[openchrome-devel] drm-openchrome: Branch 'drm-next-5.11' - 1899 commits - arch/alpha/kernel arch/arc/include arch/arc/kernel arch/arc/mm arch/arm64/boot arch/arm64/include arch/arm64/Kconfig arch/arm64/kernel arch/arm64/kvm arch/arm64/Makefile arch/arm64/mm arch/arm/boot arch/arm/configs arch/arm/include arch/arm/Kconfig arch/arm/kernel arch/arm/mach-imx arch/arm/mach-keystone arch/arm/mach-omap1 arch/arm/mach-omap2 arch/arm/mach-sunxi arch/arm/Makefile arch/arm/probes arch/csky/kernel arch/h8300/kernel arch/hexagon/kernel arch/ia64/include arch/ia64/kernel arch/Kconfig arch/microblaze/kernel arch/mips/alchemy arch/mips/include arch/mips/kernel arch/mips/mm arch/nios2/kernel arch/openrisc/kernel arch/parisc/kernel arch/powerpc/include arch/powerpc/Kconfig arch/powerpc/kernel arch/powerpc/kvm arch/powerpc/lib arch/powerpc/Makefile arch/powerpc/mm arch/powerpc/perf arch/powerpc/platforms arch/riscv/include arch/riscv/kernel arch/s390/configs arch/s390/kernel arch/s390/kvm arch/s390/lib arch/s39 0/mm arch/s390/pci arch/sh/kernel arch/sparc/kernel arch/sparc/lib arch/um/include arch/um/kernel arch/x86/boot arch/x86/events arch/x86/include arch/x86/Kconfig arch/x86/kernel arch/x86/kvm arch/x86/lib arch/x86/Makefile arch/x86/mm arch/x86/platform arch/x86/xen arch/xtensa/include arch/xtensa/mm block/blk-cgroup.c block/blk-flush.c block/blk-merge.c block/blk-settings.c block/genhd.c block/keyslot-manager.c CREDITS Documentation/ABI/testing Documentation/admin-guide/bootconfig.rst Documentation/admin-guide/kernel-parameters.txt Documentation/devicetree/bindings Documentation/dev-tools/kunit Documentation/driver-api/dma-buf.rst Documentation/driver-api/media Documentation/filesystems/ext4 Documentation/filesystems/journalling.rst Documentation/firmware-guide/acpi Documentation/kbuild/llvm.rst Documentation/networking/netdev-FAQ.rst Documentation/networking/phy.rst Documentation/process/stable-kernel-rules.rst Documentation/translations/it_IT Documentation/virt/kvm Documentation/xt ensa/mmu.rst drivers/accessibility/speakup drivers/acpi/acpi_video.c drivers/acpi/apei drivers/acpi/arm64 drivers/acpi/battery.c drivers/acpi/button.c drivers/acpi/dptf drivers/acpi/event.c drivers/acpi/evged.c drivers/acpi/fan.c drivers/acpi/internal.h drivers/acpi/nfit drivers/acpi/pci_irq.c drivers/acpi/pci_link.c drivers/acpi/pci_mcfg.c drivers/acpi/power.c drivers/acpi/processor_perflib.c drivers/acpi/sbs.c drivers/acpi/sbshc.c drivers/acpi/sbshc.h drivers/acpi/scan.c drivers/acpi/video_detect.c drivers/acpi/wakeup.c drivers/atm/nicstar.c drivers/block/loop.c drivers/block/nbd.c drivers/block/xen-blkback drivers/bus/ti-sysc.c drivers/char/agp drivers/char/virtio_console.c drivers/clk/imx drivers/clk/meson drivers/clk/qcom drivers/clk/renesas drivers/counter/ti-eqep.c drivers/cpufreq/cpufreq.c drivers/cpufreq/cpufreq_governor.h drivers/cpufreq/cpufreq_performance.c drivers/cpufreq/cpufreq_powersave.c drivers/cpufreq/intel_pstate.c drivers/cpufreq/scmi-cpufreq.c drivers/cpufreq/t egra186-cpufreq.c drivers/cpuidle/cpuidle-tegra.c drivers/dax/Kconfig drivers/dma-buf/dma-buf.c drivers/dma-buf/dma-resv.c drivers/dma-buf/heaps drivers/dma/dmaengine.c drivers/dma/idxd drivers/dma/ioat drivers/dma/pl330.c drivers/dma/ti drivers/dma/xilinx drivers/firmware/efi drivers/firmware/xilinx drivers/fpga/Kconfig drivers/gpio/gpio-arizona.c drivers/gpio/gpio-aspeed.c drivers/gpio/gpio-dwapb.c drivers/gpio/gpio-eic-sprd.c drivers/gpio/gpiolib.c drivers/gpio/gpiolib-cdev.h drivers/gpio/gpio-mvebu.c drivers/gpio/gpio-omap.c drivers/gpio/gpio-pcie-idio-24.c drivers/gpio/gpio-sifive.c drivers/gpio/gpio-zynq.c drivers/gpu/drm drivers/hid/hid-cypress.c drivers/hid/hid-ids.h drivers/hid/hid-input.c drivers/hid/hid-ite.c drivers/hid/hid-logitech-dj.c drivers/hid/hid-logitech-hidpp.c drivers/hid/hid-mcp2221.c drivers/hid/hid-quirks.c drivers/hid/hid-sensor-hub.c drivers/hid/hid-uclogic-core.c drivers/hid/hid-uclogic-params.c drivers/hid/i2c-hid drivers/hv/hv.c drivers/hwmon/amd_energy .c drivers/hwmon/applesmc.c drivers/hwmon/pmbus drivers/hwmon/pwm-fan.c drivers/i2c/busses drivers/idle/intel_idle.c drivers/iio/accel drivers/iio/adc drivers/iio/common drivers/iio/imu drivers/iio/light drivers/infiniband/core drivers/infiniband/hw drivers/infiniband/Kconfig drivers/infiniband/sw drivers/input/joystick drivers/input/keyboard drivers/input/misc drivers/input/mouse drivers/input/serio drivers/input/touchscreen drivers/interconnect/core.c drivers/interconnect/qcom drivers/iommu/amd drivers/iommu/arm drivers/iommu/intel drivers/iommu/iommu.c drivers/irqchip/irq-gic-v3-its.c drivers/irqchip/irq-sni-exiu.c drivers/Makefile drivers/md/dm.c drivers/md/dm-cache-target.c drivers/md/dm-integrity.c drivers/md/dm-raid.c drivers/md/dm-table.c drivers/md/dm-writecache.c drivers/md/md.c drivers/md/md.h drivers/md/raid0.c drivers/md/raid10.c drivers/md/raid10.h drivers/media/cec drivers/media/common drivers/media/platform drivers/media/rc drivers/media/test-drivers drivers/misc/eep rom drivers/misc/habanalabs drivers/misc/mei drivers/mmc/core drivers/mmc/host drivers/mtd/nand drivers/net/bonding drivers/net/can drivers/net/dsa drivers/net/ethernet drivers/net/geneve.c drivers/net/ipa drivers/net/netdevsim drivers/net/phy drivers/net/tun.c drivers/net/usb drivers/net/vrf.c drivers/net/vxlan.c drivers/net/wan drivers/net/wireless drivers/nfc/s3fwrn5 drivers/nvme/host drivers/of/address.c drivers/phy/broadcom drivers/phy/intel drivers/phy/mediatek drivers/phy/motorola drivers/phy/qualcomm drivers/phy/tegra drivers/pinctrl/aspeed drivers/pinctrl/intel drivers/pinctrl/pinctrl-amd.c drivers/pinctrl/pinctrl-ingenic.c drivers/pinctrl/pinctrl-mcp23s08_spi.c drivers/pinctrl/pinctrl-rockchip.c drivers/pinctrl/qcom drivers/platform/x86 drivers/powercap/powercap_sys.c drivers/ptp/ptp_clockmatrix.c drivers/pwm/pwm-sl28cpld.c drivers/regulator/core.c drivers/regulator/pfuze100-regulator.c drivers/regulator/ti-abb-regulator.c drivers/s390/block drivers/s390/net drivers/scsi/b e2iscsi drivers/scsi/bnx2i drivers/scsi/hisi_sas drivers/scsi/libiscsi.c drivers/scsi/megaraid drivers/scsi/mpt3sas drivers/scsi/scsi_lib.c drivers/scsi/storvsc_drv.c drivers/scsi/ufs drivers/soc/fsl drivers/spi/spi-bcm2835aux.c drivers/spi/spi-bcm2835.c drivers/spi/spi-bcm-qspi.c drivers/spi/spi.c drivers/spi/spi-cadence-quadspi.c drivers/spi/spi-dw-core.c drivers/spi/spi-fsi.c drivers/spi/spi-fsl-lpspi.c drivers/spi/spi-imx.c drivers/spi/spi-npcm-fiu.c drivers/spi/spi-nxp-fspi.c drivers/staging/android drivers/staging/media drivers/staging/mt7621-pci drivers/staging/ralink-gdma drivers/staging/rtl8723bs drivers/target/iscsi drivers/tee/amdtee drivers/tee/optee drivers/thermal/ti-soc-thermal drivers/thunderbolt/debugfs.c drivers/thunderbolt/icm.c drivers/thunderbolt/nhi.c drivers/thunderbolt/nhi.h drivers/thunderbolt/tb.h drivers/thunderbolt/usb4.c drivers/thunderbolt/xdomain.c drivers/tty/serial drivers/tty/tty_io.c drivers/tty/tty_jobctrl.c drivers/uio/uio.c drivers/usb/cdns3 dri vers/usb/class drivers/usb/core drivers/usb/gadget drivers/usb/host drivers/usb/musb drivers/usb/serial drivers/usb/storage drivers/usb/typec drivers/vdpa/Kconfig drivers/vhost/scsi.c drivers/vhost/vdpa.c drivers/vhost/vhost.c drivers/vhost/vhost.h drivers/vhost/vringh.c drivers/video/fbdev drivers/virt/nitro_enclaves drivers/xen/grant-table.c drivers/xen/swiotlb-xen.c drivers/xen/unpopulated-alloc.c drivers/xen/xen-scsiback.c fs/9p/vfs_file.c fs/afs/dir.c fs/afs/inode.c fs/afs/internal.h fs/afs/super.c fs/afs/write.c fs/aio.c fs/btrfs/block-rsv.c fs/btrfs/ctree.h fs/btrfs/dev-replace.c fs/btrfs/file.c fs/btrfs/inode.c fs/btrfs/ioctl.c fs/btrfs/qgroup.c fs/btrfs/ref-verify.c fs/btrfs/relocation.c fs/btrfs/scrub.c fs/btrfs/tests fs/btrfs/tree-checker.c fs/btrfs/volumes.c fs/cifs/cifsacl.c fs/cifs/connect.c fs/cifs/smb2ops.c fs/cifs/smb2pdu.c fs/cifs/smb2pdu.h fs/cifs/transport.c fs/coredump.c fs/crypto/inline_crypt.c fs/crypto/keysetup.c fs/efivarfs/inode.c fs/erofs/inode.c fs/erofs/ zdata.c fs/ext4/ext4.h fs/ext4/extents.c fs/ext4/fast_commit.c fs/ext4/fast_commit.h fs/ext4/file.c fs/ext4/fsmap.c fs/ext4/fsync.c fs/ext4/inline.c fs/ext4/inode.c fs/ext4/mballoc.c fs/ext4/namei.c fs/ext4/super.c fs/gfs2/aops.c fs/gfs2/bmap.c fs/gfs2/glock.c fs/gfs2/glops.c fs/gfs2/incore.h fs/gfs2/inode.c fs/gfs2/log.c fs/gfs2/rgrp.c fs/io_uring.c fs/jbd2/checkpoint.c fs/jbd2/commit.c fs/jbd2/journal.c fs/jbd2/recovery.c fs/jbd2/transaction.c fs/libfs.c fs/nfs/dir.c fs/nfsd/nfs3proc.c fs/nfsd/nfs3xdr.c fs/nfsd/nfs4proc.c fs/nfs/flexfilelayout fs/nfs/Kconfig fs/nfs/nfs42proc.c fs/nfs/nfs42xattr.c fs/nfs/nfs42xdr.c fs/nfs/nfs4file.c fs/nfs/nfs4proc.c fs/nfs/nfsroot.c fs/nfs/pagelist.c fs/notify/fsnotify.c fs/ocfs2/journal.c fs/ocfs2/super.c fs/proc/self.c fs/proc/task_mmu.c fs/seq_file.c fs/super.c fs/xfs/libxfs fs/xfs/scrub fs/xfs/xfs_iomap.c fs/xfs/xfs_iwalk.c fs/xfs/xfs_mount.c fs/xfs/xfs_pnfs.c fs/zonefs/super.c include/asm-generic/barrier.h include/asm-generic/percpu.h include /drm/drm_fb_helper.h include/drm/drm_gem_shmem_helper.h include/drm/drm_modeset_helper_vtables.h include/drm/drm_modes.h include/kunit/test.h include/linux/blkdev.h include/linux/bootconfig.h include/linux/build_bug.h include/linux/compiler-clang.h include/linux/compiler-gcc.h include/linux/compiler.h include/linux/compiler_types.h include/linux/cpufreq.h include/linux/dma-buf-map.h include/linux/elfcore.h include/linux/filter.h include/linux/firmware include/linux/fs.h include/linux/genhd.h include/linux/intel-iommu.h include/linux/irqdomain.h include/linux/jbd2.h include/linux/memcontrol.h include/linux/memory_hotplug.h include/linux/mlx5 include/linux/mm.h include/linux/netdevice.h include/linux/netfilter include/linux/nfs_page.h include/linux/numa.h include/linux/pagemap.h include/linux/perf_event.h include/linux/perf_regs.h include/linux/pgtable.h include/linux/platform_data include/linux/pm_runtime.h include/linux/sched.h include/linux/security.h include/linux/spi include/linu x/stmmac.h include/linux/swiotlb.h include/linux/tty.h include/linux/zsmalloc.h include/net/bonding.h include/net/inet_ecn.h include/net/inet_hashtables.h include/net/ip_tunnels.h include/net/ipv6_frag.h include/net/neighbour.h include/net/netfilter include/net/tls.h include/net/xdp.h include/net/xdp_sock.h include/net/xsk_buff_pool.h include/scsi/libiscsi.h include/soc/mscc include/sound/rt1015.h include/trace/events include/uapi/drm include/uapi/linux include/xen/grant_table.h init/initramfs.c init/Kconfig init/main.c kernel/bpf/bpf_lsm.c kernel/bpf/core.c kernel/bpf/hashtab.c kernel/bpf/helpers.c kernel/bpf/Makefile kernel/bpf/preload kernel/bpf/verifier.c kernel/cpu.c kernel/dma/swiotlb.c kernel/elfcore.c kernel/events/core.c kernel/events/internal.h kernel/events/ring_buffer.c kernel/exit.c kernel/fail_function.c kernel/futex.c kernel/irq/irqdomain.c kernel/locking/lockdep.c kernel/Makefile kernel/panic.c kernel/printk/printk.c kernel/printk/printk_ringbuffer.c kernel/ptrace.c kernel/rcu/tree.c kernel/rcu/tree_stall.h kernel/reboot.c kernel/sched/core.c kernel/sched/cpufreq_schedutil.c kernel/sched/deadline.c kernel/sched/debug.c kernel/sched/fair.c kernel/sched/idle.c kernel/sched/membarrier.c kernel/seccomp.c kernel/trace/bpf_trace.c kernel/trace/ftrace.c kernel/trace/Kconfig kernel/trace/ring_buffer.c kernel/trace/trace.c kernel/trace/trace_hwlat.c kernel/watchdog.c lib/Makefile lib/strncpy_from_user.c lib/syscall.c lib/zlib_dfltcc/dfltcc_inflate.c .mailmap MAINTAINERS Makefile mm/compaction.c mm/filemap.c mm/gup.c mm/huge_memory.c mm/hugetlb.c mm/hugetlb_cgroup.c mm/kasan/quarantine.c mm/Kconfig mm/list_lru.c mm/madvise.c mm/memcontrol.c mm/memory-failure.c mm/memory_hotplug.c mm/migrate.c mm/mmap.c mm/page_alloc.c mm/page-writeback.c mm/percpu.c mm/rmap.c mm/slab.h mm/slub.c mm/swapfile.c mm/util.c mm/vmscan.c mm/zsmalloc.c net/batman-adv/fragmentation.c net/batman-adv/hard-interface.c net/batman-adv/log.c net/bridge/br_device.c net/bridge/br_multica st.c net/bridge/br_netfilter_hooks.c net/bridge/br_private.h net/bridge/br_vlan.c net/can/af_can.c net/can/isotp.c net/core/dev.c net/core/devlink.c net/core/flow_offload.c net/core/gro_cells.c net/core/lwt_bpf.c net/core/neighbour.c net/core/netpoll.c net/core/skbuff.c net/core/skmsg.c net/core/xdp.c net/dccp/ipv4.c net/dccp/ipv6.c net/ethtool/bitset.c net/ethtool/features.c net/ipv4/arp.c net/ipv4/fib_frontend.c net/ipv4/inet_connection_sock.c net/ipv4/inet_diag.c net/ipv4/inet_hashtables.c net/ipv4/ip_tunnel_core.c net/ipv4/netfilter net/ipv4/route.c net/ipv4/syncookies.c net/ipv4/tcp_bbr.c net/ipv4/tcp_bpf.c net/ipv4/tcp_cong.c net/ipv4/tcp_input.c net/ipv4/tcp_ipv4.c net/ipv4/tcp_output.c net/ipv4/udp.c net/ipv4/udp_offload.c net/ipv6/addrconf.c net/ipv6/addrlabel.c net/ipv6/ah6.c net/ipv6/ip6_gre.c net/ipv6/ndisc.c net/ipv6/netfilter net/ipv6/reassembly.c net/ipv6/sit.c net/ipv6/syncookies.c net/ipv6/tcp_ipv6.c net/ipv6/udp_offload.c net/iucv/af_iucv.c net/mac80211/iface.c net /mac80211/mesh_pathtbl.c net/mac80211/rc80211_minstrel.c net/mac80211/rc80211_minstrel.h net/mac80211/sta_info.c net/mac80211/status.c net/mac80211/util.c net/mptcp/mib.c net/mptcp/protocol.c net/mptcp/subflow.c net/ncsi/ncsi-manage.c net/ncsi/ncsi-netlink.c net/ncsi/ncsi-netlink.h net/netfilter/ipset net/netfilter/ipvs net/netfilter/nf_tables_api.c net/netfilter/nf_tables_offload.c net/netfilter/nft_cmp.c net/netfilter/nft_ct.c net/netfilter/nft_dynset.c net/netfilter/nft_meta.c net/netfilter/nft_payload.c net/netfilter/x_tables.c net/netlabel/netlabel_unlabeled.c net/openvswitch/actions.c net/openvswitch/flow_netlink.c net/packet/af_packet.c net/rfkill/core.c net/rose/rose_loopback.c net/sched/act_mpls.c net/sched/cls_flower.c net/sched/sch_fq_pie.c net/sctp/input.c net/sctp/sm_sideeffect.c net/sctp/transport.c net/smc/af_smc.c net/smc/smc_core.c net/smc/smc_ib.c net/sunrpc/sysctl.c net/tipc/node.c net/tipc/topsrv.c net/tls/tls_device.c net/tls/tls_sw.c net/vmw_vsock/af_vsock.c ne t/vmw_vsock/virtio_transport_common.c net/wireless/nl80211.c net/x25/af_x25.c net/xdp/xdp_umem.c net/xdp/xdp_umem.h net/xdp/xsk_buff_pool.c net/xdp/xsk.c net/xdp/xsk_queue.h net/xfrm/xfrm_compat.c net/xfrm/xfrm_state.c samples/bpf/task_fd_query_user.c samples/bpf/tracex2_user.c samples/bpf/tracex3_user.c samples/bpf/xdp_redirect_cpu_user.c samples/bpf/xdp_rxq_info_user.c samples/ftrace/ftrace-direct.c samples/ftrace/ftrace-direct-modify.c samples/ftrace/ftrace-direct-too.c scripts/bpf_helpers_doc.py scripts/lld-version.sh scripts/Makefile.build scripts/Makefile.extrawarn scripts/package/builddeb security/selinux/ibpkey.c sound/core/control.c sound/firewire/fireworks sound/pci/hda sound/pci/mixart sound/soc/codecs sound/soc/intel sound/soc/qcom sound/usb/card.c sound/usb/mixer_maps.c sound/usb/mixer_us16x08.c sound/usb/quirks.c tools/arch/x86 tools/bootconfig/main.c tools/bootconfig/test-bootconfig.sh tools/bpf/bpftool tools/include/uapi tools/kvm/kvm_stat tools/lib/bpf tools/perf/ar ch tools/perf/bench tools/perf/builtin-diff.c tools/perf/builtin-inject.c tools/perf/builtin-lock.c tools/perf/tests tools/perf/util tools/power/x86 tools/testing/ktest tools/testing/kunit tools/testing/scatterlist tools/testing/selftests

Kevin Brace kevinbrace at kemper.freedesktop.org
Sat Dec 19 01:57:36 UTC 2020


 .mailmap                                                          |    8 
 CREDITS                                                           |   67 
 Documentation/ABI/testing/sysfs-bus-iio-timer-stm32               |   24 
 Documentation/admin-guide/bootconfig.rst                          |   20 
 Documentation/admin-guide/kernel-parameters.txt                   |    7 
 Documentation/dev-tools/kunit/faq.rst                             |    2 
 Documentation/dev-tools/kunit/style.rst                           |   18 
 Documentation/dev-tools/kunit/usage.rst                           |   10 
 Documentation/devicetree/bindings/clock/imx5-clock.yaml           |    2 
 Documentation/devicetree/bindings/display/brcm,bcm2711-hdmi.yaml  |    6 
 Documentation/devicetree/bindings/display/panel/panel-simple.yaml |    2 
 Documentation/devicetree/bindings/net/can/fsl,flexcan.yaml        |   18 
 Documentation/devicetree/bindings/net/can/tcan4x5x.txt            |    2 
 Documentation/devicetree/bindings/net/nfc/nxp-nci.txt             |    2 
 Documentation/devicetree/bindings/net/nfc/pn544.txt               |    2 
 Documentation/devicetree/bindings/sound/rt1015.txt                |    6 
 Documentation/driver-api/dma-buf.rst                              |    2 
 Documentation/driver-api/media/drivers/vidtv.rst                  |  120 
 Documentation/filesystems/ext4/journal.rst                        |    6 
 Documentation/filesystems/ext4/super.rst                          |    7 
 Documentation/filesystems/journalling.rst                         |    6 
 Documentation/firmware-guide/acpi/acpi-lid.rst                    |    8 
 Documentation/firmware-guide/acpi/gpio-properties.rst             |   55 
 Documentation/firmware-guide/acpi/method-tracing.rst              |    2 
 Documentation/kbuild/llvm.rst                                     |    5 
 Documentation/networking/netdev-FAQ.rst                           |   30 
 Documentation/networking/phy.rst                                  |    4 
 Documentation/process/stable-kernel-rules.rst                     |    2 
 Documentation/translations/it_IT/process/stable-kernel-rules.rst  |    2 
 Documentation/virt/kvm/api.rst                                    |    5 
 Documentation/virt/kvm/mmu.rst                                    |    2 
 Documentation/xtensa/mmu.rst                                      |    9 
 MAINTAINERS                                                       |  157 -
 Makefile                                                          |   16 
 arch/Kconfig                                                      |    9 
 arch/alpha/kernel/process.c                                       |    2 
 arch/arc/include/asm/bitops.h                                     |    4 
 arch/arc/include/asm/pgtable.h                                    |    2 
 arch/arc/kernel/stacktrace.c                                      |   56 
 arch/arc/mm/tlb.c                                                 |   24 
 arch/arm/Kconfig                                                  |    1 
 arch/arm/Makefile                                                 |    4 
 arch/arm/boot/compressed/Makefile                                 |    4 
 arch/arm/boot/compressed/head.S                                   |    3 
 arch/arm/boot/dts/am437x-l4.dtsi                                  |    2 
 arch/arm/boot/dts/dra76x.dtsi                                     |    4 
 arch/arm/boot/dts/exynos4412-odroid-common.dtsi                   |    1 
 arch/arm/boot/dts/imx50-evk.dts                                   |    2 
 arch/arm/boot/dts/imx6q-prti6q.dts                                |    4 
 arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi                     |    2 
 arch/arm/boot/dts/imx6qdl-udoo.dtsi                               |    2 
 arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi                    |    1 
 arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts                           |    3 
 arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi                     |   19 
 arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi                      |    2 
 arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi                      |    4 
 arch/arm/boot/dts/sun6i-a31-hummingbird.dts                       |    2 
 arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts                  |    2 
 arch/arm/boot/dts/sun7i-a20-bananapi.dts                          |    2 
 arch/arm/boot/dts/sun7i-a20-cubietruck.dts                        |    2 
 arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts                     |    4 
 arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts                      |    2 
 arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts                  |    2 
 arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts                   |    5 
 arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts                    |    2 
 arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts                 |    2 
 arch/arm/boot/dts/sun8i-s3-pinecube.dts                           |    2 
 arch/arm/boot/dts/sun8i-v3s.dtsi                                  |    2 
 arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts                 |   12 
 arch/arm/boot/dts/sun9i-a80-cubieboard4.dts                       |    2 
 arch/arm/boot/dts/sun9i-a80-optimus.dts                           |    2 
 arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi                     |    2 
 arch/arm/boot/dts/vf610-zii-dev-rev-b.dts                         |    3 
 arch/arm/configs/omap2plus_defconfig                              |    1 
 arch/arm/include/asm/kprobes.h                                    |   22 
 arch/arm/include/asm/pgtable-2level.h                             |    2 
 arch/arm/include/asm/pgtable-3level.h                             |    2 
 arch/arm/kernel/perf_regs.c                                       |    3 
 arch/arm/kernel/process.c                                         |    2 
 arch/arm/mach-imx/anatop.c                                        |    2 
 arch/arm/mach-keystone/memory.h                                   |    3 
 arch/arm/mach-omap1/board-osk.c                                   |    2 
 arch/arm/mach-omap2/Kconfig                                       |    3 
 arch/arm/mach-omap2/cpuidle44xx.c                                 |    8 
 arch/arm/mach-sunxi/sunxi.c                                       |    1 
 arch/arm/probes/kprobes/opt-arm.c                                 |   18 
 arch/arm64/Kconfig                                                |    1 
 arch/arm64/Makefile                                               |    4 
 arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts         |    2 
 arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts         |    2 
 arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts          |    2 
 arch/arm64/boot/dts/allwinner/sun50i-a64-pinetab.dts              |    3 
 arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts     |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts   |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo-plus2.dts      |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts          |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts        |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts           |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dts     |    2 
 arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts              |    2 
 arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts            |    2 
 arch/arm64/boot/dts/altera/socfpga_stratix10_socdk_nand.dts       |    2 
 arch/arm64/boot/dts/broadcom/stingray/stingray-usb.dtsi           |   20 
 arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28.dts        |    1 
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi                    |    1 
 arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi                    |    1 
 arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi                    |    1 
 arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi              |    2 
 arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi                     |    1 
 arch/arm64/boot/dts/freescale/imx8mm-var-som.dtsi                 |    9 
 arch/arm64/boot/dts/freescale/imx8mm.dtsi                         |    2 
 arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts                 |    1 
 arch/arm64/boot/dts/freescale/imx8mn-evk.dts                      |    1 
 arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi                 |    9 
 arch/arm64/boot/dts/freescale/imx8mn.dtsi                         |   30 
 arch/arm64/boot/dts/freescale/qoriq-fman3-0.dtsi                  |    1 
 arch/arm64/boot/dts/intel/socfpga_agilex_socdk.dts                |    2 
 arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts                |   12 
 arch/arm64/boot/dts/nvidia/tegra194-p3668-0000.dtsi               |    2 
 arch/arm64/boot/dts/nvidia/tegra194.dtsi                          |    2 
 arch/arm64/boot/dts/nvidia/tegra210-p2597.dtsi                    |   20 
 arch/arm64/boot/dts/nvidia/tegra234-sim-vdk.dts                   |    6 
 arch/arm64/boot/dts/qcom/ipq6018.dtsi                             |   72 
 arch/arm64/boot/dts/renesas/r8a774e1.dtsi                         |    6 
 arch/arm64/boot/dts/rockchip/rk3326-odroid-go2.dts                |    1 
 arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s.dts                |    2 
 arch/arm64/boot/dts/rockchip/rk3399-roc-pc.dtsi                   |    4 
 arch/arm64/boot/dts/rockchip/rk3399.dtsi                          |    3 
 arch/arm64/include/asm/cpufeature.h                               |    2 
 arch/arm64/include/asm/cputype.h                                  |    4 
 arch/arm64/include/asm/daifflags.h                                |    3 
 arch/arm64/include/asm/esr.h                                      |    1 
 arch/arm64/include/asm/exception.h                                |    5 
 arch/arm64/include/asm/kvm_emulate.h                              |    5 
 arch/arm64/include/asm/kvm_host.h                                 |    2 
 arch/arm64/include/asm/pgtable.h                                  |   34 
 arch/arm64/include/asm/probes.h                                   |    2 
 arch/arm64/include/asm/ptrace.h                                   |    4 
 arch/arm64/include/asm/sysreg.h                                   |    6 
 arch/arm64/kernel/cpu_errata.c                                    |    2 
 arch/arm64/kernel/cpufeature.c                                    |    2 
 arch/arm64/kernel/entry-common.c                                  |  254 +
 arch/arm64/kernel/entry.S                                         |   78 
 arch/arm64/kernel/irq.c                                           |   15 
 arch/arm64/kernel/kexec_image.c                                   |    2 
 arch/arm64/kernel/perf_regs.c                                     |    3 
 arch/arm64/kernel/process.c                                       |   15 
 arch/arm64/kernel/proton-pack.c                                   |    1 
 arch/arm64/kernel/psci.c                                          |    5 
 arch/arm64/kernel/sdei.c                                          |    7 
 arch/arm64/kernel/smp.c                                           |    1 
 arch/arm64/kernel/syscall.c                                       |    1 
 arch/arm64/kernel/traps.c                                         |   22 
 arch/arm64/kvm/arm.c                                              |   16 
 arch/arm64/kvm/hyp/nvhe/hyp.lds.S                                 |    5 
 arch/arm64/kvm/hyp/pgtable.c                                      |   17 
 arch/arm64/kvm/mmu.c                                              |   13 
 arch/arm64/kvm/sys_regs.c                                         |  191 -
 arch/arm64/kvm/sys_regs.h                                         |   16 
 arch/arm64/kvm/vgic/vgic-mmio-v3.c                                |   22 
 arch/arm64/mm/fault.c                                             |   25 
 arch/arm64/mm/mmu.c                                               |   17 
 arch/csky/kernel/perf_regs.c                                      |    3 
 arch/csky/kernel/process.c                                        |    2 
 arch/h8300/kernel/process.c                                       |    2 
 arch/hexagon/kernel/process.c                                     |    2 
 arch/ia64/include/asm/sparsemem.h                                 |    6 
 arch/ia64/kernel/process.c                                        |    2 
 arch/microblaze/kernel/process.c                                  |    2 
 arch/mips/alchemy/common/clock.c                                  |    9 
 arch/mips/include/asm/pgtable-32.h                                |    3 
 arch/mips/kernel/idle.c                                           |   12 
 arch/mips/kernel/setup.c                                          |    6 
 arch/mips/mm/tlb-r4k.c                                            |    1 
 arch/nios2/kernel/process.c                                       |    2 
 arch/openrisc/kernel/process.c                                    |    2 
 arch/parisc/kernel/process.c                                      |    2 
 arch/powerpc/Kconfig                                              |    1 
 arch/powerpc/Makefile                                             |    2 
 arch/powerpc/include/asm/book3s/32/pgtable.h                      |    2 
 arch/powerpc/include/asm/book3s/64/kup-radix.h                    |   68 
 arch/powerpc/include/asm/book3s/64/mmu.h                          |   12 
 arch/powerpc/include/asm/exception-64s.h                          |   12 
 arch/powerpc/include/asm/feature-fixups.h                         |   19 
 arch/powerpc/include/asm/kup.h                                    |   26 
 arch/powerpc/include/asm/mmzone.h                                 |    5 
 arch/powerpc/include/asm/nohash/32/pgtable.h                      |    2 
 arch/powerpc/include/asm/security_features.h                      |    7 
 arch/powerpc/include/asm/setup.h                                  |    4 
 arch/powerpc/include/asm/sparsemem.h                              |    5 
 arch/powerpc/kernel/exceptions-64s.S                              |   93 
 arch/powerpc/kernel/head_book3s_32.S                              |    3 
 arch/powerpc/kernel/idle.c                                        |    4 
 arch/powerpc/kernel/setup_64.c                                    |  122 
 arch/powerpc/kernel/syscall_64.c                                  |    2 
 arch/powerpc/kernel/vmlinux.lds.S                                 |   14 
 arch/powerpc/kvm/book3s_xive.c                                    |    7 
 arch/powerpc/kvm/book3s_xive_native.c                             |    7 
 arch/powerpc/lib/feature-fixups.c                                 |  104 
 arch/powerpc/mm/Makefile                                          |    2 
 arch/powerpc/mm/book3s64/hash_native.c                            |   23 
 arch/powerpc/mm/book3s64/mmu_context.c                            |   20 
 arch/powerpc/mm/maccess.c                                         |    9 
 arch/powerpc/mm/mem.c                                             |    1 
 arch/powerpc/mm/numa.c                                            |    3 
 arch/powerpc/perf/imc-pmu.c                                       |    2 
 arch/powerpc/perf/perf_regs.c                                     |    3 
 arch/powerpc/platforms/powermac/smp.c                             |    2 
 arch/powerpc/platforms/powernv/setup.c                            |   33 
 arch/powerpc/platforms/powernv/smp.c                              |    3 
 arch/powerpc/platforms/pseries/hotplug-cpu.c                      |    3 
 arch/powerpc/platforms/pseries/mobility.c                         |    4 
 arch/powerpc/platforms/pseries/msi.c                              |    3 
 arch/powerpc/platforms/pseries/pseries.h                          |    2 
 arch/powerpc/platforms/pseries/setup.c                            |   15 
 arch/riscv/include/asm/pgtable-32.h                               |    2 
 arch/riscv/include/asm/timex.h                                    |    4 
 arch/riscv/include/asm/vdso/processor.h                           |    2 
 arch/riscv/kernel/perf_regs.c                                     |    3 
 arch/riscv/kernel/process.c                                       |    2 
 arch/riscv/kernel/setup.c                                         |    1 
 arch/riscv/kernel/vdso/Makefile                                   |    2 
 arch/s390/configs/debug_defconfig                                 |    1 
 arch/s390/kernel/asm-offsets.c                                    |   10 
 arch/s390/kernel/entry.S                                          |   19 
 arch/s390/kernel/idle.c                                           |    6 
 arch/s390/kernel/perf_cpum_sf.c                                   |    4 
 arch/s390/kernel/perf_regs.c                                      |    3 
 arch/s390/kernel/uv.c                                             |    9 
 arch/s390/kvm/kvm-s390.c                                          |    4 
 arch/s390/kvm/pv.c                                                |    3 
 arch/s390/lib/delay.c                                             |    5 
 arch/s390/mm/gmap.c                                               |    2 
 arch/s390/pci/pci_irq.c                                           |   14 
 arch/sh/kernel/idle.c                                             |    2 
 arch/sparc/kernel/leon_pmc.c                                      |    4 
 arch/sparc/kernel/process_32.c                                    |    2 
 arch/sparc/kernel/process_64.c                                    |    4 
 arch/sparc/lib/csum_copy.S                                        |    2 
 arch/um/include/asm/pgalloc.h                                     |    8 
 arch/um/kernel/process.c                                          |    2 
 arch/x86/Kconfig                                                  |    1 
 arch/x86/Makefile                                                 |    3 
 arch/x86/boot/compressed/Makefile                                 |    4 
 arch/x86/boot/compressed/sev-es.c                                 |    5 
 arch/x86/events/intel/core.c                                      |   12 
 arch/x86/events/intel/cstate.c                                    |    6 
 arch/x86/events/intel/ds.c                                        |   57 
 arch/x86/events/intel/uncore.c                                    |    4 
 arch/x86/events/intel/uncore.h                                    |   12 
 arch/x86/events/intel/uncore_snb.c                                |    2 
 arch/x86/events/perf_event.h                                      |    3 
 arch/x86/events/rapl.c                                            |   14 
 arch/x86/include/asm/insn.h                                       |   15 
 arch/x86/include/asm/kvm_host.h                                   |    2 
 arch/x86/include/asm/mwait.h                                      |    2 
 arch/x86/include/asm/perf_event.h                                 |    4 
 arch/x86/include/asm/pgtable_types.h                              |    1 
 arch/x86/include/asm/sparsemem.h                                  |   10 
 arch/x86/include/asm/sync_core.h                                  |    9 
 arch/x86/include/asm/uv/uv.h                                      |   10 
 arch/x86/kernel/apic/vector.c                                     |   24 
 arch/x86/kernel/apic/x2apic_uv_x.c                                |    8 
 arch/x86/kernel/cpu/bugs.c                                        |    4 
 arch/x86/kernel/cpu/mce/core.c                                    |    6 
 arch/x86/kernel/cpu/microcode/intel.c                             |   63 
 arch/x86/kernel/cpu/resctrl/core.c                                |    4 
 arch/x86/kernel/cpu/resctrl/internal.h                            |    3 
 arch/x86/kernel/cpu/resctrl/monitor.c                             |    6 
 arch/x86/kernel/cpu/resctrl/rdtgroup.c                            |   74 
 arch/x86/kernel/dumpstack.c                                       |   23 
 arch/x86/kernel/kprobes/opt.c                                     |   22 
 arch/x86/kernel/perf_regs.c                                       |   15 
 arch/x86/kernel/process.c                                         |   12 
 arch/x86/kernel/tboot.c                                           |    8 
 arch/x86/kernel/uprobes.c                                         |   10 
 arch/x86/kvm/cpuid.c                                              |   29 
 arch/x86/kvm/cpuid.h                                              |    1 
 arch/x86/kvm/emulate.c                                            |    8 
 arch/x86/kvm/irq.c                                                |   85 
 arch/x86/kvm/lapic.c                                              |    2 
 arch/x86/kvm/mmu/mmu.c                                            |   14 
 arch/x86/kvm/mmu/spte.c                                           |    4 
 arch/x86/kvm/mmu/spte.h                                           |   25 
 arch/x86/kvm/mmu/tdp_mmu.c                                        |   11 
 arch/x86/kvm/svm/sev.c                                            |    2 
 arch/x86/kvm/svm/svm.c                                            |   16 
 arch/x86/kvm/x86.c                                                |   92 
 arch/x86/kvm/x86.h                                                |    8 
 arch/x86/lib/insn-eval.c                                          |   10 
 arch/x86/mm/mem_encrypt_identity.c                                |    4 
 arch/x86/mm/numa.c                                                |    2 
 arch/x86/mm/tlb.c                                                 |   10 
 arch/x86/platform/efi/efi_64.c                                    |   24 
 arch/x86/xen/spinlock.c                                           |   12 
 arch/xtensa/include/asm/pgtable.h                                 |    2 
 arch/xtensa/include/asm/uaccess.h                                 |    2 
 arch/xtensa/mm/cache.c                                            |   14 
 block/blk-cgroup.c                                                |    1 
 block/blk-flush.c                                                 |    7 
 block/blk-merge.c                                                 |    2 
 block/blk-settings.c                                              |    5 
 block/genhd.c                                                     |    5 
 block/keyslot-manager.c                                           |    7 
 drivers/Makefile                                                  |    1 
 drivers/accessibility/speakup/main.c                              |    1 
 drivers/accessibility/speakup/selection.c                         |   11 
 drivers/accessibility/speakup/speakup.h                           |    1 
 drivers/accessibility/speakup/spk_ttyio.c                         |   35 
 drivers/accessibility/speakup/spk_types.h                         |    8 
 drivers/acpi/acpi_video.c                                         |    6 
 drivers/acpi/apei/apei-base.c                                     |    4 
 drivers/acpi/arm64/iort.c                                         |    8 
 drivers/acpi/battery.c                                            |    2 
 drivers/acpi/button.c                                             |   13 
 drivers/acpi/dptf/dptf_pch_fivr.c                                 |    1 
 drivers/acpi/dptf/dptf_power.c                                    |    2 
 drivers/acpi/dptf/int340x_thermal.c                               |    6 
 drivers/acpi/event.c                                              |    2 
 drivers/acpi/evged.c                                              |    2 
 drivers/acpi/fan.c                                                |    2 
 drivers/acpi/internal.h                                           |    2 
 drivers/acpi/nfit/core.c                                          |   10 
 drivers/acpi/pci_irq.c                                            |    2 
 drivers/acpi/pci_link.c                                           |   12 
 drivers/acpi/pci_mcfg.c                                           |    2 
 drivers/acpi/power.c                                              |    6 
 drivers/acpi/processor_perflib.c                                  |    6 
 drivers/acpi/sbs.c                                                |    2 
 drivers/acpi/sbshc.c                                              |    2 
 drivers/acpi/sbshc.h                                              |    6 
 drivers/acpi/scan.c                                               |    2 
 drivers/acpi/video_detect.c                                       |   16 
 drivers/acpi/wakeup.c                                             |    4 
 drivers/atm/nicstar.c                                             |    2 
 drivers/block/loop.c                                              |    3 
 drivers/block/nbd.c                                               |    1 
 drivers/block/xen-blkback/blkback.c                               |   89 
 drivers/block/xen-blkback/common.h                                |    4 
 drivers/block/xen-blkback/xenbus.c                                |    6 
 drivers/bus/ti-sysc.c                                             |   29 
 drivers/char/agp/Makefile                                         |    6 
 drivers/char/agp/agp.h                                            |    5 
 drivers/char/virtio_console.c                                     |    8 
 drivers/clk/imx/Kconfig                                           |    4 
 drivers/clk/imx/clk-imx8mm.c                                      |   10 
 drivers/clk/imx/clk-imx8mn.c                                      |    6 
 drivers/clk/imx/clk-imx8mp.c                                      |   10 
 drivers/clk/imx/clk-imx8mq.c                                      |    8 
 drivers/clk/imx/clk.h                                             |    5 
 drivers/clk/meson/clk-regmap.h                                    |    5 
 drivers/clk/qcom/clk-regmap.h                                     |    6 
 drivers/clk/renesas/r9a06g032-clocks.c                            |    2 
 drivers/counter/ti-eqep.c                                         |    4 
 drivers/cpufreq/cpufreq.c                                         |    4 
 drivers/cpufreq/cpufreq_governor.h                                |    2 
 drivers/cpufreq/cpufreq_performance.c                             |    1 
 drivers/cpufreq/cpufreq_powersave.c                               |    1 
 drivers/cpufreq/intel_pstate.c                                    |   16 
 drivers/cpufreq/scmi-cpufreq.c                                    |   10 
 drivers/cpufreq/tegra186-cpufreq.c                                |   33 
 drivers/cpuidle/cpuidle-tegra.c                                   |    4 
 drivers/dax/Kconfig                                               |    1 
 drivers/dma-buf/dma-buf.c                                         |   19 
 drivers/dma-buf/dma-resv.c                                        |    2 
 drivers/dma-buf/heaps/Makefile                                    |    1 
 drivers/dma-buf/heaps/cma_heap.c                                  |  329 +-
 drivers/dma-buf/heaps/heap-helpers.c                              |  274 -
 drivers/dma-buf/heaps/heap-helpers.h                              |   53 
 drivers/dma-buf/heaps/system_heap.c                               |  414 ++
 drivers/dma/dmaengine.c                                           |   17 
 drivers/dma/idxd/device.c                                         |   31 
 drivers/dma/idxd/idxd.h                                           |    3 
 drivers/dma/idxd/init.c                                           |    5 
 drivers/dma/idxd/registers.h                                      |   25 
 drivers/dma/idxd/submit.c                                         |    2 
 drivers/dma/ioat/dca.c                                            |   10 
 drivers/dma/pl330.c                                               |    2 
 drivers/dma/ti/k3-udma-private.c                                  |    2 
 drivers/dma/ti/omap-dma.c                                         |   37 
 drivers/dma/xilinx/xilinx_dma.c                                   |   40 
 drivers/firmware/efi/Kconfig                                      |    2 
 drivers/firmware/efi/efi.c                                        |    2 
 drivers/firmware/xilinx/zynqmp.c                                  |   64 
 drivers/fpga/Kconfig                                              |    1 
 drivers/gpio/gpio-arizona.c                                       |    1 
 drivers/gpio/gpio-aspeed.c                                        |    1 
 drivers/gpio/gpio-dwapb.c                                         |    6 
 drivers/gpio/gpio-eic-sprd.c                                      |    2 
 drivers/gpio/gpio-mvebu.c                                         |   16 
 drivers/gpio/gpio-omap.c                                          |   12 
 drivers/gpio/gpio-pcie-idio-24.c                                  |   62 
 drivers/gpio/gpio-sifive.c                                        |    2 
 drivers/gpio/gpio-zynq.c                                          |    4 
 drivers/gpio/gpiolib-cdev.h                                       |   15 
 drivers/gpio/gpiolib.c                                            |   23 
 drivers/gpu/drm/amd/amdgpu/amdgpu.h                               |    8 
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c                          |    8 
 drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c                  |    2 
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c                        |   43 
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c                           |   25 
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c                           |    9 
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c                           |   17 
 drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h                         |    5 
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c                           |   53 
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c                           |    4 
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c                           |    2 
 drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c                           |    4 
 drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c                           |    1 
 drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c                             |   11 
 drivers/gpu/drm/amd/amdgpu/mxgpu_ai.h                             |    3 
 drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c                             |   11 
 drivers/gpu/drm/amd/amdgpu/mxgpu_nv.h                             |    1 
 drivers/gpu/drm/amd/amdgpu/nv.c                                   |    1 
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c                            |   42 
 drivers/gpu/drm/amd/amdkfd/Kconfig                                |    2 
 drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c             |    4 
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c                 |   29 
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h                 |   21 
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c             |   13 
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c       |    5 
 drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c         |   12 
 drivers/gpu/drm/amd/display/dc/core/dc.c                          |   20 
 drivers/gpu/drm/amd/display/dc/core/dc_link.c                     |    3 
 drivers/gpu/drm/amd/display/dc/dc.h                               |    2 
 drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c             |   44 
 drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h             |    2 
 drivers/gpu/drm/amd/display/dc/dce120/dce120_timing_generator.c   |    2 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c               |    6 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c         |    2 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c                 |   15 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h                 |    2 
 drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h       |    6 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c                |   29 
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.h       |    2 
 drivers/gpu/drm/amd/display/dc/dcn21/dcn21_dccg.h                 |    1 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c     |    2 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h     |    4 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c                |    2 
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c                 |    2 
 drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h          |    2 
 drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h                   |   62 
 drivers/gpu/drm/amd/display/modules/color/color_gamma.c           |   22 
 drivers/gpu/drm/amd/include/atomfirmware.h                        |    1 
 drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h                           |    1 
 drivers/gpu/drm/amd/pm/inc/smu_types.h                            |    4 
 drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h                    |    6 
 drivers/gpu/drm/amd/pm/inc/smu_v11_5_ppsmc.h                      |    2 
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c                         |   10 
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c           |  289 +
 drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.h           |    4 
 drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c                    |   46 
 drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c                  |    9 
 drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.h                  |    4 
 drivers/gpu/drm/bridge/cadence/Kconfig                            |    2 
 drivers/gpu/drm/bridge/synopsys/dw-hdmi.c                         |    6 
 drivers/gpu/drm/drm_atomic_helper.c                               |    8 
 drivers/gpu/drm/drm_blend.c                                       |    2 
 drivers/gpu/drm/drm_bufs.c                                        |    1 
 drivers/gpu/drm/drm_client.c                                      |    4 
 drivers/gpu/drm/drm_crtc.c                                        |   12 
 drivers/gpu/drm/drm_fb_helper.c                                   |  155 -
 drivers/gpu/drm/drm_gem_shmem_helper.c                            |   40 
 drivers/gpu/drm/etnaviv/etnaviv_gem.c                             |    4 
 drivers/gpu/drm/exynos/Kconfig                                    |    3 
 drivers/gpu/drm/gma500/psb_irq.c                                  |   34 
 drivers/gpu/drm/i915/display/intel_display.c                      |    2 
 drivers/gpu/drm/i915/display/intel_dp.c                           |    2 
 drivers/gpu/drm/i915/display/intel_dp_mst.c                       |    7 
 drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c                        |    3 
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c                    |    9 
 drivers/gpu/drm/i915/gem/i915_gem_mman.c                          |    5 
 drivers/gpu/drm/i915/gt/intel_breadcrumbs.c                       |  303 +
 drivers/gpu/drm/i915/gt/intel_breadcrumbs_types.h                 |    8 
 drivers/gpu/drm/i915/gt/intel_context.c                           |   15 
 drivers/gpu/drm/i915/gt/intel_context_types.h                     |   23 
 drivers/gpu/drm/i915/gt/intel_lrc.c                               |   68 
 drivers/gpu/drm/i915/gt/intel_mocs.c                              |   23 
 drivers/gpu/drm/i915/gt/intel_rps.c                               |    4 
 drivers/gpu/drm/i915/gt/intel_workarounds.c                       |    4 
 drivers/gpu/drm/i915/gt/shmem_utils.c                             |    9 
 drivers/gpu/drm/i915/gvt/display.c                                |    2 
 drivers/gpu/drm/i915/gvt/kvmgt.c                                  |    4 
 drivers/gpu/drm/i915/gvt/vgpu.c                                   |    3 
 drivers/gpu/drm/i915/i915_drv.h                                   |   12 
 drivers/gpu/drm/i915/i915_irq.c                                   |   27 
 drivers/gpu/drm/i915/i915_perf.c                                  |    2 
 drivers/gpu/drm/i915/i915_request.h                               |    2 
 drivers/gpu/drm/i915/selftests/i915_gem.c                         |    4 
 drivers/gpu/drm/i915/selftests/i915_request.c                     |    8 
 drivers/gpu/drm/imx/dcss/dcss-dev.h                               |    3 
 drivers/gpu/drm/imx/dcss/dcss-plane.c                             |   24 
 drivers/gpu/drm/imx/dcss/dcss-scaler.c                            |   47 
 drivers/gpu/drm/lima/lima_gem.c                                   |    2 
 drivers/gpu/drm/mcde/Kconfig                                      |    1 
 drivers/gpu/drm/mcde/Makefile                                     |    2 
 drivers/gpu/drm/mcde/mcde_clk_div.c                               |  192 +
 drivers/gpu/drm/mcde/mcde_display.c                               |  456 ++
 drivers/gpu/drm/mcde/mcde_display_regs.h                          |   91 
 drivers/gpu/drm/mcde/mcde_drm.h                                   |   10 
 drivers/gpu/drm/mcde/mcde_drv.c                                   |   54 
 drivers/gpu/drm/mediatek/mtk_dsi.c                                |   61 
 drivers/gpu/drm/meson/meson_dw_hdmi.c                             |   51 
 drivers/gpu/drm/mgag200/mgag200_drv.c                             |    1 
 drivers/gpu/drm/msm/msm_gem.c                                     |    4 
 drivers/gpu/drm/mxsfb/mxsfb_drv.c                                 |   10 
 drivers/gpu/drm/mxsfb/mxsfb_kms.c                                 |    3 
 drivers/gpu/drm/nouveau/dispnv50/disp.c                           |   34 
 drivers/gpu/drm/nouveau/nouveau_bo.c                              |   33 
 drivers/gpu/drm/nouveau/nouveau_connector.c                       |   14 
 drivers/gpu/drm/nouveau/nouveau_gem.c                             |    8 
 drivers/gpu/drm/omapdrm/dss/sdi.c                                 |   10 
 drivers/gpu/drm/omapdrm/omap_gem.c                                |    3 
 drivers/gpu/drm/panel/panel-samsung-s6e63m0.c                     |  345 +-
 drivers/gpu/drm/panel/panel-simple.c                              |   28 
 drivers/gpu/drm/panel/panel-sony-acx565akm.c                      |    2 
 drivers/gpu/drm/panfrost/panfrost_gem.c                           |    2 
 drivers/gpu/drm/qxl/qxl_ttm.c                                     |    2 
 drivers/gpu/drm/radeon/radeon_ttm.c                               |   54 
 drivers/gpu/drm/radeon/radeon_uvd.c                               |    2 
 drivers/gpu/drm/radeon/radeon_vce.c                               |    2 
 drivers/gpu/drm/rockchip/rockchip_lvds.c                          |    2 
 drivers/gpu/drm/sun4i/sun4i_backend.c                             |    8 
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c                             |    1 
 drivers/gpu/drm/tegra/drm.c                                       |    2 
 drivers/gpu/drm/tegra/output.c                                    |    1 
 drivers/gpu/drm/tegra/sor.c                                       |   76 
 drivers/gpu/drm/ttm/ttm_pool.c                                    |   22 
 drivers/gpu/drm/udl/udl_drv.c                                     |    2 
 drivers/gpu/drm/v3d/v3d_bo.c                                      |    2 
 drivers/gpu/drm/vc4/vc4_drv.h                                     |    4 
 drivers/gpu/drm/vc4/vc4_hdmi.c                                    |   48 
 drivers/gpu/drm/vc4/vc4_hdmi.h                                    |   11 
 drivers/gpu/drm/vc4/vc4_kms.c                                     |  244 +
 drivers/gpu/drm/vc4/vc4_txp.c                                     |    4 
 drivers/gpu/drm/vgem/vgem_drv.c                                   |    3 
 drivers/gpu/drm/via/via_irq.c                                     |    1 
 drivers/gpu/drm/via/via_verifier.c                                |    7 
 drivers/gpu/drm/virtio/virtgpu_debugfs.c                          |    4 
 drivers/gpu/drm/virtio/virtgpu_drv.h                              |    8 
 drivers/gpu/drm/virtio/virtgpu_fence.c                            |   13 
 drivers/gpu/drm/virtio/virtgpu_ioctl.c                            |    7 
 drivers/gpu/drm/virtio/virtgpu_object.c                           |    1 
 drivers/gpu/drm/vkms/vkms_drv.c                                   |    1 
 drivers/gpu/drm/vkms/vkms_writeback.c                             |    7 
 drivers/hid/hid-cypress.c                                         |   44 
 drivers/hid/hid-ids.h                                             |    9 
 drivers/hid/hid-input.c                                           |    3 
 drivers/hid/hid-ite.c                                             |   61 
 drivers/hid/hid-logitech-dj.c                                     |   22 
 drivers/hid/hid-logitech-hidpp.c                                  |   32 
 drivers/hid/hid-mcp2221.c                                         |   48 
 drivers/hid/hid-quirks.c                                          |    5 
 drivers/hid/hid-sensor-hub.c                                      |    3 
 drivers/hid/hid-uclogic-core.c                                    |    2 
 drivers/hid/hid-uclogic-params.c                                  |    2 
 drivers/hid/i2c-hid/i2c-hid-core.c                                |    9 
 drivers/hv/hv.c                                                   |    8 
 drivers/hwmon/amd_energy.c                                        |    2 
 drivers/hwmon/applesmc.c                                          |  130 
 drivers/hwmon/pmbus/max20730.c                                    |   26 
 drivers/hwmon/pmbus/pmbus_core.c                                  |   13 
 drivers/hwmon/pwm-fan.c                                           |   16 
 drivers/i2c/busses/Kconfig                                        |    1 
 drivers/i2c/busses/i2c-imx.c                                      |   44 
 drivers/i2c/busses/i2c-mlxbf.c                                    |   12 
 drivers/i2c/busses/i2c-qcom-cci.c                                 |    4 
 drivers/i2c/busses/i2c-qup.c                                      |    3 
 drivers/idle/intel_idle.c                                         |   37 
 drivers/iio/accel/kxcjk-1013.c                                    |   51 
 drivers/iio/adc/ingenic-adc.c                                     |   34 
 drivers/iio/adc/mt6577_auxadc.c                                   |    6 
 drivers/iio/adc/stm32-adc-core.c                                  |   41 
 drivers/iio/adc/stm32-adc.c                                       |   50 
 drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c         |   16 
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c                      |    6 
 drivers/iio/light/Kconfig                                         |    1 
 drivers/infiniband/Kconfig                                        |    3 
 drivers/infiniband/core/cache.c                                   |    3 
 drivers/infiniband/core/cm.c                                      |   14 
 drivers/infiniband/hw/efa/efa_verbs.c                             |    4 
 drivers/infiniband/hw/hfi1/chip.c                                 |    3 
 drivers/infiniband/hw/hfi1/file_ops.c                             |    4 
 drivers/infiniband/hw/hfi1/hfi.h                                  |    2 
 drivers/infiniband/hw/hfi1/mmu_rb.c                               |   68 
 drivers/infiniband/hw/hfi1/mmu_rb.h                               |   16 
 drivers/infiniband/hw/hfi1/user_exp_rcv.c                         |   12 
 drivers/infiniband/hw/hfi1/user_exp_rcv.h                         |    6 
 drivers/infiniband/hw/hfi1/user_sdma.c                            |   13 
 drivers/infiniband/hw/hfi1/user_sdma.h                            |    7 
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c                        |    9 
 drivers/infiniband/hw/hns/hns_roce_hw_v2.h                        |    2 
 drivers/infiniband/hw/i40iw/i40iw_main.c                          |    5 
 drivers/infiniband/hw/i40iw/i40iw_verbs.c                         |   37 
 drivers/infiniband/hw/mthca/mthca_cq.c                            |   10 
 drivers/infiniband/hw/qedr/verbs.c                                |    9 
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c                    |    2 
 drivers/infiniband/sw/rdmavt/Kconfig                              |    3 
 drivers/infiniband/sw/rxe/Kconfig                                 |    2 
 drivers/infiniband/sw/siw/Kconfig                                 |    1 
 drivers/input/joystick/xpad.c                                     |    2 
 drivers/input/keyboard/cros_ec_keyb.c                             |    1 
 drivers/input/keyboard/sunkbd.c                                   |   41 
 drivers/input/misc/adxl34x.c                                      |    2 
 drivers/input/misc/cm109.c                                        |    7 
 drivers/input/misc/soc_button_array.c                             |   12 
 drivers/input/mouse/elan_i2c.h                                    |    2 
 drivers/input/mouse/elan_i2c_core.c                               |    3 
 drivers/input/mouse/elan_i2c_i2c.c                                |   10 
 drivers/input/mouse/elan_i2c_smbus.c                              |    2 
 drivers/input/serio/i8042-x86ia64io.h                             |   46 
 drivers/input/serio/i8042.c                                       |   15 
 drivers/input/touchscreen/Kconfig                                 |    1 
 drivers/input/touchscreen/atmel_mxt_ts.c                          |    4 
 drivers/input/touchscreen/goodix.c                                |   12 
 drivers/input/touchscreen/raydium_i2c_ts.c                        |  126 
 drivers/interconnect/core.c                                       |    1 
 drivers/interconnect/qcom/msm8916.c                               |   12 
 drivers/interconnect/qcom/msm8974.c                               |   12 
 drivers/interconnect/qcom/qcs404.c                                |    4 
 drivers/iommu/amd/amd_iommu_types.h                               |    2 
 drivers/iommu/amd/init.c                                          |   27 
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c                        |    4 
 drivers/iommu/intel/dmar.c                                        |   24 
 drivers/iommu/intel/iommu.c                                       |   14 
 drivers/iommu/iommu.c                                             |   10 
 drivers/irqchip/irq-gic-v3-its.c                                  |   16 
 drivers/irqchip/irq-sni-exiu.c                                    |    2 
 drivers/md/dm-cache-target.c                                      |    4 
 drivers/md/dm-integrity.c                                         |    4 
 drivers/md/dm-raid.c                                              |   11 
 drivers/md/dm-table.c                                             |   11 
 drivers/md/dm-writecache.c                                        |    6 
 drivers/md/dm.c                                                   |   29 
 drivers/md/md.c                                                   |   20 
 drivers/md/md.h                                                   |    6 
 drivers/md/raid0.c                                                |   14 
 drivers/md/raid10.c                                               |  423 --
 drivers/md/raid10.h                                               |    1 
 drivers/media/cec/usb/pulse8/pulse8-cec.c                         |   52 
 drivers/media/common/videobuf2/videobuf2-core.c                   |   11 
 drivers/media/platform/Kconfig                                    |   28 
 drivers/media/platform/marvell-ccic/mmp-driver.c                  |    2 
 drivers/media/platform/mtk-vcodec/Makefile                        |   10 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c            |    2 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c            |    2 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw.c                 |  174 -
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw.h                 |    7 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_priv.h            |   52 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_scp.c             |   73 
 drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c             |  110 
 drivers/media/platform/qcom/venus/core.h                          |   15 
 drivers/media/platform/qcom/venus/pm_helpers.c                    |    4 
 drivers/media/platform/qcom/venus/venc.c                          |   31 
 drivers/media/platform/qcom/venus/venc_ctrls.c                    |   14 
 drivers/media/rc/mtk-cir.c                                        |    9 
 drivers/media/test-drivers/vidtv/vidtv_bridge.c                   |  116 
 drivers/media/test-drivers/vidtv/vidtv_bridge.h                   |    4 
 drivers/media/test-drivers/vidtv/vidtv_channel.c                  |  316 +-
 drivers/media/test-drivers/vidtv/vidtv_channel.h                  |   11 
 drivers/media/test-drivers/vidtv/vidtv_common.h                   |    1 
 drivers/media/test-drivers/vidtv/vidtv_demod.c                    |    2 
 drivers/media/test-drivers/vidtv/vidtv_demod.h                    |   11 
 drivers/media/test-drivers/vidtv/vidtv_encoder.h                  |    9 
 drivers/media/test-drivers/vidtv/vidtv_mux.c                      |  248 +
 drivers/media/test-drivers/vidtv/vidtv_mux.h                      |   21 
 drivers/media/test-drivers/vidtv/vidtv_pes.c                      |  179 -
 drivers/media/test-drivers/vidtv/vidtv_pes.h                      |    8 
 drivers/media/test-drivers/vidtv/vidtv_psi.c                      | 1521 +++++++---
 drivers/media/test-drivers/vidtv/vidtv_psi.h                      |  288 +
 drivers/media/test-drivers/vidtv/vidtv_s302m.c                    |  127 
 drivers/media/test-drivers/vidtv/vidtv_s302m.h                    |    9 
 drivers/media/test-drivers/vidtv/vidtv_ts.c                       |    5 
 drivers/media/test-drivers/vidtv/vidtv_ts.h                       |    7 
 drivers/media/test-drivers/vidtv/vidtv_tuner.c                    |    5 
 drivers/media/test-drivers/vidtv/vidtv_tuner.h                    |    1 
 drivers/misc/eeprom/at24.c                                        |    1 
 drivers/misc/habanalabs/common/command_buffer.c                   |    9 
 drivers/misc/habanalabs/common/device.c                           |   16 
 drivers/misc/habanalabs/common/habanalabs.h                       |   14 
 drivers/misc/habanalabs/common/hw_queue.c                         |   19 
 drivers/misc/habanalabs/common/irq.c                              |   17 
 drivers/misc/habanalabs/common/memory.c                           |    1 
 drivers/misc/habanalabs/gaudi/gaudi.c                             |   40 
 drivers/misc/habanalabs/gaudi/gaudiP.h                            |    1 
 drivers/misc/habanalabs/gaudi/gaudi_coresight.c                   |    5 
 drivers/misc/habanalabs/goya/goya.c                               |   26 
 drivers/misc/habanalabs/goya/goyaP.h                              |    2 
 drivers/misc/habanalabs/include/gaudi/gaudi_masks.h               |    1 
 drivers/misc/mei/Kconfig                                          |   10 
 drivers/misc/mei/Makefile                                         |    3 
 drivers/misc/mei/client.h                                         |    4 
 drivers/misc/mei/hw-virtio.c                                      |  874 -----
 drivers/mmc/core/block.c                                          |    2 
 drivers/mmc/host/mtk-sd.c                                         |   39 
 drivers/mmc/host/renesas_sdhi_core.c                              |   14 
 drivers/mmc/host/sdhci-of-arasan.c                                |   54 
 drivers/mmc/host/sdhci-of-esdhc.c                                 |    2 
 drivers/mmc/host/sdhci-pci-core.c                                 |   13 
 drivers/mmc/host/tmio_mmc_core.c                                  |    7 
 drivers/mtd/nand/raw/ams-delta.c                                  |   14 
 drivers/mtd/nand/raw/au1550nd.c                                   |   13 
 drivers/mtd/nand/raw/cs553x_nand.c                                |   24 
 drivers/mtd/nand/raw/davinci_nand.c                               |    8 
 drivers/mtd/nand/raw/diskonchip.c                                 |   29 
 drivers/mtd/nand/raw/fsmc_nand.c                                  |   30 
 drivers/mtd/nand/raw/gpio.c                                       |   13 
 drivers/mtd/nand/raw/lpc32xx_mlc.c                                |   23 
 drivers/mtd/nand/raw/lpc32xx_slc.c                                |   26 
 drivers/mtd/nand/raw/mpc5121_nfc.c                                |   21 
 drivers/mtd/nand/raw/orion_nand.c                                 |   21 
 drivers/mtd/nand/raw/pasemi_nand.c                                |   21 
 drivers/mtd/nand/raw/plat_nand.c                                  |   22 
 drivers/mtd/nand/raw/r852.c                                       |   40 
 drivers/mtd/nand/raw/r852.h                                       |    1 
 drivers/mtd/nand/raw/sharpsl.c                                    |   32 
 drivers/mtd/nand/raw/socrates_nand.c                              |   23 
 drivers/mtd/nand/raw/tmio_nand.c                                  |   33 
 drivers/mtd/nand/raw/txx9ndfmc.c                                  |   14 
 drivers/mtd/nand/raw/xway_nand.c                                  |   20 
 drivers/net/bonding/bond_main.c                                   |   61 
 drivers/net/bonding/bond_options.c                                |   22 
 drivers/net/bonding/bond_sysfs_slave.c                            |   18 
 drivers/net/can/c_can/c_can.c                                     |   18 
 drivers/net/can/dev.c                                             |    2 
 drivers/net/can/flexcan.c                                         |   28 
 drivers/net/can/kvaser_pciefd.c                                   |    8 
 drivers/net/can/m_can/Kconfig                                     |    3 
 drivers/net/can/m_can/m_can.c                                     |   24 
 drivers/net/can/m_can/m_can.h                                     |    1 
 drivers/net/can/m_can/m_can_platform.c                            |   23 
 drivers/net/can/m_can/tcan4x5x.c                                  |   41 
 drivers/net/can/sja1000/sja1000.c                                 |    1 
 drivers/net/can/softing/softing_main.c                            |    9 
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c                    |    4 
 drivers/net/can/sun4i_can.c                                       |    1 
 drivers/net/can/ti_hecc.c                                         |   13 
 drivers/net/can/usb/gs_usb.c                                      |  131 
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c                 |    2 
 drivers/net/can/usb/mcba_usb.c                                    |    4 
 drivers/net/can/usb/peak_usb/pcan_usb_core.c                      |    4 
 drivers/net/dsa/lantiq_gswip.c                                    |   11 
 drivers/net/dsa/mv88e6xxx/chip.c                                  |    2 
 drivers/net/dsa/mv88e6xxx/devlink.c                               |    4 
 drivers/net/dsa/mv88e6xxx/global1.c                               |   31 
 drivers/net/dsa/mv88e6xxx/global1.h                               |    1 
 drivers/net/dsa/mv88e6xxx/global1_vtu.c                           |   59 
 drivers/net/dsa/ocelot/felix.c                                    |    7 
 drivers/net/dsa/ocelot/felix_vsc9959.c                            |    1 
 drivers/net/dsa/ocelot/seville_vsc9953.c                          |    1 
 drivers/net/ethernet/agere/Kconfig                                |    1 
 drivers/net/ethernet/amazon/ena/ena_eth_com.c                     |    3 
 drivers/net/ethernet/amazon/ena/ena_netdev.c                      |   80 
 drivers/net/ethernet/aquantia/atlantic/aq_ring.c                  |  126 
 drivers/net/ethernet/atheros/atl1c/atl1c_main.c                   |    4 
 drivers/net/ethernet/atheros/atl1e/atl1e_main.c                   |    4 
 drivers/net/ethernet/broadcom/Kconfig                             |    1 
 drivers/net/ethernet/broadcom/b44.c                               |    3 
 drivers/net/ethernet/broadcom/bnxt/bnxt.c                         |    8 
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c                 |    5 
 drivers/net/ethernet/cadence/Kconfig                              |    1 
 drivers/net/ethernet/chelsio/Kconfig                              |    2 
 drivers/net/ethernet/chelsio/cxgb3/sge.c                          |    1 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4.h                        |    3 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c                |    2 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c                 |    3 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c                   |    1 
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h                    |    6 
 drivers/net/ethernet/chelsio/cxgb4/sge.c                          |  111 
 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.c    |  592 ++-
 drivers/net/ethernet/chelsio/inline_crypto/ch_ktls/chcr_ktls.h    |    1 
 drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c       |    1 
 drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_hw.c       |    1 
 drivers/net/ethernet/faraday/Kconfig                              |    1 
 drivers/net/ethernet/faraday/ftgmac100.c                          |    4 
 drivers/net/ethernet/freescale/Kconfig                            |    1 
 drivers/net/ethernet/freescale/dpaa/dpaa_eth.c                    |   10 
 drivers/net/ethernet/freescale/dpaa2/Kconfig                      |    2 
 drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c                  |    1 
 drivers/net/ethernet/freescale/enetc/Kconfig                      |    1 
 drivers/net/ethernet/freescale/enetc/enetc.c                      |   62 
 drivers/net/ethernet/freescale/enetc/enetc_ethtool.c              |   10 
 drivers/net/ethernet/freescale/enetc/enetc_hw.h                   |  125 
 drivers/net/ethernet/freescale/enetc/enetc_mdio.c                 |    8 
 drivers/net/ethernet/freescale/enetc/enetc_qos.c                  |   14 
 drivers/net/ethernet/freescale/fec_main.c                         |   12 
 drivers/net/ethernet/freescale/fman/Kconfig                       |    1 
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h        |    4 
 drivers/net/ethernet/ibm/ibmvnic.c                                |  209 -
 drivers/net/ethernet/ibm/ibmvnic.h                                |    6 
 drivers/net/ethernet/intel/e1000e/netdev.c                        |    8 
 drivers/net/ethernet/intel/i40e/i40e.h                            |    1 
 drivers/net/ethernet/intel/i40e/i40e_main.c                       |   22 
 drivers/net/ethernet/intel/i40e/i40e_txrx.c                       |   27 
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c                |   52 
 drivers/net/ethernet/intel/i40e/i40e_xsk.c                        |    2 
 drivers/net/ethernet/intel/ice/ice_txrx.c                         |   31 
 drivers/net/ethernet/intel/igb/igb.h                              |    5 
 drivers/net/ethernet/intel/igb/igb_main.c                         |   37 
 drivers/net/ethernet/intel/igc/igc_main.c                         |   14 
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c                     |   24 
 drivers/net/ethernet/marvell/mvneta.c                             |    5 
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c                   |    1 
 drivers/net/ethernet/marvell/prestera/Kconfig                     |    1 
 drivers/net/ethernet/marvell/prestera/prestera_main.c             |    4 
 drivers/net/ethernet/marvell/prestera/prestera_pci.c              |    7 
 drivers/net/ethernet/mediatek/mtk_star_emac.c                     |    3 
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c                    |   21 
 drivers/net/ethernet/mellanox/mlx4/en_tx.c                        |   40 
 drivers/net/ethernet/mellanox/mlx4/fw.c                           |    6 
 drivers/net/ethernet/mellanox/mlx4/fw.h                           |    4 
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h                      |   12 
 drivers/net/ethernet/mellanox/mlx5/core/Kconfig                   |    1 
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c             |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c               |    6 
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c               |   72 
 drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c            |    4 
 drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c               |    4 
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c         |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c       |   14 
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c     |    3 
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h     |    9 
 drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c        |   27 
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c                 |    1 
 drivers/net/ethernet/mellanox/mlx5/core/en_rep.h                  |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c                   |    2 
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c                   |    6 
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.h                   |    3 
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c                   |   35 
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c                 |   22 
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c                 |   14 
 drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c               |   23 
 drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h               |    2 
 drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c               |   21 
 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c         |    1 
 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c      |    5 
 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h       |    1 
 drivers/net/ethernet/mellanox/mlxsw/Kconfig                       |    2 
 drivers/net/ethernet/mellanox/mlxsw/core.c                        |    3 
 drivers/net/ethernet/microchip/Kconfig                            |    1 
 drivers/net/ethernet/microchip/lan743x_main.c                     |   37 
 drivers/net/ethernet/microchip/lan743x_main.h                     |    3 
 drivers/net/ethernet/mscc/ocelot.c                                |    9 
 drivers/net/ethernet/mscc/ocelot_vsc7514.c                        |    1 
 drivers/net/ethernet/netronome/Kconfig                            |    1 
 drivers/net/ethernet/netronome/nfp/nfp_net_common.c               |    6 
 drivers/net/ethernet/nxp/Kconfig                                  |    1 
 drivers/net/ethernet/pasemi/pasemi_mac.c                          |    8 
 drivers/net/ethernet/qlogic/qed/qed_cxt.c                         |    4 
 drivers/net/ethernet/qlogic/qed/qed_cxt.h                         |    3 
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c                       |   12 
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c             |    3 
 drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c              |    5 
 drivers/net/ethernet/realtek/r8169_main.c                         |   18 
 drivers/net/ethernet/rocker/Kconfig                               |    1 
 drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c                   |    9 
 drivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c            |    4 
 drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c               |    6 
 drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c                 |    2 
 drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c                  |    2 
 drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c                   |    2 
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c                 |   53 
 drivers/net/ethernet/ti/am65-cpts.c                               |    3 
 drivers/net/ethernet/ti/cpsw.c                                    |   11 
 drivers/net/ethernet/ti/cpsw_new.c                                |    9 
 drivers/net/ethernet/ti/cpsw_priv.c                               |    3 
 drivers/net/ethernet/xilinx/ll_temac_main.c                       |    9 
 drivers/net/geneve.c                                              |    3 
 drivers/net/ipa/gsi_trans.c                                       |   22 
 drivers/net/netdevsim/bpf.c                                       |   15 
 drivers/net/netdevsim/dev.c                                       |    2 
 drivers/net/netdevsim/health.c                                    |    1 
 drivers/net/netdevsim/netdevsim.h                                 |    1 
 drivers/net/netdevsim/udp_tunnels.c                               |    1 
 drivers/net/phy/mscc/mscc_macsec.c                                |    1 
 drivers/net/phy/realtek.c                                         |    2 
 drivers/net/phy/smsc.c                                            |    4 
 drivers/net/tun.c                                                 |   14 
 drivers/net/usb/cx82310_eth.c                                     |    3 
 drivers/net/usb/ipheth.c                                          |    2 
 drivers/net/usb/qmi_wwan.c                                        |    2 
 drivers/net/vrf.c                                                 |  102 
 drivers/net/vxlan.c                                               |    7 
 drivers/net/wan/cosa.c                                            |    1 
 drivers/net/wireless/intel/iwlwifi/fw/api/sta.h                   |   10 
 drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h            |    8 
 drivers/net/wireless/intel/iwlwifi/iwl-config.h                   |    4 
 drivers/net/wireless/intel/iwlwifi/iwl-csr.h                      |   10 
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c                 |    5 
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c                      |   18 
 drivers/net/wireless/intel/iwlwifi/mvm/time-event.c               |  103 
 drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c          |   20 
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c                     |    6 
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c                   |   36 
 drivers/net/wireless/mediatek/mt76/usb.c                          |   17 
 drivers/net/wireless/realtek/rtw88/debug.c                        |    2 
 drivers/net/wireless/realtek/rtw88/fw.c                           |    2 
 drivers/nfc/s3fwrn5/i2c.c                                         |    4 
 drivers/nvme/host/core.c                                          |   27 
 drivers/nvme/host/nvme.h                                          |    6 
 drivers/nvme/host/pci.c                                           |   15 
 drivers/of/address.c                                              |    4 
 drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c                 |    5 
 drivers/phy/intel/Kconfig                                         |    2 
 drivers/phy/mediatek/Kconfig                                      |    2 
 drivers/phy/motorola/phy-cpcap-usb.c                              |    3 
 drivers/phy/qualcomm/Kconfig                                      |    4 
 drivers/phy/qualcomm/phy-qcom-qmp.c                               |    2 
 drivers/phy/tegra/xusb.c                                          |    1 
 drivers/pinctrl/aspeed/pinctrl-aspeed.c                           |   73 
 drivers/pinctrl/aspeed/pinmux-aspeed.h                            |    7 
 drivers/pinctrl/intel/pinctrl-baytrail.c                          |    8 
 drivers/pinctrl/intel/pinctrl-intel.c                             |   44 
 drivers/pinctrl/intel/pinctrl-jasperlake.c                        |  452 +-
 drivers/pinctrl/intel/pinctrl-merrifield.c                        |    8 
 drivers/pinctrl/pinctrl-amd.c                                     |   13 
 drivers/pinctrl/pinctrl-ingenic.c                                 |   72 
 drivers/pinctrl/pinctrl-mcp23s08_spi.c                            |    4 
 drivers/pinctrl/pinctrl-rockchip.c                                |   30 
 drivers/pinctrl/qcom/pinctrl-msm.c                                |   32 
 drivers/pinctrl/qcom/pinctrl-sm8250.c                             |   18 
 drivers/platform/x86/acer-wmi.c                                   |    1 
 drivers/platform/x86/intel-vbtn.c                                 |    6 
 drivers/platform/x86/thinkpad_acpi.c                              |   13 
 drivers/platform/x86/toshiba_acpi.c                               |    3 
 drivers/platform/x86/touchscreen_dmi.c                            |   50 
 drivers/powercap/powercap_sys.c                                   |    4 
 drivers/ptp/ptp_clockmatrix.c                                     |   49 
 drivers/pwm/pwm-sl28cpld.c                                        |    6 
 drivers/regulator/core.c                                          |   43 
 drivers/regulator/pfuze100-regulator.c                            |   13 
 drivers/regulator/ti-abb-regulator.c                              |   12 
 drivers/s390/block/dasd.c                                         |    6 
 drivers/s390/net/qeth_core.h                                      |    9 
 drivers/s390/net/qeth_core_main.c                                 |   82 
 drivers/s390/net/qeth_l2_main.c                                   |   18 
 drivers/scsi/be2iscsi/be_main.c                                   |    4 
 drivers/scsi/bnx2i/Kconfig                                        |    1 
 drivers/scsi/hisi_sas/hisi_sas_main.c                             |    6 
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c                            |    5 
 drivers/scsi/libiscsi.c                                           |   23 
 drivers/scsi/megaraid/megaraid_sas_base.c                         |   39 
 drivers/scsi/megaraid/megaraid_sas_fusion.c                       |   29 
 drivers/scsi/mpt3sas/mpt3sas_base.c                               |    2 
 drivers/scsi/mpt3sas/mpt3sas_ctl.c                                |    2 
 drivers/scsi/scsi_lib.c                                           |    3 
 drivers/scsi/storvsc_drv.c                                        |    4 
 drivers/scsi/ufs/ufshcd.c                                         |   71 
 drivers/scsi/ufs/ufshcd.h                                         |    2 
 drivers/soc/fsl/dpio/dpio-driver.c                                |    5 
 drivers/spi/spi-bcm-qspi.c                                        |   34 
 drivers/spi/spi-bcm2835.c                                         |   24 
 drivers/spi/spi-bcm2835aux.c                                      |   20 
 drivers/spi/spi-cadence-quadspi.c                                 |    2 
 drivers/spi/spi-dw-core.c                                         |    7 
 drivers/spi/spi-fsi.c                                             |    2 
 drivers/spi/spi-fsl-lpspi.c                                       |    3 
 drivers/spi/spi-imx.c                                             |    1 
 drivers/spi/spi-npcm-fiu.c                                        |    2 
 drivers/spi/spi-nxp-fspi.c                                        |    7 
 drivers/spi/spi.c                                                 |   86 
 drivers/staging/android/ashmem.c                                  |    6 
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c                  |    2 
 drivers/staging/mt7621-pci/pci-mt7621.c                           |   15 
 drivers/staging/ralink-gdma/Kconfig                               |    1 
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c                      |    1 
 drivers/target/iscsi/iscsi_target.c                               |   17 
 drivers/tee/amdtee/amdtee_private.h                               |    8 
 drivers/tee/amdtee/core.c                                         |   26 
 drivers/tee/optee/call.c                                          |    3 
 drivers/thermal/ti-soc-thermal/ti-bandgap.c                       |   18 
 drivers/thunderbolt/debugfs.c                                     |    1 
 drivers/thunderbolt/icm.c                                         |   12 
 drivers/thunderbolt/nhi.c                                         |   23 
 drivers/thunderbolt/nhi.h                                         |    2 
 drivers/thunderbolt/tb.h                                          |    2 
 drivers/thunderbolt/usb4.c                                        |    4 
 drivers/thunderbolt/xdomain.c                                     |    1 
 drivers/tty/serial/ar933x_uart.c                                  |    6 
 drivers/tty/serial/imx.c                                          |   30 
 drivers/tty/tty_io.c                                              |    7 
 drivers/tty/tty_jobctrl.c                                         |   44 
 drivers/uio/uio.c                                                 |   10 
 drivers/usb/cdns3/core.c                                          |   29 
 drivers/usb/cdns3/gadget.c                                        |   27 
 drivers/usb/class/cdc-acm.c                                       |    9 
 drivers/usb/core/devio.c                                          |   14 
 drivers/usb/core/quirks.c                                         |   10 
 drivers/usb/gadget/function/f_fs.c                                |    6 
 drivers/usb/gadget/function/f_midi.c                              |   10 
 drivers/usb/gadget/legacy/inode.c                                 |    3 
 drivers/usb/host/ohci-omap.c                                      |    4 
 drivers/usb/host/xhci-histb.c                                     |    2 
 drivers/usb/musb/musb_dsps.c                                      |    4 
 drivers/usb/serial/ch341.c                                        |    5 
 drivers/usb/serial/kl5kusb105.c                                   |   10 
 drivers/usb/serial/option.c                                       |   10 
 drivers/usb/storage/scsiglue.c                                    |    2 
 drivers/usb/storage/uas.c                                         |   19 
 drivers/usb/storage/usb.c                                         |    5 
 drivers/usb/typec/Kconfig                                         |    1 
 drivers/usb/typec/stusb160x.c                                     |    2 
 drivers/usb/typec/ucsi/psy.c                                      |    9 
 drivers/usb/typec/ucsi/ucsi.c                                     |    7 
 drivers/usb/typec/ucsi/ucsi.h                                     |    2 
 drivers/vdpa/Kconfig                                              |    2 
 drivers/vhost/scsi.c                                              |  399 +-
 drivers/vhost/vdpa.c                                              |   84 
 drivers/vhost/vhost.c                                             |    6 
 drivers/vhost/vhost.h                                             |    1 
 drivers/vhost/vringh.c                                            |    6 
 drivers/video/fbdev/geode/lxfb_ops.c                              |    1 
 drivers/video/fbdev/hyperv_fb.c                                   |    8 
 drivers/video/fbdev/pm2fb.c                                       |    1 
 drivers/virt/nitro_enclaves/ne_misc_dev.c                         |    6 
 drivers/xen/grant-table.c                                         |  123 
 drivers/xen/swiotlb-xen.c                                         |    3 
 drivers/xen/unpopulated-alloc.c                                   |   20 
 drivers/xen/xen-scsiback.c                                        |   60 
 fs/9p/vfs_file.c                                                  |   12 
 fs/afs/dir.c                                                      |    1 
 fs/afs/inode.c                                                    |    8 
 fs/afs/internal.h                                                 |    1 
 fs/afs/super.c                                                    |    3 
 fs/afs/write.c                                                    |    5 
 fs/aio.c                                                          |    2 
 fs/btrfs/block-rsv.c                                              |    3 
 fs/btrfs/ctree.h                                                  |    5 
 fs/btrfs/dev-replace.c                                            |   26 
 fs/btrfs/file.c                                                   |   57 
 fs/btrfs/inode.c                                                  |   58 
 fs/btrfs/ioctl.c                                                  |   10 
 fs/btrfs/qgroup.c                                                 |  100 
 fs/btrfs/ref-verify.c                                             |    1 
 fs/btrfs/relocation.c                                             |    4 
 fs/btrfs/scrub.c                                                  |    5 
 fs/btrfs/tests/inode-tests.c                                      |   12 
 fs/btrfs/tree-checker.c                                           |    3 
 fs/btrfs/volumes.c                                                |   34 
 fs/cifs/cifsacl.c                                                 |    1 
 fs/cifs/connect.c                                                 |    5 
 fs/cifs/smb2ops.c                                                 |   92 
 fs/cifs/smb2pdu.c                                                 |   71 
 fs/cifs/smb2pdu.h                                                 |    2 
 fs/cifs/transport.c                                               |    4 
 fs/coredump.c                                                     |    3 
 fs/crypto/inline_crypt.c                                          |    2 
 fs/crypto/keysetup.c                                              |    4 
 fs/efivarfs/inode.c                                               |    2 
 fs/erofs/inode.c                                                  |   21 
 fs/erofs/zdata.c                                                  |    7 
 fs/ext4/ext4.h                                                    |   75 
 fs/ext4/extents.c                                                 |    7 
 fs/ext4/fast_commit.c                                             |  174 -
 fs/ext4/fast_commit.h                                             |    6 
 fs/ext4/file.c                                                    |    6 
 fs/ext4/fsmap.c                                                   |    2 
 fs/ext4/fsync.c                                                   |    2 
 fs/ext4/inline.c                                                  |    1 
 fs/ext4/inode.c                                                   |   19 
 fs/ext4/mballoc.c                                                 |    6 
 fs/ext4/namei.c                                                   |   61 
 fs/ext4/super.c                                                   |   62 
 fs/gfs2/aops.c                                                    |    2 
 fs/gfs2/bmap.c                                                    |    8 
 fs/gfs2/glock.c                                                   |    1 
 fs/gfs2/glops.c                                                   |   17 
 fs/gfs2/incore.h                                                  |    1 
 fs/gfs2/inode.c                                                   |   42 
 fs/gfs2/log.c                                                     |    2 
 fs/gfs2/rgrp.c                                                    |   14 
 fs/io_uring.c                                                     |  119 
 fs/jbd2/checkpoint.c                                              |    2 
 fs/jbd2/commit.c                                                  |   11 
 fs/jbd2/journal.c                                                 |  172 -
 fs/jbd2/recovery.c                                                |    6 
 fs/jbd2/transaction.c                                             |   35 
 fs/libfs.c                                                        |    6 
 fs/nfs/Kconfig                                                    |    9 
 fs/nfs/dir.c                                                      |   15 
 fs/nfs/flexfilelayout/flexfilelayout.c                            |   27 
 fs/nfs/nfs42proc.c                                                |   21 
 fs/nfs/nfs42xattr.c                                               |    2 
 fs/nfs/nfs42xdr.c                                                 |    5 
 fs/nfs/nfs4file.c                                                 |    2 
 fs/nfs/nfs4proc.c                                                 |    2 
 fs/nfs/nfsroot.c                                                  |    6 
 fs/nfs/pagelist.c                                                 |   36 
 fs/nfsd/nfs3proc.c                                                |    6 
 fs/nfsd/nfs3xdr.c                                                 |    1 
 fs/nfsd/nfs4proc.c                                                |    3 
 fs/notify/fsnotify.c                                              |   12 
 fs/ocfs2/journal.c                                                |    2 
 fs/ocfs2/super.c                                                  |    1 
 fs/proc/self.c                                                    |    7 
 fs/proc/task_mmu.c                                                |    8 
 fs/seq_file.c                                                     |   57 
 fs/super.c                                                        |   49 
 fs/xfs/libxfs/xfs_attr_leaf.c                                     |    8 
 fs/xfs/libxfs/xfs_rmap.c                                          |    2 
 fs/xfs/scrub/bmap.c                                               |   10 
 fs/xfs/scrub/btree.c                                              |   45 
 fs/xfs/scrub/dir.c                                                |   21 
 fs/xfs/scrub/refcount.c                                           |    8 
 fs/xfs/xfs_iomap.c                                                |   29 
 fs/xfs/xfs_iwalk.c                                                |   27 
 fs/xfs/xfs_mount.c                                                |   11 
 fs/xfs/xfs_pnfs.c                                                 |    2 
 fs/zonefs/super.c                                                 |   14 
 include/asm-generic/barrier.h                                     |    1 
 include/asm-generic/percpu.h                                      |   18 
 include/drm/drm_fb_helper.h                                       |   14 
 include/drm/drm_gem_shmem_helper.h                                |    7 
 include/drm/drm_modes.h                                           |    3 
 include/drm/drm_modeset_helper_vtables.h                          |   13 
 include/kunit/test.h                                              |    2 
 include/linux/blkdev.h                                            |   17 
 include/linux/bootconfig.h                                        |    3 
 include/linux/build_bug.h                                         |    5 
 include/linux/compiler-clang.h                                    |    8 
 include/linux/compiler-gcc.h                                      |   21 
 include/linux/compiler.h                                          |   18 
 include/linux/compiler_types.h                                    |    4 
 include/linux/cpufreq.h                                           |   18 
 include/linux/dma-buf-map.h                                       |    2 
 include/linux/elfcore.h                                           |   22 
 include/linux/filter.h                                            |   22 
 include/linux/firmware/xlnx-zynqmp.h                              |    4 
 include/linux/fs.h                                                |   38 
 include/linux/genhd.h                                             |    2 
 include/linux/intel-iommu.h                                       |    1 
 include/linux/irqdomain.h                                         |   12 
 include/linux/jbd2.h                                              |   25 
 include/linux/memcontrol.h                                        |   39 
 include/linux/memory_hotplug.h                                    |   14 
 include/linux/mlx5/mlx5_ifc.h                                     |    9 
 include/linux/mm.h                                                |    2 
 include/linux/netdevice.h                                         |   19 
 include/linux/netfilter/x_tables.h                                |    5 
 include/linux/nfs_page.h                                          |    4 
 include/linux/numa.h                                              |   30 
 include/linux/pagemap.h                                           |    2 
 include/linux/perf_event.h                                        |   13 
 include/linux/perf_regs.h                                         |    6 
 include/linux/pgtable.h                                           |   13 
 include/linux/platform_data/ti-sysc.h                             |    1 
 include/linux/pm_runtime.h                                        |   21 
 include/linux/sched.h                                             |   26 
 include/linux/security.h                                          |    2 
 include/linux/spi/spi.h                                           |   19 
 include/linux/stmmac.h                                            |    1 
 include/linux/swiotlb.h                                           |   11 
 include/linux/tty.h                                               |    4 
 include/linux/zsmalloc.h                                          |    1 
 include/net/bonding.h                                             |   10 
 include/net/inet_ecn.h                                            |    2 
 include/net/inet_hashtables.h                                     |    5 
 include/net/ip_tunnels.h                                          |    7 
 include/net/ipv6_frag.h                                           |   30 
 include/net/neighbour.h                                           |    1 
 include/net/netfilter/nf_tables.h                                 |    4 
 include/net/netfilter/nf_tables_offload.h                         |    7 
 include/net/tls.h                                                 |   22 
 include/net/xdp.h                                                 |    2 
 include/net/xdp_sock.h                                            |    1 
 include/net/xsk_buff_pool.h                                       |    2 
 include/scsi/libiscsi.h                                           |    3 
 include/soc/mscc/ocelot.h                                         |    3 
 include/sound/rt1015.h                                            |   15 
 include/trace/events/ext4.h                                       |   10 
 include/trace/events/sunrpc.h                                     |   11 
 include/trace/events/writeback.h                                  |    8 
 include/uapi/drm/drm_mode.h                                       |  165 -
 include/uapi/linux/bpf.h                                          |    4 
 include/uapi/linux/devlink.h                                      |    2 
 include/uapi/linux/gpio.h                                         |  106 
 include/uapi/linux/openvswitch.h                                  |    2 
 include/uapi/linux/stat.h                                         |    9 
 include/uapi/linux/virtio_gpu.h                                   |    4 
 include/xen/grant_table.h                                         |   17 
 init/Kconfig                                                      |   12 
 init/initramfs.c                                                  |    2 
 init/main.c                                                       |   18 
 kernel/Makefile                                                   |    1 
 kernel/bpf/Makefile                                               |    6 
 kernel/bpf/bpf_lsm.c                                              |   10 
 kernel/bpf/core.c                                                 |    2 
 kernel/bpf/hashtab.c                                              |   30 
 kernel/bpf/helpers.c                                              |    4 
 kernel/bpf/preload/Kconfig                                        |    1 
 kernel/bpf/verifier.c                                             |   28 
 kernel/cpu.c                                                      |    6 
 kernel/dma/swiotlb.c                                              |   22 
 kernel/elfcore.c                                                  |   26 
 kernel/events/core.c                                              |   57 
 kernel/events/internal.h                                          |   16 
 kernel/events/ring_buffer.c                                       |   20 
 kernel/exit.c                                                     |    5 
 kernel/fail_function.c                                            |    5 
 kernel/futex.c                                                    |    5 
 kernel/irq/irqdomain.c                                            |   13 
 kernel/locking/lockdep.c                                          |   25 
 kernel/panic.c                                                    |    3 
 kernel/printk/printk.c                                            |    4 
 kernel/printk/printk_ringbuffer.c                                 |    2 
 kernel/ptrace.c                                                   |   16 
 kernel/rcu/tree.c                                                 |    2 
 kernel/rcu/tree_stall.h                                           |   22 
 kernel/reboot.c                                                   |   28 
 kernel/sched/core.c                                               |   26 
 kernel/sched/cpufreq_schedutil.c                                  |    2 
 kernel/sched/deadline.c                                           |   97 
 kernel/sched/debug.c                                              |   12 
 kernel/sched/fair.c                                               |   73 
 kernel/sched/idle.c                                               |   28 
 kernel/sched/membarrier.c                                         |   77 
 kernel/seccomp.c                                                  |    5 
 kernel/trace/Kconfig                                              |    2 
 kernel/trace/bpf_trace.c                                          |   16 
 kernel/trace/ftrace.c                                             |   22 
 kernel/trace/ring_buffer.c                                        |   20 
 kernel/trace/trace.c                                              |   15 
 kernel/trace/trace_hwlat.c                                        |    2 
 kernel/watchdog.c                                                 |    4 
 lib/Makefile                                                      |    3 
 lib/strncpy_from_user.c                                           |   19 
 lib/syscall.c                                                     |   11 
 lib/zlib_dfltcc/dfltcc_inflate.c                                  |    3 
 mm/Kconfig                                                        |   13 
 mm/compaction.c                                                   |   12 
 mm/filemap.c                                                      |   26 
 mm/gup.c                                                          |   14 
 mm/huge_memory.c                                                  |    9 
 mm/hugetlb.c                                                      |   91 
 mm/hugetlb_cgroup.c                                               |    8 
 mm/kasan/quarantine.c                                             |   39 
 mm/list_lru.c                                                     |   10 
 mm/madvise.c                                                      |    7 
 mm/memcontrol.c                                                   |    9 
 mm/memory-failure.c                                               |   36 
 mm/memory_hotplug.c                                               |   18 
 mm/migrate.c                                                      |   44 
 mm/mmap.c                                                         |   28 
 mm/page-writeback.c                                               |    6 
 mm/page_alloc.c                                                   |    5 
 mm/percpu.c                                                       |    8 
 mm/rmap.c                                                         |    5 
 mm/slab.h                                                         |   40 
 mm/slub.c                                                         |    2 
 mm/swapfile.c                                                     |    4 
 mm/util.c                                                         |   12 
 mm/vmscan.c                                                       |    5 
 mm/zsmalloc.c                                                     |   54 
 net/batman-adv/fragmentation.c                                    |   26 
 net/batman-adv/hard-interface.c                                   |    3 
 net/batman-adv/log.c                                              |    1 
 net/bridge/br_device.c                                            |    7 
 net/bridge/br_multicast.c                                         |   34 
 net/bridge/br_netfilter_hooks.c                                   |    7 
 net/bridge/br_private.h                                           |   10 
 net/bridge/br_vlan.c                                              |    4 
 net/can/af_can.c                                                  |   45 
 net/can/isotp.c                                                   |    3 
 net/core/dev.c                                                    |   30 
 net/core/devlink.c                                                |   70 
 net/core/flow_offload.c                                           |    4 
 net/core/gro_cells.c                                              |    7 
 net/core/lwt_bpf.c                                                |   12 
 net/core/neighbour.c                                              |    2 
 net/core/netpoll.c                                                |   22 
 net/core/skbuff.c                                                 |    5 
 net/core/skmsg.c                                                  |   87 
 net/core/xdp.c                                                    |   29 
 net/dccp/ipv4.c                                                   |    2 
 net/dccp/ipv6.c                                                   |    2 
 net/ethtool/bitset.c                                              |    2 
 net/ethtool/features.c                                            |    2 
 net/ipv4/arp.c                                                    |    6 
 net/ipv4/fib_frontend.c                                           |    4 
 net/ipv4/inet_connection_sock.c                                   |    2 
 net/ipv4/inet_diag.c                                              |    4 
 net/ipv4/inet_hashtables.c                                        |   68 
 net/ipv4/ip_tunnel_core.c                                         |    4 
 net/ipv4/netfilter/arp_tables.c                                   |   14 
 net/ipv4/netfilter/ip_tables.c                                    |   14 
 net/ipv4/route.c                                                  |    7 
 net/ipv4/syncookies.c                                             |    9 
 net/ipv4/tcp_bbr.c                                                |    2 
 net/ipv4/tcp_bpf.c                                                |   18 
 net/ipv4/tcp_cong.c                                               |    5 
 net/ipv4/tcp_input.c                                              |    3 
 net/ipv4/tcp_ipv4.c                                               |   33 
 net/ipv4/tcp_output.c                                             |    9 
 net/ipv4/udp.c                                                    |    2 
 net/ipv4/udp_offload.c                                            |   19 
 net/ipv6/addrconf.c                                               |    8 
 net/ipv6/addrlabel.c                                              |   26 
 net/ipv6/ah6.c                                                    |    3 
 net/ipv6/ip6_gre.c                                                |   16 
 net/ipv6/ndisc.c                                                  |    7 
 net/ipv6/netfilter/ip6_tables.c                                   |   14 
 net/ipv6/netfilter/nf_conntrack_reasm.c                           |    9 
 net/ipv6/reassembly.c                                             |   26 
 net/ipv6/sit.c                                                    |    2 
 net/ipv6/syncookies.c                                             |   10 
 net/ipv6/tcp_ipv6.c                                               |   31 
 net/ipv6/udp_offload.c                                            |   17 
 net/iucv/af_iucv.c                                                |    7 
 net/mac80211/iface.c                                              |    2 
 net/mac80211/mesh_pathtbl.c                                       |    4 
 net/mac80211/rc80211_minstrel.c                                   |   27 
 net/mac80211/rc80211_minstrel.h                                   |    1 
 net/mac80211/sta_info.c                                           |   14 
 net/mac80211/status.c                                             |   18 
 net/mac80211/util.c                                               |    2 
 net/mptcp/mib.c                                                   |    1 
 net/mptcp/protocol.c                                              |    1 
 net/mptcp/subflow.c                                               |    5 
 net/ncsi/ncsi-manage.c                                            |    5 
 net/ncsi/ncsi-netlink.c                                           |   22 
 net/ncsi/ncsi-netlink.h                                           |    3 
 net/netfilter/ipset/ip_set_core.c                                 |    3 
 net/netfilter/ipvs/ip_vs_ctl.c                                    |   31 
 net/netfilter/nf_tables_api.c                                     |   11 
 net/netfilter/nf_tables_offload.c                                 |   17 
 net/netfilter/nft_cmp.c                                           |    8 
 net/netfilter/nft_ct.c                                            |    2 
 net/netfilter/nft_dynset.c                                        |    8 
 net/netfilter/nft_meta.c                                          |   16 
 net/netfilter/nft_payload.c                                       |   70 
 net/netfilter/x_tables.c                                          |   49 
 net/netlabel/netlabel_unlabeled.c                                 |   17 
 net/openvswitch/actions.c                                         |   10 
 net/openvswitch/flow_netlink.c                                    |   74 
 net/packet/af_packet.c                                            |   18 
 net/rfkill/core.c                                                 |    3 
 net/rose/rose_loopback.c                                          |   17 
 net/sched/act_mpls.c                                              |    3 
 net/sched/cls_flower.c                                            |    4 
 net/sched/sch_fq_pie.c                                            |    2 
 net/sctp/input.c                                                  |    4 
 net/sctp/sm_sideeffect.c                                          |    4 
 net/sctp/transport.c                                              |    2 
 net/smc/af_smc.c                                                  |    3 
 net/smc/smc_core.c                                                |    3 
 net/smc/smc_ib.c                                                  |    6 
 net/sunrpc/sysctl.c                                               |    9 
 net/tipc/node.c                                                   |    4 
 net/tipc/topsrv.c                                                 |   10 
 net/tls/tls_device.c                                              |   42 
 net/tls/tls_sw.c                                                  |    8 
 net/vmw_vsock/af_vsock.c                                          |    2 
 net/vmw_vsock/virtio_transport_common.c                           |    8 
 net/wireless/nl80211.c                                            |    2 
 net/x25/af_x25.c                                                  |    9 
 net/xdp/xdp_umem.c                                                |   19 
 net/xdp/xdp_umem.h                                                |    2 
 net/xdp/xsk.c                                                     |   31 
 net/xdp/xsk_buff_pool.c                                           |   14 
 net/xdp/xsk_queue.h                                               |    6 
 net/xfrm/xfrm_compat.c                                            |    5 
 net/xfrm/xfrm_state.c                                             |    4 
 samples/bpf/task_fd_query_user.c                                  |    2 
 samples/bpf/tracex2_user.c                                        |    2 
 samples/bpf/tracex3_user.c                                        |    2 
 samples/bpf/xdp_redirect_cpu_user.c                               |    2 
 samples/bpf/xdp_rxq_info_user.c                                   |    2 
 samples/ftrace/ftrace-direct-modify.c                             |    2 
 samples/ftrace/ftrace-direct-too.c                                |    1 
 samples/ftrace/ftrace-direct.c                                    |    1 
 scripts/Makefile.build                                            |   12 
 scripts/Makefile.extrawarn                                        |    2 
 scripts/bpf_helpers_doc.py                                        |    1 
 scripts/lld-version.sh                                            |   20 
 scripts/package/builddeb                                          |    2 
 security/selinux/ibpkey.c                                         |    4 
 sound/core/control.c                                              |    2 
 sound/firewire/fireworks/fireworks_transaction.c                  |    4 
 sound/pci/hda/hda_generic.c                                       |   12 
 sound/pci/hda/hda_generic.h                                       |    1 
 sound/pci/hda/hda_intel.c                                         |    3 
 sound/pci/hda/patch_ca0132.c                                      |    2 
 sound/pci/hda/patch_hdmi.c                                        |    1 
 sound/pci/hda/patch_realtek.c                                     |  157 -
 sound/pci/mixart/mixart_core.c                                    |    5 
 sound/soc/codecs/rt1015.c                                         |   22 
 sound/soc/codecs/rt1015.h                                         |    2 
 sound/soc/codecs/rt5682.c                                         |    1 
 sound/soc/codecs/wm_adsp.c                                        |    1 
 sound/soc/intel/boards/bytcr_rt5640.c                             |   17 
 sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c               |    2 
 sound/soc/intel/catpt/pcm.c                                       |    9 
 sound/soc/intel/keembay/kmb_platform.c                            |    6 
 sound/soc/qcom/lpass-cpu.c                                        |   62 
 sound/soc/qcom/lpass-lpaif-reg.h                                  |    7 
 sound/soc/qcom/lpass-platform.c                                   |   25 
 sound/soc/qcom/lpass.h                                            |    1 
 sound/usb/card.c                                                  |    4 
 sound/usb/mixer_maps.c                                            |    3 
 sound/usb/mixer_us16x08.c                                         |    2 
 sound/usb/quirks.c                                                |   10 
 tools/arch/x86/include/asm/insn.h                                 |   15 
 tools/arch/x86/lib/memcpy_64.S                                    |    8 
 tools/arch/x86/lib/memset_64.S                                    |   11 
 tools/bootconfig/main.c                                           |  124 
 tools/bootconfig/test-bootconfig.sh                               |    6 
 tools/bpf/bpftool/btf.c                                           |    1 
 tools/bpf/bpftool/feature.c                                       |    7 
 tools/bpf/bpftool/net.c                                           |   18 
 tools/bpf/bpftool/pids.c                                          |    4 
 tools/bpf/bpftool/prog.c                                          |    2 
 tools/bpf/bpftool/skeleton/profiler.bpf.c                         |    4 
 tools/include/uapi/linux/bpf.h                                    |    4 
 tools/kvm/kvm_stat/kvm_stat                                       |    6 
 tools/lib/bpf/Makefile                                            |    2 
 tools/lib/bpf/hashmap.h                                           |   15 
 tools/lib/bpf/libbpf.c                                            |   23 
 tools/lib/bpf/ringbuf.c                                           |    2 
 tools/lib/bpf/xsk.c                                               |    9 
 tools/perf/arch/x86/tests/dwarf-unwind.c                          |    7 
 tools/perf/bench/mem-memcpy-x86-64-asm.S                          |    3 
 tools/perf/bench/mem-memset-x86-64-asm.S                          |    3 
 tools/perf/builtin-diff.c                                         |    4 
 tools/perf/builtin-inject.c                                       |   12 
 tools/perf/builtin-lock.c                                         |    4 
 tools/perf/tests/shell/test_arm_coresight.sh                      |    4 
 tools/perf/util/dwarf-aux.c                                       |   28 
 tools/perf/util/hashmap.h                                         |   15 
 tools/perf/util/include/linux/linkage.h                           |    7 
 tools/perf/util/probe-finder.c                                    |    3 
 tools/perf/util/stat-display.c                                    |    5 
 tools/perf/util/synthetic-events.c                                |    3 
 tools/power/x86/turbostat/Makefile                                |    3 
 tools/power/x86/turbostat/turbostat.8                             |    2 
 tools/power/x86/turbostat/turbostat.c                             |  573 ++-
 tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c   |   67 
 tools/testing/ktest/ktest.pl                                      |    2 
 tools/testing/kunit/.gitattributes                                |    1 
 tools/testing/kunit/kunit.py                                      |   27 
 tools/testing/kunit/kunit_kernel.py                               |   53 
 tools/testing/kunit/kunit_parser.py                               |   17 
 tools/testing/kunit/kunit_tool_test.py                            |    4 
 tools/testing/scatterlist/linux/mm.h                              |    1 
 tools/testing/scatterlist/main.c                                  |    4 
 tools/testing/selftests/bpf/prog_tests/align.c                    |    8 
 tools/testing/selftests/bpf/prog_tests/map_init.c                 |  214 +
 tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c      |   71 
 tools/testing/selftests/bpf/prog_tests/ringbuf.c                  |    8 
 tools/testing/selftests/bpf/prog_tests/ringbuf_multi.c            |    2 
 tools/testing/selftests/bpf/prog_tests/sockopt_multi.c            |    3 
 tools/testing/selftests/bpf/prog_tests/subprogs.c                 |    6 
 tools/testing/selftests/bpf/prog_tests/test_global_funcs.c        |    1 
 tools/testing/selftests/bpf/progs/profiler.inc.h                  |   11 
 tools/testing/selftests/bpf/progs/test_global_func8.c             |   19 
 tools/testing/selftests/bpf/progs/test_map_init.c                 |   33 
 tools/testing/selftests/bpf/progs/test_probe_read_user_str.c      |   25 
 tools/testing/selftests/bpf/progs/test_subprogs_unused.c          |   21 
 tools/testing/selftests/bpf/test_offload.py                       |   53 
 tools/testing/selftests/bpf/verifier/array_access.c               |    2 
 tools/testing/selftests/bpf/verifier/bounds.c                     |   41 
 tools/testing/selftests/kvm/.gitignore                            |    4 
 tools/testing/selftests/kvm/Makefile                              |   25 
 tools/testing/selftests/kvm/aarch64/get-reg-list-sve.c            |    3 
 tools/testing/selftests/kvm/aarch64/get-reg-list.c                |  841 +++++
 tools/testing/selftests/kvm/clear_dirty_log_test.c                |    6 
 tools/testing/selftests/kvm/demand_paging_test.c                  |  269 -
 tools/testing/selftests/kvm/dirty_log_perf_test.c                 |  376 ++
 tools/testing/selftests/kvm/dirty_log_test.c                      |  191 +
 tools/testing/selftests/kvm/include/kvm_util.h                    |    7 
 tools/testing/selftests/kvm/include/perf_test_util.h              |  198 +
 tools/testing/selftests/kvm/include/test_util.h                   |    2 
 tools/testing/selftests/kvm/include/x86_64/processor.h            |   38 
 tools/testing/selftests/kvm/lib/aarch64/processor.c               |    4 
 tools/testing/selftests/kvm/lib/aarch64/ucall.c                   |    3 
 tools/testing/selftests/kvm/lib/kvm_util.c                        |   67 
 tools/testing/selftests/kvm/lib/kvm_util_internal.h               |    2 
 tools/testing/selftests/kvm/lib/s390x/processor.c                 |    4 
 tools/testing/selftests/kvm/lib/s390x/ucall.c                     |    3 
 tools/testing/selftests/kvm/lib/test_util.c                       |   22 
 tools/testing/selftests/kvm/lib/x86_64/handlers.S                 |   81 
 tools/testing/selftests/kvm/lib/x86_64/processor.c                |  146 
 tools/testing/selftests/kvm/lib/x86_64/ucall.c                    |    3 
 tools/testing/selftests/kvm/set_memory_region_test.c              |   17 
 tools/testing/selftests/kvm/x86_64/kvm_pv_test.c                  |  234 +
 tools/testing/selftests/net/fcnal-test.sh                         |   95 
 tools/testing/selftests/net/udpgso_bench_rx.c                     |    3 
 tools/testing/selftests/powerpc/include/utils.h                   |    5 
 tools/testing/selftests/powerpc/security/.gitignore               |    1 
 tools/testing/selftests/powerpc/security/Makefile                 |    4 
 tools/testing/selftests/powerpc/security/entry_flush.c            |  139 
 tools/testing/selftests/powerpc/security/flush_utils.c            |   70 
 tools/testing/selftests/powerpc/security/flush_utils.h            |   17 
 tools/testing/selftests/powerpc/security/rfi_flush.c              |   96 
 tools/testing/selftests/seccomp/seccomp_bpf.c                     |    8 
 tools/testing/selftests/tc-testing/config                         |    1 
 tools/testing/selftests/tc-testing/tc-tests/filters/tests.json    |    4 
 tools/testing/selftests/vm/Makefile                               |    4 
 tools/testing/selftests/vm/userfaultfd.c                          |   25 
 1498 files changed, 21843 insertions(+), 11174 deletions(-)

New commits:
commit 82d8d2c0d3970526f5f607ec12d423c083d68cf9
Merge: 002dd17efd0c 4efd7faba5e0
Author: Kevin Brace <kevinbrace at gmx.com>
Date:   Fri Dec 18 17:35:37 2020 -0800

    Merge tag 'drm-next-2020-12-18' of git://anongit.freedesktop.org/drm/drm into drm-next-5.11
    
    UAPI Changes:
    
    - Only enable char/agp uapi when CONFIG_DRM_LEGACY is set
    
    Cross-subsystem Changes:
    
    - vma_set_file helper to make vma->vm_file changing less brittle,
      acked by Andrew
    
    Core Changes:
    
    - dma-buf heaps improvements
    - pass full atomic modeset state to driver callbacks
    - shmem helpers: cached bo by default
    - cleanups for fbdev, fb-helpers
    - better docs for drm modes and SCALING_FITLER uapi
    - ttm: fix dma32 page pool regression
    
    Driver Changes:
    
    - multi-hop regression fixes for amdgpu, radeon, nouveau
    - lots of small amdgpu hw enabling fixes (display, pm, ...)
    - fixes for imx, mcde, meson, some panels, virtio, qxl, i915, all
      fairly minor
    - some cleanups for legacy drm/fbdev drivers

commit 4efd7faba5e0687ae9143b7e6a19547ede20a7dd
Merge: f96f62597ea4 046f70d31ddb
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Fri Dec 18 16:22:10 2020 +0100

    Merge tag 'drm-intel-next-fixes-2020-12-18' of git://anongit.freedesktop.org/drm/drm-intel into drm-next
    
    drm/i915 fixes for the merge window
    
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    From: Jani Nikula <jani.nikula at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/87zh2bp34m.fsf@intel.com

commit f96f62597ea48cc15d6b16bddf05dc25437dcf2d
Author: Christian König <ckoenig.leichtzumerken at gmail.com>
Date:   Fri Dec 18 14:42:43 2020 +0100

    drm/qxl: don't allocate a dma_address array
    
    That seems to be unused.
    
    Daniel: Mike reported a warning when booting with qxl, which this
    patch fixes:
    
    [    1.815561] WARNING: CPU: 7 PID: 355 at drivers/gpu/drm/ttm/ttm_pool.c:365 ttm_pool_alloc+0x41b/0x540 [ttm]
    
    Signed-off-by: Christian König <christian.koenig at amd.com>
    Reported-by: Mike Galbraith <efault at gmx.de>
    Tested-by: Mike Galbraith <efault at gmx.de>
    References: https://lore.kernel.org/lkml/7cb43d5b-4e6a-defc-1ab6-5f713ad5a963@amd.com/
    Reviewed-by: David Airlie <airlied at redhat.com>
    [davnet: bring commit message up to par.]
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201218134243.110884-1-christian.koenig@amd.com

diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index 128c38c8a837..7dd0c69baa47 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -115,7 +115,7 @@ static struct ttm_tt *qxl_ttm_tt_create(struct ttm_buffer_object *bo,
 	ttm = kzalloc(sizeof(struct ttm_tt), GFP_KERNEL);
 	if (ttm == NULL)
 		return NULL;
-	if (ttm_dma_tt_init(ttm, bo, page_flags, ttm_cached)) {
+	if (ttm_tt_init(ttm, bo, page_flags, ttm_cached)) {
 		kfree(ttm);
 		return NULL;
 	}
commit 660a59953f4ff8a4958e73f7618445ff537582b2
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Dec 18 06:09:43 2020 +1000

    drm/nouveau: fix multihop when move doesn't work.
    
    As per the radeon/amdgpu fix don't use multihop if hw moves
    aren't enabled.
    
    Reported-by: Mike Galbraith <efault at gmx.de>
    Tested-by: Mike Galbraith <efault at gmx.de>
    Fixes: 0c8c0659d747 ("drm/nouveau/ttm: use multihop")
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201217200943.30511-1-airlied@gmail.com

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 1386b0fc1640..c85b1af06b7b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -942,16 +942,6 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict,
 	struct nouveau_drm_tile *new_tile = NULL;
 	int ret = 0;
 
-	if ((old_reg->mem_type == TTM_PL_SYSTEM &&
-	     new_reg->mem_type == TTM_PL_VRAM) ||
-	    (old_reg->mem_type == TTM_PL_VRAM &&
-	     new_reg->mem_type == TTM_PL_SYSTEM)) {
-		hop->fpfn = 0;
-		hop->lpfn = 0;
-		hop->mem_type = TTM_PL_TT;
-		hop->flags = 0;
-		return -EMULTIHOP;
-	}
 
 	if (new_reg->mem_type == TTM_PL_TT) {
 		ret = nouveau_ttm_tt_bind(bo->bdev, bo->ttm, new_reg);
@@ -995,14 +985,25 @@ nouveau_bo_move(struct ttm_buffer_object *bo, bool evict,
 
 	/* Hardware assisted copy. */
 	if (drm->ttm.move) {
+		if ((old_reg->mem_type == TTM_PL_SYSTEM &&
+		     new_reg->mem_type == TTM_PL_VRAM) ||
+		    (old_reg->mem_type == TTM_PL_VRAM &&
+		     new_reg->mem_type == TTM_PL_SYSTEM)) {
+			hop->fpfn = 0;
+			hop->lpfn = 0;
+			hop->mem_type = TTM_PL_TT;
+			hop->flags = 0;
+			return -EMULTIHOP;
+		}
 		ret = nouveau_bo_move_m2mf(bo, evict, ctx,
 					   new_reg);
-		if (!ret)
-			goto out;
-	}
+	} else
+		ret = -ENODEV;
 
-	/* Fallback to software copy. */
-	ret = ttm_bo_move_memcpy(bo, ctx, new_reg);
+	if (ret) {
+		/* Fallback to software copy. */
+		ret = ttm_bo_move_memcpy(bo, ctx, new_reg);
+	}
 
 out:
 	if (drm->client.device.info.family < NV_DEVICE_INFO_V0_TESLA) {
commit 046f70d31ddb2069941aec54966fec5b7fbc7b7b
Author: Aditya Swarup <aditya.swarup at intel.com>
Date:   Wed Dec 2 23:23:58 2020 -0800

    drm/i915/tgl: Fix REVID macros for TGL to fetch correct stepping
    
    Fix TGL REVID macros to fetch correct display/gt stepping based
    on SOC rev id from INTEL_REVID() macro. Previously, we were just
    returning the first element of the revid array instead of using
    the correct index based on SOC rev id.
    
    Fixes: c33298cb34f5 ("drm/i915/tgl: Fix stepping WA matching")
    Cc: José Roberto de Souza <jose.souza at intel.com>
    Cc: Matt Roper <matthew.d.roper at intel.com>
    Cc: Lucas De Marchi <lucas.demarchi at intel.com>
    Cc: Jani Nikula <jani.nikula at intel.com>
    Cc: Ville Syrjälä <ville.syrjala at linux.intel.com>
    Signed-off-by: Aditya Swarup <aditya.swarup at intel.com>
    Reviewed-by: Lucas De Marchi <lucas.demarchi at intel.com>
    Signed-off-by: Lucas De Marchi <lucas.demarchi at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201203072359.156682-1-aditya.swarup@intel.com
    (cherry picked from commit 83dbd74f8243f020d1ad8a3a3b3cd0795067920e)
    Signed-off-by: Jani Nikula <jani.nikula at intel.com>

diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 15be8debae54..0a3ee4f9dc0a 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1579,9 +1579,9 @@ static inline const struct i915_rev_steppings *
 tgl_revids_get(struct drm_i915_private *dev_priv)
 {
 	if (IS_TGL_U(dev_priv) || IS_TGL_Y(dev_priv))
-		return tgl_uy_revids;
+		return &tgl_uy_revids[INTEL_REVID(dev_priv)];
 	else
-		return tgl_revids;
+		return &tgl_revids[INTEL_REVID(dev_priv)];
 }
 
 #define IS_TGL_DISP_REVID(p, since, until) \
@@ -1591,14 +1591,14 @@ tgl_revids_get(struct drm_i915_private *dev_priv)
 
 #define IS_TGL_UY_GT_REVID(p, since, until) \
 	((IS_TGL_U(p) || IS_TGL_Y(p)) && \
-	 tgl_uy_revids->gt_stepping >= (since) && \
-	 tgl_uy_revids->gt_stepping <= (until))
+	 tgl_uy_revids[INTEL_REVID(p)].gt_stepping >= (since) && \
+	 tgl_uy_revids[INTEL_REVID(p)].gt_stepping <= (until))
 
 #define IS_TGL_GT_REVID(p, since, until) \
 	(IS_TIGERLAKE(p) && \
 	 !(IS_TGL_U(p) || IS_TGL_Y(p)) && \
-	 tgl_revids->gt_stepping >= (since) && \
-	 tgl_revids->gt_stepping <= (until))
+	 tgl_revids[INTEL_REVID(p)].gt_stepping >= (since) && \
+	 tgl_revids[INTEL_REVID(p)].gt_stepping <= (until))
 
 #define RKL_REVID_A0		0x0
 #define RKL_REVID_B0		0x1
commit 0e53656ad8abc99e0a80c3de611e593ebbf55829
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Dec 16 09:29:51 2020 +0000

    drm/i915: Fix mismatch between misplaced vma check and vma insert
    
    When inserting a VMA, we restrict the placement to the low 4G unless the
    caller opts into using the full range. This was done to allow usersapce
    the opportunity to transition slowly from a 32b address space, and to
    avoid breaking inherent 32b assumptions of some commands.
    
    However, for insert we limited ourselves to 4G-4K, but on verification
    we allowed the full 4G. This causes some attempts to bind a new buffer
    to sporadically fail with -ENOSPC, but at other times be bound
    successfully.
    
    commit 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1
    page") suggests that there is a genuine problem with stateless addressing
    that cannot utilize the last page in 4G and so we purposefully excluded
    it. This means that the quick pin pass may cause us to utilize a buggy
    placement.
    
    Reported-by: CQ Tang <cq.tang at intel.com>
    Testcase: igt/gem_exec_params/larger-than-life-batch
    Fixes: 48ea1e32c39d ("drm/i915/gen9: Set PIN_ZONE_4G end to 4GB - 1 page")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: CQ Tang <cq.tang at intel.com>
    Reviewed-by: CQ Tang <cq.tang at intel.com>
    Reviewed-by: Matthew Auld <matthew.auld at intel.com>
    Cc: <stable at vger.kernel.org> # v4.5+
    Link: https://patchwork.freedesktop.org/patch/msgid/20201216092951.7124-1-chris@chris-wilson.co.uk
    (cherry picked from commit 5f22cc0b134ab702d7f64b714e26018f7288ffee)
    Signed-off-by: Jani Nikula <jani.nikula at intel.com>

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index b07dc1156a0e..bcc80f428172 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -382,7 +382,7 @@ eb_vma_misplaced(const struct drm_i915_gem_exec_object2 *entry,
 		return true;
 
 	if (!(flags & EXEC_OBJECT_SUPPORTS_48B_ADDRESS) &&
-	    (vma->node.start + vma->node.size - 1) >> 32)
+	    (vma->node.start + vma->node.size + 4095) >> 32)
 		return true;
 
 	if (flags & __EXEC_OBJECT_NEEDS_MAP &&
commit dd0e2193b1e41efe611d265cea2719df4e59560f
Author: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
Date:   Thu Nov 26 12:51:55 2020 +0200

    drm/i915/perf: also include Gen11 in OATAILPTR workaround
    
    CI shows this workaround is also needed on Gen11.
    
    Signed-off-by: Lionel Landwerlin <lionel.g.landwerlin at intel.com>
    Fixes: 059a0beb486344 ("drm/i915/perf: workaround register corruption in OATAILPTR")
    Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201126105155.540350-1-lionel.g.landwerlin@intel.com
    (cherry picked from commit fa5d598b8cbab0af92bac48fd60e74a893550923)
    Signed-off-by: Jani Nikula <jani.nikula at intel.com>

diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
index 3b12c8ff7182..649c26518d26 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
@@ -914,7 +914,7 @@ static int gen8_oa_read(struct i915_perf_stream *stream,
 		intel_uncore_rmw(uncore, oastatus_reg,
 				 GEN8_OASTATUS_COUNTER_OVERFLOW |
 				 GEN8_OASTATUS_REPORT_LOST,
-				 IS_GEN_RANGE(uncore->i915, 8, 10) ?
+				 IS_GEN_RANGE(uncore->i915, 8, 11) ?
 				 (GEN8_OASTATUS_HEAD_POINTER_WRAP |
 				  GEN8_OASTATUS_TAIL_POINTER_WRAP) : 0);
 	}
commit 2ccf2e03868455e508b4dc9fbd1bb1daebf2222e
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Nov 27 14:57:48 2020 +0000

    Revert "drm/i915: re-order if/else ladder for hpd_irq_setup"
    
    We now use ilk_hpd_irq_setup for all GMCH platforms that do not have
    hotplug. These are early gen3 and gen2 devices that now explode on boot
    as they try to access non-existent registers.
    
    Fixes: 794d61a19090 ("drm/i915: re-order if/else ladder for hpd_irq_setup")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: Lucas De Marchi <lucas.demarchi at intel.com>
    Cc: José Roberto de Souza <jose.souza at intel.com>
    Cc: Jani Nikula <jani.nikula at linux.intel.com>
    Reviewed-by: Jani Nikula <jani.nikula at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201127145748.29491-1-chris@chris-wilson.co.uk
    (cherry picked from commit e5346a1ff38a405c14ce8e595269e9b7dcfbb2e9)
    Signed-off-by: Jani Nikula <jani.nikula at intel.com>

diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index dc6febc63f1c..c80eeac53952 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -4242,18 +4242,21 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
 	 */
 	dev_priv->hotplug.hpd_short_storm_enabled = !HAS_DP_MST(dev_priv);
 
-	if (HAS_PCH_DG1(dev_priv))
-		dev_priv->display.hpd_irq_setup = dg1_hpd_irq_setup;
-	else if (INTEL_GEN(dev_priv) >= 11)
-		dev_priv->display.hpd_irq_setup = gen11_hpd_irq_setup;
-	else if (IS_GEN9_LP(dev_priv))
-		dev_priv->display.hpd_irq_setup = bxt_hpd_irq_setup;
-	else if (INTEL_PCH_TYPE(dev_priv) >= PCH_SPT)
-		dev_priv->display.hpd_irq_setup = spt_hpd_irq_setup;
-	else if (HAS_GMCH(dev_priv) && I915_HAS_HOTPLUG(dev_priv))
-		dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
-	else
-		dev_priv->display.hpd_irq_setup = ilk_hpd_irq_setup;
+	if (HAS_GMCH(dev_priv)) {
+		if (I915_HAS_HOTPLUG(dev_priv))
+			dev_priv->display.hpd_irq_setup = i915_hpd_irq_setup;
+	} else {
+		if (HAS_PCH_DG1(dev_priv))
+			dev_priv->display.hpd_irq_setup = dg1_hpd_irq_setup;
+		else if (INTEL_GEN(dev_priv) >= 11)
+			dev_priv->display.hpd_irq_setup = gen11_hpd_irq_setup;
+		else if (IS_GEN9_LP(dev_priv))
+			dev_priv->display.hpd_irq_setup = bxt_hpd_irq_setup;
+		else if (INTEL_PCH_TYPE(dev_priv) >= PCH_SPT)
+			dev_priv->display.hpd_irq_setup = spt_hpd_irq_setup;
+		else
+			dev_priv->display.hpd_irq_setup = ilk_hpd_irq_setup;
+	}
 }
 
 /**
commit efd3043790c6e92f0bbe1fe385db9b544131c59c
Merge: 02e66dd56422 6ae09fa49147
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Wed Dec 16 23:25:51 2020 +0100

    Merge tag 'amd-drm-fixes-5.11-2020-12-16' of git://people.freedesktop.org/~agd5f/linux into drm-next
    
    amd-drm-fixes-5.11-2020-12-16:
    
    amdgpu:
    - Fix a eDP regression for DCE asics
    - SMU fixes for sienna cichlid
    - Misc W=1 fixes
    - SDMA 5.2 reset fix
    - Suspend/resume fix
    - Misc display fixes
    - Misc runtime PM fixes and cleanups
    - Dimgrey Cavefish fixes
    - printk cleanup
    - Documentation warning fixes
    
    amdkfd:
    - Error logging fix
    - Fix pipe offset calculation
    
    radeon:
    - printk cleanup
    
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    From: Alex Deucher <alexdeucher at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201216192421.18627-1-alexander.deucher@amd.com

commit 6ae09fa49147e557eb6aebbb5b2059b63706d454
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Tue Dec 15 12:07:55 2020 -0500

    drm/amdgpu/disply: fix documentation warnings in display manager
    
    Add documentation for crc window.
    
    Fixes: c920888c604d ("drm/amd/display: Expose new CRC window property")
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: Wayne Lin <Wayne.Lin at amd.com>
    Reported-by: Stephen Rothwell <sfr at canb.auug.org.au>
    Reviewed-by: Wayne Lin <Wayne.Lin at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
index 0b31779a0485..2ee6edb3df93 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -337,10 +337,29 @@ struct amdgpu_display_manager {
 	const struct gpu_info_soc_bounding_box_v1_0 *soc_bounding_box;
 
 #ifdef CONFIG_DEBUG_FS
-	/* set the crc calculation window*/
+	/**
+	 * @crc_win_x_start_property:
+	 *
+	 * X start of the crc calculation window
+	 */
 	struct drm_property *crc_win_x_start_property;
+	/**
+	 * @crc_win_y_start_property:
+	 *
+	 * Y start of the crc calculation window
+	 */
 	struct drm_property *crc_win_y_start_property;
+	/**
+	 * @crc_win_x_end_property:
+	 *
+	 * X end of the crc calculation window
+	 */
 	struct drm_property *crc_win_x_end_property;
+	/**
+	 * @crc_win_y_end_property:
+	 *
+	 * Y end of the crc calculation window
+	 */
 	struct drm_property *crc_win_y_end_property;
 #endif
 	/**
commit 05053c4b4f8733e53e5d81d1684a29404b27cefd
Author: Tao Zhou <tao.zhou1 at amd.com>
Date:   Wed Dec 16 11:29:43 2020 +0800

    drm/amdgpu: print mmhub client name for dimgrey_cavefish
    
    This makes it easier to debug what block is causing the fault, same as
    sienna_cichlid.
    
    Signed-off-by: Tao Zhou <tao.zhou1 at amd.com>
    Reviewed-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
index 092ff2c43658..f107385faba2 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
@@ -136,6 +136,7 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
 		break;
 	case CHIP_SIENNA_CICHLID:
 	case CHIP_NAVY_FLOUNDER:
+	case CHIP_DIMGREY_CAVEFISH:
 		mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
 		break;
 	default:
commit 15ed44c0e7129a0967157f7b349e1b3feb26a534
Author: Tao Zhou <tao.zhou1 at amd.com>
Date:   Tue Dec 15 18:04:04 2020 +0800

    drm/amdgpu: set mode1 reset as default for dimgrey_cavefish
    
    Use mode1 reset for dimgrey_cavefish by default.
    
    Signed-off-by: Tao Zhou <tao.zhou1 at amd.com>
    Reviewed-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
index ac02dd707c44..6bee3677394a 100644
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -362,6 +362,7 @@ nv_asic_reset_method(struct amdgpu_device *adev)
 	switch (adev->asic_type) {
 	case CHIP_SIENNA_CICHLID:
 	case CHIP_NAVY_FLOUNDER:
+	case CHIP_DIMGREY_CAVEFISH:
 		return AMD_RESET_METHOD_MODE1;
 	default:
 		if (smu_baco_is_support(smu))
commit 6bdeff12a96c9a5da95c8d11fefd145eb165e32a
Author: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
Date:   Tue Dec 15 10:33:34 2020 -0500

    drm/amd/display: Add get_dig_frontend implementation for DCEx
    
    Some old ASICs might not implement/require get_dig_frontend helper; in
    this scenario, we can have a NULL pointer exception when we try to call
    it inside vbios disable operation. For example, this situation might
    happen when using Polaris12 with an eDP panel. This commit avoids this
    situation by adding a specific get_dig_frontend implementation for DCEx.
    
    Cc: Alex Deucher <alexander.deucher at amd.com>
    Cc: Borislav Petkov <bp at alien8.de>
    Cc: Harry Wentland <Harry.Wentland at amd.com>
    Cc: Nicholas Kazlauskas <Nicholas.Kazlauskas at amd.com>
    Cc: Chiawen Huang <chiawen.huang at amd.com>
    Reported-and-tested-by: Borislav Petkov <bp at suse.de>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
index 4592ccdfa9b0..210466b2d863 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
@@ -120,6 +120,7 @@ static const struct link_encoder_funcs dce110_lnk_enc_funcs = {
 	.is_dig_enabled = dce110_is_dig_enabled,
 	.destroy = dce110_link_encoder_destroy,
 	.get_max_link_cap = dce110_link_encoder_get_max_link_cap,
+	.get_dig_frontend = dce110_get_dig_frontend,
 };
 
 static enum bp_result link_transmitter_control(
@@ -235,6 +236,44 @@ static void set_link_training_complete(
 
 }
 
+unsigned int dce110_get_dig_frontend(struct link_encoder *enc)
+{
+	struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc);
+	u32 value;
+	enum engine_id result;
+
+	REG_GET(DIG_BE_CNTL, DIG_FE_SOURCE_SELECT, &value);
+
+	switch (value) {
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGA:
+		result = ENGINE_ID_DIGA;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGB:
+		result = ENGINE_ID_DIGB;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGC:
+		result = ENGINE_ID_DIGC;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGD:
+		result = ENGINE_ID_DIGD;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGE:
+		result = ENGINE_ID_DIGE;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGF:
+		result = ENGINE_ID_DIGF;
+		break;
+	case DCE110_DIG_FE_SOURCE_SELECT_DIGG:
+		result = ENGINE_ID_DIGG;
+		break;
+	default:
+		// invalid source select DIG
+		result = ENGINE_ID_UNKNOWN;
+	}
+
+	return result;
+}
+
 void dce110_link_encoder_set_dp_phy_pattern_training_pattern(
 	struct link_encoder *enc,
 	uint32_t index)
@@ -1665,7 +1704,8 @@ static const struct link_encoder_funcs dce60_lnk_enc_funcs = {
 	.disable_hpd = dce110_link_encoder_disable_hpd,
 	.is_dig_enabled = dce110_is_dig_enabled,
 	.destroy = dce110_link_encoder_destroy,
-	.get_max_link_cap = dce110_link_encoder_get_max_link_cap
+	.get_max_link_cap = dce110_link_encoder_get_max_link_cap,
+	.get_dig_frontend = dce110_get_dig_frontend
 };
 
 void dce60_link_encoder_construct(
diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
index cb714a48b171..fc6ade824c23 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h
@@ -295,6 +295,8 @@ void dce110_link_encoder_connect_dig_be_to_fe(
 	enum engine_id engine,
 	bool connect);
 
+unsigned int dce110_get_dig_frontend(struct link_encoder *enc);
+
 void dce110_link_encoder_set_dp_phy_pattern_training_pattern(
 	struct link_encoder *enc,
 	uint32_t index);
commit e607f6d268577986363e5838fea7a4f2b4927af4
Author: Tom Rix <trix at redhat.com>
Date:   Tue Dec 15 06:42:23 2020 -0800

    drm/radeon: remove h from printk format specifier
    
    See Documentation/core-api/printk-formats.rst.
    h should no longer be used in the format specifier for printk.
    
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Signed-off-by: Tom Rix <trix at redhat.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 57fb3eb3a4b4..39c1c339be7b 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -155,7 +155,7 @@ int radeon_uvd_init(struct radeon_device *rdev)
 			family_id = le32_to_cpu(hdr->ucode_version) & 0xff;
 			version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff;
 			version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
-			DRM_INFO("Found UVD firmware Version: %hu.%hu Family ID: %hu\n",
+			DRM_INFO("Found UVD firmware Version: %u.%u Family ID: %u\n",
 				 version_major, version_minor, family_id);
 
 			/*
diff --git a/drivers/gpu/drm/radeon/radeon_vce.c b/drivers/gpu/drm/radeon/radeon_vce.c
index 5e8006444704..a450497368b2 100644
--- a/drivers/gpu/drm/radeon/radeon_vce.c
+++ b/drivers/gpu/drm/radeon/radeon_vce.c
@@ -122,7 +122,7 @@ int radeon_vce_init(struct radeon_device *rdev)
 	if (sscanf(c, "%2u]", &rdev->vce.fb_version) != 1)
 		return -EINVAL;
 
-	DRM_INFO("Found VCE firmware/feedback version %hhd.%hhd.%hhd / %d!\n",
+	DRM_INFO("Found VCE firmware/feedback version %d.%d.%d / %d!\n",
 		 start, mid, end, rdev->vce.fb_version);
 
 	rdev->vce.fw_version = (start << 24) | (mid << 16) | (end << 8);
commit 0b437e64e0af749c302a7599c1a8f3e89aded559
Author: Tom Rix <trix at redhat.com>
Date:   Tue Dec 15 06:38:35 2020 -0800

    drm/amdgpu: remove h from printk format specifier
    
    See Documentation/core-api/printk-formats.rst.
    h should no longer be used in the format specifier for printk.
    
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Signed-off-by: Tom Rix <trix at redhat.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index 7c5b60e53482..8b989670ed66 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -240,7 +240,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
 
 		version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff;
 		version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
-		DRM_INFO("Found UVD firmware Version: %hu.%hu Family ID: %hu\n",
+		DRM_INFO("Found UVD firmware Version: %u.%u Family ID: %u\n",
 			version_major, version_minor, family_id);
 
 		/*
@@ -267,7 +267,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_device *adev)
 		dec_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
 		enc_minor = (le32_to_cpu(hdr->ucode_version) >> 24) & 0x3f;
 		enc_major = (le32_to_cpu(hdr->ucode_version) >> 30) & 0x3;
-		DRM_INFO("Found UVD firmware ENC: %hu.%hu DEC: .%hu Family ID: %hu\n",
+		DRM_INFO("Found UVD firmware ENC: %u.%u DEC: .%u Family ID: %u\n",
 			enc_major, enc_minor, dec_minor, family_id);
 
 		adev->uvd.max_handles = AMDGPU_MAX_UVD_HANDLES;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
index 9791a4057e8b..0d5284b936e4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -179,7 +179,7 @@ int amdgpu_vce_sw_init(struct amdgpu_device *adev, unsigned long size)
 	version_major = (ucode_version >> 20) & 0xfff;
 	version_minor = (ucode_version >> 8) & 0xfff;
 	binary_id = ucode_version & 0xff;
-	DRM_INFO("Found VCE firmware Version: %hhd.%hhd Binary ID: %hhd\n",
+	DRM_INFO("Found VCE firmware Version: %d.%d Binary ID: %d\n",
 		version_major, version_minor, binary_id);
 	adev->vce.fw_version = ((version_major << 24) | (version_minor << 16) |
 				(binary_id << 8));
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
index 1c97244e0d74..4a77c7424dfc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c
@@ -181,7 +181,7 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
 		enc_major = fw_check;
 		dec_ver = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xf;
 		vep = (le32_to_cpu(hdr->ucode_version) >> 28) & 0xf;
-		DRM_INFO("Found VCN firmware Version ENC: %hu.%hu DEC: %hu VEP: %hu Revision: %hu\n",
+		DRM_INFO("Found VCN firmware Version ENC: %u.%u DEC: %u VEP: %u Revision: %u\n",
 			enc_major, enc_minor, dec_ver, vep, fw_rev);
 	} else {
 		unsigned int version_major, version_minor, family_id;
@@ -189,7 +189,7 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev)
 		family_id = le32_to_cpu(hdr->ucode_version) & 0xff;
 		version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff;
 		version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff;
-		DRM_INFO("Found VCN firmware Version: %hu.%hu Family ID: %hu\n",
+		DRM_INFO("Found VCN firmware Version: %u.%u Family ID: %u\n",
 			version_major, version_minor, family_id);
 	}
 
commit b4bc9d95e69368935a399b16ea26ca7573abafca
Author: Colin Ian King <colin.king at canonical.com>
Date:   Tue Dec 15 10:56:51 2020 +0000

    drm/amdgpu: Fix spelling mistake "Heterogenous" -> "Heterogeneous"
    
    There is a spelling mistake in a comment in the Kconfig. Fix it.
    
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig
index b3672d10ea54..e8fb10c41f16 100644
--- a/drivers/gpu/drm/amd/amdkfd/Kconfig
+++ b/drivers/gpu/drm/amd/amdkfd/Kconfig
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MIT
 #
-# Heterogenous system architecture configuration
+# Heterogeneous system architecture configuration
 #
 
 config HSA_AMD
commit 7eded018bfeccb365963bb51be731a9f99aeea59
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Mon Dec 14 11:00:47 2020 -0500

    drm/amdgpu: fix regression in vbios reservation handling on headless
    
    We need to move the check under the non-headless case, otherwise
    we always reserve the VGA save size.
    
    Fixes: 157fe68d74c2ad ("drm/amdgpu: fix size calculation with stolen vga memory")
    Reviewed-by: Guchun Chen <guchun.chen at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
index 02af47ddddbc..c2ced5be6d7b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -496,13 +496,14 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)
 		break;
 	}
 
-	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE))
+	if (!amdgpu_device_ip_get_ip_block(adev, AMD_IP_BLOCK_TYPE_DCE)) {
 		size = 0;
-	else
+	} else {
 		size = amdgpu_gmc_get_vbios_fb_size(adev);
 
-	if (adev->mman.keep_stolen_vga_memory)
-		size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
+		if (adev->mman.keep_stolen_vga_memory)
+			size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
+	}
 
 	/* set to 0 if the pre-OS buffer uses up most of vram */
 	if ((adev->gmc.real_vram_size - size) < (8 * 1024 * 1024))
commit 3aa883ac8eea38281f97a7409d2922e6f343bf6c
Author: Jiange Zhao <Jiange.Zhao at amd.com>
Date:   Wed Nov 25 21:56:05 2020 +0800

    drm/amdgpu/SRIOV: Extend VF reset request wait period
    
    In Virtualization case, when one VF is sending too many
    FLR requests, hypervisor would stop responding to this
    VF's request for a long period of time. This is called
    event guard. During this period of cooling time, guest
    driver should wait instead of doing other things. After
    this period of time, guest driver would resume reset
    process and return to normal.
    
    Currently, guest driver would wait 12 seconds and return fail
    if it doesn't get response from host.
    
    Solution: extend this waiting time in guest driver and poll
    response periodically. Poll happens every 6 seconds and it will
    last for 60 seconds.
    
    v2: change the max repetition times from number to macro.
    
    Signed-off-by: Jiange Zhao <Jiange.Zhao at amd.com>
    Acked-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
index f5ce9a9f4cf5..7767ccca526b 100644
--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
@@ -187,7 +187,16 @@ static int xgpu_ai_send_access_requests(struct amdgpu_device *adev,
 
 static int xgpu_ai_request_reset(struct amdgpu_device *adev)
 {
-	return xgpu_ai_send_access_requests(adev, IDH_REQ_GPU_RESET_ACCESS);
+	int ret, i = 0;
+
+	while (i < AI_MAILBOX_POLL_MSG_REP_MAX) {
+		ret = xgpu_ai_send_access_requests(adev, IDH_REQ_GPU_RESET_ACCESS);
+		if (!ret)
+			break;
+		i++;
+	}
+
+	return ret;
 }
 
 static int xgpu_ai_request_full_gpu_access(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.h b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.h
index 83b453f5d717..50572635d0f8 100644
--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.h
+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.h
@@ -25,8 +25,9 @@
 #define __MXGPU_AI_H__
 
 #define AI_MAILBOX_POLL_ACK_TIMEDOUT	500
-#define AI_MAILBOX_POLL_MSG_TIMEDOUT	12000
+#define AI_MAILBOX_POLL_MSG_TIMEDOUT	6000
 #define AI_MAILBOX_POLL_FLR_TIMEDOUT	5000
+#define AI_MAILBOX_POLL_MSG_REP_MAX	11
 
 enum idh_request {
 	IDH_REQ_GPU_INIT_ACCESS = 1,
diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
index 666ed99cc14b..dd5c1e6ce009 100644
--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
@@ -200,7 +200,16 @@ static int xgpu_nv_send_access_requests(struct amdgpu_device *adev,
 
 static int xgpu_nv_request_reset(struct amdgpu_device *adev)
 {
-	return xgpu_nv_send_access_requests(adev, IDH_REQ_GPU_RESET_ACCESS);
+	int ret, i = 0;
+
+	while (i < NV_MAILBOX_POLL_MSG_REP_MAX) {
+		ret = xgpu_nv_send_access_requests(adev, IDH_REQ_GPU_RESET_ACCESS);
+		if (!ret)
+			break;
+		i++;
+	}
+
+	return ret;
 }
 
 static int xgpu_nv_request_full_gpu_access(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.h b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.h
index 52605e14a1a5..9f5808616174 100644
--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.h
+++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.h
@@ -27,6 +27,7 @@
 #define NV_MAILBOX_POLL_ACK_TIMEDOUT	500
 #define NV_MAILBOX_POLL_MSG_TIMEDOUT	6000
 #define NV_MAILBOX_POLL_FLR_TIMEDOUT	5000
+#define NV_MAILBOX_POLL_MSG_REP_MAX	11
 
 enum idh_request {
 	IDH_REQ_GPU_INIT_ACCESS = 1,
commit 325f4b59f6361df0e20a39acd3b89c265d6ca2a8
Author: Yifan Zhang <yifan1.zhang at amd.com>
Date:   Mon Dec 14 17:45:20 2020 +0800

    drm/amdkfd: correct amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu log.
    
    it could also be insufficient vram that makes
    amdgpu_amdkfd_reserve_mem_limit fail.
    
    Signed-off-by: Yifan Zhang <yifan1.zhang at amd.com>
    Reviewed-by: Felix Kuehling <Felix.Kuehling at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 7791d074bd32..2d991da2cead 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1213,7 +1213,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
 
 	ret = amdgpu_amdkfd_reserve_mem_limit(adev, size, alloc_domain, !!sg);
 	if (ret) {
-		pr_debug("Insufficient system memory\n");
+		pr_debug("Insufficient memory\n");
 		goto err_reserve_limit;
 	}
 
commit 8409e20e0785c0fc689446318c50eb11eb5ae0fe
Author: Souptick Joarder <jrdr.linux at gmail.com>
Date:   Sat Dec 12 20:26:24 2020 +0530

    drm/amd/display: Adding prototype for dccg21_update_dpp_dto()
    
    Kernel test robot throws below warning ->
    
    drivers/gpu/drm/amd/amdgpu/../display/dc/dcn21/dcn21_dccg.c:46:6:
    warning: no previous prototype for 'dccg21_update_dpp_dto'
    [-Wmissing-prototypes]
    
    Adding prototype for dccg21_update_dpp_dto().
    
    Reported-by: kernel test robot <lkp at intel.com>
    Signed-off-by: Souptick Joarder <jrdr.linux at gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_dccg.h b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_dccg.h
index b7efa777ec73..e44a37491c1e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_dccg.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_dccg.h
@@ -32,5 +32,6 @@ struct dccg *dccg21_create(
 	const struct dccg_shift *dccg_shift,
 	const struct dccg_mask *dccg_mask);
 
+void dccg21_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppclk);
 
 #endif /* __DCN21_DCCG_H__ */
commit d00a88ab5870f16623df9380ab85dd732667d4c8
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 17:06:18 2020 -0500

    drm/amdgpu: print what method we are using for runtime pm
    
    So we know when it's enabled and what method we are using.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index af049041ea3f..b16b32797624 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -163,9 +163,11 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 	if (amdgpu_device_supports_atpx(dev) &&
 	    (amdgpu_runtime_pm != 0)) { /* enable runpm by default for atpx */
 		adev->runpm = true;
+		dev_info(adev->dev, "Using ATPX for runtime pm\n");
 	} else if (amdgpu_device_supports_boco(dev) &&
 		   (amdgpu_runtime_pm != 0)) { /* enable runpm by default for boco */
 		adev->runpm = true;
+		dev_info(adev->dev, "Using BOCO for runtime pm\n");
 	} else if (amdgpu_device_supports_baco(dev) &&
 		   (amdgpu_runtime_pm != 0)) {
 		switch (adev->asic_type) {
@@ -187,6 +189,8 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 			adev->runpm = true;
 			break;
 		}
+		if (adev->runpm)
+			dev_info(adev->dev, "Using BACO for runtime pm\n");
 	}
 
 	/* Call ACPI methods: require modeset init
commit 637bb036ce665cede8914c4dca540d8f9f38af65
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 13:21:36 2020 -0500

    drm/amdgpu: simplify logic in atpx resume handling
    
    Simplify the logic in the runtime resume handling for
    atpx
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 4f97d493eeda..cac2724e7615 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1382,16 +1382,14 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
 		/* Only need to handle PCI state in the driver for ATPX
 		 * PCI core handles it for _PR3.
 		 */
-		if (amdgpu_is_atpx_hybrid()) {
-			pci_set_master(pdev);
-		} else {
+		if (!amdgpu_is_atpx_hybrid()) {
 			pci_set_power_state(pdev, PCI_D0);
 			amdgpu_device_load_pci_state(pdev);
 			ret = pci_enable_device(pdev);
 			if (ret)
 				return ret;
-			pci_set_master(pdev);
 		}
+		pci_set_master(pdev);
 	} else if (amdgpu_device_supports_boco(drm_dev)) {
 		/* Only need to handle PCI state in the driver for ATPX
 		 * PCI core handles it for _PR3.
commit ceb4de67c96051967c7c0095fc6036ef0d1e1248
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 13:20:03 2020 -0500

    drm/amdgpu: no need to call pci_ignore_hotplug for _PR3
    
    The platform knows it's doing d3cold.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 90b8ce762aee..4f97d493eeda 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1352,20 +1352,13 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
 		/* Only need to handle PCI state in the driver for ATPX
 		 * PCI core handles it for _PR3.
 		 */
-		if (amdgpu_is_atpx_hybrid()) {
-			pci_ignore_hotplug(pdev);
-		} else {
+		if (!amdgpu_is_atpx_hybrid()) {
 			amdgpu_device_cache_pci_state(pdev);
 			pci_disable_device(pdev);
 			pci_ignore_hotplug(pdev);
 			pci_set_power_state(pdev, PCI_D3cold);
 		}
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
-	} else if (amdgpu_device_supports_boco(drm_dev)) {
-		/* Only need to handle PCI state in the driver for ATPX
-		 * PCI core handles it for _PR3.
-		 */
-		pci_ignore_hotplug(pdev);
 	} else if (amdgpu_device_supports_baco(drm_dev)) {
 		amdgpu_device_baco_enter(drm_dev);
 	}
commit 157e8306038cf54e3c5149e72ad88ac0448ec7e2
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 13:12:50 2020 -0500

    drm/amdgpu: support runtime pm for GPUs that support BOCO
    
    Enable runtime pm on non HG/PX BOCO capable boards.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index ec8fff7839ef..af049041ea3f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -161,7 +161,10 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 	}
 
 	if (amdgpu_device_supports_atpx(dev) &&
-	    (amdgpu_runtime_pm != 0)) { /* enable runpm by default for boco */
+	    (amdgpu_runtime_pm != 0)) { /* enable runpm by default for atpx */
+		adev->runpm = true;
+	} else if (amdgpu_device_supports_boco(dev) &&
+		   (amdgpu_runtime_pm != 0)) { /* enable runpm by default for boco */
 		adev->runpm = true;
 	} else if (amdgpu_device_supports_baco(dev) &&
 		   (amdgpu_runtime_pm != 0)) {
commit 0330b8487842924351663878582b777002792acd
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 13:10:21 2020 -0500

    drm/amdgpu: update amdgpu_device_supports_boco()
    
    Change it to check if the device has ACPI power resources.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index a96150ab0774..7d2f7a2240b8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -229,7 +229,7 @@ bool amdgpu_device_supports_atpx(struct drm_device *dev)
 }
 
 /**
- * amdgpu_device_supports_boco - Is the device a dGPU with HG/PX power control
+ * amdgpu_device_supports_boco - Is the device a dGPU with ACPI power resources
  *
  * @dev: drm_device pointer
  *
@@ -240,7 +240,7 @@ bool amdgpu_device_supports_boco(struct drm_device *dev)
 {
 	struct amdgpu_device *adev = drm_to_adev(dev);
 
-	if (adev->flags & AMD_IS_PX)
+	if (adev->has_pr3)
 		return true;
 	return false;
 }
commit b10c1c5b3a4e3f1f166ab48c3619d8348a4e9c5d
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 13:07:30 2020 -0500

    drm/amdgpu: add check for ACPI power resources
    
    Check if the device has ACPI power resources so we can
    enable runtime pm if so.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 859aae780056..e119185210de 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1024,6 +1024,7 @@ struct amdgpu_device {
 	/* enable runtime pm on the device */
 	bool                            runpm;
 	bool                            in_runpm;
+	bool                            has_pr3;
 
 	bool                            pm_sysfs_en;
 	bool                            ucode_sysfs_en;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 38fb903338a4..ec8fff7839ef 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -133,6 +133,7 @@ void amdgpu_register_gpu_instance(struct amdgpu_device *adev)
 int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 {
 	struct drm_device *dev;
+	struct pci_dev *parent;
 	int r, acpi_status;
 
 	dev = adev_to_drm(adev);
@@ -144,6 +145,9 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 	    !pci_is_thunderbolt_attached(dev->pdev))
 		flags |= AMD_IS_PX;
 
+	parent = pci_upstream_bridge(adev->pdev);
+	adev->has_pr3 = parent ? pci_pr3_present(parent) : false;
+
 	/* amdgpu_device_init should report only fatal error
 	 * like memory allocation failure or iomapping failure,
 	 * or memory manager initialization failure, it must
commit fd496ca892f52df6eb0a0bfcdef1378aed966624
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Wed Dec 9 12:45:23 2020 -0500

    drm/amdgpu: split BOCO and ATPX handling
    
    In preparation for systems that support d3cold on dGPUs
    independent of PX/HG.  No functional change intended.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index b24de64f4490..859aae780056 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1230,6 +1230,7 @@ void amdgpu_device_program_register_sequence(struct amdgpu_device *adev,
 					     const u32 *registers,
 					     const u32 array_size);
 
+bool amdgpu_device_supports_atpx(struct drm_device *dev);
 bool amdgpu_device_supports_boco(struct drm_device *dev);
 bool amdgpu_device_supports_baco(struct drm_device *dev);
 bool amdgpu_device_is_peer_accessible(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 0ec7c28c4d5a..a96150ab0774 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -211,6 +211,23 @@ static ssize_t amdgpu_device_get_serial_number(struct device *dev,
 static DEVICE_ATTR(serial_number, S_IRUGO,
 		amdgpu_device_get_serial_number, NULL);
 
+/**
+ * amdgpu_device_supports_atpx - Is the device a dGPU with HG/PX power control
+ *
+ * @dev: drm_device pointer
+ *
+ * Returns true if the device is a dGPU with HG/PX power control,
+ * otherwise return false.
+ */
+bool amdgpu_device_supports_atpx(struct drm_device *dev)
+{
+	struct amdgpu_device *adev = drm_to_adev(dev);
+
+	if (adev->flags & AMD_IS_PX)
+		return true;
+	return false;
+}
+
 /**
  * amdgpu_device_supports_boco - Is the device a dGPU with HG/PX power control
  *
@@ -1398,7 +1415,7 @@ static void amdgpu_switcheroo_set_state(struct pci_dev *pdev,
 	struct drm_device *dev = pci_get_drvdata(pdev);
 	int r;
 
-	if (amdgpu_device_supports_boco(dev) && state == VGA_SWITCHEROO_OFF)
+	if (amdgpu_device_supports_atpx(dev) && state == VGA_SWITCHEROO_OFF)
 		return;
 
 	if (state == VGA_SWITCHEROO_ON) {
@@ -3177,7 +3194,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 	struct drm_device *ddev = adev_to_drm(adev);
 	struct pci_dev *pdev = adev->pdev;
 	int r, i;
-	bool boco = false;
+	bool atpx = false;
 	u32 max_MBps;
 
 	adev->shutdown = false;
@@ -3349,15 +3366,15 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 	if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA)
 		vga_client_register(adev->pdev, adev, NULL, amdgpu_device_vga_set_decode);
 
-	if (amdgpu_device_supports_boco(ddev))
-		boco = true;
+	if (amdgpu_device_supports_atpx(ddev))
+		atpx = true;
 	if (amdgpu_has_atpx() &&
 	    (amdgpu_is_atpx_hybrid() ||
 	     amdgpu_has_atpx_dgpu_power_cntl()) &&
 	    !pci_is_thunderbolt_attached(adev->pdev))
 		vga_switcheroo_register_client(adev->pdev,
-					       &amdgpu_switcheroo_ops, boco);
-	if (boco)
+					       &amdgpu_switcheroo_ops, atpx);
+	if (atpx)
 		vga_switcheroo_init_domain_pm_ops(adev->dev, &adev->vga_pm_domain);
 
 	if (amdgpu_emu_mode == 1) {
@@ -3540,7 +3557,7 @@ fence_driver_init:
 
 failed:
 	amdgpu_vf_error_trans_all(adev);
-	if (boco)
+	if (atpx)
 		vga_switcheroo_fini_domain_pm_ops(adev->dev);
 
 failed_unmap:
@@ -3604,7 +3621,7 @@ void amdgpu_device_fini(struct amdgpu_device *adev)
 	     amdgpu_has_atpx_dgpu_power_cntl()) &&
 	    !pci_is_thunderbolt_attached(adev->pdev))
 		vga_switcheroo_unregister_client(adev->pdev);
-	if (amdgpu_device_supports_boco(adev_to_drm(adev)))
+	if (amdgpu_device_supports_atpx(adev_to_drm(adev)))
 		vga_switcheroo_fini_domain_pm_ops(adev->dev);
 	if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA)
 		vga_client_register(adev->pdev, NULL, NULL, NULL);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index ebdab31f9de9..90b8ce762aee 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -1340,7 +1340,7 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
 	}
 
 	adev->in_runpm = true;
-	if (amdgpu_device_supports_boco(drm_dev))
+	if (amdgpu_device_supports_atpx(drm_dev))
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
 	drm_kms_helper_poll_disable(drm_dev);
 
@@ -1348,7 +1348,7 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
 	if (ret)
 		return ret;
 
-	if (amdgpu_device_supports_boco(drm_dev)) {
+	if (amdgpu_device_supports_atpx(drm_dev)) {
 		/* Only need to handle PCI state in the driver for ATPX
 		 * PCI core handles it for _PR3.
 		 */
@@ -1361,6 +1361,11 @@ static int amdgpu_pmops_runtime_suspend(struct device *dev)
 			pci_set_power_state(pdev, PCI_D3cold);
 		}
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
+	} else if (amdgpu_device_supports_boco(drm_dev)) {
+		/* Only need to handle PCI state in the driver for ATPX
+		 * PCI core handles it for _PR3.
+		 */
+		pci_ignore_hotplug(pdev);
 	} else if (amdgpu_device_supports_baco(drm_dev)) {
 		amdgpu_device_baco_enter(drm_dev);
 	}
@@ -1378,7 +1383,7 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
 	if (!adev->runpm)
 		return -EINVAL;
 
-	if (amdgpu_device_supports_boco(drm_dev)) {
+	if (amdgpu_device_supports_atpx(drm_dev)) {
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_CHANGING;
 
 		/* Only need to handle PCI state in the driver for ATPX
@@ -1394,12 +1399,17 @@ static int amdgpu_pmops_runtime_resume(struct device *dev)
 				return ret;
 			pci_set_master(pdev);
 		}
+	} else if (amdgpu_device_supports_boco(drm_dev)) {
+		/* Only need to handle PCI state in the driver for ATPX
+		 * PCI core handles it for _PR3.
+		 */
+		pci_set_master(pdev);
 	} else if (amdgpu_device_supports_baco(drm_dev)) {
 		amdgpu_device_baco_exit(drm_dev);
 	}
 	ret = amdgpu_device_resume(drm_dev, false);
 	drm_kms_helper_poll_enable(drm_dev);
-	if (amdgpu_device_supports_boco(drm_dev))
+	if (amdgpu_device_supports_atpx(drm_dev))
 		drm_dev->switch_power_state = DRM_SWITCH_POWER_ON;
 	adev->in_runpm = false;
 	return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index fc12fc72366f..38fb903338a4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -156,7 +156,7 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 		goto out;
 	}
 
-	if (amdgpu_device_supports_boco(dev) &&
+	if (amdgpu_device_supports_atpx(dev) &&
 	    (amdgpu_runtime_pm != 0)) { /* enable runpm by default for boco */
 		adev->runpm = true;
 	} else if (amdgpu_device_supports_baco(dev) &&
@@ -192,7 +192,7 @@ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
 
 	if (adev->runpm) {
 		/* only need to skip on ATPX */
-		if (amdgpu_device_supports_boco(dev) &&
+		if (amdgpu_device_supports_atpx(dev) &&
 		    !amdgpu_is_atpx_hybrid())
 			dev_pm_set_driver_flags(dev->dev, DPM_FLAG_NO_DIRECT_COMPLETE);
 		pm_runtime_use_autosuspend(dev->dev);
commit 8ccbfdf0b9c334196cc45260c14081855d729bc8
Author: Souptick Joarder <jrdr.linux at gmail.com>
Date:   Sat Dec 12 01:02:36 2020 +0530

    drm/amd/display: Fixed kernel test robot warning
    
    Kernel test robot throws below warning ->
    
    drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5349:5:
    warning: no previous prototype for 'amdgpu_dm_crtc_atomic_set_property'
    [-Wmissing-prototypes]
    drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5349:5:
    warning: no previous prototype for function
    'amdgpu_dm_crtc_atomic_set_property' [-Wmissing-prototypes]
    drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5373:5:
    warning: no previous prototype for 'amdgpu_dm_crtc_atomic_get_property'
    [-Wmissing-prototypes]
    drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:5373:5:
    warning: no previous prototype for function
    'amdgpu_dm_crtc_atomic_get_property' [-Wmissing-prototypes]
    
    As these functions are only used inside amdgpu_dm.c, these can be
    made static.
    
    Reported-by: kernel test robot <lkp at intel.com>
    Signed-off-by: Souptick Joarder <jrdr.linux at gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 0a908cb8119c..2c4dbdeec46a 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5342,7 +5342,7 @@ dm_crtc_duplicate_state(struct drm_crtc *crtc)
 }
 
 #ifdef CONFIG_DEBUG_FS
-int amdgpu_dm_crtc_atomic_set_property(struct drm_crtc *crtc,
+static int amdgpu_dm_crtc_atomic_set_property(struct drm_crtc *crtc,
 					    struct drm_crtc_state *crtc_state,
 					    struct drm_property *property,
 					    uint64_t val)
@@ -5366,7 +5366,7 @@ int amdgpu_dm_crtc_atomic_set_property(struct drm_crtc *crtc,
 	return 0;
 }
 
-int amdgpu_dm_crtc_atomic_get_property(struct drm_crtc *crtc,
+static int amdgpu_dm_crtc_atomic_get_property(struct drm_crtc *crtc,
 					    const struct drm_crtc_state *state,
 					    struct drm_property *property,
 					    uint64_t *val)
commit 487193856eafa0aea498aa3a5ec0701828e79743
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Mon Dec 7 10:33:09 2020 -0500

    drm/amd/display: 3.2.116
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index b8f1e2d33423..3aedadb34548 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -42,7 +42,7 @@
 #include "inc/hw/dmcu.h"
 #include "dml/display_mode_lib.h"
 
-#define DC_VER "3.2.115"
+#define DC_VER "3.2.116"
 
 #define MAX_SURFACES 3
 #define MAX_PLANES 6
commit b6402afec1cfd2550a91e83745191376542688bc
Author: Anthony Koo <Anthony.Koo at amd.com>
Date:   Sun Dec 6 13:57:54 2020 -0500

    drm/amd/display: [FW Promotion] Release 0.0.46
    
    - Add new aux_channel_type
    - Changed port_index to instance in dmub_cmd_dp_aux_control_data
    - Change aux_return_code_type to sync up with driver
    - param for ramping abm based on backlight level
    
    Signed-off-by: Anthony Koo <Anthony.Koo at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
index b20a39f488ae..f512bda96917 100644
--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
@@ -47,10 +47,10 @@
 
 /* Firmware versioning. */
 #ifdef DMUB_EXPOSE_VERSION
-#define DMUB_FW_VERSION_GIT_HASH 0x931573111
+#define DMUB_FW_VERSION_GIT_HASH 0xa18e25995
 #define DMUB_FW_VERSION_MAJOR 0
 #define DMUB_FW_VERSION_MINOR 0
-#define DMUB_FW_VERSION_REVISION 45
+#define DMUB_FW_VERSION_REVISION 46
 #define DMUB_FW_VERSION_TEST 0
 #define DMUB_FW_VERSION_VBIOS 0
 #define DMUB_FW_VERSION_HOTFIX 0
@@ -514,12 +514,20 @@ enum dp_aux_request_action {
 
 enum aux_return_code_type {
 	AUX_RET_SUCCESS = 0,
+	AUX_RET_ERROR_UNKNOWN,
+	AUX_RET_ERROR_INVALID_REPLY,
 	AUX_RET_ERROR_TIMEOUT,
-	AUX_RET_ERROR_NO_DATA,
+	AUX_RET_ERROR_HPD_DISCON,
+	AUX_RET_ERROR_ENGINE_ACQUIRE,
 	AUX_RET_ERROR_INVALID_OPERATION,
 	AUX_RET_ERROR_PROTOCOL_ERROR,
 };
 
+enum aux_channel_type {
+	AUX_CHANNEL_LEGACY_DDC,
+	AUX_CHANNEL_DPIA
+};
+
 /* DP AUX command */
 struct aux_transaction_parameters {
 	uint8_t is_i2c_over_aux;
@@ -532,9 +540,10 @@ struct aux_transaction_parameters {
 
 struct dmub_cmd_dp_aux_control_data {
 	uint32_t handle;
-	uint8_t port_index;
+	uint8_t instance;
 	uint8_t sw_crc_enabled;
 	uint16_t timeout;
+	enum aux_channel_type type;
 	struct aux_transaction_parameters dpaux;
 };
 
@@ -558,7 +567,7 @@ struct aux_reply_data {
 
 struct aux_reply_control_data {
 	uint32_t handle;
-	uint8_t phy_port_index;
+	uint8_t instance;
 	uint8_t result;
 	uint16_t pad;
 };
@@ -581,7 +590,7 @@ enum dp_hpd_status {
 };
 
 struct dp_hpd_data {
-	uint8_t phy_port_index;
+	uint8_t instance;
 	uint8_t hpd_type;
 	uint8_t hpd_status;
 	uint8_t pad;
@@ -732,27 +741,30 @@ enum dmub_cmd_abm_type {
 struct abm_config_table {
 	/* Parameters for crgb conversion */
 	uint16_t crgb_thresh[NUM_POWER_FN_SEGS];                 // 0B
-	uint16_t crgb_offset[NUM_POWER_FN_SEGS];                 // 15B
-	uint16_t crgb_slope[NUM_POWER_FN_SEGS];                  // 31B
+	uint16_t crgb_offset[NUM_POWER_FN_SEGS];                 // 16B
+	uint16_t crgb_slope[NUM_POWER_FN_SEGS];                  // 32B
 
 	/* Parameters for custom curve */
-	uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS];        // 47B
-	uint16_t backlight_offsets[NUM_BL_CURVE_SEGS];           // 79B
-
-	uint16_t ambient_thresholds_lux[NUM_AMBI_LEVEL];         // 111B
-	uint16_t min_abm_backlight;                              // 121B
-
-	uint8_t min_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 123B
-	uint8_t max_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 143B
-	uint8_t bright_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; // 163B
-	uint8_t dark_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 183B
-	uint8_t hybrid_factor[NUM_AGGR_LEVEL];                   // 203B
-	uint8_t contrast_factor[NUM_AGGR_LEVEL];                 // 207B
-	uint8_t deviation_gain[NUM_AGGR_LEVEL];                  // 211B
-	uint8_t min_knee[NUM_AGGR_LEVEL];                        // 215B
-	uint8_t max_knee[NUM_AGGR_LEVEL];                        // 219B
-	uint8_t iir_curve[NUM_AMBI_LEVEL];                       // 223B
-	uint8_t pad3[3];                                         // 228B
+	uint16_t backlight_thresholds[NUM_BL_CURVE_SEGS];        // 48B
+	uint16_t backlight_offsets[NUM_BL_CURVE_SEGS];           // 78B
+
+	uint16_t ambient_thresholds_lux[NUM_AMBI_LEVEL];         // 112B
+	uint16_t min_abm_backlight;                              // 122B
+
+	uint8_t min_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 124B
+	uint8_t max_reduction[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 144B
+	uint8_t bright_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL]; // 164B
+	uint8_t dark_pos_gain[NUM_AMBI_LEVEL][NUM_AGGR_LEVEL];   // 184B
+	uint8_t hybrid_factor[NUM_AGGR_LEVEL];                   // 204B
+	uint8_t contrast_factor[NUM_AGGR_LEVEL];                 // 208B
+	uint8_t deviation_gain[NUM_AGGR_LEVEL];                  // 212B
+	uint8_t min_knee[NUM_AGGR_LEVEL];                        // 216B
+	uint8_t max_knee[NUM_AGGR_LEVEL];                        // 220B
+	uint8_t iir_curve[NUM_AMBI_LEVEL];                       // 224B
+	uint8_t pad3[3];                                         // 229B
+
+	uint16_t blRampReduction[NUM_AGGR_LEVEL];                // 232B
+	uint16_t blRampStart[NUM_AGGR_LEVEL];                    // 240B
 };
 
 struct dmub_cmd_abm_set_pipe_data {
commit 31c6b7a9d40ad2fc4e6180215b580b99ededae22
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Tue Dec 1 18:24:09 2020 -0500

    drm/amd/display: Fix cleanup typo in MPCC visual confirm
    
    [Why]
    Typo in MPCC visual confirmation.
    
    [How]
    Fix to correct values.
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index cba3c8cd12a1..31a477194d3b 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -2243,11 +2243,11 @@ void dcn20_get_mpctree_visual_confirm_color(
 {
 	const struct tg_color pipe_colors[6] = {
 			{MAX_TG_COLOR_VALUE, 0, 0}, // red
-			{MAX_TG_COLOR_VALUE, 0, MAX_TG_COLOR_VALUE}, // yellow
-			{0, MAX_TG_COLOR_VALUE, 0}, // blue
+			{MAX_TG_COLOR_VALUE, MAX_TG_COLOR_VALUE / 4, 0}, // orange
+			{MAX_TG_COLOR_VALUE, MAX_TG_COLOR_VALUE, 0}, // yellow
+			{0, MAX_TG_COLOR_VALUE, 0}, // green
+			{0, 0, MAX_TG_COLOR_VALUE}, // blue
 			{MAX_TG_COLOR_VALUE / 2, 0, MAX_TG_COLOR_VALUE / 2}, // purple
-			{0, 0, MAX_TG_COLOR_VALUE}, // green
-			{MAX_TG_COLOR_VALUE, MAX_TG_COLOR_VALUE * 2 / 3, 0}, // orange
 	};
 
 	struct pipe_ctx *top_pipe = pipe_ctx;
@@ -2272,14 +2272,11 @@ void dcn20_update_mpcc(struct dc *dc, struct pipe_ctx *pipe_ctx)
 
 	// input to MPCC is always RGB, by default leave black_color at 0
 	if (dc->debug.visual_confirm == VISUAL_CONFIRM_HDR) {
-		hws->funcs.get_hdr_visual_confirm_color(
-				pipe_ctx, &blnd_cfg.black_color);
+		hws->funcs.get_hdr_visual_confirm_color(pipe_ctx, &blnd_cfg.black_color);
 	} else if (dc->debug.visual_confirm == VISUAL_CONFIRM_SURFACE) {
-		hws->funcs.get_surface_visual_confirm_color(
-				pipe_ctx, &blnd_cfg.black_color);
+		hws->funcs.get_surface_visual_confirm_color(pipe_ctx, &blnd_cfg.black_color);
 	} else if (dc->debug.visual_confirm == VISUAL_CONFIRM_MPCTREE) {
-		dcn20_get_mpctree_visual_confirm_color(
-				pipe_ctx, &blnd_cfg.black_color);
+		dcn20_get_mpctree_visual_confirm_color(pipe_ctx, &blnd_cfg.black_color);
 	}
 
 	if (per_pixel_alpha)
commit e10777a67963163055f9ca43292cb21ff52967d2
Author: Felipe <Felipe.Clark at amd.com>
Date:   Mon Nov 30 17:38:02 2020 -0500

    drm/amd/display: Fix OGAM LUT calculation precision
    
    [Why]
    The OGAM LUT precision was accumulating too much error
    in the higher end.
    
    [How]
    Instead of calculating all points of the LUT in relation
    to the previous ones, perform a full calculation in one
    of the intermediate segments to stop error propagation.
    
    Signed-off-by: Felipe Clark <Felipe.Clark at amd.com>
    Reviewed-by: Krunoslav Kovac <Krunoslav.Kovac at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
index eced40a2fce4..5c67e12b2e55 100644
--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
@@ -30,6 +30,14 @@
 #include "opp.h"
 #include "color_gamma.h"
 
+/* When calculating LUT values the first region and at least one subsequent
+ * region are calculated with full precision. These defines are a demarcation
+ * of where the second region starts and ends.
+ * These are hardcoded values to avoid recalculating them in loops.
+ */
+#define PRECISE_LUT_REGION_START 224
+#define PRECISE_LUT_REGION_END 239
+
 static struct hw_x_point coordinates_x[MAX_HW_POINTS + 2];
 
 // these are helpers for calculations to reduce stack usage
@@ -346,7 +354,13 @@ static struct fixed31_32 translate_from_linear_space(
 					dc_fixpt_recip(args->gamma));
 		}
 		scratch_1 = dc_fixpt_add(one, args->a3);
-		if (cal_buffer->buffer_index < 16)
+		/* In the first region (first 16 points) and in the
+		 * region delimited by START/END we calculate with
+		 * full precision to avoid error accumulation. 
+		 */
+		if ((cal_buffer->buffer_index >= PRECISE_LUT_REGION_START &&
+			cal_buffer->buffer_index <= PRECISE_LUT_REGION_END) ||
+			(cal_buffer->buffer_index < 16))
 			scratch_2 = dc_fixpt_pow(args->arg,
 					dc_fixpt_recip(args->gamma));
 		else
@@ -397,9 +411,7 @@ static struct fixed31_32 translate_from_linear_space_long(
 					dc_fixpt_recip(args->gamma))),
 					args->a2);
 	else
-		return dc_fixpt_mul(
-			args->arg,
-			args->a1);
+		return dc_fixpt_mul(args->arg, args->a1);
 }
 
 static struct fixed31_32 calculate_gamma22(struct fixed31_32 arg, bool use_eetf, struct calculate_buffer *cal_buffer)
@@ -717,7 +729,6 @@ static struct fixed31_32 calculate_mapped_value(
 		BREAK_TO_DEBUGGER();
 		result = dc_fixpt_zero;
 	} else {
-		BREAK_TO_DEBUGGER();
 		result = dc_fixpt_one;
 	}
 
@@ -976,6 +987,7 @@ static bool build_freesync_hdr(struct pwl_float_data_ex *rgb_regamma,
 		cal_buffer->buffer_index = 0; // see var definition for more info
 	rgb += 32; // first 32 points have problems with fixed point, too small
 	coord_x += 32;
+
 	for (i = 32; i <= hw_points_num; i++) {
 		if (!is_clipped) {
 			if (use_eetf) {
commit 610c4974ad172dad884244763125f8cd6585c503
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Fri Dec 4 00:22:46 2020 -0500

    drm/amd/display: Only update FP2 for full updates
    
    [Why]
    FP2 is not double buffered and must wait for VACTIVE
    before programming.
    
    [How]
    Only update when there is a full update we should
    change FP2 to avoid delay every flip.
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 58eb0d69873a..7339d9855ec8 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -2625,6 +2625,26 @@ static void commit_planes_for_stream(struct dc *dc,
 		}
 	}
 
+	if (update_type != UPDATE_TYPE_FAST) {
+		// If changing VTG FP2: wait until back in vactive to program FP2
+		// Need to ensure that pipe unlock happens soon after to minimize race condition
+		for (i = 0; i < dc->res_pool->pipe_count; i++) {
+			struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i];
+
+			if (pipe_ctx->top_pipe || pipe_ctx->stream != stream)
+				continue;
+
+			if (!pipe_ctx->update_flags.bits.global_sync)
+				continue;
+
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VBLANK);
+			pipe_ctx->stream_res.tg->funcs->wait_for_state(pipe_ctx->stream_res.tg, CRTC_STATE_VACTIVE);
+
+			pipe_ctx->stream_res.tg->funcs->set_vtg_params(
+					pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing, true);
+		}
+	}
+
 	if ((update_type != UPDATE_TYPE_FAST) && dc->hwss.interdependent_update_lock)
 		dc->hwss.interdependent_update_lock(dc, context, false);
 	else
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 52bdbf2d50f5..cba3c8cd12a1 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1214,17 +1214,6 @@ void dcn20_pipe_control_lock(
 		!flip_immediate)
 	    dcn20_setup_gsl_group_as_lock(dc, pipe, false);
 
-
-	// If changing VTG FP2: wait until back in vactive to program FP2
-	// Need to ensure that pipe unlock happens soon after to minimize race condition
-	if (!lock && pipe->update_flags.bits.global_sync) {
-		pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg, CRTC_STATE_VBLANK);
-		pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg, CRTC_STATE_VACTIVE);
-
-		pipe->stream_res.tg->funcs->set_vtg_params(
-				pipe->stream_res.tg, &pipe->stream->timing, true);
-	}
-
 	if (pipe->stream && should_use_dmub_lock(pipe->stream->link)) {
 		union dmub_hw_lock_flags hw_locks = { 0 };
 		struct dmub_hw_lock_inst_flags inst_flags = { 0 };
commit 410066d24cfc1071be25e402510367aca9db5cb6
Author: Jake Wang <haonan.wang2 at amd.com>
Date:   Thu Dec 3 14:05:56 2020 -0500

    drm/amd/display: updated wm table for Renoir
    
    [Why]
    For certain timings, Renoir may underflow due to sr exit
    latency being too slow.
    
    [How]
    Updated wm table for renoir.
    
    Signed-off-by: Jake Wang <haonan.wang2 at amd.com>
    Reviewed-by: Yongqiang Sun <yongqiang.sun at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index 6f4fe8fce6b7..d00b02553d62 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -746,24 +746,24 @@ static struct wm_table ddr4_wm_table_rn = {
 			.wm_inst = WM_B,
 			.wm_type = WM_TYPE_PSTATE_CHG,
 			.pstate_latency_us = 11.72,
-			.sr_exit_time_us = 10.12,
-			.sr_enter_plus_exit_time_us = 11.48,
+			.sr_exit_time_us = 11.12,
+			.sr_enter_plus_exit_time_us = 12.48,
 			.valid = true,
 		},
 		{
 			.wm_inst = WM_C,
 			.wm_type = WM_TYPE_PSTATE_CHG,
 			.pstate_latency_us = 11.72,
-			.sr_exit_time_us = 10.12,
-			.sr_enter_plus_exit_time_us = 11.48,
+			.sr_exit_time_us = 11.12,
+			.sr_enter_plus_exit_time_us = 12.48,
 			.valid = true,
 		},
 		{
 			.wm_inst = WM_D,
 			.wm_type = WM_TYPE_PSTATE_CHG,
 			.pstate_latency_us = 11.72,
-			.sr_exit_time_us = 10.12,
-			.sr_enter_plus_exit_time_us = 11.48,
+			.sr_exit_time_us = 11.12,
+			.sr_enter_plus_exit_time_us = 12.48,
 			.valid = true,
 		},
 	}
commit 5200c4017ef25f85634012a967c78ff64495dd85
Author: Martin Leung <martin.leung at amd.com>
Date:   Wed Dec 2 15:10:12 2020 -0500

    drm/amd/display: delay fp2 programming until vactive before lock
    
    [Why]
    race condition of programming FP2 wrt pipe locking
    and vactive state can cause underflow/black screen
    
    [How]
    Enforce the FP2 is only programmed during vactive,
    and unlock pipe soon afterwards.
    
    Signed-off-by: Martin Leung <martin.leung at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 9f7d6b087553..cfc130e2d6fd 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -2736,7 +2736,7 @@ static void dcn10_program_all_pipe_in_tree(
 				pipe_ctx->pipe_dlg_param.vupdate_width);
 
 		pipe_ctx->stream_res.tg->funcs->set_vtg_params(
-				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing, true);
 
 		if (hws->funcs.setup_vupdate_interrupt)
 			hws->funcs.setup_vupdate_interrupt(dc, pipe_ctx);
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
index 48ccdcc17ede..f033397a84e9 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
@@ -272,7 +272,7 @@ void optc1_program_timing(
 			vupdate_offset,
 			vupdate_width);
 
-	optc->funcs->set_vtg_params(optc, dc_crtc_timing);
+	optc->funcs->set_vtg_params(optc, dc_crtc_timing, true);
 
 	/* TODO
 	 * patched_crtc_timing.flags.HORZ_COUNT_BY_TWO == 1
@@ -312,7 +312,7 @@ void optc1_program_timing(
 }
 
 void optc1_set_vtg_params(struct timing_generator *optc,
-		const struct dc_crtc_timing *dc_crtc_timing)
+		const struct dc_crtc_timing *dc_crtc_timing, bool program_fp2)
 {
 	struct dc_crtc_timing patched_crtc_timing;
 	uint32_t asic_blank_end;
@@ -348,9 +348,12 @@ void optc1_set_vtg_params(struct timing_generator *optc,
 		}
 	}
 
-	REG_UPDATE_2(CONTROL,
-			VTG0_FP2, v_fp2,
-			VTG0_VCOUNT_INIT, v_init);
+	if (program_fp2)
+		REG_UPDATE_2(CONTROL,
+				VTG0_FP2, v_fp2,
+				VTG0_VCOUNT_INIT, v_init);
+	else
+		REG_UPDATE(CONTROL, VTG0_VCOUNT_INIT, v_init);
 }
 
 void optc1_set_blank_data_double_buffer(struct timing_generator *optc, bool enable)
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
index 344eb487219e..b12bd9aae52f 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.h
@@ -700,6 +700,6 @@ bool optc1_get_crc(struct timing_generator *optc,
 bool optc1_is_two_pixels_per_containter(const struct dc_crtc_timing *timing);
 
 void optc1_set_vtg_params(struct timing_generator *optc,
-		const struct dc_crtc_timing *dc_crtc_timing);
+		const struct dc_crtc_timing *dc_crtc_timing, bool program_fp2);
 
 #endif /* __DC_TIMING_GENERATOR_DCN10_H__ */
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index abcb06044e6e..52bdbf2d50f5 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1214,6 +1214,17 @@ void dcn20_pipe_control_lock(
 		!flip_immediate)
 	    dcn20_setup_gsl_group_as_lock(dc, pipe, false);
 
+
+	// If changing VTG FP2: wait until back in vactive to program FP2
+	// Need to ensure that pipe unlock happens soon after to minimize race condition
+	if (!lock && pipe->update_flags.bits.global_sync) {
+		pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg, CRTC_STATE_VBLANK);
+		pipe->stream_res.tg->funcs->wait_for_state(pipe->stream_res.tg, CRTC_STATE_VACTIVE);
+
+		pipe->stream_res.tg->funcs->set_vtg_params(
+				pipe->stream_res.tg, &pipe->stream->timing, true);
+	}
+
 	if (pipe->stream && should_use_dmub_lock(pipe->stream->link)) {
 		union dmub_hw_lock_flags hw_locks = { 0 };
 		struct dmub_hw_lock_inst_flags inst_flags = { 0 };
@@ -1595,7 +1606,7 @@ static void dcn20_program_pipe(
 				pipe_ctx->pipe_dlg_param.vupdate_width);
 
 		pipe_ctx->stream_res.tg->funcs->set_vtg_params(
-				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+				pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing, false);
 
 		if (hws->funcs.setup_vupdate_interrupt)
 			hws->funcs.setup_vupdate_interrupt(dc, pipe_ctx);
@@ -1695,14 +1706,6 @@ void dcn20_program_front_end_for_ctx(
 				&& context->res_ctx.pipe_ctx[i].stream)
 			hws->funcs.blank_pixel_data(dc, &context->res_ctx.pipe_ctx[i], true);
 
-	/* wait for outstanding pending changes before adding or removing planes */
-	for (i = 0; i < dc->res_pool->pipe_count; i++) {
-		if (context->res_ctx.pipe_ctx[i].update_flags.bits.disable ||
-				context->res_ctx.pipe_ctx[i].update_flags.bits.enable) {
-			dc->hwss.wait_for_pending_cleared(dc, context);
-			break;
-		}
-	}
 
 	/* Disconnect mpcc */
 	for (i = 0; i < dc->res_pool->pipe_count; i++)
@@ -1856,7 +1859,7 @@ bool dcn20_update_bandwidth(
 					pipe_ctx->pipe_dlg_param.vupdate_width);
 
 			pipe_ctx->stream_res.tg->funcs->set_vtg_params(
-					pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing);
+					pipe_ctx->stream_res.tg, &pipe_ctx->stream->timing, false);
 
 			if (pipe_ctx->prev_odm_pipe == NULL)
 				hws->funcs.blank_pixel_data(dc, pipe_ctx, blank);
diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
index 12d5718caea8..f7632fe25976 100644
--- a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+++ b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
@@ -271,7 +271,7 @@ struct timing_generator_funcs {
 			struct dc_crtc_timing *hw_crtc_timing);
 
 	void (*set_vtg_params)(struct timing_generator *optc,
-			const struct dc_crtc_timing *dc_crtc_timing);
+			const struct dc_crtc_timing *dc_crtc_timing, bool program_fp2);
 
 	void (*set_dsc_config)(struct timing_generator *optc,
 			       enum optc_dsc_mode dsc_mode,
commit 09b07f7a188f3b52e7f7c778ab3b4e4aa4e9677a
Author: Leo (Hanghong) Ma <hanghong.ma at amd.com>
Date:   Wed Oct 28 11:57:17 2020 -0400

    drm/amd/display: Add DP info frame update for dcn30
    
    [Why]
    We are missing the DP info frame update on dcn30, and this will
    lead to DP SDPs not being sent;
    
    [How]
    Add the DP info frame update for dcn30;
    
    Signed-off-by: Leo (Hanghong) Ma <hanghong.ma at amd.com>
    Reviewed-by: Roman Li <Roman.Li at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index 283995ab9eeb..3deb3fb1724d 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -668,7 +668,7 @@ void dcn30_update_info_frame(struct pipe_ctx *pipe_ctx)
 	is_hdmi_tmds = dc_is_hdmi_tmds_signal(pipe_ctx->stream->signal);
 	is_dp = dc_is_dp_signal(pipe_ctx->stream->signal);
 
-	if (!is_hdmi_tmds)
+	if (!is_hdmi_tmds && !is_dp)
 		return;
 
 	if (is_hdmi_tmds)
commit 3ae7a1378d70421de2161aa79209acb3564a73f4
Author: Eric Bernstein <eric.bernstein at amd.com>
Date:   Mon Nov 30 14:30:38 2020 -0500

    drm/amd/display: add dcn30_link_encoder_validate_output_with_stream to header
    
    [Why]
    dcn30_link_encoder_validate_output_with_stream was a static function.
    
    [How]
    remove the static define and include it in the header.
    
    Signed-off-by: Eric Bernstein <eric.bernstein at amd.com>
    Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
index b409f6b2bfd8..4592ccdfa9b0 100644
--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c
@@ -119,7 +119,7 @@ static const struct link_encoder_funcs dce110_lnk_enc_funcs = {
 	.disable_hpd = dce110_link_encoder_disable_hpd,
 	.is_dig_enabled = dce110_is_dig_enabled,
 	.destroy = dce110_link_encoder_destroy,
-	.get_max_link_cap = dce110_link_encoder_get_max_link_cap
+	.get_max_link_cap = dce110_link_encoder_get_max_link_cap,
 };
 
 static enum bp_result link_transmitter_control(
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
index 2ae159e2dd6e..46ea39f5ef8d 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.c
@@ -51,7 +51,7 @@
 	(enc10->link_regs->index)
 
 
-static bool dcn30_link_encoder_validate_output_with_stream(
+bool dcn30_link_encoder_validate_output_with_stream(
 	struct link_encoder *enc,
 	const struct dc_stream_state *stream)
 {
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
index 2fbf879cd327..f2d90f2b8bf1 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dio_link_encoder.h
@@ -78,4 +78,8 @@ void dcn30_link_encoder_construct(
 
 void enc3_hw_init(struct link_encoder *enc);
 
+bool dcn30_link_encoder_validate_output_with_stream(
+	struct link_encoder *enc,
+	const struct dc_stream_state *stream);
+
 #endif /* __DC_LINK_ENCODER__DCN30_H__ */
commit 02ce73b01e09e388614b22b7ebc71debf4a588f0
Author: Wayne Lin <Wayne.Lin at amd.com>
Date:   Tue Nov 24 19:57:03 2020 +0800

    drm/amd/display: Fix to be able to stop crc calculation
    
    [Why]
    Find out when we try to disable CRC calculation,
    crc generation is still enabled. Main reason is
    that dc_stream_configure_crc() will never get
    called when the source is AMDGPU_DM_PIPE_CRC_SOURCE_NONE.
    
    [How]
    Add checking condition that when source is
    AMDGPU_DM_PIPE_CRC_SOURCE_NONE, we should also call
    dc_stream_configure_crc() to disable crc calculation.
    Also, clean up crc window when disable crc calculation.
    
    Signed-off-by: Wayne Lin <Wayne.Lin at amd.com>
    Reviewed-by: Nicholas Kazlauskas <Nicholas.Kazlauskas at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
index ff6db26626ea..7b886a779a8c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c
@@ -81,6 +81,14 @@ const char *const *amdgpu_dm_crtc_get_crc_sources(struct drm_crtc *crtc,
 	return pipe_crc_sources;
 }
 
+static void amdgpu_dm_set_crc_window_default(struct dm_crtc_state *dm_crtc_state)
+{
+	dm_crtc_state->crc_window.x_start = 0;
+	dm_crtc_state->crc_window.y_start = 0;
+	dm_crtc_state->crc_window.x_end = 0;
+	dm_crtc_state->crc_window.y_end = 0;
+}
+
 bool amdgpu_dm_crc_window_is_default(struct dm_crtc_state *dm_crtc_state)
 {
 	bool ret = true;
@@ -141,7 +149,10 @@ int amdgpu_dm_crtc_configure_crc_source(struct drm_crtc *crtc,
 	mutex_lock(&adev->dm.dc_lock);
 
 	/* Enable CRTC CRC generation if necessary. */
-	if (dm_is_crc_source_crtc(source)) {
+	if (dm_is_crc_source_crtc(source) || source == AMDGPU_DM_PIPE_CRC_SOURCE_NONE) {
+		if (!enable)
+			amdgpu_dm_set_crc_window_default(dm_crtc_state);
+
 		if (!amdgpu_dm_crc_window_is_default(dm_crtc_state)) {
 			crc_window = &tmp_window;
 
commit 570b302ba1ce508dbfa3f1d6c6dc6e2531e45be5
Author: Aric Cyr <aric.cyr at amd.com>
Date:   Tue Dec 1 11:25:50 2020 -0500

    drm/amd/display: HP Reverb G2 VR fails to light up
    
    [Why]
    Many VR headsets require a HSYNC width of 4, but DCN
    has default minimum of 8.
    
    [How]
    Change the arbitrary minimum HSYNC width to 4 to match
    DCN20.
    
    Signed-off-by: Aric Cyr <aric.cyr at amd.com>
    Reviewed-by: Charlene Liu <Charlene.Liu at amd.com>
    Reviewed-by: Jun Lei <Jun.Lei at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_timing_generator.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_timing_generator.c
index 82bc4e192bbf..915fbb8e8168 100644
--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_timing_generator.c
+++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_timing_generator.c
@@ -1268,7 +1268,7 @@ void dce120_timing_generator_construct(
 	tg110->min_h_front_porch = 0;
 	tg110->min_h_back_porch = 0;
 
-	tg110->min_h_sync_width = 8;
+	tg110->min_h_sync_width = 4;
 	tg110->min_v_sync_width = 1;
 	tg110->min_v_blank = 3;
 }
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
index a125d3f05c81..48ccdcc17ede 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c
@@ -1540,7 +1540,7 @@ void dcn10_timing_generator_init(struct optc *optc1)
 	optc1->min_h_blank = 32;
 	optc1->min_v_blank = 3;
 	optc1->min_v_blank_interlace = 5;
-	optc1->min_h_sync_width = 8;
+	optc1->min_h_sync_width = 4;
 	optc1->min_v_sync_width = 1;
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
index b1f228fc119a..3ba3991ee612 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_optc.c
@@ -350,7 +350,7 @@ void dcn30_timing_generator_init(struct optc *optc1)
 	optc1->min_h_blank = 32;
 	optc1->min_v_blank = 3;
 	optc1->min_v_blank_interlace = 5;
-	optc1->min_h_sync_width = 8;
+	optc1->min_h_sync_width = 4;
 	optc1->min_v_sync_width = 1;
 }
 
commit 41aa4d3ded5cd7fa19cdc5f15fb60b85ed64f083
Author: Max Tseng <chuan-yu.tseng at amd.com>
Date:   Sat Nov 21 20:11:38 2020 +0800

    drm/amd/display: Add missing DP_SEC register definitions and masks
    
    [Why]
    some DP_SEC register defs and masks are missing.
    
    [How]
    add the missing defs and masks.
    
    Signed-off-by: Max Tseng <chuan-yu.tseng at amd.com>
    Reviewed-by: Anthony Koo <Anthony.Koo at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
index 9e38c37c1d73..76b334644f9e 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h
@@ -81,7 +81,9 @@
 	SRI(DP_MSE_RATE_UPDATE, DP, id), \
 	SRI(DP_PIXEL_FORMAT, DP, id), \
 	SRI(DP_SEC_CNTL, DP, id), \
+	SRI(DP_SEC_CNTL1, DP, id), \
 	SRI(DP_SEC_CNTL2, DP, id), \
+	SRI(DP_SEC_CNTL5, DP, id), \
 	SRI(DP_SEC_CNTL6, DP, id), \
 	SRI(DP_STEER_FIFO, DP, id), \
 	SRI(DP_VID_M, DP, id), \
@@ -126,7 +128,9 @@ struct dcn10_stream_enc_registers {
 	uint32_t DP_MSE_RATE_UPDATE;
 	uint32_t DP_PIXEL_FORMAT;
 	uint32_t DP_SEC_CNTL;
+	uint32_t DP_SEC_CNTL1;
 	uint32_t DP_SEC_CNTL2;
+	uint32_t DP_SEC_CNTL5;
 	uint32_t DP_SEC_CNTL6;
 	uint32_t DP_STEER_FIFO;
 	uint32_t DP_VID_M;
@@ -411,6 +415,8 @@ struct dcn10_stream_enc_registers {
 	type DP_SEC_GSP3_ENABLE;\
 	type DP_SEC_GSP4_ENABLE;\
 	type DP_SEC_GSP5_ENABLE;\
+	type DP_SEC_GSP5_LINE_NUM;\
+	type DP_SEC_GSP5_LINE_REFERENCE;\
 	type DP_SEC_GSP6_ENABLE;\
 	type DP_SEC_GSP7_ENABLE;\
 	type DP_SEC_GSP7_PPS;\
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.h
index d2a805bd4573..9a881e639709 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.h
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_stream_encoder.h
@@ -83,6 +83,8 @@
 	SE_SF(DIG0_HDMI_METADATA_PACKET_CONTROL, HDMI_METADATA_PACKET_LINE, mask_sh),\
 	SE_SF(DIG0_DIG_FE_CNTL, DOLBY_VISION_EN, mask_sh),\
 	SE_SF(DP0_DP_PIXEL_FORMAT, DP_PIXEL_COMBINE, mask_sh),\
+	SE_SF(DP0_DP_SEC_CNTL1, DP_SEC_GSP5_LINE_REFERENCE, mask_sh),\
+	SE_SF(DP0_DP_SEC_CNTL5, DP_SEC_GSP5_LINE_NUM, mask_sh),\
 	SE_SF(DP0_DP_SEC_FRAMING4, DP_SST_SDP_SPLITTING, mask_sh)
 
 void dcn20_stream_encoder_construct(
commit 20172ff3f0b4eddcdd1cf4ca31a7d922e9b4c662
Author: Victor Lu <victorchengchi.lu at amd.com>
Date:   Tue Nov 24 10:06:04 2020 -0500

    drm/amd/display: Change pstate expected timeout warning to 180us on linux
    
    [Why]
    There is a warning that triggers when pstate takes too long.
    Pstate can take up to ~200us on Linux without hanging but
    it is currently set to 40us.
    
    [How]
    Change the timeout for the warning to be 180us on Linux.
    
    Signed-off-by: Victor Lu <victorchengchi.lu at amd.com>
    Reviewed-by: Roman Li <Roman.Li at amd.com>
    Acked-by: Qingqing Zhuo <qingqing.zhuo at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
index 75637c291e75..6f42d10dd772 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
@@ -124,11 +124,11 @@ bool hubbub1_verify_allow_pstate_change_high(
 	 * still not asserted, we are probably stuck and going to hang
 	 *
 	 * TODO: Figure out why it takes ~100us on linux
-	 * pstate takes around ~100us on linux. Unknown currently as to
-	 * why it takes that long on linux
+	 * pstate takes around ~100us (up to 200us) on linux. Unknown currently
+	 * as to why it takes that long on linux
 	 */
 	const unsigned int pstate_wait_timeout_us = 200;
-	const unsigned int pstate_wait_expected_timeout_us = 40;
+	const unsigned int pstate_wait_expected_timeout_us = 180;
 	static unsigned int max_sampled_pstate_wait_us; /* data collection */
 	static bool forced_pstate_allow; /* help with revert wa */
 
commit 86b6037f7608f9b726281252aa1b2a55dd696486
Author: Stanley.Yang <Stanley.Yang at amd.com>
Date:   Fri Dec 11 20:59:47 2020 +0800

    drm/amdgpu: skip load smu and sdma microcode on sriov for SIENNA_CICHLID
    
    skip load smu and sdma fw on sriov due to sos,
    ta and asd fw have been skipped for SIENNA_CICHLID.
    
    V2:
        move asic check into smu11
    
    Signed-off-by: Stanley.Yang <Stanley.Yang at amd.com>
    Reviewed-by: Kevin Wang <kevin1.wang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
index 5c4ac176b7e4..f1ba36a094da 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
@@ -153,6 +153,9 @@ static int sdma_v5_2_init_microcode(struct amdgpu_device *adev)
 	struct amdgpu_firmware_info *info = NULL;
 	const struct common_firmware_header *header = NULL;
 
+	if (amdgpu_sriov_vf(adev) && (adev->asic_type == CHIP_SIENNA_CICHLID))
+		return 0;
+
 	DRM_DEBUG("\n");
 
 	switch (adev->asic_type) {
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index cf999b7a2164..8b867a6d52b5 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -847,12 +847,10 @@ static int smu_sw_init(void *handle)
 	smu->smu_dpm.dpm_level = AMD_DPM_FORCED_LEVEL_AUTO;
 	smu->smu_dpm.requested_dpm_level = AMD_DPM_FORCED_LEVEL_AUTO;
 
-	if (!amdgpu_sriov_vf(adev) || (adev->asic_type != CHIP_NAVI12)) {
-		ret = smu_init_microcode(smu);
-		if (ret) {
-			dev_err(adev->dev, "Failed to load smu firmware!\n");
-			return ret;
-		}
+	ret = smu_init_microcode(smu);
+	if (ret) {
+		dev_err(adev->dev, "Failed to load smu firmware!\n");
+		return ret;
 	}
 
 	ret = smu_smc_table_sw_init(smu);
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index 0372cb83cdd9..b279dbbbce6b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -91,6 +91,11 @@ int smu_v11_0_init_microcode(struct smu_context *smu)
 	const struct common_firmware_header *header;
 	struct amdgpu_firmware_info *ucode = NULL;
 
+	if (amdgpu_sriov_vf(adev) &&
+			((adev->asic_type == CHIP_NAVI12) ||
+			 (adev->asic_type == CHIP_SIENNA_CICHLID)))
+		return 0;
+
 	switch (adev->asic_type) {
 	case CHIP_ARCTURUS:
 		chip_name = "arcturus";
commit 79cc42697dbd17f19d8ad1d87945a47d2f73573e
Author: Flora Cui <flora.cui at amd.com>
Date:   Mon Dec 14 10:23:13 2020 +0800

    drm/amd/display: drop retired CONFIG_DRM_AMD_DC_DCN3_0
    
    CONFIG_DRM_AMD_DC_DCN3_0 is retired. drop it
    
    Signed-off-by: Flora Cui <flora.cui at amd.com>
    Reviewed-by: Guchun Chen <guchun.chen at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index a901baf2aaef..9e1071b2181f 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3267,9 +3267,6 @@ void core_link_enable_stream(
 			}
 		}
 
-#if defined(CONFIG_DRM_AMD_DC_DCN3_0)
-#endif
-
 		/* turn off otg test pattern if enable */
 		if (pipe_ctx->stream_res.tg->funcs->set_test_pattern)
 			pipe_ctx->stream_res.tg->funcs->set_test_pattern(pipe_ctx->stream_res.tg,
commit 9ca5b8a170d180889bec0424c27fdd2ee84d2d99
Author: Likun Gao <Likun.Gao at amd.com>
Date:   Tue Dec 15 11:32:20 2020 -0500

    drm/amdgpu: add judgement for suspend/resume sequence
    
    S0ix only makes sense on APUs since they are part of the platform, so
    only when the ASIC is APU should set amdgpu_acpi_is_s0ix_supported flag
    to deal with the related situation.
    
    Signed-off-by: Likun Gao <Likun.Gao at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 6e2953233231..b24de64f4490 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1311,11 +1311,11 @@ int amdgpu_acpi_pcie_notify_device_ready(struct amdgpu_device *adev);
 
 void amdgpu_acpi_get_backlight_caps(struct amdgpu_device *adev,
 		struct amdgpu_dm_backlight_caps *caps);
-bool amdgpu_acpi_is_s0ix_supported(void);
+bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev);
 #else
 static inline int amdgpu_acpi_init(struct amdgpu_device *adev) { return 0; }
 static inline void amdgpu_acpi_fini(struct amdgpu_device *adev) { }
-static inline bool amdgpu_acpi_is_s0ix_supported(void) { return false; }
+static inline bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev) { return false; }
 #endif
 
 int amdgpu_cs_find_mapping(struct amdgpu_cs_parser *parser,
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 4f4fda53c08a..8155c54392c8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -901,10 +901,12 @@ void amdgpu_acpi_fini(struct amdgpu_device *adev)
  *
  * returns true if supported, false if not.
  */
-bool amdgpu_acpi_is_s0ix_supported(void)
+bool amdgpu_acpi_is_s0ix_supported(struct amdgpu_device *adev)
 {
-	if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0)
-		return true;
+	if (acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0) {
+		if (adev->flags & AMD_IS_APU)
+			return true;
+	}
 
 	return false;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 79dd85f71fab..0ec7c28c4d5a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2650,7 +2650,7 @@ static int amdgpu_device_ip_suspend_phase1(struct amdgpu_device *adev)
 {
 	int i, r;
 
-	if (!amdgpu_acpi_is_s0ix_supported() || amdgpu_in_reset(adev)) {
+	if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) {
 		amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE);
 		amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE);
 	}
@@ -3710,7 +3710,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)
 
 	amdgpu_fence_driver_suspend(adev);
 
-	if (!amdgpu_acpi_is_s0ix_supported() || amdgpu_in_reset(adev))
+	if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev))
 		r = amdgpu_device_ip_suspend_phase2(adev);
 	else
 		amdgpu_gfx_state_change_set(adev, sGpuChangeState_D3Entry);
@@ -3744,7 +3744,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)
 	if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
 		return 0;
 
-	if (amdgpu_acpi_is_s0ix_supported())
+	if (amdgpu_acpi_is_s0ix_supported(adev))
 		amdgpu_gfx_state_change_set(adev, sGpuChangeState_D0Entry);
 
 	/* post card */
commit a9c210c1e5fefd621954fca50c72780bf0198327
Author: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
Date:   Thu Dec 10 20:18:23 2020 +0800

    drm/amdgpu/sdma5.2: soft reset sdma blocks before setup and start sdma
    
    Without doing the soft reset, register mmSDMA0_GFX_RB_WPTR's value could not be
    reset to 0 when sdma block resumes. That would cause the ring buffer's read and
    write pointers not equal and ring test fail. So add the soft reset step.
    
    Signed-off-by: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
    Reviewed-by: Huang Rui <ray.huang at amd.com>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
index 39e17aae655f..5c4ac176b7e4 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
@@ -807,6 +807,37 @@ static int sdma_v5_2_load_microcode(struct amdgpu_device *adev)
 	return 0;
 }
 
+static int sdma_v5_2_soft_reset(void *handle)
+{
+	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+	u32 grbm_soft_reset;
+	u32 tmp;
+	int i;
+
+	for (i = 0; i < adev->sdma.num_instances; i++) {
+		grbm_soft_reset = REG_SET_FIELD(0,
+						GRBM_SOFT_RESET, SOFT_RESET_SDMA0,
+						1);
+		grbm_soft_reset <<= i;
+
+		tmp = RREG32_SOC15(GC, 0, mmGRBM_SOFT_RESET);
+		tmp |= grbm_soft_reset;
+		DRM_DEBUG("GRBM_SOFT_RESET=0x%08X\n", tmp);
+		WREG32_SOC15(GC, 0, mmGRBM_SOFT_RESET, tmp);
+		tmp = RREG32_SOC15(GC, 0, mmGRBM_SOFT_RESET);
+
+		udelay(50);
+
+		tmp &= ~grbm_soft_reset;
+		WREG32_SOC15(GC, 0, mmGRBM_SOFT_RESET, tmp);
+		tmp = RREG32_SOC15(GC, 0, mmGRBM_SOFT_RESET);
+
+		udelay(50);
+	}
+
+	return 0;
+}
+
 /**
  * sdma_v5_2_start - setup and start the async dma engines
  *
@@ -838,6 +869,7 @@ static int sdma_v5_2_start(struct amdgpu_device *adev)
 			msleep(1000);
 	}
 
+	sdma_v5_2_soft_reset(adev);
 	/* unhalt the MEs */
 	sdma_v5_2_enable(adev, true);
 	/* enable sdma ring preemption */
@@ -1366,13 +1398,6 @@ static int sdma_v5_2_wait_for_idle(void *handle)
 	return -ETIMEDOUT;
 }
 
-static int sdma_v5_2_soft_reset(void *handle)
-{
-	/* todo */
-
-	return 0;
-}
-
 static int sdma_v5_2_ring_preempt_ib(struct amdgpu_ring *ring)
 {
 	int i, r = 0;
commit 78d907e2b8ba89c936b7f0c3344261c653668a62
Author: Evan Quan <evan.quan at amd.com>
Date:   Thu Dec 10 16:36:28 2020 +0800

    drm/amd/pm: add deep sleep control for uclk and fclk
    
    These are supported by Sienna Cichlid and should be
    taken into consideration during DS control.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index 45ecd0386e9f..0372cb83cdd9 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -2087,6 +2087,22 @@ int smu_v11_0_deep_sleep_control(struct smu_context *smu,
 		}
 	}
 
+	if (smu_cmn_feature_is_supported(smu, SMU_FEATURE_DS_UCLK_BIT)) {
+		ret = smu_cmn_feature_set_enabled(smu, SMU_FEATURE_DS_UCLK_BIT, enablement);
+		if (ret) {
+			dev_err(adev->dev, "Failed to %s UCLK DS!\n", enablement ? "enable" : "disable");
+			return ret;
+		}
+	}
+
+	if (smu_cmn_feature_is_supported(smu, SMU_FEATURE_DS_FCLK_BIT)) {
+		ret = smu_cmn_feature_set_enabled(smu, SMU_FEATURE_DS_FCLK_BIT, enablement);
+		if (ret) {
+			dev_err(adev->dev, "Failed to %s FCLK DS!\n", enablement ? "enable" : "disable");
+			return ret;
+		}
+	}
+
 	if (smu_cmn_feature_is_supported(smu, SMU_FEATURE_DS_SOCCLK_BIT)) {
 		ret = smu_cmn_feature_set_enabled(smu, SMU_FEATURE_DS_SOCCLK_BIT, enablement);
 		if (ret) {
commit b4b0b79d8a376d3d830a93f8fafc815d01525fc9
Author: Evan Quan <evan.quan at amd.com>
Date:   Thu Dec 10 12:42:24 2020 +0800

    drm/amd/pm: update the data strucutre for SMU metrics exchange
    
    This is needed for Sienna Cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 148fa3af33fc..9608745d732f 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -382,7 +382,7 @@ static int sienna_cichlid_tables_init(struct smu_context *smu)
 		       PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM);
 	SMU_TABLE_INIT(tables, SMU_TABLE_WATERMARKS, sizeof(Watermarks_t),
 		       PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM);
-	SMU_TABLE_INIT(tables, SMU_TABLE_SMU_METRICS, sizeof(SmuMetrics_t),
+	SMU_TABLE_INIT(tables, SMU_TABLE_SMU_METRICS, sizeof(SmuMetricsExternal_t),
 		       PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM);
 	SMU_TABLE_INIT(tables, SMU_TABLE_I2C_COMMANDS, sizeof(SwI2cRequest_t),
 		       PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM);
@@ -394,7 +394,7 @@ static int sienna_cichlid_tables_init(struct smu_context *smu)
 		       sizeof(DpmActivityMonitorCoeffIntExternal_t), PAGE_SIZE,
 	               AMDGPU_GEM_DOMAIN_VRAM);
 
-	smu_table->metrics_table = kzalloc(sizeof(SmuMetrics_t), GFP_KERNEL);
+	smu_table->metrics_table = kzalloc(sizeof(SmuMetricsExternal_t), GFP_KERNEL);
 	if (!smu_table->metrics_table)
 		goto err0_out;
 	smu_table->metrics_time = 0;
@@ -423,7 +423,8 @@ static int sienna_cichlid_get_smu_metrics_data(struct smu_context *smu,
 					       uint32_t *value)
 {
 	struct smu_table_context *smu_table= &smu->smu_table;
-	SmuMetrics_t *metrics = (SmuMetrics_t *)smu_table->metrics_table;
+	SmuMetrics_t *metrics =
+		&(((SmuMetricsExternal_t *)(smu_table->metrics_table))->SmuMetrics);
 	int ret = 0;
 
 	mutex_lock(&smu->metrics_lock);
@@ -2598,52 +2599,54 @@ static ssize_t sienna_cichlid_get_gpu_metrics(struct smu_context *smu,
 	struct smu_table_context *smu_table = &smu->smu_table;
 	struct gpu_metrics_v1_0 *gpu_metrics =
 		(struct gpu_metrics_v1_0 *)smu_table->gpu_metrics_table;
-	SmuMetrics_t metrics;
+	SmuMetricsExternal_t metrics_external;
+	SmuMetrics_t *metrics =
+		&(metrics_external.SmuMetrics);
 	int ret = 0;
 
 	ret = smu_cmn_get_metrics_table(smu,
-					&metrics,
+					&metrics_external,
 					true);
 	if (ret)
 		return ret;
 
 	smu_v11_0_init_gpu_metrics_v1_0(gpu_metrics);
 
-	gpu_metrics->temperature_edge = metrics.TemperatureEdge;
-	gpu_metrics->temperature_hotspot = metrics.TemperatureHotspot;
-	gpu_metrics->temperature_mem = metrics.TemperatureMem;
-	gpu_metrics->temperature_vrgfx = metrics.TemperatureVrGfx;
-	gpu_metrics->temperature_vrsoc = metrics.TemperatureVrSoc;
-	gpu_metrics->temperature_vrmem = metrics.TemperatureVrMem0;
+	gpu_metrics->temperature_edge = metrics->TemperatureEdge;
+	gpu_metrics->temperature_hotspot = metrics->TemperatureHotspot;
+	gpu_metrics->temperature_mem = metrics->TemperatureMem;
+	gpu_metrics->temperature_vrgfx = metrics->TemperatureVrGfx;
+	gpu_metrics->temperature_vrsoc = metrics->TemperatureVrSoc;
+	gpu_metrics->temperature_vrmem = metrics->TemperatureVrMem0;
 
-	gpu_metrics->average_gfx_activity = metrics.AverageGfxActivity;
-	gpu_metrics->average_umc_activity = metrics.AverageUclkActivity;
-	gpu_metrics->average_mm_activity = metrics.VcnActivityPercentage;
+	gpu_metrics->average_gfx_activity = metrics->AverageGfxActivity;
+	gpu_metrics->average_umc_activity = metrics->AverageUclkActivity;
+	gpu_metrics->average_mm_activity = metrics->VcnActivityPercentage;
 
-	gpu_metrics->average_socket_power = metrics.AverageSocketPower;
-	gpu_metrics->energy_accumulator = metrics.EnergyAccumulator;
+	gpu_metrics->average_socket_power = metrics->AverageSocketPower;
+	gpu_metrics->energy_accumulator = metrics->EnergyAccumulator;
 
-	if (metrics.AverageGfxActivity <= SMU_11_0_7_GFX_BUSY_THRESHOLD)
-		gpu_metrics->average_gfxclk_frequency = metrics.AverageGfxclkFrequencyPostDs;
+	if (metrics->AverageGfxActivity <= SMU_11_0_7_GFX_BUSY_THRESHOLD)
+		gpu_metrics->average_gfxclk_frequency = metrics->AverageGfxclkFrequencyPostDs;
 	else
-		gpu_metrics->average_gfxclk_frequency = metrics.AverageGfxclkFrequencyPreDs;
-	gpu_metrics->average_uclk_frequency = metrics.AverageUclkFrequencyPostDs;
-	gpu_metrics->average_vclk0_frequency = metrics.AverageVclk0Frequency;
-	gpu_metrics->average_dclk0_frequency = metrics.AverageDclk0Frequency;
-	gpu_metrics->average_vclk1_frequency = metrics.AverageVclk1Frequency;
-	gpu_metrics->average_dclk1_frequency = metrics.AverageDclk1Frequency;
-
-	gpu_metrics->current_gfxclk = metrics.CurrClock[PPCLK_GFXCLK];
-	gpu_metrics->current_socclk = metrics.CurrClock[PPCLK_SOCCLK];
-	gpu_metrics->current_uclk = metrics.CurrClock[PPCLK_UCLK];
-	gpu_metrics->current_vclk0 = metrics.CurrClock[PPCLK_VCLK_0];
-	gpu_metrics->current_dclk0 = metrics.CurrClock[PPCLK_DCLK_0];
-	gpu_metrics->current_vclk1 = metrics.CurrClock[PPCLK_VCLK_1];
-	gpu_metrics->current_dclk1 = metrics.CurrClock[PPCLK_DCLK_1];
-
-	gpu_metrics->throttle_status = metrics.ThrottlerStatus;
-
-	gpu_metrics->current_fan_speed = metrics.CurrFanSpeed;
+		gpu_metrics->average_gfxclk_frequency = metrics->AverageGfxclkFrequencyPreDs;
+	gpu_metrics->average_uclk_frequency = metrics->AverageUclkFrequencyPostDs;
+	gpu_metrics->average_vclk0_frequency = metrics->AverageVclk0Frequency;
+	gpu_metrics->average_dclk0_frequency = metrics->AverageDclk0Frequency;
+	gpu_metrics->average_vclk1_frequency = metrics->AverageVclk1Frequency;
+	gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency;
+
+	gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK];
+	gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK];
+	gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK];
+	gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0];
+	gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0];
+	gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1];
+	gpu_metrics->current_dclk1 = metrics->CurrClock[PPCLK_DCLK_1];
+
+	gpu_metrics->throttle_status = metrics->ThrottlerStatus;
+
+	gpu_metrics->current_fan_speed = metrics->CurrFanSpeed;
 
 	gpu_metrics->pcie_link_width =
 			smu_v11_0_get_current_pcie_link_width(smu);
commit f9e3fe46202a18dea8c54af392be2b361b0194e7
Author: Evan Quan <evan.quan at amd.com>
Date:   Thu Dec 10 12:03:50 2020 +0800

    drm/amd/pm: correct the data structure for activity monitor coeff exchange
    
    This is needed for Sienna Cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 0fbc9cfd76ff..148fa3af33fc 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -391,7 +391,7 @@ static int sienna_cichlid_tables_init(struct smu_context *smu)
 	SMU_TABLE_INIT(tables, SMU_TABLE_PMSTATUSLOG, SMU11_TOOL_SIZE,
 		       PAGE_SIZE, AMDGPU_GEM_DOMAIN_VRAM);
 	SMU_TABLE_INIT(tables, SMU_TABLE_ACTIVITY_MONITOR_COEFF,
-		       sizeof(DpmActivityMonitorCoeffInt_t), PAGE_SIZE,
+		       sizeof(DpmActivityMonitorCoeffIntExternal_t), PAGE_SIZE,
 	               AMDGPU_GEM_DOMAIN_VRAM);
 
 	smu_table->metrics_table = kzalloc(sizeof(SmuMetrics_t), GFP_KERNEL);
@@ -1167,7 +1167,9 @@ static int sienna_cichlid_get_fan_parameters(struct smu_context *smu)
 
 static int sienna_cichlid_get_power_profile_mode(struct smu_context *smu, char *buf)
 {
-	DpmActivityMonitorCoeffInt_t activity_monitor;
+	DpmActivityMonitorCoeffIntExternal_t activity_monitor_external;
+	DpmActivityMonitorCoeffInt_t *activity_monitor =
+		&(activity_monitor_external.DpmActivityMonitorCoeffInt);
 	uint32_t i, size = 0;
 	int16_t workload_type = 0;
 	static const char *profile_name[] = {
@@ -1209,7 +1211,7 @@ static int sienna_cichlid_get_power_profile_mode(struct smu_context *smu, char *
 
 		result = smu_cmn_update_table(smu,
 					  SMU_TABLE_ACTIVITY_MONITOR_COEFF, workload_type,
-					  (void *)(&activity_monitor), false);
+					  (void *)(&activity_monitor_external), false);
 		if (result) {
 			dev_err(smu->adev->dev, "[%s] Failed to get activity monitor!", __func__);
 			return result;
@@ -1222,43 +1224,43 @@ static int sienna_cichlid_get_power_profile_mode(struct smu_context *smu, char *
 			" ",
 			0,
 			"GFXCLK",
-			activity_monitor.Gfx_FPS,
-			activity_monitor.Gfx_MinFreqStep,
-			activity_monitor.Gfx_MinActiveFreqType,
-			activity_monitor.Gfx_MinActiveFreq,
-			activity_monitor.Gfx_BoosterFreqType,
-			activity_monitor.Gfx_BoosterFreq,
-			activity_monitor.Gfx_PD_Data_limit_c,
-			activity_monitor.Gfx_PD_Data_error_coeff,
-			activity_monitor.Gfx_PD_Data_error_rate_coeff);
+			activity_monitor->Gfx_FPS,
+			activity_monitor->Gfx_MinFreqStep,
+			activity_monitor->Gfx_MinActiveFreqType,
+			activity_monitor->Gfx_MinActiveFreq,
+			activity_monitor->Gfx_BoosterFreqType,
+			activity_monitor->Gfx_BoosterFreq,
+			activity_monitor->Gfx_PD_Data_limit_c,
+			activity_monitor->Gfx_PD_Data_error_coeff,
+			activity_monitor->Gfx_PD_Data_error_rate_coeff);
 
 		size += sprintf(buf + size, "%19s %d(%13s) %7d %7d %7d %7d %7d %7d %7d %7d %7d\n",
 			" ",
 			1,
 			"SOCCLK",
-			activity_monitor.Fclk_FPS,
-			activity_monitor.Fclk_MinFreqStep,
-			activity_monitor.Fclk_MinActiveFreqType,
-			activity_monitor.Fclk_MinActiveFreq,
-			activity_monitor.Fclk_BoosterFreqType,
-			activity_monitor.Fclk_BoosterFreq,
-			activity_monitor.Fclk_PD_Data_limit_c,
-			activity_monitor.Fclk_PD_Data_error_coeff,
-			activity_monitor.Fclk_PD_Data_error_rate_coeff);
+			activity_monitor->Fclk_FPS,
+			activity_monitor->Fclk_MinFreqStep,
+			activity_monitor->Fclk_MinActiveFreqType,
+			activity_monitor->Fclk_MinActiveFreq,
+			activity_monitor->Fclk_BoosterFreqType,
+			activity_monitor->Fclk_BoosterFreq,
+			activity_monitor->Fclk_PD_Data_limit_c,
+			activity_monitor->Fclk_PD_Data_error_coeff,
+			activity_monitor->Fclk_PD_Data_error_rate_coeff);
 
 		size += sprintf(buf + size, "%19s %d(%13s) %7d %7d %7d %7d %7d %7d %7d %7d %7d\n",
 			" ",
 			2,
 			"MEMLK",
-			activity_monitor.Mem_FPS,
-			activity_monitor.Mem_MinFreqStep,
-			activity_monitor.Mem_MinActiveFreqType,
-			activity_monitor.Mem_MinActiveFreq,
-			activity_monitor.Mem_BoosterFreqType,
-			activity_monitor.Mem_BoosterFreq,
-			activity_monitor.Mem_PD_Data_limit_c,
-			activity_monitor.Mem_PD_Data_error_coeff,
-			activity_monitor.Mem_PD_Data_error_rate_coeff);
+			activity_monitor->Mem_FPS,
+			activity_monitor->Mem_MinFreqStep,
+			activity_monitor->Mem_MinActiveFreqType,
+			activity_monitor->Mem_MinActiveFreq,
+			activity_monitor->Mem_BoosterFreqType,
+			activity_monitor->Mem_BoosterFreq,
+			activity_monitor->Mem_PD_Data_limit_c,
+			activity_monitor->Mem_PD_Data_error_coeff,
+			activity_monitor->Mem_PD_Data_error_rate_coeff);
 	}
 
 	return size;
@@ -1266,7 +1268,10 @@ static int sienna_cichlid_get_power_profile_mode(struct smu_context *smu, char *
 
 static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long *input, uint32_t size)
 {
-	DpmActivityMonitorCoeffInt_t activity_monitor;
+
+	DpmActivityMonitorCoeffIntExternal_t activity_monitor_external;
+	DpmActivityMonitorCoeffInt_t *activity_monitor =
+		&(activity_monitor_external.DpmActivityMonitorCoeffInt);
 	int workload_type, ret = 0;
 
 	smu->power_profile_mode = input[size];
@@ -1280,7 +1285,7 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long *
 
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
-				       (void *)(&activity_monitor), false);
+				       (void *)(&activity_monitor_external), false);
 		if (ret) {
 			dev_err(smu->adev->dev, "[%s] Failed to get activity monitor!", __func__);
 			return ret;
@@ -1288,43 +1293,43 @@ static int sienna_cichlid_set_power_profile_mode(struct smu_context *smu, long *
 
 		switch (input[0]) {
 		case 0: /* Gfxclk */
-			activity_monitor.Gfx_FPS = input[1];
-			activity_monitor.Gfx_MinFreqStep = input[2];
-			activity_monitor.Gfx_MinActiveFreqType = input[3];
-			activity_monitor.Gfx_MinActiveFreq = input[4];
-			activity_monitor.Gfx_BoosterFreqType = input[5];
-			activity_monitor.Gfx_BoosterFreq = input[6];
-			activity_monitor.Gfx_PD_Data_limit_c = input[7];
-			activity_monitor.Gfx_PD_Data_error_coeff = input[8];
-			activity_monitor.Gfx_PD_Data_error_rate_coeff = input[9];
+			activity_monitor->Gfx_FPS = input[1];
+			activity_monitor->Gfx_MinFreqStep = input[2];
+			activity_monitor->Gfx_MinActiveFreqType = input[3];
+			activity_monitor->Gfx_MinActiveFreq = input[4];
+			activity_monitor->Gfx_BoosterFreqType = input[5];
+			activity_monitor->Gfx_BoosterFreq = input[6];
+			activity_monitor->Gfx_PD_Data_limit_c = input[7];
+			activity_monitor->Gfx_PD_Data_error_coeff = input[8];
+			activity_monitor->Gfx_PD_Data_error_rate_coeff = input[9];
 			break;
 		case 1: /* Socclk */
-			activity_monitor.Fclk_FPS = input[1];
-			activity_monitor.Fclk_MinFreqStep = input[2];
-			activity_monitor.Fclk_MinActiveFreqType = input[3];
-			activity_monitor.Fclk_MinActiveFreq = input[4];
-			activity_monitor.Fclk_BoosterFreqType = input[5];
-			activity_monitor.Fclk_BoosterFreq = input[6];
-			activity_monitor.Fclk_PD_Data_limit_c = input[7];
-			activity_monitor.Fclk_PD_Data_error_coeff = input[8];
-			activity_monitor.Fclk_PD_Data_error_rate_coeff = input[9];
+			activity_monitor->Fclk_FPS = input[1];
+			activity_monitor->Fclk_MinFreqStep = input[2];
+			activity_monitor->Fclk_MinActiveFreqType = input[3];
+			activity_monitor->Fclk_MinActiveFreq = input[4];
+			activity_monitor->Fclk_BoosterFreqType = input[5];
+			activity_monitor->Fclk_BoosterFreq = input[6];
+			activity_monitor->Fclk_PD_Data_limit_c = input[7];
+			activity_monitor->Fclk_PD_Data_error_coeff = input[8];
+			activity_monitor->Fclk_PD_Data_error_rate_coeff = input[9];
 			break;
 		case 2: /* Memlk */
-			activity_monitor.Mem_FPS = input[1];
-			activity_monitor.Mem_MinFreqStep = input[2];
-			activity_monitor.Mem_MinActiveFreqType = input[3];
-			activity_monitor.Mem_MinActiveFreq = input[4];
-			activity_monitor.Mem_BoosterFreqType = input[5];
-			activity_monitor.Mem_BoosterFreq = input[6];
-			activity_monitor.Mem_PD_Data_limit_c = input[7];
-			activity_monitor.Mem_PD_Data_error_coeff = input[8];
-			activity_monitor.Mem_PD_Data_error_rate_coeff = input[9];
+			activity_monitor->Mem_FPS = input[1];
+			activity_monitor->Mem_MinFreqStep = input[2];
+			activity_monitor->Mem_MinActiveFreqType = input[3];
+			activity_monitor->Mem_MinActiveFreq = input[4];
+			activity_monitor->Mem_BoosterFreqType = input[5];
+			activity_monitor->Mem_BoosterFreq = input[6];
+			activity_monitor->Mem_PD_Data_limit_c = input[7];
+			activity_monitor->Mem_PD_Data_error_coeff = input[8];
+			activity_monitor->Mem_PD_Data_error_rate_coeff = input[9];
 			break;
 		}
 
 		ret = smu_cmn_update_table(smu,
 				       SMU_TABLE_ACTIVITY_MONITOR_COEFF, WORKLOAD_PPLIB_CUSTOM_BIT,
-				       (void *)(&activity_monitor), true);
+				       (void *)(&activity_monitor_external), true);
 		if (ret) {
 			dev_err(smu->adev->dev, "[%s] Failed to set activity monitor!", __func__);
 			return ret;
commit 0dc994fb61a9b859bf4bde936a4c6de652116a23
Author: Evan Quan <evan.quan at amd.com>
Date:   Wed Dec 9 14:30:29 2020 +0800

    drm/amd/pm: fulfill the sienna cichlid UMD PSTATE profiling clocks
    
    Fulfill the UMD PSTATE profiling clocks of sienna cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index b8127be43320..0fbc9cfd76ff 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -1070,12 +1070,18 @@ static int sienna_cichlid_populate_umd_state_clk(struct smu_context *smu)
 
 	pstate_table->gfxclk_pstate.min = gfx_table->min;
 	pstate_table->gfxclk_pstate.peak = gfx_table->max;
+	if (gfx_table->max >= SIENNA_CICHLID_UMD_PSTATE_PROFILING_GFXCLK)
+		pstate_table->gfxclk_pstate.standard = SIENNA_CICHLID_UMD_PSTATE_PROFILING_GFXCLK;
 
 	pstate_table->uclk_pstate.min = mem_table->min;
 	pstate_table->uclk_pstate.peak = mem_table->max;
+	if (mem_table->max >= SIENNA_CICHLID_UMD_PSTATE_PROFILING_MEMCLK)
+		pstate_table->uclk_pstate.standard = SIENNA_CICHLID_UMD_PSTATE_PROFILING_MEMCLK;
 
 	pstate_table->socclk_pstate.min = soc_table->min;
 	pstate_table->socclk_pstate.peak = soc_table->max;
+	if (soc_table->max >= SIENNA_CICHLID_UMD_PSTATE_PROFILING_SOCCLK)
+		pstate_table->socclk_pstate.standard = SIENNA_CICHLID_UMD_PSTATE_PROFILING_SOCCLK;
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.h b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.h
index 57e120c440ea..38cd0ece24f6 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.h
@@ -29,6 +29,10 @@ typedef enum {
   POWER_SOURCE_COUNT,
 } POWER_SOURCE_e;
 
+#define SIENNA_CICHLID_UMD_PSTATE_PROFILING_GFXCLK    1825
+#define SIENNA_CICHLID_UMD_PSTATE_PROFILING_SOCCLK    960
+#define SIENNA_CICHLID_UMD_PSTATE_PROFILING_MEMCLK    1000
+
 extern void sienna_cichlid_set_ppt_funcs(struct smu_context *smu);
 
 #endif
commit 02e66dd564229043c094ea951ed24df932d44644
Merge: 5fbd41d3bf12 ee46d16d2e40
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Tue Dec 15 17:25:55 2020 +0100

    Merge tag 'drm-misc-next-fixes-2020-12-15' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
    
    Short summary of fixes pull (less than what git shortlog provides):
    
     * dma-buf: Fix docs
     * mxsfb: Silence invalid error message
     * radeon: Fix TTM multihop
    
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    From: Thomas Zimmermann <tzimmermann at suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/X9i0X9mjHN9AZGD3@linux-uq9g

commit ee46d16d2e40bebc2aa790fd7b6a056466ff895c
Author: Guido Günther <agx at sigxcpu.org>
Date:   Tue Dec 15 09:23:38 2020 +0100

    drm: mxsfb: Silence -EPROBE_DEFER while waiting for bridge
    
    It can take multiple iterations until all components for an attached DSI
    bridge are up leading to several:
    
    [    3.796425] mxsfb 30320000.lcd-controller: Cannot connect bridge: -517
    [    3.816952] mxsfb 30320000.lcd-controller: [drm:mxsfb_probe [mxsfb]] *ERROR* failed to attach bridge: -517
    
    Silence this by checking for -EPROBE_DEFER and using dev_err_probe() so
    we set a deferred reason in case a dependency fails to probe (which
    quickly happens on small config/DT changes due to the rather long probe
    chain which can include bridges, phys, panels, backights, leds, etc.).
    
    This also removes the only DRM_DEV_ERROR() usage, the rest of the driver
    uses dev_err().
    
    Signed-off-by: Guido Günther <agx at sigxcpu.org>
    Fixes: c42001e357f7 ("drm: mxsfb: Use drm_panel_bridge")
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Link: https://patchwork.freedesktop.org/patch/msgid/d5761eb871adde5464ba112b89d966568bc2ff6c.1608020391.git.agx@sigxcpu.org

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index 6faf17b6408d..6da93551e2e5 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -134,11 +134,8 @@ static int mxsfb_attach_bridge(struct mxsfb_drm_private *mxsfb)
 		return -ENODEV;
 
 	ret = drm_bridge_attach(&mxsfb->encoder, bridge, NULL, 0);
-	if (ret) {
-		DRM_DEV_ERROR(drm->dev,
-			      "failed to attach bridge: %d\n", ret);
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(drm->dev, ret, "Failed to attach bridge\n");
 
 	mxsfb->bridge = bridge;
 
@@ -212,7 +209,8 @@ static int mxsfb_load(struct drm_device *drm,
 
 	ret = mxsfb_attach_bridge(mxsfb);
 	if (ret) {
-		dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
+		if (ret != -EPROBE_DEFER)
+			dev_err(drm->dev, "Cannot connect bridge: %d\n", ret);
 		goto err_vblank;
 	}
 
commit be98e05a67f05ff4c8349a51fcec993a28be718c
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Fri Dec 4 21:02:42 2020 +0100

    dma-buf: Fix kerneldoc formatting
    
    I wanted to look up something and noticed the hyperlink doesn't work.
    While fixing that also noticed a trivial kerneldoc comment typo in the
    same section, fix that too.
    
    Reviewed-by: Michael J. Ruhl <michael.j.ruhl at intel.com>
    Reviewed-by: Simon Ser <contact at emersion.fr>
    Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201204200242.2671481-1-daniel.vetter@ffwll.ch

diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
index d6b2a195dbed..a2133d69872c 100644
--- a/Documentation/driver-api/dma-buf.rst
+++ b/Documentation/driver-api/dma-buf.rst
@@ -190,7 +190,7 @@ DMA Fence uABI/Sync File
 Indefinite DMA Fences
 ~~~~~~~~~~~~~~~~~~~~~
 
-At various times &dma_fence with an indefinite time until dma_fence_wait()
+At various times struct dma_fence with an indefinite time until dma_fence_wait()
 finishes have been proposed. Examples include:
 
 * Future fences, used in HWC1 to signal when a buffer isn't used by the display
diff --git a/include/linux/dma-buf-map.h b/include/linux/dma-buf-map.h
index 583a3a1f9447..278d489e4bdd 100644
--- a/include/linux/dma-buf-map.h
+++ b/include/linux/dma-buf-map.h
@@ -122,7 +122,7 @@ struct dma_buf_map {
 
 /**
  * DMA_BUF_MAP_INIT_VADDR - Initializes struct dma_buf_map to an address in system memory
- * @vaddr:	A system-memory address
+ * @vaddr_:	A system-memory address
  */
 #define DMA_BUF_MAP_INIT_VADDR(vaddr_) \
 	{ \
commit 5fbd41d3bf123af6a135bdea564087ec0f563eb0
Merge: 1d36dffa5d88 05faf1559de5
Author: Daniel Vetter <daniel.vetter at ffwll.ch>
Date:   Tue Dec 15 10:21:47 2020 +0100

    Merge tag 'drm-misc-next-2020-11-27-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
    
    drm-misc-next for 5.11:
    
    UAPI Changes:
    
    Cross-subsystem Changes:
    
     * char/agp: Disable frontend without CONFIG_DRM_LEGACY
     * mm: Fix fput in mmap error path; Introduce vma_set_file() to change
       vma->vm_file
    
    Core Changes:
    
     * dma-buf: Use sgtables in system heap; Move heap helpers to CMA-heap code;
       Skip sync for unmapped buffers; Alloc higher order pages is available;
       Respect num_fences when initializing shared fence list
     * doc: Improvements around DRM modes and SCALING_FILTER
     * Pass full state to connector atomic functions + callee updates
     * Cleanups
     * shmem: Map pages with caching by default; Cleanups
     * ttm: Fix DMA32 for global page pool
     * fbdev: Cleanups
     * fb-helper: Update framebuffer after userspace writes; Unmap console buffer
       during shutdown; Rework damage handling of shadow framebuffer
    
    Driver Changes:
    
     * amdgpu: Multi-hop fixes, Clenaups
     * imx: Fix rotation for Vivante tiled formats; Support nearest-neighour
       skaling; Cleanups
     * mcde: Fix RGB formats; Support DPI output; Cleanups
     * meson: HDMI clock fixes
     * panel: Add driver and bindings for Innolux N125HCE-GN1
     * panel/s6e63m0: More backlight levels; Fix init; Cleanups
     * via: Clenunps
     * virtio: Use fence ID for handling fences; Cleanups
    
    Signed-off-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    From: Thomas Zimmermann <tzimmermann at suse.de>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201127083055.GA29139@linux-uq9g

diff --cc drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index b848f9e97613,c438d290a6db..4d8f19ab1014
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@@ -639,17 -635,14 +635,14 @@@ static int amdgpu_bo_move(struct ttm_bu
  		abo->flags &= ~AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
  	}
  
+ out:
  	/* update statistics */
  	atomic64_add((u64)bo->num_pages << PAGE_SHIFT, &adev->num_bytes_moved);
+ 	amdgpu_bo_move_notify(bo, evict, new_mem);
  	return 0;
- fail:
- 	swap(*new_mem, bo->mem);
- 	amdgpu_bo_move_notify(bo, false, new_mem);
- 	swap(*new_mem, bo->mem);
- 	return r;
  }
  
 -/**
 +/*
   * amdgpu_ttm_io_mem_reserve - Reserve a block of memory during a fault
   *
   * Called by ttm_mem_io_reserve() ultimately via ttm_bo_vm_fault()
commit 95e3d610d35c9c5b51e12c5c8ac18061ae08cf97
Author: Christian König <christian.koenig at amd.com>
Date:   Wed Nov 25 15:32:23 2020 +0100

    drm/radeon: fix check order in radeon_bo_move
    
    Reorder the code to fix checking if blitting is available.
    
    Signed-off-by: Christian König <christian.koenig at amd.com>
    Fixes: 28a68f828266 ("drm/radeon/ttm: use multihop")
    Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>
    Reviewed-by: Dave Airlie <airlied at redhat.com>
    Link: https://patchwork.freedesktop.org/patch/403847/

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 0ca381b95d3d..2b598141225f 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -216,27 +216,15 @@ static int radeon_bo_move(struct ttm_buffer_object *bo, bool evict,
 	struct ttm_resource *old_mem = &bo->mem;
 	int r;
 
-	if ((old_mem->mem_type == TTM_PL_SYSTEM &&
-	     new_mem->mem_type == TTM_PL_VRAM) ||
-	    (old_mem->mem_type == TTM_PL_VRAM &&
-	     new_mem->mem_type == TTM_PL_SYSTEM)) {
-		hop->fpfn = 0;
-		hop->lpfn = 0;
-		hop->mem_type = TTM_PL_TT;
-		hop->flags = 0;
-		return -EMULTIHOP;
-	}
-
 	if (new_mem->mem_type == TTM_PL_TT) {
 		r = radeon_ttm_tt_bind(bo->bdev, bo->ttm, new_mem);
 		if (r)
 			return r;
 	}
-	radeon_bo_move_notify(bo, evict, new_mem);
 
 	r = ttm_bo_wait_ctx(bo, ctx);
 	if (r)
-		goto fail;
+		return r;
 
 	/* Can't move a pinned BO */
 	rbo = container_of(bo, struct radeon_bo, tbo);
@@ -246,12 +234,12 @@ static int radeon_bo_move(struct ttm_buffer_object *bo, bool evict,
 	rdev = radeon_get_rdev(bo->bdev);
 	if (old_mem->mem_type == TTM_PL_SYSTEM && bo->ttm == NULL) {
 		ttm_bo_move_null(bo, new_mem);
-		return 0;
+		goto out;
 	}
 	if (old_mem->mem_type == TTM_PL_SYSTEM &&
 	    new_mem->mem_type == TTM_PL_TT) {
 		ttm_bo_move_null(bo, new_mem);
-		return 0;
+		goto out;
 	}
 
 	if (old_mem->mem_type == TTM_PL_TT &&
@@ -259,31 +247,37 @@ static int radeon_bo_move(struct ttm_buffer_object *bo, bool evict,
 		radeon_ttm_tt_unbind(bo->bdev, bo->ttm);
 		ttm_resource_free(bo, &bo->mem);
 		ttm_bo_assign_mem(bo, new_mem);
-		return 0;
+		goto out;
 	}
-	if (!rdev->ring[radeon_copy_ring_index(rdev)].ready ||
-	    rdev->asic->copy.copy == NULL) {
-		/* use memcpy */
-		goto memcpy;
+	if (rdev->ring[radeon_copy_ring_index(rdev)].ready &&
+	    rdev->asic->copy.copy != NULL) {
+		if ((old_mem->mem_type == TTM_PL_SYSTEM &&
+		     new_mem->mem_type == TTM_PL_VRAM) ||
+		    (old_mem->mem_type == TTM_PL_VRAM &&
+		     new_mem->mem_type == TTM_PL_SYSTEM)) {
+			hop->fpfn = 0;
+			hop->lpfn = 0;
+			hop->mem_type = TTM_PL_TT;
+			hop->flags = 0;
+			return -EMULTIHOP;
+		}
+
+		r = radeon_move_blit(bo, evict, new_mem, old_mem);
+	} else {
+		r = -ENODEV;
 	}
 
-	r = radeon_move_blit(bo, evict, new_mem, old_mem);
 	if (r) {
-memcpy:
 		r = ttm_bo_move_memcpy(bo, ctx, new_mem);
-		if (r) {
-			goto fail;
-		}
+		if (r)
+			return r;
 	}
 
+out:
 	/* update statistics */
 	atomic64_add((u64)bo->num_pages << PAGE_SHIFT, &rdev->num_bytes_moved);
+	radeon_bo_move_notify(bo, evict, new_mem);
 	return 0;
-fail:
-	swap(*new_mem, bo->mem);
-	radeon_bo_move_notify(bo, false, new_mem);
-	swap(*new_mem, bo->mem);
-	return r;
 }
 
 static int radeon_ttm_io_mem_reserve(struct ttm_bo_device *bdev, struct ttm_resource *mem)
commit 1d36dffa5d887715dacca0f717f4519b7be5e498
Merge: 2c85ebc57b3e b10733527bfd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Dec 14 11:07:56 2020 -0800

    Merge tag 'drm-next-2020-12-11' of git://anongit.freedesktop.org/drm/drm
    
    Pull drm updates from Dave Airlie:
     "Not a huge amount of big things here, AMD has support for a few new HW
      variants (vangogh, green sardine, dimgrey cavefish), Intel has some
      more DG1 enablement. We have a few big reworks of the TTM layers and
      interfaces, GEM and atomic internal API reworks cross tree. fbdev is
      marked orphaned in here as well to reflect the current reality.
    
      core:
       - documentation updates
       - deprecate DRM_FORMAT_MOD_NONE
       - atomic crtc enable/disable rework
       - GEM convert drivers to gem object functions
       - remove SCATTER_LIST_MAX_SEGMENT
    
      sched:
       - avoid infinite waits
    
      ttm:
       - remove AGP support
       - don't modify caching for swapout
       - ttm pinning rework
       - major TTM reworks
       - new backend allocator
       - multihop support
    
      vram-helper:
       - top down BO placement fix
       - TTM changes
       - GEM object support
    
      displayport:
       - DP 2.0 DPCD prep work
       - DP MST extended DPCD caps
    
      fbdev:
       - mark as orphaned
    
      amdgpu:
       - Initial Vangogh support
       - Green Sardine support
       - Dimgrey Cavefish support
       - SG display support for renoir
       - SMU7 improvements
       - gfx9+ modiifier support
       - CI BACO fixes
    
      radeon:
       - expose voltage via hwmon on SUMO
    
      amdkfd:
       - fix unique id handling
    
      i915:
       - more DG1 enablement
       - bigjoiner support
       - integer scaling filter support
       - async flip support
       - ICL+ DSI command mode
       - Improve display shutdown
       - Display refactoring
       - eLLC machine fbdev loading fix
       - dma scatterlist fixes
       - TGL hang fixes
       - eLLC display buffer caching on SKL+
       - MOCS PTE seeting for gen9+
    
      msm:
       - Shutdown hook
       - GPU cooling device support
       - DSI 7nm and 10nm phy/pll updates
       - sm8150/sm2850 DPU support
       - GEM locking re-work
       - LLCC system cache support
    
      aspeed:
       - sysfs output config support
    
      ast:
       - LUT fix
       - new display mode
    
      gma500:
       - remove 2d framebuffer accel
    
      panfrost:
       - move gpu reset to a worker
    
      exynos:
       - new HDMI mode support
    
      mediatek:
       - MT8167 support
       - yaml bindings
       - MIPI DSI phy code moved
    
      etnaviv:
       - new perf counter
       - more lockdep annotation
    
      hibmc:
       - i2c DDC support
    
      ingenic:
       - pixel clock reset fix
       - reserved memory support
       - allow both DMA channels at once
       - different pixel format support
       - 30/24/8-bit palette modes
    
      tilcdc:
       - don't keep vblank irq enabled
    
      vc4:
       - new maintainer added
       - DSI registration fix
    
      virtio:
       - blob resource support
       - host visible and cross-device support
       - uuid api support"
    
    * tag 'drm-next-2020-12-11' of git://anongit.freedesktop.org/drm/drm: (1754 commits)
      drm/amdgpu: Initialise drm_gem_object_funcs for imported BOs
      drm/amdgpu: fix size calculation with stolen vga memory
      drm/amdgpu: remove amdgpu_ttm_late_init  and amdgpu_bo_late_init
      drm/amdgpu: free the pre-OS console framebuffer after the first modeset
      drm/amdgpu: enable runtime pm using BACO on CI dGPUs
      drm/amdgpu/cik: enable BACO reset on Bonaire
      drm/amd/pm: update smu10.h WORKLOAD_PPLIB setting for raven
      drm/amd/pm: remove one unsupported smu function for vangogh
      drm/amd/display: setup system context for APUs
      drm/amd/display: add S/G support for Vangogh
      drm/amdkfd: Fix leak in dmabuf import
      drm/amdgpu: use AMDGPU_NUM_VMID when possible
      drm/amdgpu: fix sdma instance fw version and feature version init
      drm/amd/pm: update driver if version for dimgrey_cavefish
      drm/amd/display: 3.2.115
      drm/amd/display: [FW Promotion] Release 0.0.45
      drm/amd/display: Revert DCN2.1 dram_clock_change_latency update
      drm/amd/display: Enable gpu_vm_support for dcn3.01
      drm/amd/display: Fixed the audio noise during mode switching with HDCP mode on
      drm/amd/display: Add wm table for Renoir
      ...

diff --cc drivers/gpu/drm/i915/gt/intel_mocs.c
index 413dadfac2d1,254873e1646e..ab6870242e18
--- a/drivers/gpu/drm/i915/gt/intel_mocs.c
+++ b/drivers/gpu/drm/i915/gt/intel_mocs.c
@@@ -324,10 -346,14 +357,14 @@@ static unsigned int get_mocs_settings(c
  {
  	unsigned int flags;
  
- 	if (INTEL_GEN(i915) >= 12) {
+ 	if (IS_DG1(i915)) {
+ 		table->size = ARRAY_SIZE(dg1_mocs_table);
+ 		table->table = dg1_mocs_table;
 -		table->n_entries = GEN11_NUM_MOCS_ENTRIES;
++		table->n_entries = GEN9_NUM_MOCS_ENTRIES;
+ 	} else if (INTEL_GEN(i915) >= 12) {
  		table->size  = ARRAY_SIZE(tgl_mocs_table);
  		table->table = tgl_mocs_table;
 -		table->n_entries = GEN11_NUM_MOCS_ENTRIES;
 +		table->n_entries = GEN9_NUM_MOCS_ENTRIES;
  	} else if (IS_GEN(i915, 11)) {
  		table->size  = ARRAY_SIZE(icl_mocs_table);
  		table->table = icl_mocs_table;
diff --cc tools/testing/scatterlist/main.c
index f561aed7c657,d264bf853034..8a577c95496e
--- a/tools/testing/scatterlist/main.c
+++ b/tools/testing/scatterlist/main.c
@@@ -50,11 -50,11 +50,11 @@@ static void fail(struct test *test, str
  
  int main(void)
  {
- 	const unsigned int sgmax = SCATTERLIST_MAX_SEGMENT;
+ 	const unsigned int sgmax = UINT_MAX;
  	struct test *test, tests[] = {
 -		{ -EINVAL, 1, pfn(0), PAGE_SIZE, PAGE_SIZE + 1, 1 },
  		{ -EINVAL, 1, pfn(0), PAGE_SIZE, 0, 1 },
 -		{ -EINVAL, 1, pfn(0), PAGE_SIZE, sgmax + 1, 1 },
 +		{ 0, 1, pfn(0), PAGE_SIZE, PAGE_SIZE + 1, 1 },
 +		{ 0, 1, pfn(0), PAGE_SIZE, sgmax + 1, 1 },
  		{ 0, 1, pfn(0), PAGE_SIZE, sgmax, 1 },
  		{ 0, 1, pfn(0), 1, sgmax, 1 },
  		{ 0, 2, pfn(0, 1), 2 * PAGE_SIZE, sgmax, 1 },
commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 13 14:41:30 2020 -0800

    Linux 5.10

diff --git a/Makefile b/Makefile
index 9ec53d947628..e30cf02da8b8 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Kleptomaniac Octopus
 
 # *DOCUMENTATION*
commit ec6f5e0e5ca0764b4bc522c9f9d5abf876a0e3e3
Merge: d2360a398f0b 0d07c0ec4381
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 13 11:31:19 2020 -0800

    Merge tag 'x86-urgent-2020-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull x86 fixes from Thomas Gleixner:
     "A set of x86 and membarrier fixes:
    
       - Correct a few problems in the x86 and the generic membarrier
         implementation. Small corrections for assumptions about visibility
         which have turned out not to be true.
    
       - Make the PAT bits for memory encryption correct vs 4K and 2M/1G
         page table entries as they are at a different location.
    
       - Fix a concurrency issue in the the local bandwidth readout of
         resource control leading to incorrect values
    
       - Fix the ordering of allocating a vector for an interrupt. The order
         missed to respect the provided cpumask when the first attempt of
         allocating node local in the mask fails. It then tries the node
         instead of trying the full provided mask first. This leads to
         erroneous error messages and breaking the (user) supplied affinity
         request. Reorder it.
    
       - Make the INT3 padding detection in optprobe work correctly"
    
    * tag 'x86-urgent-2020-12-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      x86/kprobes: Fix optprobe to detect INT3 padding correctly
      x86/apic/vector: Fix ordering in vector assignment
      x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
      x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
      membarrier: Execute SYNC_CORE on the calling thread
      membarrier: Explicitly sync remote cores when SYNC_CORE is requested
      membarrier: Add an actual barrier before rseq_preempt()
      x86/membarrier: Get rid of a dubious optimization

commit d2360a398f0b68722641c59aeb2623e79bd03e34
Merge: 6bff9bb8a292 6ffeb1c3f822
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 13 10:36:23 2020 -0800

    Merge tag 'block-5.10-2020-12-12' of git://git.kernel.dk/linux-block
    
    Pull block fixes from Jens Axboe:
     "This should be it for 5.10.
    
      Mike and Song looked into the warning case, and thankfully it appears
      the fix was pretty trivial - we can just change the md device chunk
      type to unsigned int to get rid of it. They cannot currently be < 0,
      and nobody is checking for that either.
    
      We're reverting the discard changes as the corruption reports came in
      very late, and there's just no time to attempt to deal with it at this
      point. Reverting the changes in question is the right call for 5.10"
    
    * tag 'block-5.10-2020-12-12' of git://git.kernel.dk/linux-block:
      md: change mddev 'chunk_sectors' from int to unsigned
      Revert "md: add md_submit_discard_bio() for submitting discard bio"
      Revert "md/raid10: extend r10bio devs to raid disks"
      Revert "md/raid10: pull codes that wait for blocked dev into one function"
      Revert "md/raid10: improve raid10 discard request"
      Revert "md/raid10: improve discard request for far layout"
      Revert "dm raid: remove unnecessary discard limits for raid10"

commit 6bff9bb8a292668e7da3e740394b061e5201f683
Merge: 5ee595d9079b 4da3a54f5a02
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 12:57:12 2020 -0800

    Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
    
    Pull SCSI fixes from James Bottomley:
     "Five small fixes.  Four in drivers:
    
       - hisi_sas: fix internal queue timeout
    
       - be2iscsi: revert a prior fix causing problems
    
       - bnx2i: add missing dependency
    
       - storvsc: late arriving revert of a problem fix
    
      and one in the core.
    
      The core one is a minor change to stop paying attention to the busy
      count when returning out of resources because there's a race window
      where the queue might not restart due to missing returning I/O"
    
    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
      Revert "scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()"
      scsi: hisi_sas: Select a suitable queue for internal I/Os
      scsi: core: Fix race between handling STS_RESOURCE and completion
      scsi: be2iscsi: Revert "Fix a theoretical leak in beiscsi_create_eqs()"
      scsi: bnx2i: Requires MMU

commit 5ee595d9079b94ee931287ce004d34886b7d3c24
Merge: 7b1b868e1d91 e977aaf899a6
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 12:47:46 2020 -0800

    Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
    
    Pull i2c fix from Wolfram Sang:
     "Bugfix for the AT24 EEPROM driver"
    
    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
      misc: eeprom: at24: fix NVMEM name with custom AT24 device name

commit 7b1b868e1d9156484ccce9bf11122c053de82617
Merge: b53966ffd4c0 111d0bda8eeb
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 10:08:16 2020 -0800

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
    
    Pull kvm fixes from Paolo Bonzini:
     "Bugfixes for ARM, x86 and tools"
    
    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
      tools/kvm_stat: Exempt time-based counters
      KVM: mmu: Fix SPTE encoding of MMIO generation upper half
      kvm: x86/mmu: Use cpuid to determine max gfn
      kvm: svm: de-allocate svm_cpu_data for all cpus in svm_cpu_uninit()
      selftests: kvm/set_memory_region_test: Fix race in move region test
      KVM: arm64: Add usage of stage 2 fault lookup level in user_mem_abort()
      KVM: arm64: Fix handling of merging tables into a block entry
      KVM: arm64: Fix memory leak on stage2 update of a valid PTE

commit b53966ffd4c0676c02987d4fc33b99bdfc548cf0
Merge: b01deddb8d3c ee32f32335e8
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 10:02:03 2020 -0800

    Merge tag 'for-linus-5.10c-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
    
    Pull xen fixes from Juergen Gross:
     "A short series fixing a regression introduced in 5.9 for running as
      Xen dom0 on a system with NVMe backed storage"
    
    * tag 'for-linus-5.10c-rc8-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
      xen: don't use page->lru for ZONE_DEVICE memory
      xen: add helpers for caching grant mapping pages

commit b01deddb8d3cb779ac250978afd200931fd91dcd
Merge: 31d00f6eb1f2 ccbbfd1cbf36
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 09:50:26 2020 -0800

    Merge tag 'riscv-for-linus-5.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
    
    Pull RISC-V fix from Palmer Dabbelt:
     "Just one fix. It's nothing critical, just a randconfig that wasn't
      building. That said, it does seem pretty safe and is technically a
      regression so I'm sending it along for 5.10:
    
       - define get_cycles64() all the time, as it's used by most
         configurations"
    
    * tag 'riscv-for-linus-5.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
      RISC-V: Define get_cycles64() regardless of M-mode

commit 31d00f6eb1f2b498a1d7af62cffeba3fbea8cf75
Merge: 643e69aff89a f26c08b444df
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 09:45:01 2020 -0800

    Merge tag 'io_uring-5.10-2020-12-11' of git://git.kernel.dk/linux-block
    
    Pull io_uring fixes from Jens Axboe:
     "Two fixes in here, fixing issues introduced in this merge window"
    
    * tag 'io_uring-5.10-2020-12-11' of git://git.kernel.dk/linux-block:
      io_uring: fix file leak on error path of io ctx creation
      io_uring: fix mis-seting personality's creds

commit 643e69aff89a2d0abc53979acc441b68ce86139b
Merge: 7f376f1917d7 cffdd6d90482
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 12 09:41:33 2020 -0800

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
    
    Pull input fixes from Dmitry Torokhov:
    
     - a fix for cm109 stomping on its own control URB if it tries to toggle
       buzzer immediately after userspace opens input device (found by
       syzcaller)
    
     - another fix for Raydium touchscreens that do not like splitting
       command transfers
    
     - quirks for i8042, soc_button_array, and goodix drivers to make them
       work better with certain hardware.
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
      Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
      Input: cm109 - do not stomp on control URB
      Input: i8042 - add Acer laptops to the i8042 reset list
      Input: cros_ec_keyb - send 'scancodes' in addition to key events
      Input: soc_button_array - add Lenovo Yoga Tablet2 1051L to the dmi_use_low_level_irq list
      Input: raydium_ts_i2c - do not split tx transactions

commit 6ffeb1c3f8226244c08105bcdbeecc04bad6b89a
Author: Mike Snitzer <snitzer at redhat.com>
Date:   Sat Dec 12 11:55:37 2020 -0500

    md: change mddev 'chunk_sectors' from int to unsigned
    
    Commit e2782f560c29 ("Revert "dm raid: remove unnecessary discard
    limits for raid10"") exposed compiler warnings introduced by commit
    e0910c8e4f87 ("dm raid: fix discard limits for raid1 and raid10"):
    
    In file included from ./include/linux/kernel.h:14,
                     from ./include/asm-generic/bug.h:20,
                     from ./arch/x86/include/asm/bug.h:93,
                     from ./include/linux/bug.h:5,
                     from ./include/linux/mmdebug.h:5,
                     from ./include/linux/gfp.h:5,
                     from ./include/linux/slab.h:15,
                     from drivers/md/dm-raid.c:8:
    drivers/md/dm-raid.c: In function ‘raid_io_hints’:
    ./include/linux/minmax.h:18:28: warning: comparison of distinct pointer types lacks a cast
      (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
                                ^~
    ./include/linux/minmax.h:32:4: note: in expansion of macro ‘__typecheck’
       (__typecheck(x, y) && __no_side_effects(x, y))
        ^~~~~~~~~~~
    ./include/linux/minmax.h:42:24: note: in expansion of macro ‘__safe_cmp’
      __builtin_choose_expr(__safe_cmp(x, y), \
                            ^~~~~~~~~~
    ./include/linux/minmax.h:51:19: note: in expansion of macro ‘__careful_cmp’
     #define min(x, y) __careful_cmp(x, y, <)
                       ^~~~~~~~~~~~~
    ./include/linux/minmax.h:84:39: note: in expansion of macro ‘min’
      __x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })
                                           ^~~
    drivers/md/dm-raid.c:3739:33: note: in expansion of macro ‘min_not_zero’
       limits->max_discard_sectors = min_not_zero(rs->md.chunk_sectors,
                                     ^~~~~~~~~~~~
    
    Fix this by changing the chunk_sectors member of 'struct mddev' from
    int to 'unsigned int' to match the type used for the 'chunk_sectors'
    member of 'struct queue_limits'.  Various MD code still uses 'int' but
    none of it appears to ever make use of signed int; and storing
    positive signed int in unsigned is perfectly safe.
    
    Reported-by: Song Liu <songliubraving at fb.com>
    Fixes: e2782f560c29 ("Revert "dm raid: remove unnecessary discard limits for raid10"")
    Fixes: e0910c8e4f87 ("dm raid: fix discard limits for raid1 and raid10")
    Cc: stable at vger,kernel.org # e0910c8e4f87 was marked for stable@
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>
    Reviewed-by: Song Liu <song at kernel.org>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/drivers/md/md.h b/drivers/md/md.h
index 2175a5ac4f7c..bb645bc3ba6d 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -311,7 +311,7 @@ struct mddev {
 	int				external;	/* metadata is
 							 * managed externally */
 	char				metadata_type[17]; /* externally set*/
-	int				chunk_sectors;
+	unsigned int			chunk_sectors;
 	time64_t			ctime, utime;
 	int				level, layout;
 	char				clevel[16];
@@ -339,7 +339,7 @@ struct mddev {
 	 */
 	sector_t			reshape_position;
 	int				delta_disks, new_level, new_layout;
-	int				new_chunk_sectors;
+	unsigned int			new_chunk_sectors;
 	int				reshape_backwards;
 
 	struct md_thread		*thread;	/* management thread */
commit 0d07c0ec4381f630c801539c79ad8dcc627f6e4a
Author: Masami Hiramatsu <mhiramat at kernel.org>
Date:   Fri Dec 11 16:04:17 2020 +0900

    x86/kprobes: Fix optprobe to detect INT3 padding correctly
    
    Commit
    
      7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP for linker fill bytes")
    
    changed the padding bytes between functions from NOP to INT3. However,
    when optprobe decodes a target function it finds INT3 and gives up the
    jump optimization.
    
    Instead of giving up any INT3 detection, check whether the rest of the
    bytes to the end of the function are INT3. If all of them are INT3,
    those come from the linker. In that case, continue the optprobe jump
    optimization.
    
     [ bp: Massage commit message. ]
    
    Fixes: 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP for linker fill bytes")
    Reported-by: Adam Zabrocki <pi3 at pi3.com.pl>
    Signed-off-by: Masami Hiramatsu <mhiramat at kernel.org>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Reviewed-by: Steven Rostedt (VMware) <rostedt at goodmis.org>
    Reviewed-by: Kees Cook <keescook at chromium.org>
    Cc: stable at vger.kernel.org
    Link: https://lkml.kernel.org/r/160767025681.3880685.16021570341428835411.stgit@devnote2

diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index 041f0b50bc27..08eb23074f92 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -272,6 +272,19 @@ static int insn_is_indirect_jump(struct insn *insn)
 	return ret;
 }
 
+static bool is_padding_int3(unsigned long addr, unsigned long eaddr)
+{
+	unsigned char ops;
+
+	for (; addr < eaddr; addr++) {
+		if (get_kernel_nofault(ops, (void *)addr) < 0 ||
+		    ops != INT3_INSN_OPCODE)
+			return false;
+	}
+
+	return true;
+}
+
 /* Decode whole function to ensure any instructions don't jump into target */
 static int can_optimize(unsigned long paddr)
 {
@@ -310,9 +323,14 @@ static int can_optimize(unsigned long paddr)
 			return 0;
 		kernel_insn_init(&insn, (void *)recovered_insn, MAX_INSN_SIZE);
 		insn_get_length(&insn);
-		/* Another subsystem puts a breakpoint */
+		/*
+		 * In the case of detecting unknown breakpoint, this could be
+		 * a padding INT3 between functions. Let's check that all the
+		 * rest of the bytes are also INT3.
+		 */
 		if (insn.opcode.bytes[0] == INT3_INSN_OPCODE)
-			return 0;
+			return is_padding_int3(addr, paddr - offset + size) ? 1 : 0;
+
 		/* Recover address */
 		insn.kaddr = (void *)addr;
 		insn.next_byte = (void *)(addr + insn.length);
commit cffdd6d90482316e18d686060a4397902ea04bd2
Author: Simon Beginn <linux at simonmicro.de>
Date:   Fri Dec 11 16:17:32 2020 -0800

    Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
    
    The touchscreen on the Teclast x98 Pro is also mounted upside-down in
    relation to the display orientation.
    
    Signed-off-by: Simon Beginn <linux at simonmicro.de>
    Signed-off-by: Bastien Nocera <hadess at hadess.net>
    Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
index 02c75ea385e0..6612f9e2d7e8 100644
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -192,6 +192,18 @@ static const struct dmi_system_id rotated_screen[] = {
 			DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
 		},
 	},
+	{
+		.ident = "Teclast X98 Pro",
+		.matches = {
+			/*
+			 * Only match BIOS date, because the manufacturers
+			 * BIOS does not report the board name at all
+			 * (sometimes)...
+			 */
+			DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+			DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
+		},
+	},
 	{
 		.ident = "WinBook TW100",
 		.matches = {
commit 111d0bda8eeb4b54e0c63897b071effbf9fd9251
Author: Stefan Raspl <raspl at de.ibm.com>
Date:   Tue Dec 8 22:08:29 2020 +0100

    tools/kvm_stat: Exempt time-based counters
    
    The new counters halt_poll_success_ns and halt_poll_fail_ns do not count
    events. Instead they provide a time, and mess up our statistics. Therefore,
    we should exclude them.
    Removal is currently implemented with an exempt list. If more counters like
    these appear, we can think about a more general rule like excluding all
    fields name "*_ns", in case that's a standing convention.
    
    Signed-off-by: Stefan Raspl <raspl at linux.ibm.com>
    Tested-and-reported-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Message-Id: <20201208210829.101324-1-raspl at linux.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
index d199a3694be8..b0bf56c5f120 100755
--- a/tools/kvm/kvm_stat/kvm_stat
+++ b/tools/kvm/kvm_stat/kvm_stat
@@ -742,7 +742,11 @@ class DebugfsProvider(Provider):
         The fields are all available KVM debugfs files
 
         """
-        return self.walkdir(PATH_DEBUGFS_KVM)[2]
+        exempt_list = ['halt_poll_fail_ns', 'halt_poll_success_ns']
+        fields = [field for field in self.walkdir(PATH_DEBUGFS_KVM)[2]
+                  if field not in exempt_list]
+
+        return fields
 
     def update_fields(self, fields_filter):
         """Refresh fields, applying fields_filter"""
commit 34c0f6f2695a2db81e09a3ab7bdb2853f45d4d3d
Author: Maciej S. Szmigiero <maciej.szmigiero at oracle.com>
Date:   Sat Dec 5 01:48:08 2020 +0100

    KVM: mmu: Fix SPTE encoding of MMIO generation upper half
    
    Commit cae7ed3c2cb0 ("KVM: x86: Refactor the MMIO SPTE generation handling")
    cleaned up the computation of MMIO generation SPTE masks, however it
    introduced a bug how the upper part was encoded:
    SPTE bits 52-61 were supposed to contain bits 10-19 of the current
    generation number, however a missing shift encoded bits 1-10 there instead
    (mostly duplicating the lower part of the encoded generation number that
    then consisted of bits 1-9).
    
    In the meantime, the upper part was shrunk by one bit and moved by
    subsequent commits to become an upper half of the encoded generation number
    (bits 9-17 of bits 0-17 encoded in a SPTE).
    
    In addition to the above, commit 56871d444bc4 ("KVM: x86: fix overlap between SPTE_MMIO_MASK and generation")
    has changed the SPTE bit range assigned to encode the generation number and
    the total number of bits encoded but did not update them in the comment
    attached to their defines, nor in the KVM MMU doc.
    Let's do it here, too, since it is too trivial thing to warrant a separate
    commit.
    
    Fixes: cae7ed3c2cb0 ("KVM: x86: Refactor the MMIO SPTE generation handling")
    Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero at oracle.com>
    Message-Id: <156700708db2a5296c5ed7a8b9ac71f1e9765c85.1607129096.git.maciej.szmigiero at oracle.com>
    Cc: stable at vger.kernel.org
    [Reorganize macros so that everything is computed from the bit ranges. - Paolo]
    Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>

diff --git a/Documentation/virt/kvm/mmu.rst b/Documentation/virt/kvm/mmu.rst
index 1c030dbac7c4..5bfe28b0728e 100644
--- a/Documentation/virt/kvm/mmu.rst
+++ b/Documentation/virt/kvm/mmu.rst
@@ -455,7 +455,7 @@ If the generation number of the spte does not equal the global generation
 number, it will ignore the cached MMIO information and handle the page
 fault through the slow path.
 
-Since only 19 bits are used to store generation-number on mmio spte, all
+Since only 18 bits are used to store generation-number on mmio spte, all
 pages are zapped when there is an overflow.
 
 Unfortunately, a single memory access might access kvm_memslots(kvm) multiple
diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c
index fcac2cac78fe..c51ad544f25b 100644
--- a/arch/x86/kvm/mmu/spte.c
+++ b/arch/x86/kvm/mmu/spte.c
@@ -40,8 +40,8 @@ static u64 generation_mmio_spte_mask(u64 gen)
 	WARN_ON(gen & ~MMIO_SPTE_GEN_MASK);
 	BUILD_BUG_ON((MMIO_SPTE_GEN_HIGH_MASK | MMIO_SPTE_GEN_LOW_MASK) & SPTE_SPECIAL_MASK);
 
-	mask = (gen << MMIO_SPTE_GEN_LOW_START) & MMIO_SPTE_GEN_LOW_MASK;
-	mask |= (gen << MMIO_SPTE_GEN_HIGH_START) & MMIO_SPTE_GEN_HIGH_MASK;
+	mask = (gen << MMIO_SPTE_GEN_LOW_SHIFT) & MMIO_SPTE_GEN_LOW_MASK;
+	mask |= (gen << MMIO_SPTE_GEN_HIGH_SHIFT) & MMIO_SPTE_GEN_HIGH_MASK;
 	return mask;
 }
 
diff --git a/arch/x86/kvm/mmu/spte.h b/arch/x86/kvm/mmu/spte.h
index 5c75a451c000..2b3a30bd38b0 100644
--- a/arch/x86/kvm/mmu/spte.h
+++ b/arch/x86/kvm/mmu/spte.h
@@ -56,11 +56,11 @@
 #define SPTE_MMU_WRITEABLE	(1ULL << (PT_FIRST_AVAIL_BITS_SHIFT + 1))
 
 /*
- * Due to limited space in PTEs, the MMIO generation is a 19 bit subset of
+ * Due to limited space in PTEs, the MMIO generation is a 18 bit subset of
  * the memslots generation and is derived as follows:
  *
  * Bits 0-8 of the MMIO generation are propagated to spte bits 3-11
- * Bits 9-18 of the MMIO generation are propagated to spte bits 52-61
+ * Bits 9-17 of the MMIO generation are propagated to spte bits 54-62
  *
  * The KVM_MEMSLOT_GEN_UPDATE_IN_PROGRESS flag is intentionally not included in
  * the MMIO generation number, as doing so would require stealing a bit from
@@ -69,18 +69,29 @@
  * requires a full MMU zap).  The flag is instead explicitly queried when
  * checking for MMIO spte cache hits.
  */
-#define MMIO_SPTE_GEN_MASK		GENMASK_ULL(17, 0)
 
 #define MMIO_SPTE_GEN_LOW_START		3
 #define MMIO_SPTE_GEN_LOW_END		11
-#define MMIO_SPTE_GEN_LOW_MASK		GENMASK_ULL(MMIO_SPTE_GEN_LOW_END, \
-						    MMIO_SPTE_GEN_LOW_START)
 
 #define MMIO_SPTE_GEN_HIGH_START	PT64_SECOND_AVAIL_BITS_SHIFT
 #define MMIO_SPTE_GEN_HIGH_END		62
+
+#define MMIO_SPTE_GEN_LOW_MASK		GENMASK_ULL(MMIO_SPTE_GEN_LOW_END, \
+						    MMIO_SPTE_GEN_LOW_START)
 #define MMIO_SPTE_GEN_HIGH_MASK		GENMASK_ULL(MMIO_SPTE_GEN_HIGH_END, \
 						    MMIO_SPTE_GEN_HIGH_START)
 
+#define MMIO_SPTE_GEN_LOW_BITS		(MMIO_SPTE_GEN_LOW_END - MMIO_SPTE_GEN_LOW_START + 1)
+#define MMIO_SPTE_GEN_HIGH_BITS		(MMIO_SPTE_GEN_HIGH_END - MMIO_SPTE_GEN_HIGH_START + 1)
+
+/* remember to adjust the comment above as well if you change these */
+static_assert(MMIO_SPTE_GEN_LOW_BITS == 9 && MMIO_SPTE_GEN_HIGH_BITS == 9);
+
+#define MMIO_SPTE_GEN_LOW_SHIFT		(MMIO_SPTE_GEN_LOW_START - 0)
+#define MMIO_SPTE_GEN_HIGH_SHIFT	(MMIO_SPTE_GEN_HIGH_START - MMIO_SPTE_GEN_LOW_BITS)
+
+#define MMIO_SPTE_GEN_MASK		GENMASK_ULL(MMIO_SPTE_GEN_LOW_BITS + MMIO_SPTE_GEN_HIGH_BITS - 1, 0)
+
 extern u64 __read_mostly shadow_nx_mask;
 extern u64 __read_mostly shadow_x_mask; /* mutual exclusive with nx_mask */
 extern u64 __read_mostly shadow_user_mask;
@@ -228,8 +239,8 @@ static inline u64 get_mmio_spte_generation(u64 spte)
 {
 	u64 gen;
 
-	gen = (spte & MMIO_SPTE_GEN_LOW_MASK) >> MMIO_SPTE_GEN_LOW_START;
-	gen |= (spte & MMIO_SPTE_GEN_HIGH_MASK) >> MMIO_SPTE_GEN_HIGH_START;
+	gen = (spte & MMIO_SPTE_GEN_LOW_MASK) >> MMIO_SPTE_GEN_LOW_SHIFT;
+	gen |= (spte & MMIO_SPTE_GEN_HIGH_MASK) >> MMIO_SPTE_GEN_HIGH_SHIFT;
 	return gen;
 }
 
commit 7f376f1917d7461e05b648983e8d2aea9d0712b2
Merge: 1de5d12b7690 33d974e76e21
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 14:29:46 2020 -0800

    Merge tag 'mtd/fixes-for-5.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
    
    Pull mtd fixes from Miquel Raynal:
     "Second series of fixes for raw NAND drivers initiated because of a
      rework of the ECC engine subsystem.
    
      The location of the DT parsing logic got moved, breaking several
      drivers which in fact were not doing the ECC engine initialization at
      the right place.
    
      These drivers have been fixed by enforcing a particular ECC engine
      type and algorithm, software Hamming, while the algorithm may be
      overwritten by a DT property. This merge request fixes this in the
      xway, socrates, plat_nand, pasemi, orion, mpc5121, gpio, au1550 and
      ams-delta controller drivers"
    
    * tag 'mtd/fixes-for-5.10-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
      mtd: rawnand: xway: Do not force a particular software ECC engine
      mtd: rawnand: socrates: Do not force a particular software ECC engine
      mtd: rawnand: plat_nand: Do not force a particular software ECC engine
      mtd: rawnand: pasemi: Do not force a particular software ECC engine
      mtd: rawnand: orion: Do not force a particular software ECC engine
      mtd: rawnand: mpc5121: Do not force a particular software ECC engine
      mtd: rawnand: gpio: Do not force a particular software ECC engine
      mtd: rawnand: au1550: Do not force a particular software ECC engine
      mtd: rawnand: ams-delta: Do not force a particular software ECC engine

commit 1de5d12b769017f7354e7151ce1c26eb1d9ba2e4
Merge: 782598ecea73 c0d638a03bc5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 14:26:17 2020 -0800

    Merge tag 'mmc-v5.10-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
    
    Pull MMC fixes from Ulf Hansson:
     "A couple of MMC fixes:
    
      MMC core:
       - Fixup condition for CMD13 polling for RPMB requests
    
      MMC host:
       - mtk-sd: Fix system suspend/resume support for CQHCI
       - mtd-sd: Extend SDIO IRQ fix to more variants
       - sdhci-of-arasan: Fix clock registration error for Keem Bay SOC
       - tmio: Bring HW to a sane state after a power off"
    
    * tag 'mmc-v5.10-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
      mmc: mediatek: mark PM functions as __maybe_unused
      mmc: block: Fixup condition for CMD13 polling for RPMB requests
      mmc: tmio: improve bringing HW to a sane state with MMC_POWER_OFF
      mmc: sdhci-of-arasan: Fix clock registration error for Keem Bay SOC
      mmc: mediatek: Extend recheck_sdio_irq fix to more variants
      mmc: mediatek: Fix system suspend/resume support for CQHCI

commit e977aaf899a6d3b3d6658da66e262b6e307ae3a2
Merge: 0477e9288185 4e302c3b568e
Author: Wolfram Sang <wsa at kernel.org>
Date:   Fri Dec 11 23:23:30 2020 +0100

    Merge tag 'at24-fixes-for-v5.10' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-current
    
    at24 fixes for v5.10
    
    - fix NVMEM name with custom AT24 device name

commit 782598ecea73a4aecdd25cb0ceb0b19e8674cf30
Merge: b7906b70a233 6bea0225a4bf
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 14:22:42 2020 -0800

    Merge tag 'zonefs-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs
    
    Pull zonefs fix from Damien Le Moal:
     "A single patch in this pull request to fix a BIO and page reference
      leak when writing sequential zone files"
    
    * tag 'zonefs-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:
      zonefs: fix page reference and BIO leak

commit b7906b70a2337e445b8dca3ce7ba8976b6ebd07d
Author: Andrii Nakryiko <andrii at kernel.org>
Date:   Fri Dec 11 22:36:25 2020 +0100

    bpf: Fix enum names for bpf_this_cpu_ptr() and bpf_per_cpu_ptr() helpers
    
    Remove bpf_ prefix, which causes these helpers to be reported in verifier
    dump as bpf_bpf_this_cpu_ptr() and bpf_bpf_per_cpu_ptr(), respectively. Lets
    fix it as long as it is still possible before UAPI freezes on these helpers.
    
    Fixes: eaa6bcb71ef6 ("bpf: Introduce bpf_per_cpu_ptr()")
    Signed-off-by: Andrii Nakryiko <andrii at kernel.org>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e6ceac3f7d62..556216dc9703 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3897,8 +3897,8 @@ union bpf_attr {
 	FN(seq_printf_btf),		\
 	FN(skb_cgroup_classid),		\
 	FN(redirect_neigh),		\
-	FN(bpf_per_cpu_ptr),            \
-	FN(bpf_this_cpu_ptr),		\
+	FN(per_cpu_ptr),		\
+	FN(this_cpu_ptr),		\
 	FN(redirect_peer),		\
 	/* */
 
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 25520f5eeaf6..deda1185237b 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -717,9 +717,9 @@ bpf_base_func_proto(enum bpf_func_id func_id)
 		return &bpf_snprintf_btf_proto;
 	case BPF_FUNC_jiffies64:
 		return &bpf_jiffies64_proto;
-	case BPF_FUNC_bpf_per_cpu_ptr:
+	case BPF_FUNC_per_cpu_ptr:
 		return &bpf_per_cpu_ptr_proto;
-	case BPF_FUNC_bpf_this_cpu_ptr:
+	case BPF_FUNC_this_cpu_ptr:
 		return &bpf_this_cpu_ptr_proto;
 	default:
 		break;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 048c655315f1..a125ea5e04cd 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1337,9 +1337,9 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
 		return prog->aux->sleepable ? &bpf_copy_from_user_proto : NULL;
 	case BPF_FUNC_snprintf_btf:
 		return &bpf_snprintf_btf_proto;
-	case BPF_FUNC_bpf_per_cpu_ptr:
+	case BPF_FUNC_per_cpu_ptr:
 		return &bpf_per_cpu_ptr_proto;
-	case BPF_FUNC_bpf_this_cpu_ptr:
+	case BPF_FUNC_this_cpu_ptr:
 		return &bpf_this_cpu_ptr_proto;
 	default:
 		return NULL;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e6ceac3f7d62..556216dc9703 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3897,8 +3897,8 @@ union bpf_attr {
 	FN(seq_printf_btf),		\
 	FN(skb_cgroup_classid),		\
 	FN(redirect_neigh),		\
-	FN(bpf_per_cpu_ptr),            \
-	FN(bpf_this_cpu_ptr),		\
+	FN(per_cpu_ptr),		\
+	FN(this_cpu_ptr),		\
 	FN(redirect_peer),		\
 	/* */
 
commit a06caa4a68ce7d134b342966e65e7bd2dfa2eead
Merge: 94801e5c6d46 ba9c1201beaa
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 14:10:51 2020 -0800

    Merge branch 'akpm' (patches from Andrew)
    
    Merge misc fixes from Andrew Morton:
     "8 patches.
    
      Subsystems affected by this patch series: proc, selftests, kbuild, and
      mm (pagecache, kasan, hugetlb)"
    
    * emailed patches from Andrew Morton <akpm at linux-foundation.org>:
      mm/hugetlb: clear compound_nr before freeing gigantic pages
      kasan: fix object remaining in offline per-cpu quarantine
      elfcore: fix building with clang
      initramfs: fix clang build failure
      kbuild: avoid static_assert for genksyms
      selftest/fpu: avoid clang warning
      proc: use untagged_addr() for pagemap_read addresses
      revert "mm/filemap: add static for function __add_to_page_cache_locked"

commit ba9c1201beaa86a773e83be5654602a0667e4a4d
Author: Gerald Schaefer <gerald.schaefer at linux.ibm.com>
Date:   Fri Dec 11 13:36:53 2020 -0800

    mm/hugetlb: clear compound_nr before freeing gigantic pages
    
    Commit 1378a5ee451a ("mm: store compound_nr as well as compound_order")
    added compound_nr counter to first tail struct page, overlaying with
    page->mapping.  The overlay itself is fine, but while freeing gigantic
    hugepages via free_contig_range(), a "bad page" check will trigger for
    non-NULL page->mapping on the first tail page:
    
      BUG: Bad page state in process bash  pfn:380001
      page:00000000c35f0856 refcount:0 mapcount:0 mapping:00000000126b68aa index:0x0 pfn:0x380001
      aops:0x0
      flags: 0x3ffff00000000000()
      raw: 3ffff00000000000 0000000000000100 0000000000000122 0000000100000000
      raw: 0000000000000000 0000000000000000 ffffffff00000000 0000000000000000
      page dumped because: non-NULL mapping
      Modules linked in:
      CPU: 6 PID: 616 Comm: bash Not tainted 5.10.0-rc7-next-20201208 #1
      Hardware name: IBM 3906 M03 703 (LPAR)
      Call Trace:
        show_stack+0x6e/0xe8
        dump_stack+0x90/0xc8
        bad_page+0xd6/0x130
        free_pcppages_bulk+0x26a/0x800
        free_unref_page+0x6e/0x90
        free_contig_range+0x94/0xe8
        update_and_free_page+0x1c4/0x2c8
        free_pool_huge_page+0x11e/0x138
        set_max_huge_pages+0x228/0x300
        nr_hugepages_store_common+0xb8/0x130
        kernfs_fop_write+0xd2/0x218
        vfs_write+0xb0/0x2b8
        ksys_write+0xac/0xe0
        system_call+0xe6/0x288
      Disabling lock debugging due to kernel taint
    
    This is because only the compound_order is cleared in
    destroy_compound_gigantic_page(), and compound_nr is set to
    1U << order == 1 for order 0 in set_compound_order(page, 0).
    
    Fix this by explicitly clearing compound_nr for first tail page after
    calling set_compound_order(page, 0).
    
    Link: https://lkml.kernel.org/r/20201208182813.66391-2-gerald.schaefer@linux.ibm.com
    Fixes: 1378a5ee451a ("mm: store compound_nr as well as compound_order")
    Signed-off-by: Gerald Schaefer <gerald.schaefer at linux.ibm.com>
    Reviewed-by: Matthew Wilcox (Oracle) <willy at infradead.org>
    Cc: Heiko Carstens <hca at linux.ibm.com>
    Cc: Mike Kravetz <mike.kravetz at oracle.com>
    Cc: Christian Borntraeger <borntraeger at de.ibm.com>
    Cc: <stable at vger.kernel.org>    [5.9+]
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 37f15c3c24dc..d029d938d26d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1216,6 +1216,7 @@ static void destroy_compound_gigantic_page(struct page *page,
 	}
 
 	set_compound_order(page, 0);
+	page[1].compound_nr = 0;
 	__ClearPageHead(page);
 }
 
commit 6c82d45c7f0348b44e00bd7dcccfc47dec7577d1
Author: Kuan-Ying Lee <Kuan-Ying.Lee at mediatek.com>
Date:   Fri Dec 11 13:36:49 2020 -0800

    kasan: fix object remaining in offline per-cpu quarantine
    
    We hit this issue in our internal test.  When enabling generic kasan, a
    kfree()'d object is put into per-cpu quarantine first.  If the cpu goes
    offline, object still remains in the per-cpu quarantine.  If we call
    kmem_cache_destroy() now, slub will report "Objects remaining" error.
    
      =============================================================================
      BUG test_module_slab (Not tainted): Objects remaining in test_module_slab on __kmem_cache_shutdown()
      -----------------------------------------------------------------------------
    
      Disabling lock debugging due to kernel taint
      INFO: Slab 0x(____ptrval____) objects=34 used=1 fp=0x(____ptrval____) flags=0x2ffff00000010200
      CPU: 3 PID: 176 Comm: cat Tainted: G    B             5.10.0-rc1-00007-g4525c8781ec0-dirty #10
      Hardware name: linux,dummy-virt (DT)
      Call trace:
         dump_backtrace+0x0/0x2b0
         show_stack+0x18/0x68
         dump_stack+0xfc/0x168
         slab_err+0xac/0xd4
         __kmem_cache_shutdown+0x1e4/0x3c8
         kmem_cache_destroy+0x68/0x130
         test_version_show+0x84/0xf0
         module_attr_show+0x40/0x60
         sysfs_kf_seq_show+0x128/0x1c0
         kernfs_seq_show+0xa0/0xb8
         seq_read+0x1f0/0x7e8
         kernfs_fop_read+0x70/0x338
         vfs_read+0xe4/0x250
         ksys_read+0xc8/0x180
         __arm64_sys_read+0x44/0x58
         el0_svc_common.constprop.0+0xac/0x228
         do_el0_svc+0x38/0xa0
         el0_sync_handler+0x170/0x178
         el0_sync+0x174/0x180
      INFO: Object 0x(____ptrval____) @offset=15848
      INFO: Allocated in test_version_show+0x98/0xf0 age=8188 cpu=6 pid=172
         stack_trace_save+0x9c/0xd0
         set_track+0x64/0xf0
         alloc_debug_processing+0x104/0x1a0
         ___slab_alloc+0x628/0x648
         __slab_alloc.isra.0+0x2c/0x58
         kmem_cache_alloc+0x560/0x588
         test_version_show+0x98/0xf0
         module_attr_show+0x40/0x60
         sysfs_kf_seq_show+0x128/0x1c0
         kernfs_seq_show+0xa0/0xb8
         seq_read+0x1f0/0x7e8
         kernfs_fop_read+0x70/0x338
         vfs_read+0xe4/0x250
         ksys_read+0xc8/0x180
         __arm64_sys_read+0x44/0x58
         el0_svc_common.constprop.0+0xac/0x228
      kmem_cache_destroy test_module_slab: Slab cache still has objects
    
    Register a cpu hotplug function to remove all objects in the offline
    per-cpu quarantine when cpu is going offline.  Set a per-cpu variable to
    indicate this cpu is offline.
    
    [qiang.zhang at windriver.com: fix slab double free when cpu-hotplug]
      Link: https://lkml.kernel.org/r/20201204102206.20237-1-qiang.zhang@windriver.com
    
    Link: https://lkml.kernel.org/r/1606895585-17382-2-git-send-email-Kuan-Ying.Lee@mediatek.com
    Signed-off-by: Kuan-Ying Lee <Kuan-Ying.Lee at mediatek.com>
    Signed-off-by: Zqiang <qiang.zhang at windriver.com>
    Suggested-by: Dmitry Vyukov <dvyukov at google.com>
    Reported-by: Guangye Yang <guangye.yang at mediatek.com>
    Reviewed-by: Dmitry Vyukov <dvyukov at google.com>
    Cc: Andrey Ryabinin <aryabinin at virtuozzo.com>
    Cc: Alexander Potapenko <glider at google.com>
    Cc: Matthias Brugger <matthias.bgg at gmail.com>
    Cc: Nicholas Tang <nicholas.tang at mediatek.com>
    Cc: Miles Chen <miles.chen at mediatek.com>
    Cc: Qian Cai <qcai at redhat.com>
    Cc: Stephen Rothwell <sfr at canb.auug.org.au>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index 4c5375810449..0e3f8494628f 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -29,6 +29,7 @@
 #include <linux/srcu.h>
 #include <linux/string.h>
 #include <linux/types.h>
+#include <linux/cpuhotplug.h>
 
 #include "../slab.h"
 #include "kasan.h"
@@ -43,6 +44,7 @@ struct qlist_head {
 	struct qlist_node *head;
 	struct qlist_node *tail;
 	size_t bytes;
+	bool offline;
 };
 
 #define QLIST_INIT { NULL, NULL, 0 }
@@ -188,6 +190,10 @@ void quarantine_put(struct kasan_free_meta *info, struct kmem_cache *cache)
 	local_irq_save(flags);
 
 	q = this_cpu_ptr(&cpu_quarantine);
+	if (q->offline) {
+		local_irq_restore(flags);
+		return;
+	}
 	qlist_put(q, &info->quarantine_link, cache->size);
 	if (unlikely(q->bytes > QUARANTINE_PERCPU_SIZE)) {
 		qlist_move_all(q, &temp);
@@ -328,3 +334,36 @@ void quarantine_remove_cache(struct kmem_cache *cache)
 
 	synchronize_srcu(&remove_cache_srcu);
 }
+
+static int kasan_cpu_online(unsigned int cpu)
+{
+	this_cpu_ptr(&cpu_quarantine)->offline = false;
+	return 0;
+}
+
+static int kasan_cpu_offline(unsigned int cpu)
+{
+	struct qlist_head *q;
+
+	q = this_cpu_ptr(&cpu_quarantine);
+	/* Ensure the ordering between the writing to q->offline and
+	 * qlist_free_all. Otherwise, cpu_quarantine may be corrupted
+	 * by interrupt.
+	 */
+	WRITE_ONCE(q->offline, true);
+	barrier();
+	qlist_free_all(q, NULL);
+	return 0;
+}
+
+static int __init kasan_cpu_quarantine_init(void)
+{
+	int ret = 0;
+
+	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mm/kasan:online",
+				kasan_cpu_online, kasan_cpu_offline);
+	if (ret < 0)
+		pr_err("kasan cpu quarantine register failed [%d]\n", ret);
+	return ret;
+}
+late_initcall(kasan_cpu_quarantine_init);
commit 6e7b64b9dd6d96537d816ea07ec26b7dedd397b9
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 11 13:36:46 2020 -0800

    elfcore: fix building with clang
    
    kernel/elfcore.c only contains weak symbols, which triggers a bug with
    clang in combination with recordmcount:
    
      Cannot find symbol for section 2: .text.
      kernel/elfcore.o: failed
    
    Move the empty stubs into linux/elfcore.h as inline functions.  As only
    two architectures use these, just use the architecture specific Kconfig
    symbols to key off the declaration.
    
    Link: https://lkml.kernel.org/r/20201204165742.3815221-2-arnd@kernel.org
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Cc: Nathan Chancellor <natechancellor at gmail.com>
    Cc: Nick Desaulniers <ndesaulniers at google.com>
    Cc: Barret Rhoden <brho at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index 46c3d691f677..de51c1bef27d 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h
@@ -104,6 +104,7 @@ static inline int elf_core_copy_task_fpregs(struct task_struct *t, struct pt_reg
 #endif
 }
 
+#if defined(CONFIG_UM) || defined(CONFIG_IA64)
 /*
  * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
  * extra segments containing the gate DSO contents.  Dumping its
@@ -118,5 +119,26 @@ elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset);
 extern int
 elf_core_write_extra_data(struct coredump_params *cprm);
 extern size_t elf_core_extra_data_size(void);
+#else
+static inline Elf_Half elf_core_extra_phdrs(void)
+{
+	return 0;
+}
+
+static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
+{
+	return 1;
+}
+
+static inline int elf_core_write_extra_data(struct coredump_params *cprm)
+{
+	return 1;
+}
+
+static inline size_t elf_core_extra_data_size(void)
+{
+	return 0;
+}
+#endif
 
 #endif /* _LINUX_ELFCORE_H */
diff --git a/kernel/Makefile b/kernel/Makefile
index af601b9bda0e..6c9f19911be0 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -97,7 +97,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
 obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
 obj-$(CONFIG_LATENCYTOP) += latencytop.o
-obj-$(CONFIG_ELFCORE) += elfcore.o
 obj-$(CONFIG_FUNCTION_TRACER) += trace/
 obj-$(CONFIG_TRACING) += trace/
 obj-$(CONFIG_TRACE_CLOCK) += trace/
diff --git a/kernel/elfcore.c b/kernel/elfcore.c
deleted file mode 100644
index 57fb4dcff434..000000000000
--- a/kernel/elfcore.c
+++ /dev/null
@@ -1,26 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-#include <linux/elf.h>
-#include <linux/fs.h>
-#include <linux/mm.h>
-#include <linux/binfmts.h>
-#include <linux/elfcore.h>
-
-Elf_Half __weak elf_core_extra_phdrs(void)
-{
-	return 0;
-}
-
-int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
-{
-	return 1;
-}
-
-int __weak elf_core_write_extra_data(struct coredump_params *cprm)
-{
-	return 1;
-}
-
-size_t __weak elf_core_extra_data_size(void)
-{
-	return 0;
-}
commit 55d5b7dd6451b58489ce384282ca5a4a289eb8d5
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 11 13:36:42 2020 -0800

    initramfs: fix clang build failure
    
    There is only one function in init/initramfs.c that is in the .text
    section, and it is marked __weak.  When building with clang-12 and the
    integrated assembler, this leads to a bug with recordmcount:
    
      ./scripts/recordmcount  "init/initramfs.o"
      Cannot find symbol for section 2: .text.
      init/initramfs.o: failed
    
    I'm not quite sure what exactly goes wrong, but I notice that this
    function is only ever called from an __init function, and normally
    inlined.  Marking it __init as well is clearly correct and it leads to
    recordmcount no longer complaining.
    
    Link: https://lkml.kernel.org/r/20201204165742.3815221-1-arnd@kernel.org
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Cc: Nathan Chancellor <natechancellor at gmail.com>
    Cc: Nick Desaulniers <ndesaulniers at google.com>
    Cc: Barret Rhoden <brho at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/init/initramfs.c b/init/initramfs.c
index 1f97c0328a7a..55b74d7e5260 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -535,7 +535,7 @@ extern unsigned long __initramfs_size;
 #include <linux/initrd.h>
 #include <linux/kexec.h>
 
-void __weak free_initrd_mem(unsigned long start, unsigned long end)
+void __weak __init free_initrd_mem(unsigned long start, unsigned long end)
 {
 #ifdef CONFIG_ARCH_KEEP_MEMBLOCK
 	unsigned long aligned_start = ALIGN_DOWN(start, PAGE_SIZE);
commit 14dc3983b5dff513a90bd5a8cc90acaf7867c3d0
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 11 13:36:38 2020 -0800

    kbuild: avoid static_assert for genksyms
    
    genksyms does not know or care about the _Static_assert() built-in, and
    sometimes falls back to ignoring the later symbols, which causes
    undefined behavior such as
    
      WARNING: modpost: EXPORT symbol "ethtool_set_ethtool_phy_ops" [vmlinux] version generation failed, symbol will not be versioned.
      ld: net/ethtool/common.o: relocation R_AARCH64_ABS32 against `__crc_ethtool_set_ethtool_phy_ops' can not be used when making a shared object
      net/ethtool/common.o:(_ftrace_annotated_branch+0x0): dangerous relocation: unsupported relocation
    
    Redefine static_assert for genksyms to avoid that.
    
    Link: https://lkml.kernel.org/r/20201203230955.1482058-1-arnd@kernel.org
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Suggested-by: Ard Biesheuvel <ardb at kernel.org>
    Cc: Masahiro Yamada <masahiroy at kernel.org>
    Cc: Michal Marek <michal.lkml at markovi.net>
    Cc: Kees Cook <keescook at chromium.org>
    Cc: Rikard Falkeborn <rikard.falkeborn at gmail.com>
    Cc: Marco Elver <elver at google.com>
    Cc: <stable at vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/include/linux/build_bug.h b/include/linux/build_bug.h
index e3a0be2c90ad..7bb66e15b481 100644
--- a/include/linux/build_bug.h
+++ b/include/linux/build_bug.h
@@ -77,4 +77,9 @@
 #define static_assert(expr, ...) __static_assert(expr, ##__VA_ARGS__, #expr)
 #define __static_assert(expr, msg, ...) _Static_assert(expr, msg)
 
+#ifdef __GENKSYMS__
+/* genksyms gets confused by _Static_assert */
+#define _Static_assert(expr, ...)
+#endif
+
 #endif	/* _LINUX_BUILD_BUG_H */
commit 84edc2eff82730d45ab513ecec49cb63beb973c9
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 11 13:36:35 2020 -0800

    selftest/fpu: avoid clang warning
    
    With extra warnings enabled, clang complains about the redundant
    -mhard-float argument:
    
      clang: error: argument unused during compilation: '-mhard-float' [-Werror,-Wunused-command-line-argument]
    
    Move this into the gcc-only part of the Makefile.
    
    Link: https://lkml.kernel.org/r/20201203223652.1320700-1-arnd@kernel.org
    Fixes: 4185b3b92792 ("selftests/fpu: Add an FPU selftest")
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Cc: Nathan Chancellor <natechancellor at gmail.com>
    Cc: Nick Desaulniers <ndesaulniers at google.com>
    Cc: Petteri Aimonen <jpa at git.mail.kapsi.fi>
    Cc: Borislav Petkov <bp at suse.de>
    Cc: Arnd Bergmann <arnd at arndb.de>
    Cc: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/lib/Makefile b/lib/Makefile
index ce45af50983a..d415fc7067c5 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -107,7 +107,7 @@ obj-$(CONFIG_TEST_FREE_PAGES) += test_free_pages.o
 # off the generation of FPU/SSE* instructions for kernel proper but FPU_FLAGS
 # get appended last to CFLAGS and thus override those previous compiler options.
 #
-FPU_CFLAGS := -mhard-float -msse -msse2
+FPU_CFLAGS := -msse -msse2
 ifdef CONFIG_CC_IS_GCC
 # Stack alignment mismatch, proceed with caution.
 # GCC < 7.1 cannot compile code using `double` and -mpreferred-stack-boundary=3
@@ -120,6 +120,7 @@ ifdef CONFIG_CC_IS_GCC
 #  -mpreferred-stack-boundary=3 is not between 4 and 12
 #
 # can be triggered. Otherwise gcc doesn't complain.
+FPU_CFLAGS += -mhard-float
 FPU_CFLAGS += $(call cc-option,-msse -mpreferred-stack-boundary=3,-mpreferred-stack-boundary=4)
 endif
 
commit 40d6366e9d86d9a67b5642040e76082fdb5bdcf9
Author: Miles Chen <miles.chen at mediatek.com>
Date:   Fri Dec 11 13:36:31 2020 -0800

    proc: use untagged_addr() for pagemap_read addresses
    
    When we try to visit the pagemap of a tagged userspace pointer, we find
    that the start_vaddr is not correct because of the tag.
    To fix it, we should untag the userspace pointers in pagemap_read().
    
    I tested with 5.10-rc4 and the issue remains.
    
    Explanation from Catalin in [1]:
    
     "Arguably, that's a user-space bug since tagged file offsets were never
      supported. In this case it's not even a tag at bit 56 as per the arm64
      tagged address ABI but rather down to bit 47. You could say that the
      problem is caused by the C library (malloc()) or whoever created the
      tagged vaddr and passed it to this function. It's not a kernel
      regression as we've never supported it.
    
      Now, pagemap is a special case where the offset is usually not
      generated as a classic file offset but rather derived by shifting a
      user virtual address. I guess we can make a concession for pagemap
      (only) and allow such offset with the tag at bit (56 - PAGE_SHIFT + 3)"
    
    My test code is based on [2]:
    
    A userspace pointer which has been tagged by 0xb4: 0xb400007662f541c8
    
    userspace program:
    
      uint64 OsLayer::VirtualToPhysical(void *vaddr) {
            uint64 frame, paddr, pfnmask, pagemask;
            int pagesize = sysconf(_SC_PAGESIZE);
            off64_t off = ((uintptr_t)vaddr) / pagesize * 8; // off = 0xb400007662f541c8 / pagesize * 8 = 0x5a00003b317aa0
            int fd = open(kPagemapPath, O_RDONLY);
            ...
    
            if (lseek64(fd, off, SEEK_SET) != off || read(fd, &frame, 8) != 8) {
                    int err = errno;
                    string errtxt = ErrorString(err);
                    if (fd >= 0)
                            close(fd);
                    return 0;
            }
      ...
      }
    
    kernel fs/proc/task_mmu.c:
    
      static ssize_t pagemap_read(struct file *file, char __user *buf,
                    size_t count, loff_t *ppos)
      {
            ...
            src = *ppos;
            svpfn = src / PM_ENTRY_BYTES; // svpfn == 0xb400007662f54
            start_vaddr = svpfn << PAGE_SHIFT; // start_vaddr == 0xb400007662f54000
            end_vaddr = mm->task_size;
    
            /* watch out for wraparound */
            // svpfn == 0xb400007662f54
            // (mm->task_size >> PAGE) == 0x8000000
            if (svpfn > mm->task_size >> PAGE_SHIFT) // the condition is true because of the tag 0xb4
                    start_vaddr = end_vaddr;
    
            ret = 0;
            while (count && (start_vaddr < end_vaddr)) { // we cannot visit correct entry because start_vaddr is set to end_vaddr
                    int len;
                    unsigned long end;
                    ...
            }
            ...
      }
    
    [1] https://lore.kernel.org/patchwork/patch/1343258/
    [2] https://github.com/stressapptest/stressapptest/blob/master/src/os.cc#L158
    
    Link: https://lkml.kernel.org/r/20201204024347.8295-1-miles.chen@mediatek.com
    Signed-off-by: Miles Chen <miles.chen at mediatek.com>
    Reviewed-by: Vincenzo Frascino <vincenzo.frascino at arm.com>
    Reviewed-by: Catalin Marinas <catalin.marinas at arm.com>
    Cc: Alexey Dobriyan <adobriyan at gmail.com>
    Cc: Andrey Konovalov <andreyknvl at google.com>
    Cc: Alexander Potapenko <glider at google.com>
    Cc: Vincenzo Frascino <vincenzo.frascino at arm.com>
    Cc: Andrey Ryabinin <aryabinin at virtuozzo.com>
    Cc: Catalin Marinas <catalin.marinas at arm.com>
    Cc: Dmitry Vyukov <dvyukov at google.com>
    Cc: Marco Elver <elver at google.com>
    Cc: Will Deacon <will at kernel.org>
    Cc: Eric W. Biederman <ebiederm at xmission.com>
    Cc: Song Bao Hua (Barry Song) <song.bao.hua at hisilicon.com>
    Cc: <stable at vger.kernel.org>    [5.4-]
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 217aa2705d5d..ee5a235b3056 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1599,11 +1599,15 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 
 	src = *ppos;
 	svpfn = src / PM_ENTRY_BYTES;
-	start_vaddr = svpfn << PAGE_SHIFT;
 	end_vaddr = mm->task_size;
 
 	/* watch out for wraparound */
-	if (svpfn > mm->task_size >> PAGE_SHIFT)
+	start_vaddr = end_vaddr;
+	if (svpfn <= (ULONG_MAX >> PAGE_SHIFT))
+		start_vaddr = untagged_addr(svpfn << PAGE_SHIFT);
+
+	/* Ensure the address is inside the task */
+	if (start_vaddr > mm->task_size)
 		start_vaddr = end_vaddr;
 
 	/*
commit 16c0cc0ce3059e315a0aab6538061d95a6612589
Author: Andrew Morton <akpm at linux-foundation.org>
Date:   Fri Dec 11 13:36:27 2020 -0800

    revert "mm/filemap: add static for function __add_to_page_cache_locked"
    
    Revert commit 3351b16af494 ("mm/filemap: add static for function
    __add_to_page_cache_locked") due to incompatibility with
    ALLOW_ERROR_INJECTION which result in build errors.
    
    Link: https://lkml.kernel.org/r/CAADnVQJ6tmzBXvtroBuEH6QA0H+q7yaSKxrVvVxhqr3KBZdEXg@mail.gmail.com
    Tested-by: Justin Forbes <jmforbes at linuxtx.org>
    Tested-by: Greg Thelen <gthelen at google.com>
    Acked-by: Alexei Starovoitov <ast at kernel.org>
    Cc: Michal Kubecek <mkubecek at suse.cz>
    Cc: Alex Shi <alex.shi at linux.alibaba.com>
    Cc: Souptick Joarder <jrdr.linux at gmail.com>
    Cc: Daniel Borkmann <daniel at iogearbox.net>
    Cc: Josef Bacik <josef at toxicpanda.com>
    Cc: Tony Luck <tony.luck at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/filemap.c b/mm/filemap.c
index 331f4261d723..0b2067b3c328 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -827,7 +827,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL_GPL(replace_page_cache_page);
 
-static noinline int __add_to_page_cache_locked(struct page *page,
+noinline int __add_to_page_cache_locked(struct page *page,
 					struct address_space *mapping,
 					pgoff_t offset, gfp_t gfp,
 					void **shadowp)
commit 82e06090473289ce63e23fdeb8737aad59b10645
Author: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date:   Wed Dec 9 20:13:24 2020 -0800

    Input: cm109 - do not stomp on control URB
    
    We need to make sure we are not stomping on the control URB that was
    issued when opening the device when attempting to toggle buzzer.
    To do that we need to mark it as pending in cm109_open().
    
    Reported-and-tested-by: syzbot+150f793ac5bc18eee150 at syzkaller.appspotmail.com
    Cc: stable at vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index e413801f0491..f515fae465c3 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -568,12 +568,15 @@ static int cm109_input_open(struct input_dev *idev)
 	dev->ctl_data->byte[HID_OR2] = dev->keybit;
 	dev->ctl_data->byte[HID_OR3] = 0x00;
 
+	dev->ctl_urb_pending = 1;
 	error = usb_submit_urb(dev->urb_ctl, GFP_KERNEL);
-	if (error)
+	if (error) {
+		dev->ctl_urb_pending = 0;
 		dev_err(&dev->intf->dev, "%s: usb_submit_urb (urb_ctl) failed %d\n",
 			__func__, error);
-	else
+	} else {
 		dev->open = 1;
+	}
 
 	mutex_unlock(&dev->pm_mutex);
 
commit 33d974e76e21e9da8a36b14d2dce6394c36c3e30
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:40 2020 +0100

    mtd: rawnand: xway: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: d525914b5bd8 ("mtd: rawnand: xway: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-10-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/xway_nand.c b/drivers/mtd/nand/raw/xway_nand.c
index efc5bf5434e0..26751976e502 100644
--- a/drivers/mtd/nand/raw/xway_nand.c
+++ b/drivers/mtd/nand/raw/xway_nand.c
@@ -149,7 +149,9 @@ static void xway_write_buf(struct nand_chip *chip, const u_char *buf, int len)
 static int xway_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit cf75f00fc8026040f6ff8f054cfec99e820b62e7
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:39 2020 +0100

    mtd: rawnand: socrates: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: b36bf0a0fe5d ("mtd: rawnand: socrates: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-9-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/socrates_nand.c b/drivers/mtd/nand/raw/socrates_nand.c
index 107208311987..70f8305c9b6e 100644
--- a/drivers/mtd/nand/raw/socrates_nand.c
+++ b/drivers/mtd/nand/raw/socrates_nand.c
@@ -120,7 +120,9 @@ static int socrates_nand_device_ready(struct nand_chip *nand_chip)
 static int socrates_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit 148b4f16159f49c6d05da8189e0941880ad10a46
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:38 2020 +0100

    mtd: rawnand: plat_nand: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: 612e048e6aab ("mtd: rawnand: plat_nand: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-8-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/plat_nand.c b/drivers/mtd/nand/raw/plat_nand.c
index 93d9f1694dc1..7711e1020c21 100644
--- a/drivers/mtd/nand/raw/plat_nand.c
+++ b/drivers/mtd/nand/raw/plat_nand.c
@@ -22,7 +22,9 @@ struct plat_nand_data {
 static int plat_nand_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit 9506ab943db438d316386d45eb8a8b60bfeee27c
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:37 2020 +0100

    mtd: rawnand: pasemi: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: 8fc6f1f042b2 ("mtd: rawnand: pasemi: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-7-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/pasemi_nand.c b/drivers/mtd/nand/raw/pasemi_nand.c
index 4dfff34800f4..68c08772d7c2 100644
--- a/drivers/mtd/nand/raw/pasemi_nand.c
+++ b/drivers/mtd/nand/raw/pasemi_nand.c
@@ -77,7 +77,9 @@ static int pasemi_device_ready(struct nand_chip *chip)
 static int pasemi_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit f87b720a21641d5c5ccd4f5ccc06d96251b7f282
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:36 2020 +0100

    mtd: rawnand: orion: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Reported-by: Chris Packham <chris.packham at alliedtelesis.co.nz>
    Fixes: 553508cec2e8 ("mtd: rawnand: orion: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Tested-by: Chris Packham <chris.packham at alliedtelesis.co.nz>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-6-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/orion_nand.c b/drivers/mtd/nand/raw/orion_nand.c
index e3bb65fd3ab2..66211c9311d2 100644
--- a/drivers/mtd/nand/raw/orion_nand.c
+++ b/drivers/mtd/nand/raw/orion_nand.c
@@ -86,7 +86,9 @@ static void orion_nand_read_buf(struct nand_chip *chip, uint8_t *buf, int len)
 static int orion_nand_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit f49bde9fe25cf4cd02440a7ec68f278957ddea37
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:35 2020 +0100

    mtd: rawnand: mpc5121: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: 6dd09f775b72 ("mtd: rawnand: mpc5121: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-5-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/mpc5121_nfc.c b/drivers/mtd/nand/raw/mpc5121_nfc.c
index fb4c0b11689f..bcd4a556c959 100644
--- a/drivers/mtd/nand/raw/mpc5121_nfc.c
+++ b/drivers/mtd/nand/raw/mpc5121_nfc.c
@@ -606,7 +606,9 @@ static void mpc5121_nfc_free(struct device *dev, struct mtd_info *mtd)
 static int mpc5121_nfc_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit bd47fa451315684424d2b39aa95f2ed235fee37a
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:34 2020 +0100

    mtd: rawnand: gpio: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: f6341f6448e0 ("mtd: rawnand: gpio: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-4-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/gpio.c b/drivers/mtd/nand/raw/gpio.c
index eb03b8cea1cb..fb7a086de35e 100644
--- a/drivers/mtd/nand/raw/gpio.c
+++ b/drivers/mtd/nand/raw/gpio.c
@@ -164,7 +164,9 @@ static int gpio_nand_exec_op(struct nand_chip *chip,
 static int gpio_nand_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit 52277269c4060ced7e7d1a83c77377590d106f44
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:33 2020 +0100

    mtd: rawnand: au1550: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: dbffc8ccdf3a ("mtd: rawnand: au1550: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-3-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/au1550nd.c b/drivers/mtd/nand/raw/au1550nd.c
index 7892022bd6dd..7b6b354f2d39 100644
--- a/drivers/mtd/nand/raw/au1550nd.c
+++ b/drivers/mtd/nand/raw/au1550nd.c
@@ -239,7 +239,9 @@ static int au1550nd_exec_op(struct nand_chip *this,
 static int au1550nd_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit 249a9599c9123a4af655dd5800c2506602ffa055
Author: Miquel Raynal <miquel.raynal at bootlin.com>
Date:   Thu Dec 3 20:03:32 2020 +0100

    mtd: rawnand: ams-delta: Do not force a particular software ECC engine
    
    Originally, commit d7157ff49a5b ("mtd: rawnand: Use the ECC framework
    user input parsing bits") kind of broke the logic around the
    initialization of several ECC engines.
    
    Unfortunately, the fix (which indeed moved the ECC initialization to
    the right place) did not take into account the fact that a different
    ECC algorithm could have been used thanks to a DT property,
    considering the "Hamming" algorithm entry a configuration while it was
    only a default.
    
    Add the necessary logic to be sure Hamming keeps being only a default.
    
    Fixes: 59d93473323a ("mtd: rawnand: ams-delta: Move the ECC initialization to ->attach_chip()")
    Signed-off-by: Miquel Raynal <miquel.raynal at bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20201203190340.15522-2-miquel.raynal@bootlin.com

diff --git a/drivers/mtd/nand/raw/ams-delta.c b/drivers/mtd/nand/raw/ams-delta.c
index 0c352b39ad4b..ff1697f899ba 100644
--- a/drivers/mtd/nand/raw/ams-delta.c
+++ b/drivers/mtd/nand/raw/ams-delta.c
@@ -218,7 +218,9 @@ static int gpio_nand_setup_interface(struct nand_chip *this, int csline,
 static int gpio_nand_attach_chip(struct nand_chip *chip)
 {
 	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-	chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
+
+	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
 }
commit 94801e5c6d461045726e1563ba2369ef7ce21dbf
Merge: 6d47cdecaa45 e8873c0afd34
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 10:25:04 2020 -0800

    Merge tag 'pinctrl-v5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
    
    Pull pin control fixes from Linus Walleij:
     "Here is a late set of pin control fixes for v5.10, most concern some
      minor and major issues found in the Intel drivers. Some are so hairy
      that I have no idea what is going on there, but luckily the maintainer
      knows what's up.
    
      We also have an interesting fix for AMD, which makes AMD-based laptops
      more stable IIUC.
    
      Summary:
    
       - Fix up some SPI group and a register offset on Intel Jasperlake
    
       - Set default bias on Intel Merrifield
    
       - Preserve debouncing on Intel Baytrail
    
       - Stop .set_type() irqchip callback in the AMD driver from fiddling
         with the debounce filter
    
       - Fix access to GPIO banks that are pass-thru on the Aspeed
    
       - Fix a fix for the Intel pin control driver to disable Rx/Tx when
         requesting a UART line as GPIO"
    
    * tag 'pinctrl-v5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
      pinctrl: intel: Actually disable Tx and Rx buffers on GPIO request
      pinctrl: aspeed: Fix GPIO requests on pass-through banks
      pinctrl: amd: remove debounce filter setting in IRQ type setting
      pinctrl: baytrail: Avoid clearing debounce value when turning it off
      pinctrl: merrifield: Set default bias in case no particular value given
      pinctrl: jasperlake: Fix HOSTSW_OWN offset
      pinctrl: jasperlake: Unhide SPI group of pins

commit 6d47cdecaa45c88ba3858323aa54ec9aa1de1a9b
Merge: c1cea11227cb 263ade7166a2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 10:22:17 2020 -0800

    Merge tag 'v5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
    
    Pull GPIO fixes from Linus Walleij:
     "These are hopefully the last GPIO fixes for this cycle.
    
      All are driver fixes except a small resource leak for pin ranges in
      the gpiolib. Two are PM related, which is nice because when developers
      start to find PM bugs it is usually because they have smoked out the
      bugs of more severe nature.
    
      Summary:
    
       - Fix runtime PM balancing on the errorpath of the Arizona driver
    
       - Fix a suspend NULL pointer reference in the dwapb driver
    
       - Balance free:ing in gpiochip_generic_free()
    
       - Fix runtime PM balancing on the errorpath of the zynq driver
    
       - Fix irqdomain use-after-free in the mvebu driver
    
       - Break an eternal loop in the spreadtrum EIC driver"
    
    * tag 'v5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
      gpio: eic-sprd: break loop when getting NULL device resource
      gpio: mvebu: fix potential user-after-free on probe
      gpio: zynq: fix reference leak in zynq_gpio functions
      gpiolib: Don't free if pin ranges are not defined
      gpio: dwapb: fix NULL pointer dereference at dwapb_gpio_suspend()
      gpio: arizona: disable pm_runtime in case of failure

commit c1cea11227cb57f1ab0f111b3f6e8a250b85cfdb
Merge: 059fe8296e0f ceabbf94c317
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Dec 11 10:10:13 2020 -0800

    Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
    
    Pull clk fixes from Stephen Boyd:
     "Two small clk driver build fixes
    
       - Remove __packed from a Renesas struct to improve portability
    
       - Fix a linking problem with i.MX when config options don't agree"
    
    * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
      clk: renesas: r9a06g032: Drop __packed for portability
      clk: imx: scu: fix MXC_CLK_SCU module build break

commit 4da3a54f5a025846f9930354cfb80f075b9952e0
Author: Andrea Parri (Microsoft) <parri.andrea at gmail.com>
Date:   Fri Dec 11 14:14:04 2020 +0100

    Revert "scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()"
    
    This reverts commit 3b8c72d076c42bf27284cda7b2b2b522810686f8.
    
    Dexuan reported a regression where StorVSC fails to probe a device (and
    where, consequently, the VM may fail to boot).  The root-cause analysis led
    to a long-standing race condition that is exposed by the validation /commit
    in question.  Let's put the new validation aside until a proper solution
    for that race condition is in place.
    
    Link: https://lore.kernel.org/r/20201211131404.21359-1-parri.andrea@gmail.com
    Fixes: 3b8c72d076c4 ("scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback()")
    Cc: Dexuan Cui <decui at microsoft.com>
    Cc: "James E.J. Bottomley" <jejb at linux.ibm.com>
    Cc: "Martin K. Petersen" <martin.petersen at oracle.com>
    Cc: linux-scsi at vger.kernel.org
    Signed-off-by: Andrea Parri (Microsoft) <parri.andrea at gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>

diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 99c8ff81de74..ded00a89bfc4 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1246,11 +1246,6 @@ static void storvsc_on_channel_callback(void *context)
 		request = (struct storvsc_cmd_request *)
 			((unsigned long)desc->trans_id);
 
-		if (hv_pkt_datalen(desc) < sizeof(struct vstor_packet) - vmscsi_size_delta) {
-			dev_err(&device->device, "Invalid packet len\n");
-			continue;
-		}
-
 		if (request == &stor_device->init_request ||
 		    request == &stor_device->reset_request) {
 			memcpy(&request->vstor_packet, packet,
commit 059fe8296e0fb4b89d997ea0aa75996911b8f3aa
Merge: 33dc9614dc20 b1f195fc4981
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 17:52:13 2020 -0800

    Merge tag 'drm-fixes-2020-12-11' of git://anongit.freedesktop.org/drm/drm
    
    Pull drm fixes from Dave Airlie:
     "Last week of fixes, just amdgpu and i915 collections. We had a i915
      regression reported by HJ Lu reported this morning, and this contains
      a fix for that he has tested.
    
      There are a fair few other fixes, but they are spread across the two
      drivers, and all fairly self contained.
    
      amdgpu:
       - Fan fix for CI asics
       - Fix a warning in possible_crtcs
       - Build fix for when debugfs is disabled
       - Display overflow fix
       - Display watermark fixes for Renoir
       - SDMA 5.2 fix
       - Stolen vga memory regression fix
       - Power profile fixes
       - Fix a regression from removal of GEM and PRIME callbacks
    
      amdkfd:
       - Fix a memory leak in dmabuf import
    
      i915:
       - rc7 regression fix for modesetting
       - vdsc/dp slice fixes
       - gen9 mocs entries fix
       - preemption timeout fix
       - unsigned compare against 0 fix
       - selftest fix
       - submission error propogatig fix
       - request flow suspend fix"
    
    * tag 'drm-fixes-2020-12-11' of git://anongit.freedesktop.org/drm/drm:
      drm/i915/display: Go softly softly on initial modeset failure
      drm/amd/pm: typo fix (CUSTOM -> COMPUTE)
      drm/amdgpu: Initialise drm_gem_object_funcs for imported BOs
      drm/amdgpu: fix size calculation with stolen vga memory
      drm/amd/pm: update smu10.h WORKLOAD_PPLIB setting for raven
      drm/amdkfd: Fix leak in dmabuf import
      drm/amdgpu: fix sdma instance fw version and feature version init
      drm/amd/display: Add wm table for Renoir
      drm/amd/display: Prevent bandwidth overflow
      drm/amdgpu: fix debugfs creation/removal, again
      drm/amdgpu/disply: set num_crtc earlier
      drm/amdgpu/powerplay: parse fan table for CI asics
      drm/i915/gt: Declare gen9 has 64 mocs entries!
      drm/i915/display/dp: Compute the correct slice count for VDSC on DP
      drm/i915: fix size_t greater or equal to zero comparison
      drm/i915/gt: Cancel the preemption timeout on responding to it
      drm/i915/gt: Ignore repeated attempts to suspend request flow across reset
      drm/i915/gem: Propagate error from cancelled submit due to context closure
      drm/i915/gem: Check the correct variable in selftest

commit ccbbfd1cbf365b38d014351d1482fedd26282041
Author: Palmer Dabbelt <palmerdabbelt at google.com>
Date:   Wed Nov 25 11:57:03 2020 -0800

    RISC-V: Define get_cycles64() regardless of M-mode
    
    The timer driver uses get_cycles64() unconditionally to obtain the current
    time.  A recent refactoring lost the common definition for some configs, which
    is now the only one we need.
    
    Fixes: d5be89a8d118 ("RISC-V: Resurrect the MMIO timer implementation for M-mode systems")
    Reported-by: kernel test robot <lkp at intel.com>
    Signed-off-by: Palmer Dabbelt <palmerdabbelt at google.com>

diff --git a/arch/riscv/include/asm/timex.h b/arch/riscv/include/asm/timex.h
index ab104905d4db..81de51e6aa32 100644
--- a/arch/riscv/include/asm/timex.h
+++ b/arch/riscv/include/asm/timex.h
@@ -60,6 +60,8 @@ static inline u32 get_cycles_hi(void)
 }
 #define get_cycles_hi get_cycles_hi
 
+#endif /* !CONFIG_RISCV_M_MODE */
+
 #ifdef CONFIG_64BIT
 static inline u64 get_cycles64(void)
 {
@@ -79,8 +81,6 @@ static inline u64 get_cycles64(void)
 }
 #endif /* CONFIG_64BIT */
 
-#endif /* !CONFIG_RISCV_M_MODE */
-
 #define ARCH_HAS_READ_CURRENT_TIMER
 static inline int read_current_timer(unsigned long *timer_val)
 {
commit 33dc9614dc208291d0c4bcdeb5d30d481dcd2c4c
Merge: 47003b9971cc 271e0c9dce1b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 16:51:27 2020 -0800

    Merge tag 'ktest-v5.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest
    
    Pull ktest fix from Steven Rostedt:
     "Fix issues with grub2bls in ktest.pl
    
      ktest.pl did not know about grub2bls that was introduced in Fedora 30,
      and now it does"
    
    * tag 'ktest-v5.10-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest:
      ktest.pl: Fix incorrect reboot for grub2bls

commit 47003b9971cc7c38737f21e07034502ca35ab7af
Merge: 197c61cb176a 5eedf9fe8db2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 16:36:30 2020 -0800

    Merge tag 'powerpc-5.10-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
    
    Pull powerpc fix from Michael Ellerman:
     "One commit to implement copy_from_kernel_nofault_allowed(), otherwise
      copy_from_kernel_nofault() can trigger warnings when accessing bad
      addresses in some configurations.
    
      Thanks to Christophe Leroy and Qian Cai"
    
    * tag 'powerpc-5.10-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
      powerpc/mm: Fix KUAP warning by providing copy_from_kernel_nofault_allowed()

commit 197c61cb176a40f5877c3caf8249722e77b7d989
Merge: 6840a3dcc244 ed9b25d1970a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 16:01:47 2020 -0800

    Merge tag 'fixes-v5.10a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
    
    Pull namespaced fscaps fix from James Morris:
     "Fix namespaced fscaps when !CONFIG_SECURITY (Serge Hallyn)"
    
    * tag 'fixes-v5.10a' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
      [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY

commit b1f195fc49812359296a901e26cc7c0b761d8a70
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Dec 10 23:07:41 2020 +0000

    drm/i915/display: Go softly softly on initial modeset failure
    
    Reduce the module/device probe error into a mere debug to hide issues
    where the initial modeset is failing (after lies told by hw probe) and
    the system hangs with a livelock in cleaning up the failed commit.
    
    Reported-by: H.J. Lu <hjl.tools at gmail.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=210619
    Fixes: b3bf99daaee9 ("drm/i915/display: Defer initial modeset until after GGTT is initialised")
    Fixes: ccc9e67ab26f ("drm/i915/display: Defer initial modeset until after GGTT is initialised")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: "Ville Syrjälä" <ville.syrjala at linux.intel.com>
    Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
    Cc: H.J. Lu <hjl.tools at gmail.com>
    Cc: Dave Airlie <airlied at redhat.com>
    Reviewed-by: Rodrigo Vivi <rodrigo.vivi at intel.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201210230741.17140-1-chris@chris-wilson.co.uk

diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 3bfe6ed67da1..aabf09f89cad 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -18040,7 +18040,7 @@ int intel_modeset_init(struct drm_i915_private *i915)
 	 */
 	ret = intel_initial_commit(&i915->drm);
 	if (ret)
-		return ret;
+		drm_dbg_kms(&i915->drm, "Initial modeset failed, %d\n", ret);
 
 	intel_overlay_setup(i915);
 
commit de2df164e3f905ddcf978358cb6e69958b5d3bcc
Merge: a81ac2995a49 7c5c15dffe1e
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Dec 11 09:47:38 2020 +1000

    Merge tag 'drm-intel-fixes-2020-12-09' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
    
    Fixes for VDSC/DP, selftests, shmem_utils, preemption, submission, and gt reset:
    
    - Check the correct variable in selftest (Dan)
    - Propagate error from canceled submit due to context closure (Chris)
    - Ignore repeated attempts to suspend request flow across reset (Chris)
    - Cancel the preemption timeout on responding to it (Chris)
    - Fix unsigned compared against 0 (Colin)
    - Compute the correct slice count for VDSC on DP (Manasi)
    - Declar gen9 has 64 mocs entries (Chris)
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    
    From: Rodrigo Vivi <rodrigo.vivi at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201209235010.GA10554@intel.com

commit a81ac2995a49e3474037847e3362f5ac58dc0269
Merge: 0477e9288185 c5b58c8c860d
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Dec 11 09:42:14 2020 +1000

    Merge tag 'amd-drm-fixes-5.10-2020-12-09' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
    
    amd-drm-fixes-5.10-2020-12-09:
    
    amdgpu:
    - Fan fix for CI asics
    - Fix a warning in possible_crtcs
    - Build fix for when debugfs is disabled
    - Display overflow fix
    - Display watermark fixes for Renoir
    - SDMA 5.2 fix
    - Stolen vga memory regression fix
    - Power profile fixes
    - Fix a regression from removal of GEM and PRIME callbacks
    
    amdkfd:
    - Fix a memory leak in dmabuf import
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    From: Alex Deucher <alexdeucher at gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201210034848.18108-1-alexander.deucher@amd.com

commit 6840a3dcc2447188e7bb8464b31a7620bc4423ee
Merge: 4d31058b823c 21e31401fc45
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 15:36:09 2020 -0800

    Merge tag 'nfs-for-5.10-3' of git://git.linux-nfs.org/projects/anna/linux-nfs
    
    Pull NFS client fixes from Anna Schumaker:
     "Here are a handful more bugfixes for 5.10.
    
      Unfortunately, we found some problems with the new READ_PLUS operation
      that aren't easy to fix. We've decided to disable this codepath
      through a Kconfig option for now, but a series of patches going into
      5.11 will clean up the code and fix the issues at the same time. This
      seemed like the best way to go about it.
    
      Summary:
    
       - Fix array overflow when flexfiles mirroring is enabled
    
       - Fix rpcrdma_inline_fixup() crash with new LISTXATTRS
    
       - Fix 5 second delay when doing inter-server copy
    
       - Disable READ_PLUS by default"
    
    * tag 'nfs-for-5.10-3' of git://git.linux-nfs.org/projects/anna/linux-nfs:
      NFS: Disable READ_PLUS by default
      NFSv4.2: Fix 5 seconds delay when doing inter server copy
      NFS: Fix rpcrdma_inline_fixup() crash with new LISTXATTRS operation
      pNFS/flexfiles: Fix array overflow when flexfiles mirroring is enabled

commit 4d31058b823cb338f5218043ac09fb7795b9d908
Merge: 9fca90cf2892 d9838b1d3928
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 15:30:13 2020 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
    
    Pull networking fixes from David Miller:
    
     1) IPsec compat fixes, from Dmitry Safonov.
    
     2) Fix memory leak in xfrm_user_policy(). Fix from Yu Kuai.
    
     3) Fix polling in xsk sockets by using sk_poll_wait() instead of
        datagram_poll() which keys off of sk_wmem_alloc and such which xsk
        sockets do not update. From Xuan Zhuo.
    
     4) Missing init of rekey_data in cfgh80211, from Sara Sharon.
    
     5) Fix destroy of timer before init, from Davide Caratti.
    
     6) Missing CRYPTO_CRC32 selects in ethernet driver Kconfigs, from Arnd
        Bergmann.
    
     7) Missing error return in rtm_to_fib_config() switch case, from Zhang
        Changzhong.
    
     8) Fix some src/dest address handling in vrf and add a testcase. From
        Stephen Suryaputra.
    
     9) Fix multicast handling in Seville switches driven by mscc-ocelot
        driver. From Vladimir Oltean.
    
    10) Fix proto value passed to skb delivery demux in udp, from Xin Long.
    
    11) HW pkt counters not reported correctly in enetc driver, from Claudiu
        Manoil.
    
    12) Fix deadlock in bridge, from Joseph Huang.
    
    13) Missing of_node_pur() in dpaa2 driver, fromn Christophe JAILLET.
    
    14) Fix pid fetching in bpftool when there are a lot of results, from
        Andrii Nakryiko.
    
    15) Fix long timeouts in nft_dynset, from Pablo Neira Ayuso.
    
    16) Various stymmac fixes, from Fugang Duan.
    
    17) Fix null deref in tipc, from Cengiz Can.
    
    18) When mss is biog, coose more resonable rcvq_space in tcp, fromn Eric
        Dumazet.
    
    19) Revert a geneve change that likely isnt necessary, from Jakub
        Kicinski.
    
    20) Avoid premature rx buffer reuse in various Intel driversm from Björn
        Töpel.
    
    21) retain EcT bits during TIS reflection in tcp, from Wei Wang.
    
    22) Fix Tso deferral wrt. cwnd limiting in tcp, from Neal Cardwell.
    
    23) MPLS_OPT_LSE_LABEL attribute is 342 ot 8 bits, from Guillaume Nault
    
    24) Fix propagation of 32-bit signed bounds in bpf verifier and add test
        cases, from Alexei Starovoitov.
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (81 commits)
      selftests: fix poll error in udpgro.sh
      selftests/bpf: Fix "dubious pointer arithmetic" test
      selftests/bpf: Fix array access with signed variable test
      selftests/bpf: Add test for signed 32-bit bound check bug
      bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds.
      MAINTAINERS: Add entry for Marvell Prestera Ethernet Switch driver
      net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower
      net/mlx4_en: Handle TX error CQE
      net/mlx4_en: Avoid scheduling restart task if it is already running
      tcp: fix cwnd-limited bug for TSO deferral where we send nothing
      net: flow_offload: Fix memory leak for indirect flow block
      tcp: Retain ECT bits for tos reflection
      ethtool: fix stack overflow in ethnl_parse_bitset()
      e1000e: fix S0ix flow to allow S0i3.2 subset entry
      ice: avoid premature Rx buffer reuse
      ixgbe: avoid premature Rx buffer reuse
      i40e: avoid premature Rx buffer reuse
      igb: avoid transmit queue timeout in xdp path
      igb: use xdp_do_flush
      igb: skb add metasize for xdp
      ...

commit d9838b1d39283c1200c13f9076474c7624b8ec34
Merge: 38bf8cd821be 3615bdf6d9b1
Author: David S. Miller <davem at davemloft.net>
Date:   Thu Dec 10 14:29:30 2020 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
    
    Alexei Starovoitov says:
    
    ====================
    pull-request: bpf 2020-12-10
    
    The following pull-request contains BPF updates for your *net* tree.
    
    We've added 21 non-merge commits during the last 12 day(s) which contain
    a total of 21 files changed, 163 insertions(+), 88 deletions(-).
    
    The main changes are:
    
    1) Fix propagation of 32-bit signed bounds from 64-bit bounds, from Alexei.
    
    2) Fix ring_buffer__poll() return value, from Andrii.
    
    3) Fix race in lwt_bpf, from Cong.
    
    4) Fix test_offload, from Toke.
    
    5) Various xsk fixes.
    
    Please consider pulling these changes from:
    
      git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
    
    Thanks a lot!
    
    Also thanks to reporters, reviewers and testers of commits in this pull-request:
    
    Cong Wang, Hulk Robot, Jakub Kicinski, Jean-Philippe Brucker, John
    Fastabend, Magnus Karlsson, Maxim Mikityanskiy, Yonghong Song
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 190113b4c6531c8e09b31d5235f9b5175cbb0f72
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Thu Dec 10 21:18:22 2020 +0100

    x86/apic/vector: Fix ordering in vector assignment
    
    Prarit reported that depending on the affinity setting the
    
     ' irq $N: Affinity broken due to vector space exhaustion.'
    
    message is showing up in dmesg, but the vector space on the CPUs in the
    affinity mask is definitely not exhausted.
    
    Shung-Hsi provided traces and analysis which pinpoints the problem:
    
    The ordering of trying to assign an interrupt vector in
    assign_irq_vector_any_locked() is simply wrong if the interrupt data has a
    valid node assigned. It does:
    
     1) Try the intersection of affinity mask and node mask
     2) Try the node mask
     3) Try the full affinity mask
     4) Try the full online mask
    
    Obviously #2 and #3 are in the wrong order as the requested affinity
    mask has to take precedence.
    
    In the observed cases #1 failed because the affinity mask did not contain
    CPUs from node 0. That made it allocate a vector from node 0, thereby
    breaking affinity and emitting the misleading message.
    
    Revert the order of #2 and #3 so the full affinity mask without the node
    intersection is tried before actually affinity is broken.
    
    If no node is assigned then only the full affinity mask and if that fails
    the full online mask is tried.
    
    Fixes: d6ffc6ac83b1 ("x86/vector: Respect affinity mask in irq descriptor")
    Reported-by: Prarit Bhargava <prarit at redhat.com>
    Reported-by: Shung-Hsi Yu <shung-hsi.yu at suse.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Tested-by: Shung-Hsi Yu <shung-hsi.yu at suse.com>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/87ft4djtyp.fsf@nanos.tec.linutronix.de

diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 1eac53632786..758bbf25ef74 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -273,20 +273,24 @@ static int assign_irq_vector_any_locked(struct irq_data *irqd)
 	const struct cpumask *affmsk = irq_data_get_affinity_mask(irqd);
 	int node = irq_data_get_node(irqd);
 
-	if (node == NUMA_NO_NODE)
-		goto all;
-	/* Try the intersection of @affmsk and node mask */
-	cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
-	if (!assign_vector_locked(irqd, vector_searchmask))
-		return 0;
-	/* Try the node mask */
-	if (!assign_vector_locked(irqd, cpumask_of_node(node)))
-		return 0;
-all:
+	if (node != NUMA_NO_NODE) {
+		/* Try the intersection of @affmsk and node mask */
+		cpumask_and(vector_searchmask, cpumask_of_node(node), affmsk);
+		if (!assign_vector_locked(irqd, vector_searchmask))
+			return 0;
+	}
+
 	/* Try the full affinity mask */
 	cpumask_and(vector_searchmask, affmsk, cpu_online_mask);
 	if (!assign_vector_locked(irqd, vector_searchmask))
 		return 0;
+
+	if (node != NUMA_NO_NODE) {
+		/* Try the node mask */
+		if (!assign_vector_locked(irqd, cpumask_of_node(node)))
+			return 0;
+	}
+
 	/* Try the full online mask */
 	return assign_vector_locked(irqd, cpu_online_mask);
 }
commit 21e31401fc4595aeefa224cd36ab8175ec867b87
Author: Anna Schumaker <Anna.Schumaker at Netapp.com>
Date:   Thu Dec 3 15:18:39 2020 -0500

    NFS: Disable READ_PLUS by default
    
    We've been seeing failures with xfstests generic/091 and generic/263
    when using READ_PLUS. I've made some progress on these issues, and the
    tests fail later on but still don't pass. Let's disable READ_PLUS by
    default until we can work out what is going on.
    
    Signed-off-by: Anna Schumaker <Anna.Schumaker at Netapp.com>

diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 88e1763e02f3..e2a488d403a6 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -205,3 +205,12 @@ config NFS_DISABLE_UDP_SUPPORT
 	 Choose Y here to disable the use of NFS over UDP. NFS over UDP
 	 on modern networks (1Gb+) can lead to data corruption caused by
 	 fragmentation during high loads.
+
+config NFS_V4_2_READ_PLUS
+	bool "NFS: Enable support for the NFSv4.2 READ_PLUS operation"
+	depends on NFS_V4_2
+	default n
+	help
+	 This is intended for developers only. The READ_PLUS operation has
+	 been shown to have issues under specific conditions and should not
+	 be used in production.
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9e0ca9b2b210..e89468678ae1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5309,7 +5309,7 @@ static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
 				    nfs4_read_done_cb(task, hdr);
 }
 
-#ifdef CONFIG_NFS_V4_2
+#if defined CONFIG_NFS_V4_2 && defined CONFIG_NFS_V4_2_READ_PLUS
 static void nfs42_read_plus_support(struct nfs_server *server, struct rpc_message *msg)
 {
 	if (server->caps & NFS_CAP_READ_PLUS)
commit fe8eb820e388ca81643443b6208001ab516d1cf6
Author: Dai Ngo <dai.ngo at oracle.com>
Date:   Mon Nov 23 22:15:17 2020 -0500

    NFSv4.2: Fix 5 seconds delay when doing inter server copy
    
    Since commit b4868b44c5628 ("NFSv4: Wait for stateid updates after
    CLOSE/OPEN_DOWNGRADE"), every inter server copy operation suffers 5
    seconds delay regardless of the size of the copy. The delay is from
    nfs_set_open_stateid_locked when the check by nfs_stateid_is_sequential
    fails because the seqid in both nfs4_state and nfs4_stateid are 0.
    
    Fix __nfs42_ssc_open to delay setting of NFS_OPEN_STATE in nfs4_state,
    until after the call to update_open_stateid, to indicate this is the 1st
    open. This fix is part of a 2 patches, the other patch is the fix in the
    source server to return the stateid for COPY_NOTIFY request with seqid 1
    instead of 0.
    
    Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
    Signed-off-by: Dai Ngo <dai.ngo at oracle.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker at Netapp.com>

diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
index 9d354de613da..57b3821d975a 100644
--- a/fs/nfs/nfs4file.c
+++ b/fs/nfs/nfs4file.c
@@ -377,10 +377,10 @@ static struct file *__nfs42_ssc_open(struct vfsmount *ss_mnt,
 		goto out_stateowner;
 
 	set_bit(NFS_SRV_SSC_COPY_STATE, &ctx->state->flags);
-	set_bit(NFS_OPEN_STATE, &ctx->state->flags);
 	memcpy(&ctx->state->open_stateid.other, &stateid->other,
 	       NFS4_STATEID_OTHER_SIZE);
 	update_open_stateid(ctx->state, stateid, NULL, filep->f_mode);
+	set_bit(NFS_OPEN_STATE, &ctx->state->flags);
 
 	nfs_file_set_open_context(filep, ctx);
 	put_nfs_open_context(ctx);
commit 1c87b85162975627d684a234d7347ef630f0e3aa
Author: Chuck Lever <chuck.lever at oracle.com>
Date:   Tue Nov 24 19:15:18 2020 -0500

    NFS: Fix rpcrdma_inline_fixup() crash with new LISTXATTRS operation
    
    By switching to an XFS-backed export, I am able to reproduce the
    ibcomp worker crash on my client with xfstests generic/013.
    
    For the failing LISTXATTRS operation, xdr_inline_pages() is called
    with page_len=12 and buflen=128.
    
    - When ->send_request() is called, rpcrdma_marshal_req() does not
      set up a Reply chunk because buflen is smaller than the inline
      threshold. Thus rpcrdma_convert_iovs() does not get invoked at
      all and the transport's XDRBUF_SPARSE_PAGES logic is not invoked
      on the receive buffer.
    
    - During reply processing, rpcrdma_inline_fixup() tries to copy
      received data into rq_rcv_buf->pages because page_len is positive.
      But there are no receive pages because rpcrdma_marshal_req() never
      allocated them.
    
    The result is that the ibcomp worker faults and dies. Sometimes that
    causes a visible crash, and sometimes it results in a transport hang
    without other symptoms.
    
    RPC/RDMA's XDRBUF_SPARSE_PAGES support is not entirely correct, and
    should eventually be fixed or replaced. However, my preference is
    that upper-layer operations should explicitly allocate their receive
    buffers (using GFP_KERNEL) when possible, rather than relying on
    XDRBUF_SPARSE_PAGES.
    
    Reported-by: Olga kornievskaia <kolga at netapp.com>
    Suggested-by: Olga kornievskaia <kolga at netapp.com>
    Fixes: c10a75145feb ("NFSv4.2: add the extended attribute proc functions.")
    Signed-off-by: Chuck Lever <chuck.lever at oracle.com>
    Reviewed-by: Olga kornievskaia <kolga at netapp.com>
    Reviewed-by: Frank van der Linden <fllinden at amazon.com>
    Tested-by: Olga kornievskaia <kolga at netapp.com>
    Signed-off-by: Anna Schumaker <Anna.Schumaker at Netapp.com>

diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 2b2211d1234e..4fc61e3d098d 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -1241,12 +1241,13 @@ static ssize_t _nfs42_proc_listxattrs(struct inode *inode, void *buf,
 		.rpc_resp	= &res,
 	};
 	u32 xdrlen;
-	int ret, np;
+	int ret, np, i;
 
 
+	ret = -ENOMEM;
 	res.scratch = alloc_page(GFP_KERNEL);
 	if (!res.scratch)
-		return -ENOMEM;
+		goto out;
 
 	xdrlen = nfs42_listxattr_xdrsize(buflen);
 	if (xdrlen > server->lxasize)
@@ -1254,9 +1255,12 @@ static ssize_t _nfs42_proc_listxattrs(struct inode *inode, void *buf,
 	np = xdrlen / PAGE_SIZE + 1;
 
 	pages = kcalloc(np, sizeof(struct page *), GFP_KERNEL);
-	if (pages == NULL) {
-		__free_page(res.scratch);
-		return -ENOMEM;
+	if (!pages)
+		goto out_free_scratch;
+	for (i = 0; i < np; i++) {
+		pages[i] = alloc_page(GFP_KERNEL);
+		if (!pages[i])
+			goto out_free_pages;
 	}
 
 	arg.xattr_pages = pages;
@@ -1271,14 +1275,15 @@ static ssize_t _nfs42_proc_listxattrs(struct inode *inode, void *buf,
 		*eofp = res.eof;
 	}
 
+out_free_pages:
 	while (--np >= 0) {
 		if (pages[np])
 			__free_page(pages[np]);
 	}
-
-	__free_page(res.scratch);
 	kfree(pages);
-
+out_free_scratch:
+	__free_page(res.scratch);
+out:
 	return ret;
 
 }
diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
index 6e060a88f98c..8432bd6b95f0 100644
--- a/fs/nfs/nfs42xdr.c
+++ b/fs/nfs/nfs42xdr.c
@@ -1528,7 +1528,6 @@ static void nfs4_xdr_enc_listxattrs(struct rpc_rqst *req,
 
 	rpc_prepare_reply_pages(req, args->xattr_pages, 0, args->count,
 	    hdr.replen);
-	req->rq_rcv_buf.flags |= XDRBUF_SPARSE_PAGES;
 
 	encode_nops(&hdr);
 }
commit a0f55287b50c3e4d2fae6e3a09d2c8ea81140897
Author: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
Date:   Tue Dec 1 18:33:33 2020 +0800

    drm/amd/pm: inform SMU RLC status thus enable/disable DPM feature for vangogh
    
    RLC is halted when system suspend/shutdown. However, due to DPM enabled, PMFW is
    unaware of RLC being halted and will continue sending messages, which would
    eventually cause an ACPI hang. Use the system_feature_control interface to
    notify SMU the status of RLC (Normal/OFF) thus enable/disable DPM feature.
    
    Signed-off-by: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
    Reviewed-by: Huang Rui <ray.huang at amd.com>
    Reviewed-by: Lazar Lijo <Lijo.Lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
index a81e5c823211..9bccf2ad038c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
@@ -64,7 +64,7 @@ static struct cmn2asic_msg_mapping vangogh_message_map[SMU_MSG_MAX_COUNT] = {
 	MSG_MAP(PowerUpIspByTile,               PPSMC_MSG_PowerUpIspByTile,		0),
 	MSG_MAP(PowerDownVcn,                   PPSMC_MSG_PowerDownVcn,			0),
 	MSG_MAP(PowerUpVcn,                     PPSMC_MSG_PowerUpVcn,			0),
-	MSG_MAP(Spare,                          PPSMC_MSG_spare,				0),
+	MSG_MAP(RlcPowerNotify,                 PPSMC_MSG_RlcPowerNotify,		0),
 	MSG_MAP(SetHardMinVcn,                  PPSMC_MSG_SetHardMinVcn,		0),
 	MSG_MAP(SetSoftMinGfxclk,               PPSMC_MSG_SetSoftMinGfxclk,		0),
 	MSG_MAP(ActiveProcessNotify,            PPSMC_MSG_ActiveProcessNotify,		0),
@@ -722,6 +722,12 @@ static int vangogh_set_fine_grain_gfx_freq_parameters(struct smu_context *smu)
 	return 0;
 }
 
+static int vangogh_system_features_control(struct smu_context *smu, bool en)
+{
+	return smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_RlcPowerNotify,
+					en ? RLC_STATUS_NORMAL : RLC_STATUS_OFF, NULL);
+}
+
 static const struct pptable_funcs vangogh_ppt_funcs = {
 
 	.check_fw_status = smu_v11_0_check_fw_status,
@@ -749,6 +755,7 @@ static const struct pptable_funcs vangogh_ppt_funcs = {
 	.print_clk_levels = vangogh_print_fine_grain_clk,
 	.set_default_dpm_table = vangogh_set_default_dpm_tables,
 	.set_fine_grain_gfx_freq_parameters = vangogh_set_fine_grain_gfx_freq_parameters,
+	.system_features_control = vangogh_system_features_control,
 };
 
 void vangogh_set_ppt_funcs(struct smu_context *smu)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.h b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.h
index 8756766296cd..eab455493076 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.h
@@ -32,4 +32,8 @@ extern void vangogh_set_ppt_funcs(struct smu_context *smu);
 #define VANGOGH_UMD_PSTATE_SOCCLK       678
 #define VANGOGH_UMD_PSTATE_FCLK         800
 
+/* RLC Power Status */
+#define RLC_STATUS_OFF          0
+#define RLC_STATUS_NORMAL       1
+
 #endif
commit fe96eb197e98efa32c129c4af3b44813c42bb93f
Author: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
Date:   Tue Dec 1 17:49:50 2020 +0800

    drm/amd/pm: update the smu v11.5 smc header for vangogh
    
    Add new PMFW message to notify RLC engine status.
    
    Signed-off-by: Xiaomeng Hou <Xiaomeng.Hou at amd.com>
    Reviewed-by: Huang Rui <ray.huang at amd.com>
    Reviewed-by: Lazar Lijo <Lijo.Lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/inc/smu_types.h b/drivers/gpu/drm/amd/pm/inc/smu_types.h
index 1787ae8a9fd9..720d15612fe1 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_types.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_types.h
@@ -178,7 +178,7 @@
 	__SMU_DUMMY_MAP(SET_DRIVER_DUMMY_TABLE_DRAM_ADDR_LOW), \
 	__SMU_DUMMY_MAP(GET_UMC_FW_WA), \
 	__SMU_DUMMY_MAP(Mode1Reset), \
-	__SMU_DUMMY_MAP(Spare),                          \
+	__SMU_DUMMY_MAP(RlcPowerNotify),                 \
 	__SMU_DUMMY_MAP(SetHardMinIspiclkByFreq),        \
 	__SMU_DUMMY_MAP(SetHardMinIspxclkByFreq),        \
 	__SMU_DUMMY_MAP(SetSoftMinSocclkByFreq),         \
diff --git a/drivers/gpu/drm/amd/pm/inc/smu_v11_5_ppsmc.h b/drivers/gpu/drm/amd/pm/inc/smu_v11_5_ppsmc.h
index 7e69b3bd311b..55d7892e4e0e 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_5_ppsmc.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_5_ppsmc.h
@@ -41,7 +41,7 @@
 #define PPSMC_MSG_PowerUpIspByTile                     0x7
 #define PPSMC_MSG_PowerDownVcn                         0x8 // VCN is power gated by default
 #define PPSMC_MSG_PowerUpVcn                           0x9
-#define PPSMC_MSG_spare                                0xA
+#define PPSMC_MSG_RlcPowerNotify                       0xA
 #define PPSMC_MSG_SetHardMinVcn                        0xB // For wireless display
 #define PPSMC_MSG_SetSoftMinGfxclk                     0xC //Sets SoftMin for GFXCLK. Arg is in MHz
 #define PPSMC_MSG_ActiveProcessNotify                  0xD
commit 7c431455cdd6add04f0d4a1a671095623d18622d
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Mon Nov 30 18:57:50 2020 -0500

    drm/amdgpu/display: move link_bandwidth_kbps under CONFIG_DRM_AMD_DC_DCN
    
    It's only used when CONFIG_DRM_AMD_DC_DCN is set.  Fixes and set but
    not used warning.
    
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 562d874f81fb..0a908cb8119c 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5120,9 +5120,8 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 	int preferred_refresh = 0;
 #if defined(CONFIG_DRM_AMD_DC_DCN)
 	struct dsc_dec_dpcd_caps dsc_caps;
-#endif
 	uint32_t link_bandwidth_kbps;
-
+#endif
 	struct dc_sink *sink = NULL;
 	if (aconnector == NULL) {
 		DRM_ERROR("aconnector is NULL!\n");
@@ -5204,11 +5203,9 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
 				      aconnector->dc_link->dpcd_caps.dsc_caps.dsc_basic_caps.raw,
 				      aconnector->dc_link->dpcd_caps.dsc_caps.dsc_branch_decoder_caps.raw,
 				      &dsc_caps);
-#endif
 		link_bandwidth_kbps = dc_link_bandwidth_kbps(aconnector->dc_link,
 							     dc_link_get_link_cap(aconnector->dc_link));
 
-#if defined(CONFIG_DRM_AMD_DC_DCN)
 		if (aconnector->dsc_settings.dsc_force_enable != DSC_CLK_FORCE_DISABLE && dsc_caps.is_dsc_supported) {
 			/* Set DSC policy according to dsc_clock_en */
 			dc_dsc_policy_set_enable_dsc_when_not_needed(
commit 4c4d5a49c6347e27e1c80fb4275f8ad160bcf4f3
Author: Evan Quan <evan.quan at amd.com>
Date:   Wed Dec 9 16:34:22 2020 +0800

    drm/amd/pm: typo fix (CUSTOM -> COMPUTE)
    
    The "COMPUTE" was wrongly spelled as "CUSTOM".
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 3163de39472a..b8127be43320 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -220,7 +220,7 @@ static struct cmn2asic_mapping sienna_cichlid_workload_map[PP_SMC_POWER_PROFILE_
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,		WORKLOAD_PPLIB_POWER_SAVING_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,		WORKLOAD_PPLIB_VIDEO_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,			WORKLOAD_PPLIB_VR_BIT),
-	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_CUSTOM_BIT),
+	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_COMPUTE_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,		WORKLOAD_PPLIB_CUSTOM_BIT),
 };
 
commit d7f52e2930015d6104ed6eb4c987d1b396dc548c
Author: Evan Quan <evan.quan at amd.com>
Date:   Wed Dec 9 11:43:22 2020 +0800

    drm/amd/pm: fulfill sienna cichlid 2nd usb2.0 port workaround
    
    Fulfill the 2nd usb2.0 port workaround for sienna cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index b1b038f24cce..3163de39472a 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -2693,6 +2693,44 @@ static int sienna_cichlid_gpo_control(struct smu_context *smu,
 
 	return ret;
 }
+
+static int sienna_cichlid_notify_2nd_usb20_port(struct smu_context *smu)
+{
+	uint32_t smu_version;
+	int ret = 0;
+
+	ret = smu_cmn_get_smc_version(smu, NULL, &smu_version);
+	if (ret)
+		return ret;
+
+	/*
+	 * Message SMU_MSG_Enable2ndUSB20Port is supported by 58.45
+	 * onwards PMFWs.
+	 */
+	if (smu_version < 0x003A2D00)
+		return 0;
+
+	return smu_cmn_send_smc_msg_with_param(smu,
+					       SMU_MSG_Enable2ndUSB20Port,
+					       smu->smu_table.boot_values.firmware_caps & ATOM_FIRMWARE_CAP_ENABLE_2ND_USB20PORT ?
+					       1 : 0,
+					       NULL);
+}
+
+static int sienna_cichlid_system_features_control(struct smu_context *smu,
+						  bool en)
+{
+	int ret = 0;
+
+	if (en) {
+		ret = sienna_cichlid_notify_2nd_usb20_port(smu);
+		if (ret)
+			return ret;
+	}
+
+	return smu_v11_0_system_features_control(smu, en);
+}
+
 static const struct pptable_funcs sienna_cichlid_ppt_funcs = {
 	.get_allowed_feature_mask = sienna_cichlid_get_allowed_feature_mask,
 	.set_default_dpm_table = sienna_cichlid_set_default_dpm_table,
@@ -2733,7 +2771,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = {
 	.set_driver_table_location = smu_v11_0_set_driver_table_location,
 	.set_tool_table_location = smu_v11_0_set_tool_table_location,
 	.notify_memory_pool_location = smu_v11_0_notify_memory_pool_location,
-	.system_features_control = smu_v11_0_system_features_control,
+	.system_features_control = sienna_cichlid_system_features_control,
 	.send_smc_msg_with_param = smu_cmn_send_smc_msg_with_param,
 	.send_smc_msg = smu_cmn_send_smc_msg,
 	.init_display_count = NULL,
commit 88dfd5d5c8cb973c141a674000d40573daea58a2
Author: Evan Quan <evan.quan at amd.com>
Date:   Tue Dec 8 13:07:24 2020 +0800

    drm/amd/pm: new SMC message for 2nd usb2.0 port workaround
    
    The workaround is needed by sienna cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/inc/smu_types.h b/drivers/gpu/drm/amd/pm/inc/smu_types.h
index 1251dd411516..1787ae8a9fd9 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_types.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_types.h
@@ -210,6 +210,7 @@
        __SMU_DUMMY_MAP(SetSoftMaxCclk),                     \
 	__SMU_DUMMY_MAP(SetGpoFeaturePMask),             \
 	__SMU_DUMMY_MAP(DisallowGpo),                    \
+	__SMU_DUMMY_MAP(Enable2ndUSB20Port),             \
 
 #undef __SMU_DUMMY_MAP
 #define __SMU_DUMMY_MAP(type)	SMU_MSG_##type
diff --git a/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h b/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
index dad2832ff3b1..d2e10a724560 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
@@ -136,6 +136,8 @@
 
 #define PPSMC_MSG_DisallowGpo                    0x56
 
+#define PPSMC_MSG_Enable2ndUSB20Port             0x57
+
 #define PPSMC_Message_Count                      0x58
 
 #endif
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index d88361554d94..b1b038f24cce 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -129,6 +129,7 @@ static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT]
 	MSG_MAP(SetMGpuFanBoostLimitRpm,	PPSMC_MSG_SetMGpuFanBoostLimitRpm,     0),
 	MSG_MAP(SetGpoFeaturePMask,		PPSMC_MSG_SetGpoFeaturePMask,          0),
 	MSG_MAP(DisallowGpo,			PPSMC_MSG_DisallowGpo,                 0),
+	MSG_MAP(Enable2ndUSB20Port,		PPSMC_MSG_Enable2ndUSB20Port,          0),
 };
 
 static struct cmn2asic_mapping sienna_cichlid_clk_map[SMU_CLK_COUNT] = {
commit ad26bd11261c8b07cb88aa4e81e2d3f8e1452d77
Author: Evan Quan <evan.quan at amd.com>
Date:   Tue Dec 8 12:30:09 2020 +0800

    drm/amdgpu: new macro for determining 2ND_USB20PORT support
    
    Used for determining 2ND_USB20PORT support from firmware_capability.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/include/atomfirmware.h b/drivers/gpu/drm/amd/include/atomfirmware.h
index c38635992101..3cb8d4c5c1a3 100644
--- a/drivers/gpu/drm/amd/include/atomfirmware.h
+++ b/drivers/gpu/drm/amd/include/atomfirmware.h
@@ -499,6 +499,7 @@ enum atombios_firmware_capability
 	ATOM_FIRMWARE_CAP_HWEMU_UMC_CFG = 0x00000100,
 	ATOM_FIRMWARE_CAP_SRAM_ECC      = 0x00000200,
 	ATOM_FIRMWARE_CAP_ENABLE_2STAGE_BIST_TRAINING  = 0x00000400,
+	ATOM_FIRMWARE_CAP_ENABLE_2ND_USB20PORT = 0x0008000,
 };
 
 enum atom_cooling_solution_id{
commit a7e660e526c9936cad3871d8cd1e3360b0b87469
Author: Evan Quan <evan.quan at amd.com>
Date:   Tue Dec 8 12:26:09 2020 +0800

    drm/amd/pm: expose the firmware_capability from firmware_info table
    
    That will help to determine whether 2ND_USB20_PORT workaround is
    needed for Sienna Cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
index 89be49a43500..4bdbcce7092d 100644
--- a/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
+++ b/drivers/gpu/drm/amd/pm/inc/amdgpu_smu.h
@@ -227,6 +227,7 @@ struct smu_bios_boot_up_values
 	uint32_t			content_revision;
 	uint32_t			fclk;
 	uint32_t			lclk;
+	uint32_t			firmware_caps;
 };
 
 enum smu_table_id
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index f2565eed469f..45ecd0386e9f 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -554,6 +554,7 @@ int smu_v11_0_get_vbios_bootup_values(struct smu_context *smu)
 		smu->smu_table.boot_values.vdd_gfx = v_3_1->bootup_vddgfx_mv;
 		smu->smu_table.boot_values.cooling_id = v_3_1->coolingsolution_id;
 		smu->smu_table.boot_values.pp_table_id = 0;
+		smu->smu_table.boot_values.firmware_caps = v_3_1->firmware_capability;
 		break;
 	case 3:
 	default:
@@ -569,6 +570,7 @@ int smu_v11_0_get_vbios_bootup_values(struct smu_context *smu)
 		smu->smu_table.boot_values.vdd_gfx = v_3_3->bootup_vddgfx_mv;
 		smu->smu_table.boot_values.cooling_id = v_3_3->coolingsolution_id;
 		smu->smu_table.boot_values.pp_table_id = v_3_3->pplib_pptable_id;
+		smu->smu_table.boot_values.firmware_caps = v_3_3->firmware_capability;
 	}
 
 	smu->smu_table.boot_values.format_revision = header->format_revision;
commit ac7804bb9908b972c1aa02eb79a5688c051a5668
Author: Evan Quan <evan.quan at amd.com>
Date:   Tue Dec 8 11:59:52 2020 +0800

    drm/amd/pm: correct the gpo control for sienna cichlid
    
    New SMC message was introduced for gpo control on sienna cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/inc/smu_types.h b/drivers/gpu/drm/amd/pm/inc/smu_types.h
index 4a6d1381df16..1251dd411516 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_types.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_types.h
@@ -209,6 +209,7 @@
        __SMU_DUMMY_MAP(SetSoftMinCclk),                     \
        __SMU_DUMMY_MAP(SetSoftMaxCclk),                     \
 	__SMU_DUMMY_MAP(SetGpoFeaturePMask),             \
+	__SMU_DUMMY_MAP(DisallowGpo),                    \
 
 #undef __SMU_DUMMY_MAP
 #define __SMU_DUMMY_MAP(type)	SMU_MSG_##type
diff --git a/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h b/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
index 35dd6072cc45..dad2832ff3b1 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu_v11_0_7_ppsmc.h
@@ -134,6 +134,8 @@
 #define PPSMC_MSG_SetGpoFeaturePMask             0x45
 #define PPSMC_MSG_SetSMBUSInterrupt              0x46
 
-#define PPSMC_Message_Count                      0x47
+#define PPSMC_MSG_DisallowGpo                    0x56
+
+#define PPSMC_Message_Count                      0x58
 
 #endif
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 1ce13944721b..d88361554d94 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -128,6 +128,7 @@ static struct cmn2asic_msg_mapping sienna_cichlid_message_map[SMU_MSG_MAX_COUNT]
 	MSG_MAP(Mode1Reset,                     PPSMC_MSG_Mode1Reset,		       0),
 	MSG_MAP(SetMGpuFanBoostLimitRpm,	PPSMC_MSG_SetMGpuFanBoostLimitRpm,     0),
 	MSG_MAP(SetGpoFeaturePMask,		PPSMC_MSG_SetGpoFeaturePMask,          0),
+	MSG_MAP(DisallowGpo,			PPSMC_MSG_DisallowGpo,                 0),
 };
 
 static struct cmn2asic_mapping sienna_cichlid_clk_map[SMU_CLK_COUNT] = {
@@ -2653,19 +2654,40 @@ static int sienna_cichlid_enable_mgpu_fan_boost(struct smu_context *smu)
 static int sienna_cichlid_gpo_control(struct smu_context *smu,
 				      bool enablement)
 {
+	uint32_t smu_version;
 	int ret = 0;
 
+
 	if (smu_cmn_feature_is_supported(smu, SMU_FEATURE_DPM_GFX_GPO_BIT)) {
-		if (enablement)
-			ret = smu_cmn_send_smc_msg_with_param(smu,
-							SMU_MSG_SetGpoFeaturePMask,
-							GFX_GPO_PACE_MASK | GFX_GPO_DEM_MASK,
-							NULL);
-		else
-			ret = smu_cmn_send_smc_msg_with_param(smu,
-							SMU_MSG_SetGpoFeaturePMask,
-							0,
-							NULL);
+		ret = smu_cmn_get_smc_version(smu, NULL, &smu_version);
+		if (ret)
+			return ret;
+
+		if (enablement) {
+			if (smu_version < 0x003a2500) {
+				ret = smu_cmn_send_smc_msg_with_param(smu,
+								      SMU_MSG_SetGpoFeaturePMask,
+								      GFX_GPO_PACE_MASK | GFX_GPO_DEM_MASK,
+								      NULL);
+			} else {
+				ret = smu_cmn_send_smc_msg_with_param(smu,
+								      SMU_MSG_DisallowGpo,
+								      0,
+								      NULL);
+			}
+		} else {
+			if (smu_version < 0x003a2500) {
+				ret = smu_cmn_send_smc_msg_with_param(smu,
+								      SMU_MSG_SetGpoFeaturePMask,
+								      0,
+								      NULL);
+			} else {
+				ret = smu_cmn_send_smc_msg_with_param(smu,
+								      SMU_MSG_DisallowGpo,
+								      1,
+								      NULL);
+			}
+		}
 	}
 
 	return ret;
commit 0cb4c62125a904259e24016b5e85408c27dc412a
Author: Evan Quan <evan.quan at amd.com>
Date:   Mon Dec 7 16:53:25 2020 +0800

    drm/amd/pm: correct power limit setting for SMU V11
    
    Correct the power limit setting for SMU V11 asics.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
index 624065d3c079..f2565eed469f 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c
@@ -929,9 +929,13 @@ int smu_v11_0_get_current_power_limit(struct smu_context *smu,
 	if (power_src < 0)
 		return -EINVAL;
 
+	/*
+	 * BIT 24-31: ControllerId (only PPT0 is supported for now)
+	 * BIT 16-23: PowerSource
+	 */
 	ret = smu_cmn_send_smc_msg_with_param(smu,
 					  SMU_MSG_GetPptLimit,
-					  power_src << 16,
+					  (0 << 24) | (power_src << 16),
 					  power_limit);
 	if (ret)
 		dev_err(smu->adev->dev, "[%s] get PPT limit failed!", __func__);
@@ -941,6 +945,7 @@ int smu_v11_0_get_current_power_limit(struct smu_context *smu,
 
 int smu_v11_0_set_power_limit(struct smu_context *smu, uint32_t n)
 {
+	int power_src;
 	int ret = 0;
 
 	if (!smu_cmn_feature_is_enabled(smu, SMU_FEATURE_PPT_BIT)) {
@@ -948,6 +953,22 @@ int smu_v11_0_set_power_limit(struct smu_context *smu, uint32_t n)
 		return -EOPNOTSUPP;
 	}
 
+	power_src = smu_cmn_to_asic_specific_index(smu,
+					CMN2ASIC_MAPPING_PWR,
+					smu->adev->pm.ac_power ?
+					SMU_POWER_SOURCE_AC :
+					SMU_POWER_SOURCE_DC);
+	if (power_src < 0)
+		return -EINVAL;
+
+	/*
+	 * BIT 24-31: ControllerId (only PPT0 is supported for now)
+	 * BIT 16-23: PowerSource
+	 * BIT 0-15: PowerLimit
+	 */
+	n &= 0xFFFF;
+	n |= 0 << 24;
+	n |= (power_src) << 16;
 	ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_SetPptLimit, n, NULL);
 	if (ret) {
 		dev_err(smu->adev->dev, "[%s] Set power limit Failed!\n", __func__);
commit 18a4b3de5fc1c63c80e3be0673886431a56e4307
Author: Evan Quan <evan.quan at amd.com>
Date:   Mon Dec 7 16:21:03 2020 +0800

    drm/amd/pm: support power source switch on Sienna Cichlid
    
    Enable power source switch on Sienna Cichlid.
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index db0f2a476c23..1ce13944721b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -302,6 +302,9 @@ static int sienna_cichlid_check_powerplay_table(struct smu_context *smu)
 		table_context->power_play_table;
 	struct smu_baco_context *smu_baco = &smu->smu_baco;
 
+	if (powerplay_table->platform_caps & SMU_11_0_7_PP_PLATFORM_CAP_HARDWAREDC)
+		smu->dc_controlled_by_gpio = true;
+
 	if (powerplay_table->platform_caps & SMU_11_0_7_PP_PLATFORM_CAP_BACO ||
 	    powerplay_table->platform_caps & SMU_11_0_7_PP_PLATFORM_CAP_MACO)
 		smu_baco->platform_support = true;
@@ -2740,6 +2743,7 @@ static const struct pptable_funcs sienna_cichlid_ppt_funcs = {
 	.get_dpm_ultimate_freq = sienna_cichlid_get_dpm_ultimate_freq,
 	.set_soft_freq_limited_range = smu_v11_0_set_soft_freq_limited_range,
 	.run_btc = sienna_cichlid_run_btc,
+	.set_power_source = smu_v11_0_set_power_source,
 	.get_pp_feature_mask = smu_cmn_get_pp_feature_mask,
 	.set_pp_feature_mask = smu_cmn_set_pp_feature_mask,
 	.get_gpu_metrics = sienna_cichlid_get_gpu_metrics,
commit 0d801007f90ec023aefc1da19529bf9985050227
Author: Jiansong Chen <Jiansong.Chen at amd.com>
Date:   Wed Dec 9 19:43:44 2020 +0800

    drm/amdkfd: correct pipe offset calculation
    
    Correct pipe offset calculation in is_pipe_enabled function,
    it should be done in queues.
    
    Signed-off-by: Jiansong Chen <Jiansong.Chen at amd.com>
    Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
index f0a6f6665c81..e686ce2bf3b3 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -72,8 +72,8 @@ enum KFD_MQD_TYPE get_mqd_type_from_queue_type(enum kfd_queue_type type)
 static bool is_pipe_enabled(struct device_queue_manager *dqm, int mec, int pipe)
 {
 	int i;
-	int pipe_offset = mec * dqm->dev->shared_resources.num_pipe_per_mec
-		+ pipe * dqm->dev->shared_resources.num_queue_per_pipe;
+	int pipe_offset = (mec * dqm->dev->shared_resources.num_pipe_per_mec
+		+ pipe) * dqm->dev->shared_resources.num_queue_per_pipe;
 
 	/* queue is available for KFD usage if bit is 1 */
 	for (i = 0; i <  dqm->dev->shared_resources.num_queue_per_pipe; ++i)
commit 0269764a731bba0b5b1afb134abab702fbde1f04
Author: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
Date:   Mon Dec 7 17:20:27 2020 -0500

    drm/amd/display: Drop unnecessary function call
    
    After refactor our amdgpu_dm_atomic_commit, this function only invoke
    drm_atomic_helper_commit. For this reason, this commit drops
    amdgpu_dm_atomic_commit and add drm_atomic_helper_commit directly in the
    atomic_commit hook.
    
    v2: squash in warning fix (Alex)
    
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index c23896207e9d..562d874f81fb 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -196,10 +196,6 @@ static int amdgpu_dm_encoder_init(struct drm_device *dev,
 
 static int amdgpu_dm_connector_get_modes(struct drm_connector *connector);
 
-static int amdgpu_dm_atomic_commit(struct drm_device *dev,
-				   struct drm_atomic_state *state,
-				   bool nonblock);
-
 static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state);
 
 static int amdgpu_dm_atomic_check(struct drm_device *dev,
@@ -2212,7 +2208,7 @@ static const struct drm_mode_config_funcs amdgpu_dm_mode_funcs = {
 	.get_format_info = amd_get_format_info,
 	.output_poll_changed = drm_fb_helper_output_poll_changed,
 	.atomic_check = amdgpu_dm_atomic_check,
-	.atomic_commit = amdgpu_dm_atomic_commit,
+	.atomic_commit = drm_atomic_helper_commit,
 };
 
 static struct drm_mode_config_helper_funcs amdgpu_dm_mode_config_helperfuncs = {
@@ -8070,20 +8066,6 @@ static void amdgpu_dm_crtc_copy_transient_flags(struct drm_crtc_state *crtc_stat
 	stream_state->mode_changed = drm_atomic_crtc_needs_modeset(crtc_state);
 }
 
-static int amdgpu_dm_atomic_commit(struct drm_device *dev,
-				   struct drm_atomic_state *state,
-				   bool nonblock)
-{
-	/*
-	 * Add check here for SoC's that support hardware cursor plane, to
-	 * unset legacy_cursor_update
-	 */
-
-	return drm_atomic_helper_commit(dev, state, nonblock);
-
-	/*TODO Handle EINTR, reenable IRQ*/
-}
-
 /**
  * amdgpu_dm_atomic_commit_tail() - AMDgpu DM's commit tail implementation.
  * @state: The atomic state to commit
commit 4932d37055e7a459a92424c4d21ebf8c2c0fb19a
Author: Christian König <christian.koenig at amd.com>
Date:   Tue Dec 8 16:19:42 2020 +0100

    drm/amdgpu: limit the amdgpu_vm_update_ptes trace point
    
    The text output should not be more than a page, so only print the first
    32 page table entries.
    
    If we need all of them we can still look into the binary trace.
    
    Signed-off-by: Christian König <christian.koenig at amd.com>
    Reviewed-by: Shashank Sharma <shashank.sharma at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
index 324d5e3f3579..6752d8b13118 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
@@ -358,10 +358,11 @@ TRACE_EVENT(amdgpu_vm_update_ptes,
 			}
 	),
 	TP_printk("pid:%u vm_ctx:0x%llx start:0x%010llx end:0x%010llx,"
-		  " flags:0x%llx, incr:%llu, dst:\n%s", __entry->pid,
+		  " flags:0x%llx, incr:%llu, dst:\n%s%s", __entry->pid,
 		  __entry->vm_ctx, __entry->start, __entry->end,
 		  __entry->flags, __entry->incr,  __print_array(
-		  __get_dynamic_array(dst), __entry->nptes, 8))
+		  __get_dynamic_array(dst), min(__entry->nptes, 32u), 8),
+		  __entry->nptes > 32 ? "..." : "")
 );
 
 TRACE_EVENT(amdgpu_vm_set_ptes,
commit 38bf8cd821be292e7d8e6f6283d67c5d9708f887
Author: Paolo Abeni <pabeni at redhat.com>
Date:   Wed Dec 9 12:21:13 2020 +0100

    selftests: fix poll error in udpgro.sh
    
    The test program udpgso_bench_rx always invokes the poll()
    syscall with a timeout of 10ms. If a larger timeout is specified
    via the command line, udpgso_bench_rx is supposed to do multiple
    poll() calls till the timeout is expired or an event is received.
    
    Currently the poll() loop errors out after the first invocation with
    no events, and may causes self-tests failure alike:
    
    failed
     GRO with custom segment size            ./udpgso_bench_rx: poll: 0x0 expected 0x1
    
    This change addresses the issue allowing the poll() loop to consume
    all the configured timeout.
    
    Fixes: ada641ff6ed3 ("selftests: fixes for UDP GRO")
    Signed-off-by: Paolo Abeni <pabeni at redhat.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
index db3d4a8b5a4c..76a24052f4b4 100644
--- a/tools/testing/selftests/net/udpgso_bench_rx.c
+++ b/tools/testing/selftests/net/udpgso_bench_rx.c
@@ -113,6 +113,9 @@ static void do_poll(int fd, int timeout_ms)
 				interrupted = true;
 				break;
 			}
+
+			/* no events and more time to wait, do poll again */
+			continue;
 		}
 		if (pfd.revents != POLLIN)
 			error(1, errno, "poll: 0x%x expected 0x%x\n",
commit 3615bdf6d9b19db12b1589861609b4f1c6a8d303
Author: Jean-Philippe Brucker <jean-philippe at linaro.org>
Date:   Tue Dec 8 19:01:54 2020 +0100

    selftests/bpf: Fix "dubious pointer arithmetic" test
    
    The verifier trace changed following a bugfix. After checking the 64-bit
    sign, only the upper bit mask is known, not bit 31. Update the test
    accordingly.
    
    Signed-off-by: Jean-Philippe Brucker <jean-philippe at linaro.org>
    Acked-by: John Fastabend <john.fastabend at gmail.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>

diff --git a/tools/testing/selftests/bpf/prog_tests/align.c b/tools/testing/selftests/bpf/prog_tests/align.c
index 52414058a627..5861446d0777 100644
--- a/tools/testing/selftests/bpf/prog_tests/align.c
+++ b/tools/testing/selftests/bpf/prog_tests/align.c
@@ -456,10 +456,10 @@ static struct bpf_align_test tests[] = {
 			 */
 			{7, "R5_w=inv(id=0,smin_value=-9223372036854775806,smax_value=9223372036854775806,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"},
 			/* Checked s>=0 */
-			{9, "R5=inv(id=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"},
+			{9, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"},
 			/* packet pointer + nonnegative (4n+2) */
-			{11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"},
-			{13, "R4_w=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"},
+			{11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"},
+			{13, "R4_w=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"},
 			/* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine.
 			 * We checked the bounds, but it might have been able
 			 * to overflow if the packet pointer started in the
@@ -467,7 +467,7 @@ static struct bpf_align_test tests[] = {
 			 * So we did not get a 'range' on R6, and the access
 			 * attempt will fail.
 			 */
-			{15, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"},
+			{15, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"},
 		}
 	},
 	{
commit 77ce220c0549dcc3db8226c61c60e83fc59dfafc
Author: Jean-Philippe Brucker <jean-philippe at linaro.org>
Date:   Tue Dec 8 19:01:53 2020 +0100

    selftests/bpf: Fix array access with signed variable test
    
    The test fails because of a recent fix to the verifier, even though this
    program is valid. In details what happens is:
    
        7: (61) r1 = *(u32 *)(r0 +0)
    
    Load a 32-bit value, with signed bounds [S32_MIN, S32_MAX]. The bounds
    of the 64-bit value are [0, U32_MAX]...
    
        8: (65) if r1 s> 0xffffffff goto pc+1
    
    ... therefore this is always true (the operand is sign-extended).
    
        10: (b4) w2 = 11
        11: (6d) if r2 s> r1 goto pc+1
    
    When true, the 64-bit bounds become [0, 10]. The 32-bit bounds are still
    [S32_MIN, 10].
    
        13: (64) w1 <<= 2
    
    Because this is a 32-bit operation, the verifier propagates the new
    32-bit bounds to the 64-bit ones, and the knowledge gained from insn 11
    is lost.
    
        14: (0f) r0 += r1
        15: (7a) *(u64 *)(r0 +0) = 4
    
    Then the verifier considers r0 unbounded here, rejecting the test. To
    make the test work, change insn 8 to check the sign of the 32-bit value.
    
    Signed-off-by: Jean-Philippe Brucker <jean-philippe at linaro.org>
    Acked-by: John Fastabend <john.fastabend at gmail.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>

diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
index 1c4b1939f5a8..bed53b561e04 100644
--- a/tools/testing/selftests/bpf/verifier/array_access.c
+++ b/tools/testing/selftests/bpf/verifier/array_access.c
@@ -68,7 +68,7 @@
 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
 	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
 	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-	BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
+	BPF_JMP32_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
 	BPF_MOV32_IMM(BPF_REG_1, 0),
 	BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
 	BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
commit 511a76bcb0ce242a19153658b25437906cc6070e
Author: Jean-Philippe Brucker <jean-philippe at linaro.org>
Date:   Tue Dec 8 19:01:52 2020 +0100

    selftests/bpf: Add test for signed 32-bit bound check bug
    
    After a 32-bit load followed by a branch, the verifier would reduce the
    maximum bound of the register to 0x7fffffff, allowing a user to bypass
    bound checks. Ensure such a program is rejected.
    
    In the second test, the 64-bit compare should not sufficient to
    determine whether the signed 32-bit lower bound is 0, so the verifier
    should reject the second branch.
    
    Signed-off-by: Jean-Philippe Brucker <jean-philippe at linaro.org>
    Acked-by: John Fastabend <john.fastabend at gmail.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>

diff --git a/tools/testing/selftests/bpf/verifier/bounds.c b/tools/testing/selftests/bpf/verifier/bounds.c
index dac40de3f868..57ed67b86074 100644
--- a/tools/testing/selftests/bpf/verifier/bounds.c
+++ b/tools/testing/selftests/bpf/verifier/bounds.c
@@ -703,3 +703,44 @@
 	.fixup_map_hash_8b = { 3 },
 	.result = ACCEPT,
 },
+{
+	"bounds checks after 32-bit truncation. test 1",
+	.insns = {
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+	BPF_LD_MAP_FD(BPF_REG_1, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+	/* This used to reduce the max bound to 0x7fffffff */
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+	BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0x7fffffff, 1),
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.fixup_map_hash_8b = { 3 },
+	.errstr_unpriv = "R0 leaks addr",
+	.result_unpriv = REJECT,
+	.result = ACCEPT,
+},
+{
+	"bounds checks after 32-bit truncation. test 2",
+	.insns = {
+	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+	BPF_LD_MAP_FD(BPF_REG_1, 0),
+	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+	BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+	BPF_JMP_IMM(BPF_JSLT, BPF_REG_1, 1, 1),
+	BPF_JMP32_IMM(BPF_JSLT, BPF_REG_1, 0, 1),
+	BPF_MOV64_IMM(BPF_REG_0, 0),
+	BPF_EXIT_INSN(),
+	},
+	.fixup_map_hash_8b = { 3 },
+	.errstr_unpriv = "R0 leaks addr",
+	.result_unpriv = REJECT,
+	.result = ACCEPT,
+},
commit b02709587ea3d699a608568ee8157d8db4fd8cae
Author: Alexei Starovoitov <ast at kernel.org>
Date:   Tue Dec 8 19:01:51 2020 +0100

    bpf: Fix propagation of 32-bit signed bounds from 64-bit bounds.
    
    The 64-bit signed bounds should not affect 32-bit signed bounds unless the
    verifier knows that upper 32-bits are either all 1s or all 0s. For example the
    register with smin_value==1 doesn't mean that s32_min_value is also equal to 1,
    since smax_value could be larger than 32-bit subregister can hold.
    The verifier refines the smax/s32_max return value from certain helpers in
    do_refine_retval_range(). Teach the verifier to recognize that smin/s32_min
    value is also bounded. When both smin and smax bounds fit into 32-bit
    subregister the verifier can propagate those bounds.
    
    Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
    Reported-by: Jean-Philippe Brucker <jean-philippe at linaro.org>
    Acked-by: John Fastabend <john.fastabend at gmail.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1388bf733071..53fe6ef6d931 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1298,9 +1298,7 @@ static void __reg_combine_32_into_64(struct bpf_reg_state *reg)
 
 static bool __reg64_bound_s32(s64 a)
 {
-	if (a > S32_MIN && a < S32_MAX)
-		return true;
-	return false;
+	return a > S32_MIN && a < S32_MAX;
 }
 
 static bool __reg64_bound_u32(u64 a)
@@ -1314,10 +1312,10 @@ static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
 {
 	__mark_reg32_unbounded(reg);
 
-	if (__reg64_bound_s32(reg->smin_value))
+	if (__reg64_bound_s32(reg->smin_value) && __reg64_bound_s32(reg->smax_value)) {
 		reg->s32_min_value = (s32)reg->smin_value;
-	if (__reg64_bound_s32(reg->smax_value))
 		reg->s32_max_value = (s32)reg->smax_value;
+	}
 	if (__reg64_bound_u32(reg->umin_value))
 		reg->u32_min_value = (u32)reg->umin_value;
 	if (__reg64_bound_u32(reg->umax_value))
@@ -4895,6 +4893,8 @@ static void do_refine_retval_range(struct bpf_reg_state *regs, int ret_type,
 
 	ret_reg->smax_value = meta->msize_max_value;
 	ret_reg->s32_max_value = meta->msize_max_value;
+	ret_reg->smin_value = -MAX_ERRNO;
+	ret_reg->s32_min_value = -MAX_ERRNO;
 	__reg_deduce_bounds(ret_reg);
 	__reg_bound_offset(ret_reg);
 	__update_reg_bounds(ret_reg);
commit 9fca90cf28920c6d0723d7efd1eae0b0fb90309c
Merge: 40201575b731 340b940ea0ed
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 11:00:27 2020 -0800

    Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
    
    Pull rdma fixes from Jason Gunthorpe:
     "Two user triggerable crashers and a some EFA related regressions:
    
       - Syzkaller found a bug in CM
    
       - Restore access to the GID table and fix modify_qp for EFA
    
       - Crasher in qedr"
    
    * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
      RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
      RDMA/core: Fix empty gid table for non IB/RoCE devices
      RDMA/efa: Use the correct current and new states in modify QP
      RDMA/qedr: iWARP invalid(zero) doorbell address fix

commit 40201575b731db6bde55c2f0daa930bbd9cfcb13
Merge: a2f5ea9e314b 3d1387b3b8f6
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Dec 10 10:48:49 2020 -0800

    Merge tag 'media/v5.10-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
    
    Pull media fixes from Mauro Carvalho Chehab:
     "A couple of fixes:
    
       - videobuf2: fix a DMABUF bug, preventing it to properly handle cache
         sync/flush
    
       - vidtv: an usage after free and a few sparse/smatch warning fixes
    
       - pulse8-cec: a duplicate free and a bug related to new firmware
         usage
    
       - mtk-cir: fix a regression on a clock setting"
    
    * tag 'media/v5.10-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
      media: vidtv: fix some warnings
      media: vidtv: fix kernel-doc markups
      media: [next] media: vidtv: fix a read from an object after it has been freed
      media: vb2: set cache sync hints when init buffers
      media: pulse8-cec: add support for FW v10 and up
      media: pulse8-cec: fix duplicate free at disconnect or probe error
      media: mtk-cir: fix calculation of chk period

commit 06c5fe9b12dde1b62821f302f177c972bb1c81f9
Author: Xiaochen Shen <xiaochen.shen at intel.com>
Date:   Fri Dec 4 14:27:59 2020 +0800

    x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled
    
    The MBA software controller (mba_sc) is a feedback loop which
    periodically reads MBM counters and tries to restrict the bandwidth
    below a user-specified value. It tags along the MBM counter overflow
    handler to do the updates with 1s interval in mbm_update() and
    update_mba_bw().
    
    The purpose of mbm_update() is to periodically read the MBM counters to
    make sure that the hardware counter doesn't wrap around more than once
    between user samplings. mbm_update() calls __mon_event_count() for local
    bandwidth updating when mba_sc is not enabled, but calls mbm_bw_count()
    instead when mba_sc is enabled. __mon_event_count() will not be called
    for local bandwidth updating in MBM counter overflow handler, but it is
    still called when reading MBM local bandwidth counter file
    'mbm_local_bytes', the call path is as below:
    
      rdtgroup_mondata_show()
        mon_event_read()
          mon_event_count()
            __mon_event_count()
    
    In __mon_event_count(), m->chunks is updated by delta chunks which is
    calculated from previous MSR value (m->prev_msr) and current MSR value.
    When mba_sc is enabled, m->chunks is also updated in mbm_update() by
    mistake by the delta chunks which is calculated from m->prev_bw_msr
    instead of m->prev_msr. But m->chunks is not used in update_mba_bw() in
    the mba_sc feedback loop.
    
    When reading MBM local bandwidth counter file, m->chunks was changed
    unexpectedly by mbm_bw_count(). As a result, the incorrect local
    bandwidth counter which calculated from incorrect m->chunks is shown to
    the user.
    
    Fix this by removing incorrect m->chunks updating in mbm_bw_count() in
    MBM counter overflow handler, and always calling __mon_event_count() in
    mbm_update() to make sure that the hardware local bandwidth counter
    doesn't wrap around.
    
    Test steps:
      # Run workload with aggressive memory bandwidth (e.g., 10 GB/s)
      git clone https://github.com/intel/intel-cmt-cat && cd intel-cmt-cat
      && make
      ./tools/membw/membw -c 0 -b 10000 --read
    
      # Enable MBA software controller
      mount -t resctrl resctrl -o mba_MBps /sys/fs/resctrl
    
      # Create control group c1
      mkdir /sys/fs/resctrl/c1
    
      # Set MB throttle to 6 GB/s
      echo "MB:0=6000;1=6000" > /sys/fs/resctrl/c1/schemata
    
      # Write PID of the workload to tasks file
      echo `pidof membw` > /sys/fs/resctrl/c1/tasks
    
      # Read local bytes counters twice with 1s interval, the calculated
      # local bandwidth is not as expected (approaching to 6 GB/s):
      local_1=`cat /sys/fs/resctrl/c1/mon_data/mon_L3_00/mbm_local_bytes`
      sleep 1
      local_2=`cat /sys/fs/resctrl/c1/mon_data/mon_L3_00/mbm_local_bytes`
      echo "local b/w (bytes/s):" `expr $local_2 - $local_1`
    
    Before fix:
      local b/w (bytes/s): 11076796416
    
    After fix:
      local b/w (bytes/s): 5465014272
    
    Fixes: ba0f26d8529c (x86/intel_rdt/mba_sc: Prepare for feedback loop)
    Signed-off-by: Xiaochen Shen <xiaochen.shen at intel.com>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Reviewed-by: Tony Luck <tony.luck at intel.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/1607063279-19437-1-git-send-email-xiaochen.shen@intel.com

diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c
index 54dffe574e67..a98519a3a2e6 100644
--- a/arch/x86/kernel/cpu/resctrl/monitor.c
+++ b/arch/x86/kernel/cpu/resctrl/monitor.c
@@ -279,7 +279,6 @@ static void mbm_bw_count(u32 rmid, struct rmid_read *rr)
 		return;
 
 	chunks = mbm_overflow_count(m->prev_bw_msr, tval, rr->r->mbm_width);
-	m->chunks += chunks;
 	cur_bw = (chunks * r->mon_scale) >> 20;
 
 	if (m->delta_comp)
@@ -450,15 +449,14 @@ static void mbm_update(struct rdt_resource *r, struct rdt_domain *d, int rmid)
 	}
 	if (is_mbm_local_enabled()) {
 		rr.evtid = QOS_L3_MBM_LOCAL_EVENT_ID;
+		__mon_event_count(rmid, &rr);
 
 		/*
 		 * Call the MBA software controller only for the
 		 * control groups and when user has enabled
 		 * the software controller explicitly.
 		 */
-		if (!is_mba_sc(NULL))
-			__mon_event_count(rmid, &rr);
-		else
+		if (is_mba_sc(NULL))
 			mbm_bw_count(rmid, &rr);
 	}
 }
commit 83bbb8ffb4629ece5d6c0b093b9f66297a9e27e0
Merge: 339f5a7fb2d6 7d894834a305
Author: Paolo Bonzini <pbonzini at redhat.com>
Date:   Thu Dec 10 11:34:24 2020 -0500

    Merge tag 'kvmarm-fixes-5.10-5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
    
    kvm/arm64 fixes for 5.10, take #5
    
    - Don't leak page tables on PTE update
    - Correctly invalidate TLBs on table to block transition
    - Only update permissions if the fault level matches the
      expected mapping size

commit 4223a5be80b8998d717c6b0e1000070e0e336bf3
Merge: 7e7986f9d3ba 57a0f3a81ef2
Author: Jens Axboe <axboe at kernel.dk>
Date:   Thu Dec 10 07:08:22 2020 -0700

    Merge branch 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-5.10
    
    Pull MD fixes from Song:
    
    "This is to fix raid10 data corruption [1] in 5.10-rc7."
    
    * 'md-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md:
      Revert "md: add md_submit_discard_bio() for submitting discard bio"
      Revert "md/raid10: extend r10bio devs to raid disks"
      Revert "md/raid10: pull codes that wait for blocked dev into one function"
      Revert "md/raid10: improve raid10 discard request"
      Revert "md/raid10: improve discard request for far layout"
      Revert "dm raid: remove unnecessary discard limits for raid10"

commit 29ac40cbed2bc06fa218ca25d7f5e280d3d08a25
Author: Arvind Sankar <nivedita at alum.mit.edu>
Date:   Wed Nov 11 11:09:45 2020 -0500

    x86/mm/mem_encrypt: Fix definition of PMD_FLAGS_DEC_WP
    
    The PAT bit is in different locations for 4k and 2M/1G page table
    entries.
    
    Add a definition for _PAGE_LARGE_CACHE_MASK to represent the three
    caching bits (PWT, PCD, PAT), similar to _PAGE_CACHE_MASK for 4k pages,
    and use it in the definition of PMD_FLAGS_DEC_WP to get the correct PAT
    index for write-protected pages.
    
    Fixes: 6ebcb060713f ("x86/mm: Add support to encrypt the kernel in-place")
    Signed-off-by: Arvind Sankar <nivedita at alum.mit.edu>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Tested-by: Tom Lendacky <thomas.lendacky at amd.com>
    Cc: stable at vger.kernel.org
    Link: https://lkml.kernel.org/r/20201111160946.147341-1-nivedita@alum.mit.edu

diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 816b31c68550..394757ee030a 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -155,6 +155,7 @@ enum page_cache_mode {
 #define _PAGE_ENC		(_AT(pteval_t, sme_me_mask))
 
 #define _PAGE_CACHE_MASK	(_PAGE_PWT | _PAGE_PCD | _PAGE_PAT)
+#define _PAGE_LARGE_CACHE_MASK	(_PAGE_PWT | _PAGE_PCD | _PAGE_PAT_LARGE)
 
 #define _PAGE_NOCACHE		(cachemode2protval(_PAGE_CACHE_MODE_UC))
 #define _PAGE_CACHE_WP		(cachemode2protval(_PAGE_CACHE_MODE_WP))
diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 733b983f3a89..6c5eb6f3f14f 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -45,8 +45,8 @@
 #define PMD_FLAGS_LARGE		(__PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL)
 
 #define PMD_FLAGS_DEC		PMD_FLAGS_LARGE
-#define PMD_FLAGS_DEC_WP	((PMD_FLAGS_DEC & ~_PAGE_CACHE_MASK) | \
-				 (_PAGE_PAT | _PAGE_PWT))
+#define PMD_FLAGS_DEC_WP	((PMD_FLAGS_DEC & ~_PAGE_LARGE_CACHE_MASK) | \
+				 (_PAGE_PAT_LARGE | _PAGE_PWT))
 
 #define PMD_FLAGS_ENC		(PMD_FLAGS_LARGE | _PAGE_ENC)
 
commit 6bea0225a4bf14a58af71cb9677a756921469e46
Author: Damien Le Moal <damien.lemoal at wdc.com>
Date:   Wed Dec 9 20:16:10 2020 +0900

    zonefs: fix page reference and BIO leak
    
    In zonefs_file_dio_append(), the pages obtained using
    bio_iov_iter_get_pages() are not released on completion of the
    REQ_OP_APPEND BIO, nor when bio_iov_iter_get_pages() fails.
    Furthermore, a call to bio_put() is missing when
    bio_iov_iter_get_pages() fails.
    
    Fix these resource leaks by adding BIO resource release code (bio_put()i
    and bio_release_pages()) at the end of the function after the BIO
    execution and add a jump to this resource cleanup code in case of
    bio_iov_iter_get_pages() failure.
    
    While at it, also fix the call to task_io_account_write() to be passed
    the correct BIO size instead of bio_iov_iter_get_pages() return value.
    
    Reported-by: Christoph Hellwig <hch at lst.de>
    Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO")
    Cc: stable at vger.kernel.org
    Signed-off-by: Damien Le Moal <damien.lemoal at wdc.com>
    Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni at wdc.com>
    Reviewed-by: Christoph Hellwig <hch at lst.de>

diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index ff5930be096c..bec47f2d074b 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -691,21 +691,23 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from)
 		bio->bi_opf |= REQ_FUA;
 
 	ret = bio_iov_iter_get_pages(bio, from);
-	if (unlikely(ret)) {
-		bio_io_error(bio);
-		return ret;
-	}
+	if (unlikely(ret))
+		goto out_release;
+
 	size = bio->bi_iter.bi_size;
-	task_io_account_write(ret);
+	task_io_account_write(size);
 
 	if (iocb->ki_flags & IOCB_HIPRI)
 		bio_set_polled(bio, iocb);
 
 	ret = submit_bio_wait(bio);
 
+	zonefs_file_write_dio_end_io(iocb, size, ret, 0);
+
+out_release:
+	bio_release_pages(bio, false);
 	bio_put(bio);
 
-	zonefs_file_write_dio_end_io(iocb, size, ret, 0);
 	if (ret >= 0) {
 		iocb->ki_pos += size;
 		return size;
commit ce6520b0eafad5962ffc21dc47cd7bd3250e9045
Author: Chris Chiu <chiu at endlessos.org>
Date:   Wed Dec 9 20:24:47 2020 -0800

    Input: i8042 - add Acer laptops to the i8042 reset list
    
    The touchpad operates in Basic Mode by default in the Acer BIOS
    setup, but some Aspire/TravelMate models require the i8042 to be
    reset in order to be correctly detected.
    
    Signed-off-by: Chris Chiu <chiu at endlessos.org>
    Link: https://lore.kernel.org/r/20201207071250.15021-1-chiu@endlessos.org
    Cc: stable at vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 7ecb65176c1a..3a2dcf0805f1 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -611,6 +611,48 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "AOA150"),
 		},
 	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A114-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A314-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire A315-31"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-132"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-332"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Aspire ES1-432"),
+		},
+	},
+	{
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate Spin B118-RN"),
+		},
+	},
 	{
 		/* Advent 4211 */
 		.matches = {
commit 57a0f3a81ef21fe51d6223aa78a1a890098d4ada
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 11:44:42 2020 -0800

    Revert "md: add md_submit_discard_bio() for submitting discard bio"
    
    This reverts commit 2628089b74d5a64bd0bcb5d247a18f78d7b6f4d0.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 98bac4f304ae..0037c6ecab65 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8582,26 +8582,6 @@ void md_write_end(struct mddev *mddev)
 
 EXPORT_SYMBOL(md_write_end);
 
-/* This is used by raid0 and raid10 */
-void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev,
-			struct bio *bio, sector_t start, sector_t size)
-{
-	struct bio *discard_bio = NULL;
-
-	if (__blkdev_issue_discard(rdev->bdev, start, size,
-		GFP_NOIO, 0, &discard_bio) || !discard_bio)
-		return;
-
-	bio_chain(discard_bio, bio);
-	bio_clone_blkg_association(discard_bio, bio);
-	if (mddev->gendisk)
-		trace_block_bio_remap(bdev_get_queue(rdev->bdev),
-			discard_bio, disk_devt(mddev->gendisk),
-			bio->bi_iter.bi_sector);
-	submit_bio_noacct(discard_bio);
-}
-EXPORT_SYMBOL(md_submit_discard_bio);
-
 /* md_allow_write(mddev)
  * Calling this ensures that the array is marked 'active' so that writes
  * may proceed without blocking.  It is important to call this before
diff --git a/drivers/md/md.h b/drivers/md/md.h
index ccfb69868c2e..2175a5ac4f7c 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -713,8 +713,6 @@ extern void md_write_end(struct mddev *mddev);
 extern void md_done_sync(struct mddev *mddev, int blocks, int ok);
 extern void md_error(struct mddev *mddev, struct md_rdev *rdev);
 extern void md_finish_reshape(struct mddev *mddev);
-extern void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev,
-			struct bio *bio, sector_t start, sector_t size);
 
 extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio);
 extern void md_super_write(struct mddev *mddev, struct md_rdev *rdev,
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 6f44177593a5..35843df15b5e 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -477,6 +477,7 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
 
 	for (disk = 0; disk < zone->nb_dev; disk++) {
 		sector_t dev_start, dev_end;
+		struct bio *discard_bio = NULL;
 		struct md_rdev *rdev;
 
 		if (disk < start_disk_index)
@@ -499,9 +500,18 @@ static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
 
 		rdev = conf->devlist[(zone - conf->strip_zone) *
 			conf->strip_zone[0].nb_dev + disk];
-		md_submit_discard_bio(mddev, rdev, bio,
+		if (__blkdev_issue_discard(rdev->bdev,
 			dev_start + zone->dev_start + rdev->data_offset,
-			dev_end - dev_start);
+			dev_end - dev_start, GFP_NOIO, 0, &discard_bio) ||
+		    !discard_bio)
+			continue;
+		bio_chain(discard_bio, bio);
+		bio_clone_blkg_association(discard_bio, bio);
+		if (mddev->gendisk)
+			trace_block_bio_remap(bdev_get_queue(rdev->bdev),
+				discard_bio, disk_devt(mddev->gendisk),
+				bio->bi_iter.bi_sector);
+		submit_bio_noacct(discard_bio);
 	}
 	bio_endio(bio);
 }
commit 17c28c2a068730e9d065a0e4ed03beed074d8997
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 11:44:20 2020 -0800

    Revert "md/raid10: extend r10bio devs to raid disks"
    
    This reverts commit 8650a889017cb1f6ea6813ccf83a2e9f6fa49dd3.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index f2ec44fda1a0..3b598a3cb462 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -91,7 +91,7 @@ static inline struct r10bio *get_resync_r10bio(struct bio *bio)
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
 	struct r10conf *conf = data;
-	int size = offsetof(struct r10bio, devs[conf->geo.raid_disks]);
+	int size = offsetof(struct r10bio, devs[conf->copies]);
 
 	/* allocate a r10bio with room for raid_disks entries in the
 	 * bios array */
@@ -238,7 +238,7 @@ static void put_all_bios(struct r10conf *conf, struct r10bio *r10_bio)
 {
 	int i;
 
-	for (i = 0; i < conf->geo.raid_disks; i++) {
+	for (i = 0; i < conf->copies; i++) {
 		struct bio **bio = & r10_bio->devs[i].bio;
 		if (!BIO_SPECIAL(*bio))
 			bio_put(*bio);
@@ -327,7 +327,7 @@ static int find_bio_disk(struct r10conf *conf, struct r10bio *r10_bio,
 	int slot;
 	int repl = 0;
 
-	for (slot = 0; slot < conf->geo.raid_disks; slot++) {
+	for (slot = 0; slot < conf->copies; slot++) {
 		if (r10_bio->devs[slot].bio == bio)
 			break;
 		if (r10_bio->devs[slot].repl_bio == bio) {
@@ -336,6 +336,7 @@ static int find_bio_disk(struct r10conf *conf, struct r10bio *r10_bio,
 		}
 	}
 
+	BUG_ON(slot == conf->copies);
 	update_head_pos(slot, r10_bio);
 
 	if (slotp)
@@ -1492,7 +1493,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)
 	r10_bio->mddev = mddev;
 	r10_bio->sector = bio->bi_iter.bi_sector;
 	r10_bio->state = 0;
-	memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->geo.raid_disks);
+	memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->copies);
 
 	if (bio_data_dir(bio) == READ)
 		raid10_read_request(mddev, bio, r10_bio);
commit 4e2c6567efdd6f252e1874c41c8db4abfb0a9bf3
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 11:43:43 2020 -0800

    Revert "md/raid10: pull codes that wait for blocked dev into one function"
    
    This reverts commit f046f5d0d79cdb968f219ce249e497fd1accf484.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 4ad8447fa868..f2ec44fda1a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1275,75 +1275,12 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
 	}
 }
 
-static void wait_blocked_dev(struct mddev *mddev, struct r10bio *r10_bio)
-{
-	int i;
-	struct r10conf *conf = mddev->private;
-	struct md_rdev *blocked_rdev;
-
-retry_wait:
-	blocked_rdev = NULL;
-	rcu_read_lock();
-	for (i = 0; i < conf->copies; i++) {
-		struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
-		struct md_rdev *rrdev = rcu_dereference(
-			conf->mirrors[i].replacement);
-		if (rdev == rrdev)
-			rrdev = NULL;
-		if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) {
-			atomic_inc(&rdev->nr_pending);
-			blocked_rdev = rdev;
-			break;
-		}
-		if (rrdev && unlikely(test_bit(Blocked, &rrdev->flags))) {
-			atomic_inc(&rrdev->nr_pending);
-			blocked_rdev = rrdev;
-			break;
-		}
-
-		if (rdev && test_bit(WriteErrorSeen, &rdev->flags)) {
-			sector_t first_bad;
-			sector_t dev_sector = r10_bio->devs[i].addr;
-			int bad_sectors;
-			int is_bad;
-
-			/* Discard request doesn't care the write result
-			 * so it doesn't need to wait blocked disk here.
-			 */
-			if (!r10_bio->sectors)
-				continue;
-
-			is_bad = is_badblock(rdev, dev_sector, r10_bio->sectors,
-					     &first_bad, &bad_sectors);
-			if (is_bad < 0) {
-				/* Mustn't write here until the bad block
-				 * is acknowledged
-				 */
-				atomic_inc(&rdev->nr_pending);
-				set_bit(BlockedBadBlocks, &rdev->flags);
-				blocked_rdev = rdev;
-				break;
-			}
-		}
-	}
-	rcu_read_unlock();
-
-	if (unlikely(blocked_rdev)) {
-		/* Have to wait for this device to get unblocked, then retry */
-		allow_barrier(conf);
-		raid10_log(conf->mddev, "%s wait rdev %d blocked",
-				__func__, blocked_rdev->raid_disk);
-		md_wait_for_blocked_rdev(blocked_rdev, mddev);
-		wait_barrier(conf);
-		goto retry_wait;
-	}
-}
-
 static void raid10_write_request(struct mddev *mddev, struct bio *bio,
 				 struct r10bio *r10_bio)
 {
 	struct r10conf *conf = mddev->private;
 	int i;
+	struct md_rdev *blocked_rdev;
 	sector_t sectors;
 	int max_sectors;
 
@@ -1401,9 +1338,8 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
 
 	r10_bio->read_slot = -1; /* make sure repl_bio gets freed */
 	raid10_find_phys(conf, r10_bio);
-
-	wait_blocked_dev(mddev, r10_bio);
-
+retry_write:
+	blocked_rdev = NULL;
 	rcu_read_lock();
 	max_sectors = r10_bio->sectors;
 
@@ -1414,6 +1350,16 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
 			conf->mirrors[d].replacement);
 		if (rdev == rrdev)
 			rrdev = NULL;
+		if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) {
+			atomic_inc(&rdev->nr_pending);
+			blocked_rdev = rdev;
+			break;
+		}
+		if (rrdev && unlikely(test_bit(Blocked, &rrdev->flags))) {
+			atomic_inc(&rrdev->nr_pending);
+			blocked_rdev = rrdev;
+			break;
+		}
 		if (rdev && (test_bit(Faulty, &rdev->flags)))
 			rdev = NULL;
 		if (rrdev && (test_bit(Faulty, &rrdev->flags)))
@@ -1434,6 +1380,15 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
 
 			is_bad = is_badblock(rdev, dev_sector, max_sectors,
 					     &first_bad, &bad_sectors);
+			if (is_bad < 0) {
+				/* Mustn't write here until the bad block
+				 * is acknowledged
+				 */
+				atomic_inc(&rdev->nr_pending);
+				set_bit(BlockedBadBlocks, &rdev->flags);
+				blocked_rdev = rdev;
+				break;
+			}
 			if (is_bad && first_bad <= dev_sector) {
 				/* Cannot write here at all */
 				bad_sectors -= (dev_sector - first_bad);
@@ -1469,6 +1424,35 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
 	}
 	rcu_read_unlock();
 
+	if (unlikely(blocked_rdev)) {
+		/* Have to wait for this device to get unblocked, then retry */
+		int j;
+		int d;
+
+		for (j = 0; j < i; j++) {
+			if (r10_bio->devs[j].bio) {
+				d = r10_bio->devs[j].devnum;
+				rdev_dec_pending(conf->mirrors[d].rdev, mddev);
+			}
+			if (r10_bio->devs[j].repl_bio) {
+				struct md_rdev *rdev;
+				d = r10_bio->devs[j].devnum;
+				rdev = conf->mirrors[d].replacement;
+				if (!rdev) {
+					/* Race with remove_disk */
+					smp_mb();
+					rdev = conf->mirrors[d].rdev;
+				}
+				rdev_dec_pending(rdev, mddev);
+			}
+		}
+		allow_barrier(conf);
+		raid10_log(conf->mddev, "wait rdev %d blocked", blocked_rdev->raid_disk);
+		md_wait_for_blocked_rdev(blocked_rdev, mddev);
+		wait_barrier(conf);
+		goto retry_write;
+	}
+
 	if (max_sectors < r10_bio->sectors)
 		r10_bio->sectors = max_sectors;
 
commit d7cb6be0d0cdced2a7a96bd80a8f835e77ec5204
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 11:43:08 2020 -0800

    Revert "md/raid10: improve raid10 discard request"
    
    This reverts commit bcc90d280465ebd51ab8688be86e1f00c62dccf9.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 05773ee1b5ba..4ad8447fa868 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1516,256 +1516,6 @@ static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)
 		raid10_write_request(mddev, bio, r10_bio);
 }
 
-static struct bio *raid10_split_bio(struct r10conf *conf,
-			struct bio *bio, sector_t sectors, bool want_first)
-{
-	struct bio *split;
-
-	split = bio_split(bio, sectors,	GFP_NOIO, &conf->bio_split);
-	bio_chain(split, bio);
-	allow_barrier(conf);
-	if (want_first) {
-		submit_bio_noacct(bio);
-		bio = split;
-	} else
-		submit_bio_noacct(split);
-	wait_barrier(conf);
-
-	return bio;
-}
-
-static void raid10_end_discard_request(struct bio *bio)
-{
-	struct r10bio *r10_bio = bio->bi_private;
-	struct r10conf *conf = r10_bio->mddev->private;
-	struct md_rdev *rdev = NULL;
-	int dev;
-	int slot, repl;
-
-	/*
-	 * We don't care the return value of discard bio
-	 */
-	if (!test_bit(R10BIO_Uptodate, &r10_bio->state))
-		set_bit(R10BIO_Uptodate, &r10_bio->state);
-
-	dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
-	if (repl)
-		rdev = conf->mirrors[dev].replacement;
-	if (!rdev) {
-		/* raid10_remove_disk uses smp_mb to make sure rdev is set to
-		 * replacement before setting replacement to NULL. It can read
-		 * rdev first without barrier protect even replacment is NULL
-		 */
-		smp_rmb();
-		rdev = conf->mirrors[dev].rdev;
-	}
-
-	if (atomic_dec_and_test(&r10_bio->remaining)) {
-		md_write_end(r10_bio->mddev);
-		raid_end_bio_io(r10_bio);
-	}
-
-	rdev_dec_pending(rdev, conf->mddev);
-}
-
-/* There are some limitations to handle discard bio
- * 1st, the discard size is bigger than stripe_size*2.
- * 2st, if the discard bio spans reshape progress, we use the old way to
- * handle discard bio
- */
-static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
-{
-	struct r10conf *conf = mddev->private;
-	struct geom *geo = &conf->geo;
-	struct r10bio *r10_bio;
-
-	int disk;
-	sector_t chunk;
-	unsigned int stripe_size;
-	sector_t split_size;
-
-	sector_t bio_start, bio_end;
-	sector_t first_stripe_index, last_stripe_index;
-	sector_t start_disk_offset;
-	unsigned int start_disk_index;
-	sector_t end_disk_offset;
-	unsigned int end_disk_index;
-	unsigned int remainder;
-
-	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
-		return -EAGAIN;
-
-	wait_barrier(conf);
-
-	/* Check reshape again to avoid reshape happens after checking
-	 * MD_RECOVERY_RESHAPE and before wait_barrier
-	 */
-	if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery))
-		goto out;
-
-	stripe_size = geo->raid_disks << geo->chunk_shift;
-	bio_start = bio->bi_iter.bi_sector;
-	bio_end = bio_end_sector(bio);
-
-	/* Maybe one discard bio is smaller than strip size or across one stripe
-	 * and discard region is larger than one stripe size. For far offset layout,
-	 * if the discard region is not aligned with stripe size, there is hole
-	 * when we submit discard bio to member disk. For simplicity, we only
-	 * handle discard bio which discard region is bigger than stripe_size*2
-	 */
-	if (bio_sectors(bio) < stripe_size*2)
-		goto out;
-
-	/* For far offset layout, if bio is not aligned with stripe size, it splits
-	 * the part that is not aligned with strip size.
-	 */
-	div_u64_rem(bio_start, stripe_size, &remainder);
-	if (geo->far_offset && remainder) {
-		split_size = stripe_size - remainder;
-		bio = raid10_split_bio(conf, bio, split_size, false);
-	}
-	div_u64_rem(bio_end, stripe_size, &remainder);
-	if (geo->far_offset && remainder) {
-		split_size = bio_sectors(bio) - remainder;
-		bio = raid10_split_bio(conf, bio, split_size, true);
-	}
-
-	r10_bio = mempool_alloc(&conf->r10bio_pool, GFP_NOIO);
-	r10_bio->mddev = mddev;
-	r10_bio->state = 0;
-	r10_bio->sectors = 0;
-	memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * geo->raid_disks);
-
-	wait_blocked_dev(mddev, r10_bio);
-
-	r10_bio->master_bio = bio;
-
-	bio_start = bio->bi_iter.bi_sector;
-	bio_end = bio_end_sector(bio);
-
-	/* raid10 uses chunk as the unit to store data. It's similar like raid0.
-	 * One stripe contains the chunks from all member disk (one chunk from
-	 * one disk at the same HBA address). For layout detail, see 'man md 4'
-	 */
-	chunk = bio_start >> geo->chunk_shift;
-	chunk *= geo->near_copies;
-	first_stripe_index = chunk;
-	start_disk_index = sector_div(first_stripe_index, geo->raid_disks);
-	if (geo->far_offset)
-		first_stripe_index *= geo->far_copies;
-	start_disk_offset = (bio_start & geo->chunk_mask) +
-				(first_stripe_index << geo->chunk_shift);
-
-	chunk = bio_end >> geo->chunk_shift;
-	chunk *= geo->near_copies;
-	last_stripe_index = chunk;
-	end_disk_index = sector_div(last_stripe_index, geo->raid_disks);
-	if (geo->far_offset)
-		last_stripe_index *= geo->far_copies;
-	end_disk_offset = (bio_end & geo->chunk_mask) +
-				(last_stripe_index << geo->chunk_shift);
-
-	rcu_read_lock();
-	for (disk = 0; disk < geo->raid_disks; disk++) {
-		struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev);
-		struct md_rdev *rrdev = rcu_dereference(
-			conf->mirrors[disk].replacement);
-
-		r10_bio->devs[disk].bio = NULL;
-		r10_bio->devs[disk].repl_bio = NULL;
-
-		if (rdev && (test_bit(Faulty, &rdev->flags)))
-			rdev = NULL;
-		if (rrdev && (test_bit(Faulty, &rrdev->flags)))
-			rrdev = NULL;
-		if (!rdev && !rrdev)
-			continue;
-
-		if (rdev) {
-			r10_bio->devs[disk].bio = bio;
-			atomic_inc(&rdev->nr_pending);
-		}
-		if (rrdev) {
-			r10_bio->devs[disk].repl_bio = bio;
-			atomic_inc(&rrdev->nr_pending);
-		}
-	}
-	rcu_read_unlock();
-
-	atomic_set(&r10_bio->remaining, 1);
-	for (disk = 0; disk < geo->raid_disks; disk++) {
-		sector_t dev_start, dev_end;
-		struct bio *mbio, *rbio = NULL;
-		struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev);
-		struct md_rdev *rrdev = rcu_dereference(
-			conf->mirrors[disk].replacement);
-
-		/*
-		 * Now start to calculate the start and end address for each disk.
-		 * The space between dev_start and dev_end is the discard region.
-		 *
-		 * For dev_start, it needs to consider three conditions:
-		 * 1st, the disk is before start_disk, you can imagine the disk in
-		 * the next stripe. So the dev_start is the start address of next
-		 * stripe.
-		 * 2st, the disk is after start_disk, it means the disk is at the
-		 * same stripe of first disk
-		 * 3st, the first disk itself, we can use start_disk_offset directly
-		 */
-		if (disk < start_disk_index)
-			dev_start = (first_stripe_index + 1) * mddev->chunk_sectors;
-		else if (disk > start_disk_index)
-			dev_start = first_stripe_index * mddev->chunk_sectors;
-		else
-			dev_start = start_disk_offset;
-
-		if (disk < end_disk_index)
-			dev_end = (last_stripe_index + 1) * mddev->chunk_sectors;
-		else if (disk > end_disk_index)
-			dev_end = last_stripe_index * mddev->chunk_sectors;
-		else
-			dev_end = end_disk_offset;
-
-		/* It only handles discard bio which size is >= stripe size, so
-		 * dev_end > dev_start all the time
-		 */
-		if (r10_bio->devs[disk].bio) {
-			mbio = bio_clone_fast(bio, GFP_NOIO, &mddev->bio_set);
-			mbio->bi_end_io = raid10_end_discard_request;
-			mbio->bi_private = r10_bio;
-			r10_bio->devs[disk].bio = mbio;
-			r10_bio->devs[disk].devnum = disk;
-			atomic_inc(&r10_bio->remaining);
-			md_submit_discard_bio(mddev, rdev, mbio,
-					dev_start + choose_data_offset(r10_bio, rdev),
-					dev_end - dev_start);
-			bio_endio(mbio);
-		}
-		if (r10_bio->devs[disk].repl_bio) {
-			rbio = bio_clone_fast(bio, GFP_NOIO, &mddev->bio_set);
-			rbio->bi_end_io = raid10_end_discard_request;
-			rbio->bi_private = r10_bio;
-			r10_bio->devs[disk].repl_bio = rbio;
-			r10_bio->devs[disk].devnum = disk;
-			atomic_inc(&r10_bio->remaining);
-			md_submit_discard_bio(mddev, rrdev, rbio,
-					dev_start + choose_data_offset(r10_bio, rrdev),
-					dev_end - dev_start);
-			bio_endio(rbio);
-		}
-	}
-
-	if (atomic_dec_and_test(&r10_bio->remaining)) {
-		md_write_end(r10_bio->mddev);
-		raid_end_bio_io(r10_bio);
-	}
-
-	return 0;
-out:
-	allow_barrier(conf);
-	return -EAGAIN;
-}
-
 static bool raid10_make_request(struct mddev *mddev, struct bio *bio)
 {
 	struct r10conf *conf = mddev->private;
@@ -1780,10 +1530,6 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio)
 	if (!md_write_start(mddev, bio))
 		return false;
 
-	if (unlikely(bio_op(bio) == REQ_OP_DISCARD))
-		if (!raid10_handle_discard(mddev, bio))
-			return true;
-
 	/*
 	 * If this request crosses a chunk boundary, we need to split
 	 * it.
@@ -4023,7 +3769,7 @@ static int raid10_run(struct mddev *mddev)
 
 	if (mddev->queue) {
 		blk_queue_max_discard_sectors(mddev->queue,
-					      UINT_MAX);
+					      mddev->chunk_sectors);
 		blk_queue_max_write_same_sectors(mddev->queue, 0);
 		blk_queue_max_write_zeroes_sectors(mddev->queue, 0);
 		blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
commit 82fe9af77cd11ea7bdc133ceed1f7f5fc08f7d25
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 11:38:11 2020 -0800

    Revert "md/raid10: improve discard request for far layout"
    
    This reverts commit d3ee2d8415a6256c1c41e1be36e80e640c3e6359.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index b7bca6703df8..05773ee1b5ba 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1534,28 +1534,6 @@ static struct bio *raid10_split_bio(struct r10conf *conf,
 	return bio;
 }
 
-static void raid_end_discard_bio(struct r10bio *r10bio)
-{
-	struct r10conf *conf = r10bio->mddev->private;
-	struct r10bio *first_r10bio;
-
-	while (atomic_dec_and_test(&r10bio->remaining)) {
-
-		allow_barrier(conf);
-
-		if (!test_bit(R10BIO_Discard, &r10bio->state)) {
-			first_r10bio = (struct r10bio *)r10bio->master_bio;
-			free_r10bio(r10bio);
-			r10bio = first_r10bio;
-		} else {
-			md_write_end(r10bio->mddev);
-			bio_endio(r10bio->master_bio);
-			free_r10bio(r10bio);
-			break;
-		}
-	}
-}
-
 static void raid10_end_discard_request(struct bio *bio)
 {
 	struct r10bio *r10_bio = bio->bi_private;
@@ -1582,7 +1560,11 @@ static void raid10_end_discard_request(struct bio *bio)
 		rdev = conf->mirrors[dev].rdev;
 	}
 
-	raid_end_discard_bio(r10_bio);
+	if (atomic_dec_and_test(&r10_bio->remaining)) {
+		md_write_end(r10_bio->mddev);
+		raid_end_bio_io(r10_bio);
+	}
+
 	rdev_dec_pending(rdev, conf->mddev);
 }
 
@@ -1595,9 +1577,7 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
 {
 	struct r10conf *conf = mddev->private;
 	struct geom *geo = &conf->geo;
-	struct r10bio *r10_bio, *first_r10bio;
-	int far_copies = geo->far_copies;
-	bool first_copy = true;
+	struct r10bio *r10_bio;
 
 	int disk;
 	sector_t chunk;
@@ -1636,20 +1616,30 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
 	if (bio_sectors(bio) < stripe_size*2)
 		goto out;
 
-	/* For far and far offset layout, if bio is not aligned with stripe size,
-	 * it splits the part that is not aligned with strip size.
+	/* For far offset layout, if bio is not aligned with stripe size, it splits
+	 * the part that is not aligned with strip size.
 	 */
 	div_u64_rem(bio_start, stripe_size, &remainder);
-	if ((far_copies > 1) && remainder) {
+	if (geo->far_offset && remainder) {
 		split_size = stripe_size - remainder;
 		bio = raid10_split_bio(conf, bio, split_size, false);
 	}
 	div_u64_rem(bio_end, stripe_size, &remainder);
-	if ((far_copies > 1) && remainder) {
+	if (geo->far_offset && remainder) {
 		split_size = bio_sectors(bio) - remainder;
 		bio = raid10_split_bio(conf, bio, split_size, true);
 	}
 
+	r10_bio = mempool_alloc(&conf->r10bio_pool, GFP_NOIO);
+	r10_bio->mddev = mddev;
+	r10_bio->state = 0;
+	r10_bio->sectors = 0;
+	memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * geo->raid_disks);
+
+	wait_blocked_dev(mddev, r10_bio);
+
+	r10_bio->master_bio = bio;
+
 	bio_start = bio->bi_iter.bi_sector;
 	bio_end = bio_end_sector(bio);
 
@@ -1675,28 +1665,6 @@ static int raid10_handle_discard(struct mddev *mddev, struct bio *bio)
 	end_disk_offset = (bio_end & geo->chunk_mask) +
 				(last_stripe_index << geo->chunk_shift);
 
-retry_discard:
-	r10_bio = mempool_alloc(&conf->r10bio_pool, GFP_NOIO);
-	r10_bio->mddev = mddev;
-	r10_bio->state = 0;
-	r10_bio->sectors = 0;
-	memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * geo->raid_disks);
-	wait_blocked_dev(mddev, r10_bio);
-
-	/* For far layout it needs more than one r10bio to cover all regions.
-	 * Inspired by raid10_sync_request, we can use the first r10bio->master_bio
-	 * to record the discard bio. Other r10bio->master_bio record the first
-	 * r10bio. The first r10bio only release after all other r10bios finish.
-	 * The discard bio returns only first r10bio finishes
-	 */
-	if (first_copy) {
-		r10_bio->master_bio = bio;
-		set_bit(R10BIO_Discard, &r10_bio->state);
-		first_copy = false;
-		first_r10bio = r10_bio;
-	} else
-		r10_bio->master_bio = (struct bio *)first_r10bio;
-
 	rcu_read_lock();
 	for (disk = 0; disk < geo->raid_disks; disk++) {
 		struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev);
@@ -1787,19 +1755,11 @@ retry_discard:
 		}
 	}
 
-	if (!geo->far_offset && --far_copies) {
-		first_stripe_index += geo->stride >> geo->chunk_shift;
-		start_disk_offset += geo->stride;
-		last_stripe_index += geo->stride >> geo->chunk_shift;
-		end_disk_offset += geo->stride;
-		atomic_inc(&first_r10bio->remaining);
-		raid_end_discard_bio(r10_bio);
-		wait_barrier(conf);
-		goto retry_discard;
+	if (atomic_dec_and_test(&r10_bio->remaining)) {
+		md_write_end(r10_bio->mddev);
+		raid_end_bio_io(r10_bio);
 	}
 
-	raid_end_discard_bio(r10_bio);
-
 	return 0;
 out:
 	allow_barrier(conf);
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 1461fd55311b..79cd2b7d3128 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -179,6 +179,5 @@ enum r10bio_state {
 	R10BIO_Previous,
 /* failfast devices did receive failfast requests. */
 	R10BIO_FailFast,
-	R10BIO_Discard,
 };
 #endif
commit e2782f560c298efc2e23c7e54b3acf54e8a6ba72
Author: Song Liu <songliubraving at fb.com>
Date:   Wed Dec 9 13:53:31 2020 -0800

    Revert "dm raid: remove unnecessary discard limits for raid10"
    
    This reverts commit f0e90b6c663a7e3b4736cb318c6c7c589f152c28.
    
    Matthew Ruffell reported data corruption in raid10 due to the changes
    in discard handling [1]. Revert these changes before we find a proper fix.
    
    [1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1907262/
    Cc: Matthew Ruffell <matthew.ruffell at canonical.com>
    Cc: Xiao Ni <xni at redhat.com>
    Cc: Mike Snitzer <snitzer at redhat.com>
    Acked-by: Mike Snitzer <snitzer at redhat.com>
    Signed-off-by: Song Liu <songliubraving at fb.com>

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 9c1f7c4de65b..dc8568ab96f2 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3728,6 +3728,17 @@ static void raid_io_hints(struct dm_target *ti, struct queue_limits *limits)
 
 	blk_limits_io_min(limits, chunk_size_bytes);
 	blk_limits_io_opt(limits, chunk_size_bytes * mddev_data_stripes(rs));
+
+	/*
+	 * RAID10 personality requires bio splitting,
+	 * RAID0/1/4/5/6 don't and process large discard bios properly.
+	 */
+	if (rs_is_raid10(rs)) {
+		limits->discard_granularity = max(chunk_size_bytes,
+						  limits->discard_granularity);
+		limits->max_discard_sectors = min_not_zero(rs->md.chunk_sectors,
+							   limits->max_discard_sectors);
+	}
 }
 
 static void raid_postsuspend(struct dm_target *ti)
commit 177745beebe39773004921d6bffd6c94c77dca32
Author: Mickey Rachamim <mickeyr at marvell.com>
Date:   Wed Dec 9 15:47:39 2020 +0200

    MAINTAINERS: Add entry for Marvell Prestera Ethernet Switch driver
    
    Add maintainers info for new Marvell Prestera Ethernet switch driver.
    
    Signed-off-by: Mickey Rachamim <mickeyr at marvell.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/MAINTAINERS b/MAINTAINERS
index ebe4829cdd4d..0381eb273944 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -10555,6 +10555,13 @@ S:	Supported
 F:	Documentation/networking/device_drivers/ethernet/marvell/octeontx2.rst
 F:	drivers/net/ethernet/marvell/octeontx2/af/
 
+MARVELL PRESTERA ETHERNET SWITCH DRIVER
+M:	Vadym Kochan <vkochan at marvell.com>
+M:	Taras Chornyi <tchornyi at marvell.com>
+S:	Supported
+W:	https://github.com/Marvell-switching/switchdev-prestera
+F:	drivers/net/ethernet/marvell/prestera/
+
 MARVELL SOC MMC/SD/SDIO CONTROLLER DRIVER
 M:	Nicolas Pitre <nico at fluxnic.net>
 S:	Odd Fixes
commit 7fdd375e383097a785bb65c66802e468f398bf82
Author: Guillaume Nault <gnault at redhat.com>
Date:   Wed Dec 9 16:48:41 2020 +0100

    net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower
    
    TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL is a u32 attribute (MPLS label is
    20 bits long).
    
    Fixes the following bug:
    
     $ tc filter add dev ethX ingress protocol mpls_uc \
         flower mpls lse depth 2 label 256             \
         action drop
    
     $ tc filter show dev ethX ingress
       filter protocol mpls_uc pref 49152 flower chain 0
       filter protocol mpls_uc pref 49152 flower chain 0 handle 0x1
         eth_type 8847
         mpls
           lse depth 2 label 0  <-- invalid label 0, should be 256
       ...
    
    Fixes: 61aec25a6db5 ("cls_flower: Support filtering on multiple MPLS Label Stack Entries")
    Signed-off-by: Guillaume Nault <gnault at redhat.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index fed18fd2c50b..1319986693fc 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -2424,8 +2424,8 @@ static int fl_dump_key_mpls_opt_lse(struct sk_buff *skb,
 			return err;
 	}
 	if (lse_mask->mpls_label) {
-		err = nla_put_u8(skb, TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL,
-				 lse_key->mpls_label);
+		err = nla_put_u32(skb, TCA_FLOWER_KEY_MPLS_OPT_LSE_LABEL,
+				  lse_key->mpls_label);
 		if (err)
 			return err;
 	}
commit c5b58c8c860db330c0b8b891b69014ee9d470dab
Author: Evan Quan <evan.quan at amd.com>
Date:   Wed Dec 9 16:34:22 2020 +0800

    drm/amd/pm: typo fix (CUSTOM -> COMPUTE)
    
    The "COMPUTE" was wrongly spelled as "CUSTOM".
    
    Signed-off-by: Evan Quan <evan.quan at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org # 5.9.x

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
index 895d89bea7fa..cf7c4f0e0a0b 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c
@@ -217,7 +217,7 @@ static struct cmn2asic_mapping sienna_cichlid_workload_map[PP_SMC_POWER_PROFILE_
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING,		WORKLOAD_PPLIB_POWER_SAVING_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO,		WORKLOAD_PPLIB_VIDEO_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR,			WORKLOAD_PPLIB_VR_BIT),
-	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_CUSTOM_BIT),
+	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE,		WORKLOAD_PPLIB_COMPUTE_BIT),
 	WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM,		WORKLOAD_PPLIB_CUSTOM_BIT),
 };
 
commit b7e4ba9a91dffd298d940b4d3f173121ff829a32
Merge: 88287773ff6f 2d94b20b95b0
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Dec 9 18:55:46 2020 -0800

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf
    
    Pablo Neira Ayuso says:
    
    ====================
    Netfilter fixes for net
    
    The following patchset contains Netfilter fixes for net:
    
    1) Switch to RCU in x_tables to fix possible NULL pointer dereference,
       from Subash Abhinov Kasiviswanathan.
    
    2) Fix netlink dump of dynset timeouts later than 23 days.
    
    3) Add comment for the indirect serialization of the nft commit mutex
       with rtnl_mutex.
    
    4) Remove bogus check for confirmed conntrack when matching on the
       conntrack ID, from Brett Mastbergen.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 88287773ff6f53c47e1902ae3ae19084ef5c69aa
Merge: 9a25a30ee54c 1beb7830d3b2
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Dec 9 18:48:29 2020 -0800

    Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
    
    Tony Nguyen says:
    
    ====================
    Intel Wired LAN Driver Updates 2020-12-09
    
    This series contains updates to igb, ixgbe, i40e, and ice drivers.
    
    Sven Auhagen fixes issues with igb XDP: return correct error value in XDP
    xmit back, increase header padding to include space for double VLAN, add
    an extack error when Rx buffer is too small for frame size, set metasize if
    it is set in xdp, change xdp_do_flush_map to xdp_do_flush, and update
    trans_start to avoid possible Tx timeout.
    
    Björn fixes an issue where an Rx buffer can be reused prematurely with
    XDP redirect for ixgbe, i40e, and ice drivers.
    
    The following are changes since commit 323a391a220c4a234cb1e678689d7f4c3b73f863:
      can: isotp: isotp_setsockopt(): block setsockopt on bound sockets
    and are available in the git repository at:
      git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 1GbE
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 80db2a087f425b63f0163bc95217abd01c637cb5
Author: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date:   Wed Dec 9 17:59:53 2020 -0800

    Input: cros_ec_keyb - send 'scancodes' in addition to key events
    
    To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE
    and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in
    addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN
    capability, so it is only matter of actually sending the events.
    
    Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com
    Acked-by: Rajat Jain <rajatja at google.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
index fc1793ca2f17..0a748aed0265 100644
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
 					"changed: [r%d c%d]: byte %02x\n",
 					row, col, new_state);
 
+				input_event(idev, EV_MSC, MSC_SCAN, pos);
 				input_report_key(idev, keycodes[pos],
 						 new_state);
 			}
commit 9a25a30ee54c61a186f3f00d9797f1cc43886167
Merge: 299bcb55ecd1 ba603d9d7b12
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Dec 9 16:44:35 2020 -0800

    Merge branch 'mlx4_en-fixes'
    
    Tariq Toukan says:
    
    ====================
    mlx4_en fixes
    
    This patchset by Moshe contains fixes to the mlx4 Eth driver,
    addressing issues in restart flow.
    
    Patch 1 protects the restart task from being rescheduled while active.
      Please queue for -stable >= v2.6.
    Patch 2 reconstructs SQs stuck in error state, and adds prints for improved
      debuggability.
      Please queue for -stable >= v3.12.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ba603d9d7b1215c72513d7c7aa02b6775fd4891b
Author: Moshe Shemesh <moshe at mellanox.com>
Date:   Wed Dec 9 15:03:39 2020 +0200

    net/mlx4_en: Handle TX error CQE
    
    In case error CQE was found while polling TX CQ, the QP is in error
    state and all posted WQEs will generate error CQEs without any data
    transmitted. Fix it by reopening the channels, via same method used for
    TX timeout handling.
    
    In addition add some more info on error CQE and WQE for debug.
    
    Fixes: bd2f631d7c60 ("net/mlx4_en: Notify user when TX ring in error state")
    Signed-off-by: Moshe Shemesh <moshe at mellanox.com>
    Signed-off-by: Tariq Toukan <tariqt at nvidia.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 1a2b0bd64aa9..6f290319b617 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1735,6 +1735,7 @@ int mlx4_en_start_port(struct net_device *dev)
 				mlx4_en_deactivate_cq(priv, cq);
 				goto tx_err;
 			}
+			clear_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &tx_ring->state);
 			if (t != TX_XDP) {
 				tx_ring->tx_queue = netdev_get_tx_queue(dev, i);
 				tx_ring->recycle_ring = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 3ddb7268e415..59b097cda327 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -392,6 +392,35 @@ int mlx4_en_free_tx_buf(struct net_device *dev, struct mlx4_en_tx_ring *ring)
 	return cnt;
 }
 
+static void mlx4_en_handle_err_cqe(struct mlx4_en_priv *priv, struct mlx4_err_cqe *err_cqe,
+				   u16 cqe_index, struct mlx4_en_tx_ring *ring)
+{
+	struct mlx4_en_dev *mdev = priv->mdev;
+	struct mlx4_en_tx_info *tx_info;
+	struct mlx4_en_tx_desc *tx_desc;
+	u16 wqe_index;
+	int desc_size;
+
+	en_err(priv, "CQE error - cqn 0x%x, ci 0x%x, vendor syndrome: 0x%x syndrome: 0x%x\n",
+	       ring->sp_cqn, cqe_index, err_cqe->vendor_err_syndrome, err_cqe->syndrome);
+	print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, err_cqe, sizeof(*err_cqe),
+		       false);
+
+	wqe_index = be16_to_cpu(err_cqe->wqe_index) & ring->size_mask;
+	tx_info = &ring->tx_info[wqe_index];
+	desc_size = tx_info->nr_txbb << LOG_TXBB_SIZE;
+	en_err(priv, "Related WQE - qpn 0x%x, wqe index 0x%x, wqe size 0x%x\n", ring->qpn,
+	       wqe_index, desc_size);
+	tx_desc = ring->buf + (wqe_index << LOG_TXBB_SIZE);
+	print_hex_dump(KERN_WARNING, "", DUMP_PREFIX_OFFSET, 16, 1, tx_desc, desc_size, false);
+
+	if (test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+		return;
+
+	en_err(priv, "Scheduling port restart\n");
+	queue_work(mdev->workqueue, &priv->restart_task);
+}
+
 int mlx4_en_process_tx_cq(struct net_device *dev,
 			  struct mlx4_en_cq *cq, int napi_budget)
 {
@@ -438,13 +467,10 @@ int mlx4_en_process_tx_cq(struct net_device *dev,
 		dma_rmb();
 
 		if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
-			     MLX4_CQE_OPCODE_ERROR)) {
-			struct mlx4_err_cqe *cqe_err = (struct mlx4_err_cqe *)cqe;
-
-			en_err(priv, "CQE error - vendor syndrome: 0x%x syndrome: 0x%x\n",
-			       cqe_err->vendor_err_syndrome,
-			       cqe_err->syndrome);
-		}
+			     MLX4_CQE_OPCODE_ERROR))
+			if (!test_and_set_bit(MLX4_EN_TX_RING_STATE_RECOVERING, &ring->state))
+				mlx4_en_handle_err_cqe(priv, (struct mlx4_err_cqe *)cqe, index,
+						       ring);
 
 		/* Skip over last polled CQE */
 		new_index = be16_to_cpu(cqe->wqe_index) & size_mask;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index fd9535bde1b8..30378e4c90b5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -271,6 +271,10 @@ struct mlx4_en_page_cache {
 	} buf[MLX4_EN_CACHE_SIZE];
 };
 
+enum {
+	MLX4_EN_TX_RING_STATE_RECOVERING,
+};
+
 struct mlx4_en_priv;
 
 struct mlx4_en_tx_ring {
@@ -317,6 +321,7 @@ struct mlx4_en_tx_ring {
 	 * Only queue_stopped might be used if BQL is not properly working.
 	 */
 	unsigned long		queue_stopped;
+	unsigned long		state;
 	struct mlx4_hwq_resources sp_wqres;
 	struct mlx4_qp		sp_qp;
 	struct mlx4_qp_context	sp_context;
commit fed91613c9dd455dd154b22fa8e11b8526466082
Author: Moshe Shemesh <moshe at mellanox.com>
Date:   Wed Dec 9 15:03:38 2020 +0200

    net/mlx4_en: Avoid scheduling restart task if it is already running
    
    Add restarting state flag to avoid scheduling another restart task while
    such task is already running. Change task name from watchdog_task to
    restart_task to better fit the task role.
    
    Fixes: 1e338db56e5a ("mlx4_en: Fix a race at restart task")
    Signed-off-by: Moshe Shemesh <moshe at mellanox.com>
    Signed-off-by: Tariq Toukan <tariqt at nvidia.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 106513f772c3..1a2b0bd64aa9 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1378,8 +1378,10 @@ static void mlx4_en_tx_timeout(struct net_device *dev, unsigned int txqueue)
 		tx_ring->cons, tx_ring->prod);
 
 	priv->port_stats.tx_timeout++;
-	en_dbg(DRV, priv, "Scheduling watchdog\n");
-	queue_work(mdev->workqueue, &priv->watchdog_task);
+	if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state)) {
+		en_dbg(DRV, priv, "Scheduling port restart\n");
+		queue_work(mdev->workqueue, &priv->restart_task);
+	}
 }
 
 
@@ -1829,6 +1831,7 @@ int mlx4_en_start_port(struct net_device *dev)
 		local_bh_enable();
 	}
 
+	clear_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state);
 	netif_tx_start_all_queues(dev);
 	netif_device_attach(dev);
 
@@ -1999,7 +2002,7 @@ void mlx4_en_stop_port(struct net_device *dev, int detach)
 static void mlx4_en_restart(struct work_struct *work)
 {
 	struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
-						 watchdog_task);
+						 restart_task);
 	struct mlx4_en_dev *mdev = priv->mdev;
 	struct net_device *dev = priv->dev;
 
@@ -2377,7 +2380,7 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
 	if (netif_running(dev)) {
 		mutex_lock(&mdev->state_lock);
 		if (!mdev->device_up) {
-			/* NIC is probably restarting - let watchdog task reset
+			/* NIC is probably restarting - let restart task reset
 			 * the port */
 			en_dbg(DRV, priv, "Change MTU called with card down!?\n");
 		} else {
@@ -2386,7 +2389,9 @@ static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
 			if (err) {
 				en_err(priv, "Failed restarting port:%d\n",
 					 priv->port);
-				queue_work(mdev->workqueue, &priv->watchdog_task);
+				if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING,
+						      &priv->state))
+					queue_work(mdev->workqueue, &priv->restart_task);
 			}
 		}
 		mutex_unlock(&mdev->state_lock);
@@ -2792,7 +2797,8 @@ static int mlx4_xdp_set(struct net_device *dev, struct bpf_prog *prog)
 		if (err) {
 			en_err(priv, "Failed starting port %d for XDP change\n",
 			       priv->port);
-			queue_work(mdev->workqueue, &priv->watchdog_task);
+			if (!test_and_set_bit(MLX4_EN_STATE_FLAG_RESTARTING, &priv->state))
+				queue_work(mdev->workqueue, &priv->restart_task);
 		}
 	}
 
@@ -3165,7 +3171,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
 	priv->counter_index = MLX4_SINK_COUNTER_INDEX(mdev->dev);
 	spin_lock_init(&priv->stats_lock);
 	INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode);
-	INIT_WORK(&priv->watchdog_task, mlx4_en_restart);
+	INIT_WORK(&priv->restart_task, mlx4_en_restart);
 	INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate);
 	INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats);
 	INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index a46efe37cfa9..fd9535bde1b8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -530,6 +530,10 @@ struct mlx4_en_stats_bitmap {
 	struct mutex mutex; /* for mutual access to stats bitmap */
 };
 
+enum {
+	MLX4_EN_STATE_FLAG_RESTARTING,
+};
+
 struct mlx4_en_priv {
 	struct mlx4_en_dev *mdev;
 	struct mlx4_en_port_profile *prof;
@@ -595,7 +599,7 @@ struct mlx4_en_priv {
 	struct mlx4_en_cq *rx_cq[MAX_RX_RINGS];
 	struct mlx4_qp drop_qp;
 	struct work_struct rx_mode_task;
-	struct work_struct watchdog_task;
+	struct work_struct restart_task;
 	struct work_struct linkstate_task;
 	struct delayed_work stats_task;
 	struct delayed_work service_task;
@@ -641,6 +645,7 @@ struct mlx4_en_priv {
 	u32 pflags;
 	u8 rss_key[MLX4_EN_RSS_KEY_SIZE];
 	u8 rss_hash_fn;
+	unsigned long state;
 };
 
 enum mlx4_en_wol {
commit 299bcb55ecd1412f6df606e9dc0912d55610029e
Author: Neal Cardwell <ncardwell at google.com>
Date:   Tue Dec 8 22:57:59 2020 -0500

    tcp: fix cwnd-limited bug for TSO deferral where we send nothing
    
    When cwnd is not a multiple of the TSO skb size of N*MSS, we can get
    into persistent scenarios where we have the following sequence:
    
    (1) ACK for full-sized skb of N*MSS arrives
      -> tcp_write_xmit() transmit full-sized skb with N*MSS
      -> move pacing release time forward
      -> exit tcp_write_xmit() because pacing time is in the future
    
    (2) TSQ callback or TCP internal pacing timer fires
      -> try to transmit next skb, but TSO deferral finds remainder of
         available cwnd is not big enough to trigger an immediate send
         now, so we defer sending until the next ACK.
    
    (3) repeat...
    
    So we can get into a case where we never mark ourselves as
    cwnd-limited for many seconds at a time, even with
    bulk/infinite-backlog senders, because:
    
    o In case (1) above, every time in tcp_write_xmit() we have enough
    cwnd to send a full-sized skb, we are not fully using the cwnd
    (because cwnd is not a multiple of the TSO skb size). So every time we
    send data, we are not cwnd limited, and so in the cwnd-limited
    tracking code in tcp_cwnd_validate() we mark ourselves as not
    cwnd-limited.
    
    o In case (2) above, every time in tcp_write_xmit() that we try to
    transmit the "remainder" of the cwnd but defer, we set the local
    variable is_cwnd_limited to true, but we do not send any packets, so
    sent_pkts is zero, so we don't call the cwnd-limited logic to update
    tp->is_cwnd_limited.
    
    Fixes: ca8a22634381 ("tcp: make cwnd-limited checks measurement-based, and gentler")
    Reported-by: Ingemar Johansson <ingemar.s.johansson at ericsson.com>
    Signed-off-by: Neal Cardwell <ncardwell at google.com>
    Signed-off-by: Yuchung Cheng <ycheng at google.com>
    Acked-by: Soheil Hassas Yeganeh <soheil at google.com>
    Signed-off-by: Eric Dumazet <edumazet at google.com>
    Link: https://lore.kernel.org/r/20201209035759.1225145-1-ncardwell.kernel@gmail.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index bf48cd73e967..99011768c264 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1880,7 +1880,8 @@ static void tcp_cwnd_validate(struct sock *sk, bool is_cwnd_limited)
 	 * window, and remember whether we were cwnd-limited then.
 	 */
 	if (!before(tp->snd_una, tp->max_packets_seq) ||
-	    tp->packets_out > tp->max_packets_out) {
+	    tp->packets_out > tp->max_packets_out ||
+	    is_cwnd_limited) {
 		tp->max_packets_out = tp->packets_out;
 		tp->max_packets_seq = tp->snd_nxt;
 		tp->is_cwnd_limited = is_cwnd_limited;
@@ -2702,6 +2703,10 @@ repair:
 	else
 		tcp_chrono_stop(sk, TCP_CHRONO_RWND_LIMITED);
 
+	is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
+	if (likely(sent_pkts || is_cwnd_limited))
+		tcp_cwnd_validate(sk, is_cwnd_limited);
+
 	if (likely(sent_pkts)) {
 		if (tcp_in_cwnd_reduction(sk))
 			tp->prr_out += sent_pkts;
@@ -2709,8 +2714,6 @@ repair:
 		/* Send one loss probe per tail loss episode. */
 		if (push_one != 2)
 			tcp_schedule_loss_probe(sk, false);
-		is_cwnd_limited |= (tcp_packets_in_flight(tp) >= tp->snd_cwnd);
-		tcp_cwnd_validate(sk, is_cwnd_limited);
 		return false;
 	}
 	return !tp->packets_out && !tcp_write_queue_empty(sk);
commit 5137d303659d8c324e67814b1cc2e1bc0c0d9836
Author: Chris Mi <cmi at nvidia.com>
Date:   Tue Dec 8 10:48:35 2020 +0800

    net: flow_offload: Fix memory leak for indirect flow block
    
    The offending commit introduces a cleanup callback that is invoked
    when the driver module is removed to clean up the tunnel device
    flow block. But it returns on the first iteration of the for loop.
    The remaining indirect flow blocks will never be freed.
    
    Fixes: 1fac52da5942 ("net: flow_offload: consolidate indirect flow_block infrastructure")
    CC: Pablo Neira Ayuso <pablo at netfilter.org>
    Signed-off-by: Chris Mi <cmi at nvidia.com>
    Reviewed-by: Roi Dayan <roid at nvidia.com>

diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c
index d4474c812b64..715b67f6c62f 100644
--- a/net/core/flow_offload.c
+++ b/net/core/flow_offload.c
@@ -381,10 +381,8 @@ static void __flow_block_indr_cleanup(void (*release)(void *cb_priv),
 
 	list_for_each_entry_safe(this, next, &flow_block_indr_list, indr.list) {
 		if (this->release == release &&
-		    this->indr.cb_priv == cb_priv) {
+		    this->indr.cb_priv == cb_priv)
 			list_move(&this->indr.list, cleanup_list);
-			return;
-		}
 	}
 }
 
commit 8ef44b6fe49d2b8d03ba9aa69063612b474f963b
Author: Wei Wang <weiwan at google.com>
Date:   Tue Dec 8 09:55:08 2020 -0800

    tcp: Retain ECT bits for tos reflection
    
    For DCTCP, we have to retain the ECT bits set by the congestion control
    algorithm on the socket when reflecting syn TOS in syn-ack, in order to
    make ECN work properly.
    
    Fixes: ac8f1710c12b ("tcp: reflect tos value received in SYN to the socket")
    Reported-by: Alexander Duyck <alexanderduyck at fb.com>
    Signed-off-by: Wei Wang <weiwan at google.com>
    Reviewed-by: Eric Dumazet <edumazet at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 8391aa29e7a4..595dcc3afac5 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -984,7 +984,8 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
 		__tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr);
 
 		tos = sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ?
-				tcp_rsk(req)->syn_tos & ~INET_ECN_MASK :
+				(tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) |
+				(inet_sk(sk)->tos & INET_ECN_MASK) :
 				inet_sk(sk)->tos;
 
 		if (!INET_ECN_is_capable(tos) &&
@@ -1541,7 +1542,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
 		inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
 	newinet->inet_id = prandom_u32();
 
-	/* Set ToS of the new socket based upon the value of incoming SYN. */
+	/* Set ToS of the new socket based upon the value of incoming SYN.
+	 * ECT bits are set later in tcp_init_transfer().
+	 */
 	if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)
 		newinet->tos = tcp_rsk(req)->syn_tos & ~INET_ECN_MASK;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 992cbf3eb9e3..991dc36f95ff 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -528,7 +528,8 @@ static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
 			fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 
 		tclass = sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ?
-				tcp_rsk(req)->syn_tos & ~INET_ECN_MASK :
+				(tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) |
+				(np->tclass & INET_ECN_MASK) :
 				np->tclass;
 
 		if (!INET_ECN_is_capable(tclass) &&
@@ -1320,7 +1321,9 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
 	if (np->repflow)
 		newnp->flow_label = ip6_flowlabel(ipv6_hdr(skb));
 
-	/* Set ToS of the new socket based upon the value of incoming SYN. */
+	/* Set ToS of the new socket based upon the value of incoming SYN.
+	 * ECT bits are set later in tcp_init_transfer().
+	 */
 	if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)
 		newnp->tclass = tcp_rsk(req)->syn_tos & ~INET_ECN_MASK;
 
commit a770bf515613c6e12ae904c3593e26016de99448
Author: Michal Kubecek <mkubecek at suse.cz>
Date:   Tue Dec 8 23:13:51 2020 +0100

    ethtool: fix stack overflow in ethnl_parse_bitset()
    
    Syzbot reported a stack overflow in bitmap_from_arr32() called from
    ethnl_parse_bitset() when bitset from netlink message is longer than
    target bitmap length. While ethnl_compact_sanity_checks() makes sure that
    trailing part is all zeros (i.e. the request does not try to touch bits
    kernel does not recognize), we also need to cap change_bits to nbits so
    that we don't try to write past the prepared bitmaps.
    
    Fixes: 88db6d1e4f62 ("ethtool: add ethnl_parse_bitset() helper")
    Reported-by: syzbot+9d39fa49d4df294aab93 at syzkaller.appspotmail.com
    Signed-off-by: Michal Kubecek <mkubecek at suse.cz>
    Link: https://lore.kernel.org/r/3487ee3a98e14cd526f55b6caaa959d2dcbcad9f.1607465316.git.mkubecek@suse.cz
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/net/ethtool/bitset.c b/net/ethtool/bitset.c
index 1fb3603d92ad..0515d6604b3b 100644
--- a/net/ethtool/bitset.c
+++ b/net/ethtool/bitset.c
@@ -628,6 +628,8 @@ int ethnl_parse_bitset(unsigned long *val, unsigned long *mask,
 			return ret;
 
 		change_bits = nla_get_u32(tb[ETHTOOL_A_BITSET_SIZE]);
+		if (change_bits > nbits)
+			change_bits = nbits;
 		bitmap_from_arr32(val, nla_data(tb[ETHTOOL_A_BITSET_VALUE]),
 				  change_bits);
 		if (change_bits < nbits)
commit a379b01cd4b2aa3f12786b281a714871574e5ccb
Author: Vitaly Lifshits <vitaly.lifshits at intel.com>
Date:   Tue Dec 8 12:56:32 2020 -0600

    e1000e: fix S0ix flow to allow S0i3.2 subset entry
    
    Changed a configuration in the flows to align with
    architecture requirements to achieve S0i3.2 substate.
    
    This helps both i219V and i219LM configurations.
    
    Also fixed a typo in the previous commit 632fbd5eb5b0
    ("e1000e: fix S0ix flows for cable connected case").
    
    Fixes: 632fbd5eb5b0 ("e1000e: fix S0ix flows for cable connected case").
    Signed-off-by: Vitaly Lifshits <vitaly.lifshits at intel.com>
    Tested-by: Aaron Brown <aaron.f.brown at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>
    Reviewed-by: Alexander Duyck <alexanderduyck at fb.com>
    Signed-off-by: Mario Limonciello <mario.limonciello at dell.com>
    Link: https://lore.kernel.org/r/20201208185632.151052-1-mario.limonciello@dell.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index b30f00891c03..128ab6898070 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6475,13 +6475,13 @@ static void e1000e_s0ix_entry_flow(struct e1000_adapter *adapter)
 
 	/* Ungate PGCB clock */
 	mac_data = er32(FEXTNVM9);
-	mac_data |= BIT(28);
+	mac_data &= ~BIT(28);
 	ew32(FEXTNVM9, mac_data);
 
 	/* Enable K1 off to enable mPHY Power Gating */
 	mac_data = er32(FEXTNVM6);
 	mac_data |= BIT(31);
-	ew32(FEXTNVM12, mac_data);
+	ew32(FEXTNVM6, mac_data);
 
 	/* Enable mPHY power gating for any link and speed */
 	mac_data = er32(FEXTNVM8);
@@ -6525,11 +6525,11 @@ static void e1000e_s0ix_exit_flow(struct e1000_adapter *adapter)
 	/* Disable K1 off */
 	mac_data = er32(FEXTNVM6);
 	mac_data &= ~BIT(31);
-	ew32(FEXTNVM12, mac_data);
+	ew32(FEXTNVM6, mac_data);
 
 	/* Disable Ungate PGCB clock */
 	mac_data = er32(FEXTNVM9);
-	mac_data &= ~BIT(28);
+	mac_data |= BIT(28);
 	ew32(FEXTNVM9, mac_data);
 
 	/* Cancel not waking from dynamic
commit 1beb7830d3b285b28f7cde3644d59d2590a47e51
Author: Björn Töpel <bjorn.topel at intel.com>
Date:   Tue Aug 25 19:27:36 2020 +0200

    ice: avoid premature Rx buffer reuse
    
    The page recycle code, incorrectly, relied on that a page fragment
    could not be freed inside xdp_do_redirect(). This assumption leads to
    that page fragments that are used by the stack/XDP redirect can be
    reused and overwritten.
    
    To avoid this, store the page count prior invoking xdp_do_redirect().
    
    Fixes: efc2214b6047 ("ice: Add support for XDP")
    Reported-and-analyzed-by: Li RongQing <lirongqing at baidu.com>
    Signed-off-by: Björn Töpel <bjorn.topel at intel.com>
    Tested-by: George Kuruvinakunnel <george.kuruvinakunnel at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index eae75260fe20..23eca2f0a03b 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -762,13 +762,15 @@ ice_rx_buf_adjust_pg_offset(struct ice_rx_buf *rx_buf, unsigned int size)
 /**
  * ice_can_reuse_rx_page - Determine if page can be reused for another Rx
  * @rx_buf: buffer containing the page
+ * @rx_buf_pgcnt: rx_buf page refcount pre xdp_do_redirect() call
  *
  * If page is reusable, we have a green light for calling ice_reuse_rx_page,
  * which will assign the current buffer to the buffer that next_to_alloc is
  * pointing to; otherwise, the DMA mapping needs to be destroyed and
  * page freed
  */
-static bool ice_can_reuse_rx_page(struct ice_rx_buf *rx_buf)
+static bool
+ice_can_reuse_rx_page(struct ice_rx_buf *rx_buf, int rx_buf_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buf->pagecnt_bias;
 	struct page *page = rx_buf->page;
@@ -779,7 +781,7 @@ static bool ice_can_reuse_rx_page(struct ice_rx_buf *rx_buf)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buf_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 #define ICE_LAST_OFFSET \
@@ -864,17 +866,24 @@ ice_reuse_rx_page(struct ice_ring *rx_ring, struct ice_rx_buf *old_buf)
  * @rx_ring: Rx descriptor ring to transact packets on
  * @skb: skb to be used
  * @size: size of buffer to add to skb
+ * @rx_buf_pgcnt: rx_buf page refcount
  *
  * This function will pull an Rx buffer from the ring and synchronize it
  * for use by the CPU.
  */
 static struct ice_rx_buf *
 ice_get_rx_buf(struct ice_ring *rx_ring, struct sk_buff **skb,
-	       const unsigned int size)
+	       const unsigned int size, int *rx_buf_pgcnt)
 {
 	struct ice_rx_buf *rx_buf;
 
 	rx_buf = &rx_ring->rx_buf[rx_ring->next_to_clean];
+	*rx_buf_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buf->page);
+#else
+		0;
+#endif
 	prefetchw(rx_buf->page);
 	*skb = rx_buf->skb;
 
@@ -1006,12 +1015,15 @@ ice_construct_skb(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf,
  * ice_put_rx_buf - Clean up used buffer and either recycle or free
  * @rx_ring: Rx descriptor ring to transact packets on
  * @rx_buf: Rx buffer to pull data from
+ * @rx_buf_pgcnt: Rx buffer page count pre xdp_do_redirect()
  *
  * This function will update next_to_clean and then clean up the contents
  * of the rx_buf. It will either recycle the buffer or unmap it and free
  * the associated resources.
  */
-static void ice_put_rx_buf(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf)
+static void
+ice_put_rx_buf(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf,
+	       int rx_buf_pgcnt)
 {
 	u16 ntc = rx_ring->next_to_clean + 1;
 
@@ -1022,7 +1034,7 @@ static void ice_put_rx_buf(struct ice_ring *rx_ring, struct ice_rx_buf *rx_buf)
 	if (!rx_buf)
 		return;
 
-	if (ice_can_reuse_rx_page(rx_buf)) {
+	if (ice_can_reuse_rx_page(rx_buf, rx_buf_pgcnt)) {
 		/* hand second half of page back to the ring */
 		ice_reuse_rx_page(rx_ring, rx_buf);
 	} else {
@@ -1097,6 +1109,7 @@ int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
 		struct sk_buff *skb;
 		unsigned int size;
 		u16 stat_err_bits;
+		int rx_buf_pgcnt;
 		u16 vlan_tag = 0;
 		u8 rx_ptype;
 
@@ -1119,7 +1132,7 @@ int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
 		dma_rmb();
 
 		if (rx_desc->wb.rxdid == FDIR_DESC_RXDID || !rx_ring->netdev) {
-			ice_put_rx_buf(rx_ring, NULL);
+			ice_put_rx_buf(rx_ring, NULL, 0);
 			cleaned_count++;
 			continue;
 		}
@@ -1128,7 +1141,7 @@ int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
 			ICE_RX_FLX_DESC_PKT_LEN_M;
 
 		/* retrieve a buffer from the ring */
-		rx_buf = ice_get_rx_buf(rx_ring, &skb, size);
+		rx_buf = ice_get_rx_buf(rx_ring, &skb, size, &rx_buf_pgcnt);
 
 		if (!size) {
 			xdp.data = NULL;
@@ -1168,7 +1181,7 @@ int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
 		total_rx_pkts++;
 
 		cleaned_count++;
-		ice_put_rx_buf(rx_ring, rx_buf);
+		ice_put_rx_buf(rx_ring, rx_buf, rx_buf_pgcnt);
 		continue;
 construct_skb:
 		if (skb) {
@@ -1187,7 +1200,7 @@ construct_skb:
 			break;
 		}
 
-		ice_put_rx_buf(rx_ring, rx_buf);
+		ice_put_rx_buf(rx_ring, rx_buf, rx_buf_pgcnt);
 		cleaned_count++;
 
 		/* skip if it is NOP desc */
commit a06316dc87bdc000f7f39a315476957af2ba0f05
Author: Björn Töpel <bjorn.topel at intel.com>
Date:   Tue Aug 25 19:27:35 2020 +0200

    ixgbe: avoid premature Rx buffer reuse
    
    The page recycle code, incorrectly, relied on that a page fragment
    could not be freed inside xdp_do_redirect(). This assumption leads to
    that page fragments that are used by the stack/XDP redirect can be
    reused and overwritten.
    
    To avoid this, store the page count prior invoking xdp_do_redirect().
    
    Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect")
    Reported-and-analyzed-by: Li RongQing <lirongqing at baidu.com>
    Signed-off-by: Björn Töpel <bjorn.topel at intel.com>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 45ae33e15303..f3f449f53920 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1945,7 +1945,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page)
 	return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page);
 }
 
-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
+static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer,
+				    int rx_buffer_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
 	struct page *page = rx_buffer->page;
@@ -1956,7 +1957,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_ref_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 	/* The last offset is a bit aggressive in that we assume the
@@ -2021,11 +2022,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring,
 static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring,
 						   union ixgbe_adv_rx_desc *rx_desc,
 						   struct sk_buff **skb,
-						   const unsigned int size)
+						   const unsigned int size,
+						   int *rx_buffer_pgcnt)
 {
 	struct ixgbe_rx_buffer *rx_buffer;
 
 	rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
+	*rx_buffer_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buffer->page);
+#else
+		0;
+#endif
 	prefetchw(rx_buffer->page);
 	*skb = rx_buffer->skb;
 
@@ -2055,9 +2063,10 @@ skip_sync:
 
 static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring,
 				struct ixgbe_rx_buffer *rx_buffer,
-				struct sk_buff *skb)
+				struct sk_buff *skb,
+				int rx_buffer_pgcnt)
 {
-	if (ixgbe_can_reuse_rx_page(rx_buffer)) {
+	if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
 		/* hand second half of page back to the ring */
 		ixgbe_reuse_rx_page(rx_ring, rx_buffer);
 	} else {
@@ -2303,6 +2312,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		union ixgbe_adv_rx_desc *rx_desc;
 		struct ixgbe_rx_buffer *rx_buffer;
 		struct sk_buff *skb;
+		int rx_buffer_pgcnt;
 		unsigned int size;
 
 		/* return some buffers to hardware, one at a time is too slow */
@@ -2322,7 +2332,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 		 */
 		dma_rmb();
 
-		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size);
+		rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt);
 
 		/* retrieve a buffer from the ring */
 		if (!skb) {
@@ -2367,7 +2377,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
 			break;
 		}
 
-		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb);
+		ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt);
 		cleaned_count++;
 
 		/* place incomplete frames back on ring for completion */
commit 75aab4e10ae6a4593a60f66d13de755d4e91f400
Author: Björn Töpel <bjorn.topel at intel.com>
Date:   Tue Aug 25 19:27:34 2020 +0200

    i40e: avoid premature Rx buffer reuse
    
    The page recycle code, incorrectly, relied on that a page fragment
    could not be freed inside xdp_do_redirect(). This assumption leads to
    that page fragments that are used by the stack/XDP redirect can be
    reused and overwritten.
    
    To avoid this, store the page count prior invoking xdp_do_redirect().
    
    Longer explanation:
    
    Intel NICs have a recycle mechanism. The main idea is that a page is
    split into two parts. One part is owned by the driver, one part might
    be owned by someone else, such as the stack.
    
    t0: Page is allocated, and put on the Rx ring
                  +---------------
    used by NIC ->| upper buffer
    (rx_buffer)   +---------------
                  | lower buffer
                  +---------------
      page count  == USHRT_MAX
      rx_buffer->pagecnt_bias == USHRT_MAX
    
    t1: Buffer is received, and passed to the stack (e.g.)
                  +---------------
                  | upper buff (skb)
                  +---------------
    used by NIC ->| lower buffer
    (rx_buffer)   +---------------
      page count  == USHRT_MAX
      rx_buffer->pagecnt_bias == USHRT_MAX - 1
    
    t2: Buffer is received, and redirected
                  +---------------
                  | upper buff (skb)
                  +---------------
    used by NIC ->| lower buffer
    (rx_buffer)   +---------------
    
    Now, prior calling xdp_do_redirect():
      page count  == USHRT_MAX
      rx_buffer->pagecnt_bias == USHRT_MAX - 2
    
    This means that buffer *cannot* be flipped/reused, because the skb is
    still using it.
    
    The problem arises when xdp_do_redirect() actually frees the
    segment. Then we get:
      page count  == USHRT_MAX - 1
      rx_buffer->pagecnt_bias == USHRT_MAX - 2
    
    From a recycle perspective, the buffer can be flipped and reused,
    which means that the skb data area is passed to the Rx HW ring!
    
    To work around this, the page count is stored prior calling
    xdp_do_redirect().
    
    Note that this is not optimal, since the NIC could actually reuse the
    "lower buffer" again. However, then we need to track whether
    XDP_REDIRECT consumed the buffer or not.
    
    Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT")
    Reported-and-analyzed-by: Li RongQing <lirongqing at baidu.com>
    Signed-off-by: Björn Töpel <bjorn.topel at intel.com>
    Tested-by: George Kuruvinakunnel <george.kuruvinakunnel at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index d43ce13a93c9..3f5825fa67c9 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -1850,6 +1850,7 @@ static inline bool i40e_page_is_reusable(struct page *page)
  * the adapter for another receive
  *
  * @rx_buffer: buffer containing the page
+ * @rx_buffer_pgcnt: buffer page refcount pre xdp_do_redirect() call
  *
  * If page is reusable, rx_buffer->page_offset is adjusted to point to
  * an unused region in the page.
@@ -1872,7 +1873,8 @@ static inline bool i40e_page_is_reusable(struct page *page)
  *
  * In either case, if the page is reusable its refcount is increased.
  **/
-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
+static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer,
+				   int rx_buffer_pgcnt)
 {
 	unsigned int pagecnt_bias = rx_buffer->pagecnt_bias;
 	struct page *page = rx_buffer->page;
@@ -1883,7 +1885,7 @@ static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer)
 
 #if (PAGE_SIZE < 8192)
 	/* if we are only owner of page we can reuse it */
-	if (unlikely((page_count(page) - pagecnt_bias) > 1))
+	if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1))
 		return false;
 #else
 #define I40E_LAST_OFFSET \
@@ -1942,16 +1944,24 @@ static void i40e_add_rx_frag(struct i40e_ring *rx_ring,
  * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use
  * @rx_ring: rx descriptor ring to transact packets on
  * @size: size of buffer to add to skb
+ * @rx_buffer_pgcnt: buffer page refcount
  *
  * This function will pull an Rx buffer from the ring and synchronize it
  * for use by the CPU.
  */
 static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring,
-						 const unsigned int size)
+						 const unsigned int size,
+						 int *rx_buffer_pgcnt)
 {
 	struct i40e_rx_buffer *rx_buffer;
 
 	rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean);
+	*rx_buffer_pgcnt =
+#if (PAGE_SIZE < 8192)
+		page_count(rx_buffer->page);
+#else
+		0;
+#endif
 	prefetch_page_address(rx_buffer->page);
 
 	/* we are reusing so sync this buffer for CPU use */
@@ -2102,14 +2112,16 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring,
  * i40e_put_rx_buffer - Clean up used buffer and either recycle or free
  * @rx_ring: rx descriptor ring to transact packets on
  * @rx_buffer: rx buffer to pull data from
+ * @rx_buffer_pgcnt: rx buffer page refcount pre xdp_do_redirect() call
  *
  * This function will clean up the contents of the rx_buffer.  It will
  * either recycle the buffer or unmap it and free the associated resources.
  */
 static void i40e_put_rx_buffer(struct i40e_ring *rx_ring,
-			       struct i40e_rx_buffer *rx_buffer)
+			       struct i40e_rx_buffer *rx_buffer,
+			       int rx_buffer_pgcnt)
 {
-	if (i40e_can_reuse_rx_page(rx_buffer)) {
+	if (i40e_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) {
 		/* hand second half of page back to the ring */
 		i40e_reuse_rx_page(rx_ring, rx_buffer);
 	} else {
@@ -2336,6 +2348,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 	while (likely(total_rx_packets < (unsigned int)budget)) {
 		struct i40e_rx_buffer *rx_buffer;
 		union i40e_rx_desc *rx_desc;
+		int rx_buffer_pgcnt;
 		unsigned int size;
 		u64 qword;
 
@@ -2378,7 +2391,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 			break;
 
 		i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb);
-		rx_buffer = i40e_get_rx_buffer(rx_ring, size);
+		rx_buffer = i40e_get_rx_buffer(rx_ring, size, &rx_buffer_pgcnt);
 
 		/* retrieve a buffer from the ring */
 		if (!skb) {
@@ -2421,7 +2434,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget)
 			break;
 		}
 
-		i40e_put_rx_buffer(rx_ring, rx_buffer);
+		i40e_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
 		cleaned_count++;
 
 		if (i40e_is_non_eop(rx_ring, rx_desc, skb))
commit ec107e775d84392b35db46f6c3baa441e074042e
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:53 2020 +0100

    igb: avoid transmit queue timeout in xdp path
    
    Since we share the transmit queue with the network stack,
    it is possible that we run into a transmit queue timeout.
    This will reset the queue.
    This happens under high load when XDP is using the
    transmit queue pretty much exclusively.
    
    netdev_start_xmit() sets the trans_start variable of the
    transmit queue to jiffies which is later utilized by dev_watchdog(),
    so to avoid timeout, let stack know that XDP xmit happened by
    bumping the trans_start within XDP Tx routines to jiffies.
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index af6ace6c0f87..0d343d050973 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2919,6 +2919,8 @@ static int igb_xdp_xmit_back(struct igb_adapter *adapter, struct xdp_buff *xdp)
 
 	nq = txring_txq(tx_ring);
 	__netif_tx_lock(nq, cpu);
+	/* Avoid transmit queue timeout since we share it with the slow path */
+	nq->trans_start = jiffies;
 	ret = igb_xmit_xdp_ring(adapter, tx_ring, xdpf);
 	__netif_tx_unlock(nq);
 
@@ -2951,6 +2953,9 @@ static int igb_xdp_xmit(struct net_device *dev, int n,
 	nq = txring_txq(tx_ring);
 	__netif_tx_lock(nq, cpu);
 
+	/* Avoid transmit queue timeout since we share it with the slow path */
+	nq->trans_start = jiffies;
+
 	for (i = 0; i < n; i++) {
 		struct xdp_frame *xdpf = frames[i];
 		int err;
commit 3eca859008a75a4ad363db65b0fe83be1a3d5ad1
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:52 2020 +0100

    igb: use xdp_do_flush
    
    Since it is a new XDP implementation change xdp_do_flush_map
    to xdp_do_flush.
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Suggested-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 8e412aaba0e3..af6ace6c0f87 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8781,7 +8781,7 @@ static int igb_clean_rx_irq(struct igb_q_vector *q_vector, const int budget)
 	rx_ring->skb = skb;
 
 	if (xdp_xmit & IGB_XDP_REDIR)
-		xdp_do_flush_map();
+		xdp_do_flush();
 
 	if (xdp_xmit & IGB_XDP_TX) {
 		struct igb_ring *tx_ring = igb_xdp_tx_queue_mapping(adapter);
commit 681429dba99249546dda160e266e56035a2d750b
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:51 2020 +0100

    igb: skb add metasize for xdp
    
    add metasize if it is set in xdp
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Suggested-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a0a310a75cc5..8e412aaba0e3 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8357,6 +8357,7 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring,
 				SKB_DATA_ALIGN(xdp->data_end -
 					       xdp->data_hard_start);
 #endif
+	unsigned int metasize = xdp->data - xdp->data_meta;
 	struct sk_buff *skb;
 
 	/* prefetch first cache line of first page */
@@ -8371,6 +8372,9 @@ static struct sk_buff *igb_build_skb(struct igb_ring *rx_ring,
 	skb_reserve(skb, xdp->data - xdp->data_hard_start);
 	__skb_put(skb, xdp->data_end - xdp->data);
 
+	if (metasize)
+		skb_metadata_set(skb, metasize);
+
 	/* pull timestamp out of packet data */
 	if (igb_test_staterr(rx_desc, E1000_RXDADV_STAT_TSIP)) {
 		igb_ptp_rx_pktstamp(rx_ring->q_vector, skb->data, skb);
commit 2e2bb5594ca0a5885dc93055ab0f9b5fbcdaa403
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:50 2020 +0100

    igb: XDP extack message on error
    
    Add an extack error message when the RX buffer size is too small
    for the frame size.
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Suggested-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 0a9198037b98..a0a310a75cc5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2824,20 +2824,25 @@ static int igb_setup_tc(struct net_device *dev, enum tc_setup_type type,
 	}
 }
 
-static int igb_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
+static int igb_xdp_setup(struct net_device *dev, struct netdev_bpf *bpf)
 {
 	int i, frame_size = dev->mtu + IGB_ETH_PKT_HDR_PAD;
 	struct igb_adapter *adapter = netdev_priv(dev);
+	struct bpf_prog *prog = bpf->prog, *old_prog;
 	bool running = netif_running(dev);
-	struct bpf_prog *old_prog;
 	bool need_reset;
 
 	/* verify igb ring attributes are sufficient for XDP */
 	for (i = 0; i < adapter->num_rx_queues; i++) {
 		struct igb_ring *ring = adapter->rx_ring[i];
 
-		if (frame_size > igb_rx_bufsz(ring))
+		if (frame_size > igb_rx_bufsz(ring)) {
+			NL_SET_ERR_MSG_MOD(bpf->extack,
+					   "The RX buffer size is too small for the frame size");
+			netdev_warn(dev, "XDP RX buffer size %d is too small for the frame size %d\n",
+				    igb_rx_bufsz(ring), frame_size);
 			return -EINVAL;
+		}
 	}
 
 	old_prog = xchg(&adapter->xdp_prog, prog);
@@ -2869,7 +2874,7 @@ static int igb_xdp(struct net_device *dev, struct netdev_bpf *xdp)
 {
 	switch (xdp->command) {
 	case XDP_SETUP_PROG:
-		return igb_xdp_setup(dev, xdp->prog);
+		return igb_xdp_setup(dev, xdp);
 	default:
 		return -EINVAL;
 	}
@@ -6499,7 +6504,9 @@ static int igb_change_mtu(struct net_device *netdev, int new_mtu)
 			struct igb_ring *ring = adapter->rx_ring[i];
 
 			if (max_frame > igb_rx_bufsz(ring)) {
-				netdev_warn(adapter->netdev, "Requested MTU size is not supported with XDP\n");
+				netdev_warn(adapter->netdev,
+					    "Requested MTU size is not supported with XDP. Max frame size is %d\n",
+					    max_frame);
 				return -EINVAL;
 			}
 		}
commit b829ec1a66bc3dda4b01ab4c57d41ad1a1f82fed
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:49 2020 +0100

    igb: take VLAN double header into account
    
    Increase the packet header padding to include double VLAN tagging.
    This patch uses a macro for this.
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Suggested-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index 0286d2fceee4..aaa954aae574 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -138,6 +138,8 @@ struct vf_mac_filter {
 /* this is the size past which hardware will drop packets when setting LPE=0 */
 #define MAXIMUM_ETHERNET_VLAN_SIZE 1522
 
+#define IGB_ETH_PKT_HDR_PAD	(ETH_HLEN + ETH_FCS_LEN + (VLAN_HLEN * 2))
+
 /* Supported Rx Buffer Sizes */
 #define IGB_RXBUFFER_256	256
 #define IGB_RXBUFFER_1536	1536
@@ -247,6 +249,9 @@ enum igb_tx_flags {
 #define IGB_SFF_ADDRESSING_MODE		0x4
 #define IGB_SFF_8472_UNSUP		0x00
 
+/* TX resources are shared between XDP and netstack
+ * and we need to tag the buffer type to distinguish them
+ */
 enum igb_tx_buf_type {
 	IGB_TYPE_SKB = 0,
 	IGB_TYPE_XDP,
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 08cc6f59aa2e..0a9198037b98 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2826,7 +2826,7 @@ static int igb_setup_tc(struct net_device *dev, enum tc_setup_type type,
 
 static int igb_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
 {
-	int i, frame_size = dev->mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
+	int i, frame_size = dev->mtu + IGB_ETH_PKT_HDR_PAD;
 	struct igb_adapter *adapter = netdev_priv(dev);
 	bool running = netif_running(dev);
 	struct bpf_prog *old_prog;
@@ -3950,8 +3950,7 @@ static int igb_sw_init(struct igb_adapter *adapter)
 	/* set default work limits */
 	adapter->tx_work_limit = IGB_DEFAULT_TX_WORK;
 
-	adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN +
-				  VLAN_HLEN;
+	adapter->max_frame_size = netdev->mtu + IGB_ETH_PKT_HDR_PAD;
 	adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
 
 	spin_lock_init(&adapter->nfc_lock);
@@ -6491,7 +6490,7 @@ static void igb_get_stats64(struct net_device *netdev,
 static int igb_change_mtu(struct net_device *netdev, int new_mtu)
 {
 	struct igb_adapter *adapter = netdev_priv(netdev);
-	int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
+	int max_frame = new_mtu + IGB_ETH_PKT_HDR_PAD;
 
 	if (adapter->xdp_prog) {
 		int i;
commit cfb33e174fa25d9d830683a1e1b22850546103b5
Author: Sven Auhagen <sven.auhagen at voleatech.de>
Date:   Wed Nov 11 18:04:48 2020 +0100

    igb: XDP xmit back fix error code
    
    The igb XDP xmit back function should only return
    defined error codes.
    
    Fixes: 9cbc948b5a20 ("igb: add XDP support")
    Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
    Acked-by: Maciej Fijalkowski <maciej.fijalkowski at intel.com>
    Signed-off-by: Sven Auhagen <sven.auhagen at voleatech.de>
    Tested-by: Sandeep Penigalapati <sandeep.penigalapati at intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen at intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 5fc2c381da55..08cc6f59aa2e 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -2910,7 +2910,7 @@ static int igb_xdp_xmit_back(struct igb_adapter *adapter, struct xdp_buff *xdp)
 	 */
 	tx_ring = adapter->xdp_prog ? igb_xdp_tx_queue_mapping(adapter) : NULL;
 	if (unlikely(!tx_ring))
-		return -ENXIO;
+		return IGB_XDP_CONSUMED;
 
 	nq = txring_txq(tx_ring);
 	__netif_tx_lock(nq, cpu);
commit a2f5ea9e314ba6778f885c805c921e9362ec0420
Merge: ca4bbdaf1716 69fe24d1d80f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Dec 9 14:49:48 2020 -0800

    Merge tag 'arm-soc-fixes-v5.10-4b' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
    
    Pull ARM SoC fixes from Arnd Bergmann:
     "There are a few more PHY mode changes for allwinner SoC based boards
      with a Realtek PHY after the driver changed its behavior, I assume
      there will be more of these in the future. Also on for Allwinner, the
      Banana Pi M2 board had a regression that led to some devices not
      working because of a slightly incorrect voltage being applied.
    
      By popular demand, I picked up a change from Krzysztof Kozlowski to
      actually list the SoC tree in the MAINTAINERS file. We don't want to
      get Cc'd on normal patches that are picked up by platform maintainers,
      but the lack of an entry has led to confusion in the past.
    
      All the other changes are fairly benign, fixing boot-time or
      compile-time warning messages in various places:
    
       - A dtc warning on the OLPC XO-1.75
    
       - A boot-time warning on i.MX6 wandboard
    
       - A harmless compile-time warning
    
       - A regression causing one of the i.MX6 SoCs to be identified as
         another
    
       - Missing SoC identification of Allwinner V3 and S3"
    
    * tag 'arm-soc-fixes-v5.10-4b' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
      firmware: xilinx: Mark pm_api_features_map with static keyword
      ARM: dts: mmp2-olpc-xo-1-75: clear the warnings when make dtbs
      MAINTAINERS: add a limited ARM and ARM64 SoC entry
      MAINTAINERS: correct SoC Git address (formerly: arm-soc)
      ARM: keystone: remove SECTION_SIZE_BITS/MAX_PHYSMEM_BITS
      arm64: dts: allwinner: H5: NanoPi Neo Plus2: phy-mode rgmii-id
      arm64: dts: allwinner: A64 Sopine: phy-mode rgmii-id
      ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin
      ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp
      ARM: imx: Use correct SRC base address
      ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY
      ARM: dts: sun8i: v3s: fix GIC node memory range
      ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node
      ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator
      ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY
      ARM: dts: s3: pinecube: align compatible property to other S3 boards
      ARM: sunxi: Add machine match for the Allwinner V3 SoC
      arm64: dts: allwinner: h6: orangepi-one-plus: Fix ethernet

commit c02bd115b1d25931159f89c7d9bf47a30f5d4b41
Author: Jakub Kicinski <kuba at kernel.org>
Date:   Wed Dec 9 14:39:56 2020 -0800

    Revert "geneve: pull IP header before ECN decapsulation"
    
    This reverts commit 4179b00c04d1 ("geneve: pull IP header before ECN decapsulation").
    
    Eric says: "network header should have been pulled already before
    hitting geneve_rx()". Let's revert the syzbot fix since it's causing
    more harm than good, and revisit.
    
    Suggested-by: Eric Dumazet <edumazet at google.com>
    Reported-by: Jianlin Shi <jishi at redhat.com>
    Fixes: 4179b00c04d1 ("geneve: pull IP header before ECN decapsulation")
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=210569
    Link: https://lore.kernel.org/netdev/CANn89iJVWfb=2i7oU1=D55rOyQnBbbikf+Mc6XHMkY7YX-yGEw@mail.gmail.com/
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 8ae9ce2014a4..1426bfc009bc 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -257,21 +257,11 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
 		skb_dst_set(skb, &tun_dst->dst);
 
 	/* Ignore packet loops (and multicast echo) */
-	if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr))
-		goto rx_error;
-
-	switch (skb_protocol(skb, true)) {
-	case htons(ETH_P_IP):
-		if (pskb_may_pull(skb, sizeof(struct iphdr)))
-			goto rx_error;
-		break;
-	case htons(ETH_P_IPV6):
-		if (pskb_may_pull(skb, sizeof(struct ipv6hdr)))
-			goto rx_error;
-		break;
-	default:
-		goto rx_error;
+	if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) {
+		geneve->dev->stats.rx_errors++;
+		goto drop;
 	}
+
 	oiph = skb_network_header(skb);
 	skb_reset_network_header(skb);
 
@@ -308,8 +298,6 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
 		dev_sw_netstats_rx_add(geneve->dev, len);
 
 	return;
-rx_error:
-	geneve->dev->stats.rx_errors++;
 drop:
 	/* Consume bad packet */
 	kfree_skb(skb);
commit 69fe24d1d80feac4289778582cf0a15256d59baf
Author: Zou Wei <zou_wei at huawei.com>
Date:   Tue Dec 1 19:51:53 2020 +0800

    firmware: xilinx: Mark pm_api_features_map with static keyword
    
    Fix the following sparse warning:
    
    drivers/firmware/xilinx/zynqmp.c:32:1: warning: symbol 'pm_api_features_map' was not declared. Should it be static?
    
    Signed-off-by: Zou Wei <zou_wei at huawei.com>
    Link: https://lore.kernel.org/r/1606823513-121578-1-git-send-email-zou_wei@huawei.com
    Signed-off-by: Michal Simek <michal.simek at xilinx.com>
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zynqmp.c
index d08ac824c993..fd95edeb702b 100644
--- a/drivers/firmware/xilinx/zynqmp.c
+++ b/drivers/firmware/xilinx/zynqmp.c
@@ -29,7 +29,7 @@
 #define PM_API_FEATURE_CHECK_MAX_ORDER  7
 
 static bool feature_check_enabled;
-DEFINE_HASHTABLE(pm_api_features_map, PM_API_FEATURE_CHECK_MAX_ORDER);
+static DEFINE_HASHTABLE(pm_api_features_map, PM_API_FEATURE_CHECK_MAX_ORDER);
 
 /**
  * struct pm_api_feature_data - PM API Feature data
commit 387270cb0b4035491c4812effd8b5af0e385a66c
Author: Zhen Lei <thunder.leizhen at huawei.com>
Date:   Mon Dec 7 16:47:52 2020 +0800

    ARM: dts: mmp2-olpc-xo-1-75: clear the warnings when make dtbs
    
    The check_spi_bus_bridge() in scripts/dtc/checks.c requires that the node
    have "spi-slave" property must with "#address-cells = <0>" and
    "#size-cells = <0>". But currently both "#address-cells" and "#size-cells"
    properties are deleted, the corresponding default values are 2 and 1. As a
    result, the check fails and below warnings is displayed.
    
    arch/arm/boot/dts/mmp2.dtsi:472.23-480.6: Warning (spi_bus_bridge): \
    /soc/apb at d4000000/spi at d4037000: incorrect #address-cells for SPI bus
      also defined at arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts:225.7-237.3
    arch/arm/boot/dts/mmp2.dtsi:472.23-480.6: Warning (spi_bus_bridge): \
    /soc/apb at d4000000/spi at d4037000: incorrect #size-cells for SPI bus
      also defined at arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts:225.7-237.3
    arch/arm/boot/dts/mmp2-olpc-xo-1-75.dtb: Warning (spi_bus_reg): \
    Failed prerequisite 'spi_bus_bridge'
    
    Because the value of "#size-cells" is already defined as zero in the node
    "ssp3: spi at d4037000" in arch/arm/boot/dts/mmp2.dtsi. So we only need to
    explicitly add "#address-cells = <0>" and keep "#size-cells" no change.
    
    Signed-off-by: Zhen Lei <thunder.leizhen at huawei.com>
    Link: https://lore.kernel.org/r/20201207084752.1665-2-thunder.leizhen@huawei.com'
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts b/arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts
index adde62d6fce7..342304f5653a 100644
--- a/arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts
+++ b/arch/arm/boot/dts/mmp2-olpc-xo-1-75.dts
@@ -223,8 +223,7 @@
 };
 
 &ssp3 {
-	/delete-property/ #address-cells;
-	/delete-property/ #size-cells;
+	#address-cells = <0>;
 	spi-slave;
 	status = "okay";
 	ready-gpios = <&gpio 125 GPIO_ACTIVE_HIGH>;
commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8
Author: Leon Romanovsky <leonro at nvidia.com>
Date:   Fri Dec 4 08:42:05 2020 +0200

    RDMA/cm: Fix an attempt to use non-valid pointer when cleaning timewait
    
    If cm_create_timewait_info() fails, the timewait_info pointer will contain
    an error value and will be used in cm_remove_remote() later.
    
      general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI
      KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127]
      CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
      RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978
      Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00
      RSP: 0018:ffff888013127918 EFLAGS: 00010006
      RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000
      RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4
      RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d
      R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70
      R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c
      FS:  00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
       cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155
       cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline]
       rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107
       rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140
       ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069
       ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724
       vfs_write+0x220/0×830 fs/read_write.c:603
       ksys_write+0x1df/0×240 fs/read_write.c:658
       do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
    Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org
    Reviewed-by: Maor Gottlieb <maorg at nvidia.com>
    Reported-by: Amit Matityahu <mitm at nvidia.com>
    Signed-off-by: Leon Romanovsky <leonro at nvidia.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
index 012156624b82..5afd142fe8c7 100644
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -1522,6 +1522,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto out;
 	}
 
@@ -2114,6 +2115,7 @@ static int cm_req_handler(struct cm_work *work)
 							    id.local_id);
 	if (IS_ERR(cm_id_priv->timewait_info)) {
 		ret = PTR_ERR(cm_id_priv->timewait_info);
+		cm_id_priv->timewait_info = NULL;
 		goto destroy;
 	}
 	cm_id_priv->timewait_info->work.remote_id = cm_id_priv->id.remote_id;
commit ca4bbdaf171604841f77648a2877e2e43db69b71
Merge: a68a0262abda 4165bf015ba9
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Dec 9 09:59:14 2020 -0800

    Merge tag 'iommu-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
    
    Pull iommu fix from Will Deacon:
     "Fix interrupt table length definition for AMD IOMMU.
    
      It's actually a fix for a fix, where the size of the interrupt
      remapping table was increased but a related constant for the
      size of the interrupt table was forgotten"
    
    * tag 'iommu-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
      iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs

commit 323a391a220c4a234cb1e678689d7f4c3b73f863
Author: Oliver Hartkopp <socketcan at hartkopp.net>
Date:   Fri Dec 4 14:35:07 2020 +0100

    can: isotp: isotp_setsockopt(): block setsockopt on bound sockets
    
    The isotp socket can be widely configured in its behaviour regarding addressing
    types, fill-ups, receive pattern tests and link layer length. Usually all
    these settings need to be fixed before bind() and can not be changed
    afterwards.
    
    This patch adds a check to enforce the common usage pattern.
    
    Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
    Signed-off-by: Oliver Hartkopp <socketcan at hartkopp.net>
    Tested-by: Thomas Wagner <thwa1 at web.de>
    Link: https://lore.kernel.org/r/20201203140604.25488-2-socketcan@hartkopp.net
    Signed-off-by: Marc Kleine-Budde <mkl at pengutronix.de>
    Link: https://lore.kernel.org/r/20201204133508.742120-3-mkl@pengutronix.de
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/net/can/isotp.c b/net/can/isotp.c
index d78ab13bd8be..26bdc3c20b7e 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1157,6 +1157,9 @@ static int isotp_setsockopt(struct socket *sock, int level, int optname,
 	if (level != SOL_CAN_ISOTP)
 		return -EINVAL;
 
+	if (so->bound)
+		return -EISCONN;
+
 	switch (optname) {
 	case CAN_ISOTP_OPTS:
 		if (optlen != sizeof(struct can_isotp_options))
commit 4e083fdfa39db29bbc7725e229e701867d0da183
Merge: b62527005d46 8158cad13435
Author: Daniel Borkmann <daniel at iogearbox.net>
Date:   Wed Dec 9 16:27:42 2020 +0100

    Merge branch 'bpf-xdp-offload-fixes'
    
    Toke Høiland-Jørgensen says:
    
    ====================
    This series restores the test_offload.py selftest to working order. It seems a
    number of subtle behavioural changes have crept into various subsystems which
    broke test_offload.py in a number of ways. Most of these are fairly benign
    changes where small adjustments to the test script seems to be the best fix,
    but one is an actual kernel bug that I've observed in the wild caused by a bad
    interaction between xdp_attachment_flags_ok() and the rework of XDP program
    handling in the core netdev code.
    
    Patch 1 fixes the bug by removing xdp_attachment_flags_ok(), and the reminder of
    the patches are adjustments to test_offload.py, including a new feature for
    netdevsim to force a BPF verification fail. Please see the individual patches
    for details.
    
    Changelog:
    
    v4:
      - Accidentally truncated the Fixes: hashes in patches 3/4 to 11 chars
    v3:
      - Add Fixes: tags
    v2:
      - Replace xdp_attachment_flags_ok() with a check in dev_xdp_attach()
      - Better packing of struct nsim_dev
    ====================
    
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>

commit 8158cad13435639cd4962fb88970960f880ef6d9
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:43 2020 +0100

    selftests/bpf/test_offload.py: Filter bpftool internal map when counting maps
    
    A few of the tests in test_offload.py expects to see a certain number of
    maps created, and checks this by counting the number of maps returned by
    bpftool. There is already a filter that will remove any maps already there
    at the beginning of the test, but bpftool now creates a map for the PID
    iterator rodata on each invocation, which makes the map count wrong. Fix
    this by also filtering the pid_iter.rodata map by name when counting.
    
    Fixes: d53dee3fe013 ("tools/bpftool: Show info for processes holding BPF map/prog/link/btf FDs")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752226387.110217.9887866138149423444.stgit@toke.dk

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 2128fbd8414b..b99bb8ed3ed4 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -184,9 +184,7 @@ def bpftool_prog_list(expected=None, ns=""):
 def bpftool_map_list(expected=None, ns=""):
     _, maps = bpftool("map show", JSON=True, ns=ns, fail=True)
     # Remove the base maps
-    for m in base_maps:
-        if m in maps:
-            maps.remove(m)
+    maps = [m for m in maps if m not in base_maps and m.get('name') not in base_map_names]
     if expected is not None:
         if len(maps) != expected:
             fail(True, "%d BPF maps loaded, expected %d" %
@@ -770,6 +768,9 @@ ret, progs = bpftool("prog", fail=False)
 skip(ret != 0, "bpftool not installed")
 base_progs = progs
 _, base_maps = bpftool("map")
+base_map_names = [
+    'pid_iter.rodata' # created on each bpftool invocation
+]
 
 # Check netdevsim
 ret, out = cmd("modprobe netdevsim", fail=False)
commit 766e62b7fcd2cf1d43e6594ba37c659dc48f7ddb
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:42 2020 +0100

    selftests/bpf/test_offload.py: Reset ethtool features after failed setting
    
    When setting the ethtool feature flag fails (as expected for the test), the
    kernel now tracks that the feature was requested to be 'off' and refuses to
    subsequently disable it again. So reset it back to 'on' so a subsequent
    disable (that's not supposed to fail) can succeed.
    
    Fixes: 417ec26477a5 ("selftests/bpf: add offload test based on netdevsim")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752226280.110217.10696241563705667871.stgit@toke.dk

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 51a5e4d939cc..2128fbd8414b 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -946,6 +946,7 @@ try:
     start_test("Test disabling TC offloads is rejected while filters installed...")
     ret, _ = sim.set_ethtool_tc_offloads(False, fail=False)
     fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...")
+    sim.set_ethtool_tc_offloads(True)
 
     start_test("Test qdisc removal frees things...")
     sim.tc_flush_filters()
commit 852c2ee338f0ac6026458615b624e1c496142cf6
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:41 2020 +0100

    selftests/bpf/test_offload.py: Fix expected case of extack messages
    
    Commit 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs
    in net_device") changed the case of some of the extack messages being
    returned when attaching of XDP programs failed. This broke test_offload.py,
    so let's fix the test to reflect this.
    
    Fixes: 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs in net_device")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752226175.110217.11214100824416344952.stgit@toke.dk

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 61527b43f067..51a5e4d939cc 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -1004,7 +1004,7 @@ try:
                               fail=False, include_stderr=True)
     fail(ret == 0, "Replaced XDP program with a program in different mode")
     check_extack(err,
-                 "native and generic XDP can't be active at the same time.",
+                 "Native and generic XDP can't be active at the same time.",
                  args)
 
     start_test("Test MTU restrictions...")
@@ -1035,7 +1035,7 @@ try:
     offload = bpf_pinned("/sys/fs/bpf/offload")
     ret, _, err = sim.set_xdp(offload, "drv", fail=False, include_stderr=True)
     fail(ret == 0, "attached offloaded XDP program to drv")
-    check_extack(err, "using device-bound program without HW_MODE flag is not supported.", args)
+    check_extack(err, "Using device-bound program without HW_MODE flag is not supported.", args)
     rm("/sys/fs/bpf/offload")
     sim.wait_for_flush()
 
commit d8b5e76ae4e02908d000397597c6bc2868362fbb
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:40 2020 +0100

    selftests/bpf/test_offload.py: Only check verifier log on verification fails
    
    Since commit 6f8a57ccf851 ("bpf: Make verifier log more relevant by
    default"), the verifier discards log messages for successfully-verified
    programs. This broke test_offload.py which is looking for a verification
    message from the driver callback. Change test_offload.py to use the toggle
    in netdevsim to make the verification fail before looking for the
    verification message.
    
    Fixes: 6f8a57ccf851 ("bpf: Make verifier log more relevant by default")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752226069.110217.12370824996153348073.stgit@toke.dk

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index becd27b2f4ba..61527b43f067 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -911,11 +911,18 @@ try:
 
     sim.tc_flush_filters()
 
+    start_test("Test TC offloads failure...")
+    sim.dfs["dev/bpf_bind_verifier_accept"] = 0
+    ret, _, err = sim.cls_bpf_add_filter(obj, verbose=True, skip_sw=True,
+                                         fail=False, include_stderr=True)
+    fail(ret == 0, "TC filter did not reject with TC offloads enabled")
+    check_verifier_log(err, "[netdevsim] Hello from netdevsim!")
+    sim.dfs["dev/bpf_bind_verifier_accept"] = 1
+
     start_test("Test TC offloads work...")
     ret, _, err = sim.cls_bpf_add_filter(obj, verbose=True, skip_sw=True,
                                          fail=False, include_stderr=True)
     fail(ret != 0, "TC filter did not load with TC offloads enabled")
-    check_verifier_log(err, "[netdevsim] Hello from netdevsim!")
 
     start_test("Test TC offload basics...")
     dfs = simdev.dfs_get_bound_progs(expected=1)
@@ -1032,6 +1039,15 @@ try:
     rm("/sys/fs/bpf/offload")
     sim.wait_for_flush()
 
+    start_test("Test XDP load failure...")
+    sim.dfs["dev/bpf_bind_verifier_accept"] = 0
+    ret, _, err = bpftool_prog_load("sample_ret0.o", "/sys/fs/bpf/offload",
+                                 dev=sim['ifname'], fail=False, include_stderr=True)
+    fail(ret == 0, "verifier should fail on load")
+    check_verifier_log(err, "[netdevsim] Hello from netdevsim!")
+    sim.dfs["dev/bpf_bind_verifier_accept"] = 1
+    sim.wait_for_flush()
+
     start_test("Test XDP offload...")
     _, _, err = sim.set_xdp(obj, "offload", verbose=True, include_stderr=True)
     ipl = sim.ip_link_show(xdp=True)
@@ -1039,7 +1055,6 @@ try:
     progs = bpftool_prog_list(expected=1)
     prog = progs[0]
     fail(link_xdp["id"] != prog["id"], "Loaded program has wrong ID")
-    check_verifier_log(err, "[netdevsim] Hello from netdevsim!")
 
     start_test("Test XDP offload is device bound...")
     dfs = simdev.dfs_get_bound_progs(expected=1)
commit e4ff5aa469403462091eb22e2b0843b894167e10
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:39 2020 +0100

    netdevsim: Add debugfs toggle to reject BPF programs in verifier
    
    This adds a new debugfs toggle ('bpf_bind_verifier_accept') that can be
    used to make netdevsim reject BPF programs from being accepted by the
    verifier. If this toggle (which defaults to true) is set to false,
    nsim_bpf_verify_insn() will return EOPNOTSUPP on the last
    instruction (after outputting the 'Hello from netdevsim' verifier message).
    
    This makes it possible to check the verification callback in the driver
    from test_offload.py in selftests, since the verifier now clears the
    verifier log on a successful load, hiding the message from the driver.
    
    Fixes: 6f8a57ccf851 ("bpf: Make verifier log more relevant by default")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752225964.110217.12584017165318065332.stgit@toke.dk

diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 85546664bdd5..90aafb56f140 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -63,15 +63,20 @@ static int
 nsim_bpf_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn)
 {
 	struct nsim_bpf_bound_prog *state;
+	int ret = 0;
 
 	state = env->prog->aux->offload->dev_priv;
 	if (state->nsim_dev->bpf_bind_verifier_delay && !insn_idx)
 		msleep(state->nsim_dev->bpf_bind_verifier_delay);
 
-	if (insn_idx == env->prog->len - 1)
+	if (insn_idx == env->prog->len - 1) {
 		pr_vlog(env, "Hello from netdevsim!\n");
 
-	return 0;
+		if (!state->nsim_dev->bpf_bind_verifier_accept)
+			ret = -EOPNOTSUPP;
+	}
+
+	return ret;
 }
 
 static int nsim_bpf_finalize(struct bpf_verifier_env *env)
@@ -595,6 +600,9 @@ int nsim_bpf_dev_init(struct nsim_dev *nsim_dev)
 			    &nsim_dev->bpf_bind_accept);
 	debugfs_create_u32("bpf_bind_verifier_delay", 0600, nsim_dev->ddir,
 			   &nsim_dev->bpf_bind_verifier_delay);
+	nsim_dev->bpf_bind_verifier_accept = true;
+	debugfs_create_bool("bpf_bind_verifier_accept", 0600, nsim_dev->ddir,
+			    &nsim_dev->bpf_bind_verifier_accept);
 	return 0;
 }
 
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index 827fc80f50a0..c4e7ad2a1964 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -189,6 +189,7 @@ struct nsim_dev {
 	struct dentry *take_snapshot;
 	struct bpf_offload_dev *bpf_dev;
 	bool bpf_bind_accept;
+	bool bpf_bind_verifier_accept;
 	u32 bpf_bind_verifier_delay;
 	struct dentry *ddir_bpf_bound_progs;
 	u32 prog_id_gen;
commit 0b5b6e747c86e57b7ebd64ccb84314a227ccfcc2
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:38 2020 +0100

    selftests/bpf/test_offload.py: Remove check for program load flags match
    
    Since we just removed the xdp_attachment_flags_ok() callback, also remove
    the check for it in test_offload.py, and replace it with a test for the new
    ambiguity-avoid check when multiple programs are loaded.
    
    Fixes: 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs in net_device")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752225858.110217.13036901876869496246.stgit@toke.dk

diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py
index 43c9cda199b8..becd27b2f4ba 100755
--- a/tools/testing/selftests/bpf/test_offload.py
+++ b/tools/testing/selftests/bpf/test_offload.py
@@ -716,13 +716,11 @@ def test_multi_prog(simdev, sim, obj, modename, modeid):
     fail(ret == 0, "Replaced one of programs without -force")
     check_extack(err, "XDP program already attached.", args)
 
-    if modename == "" or modename == "drv":
-        othermode = "" if modename == "drv" else "drv"
-        start_test("Test multi-attachment XDP - detach...")
-        ret, _, err = sim.unset_xdp(othermode, force=True,
-                                    fail=False, include_stderr=True)
-        fail(ret == 0, "Removed program with a bad mode")
-        check_extack(err, "program loaded with different flags.", args)
+    start_test("Test multi-attachment XDP - remove without mode...")
+    ret, _, err = sim.unset_xdp("", force=True,
+                                fail=False, include_stderr=True)
+    fail(ret == 0, "Removed program without a mode flag")
+    check_extack(err, "More than one program loaded, unset mode is ambiguous.", args)
 
     sim.unset_xdp("offload")
     xdp = sim.ip_link_show(xdp=True)["xdp"]
@@ -1001,16 +999,6 @@ try:
     check_extack(err,
                  "native and generic XDP can't be active at the same time.",
                  args)
-    ret, _, err = sim.set_xdp(obj, "", force=True,
-                              fail=False, include_stderr=True)
-    fail(ret == 0, "Replaced XDP program with a program in different mode")
-    check_extack(err, "program loaded with different flags.", args)
-
-    start_test("Test XDP prog remove with bad flags...")
-    ret, _, err = sim.unset_xdp("", force=True,
-                                fail=False, include_stderr=True)
-    fail(ret == 0, "Removed program with a bad mode")
-    check_extack(err, "program loaded with different flags.", args)
 
     start_test("Test MTU restrictions...")
     ret, _ = sim.set_mtu(9000, fail=False)
commit 998f17296234aa8d3676b4a13962eb39f4ad24e0
Author: Toke Høiland-Jørgensen <toke at redhat.com>
Date:   Wed Dec 9 14:57:37 2020 +0100

    xdp: Remove the xdp_attachment_flags_ok() callback
    
    Since commit 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF
    programs in net_device"), the XDP program attachment info is now maintained
    in the core code. This interacts badly with the xdp_attachment_flags_ok()
    check that prevents unloading an XDP program with different load flags than
    it was loaded with. In practice, two kinds of failures are seen:
    
    - An XDP program loaded without specifying a mode (and which then ends up
      in driver mode) cannot be unloaded if the program mode is specified on
      unload.
    
    - The dev_xdp_uninstall() hook always calls the driver callback with the
      mode set to the type of the program but an empty flags argument, which
      means the flags_ok() check prevents the program from being removed,
      leading to bpf prog reference leaks.
    
    The original reason this check was added was to avoid ambiguity when
    multiple programs were loaded. With the way the checks are done in the core
    now, this is quite simple to enforce in the core code, so let's add a check
    there and get rid of the xdp_attachment_flags_ok() callback entirely.
    
    Fixes: 7f0a838254bd ("bpf, xdp: Maintain info on attached XDP BPF programs in net_device")
    Signed-off-by: Toke Høiland-Jørgensen <toke at redhat.com>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Jakub Kicinski <kuba at kernel.org>
    Link: https://lore.kernel.org/bpf/160752225751.110217.10267659521308669050.stgit@toke.dk

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index b150da43adb2..437226866ce8 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -3562,9 +3562,6 @@ static int nfp_net_xdp_setup_drv(struct nfp_net *nn, struct netdev_bpf *bpf)
 	struct nfp_net_dp *dp;
 	int err;
 
-	if (!xdp_attachment_flags_ok(&nn->xdp, bpf))
-		return -EBUSY;
-
 	if (!prog == !nn->dp.xdp_prog) {
 		WRITE_ONCE(nn->dp.xdp_prog, prog);
 		xdp_attachment_setup(&nn->xdp, bpf);
@@ -3593,9 +3590,6 @@ static int nfp_net_xdp_setup_hw(struct nfp_net *nn, struct netdev_bpf *bpf)
 {
 	int err;
 
-	if (!xdp_attachment_flags_ok(&nn->xdp_hw, bpf))
-		return -EBUSY;
-
 	err = nfp_app_xdp_offload(nn->app, nn, bpf->prog, bpf->extack);
 	if (err)
 		return err;
diff --git a/drivers/net/ethernet/ti/cpsw_priv.c b/drivers/net/ethernet/ti/cpsw_priv.c
index 31c5e36ff706..424e644724e4 100644
--- a/drivers/net/ethernet/ti/cpsw_priv.c
+++ b/drivers/net/ethernet/ti/cpsw_priv.c
@@ -1265,9 +1265,6 @@ static int cpsw_xdp_prog_setup(struct cpsw_priv *priv, struct netdev_bpf *bpf)
 	if (!priv->xdpi.prog && !prog)
 		return 0;
 
-	if (!xdp_attachment_flags_ok(&priv->xdpi, bpf))
-		return -EBUSY;
-
 	WRITE_ONCE(priv->xdp_prog, prog);
 
 	xdp_attachment_setup(&priv->xdpi, bpf);
diff --git a/drivers/net/netdevsim/bpf.c b/drivers/net/netdevsim/bpf.c
index 2e90512f3bbe..85546664bdd5 100644
--- a/drivers/net/netdevsim/bpf.c
+++ b/drivers/net/netdevsim/bpf.c
@@ -190,9 +190,6 @@ nsim_xdp_set_prog(struct netdevsim *ns, struct netdev_bpf *bpf,
 {
 	int err;
 
-	if (!xdp_attachment_flags_ok(xdp, bpf))
-		return -EBUSY;
-
 	if (bpf->command == XDP_SETUP_PROG && !ns->bpf_xdpdrv_accept) {
 		NSIM_EA(bpf->extack, "driver XDP disabled in DebugFS");
 		return -EOPNOTSUPP;
diff --git a/include/net/xdp.h b/include/net/xdp.h
index 3814fb631d52..9dab2bc6f187 100644
--- a/include/net/xdp.h
+++ b/include/net/xdp.h
@@ -240,8 +240,6 @@ struct xdp_attachment_info {
 };
 
 struct netdev_bpf;
-bool xdp_attachment_flags_ok(struct xdp_attachment_info *info,
-			     struct netdev_bpf *bpf);
 void xdp_attachment_setup(struct xdp_attachment_info *info,
 			  struct netdev_bpf *bpf);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 8588ade790cb..38412e70f761 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8917,6 +8917,17 @@ static struct bpf_prog *dev_xdp_prog(struct net_device *dev,
 	return dev->xdp_state[mode].prog;
 }
 
+static u8 dev_xdp_prog_count(struct net_device *dev)
+{
+	u8 count = 0;
+	int i;
+
+	for (i = 0; i < __MAX_XDP_MODE; i++)
+		if (dev->xdp_state[i].prog || dev->xdp_state[i].link)
+			count++;
+	return count;
+}
+
 u32 dev_xdp_prog_id(struct net_device *dev, enum bpf_xdp_mode mode)
 {
 	struct bpf_prog *prog = dev_xdp_prog(dev, mode);
@@ -9007,6 +9018,7 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
 			  struct bpf_xdp_link *link, struct bpf_prog *new_prog,
 			  struct bpf_prog *old_prog, u32 flags)
 {
+	unsigned int num_modes = hweight32(flags & XDP_FLAGS_MODES);
 	struct bpf_prog *cur_prog;
 	enum bpf_xdp_mode mode;
 	bpf_op_t bpf_op;
@@ -9022,11 +9034,17 @@ static int dev_xdp_attach(struct net_device *dev, struct netlink_ext_ack *extack
 		NL_SET_ERR_MSG(extack, "Invalid XDP flags for BPF link attachment");
 		return -EINVAL;
 	}
-	/* just one XDP mode bit should be set, zero defaults to SKB mode */
-	if (hweight32(flags & XDP_FLAGS_MODES) > 1) {
+	/* just one XDP mode bit should be set, zero defaults to drv/skb mode */
+	if (num_modes > 1) {
 		NL_SET_ERR_MSG(extack, "Only one XDP mode flag can be set");
 		return -EINVAL;
 	}
+	/* avoid ambiguity if offload + drv/skb mode progs are both loaded */
+	if (!num_modes && dev_xdp_prog_count(dev) > 1) {
+		NL_SET_ERR_MSG(extack,
+			       "More than one program loaded, unset mode is ambiguous");
+		return -EINVAL;
+	}
 	/* old_prog != NULL implies XDP_FLAGS_REPLACE is set */
 	if (old_prog && !(flags & XDP_FLAGS_REPLACE)) {
 		NL_SET_ERR_MSG(extack, "XDP_FLAGS_REPLACE is not specified");
diff --git a/net/core/xdp.c b/net/core/xdp.c
index 491ad569a79c..d900cebc0acd 100644
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -403,18 +403,6 @@ void __xdp_release_frame(void *data, struct xdp_mem_info *mem)
 }
 EXPORT_SYMBOL_GPL(__xdp_release_frame);
 
-bool xdp_attachment_flags_ok(struct xdp_attachment_info *info,
-			     struct netdev_bpf *bpf)
-{
-	if (info->prog && (bpf->flags ^ info->flags) & XDP_FLAGS_MODES) {
-		NL_SET_ERR_MSG(bpf->extack,
-			       "program loaded with different flags");
-		return false;
-	}
-	return true;
-}
-EXPORT_SYMBOL_GPL(xdp_attachment_flags_ok);
-
 void xdp_attachment_setup(struct xdp_attachment_info *info,
 			  struct netdev_bpf *bpf)
 {
commit ab43234d0bafcf2accd9db4fc4d193180b752f94
Author: Andrey Grodzovsky <andrey.grodzovsky at amd.com>
Date:   Tue Dec 8 15:16:15 2020 -0500

    drm/amdgpu: Initialise drm_gem_object_funcs for imported BOs
    
    For BOs imported from outside of amdgpu, setting of amdgpu_gem_object_funcs
    was missing in amdgpu_dma_buf_create_obj. Fix by refactoring BO creation
    and amdgpu_gem_object_funcs setting into single function called
    from both code paths.
    
    Fixes: d693def4fd1c ("drm: Remove obsolete GEM and PRIME callbacks from struct drm_driver")
    
    v2: Use use amdgpu_gem_object_create() directly
    v3: fix warning
    
    Reviewed-by: Christian König <christian.koenig at amd.com>
    Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky at amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
index 957934926b24..1b56dbc1f304 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
@@ -459,6 +459,7 @@ amdgpu_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf)
 	struct amdgpu_device *adev = drm_to_adev(dev);
 	struct amdgpu_bo *bo;
 	struct amdgpu_bo_param bp;
+	struct drm_gem_object *gobj;
 	int ret;
 
 	memset(&bp, 0, sizeof(bp));
@@ -469,17 +470,20 @@ amdgpu_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf)
 	bp.type = ttm_bo_type_sg;
 	bp.resv = resv;
 	dma_resv_lock(resv, NULL);
-	ret = amdgpu_bo_create(adev, &bp, &bo);
+	ret = amdgpu_gem_object_create(adev, dma_buf->size, PAGE_SIZE,
+			AMDGPU_GEM_DOMAIN_CPU,
+			0, ttm_bo_type_sg, resv, &gobj);
 	if (ret)
 		goto error;
 
+	bo = gem_to_amdgpu_bo(gobj);
 	bo->allowed_domains = AMDGPU_GEM_DOMAIN_GTT;
 	bo->preferred_domains = AMDGPU_GEM_DOMAIN_GTT;
 	if (dma_buf->ops != &amdgpu_dmabuf_ops)
 		bo->prime_shared_count = 1;
 
 	dma_resv_unlock(resv);
-	return &bo->tbo.base;
+	return gobj;
 
 error:
 	dma_resv_unlock(resv);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 7e8265da9f25..e8c76bd8c501 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -66,26 +66,12 @@ int amdgpu_gem_object_create(struct amdgpu_device *adev, unsigned long size,
 	bp.type = type;
 	bp.resv = resv;
 	bp.preferred_domain = initial_domain;
-retry:
 	bp.flags = flags;
 	bp.domain = initial_domain;
 	r = amdgpu_bo_create(adev, &bp, &bo);
-	if (r) {
-		if (r != -ERESTARTSYS) {
-			if (flags & AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED) {
-				flags &= ~AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
-				goto retry;
-			}
-
-			if (initial_domain == AMDGPU_GEM_DOMAIN_VRAM) {
-				initial_domain |= AMDGPU_GEM_DOMAIN_GTT;
-				goto retry;
-			}
-			DRM_DEBUG("Failed to allocate GEM object (%ld, %d, %u, %d)\n",
-				  size, initial_domain, alignment, r);
-		}
+	if (r)
 		return r;
-	}
+
 	*obj = &bo->tbo.base;
 
 	return 0;
@@ -225,7 +211,7 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
 	uint64_t size = args->in.bo_size;
 	struct dma_resv *resv = NULL;
 	struct drm_gem_object *gobj;
-	uint32_t handle;
+	uint32_t handle, initial_domain;
 	int r;
 
 	/* reject invalid gem flags */
@@ -269,9 +255,28 @@ int amdgpu_gem_create_ioctl(struct drm_device *dev, void *data,
 		resv = vm->root.base.bo->tbo.base.resv;
 	}
 
+retry:
+	initial_domain = (u32)(0xffffffff & args->in.domains);
 	r = amdgpu_gem_object_create(adev, size, args->in.alignment,
-				     (u32)(0xffffffff & args->in.domains),
+				     initial_domain,
 				     flags, ttm_bo_type_device, resv, &gobj);
+	if (r) {
+		if (r != -ERESTARTSYS) {
+			if (flags & AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED) {
+				flags &= ~AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
+				goto retry;
+			}
+
+			if (initial_domain == AMDGPU_GEM_DOMAIN_VRAM) {
+				initial_domain |= AMDGPU_GEM_DOMAIN_GTT;
+				goto retry;
+			}
+			DRM_DEBUG("Failed to allocate GEM object (%llu, %d, %llu, %d)\n",
+				  size, initial_domain, args->in.alignment, r);
+		}
+		return r;
+	}
+
 	if (flags & AMDGPU_GEM_CREATE_VM_ALWAYS_VALID) {
 		if (!r) {
 			struct amdgpu_bo *abo = gem_to_amdgpu_bo(gobj);
commit 157fe68d74c2ad2db438c91af9ed3d3a51de4ed7
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Mon Dec 7 13:12:29 2020 -0500

    drm/amdgpu: fix size calculation with stolen vga memory
    
    If we need to keep the stolen vga memory, make sure it is
    at least as big as the legacy vga size.
    
    Acked-by: Christian König <christian.koenig at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
index 36604d751d62..3e4892b7b7d3 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -499,6 +499,9 @@ void amdgpu_gmc_get_vbios_allocations(struct amdgpu_device *adev)
 	else
 		size = amdgpu_gmc_get_vbios_fb_size(adev);
 
+	if (adev->mman.keep_stolen_vga_memory)
+		size = max(size, (unsigned)AMDGPU_VBIOS_VGA_ALLOCATION);
+
 	/* set to 0 if the pre-OS buffer uses up most of vram */
 	if ((adev->gmc.real_vram_size - size) < (8 * 1024 * 1024))
 		size = 0;
commit c9918d1f63a3e77ec20997a77c997a6fa7282f2f
Author: Changfeng <Changfeng.Zhu at amd.com>
Date:   Mon Dec 7 15:42:29 2020 +0800

    drm/amd/pm: update smu10.h WORKLOAD_PPLIB setting for raven
    
    When using old WORKLOAD_PPLIB setting in smu10.h, there is problem that
    it can't be able to switch to mak gpu clk during compute workload.
    It needs to update WORKLOAD_PPLIB setting to fix this issue.
    
    Signed-off-by: Changfeng <Changfeng.Zhu at amd.com>
    Reviewed-by: Huang Rui <ray.huang at amd.com>
    Acked-by: Alex Deucher <alexander.deucher at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/pm/inc/smu10.h b/drivers/gpu/drm/amd/pm/inc/smu10.h
index b96520528240..9e837a5014c5 100644
--- a/drivers/gpu/drm/amd/pm/inc/smu10.h
+++ b/drivers/gpu/drm/amd/pm/inc/smu10.h
@@ -136,14 +136,12 @@
 #define FEATURE_CORE_CSTATES_MASK     (1 << FEATURE_CORE_CSTATES_BIT)
 
 /* Workload bits */
-#define WORKLOAD_DEFAULT_BIT              0
-#define WORKLOAD_PPLIB_FULL_SCREEN_3D_BIT 1
-#define WORKLOAD_PPLIB_POWER_SAVING_BIT   2
-#define WORKLOAD_PPLIB_VIDEO_BIT          3
-#define WORKLOAD_PPLIB_VR_BIT             4
-#define WORKLOAD_PPLIB_COMPUTE_BIT        5
-#define WORKLOAD_PPLIB_CUSTOM_BIT         6
-#define WORKLOAD_PPLIB_COUNT              7
+#define WORKLOAD_PPLIB_FULL_SCREEN_3D_BIT 0
+#define WORKLOAD_PPLIB_VIDEO_BIT          2
+#define WORKLOAD_PPLIB_VR_BIT             3
+#define WORKLOAD_PPLIB_COMPUTE_BIT        4
+#define WORKLOAD_PPLIB_CUSTOM_BIT         5
+#define WORKLOAD_PPLIB_COUNT              6
 
 typedef struct {
 	/* MP1_EXT_SCRATCH0 */
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
index cf60f3992303..e6f40ee9f313 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu10_hwmgr.c
@@ -1297,15 +1297,9 @@ static int conv_power_profile_to_pplib_workload(int power_profile)
 	int pplib_workload = 0;
 
 	switch (power_profile) {
-	case PP_SMC_POWER_PROFILE_BOOTUP_DEFAULT:
-		pplib_workload = WORKLOAD_DEFAULT_BIT;
-		break;
 	case PP_SMC_POWER_PROFILE_FULLSCREEN3D:
 		pplib_workload = WORKLOAD_PPLIB_FULL_SCREEN_3D_BIT;
 		break;
-	case PP_SMC_POWER_PROFILE_POWERSAVING:
-		pplib_workload = WORKLOAD_PPLIB_POWER_SAVING_BIT;
-		break;
 	case PP_SMC_POWER_PROFILE_VIDEO:
 		pplib_workload = WORKLOAD_PPLIB_VIDEO_BIT;
 		break;
@@ -1315,6 +1309,9 @@ static int conv_power_profile_to_pplib_workload(int power_profile)
 	case PP_SMC_POWER_PROFILE_COMPUTE:
 		pplib_workload = WORKLOAD_PPLIB_COMPUTE_BIT;
 		break;
+	case PP_SMC_POWER_PROFILE_CUSTOM:
+		pplib_workload = WORKLOAD_PPLIB_CUSTOM_BIT;
+		break;
 	}
 
 	return pplib_workload;
commit ab6e4e9de8dd7febfdf6719741f10dc6693d8ce9
Author: Felix Kuehling <Felix.Kuehling at amd.com>
Date:   Tue Dec 8 12:23:15 2020 -0500

    drm/amdkfd: Fix leak in dmabuf import
    
    Release dmabuf reference before returning from kfd_ioctl_import_dmabuf.
    amdgpu_amdkfd_gpuvm_import_dmabuf takes a reference to the underlying
    GEM BO and doesn't keep the reference to the dmabuf wrapper.
    
    Signed-off-by: Felix Kuehling <Felix.Kuehling at amd.com>
    Reviewed-by: Kent Russell <kent.russell at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 222f1df1a6b6..8cc51cec988a 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1736,6 +1736,7 @@ static int kfd_ioctl_import_dmabuf(struct file *filep,
 	}
 
 	mutex_unlock(&p->mutex);
+	dma_buf_put(dmabuf);
 
 	args->handle = MAKE_HANDLE(args->gpu_id, idr_handle);
 
@@ -1745,6 +1746,7 @@ err_free:
 	amdgpu_amdkfd_gpuvm_free_memory_of_gpu(dev->kgd, (struct kgd_mem *)mem, NULL);
 err_unlock:
 	mutex_unlock(&p->mutex);
+	dma_buf_put(dmabuf);
 	return r;
 }
 
commit 6896887b8676d8fb445c85ea56333b9661a6a8aa
Author: Stanley.Yang <Stanley.Yang at amd.com>
Date:   Mon Dec 7 14:38:33 2020 +0800

    drm/amdgpu: fix sdma instance fw version and feature version init
    
    each sdma instance fw_version and feature_version
    should be set right value when asic type isn't
    between SIENNA_CICHILD and CHIP_DIMGREY_CAVEFISH
    
    Signed-off-by: Stanley.Yang <Stanley.Yang at amd.com>
    Reviewed-by: Tao Zhou <tao.zhou1 at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
index 9f3952723c63..2a485052e3ab 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
@@ -186,7 +186,7 @@ static int sdma_v5_2_init_microcode(struct amdgpu_device *adev)
 			if (err)
 				goto out;
 
-			err = sdma_v5_2_init_inst_ctx(&adev->sdma.instance[0]);
+			err = sdma_v5_2_init_inst_ctx(&adev->sdma.instance[i]);
 			if (err)
 				goto out;
 		}
commit 369b7ebe1792b620b7a9404e7b71daaae13ebfd6
Author: Sung Lee <sung.lee at amd.com>
Date:   Mon Nov 23 15:38:54 2020 -0500

    drm/amd/display: Add wm table for Renoir
    
    [Why]
    Without additional HostVM Latency, Renoir takes 2us longer to exit
    self-refresh. This causes underflow in certain cases.
    
    [How]
    Add table for Renoir with updated sr exit latencies for WM set A.
    
    Signed-off-by: Sung Lee <sung.lee at amd.com>
    Reviewed-by: Yongqiang Sun <yongqiang.sun at amd.com>
    Reviewed-by: Roman Li <Roman.Li at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
index c001307b0a59..6b431db146cd 100644
--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c
@@ -579,7 +579,7 @@ static struct clk_bw_params rn_bw_params = {
 
 };
 
-static struct wm_table ddr4_wm_table = {
+static struct wm_table ddr4_wm_table_gs = {
 	.entries = {
 		{
 			.wm_inst = WM_A,
@@ -616,7 +616,7 @@ static struct wm_table ddr4_wm_table = {
 	}
 };
 
-static struct wm_table lpddr4_wm_table = {
+static struct wm_table lpddr4_wm_table_gs = {
 	.entries = {
 		{
 			.wm_inst = WM_A,
@@ -690,6 +690,80 @@ static struct wm_table lpddr4_wm_table_with_disabled_ppt = {
 	}
 };
 
+static struct wm_table ddr4_wm_table_rn = {
+	.entries = {
+		{
+			.wm_inst = WM_A,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.72,
+			.sr_exit_time_us = 9.09,
+			.sr_enter_plus_exit_time_us = 10.14,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_B,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.72,
+			.sr_exit_time_us = 10.12,
+			.sr_enter_plus_exit_time_us = 11.48,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_C,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.72,
+			.sr_exit_time_us = 10.12,
+			.sr_enter_plus_exit_time_us = 11.48,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_D,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.72,
+			.sr_exit_time_us = 10.12,
+			.sr_enter_plus_exit_time_us = 11.48,
+			.valid = true,
+		},
+	}
+};
+
+static struct wm_table lpddr4_wm_table_rn = {
+	.entries = {
+		{
+			.wm_inst = WM_A,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.65333,
+			.sr_exit_time_us = 7.32,
+			.sr_enter_plus_exit_time_us = 8.38,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_B,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.65333,
+			.sr_exit_time_us = 9.82,
+			.sr_enter_plus_exit_time_us = 11.196,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_C,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.65333,
+			.sr_exit_time_us = 9.89,
+			.sr_enter_plus_exit_time_us = 11.24,
+			.valid = true,
+		},
+		{
+			.wm_inst = WM_D,
+			.wm_type = WM_TYPE_PSTATE_CHG,
+			.pstate_latency_us = 11.65333,
+			.sr_exit_time_us = 9.748,
+			.sr_enter_plus_exit_time_us = 11.102,
+			.valid = true,
+		},
+	}
+};
+
 static unsigned int find_dcfclk_for_voltage(struct dpm_clocks *clock_table, unsigned int voltage)
 {
 	int i;
@@ -771,6 +845,11 @@ void rn_clk_mgr_construct(
 	struct dc_debug_options *debug = &ctx->dc->debug;
 	struct dpm_clocks clock_table = { 0 };
 	enum pp_smu_status status = 0;
+	int is_green_sardine = 0;
+
+#if defined(CONFIG_DRM_AMD_DC_DCN)
+	is_green_sardine = ASICREV_IS_GREEN_SARDINE(ctx->asic_id.hw_internal_rev);
+#endif
 
 	clk_mgr->base.ctx = ctx;
 	clk_mgr->base.funcs = &dcn21_funcs;
@@ -811,10 +890,16 @@ void rn_clk_mgr_construct(
 			if (clk_mgr->periodic_retraining_disabled) {
 				rn_bw_params.wm_table = lpddr4_wm_table_with_disabled_ppt;
 			} else {
-				rn_bw_params.wm_table = lpddr4_wm_table;
+				if (is_green_sardine)
+					rn_bw_params.wm_table = lpddr4_wm_table_gs;
+				else
+					rn_bw_params.wm_table = lpddr4_wm_table_rn;
 			}
 		} else {
-			rn_bw_params.wm_table = ddr4_wm_table;
+			if (is_green_sardine)
+				rn_bw_params.wm_table = ddr4_wm_table_gs;
+			else
+				rn_bw_params.wm_table = ddr4_wm_table_rn;
 		}
 		/* Saved clocks configured at boot for debug purposes */
 		rn_dump_clk_registers(&clk_mgr->base.boot_snapshot, &clk_mgr->base, &log_info);
commit c2ffe78b8b1354603a7d5afb719b2a6dfbb582da
Author: Chris Park <Chris.Park at amd.com>
Date:   Tue Nov 24 20:11:25 2020 -0500

    drm/amd/display: Prevent bandwidth overflow
    
    [Why]
    At very high pixel clock, bandwidth calculation exceeds 32 bit size
    and overflow value. This causes the resulting selection of link rate
    to be inaccurate.
    
    [How]
    Change order of operation and use fixed point to deal with integer
    accuracy. Also address bug found when forcing link rate.
    
    Signed-off-by: Chris Park <Chris.Park at amd.com>
    Reviewed-by: Wenjing Liu <Wenjing.Liu at amd.com>
    Acked-by: Eryk Brol <eryk.brol at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
index fec87a2e210c..5b0cedfa824a 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
@@ -3394,10 +3394,13 @@ uint32_t dc_bandwidth_in_kbps_from_timing(
 {
 	uint32_t bits_per_channel = 0;
 	uint32_t kbps;
+	struct fixed31_32 link_bw_kbps;
 
 	if (timing->flags.DSC) {
-		kbps = (timing->pix_clk_100hz * timing->dsc_cfg.bits_per_pixel);
-		kbps = kbps / 160 + ((kbps % 160) ? 1 : 0);
+		link_bw_kbps = dc_fixpt_from_int(timing->pix_clk_100hz);
+		link_bw_kbps = dc_fixpt_div_int(link_bw_kbps, 160);
+		link_bw_kbps = dc_fixpt_mul_int(link_bw_kbps, timing->dsc_cfg.bits_per_pixel);
+		kbps = dc_fixpt_ceil(link_bw_kbps);
 		return kbps;
 	}
 
commit 2343e9d2c5a94459b9de92649f1650e36eb79a10
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 4 00:06:43 2020 +0100

    drm/amdgpu: fix debugfs creation/removal, again
    
    There is still a warning when CONFIG_DEBUG_FS is disabled:
    
    drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1145:13: error: 'amdgpu_ras_debugfs_create_ctrl_node' defined but not used [-Werror=unused-function]
     1145 | static void amdgpu_ras_debugfs_create_ctrl_node(struct amdgpu_device *adev)
    
    Change the code again to make the compiler actually drop
    this code but not warn about it.
    
    Fixes: ae2bf61ff39e ("drm/amdgpu: guard ras debugfs creation/removal based on CONFIG_DEBUG_FS")
    Reviewed-by: Tao Zhou <tao.zhou1 at amd.com>
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 4e36551ab50b..82cd8e55595a 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -1172,7 +1172,7 @@ static void amdgpu_ras_debugfs_create_ctrl_node(struct amdgpu_device *adev)
 			con->dir, &con->disable_ras_err_cnt_harvest);
 }
 
-void amdgpu_ras_debugfs_create(struct amdgpu_device *adev,
+static void amdgpu_ras_debugfs_create(struct amdgpu_device *adev,
 		struct ras_fs_if *head)
 {
 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
@@ -1194,7 +1194,6 @@ void amdgpu_ras_debugfs_create(struct amdgpu_device *adev,
 
 void amdgpu_ras_debugfs_create_all(struct amdgpu_device *adev)
 {
-#if defined(CONFIG_DEBUG_FS)
 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 	struct ras_manager *obj;
 	struct ras_fs_if fs_info;
@@ -1203,7 +1202,7 @@ void amdgpu_ras_debugfs_create_all(struct amdgpu_device *adev)
 	 * it won't be called in resume path, no need to check
 	 * suspend and gpu reset status
 	 */
-	if (!con)
+	if (!IS_ENABLED(CONFIG_DEBUG_FS) || !con)
 		return;
 
 	amdgpu_ras_debugfs_create_ctrl_node(adev);
@@ -1217,10 +1216,9 @@ void amdgpu_ras_debugfs_create_all(struct amdgpu_device *adev)
 			amdgpu_ras_debugfs_create(adev, &fs_info);
 		}
 	}
-#endif
 }
 
-void amdgpu_ras_debugfs_remove(struct amdgpu_device *adev,
+static void amdgpu_ras_debugfs_remove(struct amdgpu_device *adev,
 		struct ras_common_if *head)
 {
 	struct ras_manager *obj = amdgpu_ras_find_obj(adev, head);
@@ -1234,7 +1232,6 @@ void amdgpu_ras_debugfs_remove(struct amdgpu_device *adev,
 
 static void amdgpu_ras_debugfs_remove_all(struct amdgpu_device *adev)
 {
-#if defined(CONFIG_DEBUG_FS)
 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
 	struct ras_manager *obj, *tmp;
 
@@ -1243,7 +1240,6 @@ static void amdgpu_ras_debugfs_remove_all(struct amdgpu_device *adev)
 	}
 
 	con->dir = NULL;
-#endif
 }
 /* debugfs end */
 
@@ -1291,7 +1287,8 @@ static int amdgpu_ras_fs_init(struct amdgpu_device *adev)
 
 static int amdgpu_ras_fs_fini(struct amdgpu_device *adev)
 {
-	amdgpu_ras_debugfs_remove_all(adev);
+	if (IS_ENABLED(CONFIG_DEBUG_FS))
+		amdgpu_ras_debugfs_remove_all(adev);
 	amdgpu_ras_sysfs_remove_all(adev);
 	return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
index 6b8d7bb83bb3..ec398ed7deb8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
@@ -607,14 +607,8 @@ int amdgpu_ras_sysfs_create(struct amdgpu_device *adev,
 int amdgpu_ras_sysfs_remove(struct amdgpu_device *adev,
 		struct ras_common_if *head);
 
-void amdgpu_ras_debugfs_create(struct amdgpu_device *adev,
-		struct ras_fs_if *head);
-
 void amdgpu_ras_debugfs_create_all(struct amdgpu_device *adev);
 
-void amdgpu_ras_debugfs_remove(struct amdgpu_device *adev,
-		struct ras_common_if *head);
-
 int amdgpu_ras_error_query(struct amdgpu_device *adev,
 		struct ras_query_if *info);
 
commit 578b6c487899179fed730e710ffec0b069917971
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Thu Dec 3 16:06:26 2020 -0500

    drm/amdgpu/disply: set num_crtc earlier
    
    To avoid a recently added warning:
     Bogus possible_crtcs: [ENCODER:65:TMDS-65] possible_crtcs=0xf (full crtc mask=0x7)
     WARNING: CPU: 3 PID: 439 at drivers/gpu/drm/drm_mode_config.c:617 drm_mode_config_validate+0x178/0x200 [drm]
    In this case the warning is harmless, but confusing to users.
    
    Fixes: 0df108237433 ("drm: Validate encoder->possible_crtcs")
    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=209123
    Reviewed-by: Daniel Vetter <daniel at ffwll.ch>
    Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 9b6809f309f4..0f7749e9424d 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -1058,9 +1058,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
 		goto error;
 	}
 
-	/* Update the actual used number of crtc */
-	adev->mode_info.num_crtc = adev->dm.display_indexes_num;
-
 	/* create fake encoders for MST */
 	dm_dp_create_fake_mst_encoders(adev);
 
@@ -3251,6 +3248,10 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
 	enum dc_connection_type new_connection_type = dc_connection_none;
 	const struct dc_plane_cap *plane;
 
+	dm->display_indexes_num = dm->dc->caps.max_streams;
+	/* Update the actual used number of crtc */
+	adev->mode_info.num_crtc = adev->dm.display_indexes_num;
+
 	link_cnt = dm->dc->caps.max_links;
 	if (amdgpu_dm_mode_config_init(dm->adev)) {
 		DRM_ERROR("DM: Failed to initialize mode config\n");
@@ -3312,8 +3313,6 @@ static int amdgpu_dm_initialize_drm_device(struct amdgpu_device *adev)
 			goto fail;
 		}
 
-	dm->display_indexes_num = dm->dc->caps.max_streams;
-
 	/* loops over all connectors on the board */
 	for (i = 0; i < link_cnt; i++) {
 		struct dc_link *link = NULL;
commit 2d94b20b95b009eec1a267dcf026b01af627c0cd
Author: Brett Mastbergen <brett.mastbergen at gmail.com>
Date:   Tue Dec 8 16:39:24 2020 -0500

    netfilter: nft_ct: Remove confirmation check for NFT_CT_ID
    
    Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id
    hash calculation") the ct id will not change from initialization to
    confirmation.  Removing the confirmation check allows for things like
    adding an element to a 'typeof ct id' set in prerouting upon reception
    of the first packet of a new connection, and then being able to
    reference that set consistently both before and after the connection
    is confirmed.
    
    Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation")
    Signed-off-by: Brett Mastbergen <brett.mastbergen at gmail.com>
    Acked-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 322bd674963e..a1b0aac46e9e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr,
 	}
 #endif
 	case NFT_CT_ID:
-		if (!nf_ct_is_confirmed(ct))
-			goto err;
 		*dest = nf_ct_get_id(ct);
 		return;
 	default:
commit ee32f32335e8c7f6154bf397f4ac9b6175b488a8
Author: Juergen Gross <jgross at suse.com>
Date:   Mon Dec 7 09:36:14 2020 +0100

    xen: don't use page->lru for ZONE_DEVICE memory
    
    Commit 9e2369c06c8a18 ("xen: add helpers to allocate unpopulated
    memory") introduced usage of ZONE_DEVICE memory for foreign memory
    mappings.
    
    Unfortunately this collides with using page->lru for Xen backend
    private page caches.
    
    Fix that by using page->zone_device_data instead.
    
    Cc: <stable at vger.kernel.org> # 5.9
    Fixes: 9e2369c06c8a18 ("xen: add helpers to allocate unpopulated memory")
    Signed-off-by: Juergen Gross <jgross at suse.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy at oracle.com>
    Reviewed-by: Jason Andryuk <jandryuk at gmail.com>
    Signed-off-by: Juergen Gross <jgross at suse.com>

diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index e2e42912f241..3729bea0c989 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -813,10 +813,63 @@ int gnttab_alloc_pages(int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL_GPL(gnttab_alloc_pages);
 
+#ifdef CONFIG_XEN_UNPOPULATED_ALLOC
+static inline void cache_init(struct gnttab_page_cache *cache)
+{
+	cache->pages = NULL;
+}
+
+static inline bool cache_empty(struct gnttab_page_cache *cache)
+{
+	return !cache->pages;
+}
+
+static inline struct page *cache_deq(struct gnttab_page_cache *cache)
+{
+	struct page *page;
+
+	page = cache->pages;
+	cache->pages = page->zone_device_data;
+
+	return page;
+}
+
+static inline void cache_enq(struct gnttab_page_cache *cache, struct page *page)
+{
+	page->zone_device_data = cache->pages;
+	cache->pages = page;
+}
+#else
+static inline void cache_init(struct gnttab_page_cache *cache)
+{
+	INIT_LIST_HEAD(&cache->pages);
+}
+
+static inline bool cache_empty(struct gnttab_page_cache *cache)
+{
+	return list_empty(&cache->pages);
+}
+
+static inline struct page *cache_deq(struct gnttab_page_cache *cache)
+{
+	struct page *page;
+
+	page = list_first_entry(&cache->pages, struct page, lru);
+	list_del(&page->lru);
+
+	return page;
+}
+
+static inline void cache_enq(struct gnttab_page_cache *cache, struct page *page)
+{
+	list_add(&page->lru, &cache->pages);
+}
+#endif
+
 void gnttab_page_cache_init(struct gnttab_page_cache *cache)
 {
 	spin_lock_init(&cache->lock);
-	INIT_LIST_HEAD(&cache->pages);
+	cache_init(cache);
 	cache->num_pages = 0;
 }
 EXPORT_SYMBOL_GPL(gnttab_page_cache_init);
@@ -827,13 +880,12 @@ int gnttab_page_cache_get(struct gnttab_page_cache *cache, struct page **page)
 
 	spin_lock_irqsave(&cache->lock, flags);
 
-	if (list_empty(&cache->pages)) {
+	if (cache_empty(cache)) {
 		spin_unlock_irqrestore(&cache->lock, flags);
 		return gnttab_alloc_pages(1, page);
 	}
 
-	page[0] = list_first_entry(&cache->pages, struct page, lru);
-	list_del(&page[0]->lru);
+	page[0] = cache_deq(cache);
 	cache->num_pages--;
 
 	spin_unlock_irqrestore(&cache->lock, flags);
@@ -851,7 +903,7 @@ void gnttab_page_cache_put(struct gnttab_page_cache *cache, struct page **page,
 	spin_lock_irqsave(&cache->lock, flags);
 
 	for (i = 0; i < num; i++)
-		list_add(&page[i]->lru, &cache->pages);
+		cache_enq(cache, page[i]);
 	cache->num_pages += num;
 
 	spin_unlock_irqrestore(&cache->lock, flags);
@@ -867,8 +919,7 @@ void gnttab_page_cache_shrink(struct gnttab_page_cache *cache, unsigned int num)
 	spin_lock_irqsave(&cache->lock, flags);
 
 	while (cache->num_pages > num) {
-		page[i] = list_first_entry(&cache->pages, struct page, lru);
-		list_del(&page[i]->lru);
+		page[i] = cache_deq(cache);
 		cache->num_pages--;
 		if (++i == ARRAY_SIZE(page)) {
 			spin_unlock_irqrestore(&cache->lock, flags);
diff --git a/drivers/xen/unpopulated-alloc.c b/drivers/xen/unpopulated-alloc.c
index 8c512ea550bb..7762c1bb23cb 100644
--- a/drivers/xen/unpopulated-alloc.c
+++ b/drivers/xen/unpopulated-alloc.c
@@ -12,7 +12,7 @@
 #include <xen/xen.h>
 
 static DEFINE_MUTEX(list_lock);
-static LIST_HEAD(page_list);
+static struct page *page_list;
 static unsigned int list_count;
 
 static int fill_list(unsigned int nr_pages)
@@ -84,7 +84,8 @@ static int fill_list(unsigned int nr_pages)
 		struct page *pg = virt_to_page(vaddr + PAGE_SIZE * i);
 
 		BUG_ON(!virt_addr_valid(vaddr + PAGE_SIZE * i));
-		list_add(&pg->lru, &page_list);
+		pg->zone_device_data = page_list;
+		page_list = pg;
 		list_count++;
 	}
 
@@ -118,12 +119,10 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 	}
 
 	for (i = 0; i < nr_pages; i++) {
-		struct page *pg = list_first_entry_or_null(&page_list,
-							   struct page,
-							   lru);
+		struct page *pg = page_list;
 
 		BUG_ON(!pg);
-		list_del(&pg->lru);
+		page_list = pg->zone_device_data;
 		list_count--;
 		pages[i] = pg;
 
@@ -134,7 +133,8 @@ int xen_alloc_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 				unsigned int j;
 
 				for (j = 0; j <= i; j++) {
-					list_add(&pages[j]->lru, &page_list);
+					pages[j]->zone_device_data = page_list;
+					page_list = pages[j];
 					list_count++;
 				}
 				goto out;
@@ -160,7 +160,8 @@ void xen_free_unpopulated_pages(unsigned int nr_pages, struct page **pages)
 
 	mutex_lock(&list_lock);
 	for (i = 0; i < nr_pages; i++) {
-		list_add(&pages[i]->lru, &page_list);
+		pages[i]->zone_device_data = page_list;
+		page_list = pages[i];
 		list_count++;
 	}
 	mutex_unlock(&list_lock);
@@ -189,7 +190,8 @@ static int __init init(void)
 			struct page *pg =
 				pfn_to_page(xen_extra_mem[i].start_pfn + j);
 
-			list_add(&pg->lru, &page_list);
+			pg->zone_device_data = page_list;
+			page_list = pg;
 			list_count++;
 		}
 	}
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index c6ef8ffc1a09..b9c937b3a149 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -200,7 +200,11 @@ void gnttab_free_pages(int nr_pages, struct page **pages);
 
 struct gnttab_page_cache {
 	spinlock_t		lock;
+#ifdef CONFIG_XEN_UNPOPULATED_ALLOC
+	struct page		*pages;
+#else
 	struct list_head	pages;
+#endif
 	unsigned int		num_pages;
 };
 
commit ca33479cc7be2c9b5f8be078c8bf3ac26b7d6186
Author: Juergen Gross <jgross at suse.com>
Date:   Mon Dec 7 08:31:22 2020 +0100

    xen: add helpers for caching grant mapping pages
    
    Instead of having similar helpers in multiple backend drivers use
    common helpers for caching pages allocated via gnttab_alloc_pages().
    
    Make use of those helpers in blkback and scsiback.
    
    Cc: <stable at vger.kernel.org> # 5.9
    Signed-off-by: Juergen Gross <jgross at suse.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovksy at oracle.com>
    Signed-off-by: Juergen Gross <jgross at suse.com>

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 501e9dacfff9..9ebf53903d7b 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -132,73 +132,12 @@ module_param(log_stats, int, 0644);
 
 #define BLKBACK_INVALID_HANDLE (~0)
 
-/* Number of free pages to remove on each call to gnttab_free_pages */
-#define NUM_BATCH_FREE_PAGES 10
-
 static inline bool persistent_gnt_timeout(struct persistent_gnt *persistent_gnt)
 {
 	return pgrant_timeout && (jiffies - persistent_gnt->last_used >=
 			HZ * pgrant_timeout);
 }
 
-static inline int get_free_page(struct xen_blkif_ring *ring, struct page **page)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&ring->free_pages_lock, flags);
-	if (list_empty(&ring->free_pages)) {
-		BUG_ON(ring->free_pages_num != 0);
-		spin_unlock_irqrestore(&ring->free_pages_lock, flags);
-		return gnttab_alloc_pages(1, page);
-	}
-	BUG_ON(ring->free_pages_num == 0);
-	page[0] = list_first_entry(&ring->free_pages, struct page, lru);
-	list_del(&page[0]->lru);
-	ring->free_pages_num--;
-	spin_unlock_irqrestore(&ring->free_pages_lock, flags);
-
-	return 0;
-}
-
-static inline void put_free_pages(struct xen_blkif_ring *ring, struct page **page,
-                                  int num)
-{
-	unsigned long flags;
-	int i;
-
-	spin_lock_irqsave(&ring->free_pages_lock, flags);
-	for (i = 0; i < num; i++)
-		list_add(&page[i]->lru, &ring->free_pages);
-	ring->free_pages_num += num;
-	spin_unlock_irqrestore(&ring->free_pages_lock, flags);
-}
-
-static inline void shrink_free_pagepool(struct xen_blkif_ring *ring, int num)
-{
-	/* Remove requested pages in batches of NUM_BATCH_FREE_PAGES */
-	struct page *page[NUM_BATCH_FREE_PAGES];
-	unsigned int num_pages = 0;
-	unsigned long flags;
-
-	spin_lock_irqsave(&ring->free_pages_lock, flags);
-	while (ring->free_pages_num > num) {
-		BUG_ON(list_empty(&ring->free_pages));
-		page[num_pages] = list_first_entry(&ring->free_pages,
-		                                   struct page, lru);
-		list_del(&page[num_pages]->lru);
-		ring->free_pages_num--;
-		if (++num_pages == NUM_BATCH_FREE_PAGES) {
-			spin_unlock_irqrestore(&ring->free_pages_lock, flags);
-			gnttab_free_pages(num_pages, page);
-			spin_lock_irqsave(&ring->free_pages_lock, flags);
-			num_pages = 0;
-		}
-	}
-	spin_unlock_irqrestore(&ring->free_pages_lock, flags);
-	if (num_pages != 0)
-		gnttab_free_pages(num_pages, page);
-}
-
 #define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page)))
 
 static int do_block_io_op(struct xen_blkif_ring *ring, unsigned int *eoi_flags);
@@ -331,7 +270,8 @@ static void free_persistent_gnts(struct xen_blkif_ring *ring, struct rb_root *ro
 			unmap_data.count = segs_to_unmap;
 			BUG_ON(gnttab_unmap_refs_sync(&unmap_data));
 
-			put_free_pages(ring, pages, segs_to_unmap);
+			gnttab_page_cache_put(&ring->free_pages, pages,
+					      segs_to_unmap);
 			segs_to_unmap = 0;
 		}
 
@@ -371,7 +311,8 @@ void xen_blkbk_unmap_purged_grants(struct work_struct *work)
 		if (++segs_to_unmap == BLKIF_MAX_SEGMENTS_PER_REQUEST) {
 			unmap_data.count = segs_to_unmap;
 			BUG_ON(gnttab_unmap_refs_sync(&unmap_data));
-			put_free_pages(ring, pages, segs_to_unmap);
+			gnttab_page_cache_put(&ring->free_pages, pages,
+					      segs_to_unmap);
 			segs_to_unmap = 0;
 		}
 		kfree(persistent_gnt);
@@ -379,7 +320,7 @@ void xen_blkbk_unmap_purged_grants(struct work_struct *work)
 	if (segs_to_unmap > 0) {
 		unmap_data.count = segs_to_unmap;
 		BUG_ON(gnttab_unmap_refs_sync(&unmap_data));
-		put_free_pages(ring, pages, segs_to_unmap);
+		gnttab_page_cache_put(&ring->free_pages, pages, segs_to_unmap);
 	}
 }
 
@@ -664,9 +605,10 @@ purge_gnt_list:
 
 		/* Shrink the free pages pool if it is too large. */
 		if (time_before(jiffies, blkif->buffer_squeeze_end))
-			shrink_free_pagepool(ring, 0);
+			gnttab_page_cache_shrink(&ring->free_pages, 0);
 		else
-			shrink_free_pagepool(ring, max_buffer_pages);
+			gnttab_page_cache_shrink(&ring->free_pages,
+						 max_buffer_pages);
 
 		if (log_stats && time_after(jiffies, ring->st_print))
 			print_stats(ring);
@@ -697,7 +639,7 @@ void xen_blkbk_free_caches(struct xen_blkif_ring *ring)
 	ring->persistent_gnt_c = 0;
 
 	/* Since we are shutting down remove all pages from the buffer */
-	shrink_free_pagepool(ring, 0 /* All */);
+	gnttab_page_cache_shrink(&ring->free_pages, 0 /* All */);
 }
 
 static unsigned int xen_blkbk_unmap_prepare(
@@ -736,7 +678,7 @@ static void xen_blkbk_unmap_and_respond_callback(int result, struct gntab_unmap_
 	   but is this the best way to deal with this? */
 	BUG_ON(result);
 
-	put_free_pages(ring, data->pages, data->count);
+	gnttab_page_cache_put(&ring->free_pages, data->pages, data->count);
 	make_response(ring, pending_req->id,
 		      pending_req->operation, pending_req->status);
 	free_req(ring, pending_req);
@@ -803,7 +745,8 @@ static void xen_blkbk_unmap(struct xen_blkif_ring *ring,
 		if (invcount) {
 			ret = gnttab_unmap_refs(unmap, NULL, unmap_pages, invcount);
 			BUG_ON(ret);
-			put_free_pages(ring, unmap_pages, invcount);
+			gnttab_page_cache_put(&ring->free_pages, unmap_pages,
+					      invcount);
 		}
 		pages += batch;
 		num -= batch;
@@ -850,7 +793,8 @@ again:
 			pages[i]->page = persistent_gnt->page;
 			pages[i]->persistent_gnt = persistent_gnt;
 		} else {
-			if (get_free_page(ring, &pages[i]->page))
+			if (gnttab_page_cache_get(&ring->free_pages,
+						  &pages[i]->page))
 				goto out_of_memory;
 			addr = vaddr(pages[i]->page);
 			pages_to_gnt[segs_to_map] = pages[i]->page;
@@ -883,7 +827,8 @@ again:
 			BUG_ON(new_map_idx >= segs_to_map);
 			if (unlikely(map[new_map_idx].status != 0)) {
 				pr_debug("invalid buffer -- could not remap it\n");
-				put_free_pages(ring, &pages[seg_idx]->page, 1);
+				gnttab_page_cache_put(&ring->free_pages,
+						      &pages[seg_idx]->page, 1);
 				pages[seg_idx]->handle = BLKBACK_INVALID_HANDLE;
 				ret |= 1;
 				goto next;
@@ -944,7 +889,7 @@ next:
 
 out_of_memory:
 	pr_alert("%s: out of memory\n", __func__);
-	put_free_pages(ring, pages_to_gnt, segs_to_map);
+	gnttab_page_cache_put(&ring->free_pages, pages_to_gnt, segs_to_map);
 	for (i = last_map; i < num; i++)
 		pages[i]->handle = BLKBACK_INVALID_HANDLE;
 	return -ENOMEM;
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index c6ea5d38c509..a1b9df2c4ef1 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -288,9 +288,7 @@ struct xen_blkif_ring {
 	struct work_struct	persistent_purge_work;
 
 	/* Buffer of free pages to map grant refs. */
-	spinlock_t		free_pages_lock;
-	int			free_pages_num;
-	struct list_head	free_pages;
+	struct gnttab_page_cache free_pages;
 
 	struct work_struct	free_work;
 	/* Thread shutdown wait queue. */
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index f5705569e2a7..76912c584a76 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -144,8 +144,7 @@ static int xen_blkif_alloc_rings(struct xen_blkif *blkif)
 		INIT_LIST_HEAD(&ring->pending_free);
 		INIT_LIST_HEAD(&ring->persistent_purge_list);
 		INIT_WORK(&ring->persistent_purge_work, xen_blkbk_unmap_purged_grants);
-		spin_lock_init(&ring->free_pages_lock);
-		INIT_LIST_HEAD(&ring->free_pages);
+		gnttab_page_cache_init(&ring->free_pages);
 
 		spin_lock_init(&ring->pending_free_lock);
 		init_waitqueue_head(&ring->pending_free_wq);
@@ -317,8 +316,7 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif)
 		BUG_ON(atomic_read(&ring->persistent_gnt_in_use) != 0);
 		BUG_ON(!list_empty(&ring->persistent_purge_list));
 		BUG_ON(!RB_EMPTY_ROOT(&ring->persistent_gnts));
-		BUG_ON(!list_empty(&ring->free_pages));
-		BUG_ON(ring->free_pages_num != 0);
+		BUG_ON(ring->free_pages.num_pages != 0);
 		BUG_ON(ring->persistent_gnt_c != 0);
 		WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
 		ring->active = false;
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 523dcdf39cc9..e2e42912f241 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -813,6 +813,78 @@ int gnttab_alloc_pages(int nr_pages, struct page **pages)
 }
 EXPORT_SYMBOL_GPL(gnttab_alloc_pages);
 
+void gnttab_page_cache_init(struct gnttab_page_cache *cache)
+{
+	spin_lock_init(&cache->lock);
+	INIT_LIST_HEAD(&cache->pages);
+	cache->num_pages = 0;
+}
+EXPORT_SYMBOL_GPL(gnttab_page_cache_init);
+
+int gnttab_page_cache_get(struct gnttab_page_cache *cache, struct page **page)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&cache->lock, flags);
+
+	if (list_empty(&cache->pages)) {
+		spin_unlock_irqrestore(&cache->lock, flags);
+		return gnttab_alloc_pages(1, page);
+	}
+
+	page[0] = list_first_entry(&cache->pages, struct page, lru);
+	list_del(&page[0]->lru);
+	cache->num_pages--;
+
+	spin_unlock_irqrestore(&cache->lock, flags);
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(gnttab_page_cache_get);
+
+void gnttab_page_cache_put(struct gnttab_page_cache *cache, struct page **page,
+			   unsigned int num)
+{
+	unsigned long flags;
+	unsigned int i;
+
+	spin_lock_irqsave(&cache->lock, flags);
+
+	for (i = 0; i < num; i++)
+		list_add(&page[i]->lru, &cache->pages);
+	cache->num_pages += num;
+
+	spin_unlock_irqrestore(&cache->lock, flags);
+}
+EXPORT_SYMBOL_GPL(gnttab_page_cache_put);
+
+void gnttab_page_cache_shrink(struct gnttab_page_cache *cache, unsigned int num)
+{
+	struct page *page[10];
+	unsigned int i = 0;
+	unsigned long flags;
+
+	spin_lock_irqsave(&cache->lock, flags);
+
+	while (cache->num_pages > num) {
+		page[i] = list_first_entry(&cache->pages, struct page, lru);
+		list_del(&page[i]->lru);
+		cache->num_pages--;
+		if (++i == ARRAY_SIZE(page)) {
+			spin_unlock_irqrestore(&cache->lock, flags);
+			gnttab_free_pages(i, page);
+			i = 0;
+			spin_lock_irqsave(&cache->lock, flags);
+		}
+	}
+
+	spin_unlock_irqrestore(&cache->lock, flags);
+
+	if (i != 0)
+		gnttab_free_pages(i, page);
+}
+EXPORT_SYMBOL_GPL(gnttab_page_cache_shrink);
+
 void gnttab_pages_clear_private(int nr_pages, struct page **pages)
 {
 	int i;
diff --git a/drivers/xen/xen-scsiback.c b/drivers/xen/xen-scsiback.c
index 4acc4e899600..862162dca33c 100644
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -99,6 +99,8 @@ struct vscsibk_info {
 	struct list_head v2p_entry_lists;
 
 	wait_queue_head_t waiting_to_free;
+
+	struct gnttab_page_cache free_pages;
 };
 
 /* theoretical maximum of grants for one request */
@@ -188,10 +190,6 @@ module_param_named(max_buffer_pages, scsiback_max_buffer_pages, int, 0644);
 MODULE_PARM_DESC(max_buffer_pages,
 "Maximum number of free pages to keep in backend buffer");
 
-static DEFINE_SPINLOCK(free_pages_lock);
-static int free_pages_num;
-static LIST_HEAD(scsiback_free_pages);
-
 /* Global spinlock to protect scsiback TPG list */
 static DEFINE_MUTEX(scsiback_mutex);
 static LIST_HEAD(scsiback_list);
@@ -207,41 +205,6 @@ static void scsiback_put(struct vscsibk_info *info)
 		wake_up(&info->waiting_to_free);
 }
 
-static void put_free_pages(struct page **page, int num)
-{
-	unsigned long flags;
-	int i = free_pages_num + num, n = num;
-
-	if (num == 0)
-		return;
-	if (i > scsiback_max_buffer_pages) {
-		n = min(num, i - scsiback_max_buffer_pages);
-		gnttab_free_pages(n, page + num - n);
-		n = num - n;
-	}
-	spin_lock_irqsave(&free_pages_lock, flags);
-	for (i = 0; i < n; i++)
-		list_add(&page[i]->lru, &scsiback_free_pages);
-	free_pages_num += n;
-	spin_unlock_irqrestore(&free_pages_lock, flags);
-}
-
-static int get_free_page(struct page **page)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&free_pages_lock, flags);
-	if (list_empty(&scsiback_free_pages)) {
-		spin_unlock_irqrestore(&free_pages_lock, flags);
-		return gnttab_alloc_pages(1, page);
-	}
-	page[0] = list_first_entry(&scsiback_free_pages, struct page, lru);
-	list_del(&page[0]->lru);
-	free_pages_num--;
-	spin_unlock_irqrestore(&free_pages_lock, flags);
-	return 0;
-}
-
 static unsigned long vaddr_page(struct page *page)
 {
 	unsigned long pfn = page_to_pfn(page);
@@ -302,7 +265,8 @@ static void scsiback_fast_flush_area(struct vscsibk_pend *req)
 		BUG_ON(err);
 	}
 
-	put_free_pages(req->pages, req->n_grants);
+	gnttab_page_cache_put(&req->info->free_pages, req->pages,
+			      req->n_grants);
 	req->n_grants = 0;
 }
 
@@ -445,8 +409,8 @@ static int scsiback_gnttab_data_map_list(struct vscsibk_pend *pending_req,
 	struct vscsibk_info *info = pending_req->info;
 
 	for (i = 0; i < cnt; i++) {
-		if (get_free_page(pg + mapcount)) {
-			put_free_pages(pg, mapcount);
+		if (gnttab_page_cache_get(&info->free_pages, pg + mapcount)) {
+			gnttab_page_cache_put(&info->free_pages, pg, mapcount);
 			pr_err("no grant page\n");
 			return -ENOMEM;
 		}
@@ -796,6 +760,8 @@ static int scsiback_do_cmd_fn(struct vscsibk_info *info,
 		cond_resched();
 	}
 
+	gnttab_page_cache_shrink(&info->free_pages, scsiback_max_buffer_pages);
+
 	RING_FINAL_CHECK_FOR_REQUESTS(&info->ring, more_to_do);
 	return more_to_do;
 }
@@ -1233,6 +1199,8 @@ static int scsiback_remove(struct xenbus_device *dev)
 
 	scsiback_release_translation_entry(info);
 
+	gnttab_page_cache_shrink(&info->free_pages, 0);
+
 	dev_set_drvdata(&dev->dev, NULL);
 
 	return 0;
@@ -1263,6 +1231,7 @@ static int scsiback_probe(struct xenbus_device *dev,
 	info->irq = 0;
 	INIT_LIST_HEAD(&info->v2p_entry_lists);
 	spin_lock_init(&info->v2p_lock);
+	gnttab_page_cache_init(&info->free_pages);
 
 	err = xenbus_printf(XBT_NIL, dev->nodename, "feature-sg-grant", "%u",
 			    SG_ALL);
@@ -1879,13 +1848,6 @@ out:
 
 static void __exit scsiback_exit(void)
 {
-	struct page *page;
-
-	while (free_pages_num) {
-		if (get_free_page(&page))
-			BUG();
-		gnttab_free_pages(1, &page);
-	}
 	target_unregister_template(&scsiback_ops);
 	xenbus_unregister_driver(&scsiback_driver);
 }
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index 9bc5bc07d4d3..c6ef8ffc1a09 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -198,6 +198,19 @@ void gnttab_free_auto_xlat_frames(void);
 int gnttab_alloc_pages(int nr_pages, struct page **pages);
 void gnttab_free_pages(int nr_pages, struct page **pages);
 
+struct gnttab_page_cache {
+	spinlock_t		lock;
+	struct list_head	pages;
+	unsigned int		num_pages;
+};
+
+void gnttab_page_cache_init(struct gnttab_page_cache *cache);
+int gnttab_page_cache_get(struct gnttab_page_cache *cache, struct page **page);
+void gnttab_page_cache_put(struct gnttab_page_cache *cache, struct page **page,
+			   unsigned int num);
+void gnttab_page_cache_shrink(struct gnttab_page_cache *cache,
+			      unsigned int num);
+
 #ifdef CONFIG_XEN_GRANT_DMA_ALLOC
 struct gnttab_dma_alloc_args {
 	/* Device for which DMA memory will be/was allocated. */
commit 263ade7166a2e589c5b605272690c155c0637dcb
Author: Chunyan Zhang <chunyan.zhang at unisoc.com>
Date:   Wed Dec 9 13:51:06 2020 +0800

    gpio: eic-sprd: break loop when getting NULL device resource
    
    EIC controller have unfixed numbers of banks on different Spreadtrum SoCs,
    and each bank has its own base address, the loop of getting there base
    address in driver should break if the resource gotten via
    platform_get_resource() is NULL already. The later ones would be all NULL
    even if the loop continues.
    
    Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
    Signed-off-by: Chunyan Zhang <chunyan.zhang at unisoc.com>
    Link: https://lore.kernel.org/r/20201209055106.840100-1-zhang.lyra@gmail.com
    Signed-off-by: Linus Walleij <linus.walleij at linaro.org>

diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c
index ad61daf6c212..865ab2b34fdd 100644
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -598,7 +598,7 @@ static int sprd_eic_probe(struct platform_device *pdev)
 		 */
 		res = platform_get_resource(pdev, IORESOURCE_MEM, i);
 		if (!res)
-			continue;
+			break;
 
 		sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res);
 		if (IS_ERR(sprd_eic->base[i]))
commit e45cdc71d1fa5ac3a57b23acc31eb959e4f60135
Author: Andy Lutomirski <luto at kernel.org>
Date:   Thu Dec 3 21:07:06 2020 -0800

    membarrier: Execute SYNC_CORE on the calling thread
    
    membarrier()'s MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE is documented as
    syncing the core on all sibling threads but not necessarily the calling
    thread.  This behavior is fundamentally buggy and cannot be used safely.
    
    Suppose a user program has two threads.  Thread A is on CPU 0 and thread B
    is on CPU 1.  Thread A modifies some text and calls
    membarrier(MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE).
    
    Then thread B executes the modified code.  If, at any point after
    membarrier() decides which CPUs to target, thread A could be preempted and
    replaced by thread B on CPU 0.  This could even happen on exit from the
    membarrier() syscall.  If this happens, thread B will end up running on CPU
    0 without having synced.
    
    In principle, this could be fixed by arranging for the scheduler to issue
    sync_core_before_usermode() whenever switching between two threads in the
    same mm if there is any possibility of a concurrent membarrier() call, but
    this would have considerable overhead.  Instead, make membarrier() sync the
    calling CPU as well.
    
    As an optimization, this avoids an extra smp_mb() in the default
    barrier-only mode and an extra rseq preempt on the caller.
    
    Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
    Signed-off-by: Andy Lutomirski <luto at kernel.org>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
    Link: https://lore.kernel.org/r/250ded637696d490c69bef1877148db86066881c.1607058304.git.luto@kernel.org

diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 1c278dff4f2d..9d8df34bea75 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -194,7 +194,8 @@ static int membarrier_private_expedited(int flags, int cpu_id)
 			return -EPERM;
 	}
 
-	if (atomic_read(&mm->mm_users) == 1 || num_online_cpus() == 1)
+	if (flags != MEMBARRIER_FLAG_SYNC_CORE &&
+	    (atomic_read(&mm->mm_users) == 1 || num_online_cpus() == 1))
 		return 0;
 
 	/*
@@ -213,8 +214,6 @@ static int membarrier_private_expedited(int flags, int cpu_id)
 
 		if (cpu_id >= nr_cpu_ids || !cpu_online(cpu_id))
 			goto out;
-		if (cpu_id == raw_smp_processor_id())
-			goto out;
 		rcu_read_lock();
 		p = rcu_dereference(cpu_rq(cpu_id)->curr);
 		if (!p || p->mm != mm) {
@@ -229,16 +228,6 @@ static int membarrier_private_expedited(int flags, int cpu_id)
 		for_each_online_cpu(cpu) {
 			struct task_struct *p;
 
-			/*
-			 * Skipping the current CPU is OK even through we can be
-			 * migrated at any point. The current CPU, at the point
-			 * where we read raw_smp_processor_id(), is ensured to
-			 * be in program order with respect to the caller
-			 * thread. Therefore, we can skip this CPU from the
-			 * iteration.
-			 */
-			if (cpu == raw_smp_processor_id())
-				continue;
 			p = rcu_dereference(cpu_rq(cpu)->curr);
 			if (p && p->mm == mm)
 				__cpumask_set_cpu(cpu, tmpmask);
@@ -246,12 +235,38 @@ static int membarrier_private_expedited(int flags, int cpu_id)
 		rcu_read_unlock();
 	}
 
-	preempt_disable();
-	if (cpu_id >= 0)
+	if (cpu_id >= 0) {
+		/*
+		 * smp_call_function_single() will call ipi_func() if cpu_id
+		 * is the calling CPU.
+		 */
 		smp_call_function_single(cpu_id, ipi_func, NULL, 1);
-	else
-		smp_call_function_many(tmpmask, ipi_func, NULL, 1);
-	preempt_enable();
+	} else {
+		/*
+		 * For regular membarrier, we can save a few cycles by
+		 * skipping the current cpu -- we're about to do smp_mb()
+		 * below, and if we migrate to a different cpu, this cpu
+		 * and the new cpu will execute a full barrier in the
+		 * scheduler.
+		 *
+		 * For SYNC_CORE, we do need a barrier on the current cpu --
+		 * otherwise, if we are migrated and replaced by a different
+		 * task in the same mm just before, during, or after
+		 * membarrier, we will end up with some thread in the mm
+		 * running without a core sync.
+		 *
+		 * For RSEQ, don't rseq_preempt() the caller.  User code
+		 * is not supposed to issue syscalls at all from inside an
+		 * rseq critical section.
+		 */
+		if (flags != MEMBARRIER_FLAG_SYNC_CORE) {
+			preempt_disable();
+			smp_call_function_many(tmpmask, ipi_func, NULL, true);
+			preempt_enable();
+		} else {
+			on_each_cpu_mask(tmpmask, ipi_func, NULL, true);
+		}
+	}
 
 out:
 	if (cpu_id < 0)
commit 758c9373d84168dc7d039cf85a0e920046b17b41
Author: Andy Lutomirski <luto at kernel.org>
Date:   Thu Dec 3 21:07:05 2020 -0800

    membarrier: Explicitly sync remote cores when SYNC_CORE is requested
    
    membarrier() does not explicitly sync_core() remote CPUs; instead, it
    relies on the assumption that an IPI will result in a core sync.  On x86,
    this may be true in practice, but it's not architecturally reliable.  In
    particular, the SDM and APM do not appear to guarantee that interrupt
    delivery is serializing.  While IRET does serialize, IPI return can
    schedule, thereby switching to another task in the same mm that was
    sleeping in a syscall.  The new task could then SYSRET back to usermode
    without ever executing IRET.
    
    Make this more robust by explicitly calling sync_core_before_usermode()
    on remote cores.  (This also helps people who search the kernel tree for
    instances of sync_core() and sync_core_before_usermode() -- one might be
    surprised that the core membarrier code doesn't currently show up in a
    such a search.)
    
    Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
    Signed-off-by: Andy Lutomirski <luto at kernel.org>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/776b448d5f7bd6b12690707f5ed67bcda7f1d427.1607058304.git.luto@kernel.org

diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 7d98ef5d3bcd..1c278dff4f2d 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -38,6 +38,23 @@ static void ipi_mb(void *info)
 	smp_mb();	/* IPIs should be serializing but paranoid. */
 }
 
+static void ipi_sync_core(void *info)
+{
+	/*
+	 * The smp_mb() in membarrier after all the IPIs is supposed to
+	 * ensure that memory on remote CPUs that occur before the IPI
+	 * become visible to membarrier()'s caller -- see scenario B in
+	 * the big comment at the top of this file.
+	 *
+	 * A sync_core() would provide this guarantee, but
+	 * sync_core_before_usermode() might end up being deferred until
+	 * after membarrier()'s smp_mb().
+	 */
+	smp_mb();	/* IPIs should be serializing but paranoid. */
+
+	sync_core_before_usermode();
+}
+
 static void ipi_rseq(void *info)
 {
 	/*
@@ -162,6 +179,7 @@ static int membarrier_private_expedited(int flags, int cpu_id)
 		if (!(atomic_read(&mm->membarrier_state) &
 		      MEMBARRIER_STATE_PRIVATE_EXPEDITED_SYNC_CORE_READY))
 			return -EPERM;
+		ipi_func = ipi_sync_core;
 	} else if (flags == MEMBARRIER_FLAG_RSEQ) {
 		if (!IS_ENABLED(CONFIG_RSEQ))
 			return -EINVAL;
commit 2ecedd7569080fd05c1a457e8af2165afecfa29f
Author: Andy Lutomirski <luto at kernel.org>
Date:   Thu Dec 3 21:07:04 2020 -0800

    membarrier: Add an actual barrier before rseq_preempt()
    
    It seems that most RSEQ membarrier users will expect any stores done before
    the membarrier() syscall to be visible to the target task(s).  While this
    is extremely likely to be true in practice, nothing actually guarantees it
    by a strict reading of the x86 manuals.  Rather than providing this
    guarantee by accident and potentially causing a problem down the road, just
    add an explicit barrier.
    
    Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
    Signed-off-by: Andy Lutomirski <luto at kernel.org>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/d3e7197e034fa4852afcf370ca49c30496e58e40.1607058304.git.luto@kernel.org

diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index e23e74d52db5..7d98ef5d3bcd 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -40,6 +40,14 @@ static void ipi_mb(void *info)
 
 static void ipi_rseq(void *info)
 {
+	/*
+	 * Ensure that all stores done by the calling thread are visible
+	 * to the current task before the current task resumes.  We could
+	 * probably optimize this away on most architectures, but by the
+	 * time we've already sent an IPI, the cost of the extra smp_mb()
+	 * is negligible.
+	 */
+	smp_mb();
 	rseq_preempt(current);
 }
 
commit a493d1ca1a03b532871f1da27f8dbda2b28b04c4
Author: Andy Lutomirski <luto at kernel.org>
Date:   Thu Dec 3 21:07:03 2020 -0800

    x86/membarrier: Get rid of a dubious optimization
    
    sync_core_before_usermode() had an incorrect optimization.  If the kernel
    returns from an interrupt, it can get to usermode without IRET. It just has
    to schedule to a different task in the same mm and do SYSRET.  Fortunately,
    there were no callers of sync_core_before_usermode() that could have had
    in_irq() or in_nmi() equal to true, because it's only ever called from the
    scheduler.
    
    While at it, clarify a related comment.
    
    Fixes: 70216e18e519 ("membarrier: Provide core serializing command, *_SYNC_CORE")
    Signed-off-by: Andy Lutomirski <luto at kernel.org>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
    Cc: stable at vger.kernel.org
    Link: https://lore.kernel.org/r/5afc7632be1422f91eaf7611aaaa1b5b8580a086.1607058304.git.luto@kernel.org

diff --git a/arch/x86/include/asm/sync_core.h b/arch/x86/include/asm/sync_core.h
index 0fd4a9dfb29c..ab7382f92aff 100644
--- a/arch/x86/include/asm/sync_core.h
+++ b/arch/x86/include/asm/sync_core.h
@@ -98,12 +98,13 @@ static inline void sync_core_before_usermode(void)
 	/* With PTI, we unconditionally serialize before running user code. */
 	if (static_cpu_has(X86_FEATURE_PTI))
 		return;
+
 	/*
-	 * Return from interrupt and NMI is done through iret, which is core
-	 * serializing.
+	 * Even if we're in an interrupt, we might reschedule before returning,
+	 * in which case we could switch to a different thread in the same mm
+	 * and return using SYSRET or SYSEXIT.  Instead of trying to keep
+	 * track of our need to sync the core, just sync right away.
 	 */
-	if (in_irq() || in_nmi())
-		return;
 	sync_core();
 }
 
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 11666ba19b62..569ac1d57f55 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -474,8 +474,14 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
 	/*
 	 * The membarrier system call requires a full memory barrier and
 	 * core serialization before returning to user-space, after
-	 * storing to rq->curr. Writing to CR3 provides that full
-	 * memory barrier and core serializing instruction.
+	 * storing to rq->curr, when changing mm.  This is because
+	 * membarrier() sends IPIs to all CPUs that are in the target mm
+	 * to make them issue memory barriers.  However, if another CPU
+	 * switches to/from the target mm concurrently with
+	 * membarrier(), it can cause that CPU not to receive an IPI
+	 * when it really should issue a memory barrier.  Writing to CR3
+	 * provides that full memory barrier and core serializing
+	 * instruction.
 	 */
 	if (real_prev == next) {
 		VM_WARN_ON(this_cpu_read(cpu_tlbstate.ctxs[prev_asid].ctx_id) !=
commit e8873c0afd34beb67ec492cd648dd0095b911f65
Author: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
Date:   Tue Dec 8 20:24:03 2020 +0200

    pinctrl: intel: Actually disable Tx and Rx buffers on GPIO request
    
    Mistakenly the buffers (input and output) become enabled together for a short
    period of time during GPIO request. This is problematic, because instead of
    initial motive to disable them in the commit af7e3eeb84e2
    ("pinctrl: intel: Disable input and output buffer when switching to GPIO"),
    the driven value on the pin, which might be used as an IRQ line, brings
    firmwares of some touch pads to an awkward state that needs a full power off
    to recover. Fix this, as stated in the culprit commit, by disabling the buffers.
    
    Fixes: af7e3eeb84e2 ("pinctrl: intel: Disable input and output buffer when switching to GPIO")
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210497
    Reported-by: Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>
    Signed-off-by: Andy Shevchenko <andriy.shevchenko at linux.intel.com>
    Acked-by: Mika Westerberg <mika.westerberg at linux.intel.com>
    Tested-by: Pierre-Louis Bossart <pierre-louis.bossart at linux.intel.com>
    Tested-by: Kai-Heng Feng <kai.heng.feng at canonical.com>
    Link: https://lore.kernel.org/r/20201208182403.40435-1-andriy.shevchenko@linux.intel.com
    Signed-off-by: Linus Walleij <linus.walleij at linaro.org>

diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
index 1c10ab184783..b6ef1911c1dd 100644
--- a/drivers/pinctrl/intel/pinctrl-intel.c
+++ b/drivers/pinctrl/intel/pinctrl-intel.c
@@ -442,8 +442,8 @@ static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
 	value |= PADCFG0_PMODE_GPIO;
 
 	/* Disable input and output buffers */
-	value &= ~PADCFG0_GPIORXDIS;
-	value &= ~PADCFG0_GPIOTXDIS;
+	value |= PADCFG0_GPIORXDIS;
+	value |= PADCFG0_GPIOTXDIS;
 
 	/* Disable SCI/SMI/NMI generation */
 	value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
commit a68a0262abdaa251e12c53715f48e698a18ef402
Author: Minchan Kim <minchan at kernel.org>
Date:   Tue Dec 8 20:57:18 2020 -0800

    mm/madvise: remove racy mm ownership check
    
    Jann spotted the security hole due to race of mm ownership check.
    
    If the task is sharing the mm_struct but goes through execve() before
    mm_access(), it could skip process_madvise_behavior_valid check.  That
    makes *any advice hint* to reach into the remote process.
    
    This patch removes the mm ownership check.  With it, it will lose the
    ability that local process could give *any* advice hint with vector
    interface for some reason (e.g., performance).  Since there is no
    concrete example in upstream yet, it would be better to remove the
    abiliity at this moment and need to review when such new advice comes
    up.
    
    Fixes: ecb8ac8b1f14 ("mm/madvise: introduce process_madvise() syscall: an external memory hinting API")
    Reported-by: Jann Horn <jannh at google.com>
    Suggested-by: Jann Horn <jannh at google.com>
    Signed-off-by: Minchan Kim <minchan at kernel.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/madvise.c b/mm/madvise.c
index a8d8d48a57fe..13f5677b9322 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -1204,8 +1204,7 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec,
 		goto put_pid;
 	}
 
-	if (task->mm != current->mm &&
-			!process_madvise_behavior_valid(behavior)) {
+	if (!process_madvise_behavior_valid(behavior)) {
 		ret = -EINVAL;
 		goto release_task;
 	}
commit 0e830d2872cf6e75ef6619edd23050ddf3673358
Author: Alex Deucher <alexander.deucher at amd.com>
Date:   Tue Dec 1 17:44:58 2020 -0500

    drm/amdgpu/powerplay: parse fan table for CI asics
    
    Set up all the parameters required for SMU fan control if supported.
    
    Bug: https://bugzilla.kernel.org/show_bug.cgi?id=201539
    Acked-by: Evan Quan <evan.quan at amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
    Cc: stable at vger.kernel.org

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
index 719597c5d27d..6606511891e3 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c
@@ -24,6 +24,8 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
+#include <linux/pci.h>
+
 #include <drm/amdgpu_drm.h>
 #include "processpptables.h"
 #include <atom-types.h>
@@ -984,6 +986,8 @@ static int init_thermal_controller(
 			struct pp_hwmgr *hwmgr,
 			const ATOM_PPLIB_POWERPLAYTABLE *powerplay_table)
 {
+	struct amdgpu_device *adev = hwmgr->adev;
+
 	hwmgr->thermal_controller.ucType =
 			powerplay_table->sThermalController.ucType;
 	hwmgr->thermal_controller.ucI2cLine =
@@ -1008,7 +1012,104 @@ static int init_thermal_controller(
 		   ATOM_PP_THERMALCONTROLLER_NONE != hwmgr->thermal_controller.ucType,
 		   PHM_PlatformCaps_ThermalController);
 
-	hwmgr->thermal_controller.use_hw_fan_control = 1;
+        if (powerplay_table->usTableSize >= sizeof(ATOM_PPLIB_POWERPLAYTABLE3)) {
+		const ATOM_PPLIB_POWERPLAYTABLE3 *powerplay_table3 =
+			(const ATOM_PPLIB_POWERPLAYTABLE3 *)powerplay_table;
+
+		if (0 == le16_to_cpu(powerplay_table3->usFanTableOffset)) {
+			hwmgr->thermal_controller.use_hw_fan_control = 1;
+			return 0;
+		} else {
+			const ATOM_PPLIB_FANTABLE *fan_table =
+				(const ATOM_PPLIB_FANTABLE *)(((unsigned long)powerplay_table) +
+							      le16_to_cpu(powerplay_table3->usFanTableOffset));
+
+			if (1 <= fan_table->ucFanTableFormat) {
+				hwmgr->thermal_controller.advanceFanControlParameters.ucTHyst =
+					fan_table->ucTHyst;
+				hwmgr->thermal_controller.advanceFanControlParameters.usTMin =
+					le16_to_cpu(fan_table->usTMin);
+				hwmgr->thermal_controller.advanceFanControlParameters.usTMed =
+					le16_to_cpu(fan_table->usTMed);
+				hwmgr->thermal_controller.advanceFanControlParameters.usTHigh =
+					le16_to_cpu(fan_table->usTHigh);
+				hwmgr->thermal_controller.advanceFanControlParameters.usPWMMin =
+					le16_to_cpu(fan_table->usPWMMin);
+				hwmgr->thermal_controller.advanceFanControlParameters.usPWMMed =
+					le16_to_cpu(fan_table->usPWMMed);
+				hwmgr->thermal_controller.advanceFanControlParameters.usPWMHigh =
+					le16_to_cpu(fan_table->usPWMHigh);
+				hwmgr->thermal_controller.advanceFanControlParameters.usTMax = 10900;
+				hwmgr->thermal_controller.advanceFanControlParameters.ulCycleDelay = 100000;
+
+				phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+					    PHM_PlatformCaps_MicrocodeFanControl);
+			}
+
+			if (2 <= fan_table->ucFanTableFormat) {
+				const ATOM_PPLIB_FANTABLE2 *fan_table2 =
+					(const ATOM_PPLIB_FANTABLE2 *)(((unsigned long)powerplay_table) +
+								       le16_to_cpu(powerplay_table3->usFanTableOffset));
+				hwmgr->thermal_controller.advanceFanControlParameters.usTMax =
+					le16_to_cpu(fan_table2->usTMax);
+			}
+
+			if (3 <= fan_table->ucFanTableFormat) {
+				const ATOM_PPLIB_FANTABLE3 *fan_table3 =
+					(const ATOM_PPLIB_FANTABLE3 *) (((unsigned long)powerplay_table) +
+									le16_to_cpu(powerplay_table3->usFanTableOffset));
+
+				hwmgr->thermal_controller.advanceFanControlParameters.ucFanControlMode =
+					fan_table3->ucFanControlMode;
+
+				if ((3 == fan_table->ucFanTableFormat) &&
+				    (0x67B1 == adev->pdev->device))
+					hwmgr->thermal_controller.advanceFanControlParameters.usDefaultMaxFanPWM =
+						47;
+				else
+					hwmgr->thermal_controller.advanceFanControlParameters.usDefaultMaxFanPWM =
+						le16_to_cpu(fan_table3->usFanPWMMax);
+
+				hwmgr->thermal_controller.advanceFanControlParameters.usDefaultFanOutputSensitivity =
+					4836;
+				hwmgr->thermal_controller.advanceFanControlParameters.usFanOutputSensitivity =
+					le16_to_cpu(fan_table3->usFanOutputSensitivity);
+			}
+
+			if (6 <= fan_table->ucFanTableFormat) {
+				const ATOM_PPLIB_FANTABLE4 *fan_table4 =
+					(const ATOM_PPLIB_FANTABLE4 *)(((unsigned long)powerplay_table) +
+								       le16_to_cpu(powerplay_table3->usFanTableOffset));
+
+				phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+					    PHM_PlatformCaps_FanSpeedInTableIsRPM);
+
+				hwmgr->thermal_controller.advanceFanControlParameters.usDefaultMaxFanRPM =
+					le16_to_cpu(fan_table4->usFanRPMMax);
+			}
+
+			if (7 <= fan_table->ucFanTableFormat) {
+				const ATOM_PPLIB_FANTABLE5 *fan_table5 =
+					(const ATOM_PPLIB_FANTABLE5 *)(((unsigned long)powerplay_table) +
+								       le16_to_cpu(powerplay_table3->usFanTableOffset));
+
+				if (0x67A2 == adev->pdev->device ||
+				    0x67A9 == adev->pdev->device ||
+				    0x67B9 == adev->pdev->device) {
+					phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+						    PHM_PlatformCaps_GeminiRegulatorFanControlSupport);
+					hwmgr->thermal_controller.advanceFanControlParameters.usFanCurrentLow =
+						le16_to_cpu(fan_table5->usFanCurrentLow);
+					hwmgr->thermal_controller.advanceFanControlParameters.usFanCurrentHigh =
+						le16_to_cpu(fan_table5->usFanCurrentHigh);
+					hwmgr->thermal_controller.advanceFanControlParameters.usFanRPMLow =
+						le16_to_cpu(fan_table5->usFanRPMLow);
+					hwmgr->thermal_controller.advanceFanControlParameters.usFanRPMHigh =
+						le16_to_cpu(fan_table5->usFanRPMHigh);
+				}
+			}
+		}
+	}
 
 	return 0;
 }
commit b62527005d46d52b4733cbc57f2f9b514b673ed9
Author: KP Singh <kpsingh at kernel.org>
Date:   Tue Dec 8 22:49:00 2020 +0100

    bpf, doc: Update KP's email in MAINTAINERS
    
    Helps me use a single account to sign off and send patches use
    appropriate email redirection without needing to update MAINTAINERS.
    
    Signed-off-by: KP Singh <kpsingh at kernel.org>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>
    Link: https://lore.kernel.org/bpf/20201208214900.80684-1-kpsingh@kernel.org

diff --git a/MAINTAINERS b/MAINTAINERS
index 98f0bd050ff5..ba63f61e4ef1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3237,7 +3237,7 @@ R:	Martin KaFai Lau <kafai at fb.com>
 R:	Song Liu <songliubraving at fb.com>
 R:	Yonghong Song <yhs at fb.com>
 R:	John Fastabend <john.fastabend at gmail.com>
-R:	KP Singh <kpsingh at chromium.org>
+R:	KP Singh <kpsingh at kernel.org>
 L:	netdev at vger.kernel.org
 L:	bpf at vger.kernel.org
 S:	Supported
@@ -3356,7 +3356,7 @@ F:	arch/x86/net/
 X:	arch/x86/net/bpf_jit_comp32.c
 
 BPF LSM (Security Audit and Enforcement using BPF)
-M:	KP Singh <kpsingh at chromium.org>
+M:	KP Singh <kpsingh at kernel.org>
 R:	Florent Revest <revest at chromium.org>
 R:	Brendan Jackman <jackmanb at chromium.org>
 L:	bpf at vger.kernel.org
commit 72d05c00d7ecda85df29abd046da7e41cc071c17
Author: Eric Dumazet <edumazet at google.com>
Date:   Tue Dec 8 08:21:31 2020 -0800

    tcp: select sane initial rcvq_space.space for big MSS
    
    Before commit a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
    small tcp_rmem[1] values were overridden by tcp_fixup_rcvbuf() to accommodate various MSS.
    
    This is no longer the case, and Hazem Mohamed Abuelfotoh reported
    that DRS would not work for MTU 9000 endpoints receiving regular (1500 bytes) frames.
    
    Root cause is that tcp_init_buffer_space() uses tp->rcv_wnd for upper limit
    of rcvq_space.space computation, while it can select later a smaller
    value for tp->rcv_ssthresh and tp->window_clamp.
    
    ss -temoi on receiver would show :
    
    skmem:(r0,rb131072,t0,tb46080,f0,w0,o0,bl0,d0) rcv_space:62496 rcv_ssthresh:56596
    
    This means that TCP can not increase its window in tcp_grow_window(),
    and that DRS can never kick.
    
    Fix this by making sure that rcvq_space.space is not bigger than number of bytes
    that can be held in TCP receive queue.
    
    People unable/unwilling to change their kernel can work around this issue by
    selecting a bigger tcp_rmem[1] value as in :
    
    echo "4096 196608 6291456" >/proc/sys/net/ipv4/tcp_rmem
    
    Based on an initial report and patch from Hazem Mohamed Abuelfotoh
     https://lore.kernel.org/netdev/20201204180622.14285-1-abuehaze@amazon.com/
    
    Fixes: a337531b942b ("tcp: up initial rmem to 128KB and SYN rwin to around 64KB")
    Fixes: 041a14d26715 ("tcp: start receiver buffer autotuning sooner")
    Reported-by: Hazem Mohamed Abuelfotoh <abuehaze at amazon.com>
    Signed-off-by: Eric Dumazet <edumazet at google.com>
    Acked-by: Soheil Hassas Yeganeh <soheil at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 389d1b340248..ef4bdb038a4b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -510,7 +510,6 @@ static void tcp_init_buffer_space(struct sock *sk)
 	if (!(sk->sk_userlocks & SOCK_SNDBUF_LOCK))
 		tcp_sndbuf_expand(sk);
 
-	tp->rcvq_space.space = min_t(u32, tp->rcv_wnd, TCP_INIT_CWND * tp->advmss);
 	tcp_mstamp_refresh(tp);
 	tp->rcvq_space.time = tp->tcp_mstamp;
 	tp->rcvq_space.seq = tp->copied_seq;
@@ -534,6 +533,8 @@ static void tcp_init_buffer_space(struct sock *sk)
 
 	tp->rcv_ssthresh = min(tp->rcv_ssthresh, tp->window_clamp);
 	tp->snd_cwnd_stamp = tcp_jiffies32;
+	tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
+				    (u32)TCP_INIT_CWND * tp->advmss);
 }
 
 /* 4. Recalculate window clamp after socket hit its memory bounds. */
commit cc6596fc7295e9dcd78156ed42f9f8e1221f7530
Author: Zhang Changzhong <zhangchangzhong at huawei.com>
Date:   Tue Dec 8 09:53:42 2020 +0800

    net: ll_temac: Fix potential NULL dereference in temac_probe()
    
    platform_get_resource() may fail and in this case a NULL dereference
    will occur.
    
    Fix it to use devm_platform_ioremap_resource() instead of calling
    platform_get_resource() and devm_ioremap().
    
    This is detected by Coccinelle semantic patch.
    
    @@
    expression pdev, res, n, t, e, e1, e2;
    @@
    
    res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
    + if (!res)
    +   return -EINVAL;
    ... when != res == NULL
    e = devm_ioremap(e1, res->start, e2);
    
    Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
    Signed-off-by: Zhang Changzhong <zhangchangzhong at huawei.com>
    Acked-by: Esben Haabendal <esben at geanix.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 60c199fcb91e..030185301014 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1351,7 +1351,6 @@ static int temac_probe(struct platform_device *pdev)
 	struct device_node *temac_np = dev_of_node(&pdev->dev), *dma_np;
 	struct temac_local *lp;
 	struct net_device *ndev;
-	struct resource *res;
 	const void *addr;
 	__be32 *p;
 	bool little_endian;
@@ -1500,13 +1499,11 @@ static int temac_probe(struct platform_device *pdev)
 		of_node_put(dma_np);
 	} else if (pdata) {
 		/* 2nd memory resource specifies DMA registers */
-		res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
-		lp->sdma_regs = devm_ioremap(&pdev->dev, res->start,
-						     resource_size(res));
-		if (!lp->sdma_regs) {
+		lp->sdma_regs = devm_platform_ioremap_resource(pdev, 1);
+		if (IS_ERR(lp->sdma_regs)) {
 			dev_err(&pdev->dev,
 				"could not map DMA registers\n");
-			return -ENOMEM;
+			return PTR_ERR(lp->sdma_regs);
 		}
 		if (pdata->dma_little_endian) {
 			lp->dma_in = temac_dma_in32_le;
commit 4cb682964706deffb4861f0a91329ab3a705039f
Author: David Howells <dhowells at redhat.com>
Date:   Tue Dec 8 23:52:03 2020 +0000

    afs: Fix memory leak when mounting with multiple source parameters
    
    There's a memory leak in afs_parse_source() whereby multiple source=
    parameters overwrite fc->source in the fs_context struct without freeing
    the previously recorded source.
    
    Fix this by only permitting a single source parameter and rejecting with
    an error all subsequent ones.
    
    This was caught by syzbot with the kernel memory leak detector, showing
    something like the following trace:
    
      unreferenced object 0xffff888114375440 (size 32):
        comm "repro", pid 5168, jiffies 4294923723 (age 569.948s)
        backtrace:
          slab_post_alloc_hook+0x42/0x79
          __kmalloc_track_caller+0x125/0x16a
          kmemdup_nul+0x24/0x3c
          vfs_parse_fs_string+0x5a/0xa1
          generic_parse_monolithic+0x9d/0xc5
          do_new_mount+0x10d/0x15a
          do_mount+0x5f/0x8e
          __do_sys_mount+0xff/0x127
          do_syscall_64+0x2d/0x3a
          entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 13fcc6837049 ("afs: Add fs_context support")
    Reported-by: syzbot+86dc6632faaca40133ab at syzkaller.appspotmail.com
    Signed-off-by: David Howells <dhowells at redhat.com>
    cc: Randy Dunlap <rdunlap at infradead.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/fs/afs/super.c b/fs/afs/super.c
index 6c5900df6aa5..e38bb1e7a4d2 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -230,6 +230,9 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param)
 
 	_enter(",%s", name);
 
+	if (fc->source)
+		return invalf(fc, "kAFS: Multiple sources not supported");
+
 	if (!name) {
 		printk(KERN_ERR "kAFS: no volume name specified\n");
 		return -EINVAL;
commit 0398ba9e5a4b5675aa571e0445689d3c2e499c2d
Author: Cengiz Can <cengiz at kernel.wtf>
Date:   Mon Dec 7 11:14:24 2020 +0300

    net: tipc: prevent possible null deref of link
    
    `tipc_node_apply_property` does a null check on a `tipc_link_entry`
    pointer but also accesses the same pointer out of the null check block.
    
    This triggers a warning on Coverity Static Analyzer because we're
    implying that `e->link` can BE null.
    
    Move "Update MTU for node link entry" line into if block to make sure
    that we're not in a state that `e->link` is null.
    
    Signed-off-by: Cengiz Can <cengiz at kernel.wtf>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/tipc/node.c b/net/tipc/node.c
index c95d037fde51..83978d5dae59 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2181,9 +2181,11 @@ void tipc_node_apply_property(struct net *net, struct tipc_bearer *b,
 							&xmitq);
 			else if (prop == TIPC_NLA_PROP_MTU)
 				tipc_link_set_mtu(e->link, b->mtu);
+
+			/* Update MTU for node link entry */
+			e->mtu = tipc_link_mss(e->link);
 		}
-		/* Update MTU for node link entry */
-		e->mtu = tipc_link_mss(e->link);
+
 		tipc_node_write_unlock(n);
 		tipc_bearer_xmit(net, bearer_id, &xmitq, &e->maddr, NULL);
 	}
commit d23e6297176453a247b83b3a476e33d75bf2968a
Merge: db2082700a0c d0c6707ca423
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Wed Dec 9 00:13:37 2020 +0100

    Merge tag 'sunxi-fixes-for-5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes
    
    A few more RGMII-ID fixes
    
    * tag 'sunxi-fixes-for-5.10-3' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
      arm64: dts: allwinner: H5: NanoPi Neo Plus2: phy-mode rgmii-id
      arm64: dts: allwinner: A64 Sopine: phy-mode rgmii-id
    
    Link: https://lore.kernel.org/r/2a351c9c-470f-4c5e-ba37-80065ae0586d.lettre@localhost
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

commit c6f7e1510b872c281ff603a3108c084b6548d35c
Merge: 1a0e1943d879 6220e48d9640
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Dec 8 15:03:39 2020 -0800

    Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
    
    Pull sparc64 csum fix from Al Viro:
     "Fix for a brown paperbag regression in sparc64"
    
    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
      [regression fix] really dumb fuckup in sparc64 __csum_partial_copy() changes

commit 1a0e1943d8798cb3241fb5edb9a836af1611b60a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Dec 8 15:00:36 2020 -0800

    Revert "scsi: megaraid_sas: Added support for shared host tagset for cpuhotplug"
    
    This reverts commit 103fbf8e4020845e4fcf63819288cedb092a3c91.
    
    It turns out that it causes long boot-time latencies (to the point of
    timeouts and failed boots).
    
    The cause is the increase in request queues, and a fix for that is
    queued up for 5.11, but we're reverting this commit that triggered the
    problem for now.
    
    Reported-and-tested-by: John Garry <john.garry at huawei.com>
    Reported-and-tested-by: Julia Lawall <julia.lawall at inria.fr>
    Reported-by: Qian Cai <cai at redhat.com>
    Acked-by: Jens Axboe <axboe at kernel.dk>
    Acked-by: Martin K. Petersen <martin.petersen at oracle.com>
    Link: https://lore.kernel.org/linux-scsi/fe3dff7dae4494e5a88caffbb4d877bbf472dceb.camel@redhat.com/
    Link: https://lore.kernel.org/lkml/alpine.DEB.2.22.394.2012081813310.2680@hadrien/
    Link: https://lore.kernel.org/linux-block/20201203012638.543321-1-ming.lei@redhat.com/
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 41cd66fc7d81..e158d3d62056 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -37,7 +37,6 @@
 #include <linux/poll.h>
 #include <linux/vmalloc.h>
 #include <linux/irq_poll.h>
-#include <linux/blk-mq-pci.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -114,10 +113,6 @@ unsigned int enable_sdev_max_qd;
 module_param(enable_sdev_max_qd, int, 0444);
 MODULE_PARM_DESC(enable_sdev_max_qd, "Enable sdev max qd as can_queue. Default: 0");
 
-int host_tagset_enable = 1;
-module_param(host_tagset_enable, int, 0444);
-MODULE_PARM_DESC(host_tagset_enable, "Shared host tagset enable/disable Default: enable(1)");
-
 MODULE_LICENSE("GPL");
 MODULE_VERSION(MEGASAS_VERSION);
 MODULE_AUTHOR("megaraidlinux.pdl at broadcom.com");
@@ -3124,19 +3119,6 @@ megasas_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 	return 0;
 }
 
-static int megasas_map_queues(struct Scsi_Host *shost)
-{
-	struct megasas_instance *instance;
-
-	instance = (struct megasas_instance *)shost->hostdata;
-
-	if (shost->nr_hw_queues == 1)
-		return 0;
-
-	return blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT],
-			instance->pdev, instance->low_latency_index_start);
-}
-
 static void megasas_aen_polling(struct work_struct *work);
 
 /**
@@ -3445,7 +3427,6 @@ static struct scsi_host_template megasas_template = {
 	.eh_timed_out = megasas_reset_timer,
 	.shost_attrs = megaraid_host_attrs,
 	.bios_param = megasas_bios_param,
-	.map_queues = megasas_map_queues,
 	.change_queue_depth = scsi_change_queue_depth,
 	.max_segment_size = 0xffffffff,
 };
@@ -6827,26 +6808,6 @@ static int megasas_io_attach(struct megasas_instance *instance)
 	host->max_lun = MEGASAS_MAX_LUN;
 	host->max_cmd_len = 16;
 
-	/* Use shared host tagset only for fusion adaptors
-	 * if there are managed interrupts (smp affinity enabled case).
-	 * Single msix_vectors in kdump, so shared host tag is also disabled.
-	 */
-
-	host->host_tagset = 0;
-	host->nr_hw_queues = 1;
-
-	if ((instance->adapter_type != MFI_SERIES) &&
-		(instance->msix_vectors > instance->low_latency_index_start) &&
-		host_tagset_enable &&
-		instance->smp_affinity_enable) {
-		host->host_tagset = 1;
-		host->nr_hw_queues = instance->msix_vectors -
-			instance->low_latency_index_start;
-	}
-
-	dev_info(&instance->pdev->dev,
-		"Max firmware commands: %d shared with nr_hw_queues = %d\n",
-		instance->max_fw_cmds, host->nr_hw_queues);
 	/*
 	 * Notify the mid-layer about the new controller
 	 */
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index fd607287608e..b0c01cf0428f 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -359,29 +359,24 @@ megasas_get_msix_index(struct megasas_instance *instance,
 {
 	int sdev_busy;
 
-	/* TBD - if sml remove device_busy in future, driver
-	 * should track counter in internal structure.
-	 */
-	sdev_busy = atomic_read(&scmd->device->device_busy);
+	/* nr_hw_queue = 1 for MegaRAID */
+	struct blk_mq_hw_ctx *hctx =
+		scmd->device->request_queue->queue_hw_ctx[0];
+
+	sdev_busy = atomic_read(&hctx->nr_active);
 
 	if (instance->perf_mode == MR_BALANCED_PERF_MODE &&
-	    sdev_busy > (data_arms * MR_DEVICE_HIGH_IOPS_DEPTH)) {
+	    sdev_busy > (data_arms * MR_DEVICE_HIGH_IOPS_DEPTH))
 		cmd->request_desc->SCSIIO.MSIxIndex =
 			mega_mod64((atomic64_add_return(1, &instance->high_iops_outstanding) /
 					MR_HIGH_IOPS_BATCH_COUNT), instance->low_latency_index_start);
-	} else if (instance->msix_load_balance) {
+	else if (instance->msix_load_balance)
 		cmd->request_desc->SCSIIO.MSIxIndex =
 			(mega_mod64(atomic64_add_return(1, &instance->total_io_count),
 				instance->msix_vectors));
-	} else if (instance->host->nr_hw_queues > 1) {
-		u32 tag = blk_mq_unique_tag(scmd->request);
-
-		cmd->request_desc->SCSIIO.MSIxIndex = blk_mq_unique_tag_to_hwq(tag) +
-			instance->low_latency_index_start;
-	} else {
+	else
 		cmd->request_desc->SCSIIO.MSIxIndex =
 			instance->reply_map[raw_smp_processor_id()];
-	}
 }
 
 /**
@@ -961,6 +956,9 @@ megasas_alloc_cmds_fusion(struct megasas_instance *instance)
 	if (megasas_alloc_cmdlist_fusion(instance))
 		goto fail_exit;
 
+	dev_info(&instance->pdev->dev, "Configured max firmware commands: %d\n",
+		 instance->max_fw_cmds);
+
 	/* The first 256 bytes (SMID 0) is not used. Don't add to the cmd list */
 	io_req_base = fusion->io_request_frames + MEGA_MPI2_RAID_DEFAULT_IO_FRAME_SIZE;
 	io_req_base_phys = fusion->io_request_frames_phys + MEGA_MPI2_RAID_DEFAULT_IO_FRAME_SIZE;
@@ -1104,9 +1102,8 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
 		MR_HIGH_IOPS_QUEUE_COUNT) && cur_intr_coalescing)
 		instance->perf_mode = MR_BALANCED_PERF_MODE;
 
-	dev_info(&instance->pdev->dev, "Performance mode :%s (latency index = %d)\n",
-		MEGASAS_PERF_MODE_2STR(instance->perf_mode),
-		instance->low_latency_index_start);
+	dev_info(&instance->pdev->dev, "Performance mode :%s\n",
+		MEGASAS_PERF_MODE_2STR(instance->perf_mode));
 
 	instance->fw_sync_cache_support = (scratch_pad_1 &
 		MR_CAN_HANDLE_SYNC_CACHE_OFFSET) ? 1 : 0;
commit 9756bb63e8d10aad720c378f3fd18e5fa1cc06ec
Merge: 007ab5345545 f119cc9818eb
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Dec 8 14:52:29 2020 -0800

    Merge branch 'stmmac-fixes'
    
    Joakim Zhang says:
    
    ====================
    patches for stmmac
    
    A patch set for stmmac, fix some driver issues.
    
    ChangeLogs:
    V1->V2:
            * add Fixes tag.
            * add patch 5/5 into this patch set.
    
    V2->V3:
            * rebase to latest net tree where fixes go.
    ====================
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit f119cc9818eb33b66e977ad3af75aef6500bbdc3
Author: Fugang Duan <fugang.duan at nxp.com>
Date:   Mon Dec 7 18:51:41 2020 +0800

    net: stmmac: overwrite the dma_cap.addr64 according to HW design
    
    The current IP register MAC_HW_Feature1[ADDR64] only defines
    32/40/64 bit width, but some SOCs support others like i.MX8MP
    support 34 bits but it maps to 40 bits width in MAC_HW_Feature1[ADDR64].
    So overwrite dma_cap.addr64 according to HW real design.
    
    Fixes: 94abdad6974a ("net: ethernet: dwmac: add ethernet glue logic for NXP imx8 chip")
    Signed-off-by: Fugang Duan <fugang.duan at nxp.com>
    Signed-off-by: Joakim Zhang <qiangqing.zhang at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c
index efef5476a577..223f69da7e95 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-imx.c
@@ -246,13 +246,7 @@ static int imx_dwmac_probe(struct platform_device *pdev)
 		goto err_parse_dt;
 	}
 
-	ret = dma_set_mask_and_coherent(&pdev->dev,
-					DMA_BIT_MASK(dwmac->ops->addr_width));
-	if (ret) {
-		dev_err(&pdev->dev, "DMA mask set failed\n");
-		goto err_dma_mask;
-	}
-
+	plat_dat->addr64 = dwmac->ops->addr_width;
 	plat_dat->init = imx_dwmac_init;
 	plat_dat->exit = imx_dwmac_exit;
 	plat_dat->fix_mac_speed = imx_dwmac_fix_speed;
@@ -272,7 +266,6 @@ static int imx_dwmac_probe(struct platform_device *pdev)
 err_dwmac_init:
 err_drv_probe:
 	imx_dwmac_exit(pdev, plat_dat->bsp_priv);
-err_dma_mask:
 err_parse_dt:
 err_match_data:
 	stmmac_remove_config_dt(pdev, plat_dat);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index d2521ebb8217..c33db79cdd0a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4945,6 +4945,14 @@ int stmmac_dvr_probe(struct device *device,
 		dev_info(priv->device, "SPH feature enabled\n");
 	}
 
+	/* The current IP register MAC_HW_Feature1[ADDR64] only define
+	 * 32/40/64 bit width, but some SOC support others like i.MX8MP
+	 * support 34 bits but it map to 40 bits width in MAC_HW_Feature1[ADDR64].
+	 * So overwrite dma_cap.addr64 according to HW real design.
+	 */
+	if (priv->plat->addr64)
+		priv->dma_cap.addr64 = priv->plat->addr64;
+
 	if (priv->dma_cap.addr64) {
 		ret = dma_set_mask_and_coherent(device,
 				DMA_BIT_MASK(priv->dma_cap.addr64));
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 628e28903b8b..15ca6b4167cc 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -170,6 +170,7 @@ struct plat_stmmacenet_data {
 	int unicast_filter_entries;
 	int tx_fifo_size;
 	int rx_fifo_size;
+	u32 addr64;
 	u32 rx_queues_to_use;
 	u32 tx_queues_to_use;
 	u8 rx_sched_algorithm;
commit 5f58591323bf3f342920179f24515935c4b5fd60
Author: Fugang Duan <fugang.duan at nxp.com>
Date:   Mon Dec 7 18:51:40 2020 +0800

    net: stmmac: delete the eee_ctrl_timer after napi disabled
    
    There have chance to re-enable the eee_ctrl_timer and fire the timer
    in napi callback after delete the timer in .stmmac_release(), which
    introduces to access eee registers in the timer function after clocks
    are disabled then causes system hang. Found this issue when do
    suspend/resume and reboot stress test.
    
    It is safe to delete the timer after napi disabled and disable lpi mode.
    
    Fixes: d765955d2ae0b ("stmmac: add the Energy Efficient Ethernet support")
    Signed-off-by: Fugang Duan <fugang.duan at nxp.com>
    Signed-off-by: Joakim Zhang <qiangqing.zhang at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 7452f3c1cab9..d2521ebb8217 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2908,9 +2908,6 @@ static int stmmac_release(struct net_device *dev)
 	struct stmmac_priv *priv = netdev_priv(dev);
 	u32 chan;
 
-	if (priv->eee_enabled)
-		del_timer_sync(&priv->eee_ctrl_timer);
-
 	if (device_may_wakeup(priv->device))
 		phylink_speed_down(priv->phylink, false);
 	/* Stop and disconnect the PHY */
@@ -2929,6 +2926,11 @@ static int stmmac_release(struct net_device *dev)
 	if (priv->lpi_irq > 0)
 		free_irq(priv->lpi_irq, dev);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA and clear the descriptors */
 	stmmac_stop_all_dma(priv);
 
@@ -5155,6 +5157,11 @@ int stmmac_suspend(struct device *dev)
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		del_timer_sync(&priv->tx_queue[chan].txtimer);
 
+	if (priv->eee_enabled) {
+		priv->tx_path_in_lpi_mode = false;
+		del_timer_sync(&priv->eee_ctrl_timer);
+	}
+
 	/* Stop TX/RX DMA */
 	stmmac_stop_all_dma(priv);
 
commit 4ec236c7c51f89abb0224a4da4a6b77f9beb6600
Author: Fugang Duan <fugang.duan at nxp.com>
Date:   Mon Dec 7 18:51:39 2020 +0800

    net: stmmac: free tx skb buffer in stmmac_resume()
    
    When do suspend/resume test, there have WARN_ON() log dump from
    stmmac_xmit() funciton, the code logic:
            entry = tx_q->cur_tx;
            first_entry = entry;
            WARN_ON(tx_q->tx_skbuff[first_entry]);
    
    In normal case, tx_q->tx_skbuff[txq->cur_tx] should be NULL because
    the skb should be handled and freed in stmmac_tx_clean().
    
    But stmmac_resume() reset queue parameters like below, skb buffers
    may not be freed.
            tx_q->cur_tx = 0;
            tx_q->dirty_tx = 0;
    
    So free tx skb buffer in stmmac_resume() to avoid warning and
    memory leak.
    
    log:
    [   46.139824] ------------[ cut here ]------------
    [   46.144453] WARNING: CPU: 0 PID: 0 at drivers/net/ethernet/stmicro/stmmac/stmmac_main.c:3235 stmmac_xmit+0x7a0/0x9d0
    [   46.154969] Modules linked in: crct10dif_ce vvcam(O) flexcan can_dev
    [   46.161328] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O      5.4.24-2.1.0+g2ad925d15481 #1
    [   46.170369] Hardware name: NXP i.MX8MPlus EVK board (DT)
    [   46.175677] pstate: 80000005 (Nzcv daif -PAN -UAO)
    [   46.180465] pc : stmmac_xmit+0x7a0/0x9d0
    [   46.184387] lr : dev_hard_start_xmit+0x94/0x158
    [   46.188913] sp : ffff800010003cc0
    [   46.192224] x29: ffff800010003cc0 x28: ffff000177e2a100
    [   46.197533] x27: ffff000176ef0840 x26: ffff000176ef0090
    [   46.202842] x25: 0000000000000000 x24: 0000000000000000
    [   46.208151] x23: 0000000000000003 x22: ffff8000119ddd30
    [   46.213460] x21: ffff00017636f000 x20: ffff000176ef0cc0
    [   46.218769] x19: 0000000000000003 x18: 0000000000000000
    [   46.224078] x17: 0000000000000000 x16: 0000000000000000
    [   46.229386] x15: 0000000000000079 x14: 0000000000000000
    [   46.234695] x13: 0000000000000003 x12: 0000000000000003
    [   46.240003] x11: 0000000000000010 x10: 0000000000000010
    [   46.245312] x9 : ffff00017002b140 x8 : 0000000000000000
    [   46.250621] x7 : ffff00017636f000 x6 : 0000000000000010
    [   46.255930] x5 : 0000000000000001 x4 : ffff000176ef0000
    [   46.261238] x3 : 0000000000000003 x2 : 00000000ffffffff
    [   46.266547] x1 : ffff000177e2a000 x0 : 0000000000000000
    [   46.271856] Call trace:
    [   46.274302]  stmmac_xmit+0x7a0/0x9d0
    [   46.277874]  dev_hard_start_xmit+0x94/0x158
    [   46.282056]  sch_direct_xmit+0x11c/0x338
    [   46.285976]  __qdisc_run+0x118/0x5f0
    [   46.289549]  net_tx_action+0x110/0x198
    [   46.293297]  __do_softirq+0x120/0x23c
    [   46.296958]  irq_exit+0xb8/0xd8
    [   46.300098]  __handle_domain_irq+0x64/0xb8
    [   46.304191]  gic_handle_irq+0x5c/0x148
    [   46.307936]  el1_irq+0xb8/0x180
    [   46.311076]  cpuidle_enter_state+0x84/0x360
    [   46.315256]  cpuidle_enter+0x34/0x48
    [   46.318829]  call_cpuidle+0x18/0x38
    [   46.322314]  do_idle+0x1e0/0x280
    [   46.325539]  cpu_startup_entry+0x24/0x40
    [   46.329460]  rest_init+0xd4/0xe0
    [   46.332687]  arch_call_rest_init+0xc/0x14
    [   46.336695]  start_kernel+0x420/0x44c
    [   46.340353] ---[ end trace bc1ee695123cbacd ]---
    
    Fixes: 47dd7a540b8a0 ("net: add support for STMicroelectronics Ethernet controllers.")
    Signed-off-by: Fugang Duan <fugang.duan at nxp.com>
    Signed-off-by: Joakim Zhang <qiangqing.zhang at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 0cef414f1289..7452f3c1cab9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1533,6 +1533,19 @@ static void dma_free_tx_skbufs(struct stmmac_priv *priv, u32 queue)
 		stmmac_free_tx_buffer(priv, queue, i);
 }
 
+/**
+ * stmmac_free_tx_skbufs - free TX skb buffers
+ * @priv: private structure
+ */
+static void stmmac_free_tx_skbufs(struct stmmac_priv *priv)
+{
+	u32 tx_queue_cnt = priv->plat->tx_queues_to_use;
+	u32 queue;
+
+	for (queue = 0; queue < tx_queue_cnt; queue++)
+		dma_free_tx_skbufs(priv, queue);
+}
+
 /**
  * free_dma_rx_desc_resources - free RX dma desc resources
  * @priv: private structure
@@ -5260,6 +5273,7 @@ int stmmac_resume(struct device *dev)
 
 	stmmac_reset_queues_param(priv);
 
+	stmmac_free_tx_skbufs(priv);
 	stmmac_clear_descriptors(priv);
 
 	stmmac_hw_setup(ndev, false);
commit 36d18b5664ef617ccf4da266291d2f2342fab89d
Author: Fugang Duan <fugang.duan at nxp.com>
Date:   Mon Dec 7 18:51:38 2020 +0800

    net: stmmac: start phylink instance before stmmac_hw_setup()
    
    Start phylink instance and resume back the PHY to supply
    RX clock to MAC before MAC layer initialization by calling
    .stmmac_hw_setup(), since DMA reset depends on the RX clock,
    otherwise DMA reset cost maximum timeout value then finally
    timeout.
    
    Fixes: 74371272f97f ("net: stmmac: Convert to phylink and remove phylib logic")
    Signed-off-by: Fugang Duan <fugang.duan at nxp.com>
    Signed-off-by: Joakim Zhang <qiangqing.zhang at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index ba45fe237512..0cef414f1289 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5247,6 +5247,14 @@ int stmmac_resume(struct device *dev)
 			return ret;
 	}
 
+	if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
+		rtnl_lock();
+		phylink_start(priv->phylink);
+		/* We may have called phylink_speed_down before */
+		phylink_speed_up(priv->phylink);
+		rtnl_unlock();
+	}
+
 	rtnl_lock();
 	mutex_lock(&priv->lock);
 
@@ -5265,14 +5273,6 @@ int stmmac_resume(struct device *dev)
 	mutex_unlock(&priv->lock);
 	rtnl_unlock();
 
-	if (!device_may_wakeup(priv->device) || !priv->plat->pmt) {
-		rtnl_lock();
-		phylink_start(priv->phylink);
-		/* We may have called phylink_speed_down before */
-		phylink_speed_up(priv->phylink);
-		rtnl_unlock();
-	}
-
 	phylink_mac_change(priv->phylink, true);
 
 	netif_device_attach(ndev);
commit 9d14edfdeabf37d8d8f045e63e5873712aadcd6b
Author: Fugang Duan <fugang.duan at nxp.com>
Date:   Mon Dec 7 18:51:37 2020 +0800

    net: stmmac: increase the timeout for dma reset
    
    Current timeout value is not enough for gmac5 dma reset
    on imx8mp platform, increase the timeout range.
    
    Signed-off-by: Fugang Duan <fugang.duan at nxp.com>
    Signed-off-by: Joakim Zhang <qiangqing.zhang at nxp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
index 6e30d7eb4983..0b4ee2dbb691 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
@@ -22,7 +22,7 @@ int dwmac4_dma_reset(void __iomem *ioaddr)
 
 	return readl_poll_timeout(ioaddr + DMA_BUS_MODE, value,
 				 !(value & DMA_BUS_MODE_SFT_RESET),
-				 10000, 100000);
+				 10000, 1000000);
 }
 
 void dwmac4_set_rx_tail_ptr(void __iomem *ioaddr, u32 tail_ptr, u32 chan)
commit 6220e48d9640538ff700f2e7d24c2f9277555fd6
Author: Al Viro <viro at zeniv.linux.org.uk>
Date:   Tue Dec 8 16:37:47 2020 -0500

    [regression fix] really dumb fuckup in sparc64 __csum_partial_copy() changes
    
    ~0U is -1, not 1
    
    Reported-by: Anatoly Pugachev <matorola at gmail.com>
    Tested-by: Anatoly Pugachev <matorola at gmail.com>
    Fixes: fdf8bee96f9a "sparc64: propagate the calling convention changes down to __csum_partial_copy_...()"
    X-brown-paperbag: yes
    Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>

diff --git a/arch/sparc/lib/csum_copy.S b/arch/sparc/lib/csum_copy.S
index 0c0268e77155..d839956407a7 100644
--- a/arch/sparc/lib/csum_copy.S
+++ b/arch/sparc/lib/csum_copy.S
@@ -71,7 +71,7 @@
 FUNC_NAME:		/* %o0=src, %o1=dst, %o2=len */
 	LOAD(prefetch, %o0 + 0x000, #n_reads)
 	xor		%o0, %o1, %g1
-	mov		1, %o3
+	mov		-1, %o3
 	clr		%o4
 	andcc		%g1, 0x3, %g0
 	bne,pn		%icc, 95f
commit 42f1c27120906a54e73101a7d6a12f58813f6a9f
Author: Pablo Neira Ayuso <pablo at netfilter.org>
Date:   Tue Dec 8 18:57:02 2020 +0100

    netfilter: nftables: comment indirect serialization of commit_mutex with rtnl_mutex
    
    Add an explicit comment in the code to describe the indirect
    serialization of the holders of the commit_mutex with the rtnl_mutex.
    Commit 90d2723c6d4c ("netfilter: nf_tables: do not hold reference on
    netdevice from preparation phase") already describes this, but a comment
    in this case is better for reference.
    
    Reported-by: Vladimir Oltean <olteanv at gmail.com>
    Reviewed-by: Vladimir Oltean <olteanv at gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c2f59879a48d..9a080767667b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1723,6 +1723,10 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
 	}
 
 	nla_strlcpy(ifname, attr, IFNAMSIZ);
+	/* nf_tables_netdev_event() is called under rtnl_mutex, this is
+	 * indirectly serializing all the other holders of the commit_mutex with
+	 * the rtnl_mutex.
+	 */
 	dev = __dev_get_by_name(net, ifname);
 	if (!dev) {
 		err = -ENOENT;
commit 7d8761ba27fcd9c761919beeaaceac06eed3ad74
Merge: cd796ed33450 4bbf439b09c5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Dec 8 12:20:34 2020 -0800

    Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
    
    Pull seq_file fix from Al Viro:
     "This fixes a regression introduced in this cycle wrt iov_iter based
      variant for reading a seq_file"
    
    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
      fix return values of seq_read_iter()

commit 917d80d376ffbaa9725fde9e3c0282f63643f278
Author: Pablo Neira Ayuso <pablo at netfilter.org>
Date:   Tue Dec 8 18:25:53 2020 +0100

    netfilter: nft_dynset: fix timeouts later than 23 days
    
    Use nf_msecs_to_jiffies64 and nf_jiffies64_to_msecs as provided by
    8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23
    days"), otherwise ruleset listing breaks.
    
    Fixes: a8b1e36d0d1d ("netfilter: nft_dynset: fix element timeout for HZ != 1000")
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 55b4cadf290a..c1c0a4ff92ae 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1524,4 +1524,8 @@ void __init nft_chain_route_init(void);
 void nft_chain_route_fini(void);
 
 void nf_tables_trans_destroy_flush_work(void);
+
+int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
+__be64 nf_jiffies64_to_msecs(u64 input);
+
 #endif /* _NET_NF_TABLES_H */
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 23abf1578594..c2f59879a48d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3719,7 +3719,7 @@ cont:
 	return 0;
 }
 
-static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
+int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
 {
 	u64 ms = be64_to_cpu(nla_get_be64(nla));
 	u64 max = (u64)(~((u64)0));
@@ -3733,7 +3733,7 @@ static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
 	return 0;
 }
 
-static __be64 nf_jiffies64_to_msecs(u64 input)
+__be64 nf_jiffies64_to_msecs(u64 input)
 {
 	return cpu_to_be64(jiffies64_to_msecs(input));
 }
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 64ca13a1885b..9af4f93c7f0e 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -157,8 +157,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 	if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {
 		if (!(set->flags & NFT_SET_TIMEOUT))
 			return -EINVAL;
-		timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
-						tb[NFTA_DYNSET_TIMEOUT])));
+
+		err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout);
+		if (err)
+			return err;
 	}
 
 	priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]);
@@ -267,7 +269,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
 	if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name))
 		goto nla_put_failure;
 	if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT,
-			 cpu_to_be64(jiffies_to_msecs(priv->timeout)),
+			 nf_jiffies64_to_msecs(priv->timeout),
 			 NFTA_DYNSET_PAD))
 		goto nla_put_failure;
 	if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr))
commit 007ab5345545aba2f9cbe4c096cc35d2fd3275ac
Author: Jarod Wilson <jarod at redhat.com>
Date:   Sat Dec 5 12:22:29 2020 -0500

    bonding: fix feature flag setting at init time
    
    Don't try to adjust XFRM support flags if the bond device isn't yet
    registered. Bad things can currently happen when netdev_change_features()
    is called without having wanted_features fully filled in yet. This code
    runs both on post-module-load mode changes, as well as at module init
    time, and when run at module init time, it is before register_netdevice()
    has been called and filled in wanted_features. The empty wanted_features
    led to features also getting emptied out, which was definitely not the
    intended behavior, so prevent that from happening.
    
    Originally, I'd hoped to stop adjusting wanted_features at all in the
    bonding driver, as it's documented as being something only the network
    core should touch, but we actually do need to do this to properly update
    both the features and wanted_features fields when changing the bond type,
    or we get to a situation where ethtool sees:
    
        esp-hw-offload: off [requested on]
    
    I do think we should be using netdev_update_features instead of
    netdev_change_features here though, so we only send notifiers when the
    features actually changed.
    
    Fixes: a3b658cfb664 ("bonding: allow xfrm offload setup post-module-load")
    Reported-by: Ivan Vecera <ivecera at redhat.com>
    Suggested-by: Ivan Vecera <ivecera at redhat.com>
    Cc: Jay Vosburgh <j.vosburgh at gmail.com>
    Cc: Veaceslav Falico <vfalico at gmail.com>
    Cc: Andy Gospodarek <andy at greyhouse.net>
    Signed-off-by: Jarod Wilson <jarod at redhat.com>
    Link: https://lore.kernel.org/r/20201205172229.576587-1-jarod@redhat.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
index 9abfaae1c6f7..a4e4e15f574d 100644
--- a/drivers/net/bonding/bond_options.c
+++ b/drivers/net/bonding/bond_options.c
@@ -745,6 +745,19 @@ const struct bond_option *bond_opt_get(unsigned int option)
 	return &bond_opts[option];
 }
 
+static void bond_set_xfrm_features(struct net_device *bond_dev, u64 mode)
+{
+	if (!IS_ENABLED(CONFIG_XFRM_OFFLOAD))
+		return;
+
+	if (mode == BOND_MODE_ACTIVEBACKUP)
+		bond_dev->wanted_features |= BOND_XFRM_FEATURES;
+	else
+		bond_dev->wanted_features &= ~BOND_XFRM_FEATURES;
+
+	netdev_update_features(bond_dev);
+}
+
 static int bond_option_mode_set(struct bonding *bond,
 				const struct bond_opt_value *newval)
 {
@@ -767,13 +780,8 @@ static int bond_option_mode_set(struct bonding *bond,
 	if (newval->value == BOND_MODE_ALB)
 		bond->params.tlb_dynamic_lb = 1;
 
-#ifdef CONFIG_XFRM_OFFLOAD
-	if (newval->value == BOND_MODE_ACTIVEBACKUP)
-		bond->dev->wanted_features |= BOND_XFRM_FEATURES;
-	else
-		bond->dev->wanted_features &= ~BOND_XFRM_FEATURES;
-	netdev_change_features(bond->dev);
-#endif /* CONFIG_XFRM_OFFLOAD */
+	if (bond->dev->reg_state == NETREG_REGISTERED)
+		bond_set_xfrm_features(bond->dev, newval->value);
 
 	/* don't cache arp_validate between modes */
 	bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index d9d0ff3b0ad3..adc3da776970 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -86,10 +86,8 @@
 #define bond_for_each_slave_rcu(bond, pos, iter) \
 	netdev_for_each_lower_private_rcu((bond)->dev, pos, iter)
 
-#ifdef CONFIG_XFRM_OFFLOAD
 #define BOND_XFRM_FEATURES (NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM | \
 			    NETIF_F_GSO_ESP)
-#endif /* CONFIG_XFRM_OFFLOAD */
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
 extern atomic_t netpoll_block_tx;
commit f26c08b444df833b19c00838a530d93963ce9cd0
Author: Hillf Danton <hdanton at sina.com>
Date:   Tue Dec 8 08:54:26 2020 -0700

    io_uring: fix file leak on error path of io ctx creation
    
    Put file as part of error handling when setting up io ctx to fix
    memory leaks like the following one.
    
       BUG: memory leak
       unreferenced object 0xffff888101ea2200 (size 256):
         comm "syz-executor355", pid 8470, jiffies 4294953658 (age 32.400s)
         hex dump (first 32 bytes):
           00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
           20 59 03 01 81 88 ff ff 80 87 a8 10 81 88 ff ff   Y..............
         backtrace:
           [<000000002e0a7c5f>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
           [<000000002e0a7c5f>] __alloc_file+0x1f/0x130 fs/file_table.c:101
           [<000000001a55b73a>] alloc_empty_file+0x69/0x120 fs/file_table.c:151
           [<00000000fb22349e>] alloc_file+0x33/0x1b0 fs/file_table.c:193
           [<000000006e1465bb>] alloc_file_pseudo+0xb2/0x140 fs/file_table.c:233
           [<000000007118092a>] anon_inode_getfile fs/anon_inodes.c:91 [inline]
           [<000000007118092a>] anon_inode_getfile+0xaa/0x120 fs/anon_inodes.c:74
           [<000000002ae99012>] io_uring_get_fd fs/io_uring.c:9198 [inline]
           [<000000002ae99012>] io_uring_create fs/io_uring.c:9377 [inline]
           [<000000002ae99012>] io_uring_setup+0x1125/0x1630 fs/io_uring.c:9411
           [<000000008280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
           [<00000000685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Reported-by: syzbot+71c4697e27c99fddcf17 at syzkaller.appspotmail.com
    Fixes: 0f2122045b94 ("io_uring: don't rely on weak ->files references")
    Cc: Pavel Begunkov <asml.silence at gmail.com>
    Signed-off-by: Hillf Danton <hdanton at sina.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 908817cea4f5..86dac2b2e276 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9183,6 +9183,7 @@ static int io_uring_get_fd(struct io_ring_ctx *ctx)
 {
 	struct file *file;
 	int ret;
+	int fd;
 
 #if defined(CONFIG_UNIX)
 	ret = sock_create_kern(&init_net, PF_UNIX, SOCK_RAW, IPPROTO_IP,
@@ -9194,12 +9195,12 @@ static int io_uring_get_fd(struct io_ring_ctx *ctx)
 	ret = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
 	if (ret < 0)
 		goto err;
+	fd = ret;
 
 	file = anon_inode_getfile("[io_uring]", &io_uring_fops, ctx,
 					O_RDWR | O_CLOEXEC);
 	if (IS_ERR(file)) {
-err_fd:
-		put_unused_fd(ret);
+		put_unused_fd(fd);
 		ret = PTR_ERR(file);
 		goto err;
 	}
@@ -9207,12 +9208,14 @@ err_fd:
 #if defined(CONFIG_UNIX)
 	ctx->ring_sock->file = file;
 #endif
-	if (unlikely(io_uring_add_task_file(ctx, file))) {
-		file = ERR_PTR(-ENOMEM);
-		goto err_fd;
+	ret = io_uring_add_task_file(ctx, file);
+	if (ret) {
+		fput(file);
+		put_unused_fd(fd);
+		goto err;
 	}
-	fd_install(ret, file);
-	return ret;
+	fd_install(fd, file);
+	return fd;
 err:
 #if defined(CONFIG_UNIX)
 	sock_release(ctx->ring_sock);
commit 932c60558109a9131e54dacfda6070147fd1cdfb
Author: Andrii Nakryiko <andrii at kernel.org>
Date:   Fri Dec 4 15:20:01 2020 -0800

    tools/bpftool: Fix PID fetching with a lot of results
    
    In case of having so many PID results that they don't fit into a singe page
    (4096) bytes, bpftool will erroneously conclude that it got corrupted data due
    to 4096 not being a multiple of struct pid_iter_entry, so the last entry will
    be partially truncated. Fix this by sizing the buffer to fit exactly N entries
    with no truncation in the middle of record.
    
    Fixes: d53dee3fe013 ("tools/bpftool: Show info for processes holding BPF map/prog/link/btf FDs")
    Signed-off-by: Andrii Nakryiko <andrii at kernel.org>
    Signed-off-by: Daniel Borkmann <daniel at iogearbox.net>
    Acked-by: Yonghong Song <yhs at fb.com>
    Link: https://lore.kernel.org/bpf/20201204232002.3589803-1-andrii@kernel.org

diff --git a/tools/bpf/bpftool/pids.c b/tools/bpf/bpftool/pids.c
index df7d8ec76036..477e55d59c34 100644
--- a/tools/bpf/bpftool/pids.c
+++ b/tools/bpf/bpftool/pids.c
@@ -89,9 +89,9 @@ libbpf_print_none(__maybe_unused enum libbpf_print_level level,
 
 int build_obj_refs_table(struct obj_refs_table *table, enum bpf_obj_type type)
 {
-	char buf[4096];
-	struct pid_iter_bpf *skel;
 	struct pid_iter_entry *e;
+	char buf[4096 / sizeof(*e) * sizeof(*e)];
+	struct pid_iter_bpf *skel;
 	int err, ret, fd = -1, i;
 	libbpf_print_fn_t default_print;
 
commit 7c5c15dffe1e3c42f44735ce9552afb7207f1584
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Nov 27 10:25:40 2020 +0000

    drm/i915/gt: Declare gen9 has 64 mocs entries!
    
    We checked the table size against a hardcoded number of entries, and
    that number was excluding the special mocs registers at the end.
    
    Fixes: 777a7717d60c ("drm/i915/gt: Program mocs:63 for cache eviction on gen9")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: <stable at vger.kernel.org> # v4.3+
    Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201127102540.13117-1-chris@chris-wilson.co.uk
    (cherry picked from commit 444fbf5d7058099447c5366ba8bb60d610aeb44b)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>
    [backported and updated the Fixes sha]

diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c
index 4f74706967fd..413dadfac2d1 100644
--- a/drivers/gpu/drm/i915/gt/intel_mocs.c
+++ b/drivers/gpu/drm/i915/gt/intel_mocs.c
@@ -59,8 +59,7 @@ struct drm_i915_mocs_table {
 #define _L3_CACHEABILITY(value)	((value) << 4)
 
 /* Helper defines */
-#define GEN9_NUM_MOCS_ENTRIES	62  /* 62 out of 64 - 63 & 64 are reserved. */
-#define GEN11_NUM_MOCS_ENTRIES	64  /* 63-64 are reserved, but configured. */
+#define GEN9_NUM_MOCS_ENTRIES	64  /* 63-64 are reserved, but configured. */
 
 /* (e)LLC caching options */
 /*
@@ -328,11 +327,11 @@ static unsigned int get_mocs_settings(const struct drm_i915_private *i915,
 	if (INTEL_GEN(i915) >= 12) {
 		table->size  = ARRAY_SIZE(tgl_mocs_table);
 		table->table = tgl_mocs_table;
-		table->n_entries = GEN11_NUM_MOCS_ENTRIES;
+		table->n_entries = GEN9_NUM_MOCS_ENTRIES;
 	} else if (IS_GEN(i915, 11)) {
 		table->size  = ARRAY_SIZE(icl_mocs_table);
 		table->table = icl_mocs_table;
-		table->n_entries = GEN11_NUM_MOCS_ENTRIES;
+		table->n_entries = GEN9_NUM_MOCS_ENTRIES;
 	} else if (IS_GEN9_BC(i915) || IS_CANNONLAKE(i915)) {
 		table->size  = ARRAY_SIZE(skl_mocs_table);
 		table->n_entries = GEN9_NUM_MOCS_ENTRIES;
commit f6cbe49be65ed800863ac5ba695555057363f9c2
Author: Manasi Navare <manasi.d.navare at intel.com>
Date:   Fri Dec 4 12:58:04 2020 -0800

    drm/i915/display/dp: Compute the correct slice count for VDSC on DP
    
    This patch fixes the slice count computation algorithm
    for calculating the slice count based on Peak pixel rate
    and the max slice width allowed on the DSC engines.
    We need to ensure slice count > min slice count req
    as per DP spec based on peak pixel rate and that it is
    greater than min slice count based on the max slice width
    advertised by DPCD. So use max of these two.
    In the prev patch we were using min of these 2 causing it
    to violate the max slice width limitation causing a blank
    screen on 8K at 60.
    
    Fixes: d9218c8f6cf4 ("drm/i915/dp: Add helpers for Compressed BPP and Slice Count for DSC")
    Cc: Ankit Nautiyal <ankit.k.nautiyal at intel.com>
    Cc: Jani Nikula <jani.nikula at intel.com>
    Cc: <stable at vger.kernel.org> # v5.0+
    Signed-off-by: Manasi Navare <manasi.d.navare at intel.com>
    Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201204205804.25225-1-manasi.d.navare@intel.com
    (cherry picked from commit d371d6ea92ad2a47f42bbcaa786ee5f6069c9c14)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index bf1e9cf1c0f3..9bc59fd2f95f 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -573,7 +573,7 @@ static u8 intel_dp_dsc_get_slice_count(struct intel_dp *intel_dp,
 		return 0;
 	}
 	/* Also take into account max slice width */
-	min_slice_count = min_t(u8, min_slice_count,
+	min_slice_count = max_t(u8, min_slice_count,
 				DIV_ROUND_UP(mode_hdisplay,
 					     max_slice_width));
 
commit 88c52d805eb61da99aa4607fb5131f41c0ff6bd4
Author: Colin Ian King <colin.king at canonical.com>
Date:   Fri Oct 2 18:03:54 2020 +0100

    drm/i915: fix size_t greater or equal to zero comparison
    
    Currently the check that the unsigned size_t variable i is >= 0
    is always true because the unsigned variable will never be negative,
    causing the loop to run forever.  Fix this by changing the
    pre-decrement check to a zero check on i followed by a decrement of i.
    
    Addresses-Coverity: ("Unsigned compared against 0")
    Fixes: bfed6708d6c9 ("drm/i915: use vmap in shmem_pin_map")
    Signed-off-by: Colin Ian King <colin.king at canonical.com>
    Reviewed-by: Chris Wilson <chris at chris-wilson.co.uk>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201002170354.94627-1-colin.king@canonical.com
    (cherry picked from commit e70956a2498dc81d8f2522cba074f55ae910e13c)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/gt/shmem_utils.c b/drivers/gpu/drm/i915/gt/shmem_utils.c
index 463af675fadd..5982b62f913d 100644
--- a/drivers/gpu/drm/i915/gt/shmem_utils.c
+++ b/drivers/gpu/drm/i915/gt/shmem_utils.c
@@ -73,7 +73,7 @@ void *shmem_pin_map(struct file *file)
 	mapping_set_unevictable(file->f_mapping);
 	return vaddr;
 err_page:
-	while (--i >= 0)
+	while (i--)
 		put_page(pages[i]);
 	kvfree(pages);
 	return NULL;
commit 0fe8bf4d3edce7aad6c14b9d5d92ff54dc19f0ba
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Dec 4 15:12:32 2020 +0000

    drm/i915/gt: Cancel the preemption timeout on responding to it
    
    We currently presume that the engine reset is successful, cancelling the
    expired preemption timer in the process. However, engine resets can
    fail, leaving the timeout still pending and we will then respond to the
    timeout again next time the tasklet fires. What we want is for the
    failed engine reset to be promoted to a full device reset, which is
    kicked by the heartbeat once the engine stops processing events.
    
    Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1168
    Fixes: 3a7a92aba8fb ("drm/i915/execlists: Force preemption")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: <stable at vger.kernel.org> # v5.5+
    Reviewed-by: Mika Kuoppala <mika.kuoppala at linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201204151234.19729-2-chris@chris-wilson.co.uk
    (cherry picked from commit d997e240ceecb4f732611985d3a939ad1bfc1893)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
index 03fd1fa42a75..724b2cb897d3 100644
--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
+++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
@@ -3172,8 +3172,10 @@ static void execlists_submission_tasklet(unsigned long data)
 		spin_unlock_irqrestore(&engine->active.lock, flags);
 
 		/* Recheck after serialising with direct-submission */
-		if (unlikely(timeout && preempt_timeout(engine)))
+		if (unlikely(timeout && preempt_timeout(engine))) {
+			cancel_timer(&engine->execlists.preempt);
 			execlists_reset(engine, "preemption time out");
+		}
 	}
 }
 
commit 5419d93ffd774127b195b8543b063b2b4fa5aea9
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Dec 4 15:12:31 2020 +0000

    drm/i915/gt: Ignore repeated attempts to suspend request flow across reset
    
    Before reseting the engine, we suspend the execution of the guilty
    request, so that we can continue execution with a new context while we
    slowly compress the captured error state for the guilty context. However,
    if the reset fails, we will promptly attempt to reset the same request
    again, and discover the ongoing capture. Ignore the second attempt to
    suspend and capture the same request.
    
    Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/1168
    Fixes: 32ff621fd744 ("drm/i915/gt: Allow temporary suspension of inflight requests")
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: <stable at vger.kernel.org> # v5.7+
    Reviewed-by: Mika Kuoppala <mika.kuoppala at linux.intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201204151234.19729-1-chris@chris-wilson.co.uk
    (cherry picked from commit b969540500bce60cf1cdfff5464388af32b9a553)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
index 0952bf157234..03fd1fa42a75 100644
--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
+++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
@@ -2788,6 +2788,9 @@ static void __execlists_hold(struct i915_request *rq)
 static bool execlists_hold(struct intel_engine_cs *engine,
 			   struct i915_request *rq)
 {
+	if (i915_request_on_hold(rq))
+		return false;
+
 	spin_lock_irq(&engine->active.lock);
 
 	if (i915_request_completed(rq)) { /* too late! */
commit 0e124e19ce52d20b28ee9f1d5cdb22e2106bfd29
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Dec 3 10:34:32 2020 +0000

    drm/i915/gem: Propagate error from cancelled submit due to context closure
    
    In the course of discovering and closing many races with context closure
    and execbuf submission, since commit 61231f6bd056 ("drm/i915/gem: Check
    that the context wasn't closed during setup") we started checking that
    the context was not closed by another userspace thread during the execbuf
    ioctl. In doing so we cancelled the inflight request (by telling it to be
    skipped), but kept reporting success since we do submit a request, albeit
    one that doesn't execute. As the error is known before we return from the
    ioctl, we can report the error we detect immediately, rather than leave
    it on the fence status. With the immediate propagation of the error, it
    is easier for userspace to handle.
    
    Fixes: 61231f6bd056 ("drm/i915/gem: Check that the context wasn't closed during setup")
    Testcase: igt/gem_ctx_exec/basic-close-race
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Cc: <stable at vger.kernel.org> # v5.7+
    Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20201203103432.31526-1-chris@chris-wilson.co.uk
    (cherry picked from commit ba38b79eaeaeed29d2383f122d5c711ebf5ed3d1)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
index 1904e6e5ea64..b07dc1156a0e 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c
@@ -3097,7 +3097,7 @@ static void retire_requests(struct intel_timeline *tl, struct i915_request *end)
 			break;
 }
 
-static void eb_request_add(struct i915_execbuffer *eb)
+static int eb_request_add(struct i915_execbuffer *eb, int err)
 {
 	struct i915_request *rq = eb->request;
 	struct intel_timeline * const tl = i915_request_timeline(rq);
@@ -3118,6 +3118,7 @@ static void eb_request_add(struct i915_execbuffer *eb)
 		/* Serialise with context_close via the add_to_timeline */
 		i915_request_set_error_once(rq, -ENOENT);
 		__i915_request_skip(rq);
+		err = -ENOENT; /* override any transient errors */
 	}
 
 	__i915_request_queue(rq, &attr);
@@ -3127,6 +3128,8 @@ static void eb_request_add(struct i915_execbuffer *eb)
 		retire_requests(tl, prev);
 
 	mutex_unlock(&tl->mutex);
+
+	return err;
 }
 
 static const i915_user_extension_fn execbuf_extensions[] = {
@@ -3332,7 +3335,7 @@ i915_gem_do_execbuffer(struct drm_device *dev,
 	err = eb_submit(&eb, batch);
 err_request:
 	i915_request_get(eb.request);
-	eb_request_add(&eb);
+	err = eb_request_add(&eb, err);
 
 	if (eb.fences)
 		signal_fence_array(&eb);
commit 352ded44fbd8622670ff95e90ca732a5b036ce79
Author: Dan Carpenter <dan.carpenter at oracle.com>
Date:   Thu Dec 3 11:45:17 2020 +0300

    drm/i915/gem: Check the correct variable in selftest
    
    There is a copy and paste bug in this code.  It's supposed to check
    "obj2" instead of checking "obj" a second time.
    
    Fixes: 80f0b679d6f0 ("drm/i915: Add an implementation for i915_gem_ww_ctx locking, v2.")
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Reviewed-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reviewed-by: Andi Shyti <andi.shyti at intel.com>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Link: https://patchwork.freedesktop.org/patch/msgid/8ilneOcJAjwqU4t@mwand
    (cherry picked from commit 14f2d7604f7ce4cb3d303aea17292d119dfafa75)
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi at intel.com>

diff --git a/drivers/gpu/drm/i915/selftests/i915_gem.c b/drivers/gpu/drm/i915/selftests/i915_gem.c
index 23a6132c5f4e..412e21604a05 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem.c
@@ -211,8 +211,8 @@ static int igt_gem_ww_ctx(void *arg)
 		return PTR_ERR(obj);
 
 	obj2 = i915_gem_object_create_internal(i915, PAGE_SIZE);
-	if (IS_ERR(obj)) {
-		err = PTR_ERR(obj);
+	if (IS_ERR(obj2)) {
+		err = PTR_ERR(obj2);
 		goto put1;
 	}
 
commit cc00bcaa589914096edef7fb87ca5cee4a166b5c
Author: Subash Abhinov Kasiviswanathan <subashab at codeaurora.org>
Date:   Wed Nov 25 11:27:22 2020 -0700

    netfilter: x_tables: Switch synchronization to RCU
    
    When running concurrent iptables rules replacement with data, the per CPU
    sequence count is checked after the assignment of the new information.
    The sequence count is used to synchronize with the packet path without the
    use of any explicit locking. If there are any packets in the packet path using
    the table information, the sequence count is incremented to an odd value and
    is incremented to an even after the packet process completion.
    
    The new table value assignment is followed by a write memory barrier so every
    CPU should see the latest value. If the packet path has started with the old
    table information, the sequence counter will be odd and the iptables
    replacement will wait till the sequence count is even prior to freeing the
    old table info.
    
    However, this assumes that the new table information assignment and the memory
    barrier is actually executed prior to the counter check in the replacement
    thread. If CPU decides to execute the assignment later as there is no user of
    the table information prior to the sequence check, the packet path in another
    CPU may use the old table information. The replacement thread would then free
    the table information under it leading to a use after free in the packet
    processing context-
    
    Unable to handle kernel NULL pointer dereference at virtual
    address 000000000000008e
    pc : ip6t_do_table+0x5d0/0x89c
    lr : ip6t_do_table+0x5b8/0x89c
    ip6t_do_table+0x5d0/0x89c
    ip6table_filter_hook+0x24/0x30
    nf_hook_slow+0x84/0x120
    ip6_input+0x74/0xe0
    ip6_rcv_finish+0x7c/0x128
    ipv6_rcv+0xac/0xe4
    __netif_receive_skb+0x84/0x17c
    process_backlog+0x15c/0x1b8
    napi_poll+0x88/0x284
    net_rx_action+0xbc/0x23c
    __do_softirq+0x20c/0x48c
    
    This could be fixed by forcing instruction order after the new table
    information assignment or by switching to RCU for the synchronization.
    
    Fixes: 80055dab5de0 ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore")
    Reported-by: Sean Tranchetti <stranche at codeaurora.org>
    Reported-by: kernel test robot <lkp at intel.com>
    Suggested-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Subash Abhinov Kasiviswanathan <subashab at codeaurora.org>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 5deb099d156d..8ebb64193757 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -227,7 +227,7 @@ struct xt_table {
 	unsigned int valid_hooks;
 
 	/* Man behind the curtain... */
-	struct xt_table_info *private;
+	struct xt_table_info __rcu *private;
 
 	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
 	struct module *me;
@@ -448,6 +448,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu)
 
 struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table);
+
 #ifdef CONFIG_COMPAT
 #include <net/compat.h>
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index d1e04d2b5170..563b62b76a5f 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu     = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct arpt_entry **)private->jumpstack[cpu];
@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	 * (other than comefrom, which userspace doesn't care
@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct arpt_entry *e;
 	struct xt_counters *counters;
-	struct xt_table_info *private = table->private;
+	struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	void *loc_cpu_entry;
 
@@ -807,7 +807,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
 	t = xt_request_find_table_lock(net, NFPROTO_ARP, name);
 	if (!IS_ERR(t)) {
 		struct arpt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -860,7 +860,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
@@ -1017,7 +1017,7 @@ static int do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1330,7 +1330,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
 				       void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index f15bc21d7301..6e2851f8d3a3 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb,
 	WARN_ON(!(table->valid_hooks & (1 << hook)));
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ipt_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -964,7 +964,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
 	t = xt_request_find_table_lock(net, AF_INET, name);
 	if (!IS_ERR(t)) {
 		struct ipt_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1018,7 +1018,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET, get.name);
 	if (!IS_ERR(t)) {
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1173,7 +1173,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1543,7 +1543,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2e2119bfcf13..c4f532f4d311 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb,
 
 	local_bh_disable();
 	addend = xt_write_recseq_begin();
-	private = READ_ONCE(table->private); /* Address dependency. */
+	private = rcu_access_pointer(table->private);
 	cpu        = smp_processor_id();
 	table_base = private->entries;
 	jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
 	unsigned int countersize;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 
 	/* We need atomic snapshot of counters: rest doesn't change
 	   (other than comefrom, which userspace doesn't care
@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size,
 	unsigned int off, num;
 	const struct ip6t_entry *e;
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	int ret = 0;
 	const void *loc_cpu_entry;
 
@@ -980,7 +980,7 @@ static int get_info(struct net *net, void __user *user, const int *len)
 	t = xt_request_find_table_lock(net, AF_INET6, name);
 	if (!IS_ERR(t)) {
 		struct ip6t_getinfo info;
-		const struct xt_table_info *private = t->private;
+		const struct xt_table_info *private = xt_table_get_private_protected(t);
 #ifdef CONFIG_COMPAT
 		struct xt_table_info tmp;
 
@@ -1035,7 +1035,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
 
 	t = xt_find_table_lock(net, AF_INET6, get.name);
 	if (!IS_ERR(t)) {
-		struct xt_table_info *private = t->private;
+		struct xt_table_info *private = xt_table_get_private_protected(t);
 		if (get.size == private->size)
 			ret = copy_entries_to_user(private->size,
 						   t, uptr->entrytable);
@@ -1189,7 +1189,7 @@ do_add_counters(struct net *net, sockptr_t arg, unsigned int len)
 	}
 
 	local_bh_disable();
-	private = t->private;
+	private = xt_table_get_private_protected(t);
 	if (private->number != tmp.num_counters) {
 		ret = -EINVAL;
 		goto unlock_up_free;
@@ -1552,7 +1552,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 			    void __user *userptr)
 {
 	struct xt_counters *counters;
-	const struct xt_table_info *private = table->private;
+	const struct xt_table_info *private = xt_table_get_private_protected(table);
 	void __user *pos;
 	unsigned int size;
 	int ret = 0;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index af22dbe85e2c..acce622582e3 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1349,6 +1349,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters)
 }
 EXPORT_SYMBOL(xt_counters_alloc);
 
+struct xt_table_info
+*xt_table_get_private_protected(const struct xt_table *table)
+{
+	return rcu_dereference_protected(table->private,
+					 mutex_is_locked(&xt[table->af].mutex));
+}
+EXPORT_SYMBOL(xt_table_get_private_protected);
+
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
 	      unsigned int num_counters,
@@ -1356,7 +1364,6 @@ xt_replace_table(struct xt_table *table,
 	      int *error)
 {
 	struct xt_table_info *private;
-	unsigned int cpu;
 	int ret;
 
 	ret = xt_jumpstack_alloc(newinfo);
@@ -1366,47 +1373,20 @@ xt_replace_table(struct xt_table *table,
 	}
 
 	/* Do the substitution. */
-	local_bh_disable();
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 
 	/* Check inside lock: is the old number correct? */
 	if (num_counters != private->number) {
 		pr_debug("num_counters != table->private->number (%u/%u)\n",
 			 num_counters, private->number);
-		local_bh_enable();
 		*error = -EAGAIN;
 		return NULL;
 	}
 
 	newinfo->initial_entries = private->initial_entries;
-	/*
-	 * Ensure contents of newinfo are visible before assigning to
-	 * private.
-	 */
-	smp_wmb();
-	table->private = newinfo;
-
-	/* make sure all cpus see new ->private value */
-	smp_wmb();
 
-	/*
-	 * Even though table entries have now been swapped, other CPU's
-	 * may still be using the old entries...
-	 */
-	local_bh_enable();
-
-	/* ... so wait for even xt_recseq on all cpus */
-	for_each_possible_cpu(cpu) {
-		seqcount_t *s = &per_cpu(xt_recseq, cpu);
-		u32 seq = raw_read_seqcount(s);
-
-		if (seq & 1) {
-			do {
-				cond_resched();
-				cpu_relax();
-			} while (seq == raw_read_seqcount(s));
-		}
-	}
+	rcu_assign_pointer(table->private, newinfo);
+	synchronize_rcu();
 
 	audit_log_nfcfg(table->name, table->af, private->number,
 			!private->number ? AUDIT_XT_OP_REGISTER :
@@ -1442,12 +1422,12 @@ struct xt_table *xt_register_table(struct net *net,
 	}
 
 	/* Simplifies replace_table code. */
-	table->private = bootstrap;
+	rcu_assign_pointer(table->private, bootstrap);
 
 	if (!xt_replace_table(table, 0, newinfo, &ret))
 		goto unlock;
 
-	private = table->private;
+	private = xt_table_get_private_protected(table);
 	pr_debug("table->private->number = %u\n", private->number);
 
 	/* save number of initial entries */
@@ -1470,7 +1450,8 @@ void *xt_unregister_table(struct xt_table *table)
 	struct xt_table_info *private;
 
 	mutex_lock(&xt[table->af].mutex);
-	private = table->private;
+	private = xt_table_get_private_protected(table);
+	RCU_INIT_POINTER(table->private, NULL);
 	list_del(&table->list);
 	mutex_unlock(&xt[table->af].mutex);
 	audit_log_nfcfg(table->name, table->af, private->number,
commit 7aeb353802611a8e655e019f09a370ff682af1a6
Author: Andrew Jeffery <andrew at aj.id.au>
Date:   Thu Nov 26 17:03:37 2020 +1030

    pinctrl: aspeed: Fix GPIO requests on pass-through banks
    
    Commit 6726fbff19bf ("pinctrl: aspeed: Fix GPI only function problem.")
    fixes access to GPIO banks T and U on the AST2600. Both banks contain
    input-only pins and the GPIO pin function is named GPITx and GPIUx
    respectively. Unfortunately the fix had a negative impact on GPIO banks
    D and E for the AST2400 and AST2500 where the GPIO pass-through
    functions take similar "GPI"-style names. The net effect on the older
    SoCs was that when the GPIO subsystem requested a pin in banks D or E be
    muxed for GPIO, they were instead muxed for pass-through mode.
    Mistakenly muxing pass-through mode e.g. breaks booting the host on
    IBM's Witherspoon (AC922) platform where GPIOE0 is used for FSI.
    
    Further exploit the names in the provided expression structure to
    differentiate pass-through from pin-specific GPIO modes.
    
    This follow-up fix gives the expected behaviour for the following tests:
    
    Witherspoon BMC (AST2500):
    
    1. Power-on the Witherspoon host
    2. Request GPIOD1 be muxed via /sys/class/gpio/export
    3. Request GPIOE1 be muxed via /sys/class/gpio/export
    4. Request the balls for GPIOs E2 and E3 be muxed as GPIO pass-through
       ("GPIE2" mode) via a pinctrl hog in the devicetree
    
    Rainier BMC (AST2600):
    
    5. Request GPIT0 be muxed via /sys/class/gpio/export
    6. Request GPIU0 be muxed via /sys/class/gpio/export
    
    Together the tests demonstrate that all three pieces of functionality
    (general GPIOs via 1, 2 and 3, input-only GPIOs via 5 and 6, pass-through
    mode via 4) operate as desired across old and new SoCs.
    
    Fixes: 9b92f5c51e9a ("pinctrl: aspeed: Fix GPI only function problem.")
    Signed-off-by: Andrew Jeffery <andrew at aj.id.au>
    Tested-by: Joel Stanley <joel at jms.id.au>
    Reviewed-by: Joel Stanley <joel at jms.id.au>
    Cc: Billy Tsai <billy_tsai at aspeedtech.com>
    Cc: Joel Stanley <joel at jms.id.au>
    Link: https://lore.kernel.org/r/20201126063337.489927-1-andrew@aj.id.au
    Signed-off-by: Linus Walleij <linus.walleij at linaro.org>

diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
index d6b849552a1e..9c65d560d48f 100644
--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c
+++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c
@@ -286,14 +286,76 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function,
 static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr)
 {
 	/*
-	 * The signal type is GPIO if the signal name has "GPI" as a prefix.
-	 * strncmp (rather than strcmp) is used to implement the prefix
-	 * requirement.
+	 * We need to differentiate between GPIO and non-GPIO signals to
+	 * implement the gpio_request_enable() interface. For better or worse
+	 * the ASPEED pinctrl driver uses the expression names to determine
+	 * whether an expression will mux a pin for GPIO.
 	 *
-	 * expr->signal might look like "GPIOB1" in the GPIO case.
-	 * expr->signal might look like "GPIT0" in the GPI case.
+	 * Generally we have the following - A GPIO such as B1 has:
+	 *
+	 *    - expr->signal set to "GPIOB1"
+	 *    - expr->function set to "GPIOB1"
+	 *
+	 * Using this fact we can determine whether the provided expression is
+	 * a GPIO expression by testing the signal name for the string prefix
+	 * "GPIO".
+	 *
+	 * However, some GPIOs are input-only, and the ASPEED datasheets name
+	 * them differently. An input-only GPIO such as T0 has:
+	 *
+	 *    - expr->signal set to "GPIT0"
+	 *    - expr->function set to "GPIT0"
+	 *
+	 * It's tempting to generalise the prefix test from "GPIO" to "GPI" to
+	 * account for both GPIOs and GPIs, but in doing so we run aground on
+	 * another feature:
+	 *
+	 * Some pins in the ASPEED BMC SoCs have a "pass-through" GPIO
+	 * function where the input state of one pin is replicated as the
+	 * output state of another (as if they were shorted together - a mux
+	 * configuration that is typically enabled by hardware strapping).
+	 * This feature allows the BMC to pass e.g. power button state through
+	 * to the host while the BMC is yet to boot, but take control of the
+	 * button state once the BMC has booted by muxing each pin as a
+	 * separate, pin-specific GPIO.
+	 *
+	 * Conceptually this pass-through mode is a form of GPIO and is named
+	 * as such in the datasheets, e.g. "GPID0". This naming similarity
+	 * trips us up with the simple GPI-prefixed-signal-name scheme
+	 * discussed above, as the pass-through configuration is not what we
+	 * want when muxing a pin as GPIO for the GPIO subsystem.
+	 *
+	 * On e.g. the AST2400, a pass-through function "GPID0" is grouped on
+	 * balls A18 and D16, where we have:
+	 *
+	 *    For ball A18:
+	 *    - expr->signal set to "GPID0IN"
+	 *    - expr->function set to "GPID0"
+	 *
+	 *    For ball D16:
+	 *    - expr->signal set to "GPID0OUT"
+	 *    - expr->function set to "GPID0"
+	 *
+	 * By contrast, the pin-specific GPIO expressions for the same pins are
+	 * as follows:
+	 *
+	 *    For ball A18:
+	 *    - expr->signal looks like "GPIOD0"
+	 *    - expr->function looks like "GPIOD0"
+	 *
+	 *    For ball D16:
+	 *    - expr->signal looks like "GPIOD1"
+	 *    - expr->function looks like "GPIOD1"
+	 *
+	 * Testing both the signal _and_ function names gives us the means
+	 * differentiate the pass-through GPIO pinmux configuration from the
+	 * pin-specific configuration that the GPIO subsystem is after: An
+	 * expression is a pin-specific (non-pass-through) GPIO configuration
+	 * if the signal prefix is "GPI" and the signal name matches the
+	 * function name.
 	 */
-	return strncmp(expr->signal, "GPI", 3) == 0;
+	return !strncmp(expr->signal, "GPI", 3) &&
+			!strcmp(expr->signal, expr->function);
 }
 
 static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs)
diff --git a/drivers/pinctrl/aspeed/pinmux-aspeed.h b/drivers/pinctrl/aspeed/pinmux-aspeed.h
index f86739e800c3..dba5875ff276 100644
--- a/drivers/pinctrl/aspeed/pinmux-aspeed.h
+++ b/drivers/pinctrl/aspeed/pinmux-aspeed.h
@@ -452,10 +452,11 @@ struct aspeed_sig_desc {
  * evaluation of the descriptors.
  *
  * @signal: The signal name for the priority level on the pin. If the signal
- *          type is GPIO, then the signal name must begin with the string
- *          "GPIO", e.g. GPIOA0, GPIOT4 etc.
+ *          type is GPIO, then the signal name must begin with the
+ *          prefix "GPI", e.g. GPIOA0, GPIT0 etc.
  * @function: The name of the function the signal participates in for the
- *            associated expression
+ *            associated expression. For pin-specific GPIO, the function
+ *            name must match the signal name.
  * @ndescs: The number of signal descriptors in the expression
  * @descs: Pointer to an array of signal descriptors that comprise the
  *         function expression
commit 3d1387b3b8f6cc1ccdbb5f0d7af24df02f4baef9
Author: Mauro Carvalho Chehab <mchehab+huawei at kernel.org>
Date:   Tue Dec 8 07:57:13 2020 +0100

    media: vidtv: fix some warnings
    
    As reported by sparse:
    
            drivers/media/test-drivers/vidtv/vidtv_ts.h:47:47: warning: array of flexible structures
            drivers/media/test-drivers/vidtv/vidtv_channel.c:458:54: warning: incorrect type in argument 3 (different base types)
            drivers/media/test-drivers/vidtv/vidtv_channel.c:458:54:    expected unsigned short [usertype] service_id
            drivers/media/test-drivers/vidtv/vidtv_channel.c:458:54:    got restricted __be16 [usertype] service_id
            drivers/media/test-drivers/vidtv/vidtv_s302m.c:471 vidtv_s302m_encoder_init() warn: possible memory leak of 'e'
    
    Address such warnings.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei at kernel.org>

diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.h b/drivers/media/test-drivers/vidtv/vidtv_psi.h
index 6651cc91bda1..fdc825e54138 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_psi.h
+++ b/drivers/media/test-drivers/vidtv/vidtv_psi.h
@@ -743,7 +743,7 @@ struct vidtv_psi_table_eit {
 struct vidtv_psi_table_eit
 *vidtv_psi_eit_table_init(u16 network_id,
 			  u16 transport_stream_id,
-			  u16 service_id);
+			  __be16 service_id);
 
 /**
  * struct vidtv_psi_eit_write_args - Arguments for writing an EIT section
diff --git a/drivers/media/test-drivers/vidtv/vidtv_s302m.c b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
index ce7dd6cafc8b..d79b65854627 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_s302m.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_s302m.c
@@ -467,8 +467,10 @@ struct vidtv_encoder
 	e->is_video_encoder = false;
 
 	ctx = kzalloc(priv_sz, GFP_KERNEL);
-	if (!ctx)
+	if (!ctx) {
+		kfree(e);
 		return NULL;
+	}
 
 	e->ctx = ctx;
 	ctx->last_duration = 0;
diff --git a/drivers/media/test-drivers/vidtv/vidtv_ts.h b/drivers/media/test-drivers/vidtv/vidtv_ts.h
index 10838a2b8389..f5e8e1f37f05 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_ts.h
+++ b/drivers/media/test-drivers/vidtv/vidtv_ts.h
@@ -44,7 +44,7 @@ struct vidtv_mpeg_ts {
 		u8 adaptation_field:1;
 		u8 scrambling:2;
 	} __packed;
-	struct vidtv_mpeg_ts_adaption adaption[];
+	struct vidtv_mpeg_ts_adaption *adaption;
 } __packed;
 
 /**
commit 819f56bad110cb27a8be3232467986e2baebe069
Merge: 82ca4c922b89 48f486e13ffd
Author: Jakub Kicinski <kuba at kernel.org>
Date:   Mon Dec 7 18:29:53 2020 -0800

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
    
    Steffen Klassert says:
    
    ====================
    pull request (net): ipsec 2020-12-07
    
    1) Sysbot reported fixes for the new 64/32 bit compat layer.
       From Dmitry Safonov.
    
    2) Fix a memory leak in xfrm_user_policy that was introduced
       by adding the 64/32 bit compat layer. From Yu Kuai.
    
    * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
      net: xfrm: fix memory leak in xfrm_user_policy()
      xfrm/compat: Don't allocate memory with __GFP_ZERO
      xfrm/compat: memset(0) 64-bit padding at right place
      xfrm/compat: Translate by copying XFRMA_UNSPEC attribute
    ====================
    
    Link: https://lore.kernel.org/r/20201207093937.2874932-1-steffen.klassert@secunet.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

commit 359db63378eded1ee9c8c9ad72245f9b0158ae95
Author: Xiang Chen <chenxiang66 at hisilicon.com>
Date:   Mon Dec 7 21:30:55 2020 +0800

    scsi: hisi_sas: Select a suitable queue for internal I/Os
    
    For when managed interrupts are used (and shost->nr_hw_queues is set), a
    fixed queue - set per-device - is still used for internal I/Os.
    
    If all the CPUs mapped to that queue are offlined, then the completions for
    that queue are not serviced and any internal I/Os will time out.
    
    Fix by selecting a queue for internal I/Os from the queue mapped from the
    current CPU in this scenario.
    
    This is still not ideal as it does not deal with CPU hotplug for inflight
    internal I/Os, and needs proper support from [0].
    
    [0] https://lore.kernel.org/linux-scsi/20200703130122.111448-1-hare@suse.de/T/#m7d77d049b18f33a24ef206af69ebb66d07440556
    
    Link: https://lore.kernel.org/r/1607347855-59091-1-git-send-email-john.garry@huawei.com
    Fixes: 8d98416a55eb ("scsi: hisi_sas: Switch v3 hw to MQ")
    Signed-off-by: Xiang Chen <chenxiang66 at hisilicon.com>
    Signed-off-by: John Garry <john.garry at huawei.com>
    Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>

diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index c8dd8588f800..274ccf18ce2d 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -452,6 +452,12 @@ static int hisi_sas_task_prep(struct sas_task *task,
 		blk_tag = blk_mq_unique_tag(scmd->request);
 		dq_index = blk_mq_unique_tag_to_hwq(blk_tag);
 		*dq_pointer = dq = &hisi_hba->dq[dq_index];
+	} else if (hisi_hba->shost->nr_hw_queues)  {
+		struct Scsi_Host *shost = hisi_hba->shost;
+		struct blk_mq_queue_map *qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT];
+		int queue = qmap->mq_map[raw_smp_processor_id()];
+
+		*dq_pointer = dq = &hisi_hba->dq[queue];
 	} else {
 		*dq_pointer = dq = sas_dev->dq;
 	}
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 7133ca859b5e..960de375ce69 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2452,6 +2452,11 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
 			rc = -ENOENT;
 			goto free_irq_vectors;
 		}
+		cq->irq_mask = pci_irq_get_affinity(pdev, i + BASE_VECTORS_V3_HW);
+		if (!cq->irq_mask) {
+			dev_err(dev, "could not get cq%d irq affinity!\n", i);
+			return -ENOENT;
+		}
 	}
 
 	return 0;
commit 673235f915318ced5d7ec4b2bfd8cb909e6a4a55
Author: Ming Lei <ming.lei at redhat.com>
Date:   Wed Dec 2 18:04:19 2020 +0800

    scsi: core: Fix race between handling STS_RESOURCE and completion
    
    When queuing I/O request to LLD, STS_RESOURCE may be returned because:
    
     - Host is in recovery or blocked
    
     - Target queue throttling or target is blocked
    
     - LLD rejection
    
    In these scenarios BLK_STS_DEV_RESOURCE is returned to the block layer to
    avoid an unnecessary re-run of the queue. However, all of the requests
    queued to this SCSI device may complete immediately after reading
    'sdev->device_busy' and BLK_STS_DEV_RESOURCE is returned to block layer. In
    that case the current I/O won't get a chance to get queued since it is
    invisible at that time for both scsi_run_queue_async() and blk-mq's
    RESTART.
    
    Fix the issue by not returning BLK_STS_DEV_RESOURCE in this situation.
    
    Link: https://lore.kernel.org/r/20201202100419.525144-1-ming.lei@redhat.com
    Fixes: 86ff7c2a80cd ("blk-mq: introduce BLK_STS_DEV_RESOURCE")
    Cc: Hannes Reinecke <hare at suse.com>
    Cc: Sumit Saxena <sumit.saxena at broadcom.com>
    Cc: Kashyap Desai <kashyap.desai at broadcom.com>
    Cc: Bart Van Assche <bvanassche at acm.org>
    Cc: Ewan Milne <emilne at redhat.com>
    Cc: Long Li <longli at microsoft.com>
    Reported-by: John Garry <john.garry at huawei.com>
    Tested-by: "chenxiang (M)" <chenxiang66 at hisilicon.com>
    Signed-off-by: Ming Lei <ming.lei at redhat.com>
    Signed-off-by: Martin K. Petersen <martin.petersen at oracle.com>

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 60c7a7d74852..03c6d0620bfd 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1703,8 +1703,7 @@ out_put_budget:
 		break;
 	case BLK_STS_RESOURCE:
 	case BLK_STS_ZONE_RESOURCE:
-		if (atomic_read(&sdev->device_busy) ||
-		    scsi_device_blocked(sdev))
+		if (scsi_device_blocked(sdev))
 			ret = BLK_STS_DEV_RESOURCE;
 		break;
 	default:
commit 82ca4c922b8992013a238d65cf4e60cc33e12f36
Author: Martin Blumenstingl <martin.blumenstingl at googlemail.com>
Date:   Sat Dec 5 22:32:07 2020 +0100

    net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux
    
    The m250_sel mux clock uses bit 4 in the PRG_ETH0 register. Fix this by
    shifting the PRG_ETH0_CLK_M250_SEL_MASK accordingly as the "mask" in
    struct clk_mux expects the mask relative to the "shift" field in the
    same struct.
    
    While here, get rid of the PRG_ETH0_CLK_M250_SEL_SHIFT macro and use
    __ffs() to determine it from the existing PRG_ETH0_CLK_M250_SEL_MASK
    macro.
    
    Fixes: 566e8251625304 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
    Signed-off-by: Martin Blumenstingl <martin.blumenstingl at googlemail.com>
    Reviewed-by: Jerome Brunet <jbrunet at baylibre.com>
    Link: https://lore.kernel.org/r/20201205213207.519341-1-martin.blumenstingl@googlemail.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 5afcf05bbf9c..6d6bd77bb6af 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -30,7 +30,6 @@
 #define PRG_ETH0_EXT_RMII_MODE		4
 
 /* mux to choose between fclk_div2 (bit unset) and mpll2 (bit set) */
-#define PRG_ETH0_CLK_M250_SEL_SHIFT	4
 #define PRG_ETH0_CLK_M250_SEL_MASK	GENMASK(4, 4)
 
 /* TX clock delay in ns = "8ns / 4 * tx_dly_val" (where 8ns are exactly one
@@ -155,8 +154,9 @@ static int meson8b_init_rgmii_tx_clk(struct meson8b_dwmac *dwmac)
 		return -ENOMEM;
 
 	clk_configs->m250_mux.reg = dwmac->regs + PRG_ETH0;
-	clk_configs->m250_mux.shift = PRG_ETH0_CLK_M250_SEL_SHIFT;
-	clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK;
+	clk_configs->m250_mux.shift = __ffs(PRG_ETH0_CLK_M250_SEL_MASK);
+	clk_configs->m250_mux.mask = PRG_ETH0_CLK_M250_SEL_MASK >>
+				     clk_configs->m250_mux.shift;
 	clk = meson8b_dwmac_register_clk(dwmac, "m250_sel", mux_parents,
 					 ARRAY_SIZE(mux_parents), &clk_mux_ops,
 					 &clk_configs->m250_mux.hw);
commit bbef72c630b522a9ffbf62dae19b59c880da6ea1
Author: Christophe JAILLET <christophe.jaillet at wanadoo.fr>
Date:   Sun Dec 6 16:13:39 2020 +0100

    dpaa2-mac: Add a missing of_node_put after of_device_is_available
    
    Add an 'of_node_put()' call when a tested device node is not available.
    
    Fixes: 94ae899b2096 ("dpaa2-mac: add PCS support through the Lynx module")
    Signed-off-by: Christophe JAILLET <christophe.jaillet at wanadoo.fr>
    Reviewed-by: Ioana Ciornei <ioana.ciornei at nxp.com>
    Link: https://lore.kernel.org/r/20201206151339.44306-1-christophe.jaillet@wanadoo.fr
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
index 90cd243070d7..828c177df03d 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
@@ -269,6 +269,7 @@ static int dpaa2_pcs_create(struct dpaa2_mac *mac,
 
 	if (!of_device_is_available(node)) {
 		netdev_err(mac->net_dev, "pcs-handle node not available\n");
+		of_node_put(node);
 		return -ENODEV;
 	}
 
commit f55628b3e7648198e9c072b52080c5dea8678adf
Author: Jianguo Wu <wujianguo at chinatelecom.cn>
Date:   Sat Dec 5 15:56:33 2020 +0800

    mptcp: print new line in mptcp_seq_show() if mptcp isn't in use
    
    When do cat /proc/net/netstat, the output isn't append with a new line, it looks like this:
    [root at localhost ~]# cat /proc/net/netstat
    ...
    MPTcpExt: 0 0 0 0 0 0 0 0 0 0 0 0 0[root at localhost ~]#
    
    This is because in mptcp_seq_show(), if mptcp isn't in use, net->mib.mptcp_statistics is NULL,
    so it just puts all 0 after "MPTcpExt:", and return, forgot the '\n'.
    
    After this patch:
    
    [root at localhost ~]# cat /proc/net/netstat
    ...
    MPTcpExt: 0 0 0 0 0 0 0 0 0 0 0 0 0
    [root at localhost ~]#
    
    Fixes: fc518953bc9c8d7d ("mptcp: add and use MIB counter infrastructure")
    Signed-off-by: Jianguo Wu <wujianguo at chinatelecom.cn>
    Acked-by: Florian Westphal <fw at strlen.de>
    Link: https://lore.kernel.org/r/142e2fd9-58d9-bb13-fb75-951cccc2331e@163.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c
index 84d119436b22..b921cbdd9aaa 100644
--- a/net/mptcp/mib.c
+++ b/net/mptcp/mib.c
@@ -67,6 +67,7 @@ void mptcp_seq_show(struct seq_file *seq)
 		for (i = 0; mptcp_snmp_list[i].name; i++)
 			seq_puts(seq, " 0");
 
+		seq_putc(seq, '\n');
 		return;
 	}
 
commit 851d0a73c90e6c8c63fef106c6c1e73df7e05d9d
Author: Joseph Huang <Joseph.Huang at garmin.com>
Date:   Fri Dec 4 18:56:28 2020 -0500

    bridge: Fix a deadlock when enabling multicast snooping
    
    When enabling multicast snooping, bridge module deadlocks on multicast_lock
    if 1) IPv6 is enabled, and 2) there is an existing querier on the same L2
    network.
    
    The deadlock was caused by the following sequence: While holding the lock,
    br_multicast_open calls br_multicast_join_snoopers, which eventually causes
    IP stack to (attempt to) send out a Listener Report (in igmp6_join_group).
    Since the destination Ethernet address is a multicast address, br_dev_xmit
    feeds the packet back to the bridge via br_multicast_rcv, which in turn
    calls br_multicast_add_group, which then deadlocks on multicast_lock.
    
    The fix is to move the call br_multicast_join_snoopers outside of the
    critical section. This works since br_multicast_join_snoopers only deals
    with IP and does not modify any multicast data structures of the bridge,
    so there's no need to hold the lock.
    
    Steps to reproduce:
    1. sysctl net.ipv6.conf.all.force_mld_version=1
    2. have another querier
    3. ip link set dev bridge type bridge mcast_snooping 0 && \
       ip link set dev bridge type bridge mcast_snooping 1 < deadlock >
    
    A typical call trace looks like the following:
    
    [  936.251495]  _raw_spin_lock+0x5c/0x68
    [  936.255221]  br_multicast_add_group+0x40/0x170 [bridge]
    [  936.260491]  br_multicast_rcv+0x7ac/0xe30 [bridge]
    [  936.265322]  br_dev_xmit+0x140/0x368 [bridge]
    [  936.269689]  dev_hard_start_xmit+0x94/0x158
    [  936.273876]  __dev_queue_xmit+0x5ac/0x7f8
    [  936.277890]  dev_queue_xmit+0x10/0x18
    [  936.281563]  neigh_resolve_output+0xec/0x198
    [  936.285845]  ip6_finish_output2+0x240/0x710
    [  936.290039]  __ip6_finish_output+0x130/0x170
    [  936.294318]  ip6_output+0x6c/0x1c8
    [  936.297731]  NF_HOOK.constprop.0+0xd8/0xe8
    [  936.301834]  igmp6_send+0x358/0x558
    [  936.305326]  igmp6_join_group.part.0+0x30/0xf0
    [  936.309774]  igmp6_group_added+0xfc/0x110
    [  936.313787]  __ipv6_dev_mc_inc+0x1a4/0x290
    [  936.317885]  ipv6_dev_mc_inc+0x10/0x18
    [  936.321677]  br_multicast_open+0xbc/0x110 [bridge]
    [  936.326506]  br_multicast_toggle+0xec/0x140 [bridge]
    
    Fixes: 4effd28c1245 ("bridge: join all-snoopers multicast address")
    Signed-off-by: Joseph Huang <Joseph.Huang at garmin.com>
    Acked-by: Nikolay Aleksandrov <nikolay at nvidia.com>
    Link: https://lore.kernel.org/r/20201204235628.50653-1-Joseph.Huang@garmin.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 7730c8f3cb53..d3ea9d0779fb 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -177,6 +177,9 @@ static int br_dev_open(struct net_device *dev)
 	br_stp_enable_bridge(br);
 	br_multicast_open(br);
 
+	if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
+		br_multicast_join_snoopers(br);
+
 	return 0;
 }
 
@@ -197,6 +200,9 @@ static int br_dev_stop(struct net_device *dev)
 	br_stp_disable_bridge(br);
 	br_multicast_stop(br);
 
+	if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
+		br_multicast_leave_snoopers(br);
+
 	netif_stop_queue(dev);
 
 	return 0;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index eae898c3cff7..54cb82a69056 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -3286,7 +3286,7 @@ static inline void br_ip6_multicast_join_snoopers(struct net_bridge *br)
 }
 #endif
 
-static void br_multicast_join_snoopers(struct net_bridge *br)
+void br_multicast_join_snoopers(struct net_bridge *br)
 {
 	br_ip4_multicast_join_snoopers(br);
 	br_ip6_multicast_join_snoopers(br);
@@ -3317,7 +3317,7 @@ static inline void br_ip6_multicast_leave_snoopers(struct net_bridge *br)
 }
 #endif
 
-static void br_multicast_leave_snoopers(struct net_bridge *br)
+void br_multicast_leave_snoopers(struct net_bridge *br)
 {
 	br_ip4_multicast_leave_snoopers(br);
 	br_ip6_multicast_leave_snoopers(br);
@@ -3336,9 +3336,6 @@ static void __br_multicast_open(struct net_bridge *br,
 
 void br_multicast_open(struct net_bridge *br)
 {
-	if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
-		br_multicast_join_snoopers(br);
-
 	__br_multicast_open(br, &br->ip4_own_query);
 #if IS_ENABLED(CONFIG_IPV6)
 	__br_multicast_open(br, &br->ip6_own_query);
@@ -3354,9 +3351,6 @@ void br_multicast_stop(struct net_bridge *br)
 	del_timer_sync(&br->ip6_other_query.timer);
 	del_timer_sync(&br->ip6_own_query.timer);
 #endif
-
-	if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
-		br_multicast_leave_snoopers(br);
 }
 
 void br_multicast_dev_del(struct net_bridge *br)
@@ -3487,6 +3481,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
 {
 	struct net_bridge_port *port;
+	bool change_snoopers = false;
 
 	spin_lock_bh(&br->multicast_lock);
 	if (!!br_opt_get(br, BROPT_MULTICAST_ENABLED) == !!val)
@@ -3495,7 +3490,7 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
 	br_mc_disabled_update(br->dev, val);
 	br_opt_toggle(br, BROPT_MULTICAST_ENABLED, !!val);
 	if (!br_opt_get(br, BROPT_MULTICAST_ENABLED)) {
-		br_multicast_leave_snoopers(br);
+		change_snoopers = true;
 		goto unlock;
 	}
 
@@ -3506,9 +3501,30 @@ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
 	list_for_each_entry(port, &br->port_list, list)
 		__br_multicast_enable_port(port);
 
+	change_snoopers = true;
+
 unlock:
 	spin_unlock_bh(&br->multicast_lock);
 
+	/* br_multicast_join_snoopers has the potential to cause
+	 * an MLD Report/Leave to be delivered to br_multicast_rcv,
+	 * which would in turn call br_multicast_add_group, which would
+	 * attempt to acquire multicast_lock. This function should be
+	 * called after the lock has been released to avoid deadlocks on
+	 * multicast_lock.
+	 *
+	 * br_multicast_leave_snoopers does not have the problem since
+	 * br_multicast_rcv first checks BROPT_MULTICAST_ENABLED, and
+	 * returns without calling br_multicast_ipv4/6_rcv if it's not
+	 * enabled. Moved both functions out just for symmetry.
+	 */
+	if (change_snoopers) {
+		if (br_opt_get(br, BROPT_MULTICAST_ENABLED))
+			br_multicast_join_snoopers(br);
+		else
+			br_multicast_leave_snoopers(br);
+	}
+
 	return 0;
 }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 345118e35c42..8424464186a6 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -792,6 +792,8 @@ void br_multicast_del_port(struct net_bridge_port *port);
 void br_multicast_enable_port(struct net_bridge_port *port);
 void br_multicast_disable_port(struct net_bridge_port *port);
 void br_multicast_init(struct net_bridge *br);
+void br_multicast_join_snoopers(struct net_bridge *br);
+void br_multicast_leave_snoopers(struct net_bridge *br);
 void br_multicast_open(struct net_bridge *br);
 void br_multicast_stop(struct net_bridge *br);
 void br_multicast_dev_del(struct net_bridge *br);
@@ -969,6 +971,14 @@ static inline void br_multicast_init(struct net_bridge *br)
 {
 }
 
+static inline void br_multicast_join_snoopers(struct net_bridge *br)
+{
+}
+
+static inline void br_multicast_leave_snoopers(struct net_bridge *br)
+{
+}
+
 static inline void br_multicast_open(struct net_bridge *br)
 {
 }
commit eb96b686fc2c601e78903cc61b6cf4588ddde013
Author: Claudiu Manoil <claudiu.manoil at nxp.com>
Date:   Fri Dec 4 19:15:05 2020 +0200

    enetc: Fix reporting of h/w packet counters
    
    Noticed some inconsistencies in packet statistics reporting.
    This patch adds the missing Tx packet counter registers to
    ethtool reporting and fixes the information strings for a
    few of them.
    
    Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics")
    Signed-off-by: Claudiu Manoil <claudiu.manoil at nxp.com>
    Link: https://lore.kernel.org/r/20201204171505.21389-1-claudiu.manoil@nxp.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
index 8ed1ebd5a183..89e558135432 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
@@ -143,8 +143,8 @@ static const struct {
 	{ ENETC_PM0_R255,   "MAC rx 128-255 byte packets" },
 	{ ENETC_PM0_R511,   "MAC rx 256-511 byte packets" },
 	{ ENETC_PM0_R1023,  "MAC rx 512-1023 byte packets" },
-	{ ENETC_PM0_R1518,  "MAC rx 1024-1518 byte packets" },
-	{ ENETC_PM0_R1519X, "MAC rx 1519 to max-octet packets" },
+	{ ENETC_PM0_R1522,  "MAC rx 1024-1522 byte packets" },
+	{ ENETC_PM0_R1523X, "MAC rx 1523 to max-octet packets" },
 	{ ENETC_PM0_ROVR,   "MAC rx oversized packets" },
 	{ ENETC_PM0_RJBR,   "MAC rx jabber packets" },
 	{ ENETC_PM0_RFRG,   "MAC rx fragment packets" },
@@ -163,9 +163,13 @@ static const struct {
 	{ ENETC_PM0_TBCA,   "MAC tx broadcast frames" },
 	{ ENETC_PM0_TPKT,   "MAC tx packets" },
 	{ ENETC_PM0_TUND,   "MAC tx undersized packets" },
+	{ ENETC_PM0_T64,    "MAC tx 64 byte packets" },
 	{ ENETC_PM0_T127,   "MAC tx 65-127 byte packets" },
+	{ ENETC_PM0_T255,   "MAC tx 128-255 byte packets" },
+	{ ENETC_PM0_T511,   "MAC tx 256-511 byte packets" },
 	{ ENETC_PM0_T1023,  "MAC tx 512-1023 byte packets" },
-	{ ENETC_PM0_T1518,  "MAC tx 1024-1518 byte packets" },
+	{ ENETC_PM0_T1522,  "MAC tx 1024-1522 byte packets" },
+	{ ENETC_PM0_T1523X, "MAC tx 1523 to max-octet packets" },
 	{ ENETC_PM0_TCNP,   "MAC tx control packets" },
 	{ ENETC_PM0_TDFR,   "MAC tx deferred packets" },
 	{ ENETC_PM0_TMCOL,  "MAC tx multiple collisions" },
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
index eb6bbf1113c7..4cbf1667d7ff 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h
+++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h
@@ -267,8 +267,8 @@ enum enetc_bdr_type {TX, RX};
 #define ENETC_PM0_R255		0x8180
 #define ENETC_PM0_R511		0x8188
 #define ENETC_PM0_R1023		0x8190
-#define ENETC_PM0_R1518		0x8198
-#define ENETC_PM0_R1519X	0x81A0
+#define ENETC_PM0_R1522		0x8198
+#define ENETC_PM0_R1523X	0x81A0
 #define ENETC_PM0_ROVR		0x81A8
 #define ENETC_PM0_RJBR		0x81B0
 #define ENETC_PM0_RFRG		0x81B8
@@ -287,9 +287,13 @@ enum enetc_bdr_type {TX, RX};
 #define ENETC_PM0_TBCA		0x8250
 #define ENETC_PM0_TPKT		0x8260
 #define ENETC_PM0_TUND		0x8268
+#define ENETC_PM0_T64		0x8270
 #define ENETC_PM0_T127		0x8278
+#define ENETC_PM0_T255		0x8280
+#define ENETC_PM0_T511		0x8288
 #define ENETC_PM0_T1023		0x8290
-#define ENETC_PM0_T1518		0x8298
+#define ENETC_PM0_T1522		0x8298
+#define ENETC_PM0_T1523X	0x82A0
 #define ENETC_PM0_TCNP		0x82C0
 #define ENETC_PM0_TDFR		0x82D0
 #define ENETC_PM0_TMCOL		0x82D8
commit 5eedf9fe8db23313df104576845cec5f481b9b60
Author: Christophe Leroy <christophe.leroy at csgroup.eu>
Date:   Mon Dec 7 16:58:01 2020 +0000

    powerpc/mm: Fix KUAP warning by providing copy_from_kernel_nofault_allowed()
    
    Since commit c33165253492 ("powerpc: use non-set_fs based maccess
    routines"), userspace access is not granted anymore when using
    copy_from_kernel_nofault()
    
    However, kthread_probe_data() uses copy_from_kernel_nofault()
    to check validity of pointers. When the pointer is NULL,
    it points to userspace, leading to a KUAP fault and triggering
    the following big hammer warning many times when you request
    a sysrq "show task":
    
    [ 1117.202054] ------------[ cut here ]------------
    [ 1117.202102] Bug: fault blocked by AP register !
    [ 1117.202261] WARNING: CPU: 0 PID: 377 at arch/powerpc/include/asm/nohash/32/kup-8xx.h:66 do_page_fault+0x4a8/0x5ec
    [ 1117.202310] Modules linked in:
    [ 1117.202428] CPU: 0 PID: 377 Comm: sh Tainted: G        W         5.10.0-rc5-01340-g83f53be2de31-dirty #4175
    [ 1117.202499] NIP:  c0012048 LR: c0012048 CTR: 00000000
    [ 1117.202573] REGS: cacdbb88 TRAP: 0700   Tainted: G        W          (5.10.0-rc5-01340-g83f53be2de31-dirty)
    [ 1117.202625] MSR:  00021032 <ME,IR,DR,RI>  CR: 24082222  XER: 20000000
    [ 1117.202899]
    [ 1117.202899] GPR00: c0012048 cacdbc40 c2929290 00000023 c092e554 00000001 c09865e8 c092e640
    [ 1117.202899] GPR08: 00001032 00000000 00000000 00014efc 28082224 100d166a 100a0920 00000000
    [ 1117.202899] GPR16: 100cac0c 100b0000 1080c3fc 1080d685 100d0000 100d0000 00000000 100a0900
    [ 1117.202899] GPR24: 100d0000 c07892ec 00000000 c0921510 c21f4440 0000005c c0000000 cacdbc80
    [ 1117.204362] NIP [c0012048] do_page_fault+0x4a8/0x5ec
    [ 1117.204461] LR [c0012048] do_page_fault+0x4a8/0x5ec
    [ 1117.204509] Call Trace:
    [ 1117.204609] [cacdbc40] [c0012048] do_page_fault+0x4a8/0x5ec (unreliable)
    [ 1117.204771] [cacdbc70] [c00112f0] handle_page_fault+0x8/0x34
    [ 1117.204911] --- interrupt: 301 at copy_from_kernel_nofault+0x70/0x1c0
    [ 1117.204979] NIP:  c010dbec LR: c010dbac CTR: 00000001
    [ 1117.205053] REGS: cacdbc80 TRAP: 0301   Tainted: G        W          (5.10.0-rc5-01340-g83f53be2de31-dirty)
    [ 1117.205104] MSR:  00009032 <EE,ME,IR,DR,RI>  CR: 28082224  XER: 00000000
    [ 1117.205416] DAR: 0000005c DSISR: c0000000
    [ 1117.205416] GPR00: c0045948 cacdbd38 c2929290 00000001 00000017 00000017 00000027 0000000f
    [ 1117.205416] GPR08: c09926ec 00000000 00000000 3ffff000 24082224
    [ 1117.206106] NIP [c010dbec] copy_from_kernel_nofault+0x70/0x1c0
    [ 1117.206202] LR [c010dbac] copy_from_kernel_nofault+0x30/0x1c0
    [ 1117.206258] --- interrupt: 301
    [ 1117.206372] [cacdbd38] [c004bbb0] kthread_probe_data+0x44/0x70 (unreliable)
    [ 1117.206561] [cacdbd58] [c0045948] print_worker_info+0xe0/0x194
    [ 1117.206717] [cacdbdb8] [c00548ac] sched_show_task+0x134/0x168
    [ 1117.206851] [cacdbdd8] [c005a268] show_state_filter+0x70/0x100
    [ 1117.206989] [cacdbe08] [c039baa0] sysrq_handle_showstate+0x14/0x24
    [ 1117.207122] [cacdbe18] [c039bf18] __handle_sysrq+0xac/0x1d0
    [ 1117.207257] [cacdbe48] [c039c0c0] write_sysrq_trigger+0x4c/0x74
    [ 1117.207407] [cacdbe68] [c01fba48] proc_reg_write+0xb4/0x114
    [ 1117.207550] [cacdbe88] [c0179968] vfs_write+0x12c/0x478
    [ 1117.207686] [cacdbf08] [c0179e60] ksys_write+0x78/0x128
    [ 1117.207826] [cacdbf38] [c00110d0] ret_from_syscall+0x0/0x34
    [ 1117.207938] --- interrupt: c01 at 0xfd4e784
    [ 1117.208008] NIP:  0fd4e784 LR: 0fe0f244 CTR: 10048d38
    [ 1117.208083] REGS: cacdbf48 TRAP: 0c01   Tainted: G        W          (5.10.0-rc5-01340-g83f53be2de31-dirty)
    [ 1117.208134] MSR:  0000d032 <EE,PR,ME,IR,DR,RI>  CR: 44002222  XER: 00000000
    [ 1117.208470]
    [ 1117.208470] GPR00: 00000004 7fc34090 77bfb4e0 00000001 1080fa40 00000002 7400000f fefefeff
    [ 1117.208470] GPR08: 7f7f7f7f 10048d38 1080c414 7fc343c0 00000000
    [ 1117.209104] NIP [0fd4e784] 0xfd4e784
    [ 1117.209180] LR [0fe0f244] 0xfe0f244
    [ 1117.209236] --- interrupt: c01
    [ 1117.209274] Instruction dump:
    [ 1117.209353] 714a4000 418200f0 73ca0001 40820084 73ca0032 408200f8 73c90040 4082ff60
    [ 1117.209727] 0fe00000 3c60c082 386399f4 48013b65 <0fe00000> 80010034 3860000b 7c0803a6
    [ 1117.210102] ---[ end trace 1927c0323393af3e ]---
    
    To avoid that, copy_from_kernel_nofault_allowed() is used to check
    whether the address is a valid kernel address. But the default
    version of it returns true for any address.
    
    Provide a powerpc version of copy_from_kernel_nofault_allowed()
    that returns false when the address is below TASK_USER_MAX,
    so that copy_from_kernel_nofault() will return -ERANGE.
    
    Fixes: c33165253492 ("powerpc: use non-set_fs based maccess routines")
    Reported-by: Qian Cai <qcai at redhat.com>
    Signed-off-by: Christophe Leroy <christophe.leroy at csgroup.eu>
    Signed-off-by: Michael Ellerman <mpe at ellerman.id.au>
    Link: https://lore.kernel.org/r/18bcb456d32a3e74f5ae241fd6f1580c092d07f5.1607360230.git.christophe.leroy@csgroup.eu

diff --git a/arch/powerpc/mm/Makefile b/arch/powerpc/mm/Makefile
index 5e147986400d..55b4a8bd408a 100644
--- a/arch/powerpc/mm/Makefile
+++ b/arch/powerpc/mm/Makefile
@@ -5,7 +5,7 @@
 
 ccflags-$(CONFIG_PPC64)	:= $(NO_MINIMAL_TOC)
 
-obj-y				:= fault.o mem.o pgtable.o mmap.o \
+obj-y				:= fault.o mem.o pgtable.o mmap.o maccess.o \
 				   init_$(BITS).o pgtable_$(BITS).o \
 				   pgtable-frag.o ioremap.o ioremap_$(BITS).o \
 				   init-common.o mmu_context.o drmem.o
diff --git a/arch/powerpc/mm/maccess.c b/arch/powerpc/mm/maccess.c
new file mode 100644
index 000000000000..fa9a7a718fc6
--- /dev/null
+++ b/arch/powerpc/mm/maccess.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/uaccess.h>
+#include <linux/kernel.h>
+
+bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size)
+{
+	return is_kernel_addr((unsigned long)unsafe_src);
+}
commit ceabbf94c317c6175dee6e91805fca4a6353745a
Author: Geert Uytterhoeven <geert+renesas at glider.be>
Date:   Mon Nov 30 09:57:43 2020 +0100

    clk: renesas: r9a06g032: Drop __packed for portability
    
    The R9A06G032 clock driver uses an array of packed structures to reduce
    kernel size.  However, this array contains pointers, which are no longer
    aligned naturally, and cannot be relocated on PPC64.  Hence when
    compile-testing this driver on PPC64 with CONFIG_RELOCATABLE=y (e.g.
    PowerPC allyesconfig), the following warnings are produced:
    
        WARNING: 136 bad relocations
        c000000000616be3 R_PPC64_UADDR64   .rodata+0x00000000000cf338
        c000000000616bfe R_PPC64_UADDR64   .rodata+0x00000000000cf370
        ...
    
    Fix this by dropping the __packed attribute from the r9a06g032_clkdesc
    definition, trading a small size increase for portability.
    
    This increases the 156-entry clock table by 1 byte per entry, but due to
    the compiler generating more efficient code for unpacked accesses, the
    net size increase is only 76 bytes (gcc 9.3.0 on arm32).
    
    Reported-by: Stephen Rothwell <sfr at canb.auug.org.au>
    Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver")
    Signed-off-by: Geert Uytterhoeven <geert+renesas at glider.be>
    Link: https://lore.kernel.org/r/20201130085743.1656317-1-geert+renesas@glider.be
    Tested-by: Stephen Rothwell <sfr at canb.auug.org.au> # PowerPC allyesconfig build
    Acked-by: Stephen Boyd <sboyd at kernel.org>
    Signed-off-by: Stephen Boyd <sboyd at kernel.org>

diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c
index d900f6bf53d0..892e91b92f2c 100644
--- a/drivers/clk/renesas/r9a06g032-clocks.c
+++ b/drivers/clk/renesas/r9a06g032-clocks.c
@@ -55,7 +55,7 @@ struct r9a06g032_clkdesc {
 			u16 sel, g1, r1, g2, r2;
 		} dual;
 	};
-} __packed;
+};
 
 #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \
 	{ .gate = _clk, .reset = _rst, \
commit 6247e31b75308c51476e157c9964823aeefbf5dc
Author: Dong Aisheng <aisheng.dong at nxp.com>
Date:   Mon Nov 30 16:46:24 2020 +0800

    clk: imx: scu: fix MXC_CLK_SCU module build break
    
    This issue can be reproduced by having a kernel config with
    CONFIG_IMX_MBOX=m and CONFIG_MXC_CLK_SCU=m.  It's caused by the Makefile
    wanting to build clk-scu.o and clk-imx8qxp.o as different targets but
    that doesn't work (e.g. MXC_CLK_SCU = y while CLK_IMX8QXP = n)
    
    "obj-$(CONFIG_MXC_CLK_SCU) += clk-imx-scu.o clk-imx-lpcg-scu.o
    clk-imx-scu-$(CONFIG_CLK_IMX8QXP) += clk-scu.o clk-imx8qxp.o"
    
    Having MXC_CLK_SCU=y/m while CLK_IMX8QXP=n will cause a linker problem
    like below:
    
      LD [M]  drivers/clk/imx/clk-imx-scu.o
      arm-poky-linux-gnueabi-ld: no input files
    
    Make MXC_CLK_SCU be un-selectable by users so it can only be selected by
    the CLK_IMX8QXP option, ensuring the two symbols are built together.
    Drop COMPILE_TEST too because this option isn't selectable anymore. We
    can remove it from MXC_CLK_SCU because CLK_IMX8QXP selects MXC_CLK_SCU
    which already has COMPILE_TEST.
    
    Fixes: e0d0d4d86c766 ("clk: imx8qxp: Support building i.MX8QXP clock driver as module")
    Acked-by: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
    Signed-off-by: Dong Aisheng <aisheng.dong at nxp.com>
    Link: https://lore.kernel.org/r/20201130084624.21113-1-aisheng.dong@nxp.com
    [sboyd at kernel.org: Rework commit text]
    Signed-off-by: Stephen Boyd <sboyd at kernel.org>

diff --git a/drivers/clk/imx/Kconfig b/drivers/clk/imx/Kconfig
index 3b393cb07295..3061896503f3 100644
--- a/drivers/clk/imx/Kconfig
+++ b/drivers/clk/imx/Kconfig
@@ -5,8 +5,8 @@ config MXC_CLK
 	depends on ARCH_MXC || COMPILE_TEST
 
 config MXC_CLK_SCU
-	tristate "IMX SCU clock"
-	depends on ARCH_MXC || COMPILE_TEST
+	tristate
+	depends on ARCH_MXC
 	depends on IMX_SCU && HAVE_ARM_SMCCC
 
 config CLK_IMX1
commit e432c04c17993011b2a2f59dcb5738e604bd552e
Author: Gal Pressman <galpress at amazon.com>
Date:   Sun Dec 6 17:32:38 2020 +0200

    RDMA/core: Fix empty gid table for non IB/RoCE devices
    
    The query_gid_table ioctl skips non IB/RoCE ports, which as a result
    returns an empty gid table for devices such as EFA which have a GID table,
    but are not IB/RoCE.
    
    Fixes: c4b4d548fabc ("RDMA/core: Introduce new GID table query API")
    Link: https://lore.kernel.org/r/20201206153238.34878-1-galpress@amazon.com
    Signed-off-by: Gal Pressman <galpress at amazon.com>
    Signed-off-by: Jason Gunthorpe <jgg at nvidia.com>

diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 8017c40dd110..7989b7e1d1c0 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -1269,9 +1269,6 @@ ssize_t rdma_query_gid_table(struct ib_device *device,
 	unsigned long flags;
 
 	rdma_for_each_port(device, port_num) {
-		if (!rdma_ib_or_roce(device, port_num))
-			continue;
-
 		table = rdma_gid_table(device, port_num);
 		read_lock_irqsave(&table->rwlock, flags);
 		for (i = 0; i < table->sz; i++) {
commit e3366884b383073a7edc1bad9634412ae0a22d4e
Author: Cong Wang <cong.wang at bytedance.com>
Date:   Fri Dec 4 23:59:46 2020 -0800

    lwt_bpf: Replace preempt_disable() with migrate_disable()
    
    migrate_disable() is just a wrapper for preempt_disable() in
    non-RT kernel. It is safe to replace it, and RT kernel will
    benefit.
    
    Note that it is introduced since Feb 2020.
    
    Suggested-by: Alexei Starovoitov <alexei.starovoitov at gmail.com>
    Signed-off-by: Cong Wang <cong.wang at bytedance.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>
    Link: https://lore.kernel.org/bpf/20201205075946.497763-2-xiyou.wangcong@gmail.com

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 4f3cb7c15ddf..2f7940bcf715 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -39,10 +39,10 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 {
 	int ret;
 
-	/* Preempt disable and BH disable are needed to protect per-cpu
+	/* Migration disable and BH disable are needed to protect per-cpu
 	 * redirect_info between BPF prog and skb_do_redirect().
 	 */
-	preempt_disable();
+	migrate_disable();
 	local_bh_disable();
 	bpf_compute_data_pointers(skb);
 	ret = bpf_prog_run_save_cb(lwt->prog, skb);
@@ -78,7 +78,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 	}
 
 	local_bh_enable();
-	preempt_enable();
+	migrate_enable();
 
 	return ret;
 }
commit d9054a1ff585ba01029584ab730efc794603d68f
Author: Dongdong Wang <wangdongdong.6 at bytedance.com>
Date:   Fri Dec 4 23:59:45 2020 -0800

    lwt: Disable BH too in run_lwt_bpf()
    
    The per-cpu bpf_redirect_info is shared among all skb_do_redirect()
    and BPF redirect helpers. Callers on RX path are all in BH context,
    disabling preemption is not sufficient to prevent BH interruption.
    
    In production, we observed strange packet drops because of the race
    condition between LWT xmit and TC ingress, and we verified this issue
    is fixed after we disable BH.
    
    Although this bug was technically introduced from the beginning, that
    is commit 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure"),
    at that time call_rcu() had to be call_rcu_bh() to match the RCU context.
    So this patch may not work well before RCU flavor consolidation has been
    completed around v5.0.
    
    Update the comments above the code too, as call_rcu() is now BH friendly.
    
    Signed-off-by: Dongdong Wang <wangdongdong.6 at bytedance.com>
    Signed-off-by: Alexei Starovoitov <ast at kernel.org>
    Reviewed-by: Cong Wang <cong.wang at bytedance.com>
    Link: https://lore.kernel.org/bpf/20201205075946.497763-1-xiyou.wangcong@gmail.com

diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 7d3438215f32..4f3cb7c15ddf 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -39,12 +39,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 {
 	int ret;
 
-	/* Preempt disable is needed to protect per-cpu redirect_info between
-	 * BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and
-	 * access to maps strictly require a rcu_read_lock() for protection,
-	 * mixing with BH RCU lock doesn't work.
+	/* Preempt disable and BH disable are needed to protect per-cpu
+	 * redirect_info between BPF prog and skb_do_redirect().
 	 */
 	preempt_disable();
+	local_bh_disable();
 	bpf_compute_data_pointers(skb);
 	ret = bpf_prog_run_save_cb(lwt->prog, skb);
 
@@ -78,6 +77,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
 		break;
 	}
 
+	local_bh_enable();
 	preempt_enable();
 
 	return ret;
commit cd796ed3345030aa1bb332fe5c793b3dddaf56e7
Merge: 0477e9288185 bcee52789588
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Dec 7 11:20:26 2020 -0800

    Merge tag 'trace-v5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
    
    Pull tracing fix from Steven Rostedt:
     "Fix userstacktrace option for instances
    
      While writing an application that requires user stack trace option to
      work in instances, I found that the instance option has a bug that
      makes it a nop. The check for performing the user stack trace in an
      instance, checks the top level options (not the instance options) to
      determine if a user stack trace should be performed or not.
    
      This is not only incorrect, but also confusing for users. It confused
      me for a bit!"
    
    * tag 'trace-v5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
      tracing: Fix userstacktrace option for instances

commit e8c954df234145c5765870382c2bc630a48beec9
Author: Pavel Begunkov <asml.silence at gmail.com>
Date:   Sun Dec 6 22:22:46 2020 +0000

    io_uring: fix mis-seting personality's creds
    
    After io_identity_cow() copies an work.identity it wants to copy creds
    to the new just allocated id, not the old one. Otherwise it's
    akin to req->work.identity->creds = req->work.identity->creds.
    
    Signed-off-by: Pavel Begunkov <asml.silence at gmail.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index a2a7c65a77aa..908817cea4f5 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1284,7 +1284,7 @@ static bool io_identity_cow(struct io_kiocb *req)
 	 */
 	io_init_identity(id);
 	if (creds)
-		req->work.identity->creds = creds;
+		id->creds = creds;
 
 	/* add one for this request */
 	refcount_inc(&id->count);
commit db2082700a0c7974c3a7787d50abff34b2695b4b
Author: Krzysztof Kozlowski <krzk at kernel.org>
Date:   Tue Dec 1 23:15:16 2020 +0200

    MAINTAINERS: add a limited ARM and ARM64 SoC entry
    
    It is expected for ARM and ARM64 SoC related code to go through
    sub-architecture maintainers.  Their addresses were therefore not
    documented to push patch traffic through sub-architecture maintainers.
    
    However when patches touch generic code, e.g. multi_v7_defconfig, the
    patch might not be picked up by them and instead should go to the SoC
    maintainers - Arnd and Olof.
    
    Add a minimal maintainer's entry for SoC covering only Makefile, so it
    will not appear on most of submissions (except new devicetree boards).
    It will though serve as a documentation and reference for cases when
    submitter does not know where to send his SoC-related patches.
    
    Signed-off-by: Krzysztof Kozlowski <krzk at kernel.org>
    Link: https://lore.kernel.org/r/20201201211516.24921-2-krzk@kernel.org'
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 715c84c25fb5..52086876ce40 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1486,6 +1486,16 @@ F:	Documentation/devicetree/bindings/iommu/arm,smmu*
 F:	drivers/iommu/arm/
 F:	drivers/iommu/io-pgtable-arm*
 
+ARM AND ARM64 SoC SUB-ARCHITECTURES (COMMON PARTS)
+M:	Arnd Bergmann <arnd at arndb.de>
+M:	Olof Johansson <olof at lixom.net>
+M:	soc at kernel.org
+L:	linux-arm-kernel at lists.infradead.org (moderated for non-subscribers)
+S:	Maintained
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
+F:	arch/arm/boot/dts/Makefile
+F:	arch/arm64/boot/dts/Makefile
+
 ARM SUB-ARCHITECTURES
 L:	linux-arm-kernel at lists.infradead.org (moderated for non-subscribers)
 S:	Maintained
commit c99055ec2c3974386f36eb648af77a8dbe887ca9
Author: Krzysztof Kozlowski <krzk at kernel.org>
Date:   Tue Dec 1 23:15:15 2020 +0200

    MAINTAINERS: correct SoC Git address (formerly: arm-soc)
    
    The SoC Git was moved from arm/arm-soc.git to soc/soc.git.  Correct the
    ARM Sub-architectures entry.
    
    Signed-off-by: Krzysztof Kozlowski <krzk at kernel.org>
    Link: https://lore.kernel.org/r/20201201211516.24921-1-krzk@kernel.org'
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/MAINTAINERS b/MAINTAINERS
index 6f474153dbec..715c84c25fb5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1489,7 +1489,7 @@ F:	drivers/iommu/io-pgtable-arm*
 ARM SUB-ARCHITECTURES
 L:	linux-arm-kernel at lists.infradead.org (moderated for non-subscribers)
 S:	Maintained
-T:	git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
+T:	git git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
 F:	arch/arm/mach-*/
 F:	arch/arm/plat-*/
 
commit 9280f726097b436c8c907825131cd346d7eb0c0f
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Fri Dec 4 00:18:40 2020 +0100

    ARM: keystone: remove SECTION_SIZE_BITS/MAX_PHYSMEM_BITS
    
    These definitions are evidently left over from the days when
    sparsemem settings were platform specific. This was no longer
    the case when the platform got merged.
    
    There was no warning in the past, but now the asm/sparsemem.h
    header ends up being included indirectly, causing this warning:
    
    In file included from /git/arm-soc/arch/arm/mach-keystone/keystone.c:24:
    arch/arm/mach-keystone/memory.h:10:9: warning: 'SECTION_SIZE_BITS' macro redefined [-Wmacro-redefined]
     #define SECTION_SIZE_BITS       34
            ^
    arch/arm/include/asm/sparsemem.h:23:9: note: previous definition is here
     #define SECTION_SIZE_BITS       28
            ^
    
    Clearly the definitions never had any effect here, so remove them.
    
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>
    Link: https://lore.kernel.org/r/20201203231847.1484900-1-arnd@kernel.org'
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

diff --git a/arch/arm/mach-keystone/memory.h b/arch/arm/mach-keystone/memory.h
index 9147565d0581..1b9ed1271e05 100644
--- a/arch/arm/mach-keystone/memory.h
+++ b/arch/arm/mach-keystone/memory.h
@@ -6,9 +6,6 @@
 #ifndef __MEMORY_H
 #define __MEMORY_H
 
-#define MAX_PHYSMEM_BITS	36
-#define SECTION_SIZE_BITS	34
-
 #define KEYSTONE_LOW_PHYS_START		0x80000000ULL
 #define KEYSTONE_LOW_PHYS_SIZE		0x80000000ULL /* 2G */
 #define KEYSTONE_LOW_PHYS_END		(KEYSTONE_LOW_PHYS_START + \
commit 5e2e740247791e9c0663d8c41d04b52f1db22037
Merge: b11ddaac893a 19ba8fb810c6
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Mon Dec 7 15:28:59 2020 +0100

    Merge tag 'imx-fixes-5.10-5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes
    
    i.MX fixes for 5.10, round 5:
    
    - Fix a regression on SoC revision detection with ANATOP, that is
      introduced by commit  4a4fb66119eb ("ARM: imx: Add missing
      of_node_put()").
    - Drop PAD_GPIO_6 from imx6qdl-wandboard ENET pin group, as the pin is
      used by camera sensor now.
    - Fix I2C3_SCL pinmux on imx6qdl-kontron-samx6i board, so that SoM EEPROM
      can be accessed.
    
    * tag 'imx-fixes-5.10-5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
      ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin
      ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp
      ARM: imx: Use correct SRC base address
    
    Link: https://lore.kernel.org/r/20201201091820.GW4072@dragon
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

commit b11ddaac893ada234895bcfc3be3358957e80717
Merge: 0477e9288185 a7361b9c4615
Author: Arnd Bergmann <arnd at arndb.de>
Date:   Mon Dec 7 15:28:27 2020 +0100

    Merge tag 'sunxi-fixes-for-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes
    
    A few more RGMII-ID fixes, and a bunch of other more random fixes
    
    * tag 'sunxi-fixes-for-5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
      ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY
      ARM: dts: sun8i: v3s: fix GIC node memory range
      ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node
      ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator
      ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY
      ARM: dts: s3: pinecube: align compatible property to other S3 boards
      ARM: sunxi: Add machine match for the Allwinner V3 SoC
      arm64: dts: allwinner: h6: orangepi-one-plus: Fix ethernet
    
    Link: https://lore.kernel.org/r/1280f1de-1b6d-4cc2-8448-e5a9096a41e8.lettre@localhost
    Signed-off-by: Arnd Bergmann <arnd at arndb.de>

commit 4165bf015ba9454f45beaad621d16c516d5c5afe
Author: Suravee Suthikulpanit <suravee.suthikulpanit at amd.com>
Date:   Mon Dec 7 03:19:20 2020 -0600

    iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
    
    According to the AMD IOMMU spec, the commit 73db2fc595f3
    ("iommu/amd: Increase interrupt remapping table limit to 512 entries")
    also requires the interrupt table length (IntTabLen) to be set to 9
    (power of 2) in the device table mapping entry (DTE).
    
    Fixes: 73db2fc595f3 ("iommu/amd: Increase interrupt remapping table limit to 512 entries")
    Reported-by: Jerry Snitselaar <jsnitsel at redhat.com>
    Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit at amd.com>
    Reviewed-by: Jerry Snitselaar <jsnitsel at redhat.com>
    Link: https://lore.kernel.org/r/20201207091920.3052-1-suravee.suthikulpanit@amd.com
    Signed-off-by: Will Deacon <will at kernel.org>

diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index 89647700bab2..494b42a31b7a 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -257,7 +257,7 @@
 #define DTE_IRQ_REMAP_INTCTL_MASK	(0x3ULL << 60)
 #define DTE_IRQ_TABLE_LEN_MASK	(0xfULL << 1)
 #define DTE_IRQ_REMAP_INTCTL    (2ULL << 60)
-#define DTE_IRQ_TABLE_LEN       (8ULL << 1)
+#define DTE_IRQ_TABLE_LEN       (9ULL << 1)
 #define DTE_IRQ_REMAP_ENABLE    1ULL
 
 #define PAGE_MODE_NONE    0x00
commit 10c678bd0a035ac2c64a9b26b222f20556227a53
Author: Xin Long <lucien.xin at gmail.com>
Date:   Mon Dec 7 15:55:40 2020 +0800

    udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments
    
    Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
    proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
    Otherwize, with a negtive value passed, it will underflow inet_protos.
    
    This can be reproduced with IPIP FOU:
    
      # ip fou add port 5555 ipproto 4
      # ethtool -K eth1 rx-gro-list on
    
    Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
    Reported-by: Guillaume Nault <gnault at redhat.com>
    Signed-off-by: Xin Long <lucien.xin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 09f0a23d1a01..9eeebd4a0054 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		__skb_pull(skb, skb_transport_offset(skb));
 		ret = udp_queue_rcv_one_skb(sk, skb);
 		if (ret > 0)
-			ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret);
+			ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret);
 	}
 	return 0;
 }
commit 61f54de2e9194f01874d5eda12037b0978e77519
Author: Huazhong Tan <tanhuazhong at huawei.com>
Date:   Mon Dec 7 15:20:25 2020 +0800

    net: hns3: remove a misused pragma packed
    
    hclge_dbg_reg_info[] is defined as an array of packed structure
    accidentally. However, this array contains pointers, which are
    no longer aligned naturally, and cannot be relocated on PPC64.
    Hence, when compile-testing this driver on PPC64 with
    CONFIG_RELOCATABLE=y (e.g. PowerPC allyesconfig), there will be
    some warnings.
    
    Since each field in structure hclge_qos_pri_map_cmd and
    hclge_dbg_bitmap_cmd is type u8, the pragma packed is unnecessary
    for these two structures as well, so remove the pragma packed in
    hclge_debugfs.h to fix this issue, and this increases
    hclge_dbg_reg_info[] by 4 bytes per entry.
    
    Fixes: a582b78dfc33 ("net: hns3: code optimization for debugfs related to "dump reg"")
    Reported-by: Stephen Rothwell <sfr at canb.auug.org.au>
    Signed-off-by: Huazhong Tan <tanhuazhong at huawei.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h
index a9066e6ff697..ca2ab6cf84d9 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h
@@ -35,8 +35,6 @@
 
 #define HCLGE_DBG_DFX_SSU_2_OFFSET 12
 
-#pragma pack(1)
-
 struct hclge_qos_pri_map_cmd {
 	u8 pri0_tc  : 4,
 	   pri1_tc  : 4;
@@ -85,8 +83,6 @@ struct hclge_dbg_reg_type_info {
 	struct hclge_dbg_reg_common_msg reg_msg;
 };
 
-#pragma pack()
-
 static const struct hclge_dbg_dfx_message hclge_dbg_bios_common_reg[] = {
 	{false, "Reserved"},
 	{true,	"BP_CPU_STATE"},
commit 223f61b8c5ad80f01900bc25f8073dfa4f23a2be
Author: Hans de Goede <hdegoede at redhat.com>
Date:   Sun Dec 6 21:59:42 2020 -0800

    Input: soc_button_array - add Lenovo Yoga Tablet2 1051L to the dmi_use_low_level_irq list
    
    Add the Lenovo Yoga Tablet2 1051L to the list of devices where the
    ACPI AML code is poking the GPIO config register directly changing
    the IRQ type to a low_level_irq, which we need to work around.
    
    This fixes the home button on the Lenovo Yoga Tablet2 1051L not
    working.
    
    Signed-off-by: Hans de Goede <hdegoede at redhat.com>
    Link: https://lore.kernel.org/r/20201206161245.24798-1-hdegoede@redhat.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index d14a65683c5e..cb6ec59a045d 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -83,6 +83,17 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "One S1003"),
 		},
 	},
+	{
+		/*
+		 * Lenovo Yoga Tab2 1051L, something messes with the home-button
+		 * IRQ settings, leading to a non working home-button.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "60073"),
+			DMI_MATCH(DMI_PRODUCT_VERSION, "1051L"),
+		},
+	},
 	{} /* Terminating entry */
 };
 
commit 3b384bd6c3f2d6d3526c77bfb264dfbaf737bc2a
Author: Furquan Shaikh <furquan at google.com>
Date:   Sun Dec 6 22:05:13 2020 -0800

    Input: raydium_ts_i2c - do not split tx transactions
    
    Raydium device does not like splitting of tx transactions into multiple
    messages - one for the register address and one for the actual data. This
    results in incorrect behavior on the device side.
    
    This change updates raydium_i2c_read and raydium_i2c_write to create
    i2c_msg arrays separately and passes those arrays into raydium_i2c_xfer
    which decides based on the address whether the bank switch command should
    be sent. The bank switch header is still added by raydium_i2c_read and
    raydium_i2c_write to ensure that all these operations are performed as part
    of a single I2C transfer. It guarantees that no other transactions are
    initiated to any other device on the same bus after the bank switch command
    is sent.
    
    Signed-off-by: Furquan Shaikh <furquan at google.com>
    Link: https://lore.kernel.org/r/20201205005941.1427643-1-furquan@google.com
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov at gmail.com>

diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c
index e694a9b2b1e5..603a948460d6 100644
--- a/drivers/input/touchscreen/raydium_i2c_ts.c
+++ b/drivers/input/touchscreen/raydium_i2c_ts.c
@@ -137,45 +137,25 @@ struct raydium_data {
 	bool wake_irq_enabled;
 };
 
-static int raydium_i2c_xfer(struct i2c_client *client,
-			    u32 addr, void *data, size_t len, bool is_read)
-{
-	struct raydium_bank_switch_header {
-		u8 cmd;
-		__be32 be_addr;
-	} __packed header = {
-		.cmd = RM_CMD_BANK_SWITCH,
-		.be_addr = cpu_to_be32(addr),
-	};
-
-	u8 reg_addr = addr & 0xff;
-
-	struct i2c_msg xfer[] = {
-		{
-			.addr = client->addr,
-			.len = sizeof(header),
-			.buf = (u8 *)&header,
-		},
-		{
-			.addr = client->addr,
-			.len = 1,
-			.buf = &reg_addr,
-		},
-		{
-			.addr = client->addr,
-			.len = len,
-			.buf = data,
-			.flags = is_read ? I2C_M_RD : 0,
-		}
-	};
+/*
+ * Header to be sent for RM_CMD_BANK_SWITCH command. This is used by
+ * raydium_i2c_{read|send} below.
+ */
+struct __packed raydium_bank_switch_header {
+	u8 cmd;
+	__be32 be_addr;
+};
 
+static int raydium_i2c_xfer(struct i2c_client *client, u32 addr,
+			    struct i2c_msg *xfer, size_t xfer_count)
+{
+	int ret;
 	/*
 	 * If address is greater than 255, then RM_CMD_BANK_SWITCH needs to be
 	 * sent first. Else, skip the header i.e. xfer[0].
 	 */
 	int xfer_start_idx = (addr > 0xff) ? 0 : 1;
-	size_t xfer_count = ARRAY_SIZE(xfer) - xfer_start_idx;
-	int ret;
+	xfer_count -= xfer_start_idx;
 
 	ret = i2c_transfer(client->adapter, &xfer[xfer_start_idx], xfer_count);
 	if (likely(ret == xfer_count))
@@ -189,10 +169,46 @@ static int raydium_i2c_send(struct i2c_client *client,
 {
 	int tries = 0;
 	int error;
+	u8 *tx_buf;
+	u8 reg_addr = addr & 0xff;
+
+	tx_buf = kmalloc(len + 1, GFP_KERNEL);
+	if (!tx_buf)
+		return -ENOMEM;
+
+	tx_buf[0] = reg_addr;
+	memcpy(tx_buf + 1, data, len);
 
 	do {
-		error = raydium_i2c_xfer(client, addr, (void *)data, len,
-					 false);
+		struct raydium_bank_switch_header header = {
+			.cmd = RM_CMD_BANK_SWITCH,
+			.be_addr = cpu_to_be32(addr),
+		};
+
+		/*
+		 * Perform as a single i2c_transfer transaction to ensure that
+		 * no other I2C transactions are initiated on the bus to any
+		 * other device in between. Initiating transacations to other
+		 * devices after RM_CMD_BANK_SWITCH is sent is known to cause
+		 * issues. This is also why regmap infrastructure cannot be used
+		 * for this driver. Regmap handles page(bank) switch and reads
+		 * as separate i2c_transfer() operations. This can result in
+		 * problems if the Raydium device is on a shared I2C bus.
+		 */
+		struct i2c_msg xfer[] = {
+			{
+				.addr = client->addr,
+				.len = sizeof(header),
+				.buf = (u8 *)&header,
+			},
+			{
+				.addr = client->addr,
+				.len = len + 1,
+				.buf = tx_buf,
+			},
+		};
+
+		error = raydium_i2c_xfer(client, addr, xfer, ARRAY_SIZE(xfer));
 		if (likely(!error))
 			return 0;
 
@@ -206,12 +222,46 @@ static int raydium_i2c_send(struct i2c_client *client,
 static int raydium_i2c_read(struct i2c_client *client,
 			    u32 addr, void *data, size_t len)
 {
-	size_t xfer_len;
 	int error;
 
 	while (len) {
-		xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
-		error = raydium_i2c_xfer(client, addr, data, xfer_len, true);
+		u8 reg_addr = addr & 0xff;
+		struct raydium_bank_switch_header header = {
+			.cmd = RM_CMD_BANK_SWITCH,
+			.be_addr = cpu_to_be32(addr),
+		};
+		size_t xfer_len = min_t(size_t, len, RM_MAX_READ_SIZE);
+
+		/*
+		 * Perform as a single i2c_transfer transaction to ensure that
+		 * no other I2C transactions are initiated on the bus to any
+		 * other device in between. Initiating transacations to other
+		 * devices after RM_CMD_BANK_SWITCH is sent is known to cause
+		 * issues. This is also why regmap infrastructure cannot be used
+		 * for this driver. Regmap handles page(bank) switch and writes
+		 * as separate i2c_transfer() operations. This can result in
+		 * problems if the Raydium device is on a shared I2C bus.
+		 */
+		struct i2c_msg xfer[] = {
+			{
+				.addr = client->addr,
+				.len = sizeof(header),
+				.buf = (u8 *)&header,
+			},
+			{
+				.addr = client->addr,
+				.len = 1,
+				.buf = &reg_addr,
+			},
+			{
+				.addr = client->addr,
+				.len = xfer_len,
+				.buf = data,
+				.flags = I2C_M_RD,
+			}
+		};
+
+		error = raydium_i2c_xfer(client, addr, xfer, ARRAY_SIZE(xfer));
 		if (unlikely(error))
 			return error;
 
commit 0477e92881850d44910a7e94fc2c46f96faa131f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 14:25:12 2020 -0800

    Linux 5.10-rc7

diff --git a/Makefile b/Makefile
index a2ded5029084..9ec53d947628 100644
--- a/Makefile
+++ b/Makefile
@@ -2,7 +2,7 @@
 VERSION = 5
 PATCHLEVEL = 10
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Kleptomaniac Octopus
 
 # *DOCUMENTATION*
commit ab91292cb3e9f43d9c6839d7572d17b35bc21710
Merge: d49248eb25a2 264f53b41946
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:48:17 2020 -0800

    Merge tag 'char-misc-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
    
    Pull char/misc driver fixes from Greg KH:
     "Here are some small driver fixes, and one "large" revert, for
      5.10-rc7.
    
      They include:
    
       - revert mei patch from 5.10-rc1 that was using a reserved userspace
         value. It will be resubmitted once the proper id has been assigned
         by the virtio people.
    
       - habanalabs fixes found by the fall-through audit from Gustavo
    
       - speakup driver fixes for reported issues
    
       - fpga config build fix for reported issue.
    
      All of these except the revert have been in linux-next with no
      reported issues. The revert is "clean" and just removes a
      previously-added driver, so no real issue there"
    
    * tag 'char-misc-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
      Revert "mei: virtio: virtualization frontend driver"
      fpga: Specify HAS_IOMEM dependency for FPGA_DFL
      habanalabs: put devices before driver removal
      habanalabs: free host huge va_range if not used
      speakup: Reject setting the speakup line discipline outside of speakup

commit d49248eb25a223b238cd7687ea92b080f595a323
Merge: f5226f1d20c4 c8bcd9c5be24
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:43:50 2020 -0800

    Merge tag 'tty-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
    
    Pull tty fixes from Greg KH:
     "Here are two tty core fixes for 5.10-rc7.
    
      They resolve some reported locking issues in the tty core. While they
      have not been in a released linux-next yet, they have passed all of
      the 0-day bot testing as well as the submitter's testing"
    
    * tag 'tty-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
      tty: Fix ->session locking
      tty: Fix ->pgrp locking in tiocspgrp()

commit f5226f1d20c4113922dbe7742c416f06700c1ea9
Merge: 8100a58044f8 a4b98a7512f1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:38:36 2020 -0800

    Merge tag 'usb-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
    
    Pull USB fixes from Greg KH:
     "Here are some small USB fixes for 5.10-rc7 that resolve a number of
      reported issues, and add some new device ids.
    
      Nothing major here, but these solve some problems that people were
      having with the 5.10-rc tree:
    
       - reverts for USB storage dma settings that broke working devices
    
       - thunderbolt use-after-free fix
    
       - cdns3 driver fixes
    
       - gadget driver userspace copy fix
    
       - new device ids
    
      All of these except for the reverts have been in linux-next with no
      reported issues. The reverts are "clean" and were tested by Hans, as
      well as passing the 0-day tests"
    
    * tag 'usb-5.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
      usb: gadget: f_fs: Use local copy of descriptors for userspace copy
      usb: ohci-omap: Fix descriptor conversion
      Revert "usb-storage: fix sdev->host->dma_dev"
      Revert "uas: fix sdev->host->dma_dev"
      Revert "uas: bump hw_max_sectors to 2048 blocks for SS or faster drives"
      USB: serial: kl5kusb105: fix memleak on open
      USB: serial: ch341: sort device-id entries
      USB: serial: ch341: add new Product ID for CH341A
      USB: serial: option: fix Quectel BG96 matching
      usb: cdns3: core: fix goto label for error path
      usb: cdns3: gadget: clear trb->length as zero after preparing every trb
      usb: cdns3: Fix hardware based role switch
      USB: serial: option: add support for Thales Cinterion EXS82
      USB: serial: option: add Fibocom NL668 variants
      thunderbolt: Fix use-after-free in remove_unplugged_switch()

commit 8100a58044f8f502a53d90af96d6030767df0fbd
Merge: 9f6b28d498ba 84da009f06e6
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:22:39 2020 -0800

    Merge tag 'x86-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull x86 fixes from Thomas Gleixner:
     "A set of fixes for x86:
    
       - Make the AMD L3 QoS code and data priorization enable/disable
         mechanism work correctly.
    
         The control bit was only set/cleared on one of the CPUs in a L3
         domain, but it has to be modified on all CPUs in the domain. The
         initial documentation was not clear about this, but the updated one
         from Oct 2020 spells it out.
    
       - Fix an off by one in the UV platform detection code which causes
         the UV hubs to be identified wrongly.
    
         The chip revisions start at 1 not at 0.
    
       - Fix a long standing bug in the evaluation of prefixes in the
         uprobes code which fails to handle repeated prefixes properly.
    
         The aggregate size of the prefixes can be larger than the bytes
         array but the code blindly iterated over the aggregate size beyond
         the array boundary. Add a macro to handle this case properly and
         use it at the affected places"
    
    * tag 'x86-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      x86/sev-es: Use new for_each_insn_prefix() macro to loop over prefixes bytes
      x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
      x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
      x86/platform/uv: Fix UV4 hub revision adjustment
      x86/resctrl: Fix AMD L3 QOS CDP enable/disable

commit 9f6b28d498ba084dff970ad95796642f804ffcd8
Merge: 592d9a0835c9 fc17db8aa4c5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:20:18 2020 -0800

    Merge tag 'perf-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull perf fixes from Thomas Gleixner:
     "Two fixes for performance monitoring on X86:
    
       - Add recursion protection to another callchain invoked from
         x86_pmu_stop() which can recurse back into x86_pmu_stop(). The
         first attempt to fix this missed this extra code path.
    
       - Use the already filtered status variable to check for PEBS counter
         overflow bits and not the unfiltered full status read from
         IA32_PERF_GLOBAL_STATUS which can have unrelated bits check which
         would be evaluated incorrectly"
    
    * tag 'perf-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      perf/x86/intel: Check PEBS status correctly
      perf/x86/intel: Fix a warning on x86_pmu_stop() with large PEBS

commit 592d9a0835c97f54744a7c3ce845c16735c0ab14
Merge: ff615c980357 9ea69a55b3b9
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:15:55 2020 -0800

    Merge tag 'irq-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull irq fixes from Thomas Gleixner:
     "A set of updates for the interrupt subsystem:
    
       - Make multiqueue devices which use the managed interrupt affinity
         infrastructure work on PowerPC/Pseries. PowerPC does not use the
         generic infrastructure for setting up PCI/MSI interrupts and the
         multiqueue changes failed to update the legacy PCI/MSI
         infrastructure. Make this work by passing the affinity setup
         information down to the mapping and allocation functions.
    
       - Move Jason Cooper from MAINTAINERS to CREDITS as his mail is
         bouncing and he's not reachable. We hope all is well with him and
         say thanks for his work over the years"
    
    * tag 'irq-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      powerpc/pseries: Pass MSI affinity to irq_create_mapping()
      genirq/irqdomain: Add an irq_create_mapping_affinity() function
      MAINTAINERS: Move Jason Cooper to CREDITS

commit ff615c98035729776a74f9c86c3b137ae35ac1d3
Merge: e6585a493921 4d916140bf28
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 11:11:32 2020 -0800

    Merge tag 'locking-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    
    Pull intel_idle build fix from Thomas Gleixner:
     "A tiny build fix for a recent change in the intel_idle driver which
      missed a CONFIG dependency and broke the build for certain
      configurations"
    
    * tag 'locking-urgent-2020-12-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      intel_idle: Build fix

commit e6585a493921991653be1fd65c3aa3fb90b000ae
Merge: 12c0ab6658de 7d32358be8ac
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 10:31:39 2020 -0800

    Merge tag 'kbuild-fixes-v5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
    
    Pull Kbuild fixes from Masahiro Yamada:
    
     - Move -Wcast-align to W=3, which tends to be false-positive and there
       is no tree-wide solution.
    
     - Pass -fmacro-prefix-map to KBUILD_CPPFLAGS because it is a
       preprocessor option and makes sense for .S files as well.
    
     - Disable -gdwarf-2 for Clang's integrated assembler to avoid warnings.
    
     - Disable --orphan-handling=warn for LLD 10.0.1 to avoid warnings.
    
     - Fix undesirable line breaks in *.mod files.
    
    * tag 'kbuild-fixes-v5.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
      kbuild: avoid split lines in .mod files
      kbuild: Disable CONFIG_LD_ORPHAN_WARN for ld.lld 10.0.1
      kbuild: Hoist '--orphan-handling' into Kconfig
      Kbuild: do not emit debug info for assembly with LLVM_IAS=1
      kbuild: use -fmacro-prefix-map for .S sources
      Makefile.extrawarn: move -Wcast-align to W=3

commit 12c0ab6658dea4709189c3730d2431c52808428e
Merge: 7059c2c00a21 309d08d9b3a3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Dec 6 10:20:59 2020 -0800

    Merge branch 'akpm' (patches from Andrew)
    
    Merge misc fixes from Andrew Morton:
     "12 patches.
    
      Subsystems affected by this patch series: mm (memcg, zsmalloc, swap,
      mailmap, selftests, pagecache, hugetlb, pagemap), lib, and coredump"
    
    * emailed patches from Andrew Morton <akpm at linux-foundation.org>:
      mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
      hugetlb_cgroup: fix offline of hugetlb cgroup with reservations
      mm/filemap: add static for function __add_to_page_cache_locked
      userfaultfd: selftests: fix SIGSEGV if huge mmap fails
      tools/testing/selftests/vm: fix build error
      mailmap: add two more addresses of Uwe Kleine-König
      mm/swapfile: do not sleep with a spin lock held
      mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
      mm: list_lru: set shrinker map bit when child nr_items is not zero
      mm: memcg/slab: fix obj_cgroup_charge() return value handling
      coredump: fix core_pattern parse error
      zlib: export S390 symbols for zlib modules

commit 309d08d9b3a3659ab3f239d27d4e38b670b08fc9
Author: Liu Zixian <liuzixian4 at huawei.com>
Date:   Sat Dec 5 22:15:15 2020 -0800

    mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
    
    On success, mmap should return the begin address of newly mapped area,
    but patch "mm: mmap: merge vma after call_mmap() if possible" set
    vm_start of newly merged vma to return value addr.  Users of mmap will
    get wrong address if vma is merged after call_mmap().  We fix this by
    moving the assignment to addr before merging vma.
    
    We have a driver which changes vm_flags, and this bug is found by our
    testcases.
    
    Fixes: d70cec898324 ("mm: mmap: merge vma after call_mmap() if possible")
    Signed-off-by: Liu Zixian <liuzixian4 at huawei.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Jason Gunthorpe <jgg at nvidia.com>
    Reviewed-by: David Hildenbrand <david at redhat.com>
    Cc: Miaohe Lin <linmiaohe at huawei.com>
    Cc: Hongxiang Lou <louhongxiang at huawei.com>
    Cc: Hu Shiyuan <hushiyuan at huawei.com>
    Cc: Matthew Wilcox <willy at infradead.org>
    Link: https://lkml.kernel.org/r/20201203085350.22624-1-liuzixian4@huawei.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/mmap.c b/mm/mmap.c
index d91ecb00d38c..5c8b4485860d 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1808,6 +1808,17 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 		if (error)
 			goto unmap_and_free_vma;
 
+		/* Can addr have changed??
+		 *
+		 * Answer: Yes, several device drivers can do it in their
+		 *         f_op->mmap method. -DaveM
+		 * Bug: If addr is changed, prev, rb_link, rb_parent should
+		 *      be updated for vma_link()
+		 */
+		WARN_ON_ONCE(addr != vma->vm_start);
+
+		addr = vma->vm_start;
+
 		/* If vm_flags changed after call_mmap(), we should try merge vma again
 		 * as we may succeed this time.
 		 */
@@ -1822,25 +1833,12 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
 				fput(vma->vm_file);
 				vm_area_free(vma);
 				vma = merge;
-				/* Update vm_flags and possible addr to pick up the change. We don't
-				 * warn here if addr changed as the vma is not linked by vma_link().
-				 */
-				addr = vma->vm_start;
+				/* Update vm_flags to pick up the change. */
 				vm_flags = vma->vm_flags;
 				goto unmap_writable;
 			}
 		}
 
-		/* Can addr have changed??
-		 *
-		 * Answer: Yes, several device drivers can do it in their
-		 *         f_op->mmap method. -DaveM
-		 * Bug: If addr is changed, prev, rb_link, rb_parent should
-		 *      be updated for vma_link()
-		 */
-		WARN_ON_ONCE(addr != vma->vm_start);
-
-		addr = vma->vm_start;
 		vm_flags = vma->vm_flags;
 	} else if (vm_flags & VM_SHARED) {
 		error = shmem_zero_setup(vma);
commit 7a5bde37983d37783161681ff7c6122dfd081791
Author: Mike Kravetz <mike.kravetz at oracle.com>
Date:   Sat Dec 5 22:15:12 2020 -0800

    hugetlb_cgroup: fix offline of hugetlb cgroup with reservations
    
    Adrian Moreno was ruuning a kubernetes 1.19 + containerd/docker workload
    using hugetlbfs.  In this environment the issue is reproduced by:
    
     - Start a simple pod that uses the recently added HugePages medium
       feature (pod yaml attached)
    
     - Start a DPDK app. It doesn't need to run successfully (as in transfer
       packets) nor interact with real hardware. It seems just initializing
       the EAL layer (which handles hugepage reservation and locking) is
       enough to trigger the issue
    
     - Delete the Pod (or let it "Complete").
    
    This would result in a kworker thread going into a tight loop (top output):
    
       1425 root      20   0       0      0      0 R  99.7   0.0   5:22.45 kworker/28:7+cgroup_destroy
    
    'perf top -g' reports:
    
      -   63.28%     0.01%  [kernel]                    [k] worker_thread
         - 49.97% worker_thread
            - 52.64% process_one_work
               - 62.08% css_killed_work_fn
                  - hugetlb_cgroup_css_offline
                       41.52% _raw_spin_lock
                     - 2.82% _cond_resched
                          rcu_all_qs
                       2.66% PageHuge
            - 0.57% schedule
               - 0.57% __schedule
    
    We are spinning in the do-while loop in hugetlb_cgroup_css_offline.
    Worse yet, we are holding the master cgroup lock (cgroup_mutex) while
    infinitely spinning.  Little else can be done on the system as the
    cgroup_mutex can not be acquired.
    
    Do note that the issue can be reproduced by simply offlining a hugetlb
    cgroup containing pages with reservation counts.
    
    The loop in hugetlb_cgroup_css_offline is moving page counts from the
    cgroup being offlined to the parent cgroup.  This is done for each
    hstate, and is repeated until hugetlb_cgroup_have_usage returns false.
    The routine moving counts (hugetlb_cgroup_move_parent) is only moving
    'usage' counts.  The routine hugetlb_cgroup_have_usage is checking for
    both 'usage' and 'reservation' counts.  Discussion about what to do with
    reservation counts when reparenting was discussed here:
    
    https://lore.kernel.org/linux-kselftest/CAHS8izMFAYTgxym-Hzb_JmkTK1N_S9tGN71uS6MFV+R7swYu5A@mail.gmail.com/
    
    The decision was made to leave a zombie cgroup for with reservation
    counts.  Unfortunately, the code checking reservation counts was
    incorrectly added to hugetlb_cgroup_have_usage.
    
    To fix the issue, simply remove the check for reservation counts.  While
    fixing this issue, a related bug in hugetlb_cgroup_css_offline was
    noticed.  The hstate index is not reinitialized each time through the
    do-while loop.  Fix this as well.
    
    Fixes: 1adc4d419aa2 ("hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations")
    Reported-by: Adrian Moreno <amorenoz at redhat.com>
    Signed-off-by: Mike Kravetz <mike.kravetz at oracle.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Tested-by: Adrian Moreno <amorenoz at redhat.com>
    Reviewed-by: Shakeel Butt <shakeelb at google.com>
    Cc: Mina Almasry <almasrymina at google.com>
    Cc: David Rientjes <rientjes at google.com>
    Cc: Greg Thelen <gthelen at google.com>
    Cc: Sandipan Das <sandipan at linux.ibm.com>
    Cc: Shuah Khan <shuah at kernel.org>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/20201203220242.158165-1-mike.kravetz@oracle.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c
index 1f87aec9ab5c..9182848dda3e 100644
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -82,11 +82,8 @@ static inline bool hugetlb_cgroup_have_usage(struct hugetlb_cgroup *h_cg)
 
 	for (idx = 0; idx < hugetlb_max_hstate; idx++) {
 		if (page_counter_read(
-			    hugetlb_cgroup_counter_from_cgroup(h_cg, idx)) ||
-		    page_counter_read(hugetlb_cgroup_counter_from_cgroup_rsvd(
-			    h_cg, idx))) {
+				hugetlb_cgroup_counter_from_cgroup(h_cg, idx)))
 			return true;
-		}
 	}
 	return false;
 }
@@ -202,9 +199,10 @@ static void hugetlb_cgroup_css_offline(struct cgroup_subsys_state *css)
 	struct hugetlb_cgroup *h_cg = hugetlb_cgroup_from_css(css);
 	struct hstate *h;
 	struct page *page;
-	int idx = 0;
+	int idx;
 
 	do {
+		idx = 0;
 		for_each_hstate(h) {
 			spin_lock(&hugetlb_lock);
 			list_for_each_entry(page, &h->hugepage_activelist, lru)
commit 3351b16af4946fff0d46481d155fb91adb28b1f9
Author: Alex Shi <alex.shi at linux.alibaba.com>
Date:   Sat Dec 5 22:15:09 2020 -0800

    mm/filemap: add static for function __add_to_page_cache_locked
    
      mm/filemap.c:830:14: warning: no previous prototype for `__add_to_page_cache_locked' [-Wmissing-prototypes]
    
    Signed-off-by: Alex Shi <alex.shi at linux.alibaba.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Souptick Joarder <jrdr.linux at gmail.com>
    Link: https://lkml.kernel.org/r/1604661895-5495-1-git-send-email-alex.shi@linux.alibaba.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/filemap.c b/mm/filemap.c
index 0b2067b3c328..331f4261d723 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -827,7 +827,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
 }
 EXPORT_SYMBOL_GPL(replace_page_cache_page);
 
-noinline int __add_to_page_cache_locked(struct page *page,
+static noinline int __add_to_page_cache_locked(struct page *page,
 					struct address_space *mapping,
 					pgoff_t offset, gfp_t gfp,
 					void **shadowp)
commit 573a259336f8c57739bdaf035aa7abbae7d9a713
Author: Axel Rasmussen <axelrasmussen at google.com>
Date:   Sat Dec 5 22:15:05 2020 -0800

    userfaultfd: selftests: fix SIGSEGV if huge mmap fails
    
    The error handling in hugetlb_allocate_area() was incorrect for the
    hugetlb_shared test case.
    
    Previously the behavior was:
    
    - mmap a hugetlb area
      - If this fails, set the pointer to NULL, and carry on
    - mmap an alias of the same hugetlb fd
      - If this fails, munmap the original area
    
    If the original mmap failed, it's likely the second one did too.  If
    both failed, we'd blindly try to munmap a NULL pointer, causing a
    SIGSEGV.  Instead, "goto fail" so we return before trying to mmap the
    alias.
    
    This issue can be hit "in real life" by forgetting to set
    /proc/sys/vm/nr_hugepages (leaving it at 0), and then trying to run the
    hugetlb_shared test.
    
    Another small improvement is, when the original mmap fails, don't just
    print "it failed": perror(), so we can see *why*.  :)
    
    Signed-off-by: Axel Rasmussen <axelrasmussen at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Shuah Khan <shuah at kernel.org>
    Cc: Peter Xu <peterx at redhat.com>
    Cc: Joe Perches <joe at perches.com>
    Cc: Mike Rapoport <rppt at linux.vnet.ibm.com>
    Cc: Andrea Arcangeli <aarcange at redhat.com>
    Cc: David Alan Gilbert <dgilbert at redhat.com>
    Link: https://lkml.kernel.org/r/20201204203443.2714693-1-axelrasmussen@google.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c
index 9b0912a01777..c4425597769a 100644
--- a/tools/testing/selftests/vm/userfaultfd.c
+++ b/tools/testing/selftests/vm/userfaultfd.c
@@ -206,19 +206,19 @@ static int hugetlb_release_pages(char *rel_area)
 	return ret;
 }
 
-
 static void hugetlb_allocate_area(void **alloc_area)
 {
 	void *area_alias = NULL;
 	char **alloc_area_alias;
+
 	*alloc_area = mmap(NULL, nr_pages * page_size, PROT_READ | PROT_WRITE,
 			   (map_shared ? MAP_SHARED : MAP_PRIVATE) |
 			   MAP_HUGETLB,
 			   huge_fd, *alloc_area == area_src ? 0 :
 			   nr_pages * page_size);
 	if (*alloc_area == MAP_FAILED) {
-		fprintf(stderr, "mmap of hugetlbfs file failed\n");
-		*alloc_area = NULL;
+		perror("mmap of hugetlbfs file failed");
+		goto fail;
 	}
 
 	if (map_shared) {
@@ -227,14 +227,11 @@ static void hugetlb_allocate_area(void **alloc_area)
 				  huge_fd, *alloc_area == area_src ? 0 :
 				  nr_pages * page_size);
 		if (area_alias == MAP_FAILED) {
-			if (munmap(*alloc_area, nr_pages * page_size) < 0) {
-				perror("hugetlb munmap");
-				exit(1);
-			}
-			*alloc_area = NULL;
-			return;
+			perror("mmap of hugetlb file alias failed");
+			goto fail_munmap;
 		}
 	}
+
 	if (*alloc_area == area_src) {
 		huge_fd_off0 = *alloc_area;
 		alloc_area_alias = &area_src_alias;
@@ -243,6 +240,16 @@ static void hugetlb_allocate_area(void **alloc_area)
 	}
 	if (area_alias)
 		*alloc_area_alias = area_alias;
+
+	return;
+
+fail_munmap:
+	if (munmap(*alloc_area, nr_pages * page_size) < 0) {
+		perror("hugetlb munmap");
+		exit(1);
+	}
+fail:
+	*alloc_area = NULL;
 }
 
 static void hugetlb_alias_mapping(__u64 *start, size_t len, unsigned long offset)
commit d8cbe8bfa7df3c680ddfd5e1eee3a5c86d8dc764
Author: Xingxing Su <suxingxing at loongson.cn>
Date:   Sat Dec 5 22:15:02 2020 -0800

    tools/testing/selftests/vm: fix build error
    
    Only x86 and PowerPC implement the pkey-xxx.h, and an error was reported
    when compiling protection_keys.c.
    
    Add a Arch judgment to compile "protection_keys" in the Makefile.
    
    If other arch implement this, add the arch name to the Makefile.
    eg:
        ifneq (,$(findstring $(ARCH),powerpc mips ... ))
    
    Following build errors:
    
        pkey-helpers.h:93:2: error: #error Architecture not supported
         #error Architecture not supported
        pkey-helpers.h:96:20: error: `PKEY_DISABLE_ACCESS' undeclared
         #define PKEY_MASK (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)
                            ^
        protection_keys.c:218:45: error: `PKEY_DISABLE_WRITE' undeclared
         pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE));
                                                    ^
    
    Signed-off-by: Xingxing Su <suxingxing at loongson.cn>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Shuah Khan <shuah at kernel.org>
    Cc: Sandipan Das <sandipan at linux.ibm.com>
    Cc: John Hubbard <jhubbard at nvidia.com>
    Cc: Dave Hansen <dave.hansen at intel.com>
    Cc: "Kirill A. Shutemov" <kirill.shutemov at linux.intel.com>
    Cc: Brian Geffon <bgeffon at google.com>
    Cc: Mina Almasry <almasrymina at google.com>
    Link: https://lkml.kernel.org/r/1606826876-30656-1-git-send-email-suxingxing@loongson.cn
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile
index 30873b19d04b..691893afc15d 100644
--- a/tools/testing/selftests/vm/Makefile
+++ b/tools/testing/selftests/vm/Makefile
@@ -60,9 +60,13 @@ ifeq ($(CAN_BUILD_X86_64),1)
 TEST_GEN_FILES += $(BINARIES_64)
 endif
 else
+
+ifneq (,$(findstring $(ARCH),powerpc))
 TEST_GEN_FILES += protection_keys
 endif
 
+endif
+
 ifneq (,$(filter $(MACHINE),arm64 ia64 mips64 parisc64 ppc64 ppc64le riscv64 s390x sh64 sparc64 x86_64))
 TEST_GEN_FILES += va_128TBswitch
 TEST_GEN_FILES += virtual_address_range
commit 4e60340c5ca560278c938726235bc0daa5fc8c7f
Author: Uwe Kleine-König <u.kleine-koenig at pengutronix.de>
Date:   Sat Dec 5 22:14:58 2020 -0800

    mailmap: add two more addresses of Uwe Kleine-König
    
    This fixes attribution for the commits (among others)
    
     - d4097456cd1d ("video/framebuffer: move the probe func into
       .devinit.text in Blackfin LCD driver")
    
     - 0312e024d6cd ("mfd: mc13xxx: Add support for mc34708")
    
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig at pengutronix.de>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Link: https://lkml.kernel.org/r/20201127213358.3440830-1-u.kleine-koenig@pengutronix.de
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/.mailmap b/.mailmap
index d9fb83d67055..225546cc8028 100644
--- a/.mailmap
+++ b/.mailmap
@@ -322,6 +322,8 @@ TripleX Chung <xxx.phy at gmail.com> <zhongyu at 18mail.cn>
 Tsuneo Yoshioka <Tsuneo.Yoshioka at f-secure.com>
 Tycho Andersen <tycho at tycho.pizza> <tycho at tycho.ws>
 Uwe Kleine-König <ukleinek at informatik.uni-freiburg.de>
+Uwe Kleine-König <u.kleine-koenig at pengutronix.de>
+Uwe Kleine-König <ukleinek at strlen.de>
 Uwe Kleine-König <ukl at pengutronix.de>
 Uwe Kleine-König <Uwe.Kleine-Koenig at digi.com>
 Valdis Kletnieks <Valdis.Kletnieks at vt.edu>
commit b11a76b37a5aa7b07c3e3eeeaae20b25475bddd3
Author: Qian Cai <qcai at redhat.com>
Date:   Sat Dec 5 22:14:55 2020 -0800

    mm/swapfile: do not sleep with a spin lock held
    
    We can't call kvfree() with a spin lock held, so defer it.  Fixes a
    might_sleep() runtime warning.
    
    Fixes: 873d7bcfd066 ("mm/swapfile.c: use kvzalloc for swap_info_struct allocation")
    Signed-off-by: Qian Cai <qcai at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Hugh Dickins <hughd at google.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/20201202151549.10350-1-qcai@redhat.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/swapfile.c b/mm/swapfile.c
index c4a613688a17..d58361109066 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2867,6 +2867,7 @@ late_initcall(max_swapfiles_check);
 static struct swap_info_struct *alloc_swap_info(void)
 {
 	struct swap_info_struct *p;
+	struct swap_info_struct *defer = NULL;
 	unsigned int type;
 	int i;
 
@@ -2895,7 +2896,7 @@ static struct swap_info_struct *alloc_swap_info(void)
 		smp_wmb();
 		WRITE_ONCE(nr_swapfiles, nr_swapfiles + 1);
 	} else {
-		kvfree(p);
+		defer = p;
 		p = swap_info[type];
 		/*
 		 * Do not memset this entry: a racing procfs swap_next()
@@ -2908,6 +2909,7 @@ static struct swap_info_struct *alloc_swap_info(void)
 		plist_node_init(&p->avail_lists[i], 0);
 	p->flags = SWP_USED;
 	spin_unlock(&swap_lock);
+	kvfree(defer);
 	spin_lock_init(&p->lock);
 	spin_lock_init(&p->cont_lock);
 
commit e91d8d78237de8d7120c320b3645b7100848f24d
Author: Minchan Kim <minchan at kernel.org>
Date:   Sat Dec 5 22:14:51 2020 -0800

    mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
    
    While I was doing zram testing, I found sometimes decompression failed
    since the compression buffer was corrupted.  With investigation, I found
    below commit calls cond_resched unconditionally so it could make a
    problem in atomic context if the task is reschedule.
    
      BUG: sleeping function called from invalid context at mm/vmalloc.c:108
      in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 946, name: memhog
      3 locks held by memhog/946:
       #0: ffff9d01d4b193e8 (&mm->mmap_lock#2){++++}-{4:4}, at: __mm_populate+0x103/0x160
       #1: ffffffffa3d53de0 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0xa98/0x1160
       #2: ffff9d01d56b8110 (&zspage->lock){.+.+}-{3:3}, at: zs_map_object+0x8e/0x1f0
      CPU: 0 PID: 946 Comm: memhog Not tainted 5.9.3-00011-gc5bfc0287345-dirty #316
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1 04/01/2014
      Call Trace:
        unmap_kernel_range_noflush+0x2eb/0x350
        unmap_kernel_range+0x14/0x30
        zs_unmap_object+0xd5/0xe0
        zram_bvec_rw.isra.0+0x38c/0x8e0
        zram_rw_page+0x90/0x101
        bdev_write_page+0x92/0xe0
        __swap_writepage+0x94/0x4a0
        pageout+0xe3/0x3a0
        shrink_page_list+0xb94/0xd60
        shrink_inactive_list+0x158/0x460
    
    We can fix this by removing the ZSMALLOC_PGTABLE_MAPPING feature (which
    contains the offending calling code) from zsmalloc.
    
    Even though this option showed some amount improvement(e.g., 30%) in
    some arm32 platforms, it has been headache to maintain since it have
    abused APIs[1](e.g., unmap_kernel_range in atomic context).
    
    Since we are approaching to deprecate 32bit machines and already made
    the config option available for only builtin build since v5.8, lastly it
    has been not default option in zsmalloc, it's time to drop the option
    for better maintenance.
    
    [1] http://lore.kernel.org/linux-mm/20201105170249.387069-1-minchan@kernel.org
    
    Fixes: e47110e90584 ("mm/vunmap: add cond_resched() in vunmap_pmd_range")
    Signed-off-by: Minchan Kim <minchan at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky at gmail.com>
    Cc: Tony Lindgren <tony at atomide.com>
    Cc: Christoph Hellwig <hch at infradead.org>
    Cc: Harish Sriram <harish at linux.ibm.com>
    Cc: Uladzislau Rezki <urezki at gmail.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/20201117202916.GA3856507@google.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig
index 34793aabdb65..58df9fd79a76 100644
--- a/arch/arm/configs/omap2plus_defconfig
+++ b/arch/arm/configs/omap2plus_defconfig
@@ -81,7 +81,6 @@ CONFIG_PARTITION_ADVANCED=y
 CONFIG_BINFMT_MISC=y
 CONFIG_CMA=y
 CONFIG_ZSMALLOC=m
-CONFIG_ZSMALLOC_PGTABLE_MAPPING=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
diff --git a/include/linux/zsmalloc.h b/include/linux/zsmalloc.h
index 0fdbf653b173..4807ca4d52e0 100644
--- a/include/linux/zsmalloc.h
+++ b/include/linux/zsmalloc.h
@@ -20,7 +20,6 @@
  * zsmalloc mapping modes
  *
  * NOTE: These only make a difference when a mapped object spans pages.
- * They also have no effect when ZSMALLOC_PGTABLE_MAPPING is selected.
  */
 enum zs_mapmode {
 	ZS_MM_RW, /* normal read-write mapping */
diff --git a/mm/Kconfig b/mm/Kconfig
index d42423f884a7..390165ffbb0f 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -707,19 +707,6 @@ config ZSMALLOC
 	  returned by an alloc().  This handle must be mapped in order to
 	  access the allocated space.
 
-config ZSMALLOC_PGTABLE_MAPPING
-	bool "Use page table mapping to access object in zsmalloc"
-	depends on ZSMALLOC=y
-	help
-	  By default, zsmalloc uses a copy-based object mapping method to
-	  access allocations that span two pages. However, if a particular
-	  architecture (ex, ARM) performs VM mapping faster than copying,
-	  then you should select this. This causes zsmalloc to use page table
-	  mapping rather than copying for object mapping.
-
-	  You can check speed with zsmalloc benchmark:
-	  https://github.com/spartacus06/zsmapbench
-
 config ZSMALLOC_STAT
 	bool "Export zsmalloc statistics"
 	depends on ZSMALLOC
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 918c7b019b3d..cdfaaadea8ff 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -293,11 +293,7 @@ struct zspage {
 };
 
 struct mapping_area {
-#ifdef CONFIG_ZSMALLOC_PGTABLE_MAPPING
-	struct vm_struct *vm; /* vm area for mapping object that span pages */
-#else
 	char *vm_buf; /* copy buffer for objects that span pages */
-#endif
 	char *vm_addr; /* address of kmap_atomic()'ed pages */
 	enum zs_mapmode vm_mm; /* mapping mode */
 };
@@ -1113,54 +1109,6 @@ static struct zspage *find_get_zspage(struct size_class *class)
 	return zspage;
 }
 
-#ifdef CONFIG_ZSMALLOC_PGTABLE_MAPPING
-static inline int __zs_cpu_up(struct mapping_area *area)
-{
-	/*
-	 * Make sure we don't leak memory if a cpu UP notification
-	 * and zs_init() race and both call zs_cpu_up() on the same cpu
-	 */
-	if (area->vm)
-		return 0;
-	area->vm = get_vm_area(PAGE_SIZE * 2, 0);
-	if (!area->vm)
-		return -ENOMEM;
-
-	/*
-	 * Populate ptes in advance to avoid pte allocation with GFP_KERNEL
-	 * in non-preemtible context of zs_map_object.
-	 */
-	return apply_to_page_range(&init_mm, (unsigned long)area->vm->addr,
-			PAGE_SIZE * 2, NULL, NULL);
-}
-
-static inline void __zs_cpu_down(struct mapping_area *area)
-{
-	if (area->vm)
-		free_vm_area(area->vm);
-	area->vm = NULL;
-}
-
-static inline void *__zs_map_object(struct mapping_area *area,
-				struct page *pages[2], int off, int size)
-{
-	unsigned long addr = (unsigned long)area->vm->addr;
-
-	BUG_ON(map_kernel_range(addr, PAGE_SIZE * 2, PAGE_KERNEL, pages) < 0);
-	area->vm_addr = area->vm->addr;
-	return area->vm_addr + off;
-}
-
-static inline void __zs_unmap_object(struct mapping_area *area,
-				struct page *pages[2], int off, int size)
-{
-	unsigned long addr = (unsigned long)area->vm_addr;
-
-	unmap_kernel_range(addr, PAGE_SIZE * 2);
-}
-
-#else /* CONFIG_ZSMALLOC_PGTABLE_MAPPING */
-
 static inline int __zs_cpu_up(struct mapping_area *area)
 {
 	/*
@@ -1241,8 +1189,6 @@ out:
 	pagefault_enable();
 }
 
-#endif /* CONFIG_ZSMALLOC_PGTABLE_MAPPING */
-
 static int zs_cpu_prepare(unsigned int cpu)
 {
 	struct mapping_area *area;
commit 8199be001a470209f5c938570cc199abb012fe53
Author: Yang Shi <shy828301 at gmail.com>
Date:   Sat Dec 5 22:14:48 2020 -0800

    mm: list_lru: set shrinker map bit when child nr_items is not zero
    
    When investigating a slab cache bloat problem, significant amount of
    negative dentry cache was seen, but confusingly they neither got shrunk
    by reclaimer (the host has very tight memory) nor be shrunk by dropping
    cache.  The vmcore shows there are over 14M negative dentry objects on
    lru, but tracing result shows they were even not scanned at all.
    
    Further investigation shows the memcg's vfs shrinker_map bit is not set.
    So the reclaimer or dropping cache just skip calling vfs shrinker.  So
    we have to reboot the hosts to get the memory back.
    
    I didn't manage to come up with a reproducer in test environment, and
    the problem can't be reproduced after rebooting.  But it seems there is
    race between shrinker map bit clear and reparenting by code inspection.
    The hypothesis is elaborated as below.
    
    The memcg hierarchy on our production environment looks like:
    
                    root
                   /    \
              system   user
    
    The main workloads are running under user slice's children, and it
    creates and removes memcg frequently.  So reparenting happens very often
    under user slice, but no task is under user slice directly.
    
    So with the frequent reparenting and tight memory pressure, the below
    hypothetical race condition may happen:
    
           CPU A                            CPU B
    reparent
        dst->nr_items == 0
                                     shrinker:
                                         total_objects == 0
        add src->nr_items to dst
        set_bit
                                         return SHRINK_EMPTY
                                         clear_bit
    child memcg offline
        replace child's kmemcg_id with
        parent's (in memcg_offline_kmem())
                                      list_lru_del() between shrinker runs
                                         see parent's kmemcg_id
                                         dec dst->nr_items
    reparent again
        dst->nr_items may go negative
        due to concurrent list_lru_del()
    
                                     The second run of shrinker:
                                         read nr_items without any
                                         synchronization, so it may
                                         see intermediate negative
                                         nr_items then total_objects
                                         may return 0 coincidently
    
                                         keep the bit cleared
        dst->nr_items != 0
        skip set_bit
        add scr->nr_item to dst
    
    After this point dst->nr_item may never go zero, so reparenting will not
    set shrinker_map bit anymore.  And since there is no task under user
    slice directly, so no new object will be added to its lru to set the
    shrinker map bit either.  That bit is kept cleared forever.
    
    How does list_lru_del() race with reparenting? It is because reparenting
    replaces children's kmemcg_id to parent's without protecting from
    nlru->lock, so list_lru_del() may see parent's kmemcg_id but actually
    deleting items from child's lru, but dec'ing parent's nr_items, so the
    parent's nr_items may go negative as commit 2788cf0c401c ("memcg:
    reparent list_lrus and free kmemcg_id on css offline") says.
    
    Since it is impossible that dst->nr_items goes negative and
    src->nr_items goes zero at the same time, so it seems we could set the
    shrinker map bit iff src->nr_items != 0.  We could synchronize
    list_lru_count_one() and reparenting with nlru->lock, but it seems
    checking src->nr_items in reparenting is the simplest and avoids lock
    contention.
    
    Fixes: fae91d6d8be5 ("mm/list_lru.c: set bit in memcg shrinker bitmap on first list_lru item appearance")
    Suggested-by: Roman Gushchin <guro at fb.com>
    Signed-off-by: Yang Shi <shy828301 at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Roman Gushchin <guro at fb.com>
    Reviewed-by: Shakeel Butt <shakeelb at google.com>
    Acked-by: Kirill Tkhai <ktkhai at virtuozzo.com>
    Cc: Vladimir Davydov <vdavydov.dev at gmail.com>
    Cc: <stable at vger.kernel.org>    [4.19]
    Link: https://lkml.kernel.org/r/20201202171749.264354-1-shy828301@gmail.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/list_lru.c b/mm/list_lru.c
index 5aa6e44bc2ae..fe230081690b 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -534,7 +534,6 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
 	struct list_lru_node *nlru = &lru->node[nid];
 	int dst_idx = dst_memcg->kmemcg_id;
 	struct list_lru_one *src, *dst;
-	bool set;
 
 	/*
 	 * Since list_lru_{add,del} may be called under an IRQ-safe lock,
@@ -546,11 +545,12 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
 	dst = list_lru_from_memcg_idx(nlru, dst_idx);
 
 	list_splice_init(&src->list, &dst->list);
-	set = (!dst->nr_items && src->nr_items);
-	dst->nr_items += src->nr_items;
-	if (set)
+
+	if (src->nr_items) {
+		dst->nr_items += src->nr_items;
 		memcg_set_shrinker_bit(dst_memcg, nid, lru_shrinker_id(lru));
-	src->nr_items = 0;
+		src->nr_items = 0;
+	}
 
 	spin_unlock_irq(&nlru->lock);
 }
commit becaba65f62f88e553ec92ed98370e9d2b18e629
Author: Roman Gushchin <guro at fb.com>
Date:   Sat Dec 5 22:14:45 2020 -0800

    mm: memcg/slab: fix obj_cgroup_charge() return value handling
    
    Commit 10befea91b61 ("mm: memcg/slab: use a single set of kmem_caches
    for all allocations") introduced a regression into the handling of the
    obj_cgroup_charge() return value.  If a non-zero value is returned
    (indicating of exceeding one of memory.max limits), the allocation
    should fail, instead of falling back to non-accounted mode.
    
    To make the code more readable, move memcg_slab_pre_alloc_hook() and
    memcg_slab_post_alloc_hook() calling conditions into bodies of these
    hooks.
    
    Fixes: 10befea91b61 ("mm: memcg/slab: use a single set of kmem_caches for all allocations")
    Signed-off-by: Roman Gushchin <guro at fb.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Reviewed-by: Shakeel Butt <shakeelb at google.com>
    Cc: Johannes Weiner <hannes at cmpxchg.org>
    Cc: Michal Hocko <mhocko at kernel.org>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/20201127161828.GD840171@carbon.dhcp.thefacebook.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/mm/slab.h b/mm/slab.h
index 6d7c6a5056ba..f9977d6613d6 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -274,22 +274,32 @@ static inline size_t obj_full_size(struct kmem_cache *s)
 	return s->size + sizeof(struct obj_cgroup *);
 }
 
-static inline struct obj_cgroup *memcg_slab_pre_alloc_hook(struct kmem_cache *s,
-							   size_t objects,
-							   gfp_t flags)
+/*
+ * Returns false if the allocation should fail.
+ */
+static inline bool memcg_slab_pre_alloc_hook(struct kmem_cache *s,
+					     struct obj_cgroup **objcgp,
+					     size_t objects, gfp_t flags)
 {
 	struct obj_cgroup *objcg;
 
+	if (!memcg_kmem_enabled())
+		return true;
+
+	if (!(flags & __GFP_ACCOUNT) && !(s->flags & SLAB_ACCOUNT))
+		return true;
+
 	objcg = get_obj_cgroup_from_current();
 	if (!objcg)
-		return NULL;
+		return true;
 
 	if (obj_cgroup_charge(objcg, flags, objects * obj_full_size(s))) {
 		obj_cgroup_put(objcg);
-		return NULL;
+		return false;
 	}
 
-	return objcg;
+	*objcgp = objcg;
+	return true;
 }
 
 static inline void mod_objcg_state(struct obj_cgroup *objcg,
@@ -315,7 +325,7 @@ static inline void memcg_slab_post_alloc_hook(struct kmem_cache *s,
 	unsigned long off;
 	size_t i;
 
-	if (!objcg)
+	if (!memcg_kmem_enabled() || !objcg)
 		return;
 
 	flags &= ~__GFP_ACCOUNT;
@@ -400,11 +410,11 @@ static inline void memcg_free_page_obj_cgroups(struct page *page)
 {
 }
 
-static inline struct obj_cgroup *memcg_slab_pre_alloc_hook(struct kmem_cache *s,
-							   size_t objects,
-							   gfp_t flags)
+static inline bool memcg_slab_pre_alloc_hook(struct kmem_cache *s,
+					     struct obj_cgroup **objcgp,
+					     size_t objects, gfp_t flags)
 {
-	return NULL;
+	return true;
 }
 
 static inline void memcg_slab_post_alloc_hook(struct kmem_cache *s,
@@ -508,9 +518,8 @@ static inline struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s,
 	if (should_failslab(s, flags))
 		return NULL;
 
-	if (memcg_kmem_enabled() &&
-	    ((flags & __GFP_ACCOUNT) || (s->flags & SLAB_ACCOUNT)))
-		*objcgp = memcg_slab_pre_alloc_hook(s, size, flags);
+	if (!memcg_slab_pre_alloc_hook(s, objcgp, size, flags))
+		return NULL;
 
 	return s;
 }
@@ -529,8 +538,7 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s,
 					 s->flags, flags);
 	}
 
-	if (memcg_kmem_enabled())
-		memcg_slab_post_alloc_hook(s, objcg, flags, size, p);
+	memcg_slab_post_alloc_hook(s, objcg, flags, size, p);
 }
 
 #ifndef CONFIG_SLOB
commit 2bf509d96d84c3336d08375e8af34d1b85ee71c8
Author: Menglong Dong <dong.menglong at zte.com.cn>
Date:   Sat Dec 5 22:14:42 2020 -0800

    coredump: fix core_pattern parse error
    
    'format_corename()' will splite 'core_pattern' on spaces when it is in
    pipe mode, and take helper_argv[0] as the path to usermode executable.
    It works fine in most cases.
    
    However, if there is a space between '|' and '/file/path', such as
    '| /usr/lib/systemd/systemd-coredump %P %u %g', then helper_argv[0] will
    be parsed as '', and users will get a 'Core dump to | disabled'.
    
    It is not friendly to users, as the pattern above was valid previously.
    Fix this by ignoring the spaces between '|' and '/file/path'.
    
    Fixes: 315c69261dd3 ("coredump: split pipe command whitespace before expanding template")
    Signed-off-by: Menglong Dong <dong.menglong at zte.com.cn>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Cc: Paul Wise <pabs3 at bonedaddy.net>
    Cc: Jakub Wilk <jwilk at jwilk.net> [https://bugs.debian.org/924398]
    Cc: Neil Horman <nhorman at tuxdriver.com>
    Cc: <stable at vger.kernel.org>
    Link: https://lkml.kernel.org/r/5fb62870.1c69fb81.8ef5d.af76@mx.google.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/fs/coredump.c b/fs/coredump.c
index 0cd9056d79cc..c6acfc694f65 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -229,7 +229,8 @@ static int format_corename(struct core_name *cn, struct coredump_params *cprm,
 		 */
 		if (ispipe) {
 			if (isspace(*pat_ptr)) {
-				was_space = true;
+				if (cn->used != 0)
+					was_space = true;
 				pat_ptr++;
 				continue;
 			} else if (was_space) {
commit 11fb479ff5d9872ddff02dd533c16d60372c86b2
Author: Randy Dunlap <rdunlap at infradead.org>
Date:   Sat Dec 5 22:14:38 2020 -0800

    zlib: export S390 symbols for zlib modules
    
    Fix build errors when ZLIB_INFLATE=m and ZLIB_DEFLATE=m and ZLIB_DFLTCC=y
    by exporting the 2 needed symbols in dfltcc_inflate.c.
    
    Fixes these build errors:
    
      ERROR: modpost: "dfltcc_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined!
      ERROR: modpost: "dfltcc_can_inflate" [lib/zlib_inflate/zlib_inflate.ko] undefined!
    
    Fixes: 126196100063 ("lib/zlib: add s390 hardware support for kernel zlib_inflate")
    Reported-by: kernel test robot <lkp at intel.com>
    Signed-off-by: Randy Dunlap <rdunlap at infradead.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Acked-by: Ilya Leoshkevich <iii at linux.ibm.com>
    Cc: Mikhail Zaslonko <zaslonko at linux.ibm.com>
    Cc: Heiko Carstens <hca at linux.ibm.com>
    Cc: Vasily Gorbik <gor at linux.ibm.com>
    Cc: Christian Borntraeger <borntraeger at de.ibm.com>
    Link: https://lkml.kernel.org/r/20201123191712.4882-1-rdunlap@infradead.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

diff --git a/lib/zlib_dfltcc/dfltcc_inflate.c b/lib/zlib_dfltcc/dfltcc_inflate.c
index aa9ef23474df..db107016d29b 100644
--- a/lib/zlib_dfltcc/dfltcc_inflate.c
+++ b/lib/zlib_dfltcc/dfltcc_inflate.c
@@ -4,6 +4,7 @@
 #include "dfltcc_util.h"
 #include "dfltcc.h"
 #include <asm/setup.h>
+#include <linux/export.h>
 #include <linux/zutil.h>
 
 /*
@@ -29,6 +30,7 @@ int dfltcc_can_inflate(
     return is_bit_set(dfltcc_state->af.fns, DFLTCC_XPND) &&
                is_bit_set(dfltcc_state->af.fmts, DFLTCC_FMT0);
 }
+EXPORT_SYMBOL(dfltcc_can_inflate);
 
 static int dfltcc_was_inflate_used(
     z_streamp strm
@@ -147,3 +149,4 @@ dfltcc_inflate_action dfltcc_inflate(
     return (cc == DFLTCC_CC_OP1_TOO_SHORT || cc == DFLTCC_CC_OP2_TOO_SHORT) ?
         DFLTCC_INFLATE_BREAK : DFLTCC_INFLATE_CONTINUE;
 }
+EXPORT_SYMBOL(dfltcc_inflate);
commit 7d32358be8acb119dcfe39b6cf67ec6d94bf1fe7
Author: Masahiro Yamada <masahiroy at kernel.org>
Date:   Fri Dec 4 02:55:51 2020 +0900

    kbuild: avoid split lines in .mod files
    
    "xargs echo" is not a safe way to remove line breaks because the input
    may exceed the command line limit and xargs may break it up into
    multiple invocations of echo. This should never happen because
    scripts/gen_autoksyms.sh expects all undefined symbols are placed in
    the second line of .mod files.
    
    One possible way is to replace "xargs echo" with
    "sed ':x;N;$!bx;s/\n/ /g'" or something, but I rewrote the code by
    using awk because it is more readable.
    
    This issue was reported by Sami Tolvanen; in his Clang LTO patch set,
    $(multi-used-m) is no longer an ELF object, but a thin archive that
    contains LLVM bitcode files. llvm-nm prints out symbols for each
    archive member separately, which results a lot of dupications, in some
    places, beyond the system-defined limit.
    
    This problem must be fixed irrespective of LTO, and we must ensure
    zero possibility of having this issue.
    
    Link: https://lkml.org/lkml/2020/12/1/1658
    Reported-by: Sami Tolvanen <samitolvanen at google.com>
    Signed-off-by: Masahiro Yamada <masahiroy at kernel.org>
    Reviewed-by: Sami Tolvanen <samitolvanen at google.com>

diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index ae647379b579..4c058f12dd73 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -252,6 +252,9 @@ objtool_dep = $(objtool_obj)					\
 ifdef CONFIG_TRIM_UNUSED_KSYMS
 cmd_gen_ksymdeps = \
 	$(CONFIG_SHELL) $(srctree)/scripts/gen_ksymdeps.sh $@ >> $(dot-target).cmd
+
+# List module undefined symbols
+undefined_syms = $(NM) $< | $(AWK) '$$1 == "U" { printf("%s%s", x++ ? " " : "", $$2) }';
 endif
 
 define rule_cc_o_c
@@ -271,13 +274,6 @@ define rule_as_o_S
 	$(call cmd,modversions_S)
 endef
 
-# List module undefined symbols (or empty line if not enabled)
-ifdef CONFIG_TRIM_UNUSED_KSYMS
-cmd_undef_syms = $(NM) $< | sed -n 's/^  *U //p' | xargs echo
-else
-cmd_undef_syms = echo
-endif
-
 # Built-in and composite module parts
 $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
 	$(call if_changed_rule,cc_o_c)
@@ -285,7 +281,7 @@ $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE
 
 cmd_mod = { \
 	echo $(if $($*-objs)$($*-y)$($*-m), $(addprefix $(obj)/, $($*-objs) $($*-y) $($*-m)), $(@:.mod=.o)); \
-	$(cmd_undef_syms); \
+	$(undefined_syms) echo; \
 	} > $@
 
 $(obj)/%.mod: $(obj)/%.o FORCE
commit 264f53b41946dcabb2b3304190839ab5670c7825
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sat Dec 5 14:38:46 2020 -0500

    Revert "mei: virtio: virtualization frontend driver"
    
    This reverts commit d162219c655c8cf8003128a13840d6c1e183fb80.
    
    The device uses a VIRTIO device ID out of a not-for-production range.
    Releasing Linux using an ID out of this range will make it conflict with
    development setups. An official request to reserve an ID for an MEI
    device is yet to be submitted to the virtio TC, thus there's no chance
    it will be reserved and fixed in time before the next release.
    
    Once requested it usually takes 2-3 weeks to land in the spec, which
    means the device can be supported with the official ID in the next Linux
    version if contributors act quickly.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Cc: Tomas Winkler <tomas.winkler at intel.com>
    Cc: Alexander Usyskin <alexander.usyskin at intel.com>
    Cc: Wang Yu <yu1.wang at intel.com>
    Cc: Liu Shuo <shuo.a.liu at intel.com>
    Link: https://lore.kernel.org/r/20201205193625.469773-1-mst@redhat.com
    Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>

diff --git a/drivers/misc/mei/Kconfig b/drivers/misc/mei/Kconfig
index c06581ffa7bd..f5fd5b786607 100644
--- a/drivers/misc/mei/Kconfig
+++ b/drivers/misc/mei/Kconfig
@@ -46,14 +46,4 @@ config INTEL_MEI_TXE
 	  Supported SoCs:
 	  Intel Bay Trail
 
-config INTEL_MEI_VIRTIO
-	tristate "Intel MEI interface emulation with virtio framework"
-	select INTEL_MEI
-	depends on X86 && PCI && VIRTIO_PCI
-	help
-	  This module implements mei hw emulation over virtio transport.
-	  The module will be called mei_virtio.
-	  Enable this if your virtual machine supports virtual mei
-	  device over virtio.
-
 source "drivers/misc/mei/hdcp/Kconfig"
diff --git a/drivers/misc/mei/Makefile b/drivers/misc/mei/Makefile
index 52aefaab5c1b..f1c76f7ee804 100644
--- a/drivers/misc/mei/Makefile
+++ b/drivers/misc/mei/Makefile
@@ -22,9 +22,6 @@ obj-$(CONFIG_INTEL_MEI_TXE) += mei-txe.o
 mei-txe-objs := pci-txe.o
 mei-txe-objs += hw-txe.o
 
-obj-$(CONFIG_INTEL_MEI_VIRTIO) += mei-virtio.o
-mei-virtio-objs := hw-virtio.o
-
 mei-$(CONFIG_EVENT_TRACING) += mei-trace.o
 CFLAGS_mei-trace.o = -I$(src)
 
diff --git a/drivers/misc/mei/hw-virtio.c b/drivers/misc/mei/hw-virtio.c
deleted file mode 100644
index 899dc1c5e7ca..000000000000
--- a/drivers/misc/mei/hw-virtio.c
+++ /dev/null
@@ -1,874 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Intel Management Engine Interface (Intel MEI) Linux driver
- * Copyright (c) 2018-2020, Intel Corporation.
- */
-#include <linux/err.h>
-#include <linux/module.h>
-#include <linux/pm_runtime.h>
-#include <linux/scatterlist.h>
-#include <linux/spinlock.h>
-#include <linux/slab.h>
-#include <linux/virtio.h>
-#include <linux/virtio_config.h>
-#include <linux/virtio_ids.h>
-#include <linux/atomic.h>
-
-#include "mei_dev.h"
-#include "hbm.h"
-#include "client.h"
-
-#define MEI_VIRTIO_RPM_TIMEOUT 500
-/* ACRN virtio device types */
-#ifndef VIRTIO_ID_MEI
-#define VIRTIO_ID_MEI 0xFFFE /* virtio mei */
-#endif
-
-/**
- * struct mei_virtio_cfg - settings passed from the virtio backend
- * @buf_depth: read buffer depth in slots (4bytes)
- * @hw_ready: hw is ready for operation
- * @host_reset: synchronize reset with virtio backend
- * @reserved: reserved for alignment
- * @fw_status: FW status
- */
-struct mei_virtio_cfg {
-	u32 buf_depth;
-	u8 hw_ready;
-	u8 host_reset;
-	u8 reserved[2];
-	u32 fw_status[MEI_FW_STATUS_MAX];
-} __packed;
-
-struct mei_virtio_hw {
-	struct mei_device mdev;
-	char name[32];
-
-	struct virtqueue *in;
-	struct virtqueue *out;
-
-	bool host_ready;
-	struct work_struct intr_handler;
-
-	u32 *recv_buf;
-	u8 recv_rdy;
-	size_t recv_sz;
-	u32 recv_idx;
-	u32 recv_len;
-
-	/* send buffer */
-	atomic_t hbuf_ready;
-	const void *send_hdr;
-	const void *send_buf;
-
-	struct mei_virtio_cfg cfg;
-};
-
-#define to_virtio_hw(_dev) container_of(_dev, struct mei_virtio_hw, mdev)
-
-/**
- * mei_virtio_fw_status() - read status register of mei
- * @dev: mei device
- * @fw_status: fw status register values
- *
- * Return: always 0
- */
-static int mei_virtio_fw_status(struct mei_device *dev,
-				struct mei_fw_status *fw_status)
-{
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	fw_status->count = MEI_FW_STATUS_MAX;
-	virtio_cread_bytes(vdev, offsetof(struct mei_virtio_cfg, fw_status),
-			   fw_status->status, sizeof(fw_status->status));
-	return 0;
-}
-
-/**
- * mei_virtio_pg_state() - translate internal pg state
- *   to the mei power gating state
- *   There is no power management in ACRN mode always return OFF
- * @dev: mei device
- *
- * Return:
- * * MEI_PG_OFF - if aliveness is on (always)
- * * MEI_PG_ON  - (never)
- */
-static inline enum mei_pg_state mei_virtio_pg_state(struct mei_device *dev)
-{
-	return MEI_PG_OFF;
-}
-
-/**
- * mei_virtio_hw_config() - configure hw dependent settings
- *
- * @dev: mei device
- *
- * Return: always 0
- */
-static int mei_virtio_hw_config(struct mei_device *dev)
-{
-	return 0;
-}
-
-/**
- * mei_virtio_hbuf_empty_slots() - counts write empty slots.
- * @dev: the device structure
- *
- * Return: always return frontend buf size if buffer is ready, 0 otherwise
- */
-static int mei_virtio_hbuf_empty_slots(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	return (atomic_read(&hw->hbuf_ready) == 1) ? hw->cfg.buf_depth : 0;
-}
-
-/**
- * mei_virtio_hbuf_is_ready() - checks if write buffer is ready
- * @dev: the device structure
- *
- * Return: true if hbuf is ready
- */
-static bool mei_virtio_hbuf_is_ready(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	return atomic_read(&hw->hbuf_ready) == 1;
-}
-
-/**
- * mei_virtio_hbuf_max_depth() - returns depth of FE write buffer.
- * @dev: the device structure
- *
- * Return: size of frontend write buffer in bytes
- */
-static u32 mei_virtio_hbuf_depth(const struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	return hw->cfg.buf_depth;
-}
-
-/**
- * mei_virtio_intr_clear() - clear and stop interrupts
- * @dev: the device structure
- */
-static void mei_virtio_intr_clear(struct mei_device *dev)
-{
-	/*
-	 * In our virtio solution, there are two types of interrupts,
-	 * vq interrupt and config change interrupt.
-	 *   1) start/reset rely on virtio config changed interrupt;
-	 *   2) send/recv rely on virtio virtqueue interrupts.
-	 * They are all virtual interrupts. So, we don't have corresponding
-	 * operation to do here.
-	 */
-}
-
-/**
- * mei_virtio_intr_enable() - enables mei BE virtqueues callbacks
- * @dev: the device structure
- */
-static void mei_virtio_intr_enable(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	virtio_config_enable(vdev);
-
-	virtqueue_enable_cb(hw->in);
-	virtqueue_enable_cb(hw->out);
-}
-
-/**
- * mei_virtio_intr_disable() - disables mei BE virtqueues callbacks
- *
- * @dev: the device structure
- */
-static void mei_virtio_intr_disable(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	virtio_config_disable(vdev);
-
-	virtqueue_disable_cb(hw->in);
-	virtqueue_disable_cb(hw->out);
-}
-
-/**
- * mei_virtio_synchronize_irq() - wait for pending IRQ handlers for all
- *     virtqueue
- * @dev: the device structure
- */
-static void mei_virtio_synchronize_irq(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	/*
-	 * Now, all IRQ handlers are converted to workqueue.
-	 * Change synchronize irq to flush this work.
-	 */
-	flush_work(&hw->intr_handler);
-}
-
-static void mei_virtio_free_outbufs(struct mei_virtio_hw *hw)
-{
-	kfree(hw->send_hdr);
-	kfree(hw->send_buf);
-	hw->send_hdr = NULL;
-	hw->send_buf = NULL;
-}
-
-/**
- * mei_virtio_write_message() - writes a message to mei virtio back-end service.
- * @dev: the device structure
- * @hdr: mei header of message
- * @hdr_len: header length
- * @data: message payload will be written
- * @data_len: message payload length
- *
- * Return:
- * *  0: on success
- * * -EIO: if write has failed
- * * -ENOMEM: on memory allocation failure
- */
-static int mei_virtio_write_message(struct mei_device *dev,
-				    const void *hdr, size_t hdr_len,
-				    const void *data, size_t data_len)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct scatterlist sg[2];
-	const void *hbuf, *dbuf;
-	int ret;
-
-	if (WARN_ON(!atomic_add_unless(&hw->hbuf_ready, -1, 0)))
-		return -EIO;
-
-	hbuf = kmemdup(hdr, hdr_len, GFP_KERNEL);
-	hw->send_hdr = hbuf;
-
-	dbuf = kmemdup(data, data_len, GFP_KERNEL);
-	hw->send_buf = dbuf;
-
-	if (!hbuf || !dbuf) {
-		ret = -ENOMEM;
-		goto fail;
-	}
-
-	sg_init_table(sg, 2);
-	sg_set_buf(&sg[0], hbuf, hdr_len);
-	sg_set_buf(&sg[1], dbuf, data_len);
-
-	ret = virtqueue_add_outbuf(hw->out, sg, 2, hw, GFP_KERNEL);
-	if (ret) {
-		dev_err(dev->dev, "failed to add outbuf\n");
-		goto fail;
-	}
-
-	virtqueue_kick(hw->out);
-	return 0;
-fail:
-
-	mei_virtio_free_outbufs(hw);
-
-	return ret;
-}
-
-/**
- * mei_virtio_count_full_read_slots() - counts read full slots.
- * @dev: the device structure
- *
- * Return: -EOVERFLOW if overflow, otherwise filled slots count
- */
-static int mei_virtio_count_full_read_slots(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	if (hw->recv_idx > hw->recv_len)
-		return -EOVERFLOW;
-
-	return hw->recv_len - hw->recv_idx;
-}
-
-/**
- * mei_virtio_read_hdr() - Reads 32bit dword from mei virtio receive buffer
- *
- * @dev: the device structure
- *
- * Return: 32bit dword of receive buffer (u32)
- */
-static inline u32 mei_virtio_read_hdr(const struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	WARN_ON(hw->cfg.buf_depth < hw->recv_idx + 1);
-
-	return hw->recv_buf[hw->recv_idx++];
-}
-
-static int mei_virtio_read(struct mei_device *dev, unsigned char *buffer,
-			   unsigned long len)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	u32 slots = mei_data2slots(len);
-
-	if (WARN_ON(hw->cfg.buf_depth < hw->recv_idx + slots))
-		return -EOVERFLOW;
-
-	/*
-	 * Assumption: There is only one MEI message in recv_buf each time.
-	 * Backend service need follow this rule too.
-	 */
-	memcpy(buffer, hw->recv_buf + hw->recv_idx, len);
-	hw->recv_idx += slots;
-
-	return 0;
-}
-
-static bool mei_virtio_pg_is_enabled(struct mei_device *dev)
-{
-	return false;
-}
-
-static bool mei_virtio_pg_in_transition(struct mei_device *dev)
-{
-	return false;
-}
-
-static void mei_virtio_add_recv_buf(struct mei_virtio_hw *hw)
-{
-	struct scatterlist sg;
-
-	if (hw->recv_rdy) /* not needed */
-		return;
-
-	/* refill the recv_buf to IN virtqueue to get next message */
-	sg_init_one(&sg, hw->recv_buf, mei_slots2data(hw->cfg.buf_depth));
-	hw->recv_len = 0;
-	hw->recv_idx = 0;
-	hw->recv_rdy = 1;
-	virtqueue_add_inbuf(hw->in, &sg, 1, hw->recv_buf, GFP_KERNEL);
-	virtqueue_kick(hw->in);
-}
-
-/**
- * mei_virtio_hw_is_ready() - check whether the BE(hw) has turned ready
- * @dev: mei device
- * Return: bool
- */
-static bool mei_virtio_hw_is_ready(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	virtio_cread(vdev, struct mei_virtio_cfg,
-		     hw_ready, &hw->cfg.hw_ready);
-
-	dev_dbg(dev->dev, "hw ready %d\n", hw->cfg.hw_ready);
-
-	return hw->cfg.hw_ready;
-}
-
-/**
- * mei_virtio_hw_reset - resets virtio hw.
- *
- * @dev: the device structure
- * @intr_enable: virtio use data/config callbacks
- *
- * Return: 0 on success an error code otherwise
- */
-static int mei_virtio_hw_reset(struct mei_device *dev, bool intr_enable)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	dev_dbg(dev->dev, "hw reset\n");
-
-	dev->recvd_hw_ready = false;
-	hw->host_ready = false;
-	atomic_set(&hw->hbuf_ready, 0);
-	hw->recv_len = 0;
-	hw->recv_idx = 0;
-
-	hw->cfg.host_reset = 1;
-	virtio_cwrite(vdev, struct mei_virtio_cfg,
-		      host_reset, &hw->cfg.host_reset);
-
-	mei_virtio_hw_is_ready(dev);
-
-	if (intr_enable)
-		mei_virtio_intr_enable(dev);
-
-	return 0;
-}
-
-/**
- * mei_virtio_hw_reset_release() - release device from the reset
- * @dev: the device structure
- */
-static void mei_virtio_hw_reset_release(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	struct virtio_device *vdev = dev_to_virtio(dev->dev);
-
-	dev_dbg(dev->dev, "hw reset release\n");
-	hw->cfg.host_reset = 0;
-	virtio_cwrite(vdev, struct mei_virtio_cfg,
-		      host_reset, &hw->cfg.host_reset);
-}
-
-/**
- * mei_virtio_hw_ready_wait() - wait until the virtio(hw) has turned ready
- *  or timeout is reached
- * @dev: mei device
- *
- * Return: 0 on success, error otherwise
- */
-static int mei_virtio_hw_ready_wait(struct mei_device *dev)
-{
-	mutex_unlock(&dev->device_lock);
-	wait_event_timeout(dev->wait_hw_ready,
-			   dev->recvd_hw_ready,
-			   mei_secs_to_jiffies(MEI_HW_READY_TIMEOUT));
-	mutex_lock(&dev->device_lock);
-	if (!dev->recvd_hw_ready) {
-		dev_err(dev->dev, "wait hw ready failed\n");
-		return -ETIMEDOUT;
-	}
-
-	dev->recvd_hw_ready = false;
-	return 0;
-}
-
-/**
- * mei_virtio_hw_start() - hw start routine
- * @dev: mei device
- *
- * Return: 0 on success, error otherwise
- */
-static int mei_virtio_hw_start(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-	int ret;
-
-	dev_dbg(dev->dev, "hw start\n");
-	mei_virtio_hw_reset_release(dev);
-
-	ret = mei_virtio_hw_ready_wait(dev);
-	if (ret)
-		return ret;
-
-	mei_virtio_add_recv_buf(hw);
-	atomic_set(&hw->hbuf_ready, 1);
-	dev_dbg(dev->dev, "hw is ready\n");
-	hw->host_ready = true;
-
-	return 0;
-}
-
-/**
- * mei_virtio_host_is_ready() - check whether the FE has turned ready
- * @dev: mei device
- *
- * Return: bool
- */
-static bool mei_virtio_host_is_ready(struct mei_device *dev)
-{
-	struct mei_virtio_hw *hw = to_virtio_hw(dev);
-
-	dev_dbg(dev->dev, "host ready %d\n", hw->host_ready);
-
-	return hw->host_ready;
-}
-
-/**
- * mei_virtio_data_in() - The callback of recv virtqueue of virtio mei
- * @vq: receiving virtqueue
- */
-static void mei_virtio_data_in(struct virtqueue *vq)
-{
-	struct mei_virtio_hw *hw = vq->vdev->priv;
-
-	/* disable interrupts (enabled again from in the interrupt worker) */
-	virtqueue_disable_cb(hw->in);
-
-	schedule_work(&hw->intr_handler);
-}
-
-/**
- * mei_virtio_data_out() - The callback of send virtqueue of virtio mei
- * @vq: transmitting virtqueue
- */
-static void mei_virtio_data_out(struct virtqueue *vq)
-{
-	struct mei_virtio_hw *hw = vq->vdev->priv;
-
-	schedule_work(&hw->intr_handler);
-}
-
-static void mei_virtio_intr_handler(struct work_struct *work)
-{
-	struct mei_virtio_hw *hw =
-		container_of(work, struct mei_virtio_hw, intr_handler);
-	struct mei_device *dev = &hw->mdev;
-	LIST_HEAD(complete_list);
-	s32 slots;
-	int rets = 0;
-	void *data;
-	unsigned int len;
-
-	mutex_lock(&dev->device_lock);
-
-	if (dev->dev_state == MEI_DEV_DISABLED) {
-		dev_warn(dev->dev, "Interrupt in disabled state.\n");
-		mei_virtio_intr_disable(dev);
-		goto end;
-	}
-
-	/* check if ME wants a reset */
-	if (!mei_hw_is_ready(dev) && dev->dev_state != MEI_DEV_RESETTING) {
-		dev_warn(dev->dev, "BE service not ready: resetting.\n");
-		schedule_work(&dev->reset_work);
-		goto end;
-	}
-
-	/* check if we need to start the dev */
-	if (!mei_host_is_ready(dev)) {
-		if (mei_hw_is_ready(dev)) {
-			dev_dbg(dev->dev, "we need to start the dev.\n");
-			dev->recvd_hw_ready = true;
-			wake_up(&dev->wait_hw_ready);
-		} else {
-			dev_warn(dev->dev, "Spurious Interrupt\n");
-		}
-		goto end;
-	}
-
-	/* read */
-	if (hw->recv_rdy) {
-		data = virtqueue_get_buf(hw->in, &len);
-		if (!data || !len) {
-			dev_dbg(dev->dev, "No data %d", len);
-		} else {
-			dev_dbg(dev->dev, "data_in %d\n", len);
-			WARN_ON(data != hw->recv_buf);
-			hw->recv_len = mei_data2slots(len);
-			hw->recv_rdy = 0;
-		}
-	}
-
-	/* write */
-	if (!atomic_read(&hw->hbuf_ready)) {
-		if (!virtqueue_get_buf(hw->out, &len)) {
-			dev_warn(dev->dev, "Failed to getbuf\n");
-		} else {
-			mei_virtio_free_outbufs(hw);
-			atomic_inc(&hw->hbuf_ready);
-		}
-	}
-
-	/* check slots available for reading */
-	slots = mei_count_full_read_slots(dev);
-	while (slots > 0) {
-		dev_dbg(dev->dev, "slots to read = %08x\n", slots);
-		rets = mei_irq_read_handler(dev, &complete_list, &slots);
-
-		if (rets &&
-		    (dev->dev_state != MEI_DEV_RESETTING &&
-		     dev->dev_state != MEI_DEV_POWER_DOWN)) {
-			dev_err(dev->dev, "mei_irq_read_handler ret = %d.\n",
-				rets);
-			schedule_work(&dev->reset_work);
-			goto end;
-		}
-	}
-
-	dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
-
-	mei_irq_write_handler(dev, &complete_list);
-
-	dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
-
-	mei_irq_compl_handler(dev, &complete_list);
-
-	mei_virtio_add_recv_buf(hw);
-
-end:
-	if (dev->dev_state != MEI_DEV_DISABLED) {
-		if (!virtqueue_enable_cb(hw->in))
-			schedule_work(&hw->intr_handler);
-	}
-
-	mutex_unlock(&dev->device_lock);
-}
-
-static void mei_virtio_config_changed(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw = vdev->priv;
-	struct mei_device *dev = &hw->mdev;
-
-	virtio_cread(vdev, struct mei_virtio_cfg,
-		     hw_ready, &hw->cfg.hw_ready);
-
-	if (dev->dev_state == MEI_DEV_DISABLED) {
-		dev_dbg(dev->dev, "disabled state don't start\n");
-		return;
-	}
-
-	/* Run intr handler once to handle reset notify */
-	schedule_work(&hw->intr_handler);
-}
-
-static void mei_virtio_remove_vqs(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw = vdev->priv;
-
-	virtqueue_detach_unused_buf(hw->in);
-	hw->recv_len = 0;
-	hw->recv_idx = 0;
-	hw->recv_rdy = 0;
-
-	virtqueue_detach_unused_buf(hw->out);
-
-	mei_virtio_free_outbufs(hw);
-
-	vdev->config->del_vqs(vdev);
-}
-
-/*
- * There are two virtqueues, one is for send and another is for recv.
- */
-static int mei_virtio_init_vqs(struct mei_virtio_hw *hw,
-			       struct virtio_device *vdev)
-{
-	struct virtqueue *vqs[2];
-
-	vq_callback_t *cbs[] = {
-		mei_virtio_data_in,
-		mei_virtio_data_out,
-	};
-	static const char * const names[] = {
-		"in",
-		"out",
-	};
-	int ret;
-
-	ret = virtio_find_vqs(vdev, 2, vqs, cbs, names, NULL);
-	if (ret)
-		return ret;
-
-	hw->in = vqs[0];
-	hw->out = vqs[1];
-
-	return 0;
-}
-
-static const struct mei_hw_ops mei_virtio_ops = {
-	.fw_status = mei_virtio_fw_status,
-	.pg_state  = mei_virtio_pg_state,
-
-	.host_is_ready = mei_virtio_host_is_ready,
-
-	.hw_is_ready = mei_virtio_hw_is_ready,
-	.hw_reset = mei_virtio_hw_reset,
-	.hw_config = mei_virtio_hw_config,
-	.hw_start = mei_virtio_hw_start,
-
-	.pg_in_transition = mei_virtio_pg_in_transition,
-	.pg_is_enabled = mei_virtio_pg_is_enabled,
-
-	.intr_clear = mei_virtio_intr_clear,
-	.intr_enable = mei_virtio_intr_enable,
-	.intr_disable = mei_virtio_intr_disable,
-	.synchronize_irq = mei_virtio_synchronize_irq,
-
-	.hbuf_free_slots = mei_virtio_hbuf_empty_slots,
-	.hbuf_is_ready = mei_virtio_hbuf_is_ready,
-	.hbuf_depth = mei_virtio_hbuf_depth,
-
-	.write = mei_virtio_write_message,
-
-	.rdbuf_full_slots = mei_virtio_count_full_read_slots,
-	.read_hdr = mei_virtio_read_hdr,
-	.read = mei_virtio_read,
-};
-
-static int mei_virtio_probe(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw;
-	int ret;
-
-	hw = devm_kzalloc(&vdev->dev, sizeof(*hw), GFP_KERNEL);
-	if (!hw)
-		return -ENOMEM;
-
-	vdev->priv = hw;
-
-	INIT_WORK(&hw->intr_handler, mei_virtio_intr_handler);
-
-	ret = mei_virtio_init_vqs(hw, vdev);
-	if (ret)
-		goto vqs_failed;
-
-	virtio_cread(vdev, struct mei_virtio_cfg,
-		     buf_depth, &hw->cfg.buf_depth);
-
-	hw->recv_buf = kzalloc(mei_slots2data(hw->cfg.buf_depth), GFP_KERNEL);
-	if (!hw->recv_buf) {
-		ret = -ENOMEM;
-		goto hbuf_failed;
-	}
-	atomic_set(&hw->hbuf_ready, 0);
-
-	virtio_device_ready(vdev);
-
-	mei_device_init(&hw->mdev, &vdev->dev, &mei_virtio_ops);
-
-	pm_runtime_get_noresume(&vdev->dev);
-	pm_runtime_set_active(&vdev->dev);
-	pm_runtime_enable(&vdev->dev);
-
-	ret = mei_start(&hw->mdev);
-	if (ret)
-		goto mei_start_failed;
-
-	pm_runtime_set_autosuspend_delay(&vdev->dev, MEI_VIRTIO_RPM_TIMEOUT);
-	pm_runtime_use_autosuspend(&vdev->dev);
-
-	ret = mei_register(&hw->mdev, &vdev->dev);
-	if (ret)
-		goto mei_failed;
-
-	pm_runtime_put(&vdev->dev);
-
-	return 0;
-
-mei_failed:
-	mei_stop(&hw->mdev);
-mei_start_failed:
-	mei_cancel_work(&hw->mdev);
-	mei_disable_interrupts(&hw->mdev);
-	kfree(hw->recv_buf);
-hbuf_failed:
-	vdev->config->del_vqs(vdev);
-vqs_failed:
-	return ret;
-}
-
-static int __maybe_unused mei_virtio_pm_runtime_idle(struct device *device)
-{
-	struct virtio_device *vdev = dev_to_virtio(device);
-	struct mei_virtio_hw *hw = vdev->priv;
-
-	dev_dbg(&vdev->dev, "rpm: mei_virtio : runtime_idle\n");
-
-	if (!hw)
-		return -ENODEV;
-
-	if (mei_write_is_idle(&hw->mdev))
-		pm_runtime_autosuspend(device);
-
-	return -EBUSY;
-}
-
-static int __maybe_unused mei_virtio_pm_runtime_suspend(struct device *device)
-{
-	return 0;
-}
-
-static int __maybe_unused mei_virtio_pm_runtime_resume(struct device *device)
-{
-	return 0;
-}
-
-static int __maybe_unused mei_virtio_freeze(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw = vdev->priv;
-
-	dev_dbg(&vdev->dev, "freeze\n");
-
-	if (!hw)
-		return -ENODEV;
-
-	mei_stop(&hw->mdev);
-	mei_disable_interrupts(&hw->mdev);
-	cancel_work_sync(&hw->intr_handler);
-	vdev->config->reset(vdev);
-	mei_virtio_remove_vqs(vdev);
-
-	return 0;
-}
-
-static int __maybe_unused mei_virtio_restore(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw = vdev->priv;
-	int ret;
-
-	dev_dbg(&vdev->dev, "restore\n");
-
-	if (!hw)
-		return -ENODEV;
-
-	ret = mei_virtio_init_vqs(hw, vdev);
-	if (ret)
-		return ret;
-
-	virtio_device_ready(vdev);
-
-	ret = mei_restart(&hw->mdev);
-	if (ret)
-		return ret;
-
-	/* Start timer if stopped in suspend */
-	schedule_delayed_work(&hw->mdev.timer_work, HZ);
-
-	return 0;
-}
-
-static const struct dev_pm_ops mei_virtio_pm_ops = {
-	SET_RUNTIME_PM_OPS(mei_virtio_pm_runtime_suspend,
-			   mei_virtio_pm_runtime_resume,
-			   mei_virtio_pm_runtime_idle)
-};
-
-static void mei_virtio_remove(struct virtio_device *vdev)
-{
-	struct mei_virtio_hw *hw = vdev->priv;
-
-	mei_stop(&hw->mdev);
-	mei_disable_interrupts(&hw->mdev);
-	cancel_work_sync(&hw->intr_handler);
-	mei_deregister(&hw->mdev);
-	vdev->config->reset(vdev);
-	mei_virtio_remove_vqs(vdev);
-	kfree(hw->recv_buf);
-	pm_runtime_disable(&vdev->dev);
-}
-
-static struct virtio_device_id id_table[] = {
-	{ VIRTIO_ID_MEI, VIRTIO_DEV_ANY_ID },
-	{ }
-};
-
-static struct virtio_driver mei_virtio_driver = {
-	.id_table = id_table,
-	.probe = mei_virtio_probe,
-	.remove = mei_virtio_remove,
-	.config_changed = mei_virtio_config_changed,
-	.driver = {
-		.name = KBUILD_MODNAME,
-		.owner = THIS_MODULE,
-		.pm = &mei_virtio_pm_ops,
-	},
-#ifdef CONFIG_PM_SLEEP
-	.freeze = mei_virtio_freeze,
-	.restore = mei_virtio_restore,
-#endif
-};
-
-module_virtio_driver(mei_virtio_driver);
-MODULE_DEVICE_TABLE(virtio, id_table);
-MODULE_DESCRIPTION("Virtio MEI frontend driver");
-MODULE_LICENSE("GPL v2");
commit 84da009f06e60cf59d5e861f8e2101d2d3885517
Author: Masami Hiramatsu <mhiramat at kernel.org>
Date:   Thu Dec 3 13:51:01 2020 +0900

    x86/sev-es: Use new for_each_insn_prefix() macro to loop over prefixes bytes
    
    Since insn.prefixes.nbytes can be bigger than the size of
    insn.prefixes.bytes[] when a prefix is repeated, the proper
    check must be:
    
      insn.prefixes.bytes[i] != 0 and i < 4
    
    instead of using insn.prefixes.nbytes. Use the new
    for_each_insn_prefix() macro which does it correctly.
    
    Debugged by Kees Cook <keescook at chromium.org>.
    
     [ bp: Massage commit message. ]
    
    Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions")
    Reported-by: syzbot+9b64b619f10f19d19a7c at syzkaller.appspotmail.com
    Signed-off-by: Masami Hiramatsu <mhiramat at kernel.org>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Link: https://lkml.kernel.org/r/160697106089.3146288.2052422845039649176.stgit@devnote2

diff --git a/arch/x86/boot/compressed/sev-es.c b/arch/x86/boot/compressed/sev-es.c
index 954cb2702e23..27826c265aab 100644
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -32,13 +32,12 @@ struct ghcb *boot_ghcb;
  */
 static bool insn_has_rep_prefix(struct insn *insn)
 {
+	insn_byte_t p;
 	int i;
 
 	insn_get_prefixes(insn);
 
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
-		insn_byte_t p = insn->prefixes.bytes[i];
-
+	for_each_insn_prefix(insn, i, p) {
 		if (p == 0xf2 || p == 0xf3)
 			return true;
 	}
commit 12cb908a11b2544b5f53e9af856e6b6a90ed5533
Author: Masami Hiramatsu <mhiramat at kernel.org>
Date:   Thu Dec 3 13:50:50 2020 +0900

    x86/insn-eval: Use new for_each_insn_prefix() macro to loop over prefixes bytes
    
    Since insn.prefixes.nbytes can be bigger than the size of
    insn.prefixes.bytes[] when a prefix is repeated, the proper check must
    be
    
      insn.prefixes.bytes[i] != 0 and i < 4
    
    instead of using insn.prefixes.nbytes. Use the new
    for_each_insn_prefix() macro which does it correctly.
    
    Debugged by Kees Cook <keescook at chromium.org>.
    
     [ bp: Massage commit message. ]
    
    Fixes: 32d0b95300db ("x86/insn-eval: Add utility functions to get segment selector")
    Reported-by: syzbot+9b64b619f10f19d19a7c at syzkaller.appspotmail.com
    Signed-off-by: Masami Hiramatsu <mhiramat at kernel.org>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Cc: stable at vger.kernel.org
    Link: https://lkml.kernel.org/r/160697104969.3146288.16329307586428270032.stgit@devnote2

diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
index 58f7fb95c7f4..4229950a5d78 100644
--- a/arch/x86/lib/insn-eval.c
+++ b/arch/x86/lib/insn-eval.c
@@ -63,13 +63,12 @@ static bool is_string_insn(struct insn *insn)
  */
 bool insn_has_rep_prefix(struct insn *insn)
 {
+	insn_byte_t p;
 	int i;
 
 	insn_get_prefixes(insn);
 
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
-		insn_byte_t p = insn->prefixes.bytes[i];
-
+	for_each_insn_prefix(insn, i, p) {
 		if (p == 0xf2 || p == 0xf3)
 			return true;
 	}
@@ -95,14 +94,15 @@ static int get_seg_reg_override_idx(struct insn *insn)
 {
 	int idx = INAT_SEG_REG_DEFAULT;
 	int num_overrides = 0, i;
+	insn_byte_t p;
 
 	insn_get_prefixes(insn);
 
 	/* Look for any segment override prefixes. */
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
+	for_each_insn_prefix(insn, i, p) {
 		insn_attr_t attr;
 
-		attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
+		attr = inat_get_opcode_attribute(p);
 		switch (attr) {
 		case INAT_MAKE_PREFIX(INAT_PFX_CS):
 			idx = INAT_SEG_REG_CS;
commit 4e9a5ae8df5b3365183150f6df49e49dece80d8c
Author: Masami Hiramatsu <mhiramat at kernel.org>
Date:   Thu Dec 3 13:50:37 2020 +0900

    x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
    
    Since insn.prefixes.nbytes can be bigger than the size of
    insn.prefixes.bytes[] when a prefix is repeated, the proper check must
    be
    
      insn.prefixes.bytes[i] != 0 and i < 4
    
    instead of using insn.prefixes.nbytes.
    
    Introduce a for_each_insn_prefix() macro for this purpose. Debugged by
    Kees Cook <keescook at chromium.org>.
    
     [ bp: Massage commit message, sync with the respective header in tools/
       and drop "we". ]
    
    Fixes: 2b1444983508 ("uprobes, mm, x86: Add the ability to install and remove uprobes breakpoints")
    Reported-by: syzbot+9b64b619f10f19d19a7c at syzkaller.appspotmail.com
    Signed-off-by: Masami Hiramatsu <mhiramat at kernel.org>
    Signed-off-by: Borislav Petkov <bp at suse.de>
    Reviewed-by: Srikar Dronamraju <srikar at linux.vnet.ibm.com>
    Cc: stable at vger.kernel.org
    Link: https://lkml.kernel.org/r/160697103739.3146288.7437620795200799020.stgit@devnote2

diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
index 5c1ae3eff9d4..a8c3d284fa46 100644
--- a/arch/x86/include/asm/insn.h
+++ b/arch/x86/include/asm/insn.h
@@ -201,6 +201,21 @@ static inline int insn_offset_immediate(struct insn *insn)
 	return insn_offset_displacement(insn) + insn->displacement.nbytes;
 }
 
+/**
+ * for_each_insn_prefix() -- Iterate prefixes in the instruction
+ * @insn: Pointer to struct insn.
+ * @idx:  Index storage.
+ * @prefix: Prefix byte.
+ *
+ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
+ * and the index is stored in @idx (note that this @idx is just for a cursor,
+ * do not change it.)
+ * Since prefixes.nbytes can be bigger than 4 if some prefixes
+ * are repeated, it cannot be used for looping over the prefixes.
+ */
+#define for_each_insn_prefix(insn, idx, prefix)	\
+	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
+
 #define POP_SS_OPCODE 0x1f
 #define MOV_SREG_OPCODE 0x8e
 
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 3fdaa042823d..138bdb1fd136 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -255,12 +255,13 @@ static volatile u32 good_2byte_insns[256 / 32] = {
 
 static bool is_prefix_bad(struct insn *insn)
 {
+	insn_byte_t p;
 	int i;
 
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
+	for_each_insn_prefix(insn, i, p) {
 		insn_attr_t attr;
 
-		attr = inat_get_opcode_attribute(insn->prefixes.bytes[i]);
+		attr = inat_get_opcode_attribute(p);
 		switch (attr) {
 		case INAT_MAKE_PREFIX(INAT_PFX_ES):
 		case INAT_MAKE_PREFIX(INAT_PFX_CS):
@@ -715,6 +716,7 @@ static const struct uprobe_xol_ops push_xol_ops = {
 static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
 {
 	u8 opc1 = OPCODE1(insn);
+	insn_byte_t p;
 	int i;
 
 	switch (opc1) {
@@ -746,8 +748,8 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
 	 * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix.
 	 * No one uses these insns, reject any branch insns with such prefix.
 	 */
-	for (i = 0; i < insn->prefixes.nbytes; i++) {
-		if (insn->prefixes.bytes[i] == 0x66)
+	for_each_insn_prefix(insn, i, p) {
+		if (p == 0x66)
 			return -ENOTSUPP;
 	}
 
diff --git a/tools/arch/x86/include/asm/insn.h b/tools/arch/x86/include/asm/insn.h
index 568854b14d0a..52c6262e6bfd 100644
--- a/tools/arch/x86/include/asm/insn.h
+++ b/tools/arch/x86/include/asm/insn.h
@@ -201,6 +201,21 @@ static inline int insn_offset_immediate(struct insn *insn)
 	return insn_offset_displacement(insn) + insn->displacement.nbytes;
 }
 
+/**
+ * for_each_insn_prefix() -- Iterate prefixes in the instruction
+ * @insn: Pointer to struct insn.
+ * @idx:  Index storage.
+ * @prefix: Prefix byte.
+ *
+ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
+ * and the index is stored in @idx (note that this @idx is just for a cursor,
+ * do not change it.)
+ * Since prefixes.nbytes can be bigger than 4 if some prefixes
+ * are repeated, it cannot be used for looping over the prefixes.
+ */
+#define for_each_insn_prefix(insn, idx, prefix)	\
+	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
+
 #define POP_SS_OPCODE 0x1f
 #define MOV_SREG_OPCODE 0x8e
 
commit 7059c2c00a2196865c2139083cbef47cd18109b6
Merge: 33256ce19411 8c3b55a299c3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 5 16:16:34 2020 -0800

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
    
    Pull input fixes from Dmitry Torokhov:
     "A fix for 'RETRIGEN' handling in Atmel touch controllers that was
      causing lost interrupts on systems using edge-triggered interrupts, a
      quirk for i8042 driver, and a couple more fixes."
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
      Input: atmel_mxt_ts - fix lost interrupts
      Input: xpad - support Ardwiino Controllers
      Input: i8042 - add ByteSpeed touchpad to noloop table
      Input: i8042 - fix error return code in i8042_setup_aux()
      Input: soc_button_array - add missing include

commit edd2410b165e2ef00b2264ae362edf7441ca929c
Author: Vladimir Oltean <vladimir.oltean at nxp.com>
Date:   Fri Dec 4 19:54:16 2020 +0200

    net: mscc: ocelot: fix dropping of unknown IPv4 multicast on Seville
    
    The current assumption is that the felix DSA driver has flooding knobs
    per traffic class, while ocelot switchdev has a single flooding knob.
    This was correct for felix VSC9959 and ocelot VSC7514, but with the
    introduction of seville VSC9953, we see a switch driven by felix.c which
    has a single flooding knob.
    
    So it is clear that we must do what should have been done from the
    beginning, which is not to overwrite the configuration done by ocelot.c
    in felix, but instead to teach the common ocelot library about the
    differences in our switches, and set up the flooding PGIDs centrally.
    
    The effect that the bogus iteration through FELIX_NUM_TC has upon
    seville is quite dramatic. ANA_FLOODING is located at 0x00b548, and
    ANA_FLOODING_IPMC is located at 0x00b54c. So the bogus iteration will
    actually overwrite ANA_FLOODING_IPMC when attempting to write
    ANA_FLOODING[1]. There is no ANA_FLOODING[1] in sevile, just ANA_FLOODING.
    
    And when ANA_FLOODING_IPMC is overwritten with a bogus value, the effect
    is that ANA_FLOODING_IPMC gets the value of 0x0003CF7D:
            MC6_DATA = 61,
            MC6_CTRL = 61,
            MC4_DATA = 60,
            MC4_CTRL = 0.
    Because MC4_CTRL is zero, this means that IPv4 multicast control packets
    are not flooded, but dropped. An invalid configuration, and this is how
    the issue was actually spotted.
    
    Reported-by: Eldar Gasanov <eldargasanov2 at gmail.com>
    Reported-by: Maxim Kochetkov <fido_max at inbox.ru>
    Tested-by: Eldar Gasanov <eldargasanov2 at gmail.com>
    Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch")
    Fixes: 3c7b51bd39b2 ("net: dsa: felix: allow flooding for all traffic classes")
    Signed-off-by: Vladimir Oltean <vladimir.oltean at nxp.com>
    Reviewed-by: Alexandre Belloni <alexandre.belloni at bootlin.com>
    Link: https://lore.kernel.org/r/20201204175416.1445937-1-vladimir.oltean@nxp.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
index f791860d495f..c444ef3da3e2 100644
--- a/drivers/net/dsa/ocelot/felix.c
+++ b/drivers/net/dsa/ocelot/felix.c
@@ -569,7 +569,6 @@ static int felix_setup(struct dsa_switch *ds)
 	struct ocelot *ocelot = ds->priv;
 	struct felix *felix = ocelot_to_felix(ocelot);
 	int port, err;
-	int tc;
 
 	err = felix_init_structs(felix, ds->num_ports);
 	if (err)
@@ -608,12 +607,6 @@ static int felix_setup(struct dsa_switch *ds)
 	ocelot_write_rix(ocelot,
 			 ANA_PGID_PGID_PGID(GENMASK(ocelot->num_phys_ports, 0)),
 			 ANA_PGID_PGID, PGID_UC);
-	/* Setup the per-traffic class flooding PGIDs */
-	for (tc = 0; tc < FELIX_NUM_TC; tc++)
-		ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
-				 ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
-				 ANA_FLOODING_FLD_UNICAST(PGID_UC),
-				 ANA_FLOODING, tc);
 
 	ds->mtu_enforcement_ingress = true;
 	ds->configure_vlan_while_not_filtering = true;
diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
index 3e925b8d5306..2e5bbdca5ea4 100644
--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
+++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
@@ -1429,6 +1429,7 @@ static int felix_pci_probe(struct pci_dev *pdev,
 	pci_set_drvdata(pdev, felix);
 	ocelot = &felix->ocelot;
 	ocelot->dev = &pdev->dev;
+	ocelot->num_flooding_pgids = FELIX_NUM_TC;
 	felix->info = &felix_info_vsc9959;
 	felix->switch_base = pci_resource_start(pdev,
 						felix->info->switch_pci_bar);
diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c
index 1d420c4a2f0f..ebbaf6817ec8 100644
--- a/drivers/net/dsa/ocelot/seville_vsc9953.c
+++ b/drivers/net/dsa/ocelot/seville_vsc9953.c
@@ -1210,6 +1210,7 @@ static int seville_probe(struct platform_device *pdev)
 
 	ocelot = &felix->ocelot;
 	ocelot->dev = &pdev->dev;
+	ocelot->num_flooding_pgids = 1;
 	felix->info = &seville_info_vsc9953;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 70bf8c67d7ef..a53bd36b11c6 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -1489,10 +1489,11 @@ int ocelot_init(struct ocelot *ocelot)
 		     SYS_FRM_AGING_MAX_AGE(307692), SYS_FRM_AGING);
 
 	/* Setup flooding PGIDs */
-	ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
-			 ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
-			 ANA_FLOODING_FLD_UNICAST(PGID_UC),
-			 ANA_FLOODING, 0);
+	for (i = 0; i < ocelot->num_flooding_pgids; i++)
+		ocelot_write_rix(ocelot, ANA_FLOODING_FLD_MULTICAST(PGID_MC) |
+				 ANA_FLOODING_FLD_BROADCAST(PGID_MC) |
+				 ANA_FLOODING_FLD_UNICAST(PGID_UC),
+				 ANA_FLOODING, i);
 	ocelot_write(ocelot, ANA_FLOODING_IPMC_FLD_MC6_DATA(PGID_MCIPV6) |
 		     ANA_FLOODING_IPMC_FLD_MC6_CTRL(PGID_MC) |
 		     ANA_FLOODING_IPMC_FLD_MC4_DATA(PGID_MCIPV4) |
diff --git a/drivers/net/ethernet/mscc/ocelot_vsc7514.c b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
index dc00772950e5..1e7729421a82 100644
--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
@@ -1254,6 +1254,7 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
 	}
 
 	ocelot->num_phys_ports = of_get_child_count(ports);
+	ocelot->num_flooding_pgids = 1;
 
 	ocelot->vcap = vsc7514_vcap_props;
 	ocelot->inj_prefix = OCELOT_TAG_PREFIX_NONE;
diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
index 1e9db9577441..49b46df476f2 100644
--- a/include/soc/mscc/ocelot.h
+++ b/include/soc/mscc/ocelot.h
@@ -618,6 +618,9 @@ struct ocelot {
 	/* Keep track of the vlan port masks */
 	u32				vlan_mask[VLAN_N_VID];
 
+	/* Switches like VSC9959 have flooding per traffic class */
+	int				num_flooding_pgids;
+
 	/* In tables like ANA:PORT and the ANA:PGID:PGID mask,
 	 * the CPU is located after the physical ports (at the
 	 * num_phys_ports index).
commit 33256ce194110874d4bc90078b577c59f9076c59
Merge: be1515bad737 2bf9545626f8
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 5 15:27:22 2020 -0800

    Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
    
    Pull i2c fixes from Wolfram Sang:
     "Some more I2C driver updates. IMX updates are a tad bigger, but not
      exceptionally big"
    
    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
      i2c: mlxbf: Fix the return check of devm_ioremap and ioremap
      i2c: mlxbf: select CONFIG_I2C_SLAVE
      i2c: imx: Don't generate STOP condition if arbitration has been lost
      i2c: imx: Check for I2SR_IAL after every byte
      i2c: imx: Fix reset of I2SR_IAL flag
      i2c: qcom: Fix IRQ error misassignement
      i2c: qup: Fix error return code in qup_i2c_bam_schedule_desc()

commit be1515bad737ee9efe9229ab8313a236bfa03c5c
Merge: 619ca2664cc6 7e7986f9d3ba
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 5 14:45:30 2020 -0800

    Merge tag 'block-5.10-2020-12-05' of git://git.kernel.dk/linux-block
    
    Pull block fix from Jens Axboe:
     "Single fix for an issue with chunk_sectors and stacked devices"
    
    * tag 'block-5.10-2020-12-05' of git://git.kernel.dk/linux-block:
      block: use gcd() to fix chunk_sectors limit stacking

commit 619ca2664cc6ebf6ecaff347d15ee8093b634e0c
Merge: 32f741b02f1a 2d280bc8930b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Dec 5 14:39:59 2020 -0800

    Merge tag 'io_uring-5.10-2020-12-05' of git://git.kernel.dk/linux-block
    
    Pull io_uring fix from Jens Axboe:
     "Just a small fix this time, for an issue with 32-bit compat apps and
      buffer selection with recvmsg"
    
    * tag 'io_uring-5.10-2020-12-05' of git://git.kernel.dk/linux-block:
      io_uring: fix recvmsg setup with compat buf-select

commit 4de377b659035309ba48638d70f3150d5c67611f
Author: Zhang Changzhong <zhangchangzhong at huawei.com>
Date:   Fri Dec 4 16:49:42 2020 +0800

    net: marvell: prestera: Fix error return code in prestera_port_create()
    
    Fix to return a negative error code from the error handling
    case instead of 0, as done elsewhere in this function.
    
    Fixes: 501ef3066c89 ("net: marvell: prestera: Add driver for Prestera family ASIC devices")
    Reported-by: Hulk Robot <hulkci at huawei.com>
    Signed-off-by: Zhang Changzhong <zhangchangzhong at huawei.com>
    Link: https://lore.kernel.org/r/1607071782-34006-1-git-send-email-zhangchangzhong@huawei.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_main.c b/drivers/net/ethernet/marvell/prestera/prestera_main.c
index 0f20e0788cce..da4b286d1337 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_main.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_main.c
@@ -318,8 +318,10 @@ static int prestera_port_create(struct prestera_switch *sw, u32 id)
 		goto err_port_init;
 	}
 
-	if (port->fp_id >= PRESTERA_MAC_ADDR_NUM_MAX)
+	if (port->fp_id >= PRESTERA_MAC_ADDR_NUM_MAX) {
+		err = -EINVAL;
 		goto err_port_init;
+	}
 
 	/* firmware requires that port's MAC address consist of the first
 	 * 5 bytes of the base MAC address
commit 205704c618af0ab2366015d2281a3b0814d918a0
Author: Stephen Suryaputra <ssuryaextr at gmail.com>
Date:   Thu Dec 3 22:06:04 2020 -0500

    vrf: packets with lladdr src needs dst at input with orig_iif when needs strict
    
    Depending on the order of the routes to fe80::/64 are installed on the
    VRF table, the NS for the source link-local address of the originator
    might be sent to the wrong interface.
    
    This patch ensures that packets with link-local addr source is doing a
    lookup with the orig_iif when the destination addr indicates that it
    is strict.
    
    Add the reproducer as a use case in self test script fcnal-test.sh.
    
    Fixes: b4869aa2f881 ("net: vrf: ipv6 support for local traffic to local addresses")
    Signed-off-by: Stephen Suryaputra <ssuryaextr at gmail.com>
    Reviewed-by: David Ahern <dsahern at kernel.org>
    Link: https://lore.kernel.org/r/20201204030604.18828-1-ssuryaextr@gmail.com
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index f2793ffde191..b9b7e00b72a8 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1315,11 +1315,17 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
 	int orig_iif = skb->skb_iif;
 	bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
 	bool is_ndisc = ipv6_ndisc_frame(skb);
+	bool is_ll_src;
 
 	/* loopback, multicast & non-ND link-local traffic; do not push through
-	 * packet taps again. Reset pkt_type for upper layers to process skb
+	 * packet taps again. Reset pkt_type for upper layers to process skb.
+	 * for packets with lladdr src, however, skip so that the dst can be
+	 * determine at input using original ifindex in the case that daddr
+	 * needs strict
 	 */
-	if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
+	is_ll_src = ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL;
+	if (skb->pkt_type == PACKET_LOOPBACK ||
+	    (need_strict && !is_ndisc && !is_ll_src)) {
 		skb->dev = vrf_dev;
 		skb->skb_iif = vrf_dev->ifindex;
 		IP6CB(skb)->flags |= IP6