = 1 [16] default is 1
+	AUX_RX_ALLOW_BELOW_THRESHOLD_PHASE_DETECT [17] is 0  default is 0
+	AUX_RX_ALLOW_BELOW_THRESHOLD_START [18] is 1  default is 1
+	AUX_RX_ALLOW_BELOW_THRESHOLD_STOP [19] is 1  default is 1
+	AUX_RX_PHASE_DETECT_LEN,  [21,20] = 0x3 default is 3
+	AUX_RX_DETECTION_THRESHOLD [30:28] = 1
+*/
+	AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110);
+
+	AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a);
+
+	//AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32;
+	// Set AUX_TX_REF_DIV Divider to generate 2 MHz reference from refclk
+	// 27MHz -> 0xd
+	// 100MHz -> 0x32
+	// 48MHz -> 0x18
+
+	// Set TMDS_CTL0 to 1.  This is a legacy setting.
+	REG_UPDATE(TMDS_CTL_BITS, TMDS_CTL0, 1);
+
+	dcn10_aux_initialize(enc10);
+}
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
index 585d1ce63db1..8e9fd59ccde8 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
@@ -73,4 +73,6 @@ void dcn30_link_encoder_construct(
 	const struct dcn10_link_enc_shift *link_shift,
 	const struct dcn10_link_enc_mask *link_mask);
 
+void enc3_hw_init(struct link_encoder *enc);
+
 #endif /* __DC_LINK_ENCODER__DCN30_H__ */
commit ab2cf4c86b24821b6a4164a20d46961da1686634
Author: George Shen <george.shen at amd.com>
Date:   Fri Jul 17 13:19:27 2020 -0400

    drm/amd/display: Change null plane state swizzle mode to 4kb_s
    
    [Why]
    During SetPathMode and UpdatePlanes, the plane state can be null. We default
    to linear swizzle mode when plane state is null. This resulted in bandwidth
    validation failing when trying to set 8K60 mode (which previously passed validation
    during rebuild timing list).
    
    [How]
    Change the default swizzle mode from linear to 4kb_s and update pitch accordingly.
    
    Signed-off-by: George Shen <george.shen at amd.com>
    Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 2a5e7175926a..790baf552695 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2223,7 +2223,7 @@ int dcn20_populate_dml_pipes_from_context(
 		if (!res_ctx->pipe_ctx[i].plane_state) {
 			pipes[pipe_cnt].pipe.src.is_hsplit = pipes[pipe_cnt].pipe.dest.odm_combine != dm_odm_combine_mode_disabled;
 			pipes[pipe_cnt].pipe.src.source_scan = dm_horz;
-			pipes[pipe_cnt].pipe.src.sw_mode = dm_sw_linear;
+			pipes[pipe_cnt].pipe.src.sw_mode = dm_sw_4kb_s;
 			pipes[pipe_cnt].pipe.src.macro_tile_size = dm_64k_tile;
 			pipes[pipe_cnt].pipe.src.viewport_width = timing->h_addressable;
 			if (pipes[pipe_cnt].pipe.src.viewport_width > 1920)
@@ -2235,7 +2235,7 @@ int dcn20_populate_dml_pipes_from_context(
 			pipes[pipe_cnt].pipe.src.surface_width_y = pipes[pipe_cnt].pipe.src.viewport_width;
 			pipes[pipe_cnt].pipe.src.surface_height_c = pipes[pipe_cnt].pipe.src.viewport_height;
 			pipes[pipe_cnt].pipe.src.surface_width_c = pipes[pipe_cnt].pipe.src.viewport_width;
-			pipes[pipe_cnt].pipe.src.data_pitch = ((pipes[pipe_cnt].pipe.src.viewport_width + 63) / 64) * 64; /* linear sw only */
+			pipes[pipe_cnt].pipe.src.data_pitch = ((pipes[pipe_cnt].pipe.src.viewport_width + 255) / 256) * 256;
 			pipes[pipe_cnt].pipe.src.source_format = dm_444_32;
 			pipes[pipe_cnt].pipe.dest.recout_width = pipes[pipe_cnt].pipe.src.viewport_width; /*vp_width/hratio*/
 			pipes[pipe_cnt].pipe.dest.recout_height = pipes[pipe_cnt].pipe.src.viewport_height; /*vp_height/vratio*/
commit bd42538f1f40a6de16eead6ab01a1c214e6894e4
Author: JinZe.Xu <JinZe.Xu at amd.com>
Date:   Tue Jul 21 17:52:41 2020 +0800

    drm/amd/display: Use helper function to check for HDMI signal
    
    [How]
    Use dc_is_hdmi_signal to determine signal type.
    
    Signed-off-by: JinZe.Xu <JinZe.Xu at amd.com>
    Reviewed-by: Charlene Liu <Charlene.Liu at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 071c7b32b282..4bd6e03a7ef3 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3282,7 +3282,7 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx)
 			dc_is_virtual_signal(pipe_ctx->stream->signal))
 		return;
 
-	if (pipe_ctx->stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) {
+	if (dc_is_hdmi_signal(pipe_ctx->stream->signal)) {
 		core_link_set_avmute(pipe_ctx, true);
 	}
 
commit e106c96e2e0a0b9c1305d54480b60cb670d7fd1b
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Thu Jul 23 13:06:23 2020 -0400

    drm/amd/display: AMD OUI (DPCD 0x00300) skipped on some sink
    
    [Why]
    Sink OUI supported cap is not set so driver skips programming it.
    
    [How]
    Revert the change the skips OUI programming if the cap is not set
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index d7d2dcd49c06..9bc03f26efda 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -4339,22 +4339,6 @@ void dp_set_fec_enable(struct dc_link *link, bool enable)
 
 void dpcd_set_source_specific_data(struct dc_link *link)
 {
-	uint8_t dspc = 0;
-	enum dc_status ret;
-
-	ret = core_link_read_dpcd(link, DP_DOWN_STREAM_PORT_COUNT, &dspc,
-				  sizeof(dspc));
-
-	if (ret != DC_OK) {
-		DC_LOG_ERROR("Error in DP aux read transaction,"
-			     " not writing source specific data\n");
-		return;
-	}
-
-	/* Return if OUI unsupported */
-	if (!(dspc & DP_OUI_SUPPORT))
-		return;
-
 	if (!link->dc->vendor_signature.is_valid) {
 		struct dpcd_amd_signature amd_signature;
 		amd_signature.AMD_IEEE_TxSignature_byte1 = 0x0;
commit 7edac0d3fbf58db6a807bad5c5e264bb830906aa
Author: Harry Wentland <harry.wentland at amd.com>
Date:   Tue Jun 30 11:16:05 2020 -0400

    drm/amd/display: Fix logger context
    
    [Why&How]
    use correct logger context
    
    Signed-off-by: Harry Wentland <harry.wentland at amd.com>
    Reviewed-by: Roman Li <Roman.Li at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h
index 4e6e18bbef5d..72743058836d 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/clk_mgr_internal.h
@@ -71,8 +71,9 @@ enum dentist_divider_range {
 
 #define CTX \
 	clk_mgr->base.ctx
+
 #define DC_LOGGER \
-	clk_mgr->ctx->logger
+	clk_mgr->base.ctx->logger
 
 
 
commit 7c6981e7ca74be39a16a770315606d495a860275
Author: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
Date:   Fri Jun 26 14:30:29 2020 -0400

    drm/amd/display: populate new dml variable
    
    Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
    Reviewed-by: Eric Bernstein <Eric.Bernstein at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
index b0064087b9bb..afdd4f0d9d71 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
@@ -467,7 +467,8 @@ static void fetch_pipe_params(struct display_mode_lib *mode_lib)
 		mode_lib->vba.AudioSampleLayout[mode_lib->vba.NumberOfActivePlanes] =
 			1;
 		mode_lib->vba.DRAMClockChangeLatencyOverride = 0.0;
-		mode_lib->vba.DSCEnabled[mode_lib->vba.NumberOfActivePlanes] = dout->dsc_enable;
+		mode_lib->vba.DSCEnabled[mode_lib->vba.NumberOfActivePlanes] = dout->dsc_enable;;
+		mode_lib->vba.DSCEnable[mode_lib->vba.NumberOfActivePlanes] = dout->dsc_enable;
 		mode_lib->vba.NumberOfDSCSlices[mode_lib->vba.NumberOfActivePlanes] =
 				dout->dsc_slices;
 		mode_lib->vba.DSCInputBitPerComponent[mode_lib->vba.NumberOfActivePlanes] =
commit 098214999c8f8eea8dffddb61be5742fac2c829e
Author: Igor Kravchenko <Igor.Kravchenko at amd.com>
Date:   Sun Jul 19 20:45:28 2020 -0400

    drm/amd/display: Read VBIOS Golden Settings Tbl
    
    [Why]
    For ver.4.4 and higher VBIOS contains default setting table.
    
    {How]
    Read Golden Settings Table from VBIOS, apply Aux tuning parameters.
    
    Signed-off-by: Igor Kravchenko <Igor.Kravchenko at amd.com>
    Reviewed-by: Aric Cyr <Aric.Cyr at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
index 008d4d11339d..ad394aefa5d9 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser.c
@@ -2834,6 +2834,8 @@ static const struct dc_vbios_funcs vbios_funcs = {
 	.bios_parser_destroy = bios_parser_destroy,
 
 	.get_board_layout_info = bios_get_board_layout_info,
+
+	.get_atom_dc_golden_table = NULL
 };
 
 static bool bios_parser_construct(
diff --git a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
index b8684131151d..f8db92fed9cf 100644
--- a/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c
@@ -2079,6 +2079,85 @@ static uint16_t bios_parser_pack_data_tables(
 	return 0;
 }
 
+static struct atom_dc_golden_table_v1 *bios_get_golden_table(
+		struct bios_parser *bp,
+		uint32_t rev_major,
+		uint32_t rev_minor,
+		uint16_t *dc_golden_table_ver)
+{
+	struct atom_display_controller_info_v4_4 *disp_cntl_tbl_4_4 = NULL;
+	uint32_t dc_golden_offset = 0;
+	*dc_golden_table_ver = 0;
+
+	if (!DATA_TABLES(dce_info))
+		return NULL;
+
+	/* ver.4.4 or higher */
+	switch (rev_major) {
+	case 4:
+		switch (rev_minor) {
+		case 4:
+			disp_cntl_tbl_4_4 = GET_IMAGE(struct atom_display_controller_info_v4_4,
+									DATA_TABLES(dce_info));
+			if (!disp_cntl_tbl_4_4)
+				return NULL;
+			dc_golden_offset = disp_cntl_tbl_4_4->dc_golden_table_offset;
+			*dc_golden_table_ver = disp_cntl_tbl_4_4->dc_golden_table_ver;
+			break;
+		}
+		break;
+	}
+
+	if (!dc_golden_offset)
+		return NULL;
+
+	if (*dc_golden_table_ver != 1)
+		return NULL;
+
+	return GET_IMAGE(struct atom_dc_golden_table_v1,
+					 dc_golden_offset);
+}
+
+static enum bp_result bios_get_atom_dc_golden_table(
+	struct dc_bios *dcb)
+{
+	struct bios_parser *bp = BP_FROM_DCB(dcb);
+	enum bp_result result = BP_RESULT_OK;
+	struct atom_dc_golden_table_v1 *atom_dc_golden_table = NULL;
+	struct atom_common_table_header *header;
+	struct atom_data_revision tbl_revision;
+	uint16_t dc_golden_table_ver = 0;
+
+	header = GET_IMAGE(struct atom_common_table_header,
+							DATA_TABLES(dce_info));
+	if (!header)
+		return BP_RESULT_UNSUPPORTED;
+
+	get_atom_data_table_revision(header, &tbl_revision);
+
+	atom_dc_golden_table = bios_get_golden_table(bp,
+			tbl_revision.major,
+			tbl_revision.minor,
+			&dc_golden_table_ver);
+
+	if (!atom_dc_golden_table)
+		return BP_RESULT_UNSUPPORTED;
+
+	dcb->golden_table.dc_golden_table_ver = dc_golden_table_ver;
+	dcb->golden_table.aux_dphy_rx_control0_val = atom_dc_golden_table->aux_dphy_rx_control0_val;
+	dcb->golden_table.aux_dphy_rx_control1_val = atom_dc_golden_table->aux_dphy_rx_control1_val;
+	dcb->golden_table.aux_dphy_tx_control_val = atom_dc_golden_table->aux_dphy_tx_control_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_0_val = atom_dc_golden_table->dc_gpio_aux_ctrl_0_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_1_val = atom_dc_golden_table->dc_gpio_aux_ctrl_1_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_2_val = atom_dc_golden_table->dc_gpio_aux_ctrl_2_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_3_val = atom_dc_golden_table->dc_gpio_aux_ctrl_3_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_4_val = atom_dc_golden_table->dc_gpio_aux_ctrl_4_val;
+	dcb->golden_table.dc_gpio_aux_ctrl_5_val = atom_dc_golden_table->dc_gpio_aux_ctrl_5_val;
+
+	return result;
+}
+
+
 static const struct dc_vbios_funcs vbios_funcs = {
 	.get_connectors_number = bios_parser_get_connectors_number,
 
@@ -2128,6 +2207,8 @@ static const struct dc_vbios_funcs vbios_funcs = {
 
 	.get_board_layout_info = bios_get_board_layout_info,
 	.pack_data_tables = bios_parser_pack_data_tables,
+
+	.get_atom_dc_golden_table = bios_get_atom_dc_golden_table
 };
 
 static bool bios_parser2_construct(
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 9f8ab679616c..071c7b32b282 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -1540,6 +1540,9 @@ static bool dc_link_construct(struct dc_link *link,
 		}
 	}
 
+	if (bios->funcs->get_atom_dc_golden_table)
+		bios->funcs->get_atom_dc_golden_table(bios);
+
 	/*
 	 * TODO check if GPIO programmed correctly
 	 *
diff --git a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h
index 845a3054f21f..d06d07042a12 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_bios_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_bios_types.h
@@ -133,6 +133,9 @@ struct dc_vbios_funcs {
 	uint16_t (*pack_data_tables)(
 		struct dc_bios *dcb,
 		void *dst);
+
+	enum bp_result (*get_atom_dc_golden_table)(
+			struct dc_bios *dcb);
 };
 
 struct bios_registers {
@@ -154,6 +157,7 @@ struct dc_bios {
 	struct dc_firmware_info fw_info;
 	bool fw_info_valid;
 	struct dc_vram_info vram_info;
+	struct dc_golden_table golden_table;
 };
 
 #endif /* DC_BIOS_TYPES_H */
diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h
index 29fe5389f973..946ba929c6f6 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_types.h
@@ -890,6 +890,20 @@ struct dsc_dec_dpcd_caps {
 	uint32_t branch_max_line_width;
 };
 
+struct dc_golden_table {
+	uint16_t dc_golden_table_ver;
+	uint32_t aux_dphy_rx_control0_val;
+	uint32_t aux_dphy_tx_control_val;
+	uint32_t aux_dphy_rx_control1_val;
+	uint32_t dc_gpio_aux_ctrl_0_val;
+	uint32_t dc_gpio_aux_ctrl_1_val;
+	uint32_t dc_gpio_aux_ctrl_2_val;
+	uint32_t dc_gpio_aux_ctrl_3_val;
+	uint32_t dc_gpio_aux_ctrl_4_val;
+	uint32_t dc_gpio_aux_ctrl_5_val;
+};
+
+
 #if defined(CONFIG_DRM_AMD_DC_DCN3_0)
 enum dc_gpu_mem_alloc_type {
 	DC_MEM_ALLOC_TYPE_GART,
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
index 384389f0e2c3..66027d496778 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
@@ -38,7 +38,8 @@
 
 #define AUX_REG_LIST(id)\
 	SRI(AUX_CONTROL, DP_AUX, id), \
-	SRI(AUX_DPHY_RX_CONTROL0, DP_AUX, id)
+	SRI(AUX_DPHY_RX_CONTROL0, DP_AUX, id), \
+	SRI(AUX_DPHY_RX_CONTROL1, DP_AUX, id)
 
 #define HPD_REG_LIST(id)\
 	SRI(DC_HPD_CONTROL, HPD, id)
@@ -107,6 +108,7 @@
 struct dce110_link_enc_aux_registers {
 	uint32_t AUX_CONTROL;
 	uint32_t AUX_DPHY_RX_CONTROL0;
+	uint32_t AUX_DPHY_RX_CONTROL1;
 };
 
 struct dce110_link_enc_hpd_registers {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h
index cf59ab0034dc..04dabed5f1c5 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.h
@@ -31,10 +31,10 @@
 #define TO_DCN10_LINK_ENC(link_encoder)\
 	container_of(link_encoder, struct dcn10_link_encoder, base)
 
-
 #define AUX_REG_LIST(id)\
 	SRI(AUX_CONTROL, DP_AUX, id), \
-	SRI(AUX_DPHY_RX_CONTROL0, DP_AUX, id)
+	SRI(AUX_DPHY_RX_CONTROL0, DP_AUX, id), \
+	SRI(AUX_DPHY_RX_CONTROL1, DP_AUX, id)
 
 #define HPD_REG_LIST(id)\
 	SRI(DC_HPD_CONTROL, HPD, id)
@@ -73,6 +73,7 @@ struct dcn10_link_enc_aux_registers {
 	uint32_t AUX_CONTROL;
 	uint32_t AUX_DPHY_RX_CONTROL0;
 	uint32_t AUX_DPHY_TX_CONTROL;
+	uint32_t AUX_DPHY_RX_CONTROL1;
 };
 
 struct dcn10_link_enc_hpd_registers {
@@ -443,7 +444,10 @@ struct dcn10_link_enc_registers {
 	type AUX_TX_PRECHARGE_LEN; \
 	type AUX_TX_PRECHARGE_SYMBOLS; \
 	type AUX_MODE_DET_CHECK_DELAY;\
-	type DPCS_DBG_CBUS_DIS
+	type DPCS_DBG_CBUS_DIS;\
+	type AUX_RX_PRECHARGE_SKIP;\
+	type AUX_RX_TIMEOUT_LEN;\
+	type AUX_RX_TIMEOUT_LEN_MUL
 
 struct dcn10_link_enc_shift {
 	DCN_LINK_ENCODER_REG_FIELD_LIST(uint8_t);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
index 8d209dae66e6..15c2ff264ff6 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.c
@@ -309,7 +309,6 @@ bool dcn20_link_encoder_is_in_alt_mode(struct link_encoder *enc)
 void enc2_hw_init(struct link_encoder *enc)
 {
 	struct dcn10_link_encoder *enc10 = TO_DCN10_LINK_ENC(enc);
-
 /*
 	00 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__1to2 : 1/2
 	01 - DP_AUX_DPHY_RX_DETECTION_THRESHOLD__3to4 : 3/4
@@ -333,9 +332,18 @@ void enc2_hw_init(struct link_encoder *enc)
 	AUX_RX_PHASE_DETECT_LEN,  [21,20] = 0x3 default is 3
 	AUX_RX_DETECTION_THRESHOLD [30:28] = 1
 */
-	AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110);
+	if (enc->ctx->dc_bios->golden_table.dc_golden_table_ver > 0) {
+		AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, enc->ctx->dc_bios->golden_table.aux_dphy_rx_control0_val);
+
+		AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, enc->ctx->dc_bios->golden_table.aux_dphy_tx_control_val);
+
+		AUX_REG_WRITE(AUX_DPHY_RX_CONTROL1, enc->ctx->dc_bios->golden_table.aux_dphy_rx_control1_val);
+	} else {
+		AUX_REG_WRITE(AUX_DPHY_RX_CONTROL0, 0x103d1110);
+
+		AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c4d);
 
-	AUX_REG_WRITE(AUX_DPHY_TX_CONTROL, 0x21c7a);
+	}
 
 	//AUX_DPHY_TX_REF_CONTROL'AUX_TX_REF_DIV HW default is 0x32;
 	// Set AUX_TX_REF_DIV Divider to generate 2 MHz reference from refclk
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.h
index db09f40075c2..bf0044f7417e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_link_encoder.h
@@ -191,7 +191,10 @@
 	LE_SF(DP_AUX0_AUX_DPHY_RX_CONTROL0, AUX_RX_DETECTION_THRESHOLD, mask_sh), \
 	LE_SF(DP_AUX0_AUX_DPHY_TX_CONTROL, AUX_TX_PRECHARGE_LEN, mask_sh),\
 	LE_SF(DP_AUX0_AUX_DPHY_TX_CONTROL, AUX_TX_PRECHARGE_SYMBOLS, mask_sh),\
-	LE_SF(DP_AUX0_AUX_DPHY_TX_CONTROL, AUX_MODE_DET_CHECK_DELAY, mask_sh)
+	LE_SF(DP_AUX0_AUX_DPHY_TX_CONTROL, AUX_MODE_DET_CHECK_DELAY, mask_sh),\
+	LE_SF(DP_AUX0_AUX_DPHY_RX_CONTROL1, AUX_RX_PRECHARGE_SKIP, mask_sh),\
+	LE_SF(DP_AUX0_AUX_DPHY_RX_CONTROL1, AUX_RX_TIMEOUT_LEN, mask_sh),\
+	LE_SF(DP_AUX0_AUX_DPHY_RX_CONTROL1, AUX_RX_TIMEOUT_LEN_MUL, mask_sh)
 
 #define UNIPHY_DCN2_REG_LIST(id) \
 	SRI(CLOCK_ENABLE, SYMCLK, id), \
diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h
index c2544c81dfb2..3e526c394f6c 100644
--- a/drivers/gpu/drm/amd/include/atomfirmware.h
+++ b/drivers/gpu/drm/amd/include/atomfirmware.h
@@ -941,7 +941,6 @@ struct atom_display_controller_info_v4_1
   uint8_t  reserved3[8];
 };
 
-
 struct atom_display_controller_info_v4_2
 {
   struct  atom_common_table_header  table_header;
@@ -976,6 +975,59 @@ struct atom_display_controller_info_v4_2
   uint8_t  reserved3[8];
 };
 
+struct atom_display_controller_info_v4_4 {
+	struct atom_common_table_header table_header;
+	uint32_t display_caps;
+	uint32_t bootup_dispclk_10khz;
+	uint16_t dce_refclk_10khz;
+	uint16_t i2c_engine_refclk_10khz;
+	uint16_t dvi_ss_percentage;	 // in unit of 0.001%
+	uint16_t dvi_ss_rate_10hz;
+	uint16_t hdmi_ss_percentage;	 // in unit of 0.001%
+	uint16_t hdmi_ss_rate_10hz;
+	uint16_t dp_ss_percentage;	 // in unit of 0.001%
+	uint16_t dp_ss_rate_10hz;
+	uint8_t dvi_ss_mode;		 // enum of atom_spread_spectrum_mode
+	uint8_t hdmi_ss_mode;		 // enum of atom_spread_spectrum_mode
+	uint8_t dp_ss_mode;		 // enum of atom_spread_spectrum_mode
+	uint8_t ss_reserved;
+	uint8_t dfp_hardcode_mode_num;	 // DFP hardcode mode number defined in StandardVESA_TimingTable when EDID is not available
+	uint8_t dfp_hardcode_refreshrate;// DFP hardcode mode refreshrate defined in StandardVESA_TimingTable when EDID is not available
+	uint8_t vga_hardcode_mode_num;	 // VGA hardcode mode number defined in StandardVESA_TimingTable when EDID is not avablable
+	uint8_t vga_hardcode_refreshrate;// VGA hardcode mode number defined in StandardVESA_TimingTable when EDID is not avablable
+	uint16_t dpphy_refclk_10khz;
+	uint16_t hw_chip_id;
+	uint8_t dcnip_min_ver;
+	uint8_t dcnip_max_ver;
+	uint8_t max_disp_pipe_num;
+	uint8_t max_vbios_active_disp_pipum;
+	uint8_t max_ppll_num;
+	uint8_t max_disp_phy_num;
+	uint8_t max_aux_pairs;
+	uint8_t remotedisplayconfig;
+	uint32_t dispclk_pll_vco_freq;
+	uint32_t dp_ref_clk_freq;
+	uint32_t max_mclk_chg_lat;	 // Worst case blackout duration for a memory clock frequency (p-state) change, units of 100s of ns (0.1 us)
+	uint32_t max_sr_exit_lat;	 // Worst case memory self refresh exit time, units of 100ns of ns (0.1us)
+	uint32_t max_sr_enter_exit_lat;	 // Worst case memory self refresh entry followed by immediate exit time, units of 100ns of ns (0.1us)
+	uint16_t dc_golden_table_offset; // point of struct of atom_dc_golden_table_vxx
+	uint16_t dc_golden_table_ver;
+	uint32_t reserved3[3];
+};
+
+struct atom_dc_golden_table_v1
+{
+	uint32_t aux_dphy_rx_control0_val;
+	uint32_t aux_dphy_tx_control_val;
+	uint32_t aux_dphy_rx_control1_val;
+	uint32_t dc_gpio_aux_ctrl_0_val;
+	uint32_t dc_gpio_aux_ctrl_1_val;
+	uint32_t dc_gpio_aux_ctrl_2_val;
+	uint32_t dc_gpio_aux_ctrl_3_val;
+	uint32_t dc_gpio_aux_ctrl_4_val;
+	uint32_t dc_gpio_aux_ctrl_5_val;
+	uint32_t reserved[23];
+};
 
 enum dce_info_caps_def
 {
commit c06f670f4701d3a19534eb7ca4f606b9771a94a3
Author: Eric Bernstein <eric.bernstein at amd.com>
Date:   Mon Jul 20 19:18:43 2020 -0400

    drm/amd/display: Use parameter for call to set output mux
    
    Signed-off-by: Eric Bernstein <eric.bernstein at amd.com>
    Reviewed-by: Chris Park <Chris.Park at amd.com>
    Acked-by: Aurabindo Pillai <aurabindo.pillai at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index 02742cca4d84..9f8ab679616c 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3102,6 +3102,9 @@ void core_link_enable_stream(
 	struct dc *dc = pipe_ctx->stream->ctx->dc;
 	struct dc_stream_state *stream = pipe_ctx->stream;
 	enum dc_status status;
+#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
+	enum otg_out_mux_dest otg_out_dest = OUT_MUX_DIO;
+#endif
 	DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger);
 
 	if (!IS_DIAG_DC(dc->ctx->dce_environment) &&
@@ -3136,8 +3139,8 @@ void core_link_enable_stream(
 	pipe_ctx->stream->link->link_state_valid = true;
 
 #if defined(CONFIG_DRM_AMD_DC_DCN3_0)
-		if (pipe_ctx->stream_res.tg->funcs->set_out_mux)
-					pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, OUT_MUX_DIO);
+	if (pipe_ctx->stream_res.tg->funcs->set_out_mux)
+		pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, otg_out_dest);
 #endif
 
 	if (dc_is_dvi_signal(pipe_ctx->stream->signal))
commit a15383893f798c0962ab87f7e159abba9cbe3822
Author: Jiansong Chen <Jiansong.Chen at amd.com>
Date:   Thu Jul 30 18:09:47 2020 +0800

    drm/amdgpu: enable GFXOFF for navy_flounder
    
    Enable GFXOFF for navy_flounder.
    
    Signed-off-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Reviewed-by: Likun Gao <Likun.Gao at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 43cf3487c98a..65997ffaed45 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -7529,6 +7529,7 @@ static int gfx_v10_0_set_powergating_state(void *handle,
 	case CHIP_NAVI14:
 	case CHIP_NAVI12:
 	case CHIP_SIENNA_CICHLID:
+	case CHIP_NAVY_FLOUNDER:
 		amdgpu_gfx_off_ctrl(adev, enable);
 		break;
 	default:
diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
index fd82402065e6..7b950a582a28 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c
@@ -1029,6 +1029,7 @@ int smu_v11_0_gfx_off_control(struct smu_context *smu, bool enable)
 	case CHIP_NAVI14:
 	case CHIP_NAVI12:
 	case CHIP_SIENNA_CICHLID:
+	case CHIP_NAVY_FLOUNDER:
 		if (!(adev->pm.pp_feature & PP_GFXOFF_MASK))
 			return 0;
 		if (enable)
commit d392aa02db1b3ecbec49bc8bd28a132298174539
Author: Liu ChengZhe <ChengZhe.Liu at amd.com>
Date:   Fri Jul 24 15:55:33 2020 +0800

    drm amdgpu: Skip tmr load for SRIOV
    
    1. For Navi12, CHIP_SIENNA_CICHLID, skip tmr load operation;
    2. Check pointer before release firmware.
    
    v2: use CHIP_SIENNA_CICHLID instead
    v3: remove local "bool ret"; fix grammer issue
    v4: use my name instead of "root"
    v5: fix grammer issue and indent issue
    
    Signed-off-by: Liu ChengZhe <ChengZhe.Liu at amd.com>
    Reviewed-by: Luben Tuikov <luben.tuikov at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index 8034111acd9a..7fe564275457 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -193,12 +193,18 @@ static int psp_sw_fini(void *handle)
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
 	psp_memory_training_fini(&adev->psp);
-	release_firmware(adev->psp.sos_fw);
-	adev->psp.sos_fw = NULL;
-	release_firmware(adev->psp.asd_fw);
-	adev->psp.asd_fw = NULL;
-	release_firmware(adev->psp.ta_fw);
-	adev->psp.ta_fw = NULL;
+	if (adev->psp.sos_fw) {
+		release_firmware(adev->psp.sos_fw);
+		adev->psp.sos_fw = NULL;
+	}
+	if (adev->psp.asd_fw) {
+		release_firmware(adev->psp.asd_fw);
+		adev->psp.asd_fw = NULL;
+	}
+	if (adev->psp.ta_fw) {
+		release_firmware(adev->psp.ta_fw);
+		adev->psp.ta_fw = NULL;
+	}
 
 	if (adev->asic_type == CHIP_NAVI10)
 		psp_sysfs_fini(adev);
@@ -409,11 +415,28 @@ static int psp_clear_vf_fw(struct psp_context *psp)
 	return ret;
 }
 
+static bool psp_skip_tmr(struct psp_context *psp)
+{
+	switch (psp->adev->asic_type) {
+	case CHIP_NAVI12:
+	case CHIP_SIENNA_CICHLID:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static int psp_tmr_load(struct psp_context *psp)
 {
 	int ret;
 	struct psp_gfx_cmd_resp *cmd;
 
+	/* For Navi12 and CHIP_SIENNA_CICHLID SRIOV, do not set up TMR.
+	 * Already set up by host driver.
+	 */
+	if (amdgpu_sriov_vf(psp->adev) && psp_skip_tmr(psp))
+		return 0;
+
 	cmd = kzalloc(sizeof(struct psp_gfx_cmd_resp), GFP_KERNEL);
 	if (!cmd)
 		return -ENOMEM;
commit 6b6124bb4a0b05fa9ac052e14dd7c37c42ab9297
Author: Liu ChengZhe <ChengZhe.Liu at amd.com>
Date:   Fri Jul 24 17:22:15 2020 +0800

    drm/amdgpu: fix PSP autoload twice in FLR
    
    Assigning false to block->status.hw overwrites PSP's previous
    hardware status, which causes the PSP to Resume operation after
    hardware init.
    
    Remove this assignment and let the PSP execute Resume operation
    when it is told to.
    
    v2: Remove the braces.
    v3: Modify the description.
    
    Signed-off-by: Liu ChengZhe <ChengZhe.Liu at amd.com>
    Reviewed-by: Luben Tuikov <luben.tuikov at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index aa5b54e5a1d7..eb7cfe87042e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2574,6 +2574,9 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
 		AMD_IP_BLOCK_TYPE_IH,
 	};
 
+	for (i = 0; i < adev->num_ip_blocks; i++)
+		adev->ip_blocks[i].status.hw = false;
+
 	for (i = 0; i < ARRAY_SIZE(ip_order); i++) {
 		int j;
 		struct amdgpu_ip_block *block;
@@ -2581,7 +2584,6 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
 		for (j = 0; j < adev->num_ip_blocks; j++) {
 			block = &adev->ip_blocks[j];
 
-			block->status.hw = false;
 			if (block->version->type != ip_order[i] ||
 				!block->status.valid)
 				continue;
commit 278a4b5f62be85fa62d4439b5fbdf15027e99606
Author: Jiansong Chen <Jiansong.Chen at amd.com>
Date:   Wed Jul 29 11:58:21 2020 +0800

    drm/amdgpu: update GC golden setting for navy_flounder
    
    Update GC golden setting for navy_flounder.
    
    Signed-off-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Reviewed-by: Tao Zhou <tao.zhou1 at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 8344c3b0b9b5..43cf3487c98a 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -3127,7 +3127,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_3_2[] =
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA0_CLK_CTRL, 0xff7f0fff, 0x30000100),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA1_CLK_CTRL, 0xff7f0fff, 0x7e000100),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCPF_GCR_CNTL, 0x0007ffff, 0x0000c000),
-	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000200),
+	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000280),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x00800000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_EXCEPTION_CONTROL, 0x7fff0f1f, 0x00b80000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL_Sienna_Cichlid, 0x1ff1ffff, 0x00000500),
@@ -3158,7 +3158,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_3_2[] =
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_PERFCOUNTER7_SELECT, 0xf0f001ff, 0x00000000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_PERFCOUNTER8_SELECT, 0xf0f001ff, 0x00000000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmSQ_PERFCOUNTER9_SELECT, 0xf0f001ff, 0x00000000),
-	SOC15_REG_GOLDEN_VALUE(GC, 0, mmTA_CNTL_AUX, 0xffffffff, 0x010b0000),
+	SOC15_REG_GOLDEN_VALUE(GC, 0, mmTA_CNTL_AUX, 0xfff7ffff, 0x01030000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmUTCL1_CTRL, 0xffbfffff, 0x00a00000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmVGT_GS_MAX_WAVE_ID, 0x00000fff, 0x000003ff)
 };
commit 0730344ee370012574fe73c2785557d0e9180430
Author: Jiansong Chen <Jiansong.Chen at amd.com>
Date:   Tue Jul 28 19:14:22 2020 +0800

    drm/amd/powerplay: update driver if version for navy_flounder
    
    It's in accordance with pmfw 65.5.0 for navy_flounder.
    
    Signed-off-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Reviewed-by: Tao Zhou <tao.zhou1 at amd.com>
    Reviewed-by: Kenneth Feng <kenneth.feng at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h b/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
index 9504f9954fd3..6a42331aba8a 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
@@ -31,7 +31,7 @@
 #define SMU11_DRIVER_IF_VERSION_NV12 0x33
 #define SMU11_DRIVER_IF_VERSION_NV14 0x36
 #define SMU11_DRIVER_IF_VERSION_Sienna_Cichlid 0x34
-#define SMU11_DRIVER_IF_VERSION_Navy_Flounder 0x2
+#define SMU11_DRIVER_IF_VERSION_Navy_Flounder 0x3
 
 /* MP Apertures */
 #define MP0_Public			0x03800000
commit a676a97623d399f7a2174b347d688412864d385a
Author: Huang Rui <ray.huang at amd.com>
Date:   Mon Jul 27 16:19:45 2020 +0800

    drm/amdgpu: skip crit temperature values on APU (v2)
    
    It doesn't expose PPTable descriptor on APU platform. So max/min
    temperature values cannot be got from APU platform.
    
    v2: Stoney needs to skip crit temperature as well.
    
    Signed-off-by: Huang Rui <ray.huang at amd.com>
    Reviewed-by: Kevin Wang <kevin1.wang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index 5f20cadee343..e4dbf14320b6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -3212,6 +3212,12 @@ static umode_t hwmon_attributes_visible(struct kobject *kobj,
 	     attr == &sensor_dev_attr_fan1_enable.dev_attr.attr))
 		return 0;
 
+	/* Skip crit temp on APU */
+	if ((adev->flags & AMD_IS_APU) && (adev->family >= AMDGPU_FAMILY_CZ) &&
+	    (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
+	     attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+		return 0;
+
 	/* Skip limit attributes if DPM is not enabled */
 	if (!adev->pm.dpm_enabled &&
 	    (attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
commit 76d5ef4ff10bc64f84a4b301cf8c25229048edd8
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Wed Jul 22 15:40:06 2020 -0400

    drm/amd/display: Fix DP Compliance tests 4.3.2.1 and 4.3.2.2
    
    [Why]
    Test expects that we also read HPD_IRQ_VECTOR when checking for
    symbol loss as well lane status.
    
    [How]
    Read bytes 0x200-0x205 instead of just 0x202-0x205
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 1a3dbed3becb..d7d2dcd49c06 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1138,23 +1138,22 @@ static enum link_training_result check_link_loss_status(
 	const struct link_training_settings *link_training_setting)
 {
 	enum link_training_result status = LINK_TRAINING_SUCCESS;
-	unsigned int lane01_status_address = DP_LANE0_1_STATUS;
 	union lane_status lane_status;
-	uint8_t dpcd_buf[4] = {0};
+	uint8_t dpcd_buf[6] = {0};
 	uint32_t lane;
 
 	core_link_read_dpcd(
-		link,
-		lane01_status_address,
-		(uint8_t *)(dpcd_buf),
-		sizeof(dpcd_buf));
+			link,
+			DP_SINK_COUNT,
+			(uint8_t *)(dpcd_buf),
+			sizeof(dpcd_buf));
 
 	/*parse lane status*/
 	for (lane = 0; lane < link->cur_link_settings.lane_count; lane++) {
 		/*
 		 * check lanes status
 		 */
-		lane_status.raw = get_nibble_at_index(&dpcd_buf[0], lane);
+		lane_status.raw = get_nibble_at_index(&dpcd_buf[2], lane);
 
 		if (!lane_status.bits.CHANNEL_EQ_DONE_0 ||
 			!lane_status.bits.CR_DONE_0 ||
commit b5fe6aa2b02cdfee75f747c68f3d303fddd09af9
Author: Wyatt Wood <wyatt.wood at amd.com>
Date:   Wed Jun 17 11:29:27 2020 -0400

    drm/amd/display: Use hw lock mgr
    
    [Why]
    Feature requires synchronization of dig, pipe, and cursor locking
    between driver and fw.
    
    [How]
    Set flag to force psr to use hw lock mgr.
    
    Signed-off-by: Wyatt Wood <wyatt.wood at amd.com>
    Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
index 82e67bd81f2d..5167d6b8a48d 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c
@@ -233,8 +233,8 @@ static bool dmub_psr_copy_settings(struct dmub_psr *dmub,
 	copy_settings_data->frame_cap_ind			= psr_context->psrFrameCaptureIndicationReq;
 	copy_settings_data->debug.bitfields.visual_confirm	= dc->dc->debug.visual_confirm == VISUAL_CONFIRM_PSR ?
 									true : false;
+	copy_settings_data->debug.bitfields.use_hw_lock_mgr	= 1;
 	copy_settings_data->init_sdp_deadline			= psr_context->sdpTransmitLineNumDeadline;
-	copy_settings_data->debug.bitfields.use_hw_lock_mgr	= 0;
 
 	dc_dmub_srv_cmd_queue(dc->dmub_srv, &cmd);
 	dc_dmub_srv_cmd_execute(dc->dmub_srv);
commit 8b0379a85762b516c7b46aed7dbf2a4947c00564
Author: hersen wu <hersenxs.wu at amd.com>
Date:   Sun Jul 19 17:21:59 2020 -0400

    drm/amd/display: dchubbub p-state warning during surface planes switch
    
    [Why]
    ramp_up_dispclk_with_dpp is to change dispclk, dppclk and dprefclk
    according to bandwidth requirement. call stack: rv1_update_clocks -->
    update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth
    --> prepare_bandwidth / optimize_bandwidth. before change dcn hw,
    prepare_bandwidth will be called first to allow enough clock,
    watermark for change, after end of dcn hw change, optimize_bandwidth
    is executed to lower clock to save power for new dcn hw settings.
    
    below is sequence of commit_planes_for_stream:
    step 1: prepare_bandwidth - raise clock to have enough bandwidth
    step 2: lock_doublebuffer_enable
    step 3: pipe_control_lock(true) - make dchubp register change will
    not take effect right way
    step 4: apply_ctx_for_surface - program dchubp
    step 5: pipe_control_lock(false) - dchubp register change take effect
    step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream
    for full_date, optimize clock to save power
    
    at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be
    changed for new dchubp configuration. but real dcn hub dchubps are
    still running with old configuration until end of step 5. this need
    clocks settings at step 1 should not less than that before step 1.
    this is checked by two conditions: 1. if (should_set_clock(safe_to_lower
    , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) ||
    new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz)
    2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz
    
    the second condition is based on new dchubp configuration. dppclk
    for new dchubp may be different from dppclk before step 1.
    for example, before step 1, dchubps are as below:
    pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979)
    pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080)
    for dppclk for pipe0 need dppclk = dispclk
    
    new dchubp pipe split configuration:
    pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080)
    pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080)
    dppclk only needs dppclk = dispclk /2.
    
    dispclk, dppclk are not lock by otg master lock. they take effect
    after step 1. during this transition, dispclk are the same, but
    dppclk is changed to half of previous clock for old dchubp
    configuration between step 1 and step 6. This may cause p-state
    warning intermittently.
    
    [How]
    for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we
    need make sure dppclk are not changed to less between step 1 and 6.
    for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz,
    new display clock is raised, but we do not know ratio of
    new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz,
    new_clocks->dispclk_khz /2 does not guarantee equal or higher than
    old dppclk. we could ignore power saving different between
    dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6.
    as long as safe_to_lower = false, set dpclk = dispclk to simplify
    condition check.
    
    CC: Stable <stable at vger.kernel.org>
    Signed-off-by: Hersen Wu <hersenxs.wu at amd.com>
    Reviewed-by: Aric Cyr <Aric.Cyr at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c
index 3fab9296918a..e133edc587d3 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c
@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_threshold(struct clk_mgr_internal *clk_mgr, stru
 	return disp_clk_threshold;
 }
 
-static void ramp_up_dispclk_with_dpp(struct clk_mgr_internal *clk_mgr, struct dc *dc, struct dc_clocks *new_clocks)
+static void ramp_up_dispclk_with_dpp(
+		struct clk_mgr_internal *clk_mgr,
+		struct dc *dc,
+		struct dc_clocks *new_clocks,
+		bool safe_to_lower)
 {
 	int i;
 	int dispclk_to_dpp_threshold = rv1_determine_dppclk_threshold(clk_mgr, new_clocks);
 	bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz;
 
+	/* this function is to change dispclk, dppclk and dprefclk according to
+	 * bandwidth requirement. Its call stack is rv1_update_clocks -->
+	 * update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth
+	 * --> prepare_bandwidth / optimize_bandwidth. before change dcn hw,
+	 * prepare_bandwidth will be called first to allow enough clock,
+	 * watermark for change, after end of dcn hw change, optimize_bandwidth
+	 * is executed to lower clock to save power for new dcn hw settings.
+	 *
+	 * below is sequence of commit_planes_for_stream:
+	 *
+	 * step 1: prepare_bandwidth - raise clock to have enough bandwidth
+	 * step 2: lock_doublebuffer_enable
+	 * step 3: pipe_control_lock(true) - make dchubp register change will
+	 * not take effect right way
+	 * step 4: apply_ctx_for_surface - program dchubp
+	 * step 5: pipe_control_lock(false) - dchubp register change take effect
+	 * step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream
+	 * for full_date, optimize clock to save power
+	 *
+	 * at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be
+	 * changed for new dchubp configuration. but real dcn hub dchubps are
+	 * still running with old configuration until end of step 5. this need
+	 * clocks settings at step 1 should not less than that before step 1.
+	 * this is checked by two conditions: 1. if (should_set_clock(safe_to_lower
+	 * , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) ||
+	 * new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz)
+	 * 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz
+	 *
+	 * the second condition is based on new dchubp configuration. dppclk
+	 * for new dchubp may be different from dppclk before step 1.
+	 * for example, before step 1, dchubps are as below:
+	 * pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979)
+	 * pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080)
+	 * for dppclk for pipe0 need dppclk = dispclk
+	 *
+	 * new dchubp pipe split configuration:
+	 * pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080)
+	 * pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080)
+	 * dppclk only needs dppclk = dispclk /2.
+	 *
+	 * dispclk, dppclk are not lock by otg master lock. they take effect
+	 * after step 1. during this transition, dispclk are the same, but
+	 * dppclk is changed to half of previous clock for old dchubp
+	 * configuration between step 1 and step 6. This may cause p-state
+	 * warning intermittently.
+	 *
+	 * for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we
+	 * need make sure dppclk are not changed to less between step 1 and 6.
+	 * for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz,
+	 * new display clock is raised, but we do not know ratio of
+	 * new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz,
+	 * new_clocks->dispclk_khz /2 does not guarantee equal or higher than
+	 * old dppclk. we could ignore power saving different between
+	 * dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6.
+	 * as long as safe_to_lower = false, set dpclk = dispclk to simplify
+	 * condition check.
+	 * todo: review this change for other asic.
+	 **/
+	if (!safe_to_lower)
+		request_dpp_div = false;
+
 	/* set disp clk to dpp clk threshold */
 
 	clk_mgr->funcs->set_dispclk(clk_mgr, dispclk_to_dpp_threshold);
@@ -209,7 +274,7 @@ static void rv1_update_clocks(struct clk_mgr *clk_mgr_base,
 	/* program dispclk on = as a w/a for sleep resume clock ramping issues */
 	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)
 			|| new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) {
-		ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks);
+		ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks, safe_to_lower);
 		clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
 		send_request_to_lower = true;
 	}
commit 471c1dd9546df81d259664ac3e2ab0e99169f755
Author: Reza Amini <Reza.Amini at amd.com>
Date:   Wed Jul 15 11:33:23 2020 -0400

    drm/amd/display: Allow asic specific FSFT timing optimization
    
    [Why]
    Each asic can optimize best based on its capabilities
    
    [How]
    Optimizing timing for a new pixel clock
    
    Signed-off-by: Reza Amini <Reza.Amini at amd.com>
    Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 10d69ada88e3..0257a900fe2b 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -246,20 +246,18 @@ struct dc_stream_status *dc_stream_get_status(
 
 #ifndef TRIM_FSFT
 /**
- * dc_optimize_timing() - dc to optimize timing
+ * dc_optimize_timing_for_fsft() - dc to optimize timing
  */
-bool dc_optimize_timing(
-	struct dc_crtc_timing *timing,
+bool dc_optimize_timing_for_fsft(
+	struct dc_stream_state *pStream,
 	unsigned int max_input_rate_in_khz)
 {
-	//optimization is expected to assing a value to these:
-	//timing->pix_clk_100hz
-	//timing->v_front_porch
-	//timing->v_total
-	//timing->fast_transport_output_rate_100hz;
-	timing->fast_transport_output_rate_100hz = timing->pix_clk_100hz;
+	struct dc  *dc;
 
-	return true;
+	dc = pStream->ctx->dc;
+
+	return (dc->hwss.optimize_timing_for_fsft &&
+		dc->hwss.optimize_timing_for_fsft(dc, &pStream->timing, max_input_rate_in_khz));
 }
 #endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
index e4e85a159462..633442bc7ef2 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
@@ -424,8 +424,8 @@ struct dc_stream_status *dc_stream_get_status(
 	struct dc_stream_state *dc_stream);
 
 #ifndef TRIM_FSFT
-bool dc_optimize_timing(
-	struct dc_crtc_timing *timing,
+bool dc_optimize_timing_for_fsft(
+	struct dc_stream_state *pStream,
 	unsigned int max_input_rate_in_khz);
 #endif
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 7725a406c16e..66180b4332f1 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -2498,3 +2498,30 @@ void dcn20_fpga_init_hw(struct dc *dc)
 		tg->funcs->tg_init(tg);
 	}
 }
+#ifndef TRIM_FSFT
+bool dcn20_optimize_timing_for_fsft(struct dc *dc,
+		struct dc_crtc_timing *timing,
+		unsigned int max_input_rate_in_khz)
+{
+	unsigned int old_v_front_porch;
+	unsigned int old_v_total;
+	unsigned int max_input_rate_in_100hz;
+	unsigned long long new_v_total;
+
+	max_input_rate_in_100hz = max_input_rate_in_khz * 10;
+	if (max_input_rate_in_100hz < timing->pix_clk_100hz)
+		return false;
+
+	old_v_total = timing->v_total;
+	old_v_front_porch = timing->v_front_porch;
+
+	timing->fast_transport_output_rate_100hz = timing->pix_clk_100hz;
+	timing->pix_clk_100hz = max_input_rate_in_100hz;
+
+	new_v_total = div_u64((unsigned long long)old_v_total * max_input_rate_in_100hz, timing->pix_clk_100hz);
+
+	timing->v_total = new_v_total;
+	timing->v_front_porch = old_v_front_porch + (timing->v_total - old_v_total);
+	return true;
+}
+#endif
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.h b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.h
index 63ce763f148e..83220e34c1a9 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.h
@@ -132,5 +132,10 @@ int dcn20_init_sys_ctx(struct dce_hwseq *hws,
 		struct dc *dc,
 		struct dc_phy_addr_space_config *pa_config);
 
+#ifndef TRIM_FSFT
+bool dcn20_optimize_timing_for_fsft(struct dc *dc,
+		struct dc_crtc_timing *timing,
+		unsigned int max_input_rate_in_khz);
+#endif
 #endif /* __DC_HWSS_DCN20_H__ */
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_init.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_init.c
index 2380392b916e..3dde6f26de47 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_init.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_init.c
@@ -88,6 +88,9 @@ static const struct hw_sequencer_funcs dcn20_funcs = {
 	.set_backlight_level = dce110_set_backlight_level,
 	.set_abm_immediate_disable = dce110_set_abm_immediate_disable,
 	.set_pipe = dce110_set_pipe,
+#ifndef TRIM_FSFT
+	.optimize_timing_for_fsft = dcn20_optimize_timing_for_fsft,
+#endif
 };
 
 static const struct hwseq_private_funcs dcn20_private_funcs = {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_init.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_init.c
index 177d0dc8927a..b187f71afa65 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_init.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_init.c
@@ -92,6 +92,9 @@ static const struct hw_sequencer_funcs dcn21_funcs = {
 	.set_backlight_level = dcn21_set_backlight_level,
 	.set_abm_immediate_disable = dcn21_set_abm_immediate_disable,
 	.set_pipe = dcn21_set_pipe,
+#ifndef TRIM_FSFT
+	.optimize_timing_for_fsft = dcn20_optimize_timing_for_fsft,
+#endif
 };
 
 static const struct hwseq_private_funcs dcn21_private_funcs = {
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
index 720ce5e458d8..3c986717dcd5 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h
@@ -116,6 +116,11 @@ struct hw_sequencer_funcs {
 	void (*set_static_screen_control)(struct pipe_ctx **pipe_ctx,
 			int num_pipes,
 			const struct dc_static_screen_params *events);
+#ifndef TRIM_FSFT
+	bool (*optimize_timing_for_fsft)(struct dc *dc,
+			struct dc_crtc_timing *timing,
+			unsigned int max_input_rate_in_khz);
+#endif
 
 	/* Stream Related */
 	void (*enable_stream)(struct pipe_ctx *pipe_ctx);
diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
index 7a2500fbf3f2..81820f3d6b3b 100644
--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -829,10 +829,13 @@ void mod_freesync_build_vrr_infopacket(struct mod_freesync *mod_freesync,
 	switch (packet_type) {
 	case PACKET_TYPE_FS_V3:
 #ifndef TRIM_FSFT
+		// always populate with pixel rate.
 		build_vrr_infopacket_v3(
 				stream->signal, vrr,
 				stream->timing.flags.FAST_TRANSPORT,
-				stream->timing.fast_transport_output_rate_100hz,
+				(stream->timing.flags.FAST_TRANSPORT) ?
+						stream->timing.fast_transport_output_rate_100hz :
+						stream->timing.pix_clk_100hz,
 				app_tf, infopacket);
 #else
 		build_vrr_infopacket_v3(stream->signal, vrr, app_tf, infopacket);
commit 6b6352dd1f96ca2464d7373557cb913f00c9e6dd
Author: Jun Lei <jun.lei at amd.com>
Date:   Thu Jun 25 13:24:12 2020 -0400

    drm/amd/display: Disable idle optimizations before programming DCN
    
    [Why]
    Programming DCN is explicitly forbidden during idle optimzations allowed
    state. Existing implemenation relies on OS/DM, which is not robust. Instead
    DC should sequence this.
    
    Note that DC will not re-enter idle optimized state on its own, it is only
    responsible for catching out of sequence calls. It is still DM
    responsibility to sequence appropriate for optimized power, but this change
    removes the requirement for DM to cover the .1% case.
    
    [How]
     - elevate updates during idle optimized state to full updates
     - disable idle power optimizations prior to programming
    
    Signed-off-by: Jun Lei <jun.lei at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index ef0b5941bc50..92eb1ca1634f 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1250,6 +1250,9 @@ static enum dc_status dc_commit_state_no_check(struct dc *dc, struct dc_state *c
 	int i, k, l;
 	struct dc_stream_state *dc_streams[MAX_STREAMS] = {0};
 
+#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
+	dc_allow_idle_optimizations(dc, false);
+#endif
 
 	for (i = 0; i < context->stream_count; i++)
 		dc_streams[i] =  context->streams[i];
@@ -1838,6 +1841,11 @@ static enum surface_update_type check_update_surfaces_for_stream(
 	int i;
 	enum surface_update_type overall_type = UPDATE_TYPE_FAST;
 
+#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
+	if (dc->idle_optimizations_allowed)
+		overall_type = UPDATE_TYPE_FULL;
+
+#endif
 	if (stream_status == NULL || stream_status->plane_count != surface_count)
 		overall_type = UPDATE_TYPE_FULL;
 
@@ -2306,8 +2314,14 @@ static void commit_planes_for_stream(struct dc *dc,
 		}
 	}
 
-	if (update_type == UPDATE_TYPE_FULL && dc->optimize_seamless_boot_streams == 0) {
-		dc->hwss.prepare_bandwidth(dc, context);
+	if (update_type == UPDATE_TYPE_FULL) {
+#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
+		dc_allow_idle_optimizations(dc, false);
+
+#endif
+		if (dc->optimize_seamless_boot_streams == 0)
+			dc->hwss.prepare_bandwidth(dc, context);
+
 		context_clock_trace(dc, context);
 	}
 
commit c5892a10218214d729699ab61bad6fc109baf0ce
Author: Stylon Wang <stylon.wang at amd.com>
Date:   Tue Jun 30 17:55:29 2020 +0800

    drm/amd/display: Fix dmesg warning from setting abm level
    
    [Why]
    Setting abm level does not correctly update CRTC state. As a result
    no surface update is added to dc stream state and triggers warning.
    
    [How]
    Correctly update CRTC state when setting abm level property.
    
    CC: Stable <stable at vger.kernel.org>
    Signed-off-by: Stylon Wang <stylon.wang at amd.com>
    Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 3067f54b9891..e6833a2d01f8 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8549,6 +8549,29 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
 	if (ret)
 		goto fail;
 
+	/* Check connector changes */
+	for_each_oldnew_connector_in_state(state, connector, old_con_state, new_con_state, i) {
+		struct dm_connector_state *dm_old_con_state = to_dm_connector_state(old_con_state);
+		struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state);
+
+		/* Skip connectors that are disabled or part of modeset already. */
+		if (!old_con_state->crtc && !new_con_state->crtc)
+			continue;
+
+		if (!new_con_state->crtc)
+			continue;
+
+		new_crtc_state = drm_atomic_get_crtc_state(state, new_con_state->crtc);
+		if (IS_ERR(new_crtc_state)) {
+			ret = PTR_ERR(new_crtc_state);
+			goto fail;
+		}
+
+		if (dm_old_con_state->abm_level !=
+		    dm_new_con_state->abm_level)
+			new_crtc_state->connectors_changed = true;
+	}
+
 #if defined(CONFIG_DRM_AMD_DC_DCN)
 	if (adev->asic_type >= CHIP_NAVI10) {
 		for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
commit 5eaec83a883b02c5e1d44d0537bb63444543d1e6
Author: Bhawanpreet Lakha <Bhawanpreet.Lakha at amd.com>
Date:   Fri Jul 24 16:36:07 2020 -0400

    drm/amd/display: Use proper abm/backlight functions for DCN3
    
    Use DCN21 functions instead of DCE110
    
    Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha at amd.com>
    Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas at amd.com>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_init.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_init.c
index 1b354c219d0a..9afee7160490 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_init.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_init.c
@@ -26,6 +26,7 @@
 #include "dce110/dce110_hw_sequencer.h"
 #include "dcn10/dcn10_hw_sequencer.h"
 #include "dcn20/dcn20_hwseq.h"
+#include "dcn21/dcn21_hwseq.h"
 #include "dcn30_hwseq.h"
 
 static const struct hw_sequencer_funcs dcn30_funcs = {
@@ -87,8 +88,8 @@ static const struct hw_sequencer_funcs dcn30_funcs = {
 	.set_flip_control_gsl = dcn20_set_flip_control_gsl,
 	.get_vupdate_offset_from_vsync = dcn10_get_vupdate_offset_from_vsync,
 	.apply_idle_power_optimizations = dcn30_apply_idle_power_optimizations,
-	.set_backlight_level = dce110_set_backlight_level,
-	.set_abm_immediate_disable = dce110_set_abm_immediate_disable,
+	.set_backlight_level = dcn21_set_backlight_level,
+	.set_abm_immediate_disable = dcn21_set_abm_immediate_disable,
 };
 
 static const struct hwseq_private_funcs dcn30_private_funcs = {
commit 5ce868fc474e8797bd16f19e435a538554c371ab
Author: Bhawanpreet Lakha <Bhawanpreet.Lakha at amd.com>
Date:   Tue Jul 21 13:59:52 2020 -0400

    drm/amd/display: Use seperate dmcub firmware for navy_flounder
    
    [Why]
    Currently navy_flounder is using sienna_cichlid_dmcub.bin.
    
    [How]
    Create a seperate define so navy_flounder will use its own firmware.
    
    Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 533913bf8410..3067f54b9891 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -97,6 +97,8 @@ MODULE_FIRMWARE(FIRMWARE_RENOIR_DMUB);
 #if defined(CONFIG_DRM_AMD_DC_DCN3_0)
 #define FIRMWARE_SIENNA_CICHLID_DMUB "amdgpu/sienna_cichlid_dmcub.bin"
 MODULE_FIRMWARE(FIRMWARE_SIENNA_CICHLID_DMUB);
+#define FIRMWARE_NAVY_FLOUNDER_DMUB "amdgpu/navy_flounder_dmcub.bin"
+MODULE_FIRMWARE(FIRMWARE_NAVY_FLOUNDER_DMUB);
 #endif
 
 #define FIRMWARE_RAVEN_DMCU		"amdgpu/raven_dmcu.bin"
@@ -1185,10 +1187,13 @@ static int dm_dmub_sw_init(struct amdgpu_device *adev)
 		break;
 #if defined(CONFIG_DRM_AMD_DC_DCN3_0)
 	case CHIP_SIENNA_CICHLID:
-	case CHIP_NAVY_FLOUNDER:
 		dmub_asic = DMUB_ASIC_DCN30;
 		fw_name_dmub = FIRMWARE_SIENNA_CICHLID_DMUB;
 		break;
+	case CHIP_NAVY_FLOUNDER:
+		dmub_asic = DMUB_ASIC_DCN30;
+		fw_name_dmub = FIRMWARE_NAVY_FLOUNDER_DMUB;
+		break;
 #endif
 
 	default:
commit 3fd20292c2352660155bbc11736dd014b2fc6e98
Author: Martin Tsai <martin.tsai at amd.com>
Date:   Wed Jul 15 11:21:43 2020 +0800

    drm/amd/display: Check lane status again after link training done
    
    [Why]
    Some monitors could suffer symbol unlock but cannot send HPD IRQ to
    notic source device to handle link loss. This makes monitor stuck in
    abnormal status and causes black screen.
    
    [How]
    According to the suggestion from scalar vendor, to check lane status
    again after link training done. That can improve the comaptibility
    from current production monitors.
    
    Signed-off-by: Martin Tsai <martin.tsai at amd.com>
    Reviewed-by: Aric Cyr <Aric.Cyr at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
index 5cb7b834e459..1a3dbed3becb 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
@@ -1133,6 +1133,45 @@ static inline enum link_training_result perform_link_training_int(
 	return status;
 }
 
+static enum link_training_result check_link_loss_status(
+	struct dc_link *link,
+	const struct link_training_settings *link_training_setting)
+{
+	enum link_training_result status = LINK_TRAINING_SUCCESS;
+	unsigned int lane01_status_address = DP_LANE0_1_STATUS;
+	union lane_status lane_status;
+	uint8_t dpcd_buf[4] = {0};
+	uint32_t lane;
+
+	core_link_read_dpcd(
+		link,
+		lane01_status_address,
+		(uint8_t *)(dpcd_buf),
+		sizeof(dpcd_buf));
+
+	/*parse lane status*/
+	for (lane = 0; lane < link->cur_link_settings.lane_count; lane++) {
+		/*
+		 * check lanes status
+		 */
+		lane_status.raw = get_nibble_at_index(&dpcd_buf[0], lane);
+
+		if (!lane_status.bits.CHANNEL_EQ_DONE_0 ||
+			!lane_status.bits.CR_DONE_0 ||
+			!lane_status.bits.SYMBOL_LOCKED_0) {
+			/* if one of the channel equalization, clock
+			 * recovery or symbol lock is dropped
+			 * consider it as (link has been
+			 * dropped) dp sink status has changed
+			 */
+			status = LINK_TRAINING_LINK_LOSS;
+			break;
+		}
+	}
+
+	return status;
+}
+
 static void initialize_training_settings(
 	 struct dc_link *link,
 	const struct dc_link_settings *link_setting,
@@ -1372,6 +1411,9 @@ static void print_status_message(
 	case LINK_TRAINING_LQA_FAIL:
 		lt_result = "LQA failed";
 		break;
+	case LINK_TRAINING_LINK_LOSS:
+		lt_result = "Link loss";
+		break;
 	default:
 		break;
 	}
@@ -1531,6 +1573,14 @@ enum link_training_result dc_link_dp_perform_link_training(
 				status);
 	}
 
+	/* delay 5ms after Main Link output idle pattern and then check
+	 * DPCD 0202h.
+	 */
+	if (link->connector_signal != SIGNAL_TYPE_EDP && status == LINK_TRAINING_SUCCESS) {
+		msleep(5);
+		status = check_link_loss_status(link, &lt_settings);
+	}
+
 	/* 6. print status message*/
 	print_status_message(link, &lt_settings, status);
 
diff --git a/drivers/gpu/drm/amd/display/include/link_service_types.h b/drivers/gpu/drm/amd/display/include/link_service_types.h
index 4869d4562e4d..550f46e9b95f 100644
--- a/drivers/gpu/drm/amd/display/include/link_service_types.h
+++ b/drivers/gpu/drm/amd/display/include/link_service_types.h
@@ -66,6 +66,8 @@ enum link_training_result {
 	/* other failure during EQ step */
 	LINK_TRAINING_EQ_FAIL_EQ,
 	LINK_TRAINING_LQA_FAIL,
+	/* one of the CR,EQ or symbol lock is dropped */
+	LINK_TRAINING_LINK_LOSS,
 };
 
 struct link_training_settings {
commit bc0cd80783ff7c2201b44d384bab4629c9cb7db9
Author: Alvin Lee <alvin.lee2 at amd.com>
Date:   Tue Jul 14 15:06:40 2020 -0400

    drm/amd/display: Don't compare dppclk before updating DTO
    
    [Why]
    In dcn3_update_clocks there are situations where dppclk is not
    lowered (i.e. stays the same), but DTO still needs to be increased
    before we program pipe frontend (i.e. in prepare_bandwidth). If we
    don't program the new DTO value before we program the pipe,
    we will underflow as soon as the pipe lock is released until the
    next call to dcn3_update_clocks where the DTO is updated.
    
    [How]
    Remove dppclk check before programming new DTO value.
    
    Signed-off-by: Alvin Lee <alvin.lee2 at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
index d94fdc52be37..9133646f6d5f 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn30/dcn30_clk_mgr.c
@@ -323,9 +323,10 @@ static void dcn3_update_clocks(struct clk_mgr *clk_mgr_base,
 			/* if clock is being raised, increase refclk before lowering DTO */
 			if (update_dppclk || update_dispclk)
 				dcn20_update_clocks_update_dentist(clk_mgr);
-			/* always update dtos unless clock is lowered and not safe to lower */
-			if (new_clocks->dppclk_khz >= dc->current_state->bw_ctx.bw.dcn.clk.dppclk_khz)
-				dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
+			/* There is a check inside dcn20_update_clocks_update_dpp_dto which ensures
+			 * that we do not lower dto when it is not safe to lower. We do not need to
+			 * compare the current and new dppclk before calling this function.*/
+			dcn20_update_clocks_update_dpp_dto(clk_mgr, context, safe_to_lower);
 		}
 	}
 
commit c6851841fc877d9e4361eeaa1e3851778fa440c4
Author: Eryk Brol <eryk.brol at amd.com>
Date:   Tue Jun 16 16:29:19 2020 -0400

    drm/amd/display: Fix naming of DSC Debugfs entry
    
    [why]
    Fix naming and return bits rather than bytes per pixel for
    naming consistency. Because registers return Bytes per pixel,
    but DSC Config structure is expecting bits per pixel as input.
    So when returning the value convert from bytes into bits.
    
    Signed-off-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Mikita Lipski <mikita.lipski at amd.com>
    Reviewed-by: Mikita Lipski <Mikita.Lipski at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 1c177c2ad1dc..e5a6d9115949 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -35,6 +35,7 @@
 #include "dmub/dmub_srv.h"
 #include "resource.h"
 #include "dsc.h"
+#include "dc_link_dp.h"
 
 struct dmub_debugfs_trace_header {
 	uint32_t entry_count;
@@ -1150,7 +1151,7 @@ static ssize_t dp_dsc_slice_height_read(struct file *f, char __user *buf,
 	return result;
 }
 
-static ssize_t dp_dsc_bytes_per_pixel_read(struct file *f, char __user *buf,
+static ssize_t dp_dsc_bits_per_pixel_read(struct file *f, char __user *buf,
 				    size_t size, loff_t *pos)
 {
 	char *rd_buf = NULL;
@@ -1460,9 +1461,9 @@ static const struct file_operations dp_dsc_slice_height_debugfs_fops = {
 	.llseek = default_llseek
 };
 
-static const struct file_operations dp_dsc_bytes_per_pixel_debugfs_fops = {
+static const struct file_operations dp_dsc_bits_per_pixel_debugfs_fops = {
 	.owner = THIS_MODULE,
-	.read = dp_dsc_bytes_per_pixel_read,
+	.read = dp_dsc_bits_per_pixel_read,
 	.llseek = default_llseek
 };
 
@@ -1552,7 +1553,7 @@ static const struct {
 		{"dsc_clock_en", &dp_dsc_clock_en_debugfs_fops},
 		{"dsc_slice_width", &dp_dsc_slice_width_debugfs_fops},
 		{"dsc_slice_height", &dp_dsc_slice_height_debugfs_fops},
-		{"dsc_bytes_per_pixel", &dp_dsc_bytes_per_pixel_debugfs_fops},
+		{"dsc_bits_per_pixel", &dp_dsc_bits_per_pixel_debugfs_fops},
 		{"dsc_pic_width", &dp_dsc_pic_width_debugfs_fops},
 		{"dsc_pic_height", &dp_dsc_pic_height_debugfs_fops},
 		{"dsc_chunk_size", &dp_dsc_chunk_size_debugfs_fops},
commit 5e061a4d020380566365e8aa8f629bbd200e9708
Author: Eryk Brol <eryk.brol at amd.com>
Date:   Tue Jun 16 16:24:11 2020 -0400

    drm/amd/display: Rename bytes_pp to the correct bits_pp
    
    [Why]
    Struct dcn_dsc_state is used for reading current state
    and parameters of DSC on a pipe, the target rate parameter
    uses bytes per pixel even though its reading BITS_PER_PIXEL
    register.
    
    [How]
    Changing it to Bits Per Pixel for consistency.
    
    Signed-off-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Mikita Lipski <mikita.lipski at amd.com>
    Reviewed-by: Mikita Lipski <Mikita.Lipski at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 998f729976bf..1c177c2ad1dc 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -1186,7 +1186,7 @@ static ssize_t dp_dsc_bytes_per_pixel_read(struct file *f, char __user *buf,
 
 	snprintf(rd_buf_ptr, str_len,
 		"%d\n",
-		dsc_state.dsc_bytes_per_pixel);
+		dsc_state.dsc_bits_per_pixel);
 	rd_buf_ptr += str_len;
 
 	while (size) {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index da0897fe3b54..a643927e272b 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -390,6 +390,8 @@ void dcn10_log_hw_state(struct dc *dc,
 	}
 	DTN_INFO("\n");
 
+	// dcn_dsc_state struct field bytes_per_pixel was renamed to bits_per_pixel
+	// TODO: Update golden log header to reflect this name change
 	DTN_INFO("DSC: CLOCK_EN  SLICE_WIDTH  Bytes_pp\n");
 	for (i = 0; i < pool->res_cap->num_dsc; i++) {
 		struct display_stream_compressor *dsc = pool->dscs[i];
@@ -400,7 +402,7 @@ void dcn10_log_hw_state(struct dc *dc,
 		dsc->inst,
 			s.dsc_clock_en,
 			s.dsc_slice_width,
-			s.dsc_bytes_per_pixel);
+			s.dsc_bits_per_pixel);
 		DTN_INFO("\n");
 	}
 	DTN_INFO("\n");
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c
index ba50214d6c32..79b640e202eb 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_dsc.c
@@ -156,7 +156,7 @@ static void dsc2_read_state(struct display_stream_compressor *dsc, struct dcn_ds
 
 	REG_GET(DSC_TOP_CONTROL, DSC_CLOCK_EN, &s->dsc_clock_en);
 	REG_GET(DSCC_PPS_CONFIG3, SLICE_WIDTH, &s->dsc_slice_width);
-	REG_GET(DSCC_PPS_CONFIG1, BITS_PER_PIXEL, &s->dsc_bytes_per_pixel);
+	REG_GET(DSCC_PPS_CONFIG1, BITS_PER_PIXEL, &s->dsc_bits_per_pixel);
 	REG_GET(DSCC_PPS_CONFIG3, SLICE_HEIGHT, &s->dsc_slice_height);
 	REG_GET(DSCC_PPS_CONFIG1, CHUNK_SIZE, &s->dsc_chunk_size);
 	REG_GET(DSCC_PPS_CONFIG2, PIC_WIDTH, &s->dsc_pic_width);
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h b/drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h
index 5915994f9eb8..f520e13aee4c 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/dsc.h
@@ -55,7 +55,7 @@ struct dsc_optc_config {
 struct dcn_dsc_state {
 	uint32_t dsc_clock_en;
 	uint32_t dsc_slice_width;
-	uint32_t dsc_bytes_per_pixel;
+	uint32_t dsc_bits_per_pixel;
 	uint32_t dsc_slice_height;
 	uint32_t dsc_pic_width;
 	uint32_t dsc_pic_height;
commit 7c146177b3368feda6dbb0e01b085c84d9774589
Author: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
Date:   Mon Jul 6 10:54:37 2020 -0400

    drm/amd/display: Clean up global sync param retrieval
    
    [Why]
    This change replaces older looping code in favor of these functions.
    
    [How]
    There are built in functions for extracting global sync params
    during mode validation now.
    
    Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
    Reviewed-by: Eric Bernstein <Eric.Bernstein at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 968a89bbcf24..2a5e7175926a 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -3069,8 +3069,7 @@ void dcn20_calculate_dlg_params(
 		int pipe_cnt,
 		int vlevel)
 {
-	int i, j, pipe_idx, pipe_idx_unsplit;
-	bool visited[MAX_PIPES] = { 0 };
+	int i, pipe_idx;
 
 	/* Writeback MCIF_WB arbitration parameters */
 	dc->res_pool->funcs->set_mcif_arb_params(dc, context, pipes, pipe_cnt);
@@ -3089,55 +3088,17 @@ void dcn20_calculate_dlg_params(
 	if (context->bw_ctx.bw.dcn.clk.dispclk_khz < dc->debug.min_disp_clk_khz)
 		context->bw_ctx.bw.dcn.clk.dispclk_khz = dc->debug.min_disp_clk_khz;
 
-	/*
-	 * An artifact of dml pipe split/odm is that pipes get merged back together for
-	 * calculation. Therefore we need to only extract for first pipe in ascending index order
-	 * and copy into the other split half.
-	 */
-	for (i = 0, pipe_idx = 0, pipe_idx_unsplit = 0; i < dc->res_pool->pipe_count; i++) {
-		if (!context->res_ctx.pipe_ctx[i].stream)
-			continue;
-
-		if (!visited[pipe_idx]) {
-			display_pipe_source_params_st *src = &pipes[pipe_idx].pipe.src;
-			display_pipe_dest_params_st *dst = &pipes[pipe_idx].pipe.dest;
-
-			dst->vstartup_start = context->bw_ctx.dml.vba.VStartup[pipe_idx_unsplit];
-			dst->vupdate_offset = context->bw_ctx.dml.vba.VUpdateOffsetPix[pipe_idx_unsplit];
-			dst->vupdate_width = context->bw_ctx.dml.vba.VUpdateWidthPix[pipe_idx_unsplit];
-			dst->vready_offset = context->bw_ctx.dml.vba.VReadyOffsetPix[pipe_idx_unsplit];
-			/*
-			 * j iterates inside pipes array, unlike i which iterates inside
-			 * pipe_ctx array
-			 */
-			if (src->is_hsplit)
-				for (j = pipe_idx + 1; j < pipe_cnt; j++) {
-					display_pipe_source_params_st *src_j = &pipes[j].pipe.src;
-					display_pipe_dest_params_st *dst_j = &pipes[j].pipe.dest;
-
-					if (src_j->is_hsplit && !visited[j]
-							&& src->hsplit_grp == src_j->hsplit_grp) {
-						dst_j->vstartup_start = context->bw_ctx.dml.vba.VStartup[pipe_idx_unsplit];
-						dst_j->vupdate_offset = context->bw_ctx.dml.vba.VUpdateOffsetPix[pipe_idx_unsplit];
-						dst_j->vupdate_width = context->bw_ctx.dml.vba.VUpdateWidthPix[pipe_idx_unsplit];
-						dst_j->vready_offset = context->bw_ctx.dml.vba.VReadyOffsetPix[pipe_idx_unsplit];
-						visited[j] = true;
-					}
-				}
-			visited[pipe_idx] = true;
-			pipe_idx_unsplit++;
-		}
-		pipe_idx++;
-	}
-
 	for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) {
 		if (!context->res_ctx.pipe_ctx[i].stream)
 			continue;
+		pipes[pipe_idx].pipe.dest.vstartup_start = get_vstartup(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
+		pipes[pipe_idx].pipe.dest.vupdate_offset = get_vupdate_offset(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
+		pipes[pipe_idx].pipe.dest.vupdate_width = get_vupdate_width(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
+		pipes[pipe_idx].pipe.dest.vready_offset = get_vready_offset(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx);
 		if (context->bw_ctx.bw.dcn.clk.dppclk_khz < pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000)
 			context->bw_ctx.bw.dcn.clk.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
 		context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz =
 						pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000;
-		ASSERT(visited[pipe_idx]);
 		context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest;
 		pipe_idx++;
 	}
diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
index 7916a7ea9336..b0064087b9bb 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
+++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c
@@ -154,23 +154,11 @@ dml_get_pipe_attr_func(refcyc_per_meta_chunk_vblank_c_in_us, mode_lib->vba.TimeP
 dml_get_pipe_attr_func(refcyc_per_meta_chunk_flip_l_in_us, mode_lib->vba.TimePerMetaChunkFlip);
 dml_get_pipe_attr_func(refcyc_per_meta_chunk_flip_c_in_us, mode_lib->vba.TimePerChromaMetaChunkFlip);
 
+dml_get_pipe_attr_func(vstartup, mode_lib->vba.VStartup);
 dml_get_pipe_attr_func(vupdate_offset, mode_lib->vba.VUpdateOffsetPix);
 dml_get_pipe_attr_func(vupdate_width, mode_lib->vba.VUpdateWidthPix);
 dml_get_pipe_attr_func(vready_offset, mode_lib->vba.VReadyOffsetPix);
 
-unsigned int get_vstartup_calculated(
-		struct display_mode_lib *mode_lib,
-		const display_e2e_pipe_params_st *pipes,
-		unsigned int num_pipes,
-		unsigned int which_pipe)
-{
-	unsigned int which_plane;
-
-	recalculate_params(mode_lib, pipes, num_pipes);
-	which_plane = mode_lib->vba.pipe_plane[which_pipe];
-	return mode_lib->vba.VStartup[which_plane];
-}
-
 double get_total_immediate_flip_bytes(
 		struct display_mode_lib *mode_lib,
 		const display_e2e_pipe_params_st *pipes,
diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h
index 756d8eb1221c..21e5111ea7a0 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h
+++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h
@@ -98,16 +98,11 @@ dml_get_pipe_attr_decl(refcyc_per_meta_chunk_vblank_c_in_us);
 dml_get_pipe_attr_decl(refcyc_per_meta_chunk_flip_l_in_us);
 dml_get_pipe_attr_decl(refcyc_per_meta_chunk_flip_c_in_us);
 
+dml_get_pipe_attr_decl(vstartup);
 dml_get_pipe_attr_decl(vupdate_offset);
 dml_get_pipe_attr_decl(vupdate_width);
 dml_get_pipe_attr_decl(vready_offset);
 
-unsigned int get_vstartup_calculated(
-		struct display_mode_lib *mode_lib,
-		const display_e2e_pipe_params_st *pipes,
-		unsigned int num_pipes,
-		unsigned int which_pipe);
-
 double get_total_immediate_flip_bytes(
 		struct display_mode_lib *mode_lib,
 		const display_e2e_pipe_params_st *pipes,
commit c4e0dbcb201a79639e5e74f456d8313893a259f5
Author: Kevin Wang <kevin1.wang at amd.com>
Date:   Mon Jul 27 09:08:22 2020 +0800

    drm/amd/swsmu: allow asic to handle sensor type by itself
    
    1. allow asic to handle sensor type by itself.
    2. if not, use smu common sensor to handle it.
    
    Signed-off-by: Kevin Wang <kevin1.wang at amd.com>
    Reviewed-by: Kenneth Feng <kenneth.feng at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 2da72f333ad9..8c624f1f33ba 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -1947,6 +1947,10 @@ int smu_read_sensor(struct smu_context *smu,
 
 	mutex_lock(&smu->mutex);
 
+	if (smu->ppt_funcs->read_sensor)
+		if (!smu->ppt_funcs->read_sensor(smu, sensor, data, size))
+			goto unlock;
+
 	switch (sensor) {
 	case AMDGPU_PP_SENSOR_STABLE_PSTATE_SCLK:
 		*((uint32_t *)data) = pstate_table->gfxclk_pstate.standard * 100;
@@ -1977,11 +1981,12 @@ int smu_read_sensor(struct smu_context *smu,
 		*size = 4;
 		break;
 	default:
-		if (smu->ppt_funcs->read_sensor)
-			ret = smu->ppt_funcs->read_sensor(smu, sensor, data, size);
+		*size = 0;
+		ret = -EOPNOTSUPP;
 		break;
 	}
 
+unlock:
 	mutex_unlock(&smu->mutex);
 
 	return ret;
commit 68bb3c3ff9d92645488382c7261de7d477f638e9
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date:   Mon Jul 27 16:39:40 2020 +0300

    drm/amd/powerplay: off by one bugs in smu_cmn_to_asic_specific_index()
    
    These tables have _COUNT number of elements so the comparisons should be
    >= instead of > to prevent reading one element beyond the end of the
    array.
    
    Fixes: 8264ee69f0d8 ("drm/amd/powerplay: drop unused code")
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/smu_cmn.c b/drivers/gpu/drm/amd/powerplay/smu_cmn.c
index be4b678d0e60..5c23c44c33bd 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_cmn.c
+++ b/drivers/gpu/drm/amd/powerplay/smu_cmn.c
@@ -166,7 +166,7 @@ int smu_cmn_to_asic_specific_index(struct smu_context *smu,
 
 	switch (type) {
 	case CMN2ASIC_MAPPING_MSG:
-		if (index > SMU_MSG_MAX_COUNT ||
+		if (index >= SMU_MSG_MAX_COUNT ||
 		    !smu->message_map)
 			return -EINVAL;
 
@@ -181,7 +181,7 @@ int smu_cmn_to_asic_specific_index(struct smu_context *smu,
 		return msg_mapping.map_to;
 
 	case CMN2ASIC_MAPPING_CLK:
-		if (index > SMU_CLK_COUNT ||
+		if (index >= SMU_CLK_COUNT ||
 		    !smu->clock_map)
 			return -EINVAL;
 
@@ -192,7 +192,7 @@ int smu_cmn_to_asic_specific_index(struct smu_context *smu,
 		return mapping.map_to;
 
 	case CMN2ASIC_MAPPING_FEATURE:
-		if (index > SMU_FEATURE_COUNT ||
+		if (index >= SMU_FEATURE_COUNT ||
 		    !smu->feature_map)
 			return -EINVAL;
 
@@ -203,7 +203,7 @@ int smu_cmn_to_asic_specific_index(struct smu_context *smu,
 		return mapping.map_to;
 
 	case CMN2ASIC_MAPPING_TABLE:
-		if (index > SMU_TABLE_COUNT ||
+		if (index >= SMU_TABLE_COUNT ||
 		    !smu->table_map)
 			return -EINVAL;
 
@@ -214,7 +214,7 @@ int smu_cmn_to_asic_specific_index(struct smu_context *smu,
 		return mapping.map_to;
 
 	case CMN2ASIC_MAPPING_PWR:
-		if (index > SMU_POWER_SOURCE_COUNT ||
+		if (index >= SMU_POWER_SOURCE_COUNT ||
 		    !smu->pwr_src_map)
 			return -EINVAL;
 
commit a486bc3c50198a7e895eef5dc3d2a94cd6186e4f
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Fri Jul 24 17:24:08 2020 +0800

    drm/amd/powerplay: update driver if file for sienna_cichlid
    
    Update sienna_cichlid driver if header and related files.
    Support new smu metrics for pre & postDS frequency.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Kenneth Feng <kenneth.feng at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if_sienna_cichlid.h b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if_sienna_cichlid.h
index b2232e24d82f..aa2708fccb6d 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if_sienna_cichlid.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu11_driver_if_sienna_cichlid.h
@@ -27,7 +27,7 @@
 // *** IMPORTANT ***
 // SMU TEAM: Always increment the interface version if 
 // any structure is changed in this file
-#define SMU11_DRIVER_IF_VERSION 0x33
+#define SMU11_DRIVER_IF_VERSION 0x34
 
 #define PPTABLE_Sienna_Cichlid_SMU_VERSION 5
 
@@ -968,9 +968,15 @@ typedef struct {
 
 typedef struct {
   uint32_t CurrClock[PPCLK_COUNT];
-  uint16_t AverageGfxclkFrequency;
-  uint16_t AverageFclkFrequency;
-  uint16_t AverageUclkFrequency  ;
+
+  uint16_t AverageGfxclkFrequencyPreDs;
+  uint16_t AverageGfxclkFrequencyPostDs;
+  uint16_t AverageFclkFrequencyPreDs;
+  uint16_t AverageFclkFrequencyPostDs;
+  uint16_t AverageUclkFrequencyPreDs  ;
+  uint16_t AverageUclkFrequencyPostDs  ;
+
+  
   uint16_t AverageGfxActivity    ;
   uint16_t AverageUclkActivity   ;
   uint8_t  CurrSocVoltageOffset  ;
@@ -988,6 +994,7 @@ typedef struct {
   uint16_t TemperatureLiquid0    ;
   uint16_t TemperatureLiquid1    ;  
   uint16_t TemperaturePlx        ;
+  uint16_t Padding16             ;
   uint32_t ThrottlerStatus       ; 
  
   uint8_t  LinkDpmLevel;
@@ -1006,8 +1013,10 @@ typedef struct {
   uint16_t AverageDclk0Frequency  ;  
   uint16_t AverageVclk1Frequency  ;
   uint16_t AverageDclk1Frequency  ;  
-  uint16_t VcnActivityPercentage ; //place holder, David N. to provide full sequence
-  uint16_t padding16_2;
+  uint16_t VcnActivityPercentage  ; //place holder, David N. to provide full sequence
+  uint8_t  PcieRate               ;
+  uint8_t  PcieWidth              ;
+
 } SmuMetrics_t;
 
 typedef struct {
diff --git a/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h b/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
index 429f5aa8924a..9504f9954fd3 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/smu_v11_0.h
@@ -30,7 +30,7 @@
 #define SMU11_DRIVER_IF_VERSION_NV10 0x36
 #define SMU11_DRIVER_IF_VERSION_NV12 0x33
 #define SMU11_DRIVER_IF_VERSION_NV14 0x36
-#define SMU11_DRIVER_IF_VERSION_Sienna_Cichlid 0x33
+#define SMU11_DRIVER_IF_VERSION_Sienna_Cichlid 0x34
 #define SMU11_DRIVER_IF_VERSION_Navy_Flounder 0x2
 
 /* MP Apertures */
diff --git a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
index dcc5d25a7894..f64a1be94cb8 100644
--- a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
@@ -70,6 +70,8 @@
 	FEATURE_MASK(FEATURE_DPM_FCLK_BIT)	 | \
 	FEATURE_MASK(FEATURE_DPM_DCEFCLK_BIT))
 
+#define SMU_11_0_7_GFX_BUSY_THRESHOLD 15
+
 static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT] = {
 	MSG_MAP(TestMessage,			PPSMC_MSG_TestMessage,                 1),
 	MSG_MAP(GetSmuVersion,			PPSMC_MSG_GetSmuVersion,               1),
@@ -443,13 +445,16 @@ static int sienna_cichlid_get_smu_metrics_data(struct smu_context *smu,
 		*value = metrics->CurrClock[PPCLK_DCEFCLK];
 		break;
 	case METRICS_AVERAGE_GFXCLK:
-		*value = metrics->AverageGfxclkFrequency;
+		if (metrics->AverageGfxActivity <= SMU_11_0_7_GFX_BUSY_THRESHOLD)
+			*value = metrics->AverageGfxclkFrequencyPostDs;
+		else
+			*value = metrics->AverageGfxclkFrequencyPreDs;
 		break;
 	case METRICS_AVERAGE_FCLK:
-		*value = metrics->AverageFclkFrequency;
+		*value = metrics->AverageFclkFrequencyPostDs;
 		break;
 	case METRICS_AVERAGE_UCLK:
-		*value = metrics->AverageUclkFrequency;
+		*value = metrics->AverageUclkFrequencyPostDs;
 		break;
 	case METRICS_AVERAGE_GFXACTIVITY:
 		*value = metrics->AverageGfxActivity;
commit de273b73ca6aef31c64071b90b9c76cd9f47d5d1
Author: Changfeng <Changfeng.Zhu at amd.com>
Date:   Fri Jul 24 13:15:10 2020 +0800

    drm/amd/powerplay: drop unnecessary message support check(v2)
    
    Take back patch:drop unnecessary message support check
    Because the gpu reset fail problem on renoir can be fixed by:
    drm/amd/powerplay: skip invalid msg when smu set mp1 state
    It needs to remove SWSMU_CODE_LAYER_L1 in smu_cmn.h to guard a clear
    code layer.
    
    Signed-off-by: changfeng <Changfeng.Zhu at amd.com>
    Reviewed-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 727cb9fd4aee..2da72f333ad9 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -34,7 +34,6 @@
 #include "sienna_cichlid_ppt.h"
 #include "renoir_ppt.h"
 #include "amd_pcie.h"
-#include "smu_cmn.h"
 
 /*
  * DO NOT use these for err/warn/info/debug messages.
@@ -1590,14 +1589,6 @@ int smu_set_mp1_state(struct smu_context *smu,
 		return 0;
 	}
 
-	/* some asics may not support those messages */
-	if (smu_cmn_to_asic_specific_index(smu,
-					   CMN2ASIC_MAPPING_MSG,
-					   msg) < 0) {
-		mutex_unlock(&smu->mutex);
-		return 0;
-	}
-
 	ret = smu_send_smc_msg(smu, msg, NULL);
 	/* some asics may not support those messages */
 	if (ret == -EINVAL)
diff --git a/drivers/gpu/drm/amd/powerplay/smu_cmn.h b/drivers/gpu/drm/amd/powerplay/smu_cmn.h
index f9e63f18b157..98face8c5fd6 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_cmn.h
+++ b/drivers/gpu/drm/amd/powerplay/smu_cmn.h
@@ -25,7 +25,7 @@
 
 #include "amdgpu_smu.h"
 
-#if defined(SWSMU_CODE_LAYER_L1) || defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4)
+#if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4)
 int smu_cmn_send_smc_msg_with_param(struct smu_context *smu,
 				    enum smu_message_type msg,
 				    uint32_t param,
commit bbf16f530cdf0e6f95e9954ca4aa7915cd3f1d99
Author: Boyuan Zhang <boyuan.zhang at amd.com>
Date:   Thu Jul 23 22:34:22 2020 -0400

    drm/amdgpu: update dec ring test for VCN 3.0
    
    Signed-off-by: Boyuan Zhang <boyuan.zhang at amd.com>
    Reviewed-by: Leo Liu <leo.liu at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
index 910a4a32ff78..63e5547cfb16 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -1659,7 +1659,7 @@ static const struct amdgpu_ring_funcs vcn_v3_0_dec_ring_vm_funcs = {
 	.emit_ib = vcn_v2_0_dec_ring_emit_ib,
 	.emit_fence = vcn_v2_0_dec_ring_emit_fence,
 	.emit_vm_flush = vcn_v2_0_dec_ring_emit_vm_flush,
-	.test_ring = amdgpu_vcn_dec_ring_test_ring,
+	.test_ring = vcn_v2_0_dec_ring_test_ring,
 	.test_ib = amdgpu_vcn_dec_ring_test_ib,
 	.insert_nop = vcn_v2_0_dec_ring_insert_nop,
 	.insert_start = vcn_v2_0_dec_ring_insert_start,
commit fa40a009001a30819097999d10cc3f51a0891564
Author: James Zhu <James.Zhu at amd.com>
Date:   Thu Jul 23 11:07:52 2020 -0400

    drm/amdgpu/jpeg3.0: remove extra asic type check
    
    jpeg ip block is already selected based on ASIC type during set_ip_blocks.
    
    Signed-off-by: James Zhu <James.Zhu at amd.com>
    Reviewed-by: Leo Liu <leo.liu at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
index 42f1a516005e..c41e5590a701 100644
--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c
@@ -49,12 +49,11 @@ static int jpeg_v3_0_set_powergating_state(void *handle,
 static int jpeg_v3_0_early_init(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-	if (adev->asic_type == CHIP_SIENNA_CICHLID) {
-		u32 harvest = RREG32_SOC15(JPEG, 0, mmCC_UVD_HARVESTING);
+	u32 harvest = RREG32_SOC15(JPEG, 0, mmCC_UVD_HARVESTING);
+
+	if (harvest & CC_UVD_HARVESTING__UVD_DISABLE_MASK)
+		return -ENOENT;
 
-		if (harvest & CC_UVD_HARVESTING__UVD_DISABLE_MASK)
-			return -ENOENT;
-	}
 	adev->jpeg.num_jpeg_inst = 1;
 
 	jpeg_v3_0_set_dec_ring_funcs(adev);
commit 3da0a2dfbd3a7ada2d8388775796edf12b2c7219
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Thu Jul 23 15:26:27 2020 +0800

    drm/amdgpu: update golden setting for sienna_cichlid
    
    Update golden setting for sienna_cichlid.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
index 61e89247faf3..8344c3b0b9b5 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
@@ -3082,7 +3082,7 @@ static const struct soc15_reg_golden golden_settings_gc_10_3[] =
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA0_CLK_CTRL, 0xff7f0fff, 0x30000100),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCGTT_SPI_RA1_CLK_CTRL, 0xff7f0fff, 0x7e000100),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmCPF_GCR_CNTL, 0x0007ffff, 0x0000c000),
-	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000200),
+	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG3, 0xffffffff, 0x00000280),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_DEBUG4, 0xffffffff, 0x00800000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmDB_EXCEPTION_CONTROL, 0x7fff0f1f, 0x00b80000),
 	SOC15_REG_GOLDEN_VALUE(GC, 0, mmGCR_GENERAL_CNTL_Sienna_Cichlid, 0x1ff1ffff, 0x00000500),
commit 518dcf959c68a33e61d78fec47a1d2a674d0120c
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Tue Jul 21 16:39:45 2020 +0800

    drm/amd/powerplay: correct smu message for vf mode
    
    Set valid_in_vf to false for the message not support in vf mode on
    sienna cichlid.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
index f44fd33aeb93..dcc5d25a7894 100644
--- a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
@@ -74,10 +74,10 @@ static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT]
 	MSG_MAP(TestMessage,			PPSMC_MSG_TestMessage,                 1),
 	MSG_MAP(GetSmuVersion,			PPSMC_MSG_GetSmuVersion,               1),
 	MSG_MAP(GetDriverIfVersion,		PPSMC_MSG_GetDriverIfVersion,          1),
-	MSG_MAP(SetAllowedFeaturesMaskLow,	PPSMC_MSG_SetAllowedFeaturesMaskLow,   1),
-	MSG_MAP(SetAllowedFeaturesMaskHigh,	PPSMC_MSG_SetAllowedFeaturesMaskHigh,  1),
-	MSG_MAP(EnableAllSmuFeatures,		PPSMC_MSG_EnableAllSmuFeatures,        1),
-	MSG_MAP(DisableAllSmuFeatures,		PPSMC_MSG_DisableAllSmuFeatures,       1),
+	MSG_MAP(SetAllowedFeaturesMaskLow,	PPSMC_MSG_SetAllowedFeaturesMaskLow,   0),
+	MSG_MAP(SetAllowedFeaturesMaskHigh,	PPSMC_MSG_SetAllowedFeaturesMaskHigh,  0),
+	MSG_MAP(EnableAllSmuFeatures,		PPSMC_MSG_EnableAllSmuFeatures,        0),
+	MSG_MAP(DisableAllSmuFeatures,		PPSMC_MSG_DisableAllSmuFeatures,       0),
 	MSG_MAP(EnableSmuFeaturesLow,		PPSMC_MSG_EnableSmuFeaturesLow,        1),
 	MSG_MAP(EnableSmuFeaturesHigh,		PPSMC_MSG_EnableSmuFeaturesHigh,       1),
 	MSG_MAP(DisableSmuFeaturesLow,		PPSMC_MSG_DisableSmuFeaturesLow,       1),
@@ -85,43 +85,43 @@ static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT]
 	MSG_MAP(GetEnabledSmuFeaturesLow,       PPSMC_MSG_GetRunningSmuFeaturesLow,    1),
 	MSG_MAP(GetEnabledSmuFeaturesHigh,	PPSMC_MSG_GetRunningSmuFeaturesHigh,   1),
 	MSG_MAP(SetWorkloadMask,		PPSMC_MSG_SetWorkloadMask,             1),
-	MSG_MAP(SetPptLimit,			PPSMC_MSG_SetPptLimit,                 1),
-	MSG_MAP(SetDriverDramAddrHigh,		PPSMC_MSG_SetDriverDramAddrHigh,       1),
-	MSG_MAP(SetDriverDramAddrLow,		PPSMC_MSG_SetDriverDramAddrLow,        1),
-	MSG_MAP(SetToolsDramAddrHigh,		PPSMC_MSG_SetToolsDramAddrHigh,        1),
-	MSG_MAP(SetToolsDramAddrLow,		PPSMC_MSG_SetToolsDramAddrLow,         1),
-	MSG_MAP(TransferTableSmu2Dram,		PPSMC_MSG_TransferTableSmu2Dram,       1),
-	MSG_MAP(TransferTableDram2Smu,		PPSMC_MSG_TransferTableDram2Smu,       1),
-	MSG_MAP(UseDefaultPPTable,		PPSMC_MSG_UseDefaultPPTable,           1),
-	MSG_MAP(EnterBaco,			PPSMC_MSG_EnterBaco,                   1),
-	MSG_MAP(SetSoftMinByFreq,		PPSMC_MSG_SetSoftMinByFreq,            1),
-	MSG_MAP(SetSoftMaxByFreq,		PPSMC_MSG_SetSoftMaxByFreq,            1),
+	MSG_MAP(SetPptLimit,			PPSMC_MSG_SetPptLimit,                 0),
+	MSG_MAP(SetDriverDramAddrHigh,		PPSMC_MSG_SetDriverDramAddrHigh,       0),
+	MSG_MAP(SetDriverDramAddrLow,		PPSMC_MSG_SetDriverDramAddrLow,        0),
+	MSG_MAP(SetToolsDramAddrHigh,		PPSMC_MSG_SetToolsDramAddrHigh,        0),
+	MSG_MAP(SetToolsDramAddrLow,		PPSMC_MSG_SetToolsDramAddrLow,         0),
+	MSG_MAP(TransferTableSmu2Dram,		PPSMC_MSG_TransferTableSmu2Dram,       0),
+	MSG_MAP(TransferTableDram2Smu,		PPSMC_MSG_TransferTableDram2Smu,       0),
+	MSG_MAP(UseDefaultPPTable,		PPSMC_MSG_UseDefaultPPTable,           0),
+	MSG_MAP(EnterBaco,			PPSMC_MSG_EnterBaco,                   0),
+	MSG_MAP(SetSoftMinByFreq,		PPSMC_MSG_SetSoftMinByFreq,            0),
+	MSG_MAP(SetSoftMaxByFreq,		PPSMC_MSG_SetSoftMaxByFreq,            0),
 	MSG_MAP(SetHardMinByFreq,		PPSMC_MSG_SetHardMinByFreq,            1),
-	MSG_MAP(SetHardMaxByFreq,		PPSMC_MSG_SetHardMaxByFreq,            1),
+	MSG_MAP(SetHardMaxByFreq,		PPSMC_MSG_SetHardMaxByFreq,            0),
 	MSG_MAP(GetMinDpmFreq,			PPSMC_MSG_GetMinDpmFreq,               1),
 	MSG_MAP(GetMaxDpmFreq,			PPSMC_MSG_GetMaxDpmFreq,               1),
 	MSG_MAP(GetDpmFreqByIndex,		PPSMC_MSG_GetDpmFreqByIndex,           1),
-	MSG_MAP(SetGeminiMode,			PPSMC_MSG_SetGeminiMode,               1),
-	MSG_MAP(SetGeminiApertureHigh,		PPSMC_MSG_SetGeminiApertureHigh,       1),
-	MSG_MAP(SetGeminiApertureLow,		PPSMC_MSG_SetGeminiApertureLow,        1),
-	MSG_MAP(OverridePcieParameters,		PPSMC_MSG_OverridePcieParameters,      1),
-	MSG_MAP(ReenableAcDcInterrupt,		PPSMC_MSG_ReenableAcDcInterrupt,       1),
-	MSG_MAP(NotifyPowerSource,		PPSMC_MSG_NotifyPowerSource,           1),
-	MSG_MAP(SetUclkFastSwitch,		PPSMC_MSG_SetUclkFastSwitch,           1),
-	MSG_MAP(SetVideoFps,			PPSMC_MSG_SetVideoFps,                 1),
+	MSG_MAP(SetGeminiMode,			PPSMC_MSG_SetGeminiMode,               0),
+	MSG_MAP(SetGeminiApertureHigh,		PPSMC_MSG_SetGeminiApertureHigh,       0),
+	MSG_MAP(SetGeminiApertureLow,		PPSMC_MSG_SetGeminiApertureLow,        0),
+	MSG_MAP(OverridePcieParameters,		PPSMC_MSG_OverridePcieParameters,      0),
+	MSG_MAP(ReenableAcDcInterrupt,		PPSMC_MSG_ReenableAcDcInterrupt,       0),
+	MSG_MAP(NotifyPowerSource,		PPSMC_MSG_NotifyPowerSource,           0),
+	MSG_MAP(SetUclkFastSwitch,		PPSMC_MSG_SetUclkFastSwitch,           0),
+	MSG_MAP(SetVideoFps,			PPSMC_MSG_SetVideoFps,                 0),
 	MSG_MAP(PrepareMp1ForUnload,		PPSMC_MSG_PrepareMp1ForUnload,         1),
-	MSG_MAP(AllowGfxOff,			PPSMC_MSG_AllowGfxOff,                 1),
-	MSG_MAP(DisallowGfxOff,			PPSMC_MSG_DisallowGfxOff,              1),
-	MSG_MAP(GetPptLimit,			PPSMC_MSG_GetPptLimit,                 1),
+	MSG_MAP(AllowGfxOff,			PPSMC_MSG_AllowGfxOff,                 0),
+	MSG_MAP(DisallowGfxOff,			PPSMC_MSG_DisallowGfxOff,              0),
+	MSG_MAP(GetPptLimit,			PPSMC_MSG_GetPptLimit,                 0),
 	MSG_MAP(GetDcModeMaxDpmFreq,		PPSMC_MSG_GetDcModeMaxDpmFreq,         1),
-	MSG_MAP(ExitBaco,			PPSMC_MSG_ExitBaco,                    1),
-	MSG_MAP(PowerUpVcn,			PPSMC_MSG_PowerUpVcn,                  1),
-	MSG_MAP(PowerDownVcn,			PPSMC_MSG_PowerDownVcn,                1),
-	MSG_MAP(PowerUpJpeg,			PPSMC_MSG_PowerUpJpeg,                 1),
-	MSG_MAP(PowerDownJpeg,			PPSMC_MSG_PowerDownJpeg,               1),
-	MSG_MAP(BacoAudioD3PME,			PPSMC_MSG_BacoAudioD3PME,              1),
-	MSG_MAP(ArmD3,				PPSMC_MSG_ArmD3,                       1),
-	MSG_MAP(Mode1Reset,                     PPSMC_MSG_Mode1Reset,		       1),
+	MSG_MAP(ExitBaco,			PPSMC_MSG_ExitBaco,                    0),
+	MSG_MAP(PowerUpVcn,			PPSMC_MSG_PowerUpVcn,                  0),
+	MSG_MAP(PowerDownVcn,			PPSMC_MSG_PowerDownVcn,                0),
+	MSG_MAP(PowerUpJpeg,			PPSMC_MSG_PowerUpJpeg,                 0),
+	MSG_MAP(PowerDownJpeg,			PPSMC_MSG_PowerDownJpeg,               0),
+	MSG_MAP(BacoAudioD3PME,			PPSMC_MSG_BacoAudioD3PME,              0),
+	MSG_MAP(ArmD3,				PPSMC_MSG_ArmD3,                       0),
+	MSG_MAP(Mode1Reset,                     PPSMC_MSG_Mode1Reset,		       0),
 };
 
 static struct cmn2asic_mapping sienna_cichlid_clk_map[SMU_CLK_COUNT] = {
commit ef69ab6aed16094b3d840d5863ae665f21fedf58
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Tue Jul 21 13:13:39 2020 +0800

    drm/amd/powerplay: add msg map for mode1 reset
    
    Mapping Mode1Reset message for sienna_cichlid.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
index 59da3ca2a4ca..f44fd33aeb93 100644
--- a/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/powerplay/sienna_cichlid_ppt.c
@@ -121,6 +121,7 @@ static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT]
 	MSG_MAP(PowerDownJpeg,			PPSMC_MSG_PowerDownJpeg,               1),
 	MSG_MAP(BacoAudioD3PME,			PPSMC_MSG_BacoAudioD3PME,              1),
 	MSG_MAP(ArmD3,				PPSMC_MSG_ArmD3,                       1),
+	MSG_MAP(Mode1Reset,                     PPSMC_MSG_Mode1Reset,		       1),
 };
 
 static struct cmn2asic_mapping sienna_cichlid_clk_map[SMU_CLK_COUNT] = {
commit 2f32faec004319a609982859a2b47459ae838888
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Tue Jul 21 14:01:53 2020 +0800

    drm/amd/powerplay: skip invalid msg when smu set mp1 state
    
    Some asic may not support for some message of set mp1 state.
    If the return value of smu_send_smc_msg is -EINVAL, that means it failed
    to send msg to smc as it can not map an valid message for the ASIC. And
    with that case, smu_set_mp1_state should be skipped as those ASIC was in
    fact do not support for that.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 6b03f750e63b..727cb9fd4aee 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -1599,6 +1599,9 @@ int smu_set_mp1_state(struct smu_context *smu,
 	}
 
 	ret = smu_send_smc_msg(smu, msg, NULL);
+	/* some asics may not support those messages */
+	if (ret == -EINVAL)
+		ret = 0;
 	if (ret)
 		dev_err(smu->adev->dev, "[PrepareMp1] Failed!\n");
 
commit 3520b5e22809d1fe211a7375e7b220de85e383d7
Author: Kenneth Feng <kenneth.feng at amd.com>
Date:   Wed Jul 22 21:27:35 2020 +0800

    drm/amd/powerplay: remove the dpm checking in the boot sequence
    
    It's not necessary to retrieve the power features status when the
    asic is booted up the first time. This patch can have the features
    enablement status still checked in suspend/resume case and removed
    from the first boot up sequence.
    
    Signed-off-by: Kenneth Feng <kenneth.feng at amd.com>
    Reviewed-by: Kevin Wang <kevin1.wang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index f778b00e49eb..6b03f750e63b 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -735,7 +735,7 @@ static int smu_smc_hw_setup(struct smu_context *smu)
 	uint32_t pcie_gen = 0, pcie_width = 0;
 	int ret;
 
-	if (smu_is_dpm_running(smu) && adev->in_suspend) {
+	if (adev->in_suspend && smu_is_dpm_running(smu)) {
 		dev_info(adev->dev, "dpm has been enabled\n");
 		return 0;
 	}
commit ffa453f05be1513a2a68df0bce530db0d13480de
Author: Changfeng <Changfeng.Zhu at amd.com>
Date:   Tue Jul 21 10:38:19 2020 +0800

    Revert "drm/amd/powerplay: drop unnecessary message support check"
    
    The below 3 messages are not supported on Renoir
    SMU_MSG_PrepareMp1ForShutdown
    SMU_MSG_PrepareMp1ForUnload
    SMU_MSG_PrepareMp1ForReset
    
    It needs to revert patch:
    drm/amd/powerplay: drop unnecessary message support check
    to avoid set mp1 state fail during gpu reset on renoir.
    
    Signed-off-by: changfeng <Changfeng.Zhu at amd.com>
    Reviewed-by: Kenneth Feng <kenneth.feng at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
index 838a369c9ec3..f778b00e49eb 100644
--- a/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/powerplay/amdgpu_smu.c
@@ -34,6 +34,7 @@
 #include "sienna_cichlid_ppt.h"
 #include "renoir_ppt.h"
 #include "amd_pcie.h"
+#include "smu_cmn.h"
 
 /*
  * DO NOT use these for err/warn/info/debug messages.
@@ -1589,6 +1590,14 @@ int smu_set_mp1_state(struct smu_context *smu,
 		return 0;
 	}
 
+	/* some asics may not support those messages */
+	if (smu_cmn_to_asic_specific_index(smu,
+					   CMN2ASIC_MAPPING_MSG,
+					   msg) < 0) {
+		mutex_unlock(&smu->mutex);
+		return 0;
+	}
+
 	ret = smu_send_smc_msg(smu, msg, NULL);
 	if (ret)
 		dev_err(smu->adev->dev, "[PrepareMp1] Failed!\n");
diff --git a/drivers/gpu/drm/amd/powerplay/smu_cmn.h b/drivers/gpu/drm/amd/powerplay/smu_cmn.h
index 98face8c5fd6..f9e63f18b157 100644
--- a/drivers/gpu/drm/amd/powerplay/smu_cmn.h
+++ b/drivers/gpu/drm/amd/powerplay/smu_cmn.h
@@ -25,7 +25,7 @@
 
 #include "amdgpu_smu.h"
 
-#if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4)
+#if defined(SWSMU_CODE_LAYER_L1) || defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4)
 int smu_cmn_send_smc_msg_with_param(struct smu_context *smu,
 				    enum smu_message_type msg,
 				    uint32_t param,
commit ee10e06eb00c3b371fa17a13ee2adaee4254dd54
Author: Guchun Chen <guchun.chen at amd.com>
Date:   Mon Jul 20 11:11:13 2020 +0800

    drm/amdgpu: add printing after executing page reservation to eeprom
    
    This will tell users if the faulty page has been written to
    external eeprom device in dmesg log.
    
    Signed-off-by: Guchun Chen <guchun.chen at amd.com>
    Reviewed-by: Tao Zhou <tao.zhou1 at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index e10f02ed3f65..bcce4c0be462 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1618,7 +1618,7 @@ static int amdgpu_ras_save_bad_pages(struct amdgpu_device *adev)
 	data = con->eh_data;
 	save_count = data->count - control->num_recs;
 	/* only new entries are saved */
-	if (save_count > 0)
+	if (save_count > 0) {
 		if (amdgpu_ras_eeprom_process_recods(control,
 							&data->bps[control->num_recs],
 							true,
@@ -1627,6 +1627,9 @@ static int amdgpu_ras_save_bad_pages(struct amdgpu_device *adev)
 			return -EIO;
 		}
 
+		dev_info(adev->dev, "Saved %d pages to EEPROM table.\n", save_count);
+	}
+
 	return 0;
 }
 
commit ebfbd1c2ca02f1c1bc9f8f0a7783e71efb57e4cc
Author: John Clements <john.clements at amd.com>
Date:   Wed Jul 22 09:40:11 2020 +0800

    drm/amdgpu: expand sienna chichlid reg access  support
    
    Added dedicated 64bit reg read/write support
    
    Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: John Clements <john.clements at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
index ea69ae76773e..74d02d270d34 100644
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -97,6 +97,49 @@ static void nv_pcie_wreg(struct amdgpu_device *adev, u32 reg, u32 v)
 	spin_unlock_irqrestore(&adev->pcie_idx_lock, flags);
 }
 
+static u64 nv_pcie_rreg64(struct amdgpu_device *adev, u32 reg)
+{
+	unsigned long flags, address, data;
+	u64 r;
+	address = adev->nbio.funcs->get_pcie_index_offset(adev);
+	data = adev->nbio.funcs->get_pcie_data_offset(adev);
+
+	spin_lock_irqsave(&adev->pcie_idx_lock, flags);
+	/* read low 32 bit */
+	WREG32(address, reg);
+	(void)RREG32(address);
+	r = RREG32(data);
+
+	/* read high 32 bit*/
+	WREG32(address, reg + 4);
+	(void)RREG32(address);
+	r |= ((u64)RREG32(data) << 32);
+	spin_unlock_irqrestore(&adev->pcie_idx_lock, flags);
+	return r;
+}
+
+static void nv_pcie_wreg64(struct amdgpu_device *adev, u32 reg, u64 v)
+{
+	unsigned long flags, address, data;
+
+	address = adev->nbio.funcs->get_pcie_index_offset(adev);
+	data = adev->nbio.funcs->get_pcie_data_offset(adev);
+
+	spin_lock_irqsave(&adev->pcie_idx_lock, flags);
+	/* write low 32 bit */
+	WREG32(address, reg);
+	(void)RREG32(address);
+	WREG32(data, (u32)(v & 0xffffffffULL));
+	(void)RREG32(data);
+
+	/* write high 32 bit */
+	WREG32(address, reg + 4);
+	(void)RREG32(address);
+	WREG32(data, (u32)(v >> 32));
+	(void)RREG32(data);
+	spin_unlock_irqrestore(&adev->pcie_idx_lock, flags);
+}
+
 static u32 nv_didt_rreg(struct amdgpu_device *adev, u32 reg)
 {
 	unsigned long flags, address, data;
@@ -673,6 +716,8 @@ static int nv_common_early_init(void *handle)
 	adev->smc_wreg = NULL;
 	adev->pcie_rreg = &nv_pcie_rreg;
 	adev->pcie_wreg = &nv_pcie_wreg;
+	adev->pcie_rreg64 = &nv_pcie_rreg64;
+	adev->pcie_wreg64 = &nv_pcie_wreg64;
 
 	/* TODO: will add them during VCN v2 implementation */
 	adev->uvd_ctx_rreg = NULL;
commit 2342ef4e6021f5f7f2b3d4daa1ed6d1140b1378b
Author: Colin Ian King <colin.king at canonical.com>
Date:   Fri Jul 10 09:37:58 2020 +0100

    drm/amdgpu: fix spelling mistake "Falied" -> "Failed"
    
    There is a spelling mistake in a DRM_ERROR error message. Fix it.
    
    This got lost in a merge, restore the fix.
    
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    (cherry picked from commit 4afaa61db9cf5250b5734c2531b226e7b3a3d691)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
index fe7d39bb975d..8034111acd9a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
@@ -1987,7 +1987,7 @@ static int psp_suspend(void *handle)
 
 	ret = psp_tmr_terminate(psp);
 	if (ret) {
-		DRM_ERROR("Falied to terminate tmr\n");
+		DRM_ERROR("Failed to terminate tmr\n");
 		return ret;
 	}
 
commit a34a0a632dd991a371fec56431d73279f9c54029
Author: Xin Xiong <xiongx18 at fudan.edu.cn>
Date:   Sun Jul 19 23:45:45 2020 +0800

    drm: fix drm_dp_mst_port refcount leaks in drm_dp_mst_allocate_vcpi
    
    drm_dp_mst_allocate_vcpi() invokes
    drm_dp_mst_topology_get_port_validated(), which increases the refcount
    of the "port".
    
    These reference counting issues take place in two exception handling
    paths separately. Either when “slots” is less than 0 or when
    drm_dp_init_vcpi() returns a negative value, the function forgets to
    reduce the refcnt increased drm_dp_mst_topology_get_port_validated(),
    which results in a refcount leak.
    
    Fix these issues by pulling up the error handling when "slots" is less
    than 0, and calling drm_dp_mst_topology_put_port() before termination
    when drm_dp_init_vcpi() returns a negative value.
    
    Fixes: 1e797f556c61 ("drm/dp: Split drm_dp_mst_allocate_vcpi")
    Cc: <stable at vger.kernel.org> # v4.12+
    Signed-off-by: Xiyu Yang <xiyuyang19 at fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf at gmail.com>
    Signed-off-by: Xin Xiong <xiongx18 at fudan.edu.cn>
    Reviewed-by: Lyude Paul <lyude at redhat.com>
    Signed-off-by: Lyude Paul <lyude at redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200719154545.GA41231@xin-virtual-machine

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 09b32289497e..b23cb2fec3f3 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -4308,11 +4308,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
 {
 	int ret;
 
-	port = drm_dp_mst_topology_get_port_validated(mgr, port);
-	if (!port)
+	if (slots < 0)
 		return false;
 
-	if (slots < 0)
+	port = drm_dp_mst_topology_get_port_validated(mgr, port);
+	if (!port)
 		return false;
 
 	if (port->vcpi.vcpi > 0) {
@@ -4328,6 +4328,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr,
 	if (ret) {
 		DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n",
 			      DIV_ROUND_UP(pbn, mgr->pbn_div), ret);
+		drm_dp_mst_topology_put_port(port);
 		goto out;
 	}
 	DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n",
commit b5ac98cbb8e5e30c34ebc837d1e5a3982d2b5f5c
Author: Marius Iacob <themariusus at gmail.com>
Date:   Sat Aug 1 15:34:46 2020 +0300

    drm: Added orientation quirk for ASUS tablet model T103HAF
    
    Signed-off-by: Marius Iacob <themariusus at gmail.com>
    Cc: stable at vger.kernel.org
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200801123445.1514567-1-themariusus@gmail.com

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index d00ea384dcbf..58f5dc2f6dd5 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* Asus T103HAF */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/* GPD MicroPC (generic strings, also match on bios date) */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
commit ecfdedd7da5d54416db5ca0f851264dca8736f59
Author: Tomi Valkeinen <tomi.valkeinen at ti.com>
Date:   Thu Jun 18 12:51:52 2020 +0300

    drm/omap: force runtime PM suspend on system suspend
    
    Use SET_LATE_SYSTEM_SLEEP_PM_OPS in DSS submodules to force runtime PM
    suspend and resume.
    
    We use suspend late version so that omapdrm's system suspend callback is
    called first, as that will disable all the display outputs after which
    it's safe to force DSS into suspend.
    
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen at ti.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200618095153.611071-1-tomi.valkeinen@ti.com
    Acked-by: Tony Lindgren <tony at atomide.com>
    Fixes: cef766300353 ("drm/omap: Prepare DSS for probing without legacy platform data")
    Cc: stable at vger.kernel.org # v5.7+
    Tested-by: Tony Lindgren <tony at atomide.com>

diff --git a/drivers/gpu/drm/omapdrm/dss/dispc.c b/drivers/gpu/drm/omapdrm/dss/dispc.c
index 6639ee9b05d3..48593932bddf 100644
--- a/drivers/gpu/drm/omapdrm/dss/dispc.c
+++ b/drivers/gpu/drm/omapdrm/dss/dispc.c
@@ -4915,6 +4915,7 @@ static int dispc_runtime_resume(struct device *dev)
 static const struct dev_pm_ops dispc_pm_ops = {
 	.runtime_suspend = dispc_runtime_suspend,
 	.runtime_resume = dispc_runtime_resume,
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 };
 
 struct platform_driver omap_dispchw_driver = {
diff --git a/drivers/gpu/drm/omapdrm/dss/dsi.c b/drivers/gpu/drm/omapdrm/dss/dsi.c
index 79ddfbfd1b58..eeccf40bae41 100644
--- a/drivers/gpu/drm/omapdrm/dss/dsi.c
+++ b/drivers/gpu/drm/omapdrm/dss/dsi.c
@@ -5467,6 +5467,7 @@ static int dsi_runtime_resume(struct device *dev)
 static const struct dev_pm_ops dsi_pm_ops = {
 	.runtime_suspend = dsi_runtime_suspend,
 	.runtime_resume = dsi_runtime_resume,
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 };
 
 struct platform_driver omap_dsihw_driver = {
diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c
index 4d5739fa4a5d..6ccbc29c4ce4 100644
--- a/drivers/gpu/drm/omapdrm/dss/dss.c
+++ b/drivers/gpu/drm/omapdrm/dss/dss.c
@@ -1614,6 +1614,7 @@ static int dss_runtime_resume(struct device *dev)
 static const struct dev_pm_ops dss_pm_ops = {
 	.runtime_suspend = dss_runtime_suspend,
 	.runtime_resume = dss_runtime_resume,
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 };
 
 struct platform_driver omap_dsshw_driver = {
diff --git a/drivers/gpu/drm/omapdrm/dss/venc.c b/drivers/gpu/drm/omapdrm/dss/venc.c
index 9701843ccf09..01ee6c50b663 100644
--- a/drivers/gpu/drm/omapdrm/dss/venc.c
+++ b/drivers/gpu/drm/omapdrm/dss/venc.c
@@ -902,6 +902,7 @@ static int venc_runtime_resume(struct device *dev)
 static const struct dev_pm_ops venc_pm_ops = {
 	.runtime_suspend = venc_runtime_suspend,
 	.runtime_resume = venc_runtime_resume,
+	SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
 };
 
 static const struct of_device_id venc_of_match[] = {
commit a72a6a16d51034045cb6355924b62221a8221ca3
Author: Tomi Valkeinen <tomi.valkeinen at ti.com>
Date:   Thu Jun 4 11:02:14 2020 +0300

    drm/tidss: fix modeset init for DPI panels
    
    The connector type for DISPC's DPI videoport was set the LVDS instead of
    DPI. This causes any DPI panel setup to fail with tidss, making all DPI
    panels unusable.
    
    Fix this by using correct connector type.
    
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen at ti.com>
    Fixes: 32a1795f57eecc39749017 ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
    Cc: stable at vger.kernel.org # v5.7+
    Link: https://patchwork.freedesktop.org/patch/msgid/20200604080214.107159-1-tomi.valkeinen@ti.com
    Reviewed-by: Jyri Sarha <jsarha at ti.com>

diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
index 4b99e9fa84a5..c0240f7e0b19 100644
--- a/drivers/gpu/drm/tidss/tidss_kms.c
+++ b/drivers/gpu/drm/tidss/tidss_kms.c
@@ -154,7 +154,7 @@ static int tidss_dispc_modeset_init(struct tidss_device *tidss)
 				break;
 			case DISPC_VP_DPI:
 				enc_type = DRM_MODE_ENCODER_DPI;
-				conn_type = DRM_MODE_CONNECTOR_LVDS;
+				conn_type = DRM_MODE_CONNECTOR_DPI;
 				break;
 			default:
 				WARN_ON(1);
commit d88ca7e1a27eb2df056bbf37ddef62e1c73d37ea
Author: Tetsuo Handa <penguin-kernel at i-love.sakura.ne.jp>
Date:   Thu Jul 30 19:47:14 2020 +0900

    fbmem: pull fbcon_update_vcs() out of fb_set_var()
    
    syzbot is reporting OOB read bug in vc_do_resize() [1] caused by memcpy()
    based on outdated old_{rows,row_size} values, for resize_screen() can
    recurse into vc_do_resize() which changes vc->vc_{cols,rows} that outdates
    old_{rows,row_size} values which were saved before calling resize_screen().
    
    Daniel Vetter explained that resize_screen() should not recurse into
    fbcon_update_vcs() path due to FBINFO_MISC_USEREVENT being still set
    when calling resize_screen().
    
    Instead of masking FBINFO_MISC_USEREVENT before calling fbcon_update_vcs(),
    we can remove FBINFO_MISC_USEREVENT by calling fbcon_update_vcs() only if
    fb_set_var() returned 0. This change assumes that it is harmless to call
    fbcon_update_vcs() when fb_set_var() returned 0 without reaching
    fb_notifier_call_chain().
    
    [1] https://syzkaller.appspot.com/bug?id=c70c88cfd16dcf6e1d3c7f0ab8648b3144b5b25e
    
    Reported-and-tested-by: syzbot <syzbot+c37a14770d51a085a520 at syzkaller.appspotmail.com>
    Suggested-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
    Reported-by: kernel test robot <lkp at intel.com> for missing #include
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/075b7e37-3278-cd7d-31ab-c5073cfa8e92@i-love.sakura.ne.jp

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 30e73ec4ad5c..da7c88ffaa6a 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -957,7 +957,6 @@ static int fb_check_caps(struct fb_info *info, struct fb_var_screeninfo *var,
 int
 fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 {
-	int flags = info->flags;
 	int ret = 0;
 	u32 activate;
 	struct fb_var_screeninfo old_var;
@@ -1052,9 +1051,6 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 	event.data = &mode;
 	fb_notifier_call_chain(FB_EVENT_MODE_CHANGE, &event);
 
-	if (flags & FBINFO_MISC_USEREVENT)
-		fbcon_update_vcs(info, activate & FB_ACTIVATE_ALL);
-
 	return 0;
 }
 EXPORT_SYMBOL(fb_set_var);
@@ -1105,9 +1101,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 			return -EFAULT;
 		console_lock();
 		lock_fb_info(info);
-		info->flags |= FBINFO_MISC_USEREVENT;
 		ret = fb_set_var(info, &var);
-		info->flags &= ~FBINFO_MISC_USEREVENT;
+		if (!ret)
+			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
 		unlock_fb_info(info);
 		console_unlock();
 		if (!ret && copy_to_user(argp, &var, sizeof(var)))
diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
index d54c88f88991..65dae05fff8e 100644
--- a/drivers/video/fbdev/core/fbsysfs.c
+++ b/drivers/video/fbdev/core/fbsysfs.c
@@ -91,9 +91,9 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
 
 	var->activate |= FB_ACTIVATE_FORCE;
 	console_lock();
-	fb_info->flags |= FBINFO_MISC_USEREVENT;
 	err = fb_set_var(fb_info, var);
-	fb_info->flags &= ~FBINFO_MISC_USEREVENT;
+	if (!err)
+		fbcon_update_vcs(fb_info, var->activate & FB_ACTIVATE_ALL);
 	console_unlock();
 	if (err)
 		return err;
diff --git a/drivers/video/fbdev/ps3fb.c b/drivers/video/fbdev/ps3fb.c
index 9df78fb77267..203c254f8f6c 100644
--- a/drivers/video/fbdev/ps3fb.c
+++ b/drivers/video/fbdev/ps3fb.c
@@ -29,6 +29,7 @@
 #include <linux/freezer.h>
 #include <linux/uaccess.h>
 #include <linux/fb.h>
+#include <linux/fbcon.h>
 #include <linux/init.h>
 
 #include <asm/cell-regs.h>
@@ -824,12 +825,12 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
 				var = info->var;
 				fb_videomode_to_var(&var, vmode);
 				console_lock();
-				info->flags |= FBINFO_MISC_USEREVENT;
 				/* Force, in case only special bits changed */
 				var.activate |= FB_ACTIVATE_FORCE;
 				par->new_mode_id = val;
 				retval = fb_set_var(info, &var);
-				info->flags &= ~FBINFO_MISC_USEREVENT;
+				if (!retval)
+					fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
 				console_unlock();
 			}
 			break;
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 2b530e6d86e4..850f79e9a7cb 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -400,8 +400,6 @@ struct fb_tile_ops {
 #define FBINFO_HWACCEL_YPAN		0x2000 /* optional */
 #define FBINFO_HWACCEL_YWRAP		0x4000 /* optional */
 
-#define FBINFO_MISC_USEREVENT          0x10000 /* event request
-						  from userspace */
 #define FBINFO_MISC_TILEBLITTING       0x20000 /* use tile blitting */
 
 /* A driver may set this flag to indicate that it does want a set_par to be
commit bcf876870b95592b52519ed4aafcf9d95999bc9c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 2 14:21:45 2020 -0700

    Linux 5.8

diff --git a/Makefile b/Makefile
index 229e67f2ff75..24a4c1b97bb0 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
 # *DOCUMENTATION*
commit 5a30a78924ecd97b0335d2e1d3e01a5023c1a3d8
Merge: 142c3326b055 bdd65589593e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 2 13:10:42 2020 -0700

    Merge tag 'x86-urgent-2020-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull x86 fix from Ingo Molnar:
     "A single fix for a potential deadlock when printing a message about
      spurious interrupts"
    
    * tag 'x86-urgent-2020-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      x86/i8259: Use printk_deferred() to prevent deadlock

commit 142c3326b055a278c303bfef8dc6a105fff18ca6
Merge: 628e04dfeb4f 28ab576ba8de
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 2 11:23:51 2020 -0700

    Merge tag 'kbuild-fixes-v5.8-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
    
    Pull Kbuild fixes from Masahiro Yamada:
    
     - clean the generated moc file for xconfig
    
     - fix xconfig bugs, and revert some bad commits
    
    * tag 'kbuild-fixes-v5.8-4' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
      kbuild: remove redundant FORCE definition in scripts/Makefile.modpost
      kconfig: qconf: remove wrong ConfigList::firstChild()
      Revert "kconfig: qconf: don't show goback button on splitMode"
      Revert "kconfig: qconf: Change title for the item window"
      kconfig: qconf: remove "goBack" debug message
      kconfig: qconf: use delete[] instead of delete to free array
      kconfig: qconf: compile moc object separately
      kconfig: qconf: use if_changed for qconf.moc rule
      modpost: explain why we can't use strsep

commit 628e04dfeb4f66635c0d22cf1ad0cf427406e129
Merge: ac3a0c847296 830f01b089b1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 2 10:41:00 2020 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
    
    Pull KVM fixes from Paolo Bonzini:
     "Bugfixes and strengthening the validity checks on inputs from new
      userspace APIs.
    
      Now I know why I shouldn't prepare pull requests on the weekend, it's
      hard to concentrate if your son is shouting about his latest Minecraft
      builds in your ear. Fortunately all the patches were ready and I just
      had to check the test results..."
    
    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
      KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM
      KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
      KVM: arm64: Don't inherit exec permission across page-table levels
      KVM: arm64: Prevent vcpu_has_ptrauth from generating OOL functions
      KVM: nVMX: check for invalid hdr.vmx.flags
      KVM: nVMX: check for required but missing VMCS12 in KVM_SET_NESTED_STATE
      selftests: kvm: do not set guest mode flag

commit 28ab576ba8de934ee3145b6d75119f016de567cb
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Sun Aug 2 22:54:40 2020 +0900

    kbuild: remove redundant FORCE definition in scripts/Makefile.modpost
    
    The same code exists a few lines above.
    
    Fixes: 436b2ac603d5 ("modpost: invoke modpost only when input files are updated")
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 3651cbf6ad49..f54b6ac37ac2 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -124,9 +124,6 @@ existing-targets := $(wildcard $(sort $(targets)))
 
 -include $(foreach f,$(existing-targets),$(dir $(f)).$(notdir $(f)).cmd)
 
-PHONY += FORCE
-FORCE:
-
 endif
 
 .PHONY: $(PHONY)
commit ccf56e5fe3d208883cd6db982197eac9b70a0bf9
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Sat Aug 1 16:08:50 2020 +0900

    kconfig: qconf: remove wrong ConfigList::firstChild()
    
    This function returns the first child object, but the returned pointer
    is not compatible with (ConfigItem *).
    
    Commit cc1c08edccaf ("kconfig: qconf: don't show goback button on
    splitMode") uncovered this issue because using the pointer from this
    function would make qconf crash. (https://lkml.org/lkml/2020/7/18/411)
    
    This function does not work. Remove.
    
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 762e2ac6679e..23d1cb01a41a 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -434,7 +434,7 @@ void ConfigList::updateList(ConfigItem* item)
 	}
 	if ((mode == singleMode || (mode == symbolMode && !(rootEntry->flags & MENU_ROOT))) &&
 	    rootEntry->sym && rootEntry->prompt) {
-		item = last ? last->nextSibling() : firstChild();
+		item = last ? last->nextSibling() : nullptr;
 		if (!item)
 			item = new ConfigItem(this, last, rootEntry, true);
 		else
diff --git a/scripts/kconfig/qconf.h b/scripts/kconfig/qconf.h
index fb9e9729266f..5eeab4a8bb43 100644
--- a/scripts/kconfig/qconf.h
+++ b/scripts/kconfig/qconf.h
@@ -92,10 +92,6 @@ public:
 	{
 		return this;
 	}
-	ConfigItem* firstChild() const
-	{
-		return (ConfigItem *)children().first();
-	}
 	void addColumn(colIdx idx)
 	{
 		showColumn(idx);
commit ac3a0c8472969a03c0496ae774b3a29eb26c8d5a
Merge: 0ae3495b6502 fda2ec62cf1a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 1 16:47:24 2020 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
    
    Pull networking fixes from David Miller:
    
     1) Encap offset calculation is incorrect in esp6, from Sabrina Dubroca.
    
     2) Better parameter validation in pfkey_dump(), from Mark Salyzyn.
    
     3) Fix several clang issues on powerpc in selftests, from Tanner Love.
    
     4) cmsghdr_from_user_compat_to_kern() uses the wrong length, from Al
        Viro.
    
     5) Out of bounds access in mlx5e driver, from Raed Salem.
    
     6) Fix transfer buffer memleak in lan78xx, from Johan Havold.
    
     7) RCU fixups in rhashtable, from Herbert Xu.
    
     8) Fix ipv6 nexthop refcnt leak, from Xiyu Yang.
    
     9) vxlan FDB dump must be done under RCU, from Ido Schimmel.
    
    10) Fix use after free in mlxsw, from Ido Schimmel.
    
    11) Fix map leak in HASH_OF_MAPS bpf code, from Andrii Nakryiko.
    
    12) Fix bug in mac80211 Tx ack status reporting, from Vasanthakumar
        Thiagarajan.
    
    13) Fix memory leaks in IPV6_ADDRFORM code, from Cong Wang.
    
    14) Fix bpf program reference count leaks in mlx5 during
        mlx5e_alloc_rq(), from Xin Xiong.
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (86 commits)
      vxlan: fix memleak of fdb
      rds: Prevent kernel-infoleak in rds_notify_queue_get()
      net/sched: The error lable position is corrected in ct_init_module
      net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
      net/mlx5e: E-Switch, Specify flow_source for rule with no in_port
      net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring
      net/mlx5e: CT: Support restore ipv6 tunnel
      net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()
      ionic: unlock queue mutex in error path
      atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
      net: ethernet: mtk_eth_soc: fix MTU warnings
      net: nixge: fix potential memory leak in nixge_probe()
      devlink: ignore -EOPNOTSUPP errors on dumpit
      rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
      MAINTAINERS: Replace Thor Thayer as Altera Triple Speed Ethernet maintainer
      selftests/bpf: fix netdevsim trap_flow_action_cookie read
      ipv6: fix memory leaks on IPV6_ADDRFORM path
      net/bpfilter: Initialize pos in __bpfilter_process_sockopt
      igb: reinit_locked() should be called with rtnl_lock
      e1000e: continue to init PHY even when failed to disable ULP
      ...

commit 0ae3495b6502cf93634cbd027cb2f6f9f83a406f
Merge: bf121a0bda29 7665a47f70b3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 1 16:40:59 2020 -0700

    Merge tag 'for-linus-2020-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux
    
    Pull thread fix from Christian Brauner:
     "A simple spelling fix for dequeue_synchronous_signal()"
    
    * tag 'for-linus-2020-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux:
      signal: fix typo in dequeue_synchronous_signal()

commit bf121a0bda29daa67a1fcedbdf479f6b03c9f977
Merge: d52daa8620c6 39efdd94e314
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 1 13:08:50 2020 -0700

    Merge tag 'perf-tools-fixes-2020-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
    
    Pull perf tooling fixes from Arnaldo Carvalho de Melo:
    
     - Fix libtraceevent build with binutils 2.35
    
     - Fix memory leak in process_dynamic_array_len in libtraceevent
    
     - Fix 'perf test 68' zstd compression for s390
    
     - Fix record failure when mixed with ARM SPE event
    
    * tag 'perf-tools-fixes-2020-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
      libtraceevent: Fix build with binutils 2.35
      perf tools: Fix record failure when mixed with ARM SPE event
      perf tests: Fix test 68 zstd compression for s390
      tools lib traceevent: Fix memory leak in process_dynamic_array_len

commit fda2ec62cf1aa7cbee52289dc8059cd3662795da
Author: Taehee Yoo <ap420073 at gmail.com>
Date:   Sat Aug 1 07:07:50 2020 +0000

    vxlan: fix memleak of fdb
    
    When vxlan interface is deleted, all fdbs are deleted by vxlan_flush().
    vxlan_flush() flushes fdbs but it doesn't delete fdb, which contains
    all-zeros-mac because it is deleted by vxlan_uninit().
    But vxlan_uninit() deletes only the fdb, which contains both all-zeros-mac
    and default vni.
    So, the fdb, which contains both all-zeros-mac and non-default vni
    will not be deleted.
    
    Test commands:
        ip link add vxlan0 type vxlan dstport 4789 external
        ip link set vxlan0 up
        bridge fdb add to 00:00:00:00:00:00 dst 172.0.0.1 dev vxlan0 via lo \
                src_vni 10000 self permanent
        ip link del vxlan0
    
    kmemleak reports as follows:
    unreferenced object 0xffff9486b25ced88 (size 96):
      comm "bridge", pid 2151, jiffies 4294701712 (age 35506.901s)
      hex dump (first 32 bytes):
        02 00 00 00 ac 00 00 01 40 00 09 b1 86 94 ff ff  ........ at .......
        46 02 00 00 00 00 00 00 a7 03 00 00 12 b5 6a 6b  F.............jk
      backtrace:
        [<00000000c10cf651>] vxlan_fdb_append.part.51+0x3c/0xf0 [vxlan]
        [<000000006b31a8d9>] vxlan_fdb_create+0x184/0x1a0 [vxlan]
        [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan]
        [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan]
        [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270
        [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490
        [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110
        [<00000000dff433e7>] netlink_unicast+0x18e/0x250
        [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400
        [<000000002ed55153>] ____sys_sendmsg+0x237/0x260
        [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0
        [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80
        [<00000000a8f875d2>] do_syscall_64+0x56/0xe0
        [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    unreferenced object 0xffff9486b1c40080 (size 128):
      comm "bridge", pid 2157, jiffies 4294701754 (age 35506.866s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 f8 dc 42 b2 86 94 ff ff  ..........B.....
        6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
      backtrace:
        [<00000000a2981b60>] vxlan_fdb_create+0x67/0x1a0 [vxlan]
        [<0000000049399045>] vxlan_fdb_update+0x12f/0x220 [vxlan]
        [<0000000090b1ef00>] vxlan_fdb_add+0x12a/0x1b0 [vxlan]
        [<0000000056633c2c>] rtnl_fdb_add+0x187/0x270
        [<00000000dd5dfb6b>] rtnetlink_rcv_msg+0x264/0x490
        [<00000000fc44dd54>] netlink_rcv_skb+0x4a/0x110
        [<00000000dff433e7>] netlink_unicast+0x18e/0x250
        [<00000000b87fb421>] netlink_sendmsg+0x2e9/0x400
        [<000000002ed55153>] ____sys_sendmsg+0x237/0x260
        [<00000000faa51c66>] ___sys_sendmsg+0x88/0xd0
        [<000000006c3982f1>] __sys_sendmsg+0x4e/0x80
        [<00000000a8f875d2>] do_syscall_64+0x56/0xe0
        [<000000003610eefa>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 3ad7a4b141eb ("vxlan: support fdb and learning in COLLECT_METADATA mode")
    Signed-off-by: Taehee Yoo <ap420073 at gmail.com>
    Acked-by: Roopa Prabhu <roopa at cumulusnetworks.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 5efe1e28f270..a7c3939264b0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -3076,8 +3076,10 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all)
 			if (!do_all && (f->state & (NUD_PERMANENT | NUD_NOARP)))
 				continue;
 			/* the all_zeros_mac entry is deleted at vxlan_uninit */
-			if (!is_zero_ether_addr(f->eth_addr))
-				vxlan_fdb_destroy(vxlan, f, true, true);
+			if (is_zero_ether_addr(f->eth_addr) &&
+			    f->vni == vxlan->cfg.vni)
+				continue;
+			vxlan_fdb_destroy(vxlan, f, true, true);
 		}
 		spin_unlock_bh(&vxlan->hash_lock[h]);
 	}
commit d52daa8620c65960e1ef882adc1f92061326bd7a
Merge: 7dc6fd0f3b84 c3c0c2e18d94
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 1 10:11:42 2020 -0700

    Merge tag 'pinctrl-v5.8-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
    
    Pull pin control fix from Linus Walleij:
     "A single last minute pin control fix to the Qualcomm driver fixing
      missing dual edge PCH interrupts"
    
    * tag 'pinctrl-v5.8-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
      pinctrl: qcom: Handle broken/missing PDC dual edge IRQs on sc7180

commit 4b20e103a63d056fb7a594b23d42ef8e0dbfc5ff
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Sat Aug 1 16:08:49 2020 +0900

    Revert "kconfig: qconf: don't show goback button on splitMode"
    
    This reverts commit cc1c08edccaf5317d99a17a3231fe06381044e83.
    
    Maxim Levitsky reports 'make xconfig' crashes since that commit
    (https://lkml.org/lkml/2020/7/18/411)
    
    Or, the following is simple test code that makes it crash:
    
        menu "Menu"
    
        config FOO
                bool "foo"
                default y
    
        menuconfig BAR
                bool "bar"
                depends on FOO
    
        endmenu
    
    Select the Split View mode, and double-click "bar" in the right
    window, then you will see Segmentation fault.
    
    When 'last' is not set for symbolMode, the following code in
    ConfigList::updateList() calls firstChild().
    
      item = last ? last->nextSibling() : firstChild();
    
    However, the pointer returned by ConfigList::firstChild() does not
    seem to be compatible with (ConfigItem *), which seems another bug.
    
    I'd rather want to reconsider whether hiding the goback icon is the
    right thing to do.
    
    In the following test code, the Split View shows "Menu2" and "Menu3"
    in the right window. You can descend into "Menu3", but there is no way
    to ascend back to "Menu2" from "Menu3".
    
        menu "Menu1"
    
        config FOO
                bool "foo"
                default y
    
        menu "Menu2"
                depends on FOO
    
        menu "Menu3"
    
        config BAZ
                bool "baz"
    
        endmenu
    
        endmenu
    
        endmenu
    
    It is true that the goback button is currently not functional due to
    yet another bug, but hiding the problem is not the right way to go.
    
    Anyway, Segmentation fault is fatal. Revert the offending commit for
    now, and we should find the right solution.
    
    Reported-by:  Maxim Levitsky <mlevitsk at redhat.com>
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 86bc8ded8de8..762e2ac6679e 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -428,10 +428,9 @@ void ConfigList::updateList(ConfigItem* item)
 	if (rootEntry != &rootmenu && (mode == singleMode ||
 	    (mode == symbolMode && rootEntry->parent != &rootmenu))) {
 		item = (ConfigItem *)topLevelItem(0);
-		if (!item && mode != symbolMode) {
+		if (!item)
 			item = new ConfigItem(this, 0, true);
-			last = item;
-		}
+		last = item;
 	}
 	if ((mode == singleMode || (mode == symbolMode && !(rootEntry->flags & MENU_ROOT))) &&
 	    rootEntry->sym && rootEntry->prompt) {
commit 97bebbcd8b9368212e08913461bb511e35b46627
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Thu Jul 30 02:46:17 2020 +0900

    Revert "kconfig: qconf: Change title for the item window"
    
    This reverts commit 5752ff07fd90d764d96e3c586cc95c09598abfdd.
    
    It added dead code to ConfigList:ConfigList().
    
    The constructor of ConfigList has the initializer, mode(singleMode).
    
        if (mode == symbolMode)
               setHeaderLabels(QStringList() << "Item" << "Name" << "N" << "M" << "Y" << "Value");
        else
               setHeaderLabels(QStringList() << "Option" << "Name" << "N" << "M" << "Y" << "Value");
    
    ... always takes the else part.
    
    The change to ConfigList::updateSelection() is strange too.
    When you click the split view icon for the first time, the titles in
    both windows show "Option". After you click something in the right
    window, the title suddenly changes to "Item".
    
    ConfigList::updateSelection() is not the right place to do this,
    at least. It was not a good idea, I think.
    
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index fa51e65d56d0..86bc8ded8de8 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -307,10 +307,7 @@ ConfigList::ConfigList(ConfigView* p, const char *name)
 	setVerticalScrollMode(ScrollPerPixel);
 	setHorizontalScrollMode(ScrollPerPixel);
 
-	if (mode == symbolMode)
-		setHeaderLabels(QStringList() << "Item" << "Name" << "N" << "M" << "Y" << "Value");
-	else
-		setHeaderLabels(QStringList() << "Option" << "Name" << "N" << "M" << "Y" << "Value");
+	setHeaderLabels(QStringList() << "Option" << "Name" << "N" << "M" << "Y" << "Value");
 
 	connect(this, SIGNAL(itemSelectionChanged(void)),
 		SLOT(updateSelection(void)));
@@ -391,11 +388,6 @@ void ConfigList::updateSelection(void)
 	struct menu *menu;
 	enum prop_type type;
 
-	if (mode == symbolMode)
-		setHeaderLabels(QStringList() << "Item" << "Name" << "N" << "M" << "Y" << "Value");
-	else
-		setHeaderLabels(QStringList() << "Option" << "Name" << "N" << "M" << "Y" << "Value");
-
 	if (selectedItems().count() == 0)
 		return;
 
commit ce02397f44e9ad36b14a29f3eeef252a6a8575c4
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Thu Jul 30 02:12:40 2020 +0900

    kconfig: qconf: remove "goBack" debug message
    
    Every time the goback icon is clicked, the annoying message "goBack"
    is displayed on the console.
    
    I guess this line is the left-over debug code of commit af737b4defe1
    ("kconfig: qconf: simplify the goBack() logic").
    
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 3a11940ff5dc..fa51e65d56d0 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -1734,7 +1734,6 @@ void ConfigMainWindow::listFocusChanged(void)
 
 void ConfigMainWindow::goBack(void)
 {
-qInfo() << __FUNCTION__;
 	if (configList->rootEntry == &rootmenu)
 		return;
 
commit c9b09a9249e6db802013c37a24af1fe45824cd3a
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Thu Jul 30 02:02:39 2020 +0900

    kconfig: qconf: use delete[] instead of delete to free array
    
    cppcheck reports "Mismatching allocation and deallocation".
    
    $ cppcheck scripts/kconfig/qconf.cc
    Checking scripts/kconfig/qconf.cc ...
    scripts/kconfig/qconf.cc:1242:10: error: Mismatching allocation and deallocation: data [mismatchAllocDealloc]
      delete data;
             ^
    scripts/kconfig/qconf.cc:1236:15: note: Mismatching allocation and deallocation: data
     char *data = new char[count + 1];
                  ^
    scripts/kconfig/qconf.cc:1242:10: note: Mismatching allocation and deallocation: data
      delete data;
             ^
    scripts/kconfig/qconf.cc:1255:10: error: Mismatching allocation and deallocation: data [mismatchAllocDealloc]
      delete data;
             ^
    scripts/kconfig/qconf.cc:1236:15: note: Mismatching allocation and deallocation: data
     char *data = new char[count + 1];
                  ^
    scripts/kconfig/qconf.cc:1255:10: note: Mismatching allocation and deallocation: data
      delete data;
             ^
    
    Fixes: c4f7398bee9c ("kconfig: qconf: make debug links work again")
    Reported-by: David Binderman <dcb314 at hotmail.com>
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index bb0a0bd511b9..3a11940ff5dc 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -1238,7 +1238,7 @@ void ConfigInfoView::clicked(const QUrl &url)
 
 	if (count < 1) {
 		qInfo() << "Clicked link is empty";
-		delete data;
+		delete[] data;
 		return;
 	}
 
@@ -1251,7 +1251,7 @@ void ConfigInfoView::clicked(const QUrl &url)
 	result = sym_re_search(data);
 	if (!result) {
 		qInfo() << "Clicked symbol is invalid:" << data;
-		delete data;
+		delete[] data;
 		return;
 	}
 
commit 0e912c03208075b95ea726076bf1b45db8419bc2
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Thu Jul 30 02:02:38 2020 +0900

    kconfig: qconf: compile moc object separately
    
    Currently, qconf.moc is included from qconf.cc but they can be compiled
    independently.
    
    When you modify qconf.cc, qconf.moc does not need recompiling.
    
    Rename qconf.moc to qconf-moc.cc, and split it out as an independent
    compilation unit.
    
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index 12a67fdab541..c3d537cd0275 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
-*.moc
+/qconf-moc.cc
 *conf-cfg
 
 #
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index a5e770e75653..52b59bf9efe4 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -181,21 +181,22 @@ $(addprefix $(obj)/, mconf.o $(lxdialog)): $(obj)/mconf-cfg
 
 # qconf: Used for the xconfig target based on Qt
 hostprogs	+= qconf
-qconf-cxxobjs	:= qconf.o
+qconf-cxxobjs	:= qconf.o qconf-moc.o
 qconf-objs	:= images.o $(common-objs)
 
 HOSTLDLIBS_qconf	= $(shell . $(obj)/qconf-cfg && echo $$libs)
 HOSTCXXFLAGS_qconf.o	= $(shell . $(obj)/qconf-cfg && echo $$cflags)
+HOSTCXXFLAGS_qconf-moc.o = $(shell . $(obj)/qconf-cfg && echo $$cflags)
 
-$(obj)/qconf.o: $(obj)/qconf-cfg $(obj)/qconf.moc
+$(obj)/qconf.o: $(obj)/qconf-cfg
 
 quiet_cmd_moc = MOC     $@
-      cmd_moc = $(shell . $(obj)/qconf-cfg && echo $$moc) -i $< -o $@
+      cmd_moc = $(shell . $(obj)/qconf-cfg && echo $$moc) $< -o $@
 
-$(obj)/%.moc: $(src)/%.h $(obj)/qconf-cfg FORCE
+$(obj)/qconf-moc.cc: $(src)/qconf.h $(obj)/qconf-cfg FORCE
 	$(call if_changed,moc)
 
-targets += qconf.moc
+targets += qconf-moc.cc
 
 # gconf: Used for the gconfig target based on GTK+
 hostprogs	+= gconf
diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index 4a616128a154..bb0a0bd511b9 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -23,7 +23,6 @@
 #include "lkc.h"
 #include "qconf.h"
 
-#include "qconf.moc"
 #include "images.h"
 
 
commit c3cd7cfad51ab521bf4c3edd050f3dcf275e9ee8
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Thu Jul 30 02:02:37 2020 +0900

    kconfig: qconf: use if_changed for qconf.moc rule
    
    Regenerate qconf.moc when the moc command is changed.
    
    This also allows 'make mrproper' to clean it up. Previously, it was
    not cleaned up because 'clean-files += qconf.moc' was missing.
    Now 'make mrproper' correctly cleans it up because files listed in
    'targets' are cleaned.
    
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 426881ea954f..a5e770e75653 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -192,8 +192,10 @@ $(obj)/qconf.o: $(obj)/qconf-cfg $(obj)/qconf.moc
 quiet_cmd_moc = MOC     $@
       cmd_moc = $(shell . $(obj)/qconf-cfg && echo $$moc) -i $< -o $@
 
-$(obj)/%.moc: $(src)/%.h $(obj)/qconf-cfg
-	$(call cmd,moc)
+$(obj)/%.moc: $(src)/%.h $(obj)/qconf-cfg FORCE
+	$(call if_changed,moc)
+
+targets += qconf.moc
 
 # gconf: Used for the gconfig target based on GTK+
 hostprogs	+= gconf
commit f369bc3f9096f5d355e8b80540bc30ac9a602912
Author: Christoph Hellwig <hch at lst.de>
Date:   Sat Aug 1 08:17:13 2020 +0200

    vgaarb: mark vga_tryget static
    
    This symbols isn't used anywhere outside of vgaarb.c.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200801061713.307434-1-hch@lst.de

diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index f2f3ef8af271..5180c5687ee5 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -529,7 +529,7 @@ EXPORT_SYMBOL(vga_get);
  *
  * 0 on success, negative error code on failure.
  */
-int vga_tryget(struct pci_dev *pdev, unsigned int rsrc)
+static int vga_tryget(struct pci_dev *pdev, unsigned int rsrc)
 {
 	struct vga_device *vgadev;
 	unsigned long flags;
@@ -554,7 +554,6 @@ bail:
 	spin_unlock_irqrestore(&vga_lock, flags);
 	return rc;
 }
-EXPORT_SYMBOL(vga_tryget);
 
 /**
  * vga_put - release lock on legacy VGA resources
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 553b34c8b5f7..977caf96c8d2 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -109,12 +109,6 @@ static inline int vga_get_uninterruptible(struct pci_dev *pdev,
        return vga_get(pdev, rsrc, 0);
 }
 
-#if defined(CONFIG_VGA_ARB)
-extern int vga_tryget(struct pci_dev *pdev, unsigned int rsrc);
-#else
-static inline int vga_tryget(struct pci_dev *pdev, unsigned int rsrc) { return 0; }
-#endif
-
 #if defined(CONFIG_VGA_ARB)
 extern void vga_put(struct pci_dev *pdev, unsigned int rsrc);
 #else
commit 70c8b4b8ab3714fb2d075be22aec05ae9c9a6a09
Author: Hyun Kwon <hyun.kwon at xilinx.com>
Date:   Wed Jul 29 16:30:45 2020 -0700

    drm: xlnx: zynqmp: Use switch - case for link rate downshift
    
    Use switch - case to downshift from the current link rate. It's a small
    loop now, so fine to be replaced with switch - case. With a loop, it is
    confusing and hard to follow as reported below.
    
    The patch d76271d22694: "drm: xlnx: DRM/KMS driver for Xilinx ZynqMP
    DisplayPort Subsystem" from Jul 7, 2018, leads to the following
    static checker warning:
    
            drivers/gpu/drm/xlnx/zynqmp_dp.c:594 zynqmp_dp_mode_configure()
            error: iterator underflow 'bws' (-1)-2
    
    Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: Hyun Kwon <hyun.kwon at xilinx.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/1596065445-4630-1-git-send-email-hyun.kwon@xilinx.com

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index b735072a702d..99158ee67d02 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -567,34 +567,37 @@ static int zynqmp_dp_mode_configure(struct zynqmp_dp *dp, int pclock,
 				    u8 current_bw)
 {
 	int max_rate = dp->link_config.max_rate;
-	u8 bws[3] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
+	u8 bw_code;
 	u8 max_lanes = dp->link_config.max_lanes;
 	u8 max_link_rate_code = drm_dp_link_rate_to_bw_code(max_rate);
 	u8 bpp = dp->config.bpp;
 	u8 lane_cnt;
-	s8 i;
 
-	if (current_bw == DP_LINK_BW_1_62) {
+	/* Downshift from current bandwidth */
+	switch (current_bw) {
+	case DP_LINK_BW_5_4:
+		bw_code = DP_LINK_BW_2_7;
+		break;
+	case DP_LINK_BW_2_7:
+		bw_code = DP_LINK_BW_1_62;
+		break;
+	case DP_LINK_BW_1_62:
 		dev_err(dp->dev, "can't downshift. already lowest link rate\n");
 		return -EINVAL;
-	}
-
-	for (i = ARRAY_SIZE(bws) - 1; i >= 0; i--) {
-		if (current_bw && bws[i] >= current_bw)
-			continue;
-
-		if (bws[i] <= max_link_rate_code)
-			break;
+	default:
+		/* If not given, start with max supported */
+		bw_code = max_link_rate_code;
+		break;
 	}
 
 	for (lane_cnt = 1; lane_cnt <= max_lanes; lane_cnt <<= 1) {
 		int bw;
 		u32 rate;
 
-		bw = drm_dp_bw_code_to_link_rate(bws[i]);
+		bw = drm_dp_bw_code_to_link_rate(bw_code);
 		rate = zynqmp_dp_max_rate(bw, lane_cnt, bpp);
 		if (pclock <= rate) {
-			dp->mode.bw_code = bws[i];
+			dp->mode.bw_code = bw_code;
 			dp->mode.lane_cnt = lane_cnt;
 			dp->mode.pclock = pclock;
 			return dp->mode.bw_code;
commit 69138b34a7248d2396ab85c8652e20c0c39beaba
Merge: 8d46215a1ff3 4f010246b408
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Jul 31 17:19:47 2020 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
    
    Daniel Borkmann says:
    
    ====================
    pull-request: bpf 2020-07-31
    
    The following pull-request contains BPF updates for your *net* tree.
    
    We've added 5 non-merge commits during the last 21 day(s) which contain
    a total of 5 files changed, 126 insertions(+), 18 deletions(-).
    
    The main changes are:
    
    1) Fix a map element leak in HASH_OF_MAPS map type, from Andrii Nakryiko.
    
    2) Fix a NULL pointer dereference in __btf_resolve_helper_id() when no
       btf_vmlinux is available, from Peilin Ye.
    
    3) Init pos variable in __bpfilter_process_sockopt(), from Christoph Hellwig.
    
    4) Fix a cgroup sockopt verifier test by specifying expected attach type,
       from Jean-Philippe Brucker.
    
    Note that when net gets merged into net-next later on, there is a small
    merge conflict in kernel/bpf/btf.c between commit 5b801dfb7feb ("bpf: Fix
    NULL pointer dereference in __btf_resolve_helper_id()") from the bpf tree
    and commit 138b9a0511c7 ("bpf: Remove btf_id helpers resolving") from the
    net-next tree.
    
    Resolve as follows: remove the old hunk with the __btf_resolve_helper_id()
    function. Change the btf_resolve_helper_id() so it actually tests for a
    NULL btf_vmlinux and bails out:
    
    int btf_resolve_helper_id(struct bpf_verifier_log *log,
                              const struct bpf_func_proto *fn, int arg)
    {
            int id;
    
            if (fn->arg_type[arg] != ARG_PTR_TO_BTF_ID || !btf_vmlinux)
                    return -EINVAL;
            id = fn->btf_id[arg];
            if (!id || id > btf_vmlinux->nr_types)
                    return -EINVAL;
            return id;
    }
    
    Let me know if you run into any others issues (CC'ing Jiri Olsa so he's in
    the loop with regards to merge conflict resolution).
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 8d46215a1ff37b83e80e573563066548fc82084d
Merge: e535d87d8b4f 71b59bf482b2
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Jul 31 17:10:53 2020 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
    
    Steffen Klassert says:
    
    ====================
    pull request (net): ipsec 2020-07-31
    
    1) Fix policy matching with mark and mask on userspace interfaces.
       From Xin Long.
    
    2) Several fixes for the new ESP in TCP encapsulation.
       From Sabrina Dubroca.
    
    3) Fix crash when the hold queue is used. The assumption that
       xdst->path and dst->child are not a NULL pointer only if dst->xfrm
       is not a NULL pointer is true with the exception of using the
       hold queue. Fix this by checking for hold queue usage before
       dereferencing xdst->path or dst->child.
    
    4) Validate pfkey_dump parameter before sending them.
       From Mark Salyzyn.
    
    5) Fix the location of the transport header with ESP in UDPv6
       encapsulation. From Sabrina Dubroca.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit e535d87d8b4f85fe1659aa38c8fb75226b56eec5
Merge: bbc8a99e9522 e692139e6af3
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Jul 31 17:05:54 2020 -0700

    Merge tag 'mlx5-fixes-2020-07-30' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux
    
    Saeed Mahameed says:
    
    ====================
    Mellanox, mlx5 fixes 2020-07-30
    
    This small patchset introduces some fixes to mlx5 driver.
    
    Please pull and let me know if there is any problem.
    
    For -stable v4.18:
     ('net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq')
    
    For -stable v5.7:
     ('net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring')
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit bbc8a99e952226c585ac17477a85ef1194501762
Author: Peilin Ye <yepeilin.cs at gmail.com>
Date:   Thu Jul 30 15:20:26 2020 -0400

    rds: Prevent kernel-infoleak in rds_notify_queue_get()
    
    rds_notify_queue_get() is potentially copying uninitialized kernel stack
    memory to userspace since the compiler may leave a 4-byte hole at the end
    of `cmsg`.
    
    In 2016 we tried to fix this issue by doing `= { 0 };` on `cmsg`, which
    unfortunately does not always initialize that 4-byte hole. Fix it by using
    memset() instead.
    
    Cc: stable at vger.kernel.org
    Fixes: f037590fff30 ("rds: fix a leak of kernel memory")
    Fixes: bdbe6fbc6a2f ("RDS: recv.c")
    Suggested-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
    Acked-by: Santosh Shilimkar <santosh.shilimkar at oracle.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/rds/recv.c b/net/rds/recv.c
index c8404971d5ab..aba4afe4dfed 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -450,12 +450,13 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
 {
 	struct rds_notifier *notifier;
-	struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
+	struct rds_rdma_notify cmsg;
 	unsigned int count = 0, max_messages = ~0U;
 	unsigned long flags;
 	LIST_HEAD(copy);
 	int err = 0;
 
+	memset(&cmsg, 0, sizeof(cmsg));	/* fill holes with zero */
 
 	/* put_cmsg copies to user space and thus may sleep. We can't do this
 	 * with rs_lock held, so first grab as many notifications as we can stuff
commit dc096288d579c82efbf6f82a5d895fed6e41e5a6
Merge: 8c5c51f5cac6 024a8168b749
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Jul 31 16:51:58 2020 -0700

    Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue
    
    Tony Nguyen says:
    
    ====================
    Intel Wired LAN Driver Updates 2020-07-30
    
    This series contains updates to the e1000e and igb drivers.
    
    Aaron Ma allows PHY initialization to continue if ULP disable failed for
    e1000e.
    
    Francesco Ruggeri fixes race conditions in igb reset that could cause panics.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 8c5c51f5cac676e9065cb6de9feaa3a16a462675
Author: liujian <liujian56 at huawei.com>
Date:   Thu Jul 30 16:14:28 2020 +0800

    net/sched: The error lable position is corrected in ct_init_module
    
    Exchange the positions of the err_tbl_init and err_register labels in
    ct_init_module function.
    
    Fixes: c34b961a2492 ("net/sched: act_ct: Create nf flow table per zone")
    Signed-off-by: liujian <liujian56 at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 5928efb6449c..6ed1652d1e26 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -1543,10 +1543,10 @@ static int __init ct_init_module(void)
 
 	return 0;
 
-err_tbl_init:
-	destroy_workqueue(act_ct_wq);
 err_register:
 	tcf_ct_flow_tables_uninit();
+err_tbl_init:
+	destroy_workqueue(act_ct_wq);
 	return err;
 }
 
commit 7dc6fd0f3b8404542718039f5de19fe56e474578
Merge: deacdb3e3979 8808981baf96
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 12:50:54 2020 -0700

    Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
    
    Pull i2c fixes from Wolfram Sang:
     "Some I2C core improvements to prevent NULL pointer usage and a
      MAINTAINERS update"
    
    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
      i2c: slave: add sanity check when unregistering
      i2c: slave: improve sanity check when registering
      MAINTAINERS: Update GENI I2C maintainers list
      i2c: also convert placeholder function to return errno

commit deacdb3e3979979016fcd0ffd518c320a62ad166
Merge: 14aab7eeb9f0 909adfc66b9a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 09:38:39 2020 -0700

    Merge tag 'powerpc-5.8-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
    
    Pull powerpc fix from Michael Ellerman:
     "Fix a bug introduced by the changes we made to lockless page table
      walking this cycle.
    
      When using the hash MMU, and perf with callchain recording, we can
      deadlock if the PMI interrupts a hash fault, and the callchain
      recording then takes a hash fault on the same page.
    
      Thanks to Nicholas Piggin, Aneesh Kumar K.V, Anton Blanchard, and
      Athira Rajeev"
    
    * tag 'powerpc-5.8-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
      powerpc/64s/hash: Fix hash_preload running with interrupts enabled

commit 14aab7eeb9f0b9c424aab0f07eb82b1baf2e5bbd
Merge: c1954ca6abdc 6a7389f0312f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 09:36:03 2020 -0700

    Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
    
    Pull arm64 fixes from Will Deacon:
     "The main one is to fix the build after Willy's per-cpu entropy changes
      this week. Although that was already resolved elsewhere, the arm64 fix
      here is useful cleanup anyway.
    
      Other than that, we've got a fix for building with Clang's integrated
      assembler and a fix to make our IPv4 checksumming robust against
      invalid header lengths (this only seems to be triggerable by injected
      errors).
    
       - Fix build breakage due to circular headers
    
       - Fix build regression when using Clang's integrated assembler
    
       - Fix IPv4 header checksum code to deal with invalid length field
    
       - Fix broken path for Arm PMU entry in MAINTAINERS"
    
    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
      MAINTAINERS: Include drivers subdirs for ARM PMU PROFILING AND DEBUGGING entry
      arm64: csum: Fix handling of bad packets
      arm64: Drop unnecessary include from asm/smp.h
      arm64/alternatives: move length validation inside the subsection

commit c1954ca6abdc69a02a768368eb31882e92cf5bfa
Merge: ae2911de2eb5 5c6360ee4a0e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 09:33:45 2020 -0700

    Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm
    
    Pull ARM fixes from Russell King:
    
     - avoid invoking overflow handler for uaccess watchpoints
    
     - fix incorrect clock_gettime64 availability
    
     - fix EFI crash in create_mapping_late()
    
    * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
      ARM: 8988/1: mmu: fix crash in EFI calls due to p4d typo in create_mapping_late()
      ARM: 8987/1: VDSO: Fix incorrect clock_gettime64
      ARM: 8986/1: hw_breakpoint: Don't invoke overflow handler on uaccess watchpoints

commit ae2911de2eb5dc9ccb88c6502c776a8fbb7acc67
Merge: 78431ab723aa fb448ce87a4a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 09:22:10 2020 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
    
    Pull rdma fixes from Jason Gunthorpe:
     "Two more merge window regressions, a corruption bug in hfi1 and a few
      other small fixes.
    
       - Missing user input validation regression in ucma
    
       - Disallowing a previously allowed user combination regression in
         mlx5
    
       - ODP prefetch memory leaking triggerable by userspace
    
       - Memory corruption in hf1 due to faulty ring buffer logic
    
       - Missed mutex initialization crash in mlx5
    
       - Two small defects with RDMA DIM"
    
    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
      RDMA/core: Free DIM memory in error unwind
      RDMA/core: Stop DIM before destroying CQ
      RDMA/mlx5: Initialize QP mutex for the debug kernels
      IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
      RDMA/mlx5: Allow providing extra scatter CQE QP flag
      RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
      RDMA/cm: Add min length checks to user structure copies

commit 78431ab723aa6f10258979acf88d9aaac2462cbe
Merge: d8b9faec54ae 5649625344fe
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 09:17:24 2020 -0700

    Merge tag 'sound-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
    
    Pull sound fixes from Takashi Iwai:
     "A few wrap-up small fixes for the usual HD-audio and USB-audio stuff:
    
       - A regression fix for S3 suspend on old Intel platforms
    
       - A fix for possible Oops in ASoC HD-audio binding
    
       - Trivial quirks for various devices"
    
    * tag 'sound-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
      ALSA: hda/realtek - Fixed HP right speaker no sound
      ALSA: hda: fix NULL pointer dereference during suspend
      ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
      ALSA: hda: Workaround for spurious wakeups on some Intel platforms
      ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
      ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
      ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
      ALSA: usb-audio: Add implicit feedback quirk for SSL2

commit 39efdd94e314336f4acbac4c07e0f37bdc3bef71
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Sat Jul 25 02:06:23 2020 +0100

    libtraceevent: Fix build with binutils 2.35
    
    In binutils 2.35, 'nm -D' changed to show symbol versions along with
    symbol names, with the usual @@ separator.  When generating
    libtraceevent-dynamic-list we need just the names, so strip off the
    version suffix if present.
    
    Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
    Tested-by: Salvatore Bonaccorso <carnil at debian.org>
    Reviewed-by: Steven Rostedt <rostedt at goodmis.org>
    Cc: linux-trace-devel at vger.kernel.org
    Cc: stable at vger.kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>

diff --git a/tools/lib/traceevent/plugins/Makefile b/tools/lib/traceevent/plugins/Makefile
index 349bb81482ab..680d883efe05 100644
--- a/tools/lib/traceevent/plugins/Makefile
+++ b/tools/lib/traceevent/plugins/Makefile
@@ -197,7 +197,7 @@ define do_generate_dynamic_list_file
 	xargs echo "U w W" | tr 'w ' 'W\n' | sort -u | xargs echo`;\
 	if [ "$$symbol_type" = "U W" ];then				\
 		(echo '{';                                              \
-		$(NM) -u -D $1 | awk 'NF>1 {print "\t"$$2";"}' | sort -u;\
+		$(NM) -u -D $1 | awk 'NF>1 {sub("@.*", "", $$2); print "\t"$$2";"}' | sort -u;\
 		echo '};';                                              \
 		) > $2;                                                 \
 	else                                                            \
commit bd3c628f8fafa6cbd6a1ca440034b841f0080160
Author: Wei Li <liwei391 at huawei.com>
Date:   Fri Jul 24 15:11:10 2020 +0800

    perf tools: Fix record failure when mixed with ARM SPE event
    
    When recording with cache-misses and arm_spe_x event, I found that it
    will just fail without showing any error info if i put cache-misses
    after 'arm_spe_x' event.
    
      [root at localhost 0620]# perf record -e cache-misses \
                                    -e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ sleep 1
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 0.067 MB perf.data ]
      [root at localhost 0620]#
      [root at localhost 0620]# perf record -e arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/ \
                                         -e  cache-misses sleep 1
      [root at localhost 0620]#
    
    The current code can only work if the only event to be traced is an
    'arm_spe_x', or if it is the last event to be specified. Otherwise the
    last event type will be checked against all the arm_spe_pmus[i]->types,
    none will match and an out of bound 'i' index will be used in
    arm_spe_recording_init().
    
    We don't support concurrent multiple arm_spe_x events currently, that
    is checked in arm_spe_recording_options(), and it will show the relevant
    info. So add the check and record of the first found 'arm_spe_pmu' to
    fix this issue here.
    
    Fixes: ffd3d18c20b8 ("perf tools: Add ARM Statistical Profiling Extensions (SPE) support")
    Signed-off-by: Wei Li <liwei391 at huawei.com>
    Reviewed-by: Mathieu Poirier <mathieu.poirier at linaro.org>
    Tested-by-by: Leo Yan <leo.yan at linaro.org>
    Cc: Alexander Shishkin <alexander.shishkin at linux.intel.com>
    Cc: Hanjun Guo <guohanjun at huawei.com>
    Cc: Jiri Olsa <jolsa at redhat.com>
    Cc: Kim Phillips <kim.phillips at arm.com>
    Cc: Mark Rutland <mark.rutland at arm.com>
    Cc: Mike Leach <mike.leach at linaro.org>
    Cc: Namhyung Kim <namhyung at kernel.org>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Suzuki Poulouse <suzuki.poulose at arm.com>
    Cc: linux-arm-kernel at lists.infradead.org
    Link: http://lore.kernel.org/lkml/20200724071111.35593-2-liwei391@huawei.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>

diff --git a/tools/perf/arch/arm/util/auxtrace.c b/tools/perf/arch/arm/util/auxtrace.c
index 0a6e75b8777a..28a5d0c18b1d 100644
--- a/tools/perf/arch/arm/util/auxtrace.c
+++ b/tools/perf/arch/arm/util/auxtrace.c
@@ -56,7 +56,7 @@ struct auxtrace_record
 	struct perf_pmu	*cs_etm_pmu;
 	struct evsel *evsel;
 	bool found_etm = false;
-	bool found_spe = false;
+	struct perf_pmu *found_spe = NULL;
 	static struct perf_pmu **arm_spe_pmus = NULL;
 	static int nr_spes = 0;
 	int i = 0;
@@ -74,12 +74,12 @@ struct auxtrace_record
 		    evsel->core.attr.type == cs_etm_pmu->type)
 			found_etm = true;
 
-		if (!nr_spes)
+		if (!nr_spes || found_spe)
 			continue;
 
 		for (i = 0; i < nr_spes; i++) {
 			if (evsel->core.attr.type == arm_spe_pmus[i]->type) {
-				found_spe = true;
+				found_spe = arm_spe_pmus[i];
 				break;
 			}
 		}
@@ -96,7 +96,7 @@ struct auxtrace_record
 
 #if defined(__aarch64__)
 	if (found_spe)
-		return arm_spe_recording_init(err, arm_spe_pmus[i]);
+		return arm_spe_recording_init(err, found_spe);
 #endif
 
 	/*
commit 463538a383a27337cb83ae195e432a839a52d639
Author: Thomas Richter <tmricht at linux.ibm.com>
Date:   Wed Jul 29 15:53:14 2020 +0200

    perf tests: Fix test 68 zstd compression for s390
    
    Commit 5aa98879efe7 ("s390/cpum_sf: prohibit callchain data collection")
    prohibits call graph sampling for hardware events on s390. The
    information recorded is out of context and does not match.
    
    On s390 this commit now breaks test case 68 Zstd perf.data
    compression/decompression.
    
    Therefore omit call graph sampling on s390 in this test.
    
    Output before:
      [root at t35lp46 perf]# ./perf test -Fv 68
      68: Zstd perf.data compression/decompression              :
      --- start ---
      Collecting compressed record file:
      Error:
      cycles: PMU Hardware doesn't support sampling/overflow-interrupts.
                                    Try 'perf stat'
      ---- end ----
      Zstd perf.data compression/decompression: FAILED!
      [root at t35lp46 perf]#
    
    Output after:
    [root at t35lp46 perf]# ./perf test -Fv 68
      68: Zstd perf.data compression/decompression              :
      --- start ---
      Collecting compressed record file:
      500+0 records in
      500+0 records out
      256000 bytes (256 kB, 250 KiB) copied, 0.00615638 s, 41.6 MB/s
      [ perf record: Woken up 1 times to write data ]
      [ perf record: Captured and wrote 0.004 MB /tmp/perf.data.X3M,
                            compressed (original 0.002 MB, ratio is 3.609) ]
      Checking compressed events stats:
      # compressed : Zstd, level = 1, ratio = 4
            COMPRESSED events:          1
      2ELIFREPh---- end ----
      Zstd perf.data compression/decompression: Ok
      [root at t35lp46 perf]#
    
    Signed-off-by: Thomas Richter <tmricht at linux.ibm.com>
    Reviewed-by: Sumanth Korikkar <sumanthk at linux.ibm.com>
    Cc: Heiko Carstens <heiko.carstens at de.ibm.com>
    Cc: Sven Schnelle <svens at linux.ibm.com>
    Cc: Vasily Gorbik <gor at linux.ibm.com>
    Link: http://lore.kernel.org/lkml/20200729135314.91281-1-tmricht@linux.ibm.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>

diff --git a/tools/perf/tests/shell/record+zstd_comp_decomp.sh b/tools/perf/tests/shell/record+zstd_comp_decomp.sh
index 63a91ec473bb..045723b3d992 100755
--- a/tools/perf/tests/shell/record+zstd_comp_decomp.sh
+++ b/tools/perf/tests/shell/record+zstd_comp_decomp.sh
@@ -12,7 +12,8 @@ skip_if_no_z_record() {
 
 collect_z_record() {
 	echo "Collecting compressed record file:"
-	$perf_tool record -o $trace_file -g -z -F 5000 -- \
+	[[ "$(uname -m)" != s390x ]] && gflag='-g'
+	$perf_tool record -o $trace_file $gflag -z -F 5000 -- \
 		dd count=500 if=/dev/urandom of=/dev/null
 }
 
commit e24c6447ccb7b1a01f9bf0aec94939e6450c0b4d
Author: Philippe Duplessis-Guindon <pduplessis at efficios.com>
Date:   Thu Jul 30 11:02:36 2020 -0400

    tools lib traceevent: Fix memory leak in process_dynamic_array_len
    
    I compiled with AddressSanitizer and I had these memory leaks while I
    was using the tep_parse_format function:
    
        Direct leak of 28 byte(s) in 4 object(s) allocated from:
            #0 0x7fb07db49ffe in __interceptor_realloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dffe)
            #1 0x7fb07a724228 in extend_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:985
            #2 0x7fb07a724c21 in __read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1140
            #3 0x7fb07a724f78 in read_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1206
            #4 0x7fb07a725191 in __read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1291
            #5 0x7fb07a7251df in read_expect_type /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1299
            #6 0x7fb07a72e6c8 in process_dynamic_array_len /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:2849
            #7 0x7fb07a7304b8 in process_function /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3161
            #8 0x7fb07a730900 in process_arg_token /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3207
            #9 0x7fb07a727c0b in process_arg /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:1786
            #10 0x7fb07a731080 in event_read_print_args /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3285
            #11 0x7fb07a731722 in event_read_print /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:3369
            #12 0x7fb07a740054 in __tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6335
            #13 0x7fb07a74047a in __parse_event /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6389
            #14 0x7fb07a740536 in tep_parse_format /home/pduplessis/repo/linux/tools/lib/traceevent/event-parse.c:6431
            #15 0x7fb07a785acf in parse_event ../../../src/fs-src/fs.c:251
            #16 0x7fb07a785ccd in parse_systems ../../../src/fs-src/fs.c:284
            #17 0x7fb07a786fb3 in read_metadata ../../../src/fs-src/fs.c:593
            #18 0x7fb07a78760e in ftrace_fs_source_init ../../../src/fs-src/fs.c:727
            #19 0x7fb07d90c19c in add_component_with_init_method_data ../../../../src/lib/graph/graph.c:1048
            #20 0x7fb07d90c87b in add_source_component_with_initialize_method_data ../../../../src/lib/graph/graph.c:1127
            #21 0x7fb07d90c92a in bt_graph_add_source_component ../../../../src/lib/graph/graph.c:1152
            #22 0x55db11aa632e in cmd_run_ctx_create_components_from_config_components ../../../src/cli/babeltrace2.c:2252
            #23 0x55db11aa6fda in cmd_run_ctx_create_components ../../../src/cli/babeltrace2.c:2347
            #24 0x55db11aa780c in cmd_run ../../../src/cli/babeltrace2.c:2461
            #25 0x55db11aa8a7d in main ../../../src/cli/babeltrace2.c:2673
            #26 0x7fb07d5460b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    
    The token variable in the process_dynamic_array_len function is
    allocated in the read_expect_type function, but is not freed before
    calling the read_token function.
    
    Free the token variable before calling read_token in order to plug the
    leak.
    
    Signed-off-by: Philippe Duplessis-Guindon <pduplessis at efficios.com>
    Reviewed-by: Steven Rostedt (VMware) <rostedt at goodmis.org>
    Link: https://lore.kernel.org/linux-trace-devel/20200730150236.5392-1-pduplessis@efficios.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>

diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index 5b36c589a029..ba4f33804af1 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2861,6 +2861,7 @@ process_dynamic_array_len(struct tep_event *event, struct tep_print_arg *arg,
 	if (read_expected(TEP_EVENT_DELIM, ")") < 0)
 		goto out_err;
 
+	free_token(token);
 	type = read_token(&token);
 	*tok = token;
 
commit a9e10b169e65f0f7061233ebe843a4b4f488dbae
Author: Steve Cohen <cohens at codeaurora.org>
Date:   Wed Jul 29 01:35:52 2020 -0400

    drm: re-add deleted doc for drm_gem_open_ioctl
    
    Add back the removed documentation for drm_gem_open_ioctl.
    This patch is submitted in response to [1].
    
    [1] https://lore.kernel.org/linux-arm-msm/20200728085244.GY6419@phenom.ffwll.local/
    
    Signed-off-by: Steve Cohen <cohens at codeaurora.org>
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/1596000952-27621-1-git-send-email-cohens@codeaurora.org

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index ee2058ad482c..fe9412219b1e 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -871,6 +871,9 @@ err:
  * @file_priv: drm file-private structure
  *
  * Open an object using the global name, returning a handle and the size.
+ *
+ * This handle (of course) holds a reference to the object, so the object
+ * will not go away until the handle is deleted.
  */
 int
 drm_gem_open_ioctl(struct drm_device *dev, void *data,
commit 830f01b089b12bbe93bd55f2d62837253012a30e
Author: Wanpeng Li <wanpengli at tencent.com>
Date:   Fri Jul 31 11:12:21 2020 +0800

    KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM
    
    'Commit 8566ac8b8e7c ("KVM: SVM: Implement pause loop exit logic in SVM")'
    drops disable pause loop exit/pause filtering capability completely, I
    guess it is a merge fault by Radim since disable vmexits capabilities and
    pause loop exit for SVM patchsets are merged at the same time. This patch
    reintroduces the disable pause loop exit/pause filtering capability support.
    
    Reported-by: Haiwei Li <lihaiwei at tencent.com>
    Tested-by: Haiwei Li <lihaiwei at tencent.com>
    Fixes: 8566ac8b ("KVM: SVM: Implement pause loop exit logic in SVM")
    Signed-off-by: Wanpeng Li <wanpengli at tencent.com>
    Message-Id: <1596165141-28874-3-git-send-email-wanpengli at tencent.com>
    Cc: stable at vger.kernel.org
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index c0da4dd78ac5..5bbf76189afa 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1090,7 +1090,7 @@ static void init_vmcb(struct vcpu_svm *svm)
 	svm->nested.vmcb = 0;
 	svm->vcpu.arch.hflags = 0;
 
-	if (pause_filter_count) {
+	if (!kvm_pause_in_guest(svm->vcpu.kvm)) {
 		control->pause_filter_count = pause_filter_count;
 		if (pause_filter_thresh)
 			control->pause_filter_thresh = pause_filter_thresh;
@@ -2693,7 +2693,7 @@ static int pause_interception(struct vcpu_svm *svm)
 	struct kvm_vcpu *vcpu = &svm->vcpu;
 	bool in_kernel = (svm_get_cpl(vcpu) == 0);
 
-	if (pause_filter_thresh)
+	if (!kvm_pause_in_guest(vcpu->kvm))
 		grow_ple_window(vcpu);
 
 	kvm_vcpu_on_spin(vcpu, in_kernel);
@@ -3780,7 +3780,7 @@ static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu)
 
 static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
 {
-	if (pause_filter_thresh)
+	if (!kvm_pause_in_guest(vcpu->kvm))
 		shrink_ple_window(vcpu);
 }
 
@@ -3958,6 +3958,9 @@ static void svm_vm_destroy(struct kvm *kvm)
 
 static int svm_vm_init(struct kvm *kvm)
 {
+	if (!pause_filter_count || !pause_filter_thresh)
+		kvm->arch.pause_in_guest = true;
+
 	if (avic) {
 		int ret = avic_vm_init(kvm);
 		if (ret)
commit d2286ba7d574ba3103a421a2f9ec17cb5b0d87a1
Author: Wanpeng Li <wanpengli at tencent.com>
Date:   Fri Jul 31 11:12:19 2020 +0800

    KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled
    
    Prevent setting the tscdeadline timer if the lapic is hw disabled.
    
    Fixes: bce87cce88 (KVM: x86: consolidate different ways to test for in-kernel LAPIC)
    Cc: <stable at vger.kernel.org>
    Signed-off-by: Wanpeng Li <wanpengli at tencent.com>
    Message-Id: <1596165141-28874-1-git-send-email-wanpengli at tencent.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 5bf72fc86a8e..4ce2ddd26c0b 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2195,7 +2195,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
-	if (!lapic_in_kernel(vcpu) || apic_lvtt_oneshot(apic) ||
+	if (!kvm_apic_present(vcpu) || apic_lvtt_oneshot(apic) ||
 			apic_lvtt_period(apic))
 		return;
 
commit d8b9faec54ae4bc2fff68bcd0befa93ace8256ce
Merge: a2ec905d1e16 887c909dd5d5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 30 21:26:42 2020 -0700

    Merge tag 'drm-fixes-2020-07-31' of git://anongit.freedesktop.org/drm/drm
    
    Pull more drm fixes from Dave Airlie:
     "As mentioned previously this contains the nouveau regression fix.
    
      amdgpu had three fixes outstanding as well, one revert, an info leak
      and use after free. The use after free is a bit trickier than I'd
      like, and I've personally gone over it to confirm I'm happy that it is
      doing what it says.
    
      nouveau:
       - final modifiers regression fix
    
      amdgpu:
       - Revert a fix which caused other regressions
       - Fix potential kernel info leak
       - Fix a use-after-free bug that was uncovered by another change in 5.7"
    
    * tag 'drm-fixes-2020-07-31' of git://anongit.freedesktop.org/drm/drm:
      drm/nouveau: Accept 'legacy' format modifiers
      Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
      drm/amd/display: Clear dm_state for fast updates
      drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()

commit 887c909dd5d557c203a233ebbe238c18438a680a
Merge: faa0fcf943d2 87004abfbc27
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Jul 31 13:04:00 2020 +1000

    Merge tag 'amd-drm-fixes-5.8-2020-07-30' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
    
    amd-drm-fixes-5.8-2020-07-30:
    
    amdgpu:
    - Revert a fix which caused other regressions
    - Fix potential kernel info leak
    - Fix a use-after-free bug that was uncovered by another change in 5.7
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: Alex Deucher <alexdeucher at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200730154338.244104-1-alexander.deucher@amd.com

commit faa0fcf943d2d53992b3c73752df9a0547cb4797
Author: James Jones <jajones at nvidia.com>
Date:   Thu Jul 30 16:58:23 2020 -0700

    drm/nouveau: Accept 'legacy' format modifiers
    
    Accept the DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK()
    family of modifiers to handle broken userspace
    Xorg modesetting and Mesa drivers. Existing Mesa
    drivers are still aware of only these older
    format modifiers which do not differentiate
    between different variations of the block linear
    layout. When the format modifier support flag was
    flipped in the nouveau kernel driver, the X.org
    modesetting driver began attempting to use its
    format modifier-enabled framebuffer path. Because
    the set of format modifiers advertised by the
    kernel prior to this change do not intersect with
    the set of format modifiers advertised by Mesa,
    allocating GBM buffers using format modifiers
    fails and the modesetting driver falls back to
    non-modifier allocation. However, it still later
    queries the modifier of the GBM buffer when
    creating its DRM-KMS framebuffer object, receives
    the old-format modifier from Mesa, and attempts
    to create a framebuffer with it. Since the kernel
    is still not aware of these formats, this fails.
    
    Userspace should not be attempting to query format
    modifiers of GBM buffers allocated with a non-
    format-modifier-aware allocation path, but to
    avoid breaking existing userspace behavior, this
    change accepts the old-style format modifiers when
    creating framebuffers and applying them to planes
    by translating them to the equivalent new-style
    modifier. To accomplish this, some layout
    parameters must be assumed to match properties of
    the device targeted by the relevant ioctls. To
    avoid perpetuating misuse of the old-style
    modifiers, this change does not advertise support
    for them. Doing so would imply compatibility
    between devices with incompatible memory layouts.
    
    Tested with Xorg 1.20 modesetting driver,
    weston at c46c70dac84a4b3030cd05b380f9f410536690fc,
    gnome & KDE wayland desktops from Ubuntu 18.04,
    and sway 1.5
    
    Reported-by: Kirill A. Shutemov <kirill at shutemov.name>
    Fixes: fa4f4c213f5f ("drm/nouveau/kms: Support NVIDIA format modifiers")
    Link: https://lkml.org/lkml/2020/6/30/1251
    Signed-off-by: James Jones <jajones at nvidia.com>
    Acked-by: Ben Skeggs <bskeggs at redhat.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 496c4621cc78..07373bbc2acf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -191,6 +191,7 @@ nouveau_decode_mod(struct nouveau_drm *drm,
 		   uint32_t *tile_mode,
 		   uint8_t *kind)
 {
+	struct nouveau_display *disp = nouveau_display(drm->dev);
 	BUG_ON(!tile_mode || !kind);
 
 	if (modifier == DRM_FORMAT_MOD_LINEAR) {
@@ -202,6 +203,12 @@ nouveau_decode_mod(struct nouveau_drm *drm,
 		 * Extract the block height and kind from the corresponding
 		 * modifier fields.  See drm_fourcc.h for details.
 		 */
+
+		if ((modifier & (0xffull << 12)) == 0ull) {
+			/* Legacy modifier.  Translate to this dev's 'kind.' */
+			modifier |= disp->format_modifiers[0] & (0xffull << 12);
+		}
+
 		*tile_mode = (uint32_t)(modifier & 0xF);
 		*kind = (uint8_t)((modifier >> 12) & 0xFF);
 
@@ -227,6 +234,16 @@ nouveau_framebuffer_get_layout(struct drm_framebuffer *fb,
 	}
 }
 
+static const u64 legacy_modifiers[] = {
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(0),
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(1),
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(2),
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(3),
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(4),
+	DRM_FORMAT_MOD_NVIDIA_16BX2_BLOCK(5),
+	DRM_FORMAT_MOD_INVALID
+};
+
 static int
 nouveau_validate_decode_mod(struct nouveau_drm *drm,
 			    uint64_t modifier,
@@ -247,8 +264,14 @@ nouveau_validate_decode_mod(struct nouveau_drm *drm,
 	     (disp->format_modifiers[mod] != modifier);
 	     mod++);
 
-	if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID)
-		return -EINVAL;
+	if (disp->format_modifiers[mod] == DRM_FORMAT_MOD_INVALID) {
+		for (mod = 0;
+		     (legacy_modifiers[mod] != DRM_FORMAT_MOD_INVALID) &&
+		     (legacy_modifiers[mod] != modifier);
+		     mod++);
+		if (legacy_modifiers[mod] == DRM_FORMAT_MOD_INVALID)
+			return -EINVAL;
+	}
 
 	nouveau_decode_mod(drm, modifier, tile_mode, kind);
 
commit e692139e6af339a1495ef401b2d95f7f9d1c7a44
Author: Xin Xiong <xiongx18 at fudan.edu.cn>
Date:   Thu Jul 30 18:29:41 2020 +0800

    net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
    
    The function invokes bpf_prog_inc(), which increases the reference
    count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL.
    
    The refcount leak issues take place in two error handling paths. When
    either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function
    simply returns the error code and forgets to drop the reference count
    increased earlier, causing a reference count leak of "rq->xdp_prog".
    
    Fix this issue by jumping to the error handling path err_rq_wq_destroy
    while either function fails.
    
    Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ types")
    Signed-off-by: Xin Xiong <xiongx18 at fudan.edu.cn>
    Signed-off-by: Xiyu Yang <xiyuyang19 at fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf at gmail.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 07fdbea7ea13..3b892ec301b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -419,7 +419,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 		err = mlx5_wq_ll_create(mdev, &rqp->wq, rqc_wq, &rq->mpwqe.wq,
 					&rq->wq_ctrl);
 		if (err)
-			return err;
+			goto err_rq_wq_destroy;
 
 		rq->mpwqe.wq.db = &rq->mpwqe.wq.db[MLX5_RCV_DBR];
 
@@ -470,7 +470,7 @@ static int mlx5e_alloc_rq(struct mlx5e_channel *c,
 		err = mlx5_wq_cyc_create(mdev, &rqp->wq, rqc_wq, &rq->wqe.wq,
 					 &rq->wq_ctrl);
 		if (err)
-			return err;
+			goto err_rq_wq_destroy;
 
 		rq->wqe.wq.db = &rq->wqe.wq.db[MLX5_RCV_DBR];
 
commit 6f7bbad18e8343da6318654f408dea0ccd6efb00
Author: Jianbo Liu <jianbol at mellanox.com>
Date:   Fri Jul 3 02:34:23 2020 +0000

    net/mlx5e: E-Switch, Specify flow_source for rule with no in_port
    
    The flow_source must be specified, even for rule without matching
    source vport, because some actions are only allowed in uplink.
    Otherwise, rule can't be offloaded and firmware syndrome happens.
    
    Fixes: 6fb0701a9cfa ("net/mlx5: E-Switch, Add support for offloading rules with no in_port")
    Signed-off-by: Jianbo Liu <jianbol at mellanox.com>
    Reviewed-by: Chris Mi <chrism at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index d70d6c099582..ed75353c56b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -236,6 +236,15 @@ static struct mlx5_eswitch_rep *mlx5_eswitch_get_rep(struct mlx5_eswitch *esw,
 	return &esw->offloads.vport_reps[idx];
 }
 
+static void
+mlx5_eswitch_set_rule_flow_source(struct mlx5_eswitch *esw,
+				  struct mlx5_flow_spec *spec,
+				  struct mlx5_esw_flow_attr *attr)
+{
+	if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source) &&
+	    attr && attr->in_rep && attr->in_rep->vport == MLX5_VPORT_UPLINK)
+		spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
+}
 
 static void
 mlx5_eswitch_set_rule_source_port(struct mlx5_eswitch *esw,
@@ -276,10 +285,6 @@ mlx5_eswitch_set_rule_source_port(struct mlx5_eswitch *esw,
 
 		spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
 	}
-
-	if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source) &&
-	    attr->in_rep->vport == MLX5_VPORT_UPLINK)
-		spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
 }
 
 struct mlx5_flow_handle *
@@ -377,9 +382,6 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
 		flow_act.modify_hdr = attr->modify_hdr;
 
 	if (split) {
-		if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source) &&
-		    attr->in_rep->vport == MLX5_VPORT_UPLINK)
-			spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
 		fdb = esw_vport_tbl_get(esw, attr);
 	} else {
 		if (attr->chain || attr->prio)
@@ -396,6 +398,8 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
 		goto err_esw_get;
 	}
 
+	mlx5_eswitch_set_rule_flow_source(esw, spec, attr);
+
 	if (mlx5_eswitch_termtbl_required(esw, attr, &flow_act, spec))
 		rule = mlx5_eswitch_add_termtbl_rule(esw, fdb, spec, attr,
 						     &flow_act, dest, i);
@@ -462,6 +466,7 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw,
 	i++;
 
 	mlx5_eswitch_set_rule_source_port(esw, spec, attr);
+	mlx5_eswitch_set_rule_flow_source(esw, spec, attr);
 
 	if (attr->outer_match_level != MLX5_MATCH_NONE)
 		spec->match_criteria_enable |= MLX5_MATCH_OUTER_HEADERS;
commit 0faddfe6b7953e224a1283f89f671ef6a9ba73de
Author: Jianbo Liu <jianbol at mellanox.com>
Date:   Thu Jul 2 01:06:37 2020 +0000

    net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring
    
    The modified flow_context fields in FTE must be indicated in
    modify_enable bitmask. Previously, the misc bit in modify_enable is
    always set as source vport must be set for each rule. So, when parsing
    vxlan/gre/geneve/qinq rules, this bit is not set because those are all
    from the same misc fileds that source vport fields are located at, and
    we don't need to set the indicator twice.
    
    After adding per vport tables for mirroring, misc bit is not set, then
    firmware syndrome happens. To fix it, set the bit wherever misc fileds
    are changed. This also makes it unnecessary to check misc fields and set
    the misc bit accordingly in metadata matching, so here remove it.
    
    Besides, flow_source must be specified for uplink because firmware
    will check it and some actions are only allowed for packets received
    from uplink.
    
    Fixes: 96e326878fa5 ("net/mlx5e: Eswitch, Use per vport tables for mirroring")
    Signed-off-by: Jianbo Liu <jianbol at mellanox.com>
    Reviewed-by: Chris Mi <chrism at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
index 951ea26d96bc..e472ed0eacfb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_geneve.c
@@ -301,6 +301,8 @@ static int mlx5e_tc_tun_parse_geneve_params(struct mlx5e_priv *priv,
 		MLX5_SET(fte_match_set_misc, misc_v, geneve_protocol_type, ETH_P_TEB);
 	}
 
+	spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
+
 	return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gre.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gre.c
index 58b13192df23..2805416c32a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gre.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gre.c
@@ -80,6 +80,8 @@ static int mlx5e_tc_tun_parse_gretap(struct mlx5e_priv *priv,
 			 gre_key.key, be32_to_cpu(enc_keyid.key->keyid));
 	}
 
+	spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
+
 	return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c
index 37b176801bcc..038a0f1cecec 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_vxlan.c
@@ -136,6 +136,8 @@ static int mlx5e_tc_tun_parse_vxlan(struct mlx5e_priv *priv,
 	MLX5_SET(fte_match_set_misc, misc_v, vxlan_vni,
 		 be32_to_cpu(enc_keyid.key->keyid));
 
+	spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
+
 	return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index cc8412151ca0..fcedb5bdca9e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2356,6 +2356,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
 				 match.key->vlan_priority);
 
 			*match_level = MLX5_MATCH_L2;
+			spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
 		}
 	}
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 060354bb211a..d70d6c099582 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -259,9 +259,6 @@ mlx5_eswitch_set_rule_source_port(struct mlx5_eswitch *esw,
 			 mlx5_eswitch_get_vport_metadata_mask());
 
 		spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2;
-		misc = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, misc_parameters);
-		if (memchr_inv(misc, 0, MLX5_ST_SZ_BYTES(fte_match_set_misc)))
-			spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
 	} else {
 		misc = MLX5_ADDR_OF(fte_match_param, spec->match_value, misc_parameters);
 		MLX5_SET(fte_match_set_misc, misc, source_port, attr->in_rep->vport);
@@ -380,6 +377,9 @@ mlx5_eswitch_add_offloaded_rule(struct mlx5_eswitch *esw,
 		flow_act.modify_hdr = attr->modify_hdr;
 
 	if (split) {
+		if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source) &&
+		    attr->in_rep->vport == MLX5_VPORT_UPLINK)
+			spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
 		fdb = esw_vport_tbl_get(esw, attr);
 	} else {
 		if (attr->chain || attr->prio)
commit 01cefbbe2c51fa94d4221ca63d236907c5e19fe3
Author: Jianbo Liu <jianbol at mellanox.com>
Date:   Mon Jul 20 01:36:45 2020 +0000

    net/mlx5e: CT: Support restore ipv6 tunnel
    
    Currently the driver restores only IPv4 tunnel headers.
    Add support for restoring IPv6 tunnel header.
    
    Fixes: b8ce90370977 ("net/mlx5e: Restore tunnel metadata on miss")
    Signed-off-by: Jianbo Liu <jianbol at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Reviewed-by: Oz Shlomo <ozsh at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
index eefeb1cdc2ee..245a99f69641 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
@@ -551,19 +551,31 @@ static bool mlx5e_restore_tunnel(struct mlx5e_priv *priv, struct sk_buff *skb,
 		}
 	}
 
-	tun_dst = tun_rx_dst(enc_opts.key.len);
+	if (key.enc_control.addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
+		tun_dst = __ip_tun_set_dst(key.enc_ipv4.src, key.enc_ipv4.dst,
+					   key.enc_ip.tos, key.enc_ip.ttl,
+					   key.enc_tp.dst, TUNNEL_KEY,
+					   key32_to_tunnel_id(key.enc_key_id.keyid),
+					   enc_opts.key.len);
+	} else if (key.enc_control.addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
+		tun_dst = __ipv6_tun_set_dst(&key.enc_ipv6.src, &key.enc_ipv6.dst,
+					     key.enc_ip.tos, key.enc_ip.ttl,
+					     key.enc_tp.dst, 0, TUNNEL_KEY,
+					     key32_to_tunnel_id(key.enc_key_id.keyid),
+					     enc_opts.key.len);
+	} else {
+		netdev_dbg(priv->netdev,
+			   "Couldn't restore tunnel, unsupported addr_type: %d\n",
+			   key.enc_control.addr_type);
+		return false;
+	}
+
 	if (!tun_dst) {
-		WARN_ON_ONCE(true);
+		netdev_dbg(priv->netdev, "Couldn't restore tunnel, no tun_dst\n");
 		return false;
 	}
 
-	ip_tunnel_key_init(&tun_dst->u.tun_info.key,
-			   key.enc_ipv4.src, key.enc_ipv4.dst,
-			   key.enc_ip.tos, key.enc_ip.ttl,
-			   0, /* label */
-			   key.enc_tp.src, key.enc_tp.dst,
-			   key32_to_tunnel_id(key.enc_key_id.keyid),
-			   TUNNEL_KEY);
+	tun_dst->u.tun_info.key.tp_src = key.enc_tp.src;
 
 	if (enc_opts.key.len)
 		ip_tunnel_info_opts_set(&tun_dst->u.tun_info,
commit d0c3c75d5d8911b0e92e48ce79b827ad869d5c93
Merge: 85496a292241 04e35caa32ec
Author: David S. Miller <davem at davemloft.net>
Date:   Thu Jul 30 17:47:34 2020 -0700

    Merge tag 'mac80211-for-davem-2020-07-30' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
    
    Johannes Berg says:
    
    ====================
    A couple of more changes:
     * remove a warning that can trigger in certain races
     * check a function pointer before using it
     * check before adding 6 GHz to avoid a warning in mesh
     * fix two memory leaks in mesh
     * fix a TX status bug leading to a memory leak
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 85496a29224188051b6135eb38da8afd4c584765
Author: Wang Hai <wanghai38 at huawei.com>
Date:   Thu Jul 30 15:30:00 2020 +0800

    net: gemini: Fix missing clk_disable_unprepare() in error path of gemini_ethernet_port_probe()
    
    Fix the missing clk_disable_unprepare() before return
    from gemini_ethernet_port_probe() in the error handling case.
    
    Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet")
    Reported-by: Hulk Robot <hulkci at huawei.com>
    Signed-off-by: Wang Hai <wanghai38 at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c
index 8d13ea370db1..66e67b24a887 100644
--- a/drivers/net/ethernet/cortina/gemini.c
+++ b/drivers/net/ethernet/cortina/gemini.c
@@ -2446,6 +2446,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
 	port->reset = devm_reset_control_get_exclusive(dev, NULL);
 	if (IS_ERR(port->reset)) {
 		dev_err(dev, "no reset\n");
+		clk_disable_unprepare(port->pclk);
 		return PTR_ERR(port->reset);
 	}
 	reset_control_reset(port->reset);
@@ -2501,8 +2502,10 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev)
 					IRQF_SHARED,
 					port_names[port->id],
 					port);
-	if (ret)
+	if (ret) {
+		clk_disable_unprepare(port->pclk);
 		return ret;
+	}
 
 	ret = register_netdev(netdev);
 	if (!ret) {
commit 59929fbb45e06da7d501d3a97f10a91912181f7c
Author: Shannon Nelson <snelson at pensando.io>
Date:   Wed Jul 29 10:52:17 2020 -0700

    ionic: unlock queue mutex in error path
    
    On an error return, jump to the unlock at the end to be sure
    to unlock the queue_lock mutex.
    
    Fixes: 0925e9db4dc8 ("ionic: use mutex to protect queue operations")
    Reported-by: kernel test robot <lkp at intel.com>
    Reported-by: Julia Lawall <julia.lawall at lip6.fr>
    Signed-off-by: Shannon Nelson <snelson at pensando.io>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 5fd31ba56937..e55d41546cff 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -2001,7 +2001,7 @@ int ionic_reset_queues(struct ionic_lif *lif, ionic_reset_cb cb, void *arg)
 		netif_device_detach(lif->netdev);
 		err = ionic_stop(lif->netdev);
 		if (err)
-			return err;
+			goto reset_out;
 	}
 
 	if (cb)
@@ -2011,6 +2011,8 @@ int ionic_reset_queues(struct ionic_lif *lif, ionic_reset_cb cb, void *arg)
 		err = ionic_open(lif->netdev);
 		netif_device_attach(lif->netdev);
 	}
+
+reset_out:
 	mutex_unlock(&lif->queue_lock);
 
 	return err;
commit 51875dad43b44241b46a569493f1e4bfa0386d86
Author: Xin Xiong <xiongx18 at fudan.edu.cn>
Date:   Wed Jul 29 21:06:59 2020 +0800

    atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
    
    atmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a
    reference of atm_dev with increased refcount or NULL if fails.
    
    The refcount leaks issues occur in two error handling paths. If
    dev_data->persist is zero or PRIV(dev)->vcc isn't NULL, the function
    returns 0 without decreasing the refcount kept by a local variable,
    resulting in refcount leaks.
    
    Fix the issue by adding atm_dev_put() before returning 0 both when
    dev_data->persist is zero or PRIV(dev)->vcc isn't NULL.
    
    Signed-off-by: Xin Xiong <xiongx18 at fudan.edu.cn>
    Signed-off-by: Xiyu Yang <xiyuyang19 at fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index d9fd70280482..7f814da3c2d0 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -433,9 +433,15 @@ static int atmtcp_remove_persistent(int itf)
 		return -EMEDIUMTYPE;
 	}
 	dev_data = PRIV(dev);
-	if (!dev_data->persist) return 0;
+	if (!dev_data->persist) {
+		atm_dev_put(dev);
+		return 0;
+	}
 	dev_data->persist = 0;
-	if (PRIV(dev)->vcc) return 0;
+	if (PRIV(dev)->vcc) {
+		atm_dev_put(dev);
+		return 0;
+	}
 	kfree(dev_data);
 	atm_dev_put(dev);
 	atm_dev_deregister(dev);
commit 555a893303872e044fb86f0a5834ce78d41ad2e2
Author: Landen Chao <landen.chao at mediatek.com>
Date:   Wed Jul 29 10:15:17 2020 +0200

    net: ethernet: mtk_eth_soc: fix MTU warnings
    
    in recent kernel versions there are warnings about incorrect MTU size
    like these:
    
    eth0: mtu greater than device maximum
    mtk_soc_eth 1b100000.ethernet eth0: error -22 setting MTU to include DSA overhead
    
    Fixes: bfcb813203e6 ("net: dsa: configure the MTU for switch ports")
    Fixes: 72579e14a1d3 ("net: dsa: don't fail to probe if we couldn't set the MTU")
    Fixes: 7a4c53bee332 ("net: report invalid mtu value via netlink extack")
    Signed-off-by: Landen Chao <landen.chao at mediatek.com>
    Signed-off-by: Frank Wunderlich <frank-w at public-files.de>
    Reviewed-by: Andrew Lunn <andrew at lunn.ch>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 85735d32ecb0..a1c45b39a230 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2891,6 +2891,8 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
 	eth->netdev[id]->irq = eth->irq[0];
 	eth->netdev[id]->dev.of_node = np;
 
+	eth->netdev[id]->max_mtu = MTK_MAX_RX_LENGTH - MTK_RX_ETH_HLEN;
+
 	return 0;
 
 free_netdev:
commit 366228ed01f6882cc203e3d5b40010dfae0be1c3
Author: Lu Wei <luwei32 at huawei.com>
Date:   Wed Jul 29 11:50:05 2020 +0800

    net: nixge: fix potential memory leak in nixge_probe()
    
    If some processes in nixge_probe() fail, free_netdev(dev)
    needs to be called to aviod a memory leak.
    
    Fixes: 87ab207981ec ("net: nixge: Separate ctrl and dma resources")
    Fixes: abcd3d6fc640 ("net: nixge: Fix error path for obtaining mac address")
    Reported-by: Hulk Robot <hulkci at huawei.com>
    Signed-off-by: Lu Wei <luwei32 at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
index d2708a57f2ff..4075f5e59955 100644
--- a/drivers/net/ethernet/ni/nixge.c
+++ b/drivers/net/ethernet/ni/nixge.c
@@ -1299,19 +1299,21 @@ static int nixge_probe(struct platform_device *pdev)
 	netif_napi_add(ndev, &priv->napi, nixge_poll, NAPI_POLL_WEIGHT);
 	err = nixge_of_get_resources(pdev);
 	if (err)
-		return err;
+		goto free_netdev;
 	__nixge_hw_set_mac_address(ndev);
 
 	priv->tx_irq = platform_get_irq_byname(pdev, "tx");
 	if (priv->tx_irq < 0) {
 		netdev_err(ndev, "could not find 'tx' irq");
-		return priv->tx_irq;
+		err = priv->tx_irq;
+		goto free_netdev;
 	}
 
 	priv->rx_irq = platform_get_irq_byname(pdev, "rx");
 	if (priv->rx_irq < 0) {
 		netdev_err(ndev, "could not find 'rx' irq");
-		return priv->rx_irq;
+		err = priv->rx_irq;
+		goto free_netdev;
 	}
 
 	priv->coalesce_count_rx = XAXIDMA_DFT_RX_THRESHOLD;
commit 82274d075536322368ce710b211c41c37c4740b9
Author: Jakub Kicinski <kuba at kernel.org>
Date:   Tue Jul 28 16:15:07 2020 -0700

    devlink: ignore -EOPNOTSUPP errors on dumpit
    
    Number of .dumpit functions try to ignore -EOPNOTSUPP errors.
    Recent change missed that, and started reporting all errors
    but -EMSGSIZE back from dumps. This leads to situation like
    this:
    
    $ devlink dev info
    devlink answers: Operation not supported
    
    Dump should not report an error just because the last device
    to be queried could not provide an answer.
    
    To fix this and avoid similar confusion make sure we clear
    err properly, and not leave it set to an error if we don't
    terminate the iteration.
    
    Fixes: c62c2cfb801b ("net: devlink: don't ignore errors during dumpit")
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/core/devlink.c b/net/core/devlink.c
index dc2b18475956..47f14a2f25fb 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1065,7 +1065,9 @@ static int devlink_nl_cmd_sb_pool_get_dumpit(struct sk_buff *msg,
 						   devlink_sb,
 						   NETLINK_CB(cb->skb).portid,
 						   cb->nlh->nlmsg_seq);
-			if (err && err != -EOPNOTSUPP) {
+			if (err == -EOPNOTSUPP) {
+				err = 0;
+			} else if (err) {
 				mutex_unlock(&devlink->lock);
 				goto out;
 			}
@@ -1266,7 +1268,9 @@ static int devlink_nl_cmd_sb_port_pool_get_dumpit(struct sk_buff *msg,
 							devlink, devlink_sb,
 							NETLINK_CB(cb->skb).portid,
 							cb->nlh->nlmsg_seq);
-			if (err && err != -EOPNOTSUPP) {
+			if (err == -EOPNOTSUPP) {
+				err = 0;
+			} else if (err) {
 				mutex_unlock(&devlink->lock);
 				goto out;
 			}
@@ -1498,7 +1502,9 @@ devlink_nl_cmd_sb_tc_pool_bind_get_dumpit(struct sk_buff *msg,
 							   devlink_sb,
 							   NETLINK_CB(cb->skb).portid,
 							   cb->nlh->nlmsg_seq);
-			if (err && err != -EOPNOTSUPP) {
+			if (err == -EOPNOTSUPP) {
+				err = 0;
+			} else if (err) {
 				mutex_unlock(&devlink->lock);
 				goto out;
 			}
@@ -3299,7 +3305,9 @@ static int devlink_nl_cmd_param_get_dumpit(struct sk_buff *msg,
 						    NETLINK_CB(cb->skb).portid,
 						    cb->nlh->nlmsg_seq,
 						    NLM_F_MULTI);
-			if (err && err != -EOPNOTSUPP) {
+			if (err == -EOPNOTSUPP) {
+				err = 0;
+			} else if (err) {
 				mutex_unlock(&devlink->lock);
 				goto out;
 			}
@@ -3569,7 +3577,9 @@ static int devlink_nl_cmd_port_param_get_dumpit(struct sk_buff *msg,
 						NETLINK_CB(cb->skb).portid,
 						cb->nlh->nlmsg_seq,
 						NLM_F_MULTI);
-				if (err && err != -EOPNOTSUPP) {
+				if (err == -EOPNOTSUPP) {
+					err = 0;
+				} else if (err) {
 					mutex_unlock(&devlink->lock);
 					goto out;
 				}
@@ -4518,7 +4528,9 @@ static int devlink_nl_cmd_info_get_dumpit(struct sk_buff *msg,
 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
 					   cb->extack);
 		mutex_unlock(&devlink->lock);
-		if (err && err != -EOPNOTSUPP)
+		if (err == -EOPNOTSUPP)
+			err = 0;
+		else if (err)
 			break;
 		idx++;
 	}
commit 65550098c1c4db528400c73acf3e46bfa78d9264
Author: David Howells <dhowells at redhat.com>
Date:   Wed Jul 29 00:03:56 2020 +0100

    rxrpc: Fix race between recvmsg and sendmsg on immediate call failure
    
    There's a race between rxrpc_sendmsg setting up a call, but then failing to
    send anything on it due to an error, and recvmsg() seeing the call
    completion occur and trying to return the state to the user.
    
    An assertion fails in rxrpc_recvmsg() because the call has already been
    released from the socket and is about to be released again as recvmsg deals
    with it.  (The recvmsg_q queue on the socket holds a ref, so there's no
    problem with use-after-free.)
    
    We also have to be careful not to end up reporting an error twice, in such
    a way that both returns indicate to userspace that the user ID supplied
    with the call is no longer in use - which could cause the client to
    malfunction if it recycles the user ID fast enough.
    
    Fix this by the following means:
    
     (1) When sendmsg() creates a call after the point that the call has been
         successfully added to the socket, don't return any errors through
         sendmsg(), but rather complete the call and let recvmsg() retrieve
         them.  Make sendmsg() return 0 at this point.  Further calls to
         sendmsg() for that call will fail with ESHUTDOWN.
    
         Note that at this point, we haven't send any packets yet, so the
         server doesn't yet know about the call.
    
     (2) If sendmsg() returns an error when it was expected to create a new
         call, it means that the user ID wasn't used.
    
     (3) Mark the call disconnected before marking it completed to prevent an
         oops in rxrpc_release_call().
    
     (4) recvmsg() will then retrieve the error and set MSG_EOR to indicate
         that the user ID is no longer known by the kernel.
    
    An oops like the following is produced:
    
            kernel BUG at net/rxrpc/recvmsg.c:605!
            ...
            RIP: 0010:rxrpc_recvmsg+0x256/0x5ae
            ...
            Call Trace:
             ? __init_waitqueue_head+0x2f/0x2f
             ____sys_recvmsg+0x8a/0x148
             ? import_iovec+0x69/0x9c
             ? copy_msghdr_from_user+0x5c/0x86
             ___sys_recvmsg+0x72/0xaa
             ? __fget_files+0x22/0x57
             ? __fget_light+0x46/0x51
             ? fdget+0x9/0x1b
             do_recvmmsg+0x15e/0x232
             ? _raw_spin_unlock+0xa/0xb
             ? vtime_delta+0xf/0x25
             __x64_sys_recvmmsg+0x2c/0x2f
             do_syscall_64+0x4c/0x78
             entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 357f5ef64628 ("rxrpc: Call rxrpc_release_call() on error in rxrpc_new_client_call()")
    Reported-by: syzbot+b54969381df354936d96 at syzkaller.appspotmail.com
    Signed-off-by: David Howells <dhowells at redhat.com>
    Reviewed-by: Marc Dionne <marc.dionne at auristor.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index f07970207b54..38a46167523f 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -288,7 +288,7 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
 	 */
 	ret = rxrpc_connect_call(rx, call, cp, srx, gfp);
 	if (ret < 0)
-		goto error;
+		goto error_attached_to_socket;
 
 	trace_rxrpc_call(call->debug_id, rxrpc_call_connected,
 			 atomic_read(&call->usage), here, NULL);
@@ -308,18 +308,29 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
 error_dup_user_ID:
 	write_unlock(&rx->call_lock);
 	release_sock(&rx->sk);
-	ret = -EEXIST;
-
-error:
 	__rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
-				    RX_CALL_DEAD, ret);
+				    RX_CALL_DEAD, -EEXIST);
 	trace_rxrpc_call(call->debug_id, rxrpc_call_error,
-			 atomic_read(&call->usage), here, ERR_PTR(ret));
+			 atomic_read(&call->usage), here, ERR_PTR(-EEXIST));
 	rxrpc_release_call(rx, call);
 	mutex_unlock(&call->user_mutex);
 	rxrpc_put_call(call, rxrpc_call_put);
-	_leave(" = %d", ret);
-	return ERR_PTR(ret);
+	_leave(" = -EEXIST");
+	return ERR_PTR(-EEXIST);
+
+	/* We got an error, but the call is attached to the socket and is in
+	 * need of release.  However, we might now race with recvmsg() when
+	 * completing the call queues it.  Return 0 from sys_sendmsg() and
+	 * leave the error to recvmsg() to deal with.
+	 */
+error_attached_to_socket:
+	trace_rxrpc_call(call->debug_id, rxrpc_call_error,
+			 atomic_read(&call->usage), here, ERR_PTR(ret));
+	set_bit(RXRPC_CALL_DISCONNECTED, &call->flags);
+	__rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
+				    RX_CALL_DEAD, ret);
+	_leave(" = c=%08x [err]", call->debug_id);
+	return call;
 }
 
 /*
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 19e141eeed17..8cbe0bf20ed5 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -212,9 +212,11 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)
 
 	call->peer->cong_cwnd = call->cong_cwnd;
 
-	spin_lock_bh(&conn->params.peer->lock);
-	hlist_del_rcu(&call->error_link);
-	spin_unlock_bh(&conn->params.peer->lock);
+	if (!hlist_unhashed(&call->error_link)) {
+		spin_lock_bh(&call->peer->lock);
+		hlist_del_rcu(&call->error_link);
+		spin_unlock_bh(&call->peer->lock);
+	}
 
 	if (rxrpc_is_client_call(call))
 		return rxrpc_disconnect_client_call(call);
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 490b1927215c..efecc5a8f67d 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -620,7 +620,7 @@ try_again:
 			goto error_unlock_call;
 	}
 
-	if (msg->msg_name) {
+	if (msg->msg_name && call->peer) {
 		struct sockaddr_rxrpc *srx = msg->msg_name;
 		size_t len = sizeof(call->peer->srx);
 
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 03a30d014bb6..f3f6da6e4ad2 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -681,6 +681,9 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
 		if (IS_ERR(call))
 			return PTR_ERR(call);
 		/* ... and we have the call lock. */
+		ret = 0;
+		if (READ_ONCE(call->state) == RXRPC_CALL_COMPLETE)
+			goto out_put_unlock;
 	} else {
 		switch (READ_ONCE(call->state)) {
 		case RXRPC_CALL_UNINITIALISED:
commit 591eee6d0783d4a0d7f0e7c4effdba9cf6c1e2c5
Author: Joyce Ooi <joyce.ooi at intel.com>
Date:   Mon Jul 27 17:46:41 2020 +0800

    MAINTAINERS: Replace Thor Thayer as Altera Triple Speed Ethernet maintainer
    
    This patch is to replace Thor Thayer as Altera Triple Speed Ethernet
    maintainer as he is moving to a different role.
    
    Signed-off-by: Joyce Ooi <joyce.ooi at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/MAINTAINERS b/MAINTAINERS
index f0569cf304ca..9fb232860d9c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -782,7 +782,7 @@ F:	include/dt-bindings/reset/altr,rst-mgr-a10sr.h
 F:	include/linux/mfd/altera-a10sr.h
 
 ALTERA TRIPLE SPEED ETHERNET DRIVER
-M:	Thor Thayer <thor.thayer at linux.intel.com>
+M:	Joyce Ooi <joyce.ooi at intel.com>
 L:	netdev at vger.kernel.org
 S:	Maintained
 F:	drivers/net/ethernet/altera/
commit 4bbca662df2523ff7ad3224463f1f28e6a118044
Author: Hangbin Liu <liuhangbin at gmail.com>
Date:   Mon Jul 27 19:04:55 2020 +0800

    selftests/bpf: fix netdevsim trap_flow_action_cookie read
    
    When read netdevsim trap_flow_action_cookie, we need to init it first,
    or we will get "Invalid argument" error.
    
    Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata")
    Signed-off-by: Hangbin Liu <liuhangbin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 8294ae3ffb3c..43c9cda199b8 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -318,6 +318,9 @@ class DebugfsDir:
                 continue
 
             if os.path.isfile(p):
+                # We need to init trap_flow_action_cookie before read it
+                if f == "trap_flow_action_cookie":
+                    cmd('echo deadbeef > %s/%s' % (path, f))
                 _, out = cmd('cat %s/%s' % (path, f))
                 dfs[f] = out.strip()
             elif os.path.isdir(p):
commit 8c0de6e96c9794cb523a516c465991a70245da1c
Author: Cong Wang <xiyou.wangcong at gmail.com>
Date:   Sat Jul 25 15:40:53 2020 -0700

    ipv6: fix memory leaks on IPV6_ADDRFORM path
    
    IPV6_ADDRFORM causes resource leaks when converting an IPv6 socket
    to IPv4, particularly struct ipv6_ac_socklist. Similar to
    struct ipv6_mc_socklist, we should just close it on this path.
    
    This bug can be easily reproduced with the following C program:
    
      #include <stdio.h>
      #include <string.h>
      #include <sys/types.h>
      #include <sys/socket.h>
      #include <arpa/inet.h>
    
      int main()
      {
        int s, value;
        struct sockaddr_in6 addr;
        struct ipv6_mreq m6;
    
        s = socket(AF_INET6, SOCK_DGRAM, 0);
        addr.sin6_family = AF_INET6;
        addr.sin6_port = htons(5000);
        inet_pton(AF_INET6, "::ffff:192.168.122.194", &addr.sin6_addr);
        connect(s, (struct sockaddr *)&addr, sizeof(addr));
    
        inet_pton(AF_INET6, "fe80::AAAA", &m6.ipv6mr_multiaddr);
        m6.ipv6mr_interface = 5;
        setsockopt(s, SOL_IPV6, IPV6_JOIN_ANYCAST, &m6, sizeof(m6));
    
        value = AF_INET;
        setsockopt(s, SOL_IPV6, IPV6_ADDRFORM, &value, sizeof(value));
    
        close(s);
        return 0;
      }
    
    Reported-by: ch3332xr at gmail.com
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index fdb07105384c..8418b7d38468 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -274,6 +274,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex,
 		      const struct in6_addr *addr);
 int ipv6_sock_ac_drop(struct sock *sk, int ifindex,
 		      const struct in6_addr *addr);
+void __ipv6_sock_ac_close(struct sock *sk);
 void ipv6_sock_ac_close(struct sock *sk);
 
 int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 893261230ffc..dacdea7fcb62 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -183,7 +183,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 	return 0;
 }
 
-void ipv6_sock_ac_close(struct sock *sk)
+void __ipv6_sock_ac_close(struct sock *sk)
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct net_device *dev = NULL;
@@ -191,10 +191,7 @@ void ipv6_sock_ac_close(struct sock *sk)
 	struct net *net = sock_net(sk);
 	int	prev_index;
 
-	if (!np->ipv6_ac_list)
-		return;
-
-	rtnl_lock();
+	ASSERT_RTNL();
 	pac = np->ipv6_ac_list;
 	np->ipv6_ac_list = NULL;
 
@@ -211,6 +208,16 @@ void ipv6_sock_ac_close(struct sock *sk)
 		sock_kfree_s(sk, pac, sizeof(*pac));
 		pac = next;
 	}
+}
+
+void ipv6_sock_ac_close(struct sock *sk)
+{
+	struct ipv6_pinfo *np = inet6_sk(sk);
+
+	if (!np->ipv6_ac_list)
+		return;
+	rtnl_lock();
+	__ipv6_sock_ac_close(sk);
 	rtnl_unlock();
 }
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 20576e87a5f7..76f9e41859a2 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -240,6 +240,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 
 			fl6_free_socklist(sk);
 			__ipv6_sock_mc_close(sk);
+			__ipv6_sock_ac_close(sk);
 
 			/*
 			 * Sock is moving from IPv6 to IPv4 (sk_prot), so
commit 4f010246b4087ab931b060481014ec110e6a8a46
Author: Christoph Hellwig <hch at lst.de>
Date:   Thu Jul 30 18:09:00 2020 +0200

    net/bpfilter: Initialize pos in __bpfilter_process_sockopt
    
    __bpfilter_process_sockopt never initialized the pos variable passed
    to the pipe write. This has been mostly harmless in the past as pipes
    ignore the offset, but the switch to kernel_write now verified the
    position, which can lead to a failure depending on the exact stack
    initialization pattern. Initialize the variable to zero to make
    rw_verify_area happy.
    
    Fixes: 6955a76fbcd5 ("bpfilter: switch to kernel_write")
    Reported-by: Christian Brauner <christian.brauner at ubuntu.com>
    Reported-by: Rodrigo Madera <rodrigo.madera at gmail.com>
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Tested-by: Rodrigo Madera <rodrigo.madera at gmail.com>
    Tested-by: Christian Brauner <christian.brauner at ubuntu.com>
    Reviewed-by: Christian Brauner <christian.brauner at ubuntu.com>
    Link: https://lore.kernel.org/bpf/20200730160900.187157-1-hch@lst.de

diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
index c0f0990f30b6..cfb27166bfd7 100644
--- a/net/bpfilter/bpfilter_kern.c
+++ b/net/bpfilter/bpfilter_kern.c
@@ -39,7 +39,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
 {
 	struct mbox_request req;
 	struct mbox_reply reply;
-	loff_t pos;
+	loff_t pos = 0;
 	ssize_t n;
 	int ret = -EFAULT;
 
commit d741dcae5562259841bd2211a0bd7e6c0f909f1e
Merge: 5e105c88ab48 b757b47a2fcb
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Jul 30 18:10:26 2020 -0400

    Merge tag 'kvmarm-fixes-5.8-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master
    
    KVM/arm64 fixes for Linux 5.8, take #3
    
    - Fix a corner case of a new mapping inheriting exec permission without
      and yet bypassing invalidation of the I-cache
    - Make sure PtrAuth predicates oinly generate inline code for the
      non-VHE hypervisor code

commit a2ec905d1e160a33b2e210e45ad30445ef26ce0e
Author: Alain Michaud <alainm at chromium.org>
Date:   Mon Jul 27 20:48:55 2020 +0000

    Bluetooth: fix kernel oops in store_pending_adv_report
    
    Fix kernel oops observed when an ext adv data is larger than 31 bytes.
    
    This can be reproduced by setting up an advertiser with advertisement
    larger than 31 bytes.  The issue is not sensitive to the advertisement
    content.  In particular, this was reproduced with an advertisement of
    229 bytes filled with 'A'.  See stack trace below.
    
    This is fixed by not catching ext_adv as legacy adv are only cached to
    be able to concatenate a scanable adv with its scan response before
    sending it up through mgmt.
    
    With ext_adv, this is no longer necessary.
    
      general protection fault: 0000 [#1] SMP PTI
      CPU: 6 PID: 205 Comm: kworker/u17:0 Not tainted 5.4.0-37-generic #41-Ubuntu
      Hardware name: Dell Inc. XPS 15 7590/0CF6RR, BIOS 1.7.0 05/11/2020
      Workqueue: hci0 hci_rx_work [bluetooth]
      RIP: 0010:hci_bdaddr_list_lookup+0x1e/0x40 [bluetooth]
      Code: ff ff e9 26 ff ff ff 0f 1f 44 00 00 0f 1f 44 00 00 55 48 8b 07 48 89 e5 48 39 c7 75 0a eb 24 48 8b 00 48 39 f8 74 1c 44 8b 06 <44> 39 40 10 75 ef 44 0f b7 4e 04 66 44 39 48 14 75 e3 38 50 16 75
      RSP: 0018:ffffbc6a40493c70 EFLAGS: 00010286
      RAX: 4141414141414141 RBX: 000000000000001b RCX: 0000000000000000
      RDX: 0000000000000000 RSI: ffff9903e76c100f RDI: ffff9904289d4b28
      RBP: ffffbc6a40493c70 R08: 0000000093570362 R09: 0000000000000000
      R10: 0000000000000000 R11: ffff9904344eae38 R12: ffff9904289d4000
      R13: 0000000000000000 R14: 00000000ffffffa3 R15: ffff9903e76c100f
      FS: 0000000000000000(0000) GS:ffff990434580000(0000) knlGS:0000000000000000
      CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007feed125a000 CR3: 00000001b860a003 CR4: 00000000003606e0
      Call Trace:
        process_adv_report+0x12e/0x560 [bluetooth]
        hci_le_meta_evt+0x7b2/0xba0 [bluetooth]
        hci_event_packet+0x1c29/0x2a90 [bluetooth]
        hci_rx_work+0x19b/0x360 [bluetooth]
        process_one_work+0x1eb/0x3b0
        worker_thread+0x4d/0x400
        kthread+0x104/0x140
    
    Fixes: c215e9397b00 ("Bluetooth: Process extended ADV report event")
    Reported-by: Andy Nguyen <theflow at google.com>
    Reported-by: Linus Torvalds <torvalds at linux-foundation.org>
    Reported-by: Balakrishna Godavarthi <bgodavar at codeaurora.org>
    Signed-off-by: Alain Michaud <alainm at chromium.org>
    Tested-by: Sonny Sasaka <sonnysasaka at chromium.org>
    Acked-by: Marcel Holtmann <marcel at holtmann.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index cfeaee347db3..af9d7f2ff8ba 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1338,6 +1338,9 @@ static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
 	struct discovery_state *d = &hdev->discovery;
 
+	if (len > HCI_MAX_AD_LENGTH)
+		return;
+
 	bacpy(&d->last_adv_addr, bdaddr);
 	d->last_adv_addr_type = bdaddr_type;
 	d->last_adv_rssi = rssi;
@@ -5355,7 +5358,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
 
 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 			       u8 bdaddr_type, bdaddr_t *direct_addr,
-			       u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
+			       u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
+			       bool ext_adv)
 {
 	struct discovery_state *d = &hdev->discovery;
 	struct smp_irk *irk;
@@ -5377,6 +5381,11 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 		return;
 	}
 
+	if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
+		bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
+		return;
+	}
+
 	/* Find the end of the data in case the report contains padded zero
 	 * bytes at the end causing an invalid length value.
 	 *
@@ -5437,7 +5446,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 	 */
 	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
 								direct_addr);
-	if (conn && type == LE_ADV_IND) {
+	if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
 		/* Store report for later inclusion by
 		 * mgmt_device_connected
 		 */
@@ -5491,7 +5500,7 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 	 * event or send an immediate device found event if the data
 	 * should not be stored for later.
 	 */
-	if (!has_pending_adv_report(hdev)) {
+	if (!ext_adv &&	!has_pending_adv_report(hdev)) {
 		/* If the report will trigger a SCAN_REQ store it for
 		 * later merging.
 		 */
@@ -5526,7 +5535,8 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
 		/* If the new report will trigger a SCAN_REQ store it for
 		 * later merging.
 		 */
-		if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+		if (!ext_adv && (type == LE_ADV_IND ||
+				 type == LE_ADV_SCAN_IND)) {
 			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
 						 rssi, flags, data, len);
 			return;
@@ -5566,7 +5576,7 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 			rssi = ev->data[ev->length];
 			process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 					   ev->bdaddr_type, NULL, 0, rssi,
-					   ev->data, ev->length);
+					   ev->data, ev->length, false);
 		} else {
 			bt_dev_err(hdev, "Dropping invalid advertising data");
 		}
@@ -5638,7 +5648,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 		if (legacy_evt_type != LE_ADV_INVALID) {
 			process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
 					   ev->bdaddr_type, NULL, 0, ev->rssi,
-					   ev->data, ev->length);
+					   ev->data, ev->length,
+					   !(evt_type & LE_EXT_ADV_LEGACY_PDU));
 		}
 
 		ptr += sizeof(*ev) + ev->length;
@@ -5836,7 +5847,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
 
 		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
 				   ev->bdaddr_type, &ev->direct_addr,
-				   ev->direct_addr_type, ev->rssi, NULL, 0);
+				   ev->direct_addr_type, ev->rssi, NULL, 0,
+				   false);
 
 		ptr += sizeof(*ev);
 	}
commit 417385c47ef7ee0d4f48f63f70cca6c1ed6355f4
Merge: aa54ea903abb a96b0d061d47
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 30 13:34:07 2020 -0700

    Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
    
    Pull virtio fixes from Michael Tsirkin:
     "A couple of last minute bugfixes"
    
    * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
      virtio-mem: Fix build error due to improper use 'select'
      virtio_balloon: fix up endian-ness for free cmd id
      virtio-balloon: Document byte ordering of poison_val
      vhost/scsi: fix up req type endian-ness
      firmware: Fix a reference count leak.

commit aa54ea903abb02303bf55855fb51e3fcee135d70
Author: Grygorii Strashko <grygorii.strashko at ti.com>
Date:   Thu Jul 30 22:05:01 2020 +0300

    ARM: percpu.h: fix build error
    
    Fix build error for the case:
      defined(CONFIG_SMP) && !defined(CONFIG_CPU_V6)
    
    config: keystone_defconfig
    
      CC      arch/arm/kernel/signal.o
      In file included from ../include/linux/random.h:14,
                        from ../arch/arm/kernel/signal.c:8:
      ../arch/arm/include/asm/percpu.h: In function ‘__my_cpu_offset’:
      ../arch/arm/include/asm/percpu.h:29:34: error: ‘current_stack_pointer’ undeclared (first use in this function); did you mean ‘user_stack_pointer’?
          : "Q" (*(const unsigned long *)current_stack_pointer));
                                         ^~~~~~~~~~~~~~~~~~~~~
                                         user_stack_pointer
    
    Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
    Signed-off-by: Grygorii Strashko <grygorii.strashko at ti.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/arch/arm/include/asm/percpu.h b/arch/arm/include/asm/percpu.h
index f44f448537f2..1a3eedbac4a2 100644
--- a/arch/arm/include/asm/percpu.h
+++ b/arch/arm/include/asm/percpu.h
@@ -5,6 +5,8 @@
 #ifndef _ASM_ARM_PERCPU_H_
 #define _ASM_ARM_PERCPU_H_
 
+#include <asm/thread_info.h>
+
 /*
  * Same as asm-generic/percpu.h, except that we store the per cpu offset
  * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7
commit d9644712a243ac47af4fe9cf65472d85c57753c7
Merge: e2c46b5762c6 b361663c5a40
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 30 12:01:42 2020 -0700

    Merge tag 'pci-v5.8-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci
    
    Pull PCI fix from Bjorn Helgaas:
     "Disable ASPM on ASM1083/1085 PCIe-to-PCI bridge (Robert Hancock)"
    
    * tag 'pci-v5.8-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
      PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge

commit 024a8168b749db7a4aa40a5fbdfa04bf7e77c1c0
Author: Francesco Ruggeri <fruggeri at arista.com>
Date:   Thu Jul 2 15:39:06 2020 -0700

    igb: reinit_locked() should be called with rtnl_lock
    
    We observed two panics involving races with igb_reset_task.
    The first panic is caused by this race condition:
    
            kworker                 reboot -f
    
            igb_reset_task
            igb_reinit_locked
            igb_down
            napi_synchronize
                                    __igb_shutdown
                                    igb_clear_interrupt_scheme
                                    igb_free_q_vectors
                                    igb_free_q_vector
                                    adapter->q_vector[v_idx] = NULL;
            napi_disable
            Panics trying to access
            adapter->q_vector[v_idx].napi_state
    
    The second panic (a divide error) is caused by this race:
    
    kworker         reboot -f       tx packet
    
    igb_reset_task
                    __igb_shutdown
                    rtnl_lock()
                    ...
                    igb_clear_interrupt_scheme
                    igb_free_q_vectors
                    adapter->num_tx_queues = 0
                    ...
                    rtnl_unlock()
    rtnl_lock()
    igb_reinit_locked
    igb_down
    igb_up
    netif_tx_start_all_queues
                                    dev_hard_start_xmit
                                    igb_xmit_frame
                                    igb_tx_queue_mapping
                                    Panics on
                                    r_idx % adapter->num_tx_queues
    
    This commit applies to igb_reset_task the same changes that
    were applied to ixgbe in commit 2f90b8657ec9 ("ixgbe: this patch
    adds support for DCB to the kernel and ixgbe driver"),
    commit 8f4c5c9fb87a ("ixgbe: reinit_locked() should be called with
    rtnl_lock") and commit 88adce4ea8f9 ("ixgbe: fix possible race in
    reset subtask").
    
    Signed-off-by: Francesco Ruggeri <fruggeri at arista.com>
    Tested-by: Aaron Brown <aaron.f.brown at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 8bb3db2cbd41..6e5861bfb0fa 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6224,9 +6224,18 @@ static void igb_reset_task(struct work_struct *work)
 	struct igb_adapter *adapter;
 	adapter = container_of(work, struct igb_adapter, reset_task);
 
+	rtnl_lock();
+	/* If we're already down or resetting, just bail */
+	if (test_bit(__IGB_DOWN, &adapter->state) ||
+	    test_bit(__IGB_RESETTING, &adapter->state)) {
+		rtnl_unlock();
+		return;
+	}
+
 	igb_dump(adapter);
 	netdev_err(adapter->netdev, "Reset adapter\n");
 	igb_reinit_locked(adapter);
+	rtnl_unlock();
 }
 
 /**
commit 1050242fa657093d3788c3ffa0bd9b42e4d7d1ab
Author: Aaron Ma <aaron.ma at canonical.com>
Date:   Thu Jun 18 14:54:53 2020 +0800

    e1000e: continue to init PHY even when failed to disable ULP
    
    After 'commit e086ba2fccda4 ("e1000e: disable s0ix entry and exit flows
     for ME systems")',
    ThinkPad P14s always failed to disable ULP by ME.
    'commit 0c80cdbf3320 ("e1000e: Warn if disabling ULP failed")'
    break out of init phy:
    
    error log:
    [   42.364753] e1000e 0000:00:1f.6 enp0s31f6: Failed to disable ULP
    [   42.524626] e1000e 0000:00:1f.6 enp0s31f6: PHY Wakeup cause - Unicast Packet
    [   42.822476] e1000e 0000:00:1f.6 enp0s31f6: Hardware Error
    
    When disable s0ix, E1000_FWSM_ULP_CFG_DONE will never be 1.
    If continue to init phy like before, it can work as before.
    iperf test result good too.
    
    Fixes: 0c80cdbf3320 ("e1000e: Warn if disabling ULP failed")
    Signed-off-by: Aaron Ma <aaron.ma at canonical.com>
    Tested-by: Aaron Brown <aaron.f.brown at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index f999cca37a8a..489bb5b59475 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -301,10 +301,8 @@ static s32 e1000_init_phy_workarounds_pchlan(struct e1000_hw *hw)
 	 */
 	hw->dev_spec.ich8lan.ulp_state = e1000_ulp_state_unknown;
 	ret_val = e1000_disable_ulp_lpt_lp(hw, true);
-	if (ret_val) {
+	if (ret_val)
 		e_warn("Failed to disable ULP\n");
-		goto out;
-	}
 
 	ret_val = hw->phy.ops.acquire(hw);
 	if (ret_val) {
commit e2c46b5762c616c249201688d3b9846627f78d2c
Merge: 0513b9d75c07 d6364a867ccb
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 30 09:48:51 2020 -0700

    Merge tag 'block-5.8-2020-07-30' of git://git.kernel.dk/linux-block
    
    Pull block fixes from Jens Axboe:
     "Three NVMe fixes"
    
    * tag 'block-5.8-2020-07-30' of git://git.kernel.dk/linux-block:
      nvme: add a Identify Namespace Identification Descriptor list quirk
      nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
      nvme-tcp: fix possible hang waiting for icresp response

commit 0513b9d75c07cbcdfda3778b636d3d131d679eb1
Merge: 1c9df907da83 4ae6dbd68386
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 30 09:47:07 2020 -0700

    Merge tag 'io_uring-5.8-2020-07-30' of git://git.kernel.dk/linux-block
    
    Pull io_uring fixes from Jens Axboe:
     "Two small fixes for corner/error cases"
    
    * tag 'io_uring-5.8-2020-07-30' of git://git.kernel.dk/linux-block:
      io_uring: fix lockup in io_fail_links()
      io_uring: fix ->work corruption with poll_add

commit 1c9df907da83812e4f33b59d3d142c864d9da57f
Author: Willy Tarreau <w at 1wt.eu>
Date:   Thu Jul 30 07:59:24 2020 +0200

    random: fix circular include dependency on arm64 after addition of percpu.h
    
    Daniel Díaz and Kees Cook independently reported that commit
    f227e3ec3b5c ("random32: update the net random state on interrupt and
    activity") broke arm64 due to a circular dependency on include files
    since the addition of percpu.h in random.h.
    
    The correct fix would definitely be to move all the prandom32 stuff out
    of random.h but for backporting, a smaller solution is preferred.
    
    This one replaces linux/percpu.h with asm/percpu.h, and this fixes the
    problem on x86_64, arm64, arm, and mips.  Note that moving percpu.h
    around didn't change anything and that removing it entirely broke
    differently.  When backporting, such options might still be considered
    if this patch fails to help.
    
    [ It turns out that an alternate fix seems to be to just remove the
      troublesome <asm/pointer_auth.h> remove from the arm64 <asm/smp.h>
      that causes the circular dependency.
    
      But we might as well do the whole belt-and-suspenders thing, and
      minimize inclusion in <linux/random.h> too. Either will fix the
      problem, and both are good changes.   - Linus ]
    
    Reported-by: Daniel Díaz <daniel.diaz at linaro.org>
    Reported-by: Kees Cook <keescook at chromium.org>
    Tested-by: Marc Zyngier <maz at kernel.org>
    Fixes: f227e3ec3b5c
    Cc: Stephen Rothwell <sfr at canb.auug.org.au>
    Signed-off-by: Willy Tarreau <w at 1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/random.h b/include/linux/random.h
index f310897f051d..9ab7443bd91b 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -11,7 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/once.h>
-#include <linux/percpu.h>
+#include <asm/percpu.h>
 
 #include <uapi/linux/random.h>
 
commit 6a7389f0312f01bb6641d37b395548a2922a057c
Author: John Garry <john.garry at huawei.com>
Date:   Wed Jun 17 19:17:28 2020 +0800

    MAINTAINERS: Include drivers subdirs for ARM PMU PROFILING AND DEBUGGING entry
    
    Ensure that the ARM PMU PROFILING AND DEBUGGING maintainers are included
    for the HiSilicon PMU driver.
    
    Signed-off-by: John Garry <john.garry at huawei.com>
    Link: https://lore.kernel.org/r/1592392648-128331-1-git-send-email-john.garry@huawei.com
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index 68f21d46614c..24f377f1d76c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1425,7 +1425,7 @@ F:	arch/arm*/include/asm/perf_event.h
 F:	arch/arm*/kernel/hw_breakpoint.c
 F:	arch/arm*/kernel/perf_*
 F:	arch/arm/oprofile/common.c
-F:	drivers/perf/*
+F:	drivers/perf/
 F:	include/linux/perf/arm_pmu.h
 
 ARM PORT
commit 05fb3dbda187bbd9cc1cd0e97e5d6595af570ac6
Author: Robin Murphy <robin.murphy at arm.com>
Date:   Thu Jul 30 10:56:49 2020 +0100

    arm64: csum: Fix handling of bad packets
    
    Although iph is expected to point to at least 20 bytes of valid memory,
    ihl may be bogus, for example on reception of a corrupt packet. If it
    happens to be less than 5, we really don't want to run away and
    dereference 16GB worth of memory until it wraps back to exactly zero...
    
    Fixes: 0e455d8e80aa ("arm64: Implement optimised IP checksum helpers")
    Reported-by: guodeqing <geffrey.guo at huawei.com>
    Signed-off-by: Robin Murphy <robin.murphy at arm.com>
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/arch/arm64/include/asm/checksum.h b/arch/arm64/include/asm/checksum.h
index b6f7bc6da5fb..93a161b3bf3f 100644
--- a/arch/arm64/include/asm/checksum.h
+++ b/arch/arm64/include/asm/checksum.h
@@ -24,16 +24,17 @@ static inline __sum16 ip_fast_csum(const void *iph, unsigned int ihl)
 {
 	__uint128_t tmp;
 	u64 sum;
+	int n = ihl; /* we want it signed */
 
 	tmp = *(const __uint128_t *)iph;
 	iph += 16;
-	ihl -= 4;
+	n -= 4;
 	tmp += ((tmp >> 64) | (tmp << 64));
 	sum = tmp >> 64;
 	do {
 		sum += *(const u32 *)iph;
 		iph += 4;
-	} while (--ihl);
+	} while (--n > 0);
 
 	sum += ((sum >> 32) | (sum << 32));
 	return csum_fold((__force u32)(sum >> 32));
commit 835d1c3a98799914db8aee0973018af21128cd1e
Author: Marc Zyngier <maz at kernel.org>
Date:   Thu Jul 30 10:53:05 2020 +0100

    arm64: Drop unnecessary include from asm/smp.h
    
    asm/pointer_auth.h is not needed anymore in asm/smp.h, as 62a679cb2825
    ("arm64: simplify ptrauth initialization") removed the keys from the
    secondary_data structure.
    
    This also cures a compilation issue introduced by f227e3ec3b5c
    ("random32: update the net random state on interrupt and activity").
    
    Fixes: 62a679cb2825 ("arm64: simplify ptrauth initialization")
    Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity")
    Acked-by: Catalin Marinas <catalin.marinas at arm.com>
    Signed-off-by: Marc Zyngier <maz at kernel.org>
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h
index ea268d88b6f7..a0c8a0b65259 100644
--- a/arch/arm64/include/asm/smp.h
+++ b/arch/arm64/include/asm/smp.h
@@ -30,7 +30,6 @@
 #include <linux/threads.h>
 #include <linux/cpumask.h>
 #include <linux/thread_info.h>
-#include <asm/pointer_auth.h>
 
 DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number);
 
commit 966a0acce2fca776391823381dba95c40e03c339
Author: Sami Tolvanen <samitolvanen at google.com>
Date:   Thu Jul 30 08:37:01 2020 -0700

    arm64/alternatives: move length validation inside the subsection
    
    Commit f7b93d42945c ("arm64/alternatives: use subsections for replacement
    sequences") breaks LLVM's integrated assembler, because due to its
    one-pass design, it cannot compute instruction sequence lengths before the
    layout for the subsection has been finalized. This change fixes the build
    by moving the .org directives inside the subsection, so they are processed
    after the subsection layout is known.
    
    Fixes: f7b93d42945c ("arm64/alternatives: use subsections for replacement sequences")
    Signed-off-by: Sami Tolvanen <samitolvanen at google.com>
    Link: https://github.com/ClangBuiltLinux/linux/issues/1078
    Link: https://lore.kernel.org/r/20200730153701.3892953-1-samitolvanen@google.com
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
index 12f0eb56a1cc..619db9b4c9d5 100644
--- a/arch/arm64/include/asm/alternative.h
+++ b/arch/arm64/include/asm/alternative.h
@@ -77,9 +77,9 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
 	"663:\n\t"							\
 	newinstr "\n"							\
 	"664:\n\t"							\
-	".previous\n\t"							\
 	".org	. - (664b-663b) + (662b-661b)\n\t"			\
-	".org	. - (662b-661b) + (664b-663b)\n"			\
+	".org	. - (662b-661b) + (664b-663b)\n\t"			\
+	".previous\n"							\
 	".endif\n"
 
 #define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb)	\
commit a96b0d061d476093cf86ca1c2de06fc57163588d
Author: Weilong Chen <chenweilong at huawei.com>
Date:   Fri Jun 19 16:03:33 2020 +0800

    virtio-mem: Fix build error due to improper use 'select'
    
    As noted in:
    https://www.kernel.org/doc/Documentation/kbuild/kconfig-language.txt
    "select should be used with care. select will force a symbol to a
    value without visiting the dependencies."
    Config VIRTIO_MEM should not select CONTIG_ALLOC directly.
    Otherwise it will cause an error:
    https://bugzilla.kernel.org/show_bug.cgi?id=208245
    
    Signed-off-by: Weilong Chen <chenweilong at huawei.com>
    Link: https://lore.kernel.org/r/20200619080333.194753-1-chenweilong@huawei.com
    Acked-by: Randy Dunlap <rdunlap at infradead.org> # build-tested
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Acked-by: David Hildenbrand <david at redhat.com>

diff --git a/drivers/virtio/Kconfig b/drivers/virtio/Kconfig
index 5809e5f5b157..5c92e4a50882 100644
--- a/drivers/virtio/Kconfig
+++ b/drivers/virtio/Kconfig
@@ -85,7 +85,7 @@ config VIRTIO_MEM
 	depends on VIRTIO
 	depends on MEMORY_HOTPLUG_SPARSE
 	depends on MEMORY_HOTREMOVE
-	select CONTIG_ALLOC
+	depends on CONTIG_ALLOC
 	help
 	 This driver provides access to virtio-mem paravirtualized memory
 	 devices, allowing to hotplug and hotunplug memory.
commit 87004abfbc27261edd15716515d89ab42198b405
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Thu Jul 30 11:02:30 2020 -0400

    Revert "drm/amdgpu: Fix NULL dereference in dpm sysfs handlers"
    
    This regressed some working configurations so revert it.  Will
    fix this properly for 5.9 and backport then.
    
    This reverts commit 38e0c89a19fd13f28d2b4721035160a3e66e270b.
    
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index ebb8a28ff002..02e6f8c4dde0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -778,7 +778,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
 		tmp_str++;
 	while (isspace(*++tmp_str));
 
-	while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+	while (tmp_str[0]) {
+		sub_str = strsep(&tmp_str, delimiter);
 		ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
 		if (ret)
 			return -EINVAL;
@@ -1038,7 +1039,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
 	memcpy(buf_cpy, buf, bytes);
 	buf_cpy[bytes] = '\0';
 	tmp = buf_cpy;
-	while ((sub_str = strsep(&tmp, delimiter)) != NULL) {
+	while (tmp[0]) {
+		sub_str = strsep(&tmp, delimiter);
 		if (strlen(sub_str)) {
 			ret = kstrtol(sub_str, 0, &level);
 			if (ret)
@@ -1635,7 +1637,8 @@ static ssize_t amdgpu_set_pp_power_profile_mode(struct device *dev,
 			i++;
 		memcpy(buf_cpy, buf, count-i);
 		tmp_str = buf_cpy;
-		while ((sub_str = strsep(&tmp_str, delimiter)) != NULL) {
+		while (tmp_str[0]) {
+			sub_str = strsep(&tmp_str, delimiter);
 			ret = kstrtol(sub_str, 0, &parameter[parameter_size]);
 			if (ret)
 				return -EINVAL;
commit fde9f39ac7f1ffd799a96ffa1e06b2051f0898f1
Author: Mazin Rezk <mnrzk at protonmail.com>
Date:   Mon Jul 27 05:40:46 2020 +0000

    drm/amd/display: Clear dm_state for fast updates
    
    This patch fixes a race condition that causes a use-after-free during
    amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking commits
    are requested and the second one finishes before the first. Essentially,
    this bug occurs when the following sequence of events happens:
    
    1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
    deferred to the workqueue.
    
    2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
    deferred to the workqueue.
    
    3. Commit #2 starts before commit #1, dm_state #1 is used in the
    commit_tail and commit #2 completes, freeing dm_state #1.
    
    4. Commit #1 starts after commit #2 completes, uses the freed dm_state
    1 and dereferences a freelist pointer while setting the context.
    
    Since this bug has only been spotted with fast commits, this patch fixes
    the bug by clearing the dm_state instead of using the old dc_state for
    fast updates. In addition, since dm_state is only used for its dc_state
    and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is found,
    removing the dm_state should not have any consequences in fast updates.
    
    This use-after-free bug has existed for a while now, but only caused a
    noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub: relocate
    freelist pointer to middle of object") moving the freelist pointer from
    dm_state->base (which was unused) to dm_state->context (which is
    dereferenced).
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
    Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state for fast updates")
    Reported-by: Duncan <1i5t5.duncan at cox.net>
    Signed-off-by: Mazin Rezk <mnrzk at protonmail.com>
    Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 86ffa0c2880f..710edc70e37e 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8717,20 +8717,38 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
 		 * the same resource. If we have a new DC context as part of
 		 * the DM atomic state from validation we need to free it and
 		 * retain the existing one instead.
+		 *
+		 * Furthermore, since the DM atomic state only contains the DC
+		 * context and can safely be annulled, we can free the state
+		 * and clear the associated private object now to free
+		 * some memory and avoid a possible use-after-free later.
 		 */
-		struct dm_atomic_state *new_dm_state, *old_dm_state;
 
-		new_dm_state = dm_atomic_get_new_state(state);
-		old_dm_state = dm_atomic_get_old_state(state);
+		for (i = 0; i < state->num_private_objs; i++) {
+			struct drm_private_obj *obj = state->private_objs[i].ptr;
 
-		if (new_dm_state && old_dm_state) {
-			if (new_dm_state->context)
-				dc_release_state(new_dm_state->context);
+			if (obj->funcs == adev->dm.atomic_obj.funcs) {
+				int j = state->num_private_objs-1;
 
-			new_dm_state->context = old_dm_state->context;
+				dm_atomic_destroy_state(obj,
+						state->private_objs[i].state);
+
+				/* If i is not at the end of the array then the
+				 * last element needs to be moved to where i was
+				 * before the array can safely be truncated.
+				 */
+				if (i != j)
+					state->private_objs[i] =
+						state->private_objs[j];
 
-			if (old_dm_state->context)
-				dc_retain_state(old_dm_state->context);
+				state->private_objs[j].ptr = NULL;
+				state->private_objs[j].state = NULL;
+				state->private_objs[j].old_state = NULL;
+				state->private_objs[j].new_state = NULL;
+
+				state->num_private_objs = j;
+				break;
+			}
 		}
 	}
 
commit 543e8669ed9bfb30545fd52bc0e047ca4df7fb31
Author: Peilin Ye <yepeilin.cs at gmail.com>
Date:   Tue Jul 28 15:29:24 2020 -0400

    drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
    
    Compiler leaves a 4-byte hole near the end of `dev_info`, causing
    amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace
    when `size` is greater than 356.
    
    In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which
    unfortunately does not initialize that 4-byte hole. Fix it by using
    memset() instead.
    
    Cc: stable at vger.kernel.org
    Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()")
    Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
    Suggested-by: Dan Carpenter <dan.carpenter at oracle.com>
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index d7e17e34fee1..21292098bc02 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -692,9 +692,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
 		return n ? -EFAULT : 0;
 	}
 	case AMDGPU_INFO_DEV_INFO: {
-		struct drm_amdgpu_info_device dev_info = {};
+		struct drm_amdgpu_info_device dev_info;
 		uint64_t vm_size;
 
+		memset(&dev_info, 0, sizeof(dev_info));
 		dev_info.device_id = dev->pdev->device;
 		dev_info.chip_rev = adev->rev_id;
 		dev_info.external_rev = adev->external_rev_id;
commit fb448ce87a4a9482b084e67faf804aec79ed9b43
Author: Leon Romanovsky <leonro at mellanox.com>
Date:   Thu Jul 30 11:27:19 2020 +0300

    RDMA/core: Free DIM memory in error unwind
    
    The memory allocated for the DIM wasn't freed in in error unwind path, fix
    it by calling to rdma_dim_destroy().
    
    Fixes: da6629793aa6 ("RDMA/core: Provide RDMA DIM support for ULPs")
    Link: https://lore.kernel.org/r/20200730082719.1582397-4-leon@kernel.org
    Signed-off-by: Leon Romanovsky <leonro at mellanox.com>
    Reviewed-by: Max Gurtovoy <maxg at mellanox.com <mailto:maxg at mellanox.com>>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index 33759b39c3d3..513825e424bf 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -275,6 +275,7 @@ struct ib_cq *__ib_alloc_cq_user(struct ib_device *dev, void *private,
 	return cq;
 
 out_destroy_cq:
+	rdma_dim_destroy(cq);
 	rdma_restrack_del(&cq->res);
 	cq->device->ops.destroy_cq(cq, udata);
 out_free_wc:
commit 5d46b289d04b98eb992b2f8b67745cc0953e16b1
Author: Leon Romanovsky <leonro at mellanox.com>
Date:   Thu Jul 30 11:27:18 2020 +0300

    RDMA/core: Stop DIM before destroying CQ
    
    HW destroy operation should be last operation after all possible CQ users
    completed their work, so move DIM work cancellation before such destroy
    call.
    
    Fixes: da6629793aa6 ("RDMA/core: Provide RDMA DIM support for ULPs")
    Link: https://lore.kernel.org/r/20200730082719.1582397-3-leon@kernel.org
    Reviewed-by: Max Gurtovoy <maxg at mellanox.com>
    Signed-off-by: Leon Romanovsky <leonro at mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index 655795bfa0ee..33759b39c3d3 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -72,6 +72,15 @@ static void rdma_dim_init(struct ib_cq *cq)
 	INIT_WORK(&dim->work, ib_cq_rdma_dim_work);
 }
 
+static void rdma_dim_destroy(struct ib_cq *cq)
+{
+	if (!cq->dim)
+		return;
+
+	cancel_work_sync(&cq->dim->work);
+	kfree(cq->dim);
+}
+
 static int __poll_cq(struct ib_cq *cq, int num_entries, struct ib_wc *wc)
 {
 	int rc;
@@ -331,12 +340,10 @@ void ib_free_cq_user(struct ib_cq *cq, struct ib_udata *udata)
 		WARN_ON_ONCE(1);
 	}
 
+	rdma_dim_destroy(cq);
 	trace_cq_free(cq);
 	rdma_restrack_del(&cq->res);
 	cq->device->ops.destroy_cq(cq, udata);
-	if (cq->dim)
-		cancel_work_sync(&cq->dim->work);
-	kfree(cq->dim);
 	kfree(cq->wc);
 	kfree(cq);
 }
commit 7fa84b5708cf359efe43ce99fd1f3c8765cacd23
Author: Leon Romanovsky <leonro at mellanox.com>
Date:   Thu Jul 30 11:27:17 2020 +0300

    RDMA/mlx5: Initialize QP mutex for the debug kernels
    
    In DCT and RSS RAW QP creation flows, the QP mutex wasn't initialized and
    the magic field inside lock was missing. This caused to the following
    kernel warning for kernels build with CONFIG_DEBUG_MUTEXES.
    
     DEBUG_LOCKS_WARN_ON(lock->magic != lock)
     WARNING: CPU: 3 PID: 16261 at kernel/locking/mutex.c:938 __mutex_lock+0x60e/0x940
     Modules linked in: bonding nf_tables ipip tunnel4 geneve ip6_udp_tunnel udp_tunnel ip6_gre ip6_tunnel tunnel6 ip_gre gre ip_tunnel mlx5_ib mlx5_core mlxfw ptp pps_core rdma_ucm ib_uverbs ib_ipoib ib_umad openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter overlay ib_srp scsi_transport_srp rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core [last unloaded: mlxfw]
     CPU: 3 PID: 16261 Comm: ib_send_bw Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1
     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
     RIP: 0010:__mutex_lock+0x60e/0x940
     Code: c0 0f 84 6d fa ff ff 44 8b 15 4e 9d ba 00 45 85 d2 0f 85 5d fa ff ff 48 c7 c6 f2 de 2b 82 48 c7 c7 f1 8a 2b 82 e8 d2 4d 72 ff <0f> 0b 4c 8b 4d 88 e9 3f fa ff ff f6 c2 04 0f 84 37 fe ff ff 48 89
     RSP: 0018:ffff88810bb8b870 EFLAGS: 00010286
     RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
     RDX: ffff88829f1dd880 RSI: 0000000000000000 RDI: ffffffff81192afa
     RBP: ffff88810bb8b910 R08: 0000000000000000 R09: 0000000000000028
     R10: 0000000000000000 R11: 0000000000003f85 R12: 0000000000000002
     R13: ffff88827d8d3ce0 R14: ffffffffa059f615 R15: ffff8882a4d02610
     FS:  00007f3f6988e740(0000) GS:ffff8882f5b80000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000556556158000 CR3: 000000010a63c005 CR4: 0000000000360ea0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
     Call Trace:
      ? cmd_exec+0x947/0xe60 [mlx5_core]
      ? __mutex_lock+0x76/0x940
      ? mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]
      mlx5_ib_qp_set_counter+0x25/0xa0 [mlx5_ib]
      mlx5_ib_counter_bind_qp+0x9b/0xe0 [mlx5_ib]
      __rdma_counter_bind_qp+0x6b/0xa0 [ib_core]
      rdma_counter_bind_qp_auto+0x363/0x520 [ib_core]
      _ib_modify_qp+0x316/0x580 [ib_core]
      ib_modify_qp_with_udata+0x19/0x30 [ib_core]
      modify_qp+0x4c4/0x600 [ib_uverbs]
      ib_uverbs_ex_modify_qp+0x87/0xe0 [ib_uverbs]
      ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x129/0x1c0 [ib_uverbs]
      ib_uverbs_cmd_verbs.isra.5+0x5d5/0x11f0 [ib_uverbs]
      ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x120/0x120 [ib_uverbs]
      ? lock_acquire+0xb9/0x3a0
      ? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]
      ? ib_uverbs_ioctl+0x175/0x210 [ib_uverbs]
      ib_uverbs_ioctl+0x14b/0x210 [ib_uverbs]
      ? ib_uverbs_ioctl+0xd0/0x210 [ib_uverbs]
      ksys_ioctl+0x234/0x7d0
      ? exc_page_fault+0x202/0x640
      ? do_syscall_64+0x1f/0x2e0
      __x64_sys_ioctl+0x16/0x20
      do_syscall_64+0x59/0x2e0
      ? asm_exc_page_fault+0x8/0x30
      ? rcu_read_lock_sched_held+0x52/0x60
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: b4aaa1f0b415 ("IB/mlx5: Handle type IB_QPT_DRIVER when creating a QP")
    Link: https://lore.kernel.org/r/20200730082719.1582397-2-leon@kernel.org
    Reviewed-by: Maor Gottlieb <maorg at mellanox.com>
    Signed-off-by: Leon Romanovsky <leonro at mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 42620f88e393..1225b8d77510 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1852,8 +1852,6 @@ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
 	u32 *in;
 	int err;
 
-	mutex_init(&qp->mutex);
-
 	if (attr->sq_sig_type == IB_SIGNAL_ALL_WR)
 		qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE;
 
@@ -1937,7 +1935,6 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	u32 *in;
 	int err;
 
-	mutex_init(&qp->mutex);
 	spin_lock_init(&qp->sq.lock);
 	spin_lock_init(&qp->rq.lock);
 
@@ -2128,7 +2125,6 @@ static int create_kernel_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	u32 *in;
 	int err;
 
-	mutex_init(&qp->mutex);
 	spin_lock_init(&qp->sq.lock);
 	spin_lock_init(&qp->rq.lock);
 
@@ -2969,6 +2965,7 @@ struct ib_qp *mlx5_ib_create_qp(struct ib_pd *pd, struct ib_qp_init_attr *attr,
 		goto free_ucmd;
 	}
 
+	mutex_init(&qp->mutex);
 	qp->type = type;
 	if (udata) {
 		err = process_vendor_flags(dev, qp, params.ucmd, attr);
commit c0001213d195d1bac83e0744c06ff06dd5a8ba53
Author: Felix Kuehling <Felix.Kuehling at amd.com>
Date:   Tue Jul 28 14:27:04 2020 -0400

    drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access
    
    VMAs with a pg_offs that's offset from the start of the vma_node need
    to adjust the offset within the BO accordingly. This matches the
    offset calculation in ttm_bo_vm_fault_reserved.
    
    Signed-off-by: Felix Kuehling <Felix.Kuehling at amd.com>
    Tested-by: Laurent Morichetti <laurent.morichetti at amd.com>
    Signed-off-by: Christian König <christian.koenig at amd.com>
    Link: https://patchwork.freedesktop.org/patch/381169/

diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index fa03fab02076..33526c5df0e8 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -505,8 +505,10 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo,
 int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr,
 		     void *buf, int len, int write)
 {
-	unsigned long offset = (addr) - vma->vm_start;
 	struct ttm_buffer_object *bo = vma->vm_private_data;
+	unsigned long offset = (addr) - vma->vm_start +
+		((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node))
+		 << PAGE_SHIFT);
 	int ret;
 
 	if (len < 1 || (offset + len) >> PAGE_SHIFT > bo->num_pages)
commit 04e35caa32ec9aae6b306d07f07dc2ee6d69166c
Author: Felix Fietkau <nbd at nbd.name>
Date:   Sat Jul 25 10:45:33 2020 +0200

    mac80211: remove STA txq pending airtime underflow warning
    
    This warning can trigger if there is a mismatch between frames that were
    sent with the sta pointer set vs tx status frames reported for the sta address.
    
    This can happen due to race conditions on re-creating stations, or even
    in the case of .sta_add/remove being used instead of .sta_state, which can cause
    frames to be sent to a station that has not been uploaded yet.
    
    If there is an actual underflow issue, it should show up in the device airtime
    warning below, so it is better to remove this one.
    
    Signed-off-by: Felix Fietkau <nbd at nbd.name>
    Link: https://lore.kernel.org/r/20200725084533.13829-1-nbd@nbd.name
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index cd8487bc6fc2..af4cc5fb678e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1923,9 +1923,7 @@ void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
 	if (sta) {
 		tx_pending = atomic_sub_return(tx_airtime,
 					       &sta->airtime[ac].aql_tx_pending);
-		if (WARN_ONCE(tx_pending < 0,
-			      "STA %pM AC %d txq pending airtime underflow: %u, %u",
-			      sta->addr, ac, tx_pending, tx_airtime))
+		if (tx_pending < 0)
 			atomic_cmpxchg(&sta->airtime[ac].aql_tx_pending,
 				       tx_pending, 0);
 	}
commit e61fbfca8055eef18f11727f431e1e3e5221291e
Author: Vasanthakumar Thiagarajan <vthiagar at codeaurora.org>
Date:   Wed Jul 22 19:50:17 2020 +0530

    mac80211: Fix bug in Tx ack status reporting in 802.3 xmit path
    
    Allocated ack_frame id from local->ack_status_frames is not really
    stored in the tx_info for 802.3 Tx path. Due to this, tx ack status
    is not reported and ack_frame id is not freed for the buffers requiring
    tx ack status. Also move the memset to 0 of tx_info before
    IEEE80211_TX_CTL_REQ_TX_STATUS flag assignment.
    
    Fixes: 50ff477a8639 ("mac80211: add 802.11 encapsulation offloading support")
    Signed-off-by: Vasanthakumar Thiagarajan <vthiagar at codeaurora.org>
    Link: https://lore.kernel.org/r/1595427617-1713-1-git-send-email-vthiagar@codeaurora.org
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1a2941e5244f..3529d1368068 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4230,11 +4230,12 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
 	    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
 		goto out_free;
 
+	memset(info, 0, sizeof(*info));
+
 	if (unlikely(!multicast && skb->sk &&
 		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
-		ieee80211_store_ack_skb(local, skb, &info->flags, NULL);
-
-	memset(info, 0, sizeof(*info));
+		info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
+							     &info->flags, NULL);
 
 	if (unlikely(sdata->control_port_protocol == ehdr->h_proto)) {
 		if (sdata->control_port_no_encrypt)
commit 4052d3d2e8f47a15053320bbcbe365d15610437d
Author: Julian Squires <julian at cipht.net>
Date:   Mon Jul 6 17:13:53 2020 -0400

    cfg80211: check vendor command doit pointer before use
    
    In the case where a vendor command does not implement doit, and has no
    flags set, doit would not be validated and a NULL pointer dereference
    would occur, for example when invoking the vendor command via iw.
    
    I encountered this while developing new vendor commands.  Perhaps in
    practice it is advisable to always implement doit along with dumpit,
    but it seems reasonable to me to always check doit anyway, not just
    when NEED_WDEV.
    
    Signed-off-by: Julian Squires <julian at cipht.net>
    Link: https://lore.kernel.org/r/20200706211353.2366470-1-julian@cipht.net
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0e07fb8585fb..7fbca0854265 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13266,13 +13266,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
 				if (!wdev_running(wdev))
 					return -ENETDOWN;
 			}
-
-			if (!vcmd->doit)
-				return -EOPNOTSUPP;
 		} else {
 			wdev = NULL;
 		}
 
+		if (!vcmd->doit)
+			return -EOPNOTSUPP;
+
 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
commit 5e43540c2af0a0c0a18e39579b1ad49541f87506
Author: Remi Pommarel <repk at triplefau.lt>
Date:   Sat Jul 4 15:54:19 2020 +0200

    mac80211: mesh: Free pending skb when destroying a mpath
    
    A mpath object can hold reference on a list of skb that are waiting for
    mpath resolution to be sent. When destroying a mpath this skb list
    should be cleaned up in order to not leak memory.
    
    Fixing that kind of leak:
    
    unreferenced object 0xffff0000181c9300 (size 1088):
      comm "openvpn", pid 1782, jiffies 4295071698 (age 80.416s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 f9 80 36 00 00 00 00 00  ..........6.....
        02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ... at ............
      backtrace:
        [<000000004bc6a443>] kmem_cache_alloc+0x1a4/0x2f0
        [<000000002caaef13>] sk_prot_alloc.isra.39+0x34/0x178
        [<00000000ceeaa916>] sk_alloc+0x34/0x228
        [<00000000ca1f1d04>] inet_create+0x198/0x518
        [<0000000035626b1c>] __sock_create+0x134/0x328
        [<00000000a12b3a87>] __sys_socket+0xb0/0x158
        [<00000000ff859f23>] __arm64_sys_socket+0x40/0x58
        [<00000000263486ec>] el0_svc_handler+0xd0/0x1a0
        [<0000000005b5157d>] el0_svc+0x8/0xc
    unreferenced object 0xffff000012973a40 (size 216):
      comm "openvpn", pid 1782, jiffies 4295082137 (age 38.660s)
      hex dump (first 32 bytes):
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        00 c0 06 16 00 00 ff ff 00 93 1c 18 00 00 ff ff  ................
      backtrace:
        [<000000004bc6a443>] kmem_cache_alloc+0x1a4/0x2f0
        [<0000000023c8c8f9>] __alloc_skb+0xc0/0x2b8
        [<000000007ad950bb>] alloc_skb_with_frags+0x60/0x320
        [<00000000ef90023a>] sock_alloc_send_pskb+0x388/0x3c0
        [<00000000104fb1a3>] sock_alloc_send_skb+0x1c/0x28
        [<000000006919d2dd>] __ip_append_data+0xba4/0x11f0
        [<0000000083477587>] ip_make_skb+0x14c/0x1a8
        [<0000000024f3d592>] udp_sendmsg+0xaf0/0xcf0
        [<000000005aabe255>] inet_sendmsg+0x5c/0x80
        [<000000008651ea08>] __sys_sendto+0x15c/0x218
        [<000000003505c99b>] __arm64_sys_sendto+0x74/0x90
        [<00000000263486ec>] el0_svc_handler+0xd0/0x1a0
        [<0000000005b5157d>] el0_svc+0x8/0xc
    
    Fixes: 2bdaf386f99c (mac80211: mesh: move path tables into if_mesh)
    Signed-off-by: Remi Pommarel <repk at triplefau.lt>
    Link: https://lore.kernel.org/r/20200704135419.27703-1-repk@triplefau.lt
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 117519bf33d6..aca608ae313f 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -521,6 +521,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl,
 	del_timer_sync(&mpath->timer);
 	atomic_dec(&sdata->u.mesh.mpaths);
 	atomic_dec(&tbl->entries);
+	mesh_path_flush_pending(mpath);
 	kfree_rcu(mpath, rcu);
 }
 
commit 6a01afcf8468d3ca2bd8bbb27503f60dcf643b20
Author: Remi Pommarel <repk at triplefau.lt>
Date:   Sat Jul 4 15:50:07 2020 +0200

    mac80211: mesh: Free ie data when leaving mesh
    
    At ieee80211_join_mesh() some ie data could have been allocated (see
    copy_mesh_setup()) and need to be cleaned up when leaving the mesh.
    
    This fixes the following kmemleak report:
    
    unreferenced object 0xffff0000116bc600 (size 128):
      comm "wpa_supplicant", pid 608, jiffies 4294898983 (age 293.484s)
      hex dump (first 32 bytes):
        30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00  0...............
        00 0f ac 08 00 00 00 00 c4 65 40 00 00 00 00 00  .........e at .....
      backtrace:
        [<00000000bebe439d>] __kmalloc_track_caller+0x1c0/0x330
        [<00000000a349dbe1>] kmemdup+0x28/0x50
        [<0000000075d69baa>] ieee80211_join_mesh+0x6c/0x3b8 [mac80211]
        [<00000000683bb98b>] __cfg80211_join_mesh+0x1e8/0x4f0 [cfg80211]
        [<0000000072cb507f>] nl80211_join_mesh+0x520/0x6b8 [cfg80211]
        [<0000000077e9bcf9>] genl_family_rcv_msg+0x374/0x680
        [<00000000b1bd936d>] genl_rcv_msg+0x78/0x108
        [<0000000022c53788>] netlink_rcv_skb+0xb0/0x1c0
        [<0000000011af8ec9>] genl_rcv+0x34/0x48
        [<0000000069e41f53>] netlink_unicast+0x268/0x2e8
        [<00000000a7517316>] netlink_sendmsg+0x320/0x4c0
        [<0000000069cba205>] ____sys_sendmsg+0x354/0x3a0
        [<00000000e06bab0f>] ___sys_sendmsg+0xd8/0x120
        [<0000000037340728>] __sys_sendmsg+0xa4/0xf8
        [<000000004fed9776>] __arm64_sys_sendmsg+0x44/0x58
        [<000000001c1e5647>] el0_svc_handler+0xd0/0x1a0
    
    Fixes: c80d545da3f7 (mac80211: Let userspace enable and configure vendor specific path selection.)
    Signed-off-by: Remi Pommarel <repk at triplefau.lt>
    Link: https://lore.kernel.org/r/20200704135007.27292-1-repk@triplefau.lt
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 9b360544ad6f..1079a07e43e4 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2166,6 +2166,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
 	ieee80211_stop_mesh(sdata);
 	mutex_lock(&sdata->local->mtx);
 	ieee80211_vif_release_channel(sdata);
+	kfree(sdata->u.mesh.ie);
 	mutex_unlock(&sdata->local->mtx);
 
 	return 0;
commit 65ad3ef9fced4062dfd74e2f89443fb5ce184321
Author: Rajkumar Manoharan <rmanohar at codeaurora.org>
Date:   Wed Jul 1 19:20:24 2020 -0700

    mac80211: fix warning in 6 GHz IE addition in mesh mode
    
    The commit 24a2042cb22f ("mac80211: add HE 6 GHz Band Capability
    element") failed to check device capability before adding HE 6 GHz
    capability element. Below warning is reported in 11ac device in mesh.
    Fix that by checking device capability at HE 6 GHz cap IE addition
    in mesh beacon and association request.
    
    WARNING: CPU: 1 PID: 1897 at net/mac80211/util.c:2878
    ieee80211_ie_build_he_6ghz_cap+0x149/0x150 [mac80211]
    [ 3138.720358] Call Trace:
    [ 3138.720361]  ieee80211_mesh_build_beacon+0x462/0x530 [mac80211]
    [ 3138.720363]  ieee80211_start_mesh+0xa8/0xf0 [mac80211]
    [ 3138.720365]  __cfg80211_join_mesh+0x122/0x3e0 [cfg80211]
    [ 3138.720368]  nl80211_join_mesh+0x3d3/0x510 [cfg80211]
    
    Fixes: 24a2042cb22f ("mac80211: add HE 6 GHz Band Capability element")
    Reported-by: Markus Theil <markus.theil at tu-ilmenau.de>
    Signed-off-by: Rajkumar Manoharan <rmanohar at codeaurora.org>
    Link: https://lore.kernel.org/r/1593656424-18240-1-git-send-email-rmanohar@codeaurora.org
    Signed-off-by: Johannes Berg <johannes.berg at intel.com>

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 5f1ca25b6c97..e88beb3ff6db 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -617,6 +617,19 @@ int mesh_add_he_oper_ie(struct ieee80211_sub_if_data *sdata,
 int mesh_add_he_6ghz_cap_ie(struct ieee80211_sub_if_data *sdata,
 			    struct sk_buff *skb)
 {
+	struct ieee80211_supported_band *sband;
+	const struct ieee80211_sband_iftype_data *iftd;
+
+	sband = ieee80211_get_sband(sdata);
+	if (!sband)
+		return -EINVAL;
+
+	iftd = ieee80211_get_sband_iftype_data(sband,
+					       NL80211_IFTYPE_MESH_POINT);
+	/* The device doesn't support HE in mesh mode or at all */
+	if (!iftd)
+		return 0;
+
 	ieee80211_ie_build_he_6ghz_cap(sdata, skb);
 	return 0;
 }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 21c94094a699..dd9f5c7a1ade 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2878,6 +2878,10 @@ void ieee80211_ie_build_he_6ghz_cap(struct ieee80211_sub_if_data *sdata,
 	if (WARN_ON(!iftd))
 		return;
 
+	/* Check for device HE 6 GHz capability before adding element */
+	if (!iftd->he_6ghz_capa.capa)
+		return;
+
 	cap = le16_to_cpu(iftd->he_6ghz_capa.capa);
 	cap &= ~IEEE80211_HE_6GHZ_CAP_SM_PS;
 
commit 5649625344fe1f4695eace7c37d011e317bf66d5
Author: Kailang Yang <kailang at realtek.com>
Date:   Wed Jul 29 15:09:27 2020 +0800

    ALSA: hda/realtek - Fixed HP right speaker no sound
    
    HP NB right speaker had no sound output.
    This platform was connected to I2S Amp for speaker out.(None Realtek I2S Amp IC)
    EC need to check codec GPIO1 pin to initial I2S Amp.
    
    Signed-off-by: Kailang Yang <kailang at realtek.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/01285f623ac7447187482fb4a8ecaa7c@realtek.com
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0f640d99a396..29f5878f0c50 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5975,6 +5975,16 @@ static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
 		snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
 }
 
+static void  alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec,
+			      const struct hda_fixup *fix, int action)
+{
+	if (action != HDA_FIXUP_ACT_INIT)
+		return;
+
+	msleep(100);
+	alc_write_coef_idx(codec, 0x65, 0x0);
+}
+
 /* for hda_fixup_thinkpad_acpi() */
 #include "thinkpad_helper.c"
 
@@ -6155,6 +6165,7 @@ enum {
 	ALC289_FIXUP_ASUS_GA401,
 	ALC289_FIXUP_ASUS_GA502,
 	ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+	ALC285_FIXUP_HP_GPIO_AMP_INIT,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -7387,6 +7398,12 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
 	},
+	[ALC285_FIXUP_HP_GPIO_AMP_INIT] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc285_fixup_hp_gpio_amp_init,
+		.chained = true,
+		.chain_id = ALC285_FIXUP_HP_GPIO_LED
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7537,7 +7554,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
-	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
commit 71b59bf482b2dd662774f34108c5b904efa9e02b
Author: Sabrina Dubroca <sd at queasysnail.net>
Date:   Wed Jul 29 18:38:43 2020 +0200

    espintcp: count packets dropped in espintcp_rcv
    
    Currently, espintcp_rcv drops packets silently, which makes debugging
    issues difficult. Count packets as either XfrmInHdrError (when the
    packet was too short or contained invalid data) or XfrmInError (for
    other issues).
    
    Signed-off-by: Sabrina Dubroca <sd at queasysnail.net>
    Signed-off-by: Steffen Klassert <steffen.klassert at secunet.com>

diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index 0a91b07f2b43..827ccdf2db57 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -15,6 +15,7 @@ static void handle_nonesp(struct espintcp_ctx *ctx, struct sk_buff *skb,
 {
 	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf ||
 	    !sk_rmem_schedule(sk, skb, skb->truesize)) {
+		XFRM_INC_STATS(sock_net(sk), LINUX_MIB_XFRMINERROR);
 		kfree_skb(skb);
 		return;
 	}
@@ -59,6 +60,7 @@ static void espintcp_rcv(struct strparser *strp, struct sk_buff *skb)
 
 		err = skb_copy_bits(skb, rxm->offset + 2, &data, 1);
 		if (err < 0) {
+			XFRM_INC_STATS(sock_net(strp->sk), LINUX_MIB_XFRMINHDRERROR);
 			kfree_skb(skb);
 			return;
 		}
@@ -71,6 +73,7 @@ static void espintcp_rcv(struct strparser *strp, struct sk_buff *skb)
 
 	/* drop other short messages */
 	if (unlikely(len <= sizeof(nonesp_marker))) {
+		XFRM_INC_STATS(sock_net(strp->sk), LINUX_MIB_XFRMINHDRERROR);
 		kfree_skb(skb);
 		return;
 	}
@@ -78,17 +81,20 @@ static void espintcp_rcv(struct strparser *strp, struct sk_buff *skb)
 	err = skb_copy_bits(skb, rxm->offset + 2, &nonesp_marker,
 			    sizeof(nonesp_marker));
 	if (err < 0) {
+		XFRM_INC_STATS(sock_net(strp->sk), LINUX_MIB_XFRMINHDRERROR);
 		kfree_skb(skb);
 		return;
 	}
 
 	/* remove header, leave non-ESP marker/SPI */
 	if (!__pskb_pull(skb, rxm->offset + 2)) {
+		XFRM_INC_STATS(sock_net(strp->sk), LINUX_MIB_XFRMINERROR);
 		kfree_skb(skb);
 		return;
 	}
 
 	if (pskb_trim(skb, rxm->full_len - 2) != 0) {
+		XFRM_INC_STATS(sock_net(strp->sk), LINUX_MIB_XFRMINERROR);
 		kfree_skb(skb);
 		return;
 	}
commit fadd1a63a7b4df295a01fa50b2f4e447542bee59
Author: Sabrina Dubroca <sd at queasysnail.net>
Date:   Wed Jul 29 18:38:42 2020 +0200

    espintcp: handle short messages instead of breaking the encap socket
    
    Currently, short messages (less than 4 bytes after the length header)
    will break the stream of messages. This is unnecessary, since we can
    still parse messages even if they're too short to contain any usable
    data. This is also bogus, as keepalive messages (a single 0xff byte),
    though not needed with TCP encapsulation, should be allowed.
    
    This patch changes the stream parser so that short messages are
    accepted and dropped in the kernel. Messages that contain a valid SPI
    or non-ESP header are processed as before.
    
    Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
    Reported-by: Andrew Cagney <cagney at libreswan.org>
    Signed-off-by: Sabrina Dubroca <sd at queasysnail.net>
    Signed-off-by: Steffen Klassert <steffen.klassert at secunet.com>

diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index cb83e3664680..0a91b07f2b43 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -49,9 +49,32 @@ static void espintcp_rcv(struct strparser *strp, struct sk_buff *skb)
 	struct espintcp_ctx *ctx = container_of(strp, struct espintcp_ctx,
 						strp);
 	struct strp_msg *rxm = strp_msg(skb);
+	int len = rxm->full_len - 2;
 	u32 nonesp_marker;
 	int err;
 
+	/* keepalive packet? */
+	if (unlikely(len == 1)) {
+		u8 data;
+
+		err = skb_copy_bits(skb, rxm->offset + 2, &data, 1);
+		if (err < 0) {
+			kfree_skb(skb);
+			return;
+		}
+
+		if (data == 0xff) {
+			kfree_skb(skb);
+			return;
+		}
+	}
+
+	/* drop other short messages */
+	if (unlikely(len <= sizeof(nonesp_marker))) {
+		kfree_skb(skb);
+		return;
+	}
+
 	err = skb_copy_bits(skb, rxm->offset + 2, &nonesp_marker,
 			    sizeof(nonesp_marker));
 	if (err < 0) {
@@ -91,7 +114,7 @@ static int espintcp_parse(struct strparser *strp, struct sk_buff *skb)
 		return err;
 
 	len = be16_to_cpu(blen);
-	if (len < 6)
+	if (len < 2)
 		return -EINVAL;
 
 	return len;
commit 83bdc7275e6206f560d247be856bceba3e1ed8f2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 29 19:11:00 2020 -0700

    random32: remove net_rand_state from the latent entropy gcc plugin
    
    It turns out that the plugin right now ends up being really unhappy
    about the change from 'static' to 'extern' storage that happened in
    commit f227e3ec3b5c ("random32: update the net random state on interrupt
    and activity").
    
    This is probably a trivial fix for the latent_entropy plugin, but for
    now, just remove net_rand_state from the list of things the plugin
    worries about.
    
    Reported-by: Stephen Rothwell <sfr at canb.auug.org.au>
    Cc: Emese Revfy <re.emese at gmail.com>
    Cc: Kees Cook <keescook at chromium.org>
    Cc: Willy Tarreau <w at 1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/random.h b/include/linux/random.h
index 39aaa1f78f9d..f310897f051d 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -120,7 +120,7 @@ struct rnd_state {
 	__u32 s1, s2, s3, s4;
 };
 
-DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+DECLARE_PER_CPU(struct rnd_state, net_rand_state);
 
 u32 prandom_u32_state(struct rnd_state *state);
 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
diff --git a/lib/random32.c b/lib/random32.c
index c4d317be2997..3d749abb9e80 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void)
 }
 #endif
 
-DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+DEFINE_PER_CPU(struct rnd_state, net_rand_state);
 
 /**
  *	prandom_u32_state - seeded pseudo-random number generator.
commit 2d889db7626d2b6d67f402e2478b11f9a49b44e3
Author: Wei Yongjun <weiyongjun1 at huawei.com>
Date:   Sat Jul 25 06:34:29 2020 +0000

    drm: xlnx: Fix typo in parameter description
    
    Fix typo in parameter description.
    
    Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
    Reported-by: Hulk Robot <hulkci at huawei.com>
    Signed-off-by: Wei Yongjun <weiyongjun1 at huawei.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Reviewed-by: Hyun Kwon <hyun.kwon at xilinx.com>
    Signed-off-by: Hyun Kwon <hyun.kwon at xilinx.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200725063429.172139-1-weiyongjun1@huawei.com

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 0e1c818746eb..b735072a702d 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -44,7 +44,7 @@ MODULE_PARM_DESC(aux_timeout_ms, "DP aux timeout value in msec (default: 50)");
  */
 static uint zynqmp_dp_power_on_delay_ms = 4;
 module_param_named(power_on_delay_ms, zynqmp_dp_power_on_delay_ms, uint, 0444);
-MODULE_PARM_DESC(aux_timeout_ms, "DP power on delay in msec (default: 4)");
+MODULE_PARM_DESC(power_on_delay_ms, "DP power on delay in msec (default: 4)");
 
 /* Link configuration registers */
 #define ZYNQMP_DP_LINK_BW_SET				0x0
commit be13d94b7d7f1a3e7290573faa16267941917106
Author: Colin Ian King <colin.king at canonical.com>
Date:   Fri Jul 24 12:12:58 2020 +0100

    drm: xlnx: fix spelling mistake "failes" -> "failed"
    
    There is a spelling mistake in a dev_dbg messages. Fix it.
    
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Reviewed-by: Hyun Kwon <hyun.kwon at xilinx.com>
    Signed-off-by: Hyun Kwon <hyun.kwon at xilinx.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200724111258.14762-1-colin.king@canonical.com

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 821f7a71e182..0e1c818746eb 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -1308,7 +1308,7 @@ zynqmp_dp_connector_detect(struct drm_connector *connector, bool force)
 		ret = drm_dp_dpcd_read(&dp->aux, 0x0, dp->dpcd,
 				       sizeof(dp->dpcd));
 		if (ret < 0) {
-			dev_dbg(dp->dev, "DPCD read failes");
+			dev_dbg(dp->dev, "DPCD read failed");
 			goto disconnected;
 		}
 
commit b361663c5a40c8bc758b7f7f2239f7a192180e7c
Author: Robert Hancock <hancockrwd at gmail.com>
Date:   Tue Jul 21 20:18:03 2020 -0600

    PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
    
    Recently ASPM handling was changed to allow ASPM on PCIe-to-PCI/PCI-X
    bridges.  Unfortunately the ASMedia ASM1083/1085 PCIe to PCI bridge device
    doesn't seem to function properly with ASPM enabled.  On an Asus PRIME
    H270-PRO motherboard, it causes errors like these:
    
      pcieport 0000:00:1c.0: AER: PCIe Bus Error: severity=Corrected, type=Data Link Layer, (Transmitter ID)
      pcieport 0000:00:1c.0: AER:   device [8086:a292] error status/mask=00003000/00002000
      pcieport 0000:00:1c.0: AER:    [12] Timeout
      pcieport 0000:00:1c.0: AER: Corrected error received: 0000:00:1c.0
      pcieport 0000:00:1c.0: AER: can't find device of ID00e0
    
    In addition to flooding the kernel log, this also causes the machine to
    wake up immediately after suspend is initiated.
    
    The device advertises ASPM L0s and L1 support in the Link Capabilities
    register, but the ASMedia web page for ASM1083 [1] claims "No PCIe ASPM
    support".
    
    Windows 10 (build 2004) enables L0s, but it also logs correctable PCIe
    errors.
    
    Add a quirk to disable ASPM for this device.
    
    [1] https://www.asmedia.com.tw/eng/e_show_products.php?cate_index=169&item=114
    
    [bhelgaas: commit log]
    Fixes: 66ff14e59e8a ("PCI/ASPM: Allow ASPM on links to PCIe-to-PCI/PCI-X Bridges")
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208667
    Link: https://lore.kernel.org/r/20200722021803.17958-1-hancockrwd@gmail.com
    Signed-off-by: Robert Hancock <hancockrwd at gmail.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 812bfc32ecb8..2ea61abd5830 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2330,6 +2330,19 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
 
+static void quirk_disable_aspm_l0s_l1(struct pci_dev *dev)
+{
+	pci_info(dev, "Disabling ASPM L0s/L1\n");
+	pci_disable_link_state(dev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1);
+}
+
+/*
+ * ASM1083/1085 PCIe-PCI bridge devices cause AER timeout errors on the
+ * upstream PCIe root port when ASPM is enabled. At least L0s mode is affected;
+ * disable both L0s and L1 for now to be safe.
+ */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASMEDIA, 0x1080, quirk_disable_aspm_l0s_l1);
+
 /*
  * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
  * Link bit cleared after starting the link retrain process to allow this
commit 0ba58348414eb10249480635545758b40b3c33b6
Author: Andrii Nakryiko <andriin at fb.com>
Date:   Tue Jul 28 21:09:13 2020 -0700

    selftests/bpf: Extend map-in-map selftest to detect memory leaks
    
    Add test validating that all inner maps are released properly after skeleton
    is destroyed. To ensure determinism, trigger kernel-side synchronize_rcu()
    before checking map existence by their IDs.
    
    Signed-off-by: Andrii Nakryiko <andriin at fb.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Song Liu <songliubraving at fb.com>
    Link: https://lore.kernel.org/bpf/20200729040913.2815687-2-andriin@fb.com

diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
index f7ee8fa377ad..6ccecbd39476 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
@@ -5,10 +5,60 @@
 
 #include "test_btf_map_in_map.skel.h"
 
+static int duration;
+
+static __u32 bpf_map_id(struct bpf_map *map)
+{
+	struct bpf_map_info info;
+	__u32 info_len = sizeof(info);
+	int err;
+
+	memset(&info, 0, info_len);
+	err = bpf_obj_get_info_by_fd(bpf_map__fd(map), &info, &info_len);
+	if (err)
+		return 0;
+	return info.id;
+}
+
+/*
+ * Trigger synchronize_rcu() in kernel.
+ *
+ * ARRAY_OF_MAPS/HASH_OF_MAPS lookup/update operations trigger synchronize_rcu()
+ * if looking up an existing non-NULL element or updating the map with a valid
+ * inner map FD. Use this fact to trigger synchronize_rcu(): create map-in-map,
+ * create a trivial ARRAY map, update map-in-map with ARRAY inner map. Then
+ * cleanup. At the end, at least one synchronize_rcu() would be called.
+ */
+static int kern_sync_rcu(void)
+{
+	int inner_map_fd, outer_map_fd, err, zero = 0;
+
+	inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, 4, 4, 1, 0);
+	if (CHECK(inner_map_fd < 0, "inner_map_create", "failed %d\n", -errno))
+		return -1;
+
+	outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
+					     sizeof(int), inner_map_fd, 1, 0);
+	if (CHECK(outer_map_fd < 0, "outer_map_create", "failed %d\n", -errno)) {
+		close(inner_map_fd);
+		return -1;
+	}
+
+	err = bpf_map_update_elem(outer_map_fd, &zero, &inner_map_fd, 0);
+	if (err)
+		err = -errno;
+	CHECK(err, "outer_map_update", "failed %d\n", err);
+	close(inner_map_fd);
+	close(outer_map_fd);
+	return err;
+}
+
 void test_btf_map_in_map(void)
 {
-	int duration = 0, err, key = 0, val;
-	struct test_btf_map_in_map* skel;
+	int err, key = 0, val, i;
+	struct test_btf_map_in_map *skel;
+	int outer_arr_fd, outer_hash_fd;
+	int fd, map1_fd, map2_fd, map1_id, map2_id;
 
 	skel = test_btf_map_in_map__open_and_load();
 	if (CHECK(!skel, "skel_open", "failed to open&load skeleton\n"))
@@ -18,32 +68,78 @@ void test_btf_map_in_map(void)
 	if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
 		goto cleanup;
 
+	map1_fd = bpf_map__fd(skel->maps.inner_map1);
+	map2_fd = bpf_map__fd(skel->maps.inner_map2);
+	outer_arr_fd = bpf_map__fd(skel->maps.outer_arr);
+	outer_hash_fd = bpf_map__fd(skel->maps.outer_hash);
+
 	/* inner1 = input, inner2 = input + 1 */
-	val = bpf_map__fd(skel->maps.inner_map1);
-	bpf_map_update_elem(bpf_map__fd(skel->maps.outer_arr), &key, &val, 0);
-	val = bpf_map__fd(skel->maps.inner_map2);
-	bpf_map_update_elem(bpf_map__fd(skel->maps.outer_hash), &key, &val, 0);
+	map1_fd = bpf_map__fd(skel->maps.inner_map1);
+	bpf_map_update_elem(outer_arr_fd, &key, &map1_fd, 0);
+	map2_fd = bpf_map__fd(skel->maps.inner_map2);
+	bpf_map_update_elem(outer_hash_fd, &key, &map2_fd, 0);
 	skel->bss->input = 1;
 	usleep(1);
 
-	bpf_map_lookup_elem(bpf_map__fd(skel->maps.inner_map1), &key, &val);
+	bpf_map_lookup_elem(map1_fd, &key, &val);
 	CHECK(val != 1, "inner1", "got %d != exp %d\n", val, 1);
-	bpf_map_lookup_elem(bpf_map__fd(skel->maps.inner_map2), &key, &val);
+	bpf_map_lookup_elem(map2_fd, &key, &val);
 	CHECK(val != 2, "inner2", "got %d != exp %d\n", val, 2);
 
 	/* inner1 = input + 1, inner2 = input */
-	val = bpf_map__fd(skel->maps.inner_map2);
-	bpf_map_update_elem(bpf_map__fd(skel->maps.outer_arr), &key, &val, 0);
-	val = bpf_map__fd(skel->maps.inner_map1);
-	bpf_map_update_elem(bpf_map__fd(skel->maps.outer_hash), &key, &val, 0);
+	bpf_map_update_elem(outer_arr_fd, &key, &map2_fd, 0);
+	bpf_map_update_elem(outer_hash_fd, &key, &map1_fd, 0);
 	skel->bss->input = 3;
 	usleep(1);
 
-	bpf_map_lookup_elem(bpf_map__fd(skel->maps.inner_map1), &key, &val);
+	bpf_map_lookup_elem(map1_fd, &key, &val);
 	CHECK(val != 4, "inner1", "got %d != exp %d\n", val, 4);
-	bpf_map_lookup_elem(bpf_map__fd(skel->maps.inner_map2), &key, &val);
+	bpf_map_lookup_elem(map2_fd, &key, &val);
 	CHECK(val != 3, "inner2", "got %d != exp %d\n", val, 3);
 
+	for (i = 0; i < 5; i++) {
+		val = i % 2 ? map1_fd : map2_fd;
+		err = bpf_map_update_elem(outer_hash_fd, &key, &val, 0);
+		if (CHECK_FAIL(err)) {
+			printf("failed to update hash_of_maps on iter #%d\n", i);
+			goto cleanup;
+		}
+		err = bpf_map_update_elem(outer_arr_fd, &key, &val, 0);
+		if (CHECK_FAIL(err)) {
+			printf("failed to update hash_of_maps on iter #%d\n", i);
+			goto cleanup;
+		}
+	}
+
+	map1_id = bpf_map_id(skel->maps.inner_map1);
+	map2_id = bpf_map_id(skel->maps.inner_map2);
+	CHECK(map1_id == 0, "map1_id", "failed to get ID 1\n");
+	CHECK(map2_id == 0, "map2_id", "failed to get ID 2\n");
+
+	test_btf_map_in_map__destroy(skel);
+	skel = NULL;
+
+	/* we need to either wait for or force synchronize_rcu(), before
+	 * checking for "still exists" condition, otherwise map could still be
+	 * resolvable by ID, causing false positives.
+	 *
+	 * Older kernels (5.8 and earlier) freed map only after two
+	 * synchronize_rcu()s, so trigger two, to be entirely sure.
+	 */
+	CHECK(kern_sync_rcu(), "sync_rcu", "failed\n");
+	CHECK(kern_sync_rcu(), "sync_rcu", "failed\n");
+
+	fd = bpf_map_get_fd_by_id(map1_id);
+	if (CHECK(fd >= 0, "map1_leak", "inner_map1 leaked!\n")) {
+		close(fd);
+		goto cleanup;
+	}
+	fd = bpf_map_get_fd_by_id(map2_id);
+	if (CHECK(fd >= 0, "map2_leak", "inner_map2 leaked!\n")) {
+		close(fd);
+		goto cleanup;
+	}
+
 cleanup:
 	test_btf_map_in_map__destroy(skel);
 }
commit 1d4e1eab456e1ee92a94987499b211db05f900ea
Author: Andrii Nakryiko <andriin at fb.com>
Date:   Tue Jul 28 21:09:12 2020 -0700

    bpf: Fix map leak in HASH_OF_MAPS map
    
    Fix HASH_OF_MAPS bug of not putting inner map pointer on bpf_map_elem_update()
    operation. This is due to per-cpu extra_elems optimization, which bypassed
    free_htab_elem() logic doing proper clean ups. Make sure that inner map is put
    properly in optimized case as well.
    
    Fixes: 8c290e60fa2a ("bpf: fix hashmap extra_elems logic")
    Signed-off-by: Andrii Nakryiko <andriin at fb.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Song Liu <songliubraving at fb.com>
    Link: https://lore.kernel.org/bpf/20200729040913.2815687-1-andriin@fb.com

diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index b4b288a3c3c9..b32cc8ce8ff6 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -779,15 +779,20 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 	htab_elem_free(htab, l);
 }
 
-static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
+static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
 {
 	struct bpf_map *map = &htab->map;
+	void *ptr;
 
 	if (map->ops->map_fd_put_ptr) {
-		void *ptr = fd_htab_map_get_ptr(map, l);
-
+		ptr = fd_htab_map_get_ptr(map, l);
 		map->ops->map_fd_put_ptr(ptr);
 	}
+}
+
+static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
+{
+	htab_put_fd_value(htab, l);
 
 	if (htab_is_prealloc(htab)) {
 		__pcpu_freelist_push(&htab->freelist, &l->fnode);
@@ -839,6 +844,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
 			 */
 			pl_new = this_cpu_ptr(htab->extra_elems);
 			l_new = *pl_new;
+			htab_put_fd_value(htab, old_elem);
 			*pl_new = old_elem;
 		} else {
 			struct pcpu_freelist_node *l;
commit 27a2145d6f826d1fad9de06ac541b1016ced3427
Author: Thomas Falcon <tlfalcon at linux.ibm.com>
Date:   Wed Jul 29 16:36:32 2020 -0500

    ibmvnic: Fix IRQ mapping disposal in error path
    
    RX queue IRQ mappings are disposed in both the TX IRQ and RX IRQ
    error paths. Fix this and dispose of TX IRQ mappings correctly in
    case of an error.
    
    Fixes: ea22d51a7831 ("ibmvnic: simplify and improve driver probe function")
    Signed-off-by: Thomas Falcon <tlfalcon at linux.ibm.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 0fd7eae25fe9..5afb3c9c52d2 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -3206,7 +3206,7 @@ req_rx_irq_failed:
 req_tx_irq_failed:
 	for (j = 0; j < i; j++) {
 		free_irq(adapter->tx_scrq[j]->irq, adapter->tx_scrq[j]);
-		irq_dispose_mapping(adapter->rx_scrq[j]->irq);
+		irq_dispose_mapping(adapter->tx_scrq[j]->irq);
 	}
 	release_sub_crqs(adapter, 1);
 	return rc;
commit d3590ebf6f91350192737dd1d1b219c05277f067
Merge: 21391520cbb5 8ac68dc455d9
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 29 12:35:36 2020 -0700

    Merge tag 'audit-pr-20200729' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
    
    Pull audit fixes from Paul Moore:
     "One small audit fix that you can hopefully merge before v5.8 is
      released. Unfortunately it is a revert of a patch that went in during
      the v5.7 window and we just recently started to see some bug reports
      relating to that commit.
    
      We are working on a proper fix, but I'm not yet clear on when that
      will be ready and we need to fix the v5.7 kernels anyway, so in the
      interest of time a revert seemed like the best solution right now"
    
    * tag 'audit-pr-20200729' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
      revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")

commit 21391520cbb597823050ac1bc343a0df3222ac90
Merge: c2f3850df7f9 74d6a5d56629
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 29 12:29:24 2020 -0700

    Merge tag '9p-for-5.8-2' of git://github.com/martinetd/linux into master
    
    Pull 9p fixes from Dominique Martinet:
     "A couple of syzcaller fixes for 5.8
    
      The first one in particular has been quite noisy ("broke" in -rc5) so
      this would be worth landing even this late even if users likely won't
      see a difference"
    
    * tag '9p-for-5.8-2' of git://github.com/martinetd/linux:
      9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
      net/9p: validate fds in p9_fd_open

commit 5d104a5f325e16ef92ffc05b93eabdf6f0818c9f
Merge: 83f3522860f7 10fef9ca6a87
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Jul 29 12:16:21 2020 -0700

    Merge branch 'mlxsw-fixes'
    
    Ido Schimmel says:
    
    ====================
    mlxsw fixes
    
    This patch set contains various fixes for mlxsw.
    
    Patches #1-#2 fix two trap related issues introduced in previous cycle.
    
    Patches #3-#5 fix rare use-after-frees discovered by syzkaller. After
    over a week of fuzzing with the fixes, the bugs did not reproduce.
    
    Patch #6 from Amit fixes an issue in the ethtool selftest that was
    recently discovered after running the test on a new platform that
    supports only 1Gbps and 10Gbps speeds.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 10fef9ca6a879e7bee090b8e51c9812d438d3fb1
Author: Amit Cohen <amitc at mellanox.com>
Date:   Wed Jul 29 12:26:48 2020 +0300

    selftests: ethtool: Fix test when only two speeds are supported
    
    The test case check_highest_speed_is_chosen() configures $h1 to
    advertise a subset of its supported speeds and checks that $h2 chooses
    the highest speed from the subset.
    
    To find the common advertised speeds between $h1 and $h2,
    common_speeds_get() is called.
    
    Currently, the first speed returned from common_speeds_get() is removed
    claiming "h1 does not advertise this speed". The claim is wrong because
    the function is called after $h1 already advertised a subset of speeds.
    
    In case $h1 supports only two speeds, it will advertise a single speed
    which will be later removed because of previously mentioned bug. This
    results in the test needlessly failing. When more than two speeds are
    supported this is not an issue because the first advertised speed
    is the lowest one.
    
    Fix this by not removing any speed from the list of commonly advertised
    speeds.
    
    Fixes: 64916b57c0b1 ("selftests: forwarding: Add speed and auto-negotiation test")
    Reported-by: Danielle Ratson <danieller at mellanox.com>
    Signed-off-by: Amit Cohen <amitc at mellanox.com>
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/forwarding/ethtool.sh b/tools/testing/selftests/net/forwarding/ethtool.sh
index eb8e2a23bbb4..43a948feed26 100755
--- a/tools/testing/selftests/net/forwarding/ethtool.sh
+++ b/tools/testing/selftests/net/forwarding/ethtool.sh
@@ -252,8 +252,6 @@ check_highest_speed_is_chosen()
 	fi
 
 	local -a speeds_arr=($(common_speeds_get $h1 $h2 0 1))
-	# Remove the first speed, h1 does not advertise this speed.
-	unset speeds_arr[0]
 
 	max_speed=${speeds_arr[0]}
 	for current in ${speeds_arr[@]}; do
commit 5515c3448d55bdcb5ff8a1778aa84f34e4205596
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 12:26:47 2020 +0300

    mlxsw: spectrum_router: Fix use-after-free in router init / de-init
    
    Several notifiers are registered as part of router initialization.
    Since some of these notifiers are registered before the end of the
    initialization, it is possible for them to access uninitialized or freed
    memory when processing notifications [1].
    
    Additionally, some of these notifiers queue work items on a workqueue.
    If these work items are executed after the router was de-initialized,
    they will access freed memory.
    
    Fix both problems by moving the registration of the notifiers to the end
    of the router initialization and flush the work queue after they are
    unregistered.
    
    [1]
    BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:938 [inline]
    BUG: KASAN: use-after-free in __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103
    Read of size 8 at addr ffff888038c3a6e0 by task kworker/u4:1/61
    
    CPU: 1 PID: 61 Comm: kworker/u4:1 Not tainted 5.8.0-rc2+ #36
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
    Workqueue: mlxsw_core_ordered mlxsw_sp_inet6addr_event_work
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0xf6/0x16e lib/dump_stack.c:118
     print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383
     __kasan_report mm/kasan/report.c:513 [inline]
     kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
     __mutex_lock_common kernel/locking/mutex.c:938 [inline]
     __mutex_lock+0xeea/0x1340 kernel/locking/mutex.c:1103
     mlxsw_sp_inet6addr_event_work+0xb3/0x1b0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7123
     process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
     worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
     kthread+0x355/0x470 kernel/kthread.c:291
     ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
    
    Allocated by task 1298:
     save_stack+0x1b/0x40 mm/kasan/common.c:48
     set_track mm/kasan/common.c:56 [inline]
     __kasan_kmalloc mm/kasan/common.c:494 [inline]
     __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467
     kmalloc include/linux/slab.h:555 [inline]
     kzalloc include/linux/slab.h:669 [inline]
     mlxsw_sp_router_init+0xb2/0x1d20 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:8074
     mlxsw_sp_init+0xbd8/0x3ac0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2932
     __mlxsw_core_bus_device_register+0x657/0x10d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1375
     mlxsw_core_bus_device_register drivers/net/ethernet/mellanox/mlxsw/core.c:1436 [inline]
     mlxsw_devlink_core_bus_device_reload_up+0xcd/0x150 drivers/net/ethernet/mellanox/mlxsw/core.c:1133
     devlink_reload net/core/devlink.c:2959 [inline]
     devlink_reload+0x281/0x3b0 net/core/devlink.c:2944
     devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987
     genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]
     genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]
     genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753
     netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469
     genl_rcv+0x24/0x40 net/netlink/genetlink.c:764
     netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
     netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329
     netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918
     sock_sendmsg_nosec net/socket.c:652 [inline]
     sock_sendmsg+0x150/0x190 net/socket.c:672
     ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363
     ___sys_sendmsg+0xff/0x170 net/socket.c:2417
     __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450
     do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Freed by task 1348:
     save_stack+0x1b/0x40 mm/kasan/common.c:48
     set_track mm/kasan/common.c:56 [inline]
     kasan_set_free_info mm/kasan/common.c:316 [inline]
     __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455
     slab_free_hook mm/slub.c:1474 [inline]
     slab_free_freelist_hook mm/slub.c:1507 [inline]
     slab_free mm/slub.c:3072 [inline]
     kfree+0xe6/0x320 mm/slub.c:4063
     mlxsw_sp_fini+0x340/0x4e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:3132
     mlxsw_core_bus_device_unregister+0x16c/0x6d0 drivers/net/ethernet/mellanox/mlxsw/core.c:1474
     mlxsw_devlink_core_bus_device_reload_down+0x8e/0xc0 drivers/net/ethernet/mellanox/mlxsw/core.c:1123
     devlink_reload+0xc6/0x3b0 net/core/devlink.c:2952
     devlink_nl_cmd_reload+0x2f1/0x7c0 net/core/devlink.c:2987
     genl_family_rcv_msg_doit net/netlink/genetlink.c:691 [inline]
     genl_family_rcv_msg net/netlink/genetlink.c:736 [inline]
     genl_rcv_msg+0x611/0x9d0 net/netlink/genetlink.c:753
     netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2469
     genl_rcv+0x24/0x40 net/netlink/genetlink.c:764
     netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
     netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1329
     netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1918
     sock_sendmsg_nosec net/socket.c:652 [inline]
     sock_sendmsg+0x150/0x190 net/socket.c:672
     ____sys_sendmsg+0x6d8/0x840 net/socket.c:2363
     ___sys_sendmsg+0xff/0x170 net/socket.c:2417
     __sys_sendmsg+0xe5/0x1b0 net/socket.c:2450
     do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:359
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    The buggy address belongs to the object at ffff888038c3a000
     which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 1760 bytes inside of
     2048-byte region [ffff888038c3a000, ffff888038c3a800)
    The buggy address belongs to the page:
    page:ffffea0000e30e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea0000e30e00 order:3 compound_mapcount:0 compound_pincount:0
    flags: 0x100000000010200(slab|head)
    raw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c40c000
    raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff888038c3a580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff888038c3a600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff888038c3a680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                           ^
     ffff888038c3a700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff888038c3a780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    
    Fixes: 965fa8e600d2 ("mlxsw: spectrum_router: Make RIF deletion more robust")
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index bd4803074776..0521e9d48c45 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -8069,16 +8069,6 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp,
 	mlxsw_sp->router = router;
 	router->mlxsw_sp = mlxsw_sp;
 
-	router->inetaddr_nb.notifier_call = mlxsw_sp_inetaddr_event;
-	err = register_inetaddr_notifier(&router->inetaddr_nb);
-	if (err)
-		goto err_register_inetaddr_notifier;
-
-	router->inet6addr_nb.notifier_call = mlxsw_sp_inet6addr_event;
-	err = register_inet6addr_notifier(&router->inet6addr_nb);
-	if (err)
-		goto err_register_inet6addr_notifier;
-
 	INIT_LIST_HEAD(&mlxsw_sp->router->nexthop_neighs_list);
 	err = __mlxsw_sp_router_init(mlxsw_sp);
 	if (err)
@@ -8119,12 +8109,6 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp,
 	if (err)
 		goto err_neigh_init;
 
-	mlxsw_sp->router->netevent_nb.notifier_call =
-		mlxsw_sp_router_netevent_event;
-	err = register_netevent_notifier(&mlxsw_sp->router->netevent_nb);
-	if (err)
-		goto err_register_netevent_notifier;
-
 	err = mlxsw_sp_mp_hash_init(mlxsw_sp);
 	if (err)
 		goto err_mp_hash_init;
@@ -8133,6 +8117,22 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp,
 	if (err)
 		goto err_dscp_init;
 
+	router->inetaddr_nb.notifier_call = mlxsw_sp_inetaddr_event;
+	err = register_inetaddr_notifier(&router->inetaddr_nb);
+	if (err)
+		goto err_register_inetaddr_notifier;
+
+	router->inet6addr_nb.notifier_call = mlxsw_sp_inet6addr_event;
+	err = register_inet6addr_notifier(&router->inet6addr_nb);
+	if (err)
+		goto err_register_inet6addr_notifier;
+
+	mlxsw_sp->router->netevent_nb.notifier_call =
+		mlxsw_sp_router_netevent_event;
+	err = register_netevent_notifier(&mlxsw_sp->router->netevent_nb);
+	if (err)
+		goto err_register_netevent_notifier;
+
 	mlxsw_sp->router->fib_nb.notifier_call = mlxsw_sp_router_fib_event;
 	err = register_fib_notifier(mlxsw_sp_net(mlxsw_sp),
 				    &mlxsw_sp->router->fib_nb,
@@ -8143,10 +8143,15 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp,
 	return 0;
 
 err_register_fib_notifier:
-err_dscp_init:
-err_mp_hash_init:
 	unregister_netevent_notifier(&mlxsw_sp->router->netevent_nb);
 err_register_netevent_notifier:
+	unregister_inet6addr_notifier(&router->inet6addr_nb);
+err_register_inet6addr_notifier:
+	unregister_inetaddr_notifier(&router->inetaddr_nb);
+err_register_inetaddr_notifier:
+	mlxsw_core_flush_owq();
+err_dscp_init:
+err_mp_hash_init:
 	mlxsw_sp_neigh_fini(mlxsw_sp);
 err_neigh_init:
 	mlxsw_sp_vrs_fini(mlxsw_sp);
@@ -8165,10 +8170,6 @@ err_ipips_init:
 err_rifs_init:
 	__mlxsw_sp_router_fini(mlxsw_sp);
 err_router_init:
-	unregister_inet6addr_notifier(&router->inet6addr_nb);
-err_register_inet6addr_notifier:
-	unregister_inetaddr_notifier(&router->inetaddr_nb);
-err_register_inetaddr_notifier:
 	mutex_destroy(&mlxsw_sp->router->lock);
 	kfree(mlxsw_sp->router);
 	return err;
@@ -8179,6 +8180,9 @@ void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
 	unregister_fib_notifier(mlxsw_sp_net(mlxsw_sp),
 				&mlxsw_sp->router->fib_nb);
 	unregister_netevent_notifier(&mlxsw_sp->router->netevent_nb);
+	unregister_inet6addr_notifier(&mlxsw_sp->router->inet6addr_nb);
+	unregister_inetaddr_notifier(&mlxsw_sp->router->inetaddr_nb);
+	mlxsw_core_flush_owq();
 	mlxsw_sp_neigh_fini(mlxsw_sp);
 	mlxsw_sp_vrs_fini(mlxsw_sp);
 	mlxsw_sp_mr_fini(mlxsw_sp);
@@ -8188,8 +8192,6 @@ void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
 	mlxsw_sp_ipips_fini(mlxsw_sp);
 	mlxsw_sp_rifs_fini(mlxsw_sp);
 	__mlxsw_sp_router_fini(mlxsw_sp);
-	unregister_inet6addr_notifier(&mlxsw_sp->router->inet6addr_nb);
-	unregister_inetaddr_notifier(&mlxsw_sp->router->inetaddr_nb);
 	mutex_destroy(&mlxsw_sp->router->lock);
 	kfree(mlxsw_sp->router);
 }
commit 3c8ce24b037648a5a15b85888b259a74b05ff97d
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 12:26:46 2020 +0300

    mlxsw: core: Free EMAD transactions using kfree_rcu()
    
    The lifetime of EMAD transactions (i.e., 'struct mlxsw_reg_trans') is
    managed using RCU. They are freed using kfree_rcu() once the transaction
    ends.
    
    However, in case the transaction failed it is freed immediately after being
    removed from the active transactions list. This is problematic because it is
    still possible for a different CPU to dereference the transaction from an RCU
    read-side critical section while traversing the active transaction list in
    mlxsw_emad_rx_listener_func(). In which case, a use-after-free is triggered
    [1].
    
    Fix this by freeing the transaction after a grace period by calling
    kfree_rcu().
    
    [1]
    BUG: KASAN: use-after-free in mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671
    Read of size 8 at addr ffff88800b7964e8 by task syz-executor.2/2881
    
    CPU: 0 PID: 2881 Comm: syz-executor.2 Not tainted 5.8.0-rc4+ #44
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <IRQ>
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0xf6/0x16e lib/dump_stack.c:118
     print_address_description.constprop.0+0x1c/0x250 mm/kasan/report.c:383
     __kasan_report mm/kasan/report.c:513 [inline]
     kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
     mlxsw_emad_rx_listener_func+0x969/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:671
     mlxsw_core_skb_receive+0x571/0x700 drivers/net/ethernet/mellanox/mlxsw/core.c:2061
     mlxsw_pci_cqe_rdq_handle drivers/net/ethernet/mellanox/mlxsw/pci.c:595 [inline]
     mlxsw_pci_cq_tasklet+0x12a6/0x2520 drivers/net/ethernet/mellanox/mlxsw/pci.c:651
     tasklet_action_common.isra.0+0x13f/0x3e0 kernel/softirq.c:550
     __do_softirq+0x223/0x964 kernel/softirq.c:292
     asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711
     </IRQ>
     __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
     run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
     do_softirq_own_stack+0x109/0x140 arch/x86/kernel/irq_64.c:77
     invoke_softirq kernel/softirq.c:387 [inline]
     __irq_exit_rcu kernel/softirq.c:417 [inline]
     irq_exit_rcu+0x16f/0x1a0 kernel/softirq.c:429
     sysvec_apic_timer_interrupt+0x4e/0xd0 arch/x86/kernel/apic/apic.c:1091
     asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:587
    RIP: 0010:arch_local_irq_restore arch/x86/include/asm/irqflags.h:85 [inline]
    RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
    RIP: 0010:_raw_spin_unlock_irqrestore+0x3b/0x40 kernel/locking/spinlock.c:191
    Code: e8 2a c3 f4 fc 48 89 ef e8 12 96 f5 fc f6 c7 02 75 11 53 9d e8 d6 db 11 fd 65 ff 0d 1f 21 b3 56 5b 5d c3 e8 a7 d7 11 fd 53 9d <eb> ed 0f 1f 00 55 48 89 fd 65 ff 05 05 21 b3 56 ff 74 24 08 48 8d
    RSP: 0018:ffff8880446ffd80 EFLAGS: 00000286
    RAX: 0000000000000006 RBX: 0000000000000286 RCX: 0000000000000006
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa94ecea9
    RBP: ffff888012934408 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000001 R11: fffffbfff57be301 R12: 1ffff110088dffc1
    R13: ffff888037b817c0 R14: ffff88802442415a R15: ffff888024424000
     __do_sys_perf_event_open+0x1b5d/0x2bd0 kernel/events/core.c:11874
     do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:384
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x473dbd
    Code: Bad RIP value.
    RSP: 002b:00007f21e5e9cc28 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
    RAX: ffffffffffffffda RBX: 000000000057bf00 RCX: 0000000000473dbd
    RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000040
    RBP: 000000000057bf00 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000003 R11: 0000000000000246 R12: 000000000057bf0c
    R13: 00007ffd0493503f R14: 00000000004d0f46 R15: 00007f21e5e9cd80
    
    Allocated by task 871:
     save_stack+0x1b/0x40 mm/kasan/common.c:48
     set_track mm/kasan/common.c:56 [inline]
     __kasan_kmalloc mm/kasan/common.c:494 [inline]
     __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467
     kmalloc include/linux/slab.h:555 [inline]
     kzalloc include/linux/slab.h:669 [inline]
     mlxsw_core_reg_access_emad+0x70/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1812
     mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991
     mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130
     update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173
     process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
     worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
     kthread+0x355/0x470 kernel/kthread.c:291
     ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
    
    Freed by task 871:
     save_stack+0x1b/0x40 mm/kasan/common.c:48
     set_track mm/kasan/common.c:56 [inline]
     kasan_set_free_info mm/kasan/common.c:316 [inline]
     __kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455
     slab_free_hook mm/slub.c:1474 [inline]
     slab_free_freelist_hook mm/slub.c:1507 [inline]
     slab_free mm/slub.c:3072 [inline]
     kfree+0xe6/0x320 mm/slub.c:4052
     mlxsw_core_reg_access_emad+0xd45/0x1410 drivers/net/ethernet/mellanox/mlxsw/core.c:1819
     mlxsw_core_reg_access+0xeb/0x540 drivers/net/ethernet/mellanox/mlxsw/core.c:1991
     mlxsw_sp_port_get_hw_xstats+0x335/0x7e0 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1130
     update_stats_cache+0xf4/0x140 drivers/net/ethernet/mellanox/mlxsw/spectrum.c:1173
     process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
     worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
     kthread+0x355/0x470 kernel/kthread.c:291
     ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
    
    The buggy address belongs to the object at ffff88800b796400
     which belongs to the cache kmalloc-512 of size 512
    The buggy address is located 232 bytes inside of
     512-byte region [ffff88800b796400, ffff88800b796600)
    The buggy address belongs to the page:
    page:ffffea00002de500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00002de500 order:2 compound_mapcount:0 compound_pincount:0
    flags: 0x100000000010200(slab|head)
    raw: 0100000000010200 dead000000000100 dead000000000122 ffff88806c402500
    raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    
    Memory state around the buggy address:
     ffff88800b796380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff88800b796400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    >ffff88800b796480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                              ^
     ffff88800b796500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
     ffff88800b796580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
    
    Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access")
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 5e76a96a118e..71b6185b4904 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -1814,7 +1814,7 @@ static int mlxsw_core_reg_access_emad(struct mlxsw_core *mlxsw_core,
 	err = mlxsw_emad_reg_access(mlxsw_core, reg, payload, type, trans,
 				    bulk_list, cb, cb_priv, tid);
 	if (err) {
-		kfree(trans);
+		kfree_rcu(trans, rcu);
 		return err;
 	}
 	return 0;
commit 7d8e8f3433dc8d1dc87c1aabe73a154978fb4c4d
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 12:26:45 2020 +0300

    mlxsw: core: Increase scope of RCU read-side critical section
    
    The lifetime of the Rx listener item ('rxl_item') is managed using RCU,
    but is dereferenced outside of RCU read-side critical section, which can
    lead to a use-after-free.
    
    Fix this by increasing the scope of the RCU read-side critical section.
    
    Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core")
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index d6d6fe64887b..5e76a96a118e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -2051,11 +2051,13 @@ void mlxsw_core_skb_receive(struct mlxsw_core *mlxsw_core, struct sk_buff *skb,
 			break;
 		}
 	}
-	rcu_read_unlock();
-	if (!found)
+	if (!found) {
+		rcu_read_unlock();
 		goto drop;
+	}
 
 	rxl->func(skb, local_port, rxl_item->priv);
+	rcu_read_unlock();
 	return;
 
 drop:
commit ec4f5b3617049d474b3263792785b638640f2dbe
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 12:26:44 2020 +0300

    mlxsw: spectrum: Use different trap group for externally routed packets
    
    Cited commit mistakenly removed the trap group for externally routed
    packets (e.g., via the management interface) and grouped locally routed
    and externally routed packet traps under the same group, thereby
    subjecting them to the same policer.
    
    This can result in problems, for example, when FRR is restarted and
    suddenly all transient traffic is trapped to the CPU because of a
    default route through the management interface. Locally routed packets
    required to re-establish a BGP connection will never reach the CPU and
    the routing tables will not be re-populated.
    
    Fix this by using a different trap group for externally routed packets.
    
    Fixes: 8110668ecd9a ("mlxsw: spectrum_trap: Register layer 3 control traps")
    Reported-by: Alex Veber <alexve at mellanox.com>
    Tested-by: Alex Veber <alexve at mellanox.com>
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/Documentation/networking/devlink/devlink-trap.rst b/Documentation/networking/devlink/devlink-trap.rst
index 1e3f3ffee248..2014307fbe63 100644
--- a/Documentation/networking/devlink/devlink-trap.rst
+++ b/Documentation/networking/devlink/devlink-trap.rst
@@ -486,6 +486,10 @@ narrow. The description of these groups must be added to the following table:
      - Contains packet traps for packets that should be locally delivered after
        routing, but do not match more specific packet traps (e.g.,
        ``ipv4_bgp``)
+   * - ``external_delivery``
+     - Contains packet traps for packets that should be routed through an
+       external interface (e.g., management interface) that does not belong to
+       the same device (e.g., switch ASIC) as the ingress interface
    * - ``ipv6``
      - Contains packet traps for various IPv6 control packets (e.g., Router
        Advertisements)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index fcb88d4271bf..8ac987c8c8bc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -5536,6 +5536,7 @@ enum mlxsw_reg_htgt_trap_group {
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_MULTICAST,
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_NEIGH_DISCOVERY,
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_ROUTER_EXP,
+	MLXSW_REG_HTGT_TRAP_GROUP_SP_EXTERNAL_ROUTE,
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME,
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_DHCP,
 	MLXSW_REG_HTGT_TRAP_GROUP_SP_EVENT,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c
index 157a42c63066..1e38dfe7cf64 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_trap.c
@@ -328,6 +328,9 @@ mlxsw_sp_trap_policer_items_arr[] = {
 	{
 		.policer = MLXSW_SP_TRAP_POLICER(18, 1024, 128),
 	},
+	{
+		.policer = MLXSW_SP_TRAP_POLICER(19, 1024, 512),
+	},
 };
 
 static const struct mlxsw_sp_trap_group_item mlxsw_sp_trap_group_items_arr[] = {
@@ -421,6 +424,11 @@ static const struct mlxsw_sp_trap_group_item mlxsw_sp_trap_group_items_arr[] = {
 		.hw_group_id = MLXSW_REG_HTGT_TRAP_GROUP_SP_IP2ME,
 		.priority = 2,
 	},
+	{
+		.group = DEVLINK_TRAP_GROUP_GENERIC(EXTERNAL_DELIVERY, 19),
+		.hw_group_id = MLXSW_REG_HTGT_TRAP_GROUP_SP_EXTERNAL_ROUTE,
+		.priority = 1,
+	},
 	{
 		.group = DEVLINK_TRAP_GROUP_GENERIC(IPV6, 15),
 		.hw_group_id = MLXSW_REG_HTGT_TRAP_GROUP_SP_IPV6,
@@ -882,11 +890,11 @@ static const struct mlxsw_sp_trap_item mlxsw_sp_trap_items_arr[] = {
 		},
 	},
 	{
-		.trap = MLXSW_SP_TRAP_CONTROL(EXTERNAL_ROUTE, LOCAL_DELIVERY,
+		.trap = MLXSW_SP_TRAP_CONTROL(EXTERNAL_ROUTE, EXTERNAL_DELIVERY,
 					      TRAP),
 		.listeners_arr = {
-			MLXSW_SP_RXL_MARK(RTR_INGRESS0, IP2ME, TRAP_TO_CPU,
-					  false),
+			MLXSW_SP_RXL_MARK(RTR_INGRESS0, EXTERNAL_ROUTE,
+					  TRAP_TO_CPU, false),
 		},
 	},
 	{
diff --git a/include/net/devlink.h b/include/net/devlink.h
index 1df6dfec26c2..95b0322a2a82 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h
@@ -718,6 +718,7 @@ enum devlink_trap_group_generic_id {
 	DEVLINK_TRAP_GROUP_GENERIC_ID_PIM,
 	DEVLINK_TRAP_GROUP_GENERIC_ID_UC_LB,
 	DEVLINK_TRAP_GROUP_GENERIC_ID_LOCAL_DELIVERY,
+	DEVLINK_TRAP_GROUP_GENERIC_ID_EXTERNAL_DELIVERY,
 	DEVLINK_TRAP_GROUP_GENERIC_ID_IPV6,
 	DEVLINK_TRAP_GROUP_GENERIC_ID_PTP_EVENT,
 	DEVLINK_TRAP_GROUP_GENERIC_ID_PTP_GENERAL,
@@ -915,6 +916,8 @@ enum devlink_trap_group_generic_id {
 	"uc_loopback"
 #define DEVLINK_TRAP_GROUP_GENERIC_NAME_LOCAL_DELIVERY \
 	"local_delivery"
+#define DEVLINK_TRAP_GROUP_GENERIC_NAME_EXTERNAL_DELIVERY \
+	"external_delivery"
 #define DEVLINK_TRAP_GROUP_GENERIC_NAME_IPV6 \
 	"ipv6"
 #define DEVLINK_TRAP_GROUP_GENERIC_NAME_PTP_EVENT \
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 2cafbc808b09..dc2b18475956 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -8567,6 +8567,7 @@ static const struct devlink_trap_group devlink_trap_group_generic[] = {
 	DEVLINK_TRAP_GROUP(PIM),
 	DEVLINK_TRAP_GROUP(UC_LB),
 	DEVLINK_TRAP_GROUP(LOCAL_DELIVERY),
+	DEVLINK_TRAP_GROUP(EXTERNAL_DELIVERY),
 	DEVLINK_TRAP_GROUP(IPV6),
 	DEVLINK_TRAP_GROUP(PTP_EVENT),
 	DEVLINK_TRAP_GROUP(PTP_GENERAL),
commit 89ab53313543b18640eb5d25a1e74bf9eee889b0
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 12:26:43 2020 +0300

    mlxsw: spectrum_router: Allow programming link-local host routes
    
    Cited commit added the ability to program link-local prefix routes to
    the ASIC so that relevant packets are routed and trapped correctly.
    
    However, host routes were not included in the change and thus not
    programmed to the ASIC. This can result in packets being trapped via an
    external route trap instead of a local route trap as in IPv4.
    
    Fix this by programming all the link-local routes to the ASIC.
    
    Fixes: 10d3757fcb07 ("mlxsw: spectrum_router: Allow programming link-local prefix routes")
    Reported-by: Alex Veber <alexve at mellanox.com>
    Tested-by: Alex Veber <alexve at mellanox.com>
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 019ed503aadf..bd4803074776 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -5001,15 +5001,6 @@ static void mlxsw_sp_router_fib4_del(struct mlxsw_sp *mlxsw_sp,
 
 static bool mlxsw_sp_fib6_rt_should_ignore(const struct fib6_info *rt)
 {
-	/* Packets with link-local destination IP arriving to the router
-	 * are trapped to the CPU, so no need to program specific routes
-	 * for them. Only allow prefix routes (usually one fe80::/64) so
-	 * that packets are trapped for the right reason.
-	 */
-	if ((ipv6_addr_type(&rt->fib6_dst.addr) & IPV6_ADDR_LINKLOCAL) &&
-	    (rt->fib6_flags & (RTF_LOCAL | RTF_ANYCAST)))
-		return true;
-
 	/* Multicast routes aren't supported, so ignore them. Neighbour
 	 * Discovery packets are specifically trapped.
 	 */
commit 83f3522860f702748143e022f1a546547314c715
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 11:37:13 2020 +0300

    ipv4: Silence suspicious RCU usage warning
    
    fib_trie_unmerge() is called with RTNL held, but not from an RCU
    read-side critical section. This leads to the following warning [1] when
    the FIB alias list in a leaf is traversed with
    hlist_for_each_entry_rcu().
    
    Since the function is always called with RTNL held and since
    modification of the list is protected by RTNL, simply use
    hlist_for_each_entry() and silence the warning.
    
    [1]
    WARNING: suspicious RCU usage
    5.8.0-rc4-custom-01520-gc1f937f3f83b #30 Not tainted
    -----------------------------
    net/ipv4/fib_trie.c:1867 RCU-list traversed in non-reader section!!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    1 lock held by ip/164:
     #0: ffffffff85a27850 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x49a/0xbd0
    
    stack backtrace:
    CPU: 0 PID: 164 Comm: ip Not tainted 5.8.0-rc4-custom-01520-gc1f937f3f83b #30
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
    Call Trace:
     dump_stack+0x100/0x184
     lockdep_rcu_suspicious+0x153/0x15d
     fib_trie_unmerge+0x608/0xdb0
     fib_unmerge+0x44/0x360
     fib4_rule_configure+0xc8/0xad0
     fib_nl_newrule+0x37a/0x1dd0
     rtnetlink_rcv_msg+0x4f7/0xbd0
     netlink_rcv_skb+0x17a/0x480
     rtnetlink_rcv+0x22/0x30
     netlink_unicast+0x5ae/0x890
     netlink_sendmsg+0x98a/0xf40
     ____sys_sendmsg+0x879/0xa00
     ___sys_sendmsg+0x122/0x190
     __sys_sendmsg+0x103/0x1d0
     __x64_sys_sendmsg+0x7d/0xb0
     do_syscall_64+0x54/0xa0
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7fc80a234e97
    Code: Bad RIP value.
    RSP: 002b:00007ffef8b66798 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
    RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc80a234e97
    RDX: 0000000000000000 RSI: 00007ffef8b66800 RDI: 0000000000000003
    RBP: 000000005f141b1c R08: 0000000000000001 R09: 0000000000000000
    R10: 00007fc80a2a8ac0 R11: 0000000000000246 R12: 0000000000000001
    R13: 0000000000000000 R14: 00007ffef8b67008 R15: 0000556fccb10020
    
    Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse")
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 248f1c1959a6..3c65f71d0e82 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1864,7 +1864,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb)
 	while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
 		struct key_vector *local_l = NULL, *local_tp;
 
-		hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+		hlist_for_each_entry(fa, &l->leaf, fa_list) {
 			struct fib_alias *new_fa;
 
 			if (local_tb->tb_id != fa->tb_id)
commit b5141915b5aec3b29a63db869229e3741ebce258
Author: Ido Schimmel <idosch at mellanox.com>
Date:   Wed Jul 29 11:34:36 2020 +0300

    vxlan: Ensure FDB dump is performed under RCU
    
    The commit cited below removed the RCU read-side critical section from
    rtnl_fdb_dump() which means that the ndo_fdb_dump() callback is invoked
    without RCU protection.
    
    This results in the following warning [1] in the VXLAN driver, which
    relied on the callback being invoked from an RCU read-side critical
    section.
    
    Fix this by calling rcu_read_lock() in the VXLAN driver, as already done
    in the bridge driver.
    
    [1]
    WARNING: suspicious RCU usage
    5.8.0-rc4-custom-01521-g481007553ce6 #29 Not tainted
    -----------------------------
    drivers/net/vxlan.c:1379 RCU-list traversed in non-reader section!!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    1 lock held by bridge/166:
     #0: ffffffff85a27850 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xea/0x1090
    
    stack backtrace:
    CPU: 1 PID: 166 Comm: bridge Not tainted 5.8.0-rc4-custom-01521-g481007553ce6 #29
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014
    Call Trace:
     dump_stack+0x100/0x184
     lockdep_rcu_suspicious+0x153/0x15d
     vxlan_fdb_dump+0x51e/0x6d0
     rtnl_fdb_dump+0x4dc/0xad0
     netlink_dump+0x540/0x1090
     __netlink_dump_start+0x695/0x950
     rtnetlink_rcv_msg+0x802/0xbd0
     netlink_rcv_skb+0x17a/0x480
     rtnetlink_rcv+0x22/0x30
     netlink_unicast+0x5ae/0x890
     netlink_sendmsg+0x98a/0xf40
     __sys_sendto+0x279/0x3b0
     __x64_sys_sendto+0xe6/0x1a0
     do_syscall_64+0x54/0xa0
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7fe14fa2ade0
    Code: Bad RIP value.
    RSP: 002b:00007fff75bb5b88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
    RAX: ffffffffffffffda RBX: 00005614b1ba0020 RCX: 00007fe14fa2ade0
    RDX: 000000000000011c RSI: 00007fff75bb5b90 RDI: 0000000000000003
    RBP: 00007fff75bb5b90 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000246 R12: 00005614b1b89160
    R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
    
    Fixes: 5e6d24358799 ("bridge: netlink dump interface at par with brctl")
    Signed-off-by: Ido Schimmel <idosch at mellanox.com>
    Reviewed-by: Jiri Pirko <jiri at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 89d85dcb200e..5efe1e28f270 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1376,6 +1376,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 	for (h = 0; h < FDB_HASH_SIZE; ++h) {
 		struct vxlan_fdb *f;
 
+		rcu_read_lock();
 		hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) {
 			struct vxlan_rdst *rd;
 
@@ -1387,8 +1388,10 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
 						     cb->nlh->nlmsg_seq,
 						     RTM_NEWNEIGH,
 						     NLM_F_MULTI, NULL);
-				if (err < 0)
+				if (err < 0) {
+					rcu_read_unlock();
 					goto out;
+				}
 skip_nh:
 				*idx += 1;
 				continue;
@@ -1403,12 +1406,15 @@ skip_nh:
 						     cb->nlh->nlmsg_seq,
 						     RTM_NEWNEIGH,
 						     NLM_F_MULTI, rd);
-				if (err < 0)
+				if (err < 0) {
+					rcu_read_unlock();
 					goto out;
+				}
 skip:
 				*idx += 1;
 			}
 		}
+		rcu_read_unlock();
 	}
 out:
 	return err;
commit 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5
Author: Mike Marciniszyn <mike.marciniszyn at intel.com>
Date:   Tue Jul 28 14:38:48 2020 -0400

    IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
    
    The lookaside count is improperly initialized to the size of the
    Receive Queue with the additional +1.  In the traces below, the
    RQ size is 384, so the count was set to 385.
    
    The lookaside count is then rarely refreshed.  Note the high and
    incorrect count in the trace below:
    
    rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
            qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
    rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
    
    The head,tail indicate there is only one RWQE posted although the count
    says 385 and we correctly return the element 0.
    
    The next call to rvt_get_rwqe with the decremented count:
    
    rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
            qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
    rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
    
    Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
    which is not valid because of the bogus high count.
    
    Best case, the RWQE has never been posted and the rc logic sees an RWQE
    that is too small (all zeros) and puts the QP into an error state.
    
    In the worst case, a server slow at posting receive buffers might fool
    rvt_get_rwqe() into fetching an old RWQE and corrupt memory.
    
    Fix by deleting the faulty initialization code and creating an
    inline to fetch the posted count and convert all callers to use
    new inline.
    
    Fixes: f592ae3c999f ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
    Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.com
    Reported-by: Zhaojuan Guo <zguo at redhat.com>
    Cc: <stable at vger.kernel.org> # 5.4.x
    Reviewed-by: Kaike Wan <kaike.wan at intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn at intel.com>
    Tested-by: Honggang Li <honli at redhat.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 7db35dd6ad74..332a8ba94b81 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -901,8 +901,6 @@ static void rvt_init_qp(struct rvt_dev_info *rdi, struct rvt_qp *qp,
 	qp->s_tail_ack_queue = 0;
 	qp->s_acked_ack_queue = 0;
 	qp->s_num_rd_atomic = 0;
-	if (qp->r_rq.kwq)
-		qp->r_rq.kwq->count = qp->r_rq.size;
 	qp->r_sge.num_sge = 0;
 	atomic_set(&qp->s_reserved_used, 0);
 }
@@ -2366,31 +2364,6 @@ bad_lkey:
 	return 0;
 }
 
-/**
- * get_count - count numbers of request work queue entries
- * in circular buffer
- * @rq: data structure for request queue entry
- * @tail: tail indices of the circular buffer
- * @head: head indices of the circular buffer
- *
- * Return - total number of entries in the circular buffer
- */
-static u32 get_count(struct rvt_rq *rq, u32 tail, u32 head)
-{
-	u32 count;
-
-	count = head;
-
-	if (count >= rq->size)
-		count = 0;
-	if (count < tail)
-		count += rq->size - tail;
-	else
-		count -= tail;
-
-	return count;
-}
-
 /**
  * get_rvt_head - get head indices of the circular buffer
  * @rq: data structure for request queue entry
@@ -2465,7 +2438,7 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool wr_id_only)
 
 	if (kwq->count < RVT_RWQ_COUNT_THRESHOLD) {
 		head = get_rvt_head(rq, ip);
-		kwq->count = get_count(rq, tail, head);
+		kwq->count = rvt_get_rq_count(rq, head, tail);
 	}
 	if (unlikely(kwq->count == 0)) {
 		ret = 0;
@@ -2500,7 +2473,9 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool wr_id_only)
 		 * the number of remaining WQEs.
 		 */
 		if (kwq->count < srq->limit) {
-			kwq->count = get_count(rq, tail, get_rvt_head(rq, ip));
+			kwq->count =
+				rvt_get_rq_count(rq,
+						 get_rvt_head(rq, ip), tail);
 			if (kwq->count < srq->limit) {
 				struct ib_event ev;
 
diff --git a/drivers/infiniband/sw/rdmavt/rc.c b/drivers/infiniband/sw/rdmavt/rc.c
index 977906cc0d11..c58735f4c94a 100644
--- a/drivers/infiniband/sw/rdmavt/rc.c
+++ b/drivers/infiniband/sw/rdmavt/rc.c
@@ -127,9 +127,7 @@ __be32 rvt_compute_aeth(struct rvt_qp *qp)
 			 * not atomic, which is OK, since the fuzziness is
 			 * resolved as further ACKs go out.
 			 */
-			credits = head - tail;
-			if ((int)credits < 0)
-				credits += qp->r_rq.size;
+			credits = rvt_get_rq_count(&qp->r_rq, head, tail);
 		}
 		/*
 		 * Binary search the credit table to find the code to
diff --git a/include/rdma/rdmavt_qp.h b/include/rdma/rdmavt_qp.h
index c4369a6c2951..2f1fc23602cb 100644
--- a/include/rdma/rdmavt_qp.h
+++ b/include/rdma/rdmavt_qp.h
@@ -305,6 +305,25 @@ struct rvt_rq {
 	spinlock_t lock ____cacheline_aligned_in_smp;
 };
 
+/**
+ * rvt_get_rq_count - count numbers of request work queue entries
+ * in circular buffer
+ * @rq: data structure for request queue entry
+ * @head: head indices of the circular buffer
+ * @tail: tail indices of the circular buffer
+ *
+ * Return - total number of entries in the Receive Queue
+ */
+
+static inline u32 rvt_get_rq_count(struct rvt_rq *rq, u32 head, u32 tail)
+{
+	u32 count = head - tail;
+
+	if ((s32)count < 0)
+		count += rq->size;
+	return count;
+}
+
 /*
  * This structure holds the information that the send tasklet needs
  * to send a RDMA read response or atomic operation.
commit c2f3850df7f95537e79c561f7be49df2e4ad8060
Merge: f227e3ec3b5c a4a2739beb89
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 29 11:39:20 2020 -0700

    Merge tag 'drm-fixes-2020-07-29' of git://anongit.freedesktop.org/drm/drm into master
    
    Pull drm fixes from Dave Airlie:
     "The nouveau fixes missed the last pull by a few hours, and we had a
      few arm driver/panel/bridge fixes come in.
    
      This is possibly a bit more than I'm comfortable sending at this
      stage, but I've looked at each patch, the core + nouveau patches fix
      regressions, and the arm related ones are all around screens turning
      on and working, and are mostly trivial patches, the line count is
      mostly in comments.
    
      core:
       - fix possible use-after-free
    
      drm_fb_helper:
       - regression fix to use memcpy_io on bochs' sparc64
    
      nouveau:
       - format modifiers fixes
       - HDA regression fix
       - turing modesetting race fix
    
      of:
       - fix a double free
    
      dbi:
       - fix SPI Type 1 transfer
    
      mcde:
       - fix screen stability crash
    
      panel:
       - panel: fix display noise on auo,kd101n80-45na
       - panel: delay HPD checks for boe_nv133fhm_n61
    
      bridge:
       - bridge: drop connector check in nwl-dsi bridge
       - bridge: set proper bridge type for adv7511"
    
    * tag 'drm-fixes-2020-07-29' of git://anongit.freedesktop.org/drm/drm:
      drm: hold gem reference until object is no longer accessed
      drm/dbi: Fix SPI Type 1 (9-bit) transfer
      drm/drm_fb_helper: fix fbdev with sparc64
      drm/mcde: Fix stability issue
      drm/bridge: nwl-dsi: Drop DRM_BRIDGE_ATTACH_NO_CONNECTOR check.
      drm/panel: Fix auo, kd101n80-45na horizontal noise on edges of panel
      drm: panel: simple: Delay HPD checking on boe_nv133fhm_n61 for 15 ms
      drm/bridge/adv7511: set the bridge type properly
      drm: of: Fix double-free bug
      drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
      drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
      drm/nouveau/kms/tu102: wait for core update to complete when assigning windows
      drm/nouveau/kms/gf100: use correct format modifiers
      drm/nouveau/disp/gm200-: fix regression from HDA SOR selection changes

commit f227e3ec3b5cad859ad15666874405e8c1bbc1d4
Author: Willy Tarreau <w at 1wt.eu>
Date:   Fri Jul 10 15:23:19 2020 +0200

    random32: update the net random state on interrupt and activity
    
    This modifies the first 32 bits out of the 128 bits of a random CPU's
    net_rand_state on interrupt or CPU activity to complicate remote
    observations that could lead to guessing the network RNG's internal
    state.
    
    Note that depending on some network devices' interrupt rate moderation
    or binding, this re-seeding might happen on every packet or even almost
    never.
    
    In addition, with NOHZ some CPUs might not even get timer interrupts,
    leaving their local state rarely updated, while they are running
    networked processes making use of the random state.  For this reason, we
    also perform this update in update_process_times() in order to at least
    update the state when there is user or system activity, since it's the
    only case we care about.
    
    Reported-by: Amit Klein <aksecurity at gmail.com>
    Suggested-by: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Eric Dumazet <edumazet at google.com>
    Cc: "Jason A. Donenfeld" <Jason at zx2c4.com>
    Cc: Andy Lutomirski <luto at kernel.org>
    Cc: Kees Cook <keescook at chromium.org>
    Cc: Thomas Gleixner <tglx at linutronix.de>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: <stable at vger.kernel.org>
    Signed-off-by: Willy Tarreau <w at 1wt.eu>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 2a41b21623ae..d20ba1b104ca 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1277,6 +1277,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
 
 	fast_mix(fast_pool);
 	add_interrupt_bench(cycles);
+	this_cpu_add(net_rand_state.s1, fast_pool->pool[cycles & 3]);
 
 	if (unlikely(crng_init == 0)) {
 		if ((fast_pool->count >= 64) &&
diff --git a/include/linux/random.h b/include/linux/random.h
index 45e1f8fa742b..39aaa1f78f9d 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/once.h>
+#include <linux/percpu.h>
 
 #include <uapi/linux/random.h>
 
@@ -119,6 +120,8 @@ struct rnd_state {
 	__u32 s1, s2, s3, s4;
 };
 
+DECLARE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+
 u32 prandom_u32_state(struct rnd_state *state);
 void prandom_bytes_state(struct rnd_state *state, void *buf, size_t nbytes);
 void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state);
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index df1ff803acc4..026ac01af9da 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -43,6 +43,7 @@
 #include <linux/sched/debug.h>
 #include <linux/slab.h>
 #include <linux/compat.h>
+#include <linux/random.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -1742,6 +1743,13 @@ void update_process_times(int user_tick)
 	scheduler_tick();
 	if (IS_ENABLED(CONFIG_POSIX_TIMERS))
 		run_posix_cpu_timers();
+
+	/* The current CPU might make use of net randoms without receiving IRQs
+	 * to renew them often enough. Let's update the net_rand_state from a
+	 * non-constant value that's not affine to the number of calls to make
+	 * sure it's updated when there's some activity (we don't care in idle).
+	 */
+	this_cpu_add(net_rand_state.s1, rol32(jiffies, 24) + user_tick);
 }
 
 /**
diff --git a/lib/random32.c b/lib/random32.c
index 763b920a6206..c4d317be2997 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -48,7 +48,7 @@ static inline void prandom_state_selftest(void)
 }
 #endif
 
-static DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
+DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
 
 /**
  *	prandom_u32_state - seeded pseudo-random number generator.
commit 168c358af2f8c5a37f8b5f877ba2cc93995606ee
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Mon Jul 27 12:01:27 2020 -0400

    virtio_balloon: fix up endian-ness for free cmd id
    
    free cmd id is read using virtio endian, spec says all fields
    in balloon are LE. Fix it up.
    
    Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
    Cc: stable at vger.kernel.org
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Reviewed-by: Wei Wang <wei.w.wang at intel.com>
    Acked-by: David Hildenbrand <david at redhat.com>

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index d0fd8f8dc6ed..8be02f333b7a 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -578,10 +578,14 @@ static int init_vqs(struct virtio_balloon *vb)
 static u32 virtio_balloon_cmd_id_received(struct virtio_balloon *vb)
 {
 	if (test_and_clear_bit(VIRTIO_BALLOON_CONFIG_READ_CMD_ID,
-			       &vb->config_read_bitmap))
+			       &vb->config_read_bitmap)) {
 		virtio_cread(vb->vdev, struct virtio_balloon_config,
 			     free_page_hint_cmd_id,
 			     &vb->cmd_id_received_cache);
+		/* Legacy balloon config space is LE, unlike all other devices. */
+		if (!virtio_has_feature(vb->vdev, VIRTIO_F_VERSION_1))
+			vb->cmd_id_received_cache = le32_to_cpu((__force __le32)vb->cmd_id_received_cache);
+	}
 
 	return vb->cmd_id_received_cache;
 }
commit ca72cc348355fbc969f5fa00fa94d584920d403b
Author: Alexander Duyck <alexander.h.duyck at linux.intel.com>
Date:   Mon Jul 13 13:35:39 2020 -0700

    virtio-balloon: Document byte ordering of poison_val
    
    The poison_val field in the virtio_balloon_config is treated as a
    little-endian field by the host. Since we are currently only having to deal
    with a single byte poison value this isn't a problem, however if the value
    should ever expand it would cause byte ordering issues. Document that in
    the code so that we know that if the value should ever expand we need to
    byte swap the value on big-endian architectures.
    
    Signed-off-by: Alexander Duyck <alexander.h.duyck at linux.intel.com>
    Link: https://lore.kernel.org/r/20200713203539.17140.71425.stgit@localhost.localdomain
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Acked-by: David Hildenbrand <david at redhat.com>

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 1f157d2f4952..d0fd8f8dc6ed 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -974,6 +974,11 @@ static int virtballoon_probe(struct virtio_device *vdev)
 		/*
 		 * Let the hypervisor know that we are expecting a
 		 * specific value to be written back in balloon pages.
+		 *
+		 * If the PAGE_POISON value was larger than a byte we would
+		 * need to byte swap poison_val here to guarantee it is
+		 * little-endian. However for now it is a single byte so we
+		 * can pass it as-is.
 		 */
 		if (!want_init_on_free())
 			memset(&poison_val, PAGE_POISON, sizeof(poison_val));
commit 295c1b9852d000580786375304a9800bd9634d15
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Fri Jul 10 06:36:16 2020 -0400

    vhost/scsi: fix up req type endian-ness
    
    vhost/scsi doesn't handle type conversion correctly
    for request type when using virtio 1.0 and up for BE,
    or cross-endian platforms.
    
    Fix it up using vhost_32_to_cpu.
    
    Cc: stable at vger.kernel.org
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 6fb4d7ecfa19..b22adf03f584 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1215,7 +1215,7 @@ vhost_scsi_ctl_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
 			continue;
 		}
 
-		switch (v_req.type) {
+		switch (vhost32_to_cpu(vq, v_req.type)) {
 		case VIRTIO_SCSI_T_TMF:
 			vc.req = &v_req.tmf;
 			vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);
commit d6364a867ccbf34a6afe0d57721ff64aa43befcd
Merge: 1f273e255b28 5bedd3afee8e
Author: Jens Axboe <axboe at kernel.dk>
Date:   Wed Jul 29 11:21:14 2020 -0600

    Merge branch 'nvme-5.8' of git://git.infradead.org/nvme into block-5.8
    
    Pull NVMe fixes from Christoph.
    
    * 'nvme-5.8' of git://git.infradead.org/nvme:
      nvme: add a Identify Namespace Identification Descriptor list quirk
      nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
      nvme-tcp: fix possible hang waiting for icresp response

commit 81530ab08ef002f90b7dc68f5a69816b0e3be803
Author: Leon Romanovsky <leonro at mellanox.com>
Date:   Tue Jul 28 15:02:55 2020 +0300

    RDMA/mlx5: Allow providing extra scatter CQE QP flag
    
    Scatter CQE feature relies on two flags MLX5_QP_FLAG_SCATTER_CQE and
    MLX5_QP_FLAG_ALLOW_SCATTER_CQE, both of them can be provided without
    relation to device capability.
    
    Relax global validity check to allow MLX5_QP_FLAG_ALLOW_SCATTER_CQE QP
    flag.
    
    Existing user applications are failing on this new validity check.
    
    Fixes: 90ecb37a751b ("RDMA/mlx5: Change scatter CQE flag to be set like other vendor flags")
    Fixes: 37518fa49f76 ("RDMA/mlx5: Process all vendor flags in one place")
    Link: https://lore.kernel.org/r/20200728120255.805733-1-leon@kernel.org
    Reviewed-by: Artemy Kovalyov <artemyko at mellanox.com>
    Signed-off-by: Leon Romanovsky <leonro at mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index e050eade97a1..42620f88e393 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1766,15 +1766,14 @@ err:
 }
 
 static void configure_requester_scat_cqe(struct mlx5_ib_dev *dev,
+					 struct mlx5_ib_qp *qp,
 					 struct ib_qp_init_attr *init_attr,
-					 struct mlx5_ib_create_qp *ucmd,
 					 void *qpc)
 {
 	int scqe_sz;
 	bool allow_scat_cqe = false;
 
-	if (ucmd)
-		allow_scat_cqe = ucmd->flags & MLX5_QP_FLAG_ALLOW_SCATTER_CQE;
+	allow_scat_cqe = qp->flags_en & MLX5_QP_FLAG_ALLOW_SCATTER_CQE;
 
 	if (!allow_scat_cqe && init_attr->sq_sig_type != IB_SIGNAL_ALL_WR)
 		return;
@@ -2012,7 +2011,7 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
 	}
 	if ((qp->flags_en & MLX5_QP_FLAG_SCATTER_CQE) &&
 	    (qp->type == MLX5_IB_QPT_DCI || qp->type == IB_QPT_RC))
-		configure_requester_scat_cqe(dev, init_attr, ucmd, qpc);
+		configure_requester_scat_cqe(dev, qp, init_attr, qpc);
 
 	if (qp->rq.wqe_cnt) {
 		MLX5_SET(qpc, qpc, log_rq_stride, qp->rq.wqe_shift - 4);
@@ -2543,13 +2542,18 @@ static void process_vendor_flag(struct mlx5_ib_dev *dev, int *flags, int flag,
 		return;
 	}
 
-	if (flag == MLX5_QP_FLAG_SCATTER_CQE) {
+	switch (flag) {
+	case MLX5_QP_FLAG_SCATTER_CQE:
+	case MLX5_QP_FLAG_ALLOW_SCATTER_CQE:
 		/*
-		 * We don't return error if this flag was provided,
-		 * and mlx5 doesn't have right capability.
-		 */
-		*flags &= ~MLX5_QP_FLAG_SCATTER_CQE;
+			 * We don't return error if these flags were provided,
+			 * and mlx5 doesn't have right capability.
+			 */
+		*flags &= ~(MLX5_QP_FLAG_SCATTER_CQE |
+			    MLX5_QP_FLAG_ALLOW_SCATTER_CQE);
 		return;
+	default:
+		break;
 	}
 	mlx5_ib_dbg(dev, "Vendor create QP flag 0x%X is not supported\n", flag);
 }
@@ -2589,6 +2593,8 @@ static int process_vendor_flags(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
 	process_vendor_flag(dev, &flags, MLX5_QP_FLAG_SIGNATURE, true, qp);
 	process_vendor_flag(dev, &flags, MLX5_QP_FLAG_SCATTER_CQE,
 			    MLX5_CAP_GEN(mdev, sctr_data_cqe), qp);
+	process_vendor_flag(dev, &flags, MLX5_QP_FLAG_ALLOW_SCATTER_CQE,
+			    MLX5_CAP_GEN(mdev, sctr_data_cqe), qp);
 
 	if (qp->type == IB_QPT_RAW_PACKET) {
 		cond = MLX5_CAP_ETH(mdev, tunnel_stateless_vxlan) ||
commit fe3c60684377d5ad9b0569b87ed3e26e12c8173b
Author: Qiushi Wu <wu000273 at umn.edu>
Date:   Sat Jun 13 14:05:33 2020 -0500

    firmware: Fix a reference count leak.
    
    kobject_init_and_add() takes reference even when it fails.
    If this function returns an error, kobject_put() must be called to
    properly clean up the memory associated with the object.
    Callback function fw_cfg_sysfs_release_entry() in kobject_put()
    can handle the pointer "entry" properly.
    
    Signed-off-by: Qiushi Wu <wu000273 at umn.edu>
    Link: https://lore.kernel.org/r/20200613190533.15712-1-wu000273@umn.edu
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
index 039e0f91dba8..6945c3c96637 100644
--- a/drivers/firmware/qemu_fw_cfg.c
+++ b/drivers/firmware/qemu_fw_cfg.c
@@ -605,8 +605,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
 	/* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */
 	err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
 				   fw_cfg_sel_ko, "%d", entry->select);
-	if (err)
-		goto err_register;
+	if (err) {
+		kobject_put(&entry->kobj);
+		return err;
+	}
 
 	/* add raw binary content access */
 	err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
@@ -622,7 +624,6 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
 
 err_add_raw:
 	kobject_del(&entry->kobj);
-err_register:
 	kfree(entry);
 	return err;
 }
commit bdd65589593edd79b6a12ce86b3b7a7c6dae5208
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Wed Jul 29 10:53:28 2020 +0200

    x86/i8259: Use printk_deferred() to prevent deadlock
    
    0day reported a possible circular locking dependency:
    
    Chain exists of:
      &irq_desc_lock_class --> console_owner --> &port_lock_key
    
     Possible unsafe locking scenario:
    
           CPU0                    CPU1
           ----                    ----
      lock(&port_lock_key);
                                   lock(console_owner);
                                   lock(&port_lock_key);
      lock(&irq_desc_lock_class);
    
    The reason for this is a printk() in the i8259 interrupt chip driver
    which is invoked with the irq descriptor lock held, which reverses the
    lock operations vs. printk() from arbitrary contexts.
    
    Switch the printk() to printk_deferred() to avoid that.
    
    Reported-by: kernel test robot <lkp at intel.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Signed-off-by: Ingo Molnar <mingo at kernel.org>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/87365abt2v.fsf@nanos.tec.linutronix.de

diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
index f3c76252247d..282b4ee1339f 100644
--- a/arch/x86/kernel/i8259.c
+++ b/arch/x86/kernel/i8259.c
@@ -207,7 +207,7 @@ spurious_8259A_irq:
 		 * lets ACK and report it. [once per IRQ]
 		 */
 		if (!(spurious_irq_mask & irqmask)) {
-			printk(KERN_DEBUG
+			printk_deferred(KERN_DEBUG
 			       "spurious 8259A interrupt: IRQ%d.\n", irq);
 			spurious_irq_mask |= irqmask;
 		}
commit 8ac68dc455d9d18241d44b96800d73229029ed34
Author: Paul Moore <paul at paul-moore.com>
Date:   Tue Jul 28 15:33:21 2020 -0400

    revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
    
    Unfortunately the commit listed in the subject line above failed
    to ensure that the task's audit_context was properly initialized/set
    before enabling the "accompanying records".  Depending on the
    situation, the resulting audit_context could have invalid values in
    some of it's fields which could cause a kernel panic/oops when the
    task/syscall exists and the audit records are generated.
    
    We will revisit the original patch, with the necessary fixes, in a
    future kernel but right now we just want to fix the kernel panic
    with the least amount of added risk.
    
    Cc: stable at vger.kernel.org
    Fixes: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
    Reported-by: j2468h at googlemail.com
    Signed-off-by: Paul Moore <paul at paul-moore.com>

diff --git a/kernel/audit.c b/kernel/audit.c
index e33460e01b3b..9bf2b08b051f 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1848,7 +1848,6 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 	}
 
 	audit_get_stamp(ab->ctx, &t, &serial);
-	audit_clear_dummy(ab->ctx);
 	audit_log_format(ab, "audit(%llu.%03lu:%u): ",
 			 (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
 
diff --git a/kernel/audit.h b/kernel/audit.h
index f0233dc40b17..ddc22878433d 100644
--- a/kernel/audit.h
+++ b/kernel/audit.h
@@ -290,13 +290,6 @@ extern int audit_signal_info_syscall(struct task_struct *t);
 extern void audit_filter_inodes(struct task_struct *tsk,
 				struct audit_context *ctx);
 extern struct list_head *audit_killed_trees(void);
-
-static inline void audit_clear_dummy(struct audit_context *ctx)
-{
-	if (ctx)
-		ctx->dummy = 0;
-}
-
 #else /* CONFIG_AUDITSYSCALL */
 #define auditsc_get_stamp(c, t, s) 0
 #define audit_put_watch(w) {}
@@ -330,7 +323,6 @@ static inline int audit_signal_info_syscall(struct task_struct *t)
 }
 
 #define audit_filter_inodes(t, c) AUDIT_DISABLED
-#define audit_clear_dummy(c) {}
 #endif /* CONFIG_AUDITSYSCALL */
 
 extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 468a23390457..fd840c40abf7 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1417,6 +1417,9 @@ static void audit_log_proctitle(void)
 	struct audit_context *context = audit_context();
 	struct audit_buffer *ab;
 
+	if (!context || context->dummy)
+		return;
+
 	ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
 	if (!ab)
 		return;	/* audit_panic or being filtered */
commit 7fcd9bb5acd01250bcae1ecc0cb8b8d4bb5b7e63
Author: Ranjani Sridharan <ranjani.sridharan at linux.intel.com>
Date:   Tue Jul 28 16:10:11 2020 -0700

    ALSA: hda: fix NULL pointer dereference during suspend
    
    When the ASoC card registration fails and the codec component driver
    never probes, the codec device is not initialized and therefore
    memory for codec->wcaps is not allocated. This results in a NULL pointer
    dereference when the codec driver suspend callback is invoked during
    system suspend. Fix this by returning without performing any actions
    during codec suspend/resume if the card was not registered successfully.
    
    Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>
    Signed-off-by: Ranjani Sridharan <ranjani.sridharan at linux.intel.com>
    Link: https://lore.kernel.org/r/20200728231011.1454066-1-ranjani.sridharan@linux.intel.com
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 7e3ae4534df9..803978d69e3c 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -2935,6 +2935,10 @@ static int hda_codec_runtime_suspend(struct device *dev)
 	struct hda_codec *codec = dev_to_hda_codec(dev);
 	unsigned int state;
 
+	/* Nothing to do if card registration fails and the component driver never probes */
+	if (!codec->card)
+		return 0;
+
 	cancel_delayed_work_sync(&codec->jackpoll_work);
 	state = hda_call_codec_suspend(codec);
 	if (codec->link_down_at_suspend ||
@@ -2949,6 +2953,10 @@ static int hda_codec_runtime_resume(struct device *dev)
 {
 	struct hda_codec *codec = dev_to_hda_codec(dev);
 
+	/* Nothing to do if card registration fails and the component driver never probes */
+	if (!codec->card)
+		return 0;
+
 	codec_display_power(codec, true);
 	snd_hdac_codec_link_up(&codec->core);
 	hda_call_codec_resume(codec);
commit 5bedd3afee8eb01ccd256f0cd2cc0fa6f841417a
Author: Christoph Hellwig <hch at lst.de>
Date:   Tue Jul 28 13:09:03 2020 +0200

    nvme: add a Identify Namespace Identification Descriptor list quirk
    
    Add a quirk for a device that does not support the Identify Namespace
    Identification Descriptor list despite claiming 1.3 compliance.
    
    Fixes: ea43d9709f72 ("nvme: fix identify error status silent ignore")
    Reported-by: Ingo Brunberg <ingo_brunberg at web.de>
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Tested-by: Ingo Brunberg <ingo_brunberg at web.de>
    Reviewed-by: Sagi Grimberg <sagi at grimberg.me>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index add040168e67..4ee2330c603e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1102,6 +1102,9 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid,
 	int pos;
 	int len;
 
+	if (ctrl->quirks & NVME_QUIRK_NO_NS_DESC_LIST)
+		return 0;
+
 	c.identify.opcode = nvme_admin_identify;
 	c.identify.nsid = cpu_to_le32(nsid);
 	c.identify.cns = NVME_ID_CNS_NS_DESC_LIST;
@@ -1115,18 +1118,6 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid,
 	if (status) {
 		dev_warn(ctrl->device,
 			"Identify Descriptors failed (%d)\n", status);
-		 /*
-		  * Don't treat non-retryable errors as fatal, as we potentially
-		  * already have a NGUID or EUI-64.  If we failed with DNR set,
-		  * we want to silently ignore the error as we can still
-		  * identify the device, but if the status has DNR set, we want
-		  * to propagate the error back specifically for the disk
-		  * revalidation flow to make sure we don't abandon the
-		  * device just because of a temporal retry-able error (such
-		  * as path of transport errors).
-		  */
-		if (status > 0 && (status & NVME_SC_DNR))
-			status = 0;
 		goto free_data;
 	}
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 1de3f9b827aa..09ffc3246f60 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -129,6 +129,13 @@ enum nvme_quirks {
 	 * Don't change the value of the temperature threshold feature
 	 */
 	NVME_QUIRK_NO_TEMP_THRESH_CHANGE	= (1 << 14),
+
+	/*
+	 * The controller doesn't handle the Identify Namespace
+	 * Identification Descriptor list subcommand despite claiming
+	 * NVMe 1.3 compliance.
+	 */
+	NVME_QUIRK_NO_NS_DESC_LIST		= (1 << 15),
 };
 
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 25a187e43dbe..d4b1ff747123 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3099,6 +3099,8 @@ static const struct pci_device_id nvme_id_table[] = {
 	{ PCI_VDEVICE(INTEL, 0x5845),	/* Qemu emulated controller */
 		.driver_data = NVME_QUIRK_IDENTIFY_CNS |
 				NVME_QUIRK_DISABLE_WRITE_ZEROES, },
+	{ PCI_DEVICE(0x126f, 0x2263),	/* Silicon Motion unidentified */
+		.driver_data = NVME_QUIRK_NO_NS_DESC_LIST, },
 	{ PCI_DEVICE(0x1bb1, 0x0100),   /* Seagate Nytro Flash Storage */
 		.driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
 	{ PCI_DEVICE(0x1c58, 0x0003),	/* HGST adapter */
commit a4a2739beb8933a19281bca077fdb852598803ed
Merge: 0d7869805a82 8490d6a7e0a0
Author: Dave Airlie <airlied at redhat.com>
Date:   Wed Jul 29 12:44:45 2020 +1000

    Merge tag 'drm-misc-fixes-2020-07-28' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
    
     * drm: fix possible use-after-free
     * dbi: fix SPI Type 1 transfer
     * drm_fb_helper: use memcpy_io on bochs' sparc64
     * mcde: fix stability
     * panel: fix display noise on auo,kd101n80-45na
     * panel: delay HPD checks for boe_nv133fhm_n61
     * bridge: drop connector check in nwl-dsi bridge
     * bridge: set proper bridge type for adv7511
     * of: fix a double free
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    
    From: Thomas Zimmermann <tzimmermann at suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200728110446.GA8076@linux-uq9g

commit 1ed06dbc213e1408ab60faa3ac0c0855a3ddc52d
Author: Martin Varghese <martin.varghese at nokia.com>
Date:   Tue Jul 28 22:35:52 2020 +0530

    Documentation: bareudp: Corrected description of bareudp module.
    
    Removed redundant words.
    
    Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.")
    Signed-off-by: Martin Varghese <martin.varghese at nokia.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/Documentation/networking/bareudp.rst b/Documentation/networking/bareudp.rst
index ff406563ea88..b9d04ee6dac1 100644
--- a/Documentation/networking/bareudp.rst
+++ b/Documentation/networking/bareudp.rst
@@ -8,9 +8,8 @@ There are various L3 encapsulation standards using UDP being discussed to
 leverage the UDP based load balancing capability of different networks.
 MPLSoUDP (__ https://tools.ietf.org/html/rfc7510) is one among them.
 
-The Bareudp tunnel module provides a generic L3 encapsulation tunnelling
-support for tunnelling different L3 protocols like MPLS, IP, NSH etc. inside
-a UDP tunnel.
+The Bareudp tunnel module provides a generic L3 encapsulation support for
+tunnelling different L3 protocols like MPLS, IP, NSH etc. inside a UDP tunnel.
 
 Special Handling
 ----------------
commit 302d201b5cdf6f4781ee6cd9862f377f975d6c43
Author: Guillaume Nault <gnault at redhat.com>
Date:   Sat Jul 25 15:06:47 2020 +0200

    bareudp: forbid mixing IP and MPLS in multiproto mode
    
    In multiproto mode, bareudp_xmit() accepts sending multicast MPLS and
    IPv6 packets regardless of the bareudp ethertype. In practice, this
    let an IP tunnel send multicast MPLS packets, or an MPLS tunnel send
    IPv6 packets.
    
    We need to restrict the test further, so that the multiproto mode only
    enables
      * IPv6 for IPv4 tunnels,
      * or multicast MPLS for unicast MPLS tunnels.
    
    To improve clarity, the protocol validation is moved to its own
    function, where each logical test has its own condition.
    
    v2: s/ntohs/htons/
    
    Fixes: 4b5f67232d95 ("net: Special handling for IP & MPLS.")
    Signed-off-by: Guillaume Nault <gnault at redhat.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c
index 3dd46cd55114..88e7900853db 100644
--- a/drivers/net/bareudp.c
+++ b/drivers/net/bareudp.c
@@ -407,19 +407,34 @@ free_dst:
 	return err;
 }
 
+static bool bareudp_proto_valid(struct bareudp_dev *bareudp, __be16 proto)
+{
+	if (bareudp->ethertype == proto)
+		return true;
+
+	if (!bareudp->multi_proto_mode)
+		return false;
+
+	if (bareudp->ethertype == htons(ETH_P_MPLS_UC) &&
+	    proto == htons(ETH_P_MPLS_MC))
+		return true;
+
+	if (bareudp->ethertype == htons(ETH_P_IP) &&
+	    proto == htons(ETH_P_IPV6))
+		return true;
+
+	return false;
+}
+
 static netdev_tx_t bareudp_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct bareudp_dev *bareudp = netdev_priv(dev);
 	struct ip_tunnel_info *info = NULL;
 	int err;
 
-	if (skb->protocol != bareudp->ethertype) {
-		if (!bareudp->multi_proto_mode ||
-		    (skb->protocol !=  htons(ETH_P_MPLS_MC) &&
-		     skb->protocol !=  htons(ETH_P_IPV6))) {
-			err = -EINVAL;
-			goto tx_error;
-		}
+	if (!bareudp_proto_valid(bareudp, skb->protocol)) {
+		err = -EINVAL;
+		goto tx_error;
 	}
 
 	info = skb_tunnel_info(skb);
commit 706ec919164622ff5ce822065472d0f30a9e9dd2
Author: Xiyu Yang <xiyuyang19 at fudan.edu.cn>
Date:   Sat Jul 25 16:02:18 2020 +0800

    ipv6: Fix nexthop refcnt leak when creating ipv6 route info
    
    ip6_route_info_create() invokes nexthop_get(), which increases the
    refcount of the "nh".
    
    When ip6_route_info_create() returns, local variable "nh" becomes
    invalid, so the refcount should be decreased to keep refcount balanced.
    
    The reference counting issue happens in one exception handling path of
    ip6_route_info_create(). When nexthops can not be used with source
    routing, the function forgets to decrease the refcnt increased by
    nexthop_get(), causing a refcnt leak.
    
    Fix this issue by pulling up the error source routing handling when
    nexthops can not be used with source routing.
    
    Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info")
    Signed-off-by: Xiyu Yang <xiyuyang19 at fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf at gmail.com>
    Reviewed-by: David Ahern <dsahern at kernel.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f3279810d765..4c36bd0c7930 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3685,14 +3685,14 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
 	rt->fib6_src.plen = cfg->fc_src_len;
 #endif
 	if (nh) {
-		if (!nexthop_get(nh)) {
-			NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
-			goto out;
-		}
 		if (rt->fib6_src.plen) {
 			NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing");
 			goto out;
 		}
+		if (!nexthop_get(nh)) {
+			NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
+			goto out;
+		}
 		rt->nh = nh;
 		fib6_nh = nexthop_fib6_nh(rt->nh);
 	} else {
commit fa662d7816a5a3790f3ee49f27e5f65991d3347d
Merge: 3cab8c655259 ed543f5c6a98
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Jul 28 17:14:48 2020 -0700

    Merge branch 'Fix-bugs-in-Octeontx2-netdev-driver'
    
    Subbaraya Sundeep says:
    
    ====================
    Fix bugs in Octeontx2 netdev driver
    
    There are problems in the existing Octeontx2
    netdev drivers like missing cancel_work for the
    reset task, missing lock in reset task and
    missing unergister_netdev in driver remove.
    This patch set fixes the above problems.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ed543f5c6a988d8a863d2436794230cef2c82389
Author: Subbaraya Sundeep <sbhatta at marvell.com>
Date:   Sat Jul 25 10:13:54 2020 +0530

    octeontx2-pf: Unregister netdev at driver remove
    
    Added unregister_netdev in the driver remove
    function. Generally unregister_netdev is called
    after disabling all the device interrupts but here
    it is called before disabling device mailbox
    interrupts. The reason behind this is VF needs
    mailbox interrupt to communicate with its PF to
    clean up its resources during otx2_stop.
    otx2_stop disables packet I/O and queue interrupts
    first and by using mailbox interrupt communicates
    to PF to free VF resources. Hence this patch
    calls unregister_device just before
    disabling mailbox interrupts.
    
    Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support")
    Signed-off-by: Subbaraya Sundeep <sbhatta at marvell.com>
    Signed-off-by: Sunil Goutham <sgoutham at marvell.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
index c1c263d1ac2e..92a3db69a6cd 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
@@ -618,6 +618,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
 	vf = netdev_priv(netdev);
 
 	cancel_work_sync(&vf->reset_task);
+	unregister_netdev(netdev);
 	otx2vf_disable_mbox_intr(vf);
 
 	otx2_detach_resources(&vf->mbox);
commit c0376f473c5cc2ef94f8e1e055d173293cc3698c
Author: Subbaraya Sundeep <sbhatta at marvell.com>
Date:   Sat Jul 25 10:13:53 2020 +0530

    octeontx2-pf: cancel reset_task work
    
    During driver exit cancel the queued
    reset_task work in VF driver.
    
    Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support")
    Signed-off-by: Subbaraya Sundeep <sbhatta at marvell.com>
    Signed-off-by: Sunil Goutham <sgoutham at marvell.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
index f4227517dc8e..c1c263d1ac2e 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_vf.c
@@ -617,6 +617,7 @@ static void otx2vf_remove(struct pci_dev *pdev)
 
 	vf = netdev_priv(netdev);
 
+	cancel_work_sync(&vf->reset_task);
 	otx2vf_disable_mbox_intr(vf);
 
 	otx2_detach_resources(&vf->mbox);
commit 948a66338f44c16f52c0f03f6ad81a6f59eb5604
Author: Subbaraya Sundeep <sbhatta at marvell.com>
Date:   Sat Jul 25 10:13:52 2020 +0530

    octeontx2-pf: Fix reset_task bugs
    
    Two bugs exist in the code related to reset_task
    in PF driver one is the missing protection
    against network stack ndo_open and ndo_close.
    Other one is the missing cancel_work.
    This patch fixes those problems.
    
    Fixes: 4ff7d1488a84 ("octeontx2-pf: Error handling support")
    Signed-off-by: Subbaraya Sundeep <sbhatta at marvell.com>
    Signed-off-by: Sunil Goutham <sgoutham at marvell.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 64786568af0d..75a8c407e815 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -1730,10 +1730,12 @@ static void otx2_reset_task(struct work_struct *work)
 	if (!netif_running(pf->netdev))
 		return;
 
+	rtnl_lock();
 	otx2_stop(pf->netdev);
 	pf->reset_count++;
 	otx2_open(pf->netdev);
 	netif_trans_update(pf->netdev);
+	rtnl_unlock();
 }
 
 static const struct net_device_ops otx2_netdev_ops = {
@@ -2111,6 +2113,7 @@ static void otx2_remove(struct pci_dev *pdev)
 
 	pf = netdev_priv(netdev);
 
+	cancel_work_sync(&pf->reset_task);
 	/* Disable link notifications */
 	otx2_cgx_config_linkevents(pf, false);
 
commit 3cab8c65525920f00d8f4997b3e9bb73aecb3a8e
Author: Jakub Kicinski <kuba at kernel.org>
Date:   Fri Jul 24 16:15:43 2020 -0700

    mlx4: disable device on shutdown
    
    It appears that not disabling a PCI device on .shutdown may lead to
    a Hardware Error with particular (perhaps buggy) BIOS versions:
    
        mlx4_en: eth0: Close port called
        mlx4_en 0000:04:00.0: removed PHC
        reboot: Restarting system
        {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
        {1}[Hardware Error]: event severity: fatal
        {1}[Hardware Error]:  Error 0, type: fatal
        {1}[Hardware Error]:   section_type: PCIe error
        {1}[Hardware Error]:   port_type: 4, root port
        {1}[Hardware Error]:   version: 1.16
        {1}[Hardware Error]:   command: 0x4010, status: 0x0143
        {1}[Hardware Error]:   device_id: 0000:00:02.2
        {1}[Hardware Error]:   slot: 0
        {1}[Hardware Error]:   secondary_bus: 0x04
        {1}[Hardware Error]:   vendor_id: 0x8086, device_id: 0x2f06
        {1}[Hardware Error]:   class_code: 000604
        {1}[Hardware Error]:   bridge: secondary_status: 0x2000, control: 0x0003
        {1}[Hardware Error]:   aer_uncor_status: 0x00100000, aer_uncor_mask: 0x00000000
        {1}[Hardware Error]:   aer_uncor_severity: 0x00062030
        {1}[Hardware Error]:   TLP Header: 40000018 040000ff 791f4080 00000000
    [hw error repeats]
        Kernel panic - not syncing: Fatal hardware error!
        CPU: 0 PID: 2189 Comm: reboot Kdump: loaded Not tainted 5.6.x-blabla #1
        Hardware name: HP ProLiant DL380 Gen9/ProLiant DL380 Gen9, BIOS P89 05/05/2017
    
    Fix the mlx4 driver.
    
    This is a very similar problem to what had been fixed in:
    commit 0d98ba8d70b0 ("scsi: hpsa: disable device during shutdown")
    to address https://bugzilla.kernel.org/show_bug.cgi?id=199779.
    
    Fixes: 2ba5fbd62b25 ("net/mlx4_core: Handle AER flow properly")
    Reported-by: Jake Lawrence <lawja at fb.com>
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>
    Reviewed-by: Saeed Mahameed <saeedm at mellanox.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 3d9aa7da95e9..2d3e45780719 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -4356,12 +4356,14 @@ end:
 static void mlx4_shutdown(struct pci_dev *pdev)
 {
 	struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
+	struct mlx4_dev *dev = persist->dev;
 
 	mlx4_info(persist->dev, "mlx4_shutdown was called\n");
 	mutex_lock(&persist->interface_state_mutex);
 	if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
 		mlx4_unload_one(pdev);
 	mutex_unlock(&persist->interface_state_mutex);
+	mlx4_pci_disable_device(dev);
 }
 
 static const struct pci_error_handlers mlx4_err_handler = {
commit a7ef23e56864ad7720b3a38ef408bc7c9a74c58d
Merge: 19016d93bfc3 ce9b362bf6db
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Jul 28 17:09:49 2020 -0700

    Merge branch 'rhashtable-Fix-unprotected-RCU-dereference-in-__rht_ptr'
    
    Herbert Xu says:
    
    ====================
    rhashtable: Fix unprotected RCU dereference in __rht_ptr
    
    This patch series fixes an unprotected dereference in __rht_ptr.
    The first patch is a minimal fix that does not use the correct
    RCU markings but is suitable for backport, and the second patch
    cleans up the RCU markings.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ce9b362bf6db51a083c4221ef0f93c16cfb1facf
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Fri Jul 24 20:14:34 2020 +1000

    rhashtable: Restore RCU marking on rhash_lock_head
    
    This patch restores the RCU marking on bucket_table->buckets as
    it really does need RCU protection.  Its removal had led to a fatal
    bug.
    
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index b8feb5da7c5a..68dab3e08aad 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -84,7 +84,7 @@ struct bucket_table {
 
 	struct lockdep_map	dep_map;
 
-	struct rhash_lock_head *buckets[] ____cacheline_aligned_in_smp;
+	struct rhash_lock_head __rcu *buckets[] ____cacheline_aligned_in_smp;
 };
 
 /*
@@ -261,13 +261,12 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
 				 void *arg);
 void rhashtable_destroy(struct rhashtable *ht);
 
-struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
-					   unsigned int hash);
-struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
-					     unsigned int hash);
-struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
-						  struct bucket_table *tbl,
-						  unsigned int hash);
+struct rhash_lock_head __rcu **rht_bucket_nested(
+	const struct bucket_table *tbl, unsigned int hash);
+struct rhash_lock_head __rcu **__rht_bucket_nested(
+	const struct bucket_table *tbl, unsigned int hash);
+struct rhash_lock_head __rcu **rht_bucket_nested_insert(
+	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash);
 
 #define rht_dereference(p, ht) \
 	rcu_dereference_protected(p, lockdep_rht_mutex_is_held(ht))
@@ -284,21 +283,21 @@ struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
 #define rht_entry(tpos, pos, member) \
 	({ tpos = container_of(pos, typeof(*tpos), member); 1; })
 
-static inline struct rhash_lock_head *const *rht_bucket(
+static inline struct rhash_lock_head __rcu *const *rht_bucket(
 	const struct bucket_table *tbl, unsigned int hash)
 {
 	return unlikely(tbl->nest) ? rht_bucket_nested(tbl, hash) :
 				     &tbl->buckets[hash];
 }
 
-static inline struct rhash_lock_head **rht_bucket_var(
+static inline struct rhash_lock_head __rcu **rht_bucket_var(
 	struct bucket_table *tbl, unsigned int hash)
 {
 	return unlikely(tbl->nest) ? __rht_bucket_nested(tbl, hash) :
 				     &tbl->buckets[hash];
 }
 
-static inline struct rhash_lock_head **rht_bucket_insert(
+static inline struct rhash_lock_head __rcu **rht_bucket_insert(
 	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash)
 {
 	return unlikely(tbl->nest) ? rht_bucket_nested_insert(ht, tbl, hash) :
@@ -325,7 +324,7 @@ static inline struct rhash_lock_head **rht_bucket_insert(
  */
 
 static inline void rht_lock(struct bucket_table *tbl,
-			    struct rhash_lock_head **bkt)
+			    struct rhash_lock_head __rcu **bkt)
 {
 	local_bh_disable();
 	bit_spin_lock(0, (unsigned long *)bkt);
@@ -333,7 +332,7 @@ static inline void rht_lock(struct bucket_table *tbl,
 }
 
 static inline void rht_lock_nested(struct bucket_table *tbl,
-				   struct rhash_lock_head **bucket,
+				   struct rhash_lock_head __rcu **bucket,
 				   unsigned int subclass)
 {
 	local_bh_disable();
@@ -342,7 +341,7 @@ static inline void rht_lock_nested(struct bucket_table *tbl,
 }
 
 static inline void rht_unlock(struct bucket_table *tbl,
-			      struct rhash_lock_head **bkt)
+			      struct rhash_lock_head __rcu **bkt)
 {
 	lock_map_release(&tbl->dep_map);
 	bit_spin_unlock(0, (unsigned long *)bkt);
@@ -365,48 +364,41 @@ static inline struct rhash_head *__rht_ptr(
  *            access is guaranteed, such as when destroying the table.
  */
 static inline struct rhash_head *rht_ptr_rcu(
-	struct rhash_lock_head *const *p)
+	struct rhash_lock_head __rcu *const *bkt)
 {
-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
 	return __rht_ptr(rcu_dereference(*bkt), bkt);
 }
 
 static inline struct rhash_head *rht_ptr(
-	struct rhash_lock_head *const *p,
+	struct rhash_lock_head __rcu *const *bkt,
 	struct bucket_table *tbl,
 	unsigned int hash)
 {
-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
 	return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
 }
 
 static inline struct rhash_head *rht_ptr_exclusive(
-	struct rhash_lock_head *const *p)
+	struct rhash_lock_head __rcu *const *bkt)
 {
-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
 	return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
 }
 
-static inline void rht_assign_locked(struct rhash_lock_head **bkt,
+static inline void rht_assign_locked(struct rhash_lock_head __rcu **bkt,
 				     struct rhash_head *obj)
 {
-	struct rhash_head __rcu **p = (struct rhash_head __rcu **)bkt;
-
 	if (rht_is_a_nulls(obj))
 		obj = NULL;
-	rcu_assign_pointer(*p, (void *)((unsigned long)obj | BIT(0)));
+	rcu_assign_pointer(*bkt, (void *)((unsigned long)obj | BIT(0)));
 }
 
 static inline void rht_assign_unlock(struct bucket_table *tbl,
-				     struct rhash_lock_head **bkt,
+				     struct rhash_lock_head __rcu **bkt,
 				     struct rhash_head *obj)
 {
-	struct rhash_head __rcu **p = (struct rhash_head __rcu **)bkt;
-
 	if (rht_is_a_nulls(obj))
 		obj = NULL;
 	lock_map_release(&tbl->dep_map);
-	rcu_assign_pointer(*p, obj);
+	rcu_assign_pointer(*bkt, (void *)obj);
 	preempt_enable();
 	__release(bitlock);
 	local_bh_enable();
@@ -594,7 +586,7 @@ static inline struct rhash_head *__rhashtable_lookup(
 		.ht = ht,
 		.key = key,
 	};
-	struct rhash_lock_head *const *bkt;
+	struct rhash_lock_head __rcu *const *bkt;
 	struct bucket_table *tbl;
 	struct rhash_head *he;
 	unsigned int hash;
@@ -710,7 +702,7 @@ static inline void *__rhashtable_insert_fast(
 		.ht = ht,
 		.key = key,
 	};
-	struct rhash_lock_head **bkt;
+	struct rhash_lock_head __rcu **bkt;
 	struct rhash_head __rcu **pprev;
 	struct bucket_table *tbl;
 	struct rhash_head *head;
@@ -996,7 +988,7 @@ static inline int __rhashtable_remove_fast_one(
 	struct rhash_head *obj, const struct rhashtable_params params,
 	bool rhlist)
 {
-	struct rhash_lock_head **bkt;
+	struct rhash_lock_head __rcu **bkt;
 	struct rhash_head __rcu **pprev;
 	struct rhash_head *he;
 	unsigned int hash;
@@ -1148,7 +1140,7 @@ static inline int __rhashtable_replace_fast(
 	struct rhash_head *obj_old, struct rhash_head *obj_new,
 	const struct rhashtable_params params)
 {
-	struct rhash_lock_head **bkt;
+	struct rhash_lock_head __rcu **bkt;
 	struct rhash_head __rcu **pprev;
 	struct rhash_head *he;
 	unsigned int hash;
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 9f6890aedd1a..c949c1e3b87c 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -31,7 +31,7 @@
 
 union nested_table {
 	union nested_table __rcu *table;
-	struct rhash_lock_head *bucket;
+	struct rhash_lock_head __rcu *bucket;
 };
 
 static u32 head_hashfn(struct rhashtable *ht,
@@ -222,7 +222,7 @@ static struct bucket_table *rhashtable_last_table(struct rhashtable *ht,
 }
 
 static int rhashtable_rehash_one(struct rhashtable *ht,
-				 struct rhash_lock_head **bkt,
+				 struct rhash_lock_head __rcu **bkt,
 				 unsigned int old_hash)
 {
 	struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
@@ -275,7 +275,7 @@ static int rhashtable_rehash_chain(struct rhashtable *ht,
 				    unsigned int old_hash)
 {
 	struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
-	struct rhash_lock_head **bkt = rht_bucket_var(old_tbl, old_hash);
+	struct rhash_lock_head __rcu **bkt = rht_bucket_var(old_tbl, old_hash);
 	int err;
 
 	if (!bkt)
@@ -485,7 +485,7 @@ fail:
 }
 
 static void *rhashtable_lookup_one(struct rhashtable *ht,
-				   struct rhash_lock_head **bkt,
+				   struct rhash_lock_head __rcu **bkt,
 				   struct bucket_table *tbl, unsigned int hash,
 				   const void *key, struct rhash_head *obj)
 {
@@ -535,12 +535,10 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
 	return ERR_PTR(-ENOENT);
 }
 
-static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
-						  struct rhash_lock_head **bkt,
-						  struct bucket_table *tbl,
-						  unsigned int hash,
-						  struct rhash_head *obj,
-						  void *data)
+static struct bucket_table *rhashtable_insert_one(
+	struct rhashtable *ht, struct rhash_lock_head __rcu **bkt,
+	struct bucket_table *tbl, unsigned int hash, struct rhash_head *obj,
+	void *data)
 {
 	struct bucket_table *new_tbl;
 	struct rhash_head *head;
@@ -591,7 +589,7 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
 {
 	struct bucket_table *new_tbl;
 	struct bucket_table *tbl;
-	struct rhash_lock_head **bkt;
+	struct rhash_lock_head __rcu **bkt;
 	unsigned int hash;
 	void *data;
 
@@ -1173,8 +1171,8 @@ void rhashtable_destroy(struct rhashtable *ht)
 }
 EXPORT_SYMBOL_GPL(rhashtable_destroy);
 
-struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
-					     unsigned int hash)
+struct rhash_lock_head __rcu **__rht_bucket_nested(
+	const struct bucket_table *tbl, unsigned int hash)
 {
 	const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
 	unsigned int index = hash & ((1 << tbl->nest) - 1);
@@ -1202,10 +1200,10 @@ struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
 }
 EXPORT_SYMBOL_GPL(__rht_bucket_nested);
 
-struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
-					   unsigned int hash)
+struct rhash_lock_head __rcu **rht_bucket_nested(
+	const struct bucket_table *tbl, unsigned int hash)
 {
-	static struct rhash_lock_head *rhnull;
+	static struct rhash_lock_head __rcu *rhnull;
 
 	if (!rhnull)
 		INIT_RHT_NULLS_HEAD(rhnull);
@@ -1213,9 +1211,8 @@ struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
 }
 EXPORT_SYMBOL_GPL(rht_bucket_nested);
 
-struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
-						  struct bucket_table *tbl,
-						  unsigned int hash)
+struct rhash_lock_head __rcu **rht_bucket_nested_insert(
+	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash)
 {
 	const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
 	unsigned int index = hash & ((1 << tbl->nest) - 1);
commit 1748f6a2cbc4694523f16da1c892b59861045b9d
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Fri Jul 24 20:12:53 2020 +1000

    rhashtable: Fix unprotected RCU dereference in __rht_ptr
    
    The rcu_dereference call in rht_ptr_rcu is completely bogus because
    we've already dereferenced the value in __rht_ptr and operated on it.
    This causes potential double readings which could be fatal.  The RCU
    dereference must occur prior to the comparison in __rht_ptr.
    
    This patch changes the order of RCU dereference so that it is done
    first and the result is then fed to __rht_ptr.  The RCU marking
    changes have been minimised using casts which will be removed in
    a follow-up patch.
    
    Fixes: ba6306e3f648 ("rhashtable: Remove RCU marking from...")
    Reported-by: "Gong, Sishuai" <sishuai at purdue.edu>
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
index d3432ee65de7..b8feb5da7c5a 100644
--- a/include/linux/rhashtable.h
+++ b/include/linux/rhashtable.h
@@ -349,11 +349,11 @@ static inline void rht_unlock(struct bucket_table *tbl,
 	local_bh_enable();
 }
 
-static inline struct rhash_head __rcu *__rht_ptr(
-	struct rhash_lock_head *const *bkt)
+static inline struct rhash_head *__rht_ptr(
+	struct rhash_lock_head *p, struct rhash_lock_head __rcu *const *bkt)
 {
-	return (struct rhash_head __rcu *)
-		((unsigned long)*bkt & ~BIT(0) ?:
+	return (struct rhash_head *)
+		((unsigned long)p & ~BIT(0) ?:
 		 (unsigned long)RHT_NULLS_MARKER(bkt));
 }
 
@@ -365,25 +365,26 @@ static inline struct rhash_head __rcu *__rht_ptr(
  *            access is guaranteed, such as when destroying the table.
  */
 static inline struct rhash_head *rht_ptr_rcu(
-	struct rhash_lock_head *const *bkt)
+	struct rhash_lock_head *const *p)
 {
-	struct rhash_head __rcu *p = __rht_ptr(bkt);
-
-	return rcu_dereference(p);
+	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+	return __rht_ptr(rcu_dereference(*bkt), bkt);
 }
 
 static inline struct rhash_head *rht_ptr(
-	struct rhash_lock_head *const *bkt,
+	struct rhash_lock_head *const *p,
 	struct bucket_table *tbl,
 	unsigned int hash)
 {
-	return rht_dereference_bucket(__rht_ptr(bkt), tbl, hash);
+	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+	return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
 }
 
 static inline struct rhash_head *rht_ptr_exclusive(
-	struct rhash_lock_head *const *bkt)
+	struct rhash_lock_head *const *p)
 {
-	return rcu_dereference_protected(__rht_ptr(bkt), 1);
+	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+	return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
 }
 
 static inline void rht_assign_locked(struct rhash_lock_head **bkt,
commit 19016d93bfc335f0c158c0d9e3b9d06c4dd53d39
Author: René van Dorst <opensource at vdorst.com>
Date:   Thu Jul 23 20:07:10 2020 +0100

    net: ethernet: mtk_eth_soc: Always call mtk_gmac0_rgmii_adjust() for mt7623
    
    Modify mtk_gmac0_rgmii_adjust() so it can always be called.
    mtk_gmac0_rgmii_adjust() sets-up the TRGMII clocks.
    
    Signed-off-by: René van Dorst <opensource at vdorst.com>
    Signed-off-By: David Woodhouse <dwmw2 at infradead.org>
    Tested-by: Frank Wunderlich <frank-w at public-files.de>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index f6a1f8666f95..85735d32ecb0 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -171,11 +171,21 @@ static int mt7621_gmac0_rgmii_adjust(struct mtk_eth *eth,
 	return 0;
 }
 
-static void mtk_gmac0_rgmii_adjust(struct mtk_eth *eth, int speed)
+static void mtk_gmac0_rgmii_adjust(struct mtk_eth *eth,
+				   phy_interface_t interface, int speed)
 {
 	u32 val;
 	int ret;
 
+	if (interface == PHY_INTERFACE_MODE_TRGMII) {
+		mtk_w32(eth, TRGMII_MODE, INTF_MODE);
+		val = 500000000;
+		ret = clk_set_rate(eth->clks[MTK_CLK_TRGPLL], val);
+		if (ret)
+			dev_err(eth->dev, "Failed to set trgmii pll: %d\n", ret);
+		return;
+	}
+
 	val = (speed == SPEED_1000) ?
 		INTF_MODE_RGMII_1000 : INTF_MODE_RGMII_10_100;
 	mtk_w32(eth, val, INTF_MODE);
@@ -262,10 +272,9 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode,
 							      state->interface))
 					goto err_phy;
 			} else {
-				if (state->interface !=
-				    PHY_INTERFACE_MODE_TRGMII)
-					mtk_gmac0_rgmii_adjust(mac->hw,
-							       state->speed);
+				mtk_gmac0_rgmii_adjust(mac->hw,
+						       state->interface,
+						       state->speed);
 
 				/* mt7623_pad_clk_setup */
 				for (i = 0 ; i < NUM_TRGMII_CTRL; i++)
commit b5cd55b334f3cdb2562c84626600f3728151ee29
Merge: 2ff34c909f75 350a63249d27
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Jul 28 16:55:13 2020 -0700

    Merge tag 'mlx5-fixes-2020-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux
    
    Saeed Mahameed says:
    
    ====================
    mlx5 fixes-2020-07-28
    
    This series introduces some fixes to mlx5 driver.
    v1->v2:
     - Drop the "Hold reference on mirred devices" patch, until Or's
       comments are addressed.
     - Imporve "Modify uplink state" patch commit message per Or's request.
    
    Please pull and let me know if there is any problem.
    
    For -Stable:
    
    For -stable v4.9
     ('net/mlx5e: Fix error path of device attach')
    
    For -stable v4.15
     ('net/mlx5: Verify Hardware supports requested ptp function on a given
    pin')
    
    For -stable v5.3
     ('net/mlx5e: Modify uplink state on interface up/down')
    
    For -stable v5.4
     ('net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev')
     ('net/mlx5: E-switch, Destroy TSAR when fail to enable the mode')
    
    For -stable v5.5
     ('net/mlx5: E-switch, Destroy TSAR after reload interface')
    
    For -stable v5.7
     ('net/mlx5: Fix a bug of using ptp channel index as pin index')
    ====================
    
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 2ff34c909f75d2d145a27b84e2ee6710a6b43446
Merge: e911e99a0770 ea060b352654
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Jul 28 13:35:44 2020 -0700

    Merge branch 'net-lan78xx-fix-NULL-deref-and-memory-leak'
    
    Johan Hovold says:
    
    ====================
    net: lan78xx: fix NULL deref and memory leak
    
    The first two patches fix a NULL-pointer dereference at probe that can
    be triggered by a malicious device and a small transfer-buffer memory
    leak, respectively.
    
    For another subsystem I would have marked them:
    
            Cc: stable at vger.kernel.org      # 4.3
    
    The third one replaces the driver's current broken endpoint lookup
    helper, which could end up accepting incomplete interfaces and whose
    results weren't even useeren
    Johan
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ea060b352654a8de1e070140d25fe1b7e4d50310
Author: Johan Hovold <johan at kernel.org>
Date:   Tue Jul 28 14:10:31 2020 +0200

    net: lan78xx: replace bogus endpoint lookup
    
    Drop the bogus endpoint-lookup helper which could end up accepting
    interfaces based on endpoints belonging to unrelated altsettings.
    
    Note that the returned bulk pipes and interrupt endpoint descriptor
    were never actually used. Instead the bulk-endpoint numbers are
    hardcoded to 1 and 2 (matching the specification), while the interrupt-
    endpoint descriptor was assumed to be the third descriptor created by
    USB core.
    
    Try to bring some order to this by dropping the bogus lookup helper and
    adding the missing endpoint sanity checks while keeping the interrupt-
    descriptor assumption for now.
    
    Signed-off-by: Johan Hovold <johan at kernel.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index ee062b27cfa7..442507f25aad 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -377,10 +377,6 @@ struct lan78xx_net {
 	struct tasklet_struct	bh;
 	struct delayed_work	wq;
 
-	struct usb_host_endpoint *ep_blkin;
-	struct usb_host_endpoint *ep_blkout;
-	struct usb_host_endpoint *ep_intr;
-
 	int			msg_enable;
 
 	struct urb		*urb_intr;
@@ -2860,78 +2856,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net)
 	return NETDEV_TX_OK;
 }
 
-static int
-lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf)
-{
-	int tmp;
-	struct usb_host_interface *alt = NULL;
-	struct usb_host_endpoint *in = NULL, *out = NULL;
-	struct usb_host_endpoint *status = NULL;
-
-	for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
-		unsigned ep;
-
-		in = NULL;
-		out = NULL;
-		status = NULL;
-		alt = intf->altsetting + tmp;
-
-		for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
-			struct usb_host_endpoint *e;
-			int intr = 0;
-
-			e = alt->endpoint + ep;
-			switch (e->desc.bmAttributes) {
-			case USB_ENDPOINT_XFER_INT:
-				if (!usb_endpoint_dir_in(&e->desc))
-					continue;
-				intr = 1;
-				/* FALLTHROUGH */
-			case USB_ENDPOINT_XFER_BULK:
-				break;
-			default:
-				continue;
-			}
-			if (usb_endpoint_dir_in(&e->desc)) {
-				if (!intr && !in)
-					in = e;
-				else if (intr && !status)
-					status = e;
-			} else {
-				if (!out)
-					out = e;
-			}
-		}
-		if (in && out)
-			break;
-	}
-	if (!alt || !in || !out)
-		return -EINVAL;
-
-	dev->pipe_in = usb_rcvbulkpipe(dev->udev,
-				       in->desc.bEndpointAddress &
-				       USB_ENDPOINT_NUMBER_MASK);
-	dev->pipe_out = usb_sndbulkpipe(dev->udev,
-					out->desc.bEndpointAddress &
-					USB_ENDPOINT_NUMBER_MASK);
-	dev->ep_intr = status;
-
-	return 0;
-}
-
 static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
 {
 	struct lan78xx_priv *pdata = NULL;
 	int ret;
 	int i;
 
-	ret = lan78xx_get_endpoints(dev, intf);
-	if (ret) {
-		netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
-			    ret);
-		return ret;
-	}
-
 	dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
 
 	pdata = (struct lan78xx_priv *)(dev->data[0]);
@@ -3700,6 +3630,7 @@ static void lan78xx_stat_monitor(struct timer_list *t)
 static int lan78xx_probe(struct usb_interface *intf,
 			 const struct usb_device_id *id)
 {
+	struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr;
 	struct lan78xx_net *dev;
 	struct net_device *netdev;
 	struct usb_device *udev;
@@ -3748,6 +3679,34 @@ static int lan78xx_probe(struct usb_interface *intf,
 
 	mutex_init(&dev->stats.access_lock);
 
+	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
+	dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
+	ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in);
+	if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
+	dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
+	ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out);
+	if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
+	ep_intr = &intf->cur_altsetting->endpoint[2];
+	if (!usb_endpoint_is_int_in(&ep_intr->desc)) {
+		ret = -ENODEV;
+		goto out2;
+	}
+
+	dev->pipe_intr = usb_rcvintpipe(dev->udev,
+					usb_endpoint_num(&ep_intr->desc));
+
 	ret = lan78xx_bind(dev, intf);
 	if (ret < 0)
 		goto out2;
@@ -3759,23 +3718,7 @@ static int lan78xx_probe(struct usb_interface *intf,
 	netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
 	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
 
-	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
-		ret = -ENODEV;
-		goto out3;
-	}
-
-	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
-	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
-	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
-
-	dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
-	dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
-
-	dev->pipe_intr = usb_rcvintpipe(dev->udev,
-					dev->ep_intr->desc.bEndpointAddress &
-					USB_ENDPOINT_NUMBER_MASK);
-	period = dev->ep_intr->desc.bInterval;
-
+	period = ep_intr->desc.bInterval;
 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
 	buf = kmalloc(maxp, GFP_KERNEL);
 	if (buf) {
commit 63634aa679ba8b5e306ad0727120309ae6ba8a8e
Author: Johan Hovold <johan at kernel.org>
Date:   Tue Jul 28 14:10:30 2020 +0200

    net: lan78xx: fix transfer-buffer memory leak
    
    The interrupt URB transfer-buffer was never freed on disconnect or after
    probe errors.
    
    Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
    Cc: Woojung.Huh at microchip.com <Woojung.Huh at microchip.com>
    Signed-off-by: Johan Hovold <johan at kernel.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index d7162690e3f3..ee062b27cfa7 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3788,6 +3788,7 @@ static int lan78xx_probe(struct usb_interface *intf,
 			usb_fill_int_urb(dev->urb_intr, dev->udev,
 					 dev->pipe_intr, buf, maxp,
 					 intr_complete, dev, period);
+			dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
 		}
 	}
 
commit 8d8e95fd6d69d774013f51e5f2ee10c6e6d1fc14
Author: Johan Hovold <johan at kernel.org>
Date:   Tue Jul 28 14:10:29 2020 +0200

    net: lan78xx: add missing endpoint sanity check
    
    Add the missing endpoint sanity check to prevent a NULL-pointer
    dereference should a malicious device lack the expected endpoints.
    
    Note that the driver has a broken endpoint-lookup helper,
    lan78xx_get_endpoints(), which can end up accepting interfaces in an
    altsetting without endpoints as long as *some* altsetting has a bulk-in
    and a bulk-out endpoint.
    
    Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
    Cc: Woojung.Huh at microchip.com <Woojung.Huh at microchip.com>
    Signed-off-by: Johan Hovold <johan at kernel.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index eccbf4cd7149..d7162690e3f3 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3759,6 +3759,11 @@ static int lan78xx_probe(struct usb_interface *intf,
 	netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
 	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
 
+	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
+		ret = -ENODEV;
+		goto out3;
+	}
+
 	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
 	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
 	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
commit e911e99a0770f760377c263bc7bac1b1593c6147
Author: Rustam Kovhaev <rkovhaev at gmail.com>
Date:   Mon Jul 27 23:42:17 2020 -0700

    usb: hso: check for return value in hso_serial_common_create()
    
    in case of an error tty_register_device_attr() returns ERR_PTR(),
    add IS_ERR() check
    
    Reported-and-tested-by: syzbot+67b2bd0e34f952d0321e at syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?extid=67b2bd0e34f952d0321e
    Signed-off-by: Rustam Kovhaev <rkovhaev at gmail.com>
    Reviewed-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 5f123a8cf68e..d2fdb5430d27 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2261,12 +2261,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 
 	minor = get_free_serial_index();
 	if (minor < 0)
-		goto exit;
+		goto exit2;
 
 	/* register our minor number */
 	serial->parent->dev = tty_port_register_device_attr(&serial->port,
 			tty_drv, minor, &serial->parent->interface->dev,
 			serial->parent, hso_serial_dev_groups);
+	if (IS_ERR(serial->parent->dev))
+		goto exit2;
 
 	/* fill in specific data for later use */
 	serial->minor = minor;
@@ -2311,6 +2313,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
 	return 0;
 exit:
 	hso_serial_tty_unregister(serial);
+exit2:
 	hso_serial_common_free(serial);
 	return -1;
 }
commit 350a63249d270b1f5bd05c7e2a24cd8de0f9db20
Author: Alaa Hleihel <alaa at mellanox.com>
Date:   Wed Jul 15 11:46:30 2020 +0300

    net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev
    
    After the cited commit, function 'mlx5_eswitch_set_vport_vlan' started
    to acquire esw->state_lock.
    However, esw is not defined for VF devices, hence attempting to set vf
    VLANID on a VF dev will cause a kernel panic.
    
    Fix it by moving up the (redundant) esw validation from function
    '__mlx5_eswitch_set_vport_vlan' since the rest of the callers now have
    and use a valid esw.
    
    For example with vf device eth4:
     # ip link set dev eth4 vf 0 vlan 0
    
    Trace of the panic:
     [  411.409842] BUG: unable to handle page fault for address: 00000000000011b8
     [  411.449745] #PF: supervisor read access in kernel mode
     [  411.452348] #PF: error_code(0x0000) - not-present page
     [  411.454938] PGD 80000004189c9067 P4D 80000004189c9067 PUD 41899a067 PMD 0
     [  411.458382] Oops: 0000 [#1] SMP PTI
     [  411.460268] CPU: 4 PID: 5711 Comm: ip Not tainted 5.8.0-rc4_for_upstream_min_debug_2020_07_08_22_04 #1
     [  411.462447] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
     [  411.464158] RIP: 0010:__mutex_lock+0x4e/0x940
     [  411.464928] Code: fd 41 54 49 89 f4 41 52 53 89 d3 48 83 ec 70 44 8b 1d ee 03 b0 01 65 48 8b 04 25 28 00 00 00 48 89 45 c8 31 c0 45 85 db 75 0a <48> 3b 7f 60 0f 85 7e 05 00 00 49 8d 45 68 41 56 41 b8 01 00 00 00
     [  411.467678] RSP: 0018:ffff88841fcd74b0 EFLAGS: 00010246
     [  411.468562] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
     [  411.469715] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000001158
     [  411.470812] RBP: ffff88841fcd7550 R08: ffffffffa00fa1ce R09: 0000000000000000
     [  411.471835] R10: ffff88841fcd7570 R11: 0000000000000000 R12: 0000000000000002
     [  411.472862] R13: 0000000000001158 R14: ffffffffa00fa1ce R15: 0000000000000000
     [  411.474004] FS:  00007faee7ca6b80(0000) GS:ffff88846fc00000(0000) knlGS:0000000000000000
     [  411.475237] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     [  411.476129] CR2: 00000000000011b8 CR3: 000000041909c006 CR4: 0000000000360ea0
     [  411.477260] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     [  411.478340] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
     [  411.479332] Call Trace:
     [  411.479760]  ? __nla_validate_parse.part.6+0x57/0x8f0
     [  411.482825]  ? mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
     [  411.483804]  mlx5_eswitch_set_vport_vlan+0x3e/0xa0 [mlx5_core]
     [  411.484733]  mlx5e_set_vf_vlan+0x41/0x50 [mlx5_core]
     [  411.485545]  do_setlink+0x613/0x1000
     [  411.486165]  __rtnl_newlink+0x53d/0x8c0
     [  411.486791]  ? mark_held_locks+0x49/0x70
     [  411.487429]  ? __lock_acquire+0x8fe/0x1eb0
     [  411.488085]  ? rcu_read_lock_sched_held+0x52/0x60
     [  411.488998]  ? kmem_cache_alloc_trace+0x16d/0x2d0
     [  411.489759]  rtnl_newlink+0x47/0x70
     [  411.490357]  rtnetlink_rcv_msg+0x24e/0x450
     [  411.490978]  ? netlink_deliver_tap+0x92/0x3d0
     [  411.491631]  ? validate_linkmsg+0x330/0x330
     [  411.492262]  netlink_rcv_skb+0x47/0x110
     [  411.492852]  netlink_unicast+0x1ac/0x270
     [  411.493551]  netlink_sendmsg+0x336/0x450
     [  411.494209]  sock_sendmsg+0x30/0x40
     [  411.494779]  ____sys_sendmsg+0x1dd/0x1f0
     [  411.495378]  ? copy_msghdr_from_user+0x5c/0x90
     [  411.496082]  ___sys_sendmsg+0x87/0xd0
     [  411.496683]  ? lock_acquire+0xb9/0x3a0
     [  411.497322]  ? lru_cache_add+0x5/0x170
     [  411.497944]  ? find_held_lock+0x2d/0x90
     [  411.498568]  ? handle_mm_fault+0xe46/0x18c0
     [  411.499205]  ? __sys_sendmsg+0x51/0x90
     [  411.499784]  __sys_sendmsg+0x51/0x90
     [  411.500341]  do_syscall_64+0x59/0x2e0
     [  411.500938]  ? asm_exc_page_fault+0x8/0x30
     [  411.501609]  ? rcu_read_lock_sched_held+0x52/0x60
     [  411.502350]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
     [  411.503093] RIP: 0033:0x7faee73b85a7
     [  411.503654] Code: Bad RIP value.
    
    Fixes: 0e18134f4f9f ("net/mlx5e: Eswitch, use state_lock to synchronize vlan change")
    Signed-off-by: Alaa Hleihel <alaa at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Reviewed-by: Vlad Buslov <vladbu at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 71d01143c455..43005caff09e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1887,8 +1887,6 @@ int __mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
 	struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
 	int err = 0;
 
-	if (!ESW_ALLOWED(esw))
-		return -EPERM;
 	if (IS_ERR(evport))
 		return PTR_ERR(evport);
 	if (vlan > 4095 || qos > 7)
@@ -1916,6 +1914,9 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
 	u8 set_flags = 0;
 	int err;
 
+	if (!ESW_ALLOWED(esw))
+		return -EPERM;
+
 	if (vlan || qos)
 		set_flags = SET_VLAN_STRIP | SET_VLAN_INSERT;
 
commit 7d0314b11cdd92bca8b89684c06953bf114605fc
Author: Ron Diskin <rondi at mellanox.com>
Date:   Sun Apr 5 13:58:40 2020 +0300

    net/mlx5e: Modify uplink state on interface up/down
    
    When setting the PF interface up/down, notify the firmware to update
    uplink state via MODIFY_VPORT_STATE, when E-Switch is enabled.
    
    This behavior will prevent sending traffic out on uplink port when PF is
    down, such as sending traffic from a VF interface which is still up.
    Currently when calling mlx5e_open/close(), the driver only sends PAOS
    command to notify the firmware to set the physical port state to
    up/down, however, it is not sufficient. When VF is in "auto" state, it
    follows the uplink state, which was not updated on mlx5e_open/close()
    before this patch.
    
    When switchdev mode is enabled and uplink representor is first enabled,
    set the uplink port state value back to its FW default "AUTO".
    
    Fixes: 63bfd399de55 ("net/mlx5e: Send PAOS command on interface up/down")
    Signed-off-by: Ron Diskin <rondi at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Reviewed-by: Moshe Shemesh <moshe at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 31f9ecae98df..07fdbea7ea13 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3069,6 +3069,25 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
 	priv->tstamp.rx_filter = HWTSTAMP_FILTER_NONE;
 }
 
+static void mlx5e_modify_admin_state(struct mlx5_core_dev *mdev,
+				     enum mlx5_port_status state)
+{
+	struct mlx5_eswitch *esw = mdev->priv.eswitch;
+	int vport_admin_state;
+
+	mlx5_set_port_admin_status(mdev, state);
+
+	if (!MLX5_ESWITCH_MANAGER(mdev) ||  mlx5_eswitch_mode(esw) == MLX5_ESWITCH_OFFLOADS)
+		return;
+
+	if (state == MLX5_PORT_UP)
+		vport_admin_state = MLX5_VPORT_ADMIN_STATE_AUTO;
+	else
+		vport_admin_state = MLX5_VPORT_ADMIN_STATE_DOWN;
+
+	mlx5_eswitch_set_vport_state(esw, MLX5_VPORT_UPLINK, vport_admin_state);
+}
+
 int mlx5e_open_locked(struct net_device *netdev)
 {
 	struct mlx5e_priv *priv = netdev_priv(netdev);
@@ -3101,7 +3120,7 @@ int mlx5e_open(struct net_device *netdev)
 	mutex_lock(&priv->state_lock);
 	err = mlx5e_open_locked(netdev);
 	if (!err)
-		mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_UP);
+		mlx5e_modify_admin_state(priv->mdev, MLX5_PORT_UP);
 	mutex_unlock(&priv->state_lock);
 
 	return err;
@@ -3135,7 +3154,7 @@ int mlx5e_close(struct net_device *netdev)
 		return -ENODEV;
 
 	mutex_lock(&priv->state_lock);
-	mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_DOWN);
+	mlx5e_modify_admin_state(priv->mdev, MLX5_PORT_DOWN);
 	err = mlx5e_close_locked(netdev);
 	mutex_unlock(&priv->state_lock);
 
@@ -5182,7 +5201,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
 
 	/* Marking the link as currently not needed by the Driver */
 	if (!netif_running(netdev))
-		mlx5_set_port_admin_status(mdev, MLX5_PORT_DOWN);
+		mlx5e_modify_admin_state(mdev, MLX5_PORT_DOWN);
 
 	mlx5e_set_netdev_mtu_boundaries(priv);
 	mlx5e_set_dev_port_mtu(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 8c294ab43f90..9519a61bd8ec 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -1081,6 +1081,8 @@ static void mlx5e_uplink_rep_enable(struct mlx5e_priv *priv)
 
 	mlx5e_rep_tc_enable(priv);
 
+	mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK,
+				      0, 0, MLX5_VPORT_ADMIN_STATE_AUTO);
 	mlx5_lag_add(mdev, netdev);
 	priv->events_nb.notifier_call = uplink_rep_async_event;
 	mlx5_notifier_register(mdev, &priv->events_nb);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index d9376627584e..71d01143c455 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1826,6 +1826,8 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
 				 u16 vport, int link_state)
 {
 	struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
+	int opmod = MLX5_VPORT_STATE_OP_MOD_ESW_VPORT;
+	int other_vport = 1;
 	int err = 0;
 
 	if (!ESW_ALLOWED(esw))
@@ -1833,15 +1835,17 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
 	if (IS_ERR(evport))
 		return PTR_ERR(evport);
 
+	if (vport == MLX5_VPORT_UPLINK) {
+		opmod = MLX5_VPORT_STATE_OP_MOD_UPLINK;
+		other_vport = 0;
+		vport = 0;
+	}
 	mutex_lock(&esw->state_lock);
 
-	err = mlx5_modify_vport_admin_state(esw->dev,
-					    MLX5_VPORT_STATE_OP_MOD_ESW_VPORT,
-					    vport, 1, link_state);
+	err = mlx5_modify_vport_admin_state(esw->dev, opmod, vport, other_vport, link_state);
 	if (err) {
-		mlx5_core_warn(esw->dev,
-			       "Failed to set vport %d link state, err = %d",
-			       vport, err);
+		mlx5_core_warn(esw->dev, "Failed to set vport %d link state, opmod = %d, err = %d",
+			       vport, opmod, err);
 		goto unlock;
 	}
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index a5175e98c0b3..5785596f13f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -680,6 +680,8 @@ static inline int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int num_vfs) { r
 static inline void mlx5_eswitch_disable(struct mlx5_eswitch *esw, bool clear_vf) {}
 static inline bool mlx5_esw_lag_prereq(struct mlx5_core_dev *dev0, struct mlx5_core_dev *dev1) { return true; }
 static inline bool mlx5_eswitch_is_funcs_handler(struct mlx5_core_dev *dev) { return false; }
+static inline
+int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw, u16 vport, int link_state) { return 0; }
 static inline const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev)
 {
 	return ERR_PTR(-EOPNOTSUPP);
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 073b79eacc99..1340e02b14ef 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -4381,6 +4381,7 @@ struct mlx5_ifc_query_vport_state_out_bits {
 enum {
 	MLX5_VPORT_STATE_OP_MOD_VNIC_VPORT  = 0x0,
 	MLX5_VPORT_STATE_OP_MOD_ESW_VPORT   = 0x1,
+	MLX5_VPORT_STATE_OP_MOD_UPLINK      = 0x2,
 };
 
 struct mlx5_ifc_arm_monitor_counter_in_bits {
commit ed56d749c366be269d58b29597392e4a0ae71c0a
Author: Eran Ben Elisha <eranbe at mellanox.com>
Date:   Mon Jul 20 18:34:37 2020 +0300

    net/mlx5: Query PPS pin operational status before registering it
    
    In a special configuration, a ConnectX6-Dx pin pps-out might be activated
    when driver is loaded. Fix the driver to always read the operational pin
    mode when registering it, and advertise it accordingly.
    
    Fixes: ee7f12205abc ("net/mlx5e: Implement 1PPS support")
    Signed-off-by: Eran Ben Elisha <eranbe at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index 284806e331bd..2d55b7c22c03 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -452,6 +452,38 @@ static const struct ptp_clock_info mlx5_ptp_clock_info = {
 	.verify		= NULL,
 };
 
+static int mlx5_query_mtpps_pin_mode(struct mlx5_core_dev *mdev, u8 pin,
+				     u32 *mtpps, u32 mtpps_size)
+{
+	u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {};
+
+	MLX5_SET(mtpps_reg, in, pin, pin);
+
+	return mlx5_core_access_reg(mdev, in, sizeof(in), mtpps,
+				    mtpps_size, MLX5_REG_MTPPS, 0, 0);
+}
+
+static int mlx5_get_pps_pin_mode(struct mlx5_clock *clock, u8 pin)
+{
+	struct mlx5_core_dev *mdev = clock->mdev;
+	u32 out[MLX5_ST_SZ_DW(mtpps_reg)] = {};
+	u8 mode;
+	int err;
+
+	err = mlx5_query_mtpps_pin_mode(mdev, pin, out, sizeof(out));
+	if (err || !MLX5_GET(mtpps_reg, out, enable))
+		return PTP_PF_NONE;
+
+	mode = MLX5_GET(mtpps_reg, out, pin_mode);
+
+	if (mode == MLX5_PIN_MODE_IN)
+		return PTP_PF_EXTTS;
+	else if (mode == MLX5_PIN_MODE_OUT)
+		return PTP_PF_PEROUT;
+
+	return PTP_PF_NONE;
+}
+
 static int mlx5_init_pin_config(struct mlx5_clock *clock)
 {
 	int i;
@@ -471,7 +503,7 @@ static int mlx5_init_pin_config(struct mlx5_clock *clock)
 			 sizeof(clock->ptp_info.pin_config[i].name),
 			 "mlx5_pps%d", i);
 		clock->ptp_info.pin_config[i].index = i;
-		clock->ptp_info.pin_config[i].func = PTP_PF_NONE;
+		clock->ptp_info.pin_config[i].func = mlx5_get_pps_pin_mode(clock, i);
 		clock->ptp_info.pin_config[i].chan = 0;
 	}
 
commit 21083309cab1a66877b410cd61340b5dd7cf4875
Author: Raed Salem <raeds at mellanox.com>
Date:   Thu Jul 9 15:51:53 2020 +0300

    net/mlx5e: Fix slab-out-of-bounds in mlx5e_rep_is_lag_netdev
    
    mlx5e_rep_is_lag_netdev is used as first check as part of netdev events
    handler for bond device of non-uplink representors, this handler can get
    any netdevice under the same network namespace of mlx5e netdevice. Current
    code treats the netdev as mlx5e netdev and only later on verifies this,
    hence causes the following Kasan trace:
    [15402.744990] ==================================================================
    [15402.746942] BUG: KASAN: slab-out-of-bounds in mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.749009] Read of size 8 at addr ffff880391f3f6b0 by task ovs-vswitchd/5347
    
    [15402.752065] CPU: 7 PID: 5347 Comm: ovs-vswitchd Kdump: loaded Tainted: G    B      O     --------- -t - 4.18.0-g3dcc204d291d-dirty #1
    [15402.755349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
    [15402.757600] Call Trace:
    [15402.758968]  dump_stack+0x71/0xab
    [15402.760427]  print_address_description+0x6a/0x270
    [15402.761969]  kasan_report+0x179/0x2d0
    [15402.763445]  ? mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.765121]  mlx5e_rep_is_lag_netdev+0xcb/0xf0 [mlx5_core]
    [15402.766782]  mlx5e_rep_esw_bond_netevent+0x129/0x620 [mlx5_core]
    
    Fix by deferring the violating access to be post the netdev verify check.
    
    Fixes: 7e51891a237f ("net/mlx5e: Use netdev events to set/del egress acl forward-to-vport rule")
    Signed-off-by: Raed Salem <raeds at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Reviewed-by: Vu Pham <vuhuong at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
index bdb71332cbf2..3e44e4d820c5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c
@@ -183,13 +183,16 @@ void mlx5e_rep_bond_unslave(struct mlx5_eswitch *esw,
 
 static bool mlx5e_rep_is_lag_netdev(struct net_device *netdev)
 {
-	struct mlx5e_priv *priv = netdev_priv(netdev);
-	struct mlx5e_rep_priv *rpriv = priv->ppriv;
+	struct mlx5e_rep_priv *rpriv;
+	struct mlx5e_priv *priv;
 
 	/* A given netdev is not a representor or not a slave of LAG configuration */
 	if (!mlx5e_eswitch_rep(netdev) || !bond_slave_get_rtnl(netdev))
 		return false;
 
+	priv = netdev_priv(netdev);
+	rpriv = priv->ppriv;
+
 	/* Egress acl forward to vport is supported only non-uplink representor */
 	return rpriv->rep->vport != MLX5_VPORT_UPLINK;
 }
commit 071995c877a8646209d55ff8edddd2b054e7424c
Author: Eran Ben Elisha <eranbe at mellanox.com>
Date:   Wed Jul 8 11:10:01 2020 +0300

    net/mlx5: Verify Hardware supports requested ptp function on a given pin
    
    Fix a bug where driver did not verify Hardware pin capabilities for
    PTP functions.
    
    Fixes: ee7f12205abc ("net/mlx5e: Implement 1PPS support")
    Signed-off-by: Eran Ben Elisha <eranbe at mellanox.com>
    Reviewed-by: Ariel Levkovich <lariel at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index c6967e1a560b..284806e331bd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -408,10 +408,31 @@ static int mlx5_ptp_enable(struct ptp_clock_info *ptp,
 	return 0;
 }
 
+enum {
+	MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN = BIT(0),
+	MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT = BIT(1),
+};
+
 static int mlx5_ptp_verify(struct ptp_clock_info *ptp, unsigned int pin,
 			   enum ptp_pin_function func, unsigned int chan)
 {
-	return (func == PTP_PF_PHYSYNC) ? -EOPNOTSUPP : 0;
+	struct mlx5_clock *clock = container_of(ptp, struct mlx5_clock,
+						ptp_info);
+
+	switch (func) {
+	case PTP_PF_NONE:
+		return 0;
+	case PTP_PF_EXTTS:
+		return !(clock->pps_info.pin_caps[pin] &
+			 MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_IN);
+	case PTP_PF_PEROUT:
+		return !(clock->pps_info.pin_caps[pin] &
+			 MLX5_MTPPS_REG_CAP_PIN_X_MODE_SUPPORT_PPS_OUT);
+	default:
+		return -EOPNOTSUPP;
+	}
+
+	return -EOPNOTSUPP;
 }
 
 static const struct ptp_clock_info mlx5_ptp_clock_info = {
commit 88c8cf92db48b2e359fe3051ad8e09829c1bee5d
Author: Eran Ben Elisha <eranbe at mellanox.com>
Date:   Wed Jul 8 18:53:19 2020 +0300

    net/mlx5: Fix a bug of using ptp channel index as pin index
    
    On PTP mlx5_ptp_enable(on=0) flow, driver mistakenly used channel index
    as pin index.
    
    After ptp patch marked in fixes tag was introduced, driver can freely
    call ptp_find_pin() as part of the .enable() callback.
    
    Fix driver mlx5_ptp_enable(on=0) flow to always use ptp_find_pin(). With
    that, Driver will use the correct pin index in mlx5_ptp_enable(on=0) flow.
    
    In addition, when initializing the pins, always set channel to zero. As
    all pins can be attached to all channels, let ptp_set_pinfunc() to move
    them between the channels.
    
    For stable branches, this fix to be applied only on kernels that includes
    both patches in fixes tag. Otherwise, mlx5_ptp_enable(on=0) will be stuck
    on pincfg_mux.
    
    Fixes: 62582a7ee783 ("ptp: Avoid deadlocks in the programmable pin code.")
    Fixes: ee7f12205abc ("net/mlx5e: Implement 1PPS support")
    Signed-off-by: Eran Ben Elisha <eranbe at mellanox.com>
    Reviewed-by: Ariel Levkovich <lariel at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
index ef0706d15a5b..c6967e1a560b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
@@ -273,17 +273,17 @@ static int mlx5_extts_configure(struct ptp_clock_info *ptp,
 	if (rq->extts.index >= clock->ptp_info.n_pins)
 		return -EINVAL;
 
+	pin = ptp_find_pin(clock->ptp, PTP_PF_EXTTS, rq->extts.index);
+	if (pin < 0)
+		return -EBUSY;
+
 	if (on) {
-		pin = ptp_find_pin(clock->ptp, PTP_PF_EXTTS, rq->extts.index);
-		if (pin < 0)
-			return -EBUSY;
 		pin_mode = MLX5_PIN_MODE_IN;
 		pattern = !!(rq->extts.flags & PTP_FALLING_EDGE);
 		field_select = MLX5_MTPPS_FS_PIN_MODE |
 			       MLX5_MTPPS_FS_PATTERN |
 			       MLX5_MTPPS_FS_ENABLE;
 	} else {
-		pin = rq->extts.index;
 		field_select = MLX5_MTPPS_FS_ENABLE;
 	}
 
@@ -331,12 +331,12 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp,
 	if (rq->perout.index >= clock->ptp_info.n_pins)
 		return -EINVAL;
 
-	if (on) {
-		pin = ptp_find_pin(clock->ptp, PTP_PF_PEROUT,
-				   rq->perout.index);
-		if (pin < 0)
-			return -EBUSY;
+	pin = ptp_find_pin(clock->ptp, PTP_PF_PEROUT,
+			   rq->perout.index);
+	if (pin < 0)
+		return -EBUSY;
 
+	if (on) {
 		pin_mode = MLX5_PIN_MODE_OUT;
 		pattern = MLX5_OUT_PATTERN_PERIODIC;
 		ts.tv_sec = rq->perout.period.sec;
@@ -362,7 +362,6 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp,
 			       MLX5_MTPPS_FS_ENABLE |
 			       MLX5_MTPPS_FS_TIME_STAMP;
 	} else {
-		pin = rq->perout.index;
 		field_select = MLX5_MTPPS_FS_ENABLE;
 	}
 
@@ -452,7 +451,7 @@ static int mlx5_init_pin_config(struct mlx5_clock *clock)
 			 "mlx5_pps%d", i);
 		clock->ptp_info.pin_config[i].index = i;
 		clock->ptp_info.pin_config[i].func = PTP_PF_NONE;
-		clock->ptp_info.pin_config[i].chan = i;
+		clock->ptp_info.pin_config[i].chan = 0;
 	}
 
 	return 0;
commit 0e2e7aa57b8060ee357839dc4f1731a724ba387b
Author: Maor Dickman <maord at mellanox.com>
Date:   Wed Jul 8 13:01:36 2020 +0300

    net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup
    
    The cited commit add initialization of ethtool steering during
    representor rx initializations without cleaning it up in representor
    rx cleanup, this may cause for stale ethtool flows to remain after
    moving back from switchdev mode to legacy mode.
    
    Fixed by calling ethtool steering cleanup during rep rx cleanup.
    
    Fixes: 6783e8b29f63 ("net/mlx5e: Init ethtool steering for representors")
    Signed-off-by: Maor Dickman <maord at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Reviewed-by: Vlad Buslov <vladbu at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 006807e04eda..8c294ab43f90 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -936,6 +936,7 @@ err_close_drop_rq:
 
 static void mlx5e_cleanup_rep_rx(struct mlx5e_priv *priv)
 {
+	mlx5e_ethtool_cleanup_steering(priv);
 	rep_vport_rx_rule_destroy(priv);
 	mlx5e_destroy_rep_root_ft(priv);
 	mlx5e_destroy_ttc_table(priv, &priv->fs.ttc);
commit 5cd39b6e9a420329a9a408894be7ba8aa7dd755e
Author: Aya Levin <ayal at mellanox.com>
Date:   Wed Jul 1 12:21:53 2020 +0300

    net/mlx5e: Fix error path of device attach
    
    On failure to attach the netdev, fix the rollback by re-setting the
    device's state back to MLX5E_STATE_DESTROYING.
    
    Failing to attach doesn't stop statistics polling via .ndo_get_stats64.
    In this case, although the device is not attached, it falsely continues
    to query the firmware for counters. Setting the device's state back to
    MLX5E_STATE_DESTROYING prevents the firmware counters query.
    
    Fixes: 26e59d8077a3 ("net/mlx5e: Implement mlx5e interface attach/detach callbacks")
    Signed-off-by: Aya Levin <ayal at mellanox.com>
    Reviewed-by: Tariq Toukan <tariqt at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 081f15074cac..31f9ecae98df 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5390,6 +5390,8 @@ err_cleanup_tx:
 	profile->cleanup_tx(priv);
 
 out:
+	set_bit(MLX5E_STATE_DESTROYING, &priv->state);
+	cancel_work_sync(&priv->update_stats_work);
 	return err;
 }
 
commit 59f8f7c84c506cd4fafbfa47acd23ebdb6256dac
Author: Maor Gottlieb <maorg at mellanox.com>
Date:   Thu Jun 25 10:56:07 2020 +0300

    net/mlx5: Fix forward to next namespace
    
    The steering tree is as follow (nic RX as example):
                       ---------
                       |root_ns|
                       ---------
                            |
            --------------------------------
            |               |              |
       ----------      ----------      ---------
       |p(prio)0|      |   p1   |      |   pn  |
       ----------      ----------      ---------
            |               |
     ----------------  ---------------
     |ns(e.g bypass)|  |ns(e.g. lag) |
     ----------------  ---------------
      |     |    |
    ----  ----  ----
    |p0|  |p1|  |pn|
    ----  ----  ----
     |
    ----
    |FT|
    ----
    
    find_next_chained_ft(prio) returns the first flow table in the next
    priority. If prio is a parent of a flow table then it returns the first
    flow table in the next priority in the same namespace, else if prio
    is parent of namespace, then it should return the first flow table
    in the next namespace. Currently if the user requests to forward to
    next namespace, the code calls to find_next_chained_ft with the prio
    of the next namespace and not the prio of the namesapce itself.
    
    Fixes: 9254f8ed15b6 ("net/mlx5: Add support in forward to namespace")
    Signed-off-by: Maor Gottlieb <maorg at mellanox.com>
    Reviewed-by: Mark Bloch <markb at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 13e2fb79c21a..2569bb6228b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -797,7 +797,7 @@ static struct mlx5_flow_table *find_closest_ft_recursive(struct fs_node  *root,
 	return ft;
 }
 
-/* If reverse if false then return the first flow table in next priority of
+/* If reverse is false then return the first flow table in next priority of
  * prio in the tree, else return the last flow table in the previous priority
  * of prio in the tree.
  */
@@ -829,34 +829,16 @@ static struct mlx5_flow_table *find_prev_chained_ft(struct fs_prio *prio)
 	return find_closest_ft(prio, true);
 }
 
-static struct fs_prio *find_fwd_ns_prio(struct mlx5_flow_root_namespace *root,
-					struct mlx5_flow_namespace *ns)
-{
-	struct mlx5_flow_namespace *root_ns = &root->ns;
-	struct fs_prio *iter_prio;
-	struct fs_prio *prio;
-
-	fs_get_obj(prio, ns->node.parent);
-	list_for_each_entry(iter_prio, &root_ns->node.children, node.list) {
-		if (iter_prio == prio &&
-		    !list_is_last(&prio->node.children, &iter_prio->node.list))
-			return list_next_entry(iter_prio, node.list);
-	}
-	return NULL;
-}
-
 static struct mlx5_flow_table *find_next_fwd_ft(struct mlx5_flow_table *ft,
 						struct mlx5_flow_act *flow_act)
 {
-	struct mlx5_flow_root_namespace *root = find_root(&ft->node);
 	struct fs_prio *prio;
+	bool next_ns;
 
-	if (flow_act->action & MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_NS)
-		prio = find_fwd_ns_prio(root, ft->ns);
-	else
-		fs_get_obj(prio, ft->node.parent);
+	next_ns = flow_act->action & MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_NS;
+	fs_get_obj(prio, next_ns ? ft->ns->node.parent : ft->node.parent);
 
-	return (prio) ? find_next_chained_ft(prio) : NULL;
+	return find_next_chained_ft(prio);
 }
 
 static int connect_fts_in_prio(struct mlx5_core_dev *dev,
commit 0c2600c619578f759cf3d5192b01bd14e281f24c
Author: Parav Pandit <parav at mellanox.com>
Date:   Sat Jun 27 13:11:56 2020 +0300

    net/mlx5: E-switch, Destroy TSAR after reload interface
    
    When eswitch offloads is enabled, TSAR is created before reloading
    the interfaces.
    However when eswitch offloads mode is disabled, TSAR is disabled before
    reloading the interfaces.
    
    To keep the eswitch enable/disable sequence as mirror, destroy TSAR
    after reloading the interfaces.
    
    Fixes: 1bd27b11c1df ("net/mlx5: Introduce E-switch QoS management")
    Signed-off-by: Parav Pandit <parav at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 9701f0f8be50..d9376627584e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1653,8 +1653,6 @@ void mlx5_eswitch_disable_locked(struct mlx5_eswitch *esw, bool clear_vf)
 	else if (esw->mode == MLX5_ESWITCH_OFFLOADS)
 		esw_offloads_disable(esw);
 
-	esw_destroy_tsar(esw);
-
 	old_mode = esw->mode;
 	esw->mode = MLX5_ESWITCH_NONE;
 
@@ -1664,6 +1662,8 @@ void mlx5_eswitch_disable_locked(struct mlx5_eswitch *esw, bool clear_vf)
 		mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
 		mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_ETH);
 	}
+	esw_destroy_tsar(esw);
+
 	if (clear_vf)
 		mlx5_eswitch_clear_vf_vports_info(esw);
 }
commit 2b8e9c7c3fd0e31091edb1c66cc06ffe4988ca21
Author: Parav Pandit <parav at mellanox.com>
Date:   Sat Jun 27 13:29:28 2020 +0300

    net/mlx5: E-switch, Destroy TSAR when fail to enable the mode
    
    When either esw_legacy_enable() or esw_offloads_enable() fails,
    code missed to destroy the created TSAR.
    
    Hence, add the missing call to destroy the TSAR.
    
    Fixes: 610090ebce92 ("net/mlx5: E-switch, Initialize TSAR Qos hardware block before its user vports")
    Signed-off-by: Parav Pandit <parav at mellanox.com>
    Reviewed-by: Roi Dayan <roid at mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm at mellanox.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 1116ab9bea6c..9701f0f8be50 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1608,7 +1608,7 @@ abort:
 		mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
 		mlx5_reload_interface(esw->dev, MLX5_INTERFACE_PROTOCOL_ETH);
 	}
-
+	esw_destroy_tsar(esw);
 	return err;
 }
 
commit 7a9212d1783192eb087a24f7ef47e777e1d1a790
Merge: 181964e619b7 b7b5d25bdd7b
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Jul 28 12:54:48 2020 -0700

    Merge branch 'hns3-fixes'
    
    Huazhong Tan says:
    
    ====================
    net: hns3: fixes for -net
    
    There are some bugfixes for the HNS3 ethernet driver. patch#1 fixes
    a desc filling bug, patch#2 fixes a false TX timeout issue, and
    patch#3~#5 fixes some bugs related to VLAN and FD.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit b7b5d25bdd7bdea7d72a41e0a97b1b8f3dea2ee7
Author: Guojia Liao <liaoguojia at huawei.com>
Date:   Tue Jul 28 10:16:52 2020 +0800

    net: hns3: fix for VLAN config when reset failed
    
    When device is resetting or reset failed, firmware is unable to
    handle mailbox. VLAN should not be configured in this case.
    
    Fixes: fe4144d47eef ("net: hns3: sync VLAN filter entries when kill VLAN ID failed")
    Signed-off-by: Guojia Liao <liaoguojia at huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index cee84e7080d6..36575e72a915 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -9042,11 +9042,12 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto,
 	bool writen_to_tbl = false;
 	int ret = 0;
 
-	/* When device is resetting, firmware is unable to handle
-	 * mailbox. Just record the vlan id, and remove it after
+	/* When device is resetting or reset failed, firmware is unable to
+	 * handle mailbox. Just record the vlan id, and remove it after
 	 * reset finished.
 	 */
-	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) && is_kill) {
+	if ((test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) ||
+	     test_bit(HCLGE_STATE_RST_FAIL, &hdev->state)) && is_kill) {
 		set_bit(vlan_id, vport->vlan_del_fail_bmap);
 		return -EBUSY;
 	}
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index b8b72ac9935f..9162856de1b1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -1592,11 +1592,12 @@ static int hclgevf_set_vlan_filter(struct hnae3_handle *handle,
 	if (proto != htons(ETH_P_8021Q))
 		return -EPROTONOSUPPORT;
 
-	/* When device is resetting, firmware is unable to handle
-	 * mailbox. Just record the vlan id, and remove it after
+	/* When device is resetting or reset failed, firmware is unable to
+	 * handle mailbox. Just record the vlan id, and remove it after
 	 * reset finished.
 	 */
-	if (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state) && is_kill) {
+	if ((test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state) ||
+	     test_bit(HCLGEVF_STATE_RST_FAIL, &hdev->state)) && is_kill) {
 		set_bit(vlan_id, hdev->vlan_del_fail_bmap);
 		return -EBUSY;
 	}
@@ -3443,7 +3444,8 @@ void hclgevf_update_port_base_vlan_info(struct hclgevf_dev *hdev, u16 state,
 
 	rtnl_lock();
 
-	if (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state)) {
+	if (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state) ||
+	    test_bit(HCLGEVF_STATE_RST_FAIL, &hdev->state)) {
 		dev_warn(&hdev->pdev->dev,
 			 "is resetting when updating port based vlan info\n");
 		rtnl_unlock();
commit efe3fa45f770f1d66e2734ee7a3523c75694ff04
Author: Guojia Liao <liaoguojia at huawei.com>
Date:   Tue Jul 28 10:16:51 2020 +0800

    net: hns3: fix aRFS FD rules leftover after add a user FD rule
    
    When user had created a FD rule, all the aRFS rules should be clear up.
    HNS3 process flow as below:
    1.get spin lock of fd_ruls_list
    2.clear up all aRFS rules
    3.release lock
    4.get spin lock of fd_ruls_list
    5.creat a rules
    6.release lock;
    
    There is a short period of time between step 3 and step 4, which would
    creatting some new aRFS FD rules if driver was receiving packet.
    So refactor the fd_rule_lock to fix it.
    
    Fixes: 441228875706 ("net: hns3: refine the flow director handle")
    Signed-off-by: Guojia Liao <liaoguojia at huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index bb4a6327035d..cee84e7080d6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -5806,9 +5806,9 @@ static int hclge_add_fd_entry(struct hnae3_handle *handle,
 	/* to avoid rule conflict, when user configure rule by ethtool,
 	 * we need to clear all arfs rules
 	 */
+	spin_lock_bh(&hdev->fd_rule_lock);
 	hclge_clear_arfs_rules(handle);
 
-	spin_lock_bh(&hdev->fd_rule_lock);
 	ret = hclge_fd_config_rule(hdev, rule);
 
 	spin_unlock_bh(&hdev->fd_rule_lock);
@@ -5851,6 +5851,7 @@ static int hclge_del_fd_entry(struct hnae3_handle *handle,
 	return ret;
 }
 
+/* make sure being called after lock up with fd_rule_lock */
 static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
 				     bool clear_list)
 {
@@ -5863,7 +5864,6 @@ static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
 	if (!hnae3_dev_fd_supported(hdev))
 		return;
 
-	spin_lock_bh(&hdev->fd_rule_lock);
 	for_each_set_bit(location, hdev->fd_bmap,
 			 hdev->fd_cfg.rule_num[HCLGE_FD_STAGE_1])
 		hclge_fd_tcam_config(hdev, HCLGE_FD_STAGE_1, true, location,
@@ -5880,8 +5880,6 @@ static void hclge_del_all_fd_entries(struct hnae3_handle *handle,
 		bitmap_zero(hdev->fd_bmap,
 			    hdev->fd_cfg.rule_num[HCLGE_FD_STAGE_1]);
 	}
-
-	spin_unlock_bh(&hdev->fd_rule_lock);
 }
 
 static int hclge_restore_fd_entries(struct hnae3_handle *handle)
@@ -6263,7 +6261,7 @@ static int hclge_add_fd_entry_by_arfs(struct hnae3_handle *handle, u16 queue_id,
 				      u16 flow_id, struct flow_keys *fkeys)
 {
 	struct hclge_vport *vport = hclge_get_vport(handle);
-	struct hclge_fd_rule_tuples new_tuples;
+	struct hclge_fd_rule_tuples new_tuples = {};
 	struct hclge_dev *hdev = vport->back;
 	struct hclge_fd_rule *rule;
 	u16 tmp_queue_id;
@@ -6273,19 +6271,17 @@ static int hclge_add_fd_entry_by_arfs(struct hnae3_handle *handle, u16 queue_id,
 	if (!hnae3_dev_fd_supported(hdev))
 		return -EOPNOTSUPP;
 
-	memset(&new_tuples, 0, sizeof(new_tuples));
-	hclge_fd_get_flow_tuples(fkeys, &new_tuples);
-
-	spin_lock_bh(&hdev->fd_rule_lock);
-
 	/* when there is already fd rule existed add by user,
 	 * arfs should not work
 	 */
+	spin_lock_bh(&hdev->fd_rule_lock);
 	if (hdev->fd_active_type == HCLGE_FD_EP_ACTIVE) {
 		spin_unlock_bh(&hdev->fd_rule_lock);
 		return -EOPNOTSUPP;
 	}
 
+	hclge_fd_get_flow_tuples(fkeys, &new_tuples);
+
 	/* check is there flow director filter existed for this flow,
 	 * if not, create a new filter for it;
 	 * if filter exist with different queue id, modify the filter;
@@ -6368,6 +6364,7 @@ static void hclge_rfs_filter_expire(struct hclge_dev *hdev)
 #endif
 }
 
+/* make sure being called after lock up with fd_rule_lock */
 static void hclge_clear_arfs_rules(struct hnae3_handle *handle)
 {
 #ifdef CONFIG_RFS_ACCEL
@@ -6420,10 +6417,14 @@ static void hclge_enable_fd(struct hnae3_handle *handle, bool enable)
 
 	hdev->fd_en = enable;
 	clear = hdev->fd_active_type == HCLGE_FD_ARFS_ACTIVE;
-	if (!enable)
+
+	if (!enable) {
+		spin_lock_bh(&hdev->fd_rule_lock);
 		hclge_del_all_fd_entries(handle, clear);
-	else
+		spin_unlock_bh(&hdev->fd_rule_lock);
+	} else {
 		hclge_restore_fd_entries(handle);
+	}
 }
 
 static void hclge_cfg_mac_mode(struct hclge_dev *hdev, bool enable)
@@ -6886,8 +6887,9 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
 	int i;
 
 	set_bit(HCLGE_STATE_DOWN, &hdev->state);
-
+	spin_lock_bh(&hdev->fd_rule_lock);
 	hclge_clear_arfs_rules(handle);
+	spin_unlock_bh(&hdev->fd_rule_lock);
 
 	/* If it is not PF reset, the firmware will disable the MAC,
 	 * so it only need to stop phy here.
commit a6f7bfdc78ddd8d719d108fef973b4e4a5a6ac6b
Author: Jian Shen <shenjian15 at huawei.com>
Date:   Tue Jul 28 10:16:50 2020 +0800

    net: hns3: add reset check for VF updating port based VLAN
    
    Currently hclgevf_update_port_base_vlan_info() may be called when
    VF is resetting,  which may cause hns3_nic_net_open() being called
    twice unexpectedly.
    
    So fix it by adding a reset check for it, and extend critical
    region for rntl_lock in hclgevf_update_port_base_vlan_info().
    
    Fixes: 92f11ea177cd ("net: hns3: fix set port based VLAN issue for VF")
    Signed-off-by: Jian Shen <shenjian15 at huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index a10b022d1951..b8b72ac9935f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -3439,23 +3439,35 @@ void hclgevf_update_port_base_vlan_info(struct hclgevf_dev *hdev, u16 state,
 {
 	struct hnae3_handle *nic = &hdev->nic;
 	struct hclge_vf_to_pf_msg send_msg;
+	int ret;
 
 	rtnl_lock();
-	hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT);
-	rtnl_unlock();
+
+	if (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state)) {
+		dev_warn(&hdev->pdev->dev,
+			 "is resetting when updating port based vlan info\n");
+		rtnl_unlock();
+		return;
+	}
+
+	ret = hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT);
+	if (ret) {
+		rtnl_unlock();
+		return;
+	}
 
 	/* send msg to PF and wait update port based vlan info */
 	hclgevf_build_send_msg(&send_msg, HCLGE_MBX_SET_VLAN,
 			       HCLGE_MBX_PORT_BASE_VLAN_CFG);
 	memcpy(send_msg.data, port_base_vlan_info, data_size);
-	hclgevf_send_mbx_msg(hdev, &send_msg, false, NULL, 0);
-
-	if (state == HNAE3_PORT_BASE_VLAN_DISABLE)
-		nic->port_base_vlan_state = HNAE3_PORT_BASE_VLAN_DISABLE;
-	else
-		nic->port_base_vlan_state = HNAE3_PORT_BASE_VLAN_ENABLE;
+	ret = hclgevf_send_mbx_msg(hdev, &send_msg, false, NULL, 0);
+	if (!ret) {
+		if (state == HNAE3_PORT_BASE_VLAN_DISABLE)
+			nic->port_base_vlan_state = state;
+		else
+			nic->port_base_vlan_state = HNAE3_PORT_BASE_VLAN_ENABLE;
+	}
 
-	rtnl_lock();
 	hclgevf_notify_client(hdev, HNAE3_UP_CLIENT);
 	rtnl_unlock();
 }
commit a7e90ee5965fafc53d36e8b3205f08c88d7bc11f
Author: Yonglong Liu <liuyonglong at huawei.com>
Date:   Tue Jul 28 10:16:49 2020 +0800

    net: hns3: fix a TX timeout issue
    
    When the queue depth and queue parameters are modified, there is
    a low probability that TX timeout occurs. The two operations cause
    the link to be down or up when the watchdog is still working. All
    queues are stopped when the link is down. After the carrier is on,
    all queues are woken up. If the watchdog detects the link between
    the carrier on and wakeup queues, a false TX timeout occurs.
    
    So fix this issue by modifying the sequence of carrier on and queue
    wakeup, which is symmetrical to the link down action.
    
    Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
    Signed-off-by: Yonglong Liu <liuyonglong at huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 3328500c0543..71ed4c54f6d5 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -4136,8 +4136,8 @@ static void hns3_link_status_change(struct hnae3_handle *handle, bool linkup)
 		return;
 
 	if (linkup) {
-		netif_carrier_on(netdev);
 		netif_tx_wake_all_queues(netdev);
+		netif_carrier_on(netdev);
 		if (netif_msg_link(handle))
 			netdev_info(netdev, "link up\n");
 	} else {
commit cfdaeba5ddc98b303639a3265c2031ac5db249d6
Author: Yunsheng Lin <linyunsheng at huawei.com>
Date:   Tue Jul 28 10:16:48 2020 +0800

    net: hns3: fix desc filling bug when skb is expanded or lineared
    
    The linear and frag data part may be changed when the skb is expanded
    or lineared in skb_cow_head() or skb_checksum_help(), which is called
    by hns3_fill_skb_desc(), so the linear len return by skb_headlen()
    before the calling of hns3_fill_skb_desc() is unreliable.
    
    Move hns3_fill_skb_desc() before the calling of skb_headlen() to fix
    this bug.
    
    Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
    Signed-off-by: Yunsheng Lin <linyunsheng at huawei.com>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 33c481d11116..3328500c0543 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1093,16 +1093,8 @@ static int hns3_fill_desc(struct hns3_enet_ring *ring, void *priv,
 	int k, sizeoflast;
 	dma_addr_t dma;
 
-	if (type == DESC_TYPE_SKB) {
-		struct sk_buff *skb = (struct sk_buff *)priv;
-		int ret;
-
-		ret = hns3_fill_skb_desc(ring, skb, desc);
-		if (unlikely(ret < 0))
-			return ret;
-
-		dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
-	} else if (type == DESC_TYPE_FRAGLIST_SKB) {
+	if (type == DESC_TYPE_FRAGLIST_SKB ||
+	    type == DESC_TYPE_SKB) {
 		struct sk_buff *skb = (struct sk_buff *)priv;
 
 		dma = dma_map_single(dev, skb->data, size, DMA_TO_DEVICE);
@@ -1439,6 +1431,10 @@ netdev_tx_t hns3_nic_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 
 	next_to_use_head = ring->next_to_use;
 
+	ret = hns3_fill_skb_desc(ring, skb, &ring->desc[ring->next_to_use]);
+	if (unlikely(ret < 0))
+		goto fill_err;
+
 	ret = hns3_fill_skb_to_desc(ring, skb, DESC_TYPE_SKB);
 	if (unlikely(ret < 0))
 		goto fill_err;
commit 6ba1b005ffc388c2aeaddae20da29e4810dea298
Merge: fb896c910712 214ba3584b2e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Jul 28 11:55:53 2020 -0700

    Merge tag 'asm-generic-fixes-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic into master
    
    Pull asm-generic bugfix from Arnd Bergmann:
     "A single bugfix for a regression introduced through a typo in the v5.8
      merge window, leading to incorrect data returned from inl() on some
      architectures"
    
    * tag 'asm-generic-fixes-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
      io: Fix return type of _inb and _inl

commit fb896c9107127ec80263225dc060d9622697d76b
Merge: 4764e61e1d57 fe1d899f4212
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Jul 28 11:44:44 2020 -0700

    Merge tag 'arm-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc into master
    
    Pull ARM SoC DT fixes from Arnd Bergmann:
     "These are the latest device tree fixes for Arm SoCs:
    
       - TI Keystone2 ethernet regressed after a driver change broke with
         incorrect phy-mode in a board's DT source.
    
       - A similar fix is needed for two i.MX boards that were missed in an
         earlier bugfix.
    
       - DT change for Armada 38x allowing to add the register needed to fix
         NETA lockup when repeatedly switching speed.
    
       - One fix on imx6qdl-icore pin muxing to get USB OTG_ID and SD card
         detect work correctly.
    
       - Two fixes for the Allwinner SoCs, one to relax the CMA allocation
         ranges that were failing on older SoCs and one to fix Cedrus on the
         H6"
    
    * tag 'arm-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
      ARM: dts: keystone-k2g-evm: fix rgmii phy-mode for ksz9031 phy
      ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds
      ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect
      ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2
      ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2
      arm64: dts: allwinner: h6: Fix Cedrus IOMMU usage
      ARM: dts sunxi: Relax a bit the CMA pool allocation range

commit 8808981baf96e1b3dea1f08461e4d958aa0dbde1
Author: Wolfram Sang <wsa+renesas at sang-engineering.com>
Date:   Sat Jul 25 21:50:53 2020 +0200

    i2c: slave: add sanity check when unregistering
    
    Signed-off-by: Wolfram Sang <wsa+renesas at sang-engineering.com>
    Reviewed-by: Alain Volmat <alain.volmat at st.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/i2c-core-slave.c b/drivers/i2c/i2c-core-slave.c
index 549751347e6c..1589179d5eb9 100644
--- a/drivers/i2c/i2c-core-slave.c
+++ b/drivers/i2c/i2c-core-slave.c
@@ -58,6 +58,9 @@ int i2c_slave_unregister(struct i2c_client *client)
 {
 	int ret;
 
+	if (IS_ERR_OR_NULL(client))
+		return -EINVAL;
+
 	if (!client->adapter->algo->unreg_slave) {
 		dev_err(&client->dev, "%s: not supported by adapter\n", __func__);
 		return -EOPNOTSUPP;
commit 1b1be3bf27b62f5abcf85c6f3214bdb9c7526685
Author: Wolfram Sang <wsa+renesas at sang-engineering.com>
Date:   Sat Jul 25 21:50:52 2020 +0200

    i2c: slave: improve sanity check when registering
    
    Add check for ERR_PTR and simplify code while here.
    
    Signed-off-by: Wolfram Sang <wsa+renesas at sang-engineering.com>
    Reviewed-by: Alain Volmat <alain.volmat at st.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/i2c-core-slave.c b/drivers/i2c/i2c-core-slave.c
index 5427f047faf0..549751347e6c 100644
--- a/drivers/i2c/i2c-core-slave.c
+++ b/drivers/i2c/i2c-core-slave.c
@@ -18,10 +18,8 @@ int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb)
 {
 	int ret;
 
-	if (!client || !slave_cb) {
-		WARN(1, "insufficient data\n");
+	if (WARN(IS_ERR_OR_NULL(client) || !slave_cb, "insufficient data\n"))
 		return -EINVAL;
-	}
 
 	if (!(client->flags & I2C_CLIENT_SLAVE))
 		dev_warn(&client->dev, "%s: client slave flag not set. You might see address collisions\n",
commit f4a1692491b5cce8978cea19cb8946bc2c6f14bc
Merge: 8490d6a7e0a0 0d7869805a82
Author: Thomas Zimmermann <tzimmermann at suse.de>
Date:   Tue Jul 28 15:35:50 2020 +0200

    Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes
    
    Updating drm-misc-fixes to v5.8-rc7.

commit c2c3657f0aedb8736a0fb7b2b1985adfb86e7802
Author: Takashi Iwai <tiwai at suse.de>
Date:   Tue Jul 28 10:20:33 2020 +0200

    ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
    
    It's been reported that, when neither nouveau nor Nvidia graphics
    driver is used, the screen starts flickering.  And, after comparing
    between the working case (stable 4.4.x) and the broken case, it turned
    out that the problem comes from the audio component binding.  The
    Nvidia and AMD audio binding code clears the bus->keep_power flag
    whenever snd_hdac_acomp_init() succeeds.  But this doesn't mean that
    the component is actually bound, but it merely indicates that it's
    ready for binding.  So, when both nouveau and Nvidia are blacklisted
    or not ready, the driver keeps running without the audio component but
    also with bus->keep_power = false.  This made the driver runtime PM
    kicked in and powering down when unused, which results in flickering
    in the graphics side, as it seems.
    
    For fixing the bug, this patch moves the bus->keep_power flag change
    into generic_acomp_notifier_set() that is the function called from the
    master_bind callback of component ops; i.e. it's guaranteed that the
    binding succeeded.
    
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208609
    Fixes: 5a858e79c911 ("ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs")
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200728082033.23933-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 41eaa89660c3..cd46247988e4 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2440,6 +2440,7 @@ static void generic_acomp_notifier_set(struct drm_audio_component *acomp,
 	mutex_lock(&spec->bind_lock);
 	spec->use_acomp_notifier = use_acomp;
 	spec->codec->relaxed_resume = use_acomp;
+	spec->codec->bus->keep_power = 0;
 	/* reprogram each jack detection logic depending on the notifier */
 	for (i = 0; i < spec->num_pins; i++)
 		reprogram_jack_detect(spec->codec,
@@ -2534,7 +2535,6 @@ static void generic_acomp_init(struct hda_codec *codec,
 	if (!snd_hdac_acomp_init(&codec->bus->core, &spec->drm_audio_ops,
 				 match_bound_vga, 0)) {
 		spec->acomp_registered = true;
-		codec->bus->keep_power = 0;
 	}
 }
 
commit b757b47a2fcba584d4a32fd7ee68faca510ab96f
Author: Will Deacon <will at kernel.org>
Date:   Thu Jul 23 11:17:14 2020 +0100

    KVM: arm64: Don't inherit exec permission across page-table levels
    
    If a stage-2 page-table contains an executable, read-only mapping at the
    pte level (e.g. due to dirty logging being enabled), a subsequent write
    fault to the same page which tries to install a larger block mapping
    (e.g. due to dirty logging having been disabled) will erroneously inherit
    the exec permission and consequently skip I-cache invalidation for the
    rest of the block.
    
    Ensure that exec permission is only inherited by write faults when the
    new mapping is of the same size as the existing one. A subsequent
    instruction abort will result in I-cache invalidation for the entire
    block mapping.
    
    Signed-off-by: Will Deacon <will at kernel.org>
    Signed-off-by: Marc Zyngier <maz at kernel.org>
    Tested-by: Quentin Perret <qperret at google.com>
    Reviewed-by: Quentin Perret <qperret at google.com>
    Cc: Marc Zyngier <maz at kernel.org>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200723101714.15873-1-will@kernel.org

diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index 8c0035cab6b6..31058e6e7c2a 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1326,7 +1326,7 @@ static bool stage2_get_leaf_entry(struct kvm *kvm, phys_addr_t addr,
 	return true;
 }
 
-static bool stage2_is_exec(struct kvm *kvm, phys_addr_t addr)
+static bool stage2_is_exec(struct kvm *kvm, phys_addr_t addr, unsigned long sz)
 {
 	pud_t *pudp;
 	pmd_t *pmdp;
@@ -1338,11 +1338,11 @@ static bool stage2_is_exec(struct kvm *kvm, phys_addr_t addr)
 		return false;
 
 	if (pudp)
-		return kvm_s2pud_exec(pudp);
+		return sz <= PUD_SIZE && kvm_s2pud_exec(pudp);
 	else if (pmdp)
-		return kvm_s2pmd_exec(pmdp);
+		return sz <= PMD_SIZE && kvm_s2pmd_exec(pmdp);
 	else
-		return kvm_s2pte_exec(ptep);
+		return sz == PAGE_SIZE && kvm_s2pte_exec(ptep);
 }
 
 static int stage2_set_pte(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
@@ -1958,7 +1958,8 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
 	 * execute permissions, and we preserve whatever we have.
 	 */
 	needs_exec = exec_fault ||
-		(fault_status == FSC_PERM && stage2_is_exec(kvm, fault_ipa));
+		(fault_status == FSC_PERM &&
+		 stage2_is_exec(kvm, fault_ipa, vma_pagesize));
 
 	if (vma_pagesize == PUD_SIZE) {
 		pud_t new_pud = kvm_pfn_pud(pfn, mem_type);
commit bf4086b1a1efa3d3a2c17582e00bbd2176dfe177
Author: Marc Zyngier <maz at kernel.org>
Date:   Wed Jul 22 17:22:31 2020 +0100

    KVM: arm64: Prevent vcpu_has_ptrauth from generating OOL functions
    
    So far, vcpu_has_ptrauth() is implemented in terms of system_supports_*_auth()
    calls, which are declared "inline". In some specific conditions (clang
    and SCS), the "inline" very much turns into an "out of line", which
    leads to a fireworks when this predicate is evaluated on a non-VHE
    system (right at the beginning of __hyp_handle_ptrauth).
    
    Instead, make sure vcpu_has_ptrauth gets expanded inline by directly
    using the cpus_have_final_cap() helpers, which are __always_inline,
    generate much better code, and are the only thing that make sense when
    running at EL2 on a nVHE system.
    
    Fixes: 29eb5a3c57f7 ("KVM: arm64: Handle PtrAuth traps early")
    Reported-by: Nathan Chancellor <natechancellor at gmail.com>
    Reported-by: Nick Desaulniers <ndesaulniers at google.com>
    Signed-off-by: Marc Zyngier <maz at kernel.org>
    Tested-by: Nathan Chancellor <natechancellor at gmail.com>
    Reviewed-by: Nathan Chancellor <natechancellor at gmail.com>
    Link: https://lore.kernel.org/r/20200722162231.3689767-1-maz@kernel.org

diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index c3e6fcc664b1..e21d4a01372f 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -380,9 +380,14 @@ struct kvm_vcpu_arch {
 #define vcpu_has_sve(vcpu) (system_supports_sve() && \
 			    ((vcpu)->arch.flags & KVM_ARM64_GUEST_HAS_SVE))
 
-#define vcpu_has_ptrauth(vcpu)	((system_supports_address_auth() || \
-				  system_supports_generic_auth()) && \
-				 ((vcpu)->arch.flags & KVM_ARM64_GUEST_HAS_PTRAUTH))
+#ifdef CONFIG_ARM64_PTR_AUTH
+#define vcpu_has_ptrauth(vcpu)						\
+	((cpus_have_final_cap(ARM64_HAS_ADDRESS_AUTH) ||		\
+	  cpus_have_final_cap(ARM64_HAS_GENERIC_AUTH)) &&		\
+	 (vcpu)->arch.flags & KVM_ARM64_GUEST_HAS_PTRAUTH)
+#else
+#define vcpu_has_ptrauth(vcpu)		false
+#endif
 
 #define vcpu_gp_regs(v)		(&(v)->arch.ctxt.gp_regs)
 
commit d5dba1376e2bafec0f4408dc65706c5908964083
Author: Sabrina Dubroca <sd at queasysnail.net>
Date:   Mon Jul 27 16:03:47 2020 +0200

    xfrm: esp6: fix the location of the transport header with encapsulation
    
    commit 17175d1a27c6 ("xfrm: esp6: fix encapsulation header offset
    computation") changed esp6_input_done2 to correctly find the size of
    the IPv6 header that precedes the TCP/UDP encapsulation header, but
    didn't adjust the final call to skb_set_transport_header, which I
    assumed was correct in using skb_network_header_len.
    
    Xiumei Mu reported that when we create xfrm states that include port
    numbers in the selector, traffic from the user sockets is dropped. It
    turns out that we get a state mismatch in __xfrm_policy_check, because
    we end up trying to compare the encapsulation header's ports with the
    selector that's based on user traffic ports.
    
    Fixes: 0146dca70b87 ("xfrm: add support for UDPv6 encapsulation of ESP")
    Fixes: 26333c37fc28 ("xfrm: add IPv6 support for espintcp")
    Reported-by: Xiumei Mu <xmu at redhat.com>
    Signed-off-by: Sabrina Dubroca <sd at queasysnail.net>
    Signed-off-by: Steffen Klassert <steffen.klassert at secunet.com>

diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 55ae70be91b3..52c2f063529f 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -815,6 +815,7 @@ int esp6_input_done2(struct sk_buff *skb, int err)
 		offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
 		uh = (void *)(skb->data + offset);
 		th = (void *)(skb->data + offset);
+		hdr_len += offset;
 
 		switch (x->encap->encap_type) {
 		case TCP_ENCAP_ESPINTCP:
commit 4764e61e1d57c0bc3569dbc540af8bb28e18d2e6
Merge: 92ed30191993 04a8a3d0a73f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Jul 27 17:04:45 2020 -0700

    Merge tag 'sh-for-5.8-part2' of git://git.libc.org/linux-sh into master
    
    Pull arch/sh fixes from Rich Felker:
     "Two last-minute fixes: one is for a boot regression (mmu code broken)
      and the other fixes a long-standing broken syscall number bounds
      check"
    
    * tag 'sh-for-5.8-part2' of git://git.libc.org/linux-sh:
      sh: Fix validation of system call number
      sh/tlb: Fix PGTABLE_LEVELS > 2

commit 181964e619b76ae2e71bcdc6001cf977bec4cf6e
Author: Al Viro <viro at zeniv.linux.org.uk>
Date:   Mon Jul 27 19:22:20 2020 +0100

    fix a braino in cmsghdr_from_user_compat_to_kern()
    
    commit 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to
    copy_from_user()") missed one of the places where ucmlen should've been
    replaced with cmsg.cmsg_len, now that we are fetching the entire struct
    rather than doing it field-by-field.
    
            As the result, compat sendmsg() with several different-sized cmsg
    attached started to fail with EINVAL.  Trivial to fix, fortunately.
    
    Fixes: 547ce4cfb34c ("switch cmsghdr_from_user_compat_to_kern() to copy_from_user()")
    Reported-by: Nick Bowler <nbowler at draconx.ca>
    Tested-by: Nick Bowler <nbowler at draconx.ca>
    Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/compat.c b/net/compat.c
index 5e3041a2c37d..434838bef5f8 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -202,7 +202,7 @@ int cmsghdr_from_user_compat_to_kern(struct msghdr *kmsg, struct sock *sk,
 
 		/* Advance. */
 		kcmsg = (struct cmsghdr *)((char *)kcmsg + tmp);
-		ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, ucmlen);
+		ucmsg = cmsg_compat_nxthdr(kmsg, ucmsg, cmsg.cmsg_len);
 	}
 
 	/*
commit 04a8a3d0a73f51c7c2da84f494db7ec1df230e69
Author: Michael Karcher <kernel at mkarcher.dialup.fu-berlin.de>
Date:   Thu Jul 23 01:13:19 2020 +0200

    sh: Fix validation of system call number
    
    The slow path for traced system call entries accessed a wrong memory
    location to get the number of the maximum allowed system call number.
    Renumber the numbered "local" label for the correct location to avoid
    collisions with actual local labels.
    
    Signed-off-by: Michael Karcher <kernel at mkarcher.dialup.fu-berlin.de>
    Tested-by: John Paul Adrian Glaubitz <glaubitz at physik.fu-berlin.de>
    Fixes: f3a8308864f920d2 ("sh: Add a few missing irqflags tracing markers.")
    Signed-off-by: Rich Felker <dalias at libc.org>

diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index 956a7a03b0c8..9bac5bbb67f3 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -199,7 +199,7 @@ syscall_trace_entry:
 	mov.l	@(OFF_R7,r15), r7   ! arg3
 	mov.l	@(OFF_R3,r15), r3   ! syscall_nr
 	!
-	mov.l	2f, r10			! Number of syscalls
+	mov.l	6f, r10			! Number of syscalls
 	cmp/hs	r10, r3
 	bf	syscall_call
 	mov	#-ENOSYS, r0
@@ -353,7 +353,7 @@ ENTRY(system_call)
 	tst	r9, r8
 	bf	syscall_trace_entry
 	!
-	mov.l	2f, r8			! Number of syscalls
+	mov.l	6f, r8			! Number of syscalls
 	cmp/hs	r8, r3
 	bt	syscall_badsys
 	!
@@ -392,7 +392,7 @@ syscall_exit:
 #if !defined(CONFIG_CPU_SH2)
 1:	.long	TRA
 #endif
-2:	.long	NR_syscalls
+6:	.long	NR_syscalls
 3:	.long	sys_call_table
 7:	.long	do_syscall_trace_enter
 8:	.long	do_syscall_trace_leave
commit c7bcbc8ab9cb20536b8f50c62a48cebda965fdba
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Fri Jul 17 13:10:07 2020 +0200

    sh/tlb: Fix PGTABLE_LEVELS > 2
    
    Geert reported that his SH7722-based Migo-R board failed to boot after
    commit:
    
      c5b27a889da9 ("sh/tlb: Convert SH to generic mmu_gather")
    
    That commit fell victim to copying the wrong pattern --
    __pmd_free_tlb() used to be implemented with pmd_free().
    
    Fixes: c5b27a889da9 ("sh/tlb: Convert SH to generic mmu_gather")
    Reported-by: Geert Uytterhoeven <geert at linux-m68k.org>
    Signed-off-by: Peter Zijlstra (Intel) <peterz at infradead.org>
    Reviewed-by: Geert Uytterhoeven <geert+renesas at glider.be>
    Tested-by: Geert Uytterhoeven <geert+renesas at glider.be>
    Signed-off-by: Rich Felker <dalias at libc.org>

diff --git a/arch/sh/include/asm/pgalloc.h b/arch/sh/include/asm/pgalloc.h
index 22d968bfe9bb..d770da3f8b6f 100644
--- a/arch/sh/include/asm/pgalloc.h
+++ b/arch/sh/include/asm/pgalloc.h
@@ -12,6 +12,7 @@ extern void pgd_free(struct mm_struct *mm, pgd_t *pgd);
 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
 extern pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address);
 extern void pmd_free(struct mm_struct *mm, pmd_t *pmd);
+#define __pmd_free_tlb(tlb, pmdp, addr)		pmd_free((tlb)->mm, (pmdp))
 #endif
 
 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
@@ -33,13 +34,4 @@ do {							\
 	tlb_remove_page((tlb), (pte));			\
 } while (0)
 
-#if CONFIG_PGTABLE_LEVELS > 2
-#define __pmd_free_tlb(tlb, pmdp, addr)			\
-do {							\
-	struct page *page = virt_to_page(pmdp);		\
-	pgtable_pmd_page_dtor(page);			\
-	tlb_remove_page((tlb), page);			\
-} while (0);
-#endif
-
 #endif /* __ASM_SH_PGALLOC_H */
commit 175233f92e80d09f78be51e5b9abf5ca1fc9dc26
Author: Li Heng <liheng40 at huawei.com>
Date:   Thu Jul 23 11:27:42 2020 +0800

    drm: Remove redundant NULL check
    
    Fix below warnings reported by coccicheck:
    ./drivers/gpu/drm/drm_drv.c:819:2-7: WARNING: NULL check before some freeing functions is not needed.
    
    Fixes: 5dad34f3c444 ("drm: Cleanups after drmm_add_final_kfree rollout")
    Signed-off-by: Li Heng <liheng40 at huawei.com>
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/1595474863-33112-1-git-send-email-liheng40@huawei.com

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index bc38322f306e..13068fdf4331 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -815,8 +815,7 @@ static void drm_dev_release(struct kref *ref)
 
 	drm_managed_release(dev);
 
-	if (dev->managed.final_kfree)
-		kfree(dev->managed.final_kfree);
+	kfree(dev->managed.final_kfree);
 }
 
 /**
commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864
Author: Steve Cohen <cohens at codeaurora.org>
Date:   Mon Jul 20 18:30:50 2020 -0400

    drm: hold gem reference until object is no longer accessed
    
    A use-after-free in drm_gem_open_ioctl can happen if the
    GEM object handle is closed between the idr lookup and
    retrieving the size from said object since a local reference
    is not being held at that point. Hold the local reference
    while the object can still be accessed to fix this and
    plug the potential security hole.
    
    Signed-off-by: Steve Cohen <cohens at codeaurora.org>
    Cc: stable at vger.kernel.org
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 7bf628e13023..ee2058ad482c 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -871,9 +871,6 @@ err:
  * @file_priv: drm file-private structure
  *
  * Open an object using the global name, returning a handle and the size.
- *
- * This handle (of course) holds a reference to the object, so the object
- * will not go away until the handle is deleted.
  */
 int
 drm_gem_open_ioctl(struct drm_device *dev, void *data,
@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
 
 	/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
 	ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
-	drm_gem_object_put_unlocked(obj);
 	if (ret)
-		return ret;
+		goto err;
 
 	args->handle = handle;
 	args->size = obj->size;
 
-	return 0;
+err:
+	drm_gem_object_put_unlocked(obj);
+	return ret;
 }
 
 /**
commit 11d268107ad4c7d694148269e3b23ef43dd0e8ba
Merge: 5fd82200d870 94b6c13be57c
Author: David S. Miller <davem at davemloft.net>
Date:   Mon Jul 27 12:56:59 2020 -0700

    Merge branch 'selftests-net-Fix-clang-warnings-on-powerpc'
    
    Tanner Love says:
    
    ====================
    selftests/net: Fix clang warnings on powerpc
    
    This is essentially a v2 of
    http://patchwork.ozlabs.org/project/netdev/patch/20200724181757.2331172-1-tannerlove.kernel@gmail.com/,
    but it has been split up in order to have only one "Fixes" tag per
    patch.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 94b6c13be57cdedb7cf4d33dbcd066fad133f22b
Author: Tanner Love <tannerlove at google.com>
Date:   Mon Jul 27 12:25:31 2020 -0400

    selftests/net: tcp_mmap: fix clang warning for target arch PowerPC
    
    When size_t maps to unsigned int (e.g. on 32-bit powerpc), then the
    comparison with 1<<35 is always true. Clang 9 threw:
    warning: result of comparison of constant 34359738368 with \
    expression of type 'size_t' (aka 'unsigned int') is always true \
    [-Wtautological-constant-out-of-range-compare]
            while (total < FILE_SZ) {
    
    Tested: make -C tools/testing/selftests TARGETS="net" run_tests
    
    Fixes: 192dc405f308 ("selftests: net: add tcp_mmap program")
    Signed-off-by: Tanner Love <tannerlove at google.com>
    Acked-by: Willem de Bruijn <willemb at google.com>
    Reviewed-by: Eric Dumazet <edumazet at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/tcp_mmap.c b/tools/testing/selftests/net/tcp_mmap.c
index 4555f88252ba..a61b7b3da549 100644
--- a/tools/testing/selftests/net/tcp_mmap.c
+++ b/tools/testing/selftests/net/tcp_mmap.c
@@ -344,7 +344,7 @@ int main(int argc, char *argv[])
 {
 	struct sockaddr_storage listenaddr, addr;
 	unsigned int max_pacing_rate = 0;
-	size_t total = 0;
+	uint64_t total = 0;
 	char *host = NULL;
 	int fd, c, on = 1;
 	char *buffer;
@@ -473,12 +473,12 @@ int main(int argc, char *argv[])
 		zflg = 0;
 	}
 	while (total < FILE_SZ) {
-		ssize_t wr = FILE_SZ - total;
+		int64_t wr = FILE_SZ - total;
 
 		if (wr > chunk_size)
 			wr = chunk_size;
 		/* Note : we just want to fill the pipe with 0 bytes */
-		wr = send(fd, buffer, wr, zflg ? MSG_ZEROCOPY : 0);
+		wr = send(fd, buffer, (size_t)wr, zflg ? MSG_ZEROCOPY : 0);
 		if (wr <= 0)
 			break;
 		total += wr;
commit b4da96ffd30bd4a305045ba5c9b0de5d4aa20dc7
Author: Tanner Love <tannerlove at google.com>
Date:   Mon Jul 27 12:25:30 2020 -0400

    selftests/net: so_txtime: fix clang issues for target arch PowerPC
    
    On powerpcle, int64_t maps to long long. Clang 9 threw:
    warning: absolute value function 'labs' given an argument of type \
    'long long' but has parameter of type 'long' which may cause \
    truncation of value [-Wabsolute-value]
            if (labs(tstop - texpect) > cfg_variance_us)
    
    Tested: make -C tools/testing/selftests TARGETS="net" run_tests
    
    Fixes: af5136f95045 ("selftests/net: SO_TXTIME with ETF and FQ")
    Signed-off-by: Tanner Love <tannerlove at google.com>
    Acked-by: Willem de Bruijn <willemb at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c
index ceaad78e9667..3155fbbf644b 100644
--- a/tools/testing/selftests/net/so_txtime.c
+++ b/tools/testing/selftests/net/so_txtime.c
@@ -121,7 +121,7 @@ static bool do_recv_one(int fdr, struct timed_send *ts)
 	if (rbuf[0] != ts->data)
 		error(1, 0, "payload mismatch. expected %c", ts->data);
 
-	if (labs(tstop - texpect) > cfg_variance_us)
+	if (llabs(tstop - texpect) > cfg_variance_us)
 		error(1, 0, "exceeds variance (%d us)", cfg_variance_us);
 
 	return false;
commit 64f9ede2274980076423583683d44480909b7a40
Author: Tanner Love <tannerlove at google.com>
Date:   Mon Jul 27 12:25:29 2020 -0400

    selftests/net: psock_fanout: fix clang issues for target arch PowerPC
    
    Clang 9 threw:
    warning: format specifies type 'unsigned short' but the argument has \
    type 'int' [-Wformat]
                    typeflags, PORT_BASE, PORT_BASE + port_off);
    
    Tested: make -C tools/testing/selftests TARGETS="net" run_tests
    
    Fixes: 77f65ebdca50 ("packet: packet fanout rollover during socket overload")
    Signed-off-by: Tanner Love <tannerlove at google.com>
    Acked-by: Willem de Bruijn <willemb at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
index 8c8c7d79c38d..2c522f7a0aec 100644
--- a/tools/testing/selftests/net/psock_fanout.c
+++ b/tools/testing/selftests/net/psock_fanout.c
@@ -350,7 +350,8 @@ static int test_datapath(uint16_t typeflags, int port_off,
 	int fds[2], fds_udp[2][2], ret;
 
 	fprintf(stderr, "\ntest: datapath 0x%hx ports %hu,%hu\n",
-		typeflags, PORT_BASE, PORT_BASE + port_off);
+		typeflags, (uint16_t)PORT_BASE,
+		(uint16_t)(PORT_BASE + port_off));
 
 	fds[0] = sock_fanout_open(typeflags, 0);
 	fds[1] = sock_fanout_open(typeflags, 0);
commit 955cbe91bcf782c09afe369c95a20f0a4b6dcc3c
Author: Tanner Love <tannerlove at google.com>
Date:   Mon Jul 27 12:25:28 2020 -0400

    selftests/net: rxtimestamp: fix clang issues for target arch PowerPC
    
    The signedness of char is implementation-dependent. Some systems
    (including PowerPC and ARM) use unsigned char. Clang 9 threw:
    warning: result of comparison of constant -1 with expression of type \
    'char' is always true [-Wtautological-constant-out-of-range-compare]
                                      &arg_index)) != -1) {
    
    Tested: make -C tools/testing/selftests TARGETS="net" run_tests
    
    Fixes: 16e781224198 ("selftests/net: Add a test to validate behavior of rx timestamps")
    Signed-off-by: Tanner Love <tannerlove at google.com>
    Acked-by: Willem de Bruijn <willemb at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/rxtimestamp.c b/tools/testing/selftests/net/rxtimestamp.c
index 422e7761254d..bcb79ba1f214 100644
--- a/tools/testing/selftests/net/rxtimestamp.c
+++ b/tools/testing/selftests/net/rxtimestamp.c
@@ -329,8 +329,7 @@ int main(int argc, char **argv)
 	bool all_tests = true;
 	int arg_index = 0;
 	int failures = 0;
-	int s, t;
-	char opt;
+	int s, t, opt;
 
 	while ((opt = getopt_long(argc, argv, "", long_options,
 				  &arg_index)) != -1) {
commit 5fd82200d870a5dd3e509c98ef2041f580b2c0e1
Author: laurent brando <laurent.brando at nxp.com>
Date:   Mon Jul 27 18:26:14 2020 +0800

    net: mscc: ocelot: fix hardware timestamp dequeue logic
    
    The next hw timestamp should be snapshoot to the read registers
    only once the current timestamp has been read.
    If none of the pending skbs matches the current HW timestamp
    just gracefully flush the available timestamp by reading it.
    
    Signed-off-by: laurent brando <laurent.brando at nxp.com>
    Signed-off-by: Vladimir Oltean <vladimir.oltean at nxp.com>
    Signed-off-by: Yangbo Lu <yangbo.lu at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 9cfe1fd98c30..f17da67a4622 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -748,21 +748,21 @@ void ocelot_get_txtstamp(struct ocelot *ocelot)
 
 		spin_unlock_irqrestore(&port->tx_skbs.lock, flags);
 
-		/* Next ts */
-		ocelot_write(ocelot, SYS_PTP_NXT_PTP_NXT, SYS_PTP_NXT);
+		/* Get the h/w timestamp */
+		ocelot_get_hwtimestamp(ocelot, &ts);
 
 		if (unlikely(!skb_match))
 			continue;
 
-		/* Get the h/w timestamp */
-		ocelot_get_hwtimestamp(ocelot, &ts);
-
 		/* Set the timestamp into the skb */
 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
 		shhwtstamps.hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
 		skb_tstamp_tx(skb_match, &shhwtstamps);
 
 		dev_kfree_skb_any(skb_match);
+
+		/* Next ts */
+		ocelot_write(ocelot, SYS_PTP_NXT_PTP_NXT, SYS_PTP_NXT);
 	}
 }
 EXPORT_SYMBOL(ocelot_get_txtstamp);
commit 367fe04eb64760fab400bdc990cc6067071e1e39
Author: Matthieu Baerts <matthieu.baerts at tessares.net>
Date:   Mon Jul 27 12:24:33 2020 +0200

    mptcp: fix joined subflows with unblocking sk
    
    Unblocking sockets used for outgoing connections were not containing
    inet info about the initial connection due to a typo there: the value of
    "err" variable is negative in the kernelspace.
    
    This fixes the creation of additional subflows where the remote port has
    to be reused if the other host didn't announce another one. This also
    fixes inet_diag showing blank info about MPTCP sockets from unblocking
    sockets doing a connect().
    
    Fixes: 41be81a8d3d0 ("mptcp: fix unblocking connect()")
    Signed-off-by: Matthieu Baerts <matthieu.baerts at tessares.net>
    Acked-by: Paolo Abeni <pabeni at redhat.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 3980fbb6f31e..c0abe738e7d3 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1833,7 +1833,7 @@ do_connect:
 	/* on successful connect, the msk state will be moved to established by
 	 * subflow_finish_connect()
 	 */
-	if (!err || err == EINPROGRESS)
+	if (!err || err == -EINPROGRESS)
 		mptcp_copy_inaddrs(sock->sk, ssock->sk);
 	else
 		inet_sk_state_store(sock->sk, inet_sk_state_load(ssock->sk));
commit 900ab59e2621053b009f707f80b2c19ce0af5dee
Author: Paul Cercueil <paul at crapouillou.net>
Date:   Fri Jul 3 16:13:41 2020 +0200

    drm/dbi: Fix SPI Type 1 (9-bit) transfer
    
    The function mipi_dbi_spi1_transfer() will transfer its payload as 9-bit
    data, the 9th (MSB) bit being the data/command bit. In order to do that,
    it unpacks the 8-bit values into 16-bit values, then sets the 9th bit if
    the byte corresponds to data, clears it otherwise. The 7 MSB are
    padding. The array of now 16-bit values is then passed to the SPI core
    for transfer.
    
    This function was broken since its introduction, as the length of the
    SPI transfer was set to the payload size before its conversion, but the
    payload doubled in size due to the 8-bit -> 16-bit conversion.
    
    Fixes: 02dd95fe3169 ("drm/tinydrm: Add MIPI DBI support")
    Cc: <stable at vger.kernel.org> # 5.4+
    Signed-off-by: Paul Cercueil <paul at crapouillou.net>
    Reviewed-by: Sam Ravnborg <sam at ravnborg.org>
    Reviewed-by: Noralf Trønnes <noralf at tronnes.org>
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200703141341.1266263-1-paul@crapouillou.net

diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c
index bb27c82757f1..bf7888ad9ad4 100644
--- a/drivers/gpu/drm/drm_mipi_dbi.c
+++ b/drivers/gpu/drm/drm_mipi_dbi.c
@@ -923,7 +923,7 @@ static int mipi_dbi_spi1_transfer(struct mipi_dbi *dbi, int dc,
 			}
 		}
 
-		tr.len = chunk;
+		tr.len = chunk * 2;
 		len -= chunk;
 
 		ret = spi_sync(spi, &m);
commit d076947912696efc1e223b25799a025cd73d6a22
Author: Akash Asthana <akashast at codeaurora.org>
Date:   Mon Jul 27 13:56:00 2020 +0530

    MAINTAINERS: Update GENI I2C maintainers list
    
    Alok Chauhan has moved out of GENI team, he no longer supports GENI I2C
    driver, remove him from maintainer list.
    
    Add Akash Asthana & Mukesh Savaliya as maintainers for GENI I2C drivers.
    
    Signed-off-by: Akash Asthana <akashast at codeaurora.org>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index f0569cf304ca..ee2286adb736 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14188,7 +14188,8 @@ F:	Documentation/devicetree/bindings/net/qcom,ethqos.txt
 F:	drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
 
 QUALCOMM GENERIC INTERFACE I2C DRIVER
-M:	Alok Chauhan <alokc at codeaurora.org>
+M:	Akash Asthana <akashast at codeaurora.org>
+M:	Mukesh Savaliya <msavaliy at codeaurora.org>
 L:	linux-i2c at vger.kernel.org
 L:	linux-arm-msm at vger.kernel.org
 S:	Supported
commit 8be23aec0ee151de731626d5578973fde25b2285
Author: Wolfram Sang <wsa+renesas at sang-engineering.com>
Date:   Sat Jul 25 16:07:36 2020 +0200

    i2c: also convert placeholder function to return errno
    
    All i2c_new_device-alike functions return ERR_PTR these days, but this
    fallback function was missed.
    
    Fixes: 2dea645ffc21 ("i2c: acpi: Return error pointers from i2c_acpi_new_device()")
    Signed-off-by: Wolfram Sang <wsa+renesas at sang-engineering.com>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
    [wsa: changed from 'ENOSYS' to 'ENODEV']
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index ee328cf80bd9..4e7714c88f95 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -1001,7 +1001,7 @@ static inline u32 i2c_acpi_find_bus_speed(struct device *dev)
 static inline struct i2c_client *i2c_acpi_new_device(struct device *dev,
 					int index, struct i2c_board_info *info)
 {
-	return NULL;
+	return ERR_PTR(-ENODEV);
 }
 static inline struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle)
 {
commit a6630529aecb5a3e84370c376ed658e892e6261e
Author: Takashi Iwai <tiwai at suse.de>
Date:   Mon Jul 27 18:44:43 2020 +0200

    ALSA: hda: Workaround for spurious wakeups on some Intel platforms
    
    We've received a regression report on Intel HD-audio controller that
    wakes up immediately after S3 suspend.  The bisection leads to the
    commit c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not
    needed").  This commit replaces the system-suspend to use
    pm_runtime_force_suspend() instead of the direct call of
    __azx_runtime_suspend().  However, by some really mysterious reason,
    pm_runtime_force_suspend() causes a spurious wakeup (although it calls
    the same __azx_runtime_suspend() internally).
    
    As an ugly workaround for now, revert the behavior to call
    __azx_runtime_suspend() and __azx_runtime_resume() for those old Intel
    platforms that may exhibit such a problem, while keeping the new
    standard pm_runtime_force_suspend() and pm_runtime_force_resume()
    pair for the remaining chips.
    
    Fixes: c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not needed")
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208649
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200727164443.4233-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index 82e26442724b..a356fb0e5773 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -41,7 +41,7 @@
 /* 24 unused */
 #define AZX_DCAPS_COUNT_LPIB_DELAY  (1 << 25)	/* Take LPIB as delay */
 #define AZX_DCAPS_PM_RUNTIME	(1 << 26)	/* runtime PM support */
-/* 27 unused */
+#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27) /* Workaround for spurious wakeups after suspend */
 #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)	/* CORBRP clears itself after reset */
 #define AZX_DCAPS_NO_MSI64      (1 << 29)	/* Stick to 32-bit MSIs */
 #define AZX_DCAPS_SEPARATE_STREAM_TAG	(1 << 30) /* capture and playback use separate stream tag */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 11ec5c56c80e..9d14c40c07ea 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -298,7 +298,8 @@ enum {
 /* PCH for HSW/BDW; with runtime PM */
 /* no i915 binding for this as HSW/BDW has another controller for HDMI */
 #define AZX_DCAPS_INTEL_PCH \
-	(AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME)
+	(AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
+	 AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
 
 /* HSW HDMI */
 #define AZX_DCAPS_INTEL_HASWELL \
@@ -1028,7 +1029,14 @@ static int azx_suspend(struct device *dev)
 	chip = card->private_data;
 	bus = azx_bus(chip);
 	snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
-	pm_runtime_force_suspend(dev);
+	/* An ugly workaround: direct call of __azx_runtime_suspend() and
+	 * __azx_runtime_resume() for old Intel platforms that suffer from
+	 * spurious wakeups after S3 suspend
+	 */
+	if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
+		__azx_runtime_suspend(chip);
+	else
+		pm_runtime_force_suspend(dev);
 	if (bus->irq >= 0) {
 		free_irq(bus->irq, chip);
 		bus->irq = -1;
@@ -1057,7 +1065,10 @@ static int azx_resume(struct device *dev)
 	if (azx_acquire_irq(chip, 1) < 0)
 		return -EIO;
 
-	pm_runtime_force_resume(dev);
+	if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
+		__azx_runtime_resume(chip, false);
+	else
+		pm_runtime_force_resume(dev);
 	snd_power_change_state(card, SNDRV_CTL_POWER_D0);
 
 	trace_azx_resume(chip);
commit 5351a56b1a4ceafd7a17ebfdf3cda430cdfd365d
Author: Jason Gunthorpe <jgg at nvidia.com>
Date:   Mon Jul 27 12:57:12 2020 +0300

    RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
    
    destroy_prefetch_work() must always be called if the work is not going
    to be queued. The num_sge also should have been set to i, not i-1
    which avoids the condition where it shouldn't have been called in the
    first place.
    
    Cc: stable at vger.kernel.org
    Fixes: fb985e278a30 ("RDMA/mlx5: Use SRCU properly in ODP prefetch")
    Link: https://lore.kernel.org/r/20200727095712.495652-1-leon@kernel.org
    Signed-off-by: Leon Romanovsky <leonro at mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 1ab676b66894..77dca1e05bba 100644
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1797,9 +1797,7 @@ static bool init_prefetch_work(struct ib_pd *pd,
 		work->frags[i].mr =
 			get_prefetchable_mr(pd, advice, sg_list[i].lkey);
 		if (!work->frags[i].mr) {
-			work->num_sge = i - 1;
-			if (i)
-				destroy_prefetch_work(work);
+			work->num_sge = i;
 			return false;
 		}
 
@@ -1865,6 +1863,7 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
 	srcu_key = srcu_read_lock(&dev->odp_srcu);
 	if (!init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge)) {
 		srcu_read_unlock(&dev->odp_srcu, srcu_key);
+		destroy_prefetch_work(work);
 		return -EINVAL;
 	}
 	queue_work(system_unbound_wq, &work->work);
commit 31142a4ba617f5aa8aefdf1c65561ca30d43f360
Author: Jason Gunthorpe <jgg at nvidia.com>
Date:   Fri Jul 24 10:19:29 2020 -0300

    RDMA/cm: Add min length checks to user structure copies
    
    These are missing throughout ucma, it harmlessly copies garbage from
    userspace, but in this new code which uses min to compute the copy length
    it can result in uninitialized stack memory. Check for minimum length at
    the very start.
    
      BUG: KMSAN: uninit-value in ucma_connect+0x2aa/0xab0 drivers/infiniband/core/ucma.c:1091
      CPU: 0 PID: 8457 Comm: syz-executor069 Not tainted 5.8.0-rc5-syzkaller #0
      Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
      Call Trace:
       __dump_stack lib/dump_stack.c:77 [inline]
       dump_stack+0x1df/0x240 lib/dump_stack.c:118
       kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
       __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
       ucma_connect+0x2aa/0xab0 drivers/infiniband/core/ucma.c:1091
       ucma_write+0x5c5/0x630 drivers/infiniband/core/ucma.c:1764
       do_loop_readv_writev fs/read_write.c:737 [inline]
       do_iter_write+0x710/0xdc0 fs/read_write.c:1020
       vfs_writev fs/read_write.c:1091 [inline]
       do_writev+0x42d/0x8f0 fs/read_write.c:1134
       __do_sys_writev fs/read_write.c:1207 [inline]
       __se_sys_writev+0x9b/0xb0 fs/read_write.c:1204
       __x64_sys_writev+0x4a/0x70 fs/read_write.c:1204
       do_syscall_64+0xb0/0x150 arch/x86/entry/common.c:386
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 34e2ab57a911 ("RDMA/ucma: Extend ucma_connect to receive ECE parameters")
    Fixes: 0cb15372a615 ("RDMA/cma: Connect ECE to rdma_accept")
    Link: https://lore.kernel.org/r/0-v1-d5b86dab17dc+28c25-ucma_syz_min_jgg@nvidia.com
    Reported-by: syzbot+086ab5ca9eafd2379aa6 at syzkaller.appspotmail.com
    Reported-by: syzbot+7446526858b83c8828b2 at syzkaller.appspotmail.com
    Reviewed-by: Leon Romanovsky <leonro at mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 5b87eee8ccc8..d03dacaef788 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1084,6 +1084,8 @@ static ssize_t ucma_connect(struct ucma_file *file, const char __user *inbuf,
 	size_t in_size;
 	int ret;
 
+	if (in_len < offsetofend(typeof(cmd), reserved))
+		return -EINVAL;
 	in_size = min_t(size_t, in_len, sizeof(cmd));
 	if (copy_from_user(&cmd, inbuf, in_size))
 		return -EFAULT;
@@ -1141,6 +1143,8 @@ static ssize_t ucma_accept(struct ucma_file *file, const char __user *inbuf,
 	size_t in_size;
 	int ret;
 
+	if (in_len < offsetofend(typeof(cmd), reserved))
+		return -EINVAL;
 	in_size = min_t(size_t, in_len, sizeof(cmd));
 	if (copy_from_user(&cmd, inbuf, in_size))
 		return -EFAULT;
commit 2a1658bf922ffd9b7907e270a7d9cdc9643fc45d
Author: Sam Ravnborg <sam at ravnborg.org>
Date:   Thu Jul 9 21:30:16 2020 +0200

    drm/drm_fb_helper: fix fbdev with sparc64
    
    Recent kernels have been reported to panic using the bochs_drm
    framebuffer under qemu-system-sparc64 which was bisected to
    commit 7a0483ac4ffc ("drm/bochs: switch to generic drm fbdev emulation").
    
    The backtrace indicates that the shadow framebuffer copy in
    drm_fb_helper_dirty_blit_real() is trying to access the real
    framebuffer using a virtual address rather than use an IO access
    typically implemented using a physical (ASI_PHYS) access on SPARC.
    
    The fix is to replace the memcpy with memcpy_toio() from io.h.
    
    memcpy_toio() uses writeb() where the original fbdev code
    used sbus_memcpy_toio(). The latter uses sbus_writeb().
    
    The difference between writeb() and sbus_memcpy_toio() is
    that writeb() writes bytes in little-endian, where sbus_writeb() writes
    bytes in big-endian. As endian does not matter for byte writes they are
    the same. So we can safely use memcpy_toio() here.
    
    Note that this only fixes bochs, in general fbdev helpers still have
    issues with mixing up system memory and __iomem space. Fixing that will
    require a lot more work.
    
    v3:
      - Improved changelog (Daniel)
      - Added FIXME to fbdev_use_iomem (Daniel)
    
    v2:
      - Added missing __iomem cast (kernel test robot)
      - Made changelog readable and fix typos (Mark)
      - Add flag to select iomem - and set it in the bochs driver
    
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Reported-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Reported-by: kernel test robot <lkp at intel.com>
    Tested-by: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Cc: Mark Cave-Ayland <mark.cave-ayland at ilande.co.uk>
    Cc: Thomas Zimmermann <tzimmermann at suse.de>
    Cc: Gerd Hoffmann <kraxel at redhat.com>
    Cc: "David S. Miller" <davem at davemloft.net>
    Cc: sparclinux at vger.kernel.org
    Link: https://patchwork.freedesktop.org/patch/msgid/20200709193016.291267-1-sam@ravnborg.org
    Link: https://patchwork.freedesktop.org/patch/msgid/20200725191012.GA434957@ravnborg.org

diff --git a/drivers/gpu/drm/bochs/bochs_kms.c b/drivers/gpu/drm/bochs/bochs_kms.c
index 05d8373888e8..079f46f5cdb6 100644
--- a/drivers/gpu/drm/bochs/bochs_kms.c
+++ b/drivers/gpu/drm/bochs/bochs_kms.c
@@ -146,6 +146,7 @@ int bochs_kms_init(struct bochs_device *bochs)
 	bochs->dev->mode_config.preferred_depth = 24;
 	bochs->dev->mode_config.prefer_shadow = 0;
 	bochs->dev->mode_config.prefer_shadow_fbdev = 1;
+	bochs->dev->mode_config.fbdev_use_iomem = true;
 	bochs->dev->mode_config.quirk_addfb_prefer_host_byte_order = true;
 
 	bochs->dev->mode_config.funcs = &bochs_mode_funcs;
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 5609e164805f..89cfd68ef400 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -399,7 +399,11 @@ static void drm_fb_helper_dirty_blit_real(struct drm_fb_helper *fb_helper,
 	unsigned int y;
 
 	for (y = clip->y1; y < clip->y2; y++) {
-		memcpy(dst, src, len);
+		if (!fb_helper->dev->mode_config.fbdev_use_iomem)
+			memcpy(dst, src, len);
+		else
+			memcpy_toio((void __iomem *)dst, src, len);
+
 		src += fb->pitches[0];
 		dst += fb->pitches[0];
 	}
diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
index 6c3ef49b46b3..e73dea5c7333 100644
--- a/include/drm/drm_mode_config.h
+++ b/include/drm/drm_mode_config.h
@@ -865,6 +865,18 @@ struct drm_mode_config {
 	 */
 	bool prefer_shadow_fbdev;
 
+	/**
+	 * @fbdev_use_iomem:
+	 *
+	 * Set to true if framebuffer reside in iomem.
+	 * When set to true memcpy_toio() is used when copying the framebuffer in
+	 * drm_fb_helper.drm_fb_helper_dirty_blit_real().
+	 *
+	 * FIXME: This should be replaced with a per-mapping is_iomem
+	 * flag (like ttm does), and then used everywhere in fbdev code.
+	 */
+	bool fbdev_use_iomem;
+
 	/**
 	 * @quirk_addfb_prefer_xbgr_30bpp:
 	 *
commit 5e105c88ab4859bc1aedd29e8d2f55e599427035
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 27 08:55:09 2020 -0400

    KVM: nVMX: check for invalid hdr.vmx.flags
    
    hdr.vmx.flags is meant for future extensions to the ABI, rejecting
    invalid flags is necessary to avoid broken half-loads of the
    nVMX state.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 6a0e32a7418c..11e4df560018 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -6079,6 +6079,9 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
 	    ~(KVM_STATE_NESTED_SMM_GUEST_MODE | KVM_STATE_NESTED_SMM_VMXON))
 		return -EINVAL;
 
+	if (kvm_state->hdr.vmx.flags & ~KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE)
+		return -EINVAL;
+
 	/*
 	 * SMM temporarily disables VMX, so we cannot be in guest mode,
 	 * nor can VMLAUNCH/VMRESUME be pending.  Outside SMM, SMM flags
diff --git a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
index 94f28a657569..d59f3eb67c8f 100644
--- a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
@@ -146,6 +146,11 @@ void test_vmx_nested_state(struct kvm_vm *vm)
 	state->hdr.vmx.smm.flags = 1;
 	test_nested_state_expect_einval(vm, state);
 
+	/* Invalid flags are rejected. */
+	set_default_vmx_state(state, state_sz);
+	state->hdr.vmx.flags = ~0;
+	test_nested_state_expect_einval(vm, state);
+
 	/* It is invalid to have vmxon_pa == -1ull and vmcs_pa != -1ull. */
 	set_default_vmx_state(state, state_sz);
 	state->hdr.vmx.vmxon_pa = -1ull;
@@ -206,6 +211,14 @@ void test_vmx_nested_state(struct kvm_vm *vm)
 	state->flags = 0;
 	test_nested_state(vm, state);
 
+	/* Invalid flags are rejected, even if no VMCS loaded. */
+	set_default_vmx_state(state, state_sz);
+	state->size = sizeof(*state);
+	state->flags = 0;
+	state->hdr.vmx.vmcs12_pa = -1;
+	state->hdr.vmx.flags = ~0;
+	test_nested_state_expect_einval(vm, state);
+
 	/* vmxon_pa cannot be the same address as vmcs_pa. */
 	set_default_vmx_state(state, state_sz);
 	state->hdr.vmx.vmxon_pa = 0;
commit 0f02bd0ade9a552492463c0159abbe26c4d92b40
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 27 09:00:37 2020 -0400

    KVM: nVMX: check for required but missing VMCS12 in KVM_SET_NESTED_STATE
    
    A missing VMCS12 was not causing -EINVAL (it was just read with
    copy_from_user, so it is not a security issue, but it is still
    wrong).  Test for VMCS12 validity and reject the nested state
    if a VMCS12 is required but not present.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index d4a4cec034d0..6a0e32a7418c 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -6108,9 +6108,16 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
 	if (ret)
 		return ret;
 
-	/* Empty 'VMXON' state is permitted */
-	if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12))
-		return 0;
+	/* Empty 'VMXON' state is permitted if no VMCS loaded */
+	if (kvm_state->size < sizeof(*kvm_state) + sizeof(*vmcs12)) {
+		/* See vmx_has_valid_vmcs12.  */
+		if ((kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE) ||
+		    (kvm_state->flags & KVM_STATE_NESTED_EVMCS) ||
+		    (kvm_state->hdr.vmx.vmcs12_pa != -1ull))
+			return -EINVAL;
+		else
+			return 0;
+	}
 
 	if (kvm_state->hdr.vmx.vmcs12_pa != -1ull) {
 		if (kvm_state->hdr.vmx.vmcs12_pa == kvm_state->hdr.vmx.vmxon_pa ||
diff --git a/arch/x86/kvm/vmx/nested.h b/arch/x86/kvm/vmx/nested.h
index 758bccc26cf9..197148d76b8f 100644
--- a/arch/x86/kvm/vmx/nested.h
+++ b/arch/x86/kvm/vmx/nested.h
@@ -47,6 +47,11 @@ static inline struct vmcs12 *get_shadow_vmcs12(struct kvm_vcpu *vcpu)
 	return to_vmx(vcpu)->nested.cached_shadow_vmcs12;
 }
 
+/*
+ * Note: the same condition is checked against the state provided by userspace
+ * in vmx_set_nested_state; if it is satisfied, the nested state must include
+ * the VMCS12.
+ */
 static inline int vmx_has_valid_vmcs12(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
diff --git a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
index d14a34f1b018..94f28a657569 100644
--- a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
@@ -183,9 +183,19 @@ void test_vmx_nested_state(struct kvm_vm *vm)
 	state->hdr.vmx.smm.flags = KVM_STATE_NESTED_SMM_GUEST_MODE;
 	test_nested_state_expect_einval(vm, state);
 
-	/* Size must be large enough to fit kvm_nested_state and vmcs12. */
+	/*
+	 * Size must be large enough to fit kvm_nested_state and vmcs12
+	 * if VMCS12 physical address is set
+	 */
+	set_default_vmx_state(state, state_sz);
+	state->size = sizeof(*state);
+	state->flags = 0;
+	test_nested_state_expect_einval(vm, state);
+
 	set_default_vmx_state(state, state_sz);
 	state->size = sizeof(*state);
+	state->flags = 0;
+	state->hdr.vmx.vmcs12_pa = -1;
 	test_nested_state(vm, state);
 
 	/*
commit 9319676595a2da8022327119e89c8b13f934835e
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Mon Jul 27 08:45:00 2020 -0400

    selftests: kvm: do not set guest mode flag
    
    Setting KVM_STATE_NESTED_GUEST_MODE enables various consistency checks
    on VMCS12 and therefore causes KVM_SET_NESTED_STATE to fail spuriously
    with -EINVAL.  Do not set the flag so that we're sure to cover the
    conditions included by the test, and cover the case where VMCS12 is
    set and KVM_SET_NESTED_STATE is called with invalid VMCS12 contents.
    
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
index 54cdefdfb49d..d14a34f1b018 100644
--- a/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
+++ b/tools/testing/selftests/kvm/x86_64/vmx_set_nested_state_test.c
@@ -76,10 +76,8 @@ void set_default_state(struct kvm_nested_state *state)
 void set_default_vmx_state(struct kvm_nested_state *state, int size)
 {
 	memset(state, 0, size);
-	state->flags = KVM_STATE_NESTED_GUEST_MODE  |
-			KVM_STATE_NESTED_RUN_PENDING;
 	if (have_evmcs)
-		state->flags |= KVM_STATE_NESTED_EVMCS;
+		state->flags = KVM_STATE_NESTED_EVMCS;
 	state->format = 0;
 	state->size = size;
 	state->hdr.vmx.vmxon_pa = 0x1000;
@@ -190,17 +188,20 @@ void test_vmx_nested_state(struct kvm_vm *vm)
 	state->size = sizeof(*state);
 	test_nested_state(vm, state);
 
+	/*
+	 * KVM_SET_NESTED_STATE succeeds with invalid VMCS
+	 * contents but L2 not running.
+	 */
+	set_default_vmx_state(state, state_sz);
+	state->flags = 0;
+	test_nested_state(vm, state);
+
 	/* vmxon_pa cannot be the same address as vmcs_pa. */
 	set_default_vmx_state(state, state_sz);
 	state->hdr.vmx.vmxon_pa = 0;
 	state->hdr.vmx.vmcs12_pa = 0;
 	test_nested_state_expect_einval(vm, state);
 
-	/* The revision id for vmcs12 must be VMCS12_REVISION. */
-	set_default_vmx_state(state, state_sz);
-	set_revision_id_for_vmcs12(state, 0);
-	test_nested_state_expect_einval(vm, state);
-
 	/*
 	 * Test that if we leave nesting the state reflects that when we get
 	 * it again.
commit 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac
Author: PeiSen Hou <pshou at realtek.com>
Date:   Mon Jul 27 13:56:47 2020 +0200

    ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
    
    Intel requires to enable power saving mode for intel reference board (alc256)
    
    Signed-off-by: PeiSen Hou <pshou at realtek.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200727115647.10967-1-tiwai@suse.de
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3f2512942daf..0f640d99a396 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7590,7 +7590,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
 	SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
-	SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK),
+	SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
 	SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
 	SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
 	SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
commit 214ba3584b2e2c57536fa8aed52521ac59c5b448
Author: Stafford Horne <shorne at gmail.com>
Date:   Sun Jul 26 12:11:54 2020 +0900

    io: Fix return type of _inb and _inl
    
    The return type of functions _inb, _inw and _inl are all u16 which looks
    wrong.  This patch makes them u8, u16 and u32 respectively.
    
    The original commit text for these does not indicate that these should
    be all forced to u16.
    
    Fixes: f009c89df79a ("io: Provide _inX() and _outX()")
    Signed-off-by: Stafford Horne <shorne at gmail.com>
    Reviewed-by: John Garry <john.garry at huawei.com>
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/include/asm-generic/io.h b/include/asm-generic/io.h
index 8b1e020e9a03..30a3aab312e6 100644
--- a/include/asm-generic/io.h
+++ b/include/asm-generic/io.h
@@ -456,7 +456,7 @@ static inline void writesq(volatile void __iomem *addr, const void *buffer,
 
 #if !defined(inb) && !defined(_inb)
 #define _inb _inb
-static inline u16 _inb(unsigned long addr)
+static inline u8 _inb(unsigned long addr)
 {
 	u8 val;
 
@@ -482,7 +482,7 @@ static inline u16 _inw(unsigned long addr)
 
 #if !defined(inl) && !defined(_inl)
 #define _inl _inl
-static inline u16 _inl(unsigned long addr)
+static inline u32 _inl(unsigned long addr)
 {
 	u32 val;
 
commit da3a9e9a6aa96ef589c153078f66e0646bf06b55
Author: Neil Armstrong <narmstrong at baylibre.com>
Date:   Thu Jul 23 11:05:50 2020 +0200

    drm/fourcc: fix Amlogic Video Framebuffer Compression macro
    
    Fix the Amlogic Video Framebuffer Compression modifier macro to
    correctly add the layout options, a pair of parenthesis was missing.
    
    Fixes: d6528ec88309 ("drm/fourcc: Add modifier definitions for describing Amlogic Video Framebuffer Compression")
    Signed-off-by: Neil Armstrong <narmstrong at baylibre.com>
    Acked-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200723090551.27529-1-narmstrong@baylibre.com

diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h
index 4bee7de5f306..82f327801267 100644
--- a/include/uapi/drm/drm_fourcc.h
+++ b/include/uapi/drm/drm_fourcc.h
@@ -1004,7 +1004,7 @@ drm_fourcc_canonicalize_nvidia_format_mod(__u64 modifier)
 #define DRM_FORMAT_MOD_AMLOGIC_FBC(__layout, __options) \
 	fourcc_mod_code(AMLOGIC, \
 			((__layout) & __fourcc_mod_amlogic_layout_mask) | \
-			((__options) & __fourcc_mod_amlogic_options_mask \
+			(((__options) & __fourcc_mod_amlogic_options_mask) \
 			 << __fourcc_mod_amlogic_options_shift))
 
 /* Amlogic FBC Layouts */
commit 909adfc66b9a1db21b5e8733e9ebfa6cd5135d74
Author: Nicholas Piggin <npiggin at gmail.com>
Date:   Mon Jul 27 16:09:47 2020 +1000

    powerpc/64s/hash: Fix hash_preload running with interrupts enabled
    
    Commit 2f92447f9f96 ("powerpc/book3s64/hash: Use the pte_t address from the
    caller") removed the local_irq_disable from hash_preload, but it was
    required for more than just the page table walk: the hash pte busy bit is
    effectively a lock which may be taken in interrupt context, and the local
    update flag test must not be preempted before it's used.
    
    This solves apparent lockups with perf interrupting __hash_page_64K. If
    get_perf_callchain then also takes a hash fault on the same page while it
    is already locked, it will loop forever taking hash faults, which looks like
    this:
    
      cpu 0x49e: Vector: 100 (System Reset) at [c00000001a4f7d70]
          pc: c000000000072dc8: hash_page_mm+0x8/0x800
          lr: c00000000000c5a4: do_hash_page+0x24/0x38
          sp: c0002ac1cc69ac70
         msr: 8000000000081033
        current = 0xc0002ac1cc602e00
        paca    = 0xc00000001de1f280   irqmask: 0x03   irq_happened: 0x01
          pid   = 20118, comm = pread2_processe
      Linux version 5.8.0-rc6-00345-g1fad14f18bc6
      49e:mon> t
      [c0002ac1cc69ac70] c00000000000c5a4 do_hash_page+0x24/0x38 (unreliable)
      --- Exception: 300 (Data Access) at c00000000008fa60 __copy_tofrom_user_power7+0x20c/0x7ac
      [link register   ] c000000000335d10 copy_from_user_nofault+0xf0/0x150
      [c0002ac1cc69af70] c00032bf9fa3c880 (unreliable)
      [c0002ac1cc69afa0] c000000000109df0 read_user_stack_64+0x70/0xf0
      [c0002ac1cc69afd0] c000000000109fcc perf_callchain_user_64+0x15c/0x410
      [c0002ac1cc69b060] c000000000109c00 perf_callchain_user+0x20/0x40
      [c0002ac1cc69b080] c00000000031c6cc get_perf_callchain+0x25c/0x360
      [c0002ac1cc69b120] c000000000316b50 perf_callchain+0x70/0xa0
      [c0002ac1cc69b140] c000000000316ddc perf_prepare_sample+0x25c/0x790
      [c0002ac1cc69b1a0] c000000000317350 perf_event_output_forward+0x40/0xb0
      [c0002ac1cc69b220] c000000000306138 __perf_event_overflow+0x88/0x1a0
      [c0002ac1cc69b270] c00000000010cf70 record_and_restart+0x230/0x750
      [c0002ac1cc69b620] c00000000010d69c perf_event_interrupt+0x20c/0x510
      [c0002ac1cc69b730] c000000000027d9c performance_monitor_exception+0x4c/0x60
      [c0002ac1cc69b750] c00000000000b2f8 performance_monitor_common_virt+0x1b8/0x1c0
      --- Exception: f00 (Performance Monitor) at c0000000000cb5b0 pSeries_lpar_hpte_insert+0x0/0x160
      [link register   ] c0000000000846f0 __hash_page_64K+0x210/0x540
      [c0002ac1cc69ba50] 0000000000000000 (unreliable)
      [c0002ac1cc69bb00] c000000000073ae0 update_mmu_cache+0x390/0x3a0
      [c0002ac1cc69bb70] c00000000037f024 wp_page_copy+0x364/0xce0
      [c0002ac1cc69bc20] c00000000038272c do_wp_page+0xdc/0xa60
      [c0002ac1cc69bc70] c0000000003857bc handle_mm_fault+0xb9c/0x1b60
      [c0002ac1cc69bd50] c00000000006c434 __do_page_fault+0x314/0xc90
      [c0002ac1cc69be20] c00000000000c5c8 handle_page_fault+0x10/0x2c
      --- Exception: 300 (Data Access) at 00007fff8c861fe8
      SP (7ffff6b19660) is in userspace
    
    Fixes: 2f92447f9f96 ("powerpc/book3s64/hash: Use the pte_t address from the caller")
    Reported-by: Athira Rajeev <atrajeev at linux.vnet.ibm.com>
    Reported-by: Anton Blanchard <anton at ozlabs.org>
    Signed-off-by: Nicholas Piggin <npiggin at gmail.com>
    Reviewed-by: Aneesh Kumar K.V <aneesh.kumar at linux.ibm.com>
    Signed-off-by: Michael Ellerman <mpe at ellerman.id.au>
    Link: https://lore.kernel.org/r/20200727060947.10060-1-npiggin@gmail.com

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 0fc8bad878b2..446e54c3f71e 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -3072,10 +3072,18 @@ do_hash_page:
 	ori	r0,r0,DSISR_BAD_FAULT_64S at l
 	and.	r0,r5,r0		/* weird error? */
 	bne-	handle_page_fault	/* if not, try to insert a HPTE */
+
+	/*
+	 * If we are in an "NMI" (e.g., an interrupt when soft-disabled), then
+	 * don't call hash_page, just fail the fault. This is required to
+	 * prevent re-entrancy problems in the hash code, namely perf
+	 * interrupts hitting while something holds H_PAGE_BUSY, and taking a
+	 * hash fault. See the comment in hash_preload().
+	 */
 	ld	r11, PACA_THREAD_INFO(r13)
-	lwz	r0,TI_PREEMPT(r11)	/* If we're in an "NMI" */
-	andis.	r0,r0,NMI_MASK at h	/* (i.e. an irq when soft-disabled) */
-	bne	77f			/* then don't call hash_page now */
+	lwz	r0,TI_PREEMPT(r11)
+	andis.	r0,r0,NMI_MASK at h
+	bne	77f
 
 	/*
 	 * r3 contains the trap number
diff --git a/arch/powerpc/mm/book3s64/hash_utils.c b/arch/powerpc/mm/book3s64/hash_utils.c
index 468169e33c86..9b9f92ad0e7a 100644
--- a/arch/powerpc/mm/book3s64/hash_utils.c
+++ b/arch/powerpc/mm/book3s64/hash_utils.c
@@ -1559,6 +1559,7 @@ static void hash_preload(struct mm_struct *mm, pte_t *ptep, unsigned long ea,
 	pgd_t *pgdir;
 	int rc, ssize, update_flags = 0;
 	unsigned long access = _PAGE_PRESENT | _PAGE_READ | (is_exec ? _PAGE_EXEC : 0);
+	unsigned long flags;
 
 	BUG_ON(get_region_id(ea) != USER_REGION_ID);
 
@@ -1592,6 +1593,28 @@ static void hash_preload(struct mm_struct *mm, pte_t *ptep, unsigned long ea,
 		return;
 #endif /* CONFIG_PPC_64K_PAGES */
 
+	/*
+	 * __hash_page_* must run with interrupts off, as it sets the
+	 * H_PAGE_BUSY bit. It's possible for perf interrupts to hit at any
+	 * time and may take a hash fault reading the user stack, see
+	 * read_user_stack_slow() in the powerpc/perf code.
+	 *
+	 * If that takes a hash fault on the same page as we lock here, it
+	 * will bail out when seeing H_PAGE_BUSY set, and retry the access
+	 * leading to an infinite loop.
+	 *
+	 * Disabling interrupts here does not prevent perf interrupts, but it
+	 * will prevent them taking hash faults (see the NMI test in
+	 * do_hash_page), then read_user_stack's copy_from_user_nofault will
+	 * fail and perf will fall back to read_user_stack_slow(), which
+	 * walks the Linux page tables.
+	 *
+	 * Interrupts must also be off for the duration of the
+	 * mm_is_thread_local test and update, to prevent preempt running the
+	 * mm on another CPU (XXX: this may be racy vs kthread_use_mm).
+	 */
+	local_irq_save(flags);
+
 	/* Is that local to this CPU ? */
 	if (mm_is_thread_local(mm))
 		update_flags |= HPTE_LOCAL_UPDATE;
@@ -1614,6 +1637,8 @@ static void hash_preload(struct mm_struct *mm, pte_t *ptep, unsigned long ea,
 				   mm_ctx_user_psize(&mm->context),
 				   mm_ctx_user_psize(&mm->context),
 				   pte_val(*ptep));
+
+	local_irq_restore(flags);
 }
 
 /*
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index cd6a742ac6ef..01d70280d287 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2179,6 +2179,12 @@ static void __perf_event_interrupt(struct pt_regs *regs)
 
 	perf_read_regs(regs);
 
+	/*
+	 * If perf interrupts hit in a local_irq_disable (soft-masked) region,
+	 * we consider them as NMIs. This is required to prevent hash faults on
+	 * user addresses when reading callchains. See the NMI test in
+	 * do_hash_page.
+	 */
 	nmi = perf_intr_is_nmi(regs);
 	if (nmi)
 		nmi_enter();
commit 6020db504cece0d93cc31c6f73609ef1304607e2
Author: Wolfram Sang <wsa at kernel.org>
Date:   Sun Jul 26 23:44:19 2020 +0200

    modpost: explain why we can't use strsep
    
    Mention why we open-code strsep, so it is clear that it is intentional.
    
    Fixes: 736bb11898ef ("modpost: remove use of non-standard strsep() in HOSTCC code")
    Signed-off-by: Wolfram Sang <wsa at kernel.org>
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 45f2ab2ec2d4..69341b36f271 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -144,6 +144,7 @@ char *get_line(char **stringp)
 	if (!orig || *orig == '\0')
 		return NULL;
 
+	/* don't use strsep here, it is not available everywhere */
 	next = strchr(orig, '\n');
 	if (next)
 		*next++ = '\0';
commit 0d7869805a82b91abdc1a56bddeaa374969af310
Merge: 92ed30191993 15fbc3b93853
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Jul 27 11:05:01 2020 +1000

    Merge branch 'linux-5.8' of git://github.com/skeggsb/linux into drm-fixes
    
    A couple of fixes for issues relating to format modifiers (there's
    still a patch pending from James Jones to hopefully address the
    remaining ones), regression fix from the recent HDA nightmare, and a
    race fix for Turing modesetting.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: Ben Skeggs <skeggsb at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/ <CACAvsv5aAp+FZMZGTB+Nszc==h5gEbdNV58sSRRQDF1R5qQRGg at mail.gmail.com

commit 7665a47f70b3f64bf09c233cc7df73fde9e506f1
Author: Pavel Machek <pavel at ucw.cz>
Date:   Fri Jul 24 11:05:31 2020 +0200

    signal: fix typo in dequeue_synchronous_signal()
    
    s/postive/positive/
    
    Signed-off-by: Pavel Machek (CIP) <pavel at denx.de>
    Link: https://lore.kernel.org/r/20200724090531.GA14409@amd
    [christian.brauner at ubuntu.com: tweak commit message]
    Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>

diff --git a/kernel/signal.c b/kernel/signal.c
index ee22ec78fd6d..6f16f7c5d375 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -719,7 +719,7 @@ static int dequeue_synchronous_signal(kernel_siginfo_t *info)
 	 * Return the first synchronous signal in the queue.
 	 */
 	list_for_each_entry(q, &pending->list, list) {
-		/* Synchronous signals have a postive si_code */
+		/* Synchronous signals have a positive si_code */
 		if ((q->info.si_code > SI_USER) &&
 		    (sigmask(q->info.si_signo) & SYNCHRONOUS_MASK)) {
 			sync = q;
commit 92ed301919932f777713b9172e525674157e983d
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 14:14:06 2020 -0700

    Linux 5.8-rc7

diff --git a/Makefile b/Makefile
index 1bf740d91459..229e67f2ff75 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Kleptomaniac Octopus
 
 # *DOCUMENTATION*
commit 1c8594b8427290c178c5d39885eacd9e41f68743
Merge: 40c60ac32174 ca9b31f6bb9c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 13:46:57 2020 -0700

    Merge tag 'kbuild-fixes-v5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild into master
    
    Pull Kbuild fixes from Masahiro Yamada:
    
     - do not use non-portable strsep() in a host program
    
     - fix single target builds for external modules
    
     - change Clang's --prefix option to make it work for the latest Clang
    
    * tag 'kbuild-fixes-v5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
      Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
      kbuild: fix single target builds for external modules
      modpost: remove use of non-standard strsep() in HOSTCC code

commit aa7bf898d4bf921f61fab078040e8baec3f28126
Author: Linus Walleij <linus.walleij at linaro.org>
Date:   Sun Jul 19 01:33:22 2020 +0200

    drm/mcde: Fix stability issue
    
    Whenever a display update was sent, apart from updating
    the memory base address, we called mcde_display_send_one_frame()
    which also sent a command to the display requesting the TE IRQ
    and enabling the FIFO.
    
    When continuous updates are running this is wrong: we need
    to only send this to start the flow to the display on
    the very first update. This lead to the display pipeline
    locking up and crashing.
    
    Check if the flow is already running and in that case
    do not call mcde_display_send_one_frame().
    
    This fixes crashes on the Samsung GT-S7710 (Skomer).
    
    Signed-off-by: Linus Walleij <linus.walleij at linaro.org>
    Acked-by: Sam Ravnborg <sam at ravnborg.org>
    Acked-by: Stephan Gerhold <stephan at gerhold.net>
    Cc: Stephan Gerhold <stephan at gerhold.net>
    Cc: stable at vger.kernel.org
    Link: https://patchwork.freedesktop.org/patch/msgid/20200718233323.3407670-1-linus.walleij@linaro.org

diff --git a/drivers/gpu/drm/mcde/mcde_display.c b/drivers/gpu/drm/mcde/mcde_display.c
index 08802e5177f6..4d2290f88edb 100644
--- a/drivers/gpu/drm/mcde/mcde_display.c
+++ b/drivers/gpu/drm/mcde/mcde_display.c
@@ -1060,9 +1060,14 @@ static void mcde_display_update(struct drm_simple_display_pipe *pipe,
 	 */
 	if (fb) {
 		mcde_set_extsrc(mcde, drm_fb_cma_get_gem_addr(fb, pstate, 0));
-		if (!mcde->video_mode)
-			/* Send a single frame using software sync */
-			mcde_display_send_one_frame(mcde);
+		if (!mcde->video_mode) {
+			/*
+			 * Send a single frame using software sync if the flow
+			 * is not active yet.
+			 */
+			if (mcde->flow_active == 0)
+				mcde_display_send_one_frame(mcde);
+		}
 		dev_info_once(mcde->dev, "sent first display update\n");
 	} else {
 		/*
commit 40c60ac32174f0c0c090cd31d0d1712f2478e689
Merge: 1ada9010e578 be6577af0cef
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 12:14:46 2020 -0700

    Merge branch 'parisc-5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux into master
    
    Pull parisc fixes from Helge Deller:
     "Two fixes:
    
       - Add the cmpxchg() function for pointers to u8 values. This fixes a
         kernel linking error when building the tusb1210 driver (from Liam
         Beguin).
    
       - Add a define for atomic64_set_release() to fix CPU soft lockups
         which happen because of missing unlocks while processing bit
         operations (from John David Anglin)"
    
    * 'parisc-5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
      parisc: Add atomic64_set_release() define to avoid CPU soft lockups
      parisc: add support for cmpxchg on u8 pointers

commit 07c08f5210e08dd6d4e0c3f8df2cf1c7de6d4ea4
Author: Guido Günther <agx at sigxcpu.org>
Date:   Sat Jul 18 20:26:37 2020 +0200

    drm/bridge: nwl-dsi: Drop DRM_BRIDGE_ATTACH_NO_CONNECTOR check.
    
    We don't create a connector but let panel_bridge handle that so there's
    no point in rejecting DRM_BRIDGE_ATTACH_NO_CONNECTOR.
    
    Signed-off-by: Guido Günther <agx at sigxcpu.org>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/8b6545b991afce6add0a24f5f5d116778b0cb763.1595096667.git.agx@sigxcpu.org

diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
index b14d725bf609..c7bc194bbce3 100644
--- a/drivers/gpu/drm/bridge/nwl-dsi.c
+++ b/drivers/gpu/drm/bridge/nwl-dsi.c
@@ -917,11 +917,6 @@ static int nwl_dsi_bridge_attach(struct drm_bridge *bridge,
 	struct drm_panel *panel;
 	int ret;
 
-	if (flags & DRM_BRIDGE_ATTACH_NO_CONNECTOR) {
-		DRM_ERROR("Fix bridge driver to make connector optional!");
-		return -EINVAL;
-	}
-
 	ret = drm_of_find_panel_or_bridge(dsi->dev->of_node, 1, 0, &panel,
 					  &panel_bridge);
 	if (ret)
commit d76acc9fcddeda53b985b029c890976a87fcc3fc
Author: Jitao Shi <jitao.shi at mediatek.com>
Date:   Tue Jul 14 20:33:32 2020 +0800

    drm/panel: Fix auo, kd101n80-45na horizontal noise on edges of panel
    
    Fine tune the HBP and HFP to avoid the dot noise on the left and right edges.
    
    Signed-off-by: Jitao Shi <jitao.shi at mediatek.com>
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200714123332.37609-1-jitao.shi@mediatek.com

diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
index 46fe1805c588..2649469070aa 100644
--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
@@ -615,9 +615,9 @@ static const struct panel_desc boe_tv101wum_nl6_desc = {
 static const struct drm_display_mode auo_kd101n80_45na_default_mode = {
 	.clock = 157000,
 	.hdisplay = 1200,
-	.hsync_start = 1200 + 80,
-	.hsync_end = 1200 + 80 + 24,
-	.htotal = 1200 + 80 + 24 + 36,
+	.hsync_start = 1200 + 60,
+	.hsync_end = 1200 + 60 + 24,
+	.htotal = 1200 + 60 + 24 + 56,
 	.vdisplay = 1920,
 	.vsync_start = 1920 + 16,
 	.vsync_end = 1920 + 16 + 4,
commit 667d73d72f3188909914c60e97a1db33edc21971
Author: Douglas Anderson <dianders at chromium.org>
Date:   Thu Jul 16 13:21:22 2020 -0700

    drm: panel: simple: Delay HPD checking on boe_nv133fhm_n61 for 15 ms
    
    On boe_nv133fhm_n62 (and presumably on boe_nv133fhm_n61) a scope shows
    a small spike on the HPD line right when you power the panel on.  The
    picture looks something like this:
    
             +--------------------------------------
             |
             |
             |
    Power ---+
                                               +---
                                               |
                  ++                           |
             +----+|                           |
    HPD -----+     +---------------------------+
    
    So right when power is applied there's a little bump in HPD and then
    there's small spike right before it goes low.  The total time of the
    little bump plus the spike was measured on one panel as being 8 ms
    long.  The total time for the HPD to go high on the same panel was
    51.2 ms, though the datasheet only promises it is < 200 ms.
    
    When asked about this glitch, BOE indicated that it was expected and
    persisted until the TCON has been initialized.
    
    If this was a real hotpluggable DP panel then this wouldn't matter a
    whole lot.  We'd debounce the HPD signal for a really long time and so
    the little blip wouldn't hurt.  However, this is not a hotpluggable DP
    panel and the the debouncing logic isn't needed and just shows down
    the time needed to get the display working.  This is why the code in
    panel_simple_prepare() doesn't do debouncing and just waits for HPD to
    go high once.  Unfortunately if we get unlucky and happen to poll the
    HPD line right at the spike we can try talking to the panel before
    it's ready.
    
    Let's handle this situation by putting in a 15 ms prepare delay and
    decreasing the "hpd absent delay" by 15 ms.  That means:
    * If you don't have HPD hooked up at all you've still got the
      hardcoded 200 ms delay.
    * If you've got HPD hooked up you will always wait at least 15 ms
      before checking HPD.  The only case where this could be bad is if
      the panel is sharing a voltage rail with something else in the
      system and was already turned on long before the panel came up.  In
      such a case we'll be delaying 15 ms for no reason, but it's not a
      huge delay and I don't see any other good solution to handle that
      case.
    
    Even though the delay was measured as 8 ms, 15 ms was chosen to give a
    bit of margin.
    
    Signed-off-by: Douglas Anderson <dianders at chromium.org>
    Reviewed-by: Bjorn Andersson <bjorn.andersson at linaro.org>
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200716132120.1.I01e738cd469b61fc9b28b3ef1c6541a4f48b11bf@changeid

diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index 5178f87d6574..4aeb960ccf15 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -1250,7 +1250,21 @@ static const struct panel_desc boe_nv133fhm_n61 = {
 		.height = 165,
 	},
 	.delay = {
-		.hpd_absent_delay = 200,
+		/*
+		 * When power is first given to the panel there's a short
+		 * spike on the HPD line.  It was explained that this spike
+		 * was until the TCON data download was complete.  On
+		 * one system this was measured at 8 ms.  We'll put 15 ms
+		 * in the prepare delay just to be safe and take it away
+		 * from the hpd_absent_delay (which would otherwise be 200 ms)
+		 * to handle this.  That means:
+		 * - If HPD isn't hooked up you still have 200 ms delay.
+		 * - If HPD is hooked up we won't try to look at it for the
+		 *   first 15 ms.
+		 */
+		.prepare = 15,
+		.hpd_absent_delay = 185,
+
 		.unprepare = 500,
 	},
 	.bus_format = MEDIA_BUS_FMT_RGB888_1X24,
commit f10761c9df96a882438faa09dcd25261281d69ca
Author: Laurentiu Palcu <laurentiu.palcu at nxp.com>
Date:   Mon Jul 20 15:42:27 2020 +0300

    drm/bridge/adv7511: set the bridge type properly
    
    After the drm_bridge_connector_init() helper function has been added,
    the ADV driver has been changed accordingly. However, the 'type'
    field of the bridge structure was left unset, which makes the helper
    function always return -EINVAL.
    
    Signed-off-by: Laurentiu Palcu <laurentiu.palcu at nxp.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Reviewed-by: Vinod Koul <vkoul at kernel.org>
    Tested-by: Vinod Koul <vkoul at kernel.org> # tested on DragonBoard 410c
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200720124228.12552-1-laurentiu.palcu@oss.nxp.com

diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 87b58c1acff4..648eb23d0784 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -1224,6 +1224,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
 
 	adv7511->bridge.funcs = &adv7511_bridge_funcs;
 	adv7511->bridge.of_node = dev->of_node;
+	adv7511->bridge.type = DRM_MODE_CONNECTOR_HDMIA;
 
 	drm_bridge_add(&adv7511->bridge);
 
commit 1ada9010e578150984039a770c98f41799b30bc4
Merge: 7f2e231c3165 92d232d17604
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 09:33:25 2020 -0700

    Merge tag 'char-misc-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc into master
    
    Pull char/misc driver fixes from Greg KH:
     "Here are a few small driver fixes for 5.8-rc7
    
      They include:
    
       - habanalabs fixes
    
       - tiny fpga driver fixes
    
       - /dev/mem fixup from previous changes
    
       - interconnect driver fixes
    
       - binder fix
    
      All of these have been in linux-next for a while with no reported
      issues"
    
    * tag 'char-misc-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
      interconnect: msm8916: Fix buswidth of pcnoc_s nodes
      interconnect: Do not skip aggregation for disabled paths
      /dev/mem: Add missing memory barriers for devmem_inode
      binder: Don't use mmput() from shrinker function.
      habanalabs: prevent possible out-of-bounds array access
      fpga: dfl: fix bug in port reset handshake
      fpga: dfl: pci: reduce the scope of variable 'ret'
      habanalabs: set 4s timeout for message to device CPU
      habanalabs: set clock gating per engine
      habanalabs: block WREG_BULK packet on PDMA

commit 7f2e231c316591246284b10b008cadfc953f16d3
Merge: f208a76fcb57 29c4a54bc645
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 09:29:22 2020 -0700

    Merge tag 'driver-core-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core into master
    
    Pull driver core fix from Greg KH:
     "A single driver core fix for 5.8-rc7. It resolves a problem found in
      the previous fix for this code made in 5.8-rc6. Hopefully this is all
      now cleared up, as this seems to be the last of the reported issues in
      this area, and was tested on the problem hardware.
    
      This patch has been in linux-next with no reported problems"
    
    * tag 'driver-core-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
      device property: Avoid NULL pointer dereference in device_get_next_child_node()

commit f208a76fcb5700a0c5104e5888679acc31d1ce41
Merge: 7d22af6c5bdb faaff9765664
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 09:14:59 2020 -0700

    Merge tag 'staging-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging into master
    
    Pull staging driver fixes from Greg KH:
     "Five small staging driver fixes for 5.8-rc7 to resolve some reported
      problems:
    
       - four comedi driver fixes for problems found with them
    
       - a syzbot-found fix for the wlang-ng driver that resolves a much
         reported problem.
    
      All of these have been in linux-next with no reported issues"
    
    * tag 'staging-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
      staging: wlan-ng: properly check endpoint types
      staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
      staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift
      staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift
      staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support

commit 7d22af6c5bdb001c5ed0a20185138304ad2af91b
Merge: 17f50e28a858 5fdbe136ae19
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 09:09:43 2020 -0700

    Merge tag 'tty-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty into master
    
    Pull tty/serial/fbcon fixes from Greg KH:
     "Here are some small tty and serial and fbcon fixes for 5.8-rc7 to
      resolve some reported issues.
    
      The fbcon fix is in here as it was simpler to take it this way (and it
      was acked by the maintainer) as it was related to the vt console fix
      as well, both of which resolve syzbot-found issues in the console
      handling code.
    
      The other serial driver fixes are for small issues reported in the -rc
      releases.
    
      All of these have been in linux-next with no reported issues"
    
    * tag 'tty-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
      serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
      fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
      serial: 8250_mtk: Fix high-speed baud rates clamping
      serial: 8250: fix null-ptr-deref in serial8250_start_tx()
      serial: tegra: drop bogus NULL tty-port checks
      serial: tegra: fix CREAD handling for PIO
      tty: xilinx_uartps: Really fix id assignment
      vt: Reject zero-sized screen buffer size.

commit 4ee48cc5586bf519df19894273002aa8ef7b70ad
Author: Biju Das <biju.das.jz at bp.renesas.com>
Date:   Thu Jul 23 12:10:54 2020 +0100

    drm: of: Fix double-free bug
    
    Fix double-free bug in the error path.
    
    Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
    Reported-by: Pavel Machek <pavel at denx.de>
    Signed-off-by: Biju Das <biju.das.jz at bp.renesas.com>
    Reviewed-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
    Cc: stable at vger.kernel.org
    Signed-off-by: Sam Ravnborg <sam at ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/1595502654-40595-1-git-send-email-biju.das.jz@bp.renesas.com

diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
index b50b44e76279..8fc3f67e3e76 100644
--- a/drivers/gpu/drm/drm_of.c
+++ b/drivers/gpu/drm/drm_of.c
@@ -322,10 +322,8 @@ static int drm_of_lvds_get_remote_pixels_type(
 		 * configurations by passing the endpoints explicitly to
 		 * drm_of_lvds_get_dual_link_pixel_order().
 		 */
-		if (!current_pt || pixels_type != current_pt) {
-			of_node_put(remote_port);
+		if (!current_pt || pixels_type != current_pt)
 			return -EINVAL;
-		}
 	}
 
 	return pixels_type;
commit 17f50e28a858e4bab808733339995133390aae54
Merge: cf48f79b74de 0b987032f8b5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 09:02:29 2020 -0700

    Merge tag 'usb-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb into master
    
    Pull USB fixes from Greg KH:
     "Three small USB XHCI driver fixes for 5.8-rc7.
    
      They all resolve some minor issues that have been reported on some
      different platforms.
    
      All of these have been in linux-next with no reported issues"
    
    * tag 'usb-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
      usb: tegra: Fix allocation for the FPCI context
      usb: xhci: Fix ASM2142/ASM3142 DMA addressing
      usb: xhci-mtk: fix the failure of bandwidth allocation

commit cf48f79b74de2bf900d27c924528bb41d73689c3
Merge: 04300d66f0a0 3f0dcfbcd2e1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Jul 26 08:59:15 2020 -0700

    Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi into master
    
    Pull SCSI fix from James Bottomley:
     "Small core patch to fix a corner case bug: we forgot to run the queues
      to handle starvation in the error exit from the scsi_queue_rq routine,
      which can lead to hangs on error conditions"
    
    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
      scsi: core: Run queue in case of I/O resource contention failure

commit 5611ec2b9814bc91f7b0a8d804c1fc152e2025d9
Author: Kai-Heng Feng <kai.heng.feng at canonical.com>
Date:   Fri Jul 24 01:29:10 2020 +0800

    nvme-pci: prevent SK hynix PC400 from using Write Zeroes command
    
    After commit 6e02318eaea5 ("nvme: add support for the Write Zeroes
    command"), SK hynix PC400 becomes very slow with the following error
    message:
    
    [  224.567695] blk_update_request: operation not supported error, dev nvme1n1, sector 499384320 op 0x9:(WRITE_ZEROES) flags 0x1000000 phys_seg 0 prio class 0]
    
    SK Hynix PC400 has a buggy firmware that treats NLB as max value instead
    of a range, so the NLB passed isn't a valid value to the firmware.
    
    According to SK hynix there are three commands are affected:
    - Write Zeroes
    - Compare
    - Write Uncorrectable
    
    Right now only Write Zeroes is implemented, so disable it completely on
    SK hynix PC400.
    
    BugLink: https://bugs.launchpad.net/bugs/1872383
    Cc: kyounghwan sohn <kyounghwan.sohn at sk.com>
    Signed-off-by: Kai-Heng Feng <kai.heng.feng at canonical.com>
    Signed-off-by: Christoph Hellwig <hch at lst.de>

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index b1d18f0633c7..25a187e43dbe 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3122,6 +3122,8 @@ static const struct pci_device_id nvme_id_table[] = {
 	{ PCI_DEVICE(0x1cc1, 0x8201),   /* ADATA SX8200PNP 512GB */
 		.driver_data = NVME_QUIRK_NO_DEEPEST_PS |
 				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+	{ PCI_DEVICE(0x1c5c, 0x1504),   /* SK Hynix PC400 */
+		.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001),
 		.driver_data = NVME_QUIRK_SINGLE_VECTOR },
commit adc99fd378398f4c58798a1c57889872967d56a6
Author: Sagi Grimberg <sagi at grimberg.me>
Date:   Thu Jul 23 16:42:26 2020 -0700

    nvme-tcp: fix possible hang waiting for icresp response
    
    If the controller died exactly when we are receiving icresp
    we hang because icresp may never return. Make sure to set a
    high finite limit.
    
    Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
    Signed-off-by: Sagi Grimberg <sagi at grimberg.me>
    Signed-off-by: Christoph Hellwig <hch at lst.de>

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 79ef2b8e2b3c..f3a91818167b 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1382,6 +1382,9 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,
 	if (nctrl->opts->tos >= 0)
 		ip_sock_set_tos(queue->sock->sk, nctrl->opts->tos);
 
+	/* Set 10 seconds timeout for icresp recvmsg */
+	queue->sock->sk->sk_rcvtimeo = 10 * HZ;
+
 	queue->sock->sk->sk_allocation = GFP_ATOMIC;
 	nvme_tcp_set_queue_io_cpu(queue);
 	queue->request = NULL;
commit 04300d66f0a06d572d9f2ad6768c38cabde22179
Merge: fbe0d451bcea fa5a19835905
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 14:42:11 2020 -0700

    Merge tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux into master
    
    Pull RISC-V fixes from Palmer Dabbelt:
     "A few more fixes this week:
    
       - A fix to avoid using SBI calls during kasan initialization, as the
         SBI calls themselves have not been probed yet.
    
       - Three fixes related to systems with multiple memory regions"
    
    * tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
      riscv: Parse all memory blocks to remove unusable memory
      RISC-V: Do not rely on initrd_start/end computed during early dt parsing
      RISC-V: Set maximum number of mapped pages correctly
      riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence

commit fbe0d451bcea569fc0ed3455511a90646c8a9c81
Merge: 78b1afe22d51 d181d2da0141
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 14:25:47 2020 -0700

    Merge tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
    
    Pull x86 fixes from Ingo Molnar:
     "Misc fixes:
    
       - Fix a section end page alignment assumption that was causing
         crashes
    
       - Fix ORC unwinding on freshly forked tasks which haven't executed
         yet and which have empty user task stacks
    
       - Fix the debug.exception-trace=1 sysctl dumping of user stacks,
         which was broken by recent maccess changes"
    
    * tag 'x86-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      x86/dumpstack: Dump user space code correctly again
      x86/stacktrace: Fix reliable check for empty user task stacks
      x86/unwind/orc: Fix ORC for newly forked tasks
      x86, vmlinux.lds: Page-align end of ..page_aligned sections

commit 78b1afe22d51996c1916a332d43b853ff2b10ade
Merge: a7b36c2b134f fe5ed7ab99c6
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 13:55:38 2020 -0700

    Merge tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
    
    Pull uprobe fix from Ingo Molnar:
     "Fix an interaction/regression between uprobes based shared library
      tracing & GDB"
    
    * tag 'perf-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression

commit a7b36c2b134f7ca75789d174b97d07acccbf6b93
Merge: 3077805eebb6 b4a25fb0e629
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 13:27:12 2020 -0700

    Merge tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
    
    Pull timer fix from Ingo Molnar:
     "Fix a suspend/resume regression (crash) on TI AM3/AM4 SoC's"
    
    * tag 'timers-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4

commit 3077805eebb63d75ad716e36777a54a3321d34a5
Merge: 17baa4428642 062d3f95b630
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 13:24:40 2020 -0700

    Merge tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
    
    Pull scheduler fixes from Ingo Molnar:
     "Fix a race introduced by the recent loadavg race fix, plus add a debug
      check for a hard to debug case of bogus wakeup function flags"
    
    * tag 'sched-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      sched: Warn if garbage is passed to default_wake_function()
      sched: Fix race against ptrace_freeze_trace()

commit 17baa442864254cb2aadf3a4d668c0f81d2f07c5
Merge: 7cb3a5c5f647 74f85551666f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 13:18:42 2020 -0700

    Merge tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into master
    
    Pull EFI fixes from Ingo Molnar:
     "Various EFI fixes:
    
       - Fix the layering violation in the use of the EFI runtime services
         availability mask in users of the 'efivars' abstraction
    
       - Revert build fix for GCC v4.8 which is no longer supported
    
       - Clean up some x86 EFI stub details, some of which are borderline
         bugs that copy around garbage into padding fields - let's fix these
         out of caution.
    
       - Fix build issues while working on RISC-V support
    
       - Avoid --whole-archive when linking the stub on arm64"
    
    * tag 'efi-urgent-2020-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      efi: Revert "efi/x86: Fix build with gcc 4"
      efi/efivars: Expose RT service availability via efivars abstraction
      efi/libstub: Move the function prototypes to header file
      efi/libstub: Fix gcc error around __umoddi3 for 32 bit builds
      efi/libstub/arm64: link stub lib.a conditionally
      efi/x86: Only copy upto the end of setup_header
      efi/x86: Remove unused variables

commit 7cb3a5c5f6478ac0c14d01e35bc49e0ba7525e21
Merge: 1b64b2e2444c 0e6705182d4e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 12:53:46 2020 -0700

    Merge tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6 into master
    
    Pull cifs fix from Steve French:
     "A fix for a recently discovered regression in rename to older servers
      caused by a recent patch"
    
    * tag '5.8-rc6-cifs-fix' of git://git.samba.org/sfrench/cifs-2.6:
      Revert "cifs: Fix the target file was deleted when rename failed."

commit 1b64b2e2444c11b8dd2b657f8538c05cb699ed25
Merge: 23ee3e4e5bd2 8754e1379e70
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Jul 25 11:50:59 2020 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net into master
    
    Pull networking fixes from David Miller:
    
     1) Fix RCU locaking in iwlwifi, from Johannes Berg.
    
     2) mt76 can access uninitialized NAPI struct, from Felix Fietkau.
    
     3) Fix race in updating pause settings in bnxt_en, from Vasundhara
        Volam.
    
     4) Propagate error return properly during unbind failures in ax88172a,
        from George Kennedy.
    
     5) Fix memleak in adf7242_probe, from Liu Jian.
    
     6) smc_drv_probe() can leak, from Wang Hai.
    
     7) Don't muck with the carrier state if register_netdevice() fails in
        the bonding driver, from Taehee Yoo.
    
     8) Fix memleak in dpaa_eth_probe, from Liu Jian.
    
     9) Need to check skb_put_padto() return value in hsr_fill_tag(), from
        Murali Karicheri.
    
    10) Don't lose ionic RSS hash settings across FW update, from Shannon
        Nelson.
    
    11) Fix clobbered SKB control block in act_ct, from Wen Xu.
    
    12) Missing newlink in "tx_timeout" sysfs output, from Xiongfeng Wang.
    
    13) IS_UDPLITE cleanup a long time ago, incorrectly handled
        transformations involving UDPLITE_RECV_CC. From Miaohe Lin.
    
    14) Unbalanced locking in netdevsim, from Taehee Yoo.
    
    15) Suppress false-positive error messages in qed driver, from Alexander
        Lobakin.
    
    16) Out of bounds read in ax25_connect and ax25_sendmsg, from Peilin Ye.
    
    17) Missing SKB release in cxgb4's uld_send(), from Navid Emamdoost.
    
    18) Uninitialized value in geneve_changelink(), from Cong Wang.
    
    19) Fix deadlock in xen-netfront, from Andera Righi.
    
    19) flush_backlog() frees skbs with IRQs disabled, so should use
        dev_kfree_skb_irq() instead of kfree_skb(). From Subash Abhinov
        Kasiviswanathan.
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (111 commits)
      drivers/net/wan: lapb: Corrected the usage of skb_cow
      dev: Defer free of skbs in flush_backlog
      qrtr: orphan socket in qrtr_release()
      xen-netfront: fix potential deadlock in xennet_remove()
      flow_offload: Move rhashtable inclusion to the source file
      geneve: fix an uninitialized value in geneve_changelink()
      bonding: check return value of register_netdevice() in bond_newlink()
      tcp: allow at most one TLP probe per flight
      AX.25: Prevent integer overflows in connect and sendmsg
      cxgb4: add missing release on skb in uld_send()
      net: atlantic: fix PTP on AQC10X
      AX.25: Prevent out-of-bounds read in ax25_sendmsg()
      sctp: shrink stream outq when fails to do addstream reconf
      sctp: shrink stream outq only when new outcnt < old outcnt
      AX.25: Fix out-of-bounds read in ax25_connect()
      enetc: Remove the mdio bus on PF probe bailout
      net: ethernet: ti: add NETIF_F_HW_TC hw feature flag for taprio offload
      net: ethernet: ave: Fix error returns in ave_init
      drivers/net/wan/x25_asy: Fix to make it work
      ipvs: fix the connection sync failed in some cases
      ...

commit fe1d899f4212a08dad98accb47cd335b58cc9085
Author: Grygorii Strashko <grygorii.strashko at ti.com>
Date:   Sat Jul 25 00:42:21 2020 +0300

    ARM: dts: keystone-k2g-evm: fix rgmii phy-mode for ksz9031 phy
    
    Since commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
    KSZ9031 PHY") the networking is broken on keystone-k2g-evm board.
    
    The above board have phy-mode = "rgmii-id" and it is worked before because
    KSZ9031 PHY started with default RGMII internal delays configuration (TX
    off, RX on 1.2 ns) and MAC provided TX delay by default.
    After above commit, the KSZ9031 PHY starts handling phy mode properly and
    enables both RX and TX delays, as result networking is become broken.
    
    Fix it by switching to phy-mode = "rgmii-rxid" to reflect previous
    behavior.
    
    Fixes: bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the KSZ9031 PHY")
    Signed-off-by: Grygorii Strashko <grygorii.strashko at ti.com>
    Cc: Oleksij Rempel <o.rempel at pengutronix.de>
    Cc: Andrew Lunn <andrew at lunn.ch>
    Cc: Philippe Schenker <philippe.schenker at toradex.com>
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/arch/arm/boot/dts/keystone-k2g-evm.dts b/arch/arm/boot/dts/keystone-k2g-evm.dts
index db640bab8c1d..8b3d64c913d8 100644
--- a/arch/arm/boot/dts/keystone-k2g-evm.dts
+++ b/arch/arm/boot/dts/keystone-k2g-evm.dts
@@ -402,7 +402,7 @@
 
 &gbe0 {
 	phy-handle = <&ethphy0>;
-	phy-mode = "rgmii-id";
+	phy-mode = "rgmii-rxid";
 	status = "okay";
 };
 
commit fa5a198359053c8e21dcc2b39c0e13871059bc9f
Author: Atish Patra <atish.patra at wdc.com>
Date:   Wed Jul 15 16:30:09 2020 -0700

    riscv: Parse all memory blocks to remove unusable memory
    
    Currently, maximum physical memory allowed is equal to -PAGE_OFFSET.
    That's why we remove any memory blocks spanning beyond that size. However,
    it is done only for memblock containing linux kernel which will not work
    if there are multiple memblocks.
    
    Process all memory blocks to figure out how much memory needs to be removed
    and remove at the end instead of updating the memblock list in place.
    
    Signed-off-by: Atish Patra <atish.patra at wdc.com>
    Signed-off-by: Palmer Dabbelt <palmerdabbelt at google.com>

diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index f818a47a72d1..79e9d55bdf1a 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -147,26 +147,29 @@ void __init setup_bootmem(void)
 {
 	struct memblock_region *reg;
 	phys_addr_t mem_size = 0;
+	phys_addr_t total_mem = 0;
+	phys_addr_t mem_start, end = 0;
 	phys_addr_t vmlinux_end = __pa_symbol(&_end);
 	phys_addr_t vmlinux_start = __pa_symbol(&_start);
 
 	/* Find the memory region containing the kernel */
 	for_each_memblock(memory, reg) {
-		phys_addr_t end = reg->base + reg->size;
-
-		if (reg->base <= vmlinux_start && vmlinux_end <= end) {
-			mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET);
-
-			/*
-			 * Remove memblock from the end of usable area to the
-			 * end of region
-			 */
-			if (reg->base + mem_size < end)
-				memblock_remove(reg->base + mem_size,
-						end - reg->base - mem_size);
-		}
+		end = reg->base + reg->size;
+		if (!total_mem)
+			mem_start = reg->base;
+		if (reg->base <= vmlinux_start && vmlinux_end <= end)
+			BUG_ON(reg->size == 0);
+		total_mem = total_mem + reg->size;
 	}
-	BUG_ON(mem_size == 0);
+
+	/*
+	 * Remove memblock from the end of usable area to the
+	 * end of region
+	 */
+	mem_size = min(total_mem, (phys_addr_t)-PAGE_OFFSET);
+	if (mem_start + mem_size < end)
+		memblock_remove(mem_start + mem_size,
+				end - mem_start - mem_size);
 
 	/* Reserve from the start of the kernel to the end of the kernel */
 	memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
commit 4400231c8acc7e513204c8470c6d796ba47dc169
Author: Atish Patra <atish.patra at wdc.com>
Date:   Wed Jul 15 16:30:08 2020 -0700

    RISC-V: Do not rely on initrd_start/end computed during early dt parsing
    
    Currently, initrd_start/end are computed during early_init_dt_scan
    but used during arch_setup. We will get the following panic if initrd is used
    and CONFIG_DEBUG_VIRTUAL is turned on.
    
    [    0.000000] ------------[ cut here ]------------
    [    0.000000] kernel BUG at arch/riscv/mm/physaddr.c:33!
    [    0.000000] Kernel BUG [#1]
    [    0.000000] Modules linked in:
    [    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.8.0-rc4-00015-ged0b226fed02 #886
    [    0.000000] epc: ffffffe0002058d2 ra : ffffffe0000053f0 sp : ffffffe001001f40
    [    0.000000]  gp : ffffffe00106e250 tp : ffffffe001009d40 t0 : ffffffe00107ee28
    [    0.000000]  t1 : 0000000000000000 t2 : ffffffe000a2e880 s0 : ffffffe001001f50
    [    0.000000]  s1 : ffffffe0001383e8 a0 : ffffffe00c087e00 a1 : 0000000080200000
    [    0.000000]  a2 : 00000000010bf000 a3 : ffffffe00106f3c8 a4 : ffffffe0010bf000
    [    0.000000]  a5 : ffffffe000000000 a6 : 0000000000000006 a7 : 0000000000000001
    [    0.000000]  s2 : ffffffe00106f068 s3 : ffffffe00106f070 s4 : 0000000080200000
    [    0.000000]  s5 : 0000000082200000 s6 : 0000000000000000 s7 : 0000000000000000
    [    0.000000]  s8 : 0000000080011010 s9 : 0000000080012700 s10: 0000000000000000
    [    0.000000]  s11: 0000000000000000 t3 : 000000000001fe30 t4 : 000000000001fe30
    [    0.000000]  t5 : 0000000000000000 t6 : ffffffe00107c471
    [    0.000000] status: 0000000000000100 badaddr: 0000000000000000 cause: 0000000000000003
    [    0.000000] random: get_random_bytes called from print_oops_end_marker+0x22/0x46 with crng_init=0
    
    To avoid the error, initrd_start/end can be computed from phys_initrd_start/size
    in setup itself. It also improves the initrd placement by aligning the start
    and size with the page size.
    
    Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code")
    Signed-off-by: Atish Patra <atish.patra at wdc.com>
    Signed-off-by: Palmer Dabbelt <palmerdabbelt at google.com>

diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 8d22973bde40..f818a47a72d1 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -95,19 +95,40 @@ void __init mem_init(void)
 #ifdef CONFIG_BLK_DEV_INITRD
 static void __init setup_initrd(void)
 {
+	phys_addr_t start;
 	unsigned long size;
 
-	if (initrd_start >= initrd_end) {
-		pr_info("initrd not found or empty");
+	/* Ignore the virtul address computed during device tree parsing */
+	initrd_start = initrd_end = 0;
+
+	if (!phys_initrd_size)
+		return;
+	/*
+	 * Round the memory region to page boundaries as per free_initrd_mem()
+	 * This allows us to detect whether the pages overlapping the initrd
+	 * are in use, but more importantly, reserves the entire set of pages
+	 * as we don't want these pages allocated for other purposes.
+	 */
+	start = round_down(phys_initrd_start, PAGE_SIZE);
+	size = phys_initrd_size + (phys_initrd_start - start);
+	size = round_up(size, PAGE_SIZE);
+
+	if (!memblock_is_region_memory(start, size)) {
+		pr_err("INITRD: 0x%08llx+0x%08lx is not a memory region",
+		       (u64)start, size);
 		goto disable;
 	}
-	if (__pa_symbol(initrd_end) > PFN_PHYS(max_low_pfn)) {
-		pr_err("initrd extends beyond end of memory");
+
+	if (memblock_is_region_reserved(start, size)) {
+		pr_err("INITRD: 0x%08llx+0x%08lx overlaps in-use memory region\n",
+		       (u64)start, size);
 		goto disable;
 	}
 
-	size = initrd_end - initrd_start;
-	memblock_reserve(__pa_symbol(initrd_start), size);
+	memblock_reserve(start, size);
+	/* Now convert initrd to virtual addresses */
+	initrd_start = (unsigned long)__va(phys_initrd_start);
+	initrd_end = initrd_start + phys_initrd_size;
 	initrd_below_start_ok = 1;
 
 	pr_info("Initial ramdisk at: 0x%p (%lu bytes)\n",
commit 8754e1379e7089516a449821f88e1fe1ebbae5e1
Author: Xie He <xie.he.0141 at gmail.com>
Date:   Fri Jul 24 09:33:47 2020 -0700

    drivers/net/wan: lapb: Corrected the usage of skb_cow
    
    This patch fixed 2 issues with the usage of skb_cow in LAPB drivers
    "lapbether" and "hdlc_x25":
    
    1) After skb_cow fails, kfree_skb should be called to drop a reference
    to the skb. But in both drivers, kfree_skb is not called.
    
    2) skb_cow should be called before skb_push so that is can ensure the
    safety of skb_push. But in "lapbether", it is incorrectly called after
    skb_push.
    
    More details about these 2 issues:
    
    1) The behavior of calling kfree_skb on failure is also the behavior of
    netif_rx, which is called by this function with "return netif_rx(skb);".
    So this function should follow this behavior, too.
    
    2) In "lapbether", skb_cow is called after skb_push. This results in 2
    logical issues:
       a) skb_push is not protected by skb_cow;
       b) An extra headroom of 1 byte is ensured after skb_push. This extra
          headroom has no use in this function. It also has no use in the
          upper-layer function that this function passes the skb to
          (x25_lapb_receive_frame in net/x25/x25_dev.c).
    So logically skb_cow should instead be called before skb_push.
    
    Cc: Eric Dumazet <edumazet at google.com>
    Cc: Martin Schiller <ms at dev.tdt.de>
    Signed-off-by: Xie He <xie.he.0141 at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index c84536b03aa8..f70336bb6f52 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -71,8 +71,10 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
 {
 	unsigned char *ptr;
 
-	if (skb_cow(skb, 1))
+	if (skb_cow(skb, 1)) {
+		kfree_skb(skb);
 		return NET_RX_DROP;
+	}
 
 	skb_push(skb, 1);
 	skb_reset_network_header(skb);
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 284832314f31..b2868433718f 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -128,10 +128,12 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
 {
 	unsigned char *ptr;
 
-	skb_push(skb, 1);
-
-	if (skb_cow(skb, 1))
+	if (skb_cow(skb, 1)) {
+		kfree_skb(skb);
 		return NET_RX_DROP;
+	}
+
+	skb_push(skb, 1);
 
 	ptr  = skb->data;
 	*ptr = X25_IFACE_DATA;
commit 7df5cb75cfb8acf96c7f2342530eb41e0c11f4c3
Author: Subash Abhinov Kasiviswanathan <subashab at codeaurora.org>
Date:   Thu Jul 23 11:31:48 2020 -0600

    dev: Defer free of skbs in flush_backlog
    
    IRQs are disabled when freeing skbs in input queue.
    Use the IRQ safe variant to free skbs here.
    
    Fixes: 145dd5f9c88f ("net: flush the softnet backlog in process context")
    Signed-off-by: Subash Abhinov Kasiviswanathan <subashab at codeaurora.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/core/dev.c b/net/core/dev.c
index 90b59fc50dc9..7a774ebf64e2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5601,7 +5601,7 @@ static void flush_backlog(struct work_struct *work)
 	skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
 		if (skb->dev->reg_state == NETREG_UNREGISTERING) {
 			__skb_unlink(skb, &sd->input_pkt_queue);
-			kfree_skb(skb);
+			dev_kfree_skb_irq(skb);
 			input_queue_head_incr(sd);
 		}
 	}
commit d0d8aae64566b753c4330fbd5944b88af035f299
Author: Atish Patra <atish.patra at wdc.com>
Date:   Wed Jul 15 16:30:07 2020 -0700

    RISC-V: Set maximum number of mapped pages correctly
    
    Currently, maximum number of mapper pages are set to the pfn calculated
    from the memblock size of the memblock containing kernel. This will work
    until that memblock spans the entire memory. However, it will be set to
    a wrong value if there are multiple memblocks defined in kernel
    (e.g. with efi runtime services).
    
    Set the the maximum value to the pfn calculated from dram size.
    
    Signed-off-by: Atish Patra <atish.patra at wdc.com>
    Signed-off-by: Palmer Dabbelt <palmerdabbelt at google.com>

diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index f4adb3684f3d..8d22973bde40 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -150,9 +150,9 @@ void __init setup_bootmem(void)
 	/* Reserve from the start of the kernel to the end of the kernel */
 	memblock_reserve(vmlinux_start, vmlinux_end - vmlinux_start);
 
-	set_max_mapnr(PFN_DOWN(mem_size));
 	max_pfn = PFN_DOWN(memblock_end_of_DRAM());
 	max_low_pfn = max_pfn;
+	set_max_mapnr(max_low_pfn);
 
 #ifdef CONFIG_BLK_DEV_INITRD
 	setup_initrd();
commit 23ee3e4e5bd27bdbc0f1785eef7209ce872794c7
Merge: 5876aa073f52 d08c30d7a0d1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 18:30:24 2020 -0700

    Merge tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci into master
    
    Pull PCI fixes from Bjorn Helgaas:
    
     - Reject invalid IRQ 0 command line argument for virtio_mmio because
       IRQ 0 now generates warnings (Bjorn Helgaas)
    
     - Revert "PCI/PM: Assume ports without DLL Link Active train links in
       100 ms", which broke nouveau (Bjorn Helgaas)
    
    * tag 'pci-v5.8-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
      Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
      virtio-mmio: Reject invalid IRQ 0 command line argument

commit af9f691f0f5bdd1ade65a7b84927639882d7c3e5
Author: Cong Wang <xiyou.wangcong at gmail.com>
Date:   Fri Jul 24 09:45:51 2020 -0700

    qrtr: orphan socket in qrtr_release()
    
    We have to detach sock from socket in qrtr_release(),
    otherwise skb->sk may still reference to this socket
    when the skb is released in tun->queue, particularly
    sk->sk_wq still points to &sock->wq, which leads to
    a UAF.
    
    Reported-and-tested-by: syzbot+6720d64f31c081c2f708 at syzkaller.appspotmail.com
    Fixes: 28fb4e59a47d ("net: qrtr: Expose tunneling endpoint to user space")
    Cc: Bjorn Andersson <bjorn.andersson at linaro.org>
    Cc: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>
    Reviewed-by: Eric Dumazet <edumazet at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 24a8c3c6da0d..300a104b9a0f 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -1180,6 +1180,7 @@ static int qrtr_release(struct socket *sock)
 		sk->sk_state_change(sk);
 
 	sock_set_flag(sk, SOCK_DEAD);
+	sock_orphan(sk);
 	sock->sk = NULL;
 
 	if (!sock_flag(sk, SOCK_ZAPPED))
commit 657237f56b26be2784cbf82867d65ebddff16539
Merge: c2c633106453 1cfd3426ef98
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Jul 24 17:26:09 2020 -0700

    Merge tag 'wireless-drivers-2020-07-24' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers
    
    Kalle Valo says:
    
    ====================
    wireless-drivers fixes for v5.8
    
    Second set of fixes for v5.8, and hopefully also the last. Three
    important regressions fixed.
    
    ath9k
    
    * fix a regression which broke support for all ath9k usb devices
    
    ath10k
    
    * fix a regression which broke support for all QCA4019 AHB devices
    
    iwlwifi
    
    * fix a regression which broke support for some Killer Wireless-AC 1550 cards
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c2c633106453611be07821f53dff9e93a9d1c3f0
Author: Andrea Righi <andrea.righi at canonical.com>
Date:   Fri Jul 24 10:59:10 2020 +0200

    xen-netfront: fix potential deadlock in xennet_remove()
    
    There's a potential race in xennet_remove(); this is what the driver is
    doing upon unregistering a network device:
    
      1. state = read bus state
      2. if state is not "Closed":
      3.    request to set state to "Closing"
      4.    wait for state to be set to "Closing"
      5.    request to set state to "Closed"
      6.    wait for state to be set to "Closed"
    
    If the state changes to "Closed" immediately after step 1 we are stuck
    forever in step 4, because the state will never go back from "Closed" to
    "Closing".
    
    Make sure to check also for state == "Closed" in step 4 to prevent the
    deadlock.
    
    Also add a 5 sec timeout any time we wait for the bus state to change,
    to avoid getting stuck forever in wait_event().
    
    Signed-off-by: Andrea Righi <andrea.righi at canonical.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 482c6c8b0fb7..88280057e032 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -63,6 +63,8 @@ module_param_named(max_queues, xennet_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
 		 "Maximum number of queues per virtual interface");
 
+#define XENNET_TIMEOUT  (5 * HZ)
+
 static const struct ethtool_ops xennet_ethtool_ops;
 
 struct netfront_cb {
@@ -1334,12 +1336,15 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
 
 	netif_carrier_off(netdev);
 
-	xenbus_switch_state(dev, XenbusStateInitialising);
-	wait_event(module_wq,
-		   xenbus_read_driver_state(dev->otherend) !=
-		   XenbusStateClosed &&
-		   xenbus_read_driver_state(dev->otherend) !=
-		   XenbusStateUnknown);
+	do {
+		xenbus_switch_state(dev, XenbusStateInitialising);
+		err = wait_event_timeout(module_wq,
+				 xenbus_read_driver_state(dev->otherend) !=
+				 XenbusStateClosed &&
+				 xenbus_read_driver_state(dev->otherend) !=
+				 XenbusStateUnknown, XENNET_TIMEOUT);
+	} while (!err);
+
 	return netdev;
 
  exit:
@@ -2139,28 +2144,43 @@ static const struct attribute_group xennet_dev_group = {
 };
 #endif /* CONFIG_SYSFS */
 
-static int xennet_remove(struct xenbus_device *dev)
+static void xennet_bus_close(struct xenbus_device *dev)
 {
-	struct netfront_info *info = dev_get_drvdata(&dev->dev);
-
-	dev_dbg(&dev->dev, "%s\n", dev->nodename);
+	int ret;
 
-	if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) {
+	if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+		return;
+	do {
 		xenbus_switch_state(dev, XenbusStateClosing);
-		wait_event(module_wq,
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateClosing ||
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateUnknown);
+		ret = wait_event_timeout(module_wq,
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosing ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosed ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateUnknown,
+				   XENNET_TIMEOUT);
+	} while (!ret);
+
+	if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed)
+		return;
 
+	do {
 		xenbus_switch_state(dev, XenbusStateClosed);
-		wait_event(module_wq,
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateClosed ||
-			   xenbus_read_driver_state(dev->otherend) ==
-			   XenbusStateUnknown);
-	}
+		ret = wait_event_timeout(module_wq,
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateClosed ||
+				   xenbus_read_driver_state(dev->otherend) ==
+				   XenbusStateUnknown,
+				   XENNET_TIMEOUT);
+	} while (!ret);
+}
+
+static int xennet_remove(struct xenbus_device *dev)
+{
+	struct netfront_info *info = dev_get_drvdata(&dev->dev);
 
+	xennet_bus_close(dev);
 	xennet_disconnect_backend(info);
 
 	if (info->netdev->reg_state == NETREG_REGISTERED)
commit 5876aa073f52541f4787b6111c8494ea9cfcde15
Merge: 68845a55c31b 9affa4358177
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 16:27:54 2020 -0700

    Merge tag 'nfsd-5.8-2' of git://linux-nfs.org/~bfields/linux into master
    
    Pull nfsd fix from Bruce Fields:
     "Just one fix for a NULL dereference if someone happens to read
      /proc/fs/nfsd/client/../state at the wrong moment"
    
    * tag 'nfsd-5.8-2' of git://linux-nfs.org/~bfields/linux:
      nfsd4: fix NULL dereference in nfsd/clients display code

commit c2b69f24ebd166a13cdc9909b50f33228895998b
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Fri Jul 24 10:50:22 2020 +1000

    flow_offload: Move rhashtable inclusion to the source file
    
    I noticed that touching linux/rhashtable.h causes lib/vsprintf.c to
    be rebuilt.  This dependency came through a bogus inclusion in the
    file net/flow_offload.h.  This patch moves it to the right place.
    
    This patch also removes a lingering rhashtable inclusion in cls_api
    created by the same commit.
    
    Fixes: 4e481908c51b ("flow_offload: move tc indirect block to...")
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
index 6315324b9dc2..3eaf25f68b79 100644
--- a/include/net/flow_offload.h
+++ b/include/net/flow_offload.h
@@ -5,7 +5,6 @@
 #include <linux/list.h>
 #include <linux/netlink.h>
 #include <net/flow_dissector.h>
-#include <linux/rhashtable.h>
 
 struct flow_match {
 	struct flow_dissector	*dissector;
diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c
index b739cfab796e..2076219b8ba5 100644
--- a/net/core/flow_offload.c
+++ b/net/core/flow_offload.c
@@ -4,6 +4,7 @@
 #include <net/flow_offload.h>
 #include <linux/rtnetlink.h>
 #include <linux/mutex.h>
+#include <linux/rhashtable.h>
 
 struct flow_rule *flow_rule_alloc(unsigned int num_actions)
 {
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index e62beec0d844..4619cb3cb0a8 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -20,7 +20,6 @@
 #include <linux/kmod.h>
 #include <linux/slab.h>
 #include <linux/idr.h>
-#include <linux/rhashtable.h>
 #include <linux/jhash.h>
 #include <linux/rculist.h>
 #include <net/net_namespace.h>
commit 68845a55c31bd4e00107c6b6585ab0c707782c5c
Merge: c953d60b1180 7359608a271c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:24:35 2020 -0700

    Merge branch 'akpm' into master (patches from Andrew)
    
    Merge misc fixes from Andrew Morton:
     "Subsystems affected by this patch series: mm/pagemap, mm/shmem,
      mm/hotfixes, mm/memcg, mm/hugetlb, mailmap, squashfs, scripts,
      io-mapping, MAINTAINERS, and gdb"
    
    * emailed patches from Andrew Morton <akpm at linux-foundation.org>:
      scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
      MAINTAINERS: add KCOV section
      io-mapping: indicate mapping failure
      scripts/decode_stacktrace: strip basepath from all paths
      squashfs: fix length field overlap check in metadata reading
      mailmap: add entry for Mike Rapoport
      khugepaged: fix null-pointer dereference due to race
      mm/hugetlb: avoid hardcoding while checking if cma is enabled
      mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
      mm/memcg: fix refcount error while moving and swapping
      mm/memcontrol: fix OOPS inside mem_cgroup_get_nr_swap_pages()
      mm: initialize return of vm_insert_pages
      vfs/xattr: mm/shmem: kernfs: release simple xattr entry in a right way
      mm/mmap.c: close race between munmap() and expand_upwards()/downwards()

commit c953d60b1180c4a59a55b72fecd278d264d60f5b
Merge: c6d686047456 5fff09bc1415
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:19:00 2020 -0700

    Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs into master
    
    Pull xtensa csum regression fix from Al Viro:
     "Max Filippov caught a breakage introduced in xtensa this cycle
      by the csum_and_copy_..._user() series.
    
      Cut'n'paste from the wrong source - the check that belongs
      in csum_and_copy_to_user() ended up both there and in
      csum_and_copy_from_user()"
    
    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
      xtensa: fix access check in csum_and_copy_from_user

commit c6d686047456bd3e36dce7de95375890fb8b7dd9
Merge: 0669704270e1 7b7891c7bdfd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:16:12 2020 -0700

    Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux into master
    
    Pull arm64 fix from Will Deacon:
     "Fix compat vDSO build flags for recent versions of clang to tell it
      where to find the assembler"
    
    * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
      arm64: vdso32: Fix '--prefix=' value for newer versions of clang

commit 0669704270e142483d80cfda5c526426c1a89711
Merge: 6a343656d302 48cfa61b58a1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:11:43 2020 -0700

    Merge tag 'for-5.8-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into master
    
    Pull btrfs fixes from David Sterba:
     "A few resouce leak fixes from recent patches, all are stable material.
    
      The problems have been observed during testing or have a reproducer"
    
    * tag 'for-5.8-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
      btrfs: fix mount failure caused by race with umount
      btrfs: fix page leaks after failure to lock page for delalloc
      btrfs: qgroup: fix data leak caused by race between writeback and truncate
      btrfs: fix double free on ulist after backref resolution failure

commit 6a343656d30229a424458f8111e55df336375382
Merge: 1f68f31b5150 89ee72376be2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:09:19 2020 -0700

    Merge tag 'zonefs-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs into master
    
    Pull zonefs fixes from Damien Le Moal:
     "Two fixes, the first one to remove compilation warnings and the second
      to avoid potentially inefficient allocation of BIOs for direct writes
      into sequential zones"
    
    * tag 'zonefs-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:
      zonefs: count pages after truncating the iterator
      zonefs: Fix compilation warning

commit 1f68f31b51507e1ad647aa3a43c295eb024490ad
Merge: 5a0b8af0719f 3e863ea3bb1a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 14:02:41 2020 -0700

    Merge tag 'io_uring-5.8-2020-07-24' of git://git.kernel.dk/linux-block into master
    
    Pull io_uring fixes from Jens Axboe:
    
     - Fix discrepancy in how sqe->flags are treated for a few requests,
       this makes it consistent (Daniele)
    
     - Ensure that poll driven retry works with double waitqueue poll users
    
     - Fix a missing io_req_init_async() (Pavel)
    
    * tag 'io_uring-5.8-2020-07-24' of git://git.kernel.dk/linux-block:
      io_uring: missed req_init_async() for IOSQE_ASYNC
      io_uring: always allow drain/link/hardlink/async sqe flags
      io_uring: ensure double poll additions work with both request types

commit 5a0b8af0719fd0710d9d1a9ad83b7fbdf4bfca66
Merge: fcef1046eb1b 1014a2f8d76b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:58:05 2020 -0700

    Merge tag 'iommu-fix-v5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu into master
    
    Pull iommu fix from Joerg Roedel:
     "Fix a NULL-ptr dereference in the QCOM IOMMU driver"
    
    * tag 'iommu-fix-v5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
      iommu/qcom: Use domain rather than dev as tlb cookie

commit fcef1046eb1b78c98105e9b68e48df6022c23a06
Merge: a38a19efcd9b a862192e9227
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:48:57 2020 -0700

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma into master
    
    Pull rdma fixes from Jason Gunthorpe:
     "One merge window regression, some corruption bugs in HNS and a few
      more syzkaller fixes:
    
       - Two long standing syzkaller races
    
       - Fix incorrect HW configuration in HNS
    
       - Restore accidentally dropped locking in IB CM
    
       - Fix ODP prefetch bug added in the big rework several versions ago"
    
    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
      RDMA/mlx5: Prevent prefetch from racing with implicit destruction
      RDMA/cm: Protect access to remote_sidr_table
      RDMA/core: Fix race in rdma_alloc_commit_uobject()
      RDMA/hns: Fix wrong PBL offset when VA is not aligned to PAGE_SIZE
      RDMA/hns: Fix wrong assignment of lp_pktn_ini in QPC
      RDMA/mlx5: Use xa_lock_irq when access to SRQ table

commit a38a19efcd9b7b536e2820df91e9f0be806f9a42
Merge: c615035b29c3 5df96f2b9f58
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:44:14 2020 -0700

    Merge tag 'for-5.8/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm into master
    
    Pull device mapper fix from Mike Snitzer:
     "A stable fix for DM integrity target's integrity recalculation that
      gets skipped when resuming a device. This is a fix for a previous
      stable@ fix"
    
    * tag 'for-5.8/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
      dm integrity: fix integrity recalculation that is improperly skipped

commit c615035b29c3628a35ece192046e0e6658d96ab3
Merge: b85bcb784fd8 02b9aec59243
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:41:13 2020 -0700

    Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux into master
    
    Pull i2c fixes from Wolfram Sang:
     "Again some driver bugfixes and some documentation fixes"
    
    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
      i2c: i2c-qcom-geni: Fix DMA transfer race
      i2c: rcar: always clear ICSAR to avoid side effects
      MAINTAINERS: i2c: at91: handover maintenance to Codrin Ciubotariu
      i2c: drop duplicated word in the header file
      i2c: cadence: Clear HOLD bit at correct time in Rx path
      Revert "i2c: cadence: Fix the hold bit setting"

commit b85bcb784fd84ef854f6a6d03a0c48c207d0b0ec
Merge: 88fff0b7dcc1 ebd4050c6144
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:37:38 2020 -0700

    Merge tag 'mmc-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc into master
    
    Pull MMC fix from Ulf Hansson:
     "Fix clock divider calculation in the ASPEED SDHCI controller"
    
    * tag 'mmc-v5.8-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
      mmc: sdhci-of-aspeed: Fix clock divider calculation

commit 88fff0b7dcc132c924d710d75d1401264b6d0ef6
Merge: f37e99aca03f d8904ca9d338
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 24 13:35:55 2020 -0700

    Merge tag 'drm-fixes-2020-07-24' of git://anongit.freedesktop.org/drm/drm into master
    
    Pull drm fixes from Dave Airlie:
     "Quiet fixes, I may have a single regression fix follow up to this for
      nouveau, but it might be next week, Ben was testing it a bit more .
    
      Otherwise two amdgpu fixes, one lima and one sun4i:
    
      amdgpu:
        - Fix crash when overclocking VegaM
        - Fix possible crash when editing dpm levels
    
      sun4i:
        - Fix inverted HPD result; fixes an earlier fix
    
      lima:
        - fix timeout during reset"
    
    * tag 'drm-fixes-2020-07-24' of git://anongit.freedesktop.org/drm/drm:
      drm/amdgpu: Fix NULL dereference in dpm sysfs handlers
      drm/amd/powerplay: fix a crash when overclocking Vega M
      drm/lima: fix wait pp reset timeout
      drm: sun4i: hdmi: Fix inverted HPD result

commit 7d98404c8162b7f1d1b22eccce92f5ee7f93cab8
Author: Ville Syrjälä <ville.syrjala at linux.intel.com>
Date:   Fri Jul 24 22:07:18 2020 +0300

    drm/omap: Use {} to zero initialize the mode
    
    The first member of drm_display_mode is no longer a structure, but
    the code is still using {{0}} to zero initialize it. Make that just
    {} so it works regardless of what lies inside.
    
    Cc: Dave Airlie <airlied at redhat.com>
    Cc: Laurent Pinchart <laurent.pinchart+renesas at ideasonboard.com>
    Cc: Tomi Valkeinen <tomi.valkeinen at ti.com>
    Fixes: 42acb06b01b1 ("drm: pahole struct drm_display_mode")
    Signed-off-by: Ville Syrjälä <ville.syrjala at linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200724190718.23567-1-ville.syrjala@linux.intel.com
    Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch.ch>

diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c
index 528764566b17..de95dc1b861c 100644
--- a/drivers/gpu/drm/omapdrm/omap_connector.c
+++ b/drivers/gpu/drm/omapdrm/omap_connector.c
@@ -89,7 +89,7 @@ static enum drm_mode_status omap_connector_mode_valid(struct drm_connector *conn
 				 struct drm_display_mode *mode)
 {
 	struct omap_connector *omap_connector = to_omap_connector(connector);
-	struct drm_display_mode new_mode = { { 0 } };
+	struct drm_display_mode new_mode = {};
 	enum drm_mode_status status;
 
 	status = omap_connector_mode_fixup(omap_connector->output, mode,
commit 7359608a271ce81803de148befefd309baf88c76
Author: Stefano Garzarella <sgarzare at redhat.com>
Date:   Thu Jul 23 21:15:52 2020 -0700

    scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
    
    Commit ed66f991bb19 ("module: Refactor section attr into bin attribute")
    removed the 'name' field from 'struct module_sect_attr' triggering the
    following error when invoking lx-symbols:
    
      (gdb) lx-symbols
      loading vmlinux
      scanning for modules in linux/build
      loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko
      Python Exception <class 'gdb.error'> There is no member named name.:
      Error occurred in Python: There is no member named name.
    
    This patch fixes the issue taking the module name from the 'struct
    attribute'.
    
    Fixes: ed66f991bb19 ("module: Refactor section attr into bin attribute")
    Signed-off-by: Stefano Garzarella <sgarzare at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Jan Kiszka <jan.kiszka at siemens.com>
    Reviewed-by: Kieran Bingham <kbingham at kernel.org>
    Link: http://lkml.kernel.org/r/20200722102239.313231-1-sgarzare@redhat.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
index be984aa29b75..1be9763cf8bb 100644
--- a/scripts/gdb/linux/symbols.py
+++ b/scripts/gdb/linux/symbols.py
@@ -96,7 +96,7 @@ lx-symbols command."""
             return ""
         attrs = sect_attrs['attrs']
         section_name_to_address = {
-            attrs[n]['name'].string(): attrs[n]['address']
+            attrs[n]['battr']['attr']['name'].string(): attrs[n]['address']
             for n in range(int(sect_attrs['nsections']))}
         args = []
         for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
commit bb9715379abfeddea86343b748b62410e20ef037
Author: Andrey Konovalov <andreyknvl at google.com>
Date:   Thu Jul 23 21:15:49 2020 -0700

    MAINTAINERS: add KCOV section
    
    To link KCOV to the kasan-dev@ mailing list.
    
    Signed-off-by: Andrey Konovalov <andreyknvl at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Acked-by: Dmitry Vyukov <dvyukov at google.com>
    Cc: Alexander Potapenko <glider at google.com>
    Cc: Marco Elver <elver at google.com>
    Link: http://lkml.kernel.org/r/5fa344db7ac4af2213049e5656c0f43d6ecaa379.1595331682.git.andreyknvl@google.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index e64cdde81851..ef39a48f63e4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9306,6 +9306,17 @@ F:	Documentation/kbuild/kconfig*
 F:	scripts/Kconfig.include
 F:	scripts/kconfig/
 
+KCOV
+R:	Dmitry Vyukov <dvyukov at google.com>
+R:	Andrey Konovalov <andreyknvl at google.com>
+L:	kasan-dev at googlegroups.com
+S:	Maintained
+F:	Documentation/dev-tools/kcov.rst
+F:	include/linux/kcov.h
+F:	include/uapi/linux/kcov.h
+F:	kernel/kcov.c
+F:	scripts/Makefile.kcov
+
 KCSAN
 M:	Marco Elver <elver at google.com>
 R:	Dmitry Vyukov <dvyukov at google.com>
commit e0b3e0b1a04367fc15c07f44e78361545b55357c
Author: Michael J. Ruhl <michael.j.ruhl at intel.com>
Date:   Thu Jul 23 21:15:46 2020 -0700

    io-mapping: indicate mapping failure
    
    The !ATOMIC_IOMAP version of io_maping_init_wc will always return
    success, even when the ioremap fails.
    
    Since the ATOMIC_IOMAP version returns NULL when the init fails, and
    callers check for a NULL return on error this is unexpected.
    
    During a device probe, where the ioremap failed, a crash can look like
    this:
    
        BUG: unable to handle page fault for address: 0000000000210000
         #PF: supervisor write access in kernel mode
         #PF: error_code(0x0002) - not-present page
         Oops: 0002 [#1] PREEMPT SMP
         CPU: 0 PID: 177 Comm:
         RIP: 0010:fill_page_dma [i915]
           gen8_ppgtt_create [i915]
           i915_ppgtt_create [i915]
           intel_gt_init [i915]
           i915_gem_init [i915]
           i915_driver_probe [i915]
           pci_device_probe
           really_probe
           driver_probe_device
    
    The remap failure occurred much earlier in the probe.  If it had been
    propagated, the driver would have exited with an error.
    
    Return NULL on ioremap failure.
    
    [akpm at linux-foundation.org: detect ioremap_wc() errors earlier]
    
    Fixes: cafaf14a5d8f ("io-mapping: Always create a struct to hold metadata about the io-mapping")
    Signed-off-by: Michael J. Ruhl <michael.j.ruhl at intel.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Mike Rapoport <rppt at linux.ibm.com>
    Cc: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
    Cc: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: Daniel Vetter <daniel at ffwll.ch>
    Cc: <stable at vger.kernel.org>
    Link: http://lkml.kernel.org/r/20200721171936.81563-1-michael.j.ruhl@intel.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
index 0beaa3eba155..c75e4d3d8833 100644
--- a/include/linux/io-mapping.h
+++ b/include/linux/io-mapping.h
@@ -107,9 +107,12 @@ io_mapping_init_wc(struct io_mapping *iomap,
 		   resource_size_t base,
 		   unsigned long size)
 {
+	iomap->iomem = ioremap_wc(base, size);
+	if (!iomap->iomem)
+		return NULL;
+
 	iomap->base = base;
 	iomap->size = size;
-	iomap->iomem = ioremap_wc(base, size);
 #if defined(pgprot_noncached_wc) /* archs can't agree on a name ... */
 	iomap->prot = pgprot_noncached_wc(PAGE_KERNEL);
 #elif defined(pgprot_writecombine)
commit d178770d8d21489abf5bafefcbb6d5243b482e9a
Author: Pi-Hsun Shih <pihsun at chromium.org>
Date:   Thu Jul 23 21:15:43 2020 -0700

    scripts/decode_stacktrace: strip basepath from all paths
    
    Currently the basepath is removed only from the beginning of the string.
    When the symbol is inlined and there's multiple line outputs of
    addr2line, only the first line would have basepath removed.
    
    Change to remove the basepath prefix from all lines.
    
    Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex")
    Co-developed-by: Shik Chen <shik at chromium.org>
    Signed-off-by: Pi-Hsun Shih <pihsun at chromium.org>
    Signed-off-by: Shik Chen <shik at chromium.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Stephen Boyd <swboyd at chromium.org>
    Cc: Sasha Levin <sashal at kernel.org>
    Cc: Nicolas Boichat <drinkcat at chromium.org>
    Cc: Jiri Slaby <jslaby at suse.cz>
    Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
index 66a6d511b524..0869def435ee 100755
--- a/scripts/decode_stacktrace.sh
+++ b/scripts/decode_stacktrace.sh
@@ -87,8 +87,8 @@ parse_symbol() {
 		return
 	fi
 
-	# Strip out the base of the path
-	code=${code#$basepath/}
+	# Strip out the base of the path on each line
+	code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
 
 	# In the case of inlines, move everything to same line
 	code=${code//$'\n'/' '}
commit 2910c59fd0423f87aca3a669b156a2325da63745
Author: Phillip Lougher <phillip at squashfs.org.uk>
Date:   Thu Jul 23 21:15:40 2020 -0700

    squashfs: fix length field overlap check in metadata reading
    
    This is a regression introduced by the "migrate from ll_rw_block usage
    to BIO" patch.
    
    Squashfs packs structures on byte boundaries, and due to that the length
    field (of the metadata block) may not be fully in the current block.
    The new code rewrote and introduced a faulty check for that edge case.
    
    Fixes: 93e72b3c612adcaca1 ("squashfs: migrate from ll_rw_block usage to BIO")
    Reported-by: Bernd Amend <bernd.amend at gmail.com>
    Signed-off-by: Phillip Lougher <phillip at squashfs.org.uk>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Christoph Hellwig <hch at lst.de>
    Cc: Adrien Schildknecht <adrien+dev at schischi.me>
    Cc: Guenter Roeck <groeck at chromium.org>
    Cc: Daniel Rosenberg <drosen at google.com>
    Link: http://lkml.kernel.org/r/20200717195536.16069-1-phillip@squashfs.org.uk
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index 64f61330564a..76bb1c846845 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -175,7 +175,7 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
 		/* Extract the length of the metadata block */
 		data = page_address(bvec->bv_page) + bvec->bv_offset;
 		length = data[offset];
-		if (offset <= bvec->bv_len - 1) {
+		if (offset < bvec->bv_len - 1) {
 			length |= data[offset + 1] << 8;
 		} else {
 			if (WARN_ON_ONCE(!bio_next_segment(bio, &iter_all))) {
commit e57942c5630f86880f2cefa61f4a1ab10d4864af
Author: Mike Rapoport <rppt at linux.ibm.com>
Date:   Thu Jul 23 21:15:37 2020 -0700

    mailmap: add entry for Mike Rapoport
    
    Add an entry to correct my email addresses.
    
    Signed-off-by: Mike Rapoport <rppt at linux.ibm.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Link: http://lkml.kernel.org/r/20200708095414.12275-1-rppt@kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/.mailmap b/.mailmap
index 6da12dfd10dc..db4f2295bd9d 100644
--- a/.mailmap
+++ b/.mailmap
@@ -198,6 +198,9 @@ Maxime Ripard <mripard at kernel.org> <maxime.ripard at free-electrons.com>
 Mayuresh Janorkar <mayur at ti.com>
 Michael Buesch <m at bues.ch>
 Michel Dänzer <michel at tungstengraphics.com>
+Mike Rapoport <rppt at kernel.org> <mike at compulab.co.il>
+Mike Rapoport <rppt at kernel.org> <mike.rapoport at gmail.com>
+Mike Rapoport <rppt at kernel.org> <rppt at linux.ibm.com>
 Miodrag Dinic <miodrag.dinic at mips.com> <miodrag.dinic at imgtec.com>
 Miquel Raynal <miquel.raynal at bootlin.com> <miquel.raynal at free-electrons.com>
 Mitesh shah <mshah at teja.com>
commit 594cced14ad3903166c8b091ff96adac7552f0b3
Author: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
Date:   Thu Jul 23 21:15:34 2020 -0700

    khugepaged: fix null-pointer dereference due to race
    
    khugepaged has to drop mmap lock several times while collapsing a page.
    The situation can change while the lock is dropped and we need to
    re-validate that the VMA is still in place and the PMD is still subject
    for collapse.
    
    But we miss one corner case: while collapsing an anonymous pages the VMA
    could be replaced with file VMA.  If the file VMA doesn't have any
    private pages we get NULL pointer dereference:
    
            general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
            KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
            anon_vma_lock_write include/linux/rmap.h:120 [inline]
            collapse_huge_page mm/khugepaged.c:1110 [inline]
            khugepaged_scan_pmd mm/khugepaged.c:1349 [inline]
            khugepaged_scan_mm_slot mm/khugepaged.c:2110 [inline]
            khugepaged_do_scan mm/khugepaged.c:2193 [inline]
            khugepaged+0x3bba/0x5a10 mm/khugepaged.c:2238
    
    The fix is to make sure that the VMA is anonymous in
    hugepage_vma_revalidate().  The helper is only used for collapsing
    anonymous pages.
    
    Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
    Reported-by: syzbot+ed318e8b790ca72c5ad0 at syzkaller.appspotmail.com
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: David Hildenbrand <david at redhat.com>
    Acked-by: Yang Shi <yang.shi at linux.alibaba.com>
    Cc: <stable at vger.kernel.org>
    Link: http://lkml.kernel.org/r/20200722121439.44328-1-kirill.shutemov@linux.intel.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index b043c40a21d4..700f5160f3e4 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -958,6 +958,9 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
 		return SCAN_ADDRESS_RANGE;
 	if (!hugepage_vma_check(vma, vma->vm_flags))
 		return SCAN_VMA_CHECK;
+	/* Anon VMA expected */
+	if (!vma->anon_vma || vma->vm_ops)
+		return SCAN_VMA_CHECK;
 	return 0;
 }
 
commit dbda8feadfa46b3d8dd7a2304f84ccbc036effe9
Author: Barry Song <song.bao.hua at hisilicon.com>
Date:   Thu Jul 23 21:15:30 2020 -0700

    mm/hugetlb: avoid hardcoding while checking if cma is enabled
    
    hugetlb_cma[0] can be NULL due to various reasons, for example, node0
    has no memory.  so NULL hugetlb_cma[0] doesn't necessarily mean cma is
    not enabled.  gigantic pages might have been reserved on other nodes.
    This patch fixes possible double reservation and CMA leak.
    
    [akpm at linux-foundation.org: fix CONFIG_CMA=n warning]
    [sfr at canb.auug.org.au: better checks before using hugetlb_cma]
      Link: http://lkml.kernel.org/r/20200721205716.6dbaa56b@canb.auug.org.au
    
    Fixes: cf11e85fc08c ("mm: hugetlb: optionally allocate gigantic hugepages using cma")
    Signed-off-by: Barry Song <song.bao.hua at hisilicon.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Mike Kravetz <mike.kravetz at oracle.com>
    Acked-by: Roman Gushchin <guro at fb.com>
    Cc: Jonathan Cameron <jonathan.cameron at huawei.com>
    Cc: <stable at vger.kernel.org>
    Link: http://lkml.kernel.org/r/20200710005726.36068-1-song.bao.hua@hisilicon.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index fab4485b9e52..590111ea6975 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -45,7 +45,10 @@ int hugetlb_max_hstate __read_mostly;
 unsigned int default_hstate_idx;
 struct hstate hstates[HUGE_MAX_HSTATE];
 
+#ifdef CONFIG_CMA
 static struct cma *hugetlb_cma[MAX_NUMNODES];
+#endif
+static unsigned long hugetlb_cma_size __initdata;
 
 /*
  * Minimum page order among possible hugepage sizes, set to a proper value
@@ -1235,9 +1238,10 @@ static void free_gigantic_page(struct page *page, unsigned int order)
 	 * If the page isn't allocated using the cma allocator,
 	 * cma_release() returns false.
 	 */
-	if (IS_ENABLED(CONFIG_CMA) &&
-	    cma_release(hugetlb_cma[page_to_nid(page)], page, 1 << order))
+#ifdef CONFIG_CMA
+	if (cma_release(hugetlb_cma[page_to_nid(page)], page, 1 << order))
 		return;
+#endif
 
 	free_contig_range(page_to_pfn(page), 1 << order);
 }
@@ -1248,7 +1252,8 @@ static struct page *alloc_gigantic_page(struct hstate *h, gfp_t gfp_mask,
 {
 	unsigned long nr_pages = 1UL << huge_page_order(h);
 
-	if (IS_ENABLED(CONFIG_CMA)) {
+#ifdef CONFIG_CMA
+	{
 		struct page *page;
 		int node;
 
@@ -1262,6 +1267,7 @@ static struct page *alloc_gigantic_page(struct hstate *h, gfp_t gfp_mask,
 				return page;
 		}
 	}
+#endif
 
 	return alloc_contig_pages(nr_pages, gfp_mask, nid, nodemask);
 }
@@ -2571,7 +2577,7 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h)
 
 	for (i = 0; i < h->max_huge_pages; ++i) {
 		if (hstate_is_gigantic(h)) {
-			if (IS_ENABLED(CONFIG_CMA) && hugetlb_cma[0]) {
+			if (hugetlb_cma_size) {
 				pr_warn_once("HugeTLB: hugetlb_cma is enabled, skip boot time allocation\n");
 				break;
 			}
@@ -5654,7 +5660,6 @@ void move_hugetlb_state(struct page *oldpage, struct page *newpage, int reason)
 }
 
 #ifdef CONFIG_CMA
-static unsigned long hugetlb_cma_size __initdata;
 static bool cma_reserve_called __initdata;
 
 static int __init cmdline_parse_hugetlb_cma(char *p)
commit d38a2b7a9c939e6d7329ab92b96559ccebf7b135
Author: Muchun Song <songmuchun at bytedance.com>
Date:   Thu Jul 23 21:15:27 2020 -0700

    mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
    
    If the kmem_cache refcount is greater than one, we should not mark the
    root kmem_cache as dying.  If we mark the root kmem_cache dying
    incorrectly, the non-root kmem_cache can never be destroyed.  It
    resulted in memory leak when memcg was destroyed.  We can use the
    following steps to reproduce.
    
      1) Use kmem_cache_create() to create a new kmem_cache named A.
      2) Coincidentally, the kmem_cache A is an alias for kmem_cache B,
         so the refcount of B is just increased.
      3) Use kmem_cache_destroy() to destroy the kmem_cache A, just
         decrease the B's refcount but mark the B as dying.
      4) Create a new memory cgroup and alloc memory from the kmem_cache
         B. It leads to create a non-root kmem_cache for allocating memory.
      5) When destroy the memory cgroup created in the step 4), the
         non-root kmem_cache can never be destroyed.
    
    If we repeat steps 4) and 5), this will cause a lot of memory leak.  So
    only when refcount reach zero, we mark the root kmem_cache as dying.
    
    Fixes: 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")
    Signed-off-by: Muchun Song <songmuchun at bytedance.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Shakeel Butt <shakeelb at google.com>
    Acked-by: Roman Gushchin <guro at fb.com>
    Cc: Vlastimil Babka <vbabka at suse.cz>
    Cc: Christoph Lameter <cl at linux.com>
    Cc: Pekka Enberg <penberg at kernel.org>
    Cc: David Rientjes <rientjes at google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim at lge.com>
    Cc: Shakeel Butt <shakeelb at google.com>
    Cc: <stable at vger.kernel.org>
    Link: http://lkml.kernel.org/r/20200716165103.83462-1-songmuchun@bytedance.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 37d48a56431d..fe8b68482670 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -326,6 +326,14 @@ int slab_unmergeable(struct kmem_cache *s)
 	if (s->refcount < 0)
 		return 1;
 
+#ifdef CONFIG_MEMCG_KMEM
+	/*
+	 * Skip the dying kmem_cache.
+	 */
+	if (s->memcg_params.dying)
+		return 1;
+#endif
+
 	return 0;
 }
 
@@ -886,12 +894,15 @@ static int shutdown_memcg_caches(struct kmem_cache *s)
 	return 0;
 }
 
-static void flush_memcg_workqueue(struct kmem_cache *s)
+static void memcg_set_kmem_cache_dying(struct kmem_cache *s)
 {
 	spin_lock_irq(&memcg_kmem_wq_lock);
 	s->memcg_params.dying = true;
 	spin_unlock_irq(&memcg_kmem_wq_lock);
+}
 
+static void flush_memcg_workqueue(struct kmem_cache *s)
+{
 	/*
 	 * SLAB and SLUB deactivate the kmem_caches through call_rcu. Make
 	 * sure all registered rcu callbacks have been invoked.
@@ -923,10 +934,6 @@ static inline int shutdown_memcg_caches(struct kmem_cache *s)
 {
 	return 0;
 }
-
-static inline void flush_memcg_workqueue(struct kmem_cache *s)
-{
-}
 #endif /* CONFIG_MEMCG_KMEM */
 
 void slab_kmem_cache_release(struct kmem_cache *s)
@@ -944,8 +951,6 @@ void kmem_cache_destroy(struct kmem_cache *s)
 	if (unlikely(!s))
 		return;
 
-	flush_memcg_workqueue(s);
-
 	get_online_cpus();
 	get_online_mems();
 
@@ -955,6 +960,22 @@ void kmem_cache_destroy(struct kmem_cache *s)
 	if (s->refcount)
 		goto out_unlock;
 
+#ifdef CONFIG_MEMCG_KMEM
+	memcg_set_kmem_cache_dying(s);
+
+	mutex_unlock(&slab_mutex);
+
+	put_online_mems();
+	put_online_cpus();
+
+	flush_memcg_workqueue(s);
+
+	get_online_cpus();
+	get_online_mems();
+
+	mutex_lock(&slab_mutex);
+#endif
+
 	err = shutdown_memcg_caches(s);
 	if (!err)
 		err = shutdown_cache(s);
commit 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c
Author: Hugh Dickins <hughd at google.com>
Date:   Thu Jul 23 21:15:24 2020 -0700

    mm/memcg: fix refcount error while moving and swapping
    
    It was hard to keep a test running, moving tasks between memcgs with
    move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s
    refcount is discovered to be 0 (supposedly impossible), so it is then
    forced to REFCOUNT_SATURATED, and after thousands of warnings in quick
    succession, the test is at last put out of misery by being OOM killed.
    
    This is because of the way moved_swap accounting was saved up until the
    task move gets completed in __mem_cgroup_clear_mc(), deferred from when
    mem_cgroup_move_swap_account() actually exchanged old and new ids.
    Concurrent activity can free up swap quicker than the task is scanned,
    bringing id refcount down 0 (which should only be possible when
    offlining).
    
    Just skip that optimization: do that part of the accounting immediately.
    
    Fixes: 615d66c37c75 ("mm: memcontrol: fix memcg id ref counter on swap charge move")
    Signed-off-by: Hugh Dickins <hughd at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Alex Shi <alex.shi at linux.alibaba.com>
    Cc: Johannes Weiner <hannes at cmpxchg.org>
    Cc: Alex Shi <alex.shi at linux.alibaba.com>
    Cc: Shakeel Butt <shakeelb at google.com>
    Cc: Michal Hocko <mhocko at suse.com>
    Cc: <stable at vger.kernel.org>
    Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2007071431050.4726@eggly.anvils
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index c75c4face02e..13f559af1ab6 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5669,7 +5669,6 @@ static void __mem_cgroup_clear_mc(void)
 		if (!mem_cgroup_is_root(mc.to))
 			page_counter_uncharge(&mc.to->memory, mc.moved_swap);
 
-		mem_cgroup_id_get_many(mc.to, mc.moved_swap);
 		css_put_many(&mc.to->css, mc.moved_swap);
 
 		mc.moved_swap = 0;
@@ -5860,7 +5859,8 @@ put:			/* get_mctgt_type() gets the page */
 			ent = target.ent;
 			if (!mem_cgroup_move_swap_account(ent, mc.from, mc.to)) {
 				mc.precharge--;
-				/* we fixup refcnts and charges later. */
+				mem_cgroup_id_get_many(mc.to, 1);
+				/* we fixup other refcnts and charges later. */
 				mc.moved_swap++;
 			}
 			break;
commit 82ff165cd35110d4e380b55927bbd74dcb564998
Author: Bhupesh Sharma <bhsharma at redhat.com>
Date:   Thu Jul 23 21:15:21 2020 -0700

    mm/memcontrol: fix OOPS inside mem_cgroup_get_nr_swap_pages()
    
    Prabhakar reported an OOPS inside mem_cgroup_get_nr_swap_pages()
    function in a corner case seen on some arm64 boards when kdump kernel
    runs with "cgroup_disable=memory" passed to the kdump kernel via
    bootargs.
    
    The root-cause behind the same is that currently mem_cgroup_swap_init()
    function is implemented as a subsys_initcall() call instead of a
    core_initcall(), this means 'cgroup_memory_noswap' still remains set to
    the default value (false) even when memcg is disabled via
    "cgroup_disable=memory" boot parameter.
    
    This may result in premature OOPS inside mem_cgroup_get_nr_swap_pages()
    function in corner cases:
    
      Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188
      Mem abort info:
        ESR = 0x96000006
        EC = 0x25: DABT (current EL), IL = 32 bits
        SET = 0, FnV = 0
        EA = 0, S1PTW = 0
      Data abort info:
        ISV = 0, ISS = 0x00000006
        CM = 0, WnR = 0
      [0000000000000188] user address but active_mm is swapper
      Internal error: Oops: 96000006 [#1] SMP
      Modules linked in:
      <..snip..>
      Call trace:
        mem_cgroup_get_nr_swap_pages+0x9c/0xf4
        shrink_lruvec+0x404/0x4f8
        shrink_node+0x1a8/0x688
        do_try_to_free_pages+0xe8/0x448
        try_to_free_pages+0x110/0x230
        __alloc_pages_slowpath.constprop.106+0x2b8/0xb48
        __alloc_pages_nodemask+0x2ac/0x2f8
        alloc_page_interleave+0x20/0x90
        alloc_pages_current+0xdc/0xf8
        atomic_pool_expand+0x60/0x210
        __dma_atomic_pool_init+0x50/0xa4
        dma_atomic_pool_init+0xac/0x158
        do_one_initcall+0x50/0x218
        kernel_init_freeable+0x22c/0x2d0
        kernel_init+0x18/0x110
        ret_from_fork+0x10/0x18
      Code: aa1403e3 91106000 97f82a27 14000011 (f940c663)
      ---[ end trace 9795948475817de4 ]---
      Kernel panic - not syncing: Fatal exception
      Rebooting in 10 seconds..
    
    Fixes: eccb52e78809 ("mm: memcontrol: prepare swap controller setup for integration")
    Reported-by: Prabhakar Kushwaha <pkushwaha at marvell.com>
    Signed-off-by: Bhupesh Sharma <bhsharma at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Acked-by: Michal Hocko <mhocko at suse.com>
    Cc: Johannes Weiner <hannes at cmpxchg.org>
    Cc: Vladimir Davydov <vdavydov.dev at gmail.com>
    Cc: James Morse <james.morse at arm.com>
    Cc: Mark Rutland <mark.rutland at arm.com>
    Cc: Will Deacon <will at kernel.org>
    Cc: Catalin Marinas <catalin.marinas at arm.com>
    Link: http://lkml.kernel.org/r/1593641660-13254-2-git-send-email-bhsharma@redhat.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 19622328e4b5..c75c4face02e 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -7186,6 +7186,13 @@ static struct cftype memsw_files[] = {
 	{ },	/* terminate */
 };
 
+/*
+ * If mem_cgroup_swap_init() is implemented as a subsys_initcall()
+ * instead of a core_initcall(), this could mean cgroup_memory_noswap still
+ * remains set to false even when memcg is disabled via "cgroup_disable=memory"
+ * boot parameter. This may result in premature OOPS inside
+ * mem_cgroup_get_nr_swap_pages() function in corner cases.
+ */
 static int __init mem_cgroup_swap_init(void)
 {
 	/* No memory control -> no swap control */
@@ -7200,6 +7207,6 @@ static int __init mem_cgroup_swap_init(void)
 
 	return 0;
 }
-subsys_initcall(mem_cgroup_swap_init);
+core_initcall(mem_cgroup_swap_init);
 
 #endif /* CONFIG_MEMCG_SWAP */
commit 45779b036d3d2870633443a9f9bd03c177befbf5
Author: Tom Rix <trix at redhat.com>
Date:   Thu Jul 23 21:15:18 2020 -0700

    mm: initialize return of vm_insert_pages
    
    clang static analysis reports a garbage return
    
      In file included from mm/memory.c:84:
      mm/memory.c:1612:2: warning: Undefined or garbage value returned to caller [core.uninitialized.UndefReturn]
              return err;
              ^~~~~~~~~~
    
    The setting of err depends on a loop executing.  So initialize err.
    
    Signed-off-by: Tom Rix <trix at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Link: http://lkml.kernel.org/r/20200703155354.29132-1-trix@redhat.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/memory.c b/mm/memory.c
index 87ec87cdc1ff..3ecad55103ad 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1601,7 +1601,7 @@ int vm_insert_pages(struct vm_area_struct *vma, unsigned long addr,
 	return insert_pages(vma, addr, pages, num, vma->vm_page_prot);
 #else
 	unsigned long idx = 0, pgcount = *num;
-	int err;
+	int err = -EINVAL;
 
 	for (; idx < pgcount; ++idx) {
 		err = vm_insert_page(vma, addr + (PAGE_SIZE * idx), pages[idx]);
commit 3bef735ad7b7d987069181e7b58588043cbd1509
Author: Chengguang Xu <cgxu519 at mykernel.net>
Date:   Thu Jul 23 21:15:14 2020 -0700

    vfs/xattr: mm/shmem: kernfs: release simple xattr entry in a right way
    
    After commit fdc85222d58e ("kernfs: kvmalloc xattr value instead of
    kmalloc"), simple xattr entry is allocated with kvmalloc() instead of
    kmalloc(), so we should release it with kvfree() instead of kfree().
    
    Fixes: fdc85222d58e ("kernfs: kvmalloc xattr value instead of kmalloc")
    Signed-off-by: Chengguang Xu <cgxu519 at mykernel.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Acked-by: Hugh Dickins <hughd at google.com>
    Acked-by: Tejun Heo <tj at kernel.org>
    Cc: Daniel Xu <dxu at dxuuu.xyz>
    Cc: Chris Down <chris at chrisdown.name>
    Cc: Andreas Dilger <adilger at dilger.ca>
    Cc: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
    Cc: Al Viro <viro at zeniv.linux.org.uk>
    Cc: <stable at vger.kernel.org>    [5.7]
    Link: http://lkml.kernel.org/r/20200704051608.15043-1-cgxu519@mykernel.net
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/xattr.h b/include/linux/xattr.h
index 47eaa34f8761..c5afaf8ca7a2 100644
--- a/include/linux/xattr.h
+++ b/include/linux/xattr.h
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/spinlock.h>
+#include <linux/mm.h>
 #include <uapi/linux/xattr.h>
 
 struct inode;
@@ -94,7 +95,7 @@ static inline void simple_xattrs_free(struct simple_xattrs *xattrs)
 
 	list_for_each_entry_safe(xattr, node, &xattrs->head, list) {
 		kfree(xattr->name);
-		kfree(xattr);
+		kvfree(xattr);
 	}
 }
 
diff --git a/mm/shmem.c b/mm/shmem.c
index a0dbe62f8042..b2abca3f7f33 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3178,7 +3178,7 @@ static int shmem_initxattrs(struct inode *inode,
 		new_xattr->name = kmalloc(XATTR_SECURITY_PREFIX_LEN + len,
 					  GFP_KERNEL);
 		if (!new_xattr->name) {
-			kfree(new_xattr);
+			kvfree(new_xattr);
 			return -ENOMEM;
 		}
 
commit 246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c
Author: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
Date:   Thu Jul 23 21:15:11 2020 -0700

    mm/mmap.c: close race between munmap() and expand_upwards()/downwards()
    
    VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under
    mmap_read_lock().  It can lead to race with __do_munmap():
    
            Thread A                        Thread B
    __do_munmap()
      detach_vmas_to_be_unmapped()
      mmap_write_downgrade()
                                    expand_downwards()
                                      vma->vm_start = address;
                                      // The VMA now overlaps with
                                      // VMAs detached by the Thread A
                                    // page fault populates expanded part
                                    // of the VMA
      unmap_region()
        // Zaps pagetables partly
        // populated by Thread B
    
    Similar race exists for expand_upwards().
    
    The fix is to avoid downgrading mmap_lock in __do_munmap() if detached
    VMAs are next to VM_GROWSDOWN or VM_GROWSUP VMA.
    
    [akpm at linux-foundation.org: s/mmap_sem/mmap_lock/ in comment]
    
    Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
    Reported-by: Jann Horn <jannh at google.com>
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Yang Shi <yang.shi at linux.alibaba.com>
    Acked-by: Vlastimil Babka <vbabka at suse.cz>
    Cc: Oleg Nesterov <oleg at redhat.com>
    Cc: Matthew Wilcox <willy at infradead.org>
    Cc: <stable at vger.kernel.org>    [4.20+]
    Link: http://lkml.kernel.org/r/20200709105309.42495-1-kirill.shutemov@linux.intel.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/mmap.c b/mm/mmap.c
index 59a4682ebf3f..8c7ca737a19b 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2620,7 +2620,7 @@ static void unmap_region(struct mm_struct *mm,
  * Create a list of vma's touched by the unmap, removing them from the mm's
  * vma list as we go..
  */
-static void
+static bool
 detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
 	struct vm_area_struct *prev, unsigned long end)
 {
@@ -2645,6 +2645,17 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
 
 	/* Kill the cache */
 	vmacache_invalidate(mm);
+
+	/*
+	 * Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or
+	 * VM_GROWSUP VMA. Such VMAs can change their size under
+	 * down_read(mmap_lock) and collide with the VMA we are about to unmap.
+	 */
+	if (vma && (vma->vm_flags & VM_GROWSDOWN))
+		return false;
+	if (prev && (prev->vm_flags & VM_GROWSUP))
+		return false;
+	return true;
 }
 
 /*
@@ -2825,7 +2836,8 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
 	}
 
 	/* Detach vmas from rbtree */
-	detach_vmas_to_be_unmapped(mm, vma, prev, end);
+	if (!detach_vmas_to_be_unmapped(mm, vma, prev, end))
+		downgrade = false;
 
 	if (downgrade)
 		mmap_write_downgrade(mm);
commit 4ae6dbd683860b9edc254ea8acf5e04b5ae242e5
Author: Pavel Begunkov <asml.silence at gmail.com>
Date:   Fri Jul 24 20:07:21 2020 +0300

    io_uring: fix lockup in io_fail_links()
    
    io_fail_links() doesn't consider REQ_F_COMP_LOCKED leading to nested
    spin_lock(completion_lock) and lockup.
    
    [  197.680409] rcu: INFO: rcu_preempt detected expedited stalls on
            CPUs/tasks: { 6-... } 18239 jiffies s: 1421 root: 0x40/.
    [  197.680411] rcu: blocking rcu_node structures:
    [  197.680412] Task dump for CPU 6:
    [  197.680413] link-timeout    R  running task        0  1669
            1 0x8000008a
    [  197.680414] Call Trace:
    [  197.680420]  ? io_req_find_next+0xa0/0x200
    [  197.680422]  ? io_put_req_find_next+0x2a/0x50
    [  197.680423]  ? io_poll_task_func+0xcf/0x140
    [  197.680425]  ? task_work_run+0x67/0xa0
    [  197.680426]  ? do_exit+0x35d/0xb70
    [  197.680429]  ? syscall_trace_enter+0x187/0x2c0
    [  197.680430]  ? do_group_exit+0x43/0xa0
    [  197.680448]  ? __x64_sys_exit_group+0x18/0x20
    [  197.680450]  ? do_syscall_64+0x52/0xa0
    [  197.680452]  ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Signed-off-by: Pavel Begunkov <asml.silence at gmail.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 98e8079e67e7..493e5047e67c 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4199,10 +4199,9 @@ static void io_poll_task_handler(struct io_kiocb *req, struct io_kiocb **nxt)
 
 	hash_del(&req->hash_node);
 	io_poll_complete(req, req->result, 0);
-	req->flags |= REQ_F_COMP_LOCKED;
-	io_put_req_find_next(req, nxt);
 	spin_unlock_irq(&ctx->completion_lock);
 
+	io_put_req_find_next(req, nxt);
 	io_cqring_ev_posted(ctx);
 }
 
commit d5e16d8e23825304c6a9945116cc6b6f8d51f28c
Author: Pavel Begunkov <asml.silence at gmail.com>
Date:   Fri Jul 24 20:07:20 2020 +0300

    io_uring: fix ->work corruption with poll_add
    
    req->work might be already initialised by the time it gets into
    __io_arm_poll_handler(), which will corrupt it by using fields that are
    in an union with req->work. Luckily, the only side effect is missing
    put_creds(). Clean req->work before going there.
    
    Suggested-by: Jens Axboe <axboe at kernel.dk>
    Signed-off-by: Pavel Begunkov <asml.silence at gmail.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 32b0064f806e..98e8079e67e7 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4658,6 +4658,10 @@ static int io_poll_add(struct io_kiocb *req)
 	struct io_poll_table ipt;
 	__poll_t mask;
 
+	/* ->work is in union with hash_node and others */
+	io_req_work_drop_env(req);
+	req->flags &= ~REQ_F_WORK_INITIALIZED;
+
 	INIT_HLIST_NODE(&req->hash_node);
 	INIT_LIST_HEAD(&req->list);
 	ipt.pt._qproc = io_poll_queue_proc;
commit 293a92c1d9913248b9987b68f3a5d6d2f0aae62b
Author: Armas Spann <zappel at retarded.farm>
Date:   Fri Jul 24 16:08:37 2020 +0200

    ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
    
    This patch fixes a small typo I accidently submitted with the initial patch. The board should be named GA401 not G401.
    
    Fixes: ff53664daff2 ("ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289")
    Signed-off-by: Armas Spann <zappel at retarded.farm>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200724140837.302763-1-zappel@retarded.farm
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index a2c48a7f4594..3f2512942daf 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6152,7 +6152,7 @@ enum {
 	ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
 	ALC269VC_FIXUP_ACER_HEADSET_MIC,
 	ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
-	ALC289_FIXUP_ASUS_G401,
+	ALC289_FIXUP_ASUS_GA401,
 	ALC289_FIXUP_ASUS_GA502,
 	ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
 };
@@ -7364,7 +7364,7 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC269_FIXUP_HEADSET_MIC
 	},
-	[ALC289_FIXUP_ASUS_G401] = {
+	[ALC289_FIXUP_ASUS_GA401] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
 			{ 0x19, 0x03a11020 }, /* headset mic with jack detect */
@@ -7570,7 +7570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
-	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
+	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
commit 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b
Author: Armas Spann <zappel at retarded.farm>
Date:   Fri Jul 24 16:06:16 2020 +0200

    ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
    
    This patch adds support for headset mic to the ASUS ROG Zephyrus
    G15(GA502) notebook series by adding the corresponding
    vendor/pci_device id, as well as adding a new fixup for the used
    realtek ALC289. The fixup stets the correct pin to get the headset mic
    correctly recognized on audio-jack.
    
    Signed-off-by: Armas Spann <zappel at retarded.farm>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200724140616.298892-1-zappel@retarded.farm
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 1b2d8e56390a..a2c48a7f4594 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6153,6 +6153,7 @@ enum {
 	ALC269VC_FIXUP_ACER_HEADSET_MIC,
 	ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
 	ALC289_FIXUP_ASUS_G401,
+	ALC289_FIXUP_ASUS_GA502,
 	ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
 };
 
@@ -7370,6 +7371,13 @@ static const struct hda_fixup alc269_fixups[] = {
 			{ }
 		},
 	},
+	[ALC289_FIXUP_ASUS_GA502] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x03a11020 }, /* headset mic with jack detect */
+			{ }
+		},
+	},
 	[ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -7561,6 +7569,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+	SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
 	SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
 	SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
commit b0fef5edff0330eb6de267acd3b6cccb32a43633
Merge: 7c8c70ba5c15 09781ba0395c
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Jul 24 16:14:24 2020 +0200

    Merge tag 'mvebu-fixes-5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into arm/fixes
    
    mvebu fixes for 5.8 (part 1)
    
    - DT change for Armada 38x allowing to add the register needed to fix
      NETA lockup when repeatedly switching speed.
    
    * tag 'mvebu-fixes-5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu:
      ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds

commit fe5ed7ab99c656bd2f5b79b49df0e9ebf2cead8a
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Thu Jul 23 17:44:20 2020 +0200

    uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression
    
    If a tracee is uprobed and it hits int3 inserted by debugger, handle_swbp()
    does send_sig(SIGTRAP, current, 0) which means si_code == SI_USER. This used
    to work when this code was written, but then GDB started to validate si_code
    and now it simply can't use breakpoints if the tracee has an active uprobe:
    
            # cat test.c
            void unused_func(void)
            {
            }
            int main(void)
            {
                    return 0;
            }
    
            # gcc -g test.c -o test
            # perf probe -x ./test -a unused_func
            # perf record -e probe_test:unused_func gdb ./test -ex run
            GNU gdb (GDB) 10.0.50.20200714-git
            ...
            Program received signal SIGTRAP, Trace/breakpoint trap.
            0x00007ffff7ddf909 in dl_main () from /lib64/ld-linux-x86-64.so.2
            (gdb)
    
    The tracee hits the internal breakpoint inserted by GDB to monitor shared
    library events but GDB misinterprets this SIGTRAP and reports a signal.
    
    Change handle_swbp() to use force_sig(SIGTRAP), this matches do_int3_user()
    and fixes the problem.
    
    This is the minimal fix for -stable, arch/x86/kernel/uprobes.c is equally
    wrong; it should use send_sigtrap(TRAP_TRACE) instead of send_sig(SIGTRAP),
    but this doesn't confuse GDB and needs another x86-specific patch.
    
    Reported-by: Aaron Merey <amerey at redhat.com>
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Signed-off-by: Ingo Molnar <mingo at kernel.org>
    Reviewed-by: Srikar Dronamraju <srikar at linux.vnet.ibm.com>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/20200723154420.GA32043@redhat.com

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index bb0862873dba..5f8b0c52fd2e 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2199,7 +2199,7 @@ static void handle_swbp(struct pt_regs *regs)
 	if (!uprobe) {
 		if (is_swbp > 0) {
 			/* No matching uprobe; signal SIGTRAP. */
-			send_sig(SIGTRAP, current, 0);
+			force_sig(SIGTRAP);
 		} else {
 			/*
 			 * Either we raced with uprobe_unregister() or we can't
commit 062d3f95b630113e1156a31f376ad36e25da29a7
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Jul 23 21:10:42 2020 +0100

    sched: Warn if garbage is passed to default_wake_function()
    
    Since the default_wake_function() passes its flags onto
    try_to_wake_up(), warn if those flags collide with internal values.
    
    Given that the supplied flags are garbage, no repair can be done but at
    least alert the user to the damage they are causing.
    
    In the belief that these errors should be picked up during testing, the
    warning is only compiled in under CONFIG_SCHED_DEBUG.
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Signed-off-by: Ingo Molnar <mingo at kernel.org>
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Link: https://lore.kernel.org/r/20200723201042.18861-1-chris@chris-wilson.co.uk

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 5dece9b34e25..2142c6767682 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4485,6 +4485,7 @@ asmlinkage __visible void __sched preempt_schedule_irq(void)
 int default_wake_function(wait_queue_entry_t *curr, unsigned mode, int wake_flags,
 			  void *key)
 {
+	WARN_ON_ONCE(IS_ENABLED(CONFIG_SCHED_DEBUG) && wake_flags & ~WF_SYNC);
 	return try_to_wake_up(curr->private, mode, wake_flags);
 }
 EXPORT_SYMBOL(default_wake_function);
commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9
Author: Matthew Howell <matthew.howell at sealevel.com>
Date:   Wed Jul 22 16:11:24 2020 -0400

    serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X
    
    Sealevel XR17V35X based devices are inoperable on kernel versions
    4.11 and above due to a change in the GPIO preconfiguration introduced in
    commit
    7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel
    cards to the value (0x00) used prior to commit 7dea8165f1d
    
    With GPIOs preconfigured as per commit 7dea8165f1d all ports on
    Sealevel XR17V35X based devices become stuck in high impedance
    mode, regardless of dip-switch or software configuration. This
    causes the device to become effectively unusable. This patch (in
    various forms) has been distributed to our customers and no issues
    related to it have been reported.
    
    Fixes: 7dea8165f1d6 ("serial: exar: Preconfigure xr17v35x MPIOs as output")
    Signed-off-by: Matthew Howell <matthew.howell at sealevel.com>
    Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
index ddb6aeb76dc5..04b9af7ed941 100644
--- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -326,7 +326,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)
 	 * devices will export them as GPIOs, so we pre-configure them safely
 	 * as inputs.
 	 */
-	u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00;
+
+	u8 dir = 0x00;
+
+	if  ((pcidev->vendor == PCI_VENDOR_ID_EXAR) &&
+		(pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) {
+		// Configure GPIO as inputs for Commtech adapters
+		dir = 0xff;
+	} else {
+		// Configure GPIO as outputs for SeaLevel adapters
+		dir = 0x00;
+	}
 
 	writeb(0x00, p + UART_EXAR_MPIOINT_7_0);
 	writeb(0x00, p + UART_EXAR_MPIOLVL_7_0);
commit 15fbc3b938534cc8eaac584a7b0c1183fc968b86
Author: Ben Skeggs <bskeggs at redhat.com>
Date:   Fri Jul 24 17:02:48 2020 +1000

    drm/nouveau/fbcon: zero-initialise the mode_cmd2 structure
    
    This is tripping up the format modifier patches.
    
    Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 843928ec059e..d5c23d1c20d8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -315,7 +315,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
 	struct drm_framebuffer *fb;
 	struct nouveau_channel *chan;
 	struct nouveau_bo *nvbo;
-	struct drm_mode_fb_cmd2 mode_cmd;
+	struct drm_mode_fb_cmd2 mode_cmd = {};
 	int ret;
 
 	mode_cmd.width = sizes->surface_width;
commit 498595abf5bd51f0ae074cec565d888778ea558f
Author: Ben Skeggs <bskeggs at redhat.com>
Date:   Fri Jul 24 17:01:39 2020 +1000

    drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason
    
    Stale pointer was tripping up the unload path.
    
    Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 3d11b84d4cf9..843928ec059e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -590,6 +590,7 @@ fini:
 	drm_fb_helper_fini(&fbcon->helper);
 free:
 	kfree(fbcon);
+	drm->fbcon = NULL;
 	return ret;
 }
 
commit 705d9d022949e3cdae82d89db6a8fc773eb23dad
Author: Ben Skeggs <bskeggs at redhat.com>
Date:   Thu Jul 23 20:10:42 2020 +1000

    drm/nouveau/kms/tu102: wait for core update to complete when assigning windows
    
    Fixes a race on Turing between the core cross-channel error checks and
    the following window update.
    
    Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index dc90d4f61b7f..800b7757252e 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -2073,7 +2073,7 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
 	 */
 	if (core->assign_windows) {
 		core->func->wndw.owner(core);
-		core->func->update(core, interlock, false);
+		nv50_disp_atomic_commit_core(state, interlock);
 		core->assign_windows = false;
 		interlock[NV50_DISP_INTERLOCK_CORE] = 0;
 	}
commit 0508831470fb5ba02485156cb8bea9aeda74248b
Author: Ben Skeggs <bskeggs at redhat.com>
Date:   Fri Jul 24 13:26:40 2020 +1000

    drm/nouveau/kms/gf100: use correct format modifiers
    
    The disp015x classes are used by both gt21x and gf1xx (aside from gf119), but page
    kinds differ between Tesla and Fermi.
    
    Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
index 519f99868e35..dc90d4f61b7f 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
@@ -2506,7 +2506,7 @@ nv50_display_create(struct drm_device *dev)
 	if (disp->disp->object.oclass >= TU102_DISP)
 		nouveau_display(dev)->format_modifiers = wndwc57e_modifiers;
 	else
-	if (disp->disp->object.oclass >= GF110_DISP)
+	if (drm->client.device.info.family >= NV_DEVICE_INFO_V0_FERMI)
 		nouveau_display(dev)->format_modifiers = disp90xx_modifiers;
 	else
 		nouveau_display(dev)->format_modifiers = disp50xx_modifiers;
commit 163d5446c37af92c85e6d58f87fe9840abac71ea
Author: Ben Skeggs <bskeggs at redhat.com>
Date:   Wed Jul 8 17:28:09 2020 +1000

    drm/nouveau/disp/gm200-: fix regression from HDA SOR selection changes
    
    Fixes: 9b5ca547bb8 ("drm/nouveau/disp/gm200-: detect and potentially disable HDA support on some SORs")
    Signed-off-by: Ben Skeggs <bskeggs at redhat.com>

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
index dcf08249374a..dffcac249211 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c
@@ -117,15 +117,6 @@ nvkm_outp_acquire_hda(struct nvkm_outp *outp, enum nvkm_ior_type type,
 {
 	struct nvkm_ior *ior;
 
-	/* First preference is to reuse the OR that is currently armed
-	 * on HW, if any, in order to prevent unnecessary switching.
-	 */
-	list_for_each_entry(ior, &outp->disp->ior, head) {
-		if (!ior->identity && !!ior->func->hda.hpd == hda &&
-		    !ior->asy.outp && ior->arm.outp == outp)
-			return nvkm_outp_acquire_ior(outp, user, ior);
-	}
-
 	/* Failing that, a completely unused OR is the next best thing. */
 	list_for_each_entry(ior, &outp->disp->ior, head) {
 		if (!ior->identity && !!ior->func->hda.hpd == hda &&
@@ -173,6 +164,27 @@ nvkm_outp_acquire(struct nvkm_outp *outp, u8 user, bool hda)
 		return nvkm_outp_acquire_ior(outp, user, ior);
 	}
 
+	/* First preference is to reuse the OR that is currently armed
+	 * on HW, if any, in order to prevent unnecessary switching.
+	 */
+	list_for_each_entry(ior, &outp->disp->ior, head) {
+		if (!ior->identity && !ior->asy.outp && ior->arm.outp == outp) {
+			/*XXX: For various complicated reasons, we can't outright switch
+			 *     the boot-time OR on the first modeset without some fairly
+			 *     invasive changes.
+			 *
+			 *     The systems that were fixed by modifying the OR selection
+			 *     code to account for HDA support shouldn't regress here as
+			 *     the HDA-enabled ORs match the relevant output's pad macro
+			 *     index, and the firmware seems to select an OR this way.
+			 *
+			 *     This warning is to make it obvious if that proves wrong.
+			 */
+			WARN_ON(hda && !ior->func->hda.hpd);
+			return nvkm_outp_acquire_ior(outp, user, ior);
+		}
+	}
+
 	/* If we don't need HDA, first try to acquire an OR that doesn't
 	 * support it to leave free the ones that do.
 	 */
commit 09781ba0395c46b1c844f47e405e3ce7856f5989
Author: Russell King <rmk+kernel at armlinux.org.uk>
Date:   Tue Jul 21 15:40:38 2020 +0100

    ARM: dts: armada-38x: fix NETA lockup when repeatedly switching speeds
    
    To support the change in "phy: armada-38x: fix NETA lockup when
    repeatedly switching speeds" we need to update the DT with the
    additional register.
    
    Fixes: 14dc100b4411 ("phy: armada38x: add common phy support")
    Signed-off-by: Russell King <rmk+kernel at armlinux.org.uk>
    Reviewed-by: Andrew Lunn <andrew at lunn.ch>
    Signed-off-by: Gregory CLEMENT <gregory.clement at bootlin.com>

diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 348116501aa2..9b1a24cc5e91 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -342,7 +342,8 @@
 
 			comphy: phy at 18300 {
 				compatible = "marvell,armada-380-comphy";
-				reg = <0x18300 0x100>;
+				reg-names = "comphy", "conf";
+				reg = <0x18300 0x100>, <0x18460 4>;
 				#address-cells = <1>;
 				#size-cells = <0>;
 
commit 8e8135862ccb5082347e2137b8a33edaf51427ce
Merge: 32818c075c54 8210e344ccb7
Author: David S. Miller <davem at davemloft.net>
Date:   Thu Jul 23 17:22:09 2020 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
    
    Pablo Neira Ayuso says:
    
    ====================
    Netfilter/IPVS fixes for net
    
    The following patchset contains Netfilter/IPVS fixes for net:
    
    1) Fix NAT hook deletion when table is dormant, from Florian Westphal.
    
    2) Fix IPVS sync stalls, from guodeqing.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 32818c075c54bb0cae44dd6f7ab00b01c52b8372
Author: Cong Wang <xiyou.wangcong at gmail.com>
Date:   Wed Jul 22 18:56:25 2020 -0700

    geneve: fix an uninitialized value in geneve_changelink()
    
    geneve_nl2info() sets 'df' conditionally, so we have to
    initialize it by copying the value from existing geneve
    device in geneve_changelink().
    
    Fixes: 56c09de347e4 ("geneve: allow changing DF behavior after creation")
    Reported-by: syzbot+7ebc2e088af5e4c0c9fa at syzkaller.appspotmail.com
    Cc: Sabrina Dubroca <sd at queasysnail.net>
    Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>
    Reviewed-by: Sabrina Dubroca <sd at queasysnail.net>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 4661ef865807..dec52b763d50 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1615,11 +1615,11 @@ static int geneve_changelink(struct net_device *dev, struct nlattr *tb[],
 			     struct netlink_ext_ack *extack)
 {
 	struct geneve_dev *geneve = netdev_priv(dev);
+	enum ifla_geneve_df df = geneve->df;
 	struct geneve_sock *gs4, *gs6;
 	struct ip_tunnel_info info;
 	bool metadata;
 	bool use_udp6_rx_checksums;
-	enum ifla_geneve_df df;
 	bool ttl_inherit;
 	int err;
 
commit c75d1d5248c0c97996051809ad0e9f154ba5d76e
Author: Cong Wang <xiyou.wangcong at gmail.com>
Date:   Wed Jul 22 16:31:54 2020 -0700

    bonding: check return value of register_netdevice() in bond_newlink()
    
    Very similar to commit 544f287b8495
    ("bonding: check error value of register_netdevice() immediately"),
    we should immediately check the return value of register_netdevice()
    before doing anything else.
    
    Fixes: 005db31d5f5f ("bonding: set carrier off for devices created through netlink")
    Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6 at syzkaller.appspotmail.com
    Cc: Beniamino Galvani <bgalvani at redhat.com>
    Cc: Taehee Yoo <ap420073 at gmail.com>
    Cc: Jay Vosburgh <j.vosburgh at gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index b43b51646b11..f0f9138e967f 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -456,11 +456,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
 		return err;
 
 	err = register_netdevice(bond_dev);
-
-	netif_carrier_off(bond_dev);
 	if (!err) {
 		struct bonding *bond = netdev_priv(bond_dev);
 
+		netif_carrier_off(bond_dev);
 		bond_work_init_all(bond);
 	}
 
commit 0e6705182d4e1b77248a93470d6d7b3013d59b30
Author: Steve French <stfrench at microsoft.com>
Date:   Thu Jul 23 14:41:29 2020 -0500

    Revert "cifs: Fix the target file was deleted when rename failed."
    
    This reverts commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2.
    
    Upon additional testing with older servers, it was found that
    the original commit introduced a regression when using the old SMB1
    dialect and rsyncing over an existing file.
    
    The patch will need to be respun to address this, likely including
    a larger refactoring of the SMB1 and SMB3 rename code paths to make
    it less confusing and also to address some additional rename error
    cases that SMB3 may be able to workaround.
    
    Signed-off-by: Steve French <stfrench at microsoft.com>
    Reported-by: Patrick Fernie <patrick.fernie at gmail.com>
    CC: Stable <stable at vger.kernel.org>
    Acked-by: Ronnie Sahlberg <lsahlber at redhat.com>
    Acked-by: Pavel Shilovsky <pshilov at microsoft.com>
    Acked-by: Zhang Xiaoxu <zhangxiaoxu5 at huawei.com>

diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 49c3ea8aa845..ce95801e9b66 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -2044,7 +2044,6 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	FILE_UNIX_BASIC_INFO *info_buf_target;
 	unsigned int xid;
 	int rc, tmprc;
-	bool new_target = d_really_is_negative(target_dentry);
 
 	if (flags & ~RENAME_NOREPLACE)
 		return -EINVAL;
@@ -2121,13 +2120,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry,
 	 */
 
 unlink_target:
-	/*
-	 * If the target dentry was created during the rename, try
-	 * unlinking it if it's not negative
-	 */
-	if (new_target &&
-	    d_really_is_positive(target_dentry) &&
-	    (rc == -EACCES || rc == -EEXIST)) {
+	/* Try unlinking the target dentry if it's not negative */
+	if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) {
 		if (d_is_dir(target_dentry))
 			tmprc = cifs_rmdir(target_dir, target_dentry);
 		else
commit f37e99aca03f63aa3f2bd13ceaf769455d12c4b0
Merge: d15be546031c 0cfa112b33ab
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Jul 23 13:42:46 2020 -0700

    Merge tag 's390-5.8-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into master
    
    Pull s390 fixes from Heiko Carstens:
    
     - Change cpum_cf/perf counter name from DFLT_CCERROR to DFLT_CCFINISH
       to reflect reality and avoid further confusion. This is a user space
       visible change therefore the commit has also a stable tag for 5.7,
       where this counter was introduced.
    
     - Add Matthew Rosato as s390 IOMMU maintainer.
    
    * tag 's390-5.8-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
      MAINTAINERS: add Matthew for s390 IOMMU
      s390/cpum_cf,perf: change DFLT_CCERROR counter name

commit 02b9aec59243c6240fc42884acc958602146ddf6
Author: Douglas Anderson <dianders at chromium.org>
Date:   Wed Jul 22 15:00:21 2020 -0700

    i2c: i2c-qcom-geni: Fix DMA transfer race
    
    When I have KASAN enabled on my kernel and I start stressing the
    touchscreen my system tends to hang.  The touchscreen is one of the
    only things that does a lot of big i2c transfers and ends up hitting
    the DMA paths in the geni i2c driver.  It appears that KASAN adds
    enough delay in my system to tickle a race condition in the DMA setup
    code.
    
    When the system hangs, I found that it was running the geni_i2c_irq()
    over and over again.  It had these:
    
    m_stat   = 0x04000080
    rx_st    = 0x30000011
    dm_tx_st = 0x00000000
    dm_rx_st = 0x00000000
    dma      = 0x00000001
    
    Notably we're in DMA mode but are getting M_RX_IRQ_EN and
    M_RX_FIFO_WATERMARK_EN over and over again.
    
    Putting some traces in geni_i2c_rx_one_msg() showed that when we
    failed we were getting to the start of geni_i2c_rx_one_msg() but were
    never executing geni_se_rx_dma_prep().
    
    I believe that the problem here is that we are starting the geni
    command before we run geni_se_rx_dma_prep().  If a transfer makes it
    far enough before we do that then we get into the state I have
    observed.  Let's change the order, which seems to work fine.
    
    Although problems were seen on the RX path, code inspection suggests
    that the TX should be changed too.  Change it as well.
    
    Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
    Signed-off-by: Douglas Anderson <dianders at chromium.org>
    Tested-by: Sai Prakash Ranjan <saiprakash.ranjan at codeaurora.org>
    Reviewed-by: Akash Asthana <akashast at codeaurora.org>
    Reviewed-by: Stephen Boyd <swboyd at chromium.org>
    Reviewed-by: Mukesh Kumar Savaliya <msavaliy at codeaurora.org>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
index 18d1e4fd4cf3..7f130829bf01 100644
--- a/drivers/i2c/busses/i2c-qcom-geni.c
+++ b/drivers/i2c/busses/i2c-qcom-geni.c
@@ -367,7 +367,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
-	geni_se_setup_m_cmd(se, I2C_READ, m_param);
 
 	if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -375,6 +374,8 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
+	geni_se_setup_m_cmd(se, I2C_READ, m_param);
+
 	time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
 	if (!time_left)
 		geni_i2c_abort_xfer(gi2c);
@@ -408,7 +409,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		geni_se_select_mode(se, GENI_SE_FIFO);
 
 	writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
-	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
 
 	if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
 		geni_se_select_mode(se, GENI_SE_FIFO);
@@ -416,6 +416,8 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
 		dma_buf = NULL;
 	}
 
+	geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
+
 	if (!dma_buf) /* Get FIFO IRQ */
 		writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
 
commit eb01597158ffb1853a7a7fc2c57d4c844640f75e
Author: Wolfram Sang <wsa+renesas at sang-engineering.com>
Date:   Sat Jul 4 15:38:29 2020 +0200

    i2c: rcar: always clear ICSAR to avoid side effects
    
    On R-Car Gen2, we get a timeout when reading from the address set in
    ICSAR, even though the slave interface is disabled. Clearing it fixes
    this situation. Note that Gen3 is not affected.
    
    To reproduce: bind and undbind an I2C slave on some bus, run
    'i2cdetect' on that bus.
    
    Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
    Signed-off-by: Wolfram Sang <wsa+renesas at sang-engineering.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index a45c4bf1ec01..2e3e1bb75013 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -868,6 +868,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 	/* disable irqs and ensure none is running before clearing ptr */
 	rcar_i2c_write(priv, ICSIER, 0);
 	rcar_i2c_write(priv, ICSCR, 0);
+	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
 
 	synchronize_irq(priv->irq);
 	priv->slave = NULL;
@@ -969,6 +970,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)
 	if (ret < 0)
 		goto out_pm_put;
 
+	rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
 	if (priv->devtype == I2C_RCAR_GEN3) {
 		priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
 		if (!IS_ERR(priv->rstc)) {
commit 76be93fc0702322179bb0ea87295d820ee46ad14
Author: Yuchung Cheng <ycheng at google.com>
Date:   Thu Jul 23 12:00:06 2020 -0700

    tcp: allow at most one TLP probe per flight
    
    Previously TLP may send multiple probes of new data in one
    flight. This happens when the sender is cwnd limited. After the
    initial TLP containing new data is sent, the sender receives another
    ACK that acks partial inflight.  It may re-arm another TLP timer
    to send more, if no further ACK returns before the next TLP timeout
    (PTO) expires. The sender may send in theory a large amount of TLP
    until send queue is depleted. This only happens if the sender sees
    such irregular uncommon ACK pattern. But it is generally undesirable
    behavior during congestion especially.
    
    The original TLP design restrict only one TLP probe per inflight as
    published in "Reducing Web Latency: the Virtue of Gentle Aggression",
    SIGCOMM 2013. This patch changes TLP to send at most one probe
    per inflight.
    
    Note that if the sender is app-limited, TLP retransmits old data
    and did not have this issue.
    
    Signed-off-by: Yuchung Cheng <ycheng at google.com>
    Signed-off-by: Neal Cardwell <ncardwell at google.com>
    Signed-off-by: Eric Dumazet <edumazet at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 9aac824c523c..a1bbaa1c1a3a 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -220,7 +220,9 @@ struct tcp_sock {
 	} rack;
 	u16	advmss;		/* Advertised MSS			*/
 	u8	compressed_ack;
-	u8	dup_ack_counter;
+	u8	dup_ack_counter:2,
+		tlp_retrans:1,	/* TLP is a retransmission */
+		unused:5;
 	u32	chrono_start;	/* Start time in jiffies of a TCP chrono */
 	u32	chrono_stat[3];	/* Time in jiffies for chrono_stat stats */
 	u8	chrono_type:2,	/* current chronograph type */
@@ -243,7 +245,7 @@ struct tcp_sock {
 		save_syn:1,	/* Save headers of SYN packet */
 		is_cwnd_limited:1,/* forward progress limited by snd_cwnd? */
 		syn_smc:1;	/* SYN includes SMC */
-	u32	tlp_high_seq;	/* snd_nxt at the time of TLP retransmit. */
+	u32	tlp_high_seq;	/* snd_nxt at the time of TLP */
 
 	u32	tcp_tx_delay;	/* delay (in usec) added to TX packets */
 	u64	tcp_wstamp_ns;	/* departure time for next sent data packet */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9615e72656d1..518f04355fbf 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3488,10 +3488,8 @@ static void tcp_replace_ts_recent(struct tcp_sock *tp, u32 seq)
 	}
 }
 
-/* This routine deals with acks during a TLP episode.
- * We mark the end of a TLP episode on receiving TLP dupack or when
- * ack is after tlp_high_seq.
- * Ref: loss detection algorithm in draft-dukkipati-tcpm-tcp-loss-probe.
+/* This routine deals with acks during a TLP episode and ends an episode by
+ * resetting tlp_high_seq. Ref: TLP algorithm in draft-ietf-tcpm-rack
  */
 static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
 {
@@ -3500,7 +3498,10 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
 	if (before(ack, tp->tlp_high_seq))
 		return;
 
-	if (flag & FLAG_DSACKING_ACK) {
+	if (!tp->tlp_retrans) {
+		/* TLP of new data has been acknowledged */
+		tp->tlp_high_seq = 0;
+	} else if (flag & FLAG_DSACKING_ACK) {
 		/* This DSACK means original and TLP probe arrived; no loss */
 		tp->tlp_high_seq = 0;
 	} else if (after(ack, tp->tlp_high_seq)) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5f5b2f0b0e60..0bc05d68cd74 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2624,6 +2624,11 @@ void tcp_send_loss_probe(struct sock *sk)
 	int pcount;
 	int mss = tcp_current_mss(sk);
 
+	/* At most one outstanding TLP */
+	if (tp->tlp_high_seq)
+		goto rearm_timer;
+
+	tp->tlp_retrans = 0;
 	skb = tcp_send_head(sk);
 	if (skb && tcp_snd_wnd_test(tp, skb, mss)) {
 		pcount = tp->packets_out;
@@ -2641,10 +2646,6 @@ void tcp_send_loss_probe(struct sock *sk)
 		return;
 	}
 
-	/* At most one outstanding TLP retransmission. */
-	if (tp->tlp_high_seq)
-		goto rearm_timer;
-
 	if (skb_still_in_host_queue(sk, skb))
 		goto rearm_timer;
 
@@ -2666,10 +2667,12 @@ void tcp_send_loss_probe(struct sock *sk)
 	if (__tcp_retransmit_skb(sk, skb, 1))
 		goto rearm_timer;
 
+	tp->tlp_retrans = 1;
+
+probe_sent:
 	/* Record snd_nxt for loss detection. */
 	tp->tlp_high_seq = tp->snd_nxt;
 
-probe_sent:
 	NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPLOSSPROBES);
 	/* Reset s.t. tcp_rearm_rto will restart timer from now */
 	inet_csk(sk)->icsk_pending = 0;
commit 17ad73e941b71f3bec7523ea4e9cbc3752461c2d
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date:   Thu Jul 23 17:49:57 2020 +0300

    AX.25: Prevent integer overflows in connect and sendmsg
    
    We recently added some bounds checking in ax25_connect() and
    ax25_sendmsg() and we so we removed the AX25_MAX_DIGIS checks because
    they were no longer required.
    
    Unfortunately, I believe they are required to prevent integer overflows
    so I have added them back.
    
    Fixes: 8885bb0621f0 ("AX.25: Prevent out-of-bounds read in ax25_sendmsg()")
    Fixes: 2f2a7ffad5c6 ("AX.25: Fix out-of-bounds read in ax25_connect()")
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 0862fe49d434..dec3f35467c9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1188,6 +1188,7 @@ static int __must_check ax25_connect(struct socket *sock,
 	    fsa->fsa_ax25.sax25_ndigis != 0) {
 		/* Valid number of digipeaters ? */
 		if (fsa->fsa_ax25.sax25_ndigis < 1 ||
+		    fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS ||
 		    addr_len < sizeof(struct sockaddr_ax25) +
 		    sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
 			err = -EINVAL;
@@ -1509,7 +1510,9 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
 
 			/* Valid number of digipeaters ? */
-			if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) +
+			if (usax->sax25_ndigis < 1 ||
+			    usax->sax25_ndigis > AX25_MAX_DIGIS ||
+			    addr_len < sizeof(struct sockaddr_ax25) +
 			    sizeof(ax25_address) * usax->sax25_ndigis) {
 				err = -EINVAL;
 				goto out;
commit 5df96f2b9f58a5d2dc1f30fe7de75e197f2c25f2
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Thu Jul 23 10:42:09 2020 -0400

    dm integrity: fix integrity recalculation that is improperly skipped
    
    Commit adc0daad366b62ca1bce3e2958a40b0b71a8b8b3 ("dm: report suspended
    device during destroy") broke integrity recalculation.
    
    The problem is dm_suspended() returns true not only during suspend,
    but also during resume. So this race condition could occur:
    1. dm_integrity_resume calls queue_work(ic->recalc_wq, &ic->recalc_work)
    2. integrity_recalc (&ic->recalc_work) preempts the current thread
    3. integrity_recalc calls if (unlikely(dm_suspended(ic->ti))) goto unlock_ret;
    4. integrity_recalc exits and no recalculating is done.
    
    To fix this race condition, add a function dm_post_suspending that is
    only true during the postsuspend phase and use it instead of
    dm_suspended().
    
    Signed-off-by: Mikulas Patocka <mpatocka redhat com>
    Fixes: adc0daad366b ("dm: report suspended device during destroy")
    Cc: stable vger kernel org # v4.18+
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 81dc5ff08909..a83a1de1e03f 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2420,7 +2420,7 @@ static void integrity_writer(struct work_struct *w)
 	unsigned prev_free_sectors;
 
 	/* the following test is not needed, but it tests the replay code */
-	if (unlikely(dm_suspended(ic->ti)) && !ic->meta_dev)
+	if (unlikely(dm_post_suspending(ic->ti)) && !ic->meta_dev)
 		return;
 
 	spin_lock_irq(&ic->endio_wait.lock);
@@ -2481,7 +2481,7 @@ static void integrity_recalc(struct work_struct *w)
 
 next_chunk:
 
-	if (unlikely(dm_suspended(ic->ti)))
+	if (unlikely(dm_post_suspending(ic->ti)))
 		goto unlock_ret;
 
 	range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 52449afd58eb..5b9de2f71bb0 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -143,6 +143,7 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_nr);
 #define DMF_NOFLUSH_SUSPENDING 5
 #define DMF_DEFERRED_REMOVE 6
 #define DMF_SUSPENDED_INTERNALLY 7
+#define DMF_POST_SUSPENDING 8
 
 #define DM_NUMA_NODE NUMA_NO_NODE
 static int dm_numa_node = DM_NUMA_NODE;
@@ -2408,6 +2409,7 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
 	if (!dm_suspended_md(md)) {
 		dm_table_presuspend_targets(map);
 		set_bit(DMF_SUSPENDED, &md->flags);
+		set_bit(DMF_POST_SUSPENDING, &md->flags);
 		dm_table_postsuspend_targets(map);
 	}
 	/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
@@ -2766,7 +2768,9 @@ retry:
 	if (r)
 		goto out_unlock;
 
+	set_bit(DMF_POST_SUSPENDING, &md->flags);
 	dm_table_postsuspend_targets(map);
+	clear_bit(DMF_POST_SUSPENDING, &md->flags);
 
 out_unlock:
 	mutex_unlock(&md->suspend_lock);
@@ -2863,7 +2867,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
 	(void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE,
 			    DMF_SUSPENDED_INTERNALLY);
 
+	set_bit(DMF_POST_SUSPENDING, &md->flags);
 	dm_table_postsuspend_targets(map);
+	clear_bit(DMF_POST_SUSPENDING, &md->flags);
 }
 
 static void __dm_internal_resume(struct mapped_device *md)
@@ -3024,6 +3030,11 @@ int dm_suspended_md(struct mapped_device *md)
 	return test_bit(DMF_SUSPENDED, &md->flags);
 }
 
+static int dm_post_suspending_md(struct mapped_device *md)
+{
+	return test_bit(DMF_POST_SUSPENDING, &md->flags);
+}
+
 int dm_suspended_internally_md(struct mapped_device *md)
 {
 	return test_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
@@ -3040,6 +3051,12 @@ int dm_suspended(struct dm_target *ti)
 }
 EXPORT_SYMBOL_GPL(dm_suspended);
 
+int dm_post_suspending(struct dm_target *ti)
+{
+	return dm_post_suspending_md(dm_table_get_md(ti->table));
+}
+EXPORT_SYMBOL_GPL(dm_post_suspending);
+
 int dm_noflush_suspending(struct dm_target *ti)
 {
 	return __noflush_suspending(dm_table_get_md(ti->table));
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 8750f2dc5613..73dec4b5d5be 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -426,6 +426,7 @@ const char *dm_device_name(struct mapped_device *md);
 int dm_copy_name_and_uuid(struct mapped_device *md, char *name, char *uuid);
 struct gendisk *dm_disk(struct mapped_device *md);
 int dm_suspended(struct dm_target *ti);
+int dm_post_suspending(struct dm_target *ti);
 int dm_noflush_suspending(struct dm_target *ti);
 void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors);
 union map_info *dm_get_rq_mapinfo(struct request *rq);
commit 3e863ea3bb1a2203ae648eb272db0ce6a1a2072c
Author: Pavel Begunkov <asml.silence at gmail.com>
Date:   Thu Jul 23 20:17:20 2020 +0300

    io_uring: missed req_init_async() for IOSQE_ASYNC
    
    IOSQE_ASYNC branch of io_queue_sqe() is another place where an
    unitialised req->work can be accessed (i.e. prior io_req_init_async()).
    Nothing really bad though, it just looses IO_WQ_WORK_CONCURRENT flag.
    
    Signed-off-by: Pavel Begunkov <asml.silence at gmail.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index d99802ac166f..32b0064f806e 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5730,6 +5730,7 @@ fail_req:
 		 * Never try inline submit of IOSQE_ASYNC is set, go straight
 		 * to async execution.
 		 */
+		io_req_init_async(req);
 		req->work.flags |= IO_WQ_WORK_CONCURRENT;
 		io_queue_async_work(req);
 	} else {
commit 29c4a54bc645c8b6745eeb58519e9ad794ceb419
Author: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
Date:   Thu Jul 16 21:27:47 2020 +0300

    device property: Avoid NULL pointer dereference in device_get_next_child_node()
    
    When we have no primary fwnode or when it's a software node, we may end up
    in the situation when fwnode is a NULL pointer. There is no point to look for
    secondary fwnode in such case. Add a necessary check to a condition.
    
    Fixes: 114dbb4fa7c4 ("drivers property: When no children in primary, try secondary")
    Reported-by: Maxim Levitsky <mlevitsk at redhat.com>
    Signed-off-by: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
    Tested-by: Maxim Levitsky <mlevitsk at redhat.com>
    Link: https://lore.kernel.org/r/20200716182747.54929-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/base/property.c b/drivers/base/property.c
index 1e6d75e65938..d58aa98fe964 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -721,7 +721,7 @@ struct fwnode_handle *device_get_next_child_node(struct device *dev,
 		return next;
 
 	/* When no more children in primary, continue with secondary */
-	if (!IS_ERR_OR_NULL(fwnode->secondary))
+	if (fwnode && !IS_ERR_OR_NULL(fwnode->secondary))
 		next = fwnode_get_next_child_node(fwnode->secondary, child);
 
 	return next;
commit 033724d6864245a11f8e04c066002e6ad22b3fd0
Author: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
Date:   Wed Jul 15 10:51:02 2020 +0900

    fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
    
    syzbot is reporting general protection fault in bitfill_aligned() [1]
    caused by integer underflow in bit_clear_margins(). The cause of this
    problem is when and how do_vc_resize() updates vc->vc_{cols,rows}.
    
    If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres
    is going to shrink, vc->vc_{cols,rows} will not be updated. This allows
    bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or
    info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will
    try to overrun the __iomem region and causes general protection fault.
    
    Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to
    
      new_cols = (cols ? cols : vc->vc_cols);
      new_rows = (lines ? lines : vc->vc_rows);
    
    exception. Since cols and lines are calculated as
    
      cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
      rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
      cols /= vc->vc_font.width;
      rows /= vc->vc_font.height;
      vc_resize(vc, cols, rows);
    
    in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0
    and var.yres < vc->vc_font.height makes rows = 0. This means that
    
      const int fd = open("/dev/fb0", O_ACCMODE);
      struct fb_var_screeninfo var = { };
      ioctl(fd, FBIOGET_VSCREENINFO, &var);
      var.xres = var.yres = 1;
      ioctl(fd, FBIOPUT_VSCREENINFO, &var);
    
    easily reproduces integer underflow bug explained above.
    
    Of course, callers of vc_resize() are not handling vc_do_resize() failure
    is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore,
    as a band-aid workaround, this patch checks integer underflow in
    "struct fbcon_ops"->clear_margins call, assuming that
    vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not
    cause integer overflow.
    
    [1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6
    
    Reported-and-tested-by: syzbot <syzbot+e5fd3e65515b48c02a30 at syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
    Acked-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Cc: stable <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index ca935c09a261..35ebeeccde4d 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = color;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = info->var.xoffset + rs;
 		region.dy = 0;
 		region.width = rw;
@@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset;
 		region.dy = info->var.yoffset + bs;
 		region.width = rs;
diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c
index dfa9a8aa4509..78f3a5621478 100644
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = color;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = 0;
 		region.dy = info->var.yoffset;
 		region.height = rw;
@@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset + bs;
 		region.dy = 0;
                 region.height = info->var.yres_virtual;
diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c
index ce08251bfd38..fd098ff17574 100644
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = color;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dx = 0;
 		region.dy = info->var.yoffset + rs;
 		region.height = rw;
@@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dx = info->var.xoffset;
 		region.dy = info->var.yoffset;
                 region.height = info->var.yres;
diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c
index 1936afc78fec..e165a3fad29a 100644
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
 	region.color = color;
 	region.rop = ROP_COPY;
 
-	if (rw && !bottom_only) {
+	if ((int) rw > 0 && !bottom_only) {
 		region.dy = 0;
 		region.dx = info->var.xoffset;
 		region.width  = rw;
@@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
 		info->fbops->fb_fillrect(info, &region);
 	}
 
-	if (bh) {
+	if ((int) bh > 0) {
 		region.dy = info->var.yoffset;
 		region.dx = info->var.xoffset;
                 region.height  = bh;
commit 0b987032f8b58ef51cc8a042f46cc0cf1f277172
Author: Jon Hunter <jonathanh at nvidia.com>
Date:   Wed Jul 15 12:38:42 2020 +0100

    usb: tegra: Fix allocation for the FPCI context
    
    Commit 5c4e8d3781bc ("usb: host: xhci-tegra: Add support for XUSB
    context save/restore") is using the IPFS 'num_offsets' value when
    allocating memory for FPCI context instead of the FPCI 'num_offsets'.
    
    After commit cad064f1bd52 ("devres: handle zero size in devm_kmalloc()")
    was added system suspend started failing on Tegra186. The kernel log
    showed that the Tegra XHCI driver was crashing on entry to suspend when
    attempting the save the USB context. On Tegra186, the IPFS context has a
    zero length but the FPCI content has a non-zero length, and because of
    the bug in the Tegra XHCI driver we are incorrectly allocating a zero
    length array for the FPCI context. The crash seen on entering suspend
    when we attempt to save the FPCI context and following commit
    cad064f1bd52 ("devres: handle zero size in devm_kmalloc()") this now
    causes a NULL pointer deference when we access the memory. Fix this by
    correcting the amount of memory we are allocating for FPCI contexts.
    
    Cc: stable at vger.kernel.org
    
    Fixes: 5c4e8d3781bc ("usb: host: xhci-tegra: Add support for XUSB context save/restore")
    
    Signed-off-by: Jon Hunter <jonathanh at nvidia.com>
    Acked-by: Thierry Reding <treding at nvidia.com>
    Link: https://lore.kernel.org/r/20200715113842.30680-1-jonathanh@nvidia.com
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index 2eaf5c0af80c..ee6bf01775bb 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -856,7 +856,7 @@ static int tegra_xusb_init_context(struct tegra_xusb *tegra)
 	if (!tegra->context.ipfs)
 		return -ENOMEM;
 
-	tegra->context.fpci = devm_kcalloc(tegra->dev, soc->ipfs.num_offsets,
+	tegra->context.fpci = devm_kcalloc(tegra->dev, soc->fpci.num_offsets,
 					   sizeof(u32), GFP_KERNEL);
 	if (!tegra->context.fpci)
 		return -ENOMEM;
commit 7b7891c7bdfd61fc9ed6747a0a05efe2394dddc6
Author: Nathan Chancellor <natechancellor at gmail.com>
Date:   Wed Jul 22 21:15:10 2020 -0700

    arm64: vdso32: Fix '--prefix=' value for newer versions of clang
    
    Newer versions of clang only look for $(COMPAT_GCC_TOOLCHAIN_DIR)as [1],
    rather than $(COMPAT_GCC_TOOLCHAIN_DIR)$(CROSS_COMPILE_COMPAT)as,
    resulting in the following build error:
    
    $ make -skj"$(nproc)" ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- \
    CROSS_COMPILE_COMPAT=arm-linux-gnueabi- LLVM=1 O=out/aarch64 distclean \
    defconfig arch/arm64/kernel/vdso32/
    ...
    /home/nathan/cbl/toolchains/llvm-binutils/bin/as: unrecognized option '-EL'
    clang-12: error: assembler command failed with exit code 1 (use -v to see invocation)
    make[3]: *** [arch/arm64/kernel/vdso32/Makefile:181: arch/arm64/kernel/vdso32/note.o] Error 1
    ...
    
    Adding the value of CROSS_COMPILE_COMPAT (adding notdir to account for a
    full path for CROSS_COMPILE_COMPAT) fixes this issue, which matches the
    solution done for the main Makefile [2].
    
    [1]: https://github.com/llvm/llvm-project/commit/3452a0d8c17f7166f479706b293caf6ac76ffd90
    [2]: https://lore.kernel.org/lkml/20200721173125.1273884-1-maskray@google.com/
    
    Signed-off-by: Nathan Chancellor <natechancellor at gmail.com>
    Cc: stable at vger.kernel.org
    Link: https://github.com/ClangBuiltLinux/linux/issues/1099
    Link: https://lore.kernel.org/r/20200723041509.400450-1-natechancellor@gmail.com
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile
index d88148bef6b0..5139a5f19256 100644
--- a/arch/arm64/kernel/vdso32/Makefile
+++ b/arch/arm64/kernel/vdso32/Makefile
@@ -14,7 +14,7 @@ COMPAT_GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE_COMPAT)elfedit))
 COMPAT_GCC_TOOLCHAIN := $(realpath $(COMPAT_GCC_TOOLCHAIN_DIR)/..)
 
 CC_COMPAT_CLANG_FLAGS := --target=$(notdir $(CROSS_COMPILE_COMPAT:%-=%))
-CC_COMPAT_CLANG_FLAGS += --prefix=$(COMPAT_GCC_TOOLCHAIN_DIR)
+CC_COMPAT_CLANG_FLAGS += --prefix=$(COMPAT_GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE_COMPAT))
 CC_COMPAT_CLANG_FLAGS += -no-integrated-as -Qunused-arguments
 ifneq ($(COMPAT_GCC_TOOLCHAIN),)
 CC_COMPAT_CLANG_FLAGS += --gcc-toolchain=$(COMPAT_GCC_TOOLCHAIN)
commit 92d232d176041db5b033dd7b7f7f2cf343f82237
Author: Georgi Djakov <georgi.djakov at linaro.org>
Date:   Thu Jul 23 11:37:35 2020 +0300

    interconnect: msm8916: Fix buswidth of pcnoc_s nodes
    
    The buswidth of the pcnoc_s_* nodes is actually not 8, but
    4 bytes. Let's fix it.
    
    Reported-by: Jun Nie <jun.nie at linaro.org>
    Reviewed-by: Mike Tipton <mdtipton at codeaurora.org>
    Fixes: 30c8fa3ec61a ("interconnect: qcom: Add MSM8916 interconnect provider driver")
    Link: https://lore.kernel.org/r/20200709130004.12462-1-georgi.djakov@linaro.org
    Signed-off-by: Georgi Djakov <georgi.djakov at linaro.org>
    Cc: stable <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200723083735.5616-3-georgi.djakov@linaro.org
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/interconnect/qcom/msm8916.c b/drivers/interconnect/qcom/msm8916.c
index e94f3c5228b7..42c6c5581662 100644
--- a/drivers/interconnect/qcom/msm8916.c
+++ b/drivers/interconnect/qcom/msm8916.c
@@ -197,13 +197,13 @@ DEFINE_QNODE(pcnoc_int_0, MSM8916_PNOC_INT_0, 8, -1, -1, MSM8916_PNOC_SNOC_MAS,
 DEFINE_QNODE(pcnoc_int_1, MSM8916_PNOC_INT_1, 8, -1, -1, MSM8916_PNOC_SNOC_MAS);
 DEFINE_QNODE(pcnoc_m_0, MSM8916_PNOC_MAS_0, 8, -1, -1, MSM8916_PNOC_INT_0);
 DEFINE_QNODE(pcnoc_m_1, MSM8916_PNOC_MAS_1, 8, -1, -1, MSM8916_PNOC_SNOC_MAS);
-DEFINE_QNODE(pcnoc_s_0, MSM8916_PNOC_SLV_0, 8, -1, -1, MSM8916_SLAVE_CLK_CTL, MSM8916_SLAVE_TLMM, MSM8916_SLAVE_TCSR, MSM8916_SLAVE_SECURITY, MSM8916_SLAVE_MSS);
-DEFINE_QNODE(pcnoc_s_1, MSM8916_PNOC_SLV_1, 8, -1, -1, MSM8916_SLAVE_IMEM_CFG, MSM8916_SLAVE_CRYPTO_0_CFG, MSM8916_SLAVE_MSG_RAM, MSM8916_SLAVE_PDM, MSM8916_SLAVE_PRNG);
-DEFINE_QNODE(pcnoc_s_2, MSM8916_PNOC_SLV_2, 8, -1, -1, MSM8916_SLAVE_SPDM, MSM8916_SLAVE_BOOT_ROM, MSM8916_SLAVE_BIMC_CFG, MSM8916_SLAVE_PNOC_CFG, MSM8916_SLAVE_PMIC_ARB);
-DEFINE_QNODE(pcnoc_s_3, MSM8916_PNOC_SLV_3, 8, -1, -1, MSM8916_SLAVE_MPM, MSM8916_SLAVE_SNOC_CFG, MSM8916_SLAVE_RBCPR_CFG, MSM8916_SLAVE_QDSS_CFG, MSM8916_SLAVE_DEHR_CFG);
-DEFINE_QNODE(pcnoc_s_4, MSM8916_PNOC_SLV_4, 8, -1, -1, MSM8916_SLAVE_VENUS_CFG, MSM8916_SLAVE_CAMERA_CFG, MSM8916_SLAVE_DISPLAY_CFG);
-DEFINE_QNODE(pcnoc_s_8, MSM8916_PNOC_SLV_8, 8, -1, -1, MSM8916_SLAVE_USB_HS, MSM8916_SLAVE_SDCC_1, MSM8916_SLAVE_BLSP_1);
-DEFINE_QNODE(pcnoc_s_9, MSM8916_PNOC_SLV_9, 8, -1, -1, MSM8916_SLAVE_SDCC_2, MSM8916_SLAVE_LPASS, MSM8916_SLAVE_GRAPHICS_3D_CFG);
+DEFINE_QNODE(pcnoc_s_0, MSM8916_PNOC_SLV_0, 4, -1, -1, MSM8916_SLAVE_CLK_CTL, MSM8916_SLAVE_TLMM, MSM8916_SLAVE_TCSR, MSM8916_SLAVE_SECURITY, MSM8916_SLAVE_MSS);
+DEFINE_QNODE(pcnoc_s_1, MSM8916_PNOC_SLV_1, 4, -1, -1, MSM8916_SLAVE_IMEM_CFG, MSM8916_SLAVE_CRYPTO_0_CFG, MSM8916_SLAVE_MSG_RAM, MSM8916_SLAVE_PDM, MSM8916_SLAVE_PRNG);
+DEFINE_QNODE(pcnoc_s_2, MSM8916_PNOC_SLV_2, 4, -1, -1, MSM8916_SLAVE_SPDM, MSM8916_SLAVE_BOOT_ROM, MSM8916_SLAVE_BIMC_CFG, MSM8916_SLAVE_PNOC_CFG, MSM8916_SLAVE_PMIC_ARB);
+DEFINE_QNODE(pcnoc_s_3, MSM8916_PNOC_SLV_3, 4, -1, -1, MSM8916_SLAVE_MPM, MSM8916_SLAVE_SNOC_CFG, MSM8916_SLAVE_RBCPR_CFG, MSM8916_SLAVE_QDSS_CFG, MSM8916_SLAVE_DEHR_CFG);
+DEFINE_QNODE(pcnoc_s_4, MSM8916_PNOC_SLV_4, 4, -1, -1, MSM8916_SLAVE_VENUS_CFG, MSM8916_SLAVE_CAMERA_CFG, MSM8916_SLAVE_DISPLAY_CFG);
+DEFINE_QNODE(pcnoc_s_8, MSM8916_PNOC_SLV_8, 4, -1, -1, MSM8916_SLAVE_USB_HS, MSM8916_SLAVE_SDCC_1, MSM8916_SLAVE_BLSP_1);
+DEFINE_QNODE(pcnoc_s_9, MSM8916_PNOC_SLV_9, 4, -1, -1, MSM8916_SLAVE_SDCC_2, MSM8916_SLAVE_LPASS, MSM8916_SLAVE_GRAPHICS_3D_CFG);
 DEFINE_QNODE(pcnoc_snoc_mas, MSM8916_PNOC_SNOC_MAS, 8, 29, -1, MSM8916_PNOC_SNOC_SLV);
 DEFINE_QNODE(pcnoc_snoc_slv, MSM8916_PNOC_SNOC_SLV, 8, -1, 45, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC, MSM8916_SNOC_INT_1);
 DEFINE_QNODE(qdss_int, MSM8916_SNOC_QDSS_INT, 8, -1, -1, MSM8916_SNOC_INT_0, MSM8916_SNOC_INT_BIMC);
commit 91b44981a2316e7b00574d32dec4fae356444dcf
Author: Georgi Djakov <georgi.djakov at linaro.org>
Date:   Thu Jul 23 11:37:34 2020 +0300

    interconnect: Do not skip aggregation for disabled paths
    
    When an interconnect path is being disabled, currently we don't aggregate
    the requests for it afterwards. But the re-aggregation step shouldn't be
    skipped, as it may leave the nodes with outdated bandwidth data. This
    outdated data may actually keep the path still enabled and prevent the
    device from going into lower power states.
    
    Reported-by: Atul Dhudase <adhudase at codeaurora.org>
    Fixes: 7d374b209083 ("interconnect: Add helpers for enabling/disabling a path")
    Reviewed-by: Sibi Sankar <sibis at codeaurora.org>
    Tested-by: Atul Dhudase <adhudase at codeaurora.org>
    Reviewed-by: Atul Dhudase <adhudase at codeaurora.org>
    Link: https://lore.kernel.org/r/20200721120740.3436-1-georgi.djakov@linaro.org
    Signed-off-by: Georgi Djakov <georgi.djakov at linaro.org>
    Link: https://lore.kernel.org/r/20200723083735.5616-2-georgi.djakov@linaro.org
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
index e5f998744501..9e1ab701785c 100644
--- a/drivers/interconnect/core.c
+++ b/drivers/interconnect/core.c
@@ -243,6 +243,7 @@ static int aggregate_requests(struct icc_node *node)
 {
 	struct icc_provider *p = node->provider;
 	struct icc_req *r;
+	u32 avg_bw, peak_bw;
 
 	node->avg_bw = 0;
 	node->peak_bw = 0;
@@ -251,9 +252,14 @@ static int aggregate_requests(struct icc_node *node)
 		p->pre_aggregate(node);
 
 	hlist_for_each_entry(r, &node->req_list, req_node) {
-		if (!r->enabled)
-			continue;
-		p->aggregate(node, r->tag, r->avg_bw, r->peak_bw,
+		if (r->enabled) {
+			avg_bw = r->avg_bw;
+			peak_bw = r->peak_bw;
+		} else {
+			avg_bw = 0;
+			peak_bw = 0;
+		}
+		p->aggregate(node, r->tag, avg_bw, peak_bw,
 			     &node->avg_bw, &node->peak_bw);
 	}
 
commit b34e7e298d7a5ed76b3aa327c240c29f1ef6dd22
Author: Eric Biggers <ebiggers at google.com>
Date:   Wed Jul 15 23:05:53 2020 -0700

    /dev/mem: Add missing memory barriers for devmem_inode
    
    WRITE_ONCE() isn't the correct way to publish a pointer to a data
    structure, since it doesn't include a write memory barrier.  Therefore
    other tasks may see that the pointer has been set but not see that the
    pointed-to memory has finished being initialized yet.  Instead a
    primitive with "release" semantics is needed.
    
    Use smp_store_release() for this.
    
    The use of READ_ONCE() on the read side is still potentially correct if
    there's no control dependency, i.e. if all memory being "published" is
    transitively reachable via the pointer itself.  But this pairing is
    somewhat confusing and error-prone.  So just upgrade the read side to
    smp_load_acquire() so that it clearly pairs with smp_store_release().
    
    Cc: Arnd Bergmann <arnd at arndb.de>
    Cc: Ingo Molnar <mingo at redhat.com>
    Cc: Kees Cook <keescook at chromium.org>
    Cc: Matthew Wilcox <willy at infradead.org>
    Cc: Russell King <linux at arm.linux.org.uk>
    Cc: Andrew Morton <akpm at linux-foundation.org>
    Fixes: 3234ac664a87 ("/dev/mem: Revoke mappings when a driver claims the region")
    Signed-off-by: Eric Biggers <ebiggers at google.com>
    Cc: stable <stable at vger.kernel.org>
    Acked-by: Dan Williams <dan.j.williams at intel.com>
    Link: https://lore.kernel.org/r/20200716060553.24618-1-ebiggers@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 934c92dcb9ab..687d4af6945d 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -814,7 +814,8 @@ static struct inode *devmem_inode;
 #ifdef CONFIG_IO_STRICT_DEVMEM
 void revoke_devmem(struct resource *res)
 {
-	struct inode *inode = READ_ONCE(devmem_inode);
+	/* pairs with smp_store_release() in devmem_init_inode() */
+	struct inode *inode = smp_load_acquire(&devmem_inode);
 
 	/*
 	 * Check that the initialization has completed. Losing the race
@@ -1028,8 +1029,11 @@ static int devmem_init_inode(void)
 		return rc;
 	}
 
-	/* publish /dev/mem initialized */
-	WRITE_ONCE(devmem_inode, inode);
+	/*
+	 * Publish /dev/mem initialized.
+	 * Pairs with smp_load_acquire() in revoke_devmem().
+	 */
+	smp_store_release(&devmem_inode, inode);
 
 	return 0;
 }
commit f867c771f98891841c217fa8459244ed0dd28921
Author: Tetsuo Handa <penguin-kernel at i-love.sakura.ne.jp>
Date:   Fri Jul 17 00:12:15 2020 +0900

    binder: Don't use mmput() from shrinker function.
    
    syzbot is reporting that mmput() from shrinker function has a risk of
    deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls
    kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and
    uprobe_clear_state() from __mmput() also holds delayed_uprobe_lock.
    
    Commit a1b2289cef92ef0e ("android: binder: drop lru lock in isolate
    callback") replaced mmput() with mmput_async() in order to avoid sleeping
    with spinlock held. But this patch replaces mmput() with mmput_async() in
    order not to start __mmput() from shrinker context.
    
    [1] https://syzkaller.appspot.com/bug?id=bc9e7303f537c41b2b0cc2dfcea3fc42964c2d45
    
    Reported-by: syzbot <syzbot+1068f09c44d151250c33 at syzkaller.appspotmail.com>
    Reported-by: syzbot <syzbot+e5344baa319c9a96edec at syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
    Reviewed-by: Michal Hocko <mhocko at suse.com>
    Acked-by: Todd Kjos <tkjos at google.com>
    Acked-by: Christian Brauner <christian.brauner at ubuntu.com>
    Cc: stable <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/4ba9adb2-43f5-2de0-22de-f6075c1fab50@i-love.sakura.ne.jp
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 42c672f1584e..cbe6aa77d50d 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -947,7 +947,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
 		trace_binder_unmap_user_end(alloc, index);
 	}
 	mmap_read_unlock(mm);
-	mmput(mm);
+	mmput_async(mm);
 
 	trace_binder_unmap_kernel_start(alloc, index);
 
commit d8904ca9d338cdaa67e3bd06d7a7d418e426648c
Merge: 26a2be0789a7 38e0c89a19fd
Author: Dave Airlie <airlied at redhat.com>
Date:   Thu Jul 23 14:06:14 2020 +1000

    Merge tag 'amd-drm-fixes-5.8-2020-07-22' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
    
    amd-drm-fixes-5.8-2020-07-22:
    
    amdgpu:
    - Fix crash when overclocking VegaM
    - Fix possible crash when editing dpm levels
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: Alex Deucher <alexdeucher at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200723032608.3865-1-alexander.deucher@amd.com

commit 26a2be0789a7c0d1c6d7d86d9ed8d25e2efd94a8
Merge: ba47d845d715 f3f90c6db188
Author: Dave Airlie <airlied at redhat.com>
Date:   Thu Jul 23 14:05:28 2020 +1000

    Merge tag 'drm-misc-fixes-2020-07-22' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
    
     * sun4i: Fix inverted HPD result; fixes an earlier fix
     * lima: fix timeout during reset
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    
    From: Thomas Zimmermann <tzimmermann at suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200722070321.GA29190@linux-uq9g

commit e6827d1abdc9b061a57d7b7d3019c4e99fabea2f
Author: Navid Emamdoost <navid.emamdoost at gmail.com>
Date:   Wed Jul 22 21:58:39 2020 -0500

    cxgb4: add missing release on skb in uld_send()
    
    In the implementation of uld_send(), the skb is consumed on all
    execution paths except one. Release skb when returning NET_XMIT_DROP.
    
    Signed-off-by: Navid Emamdoost <navid.emamdoost at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 32a45dc51ed7..92eee66cbc84 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2938,6 +2938,7 @@ static inline int uld_send(struct adapter *adap, struct sk_buff *skb,
 	txq_info = adap->sge.uld_txq_info[tx_uld_type];
 	if (unlikely(!txq_info)) {
 		WARN_ON(true);
+		kfree_skb(skb);
 		return NET_XMIT_DROP;
 	}
 
commit ca9b31f6bb9c6aa9b4e5f0792f39a97bbffb8c51
Author: Fangrui Song <maskray at google.com>
Date:   Tue Jul 21 10:31:23 2020 -0700

    Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation
    
    When CROSS_COMPILE is set (e.g. aarch64-linux-gnu-), if
    $(CROSS_COMPILE)elfedit is found at /usr/bin/aarch64-linux-gnu-elfedit,
    GCC_TOOLCHAIN_DIR will be set to /usr/bin/.  --prefix= will be set to
    /usr/bin/ and Clang as of 11 will search for both
    $(prefix)aarch64-linux-gnu-$needle and $(prefix)$needle.
    
    GCC searchs for $(prefix)aarch64-linux-gnu/$version/$needle,
    $(prefix)aarch64-linux-gnu/$needle and $(prefix)$needle. In practice,
    $(prefix)aarch64-linux-gnu/$needle rarely contains executables.
    
    To better model how GCC's -B/--prefix takes in effect in practice, newer
    Clang (since
    https://github.com/llvm/llvm-project/commit/3452a0d8c17f7166f479706b293caf6ac76ffd90)
    only searches for $(prefix)$needle. Currently it will find /usr/bin/as
    instead of /usr/bin/aarch64-linux-gnu-as.
    
    Set --prefix= to $(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
    (/usr/bin/aarch64-linux-gnu-) so that newer Clang can find the
    appropriate cross compiling GNU as (when -no-integrated-as is in
    effect).
    
    Cc: stable at vger.kernel.org
    Reported-by: Nathan Chancellor <natechancellor at gmail.com>
    Signed-off-by: Fangrui Song <maskray at google.com>
    Reviewed-by: Nathan Chancellor <natechancellor at gmail.com>
    Tested-by: Nathan Chancellor <natechancellor at gmail.com>
    Tested-by: Nick Desaulniers <ndesaulniers at google.com>
    Link: https://github.com/ClangBuiltLinux/linux/issues/1099
    Reviewed-by: Nick Desaulniers <ndesaulniers at google.com>
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>

diff --git a/Makefile b/Makefile
index 676f1cfb1d56..9d9d4166c0be 100644
--- a/Makefile
+++ b/Makefile
@@ -567,7 +567,7 @@ ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),)
 ifneq ($(CROSS_COMPILE),)
 CLANG_FLAGS	+= --target=$(notdir $(CROSS_COMPILE:%-=%))
 GCC_TOOLCHAIN_DIR := $(dir $(shell which $(CROSS_COMPILE)elfedit))
-CLANG_FLAGS	+= --prefix=$(GCC_TOOLCHAIN_DIR)
+CLANG_FLAGS	+= --prefix=$(GCC_TOOLCHAIN_DIR)$(notdir $(CROSS_COMPILE))
 GCC_TOOLCHAIN	:= $(realpath $(GCC_TOOLCHAIN_DIR)/..)
 endif
 ifneq ($(GCC_TOOLCHAIN),)
commit 901f3cc1639e5103a8997f6ab243785d292e2074
Author: Egor Pomozov <epomozov at marvell.com>
Date:   Wed Jul 22 22:09:58 2020 +0300

    net: atlantic: fix PTP on AQC10X
    
    This patch fixes PTP on AQC10X.
    PTP support on AQC10X requires FW involvement and FW configures the
    TPS data arb mode itself.
    So we must make sure driver doesn't touch TPS data arb mode on AQC10x
    if PTP is enabled. Otherwise, there are no timestamps even though
    packets are flowing.
    
    Fixes: 2deac71ac492a ("net: atlantic: QoS implementation: min_rate")
    Signed-off-by: Egor Pomozov <epomozov at marvell.com>
    Signed-off-by: Mark Starovoytov <mstarovoitov at marvell.com>
    Signed-off-by: Igor Russkikh <irusskikh at marvell.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index d2bc6b289a54..2125bc20ab6a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -373,8 +373,13 @@ static int hw_atl_b0_hw_init_tx_tc_rate_limit(struct aq_hw_s *self)
 
 	/* WSP, if min_rate is set for at least one TC.
 	 * RR otherwise.
+	 *
+	 * NB! MAC FW sets arb mode itself if PTP is enabled. We shouldn't
+	 * overwrite it here in that case.
 	 */
-	hw_atl_tps_tx_pkt_shed_data_arb_mode_set(self, min_rate_msk ? 1U : 0U);
+	if (!nic_cfg->is_ptp)
+		hw_atl_tps_tx_pkt_shed_data_arb_mode_set(self, min_rate_msk ? 1U : 0U);
+
 	/* Data TC Arbiter takes precedence over Descriptor TC Arbiter,
 	 * leave Descriptor TC Arbiter as RR.
 	 */
commit 8885bb0621f01a6c82be60a91e5fc0f6e2f71186
Author: Peilin Ye <yepeilin.cs at gmail.com>
Date:   Wed Jul 22 12:05:12 2020 -0400

    AX.25: Prevent out-of-bounds read in ax25_sendmsg()
    
    Checks on `addr_len` and `usax->sax25_ndigis` are insufficient.
    ax25_sendmsg() can go out of bounds when `usax->sax25_ndigis` equals to 7
    or 8. Fix it.
    
    It is safe to remove `usax->sax25_ndigis > AX25_MAX_DIGIS`, since
    `addr_len` is guaranteed to be less than or equal to
    `sizeof(struct full_sockaddr_ax25)`
    
    Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index ef5bf116157a..0862fe49d434 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1509,7 +1509,8 @@ static int ax25_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 			struct full_sockaddr_ax25 *fsa = (struct full_sockaddr_ax25 *)usax;
 
 			/* Valid number of digipeaters ? */
-			if (usax->sax25_ndigis < 1 || usax->sax25_ndigis > AX25_MAX_DIGIS) {
+			if (usax->sax25_ndigis < 1 || addr_len < sizeof(struct sockaddr_ax25) +
+			    sizeof(ax25_address) * usax->sax25_ndigis) {
 				err = -EINVAL;
 				goto out;
 			}
commit f659173364c64d3276b8aba62368e7e732fab309
Merge: 2f2a7ffad5c6 3ecdda3e9ad8
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Jul 22 18:00:12 2020 -0700

    Merge branch 'sctp-shrink-stream-outq-in-the-right-place'
    
    Xin Long says:
    
    ====================
    sctp: shrink stream outq in the right place
    
    Patch 1 is an improvement, and Patch 2 is a bug fix.
    ====================
    
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 3ecdda3e9ad837cf9cb41b6faa11b1af3a5abc0c
Author: Xin Long <lucien.xin at gmail.com>
Date:   Wed Jul 22 23:52:12 2020 +0800

    sctp: shrink stream outq when fails to do addstream reconf
    
    When adding a stream with stream reconf, the new stream firstly is in
    CLOSED state but new out chunks can still be enqueued. Then once gets
    the confirmation from the peer, the state will change to OPEN.
    
    However, if the peer denies, it needs to roll back the stream. But when
    doing that, it only sets the stream outcnt back, and the chunks already
    in the new stream don't get purged. It caused these chunks can still be
    dequeued in sctp_outq_dequeue_data().
    
    As its stream is still in CLOSE, the chunk will be enqueued to the head
    again by sctp_outq_head_data(). This chunk will never be sent out, and
    the chunks after it can never be dequeued. The assoc will be 'hung' in
    a dead loop of sending this chunk.
    
    To fix it, this patch is to purge these chunks already in the new
    stream by calling sctp_stream_shrink_out() when failing to do the
    addstream reconf.
    
    Fixes: 11ae76e67a17 ("sctp: implement receiver-side procedures for the Reconf Response Parameter")
    Reported-by: Ying Xu <yinxu at redhat.com>
    Signed-off-by: Xin Long <lucien.xin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 4f87693cc036..bda2536dd740 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -1044,11 +1044,13 @@ struct sctp_chunk *sctp_process_strreset_resp(
 		nums = ntohs(addstrm->number_of_streams);
 		number = stream->outcnt - nums;
 
-		if (result == SCTP_STRRESET_PERFORMED)
+		if (result == SCTP_STRRESET_PERFORMED) {
 			for (i = number; i < stream->outcnt; i++)
 				SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
-		else
+		} else {
+			sctp_stream_shrink_out(stream, number);
 			stream->outcnt = number;
+		}
 
 		*evp = sctp_ulpevent_make_stream_change_event(asoc, flags,
 			0, nums, GFP_ATOMIC);
commit 8f13399db22f909a35735bf8ae2f932e0c8f0e30
Author: Xin Long <lucien.xin at gmail.com>
Date:   Wed Jul 22 23:52:11 2020 +0800

    sctp: shrink stream outq only when new outcnt < old outcnt
    
    It's not necessary to go list_for_each for outq->out_chunk_list
    when new outcnt >= old outcnt, as no chunk with higher sid than
    new (outcnt - 1) exists in the outqueue.
    
    While at it, also move the list_for_each code in a new function
    sctp_stream_shrink_out(), which will be used in the next patch.
    
    Signed-off-by: Xin Long <lucien.xin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 67f7e71f9129..4f87693cc036 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -22,17 +22,11 @@
 #include <net/sctp/sm.h>
 #include <net/sctp/stream_sched.h>
 
-/* Migrates chunks from stream queues to new stream queues if needed,
- * but not across associations. Also, removes those chunks to streams
- * higher than the new max.
- */
-static void sctp_stream_outq_migrate(struct sctp_stream *stream,
-				     struct sctp_stream *new, __u16 outcnt)
+static void sctp_stream_shrink_out(struct sctp_stream *stream, __u16 outcnt)
 {
 	struct sctp_association *asoc;
 	struct sctp_chunk *ch, *temp;
 	struct sctp_outq *outq;
-	int i;
 
 	asoc = container_of(stream, struct sctp_association, stream);
 	outq = &asoc->outqueue;
@@ -56,6 +50,19 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
 
 		sctp_chunk_free(ch);
 	}
+}
+
+/* Migrates chunks from stream queues to new stream queues if needed,
+ * but not across associations. Also, removes those chunks to streams
+ * higher than the new max.
+ */
+static void sctp_stream_outq_migrate(struct sctp_stream *stream,
+				     struct sctp_stream *new, __u16 outcnt)
+{
+	int i;
+
+	if (stream->outcnt > outcnt)
+		sctp_stream_shrink_out(stream, outcnt);
 
 	if (new) {
 		/* Here we actually move the old ext stuff into the new
commit 2f2a7ffad5c6cbf3d438e813cfdc88230e185ba6
Author: Peilin Ye <yepeilin.cs at gmail.com>
Date:   Wed Jul 22 11:19:01 2020 -0400

    AX.25: Fix out-of-bounds read in ax25_connect()
    
    Checks on `addr_len` and `fsa->fsa_ax25.sax25_ndigis` are insufficient.
    ax25_connect() can go out of bounds when `fsa->fsa_ax25.sax25_ndigis`
    equals to 7 or 8. Fix it.
    
    This issue has been reported as a KMSAN uninit-value bug, because in such
    a case, ax25_connect() reaches into the uninitialized portion of the
    `struct sockaddr_storage` statically allocated in __sys_connect().
    
    It is safe to remove `fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS` because
    `addr_len` is guaranteed to be less than or equal to
    `sizeof(struct full_sockaddr_ax25)`.
    
    Reported-by: syzbot+c82752228ed975b0a623 at syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?id=55ef9d629f3b3d7d70b69558015b63b48d01af66
    Signed-off-by: Peilin Ye <yepeilin.cs at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fd91cd34f25e..ef5bf116157a 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1187,7 +1187,9 @@ static int __must_check ax25_connect(struct socket *sock,
 	if (addr_len > sizeof(struct sockaddr_ax25) &&
 	    fsa->fsa_ax25.sax25_ndigis != 0) {
 		/* Valid number of digipeaters ? */
-		if (fsa->fsa_ax25.sax25_ndigis < 1 || fsa->fsa_ax25.sax25_ndigis > AX25_MAX_DIGIS) {
+		if (fsa->fsa_ax25.sax25_ndigis < 1 ||
+		    addr_len < sizeof(struct sockaddr_ax25) +
+		    sizeof(ax25_address) * fsa->fsa_ax25.sax25_ndigis) {
 			err = -EINVAL;
 			goto out_release;
 		}
commit 26cb7085c8984e5b71d65c374a135134ed8cabb3
Author: Claudiu Manoil <claudiu.manoil at nxp.com>
Date:   Wed Jul 22 17:40:12 2020 +0300

    enetc: Remove the mdio bus on PF probe bailout
    
    For ENETC ports that register an external MDIO bus,
    the bus doesn't get removed on the error bailout path
    of enetc_pf_probe().
    
    This issue became much more visible after recent:
    commit 07095c025ac2 ("net: enetc: Use DT protocol information to set up the ports")
    Before this commit, one could make probing fail on the error
    path only by having register_netdev() fail, which is unlikely.
    But after this commit, because it moved the enetc_of_phy_get()
    call up in the probing sequence, now we can trigger an mdiobus_free()
    bug just by forcing enetc_alloc_msix() to return error, i.e. with the
    'pci=nomsi' kernel bootarg (since ENETC relies on MSI support to work),
    as the calltrace below shows:
    
    kernel BUG at /home/eiz/work/enetc/net/drivers/net/phy/mdio_bus.c:648!
    Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
    [...]
    Hardware name: LS1028A RDB Board (DT)
    pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
    pc : mdiobus_free+0x50/0x58
    lr : devm_mdiobus_free+0x14/0x20
    [...]
    Call trace:
     mdiobus_free+0x50/0x58
     devm_mdiobus_free+0x14/0x20
     release_nodes+0x138/0x228
     devres_release_all+0x38/0x60
     really_probe+0x1c8/0x368
     driver_probe_device+0x5c/0xc0
     device_driver_attach+0x74/0x80
     __driver_attach+0x8c/0xd8
     bus_for_each_dev+0x7c/0xd8
     driver_attach+0x24/0x30
     bus_add_driver+0x154/0x200
     driver_register+0x64/0x120
     __pci_register_driver+0x44/0x50
     enetc_pf_driver_init+0x24/0x30
     do_one_initcall+0x60/0x1c0
     kernel_init_freeable+0x1fc/0x274
     kernel_init+0x14/0x110
     ret_from_fork+0x10/0x34
    
    Fixes: ebfcb23d62ab ("enetc: Add ENETC PF level external MDIO support")
    Signed-off-by: Claudiu Manoil <claudiu.manoil at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
index 4fac57dbb3c8..7a9675bd36e8 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -906,6 +906,7 @@ static int enetc_pf_probe(struct pci_dev *pdev,
 	return 0;
 
 err_reg_netdev:
+	enetc_mdio_remove(pf);
 	enetc_of_put_phy(priv);
 	enetc_free_msix(priv);
 err_alloc_msix:
commit 74f85551666fe40bd739e95b5ecb20f53f8ad4df
Merge: 2a55280a3675 769e0fe1171e
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Thu Jul 23 00:46:44 2020 +0200

    Merge tag 'efi-urgent-for-v5.8-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi into efi/urgent
    
    Pull EFI fixes from Ard Biesheuvel:
    
     - Fix the layering violation in the use of the EFI runtime services
       availability mask in users of the 'efivars' abstraction
     - Revert build fix for GCC v4.8 which is no longer supported
     - Some fixes for build issues found by Atish while working on RISC-V support
     - Avoid --whole-archive when linking the stub on arm64
     - Some x86 EFI stub cleanups from Arvind

commit d181d2da0141371bbc360eaea78719203e165e1c
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Wed Jul 22 10:39:54 2020 +0200

    x86/dumpstack: Dump user space code correctly again
    
    H.J. reported that post 5.7 a segfault of a user space task does not longer
    dump the Code bytes when /proc/sys/debug/exception-trace is enabled. It
    prints 'Code: Bad RIP value.' instead.
    
    This was broken by a recent change which made probe_kernel_read() reject
    non-kernel addresses.
    
    Update show_opcodes() so it retrieves user space opcodes via
    copy_from_user_nmi().
    
    Fixes: 98a23609b103 ("maccess: always use strict semantics for probe_kernel_read")
    Reported-by: H.J. Lu <hjl.tools at gmail.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Link: https://lkml.kernel.org/r/87h7tz306w.fsf@nanos.tec.linutronix.de

diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index b037cfa7c0c5..7401cc12c3cc 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -71,6 +71,22 @@ static void printk_stack_address(unsigned long address, int reliable,
 	printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
 }
 
+static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
+		     unsigned int nbytes)
+{
+	if (!user_mode(regs))
+		return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
+
+	/*
+	 * Make sure userspace isn't trying to trick us into dumping kernel
+	 * memory by pointing the userspace instruction pointer at it.
+	 */
+	if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX))
+		return -EINVAL;
+
+	return copy_from_user_nmi(buf, (void __user *)src, nbytes);
+}
+
 /*
  * There are a couple of reasons for the 2/3rd prologue, courtesy of Linus:
  *
@@ -97,17 +113,8 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl)
 #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)
 	u8 opcodes[OPCODE_BUFSIZE];
 	unsigned long prologue = regs->ip - PROLOGUE_SIZE;
-	bool bad_ip;
-
-	/*
-	 * Make sure userspace isn't trying to trick us into dumping kernel
-	 * memory by pointing the userspace instruction pointer at it.
-	 */
-	bad_ip = user_mode(regs) &&
-		__chk_range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX);
 
-	if (bad_ip || copy_from_kernel_nofault(opcodes, (u8 *)prologue,
-					OPCODE_BUFSIZE)) {
+	if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
 		printk("%sCode: Bad RIP value.\n", loglvl);
 	} else {
 		printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"
commit 039a7a30ec102ec866d382a66f87f6f7654f8140
Author: Josh Poimboeuf <jpoimboe at redhat.com>
Date:   Fri Jul 17 09:04:26 2020 -0500

    x86/stacktrace: Fix reliable check for empty user task stacks
    
    If a user task's stack is empty, or if it only has user regs, ORC
    reports it as a reliable empty stack.  But arch_stack_walk_reliable()
    incorrectly treats it as unreliable.
    
    That happens because the only success path for user tasks is inside the
    loop, which only iterates on non-empty stacks.  Generally, a user task
    must end in a user regs frame, but an empty stack is an exception to
    that rule.
    
    Thanks to commit 71c95825289f ("x86/unwind/orc: Fix error handling in
    __unwind_start()"), unwind_start() now sets state->error appropriately.
    So now for both ORC and FP unwinders, unwind_done() and !unwind_error()
    always means the end of the stack was successfully reached.  So the
    success path for kthreads is no longer needed -- it can also be used for
    empty user tasks.
    
    Reported-by: Wang ShaoBo <bobo.shaobowang at huawei.com>
    Signed-off-by: Josh Poimboeuf <jpoimboe at redhat.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Tested-by: Wang ShaoBo <bobo.shaobowang at huawei.com>
    Link: https://lkml.kernel.org/r/f136a4e5f019219cbc4f4da33b30c2f44fa65b84.1594994374.git.jpoimboe@redhat.com

diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
index 6ad43fc44556..2fd698e28e4d 100644
--- a/arch/x86/kernel/stacktrace.c
+++ b/arch/x86/kernel/stacktrace.c
@@ -58,7 +58,6 @@ int arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
 			 * or a page fault), which can make frame pointers
 			 * unreliable.
 			 */
-
 			if (IS_ENABLED(CONFIG_FRAME_POINTER))
 				return -EINVAL;
 		}
@@ -81,10 +80,6 @@ int arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
 	if (unwind_error(&state))
 		return -EINVAL;
 
-	/* Success path for non-user tasks, i.e. kthreads and idle tasks */
-	if (!(task->flags & (PF_KTHREAD | PF_IDLE)))
-		return -EINVAL;
-
 	return 0;
 }
 
commit 372a8eaa05998cd45b3417d0e0ffd3a70978211a
Author: Josh Poimboeuf <jpoimboe at redhat.com>
Date:   Fri Jul 17 09:04:25 2020 -0500

    x86/unwind/orc: Fix ORC for newly forked tasks
    
    The ORC unwinder fails to unwind newly forked tasks which haven't yet
    run on the CPU.  It correctly reads the 'ret_from_fork' instruction
    pointer from the stack, but it incorrectly interprets that value as a
    call stack address rather than a "signal" one, so the address gets
    incorrectly decremented in the call to orc_find(), resulting in bad ORC
    data.
    
    Fix it by forcing 'ret_from_fork' frames to be signal frames.
    
    Reported-by: Wang ShaoBo <bobo.shaobowang at huawei.com>
    Signed-off-by: Josh Poimboeuf <jpoimboe at redhat.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Tested-by: Wang ShaoBo <bobo.shaobowang at huawei.com>
    Link: https://lkml.kernel.org/r/f91a8778dde8aae7f71884b5df2b16d552040441.1594994374.git.jpoimboe@redhat.com

diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index 7f969b2d240f..ec88bbe08a32 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -440,8 +440,11 @@ bool unwind_next_frame(struct unwind_state *state)
 	/*
 	 * Find the orc_entry associated with the text address.
 	 *
-	 * Decrement call return addresses by one so they work for sibling
-	 * calls and calls to noreturn functions.
+	 * For a call frame (as opposed to a signal frame), state->ip points to
+	 * the instruction after the call.  That instruction's stack layout
+	 * could be different from the call instruction's layout, for example
+	 * if the call was to a noreturn function.  So get the ORC data for the
+	 * call instruction itself.
 	 */
 	orc = orc_find(state->signal ? state->ip : state->ip - 1);
 	if (!orc) {
@@ -662,6 +665,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
 		state->sp = task->thread.sp;
 		state->bp = READ_ONCE_NOCHECK(frame->bp);
 		state->ip = READ_ONCE_NOCHECK(frame->ret_addr);
+		state->signal = (void *)state->ip == ret_from_fork;
 	}
 
 	if (get_stack_info((unsigned long *)state->sp, state->task,
commit 9affa435817711861d774f5626c393c80f16d044
Author: J. Bruce Fields <bfields at redhat.com>
Date:   Wed Jul 15 13:31:36 2020 -0400

    nfsd4: fix NULL dereference in nfsd/clients display code
    
    We hold the cl_lock here, and that's enough to keep stateid's from going
    away, but it's not enough to prevent the files they point to from going
    away.  Take fi_lock and a reference and check for NULL, as we do in
    other code.
    
    Reported-by: NeilBrown <neilb at suse.de>
    Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens")
    Reviewed-by: NeilBrown <neilb at suse.de>
    Signed-off-by: J. Bruce Fields <bfields at redhat.com>

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index cce2510b2cca..c9056316a0b3 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -507,6 +507,17 @@ find_any_file(struct nfs4_file *f)
 	return ret;
 }
 
+static struct nfsd_file *find_deleg_file(struct nfs4_file *f)
+{
+	struct nfsd_file *ret = NULL;
+
+	spin_lock(&f->fi_lock);
+	if (f->fi_deleg_file)
+		ret = nfsd_file_get(f->fi_deleg_file);
+	spin_unlock(&f->fi_lock);
+	return ret;
+}
+
 static atomic_long_t num_delegations;
 unsigned long max_delegations;
 
@@ -2444,6 +2455,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
 	oo = ols->st_stateowner;
 	nf = st->sc_file;
 	file = find_any_file(nf);
+	if (!file)
+		return 0;
 
 	seq_printf(s, "- ");
 	nfs4_show_stateid(s, &st->sc_stateid);
@@ -2481,6 +2494,8 @@ static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
 	oo = ols->st_stateowner;
 	nf = st->sc_file;
 	file = find_any_file(nf);
+	if (!file)
+		return 0;
 
 	seq_printf(s, "- ");
 	nfs4_show_stateid(s, &st->sc_stateid);
@@ -2513,7 +2528,9 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
 
 	ds = delegstateid(st);
 	nf = st->sc_file;
-	file = nf->fi_deleg_file;
+	file = find_deleg_file(nf);
+	if (!file)
+		return 0;
 
 	seq_printf(s, "- ");
 	nfs4_show_stateid(s, &st->sc_stateid);
@@ -2529,6 +2546,7 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
 	seq_printf(s, ", ");
 	nfs4_show_fname(s, file);
 	seq_printf(s, " }\n");
+	nfsd_file_put(file);
 
 	return 0;
 }
commit 7c8c70ba5c15adcd9785aa7b17431a9d3fe7f717
Merge: 21a59e0bf5e0 4a601da92c2a
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Wed Jul 22 21:41:36 2020 +0200

    Merge tag 'imx-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes
    
    i.MX fixes for 5.8, round 3:
    
    - A couple of FEC2 phy-mode fixes on imx6sx-sabreauto and imx6sx-sdb
      board.
    - One fix on imx6qdl-icore pin muxing to get USB OTG_ID and SD card
      detect work correctly.
    
    * tag 'imx-fixes-5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
      ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect
      ARM: dts: imx6sx-sabreauto: Fix the phy-mode on fec2
      ARM: dts: imx6sx-sdb: Fix the phy-mode on fec2
    
    Link: https://lore.kernel.org/r/20200720040148.GA20462@dragon
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

commit 21a59e0bf5e00d69303a0ab61729c514ef067c3b
Merge: 2648298a06ba 62a8ccf3a248
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Wed Jul 22 21:40:40 2020 +0200

    Merge tag 'sunxi-fixes-for-5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes
    
    Two fixes for the Allwinner SoCs, one to relax the CMA allocation ranges that
    were failing on older SoCs and one to fix Cedrus on the H6.
    
    * tag 'sunxi-fixes-for-5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
      arm64: dts: allwinner: h6: Fix Cedrus IOMMU usage
      ARM: dts sunxi: Relax a bit the CMA pool allocation range
    
    Link: https://lore.kernel.org/r/e24f0608-6a4f-4163-b99e-a5f48e796184.lettre@localhost
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

commit d15be546031cf65a0fc34879beca02fd90fe7ac7
Merge: 071fb1bcd727 0d6db85131e0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 22 11:56:00 2020 -0700

    Merge tag 'media/v5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media into master
    
    Pull media fixes from Mauro Carvalho Chehab:
     "A series of fixes for the upcoming atomisp driver. They solve issues
      when probing atomisp on devices with multiple cameras and get rid of
      warnings when built with W=1.
    
      The diffstat is a bit long, as this driver has several abstractions.
      The patches that solved the issues with W=1 had to get rid of some
      duplicated code (there used to have 2 versions of the same code, one
      for ISP2401 and another one for ISP2400).
    
      As this driver is not in 5.7, such changes won't cause regressions"
    
    * tag 'media/v5.8-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (38 commits)
      Revert "media: atomisp: keep the ISP powered on when setting it"
      media: atomisp: fix mask and shift operation on ISPSSPM0
      media: atomisp: move system_local consts into a C file
      media: atomisp: get rid of version-specific system_local.h
      media: atomisp: move global stuff into a common header
      media: atomisp: remove non-used 32-bits consts at system_local
      media: atomisp: get rid of some unused static vars
      media: atomisp: Fix error code in ov5693_probe()
      media: atomisp: Replace trace_printk by pr_info
      media: atomisp: Fix __func__ style warnings
      media: atomisp: fix help message for ISP2401 selection
      media: atomisp: i2c: atomisp-ov2680.c: fixed a brace coding style issue.
      media: atomisp: make const arrays static, makes object smaller
      media: atomisp: Clean up non-existing folders from Makefile
      media: atomisp: Get rid of ACPI specifics in gmin_subdev_add()
      media: atomisp: Provide Gmin subdev as parameter to gmin_subdev_add()
      media: atomisp: Use temporary variable for device in gmin_subdev_add()
      media: atomisp: Refactor PMIC detection to a separate function
      media: atomisp: Deduplicate return ret in gmin_i2c_write()
      media: atomisp: Make pointer to PMIC client global
      ...

commit 071fb1bcd727e306f3e5911e53e7222fc4efab35
Merge: 8c26c87b0532 db415f7aae07
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Jul 22 11:30:07 2020 -0700

    Merge tag 'exfat-for-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat into master
    
    Pull exfat fixes from Namjae Jeon:
    
     - fix overflow issue at sector calculation
    
     - fix wrong hint_stat initialization
    
     - fix wrong size update of stream entry
    
     - fix endianness of upname in name_hash computation
    
    * tag 'exfat-for-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
      exfat: fix name_hash computation on big endian systems
      exfat: fix wrong size update of stream entry by typo
      exfat: fix wrong hint_stat initialization in exfat_find_dir_entry()
      exfat: fix overflow issue in exfat_cluster_to_sector()

commit faaff9765664009c1c7c65551d32e9ed3b1dda8f
Author: Rustam Kovhaev <rkovhaev at gmail.com>
Date:   Wed Jul 22 09:10:52 2020 -0700

    staging: wlan-ng: properly check endpoint types
    
    As syzkaller detected, wlan-ng driver does not do sanity check of
    endpoints in prism2sta_probe_usb(), add check for xfer direction and type
    
    Reported-and-tested-by: syzbot+c2a1fa67c02faa0de723 at syzkaller.appspotmail.com
    Link: https://syzkaller.appspot.com/bug?extid=c2a1fa67c02faa0de723
    Signed-off-by: Rustam Kovhaev <rkovhaev at gmail.com>
    Cc: stable <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200722161052.999754-1-rkovhaev@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/staging/wlan-ng/prism2usb.c b/drivers/staging/wlan-ng/prism2usb.c
index 4689b2170e4f..456603fd26c0 100644
--- a/drivers/staging/wlan-ng/prism2usb.c
+++ b/drivers/staging/wlan-ng/prism2usb.c
@@ -61,11 +61,25 @@ static int prism2sta_probe_usb(struct usb_interface *interface,
 			       const struct usb_device_id *id)
 {
 	struct usb_device *dev;
-
+	const struct usb_endpoint_descriptor *epd;
+	const struct usb_host_interface *iface_desc = interface->cur_altsetting;
 	struct wlandevice *wlandev = NULL;
 	struct hfa384x *hw = NULL;
 	int result = 0;
 
+	if (iface_desc->desc.bNumEndpoints != 2) {
+		result = -ENODEV;
+		goto failed;
+	}
+
+	result = -EINVAL;
+	epd = &iface_desc->endpoint[1].desc;
+	if (!usb_endpoint_is_bulk_in(epd))
+		goto failed;
+	epd = &iface_desc->endpoint[2].desc;
+	if (!usb_endpoint_is_bulk_out(epd))
+		goto failed;
+
 	dev = interface_to_usbdev(interface);
 	wlandev = create_wlan();
 	if (!wlandev) {
commit d08c30d7a0d1826f771f16cde32bd86e48401791
Author: Bjorn Helgaas <bhelgaas at google.com>
Date:   Fri Jul 17 17:21:28 2020 -0500

    Revert "PCI/PM: Assume ports without DLL Link Active train links in 100 ms"
    
    This reverts commit ec411e02b7a2e785a4ed9ed283207cd14f48699d.
    
    Patrick reported that this commit broke hybrid graphics on a ThinkPad X1
    Extreme 2nd with Intel UHD Graphics 630 and NVIDIA GeForce GTX 1650 Mobile:
    
      nouveau 0000:01:00.0: fifo: PBDMA0: 01000000 [] ch 0 [00ff992000 DRM] subc 0 mthd 0008 data 00000000
    
    Karol reported that this commit broke Nouveau firmware loading on a Lenovo
    P1G2 with Intel UHD Graphics 630 and NVIDIA TU117GLM [Quadro T1000 Mobile]:
    
      nouveau 0000:01:00.0: acr: AHESASC binary failed
    
    In both cases, reverting ec411e02b7a2 solved the problem.  Unfortunately,
    this revert will reintroduce the "Thunderbolt bridges take long time to
    resume from D3cold" problem:
    https://bugzilla.kernel.org/show_bug.cgi?id=206837
    
    Link: https://lore.kernel.org/r/CAErSpo5sTeK_my1dEhWp7aHD0xOp87+oHYWkTjbL7ALgDbXo-Q@mail.gmail.com
    Link: https://lore.kernel.org/r/CACO55tsAEa5GXw5oeJPG=mcn+qxNvspXreJYWDJGZBy5v82JDA@mail.gmail.com
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=208597
    Reported-by: Patrick Volkerding <volkerdi at gmail.com>
    Reported-by: Karol Herbst <kherbst at redhat.com>
    Fixes: ec411e02b7a2 ("PCI/PM: Assume ports without DLL Link Active train links in 100 ms")
    Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index ce096272f52b..c9338f914a0e 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4638,8 +4638,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
  * pcie_wait_for_link_delay - Wait until link is active or inactive
  * @pdev: Bridge device
  * @active: waiting for active or inactive?
- * @delay: Delay to wait after link has become active (in ms). Specify %0
- *	   for no delay.
+ * @delay: Delay to wait after link has become active (in ms)
  *
  * Use this to wait till link becomes active or inactive.
  */
@@ -4680,7 +4679,7 @@ static bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active,
 		msleep(10);
 		timeout -= 10;
 	}
-	if (active && ret && delay)
+	if (active && ret)
 		msleep(delay);
 	else if (ret != active)
 		pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n",
@@ -4801,28 +4800,17 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev)
 	if (!pcie_downstream_port(dev))
 		return;
 
-	/*
-	 * Per PCIe r5.0, sec 6.6.1, for downstream ports that support
-	 * speeds > 5 GT/s, we must wait for link training to complete
-	 * before the mandatory delay.
-	 *
-	 * We can only tell when link training completes via DLL Link
-	 * Active, which is required for downstream ports that support
-	 * speeds > 5 GT/s (sec 7.5.3.6).  Unfortunately some common
-	 * devices do not implement Link Active reporting even when it's
-	 * required, so we'll check for that directly instead of checking
-	 * the supported link speed.  We assume devices without Link Active
-	 * reporting can train in 100 ms regardless of speed.
-	 */
-	if (dev->link_active_reporting) {
-		pci_dbg(dev, "waiting for link to train\n");
-		if (!pcie_wait_for_link_delay(dev, true, 0)) {
+	if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) {
+		pci_dbg(dev, "waiting %d ms for downstream link\n", delay);
+		msleep(delay);
+	} else {
+		pci_dbg(dev, "waiting %d ms for downstream link, after activation\n",
+			delay);
+		if (!pcie_wait_for_link_delay(dev, true, delay)) {
 			/* Did not train, no need to wait any further */
 			return;
 		}
 	}
-	pci_dbg(child, "waiting %d ms to become accessible\n", delay);
-	msleep(delay);
 
 	if (!pci_device_is_present(child)) {
 		pci_dbg(child, "waiting additional %d ms to become accessible\n", delay);
commit 62ca18a0896f5590806e6aee7bce39f130a2d9d5
Author: Bjorn Helgaas <bhelgaas at google.com>
Date:   Wed Jul 1 15:53:15 2020 -0500

    virtio-mmio: Reject invalid IRQ 0 command line argument
    
    The "virtio_mmio.device=" command line argument allows a user to specify
    the size, address, and IRQ of a virtio device.  Previously the only
    requirement for the IRQ was that it be an unsigned integer.
    
    Zero is an unsigned integer but an invalid IRQ number, and after
    a85a6c86c25be ("driver core: platform: Clarify that IRQ 0 is invalid"),
    attempts to use IRQ 0 cause warnings.
    
    If the user specifies IRQ 0, return failure instead of registering a device
    with IRQ 0.
    
    Fixes: a85a6c86c25be ("driver core: platform: Clarify that IRQ 0 is invalid")
    Signed-off-by: Bjorn Helgaas <bhelgaas at google.com>
    Acked-by: Jason Wang <jasowang at redhat.com>
    Acked-by: Michael S. Tsirkin <mst at redhat.com>

diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c
index 9d16aaffca9d..627ac0487494 100644
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -641,11 +641,11 @@ static int vm_cmdline_set(const char *device,
 			&vm_cmdline_id, &consumed);
 
 	/*
-	 * sscanf() must processes at least 2 chunks; also there
+	 * sscanf() must process at least 2 chunks; also there
 	 * must be no extra characters after the last chunk, so
 	 * str[consumed] must be '\0'
 	 */
-	if (processed < 2 || str[consumed])
+	if (processed < 2 || str[consumed] || irq == 0)
 		return -EINVAL;
 
 	resources[0].flags = IORESOURCE_MEM;
commit 1014a2f8d76b05e0f228dd097ac1a249c5934232
Author: Rob Clark <robdclark at chromium.org>
Date:   Mon Jul 20 08:52:17 2020 -0700

    iommu/qcom: Use domain rather than dev as tlb cookie
    
    The device may be torn down, but the domain should still be valid.  Lets
    use that as the tlb flush ops cookie.
    
    Fixes a problem reported in [1]
    
    [1] https://lkml.org/lkml/2020/7/20/104
    
    Reported-by: Naresh Kamboju <naresh.kamboju at linaro.org>
    Signed-off-by: Rob Clark <robdclark at chromium.org>
    Tested-by: Naresh Kamboju <naresh.kamboju at linaro.org>
    Fixes: 09b5dfff9ad6 ("iommu/qcom: Use accessor functions for iommu private data")
    Link: https://lore.kernel.org/r/20200720155217.274994-1-robdclark@gmail.com
    Signed-off-by: Joerg Roedel <jroedel at suse.de>

diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c
index c3e1fbd1988c..d176df569af8 100644
--- a/drivers/iommu/qcom_iommu.c
+++ b/drivers/iommu/qcom_iommu.c
@@ -65,6 +65,7 @@ struct qcom_iommu_domain {
 	struct mutex		 init_mutex; /* Protects iommu pointer */
 	struct iommu_domain	 domain;
 	struct qcom_iommu_dev	*iommu;
+	struct iommu_fwspec	*fwspec;
 };
 
 static struct qcom_iommu_domain *to_qcom_iommu_domain(struct iommu_domain *dom)
@@ -84,9 +85,9 @@ static struct qcom_iommu_dev * to_iommu(struct device *dev)
 	return dev_iommu_priv_get(dev);
 }
 
-static struct qcom_iommu_ctx * to_ctx(struct device *dev, unsigned asid)
+static struct qcom_iommu_ctx * to_ctx(struct qcom_iommu_domain *d, unsigned asid)
 {
-	struct qcom_iommu_dev *qcom_iommu = to_iommu(dev);
+	struct qcom_iommu_dev *qcom_iommu = d->iommu;
 	if (!qcom_iommu)
 		return NULL;
 	return qcom_iommu->ctxs[asid - 1];
@@ -118,14 +119,12 @@ iommu_readq(struct qcom_iommu_ctx *ctx, unsigned reg)
 
 static void qcom_iommu_tlb_sync(void *cookie)
 {
-	struct iommu_fwspec *fwspec;
-	struct device *dev = cookie;
+	struct qcom_iommu_domain *qcom_domain = cookie;
+	struct iommu_fwspec *fwspec = qcom_domain->fwspec;
 	unsigned i;
 
-	fwspec = dev_iommu_fwspec_get(dev);
-
 	for (i = 0; i < fwspec->num_ids; i++) {
-		struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
+		struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
 		unsigned int val, ret;
 
 		iommu_writel(ctx, ARM_SMMU_CB_TLBSYNC, 0);
@@ -139,14 +138,12 @@ static void qcom_iommu_tlb_sync(void *cookie)
 
 static void qcom_iommu_tlb_inv_context(void *cookie)
 {
-	struct device *dev = cookie;
-	struct iommu_fwspec *fwspec;
+	struct qcom_iommu_domain *qcom_domain = cookie;
+	struct iommu_fwspec *fwspec = qcom_domain->fwspec;
 	unsigned i;
 
-	fwspec = dev_iommu_fwspec_get(dev);
-
 	for (i = 0; i < fwspec->num_ids; i++) {
-		struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
+		struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
 		iommu_writel(ctx, ARM_SMMU_CB_S1_TLBIASID, ctx->asid);
 	}
 
@@ -156,16 +153,14 @@ static void qcom_iommu_tlb_inv_context(void *cookie)
 static void qcom_iommu_tlb_inv_range_nosync(unsigned long iova, size_t size,
 					    size_t granule, bool leaf, void *cookie)
 {
-	struct device *dev = cookie;
-	struct iommu_fwspec *fwspec;
+	struct qcom_iommu_domain *qcom_domain = cookie;
+	struct iommu_fwspec *fwspec = qcom_domain->fwspec;
 	unsigned i, reg;
 
 	reg = leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA;
 
-	fwspec = dev_iommu_fwspec_get(dev);
-
 	for (i = 0; i < fwspec->num_ids; i++) {
-		struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
+		struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
 		size_t s = size;
 
 		iova = (iova >> 12) << 12;
@@ -256,7 +251,9 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain,
 	};
 
 	qcom_domain->iommu = qcom_iommu;
-	pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, dev);
+	qcom_domain->fwspec = fwspec;
+
+	pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, qcom_domain);
 	if (!pgtbl_ops) {
 		dev_err(qcom_iommu->dev, "failed to allocate pagetable ops\n");
 		ret = -ENOMEM;
@@ -269,7 +266,7 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain,
 	domain->geometry.force_aperture = true;
 
 	for (i = 0; i < fwspec->num_ids; i++) {
-		struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
+		struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
 
 		if (!ctx->secure_init) {
 			ret = qcom_scm_restore_sec_cfg(qcom_iommu->sec_id, ctx->asid);
@@ -419,7 +416,7 @@ static void qcom_iommu_detach_dev(struct iommu_domain *domain, struct device *de
 
 	pm_runtime_get_sync(qcom_iommu->dev);
 	for (i = 0; i < fwspec->num_ids; i++) {
-		struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
+		struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
 
 		/* Disable the context bank: */
 		iommu_writel(ctx, ARM_SMMU_CB_SCTLR, 0);
commit 0cfa112b33aba4473b00151c75b87818a835702a
Author: Gerald Schaefer <gerald.schaefer at linux.ibm.com>
Date:   Tue Jul 21 15:04:30 2020 +0200

    MAINTAINERS: add Matthew for s390 IOMMU
    
    Acked-By: Matthew Rosato <mjrosato at linux.ibm.com>
    Signed-off-by: Gerald Schaefer <gerald.schaefer at linux.ibm.com>
    Signed-off-by: Heiko Carstens <hca at linux.ibm.com>

diff --git a/MAINTAINERS b/MAINTAINERS
index d53db30d1365..df5fc5625ec8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14862,6 +14862,7 @@ F:	drivers/s390/block/dasd*
 F:	include/linux/dasd_mod.h
 
 S390 IOMMU (PCI)
+M:	Matthew Rosato <mjrosato at linux.ibm.com>
 M:	Gerald Schaefer <gerald.schaefer at linux.ibm.com>
 L:	linux-s390 at vger.kernel.org
 S:	Supported
commit 37bd22420f856fcd976989f1d4f1f7ad28e1fcac
Author: Mark Salyzyn <salyzyn at android.com>
Date:   Wed Jul 22 04:00:53 2020 -0700

    af_key: pfkey_dump needs parameter validation
    
    In pfkey_dump() dplen and splen can both be specified to access the
    xfrm_address_t structure out of bounds in__xfrm_state_filter_match()
    when it calls addr_match() with the indexes.  Return EINVAL if either
    are out of range.
    
    Signed-off-by: Mark Salyzyn <salyzyn at android.com>
    Cc: netdev at vger.kernel.org
    Cc: linux-kernel at vger.kernel.org
    Cc: kernel-team at android.com
    Cc: Steffen Klassert <steffen.klassert at secunet.com>
    Cc: Herbert Xu <herbert at gondor.apana.org.au>
    Cc: "David S. Miller" <davem at davemloft.net>
    Cc: Jakub Kicinski <kuba at kernel.org>
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Steffen Klassert <steffen.klassert at secunet.com>

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 979c579afc63..a915bc86620a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1849,6 +1849,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
 
+		if ((xfilter->sadb_x_filter_splen >=
+			(sizeof(xfrm_address_t) << 3)) ||
+		    (xfilter->sadb_x_filter_dplen >=
+			(sizeof(xfrm_address_t) << 3))) {
+			mutex_unlock(&pfk->dump_lock);
+			return -EINVAL;
+		}
 		filter = kmalloc(sizeof(*filter), GFP_KERNEL);
 		if (filter == NULL) {
 			mutex_unlock(&pfk->dump_lock);
commit 436d17675be1c090f08d4eddf1d7193cacf0e9be
Author: Ludovic Desroches <ludovic.desroches at microchip.com>
Date:   Thu Jul 9 10:42:33 2020 +0200

    MAINTAINERS: i2c: at91: handover maintenance to Codrin Ciubotariu
    
    My colleague Codrin Ciubotariu, now, maintains this driver internally.
    Then I handover the mainline maintenance to him.
    
    Signed-off-by: Ludovic Desroches <ludovic.desroches at microchip.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/MAINTAINERS b/MAINTAINERS
index d53db30d1365..2ec6db685992 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -11240,7 +11240,7 @@ S:	Maintained
 F:	drivers/crypto/atmel-ecc.*
 
 MICROCHIP I2C DRIVER
-M:	Ludovic Desroches <ludovic.desroches at microchip.com>
+M:	Codrin Ciubotariu <codrin.ciubotariu at microchip.com>
 L:	linux-i2c at vger.kernel.org
 S:	Supported
 F:	drivers/i2c/busses/i2c-at91-*.c
commit aca7ed091117d9b4ce499855c383119afb2819a2
Author: Randy Dunlap <rdunlap at infradead.org>
Date:   Fri Jul 17 16:38:15 2020 -0700

    i2c: drop duplicated word in the header file
    
    Drop the doubled word "be" in a comment.
    
    Signed-off-by: Randy Dunlap <rdunlap at infradead.org>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index b8b8963f8bb9..ee328cf80bd9 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -56,7 +56,7 @@ struct property_entry;
  * on a bus (or read from them). Apart from two basic transfer functions to
  * transmit one message at a time, a more complex version can be used to
  * transmit an arbitrary number of messages without interruption.
- * @count must be be less than 64k since msg.len is u16.
+ * @count must be less than 64k since msg.len is u16.
  */
 int i2c_transfer_buffer_flags(const struct i2c_client *client,
 			      char *buf, int count, u16 flags);
commit 12d4d9ec5eeecd712c73772e422b6d082e66b046
Author: Raviteja Narayanam <raviteja.narayanam at xilinx.com>
Date:   Fri Jul 3 19:26:12 2020 +0530

    i2c: cadence: Clear HOLD bit at correct time in Rx path
    
    There are few issues on Zynq SOC observed in the stress tests causing
    timeout errors. Even though all the data is received, timeout error
    is thrown. This is due to an IP bug in which the COMP bit in ISR is
    not set at end of transfer and completion interrupt is not generated.
    
    This bug is seen on Zynq platforms when the following condition occurs:
    Master read & HOLD bit set & Transfer size register reaches '0'.
    
    One workaround is to clear the HOLD bit before the transfer size
    register reaches '0'. The current implementation checks for this at
    the start of the loop and also only for less than FIFO DEPTH case
    (ignoring the equal to case).
    
    So clear the HOLD bit when the data yet to receive is less than or
    equal to the FIFO DEPTH. This avoids the IP bug condition.
    
    Signed-off-by: Raviteja Narayanam <raviteja.narayanam at xilinx.com>
    Acked-by: Michal Simek <michal.simek at xilinx.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index e06960207ada..e4b7f2a951ad 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -421,20 +421,21 @@ static irqreturn_t cdns_i2c_master_isr(void *ptr)
 		/* Read data if receive data valid is set */
 		while (cdns_i2c_readreg(CDNS_I2C_SR_OFFSET) &
 		       CDNS_I2C_SR_RXDV) {
-			/*
-			 * Clear hold bit that was set for FIFO control if
-			 * RX data left is less than FIFO depth, unless
-			 * repeated start is selected.
-			 */
-			if ((id->recv_count < CDNS_I2C_FIFO_DEPTH) &&
-			    !id->bus_hold_flag)
-				cdns_i2c_clear_bus_hold(id);
-
 			if (id->recv_count > 0) {
 				*(id->p_recv_buf)++ =
 					cdns_i2c_readreg(CDNS_I2C_DATA_OFFSET);
 				id->recv_count--;
 				id->curr_recv_count--;
+
+				/*
+				 * Clear hold bit that was set for FIFO control
+				 * if RX data left is less than or equal to
+				 * FIFO DEPTH unless repeated start is selected
+				 */
+				if (id->recv_count <= CDNS_I2C_FIFO_DEPTH &&
+				    !id->bus_hold_flag)
+					cdns_i2c_clear_bus_hold(id);
+
 			} else {
 				dev_err(id->adap.dev.parent,
 					"xfer_size reg rollover. xfer aborted!\n");
commit 0db9254d6b896b587759e2c844c277fb1a6da5b9
Author: Raviteja Narayanam <raviteja.narayanam at xilinx.com>
Date:   Fri Jul 3 19:25:49 2020 +0530

    Revert "i2c: cadence: Fix the hold bit setting"
    
    This reverts commit d358def706880defa4c9e87381c5bf086a97d5f9.
    
    There are two issues with "i2c: cadence: Fix the hold bit setting" commit.
    
    1. In case of combined message request from user space, when the HOLD
    bit is cleared in cdns_i2c_mrecv function, a STOP condition is sent
    on the bus even before the last message is started. This is because when
    the HOLD bit is cleared, the FIFOS are empty and there is no pending
    transfer. The STOP condition should occur only after the last message
    is completed.
    
    2. The code added by the commit is redundant. Driver is handling the
    setting/clearing of HOLD bit in right way before the commit.
    
    The setting of HOLD bit based on 'bus_hold_flag' is taken care in
    cdns_i2c_master_xfer function even before cdns_i2c_msend/cdns_i2c_recv
    functions.
    
    The clearing of HOLD bit is taken care at the end of cdns_i2c_msend and
    cdns_i2c_recv functions based on bus_hold_flag and byte count.
    Since clearing of HOLD bit is done after the slave address is written to
    the register (writing to address register triggers the message transfer),
    it is ensured that STOP condition occurs at the right time after
    completion of the pending transfer (last message).
    
    Signed-off-by: Raviteja Narayanam <raviteja.narayanam at xilinx.com>
    Acked-by: Michal Simek <michal.simek at xilinx.com>
    Signed-off-by: Wolfram Sang <wsa at kernel.org>

diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 4b72398af505..e06960207ada 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -594,10 +594,8 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
 	 * Check for the message size against FIFO depth and set the
 	 * 'hold bus' bit if it is greater than FIFO depth.
 	 */
-	if ((id->recv_count > CDNS_I2C_FIFO_DEPTH)  || id->bus_hold_flag)
+	if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
 		ctrl_reg |= CDNS_I2C_CR_HOLD;
-	else
-		ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
 
 	cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
@@ -654,11 +652,8 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
 	 * Check for the message size against FIFO depth and set the
 	 * 'hold bus' bit if it is greater than FIFO depth.
 	 */
-	if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+	if (id->send_count > CDNS_I2C_FIFO_DEPTH)
 		ctrl_reg |= CDNS_I2C_CR_HOLD;
-	else
-		ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
-
 	cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
 
 	/* Clear the interrupts in interrupt status register. */
commit 3da87ec67a491b9633a82045896c076b794bf938
Author: Laurence Tratt <laurie at tratt.net>
Date:   Sun Jun 21 08:50:05 2020 +0100

    ALSA: usb-audio: Add implicit feedback quirk for SSL2
    
    As expected, this requires the same quirk as the SSL2+ in order for the
    clock to sync. This was suggested by, and tested on an SSL2, by Dmitry.
    
    Suggested-by: Dmitry <dpavlushko at gmail.com>
    Signed-off-by: Laurence Tratt <laurie at tratt.net>
    Cc: <stable at vger.kernel.org>
    Link: https://lore.kernel.org/r/20200621075005.52mjjfc6dtdjnr3h@overdrive.tratt.net
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 40b7cd13fed9..a69d9e75f66f 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -367,6 +367,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
 		ifnum = 0;
 		goto add_sync_ep_from_ifnum;
 	case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
+	case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */
 	case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
 	case USB_ID(0x0d9a, 0x00df): /* RTX6001 */
 		ep = 0x81;
commit d136122f58458479fd8926020ba2937de61d7f65
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Mon Jul 20 17:20:21 2020 +0200

    sched: Fix race against ptrace_freeze_trace()
    
    There is apparently one site that violates the rule that only current
    and ttwu() will modify task->state, namely ptrace_{,un}freeze_traced()
    will change task->state for a remote task.
    
    Oleg explains:
    
      "TASK_TRACED/TASK_STOPPED was always protected by siglock. In
    particular, ttwu(__TASK_TRACED) must be always called with siglock
    held. That is why ptrace_freeze_traced() assumes it can safely do
    s/TASK_TRACED/__TASK_TRACED/ under spin_lock(siglock)."
    
    This breaks the ordering scheme introduced by commit:
    
      dbfb089d360b ("sched: Fix loadavg accounting race")
    
    Specifically, the reload not matching no longer implies we don't have
    to block.
    
    Simply things by noting that what we need is a LOAD->STORE ordering
    and this can be provided by a control dependency.
    
    So replace:
    
            prev_state = prev->state;
            raw_spin_lock(&rq->lock);
            smp_mb__after_spinlock(); /* SMP-MB */
            if (... && prev_state && prev_state == prev->state)
                    deactivate_task();
    
    with:
    
            prev_state = prev->state;
            if (... && prev_state) /* CTRL-DEP */
                    deactivate_task();
    
    Since that already implies the 'prev->state' load must be complete
    before allowing the 'prev->on_rq = 0' store to become visible.
    
    Fixes: dbfb089d360b ("sched: Fix loadavg accounting race")
    Reported-by: Jiri Slaby <jirislaby at kernel.org>
    Signed-off-by: Peter Zijlstra (Intel) <peterz at infradead.org>
    Acked-by: Oleg Nesterov <oleg at redhat.com>
    Tested-by: Paul Gortmaker <paul.gortmaker at windriver.com>
    Tested-by: Christian Brauner <christian.brauner at ubuntu.com>

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e15543cb8481..5dece9b34e25 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4119,9 +4119,6 @@ static void __sched notrace __schedule(bool preempt)
 	local_irq_disable();
 	rcu_note_context_switch(preempt);
 
-	/* See deactivate_task() below. */
-	prev_state = prev->state;
-
 	/*
 	 * Make sure that signal_pending_state()->signal_pending() below
 	 * can't be reordered with __set_current_state(TASK_INTERRUPTIBLE)
@@ -4145,11 +4142,16 @@ static void __sched notrace __schedule(bool preempt)
 	update_rq_clock(rq);
 
 	switch_count = &prev->nivcs