--- /dev/null
+From 4e74db243dce220c9131b2a021e11d4ceb233c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 10:48:18 -0800
+Subject: ACPICA: Fix exception code class checks
+
+From: Maximilian Luz <luzmaximilian@gmail.com>
+
+[ Upstream commit 3dfaea3811f8b6a89a347e8da9ab862cdf3e30fe ]
+
+ACPICA commit 1a3a549286ea9db07d7ec700e7a70dd8bcc4354e
+
+The macros to classify different AML exception codes are broken. For
+instance,
+
+ ACPI_ENV_EXCEPTION(Status)
+
+will always evaluate to zero due to
+
+ #define AE_CODE_ENVIRONMENTAL 0x0000
+ #define ACPI_ENV_EXCEPTION(Status) (Status & AE_CODE_ENVIRONMENTAL)
+
+Similarly, ACPI_AML_EXCEPTION(Status) will evaluate to a non-zero
+value for error codes of type AE_CODE_PROGRAMMER, AE_CODE_ACPI_TABLES,
+as well as AE_CODE_AML, and not just AE_CODE_AML as the name suggests.
+
+This commit fixes those checks.
+
+Fixes: d46b6537f0ce ("ACPICA: AML Parser: ignore all exceptions resulting from incorrect AML during table load")
+Link: https://github.com/acpica/acpica/commit/1a3a5492
+Signed-off-by: Maximilian Luz <luzmaximilian@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/acpi/acexcep.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/include/acpi/acexcep.h b/include/acpi/acexcep.h
+index 2fc624a617690..f8a4afb0279a3 100644
+--- a/include/acpi/acexcep.h
++++ b/include/acpi/acexcep.h
+@@ -59,11 +59,11 @@ struct acpi_exception_info {
+
+ #define AE_OK (acpi_status) 0x0000
+
+-#define ACPI_ENV_EXCEPTION(status) (status & AE_CODE_ENVIRONMENTAL)
+-#define ACPI_AML_EXCEPTION(status) (status & AE_CODE_AML)
+-#define ACPI_PROG_EXCEPTION(status) (status & AE_CODE_PROGRAMMER)
+-#define ACPI_TABLE_EXCEPTION(status) (status & AE_CODE_ACPI_TABLES)
+-#define ACPI_CNTL_EXCEPTION(status) (status & AE_CODE_CONTROL)
++#define ACPI_ENV_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ENVIRONMENTAL)
++#define ACPI_AML_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_AML)
++#define ACPI_PROG_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_PROGRAMMER)
++#define ACPI_TABLE_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_ACPI_TABLES)
++#define ACPI_CNTL_EXCEPTION(status) (((status) & AE_CODE_MASK) == AE_CODE_CONTROL)
+
+ /*
+ * Environmental exceptions
+--
+2.27.0
+
--- /dev/null
+From a66eabaa1b3cae0b0669b8938d32a2ecfef2579c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 17:58:31 +0100
+Subject: amba: Fix resource leak for drivers without .remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit de5d7adb89367bbc87b4e5ce7afe7ae9bd86dc12 ]
+
+Consider an amba driver with a .probe but without a .remove callback (e.g.
+pl061_gpio_driver). The function amba_probe() is called to bind a device
+and so dev_pm_domain_attach() and others are called. As there is no remove
+callback amba_remove() isn't called at unbind time however and so calling
+dev_pm_domain_detach() is missed and the pm domain keeps active.
+
+To fix this always use the core driver callbacks and handle missing amba
+callbacks there. For probe refuse registration as a driver without probe
+doesn't make sense.
+
+Fixes: 7cfe249475fd ("ARM: AMBA: Add pclk support to AMBA bus infrastructure")
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210126165835.687514-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/amba/bus.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
+index ecc304149067c..b5f5ca4e3f343 100644
+--- a/drivers/amba/bus.c
++++ b/drivers/amba/bus.c
+@@ -299,10 +299,11 @@ static int amba_remove(struct device *dev)
+ {
+ struct amba_device *pcdev = to_amba_device(dev);
+ struct amba_driver *drv = to_amba_driver(dev->driver);
+- int ret;
++ int ret = 0;
+
+ pm_runtime_get_sync(dev);
+- ret = drv->remove(pcdev);
++ if (drv->remove)
++ ret = drv->remove(pcdev);
+ pm_runtime_put_noidle(dev);
+
+ /* Undo the runtime PM settings in amba_probe() */
+@@ -319,7 +320,9 @@ static int amba_remove(struct device *dev)
+ static void amba_shutdown(struct device *dev)
+ {
+ struct amba_driver *drv = to_amba_driver(dev->driver);
+- drv->shutdown(to_amba_device(dev));
++
++ if (drv->shutdown)
++ drv->shutdown(to_amba_device(dev));
+ }
+
+ /**
+@@ -332,12 +335,13 @@ static void amba_shutdown(struct device *dev)
+ */
+ int amba_driver_register(struct amba_driver *drv)
+ {
+- drv->drv.bus = &amba_bustype;
++ if (!drv->probe)
++ return -EINVAL;
+
+-#define SETFN(fn) if (drv->fn) drv->drv.fn = amba_##fn
+- SETFN(probe);
+- SETFN(remove);
+- SETFN(shutdown);
++ drv->drv.bus = &amba_bustype;
++ drv->drv.probe = amba_probe;
++ drv->drv.remove = amba_remove;
++ drv->drv.shutdown = amba_shutdown;
+
+ return driver_register(&drv->drv);
+ }
+--
+2.27.0
+
--- /dev/null
+From fc9b24eaaa85fab4b7718ac6a1e7795c2b2306fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 10:47:24 +0100
+Subject: ARM: 9046/1: decompressor: Do not clear SCTLR.nTLSMD for ARMv7+ cores
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 2acb909750431030b65a0a2a17fd8afcbd813a84 ]
+
+It was observed that decompressor running on hardware implementing ARM v8.2
+Load/Store Multiple Atomicity and Ordering Control (LSMAOC), say, as guest,
+would stuck just after:
+
+Uncompressing Linux... done, booting the kernel.
+
+The reason is that it clears nTLSMD bit when disabling caches:
+
+ nTLSMD, bit [3]
+
+ When ARMv8.2-LSMAOC is implemented:
+
+ No Trap Load Multiple and Store Multiple to
+ Device-nGRE/Device-nGnRE/Device-nGnRnE memory.
+
+ 0b0 All memory accesses by A32 and T32 Load Multiple and Store
+ Multiple at EL1 or EL0 that are marked at stage 1 as
+ Device-nGRE/Device-nGnRE/Device-nGnRnE memory are trapped and
+ generate a stage 1 Alignment fault.
+
+ 0b1 All memory accesses by A32 and T32 Load Multiple and Store
+ Multiple at EL1 or EL0 that are marked at stage 1 as
+ Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not trapped.
+
+ This bit is permitted to be cached in a TLB.
+
+ This field resets to 1.
+
+ Otherwise:
+
+ Reserved, RES1
+
+So as effect we start getting traps we are not quite ready for.
+
+Looking into history it seems that mask used for SCTLR clear came from
+the similar code for ARMv4, where bit[3] is the enable/disable bit for
+the write buffer. That not applicable to ARMv7 and onwards, so retire
+that bit from the masks.
+
+Fixes: 7d09e85448dfa78e3e58186c934449aaf6d49b50 ("[ARM] 4393/2: ARMv7: Add uncompressing code for the new CPU Id format")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index d9cce7238a365..73eee41826e2d 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1164,9 +1164,9 @@ __armv4_mmu_cache_off:
+ __armv7_mmu_cache_off:
+ mrc p15, 0, r0, c1, c0
+ #ifdef CONFIG_MMU
+- bic r0, r0, #0x000d
++ bic r0, r0, #0x0005
+ #else
+- bic r0, r0, #0x000c
++ bic r0, r0, #0x0004
+ #endif
+ mcr p15, 0, r0, c1, c0 @ turn MMU and cache off
+ mov r0, #0
+--
+2.27.0
+
--- /dev/null
+From 161305d3d8898e7f99872bc1640bf77c39e88dc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Feb 2021 19:47:48 +0100
+Subject: ARM: 9065/1: OABI compat: fix build when EPOLL is not enabled
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit fd749fe4bcb00ad80d9eece709f804bb4ac6bf1e ]
+
+When CONFIG_EPOLL is not set/enabled, sys_oabi-compat.c has build
+errors. Fix these by surrounding them with ifdef CONFIG_EPOLL/endif
+and providing stubs for the "EPOLL is not set" case.
+
+../arch/arm/kernel/sys_oabi-compat.c: In function 'sys_oabi_epoll_ctl':
+../arch/arm/kernel/sys_oabi-compat.c:257:6: error: implicit declaration of function 'ep_op_has_event' [-Werror=implicit-function-declaration]
+ 257 | if (ep_op_has_event(op) &&
+ | ^~~~~~~~~~~~~~~
+../arch/arm/kernel/sys_oabi-compat.c:264:9: error: implicit declaration of function 'do_epoll_ctl'; did you mean 'sys_epoll_ctl'? [-Werror=implicit-function-declaration]
+ 264 | return do_epoll_ctl(epfd, op, fd, &kernel, false);
+ | ^~~~~~~~~~~~
+
+Fixes: c281634c8652 ("ARM: compat: remove KERNEL_DS usage in sys_oabi_epoll_ctl()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com> # from an lkp .config file
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Nicolas Pitre <nico@fluxnic.net>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: patches@armlinux.org.uk
+Acked-by: Nicolas Pitre <nico@fluxnic.net>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/sys_oabi-compat.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
+index 0203e545bbc8d..075a2e0ed2c15 100644
+--- a/arch/arm/kernel/sys_oabi-compat.c
++++ b/arch/arm/kernel/sys_oabi-compat.c
+@@ -248,6 +248,7 @@ struct oabi_epoll_event {
+ __u64 data;
+ } __attribute__ ((packed,aligned(4)));
+
++#ifdef CONFIG_EPOLL
+ asmlinkage long sys_oabi_epoll_ctl(int epfd, int op, int fd,
+ struct oabi_epoll_event __user *event)
+ {
+@@ -298,6 +299,20 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
+ kfree(kbuf);
+ return err ? -EFAULT : ret;
+ }
++#else
++asmlinkage long sys_oabi_epoll_ctl(int epfd, int op, int fd,
++ struct oabi_epoll_event __user *event)
++{
++ return -EINVAL;
++}
++
++asmlinkage long sys_oabi_epoll_wait(int epfd,
++ struct oabi_epoll_event __user *events,
++ int maxevents, int timeout)
++{
++ return -EINVAL;
++}
++#endif
+
+ struct oabi_sembuf {
+ unsigned short sem_num;
+--
+2.27.0
+
--- /dev/null
+From 0bab42b9e77fbc924808feb546c62929bf90951d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 17:01:20 +0100
+Subject: ARM: at91: use proper asm syntax in pm_suspend
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d30337da8677cd73cb19444436b311c13e57356f ]
+
+Compiling with the clang integrated assembler warns about
+a recently added instruction:
+
+<instantiation>:14:13: error: unknown token in expression
+ ldr tmp1, =#0x00020010UL
+arch/arm/mach-at91/pm_suspend.S:542:2: note: while in macro instantiation
+ at91_plla_enable
+
+Remove the extra '#' character that is not used for the 'ldr'
+instruction when doing an indirect load of a constant.
+
+Fixes: 4fd36e458392 ("ARM: at91: pm: add plla disable/enable support for sam9x60")
+Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20210204160129.2249394-1-arnd@kernel.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm_suspend.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
+index 0184de05c1be1..b683c2caa40b9 100644
+--- a/arch/arm/mach-at91/pm_suspend.S
++++ b/arch/arm/mach-at91/pm_suspend.S
+@@ -442,7 +442,7 @@ ENDPROC(at91_backup_mode)
+ str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
+
+ /* step 2. */
+- ldr tmp1, =#AT91_PMC_PLL_ACR_DEFAULT_PLLA
++ ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
+ str tmp1, [pmc, #AT91_PMC_PLL_ACR]
+
+ /* step 3. */
+--
+2.27.0
+
--- /dev/null
+From 28ade30a46386b261d416df3b44933ad84a2ada2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:23:21 -0800
+Subject: ARM: dts: armada388-helios4: assign pinctrl to each fan
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit 46ecdfc1830eaa40a11d7f832089c82b0e67ea96 ]
+
+Split up the pins for each fan. This is needed in order to control them
+
+Fixes: ced8025b569e ("ARM: dts: armada388-helios4")
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-helios4.dts | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
+index 5a6af7e83e445..ec134e22bae3e 100644
+--- a/arch/arm/boot/dts/armada-388-helios4.dts
++++ b/arch/arm/boot/dts/armada-388-helios4.dts
+@@ -127,11 +127,15 @@
+ fan1: j10-pwm {
+ compatible = "pwm-fan";
+ pwms = <&gpio1 9 40000>; /* Target freq:25 kHz */
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_fan1_pins>;
+ };
+
+ fan2: j17-pwm {
+ compatible = "pwm-fan";
+ pwms = <&gpio1 23 40000>; /* Target freq:25 kHz */
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_fan2_pins>;
+ };
+
+ usb2_phy: usb2-phy {
+@@ -302,9 +306,12 @@
+ "mpp54";
+ marvell,function = "gpio";
+ };
+- helios_fan_pins: helios-fan-pins {
+- marvell,pins = "mpp41", "mpp43",
+- "mpp48", "mpp55";
++ helios_fan1_pins: helios_fan1_pins {
++ marvell,pins = "mpp41", "mpp43";
++ marvell,function = "gpio";
++ };
++ helios_fan2_pins: helios_fan2_pins {
++ marvell,pins = "mpp48", "mpp55";
+ marvell,function = "gpio";
+ };
+ microsom_spi1_cs_pins: spi1-cs-pins {
+--
+2.27.0
+
--- /dev/null
+From bc224600620fea773ec8bb8cc8ac434371b236ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 18:23:20 -0800
+Subject: ARM: dts: armada388-helios4: assign pinctrl to LEDs
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit e011c9025a4691b5c734029577a920bd6c320994 ]
+
+Split up the pins to match earlier definitions. Allows LEDs to flash
+properly.
+
+Fixes: ced8025b569e ("ARM: dts: armada388-helios4")
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-388-helios4.dts | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-388-helios4.dts b/arch/arm/boot/dts/armada-388-helios4.dts
+index b3728de3bd3fa..5a6af7e83e445 100644
+--- a/arch/arm/boot/dts/armada-388-helios4.dts
++++ b/arch/arm/boot/dts/armada-388-helios4.dts
+@@ -70,6 +70,9 @@
+
+ system-leds {
+ compatible = "gpio-leds";
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_system_led_pins>;
++
+ status-led {
+ label = "helios4:green:status";
+ gpios = <&gpio0 24 GPIO_ACTIVE_LOW>;
+@@ -86,6 +89,9 @@
+
+ io-leds {
+ compatible = "gpio-leds";
++ pinctrl-names = "default";
++ pinctrl-0 = <&helios_io_led_pins>;
++
+ sata1-led {
+ label = "helios4:green:ata1";
+ gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
+@@ -286,9 +292,12 @@
+ "mpp39", "mpp40";
+ marvell,function = "sd0";
+ };
+- helios_led_pins: helios-led-pins {
+- marvell,pins = "mpp24", "mpp25",
+- "mpp49", "mpp50",
++ helios_system_led_pins: helios-system-led-pins {
++ marvell,pins = "mpp24", "mpp25";
++ marvell,function = "gpio";
++ };
++ helios_io_led_pins: helios-io-led-pins {
++ marvell,pins = "mpp49", "mpp50",
+ "mpp52", "mpp53",
+ "mpp54";
+ marvell,function = "gpio";
+--
+2.27.0
+
--- /dev/null
+From bd818520e87212efa8ff7b49925accca2242075d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 10:42:30 +0200
+Subject: ARM: dts: Configure missing thermal interrupt for 4430
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 44f416879a442600b006ef7dec3a6dc98bcf59c6 ]
+
+We have gpio_86 wired internally to the bandgap thermal shutdown
+interrupt on 4430 like we have it on 4460 according to the TRM.
+This can be found easily by searching for TSHUT.
+
+For some reason the thermal shutdown interrupt was never added
+for 4430, let's add it. I believe this is needed for the thermal
+shutdown interrupt handler ti_bandgap_tshut_irq_handler() to call
+orderly_poweroff().
+
+Fixes: aa9bb4bb8878 ("arm: dts: add omap4430 thermal data")
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Eduardo Valentin <edubezval@gmail.com>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap443x.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/omap443x.dtsi b/arch/arm/boot/dts/omap443x.dtsi
+index cb309743de5da..dd8ef58cbaed4 100644
+--- a/arch/arm/boot/dts/omap443x.dtsi
++++ b/arch/arm/boot/dts/omap443x.dtsi
+@@ -33,10 +33,12 @@
+ };
+
+ ocp {
++ /* 4430 has only gpio_86 tshut and no talert interrupt */
+ bandgap: bandgap@4a002260 {
+ reg = <0x4a002260 0x4
+ 0x4a00232C 0x4>;
+ compatible = "ti,omap4430-bandgap";
++ gpios = <&gpio3 22 GPIO_ACTIVE_HIGH>;
+
+ #thermal-sensor-cells = <0>;
+ };
+--
+2.27.0
+
--- /dev/null
+From 9cb1ab43ec68a800d01ecb7419172e0758161bc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:55 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Artik 5
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit cb31334687db31c691901269d65074a7ffaecb18 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: b004a34bd0ff ("ARM: dts: exynos: Add exynos3250-artik5 dtsi file for ARTIK5 module")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-1-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-artik5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+index 04290ec4583a6..829c05b2c405f 100644
+--- a/arch/arm/boot/dts/exynos3250-artik5.dtsi
++++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi
+@@ -79,7 +79,7 @@
+ pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx3>;
+- interrupts = <5 IRQ_TYPE_NONE>;
++ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps14_irq>;
+ reg = <0x66>;
+--
+2.27.0
+
--- /dev/null
+From 9bcd6d8c95a5a6f9b9ca1bc5cb1c964e6ad728ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:56 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Monk
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 8528cda2b7c667e9cd173aef1a677c71b7d5a096 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: e0cefb3f79d3 ("ARM: dts: add board dts file for Exynos3250-based Monk board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-2-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-monk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts
+index 69451566945dc..fae046e08a5dd 100644
+--- a/arch/arm/boot/dts/exynos3250-monk.dts
++++ b/arch/arm/boot/dts/exynos3250-monk.dts
+@@ -200,7 +200,7 @@
+ pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ wakeup-source;
+
+--
+2.27.0
+
--- /dev/null
+From c415e098397bad6e8173e59db29d52f6805d9a57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:57 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Rinato
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 437ae60947716bb479e2f32466f49445c0509b1e ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: faaf348ef468 ("ARM: dts: Add board dts file for exynos3250-rinato")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-3-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250-rinato.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts
+index a26e3e582a7e7..d64ccf4b7d324 100644
+--- a/arch/arm/boot/dts/exynos3250-rinato.dts
++++ b/arch/arm/boot/dts/exynos3250-rinato.dts
+@@ -270,7 +270,7 @@
+ pmic@66 {
+ compatible = "samsung,s2mps14-pmic";
+ interrupt-parent = <&gpx0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ wakeup-source;
+
+--
+2.27.0
+
--- /dev/null
+From eecd358de38c55cd7e4fba2f855a63c56cc9006c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:59 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Arndale
+ Octa
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1ac8893c4fa3d4a34915dc5cdab568a39db5086c ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: 1fed2252713e ("ARM: dts: fix pinctrl for s2mps11-irq on exynos5420-arndale-octa")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-5-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+index bf457d0c02ebd..1aad4859c5f14 100644
+--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts
++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts
+@@ -349,7 +349,7 @@
+ reg = <0x66>;
+
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps11_irq>;
+
+--
+2.27.0
+
--- /dev/null
+From ff6289b67e54145629eb3e9ba6e137302fe4e76a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:00 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid XU3
+ family
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 3e7d9a583a24f7582c6bc29a0d4d624feedbc2f9 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. The falling edge
+interrupt will mostly work but it's not correct.
+
+Fixes: aac4e0615341 ("ARM: dts: odroidxu3: Enable wake alarm of S2MPS11 RTC")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-6-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index d0df560eb0db1..6d690b1db0994 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -509,7 +509,7 @@
+ samsung,s2mps11-acokb-ground;
+
+ interrupt-parent = <&gpx0>;
+- interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++ interrupts = <4 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s2mps11_irq>;
+
+--
+2.27.0
+
--- /dev/null
+From 3e959a5534b7abc02045b4b97ed6a00ca2d06683 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:28:58 +0100
+Subject: ARM: dts: exynos: correct PMIC interrupt trigger level on Spring
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 77e6a5467cb8657cf8b5e610a30a4c502085e4f9 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 53dd4138bb0a ("ARM: dts: Add exynos5250-spring device tree")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-4-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250-spring.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250-spring.dts b/arch/arm/boot/dts/exynos5250-spring.dts
+index 9d2baea62d0d7..fba1462b19dfd 100644
+--- a/arch/arm/boot/dts/exynos5250-spring.dts
++++ b/arch/arm/boot/dts/exynos5250-spring.dts
+@@ -109,7 +109,7 @@
+ compatible = "samsung,s5m8767-pmic";
+ reg = <0x66>;
+ interrupt-parent = <&gpx3>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&s5m8767_irq &s5m8767_dvs &s5m8767_ds>;
+ wakeup-source;
+--
+2.27.0
+
--- /dev/null
+From da7993dd33541bf85e1657a014affd2692a754ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 17:23:42 +0100
+Subject: ARM: s3c: fix fiq for clang IAS
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7f9942c61fa60eda7cc8e42f04bd25b7d175876e ]
+
+Building with the clang integrated assembler produces a couple of
+errors for the s3c24xx fiq support:
+
+ arch/arm/mach-s3c/irq-s3c24xx-fiq.S:52:2: error: instruction 'subne' can not set flags, but 's' suffix specified
+ subnes pc, lr, #4 @@ return, still have work to do
+
+ arch/arm/mach-s3c/irq-s3c24xx-fiq.S:64:1: error: invalid symbol redefinition
+ s3c24xx_spi_fiq_txrx:
+
+There are apparently two problems: one with extraneous or duplicate
+labels, and one with old-style opcode mnemonics. Stefan Agner has
+previously fixed other problems like this, but missed this particular
+file.
+
+Fixes: bec0806cfec6 ("spi_s3c24xx: add FIQ pseudo-DMA support")
+Cc: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20210204162416.3030114-1-arnd@kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-s3c/irq-s3c24xx-fiq.S | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/mach-s3c/irq-s3c24xx-fiq.S b/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
+index b54cbd0122413..5d238d9a798e1 100644
+--- a/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
++++ b/arch/arm/mach-s3c/irq-s3c24xx-fiq.S
+@@ -35,7 +35,6 @@
+ @ and an offset to the irq acknowledgment word
+
+ ENTRY(s3c24xx_spi_fiq_rx)
+-s3c24xx_spi_fix_rx:
+ .word fiq_rx_end - fiq_rx_start
+ .word fiq_rx_irq_ack - fiq_rx_start
+ fiq_rx_start:
+@@ -49,7 +48,7 @@ fiq_rx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ @@ set IRQ controller so that next op will trigger IRQ
+ mov fiq_rtmp, #0
+@@ -61,7 +60,6 @@ fiq_rx_irq_ack:
+ fiq_rx_end:
+
+ ENTRY(s3c24xx_spi_fiq_txrx)
+-s3c24xx_spi_fiq_txrx:
+ .word fiq_txrx_end - fiq_txrx_start
+ .word fiq_txrx_irq_ack - fiq_txrx_start
+ fiq_txrx_start:
+@@ -76,7 +74,7 @@ fiq_txrx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ mov fiq_rtmp, #0
+ str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
+@@ -88,7 +86,6 @@ fiq_txrx_irq_ack:
+ fiq_txrx_end:
+
+ ENTRY(s3c24xx_spi_fiq_tx)
+-s3c24xx_spi_fix_tx:
+ .word fiq_tx_end - fiq_tx_start
+ .word fiq_tx_irq_ack - fiq_tx_start
+ fiq_tx_start:
+@@ -101,7 +98,7 @@ fiq_tx_start:
+ strb fiq_rtmp, [ fiq_rspi, # S3C2410_SPTDAT ]
+
+ subs fiq_rcount, fiq_rcount, #1
+- subnes pc, lr, #4 @@ return, still have work to do
++ subsne pc, lr, #4 @@ return, still have work to do
+
+ mov fiq_rtmp, #0
+ str fiq_rtmp, [ fiq_rirq, # S3C2410_INTMOD - S3C24XX_VA_IRQ ]
+--
+2.27.0
+
--- /dev/null
+From 6e01171b5667df50286339008e2d49b93ea0bd05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 16:56:59 +0000
+Subject: ARM: tegra: ouya: Fix eMMC on specific bootloaders
+
+From: Peter Geis <pgwipeout@gmail.com>
+
+[ Upstream commit 3029a563ac0ccd39b9dc53eadfb9c0e3fb57a449 ]
+
+Ouya fails to detect the eMMC module when booted via certain bootloaders.
+Fastboot and hard-kexec bootloaders fail while u-boot does not. It was
+discovered that the issue manifests if the sdmmc4 alternate configuration
+clock pin is input disabled.
+
+Ouya uses sdmmc4 in the primary pin configuration. It is unknown why this
+occurs, though it is likely related to other eMMC limitations experienced
+on Ouya.
+
+For now, fix it by enabling input on cam_mclk_pcc0.
+
+Fixes: d7195ac5c9c5 ("ARM: tegra: Add device-tree for Ouya")
+Reported-by: Matt Merhar <mattmerhar@protonmail.com>
+Tested-by: Matt Merhar <mattmerhar@protonmail.com>
+Signed-off-by: Peter Geis <pgwipeout@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/tegra30-ouya.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/tegra30-ouya.dts b/arch/arm/boot/dts/tegra30-ouya.dts
+index 74da1360d297c..0368b3b816ef2 100644
+--- a/arch/arm/boot/dts/tegra30-ouya.dts
++++ b/arch/arm/boot/dts/tegra30-ouya.dts
+@@ -4352,8 +4352,8 @@
+ nvidia,pins = "cam_mclk_pcc0";
+ nvidia,function = "vi_alt3";
+ nvidia,pull = <TEGRA_PIN_PULL_NONE>;
+- nvidia,tristate = <TEGRA_PIN_ENABLE>;
+- nvidia,enable-input = <TEGRA_PIN_DISABLE>;
++ nvidia,tristate = <TEGRA_PIN_DISABLE>;
++ nvidia,enable-input = <TEGRA_PIN_ENABLE>;
+ };
+ pcc1 {
+ nvidia,pins = "pcc1";
+--
+2.27.0
+
--- /dev/null
+From 56d5ac094cde3b2b72eeb29358110b78052e6dc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 09:37:37 +0000
+Subject: arm64: Add missing ISB after invalidating TLB in __primary_switch
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 9d41053e8dc115c92b8002c3db5f545d7602498b ]
+
+Although there has been a bit of back and forth on the subject, it
+appears that invalidating TLBs requires an ISB instruction when FEAT_ETS
+is not implemented by the CPU.
+
+From the bible:
+
+ | In an implementation that does not implement FEAT_ETS, a TLB
+ | maintenance instruction executed by a PE, PEx, can complete at any
+ | time after it is issued, but is only guaranteed to be finished for a
+ | PE, PEx, after the execution of DSB by the PEx followed by a Context
+ | synchronization event
+
+Add the missing ISB in __primary_switch, just in case.
+
+Fixes: 3c5e9f238bc4 ("arm64: head.S: move KASLR processing out of __enable_mmu()")
+Suggested-by: Will Deacon <will@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/20210224093738.3629662-3-maz@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index a0dc987724eda..7ec430e18f95e 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -882,6 +882,7 @@ SYM_FUNC_START_LOCAL(__primary_switch)
+
+ tlbi vmalle1 // Remove any stale TLB entries
+ dsb nsh
++ isb
+
+ msr sctlr_el1, x19 // re-enable the MMU
+ isb
+--
+2.27.0
+
--- /dev/null
+From a9679fb3011636e0d396b22d14e4368af7951d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:28 +0000
+Subject: arm64: dts: allwinner: A64: Limit MMC2 bus frequency to 150 MHz
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 948c657cc45e8ce48cb533d4e2106145fa765759 ]
+
+In contrast to the H6 (and later) manuals, the A64 datasheet does not
+specify any limitations in the maximum possible frequency for eMMC
+controllers.
+However experimentation has found that a 150 MHz limit similar to other
+SoCs and also the MMC0 and MMC1 controllers on the A64 seems to exist
+for the MMC2 controller.
+
+Limit the frequency for the MMC2 controller to 150 MHz in the SoC .dtsi.
+The Pinebook seems to be the an odd exception, since it apparently seems
+to work with 200 MHz as well, so overwrite this in its board .dts file.
+
+Tested on a Pine64-LTS: 200 MHz HS-200 fails, 150 MHz HS-200 works.
+
+Fixes: 22be992faea7 ("arm64: allwinner: a64: Increase the MMC max frequency")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-7-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 1 +
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index d07cf05549c32..7ae16541d14f5 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -167,6 +167,7 @@
+ pinctrl-0 = <&mmc2_pins>, <&mmc2_ds_pin>;
+ vmmc-supply = <®_dcdc1>;
+ vqmmc-supply = <®_eldo1>;
++ max-frequency = <200000000>;
+ bus-width = <8>;
+ non-removable;
+ cap-mmc-hw-reset;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 19e9b8ca8432f..57786fc120c30 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -514,7 +514,7 @@
+ resets = <&ccu RST_BUS_MMC2>;
+ reset-names = "ahb";
+ interrupts = <GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>;
+- max-frequency = <200000000>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.27.0
+
--- /dev/null
+From cffe96544697454fff2e6ed21c1b2128d5686e80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:23 +0000
+Subject: arm64: dts: allwinner: A64: properly connect USB PHY to port 0
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit cc72570747e43335f4933a24dd74d5653639176a ]
+
+In recent Allwinner SoCs the first USB host controller (HCI0) shares
+the first PHY with the MUSB controller. Probably to make this sharing
+work, we were avoiding to declare this in the DT. This has two
+shortcomings:
+- U-Boot (which uses the same .dts) cannot use this port in host mode
+ without a PHY linked, so we were loosing one USB port there.
+- It requires the MUSB driver to be enabled and loaded, although we
+ don't actually use it.
+
+To avoid those issues, let's add this PHY link to the A64 .dtsi file.
+After all PHY port 0 *is* connected to HCI0, so we should describe
+it as this. Remove the part from the Pinebook DTS which already had
+this property.
+
+This makes it work in U-Boot, also improves compatiblity when no MUSB
+driver is loaded (for instance in distribution installers).
+
+Fixes: dc03a047df1d ("arm64: allwinner: a64: add EHCI0/OHCI0 nodes to A64 DTSI")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-2-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts | 4 ----
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 4 ++++
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index 896f34fd9fc3a..d07cf05549c32 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -126,8 +126,6 @@
+ };
+
+ &ehci0 {
+- phys = <&usbphy 0>;
+- phy-names = "usb";
+ status = "okay";
+ };
+
+@@ -177,8 +175,6 @@
+ };
+
+ &ohci0 {
+- phys = <&usbphy 0>;
+- phy-names = "usb";
+ status = "okay";
+ };
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 51cc30e84e261..19e9b8ca8432f 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -593,6 +593,8 @@
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>,
+ <&ccu RST_BUS_EHCI0>;
++ phys = <&usbphy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+@@ -603,6 +605,8 @@
+ clocks = <&ccu CLK_BUS_OHCI0>,
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>;
++ phys = <&usbphy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 5966e41f1a92169ba445f9b7e04a4e0abaaf3bf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:26 +0000
+Subject: arm64: dts: allwinner: Drop non-removable from SoPine/LTS SD card
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 941432d007689f3774646e41a1439228b6c6ee0e ]
+
+The SD card on the SoPine SoM module is somewhat concealed, so was
+originally defined as "non-removable".
+However there is a working card-detect pin (tested on two different
+SoM versions), and in certain SoM base boards it might be actually
+accessible at runtime.
+Also the Pine64-LTS shares the SoPine base .dtsi, so inherited the
+non-removable flag, even though the SD card slot is perfectly accessible
+and usable there. (It turns out that just *my* board has a broken card
+detect switch, so I originally thought CD wouldn't work on the LTS.)
+
+Drop the "non-removable" flag to describe the SD card slot properly.
+
+Fixes: c3904a269891 ("arm64: allwinner: a64: add DTSI file for SoPine SoM")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-5-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+index c48692b06e1fa..3402cec87035b 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine.dtsi
+@@ -32,7 +32,6 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc0_pins>;
+ vmmc-supply = <®_dcdc1>;
+- non-removable;
+ disable-wp;
+ bus-width = <4>;
+ cd-gpios = <&pio 5 6 GPIO_ACTIVE_LOW>; /* PF6 */
+--
+2.27.0
+
--- /dev/null
+From 36f852ebe5969925fc5487ad519dacbb1be9893c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:27 +0000
+Subject: arm64: dts: allwinner: H6: Allow up to 150 MHz MMC bus frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit cfe6c487b9a1abc6197714ec5605716a5428cf03 ]
+
+The H6 manual explicitly lists a frequency limit of 150 MHz for the bus
+frequency of the MMC controllers. So far we had no explicit limits in the
+DT, which limited eMMC to the spec defined frequencies, or whatever the
+driver defines (both Linux and FreeBSD use 52 MHz here).
+
+Put those maximum frequencies in the SoC .dtsi, to allow higher speed
+modes (which still would need to be explicitly enabled, per board).
+
+Tested with an eMMC using HS-200 on a Pine H64. Running at the spec'ed
+200 MHz indeed fails with I/O errors, but 150 MHz seems to work stably.
+
+Fixes: 8f54bd1595b3 ("arm64: allwinner: h6: add device tree nodes for MMC controllers")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-6-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index f593cfeaecc9f..77765d4a05ec9 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -436,6 +436,7 @@
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc0_pins>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -452,6 +453,7 @@
+ interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+@@ -468,6 +470,7 @@
+ interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc2_pins>;
++ max-frequency = <150000000>;
+ status = "disabled";
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.27.0
+
--- /dev/null
+From 39ea6190a0121b6cef292e55e140264eb4ffb8b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:26:24 +0000
+Subject: arm64: dts: allwinner: H6: properly connect USB PHY to port 0
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit da2fb8457f71138d455cba82edec0d34f858e506 ]
+
+In recent Allwinner SoCs the first USB host controller (HCI0) shares
+the first PHY with the MUSB controller. Probably to make this sharing
+work, we were avoiding to declare this in the DT. This has two
+shortcomings:
+- U-Boot (which uses the same .dts) cannot use this port in host mode
+ without a PHY linked, so we were loosing one USB port there.
+- It requires the MUSB driver to be enabled and loaded, although we
+ don't actually use it.
+
+To avoid those issues, let's add this PHY link to the H6 .dtsi file.
+After all PHY port 0 *is* connected to HCI0, so we should describe
+it as this.
+
+This makes it work in U-Boot, also improves compatiblity when no MUSB
+driver is loaded (for instance in distribution installers).
+
+Fixes: eabb3d424b6d ("arm64: dts: allwinner: h6: add USB2-related device nodes")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210113152630.28810-3-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 8a62a9fbe3475..f593cfeaecc9f 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -680,6 +680,8 @@
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>,
+ <&ccu RST_BUS_EHCI0>;
++ phys = <&usb2phy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+@@ -690,6 +692,8 @@
+ clocks = <&ccu CLK_BUS_OHCI0>,
+ <&ccu CLK_USB_OHCI0>;
+ resets = <&ccu RST_BUS_OHCI0>;
++ phys = <&usb2phy 0>;
++ phy-names = "usb";
+ status = "disabled";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 2f0db116e1264195bd49c70622fbd976581abb6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 03:12:43 +0100
+Subject: arm64: dts: armada-3720-turris-mox: rename u-boot mtd partition to
+ a53-firmware
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit a9d9bfcadfb43b856dbcf9419de75f7420d5a225 ]
+
+The partition called "u-boot" in reality contains TF-A and U-Boot, and
+TF-A is before U-Boot.
+
+Rename this parition to "a53-firmware" to avoid confusion for users,
+since they cannot simply build U-Boot from U-Boot repository and flash
+the resulting image there. Instead they have to build the firmware with
+the sources from the mox-boot-builder repository [1] and flash the
+a53-firmware.bin binary there.
+
+[1] https://gitlab.nic.cz/turris/mox-boot-builder
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox")
+Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index f5ec3b6447692..d239ab70ed995 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -205,7 +205,7 @@
+ };
+
+ partition@20000 {
+- label = "u-boot";
++ label = "a53-firmware";
+ reg = <0x20000 0x160000>;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 4e921896d1db45951c1ade450cb3a62c2ccd6f6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 11:49:50 +0100
+Subject: arm64: dts: broadcom: bcm4908: use proper NAND binding
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 56098be85d19cd56b59d7b3854ea035cc8cb9e95 ]
+
+BCM4908 has controller that needs different IRQ handling just like the
+BCM63138. Describe it properly.
+
+On Linux this change fixes:
+brcmstb_nand ff801800.nand: timeout waiting for command 0x9
+brcmstb_nand ff801800.nand: intfc status d0000000
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+index f873dc44ce9ca..55d9b56ac749d 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm4908/bcm4908.dtsi
+@@ -164,7 +164,7 @@
+ nand@1800 {
+ #address-cells = <1>;
+ #size-cells = <0>;
+- compatible = "brcm,brcmnand-v7.1", "brcm,brcmnand";
++ compatible = "brcm,nand-bcm63138", "brcm,brcmnand-v7.1", "brcm,brcmnand";
+ reg = <0x1800 0x600>, <0x2000 0x10>;
+ reg-names = "nand", "nand-int-base";
+ interrupts = <GIC_SPI 37 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.27.0
+
--- /dev/null
+From 653741013328322e4d17c4fee60a78b301232369 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:01 +0100
+Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on TM2
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit e98e2367dfb4b6d7a80c8ce795c644124eff5f36 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 01e5d2352152 ("arm64: dts: exynos: Add dts file for Exynos5433-based TM2 board")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Link: https://lore.kernel.org/r/20201210212903.216728-7-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+index 03486a8ffc67e..4c5106a0860d0 100644
+--- a/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos5433-tm2-common.dtsi
+@@ -388,7 +388,7 @@
+ pmic@66 {
+ compatible = "samsung,s2mps13-pmic";
+ interrupt-parent = <&gpa0>;
+- interrupts = <7 IRQ_TYPE_NONE>;
++ interrupts = <7 IRQ_TYPE_LEVEL_LOW>;
+ reg = <0x66>;
+ samsung,s2mps11-wrstbi-ground;
+
+--
+2.27.0
+
--- /dev/null
+From 270b4e03ae99594b9b40398ed307c8be948691b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 22:29:02 +0100
+Subject: arm64: dts: exynos: correct PMIC interrupt trigger level on Espresso
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1fea2eb2f5bbd3fbbe2513d2386b5f6e6db17fd7 ]
+
+The Samsung PMIC datasheets describe the interrupt line as active low
+with a requirement of acknowledge from the CPU. Without specifying the
+interrupt type in Devicetree, kernel might apply some fixed
+configuration, not necessarily working for this hardware.
+
+Fixes: 9589f7721e16 ("arm64: dts: Add S2MPS15 PMIC node on exynos7-espresso")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201210212903.216728-8-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7-espresso.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+index 695d4c1406466..125c03f351d97 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
++++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+@@ -90,7 +90,7 @@
+ pmic@66 {
+ compatible = "samsung,s2mps15-pmic";
+ reg = <0x66>;
+- interrupts = <2 IRQ_TYPE_NONE>;
++ interrupts = <2 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-parent = <&gpa0>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pmic_irq>;
+--
+2.27.0
+
--- /dev/null
+From 63947d4c6701ae793f3180317f7093a8c1f328e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 16:50:40 +0800
+Subject: arm64: dts: meson: fix broken wifi node for Khadas VIM3L
+
+From: Artem Lapkin <email2tema@gmail.com>
+
+[ Upstream commit 39be8f441f78908e97ff913571e10ec03387a63a ]
+
+move &sd_emmc_a ... from /* */ commented area, because cant load wifi fw
+without sd-uhs-sdr50 option on VIM3L
+
+[ 11.686590] brcmfmac: brcmf_chip_cores_check: CPU core not detected
+[ 11.696382] brcmfmac: brcmf_sdio_probe_attach: brcmf_chip_attach failed!
+[ 11.706240] brcmfmac: brcmf_sdio_probe: brcmf_sdio_probe_attach failed
+[ 11.715890] brcmfmac: brcmf_ops_sdio_probe: F2 error, probe failed -19...
+[ 13.718424] brcmfmac: brcmf_chip_recognition: chip backplane type 15 is not supported
+
+Signed-off-by: Artem Lapkin <art@khadas.com>
+Fixes: f1bb924e8f5b ("arm64: dts: meson: fix mmc0 tuning error on Khadas VIM3")
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20210129085041.1408540-1-art@khadas.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
+index 4b517ca720597..06de0b1ce7267 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-khadas-vim3l.dts
+@@ -89,13 +89,12 @@
+ status = "okay";
+ };
+
+-&sd_emmc_a {
+- sd-uhs-sdr50;
+-};
+-
+ &usb {
+ phys = <&usb2_phy0>, <&usb2_phy1>;
+ phy-names = "usb2-phy0", "usb2-phy1";
+ };
+ */
+
++&sd_emmc_a {
++ sd-uhs-sdr50;
++};
+--
+2.27.0
+
--- /dev/null
+From 2797a58ccfd18ed4b7aee916411ee8595a414420 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 11:44:16 +0100
+Subject: arm64: dts: msm8916: Fix reserved and rfsa nodes unit address
+
+From: Vincent Knecht <vincent.knecht@mailoo.org>
+
+[ Upstream commit d5ae2528b0b56cf054b27d48b0cb85330900082f ]
+
+Fix `reserved` and `rfsa` unit address according to their reg address
+
+Fixes: 7258e10e6a0b ("ARM: dts: msm8916: Update reserved-memory")
+
+Signed-off-by: Vincent Knecht <vincent.knecht@mailoo.org>
+Link: https://lore.kernel.org/r/20210123104417.518105-1-vincent.knecht@mailoo.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+index 402e891a84ab6..d25f6dc751e99 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
+@@ -56,7 +56,7 @@
+ no-map;
+ };
+
+- reserved@8668000 {
++ reserved@86680000 {
+ reg = <0x0 0x86680000 0x0 0x80000>;
+ no-map;
+ };
+@@ -69,7 +69,7 @@
+ qcom,client-id = <1>;
+ };
+
+- rfsa@867e00000 {
++ rfsa@867e0000 {
+ reg = <0x0 0x867e0000 0x0 0x20000>;
+ no-map;
+ };
+--
+2.27.0
+
--- /dev/null
+From f4ffec277b37c0b99e99e455d1cb4b41c4b87ef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 22:57:23 +0100
+Subject: arm64: dts: mt8183: Add missing power-domain for pwm0 node
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 2f99fb6e46b0e982bb6ab18b24a08fa318f740ea ]
+
+The MT8183 display PWM device will not work until the associated
+power-domain is enabled. Add the power-domain reference to the node
+allows the display PWM driver to operate and the backlight turn on.
+
+Fixes: f15722c0fef0 ("arm64: dts: mt8183: Add pwm and backlight node")
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Link: https://lore.kernel.org/r/20210113215723.71966-1-enric.balletbo@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 9c0073cfad452..64fbba76597c8 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -661,6 +661,7 @@
+ compatible = "mediatek,mt8183-disp-pwm";
+ reg = <0 0x1100e000 0 0x1000>;
+ interrupts = <GIC_SPI 128 IRQ_TYPE_LEVEL_LOW>;
++ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ #pwm-cells = <2>;
+ clocks = <&topckgen CLK_TOP_MUX_DISP_PWM>,
+ <&infracfg CLK_INFRA_DISP_PWM>;
+--
+2.27.0
+
--- /dev/null
+From 81f4fc5cc6a09eec27eee14da9ffc914dd0490db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Jan 2021 11:17:26 +0100
+Subject: arm64: dts: mt8183: Fix GCE include path
+
+From: Matthias Brugger <mbrugger@suse.com>
+
+[ Upstream commit 18d6e3f6744d6105ab61de790170cb60534eeebc ]
+
+The header file of GCE should be for MT8183 SoC instead of MT8173.
+
+Fixes: 91f9c963ce79 ("arm64: dts: mt8183: Add display nodes for MT8183")
+Reported-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Matthias Brugger <mbrugger@suse.com>
+
+Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Link: https://lore.kernel.org/r/20210131101726.804-1-matthias.bgg@kernel.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 64fbba76597c8..36a90dd2fa7c6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -6,7 +6,7 @@
+ */
+
+ #include <dt-bindings/clock/mt8183-clk.h>
+-#include <dt-bindings/gce/mt8173-gce.h>
++#include <dt-bindings/gce/mt8183-gce.h>
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/memory/mt8183-larb-port.h>
+--
+2.27.0
+
--- /dev/null
+From 960233590a40f46f2c73dfbb13912dfe2eee3e3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 19:23:08 +0800
+Subject: arm64: dts: mt8183: refine gamma compatible name
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 9a2cb5eba7ad4fa7ccb3a4aa754f5263111e8f96 ]
+
+mt8183 gamma is different with mt8173
+remove mt8173 compatible name for mt8183 gamma
+
+Fixes: 91f9c963ce79 ("arm64: dts: mt8183: Add display nodes for MT8183")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20210128112314.1304160-3-hsinyi@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 6c84ccb709af6..9c0073cfad452 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -1055,8 +1055,7 @@
+ };
+
+ gamma0: gamma@14011000 {
+- compatible = "mediatek,mt8183-disp-gamma",
+- "mediatek,mt8173-disp-gamma";
++ compatible = "mediatek,mt8183-disp-gamma";
+ reg = <0 0x14011000 0 0x1000>;
+ interrupts = <GIC_SPI 234 IRQ_TYPE_LEVEL_LOW>;
+ power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+--
+2.27.0
+
--- /dev/null
+From e242defeff878949648c897d2dfca8df4edd5a0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 19:23:07 +0800
+Subject: arm64: dts: mt8183: rename rdma fifo size
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 431368c2648b59e5485a1b5f1276a83d885fb44b ]
+
+property name must include only lowercase and '-'
+
+Fixes: 91f9c963ce79 ("arm64: dts: mt8183: Add display nodes for MT8183")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20210128112314.1304160-2-hsinyi@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 5b782a4769e7e..6c84ccb709af6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -1011,7 +1011,7 @@
+ clocks = <&mmsys CLK_MM_DISP_RDMA0>;
+ iommus = <&iommu M4U_PORT_DISP_RDMA0>;
+ mediatek,larb = <&larb0>;
+- mediatek,rdma_fifo_size = <5120>;
++ mediatek,rdma-fifo-size = <5120>;
+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0xb000 0x1000>;
+ };
+
+@@ -1023,7 +1023,7 @@
+ clocks = <&mmsys CLK_MM_DISP_RDMA1>;
+ iommus = <&iommu M4U_PORT_DISP_RDMA1>;
+ mediatek,larb = <&larb0>;
+- mediatek,rdma_fifo_size = <2048>;
++ mediatek,rdma-fifo-size = <2048>;
+ mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0xc000 0x1000>;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From f5d35f405d29d144106a4522a212631e5c7e4c6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 18:53:58 +0100
+Subject: arm64: dts: qcom: msm8916-samsung-a2015: Fix sensors
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 3716a583fe0bbe3babf4ce260064a7fa13d6d989 ]
+
+When the BMC150 accelerometer/magnetometer was added to the device tree,
+the sensors were working without specifying any regulator supplies,
+likely because the regulators were on by default and then never turned off.
+
+For some reason, this is no longer the case for pm8916_l17, which prevents
+the sensors from working in some cases.
+
+Now that the bmc150_accel/bmc150_magn drivers can enable necessary
+regulators, declare the necessary regulator supplies to make the sensors
+work again.
+
+Fixes: 079f81acf10f ("arm64: dts: qcom: msm8916-samsung-a2015: Add accelerometer/magnetometer")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20210111175358.97171-1-stephan@gerhold.net
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+index f91269492d729..f1af798abd749 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a2015-common.dtsi
+@@ -106,6 +106,9 @@
+ interrupt-parent = <&msmgpio>;
+ interrupts = <115 IRQ_TYPE_EDGE_RISING>;
+
++ vdd-supply = <&pm8916_l17>;
++ vddio-supply = <&pm8916_l5>;
++
+ pinctrl-names = "default";
+ pinctrl-0 = <&accel_int_default>;
+ };
+@@ -113,6 +116,9 @@
+ magnetometer@12 {
+ compatible = "bosch,bmc150_magn";
+ reg = <0x12>;
++
++ vdd-supply = <&pm8916_l17>;
++ vddio-supply = <&pm8916_l5>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 5513d8002c2dd63093dd9e5ef23aefc2dd0c463e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 11:21:34 +0100
+Subject: arm64: dts: qcom: msm8916-samsung-a5u: Fix iris compatible
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 826e6faf49ae1eb065759a30832a2e34740bd8b1 ]
+
+Unlike most MSM8916 boards, samsung-a5u uses WCN3660B instead of
+WCN3620 to support the 5 GHz band additionally.
+
+WCN3660B has similar requirements as WCN3620, but it needs the XO
+clock to run at 48 MHz instead of 19.2 MHz. So far it was possible
+to describe that configuration using the qcom,wcn3680 compatible.
+
+However, as of commit 8490987bdb9a ("wcn36xx: Hook and identify RF_IRIS_WCN3680"),
+the wcn36xx driver will now use the qcom,wcn3680 compatible
+to enable functionality specific to WCN3680. In particular,
+WCN3680 supports 802.11ac, which is not available in WCN3660B.
+
+Use the new qcom,wcn3660b compatible to describe the chip properly.
+
+Fixes: 0d7051999175 ("arm64: dts: msm8916-samsung-a5u: Override iris compatible")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20210106102134.59801-4-stephan@gerhold.net
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts b/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
+index e39c04d977c25..dd35c3344358c 100644
+--- a/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
++++ b/arch/arm64/boot/dts/qcom/msm8916-samsung-a5u-eur.dts
+@@ -38,7 +38,7 @@
+
+ &pronto {
+ iris {
+- compatible = "qcom,wcn3680";
++ compatible = "qcom,wcn3660b";
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 7b49a01835dc5c83ad1ebfc91f451652a40f4e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 15:23:48 +0300
+Subject: arm64: dts: qcom: qrb5165-rb5: fix pm8009 regulators
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c3da02421230639bf6ee5462b70b58f5b7f3b7c6 ]
+
+Fix pm8009 compatibility string to reference pm8009 revision specific to
+sm8250 platform. Also add S2 regulator to be used for qca639x.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: b1d2674e6121 ("arm64: dts: qcom: Add basic devicetree support for QRB5165 RB5")
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20201231122348.637917-5-dmitry.baryshkov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+index f86cc5140d3b9..f13a63ca8efd6 100644
+--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+@@ -122,7 +122,7 @@
+
+ &apps_rsc {
+ pm8009-rpmh-regulators {
+- compatible = "qcom,pm8009-rpmh-regulators";
++ compatible = "qcom,pm8009-1-rpmh-regulators";
+ qcom,pmic-id = "f";
+
+ vdd-s1-supply = <&vph_pwr>;
+@@ -131,6 +131,13 @@
+ vdd-l5-l6-supply = <&vreg_bob>;
+ vdd-l7-supply = <&vreg_s4a_1p8>;
+
++ vreg_s2f_0p95: smps2 {
++ regulator-name = "vreg_s2f_0p95";
++ regulator-min-microvolt = <900000>;
++ regulator-max-microvolt = <952000>;
++ regulator-initial-mode = <RPMH_REGULATOR_MODE_AUTO>;
++ };
++
+ vreg_l1f_1p1: ldo1 {
+ regulator-name = "vreg_l1f_1p1";
+ regulator-min-microvolt = <1104000>;
+--
+2.27.0
+
--- /dev/null
+From c33d0ae710c18466699ca4e37f3ecd7b3b1daeb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 21:33:41 +0300
+Subject: arm64: dts: qcom: qrb5165-rb5: fix uSD pins drive strength
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit abf2c58aaa776cf43daf0fc4fd20082c71583c6b ]
+
+Lower drive strength for microSD data and CMD pins from 16 to 10. This
+fixes spurious card removal issues observed on some boards. Also this
+change allows us to re-enable 1.8V support, which seems to work with
+lowered drive strength.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Cc: Veerabhadrarao Badiganti <vbadigan@codeaurora.org>
+Fixes: 53a8ccf1c7e5 ("arm64: dts: qcom: rb5: Add support for uSD card")
+Link: https://lore.kernel.org/r/20201217183341.3186402-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+index ce22d4fa383e6..f86cc5140d3b9 100644
+--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+@@ -491,8 +491,6 @@
+ vqmmc-supply = <&vreg_l6c_2p96>;
+ cd-gpios = <&tlmm 77 GPIO_ACTIVE_LOW>;
+ bus-width = <4>;
+- /* there seem to be issues with HS400-1.8V mode, so disable it */
+- no-1-8-v;
+ no-sdio;
+ no-emmc;
+ };
+@@ -706,13 +704,13 @@
+ cmd {
+ pins = "sdc2_cmd";
+ bias-pull-up;
+- drive-strength = <16>;
++ drive-strength = <10>;
+ };
+
+ data {
+ pins = "sdc2_data";
+ bias-pull-up;
+- drive-strength = <16>;
++ drive-strength = <10>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 88bf9d28110663ce13e09da8f1e3c5503fe8b28d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 11:09:55 +0100
+Subject: arm64: dts: qcom: sdm845-db845c: Fix reset-pin of ov8856 node
+
+From: Robert Foss <robert.foss@linaro.org>
+
+[ Upstream commit d4863ef399a29cae3001b3fedfd2864e651055ba ]
+
+Switch reset pin of ov8856 node from GPIO_ACTIVE_HIGH to GPIO_ACTIVE_LOW,
+this issue prevented the ov8856 from probing properly as it did not respon
+to I2C messages.
+
+Fixes: d4919a44564b ("arm64: dts: qcom: sdm845-db845c: Add ov8856 & ov7251
+camera nodes")
+
+Signed-off-by: Robert Foss <robert.foss@linaro.org>
+Link: https://lore.kernel.org/r/20201221100955.148584-1-robert.foss@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index c0b93813ea9ac..c4ac6f5dc008d 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -1114,11 +1114,11 @@
+ reg = <0x10>;
+
+ // CAM0_RST_N
+- reset-gpios = <&tlmm 9 0>;
++ reset-gpios = <&tlmm 9 GPIO_ACTIVE_LOW>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&cam0_default>;
+ gpios = <&tlmm 13 0>,
+- <&tlmm 9 0>;
++ <&tlmm 9 GPIO_ACTIVE_LOW>;
+
+ clocks = <&clock_camcc CAM_CC_MCLK0_CLK>;
+ clock-names = "xvclk";
+--
+2.27.0
+
--- /dev/null
+From c53acf90625843aa87ab860235ba4c0c12d67dd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Jan 2021 04:12:52 +0300
+Subject: arm64: dts: qcom: sm8250: correct sdhc_2 xo clk
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 74097d805edb9305a2a588a8ece82d2495ff5a88 ]
+
+sdhc_2 uses 19200000 Hz clock rather than wrongly specified xo_board
+(39400000 Hz). Specify correct clock to fix DLL setup for SDR104 mode.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: c4cf0300be84 ("arm64: dts: qcom: sm8250: Add support for SDC2")
+Link: https://lore.kernel.org/r/20210109011252.3436533-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 65acd1f381eba..1ae90e8b70f32 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -1657,7 +1657,7 @@
+
+ clocks = <&gcc GCC_SDCC2_AHB_CLK>,
+ <&gcc GCC_SDCC2_APPS_CLK>,
+- <&xo_board>;
++ <&rpmhcc RPMH_CXO_CLK>;
+ clock-names = "iface", "core", "xo";
+ iommus = <&apps_smmu 0x4a0 0x0>;
+ qcom,dll-config = <0x0007642c>;
+--
+2.27.0
+
--- /dev/null
+From 87f3257f11c442649571e25042af53dae4a8f0c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 12:37:45 -0600
+Subject: arm64: dts: renesas: beacon: Fix audio-1.8V pin enable
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 5a5da0b758b327b727c5392d7f11e046e113a195 ]
+
+The fact the audio worked at all was a coincidence because the wrong
+gpio enable was used. Use the correct GPIO pin to ensure its operation.
+
+Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Link: https://lore.kernel.org/r/20201213183759.223246-6-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+index e66b5b36e4894..759734b7715bd 100644
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi
+@@ -150,7 +150,7 @@
+ regulator-name = "audio-1.8V";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+- gpio = <&gpio_exp2 7 GPIO_ACTIVE_HIGH>;
++ gpio = <&gpio_exp4 1 GPIO_ACTIVE_HIGH>;
+ enable-active-high;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 2355abaff2b080247de077418986c8824e7d7fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 12:01:36 +0100
+Subject: arm64: dts: renesas: beacon: Fix EEPROM compatible value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 74477936a828a7c91a61ba7e625b7ce2299c8c98 ]
+
+"make dtbs_check" fails with:
+
+ arch/arm64/boot/dts/renesas/r8a774b1-beacon-rzg2n-kit.dt.yaml: eeprom@50: compatible: 'oneOf' conditional failed, one must be fixed:
+ 'microchip,at24c64' does not match '^(atmel|catalyst|microchip|nxp|ramtron|renesas|rohm|st),(24(c|cs|lc|mac)[0-9]+|spd)$'
+
+Fix this by dropping the bogus "at" prefix.
+
+Fixes: a1d8a344f1ca0709 ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210128110136.2293490-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+index b93219a95afcd..ea937a926c0e3 100644
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+@@ -148,7 +148,7 @@
+ };
+
+ eeprom@50 {
+- compatible = "microchip,at24c64", "atmel,24c64";
++ compatible = "microchip,24c64", "atmel,24c64";
+ pagesize = <32>;
+ read-only; /* Manufacturing EEPROM programmed at factory */
+ reg = <0x50>;
+--
+2.27.0
+
--- /dev/null
+From 040eb88550c8dc50c6d54ada48088051b461c97a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 12:37:42 -0600
+Subject: arm64: dts: renesas: beacon kit: Fix choppy Bluetooth Audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit db030c5a9658846a42fbed4d43a8b5f28a2d7ab7 ]
+
+The Bluetooth chip is capable of operating at 4Mbps, but the
+max-speed setting was on the UART node instead of the Bluetooth
+node, so the chip didn't operate at the correct speed resulting
+in choppy audio. Fix this by setting the max-speed in the proper
+node.
+
+Fixes: a1d8a344f1ca ("arm64: dts: renesas: Introduce r8a774a1-beacon-rzg2m-kit")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Link: https://lore.kernel.org/r/20201213183759.223246-3-aford173@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+index 8ac167aa18f04..b93219a95afcd 100644
+--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+@@ -89,7 +89,6 @@
+ pinctrl-names = "default";
+ uart-has-rtscts;
+ status = "okay";
+- max-speed = <4000000>;
+
+ bluetooth {
+ compatible = "brcm,bcm43438-bt";
+@@ -98,6 +97,7 @@
+ device-wakeup-gpios = <&pca9654 5 GPIO_ACTIVE_HIGH>;
+ clocks = <&osc_32k>;
+ clock-names = "extclk";
++ max-speed = <4000000>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 42f198f5f4bc99155b7771bdad5129182dc0949f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 18:07:08 +0800
+Subject: arm64: dts: rockchip: rk3328: Add clock_in_out property to gmac2phy
+ node
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit c6433083f5930fdf52ad47c8c0459719c810dc89 ]
+
+The gmac2phy is integrated with the PHY within the SoC. Any properties
+related to this integration can be included in the .dtsi file, instead
+of having board dts files specify them separately.
+
+Add the clock_in_out property to specify the direction of the PHY clock.
+This is the minimum required to have gmac2phy working on Linux. Other
+examples include assigned-clocks, assigned-clock-rates, and
+assigned-clock-parents properties, but the hardware default plus the
+implementation requesting the appropriate clock rate also works.
+
+Fixes: 9c4cc910fe28 ("ARM64: dts: rockchip: Add gmac2phy node support for rk3328")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20210117100710.4857-2-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index db0d5c8e5f96a..93c734d8a46c2 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -928,6 +928,7 @@
+ phy-mode = "rmii";
+ phy-handle = <&phy>;
+ snps,txpbl = <0x4>;
++ clock_in_out = "output";
+ status = "disabled";
+
+ mdio {
+--
+2.27.0
+
--- /dev/null
+From e53477119f7510fd79c13e6cd8913d8d64fe0328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 16:14:29 +0000
+Subject: ASoC: codecs: add missing max_register in regmap config
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit e8820dbddbcad7e91daacf7d42a49d1d04a4e489 ]
+
+For some reason setting max_register was missed from regmap_config.
+Without this cat /sys/kernel/debug/regmap/sdw:0:217:2010:0:1/range
+actually throws below Warning.
+
+WARNING: CPU: 7 PID: 540 at drivers/base/regmap/regmap-debugfs.c:160
+ regmap_debugfs_get_dump_start.part.10+0x1e0/0x220
+...
+Call trace:
+ regmap_debugfs_get_dump_start.part.10+0x1e0/0x220
+ regmap_reg_ranges_read_file+0xc0/0x2e0
+ full_proxy_read+0x64/0x98
+ vfs_read+0xa8/0x1e0
+ ksys_read+0x6c/0x100
+ __arm64_sys_read+0x1c/0x28
+ el0_svc_common.constprop.3+0x6c/0x190
+ do_el0_svc+0x24/0x90
+ el0_svc+0x14/0x20
+ el0_sync_handler+0x90/0xb8
+ el0_sync+0x158/0x180
+...
+
+Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210201161429.28060-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wsa881x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/wsa881x.c b/sound/soc/codecs/wsa881x.c
+index 4530b74f5921b..db87e07b11c94 100644
+--- a/sound/soc/codecs/wsa881x.c
++++ b/sound/soc/codecs/wsa881x.c
+@@ -640,6 +640,7 @@ static struct regmap_config wsa881x_regmap_config = {
+ .val_bits = 8,
+ .cache_type = REGCACHE_RBTREE,
+ .reg_defaults = wsa881x_defaults,
++ .max_register = WSA881X_SPKR_STATUS3,
+ .num_reg_defaults = ARRAY_SIZE(wsa881x_defaults),
+ .volatile_reg = wsa881x_volatile_register,
+ .readable_reg = wsa881x_readable_register,
+--
+2.27.0
+
--- /dev/null
+From a05bcb33b46c3ee3a9a7657ac39674329bed0dbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 18:29:45 +0100
+Subject: ASoC: cpcap: fix microphone timeslot mask
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit de5bfae2fd962a9da99f56382305ec7966a604b9 ]
+
+The correct mask is 0x1f8 (Bit 3-8), but due to missing BIT() 0xf (Bit
+0-3) was set instead. This means setting of CPCAP_BIT_MIC1_RX_TIMESLOT0
+(Bit 3) still worked (part of both masks). On the other hand the code
+does not properly clear the other MIC timeslot bits. I think this
+is not a problem, since they are probably initialized to 0 and not
+touched by the driver anywhere else. But the mask also contains some
+wrong bits, that will be cleared. Bit 0 (CPCAP_BIT_SMB_CDC) should be
+safe, since the driver enforces it to be 0 anyways.
+
+Bit 1-2 are CPCAP_BIT_FS_INV and CPCAP_BIT_CLK_INV. This means enabling
+audio recording forces the codec into SND_SOC_DAIFMT_NB_NF mode, which
+is obviously bad.
+
+The bug probably remained undetected, because there are not many use
+cases for routing microphone to the CPU on platforms using cpcap and
+user base is small. I do remember having some issues with bad sound
+quality when testing voice recording back when I wrote the driver.
+It probably was this bug.
+
+Fixes: f6cdf2d3445d ("ASoC: cpcap: new codec")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Reviewed-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210123172945.3958622-1-sre@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cpcap.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/cpcap.c b/sound/soc/codecs/cpcap.c
+index f046987ee4cdb..c0425e3707d9c 100644
+--- a/sound/soc/codecs/cpcap.c
++++ b/sound/soc/codecs/cpcap.c
+@@ -1264,12 +1264,12 @@ static int cpcap_voice_hw_params(struct snd_pcm_substream *substream,
+
+ if (direction == SNDRV_PCM_STREAM_CAPTURE) {
+ mask = 0x0000;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT0;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT1;
+- mask |= CPCAP_BIT_MIC1_RX_TIMESLOT2;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT0;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT1;
+- mask |= CPCAP_BIT_MIC2_TIMESLOT2;
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT1);
++ mask |= BIT(CPCAP_BIT_MIC1_RX_TIMESLOT2);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT0);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT1);
++ mask |= BIT(CPCAP_BIT_MIC2_TIMESLOT2);
+ val = 0x0000;
+ if (channels >= 2)
+ val = BIT(CPCAP_BIT_MIC1_RX_TIMESLOT0);
+--
+2.27.0
+
--- /dev/null
+From b3f791fb3dc309a43a4caa3676a4fb6ab1a4a162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 13:07:59 +0300
+Subject: ASoC: cs42l56: fix up error handling in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 856fe64da84c95a1d415564b981ae3908eea2a76 ]
+
+There are two issues with this code. The first error path forgot to set
+the error code and instead returns success. The second error path
+doesn't clean up.
+
+Fixes: 272b5edd3b8f ("ASoC: Add support for CS42L56 CODEC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9NE/9nK9/TuxuL+@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs42l56.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
+index bb9599cc832bc..c44a5cdb796ec 100644
+--- a/sound/soc/codecs/cs42l56.c
++++ b/sound/soc/codecs/cs42l56.c
+@@ -1250,6 +1250,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ dev_err(&i2c_client->dev,
+ "CS42L56 Device ID (%X). Expected %X\n",
+ devid, CS42L56_DEVID);
++ ret = -EINVAL;
+ goto err_enable;
+ }
+ alpha_rev = reg & CS42L56_AREV_MASK;
+@@ -1307,7 +1308,7 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,
+ ret = devm_snd_soc_register_component(&i2c_client->dev,
+ &soc_component_dev_cs42l56, &cs42l56_dai, 1);
+ if (ret < 0)
+- return ret;
++ goto err_enable;
+
+ return 0;
+
+--
+2.27.0
+
--- /dev/null
+From 9697a14cce342eec64237fdc9a3dc7776d2cb150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 14:53:17 +0100
+Subject: ASoC: fsl_aud2htx: select SND_SOC_IMX_PCM_DMA
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a1f31cc4e98e1833f53fd2c6e9a218d6b86f5388 ]
+
+The newly added driver requires DMA support and fails to build
+when that is disabled:
+
+aarch64-linux-ld: sound/soc/fsl/fsl_aud2htx.o: in function `fsl_aud2htx_probe':
+fsl_aud2htx.c:(.text+0x3e0): undefined reference to `imx_pcm_dma_init'
+
+Fixes: 8a24c834c053 ("ASoC: fsl_aud2htx: Add aud2htx module driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Link: https://lore.kernel.org/r/20210103135327.3630973-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
+index 84db0b7b9d593..d7f30036d4343 100644
+--- a/sound/soc/fsl/Kconfig
++++ b/sound/soc/fsl/Kconfig
+@@ -108,6 +108,7 @@ config SND_SOC_FSL_XCVR
+ config SND_SOC_FSL_AUD2HTX
+ tristate "AUDIO TO HDMI TX module support"
+ depends on ARCH_MXC || COMPILE_TEST
++ select SND_SOC_IMX_PCM_DMA if SND_IMX_SOC != n
+ help
+ Say Y if you want to add AUDIO TO HDMI TX support for NXP.
+
+--
+2.27.0
+
--- /dev/null
+From 1f16bd839bd18a50a81b76fd95dc83dac59ba899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 14:33:00 -0600
+Subject: ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A5E
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit f12bbc50f3b14c9b8ed902c6d1da980dd5addcce ]
+
+We missed adding the TGL_HDMI quirk which is very much needed to
+expose the 4 display pipelines and will be required on TGL topologies.
+
+Fixes: 9ad9bc59dde10 ('ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210204203312.27112-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 6d0d6ef711e0f..29b6bba3d4257 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -73,7 +73,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A5E")
+ },
+- .driver_data = (void *)(SOF_RT711_JD_SRC_JD2 |
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_RT711_JD_SRC_JD2 |
+ SOF_RT715_DAI_ID_FIX |
+ SOF_SDW_FOUR_SPK),
+ },
+--
+2.27.0
+
--- /dev/null
+From 7aee629c4979664995d3f33f517f8ba2cb3a8d75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 14:32:59 -0600
+Subject: ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A3E
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 5ab3ff4d66960be766a544886667e7c002f17fd6 ]
+
+We missed adding the TGL_HDMI quirk which is very much needed to
+expose the 4 display pipelines and will be required on TGL topologies.
+
+Fixes: e787f5b5b1406 ('ASoC: Intel: add support for new SoundWire hardware layout on TGL')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210204203312.27112-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index afdc336ec9bf5..152ea166eeaef 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -65,7 +65,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A3E")
+ },
+- .driver_data = (void *)(SOF_RT711_JD_SRC_JD2 |
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_RT711_JD_SRC_JD2 |
+ SOF_RT715_DAI_ID_FIX),
+ },
+ {
+--
+2.27.0
+
--- /dev/null
+From e1e2f4b3b400a72536f497a7de30d44bbba0be00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 14:33:01 -0600
+Subject: ASoC: Intel: sof_sdw: add missing TGL_HDMI quirk for Dell SKU 0A32
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 45c92ec32b43c6cb42341ebf07577eefed9d87ec ]
+
+We missed adding the TGL_HDMI quirk which is very much needed to
+expose the 4 display pipelines and will be required on TGL topologies.
+
+Fixes: 488cdbd8931fe ('ASoC: Intel: sof_sdw: add quirk for new TigerLake-SDCA device')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210204203312.27112-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 29b6bba3d4257..afdc336ec9bf5 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -54,7 +54,8 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0A32")
+ },
+- .driver_data = (void *)(SOF_RT711_JD_SRC_JD2 |
++ .driver_data = (void *)(SOF_SDW_TGL_HDMI |
++ SOF_RT711_JD_SRC_JD2 |
+ SOF_RT715_DAI_ID_FIX |
+ SOF_SDW_FOUR_SPK),
+ },
+--
+2.27.0
+
--- /dev/null
+From ca4fcea3169ffa8416506ab9fbfec304abc517d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 21:56:20 +0800
+Subject: ASoC: max98373: Fixes a typo in max98373_feedback_get
+
+From: Judy Hsiao <judyhsiao@google.com>
+
+[ Upstream commit ded055eea679139f11bd808795d9697b430d1c7d ]
+
+The snd_soc_put_volsw in max98373_feedback_get is a typo, change it
+to snd_soc_get_volsw.
+
+Fixes: 349dd23931d1 ("ASoC: max98373: don't access volatile registers in bias level off")
+Signed-off-by: Judy Hsiao <judyhsiao@google.com>
+Link: https://lore.kernel.org/r/20210127135620.1143942-1-judyhsiao@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98373.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/max98373.c b/sound/soc/codecs/max98373.c
+index 31d571d4fac1c..746c829312b87 100644
+--- a/sound/soc/codecs/max98373.c
++++ b/sound/soc/codecs/max98373.c
+@@ -190,7 +190,7 @@ static int max98373_feedback_get(struct snd_kcontrol *kcontrol,
+ }
+ }
+
+- return snd_soc_put_volsw(kcontrol, ucontrol);
++ return snd_soc_get_volsw(kcontrol, ucontrol);
+ }
+
+ static const struct snd_kcontrol_new max98373_snd_controls[] = {
+--
+2.27.0
+
--- /dev/null
+From 0552f33b3f47590c9a06572159a77435478d57b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 11:57:27 +0530
+Subject: ASoC: qcom: Fix typo error in HDMI regmap config callbacks
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit e681b1a6d706b4e54c3847bb822531b4660234f3 ]
+
+Had a typo in lpass platform driver that resulted in crash
+during suspend/resume with an HDMI dongle connected.
+
+The regmap read/write/volatile regesters validation callbacks in lpass-cpu
+were using MI2S rdma_channels count instead of hdmi_rdma_channels.
+
+This typo error causing to read registers from the regmap beyond the length
+of the mapping created by ioremap().
+
+This fix avoids the need for reducing number hdmi_rdma_channels,
+which is done in
+commit 7dfe20ee92f6 ("ASoC: qcom: Fix number of HDMI RDMA channels on sc7180").
+So reverting the same.
+
+Fixes: 7cb37b7bd0d3c ("ASoC: qcom: Add support for lpass hdmi driver")
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Link: https://lore.kernel.org/r/20210202062727.22469-1-srivasam@codeaurora.org
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Tested-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-cpu.c | 8 ++++----
+ sound/soc/qcom/lpass-sc7180.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 73ca24c0a08b7..8e5415c9234f1 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -594,7 +594,7 @@ static bool lpass_hdmi_regmap_writeable(struct device *dev, unsigned int reg)
+ return true;
+ }
+
+- for (i = 0; i < v->rdma_channels; ++i) {
++ for (i = 0; i < v->hdmi_rdma_channels; ++i) {
+ if (reg == LPAIF_HDMI_RDMACTL_REG(v, i))
+ return true;
+ if (reg == LPAIF_HDMI_RDMABASE_REG(v, i))
+@@ -640,7 +640,7 @@ static bool lpass_hdmi_regmap_readable(struct device *dev, unsigned int reg)
+ if (reg == LPASS_HDMITX_APP_IRQSTAT_REG(v))
+ return true;
+
+- for (i = 0; i < v->rdma_channels; ++i) {
++ for (i = 0; i < v->hdmi_rdma_channels; ++i) {
+ if (reg == LPAIF_HDMI_RDMACTL_REG(v, i))
+ return true;
+ if (reg == LPAIF_HDMI_RDMABASE_REG(v, i))
+@@ -667,7 +667,7 @@ static bool lpass_hdmi_regmap_volatile(struct device *dev, unsigned int reg)
+ if (reg == LPASS_HDMI_TX_LEGACY_ADDR(v))
+ return true;
+
+- for (i = 0; i < v->rdma_channels; ++i) {
++ for (i = 0; i < v->hdmi_rdma_channels; ++i) {
+ if (reg == LPAIF_HDMI_RDMACURR_REG(v, i))
+ return true;
+ }
+@@ -817,7 +817,7 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
+ }
+
+ lpass_hdmi_regmap_config.max_register = LPAIF_HDMI_RDMAPER_REG(variant,
+- variant->hdmi_rdma_channels);
++ variant->hdmi_rdma_channels - 1);
+ drvdata->hdmiif_map = devm_regmap_init_mmio(dev, drvdata->hdmiif,
+ &lpass_hdmi_regmap_config);
+ if (IS_ERR(drvdata->hdmiif_map)) {
+diff --git a/sound/soc/qcom/lpass-sc7180.c b/sound/soc/qcom/lpass-sc7180.c
+index 735c9dac28f26..8c168d3c589e9 100644
+--- a/sound/soc/qcom/lpass-sc7180.c
++++ b/sound/soc/qcom/lpass-sc7180.c
+@@ -171,7 +171,7 @@ static struct lpass_variant sc7180_data = {
+ .rdma_channels = 5,
+ .hdmi_rdma_reg_base = 0x64000,
+ .hdmi_rdma_reg_stride = 0x1000,
+- .hdmi_rdma_channels = 3,
++ .hdmi_rdma_channels = 4,
+ .dmactl_audif_start = 1,
+ .wrdma_reg_base = 0x18000,
+ .wrdma_reg_stride = 0x1000,
+--
+2.27.0
+
--- /dev/null
+From fba2766712f559e0d11a249353a3e60520b226fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 20:48:24 +0530
+Subject: ASoC: qcom: lpass-cpu: Remove bit clock state check
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit 6c28377b7114d04cf82eedffe9dcc8fa66ecec48 ]
+
+No need of BCLK state maintenance from driver side as
+clock_enable and clk_disable API's maintaing state counter.
+
+One of the major issue was spotted when Headset jack inserted
+while playback continues, due to same PCM device node opens twice
+for playaback/capture and closes once for capture and playback continues.
+
+It can resolve the errors in such scenarios.
+
+Fixes: b1824968221c ("ASoC: qcom: Fix enabling BCLK and LRCLK in LPAIF invalid state")
+
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210127151824.8929-1-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-cpu.c | 22 ++++++++--------------
+ sound/soc/qcom/lpass-lpaif-reg.h | 3 ---
+ sound/soc/qcom/lpass.h | 1 -
+ 3 files changed, 8 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
+index 66b834312f330..73ca24c0a08b7 100644
+--- a/sound/soc/qcom/lpass-cpu.c
++++ b/sound/soc/qcom/lpass-cpu.c
+@@ -286,16 +286,12 @@ static int lpass_cpu_daiops_trigger(struct snd_pcm_substream *substream,
+ dev_err(dai->dev, "error writing to i2sctl reg: %d\n",
+ ret);
+
+- if (drvdata->bit_clk_state[id] == LPAIF_BIT_CLK_DISABLE) {
+- ret = clk_enable(drvdata->mi2s_bit_clk[id]);
+- if (ret) {
+- dev_err(dai->dev, "error in enabling mi2s bit clk: %d\n", ret);
+- clk_disable(drvdata->mi2s_osr_clk[id]);
+- return ret;
+- }
+- drvdata->bit_clk_state[id] = LPAIF_BIT_CLK_ENABLE;
++ ret = clk_enable(drvdata->mi2s_bit_clk[id]);
++ if (ret) {
++ dev_err(dai->dev, "error in enabling mi2s bit clk: %d\n", ret);
++ clk_disable(drvdata->mi2s_osr_clk[id]);
++ return ret;
+ }
+-
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+@@ -310,10 +306,9 @@ static int lpass_cpu_daiops_trigger(struct snd_pcm_substream *substream,
+ if (ret)
+ dev_err(dai->dev, "error writing to i2sctl reg: %d\n",
+ ret);
+- if (drvdata->bit_clk_state[id] == LPAIF_BIT_CLK_ENABLE) {
+- clk_disable(drvdata->mi2s_bit_clk[dai->driver->id]);
+- drvdata->bit_clk_state[id] = LPAIF_BIT_CLK_DISABLE;
+- }
++
++ clk_disable(drvdata->mi2s_bit_clk[dai->driver->id]);
++
+ break;
+ }
+
+@@ -866,7 +861,6 @@ int asoc_qcom_lpass_cpu_platform_probe(struct platform_device *pdev)
+ PTR_ERR(drvdata->mi2s_bit_clk[dai_id]));
+ return PTR_ERR(drvdata->mi2s_bit_clk[dai_id]);
+ }
+- drvdata->bit_clk_state[dai_id] = LPAIF_BIT_CLK_DISABLE;
+ }
+
+ /* Allocation for i2sctl regmap fields */
+diff --git a/sound/soc/qcom/lpass-lpaif-reg.h b/sound/soc/qcom/lpass-lpaif-reg.h
+index baf72f124ea9b..2eb03ad9b7c74 100644
+--- a/sound/soc/qcom/lpass-lpaif-reg.h
++++ b/sound/soc/qcom/lpass-lpaif-reg.h
+@@ -60,9 +60,6 @@
+ #define LPAIF_I2SCTL_BITWIDTH_24 1
+ #define LPAIF_I2SCTL_BITWIDTH_32 2
+
+-#define LPAIF_BIT_CLK_DISABLE 0
+-#define LPAIF_BIT_CLK_ENABLE 1
+-
+ #define LPAIF_I2SCTL_RESET_STATE 0x003C0004
+ #define LPAIF_DMACTL_RESET_STATE 0x00200000
+
+diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
+index 2d68af0da34d8..83b2e08ade060 100644
+--- a/sound/soc/qcom/lpass.h
++++ b/sound/soc/qcom/lpass.h
+@@ -68,7 +68,6 @@ struct lpass_data {
+ unsigned int mi2s_playback_sd_mode[LPASS_MAX_MI2S_PORTS];
+ unsigned int mi2s_capture_sd_mode[LPASS_MAX_MI2S_PORTS];
+ int hdmi_port_enable;
+- int bit_clk_state[LPASS_MAX_MI2S_PORTS];
+
+ /* low-power audio interface (LPAIF) registers */
+ void __iomem *lpaif;
+--
+2.27.0
+
--- /dev/null
+From 65f25f7d64779a0f20fd858fe732ad7d285fa761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 21:29:41 +0800
+Subject: ASoC: qcom: lpass: Fix i2s ctl register bit map
+
+From: Jun Nie <jun.nie@linaro.org>
+
+[ Upstream commit 5e3277ab3baff6db96ae44adf6f85d6f0f6502cc ]
+
+Fix bitwidth mapping in i2s ctl register per APQ8016 document.
+
+Fixes: b5022a36d28f ("ASoC: qcom: lpass: Use regmap_field for i2sctl and dmactl registers")
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Reviewed-by: Stephan Gerhold <stephan@gerhold.net>
+Signed-off-by: Jun Nie <jun.nie@linaro.org>
+Link: https://lore.kernel.org/r/20210201132941.460360-1-jun.nie@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-apq8016.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-apq8016.c b/sound/soc/qcom/lpass-apq8016.c
+index 8507ef8f6679b..3efa133d1c641 100644
+--- a/sound/soc/qcom/lpass-apq8016.c
++++ b/sound/soc/qcom/lpass-apq8016.c
+@@ -250,7 +250,7 @@ static struct lpass_variant apq8016_data = {
+ .micmode = REG_FIELD_ID(0x1000, 4, 7, 4, 0x1000),
+ .micmono = REG_FIELD_ID(0x1000, 3, 3, 4, 0x1000),
+ .wssrc = REG_FIELD_ID(0x1000, 2, 2, 4, 0x1000),
+- .bitwidth = REG_FIELD_ID(0x1000, 0, 0, 4, 0x1000),
++ .bitwidth = REG_FIELD_ID(0x1000, 0, 1, 4, 0x1000),
+
+ .rdma_dyncclk = REG_FIELD_ID(0x8400, 12, 12, 2, 0x1000),
+ .rdma_bursten = REG_FIELD_ID(0x8400, 11, 11, 2, 0x1000),
+--
+2.27.0
+
--- /dev/null
+From 83766ae1e4bd3b6c049e83353962865b0aefaa19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 21:32:55 +0100
+Subject: ASoC: qcom: qdsp6: Move frontend AIFs to q6asm-dai
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 6fd8d2d275f74baa7ac17b2656da1235f56dab99 ]
+
+At the moment it is necessary to set up the DAPM routes between
+front-end AIF<->DAI explicitly in the device tree, e.g. using
+
+ audio-routing =
+ "MM_DL1", "MultiMedia1 Playback",
+ "MM_DL3", "MultiMedia3 Playback",
+ "MM_DL4", "MultiMedia4 Playback",
+ "MultiMedia2 Capture", "MM_UL2";
+
+This is prone to mistakes and (sadly) there is no clear error if one
+of these routes is missing. :(
+
+Actually, this should not be necessary because the ASoC core normally
+automatically links AIF<->DAI within snd_soc_dapm_link_dai_widgets().
+This is done using the "stname" parameter of SND_SOC_DAPM_AIF_IN/OUT.
+
+For SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, 0, 0, 0),
+it should create the route from above: MM_DL1 <-> MultiMedia1 Playback.
+
+This does not work at the moment because the AIF widget (MM_DL1)
+and the DAI widget (MultiMedia1 Playback) belong to different
+DAPM contexts (q6routing / q6asm-dai).
+
+Fix this by declaring the AIF widgets in the same driver as the DAIs
+(q6asm-dai). Now the routes above are created automatically
+and no longer need to be specified in the device tree.
+
+This is also more consistent with the back-end AIFs which are already
+declared in q6afe-dais instead of q6routing. q6routing should only link
+the components together using mixers.
+
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20201211203255.148246-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/qdsp6/q6asm-dai.c | 21 +++++++++++++++++++++
+ sound/soc/qcom/qdsp6/q6routing.c | 18 ------------------
+ 2 files changed, 21 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/qcom/qdsp6/q6asm-dai.c b/sound/soc/qcom/qdsp6/q6asm-dai.c
+index c9ac9c1d26c47..9766725c29166 100644
+--- a/sound/soc/qcom/qdsp6/q6asm-dai.c
++++ b/sound/soc/qcom/qdsp6/q6asm-dai.c
+@@ -1233,6 +1233,25 @@ static void q6asm_dai_pcm_free(struct snd_soc_component *component,
+ }
+ }
+
++static const struct snd_soc_dapm_widget q6asm_dapm_widgets[] = {
++ SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL2", "MultiMedia2 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL3", "MultiMedia3 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL4", "MultiMedia4 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL5", "MultiMedia5 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL6", "MultiMedia6 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL7", "MultiMedia7 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("MM_DL8", "MultiMedia8 Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL1", "MultiMedia1 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL2", "MultiMedia2 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL3", "MultiMedia3 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL4", "MultiMedia4 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL5", "MultiMedia5 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL6", "MultiMedia6 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL7", "MultiMedia7 Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("MM_UL8", "MultiMedia8 Capture", 0, SND_SOC_NOPM, 0, 0),
++};
++
+ static const struct snd_soc_component_driver q6asm_fe_dai_component = {
+ .name = DRV_NAME,
+ .open = q6asm_dai_open,
+@@ -1245,6 +1264,8 @@ static const struct snd_soc_component_driver q6asm_fe_dai_component = {
+ .pcm_construct = q6asm_dai_pcm_new,
+ .pcm_destruct = q6asm_dai_pcm_free,
+ .compress_ops = &q6asm_dai_compress_ops,
++ .dapm_widgets = q6asm_dapm_widgets,
++ .num_dapm_widgets = ARRAY_SIZE(q6asm_dapm_widgets),
+ };
+
+ static struct snd_soc_dai_driver q6asm_fe_dais_template[] = {
+diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c
+index 53185e26fea17..0a6b9433f6acf 100644
+--- a/sound/soc/qcom/qdsp6/q6routing.c
++++ b/sound/soc/qcom/qdsp6/q6routing.c
+@@ -713,24 +713,6 @@ static const struct snd_kcontrol_new mmul8_mixer_controls[] = {
+ Q6ROUTING_TX_MIXERS(MSM_FRONTEND_DAI_MULTIMEDIA8) };
+
+ static const struct snd_soc_dapm_widget msm_qdsp6_widgets[] = {
+- /* Frontend AIF */
+- SND_SOC_DAPM_AIF_IN("MM_DL1", "MultiMedia1 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL2", "MultiMedia2 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL3", "MultiMedia3 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL4", "MultiMedia4 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL5", "MultiMedia5 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL6", "MultiMedia6 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL7", "MultiMedia7 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_IN("MM_DL8", "MultiMedia8 Playback", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL1", "MultiMedia1 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL2", "MultiMedia2 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL3", "MultiMedia3 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL4", "MultiMedia4 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL5", "MultiMedia5 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL6", "MultiMedia6 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL7", "MultiMedia7 Capture", 0, 0, 0, 0),
+- SND_SOC_DAPM_AIF_OUT("MM_UL8", "MultiMedia8 Capture", 0, 0, 0, 0),
+-
+ /* Mixer definitions */
+ SND_SOC_DAPM_MIXER("HDMI Mixer", SND_SOC_NOPM, 0, 0,
+ hdmi_mixer_controls,
+--
+2.27.0
+
--- /dev/null
+From feb6e59e0326e2941bbcaf3d355b01c4f1bee357 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 09:14:28 -0800
+Subject: ASoC: rt5682: Fix panic in rt5682_jack_detect_handler happening
+ during system shutdown
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit 45a2702ce10993eda7a5b12690294782d565519c ]
+
+During Coldboot stress tests, system encountered the following panic.
+Panic logs depicts rt5682_i2c_shutdown() happened first and then later
+jack detect handler workqueue function triggered.
+This situation causes panic as rt5682_i2c_shutdown() resets codec.
+Fix this panic by cancelling all jack detection delayed work.
+
+Panic log:
+[ 20.936124] sof_pci_shutdown
+[ 20.940248] snd_sof_device_shutdown
+[ 20.945023] snd_sof_shutdown
+[ 21.126849] rt5682_i2c_shutdown
+[ 21.286053] rt5682_jack_detect_handler
+[ 21.291235] BUG: kernel NULL pointer dereference, address: 000000000000037c
+[ 21.299302] #PF: supervisor read access in kernel mode
+[ 21.305254] #PF: error_code(0x0000) - not-present page
+[ 21.311218] PGD 0 P4D 0
+[ 21.314155] Oops: 0000 [#1] PREEMPT SMP NOPTI
+[ 21.319206] CPU: 2 PID: 123 Comm: kworker/2:3 Tainted: G U 5.4.68 #10
+[ 21.333687] ACPI: Preparing to enter system sleep state S5
+[ 21.337669] Workqueue: events_power_efficient rt5682_jack_detect_handler [snd_soc_rt5682]
+[ 21.337671] RIP: 0010:rt5682_jack_detect_handler+0x6c/0x279 [snd_soc_rt5682]
+
+Fixes: a50067d4f3c1d ('ASoC: rt5682: split i2c driver into separate module')
+Signed-off-by: Jairaj Arava <jairaj.arava@intel.com>
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@intel.com>
+Reviewed-by: Shuming Fan <shumingf@realtek.com>
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20210205171428.2344210-1-ranjani.sridharan@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682-i2c.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c
+index 37d13120f5ba8..93c1603b42f10 100644
+--- a/sound/soc/codecs/rt5682-i2c.c
++++ b/sound/soc/codecs/rt5682-i2c.c
+@@ -273,6 +273,9 @@ static void rt5682_i2c_shutdown(struct i2c_client *client)
+ {
+ struct rt5682_priv *rt5682 = i2c_get_clientdata(client);
+
++ cancel_delayed_work_sync(&rt5682->jack_detect_work);
++ cancel_delayed_work_sync(&rt5682->jd_check_work);
++
+ rt5682_reset(rt5682);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 15bc8cb7e0be182c3b1c37c4049537bb01f0d60b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 12:13:39 +0530
+Subject: ASoC: simple-card-utils: Fix device module clock
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+[ Upstream commit 1e30f642cf2939bbdac82ea0dd3071232670b5ab ]
+
+If "clocks = <&xxx>" is specified from the CPU or Codec component
+device node, the clock is not getting enabled. Thus audio playback
+or capture fails.
+
+Fix this by populating "simple_dai->clk" field when clocks property
+is specified from device node as well. Also tidy up by re-organising
+conditional statements of parsing logic.
+
+Fixes: bb6fc620c2ed ("ASoC: simple-card-utils: add asoc_simple_card_parse_clk()")
+Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://lore.kernel.org/r/1612939421-19900-2-git-send-email-spujar@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card-utils.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
+index 6cada4c1e283b..ab31045cfc952 100644
+--- a/sound/soc/generic/simple-card-utils.c
++++ b/sound/soc/generic/simple-card-utils.c
+@@ -172,16 +172,15 @@ int asoc_simple_parse_clk(struct device *dev,
+ * or device's module clock.
+ */
+ clk = devm_get_clk_from_child(dev, node, NULL);
+- if (!IS_ERR(clk)) {
+- simple_dai->sysclk = clk_get_rate(clk);
++ if (IS_ERR(clk))
++ clk = devm_get_clk_from_child(dev, dlc->of_node, NULL);
+
++ if (!IS_ERR(clk)) {
+ simple_dai->clk = clk;
+- } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
++ simple_dai->sysclk = clk_get_rate(clk);
++ } else if (!of_property_read_u32(node, "system-clock-frequency",
++ &val)) {
+ simple_dai->sysclk = val;
+- } else {
+- clk = devm_get_clk_from_child(dev, dlc->of_node, NULL);
+- if (!IS_ERR(clk))
+- simple_dai->sysclk = clk_get_rate(clk);
+ }
+
+ if (of_property_read_bool(node, "system-clock-direction-out"))
+--
+2.27.0
+
--- /dev/null
+From e5b4c9d4cc9ae7cf9af7b5c7bb488b1998df5c37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 18:38:57 +0800
+Subject: ASoC: SOF: debug: Fix a potential issue on string buffer termination
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 9037c3bde65d339017ef41d81cb58069ffc321d4 ]
+
+The function simple_write_to_buffer() doesn't add string termination
+at the end of buf, we need to handle it on our own. This change refers
+to the function tokenize_input() in debug.c and the function
+sof_dfsentry_trace_filter_write() in trace.c.
+
+Fixes: 091c12e1f50c ("ASoC: SOF: debug: add new debugfs entries for IPC flood test")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20210208103857.75705-1-hui.wang@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
+index 30213a1beaaa2..715a374b33cfb 100644
+--- a/sound/soc/sof/debug.c
++++ b/sound/soc/sof/debug.c
+@@ -352,7 +352,7 @@ static ssize_t sof_dfsentry_write(struct file *file, const char __user *buffer,
+ char *string;
+ int ret;
+
+- string = kzalloc(count, GFP_KERNEL);
++ string = kzalloc(count+1, GFP_KERNEL);
+ if (!string)
+ return -ENOMEM;
+
+--
+2.27.0
+
--- /dev/null
+From 2a9ebfead94ac268735c3365d73a49db52828228 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 11:23:45 +0200
+Subject: ASoC: SOF: Intel: hda: cancel D0i3 work during runtime suspend
+
+From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+
+[ Upstream commit 0084364d9678e9d722ee620ed916f2f9954abdbf ]
+
+Cancel the D0i3 work during runtime suspend as no streams are
+active at this point anyway.
+
+Fixes: 63e51fd33fef ("ASoC: SOF: Intel: cnl: Implement feature to support DSP D0i3 in S0")
+Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20210128092345.1033085-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dsp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c
+index 1c5e05b88a90d..1799fc56a3e41 100644
+--- a/sound/soc/sof/intel/hda-dsp.c
++++ b/sound/soc/sof/intel/hda-dsp.c
+@@ -802,11 +802,15 @@ int hda_dsp_runtime_idle(struct snd_sof_dev *sdev)
+
+ int hda_dsp_runtime_suspend(struct snd_sof_dev *sdev)
+ {
++ struct sof_intel_hda_dev *hda = sdev->pdata->hw_pdata;
+ const struct sof_dsp_power_state target_state = {
+ .state = SOF_DSP_PM_D3,
+ };
+ int ret;
+
++ /* cancel any attempt for DSP D0I3 */
++ cancel_delayed_work_sync(&hda->d0i3_work);
++
+ /* stop hda controller and power dsp off */
+ ret = hda_suspend(sdev, true);
+ if (ret < 0)
+--
+2.27.0
+
--- /dev/null
+From 45b06b1ac61529556edaa9bd4b99d969b9cd4b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 17:18:53 -0600
+Subject: ASoC: SOF: sof-pci-dev: add missing Up-Extreme quirk
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit bd8036eb15263a720b8f846861c180b27d050a09 ]
+
+The UpExtreme board supports the community key and was missed in
+previous contributions. Add it to make sure the open firmware is
+picked by default without needing a symlink on the target.
+
+Fixes: 46207ca24545 ('ASoC: SOF: pci: change the default firmware path when the community key is used')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Bard Liao <bard.liao@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20210208231853.58761-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/sof-pci-dev.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c
+index 215711ac74509..9adf50b20a735 100644
+--- a/sound/soc/sof/sof-pci-dev.c
++++ b/sound/soc/sof/sof-pci-dev.c
+@@ -65,6 +65,13 @@ static const struct dmi_system_id community_key_platforms[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "UP-APL01"),
+ }
+ },
++ {
++ .ident = "Up Extreme",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "AAEON"),
++ DMI_MATCH(DMI_BOARD_NAME, "UP-WHL01"),
++ }
++ },
+ {
+ .ident = "Google Chromebooks",
+ .matches = {
+--
+2.27.0
+
--- /dev/null
+From 0100cc8a8bedbeb6851a32e184fe88dfdb4ec762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 10:28:45 -0800
+Subject: ata: ahci_brcm: Add back regulators management
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 10340f8d7b6dd54e616339c8ccb2f397133ebea0 ]
+
+While reworking the resources management and departing from using
+ahci_platform_enable_resources() which did not allow a proper step
+separation like we need, we unfortunately lost the ability to control
+AHCI regulators. This broke some Broadcom STB systems that do expect
+regulators to be turned on to link up with attached hard drives.
+
+Fixes: c0cdf2ac4b5b ("ata: ahci_brcm: Fix AHCI resources management")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_brcm.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c
+index 49f7acbfcf01e..5b32df5d33adc 100644
+--- a/drivers/ata/ahci_brcm.c
++++ b/drivers/ata/ahci_brcm.c
+@@ -377,6 +377,10 @@ static int __maybe_unused brcm_ahci_resume(struct device *dev)
+ if (ret)
+ return ret;
+
++ ret = ahci_platform_enable_regulators(hpriv);
++ if (ret)
++ goto out_disable_clks;
++
+ brcm_sata_init(priv);
+ brcm_sata_phys_enable(priv);
+ brcm_sata_alpm_init(hpriv);
+@@ -406,6 +410,8 @@ out_disable_platform_phys:
+ ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ brcm_sata_phys_disable(priv);
++ ahci_platform_disable_regulators(hpriv);
++out_disable_clks:
+ ahci_platform_disable_clks(hpriv);
+ return ret;
+ }
+@@ -490,6 +496,10 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ if (ret)
+ goto out_reset;
+
++ ret = ahci_platform_enable_regulators(hpriv);
++ if (ret)
++ goto out_disable_clks;
++
+ /* Must be first so as to configure endianness including that
+ * of the standard AHCI register space.
+ */
+@@ -499,7 +509,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
+ if (!priv->port_mask) {
+ ret = -ENODEV;
+- goto out_disable_clks;
++ goto out_disable_regulators;
+ }
+
+ /* Must be done before ahci_platform_enable_phys() */
+@@ -524,6 +534,8 @@ out_disable_platform_phys:
+ ahci_platform_disable_phys(hpriv);
+ out_disable_phys:
+ brcm_sata_phys_disable(priv);
++out_disable_regulators:
++ ahci_platform_disable_regulators(hpriv);
+ out_disable_clks:
+ ahci_platform_disable_clks(hpriv);
+ out_reset:
+--
+2.27.0
+
--- /dev/null
+From d0c5e21466ca9044887ca953b84d9509718c24f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 00:30:10 +0530
+Subject: ath10k: Fix error handling in case of CE pipe init failure
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 31561e8557cd1eeba5806ac9ce820f8323b2201b ]
+
+Currently if the copy engine pipe init fails for snoc based
+chipsets, the rri is not freed.
+
+Fix this error handling for copy engine pipe init
+failure.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.1-01040-QCAHLSWMTPLZ-1
+
+Fixes: 4945af5b264f ("ath10k: enable SRRI/DRRI support on ddr for WCN3990")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1607713210-18320-1-git-send-email-pillair@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/snoc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index bf9a8cb713dc0..1c3307e3b1085 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1045,12 +1045,13 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar,
+ ret = ath10k_snoc_init_pipes(ar);
+ if (ret) {
+ ath10k_err(ar, "failed to initialize CE: %d\n", ret);
+- goto err_wlan_enable;
++ goto err_free_rri;
+ }
+
+ return 0;
+
+-err_wlan_enable:
++err_free_rri:
++ ath10k_ce_free_rri(ar);
+ ath10k_snoc_wlan_disable(ar);
+
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 5ec8925d8a4b3e11db0bc9092a0cdb35b1abebbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 13:32:10 +0200
+Subject: ath10k: Fix lockdep assertion warning in ath10k_sta_statistics
+
+From: Anand K Mistry <amistry@google.com>
+
+[ Upstream commit 7df28718928d08034b36168200d67b558ce36f3d ]
+
+ath10k_debug_fw_stats_request just be called with conf_mutex held,
+otherwise the following warning is seen when lock debugging is enabled:
+
+WARNING: CPU: 0 PID: 793 at drivers/net/wireless/ath/ath10k/debug.c:357 ath10k_debug_fw_stats_request+0x12c/0x133 [ath10k_core]
+Modules linked in: snd_hda_codec_hdmi designware_i2s snd_hda_intel snd_intel_dspcfg snd_hda_codec i2c_piix4 snd_hwdep snd_hda_core acpi_als kfifo_buf industrialio snd_soc_max98357a snd_soc_adau7002 snd_soc_acp_da7219mx98357_mach snd_soc_da7219 acp_audio_dma ccm xt_MASQUERADE fuse ath10k_pci ath10k_core lzo_rle ath lzo_compress mac80211 zram cfg80211 r8152 mii joydev
+CPU: 0 PID: 793 Comm: wpa_supplicant Tainted: G W 5.10.9 #5
+Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.104.0 09/05/2019
+RIP: 0010:ath10k_debug_fw_stats_request+0x12c/0x133 [ath10k_core]
+Code: 1e bb a1 ff ff ff 4c 89 ef 48 c7 c6 d3 31 2e c0 89 da 31 c0 e8 bd f8 ff ff 89 d8 eb 02 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b e9 04 ff ff ff 0f 1f 44 00 00 55 48 89 e5 41 56 53 48 89 fb
+RSP: 0018:ffffb2478099f7d0 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: ffff9e432700cce0 RCX: 11c85cfd6b8e3b00
+RDX: ffff9e432700cce0 RSI: ffff9e43127c5668 RDI: ffff9e4318deddf0
+RBP: ffffb2478099f7f8 R08: 0000000000000002 R09: 00000003fd7068cc
+R10: ffffffffc01b2749 R11: ffffffffc029efaf R12: ffff9e432700c000
+R13: ffff9e43127c33e0 R14: ffffb2478099f918 R15: ffff9e43127c33e0
+FS: 00007f7ea48e2740(0000) GS:ffff9e432aa00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000059aa799ddf38 CR3: 0000000118de2000 CR4: 00000000001506f0
+Call Trace:
+ ath10k_sta_statistics+0x4d/0x270 [ath10k_core]
+ sta_set_sinfo+0x1be/0xaec [mac80211]
+ ieee80211_get_station+0x58/0x76 [mac80211]
+ rdev_get_station+0xf1/0x11e [cfg80211]
+ nl80211_get_station+0x7f/0x146 [cfg80211]
+ genl_rcv_msg+0x32e/0x35e
+ ? nl80211_stop_ap+0x19/0x19 [cfg80211]
+ ? nl80211_get_station+0x146/0x146 [cfg80211]
+ ? genl_rcv+0x19/0x36
+ ? genl_rcv+0x36/0x36
+ netlink_rcv_skb+0x89/0xfb
+ genl_rcv+0x28/0x36
+ netlink_unicast+0x169/0x23b
+ netlink_sendmsg+0x38a/0x402
+ sock_sendmsg+0x72/0x76
+ ____sys_sendmsg+0x153/0x1cc
+ ? copy_msghdr_from_user+0x5d/0x85
+ ___sys_sendmsg+0x7c/0xb5
+ ? lock_acquire+0x181/0x23d
+ ? syscall_trace_enter+0x15e/0x160
+ ? find_held_lock+0x3d/0xb2
+ ? syscall_trace_enter+0x15e/0x160
+ ? sched_clock_cpu+0x15/0xc6
+ __sys_sendmsg+0x62/0x9a
+ do_syscall_64+0x43/0x55
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 4913e675630e ("ath10k: enable rx duration report default for wmi tlv")
+Signed-off-by: Anand K Mistry <amistry@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210202144033.1.I9e556f9fb1110d58c31d04a8a1293995fb8bb678@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 7d98250380ec5..e815aab412d7a 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -9117,7 +9117,9 @@ static void ath10k_sta_statistics(struct ieee80211_hw *hw,
+ if (!ath10k_peer_stats_enabled(ar))
+ return;
+
++ mutex_lock(&ar->conf_mutex);
+ ath10k_debug_fw_stats_request(ar);
++ mutex_unlock(&ar->conf_mutex);
+
+ sinfo->rx_duration = arsta->rx_duration;
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_DURATION);
+--
+2.27.0
+
--- /dev/null
+From 23a8fc115e5308d2947c9507a1a61ebcdb885485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 13:32:09 +0200
+Subject: ath10k: Fix suspicious RCU usage warning in
+ ath10k_wmi_tlv_parse_peer_stats_info()
+
+From: Anand K Mistry <amistry@google.com>
+
+[ Upstream commit 2615e3cdbd9c0e864f5906279c952a309871d225 ]
+
+The ieee80211_find_sta_by_ifaddr call in
+ath10k_wmi_tlv_parse_peer_stats_info must be called while holding the
+RCU read lock. Otherwise, the following warning will be seen when RCU
+usage checking is enabled:
+
+=============================
+WARNING: suspicious RCU usage
+5.10.3 #8 Tainted: G W
+-----------------------------
+include/linux/rhashtable.h:594 suspicious rcu_dereference_check() usage!
+
+other info that might help us debug this:
+
+rcu_scheduler_active = 2, debug_locks = 1
+no locks held by ksoftirqd/1/16.
+
+stack backtrace:
+CPU: 1 PID: 16 Comm: ksoftirqd/1 Tainted: G W 5.10.3 #8
+Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.104.0 09/05/2019
+Call Trace:
+ dump_stack+0xab/0x115
+ sta_info_hash_lookup+0x71/0x1e9 [mac80211]
+ ? lock_is_held_type+0xe6/0x12f
+ ? __kasan_kmalloc+0xfb/0x112
+ ieee80211_find_sta_by_ifaddr+0x12/0x61 [mac80211]
+ ath10k_wmi_tlv_parse_peer_stats_info+0xbd/0x10b [ath10k_core]
+ ath10k_wmi_tlv_iter+0x8b/0x1a1 [ath10k_core]
+ ? ath10k_wmi_tlv_iter+0x1a1/0x1a1 [ath10k_core]
+ ath10k_wmi_tlv_event_peer_stats_info+0x103/0x13b [ath10k_core]
+ ath10k_wmi_tlv_op_rx+0x722/0x80d [ath10k_core]
+ ath10k_htc_rx_completion_handler+0x16e/0x1d7 [ath10k_core]
+ ath10k_pci_process_rx_cb+0x116/0x22c [ath10k_pci]
+ ? ath10k_htc_process_trailer+0x332/0x332 [ath10k_core]
+ ? _raw_spin_unlock_irqrestore+0x34/0x61
+ ? lockdep_hardirqs_on+0x8e/0x12e
+ ath10k_ce_per_engine_service+0x55/0x74 [ath10k_core]
+ ath10k_ce_per_engine_service_any+0x76/0x84 [ath10k_core]
+ ath10k_pci_napi_poll+0x49/0x141 [ath10k_pci]
+ net_rx_action+0x11a/0x347
+ __do_softirq+0x2d3/0x539
+ run_ksoftirqd+0x4b/0x86
+ smpboot_thread_fn+0x1d0/0x2ab
+ ? cpu_report_death+0x7f/0x7f
+ kthread+0x189/0x191
+ ? cpu_report_death+0x7f/0x7f
+ ? kthread_blkcg+0x31/0x31
+ ret_from_fork+0x22/0x30
+
+Fixes: 0f7cb26830a6e ("ath10k: add rx bitrate report for SDIO")
+Signed-off-by: Anand K Mistry <amistry@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210202134451.1.I0d2e83c42755671b7143504b62787fd06cd914ed@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 7b5834157fe51..e6135795719a1 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -240,8 +240,10 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
+ __le32_to_cpu(stat->last_tx_rate_code),
+ __le32_to_cpu(stat->last_tx_bitrate_kbps));
+
++ rcu_read_lock();
+ sta = ieee80211_find_sta_by_ifaddr(ar->hw, stat->peer_macaddr.addr, NULL);
+ if (!sta) {
++ rcu_read_unlock();
+ ath10k_warn(ar, "not found station for peer stats\n");
+ return -EINVAL;
+ }
+@@ -251,6 +253,7 @@ static int ath10k_wmi_tlv_parse_peer_stats_info(struct ath10k *ar, u16 tag, u16
+ arsta->rx_bitrate_kbps = __le32_to_cpu(stat->last_rx_bitrate_kbps);
+ arsta->tx_rate_code = __le32_to_cpu(stat->last_tx_rate_code);
+ arsta->tx_bitrate_kbps = __le32_to_cpu(stat->last_tx_bitrate_kbps);
++ rcu_read_unlock();
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From fe09f4513466282ce517742b2a852cbee78bb196 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 09:29:43 +0200
+Subject: ath11k: fix a locking bug in ath11k_mac_op_start()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c202e2ebe1dc454ad54fd0018c023ec553d47284 ]
+
+This error path leads to a Smatch warning:
+
+ drivers/net/wireless/ath/ath11k/mac.c:4269 ath11k_mac_op_start()
+ error: double unlocked '&ar->conf_mutex' (orig line 4251)
+
+We're not holding the lock when we do the "goto err;" so it leads to a
+double unlock. The fix is to hold the lock for a little longer.
+
+Fixes: c83c500b55b6 ("ath11k: enable idle power save mode")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+[kvalo@codeaurora.org: move also rcu_assign_pointer() call]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/YBk4GoeE+yc0wlJH@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index c1608f64ea95d..7d799fe6fbd89 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4248,11 +4248,6 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
+ /* Configure the hash seed for hash based reo dest ring selection */
+ ath11k_wmi_pdev_lro_cfg(ar, ar->pdev->pdev_id);
+
+- mutex_unlock(&ar->conf_mutex);
+-
+- rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
+- &ab->pdevs[ar->pdev_idx]);
+-
+ /* allow device to enter IMPS */
+ if (ab->hw_params.idle_ps) {
+ ret = ath11k_wmi_pdev_set_param(ar, WMI_PDEV_PARAM_IDLE_PS_CONFIG,
+@@ -4262,6 +4257,12 @@ static int ath11k_mac_op_start(struct ieee80211_hw *hw)
+ goto err;
+ }
+ }
++
++ mutex_unlock(&ar->conf_mutex);
++
++ rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx],
++ &ab->pdevs[ar->pdev_idx]);
++
+ return 0;
+
+ err:
+--
+2.27.0
+
--- /dev/null
+From b788c081df2e882490d6c650c793f15f79f81c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 09:53:44 +0200
+Subject: ath9k: fix data bus crash when setting nf_override via debugfs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Lüssing <ll@simonwunderlich.de>
+
+[ Upstream commit 12c8f3d1cdd84f01ee777b756db9dddc1f1c9d17 ]
+
+When trying to set the noise floor via debugfs, a "data bus error"
+crash like the following can happen:
+
+[ 88.433133] Data bus error, epc == 80221c28, ra == 83314e60
+[ 88.438895] Oops[#1]:
+[ 88.441246] CPU: 0 PID: 7263 Comm: sh Not tainted 4.14.195 #0
+[ 88.447174] task: 838a1c20 task.stack: 82d5e000
+[ 88.451847] $ 0 : 00000000 00000030 deadc0de 83141de4
+[ 88.457248] $ 4 : b810a2c4 0000a2c4 83230fd4 00000000
+[ 88.462652] $ 8 : 0000000a 00000000 00000001 00000000
+[ 88.468055] $12 : 7f8ef318 00000000 00000000 77f802a0
+[ 88.473457] $16 : 83230080 00000002 0000001b 83230080
+[ 88.478861] $20 : 83a1c3f8 00841000 77f7adb0 ffffff92
+[ 88.484263] $24 : 00000fa4 77edd860
+[ 88.489665] $28 : 82d5e000 82d5fda8 00000000 83314e60
+[ 88.495070] Hi : 00000000
+[ 88.498044] Lo : 00000000
+[ 88.501040] epc : 80221c28 ioread32+0x8/0x10
+[ 88.505671] ra : 83314e60 ath9k_hw_loadnf+0x88/0x520 [ath9k_hw]
+[ 88.512049] Status: 1000fc03 KERNEL EXL IE
+[ 88.516369] Cause : 5080801c (ExcCode 07)
+[ 88.520508] PrId : 00019374 (MIPS 24Kc)
+[ 88.524556] Modules linked in: ath9k ath9k_common pppoe ppp_async l2tp_ppp cdc_mbim batman_adv ath9k_hw ath sr9700 smsc95xx sierra_net rndis_host qmi_wwan pppox ppp_generic pl2303 nf_conntrack_ipv6 mcs7830 mac80211 kalmia iptable_nat ipt_REJECT ipt_MASQUERADE huawei_cdc_ncm ftdi_sio dm9601 cfg80211 cdc_subset cdc_ncm cdc_ether cdc_eem ax88179_178a asix xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_ecn xt_dscp xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_NETMAP xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CLASSIFY usbserial usbnet usbhid slhc rtl8150 r8152 pegasus nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack
+[ 88.597894] libcrc32c kaweth iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hso hid_generic crc_ccitt compat cdc_wdm cdc_acm br_netfilter hid evdev input_core nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 l2tp_netlink l2tp_core udp_tunnel ip6_udp_tunnel xfrm6_mode_tunnel xfrm6_mode_transport xfrm6_mode_beet ipcomp6 xfrm6_tunnel esp6 ah6 xfrm4_tunnel xfrm4_mode_tunnel xfrm4_mode_transport xfrm4_mode_beet ipcomp esp4 ah4 tunnel6 tunnel4 tun xfrm_user xfrm_ipcomp af_key xfrm_algo sha256_generic sha1_generic jitterentropy_rng drbg md5 hmac echainiv des_generic deflate zlib_inflate zlib_deflate cbc authenc crypto_acompress ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common crc16 mii aead crypto_null cryptomgr crc32c_generic
+[ 88.671671] crypto_hash
+[ 88.674292] Process sh (pid: 7263, threadinfo=82d5e000, task=838a1c20, tls=77f81efc)
+[ 88.682279] Stack : 00008060 00000008 00000200 00000000 00000000 00000000 00000000 00000002
+[ 88.690916] 80500000 83230080 82d5fe22 00841000 77f7adb0 00000000 00000000 83156858
+[ 88.699553] 00000000 8352fa00 83ad62b0 835302a8 00000000 300a00f8 00000003 82d5fe38
+[ 88.708190] 82d5fef4 00000001 77f54dc4 77f80000 77f7adb0 c79fe901 00000000 00000000
+[ 88.716828] 80510000 00000002 00841000 77f54dc4 77f80000 801ce4cc 0000000b 41824292
+[ 88.725465] ...
+[ 88.727994] Call Trace:
+[ 88.730532] [<80221c28>] ioread32+0x8/0x10
+[ 88.734765] Code: 00000000 8c820000 0000000f <03e00008> 00000000 08088708 00000000 aca40000 03e00008
+[ 88.744846]
+[ 88.746464] ---[ end trace db226b2de1b69b9e ]---
+[ 88.753477] Kernel panic - not syncing: Fatal exception
+[ 88.759981] Rebooting in 3 seconds..
+
+The "REG_READ(ah, AR_PHY_AGC_CONTROL)" in ath9k_hw_loadnf() does not
+like being called when the hardware is asleep, leading to this crash.
+
+The easiest way to reproduce this is trying to set nf_override while
+the hardware is down:
+
+ $ ip link set down dev wlan0
+ $ echo "-85" > /sys/kernel/debug/ieee80211/phy0/ath9k/nf_override
+
+Fixing this crash by waking the hardware up before trying to set the
+noise floor. Similar to what other ath9k debugfs files do.
+
+Tested on a Lima board from 8devices, which has a QCA 4531 chipset.
+
+Fixes: b90189759a7f ("ath9k: add noise floor override option")
+Cc: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210209184352.4272-1-linus.luessing@c0d3.blue
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/debug.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
+index 017a43bc400ca..4c81b1d7f4171 100644
+--- a/drivers/net/wireless/ath/ath9k/debug.c
++++ b/drivers/net/wireless/ath/ath9k/debug.c
+@@ -1223,8 +1223,11 @@ static ssize_t write_file_nf_override(struct file *file,
+
+ ah->nf_override = val;
+
+- if (ah->curchan)
++ if (ah->curchan) {
++ ath9k_ps_wakeup(sc);
+ ath9k_hw_loadnf(ah, ah->curchan);
++ ath9k_ps_restore(sc);
++ }
+
+ return count;
+ }
+--
+2.27.0
+
--- /dev/null
+From 85ea41c80b984918b673f6e88d2feb89b74b5f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 17:01:02 +0100
+Subject: auxdisplay: Fix duplicate CHARLCD config symbol
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit b45616445a6e346daf8a173a0c51413aec067ebb ]
+
+A second CHARLCD config symbol was added instead of moving the existing
+one. Fix this by removing the old one.
+
+Fixes: 718e05ed92ecac0d ("auxdisplay: Introduce hd44780_common.[ch]")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/Kconfig | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
+index a2b59b84bb881..1509cb74705a3 100644
+--- a/drivers/auxdisplay/Kconfig
++++ b/drivers/auxdisplay/Kconfig
+@@ -507,6 +507,3 @@ config PANEL
+ depends on PARPORT
+ select AUXDISPLAY
+ select PARPORT_PANEL
+-
+-config CHARLCD
+- tristate "Character LCD core support" if COMPILE_TEST
+--
+2.27.0
+
--- /dev/null
+From e3f58971ae02b177e18ecba83662ad3c4d86f601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 16:39:40 +0100
+Subject: auxdisplay: ht16k33: Fix refresh rate handling
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit e89b0a426721a8ca5971bc8d70aa5ea35c020f90 ]
+
+Drop the call to msecs_to_jiffies(), as "HZ / fbdev->refresh_rate" is
+already the number of jiffies to wait.
+
+Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/ht16k33.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
+index d951d54b26f52..d8602843e8a53 100644
+--- a/drivers/auxdisplay/ht16k33.c
++++ b/drivers/auxdisplay/ht16k33.c
+@@ -117,8 +117,7 @@ static void ht16k33_fb_queue(struct ht16k33_priv *priv)
+ {
+ struct ht16k33_fbdev *fbdev = &priv->fbdev;
+
+- schedule_delayed_work(&fbdev->work,
+- msecs_to_jiffies(HZ / fbdev->refresh_rate));
++ schedule_delayed_work(&fbdev->work, HZ / fbdev->refresh_rate);
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 6b5232b19ecd6d1282ad08ce005a3ca12bbfcecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 12:05:32 +0000
+Subject: b43: N-PHY: Fix the update of coef for the PHY revision >= 3case
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4773acf3d4b50768bf08e9e97a204819e9ea0895 ]
+
+The documentation for the PHY update [1] states:
+
+Loop 4 times with index i
+
+ If PHY Revision >= 3
+ Copy table[i] to coef[i]
+ Otherwise
+ Set coef[i] to 0
+
+the copy of the table to coef is currently implemented the wrong way
+around, table is being updated from uninitialized values in coeff.
+Fix this by swapping the assignment around.
+
+[1] https://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal/
+
+Fixes: 2f258b74d13c ("b43: N-PHY: implement restoring general configuration")
+Addresses-Coverity: ("Uninitialized scalar variable")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/phy_n.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c
+index b669dff24b6e0..665b737fbb0d8 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_n.c
++++ b/drivers/net/wireless/broadcom/b43/phy_n.c
+@@ -5311,7 +5311,7 @@ static void b43_nphy_restore_cal(struct b43_wldev *dev)
+
+ for (i = 0; i < 4; i++) {
+ if (dev->phy.rev >= 3)
+- table[i] = coef[i];
++ coef[i] = table[i];
+ else
+ coef[i] = 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 9e3cd6803315cb8c88e7570f187bf46ee0447e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 16:50:15 +0800
+Subject: block: fix logging on capacity change
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 452c0bf8754fbeffdf579465b82a3c2bbe373c95 ]
+
+Local variable of 'capacity' stores the previous disk capacity, and
+'size' variable records the latest disk capacity, so swap them for
+fixing logging on capacity change.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: a782483cc1f8 ("block: remove the nr_sects field in struct hd_struct")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 9e741a4f351be..07a0ef741de19 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -74,7 +74,7 @@ bool set_capacity_and_notify(struct gendisk *disk, sector_t size)
+ return false;
+
+ pr_info("%s: detected capacity change from %lld to %lld\n",
+- disk->disk_name, size, capacity);
++ disk->disk_name, capacity, size);
+
+ /*
+ * Historically we did not send a uevent for changes to/from an empty
+--
+2.27.0
+
--- /dev/null
+From f92c5618ea74cf10c226511bf63c151f2c836d9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 16:18:22 +0100
+Subject: block: reopen the device in blkdev_reread_part
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 4601b4b130de2329fe06df80ed5d77265f2058e5 ]
+
+Historically the BLKRRPART ioctls called into the now defunct ->revalidate
+method, which caused the sd driver to check if any media is present.
+When the ->revalidate method was removed this revalidation was lost,
+leading to lots of I/O errors when using the eject command. Fix this by
+reopening the device to rescan the partitions, and thus calling the
+revalidation logic in the sd driver.
+
+Fixes: 471bd0af544b ("sd: use bdev_check_media_change")
+Reported--by: Tom Seewald <tseewald@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Tested-by: Tom Seewald <tseewald@gmail.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Minwoo Im <minwoo.im.dev@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/ioctl.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/block/ioctl.c b/block/ioctl.c
+index d61d652078f41..ff241e663c018 100644
+--- a/block/ioctl.c
++++ b/block/ioctl.c
+@@ -81,20 +81,27 @@ static int compat_blkpg_ioctl(struct block_device *bdev,
+ }
+ #endif
+
+-static int blkdev_reread_part(struct block_device *bdev)
++static int blkdev_reread_part(struct block_device *bdev, fmode_t mode)
+ {
+- int ret;
++ struct block_device *tmp;
+
+ if (!disk_part_scan_enabled(bdev->bd_disk) || bdev_is_partition(bdev))
+ return -EINVAL;
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
+
+- mutex_lock(&bdev->bd_mutex);
+- ret = bdev_disk_changed(bdev, false);
+- mutex_unlock(&bdev->bd_mutex);
++ /*
++ * Reopen the device to revalidate the driver state and force a
++ * partition rescan.
++ */
++ mode &= ~FMODE_EXCL;
++ set_bit(GD_NEED_PART_SCAN, &bdev->bd_disk->state);
+
+- return ret;
++ tmp = blkdev_get_by_dev(bdev->bd_dev, mode, NULL);
++ if (IS_ERR(tmp))
++ return PTR_ERR(tmp);
++ blkdev_put(tmp, mode);
++ return 0;
+ }
+
+ static int blk_ioctl_discard(struct block_device *bdev, fmode_t mode,
+@@ -498,7 +505,7 @@ static int blkdev_common_ioctl(struct block_device *bdev, fmode_t mode,
+ bdev->bd_bdi->ra_pages = (arg * 512) / PAGE_SIZE;
+ return 0;
+ case BLKRRPART:
+- return blkdev_reread_part(bdev);
++ return blkdev_reread_part(bdev, mode);
+ case BLKTRACESTART:
+ case BLKTRACESTOP:
+ case BLKTRACETEARDOWN:
+--
+2.27.0
+
--- /dev/null
+From 8d6a2f9ea0b299724969aba5134a14666162302d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 10:46:58 +0100
+Subject: Bluetooth: btqcomsmd: Fix a resource leak in error handling paths in
+ the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 9a39a927be01d89e53f04304ab99a8761e08910d ]
+
+Some resource should be released in the error handling path of the probe
+function, as already done in the remove function.
+
+The remove function was fixed in commit 5052de8deff5 ("soc: qcom: smd:
+Transition client drivers from smd to rpmsg")
+
+Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btqcomsmd.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
+index 98d53764871f5..2acb719e596f5 100644
+--- a/drivers/bluetooth/btqcomsmd.c
++++ b/drivers/bluetooth/btqcomsmd.c
+@@ -142,12 +142,16 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+
+ btq->cmd_channel = qcom_wcnss_open_channel(wcnss, "APPS_RIVA_BT_CMD",
+ btqcomsmd_cmd_callback, btq);
+- if (IS_ERR(btq->cmd_channel))
+- return PTR_ERR(btq->cmd_channel);
++ if (IS_ERR(btq->cmd_channel)) {
++ ret = PTR_ERR(btq->cmd_channel);
++ goto destroy_acl_channel;
++ }
+
+ hdev = hci_alloc_dev();
+- if (!hdev)
+- return -ENOMEM;
++ if (!hdev) {
++ ret = -ENOMEM;
++ goto destroy_cmd_channel;
++ }
+
+ hci_set_drvdata(hdev, btq);
+ btq->hdev = hdev;
+@@ -161,14 +165,21 @@ static int btqcomsmd_probe(struct platform_device *pdev)
+ hdev->set_bdaddr = qca_set_bdaddr_rome;
+
+ ret = hci_register_dev(hdev);
+- if (ret < 0) {
+- hci_free_dev(hdev);
+- return ret;
+- }
++ if (ret < 0)
++ goto hci_free_dev;
+
+ platform_set_drvdata(pdev, btq);
+
+ return 0;
++
++hci_free_dev:
++ hci_free_dev(hdev);
++destroy_cmd_channel:
++ rpmsg_destroy_ept(btq->cmd_channel);
++destroy_acl_channel:
++ rpmsg_destroy_ept(btq->acl_channel);
++
++ return ret;
+ }
+
+ static int btqcomsmd_remove(struct platform_device *pdev)
+--
+2.27.0
+
--- /dev/null
+From 11f1f69cabaab1a6b96d87913e20e94eeb73e805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 09:39:13 +0800
+Subject: Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jupeng Zhong <zhongjupeng@yulong.com>
+
+[ Upstream commit de71a6cb4bf24d8993b9ca90d1ddb131b60251a1 ]
+
+In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should be
+released.
+
+Omit the labels “err_out” and “err_free_skb” in this function
+implementation so that the desired exception handling code
+would be directly specified in the affected if branches.
+
+Fixes: a1c49c434e15 ("btusb: Add protocol support for MediaTek MT7668U USB devices")
+Signed-off-by: Jupeng Zhong <zhongjupeng@yulong.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index da57c561642c4..a4f834a50a988 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3195,7 +3195,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
+ if (!skb) {
+ hdev->stat.err_rx++;
+- goto err_out;
++ return;
+ }
+
+ hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
+@@ -3213,13 +3213,18 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ */
+ if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
+ data->evt_skb = skb_clone(skb, GFP_ATOMIC);
+- if (!data->evt_skb)
+- goto err_out;
++ if (!data->evt_skb) {
++ kfree_skb(skb);
++ return;
++ }
+ }
+
+ err = hci_recv_frame(hdev, skb);
+- if (err < 0)
+- goto err_free_skb;
++ if (err < 0) {
++ kfree_skb(data->evt_skb);
++ data->evt_skb = NULL;
++ return;
++ }
+
+ if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
+ &data->flags)) {
+@@ -3228,11 +3233,6 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
+ wake_up_bit(&data->flags,
+ BTUSB_TX_WAIT_VND_EVT);
+ }
+-err_out:
+- return;
+-err_free_skb:
+- kfree_skb(data->evt_skb);
+- data->evt_skb = NULL;
+ return;
+ } else if (urb->status == -ENOENT) {
+ /* Avoid suspend failed when usb_kill_urb */
+--
+2.27.0
+
--- /dev/null
+From ab26dbae66ec6ddd85a2748070dd78d4f4a3d50e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 23:34:19 -0800
+Subject: Bluetooth: drop HCI device reference before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 5a3ef03afe7e12982dc3b978f4c5077c907f7501 ]
+
+Call hci_dev_put() to decrement reference count of HCI device hdev if
+fails to duplicate memory.
+
+Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/a2mp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index cc26e4c047ad0..463bad58478b2 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -512,6 +512,7 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
+ if (!assoc) {
+ amp_ctrl_put(ctrl);
++ hci_dev_put(hdev);
+ return -ENOMEM;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 40c27e9e134f69f380585491cb83fb8300b590da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 19:12:32 -0800
+Subject: Bluetooth: Fix initializing response id after clearing struct
+
+From: Christopher William Snowhill <chris@kode54.net>
+
+[ Upstream commit a5687c644015a097304a2e47476c0ecab2065734 ]
+
+Looks like this was missed when patching the source to clear the structures
+throughout, causing this one instance to clear the struct after the response
+id is assigned.
+
+Fixes: eddb7732119d ("Bluetooth: A2MP: Fix not initializing all members")
+Signed-off-by: Christopher William Snowhill <chris@kode54.net>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/a2mp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+index da7fd7c8c2dc0..cc26e4c047ad0 100644
+--- a/net/bluetooth/a2mp.c
++++ b/net/bluetooth/a2mp.c
+@@ -381,9 +381,9 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+ hdev = hci_dev_get(req->id);
+ if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
+ struct a2mp_amp_assoc_rsp rsp;
+- rsp.id = req->id;
+
+ memset(&rsp, 0, sizeof(rsp));
++ rsp.id = req->id;
+
+ if (tmp) {
+ rsp.status = A2MP_STATUS_COLLISION_OCCURED;
+--
+2.27.0
+
--- /dev/null
+From f9def73f805dbc48f8638db51e6961e785c06098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 20:27:42 +0530
+Subject: Bluetooth: hci_qca: check for SSR triggered flag while suspend
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit 1bb0c66332babc5cbc4581d962da0b03af9f23e8 ]
+
+QCA_IBS_DISABLED flag will be set after memorydump started from
+controller.Currently qca_suspend() is waiting for SSR to complete
+based on flag QCA_IBS_DISABLED.Added to check for QCA_SSR_TRIGGERED
+flag too.
+
+Fixes: 2be43abac5a8 ("Bluetooth: hci_qca: Wait for timeout during suspend")
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 17a3859326dc7..ff2fb68a45b1e 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -2111,7 +2111,8 @@ static int __maybe_unused qca_suspend(struct device *dev)
+ !test_bit(QCA_SSR_TRIGGERED, &qca->flags))
+ return 0;
+
+- if (test_bit(QCA_IBS_DISABLED, &qca->flags)) {
++ if (test_bit(QCA_IBS_DISABLED, &qca->flags) ||
++ test_bit(QCA_SSR_TRIGGERED, &qca->flags)) {
+ wait_timeout = test_bit(QCA_SSR_TRIGGERED, &qca->flags) ?
+ IBS_DISABLE_SSR_TIMEOUT_MS :
+ FW_DOWNLOAD_TIMEOUT_MS;
+--
+2.27.0
+
--- /dev/null
+From 7e097f9b27850a139ffb98a0b101e483ab84f5dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 13:47:55 +0800
+Subject: Bluetooth: hci_qca: Fix memleak in qca_controller_memdump
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 71f8e707557b9bc25dc90a59a752528d4e7c1cbf ]
+
+When __le32_to_cpu() fails, qca_memdump should be freed
+just like when vmalloc() fails.
+
+Fixes: d841502c79e3f ("Bluetooth: hci_qca: Collect controller memory dump during SSR")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 4a963682c7021..5dbcb7c42b805 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1024,7 +1024,9 @@ static void qca_controller_memdump(struct work_struct *work)
+ dump_size = __le32_to_cpu(dump->dump_size);
+ if (!(dump_size)) {
+ bt_dev_err(hu->hdev, "Rx invalid memdump size");
++ kfree(qca_memdump);
+ kfree_skb(skb);
++ qca->qca_memdump = NULL;
+ mutex_unlock(&qca->hci_memdump_lock);
+ return;
+ }
+--
+2.27.0
+
--- /dev/null
+From 93d56778b167a127f7cd1d1eb5dc36879915af19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 21:07:16 +0530
+Subject: Bluetooth: hci_qca: Fixed issue during suspend
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit 55c0bd77479b60ea29fd390faf4545cfb3a1d79e ]
+
+If BT SoC is running with ROM FW then just return in
+qca_suspend function as ROM FW does not support
+in-band sleep.
+
+Fixes: 2be43abac5a8 ("Bluetooth: hci_qca: Wait for timeout during suspend")
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index ff2fb68a45b1e..de36af63e1825 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -77,7 +77,8 @@ enum qca_flags {
+ QCA_MEMDUMP_COLLECTION,
+ QCA_HW_ERROR_EVENT,
+ QCA_SSR_TRIGGERED,
+- QCA_BT_OFF
++ QCA_BT_OFF,
++ QCA_ROM_FW
+ };
+
+ enum qca_capabilities {
+@@ -1664,6 +1665,7 @@ static int qca_setup(struct hci_uart *hu)
+ if (ret)
+ return ret;
+
++ clear_bit(QCA_ROM_FW, &qca->flags);
+ /* Patch downloading has to be done without IBS mode */
+ set_bit(QCA_IBS_DISABLED, &qca->flags);
+
+@@ -1721,12 +1723,14 @@ retry:
+ hu->hdev->cmd_timeout = qca_cmd_timeout;
+ } else if (ret == -ENOENT) {
+ /* No patch/nvm-config found, run with original fw/config */
++ set_bit(QCA_ROM_FW, &qca->flags);
+ ret = 0;
+ } else if (ret == -EAGAIN) {
+ /*
+ * Userspace firmware loader will return -EAGAIN in case no
+ * patch/nvm-config is found, so run with original fw/config.
+ */
++ set_bit(QCA_ROM_FW, &qca->flags);
+ ret = 0;
+ }
+
+@@ -2103,6 +2107,12 @@ static int __maybe_unused qca_suspend(struct device *dev)
+
+ set_bit(QCA_SUSPENDING, &qca->flags);
+
++ /* if BT SoC is running with default firmware then it does not
++ * support in-band sleep
++ */
++ if (test_bit(QCA_ROM_FW, &qca->flags))
++ return 0;
++
+ /* During SSR after memory dump collection, controller will be
+ * powered off and then powered on.If controller is powered off
+ * during SSR then we should wait until SSR is completed.
+--
+2.27.0
+
--- /dev/null
+From 4ec34984d8c7d524dbfe7ee20551061524a8aa0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 22:47:08 +0530
+Subject: Bluetooth: hci_qca: Wait for SSR completion during suspend
+
+From: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+
+[ Upstream commit ad3a9c0ec2d2baed936cfdd05870f9d1e1f40e0e ]
+
+During SSR after memory dump collection,BT controller will be powered off,
+powered on and then FW will be downloaded.During suspend if BT controller
+is powered off due to SSR then we should wait until SSR is completed and
+then suspend.
+
+Fixes: 2be43abac5a8 ("Bluetooth: hci_qca: Wait for timeout during suspend")
+Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 5dbcb7c42b805..17a3859326dc7 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -50,7 +50,8 @@
+ #define IBS_HOST_TX_IDLE_TIMEOUT_MS 2000
+ #define CMD_TRANS_TIMEOUT_MS 100
+ #define MEMDUMP_TIMEOUT_MS 8000
+-#define IBS_DISABLE_SSR_TIMEOUT_MS (MEMDUMP_TIMEOUT_MS + 1000)
++#define IBS_DISABLE_SSR_TIMEOUT_MS \
++ (MEMDUMP_TIMEOUT_MS + FW_DOWNLOAD_TIMEOUT_MS)
+ #define FW_DOWNLOAD_TIMEOUT_MS 3000
+
+ /* susclk rate */
+@@ -2102,7 +2103,12 @@ static int __maybe_unused qca_suspend(struct device *dev)
+
+ set_bit(QCA_SUSPENDING, &qca->flags);
+
+- if (test_bit(QCA_BT_OFF, &qca->flags))
++ /* During SSR after memory dump collection, controller will be
++ * powered off and then powered on.If controller is powered off
++ * during SSR then we should wait until SSR is completed.
++ */
++ if (test_bit(QCA_BT_OFF, &qca->flags) &&
++ !test_bit(QCA_SSR_TRIGGERED, &qca->flags))
+ return 0;
+
+ if (test_bit(QCA_IBS_DISABLED, &qca->flags)) {
+@@ -2112,7 +2118,7 @@ static int __maybe_unused qca_suspend(struct device *dev)
+
+ /* QCA_IBS_DISABLED flag is set to true, During FW download
+ * and during memory dump collection. It is reset to false,
+- * After FW download complete and after memory dump collections.
++ * After FW download complete.
+ */
+ wait_on_bit_timeout(&qca->flags, QCA_IBS_DISABLED,
+ TASK_UNINTERRUPTIBLE, msecs_to_jiffies(wait_timeout));
+@@ -2124,10 +2130,6 @@ static int __maybe_unused qca_suspend(struct device *dev)
+ }
+ }
+
+- /* After memory dump collection, Controller is powered off.*/
+- if (test_bit(QCA_BT_OFF, &qca->flags))
+- return 0;
+-
+ cancel_work_sync(&qca->ws_awake_device);
+ cancel_work_sync(&qca->ws_awake_rx);
+
+--
+2.27.0
+
--- /dev/null
+From 1a1dc599390843f7ec634274d4dcf06acd017bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 15:29:21 +0800
+Subject: Bluetooth: hci_uart: Fix a race for write_work scheduling
+
+From: Claire Chang <tientzu@chromium.org>
+
+[ Upstream commit afe0b1c86458f121b085271e4f3034017a90d4a3 ]
+
+In hci_uart_write_work, there is a loop/goto checking the value of
+HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
+hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.
+
+In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
+HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
+hci_uart_write_work worker will do hci_uart_dequeue properly.
+
+However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
+the loop breaks, but before HCI_UART_SENDING is cleared in
+hci_uart_write_work, the schedule_work is skipped incorrectly.
+
+Fix this race by changing the order of HCI_UART_SENDING and
+HCI_UART_TX_WAKEUP modification.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Fixes: 82f5169bf3d3 ("Bluetooth: hci_uart: add serdev driver support library")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_ldisc.c | 7 +++----
+ drivers/bluetooth/hci_serdev.c | 4 ++--
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index f83d67eafc9f0..8be4d807d1370 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -127,10 +127,9 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
+ if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
+ goto no_schedule;
+
+- if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
+- set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
++ set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
++ if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state))
+ goto no_schedule;
+- }
+
+ BT_DBG("");
+
+@@ -174,10 +173,10 @@ restart:
+ kfree_skb(skb);
+ }
+
++ clear_bit(HCI_UART_SENDING, &hu->tx_state);
+ if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
+ goto restart;
+
+- clear_bit(HCI_UART_SENDING, &hu->tx_state);
+ wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
+ }
+
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index ef96ad06fa54e..9e03402ef1b37 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -83,9 +83,9 @@ static void hci_uart_write_work(struct work_struct *work)
+ hci_uart_tx_complete(hu, hci_skb_pkt_type(skb));
+ kfree_skb(skb);
+ }
+- } while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
+
+- clear_bit(HCI_UART_SENDING, &hu->tx_state);
++ clear_bit(HCI_UART_SENDING, &hu->tx_state);
++ } while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
+ }
+
+ /* ------- Interface to HCI layer ------ */
+--
+2.27.0
+
--- /dev/null
+From 07dd95dbc93c15e21add600f43adc1328a29c41d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 00:10:45 -0800
+Subject: Bluetooth: Put HCI device if inquiry procedure interrupts
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 28a758c861ff290e39d4f1ee0aa5df0f0b9a45ee ]
+
+Jump to the label done to decrement the reference count of HCI device
+hdev on path that the Inquiry procedure is interrupted.
+
+Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 9d2c9a1c552fd..9f8573131b97e 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1362,8 +1362,10 @@ int hci_inquiry(void __user *arg)
+ * cleared). If it is interrupted by a signal, return -EINTR.
+ */
+ if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
+- TASK_INTERRUPTIBLE))
+- return -EINTR;
++ TASK_INTERRUPTIBLE)) {
++ err = -EINTR;
++ goto done;
++ }
+ }
+
+ /* for unlimited number of responses we will use buffer with
+--
+2.27.0
+
--- /dev/null
+From b898a0d42fb16946aa47d1065c6b7172ce19da37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 16:12:54 -0800
+Subject: Bluetooth: Remove hci_req_le_suspend_config
+
+From: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+
+[ Upstream commit 295fa2a5647b13681594bb1bcc76c74619035218 ]
+
+Add a missing SUSPEND_SCAN_ENABLE in passive scan, remove the separate
+function for configuring le scan during suspend and update the request
+complete function to clear both enable and disable tasks.
+
+Fixes: dce0a4be8054 ("Bluetooth: Set missing suspend task bits")
+Reviewed-by: Alain Michaud <alainm@chromium.org>
+Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_request.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 71bffd7454720..5aa7bd5030a21 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -1087,6 +1087,8 @@ void hci_req_add_le_passive_scan(struct hci_request *req)
+ if (hdev->suspended) {
+ window = hdev->le_scan_window_suspend;
+ interval = hdev->le_scan_int_suspend;
++
++ set_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks);
+ } else if (hci_is_le_conn_scanning(hdev)) {
+ window = hdev->le_scan_window_connect;
+ interval = hdev->le_scan_int_connect;
+@@ -1170,19 +1172,6 @@ static void hci_req_set_event_filter(struct hci_request *req)
+ hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+ }
+
+-static void hci_req_config_le_suspend_scan(struct hci_request *req)
+-{
+- /* Before changing params disable scan if enabled */
+- if (hci_dev_test_flag(req->hdev, HCI_LE_SCAN))
+- hci_req_add_le_scan_disable(req, false);
+-
+- /* Configure params and enable scanning */
+- hci_req_add_le_passive_scan(req);
+-
+- /* Block suspend notifier on response */
+- set_bit(SUSPEND_SCAN_ENABLE, req->hdev->suspend_tasks);
+-}
+-
+ static void cancel_adv_timeout(struct hci_dev *hdev)
+ {
+ if (hdev->adv_instance_timeout) {
+@@ -1245,8 +1234,10 @@ static void suspend_req_complete(struct hci_dev *hdev, u8 status, u16 opcode)
+ {
+ bt_dev_dbg(hdev, "Request complete opcode=0x%x, status=0x%x", opcode,
+ status);
+- if (test_and_clear_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks) ||
+- test_and_clear_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks)) {
++ if (test_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks) ||
++ test_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks)) {
++ clear_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks);
++ clear_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks);
+ wake_up(&hdev->suspend_wait_q);
+ }
+ }
+@@ -1336,7 +1327,7 @@ void hci_req_prepare_suspend(struct hci_dev *hdev, enum suspended_state next)
+ /* Enable event filter for paired devices */
+ hci_req_set_event_filter(&req);
+ /* Enable passive scan at lower duty cycle */
+- hci_req_config_le_suspend_scan(&req);
++ __hci_update_background_scan(&req);
+ /* Pause scan changes again. */
+ hdev->scanning_paused = true;
+ hci_req_run(&req, suspend_req_complete);
+@@ -1346,7 +1337,7 @@ void hci_req_prepare_suspend(struct hci_dev *hdev, enum suspended_state next)
+
+ hci_req_clear_event_filter(&req);
+ /* Reset passive/background scanning to normal */
+- hci_req_config_le_suspend_scan(&req);
++ __hci_update_background_scan(&req);
+
+ /* Unpause directed advertising */
+ hdev->advertising_paused = false;
+--
+2.27.0
+
--- /dev/null
+From 611814e2bbb378452d7367203f86ba615e1ce677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 02:24:24 -0500
+Subject: bnxt_en: Fix devlink info's stored fw.psid version format.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit db28b6c77f4050f62599267a886b61fbd6504633 ]
+
+The running fw.psid version is in decimal format but the stored
+fw.psid is in hex format. This can mislead the user to reset the
+NIC to activate the stored version to become the running version.
+
+Fix it to display the stored fw.psid in decimal format.
+
+Fixes: 1388875b3916 ("bnxt_en: Add stored FW version info to devlink info_get cb.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+index 6b7b69ed62db0..a9bcf887d2fbe 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -472,8 +472,8 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
+ if (BNXT_PF(bp) && !bnxt_hwrm_get_nvm_cfg_ver(bp, &nvm_cfg_ver)) {
+ u32 ver = nvm_cfg_ver.vu32;
+
+- sprintf(buf, "%X.%X.%X", (ver >> 16) & 0xF, (ver >> 8) & 0xF,
+- ver & 0xF);
++ sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xf, (ver >> 8) & 0xf,
++ ver & 0xf);
+ rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_STORED,
+ DEVLINK_INFO_VERSION_GENERIC_FW_PSID,
+ buf);
+--
+2.27.0
+
--- /dev/null
+From 0a34a6c26884ba7d114fee6c91767ff624ba0ce5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 02:24:23 -0500
+Subject: bnxt_en: reverse order of TX disable and carrier off
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit 132e0b65dc2b8bfa9721bfce834191f24fd1d7ed ]
+
+A TX queue can potentially immediately timeout after it is stopped
+and the last TX timestamp on that queue was more than 5 seconds ago with
+carrier still up. Prevent these intermittent false TX timeouts
+by bringing down carrier first before calling netif_tx_disable().
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index d10e4f85dd11a..1c96b7ba24f28 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8856,9 +8856,10 @@ void bnxt_tx_disable(struct bnxt *bp)
+ txr->dev_state = BNXT_DEV_STATE_CLOSING;
+ }
+ }
++ /* Drop carrier first to prevent TX timeout */
++ netif_carrier_off(bp->dev);
+ /* Stop all TX queues */
+ netif_tx_disable(bp->dev);
+- netif_carrier_off(bp->dev);
+ }
+
+ void bnxt_tx_enable(struct bnxt *bp)
+--
+2.27.0
+
--- /dev/null
+From 7645393ea136eca878bda71ec20acfc301552278 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:14 -0800
+Subject: bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit a643bff752dcf72a07e1b2ab2f8587e4f51118be ]
+
+Add bpf_patch_call_args() prototype. This function is called from BPF verifier
+and only if CONFIG_BPF_JIT_ALWAYS_ON is not defined. This fixes compiler
+warning about missing prototype in some kernel configurations.
+
+Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-2-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 07cb5d15e7439..ef9309604b3e5 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -1403,7 +1403,10 @@ static inline void bpf_long_memcpy(void *dst, const void *src, u32 size)
+ /* verify correctness of eBPF program */
+ int bpf_check(struct bpf_prog **fp, union bpf_attr *attr,
+ union bpf_attr __user *uattr);
++
++#ifndef CONFIG_BPF_JIT_ALWAYS_ON
+ void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);
++#endif
+
+ struct btf *bpf_get_btf_vmlinux(void);
+
+--
+2.27.0
+
--- /dev/null
+From 06186fb9d784671bda576a4c360c08dee0d2cfae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:15 -0800
+Subject: bpf: Avoid warning when re-casting __bpf_call_base into
+ __bpf_call_base_args
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 6943c2b05bf09fd5c5729f7d7d803bf3f126cb9a ]
+
+BPF interpreter uses extra input argument, so re-casts __bpf_call_base into
+__bpf_call_base_args. Avoid compiler warning about incompatible function
+prototypes by casting to void * first.
+
+Fixes: 1ea47e01ad6e ("bpf: add support for bpf_call to interpreter")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-3-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 29c27656165b2..5edf2b6608812 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -886,7 +886,7 @@ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);
+ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);
+ #define __bpf_call_base_args \
+ ((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \
+- __bpf_call_base)
++ (void *)__bpf_call_base)
+
+ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog);
+ void bpf_jit_compile(struct bpf_prog *prog);
+--
+2.27.0
+
--- /dev/null
+From 26578e84397bc479966be8d2f86e96384cf82802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 05:04:08 +0100
+Subject: bpf: Clear subreg_def for global function return values
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 45159b27637b0fef6d5ddb86fc7c46b13c77960f ]
+
+test_global_func4 fails on s390 as reported by Yauheni in [1].
+
+The immediate problem is that the zext code includes the instruction,
+whose result needs to be zero-extended, into the zero-extension
+patchlet, and if this instruction happens to be a branch, then its
+delta is not adjusted. As a result, the verifier rejects the program
+later.
+
+However, according to [2], as far as the verifier's algorithm is
+concerned and as specified by the insn_no_def() function, branching
+insns do not define anything. This includes call insns, even though
+one might argue that they define %r0.
+
+This means that the real problem is that zero extension kicks in at
+all. This happens because clear_caller_saved_regs() sets BPF_REG_0's
+subreg_def after global function calls. This can be fixed in many
+ways; this patch mimics what helper function call handling already
+does.
+
+ [1] https://lore.kernel.org/bpf/20200903140542.156624-1-yauheni.kaliuta@redhat.com/
+ [2] https://lore.kernel.org/bpf/CAADnVQ+2RPKcftZw8d+B1UwB35cpBhpF5u3OocNh90D9pETPwg@mail.gmail.com/
+
+Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
+Reported-by: Yauheni Kaliuta <yauheni.kaliuta@redhat.com>
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210212040408.90109-1-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 20babdd06278f..33683eafea90e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4834,8 +4834,9 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+ subprog);
+ clear_caller_saved_regs(env, caller->regs);
+
+- /* All global functions return SCALAR_VALUE */
++ /* All global functions return a 64-bit SCALAR_VALUE */
+ mark_reg_unknown(env, caller->regs, BPF_REG_0);
++ caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
+
+ /* continue with next insn after call */
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 880278d25968328205dc6a9eb320a6eae1ff130f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:16 -0800
+Subject: bpf: Declare __bpf_free_used_maps() unconditionally
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 936f8946bdb48239f4292812d4d2e26c6d328c95 ]
+
+__bpf_free_used_maps() is always defined in kernel/bpf/core.c, while
+include/linux/bpf.h is guarding it behind CONFIG_BPF_SYSCALL. Move it out of
+that guard region and fix compiler warning.
+
+Fixes: a2ea07465c8d ("bpf: Fix missing prog untrack in release_maps")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-4-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index ef9309604b3e5..6e585dbc10df3 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -1206,8 +1206,6 @@ void bpf_prog_sub(struct bpf_prog *prog, int i);
+ void bpf_prog_inc(struct bpf_prog *prog);
+ struct bpf_prog * __must_check bpf_prog_inc_not_zero(struct bpf_prog *prog);
+ void bpf_prog_put(struct bpf_prog *prog);
+-void __bpf_free_used_maps(struct bpf_prog_aux *aux,
+- struct bpf_map **used_maps, u32 len);
+
+ void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock);
+ void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock);
+@@ -1676,6 +1674,9 @@ static inline struct bpf_prog *bpf_prog_get_type(u32 ufd,
+ return bpf_prog_get_type_dev(ufd, type, false);
+ }
+
++void __bpf_free_used_maps(struct bpf_prog_aux *aux,
++ struct bpf_map **used_maps, u32 len);
++
+ bool bpf_prog_get_ok(struct bpf_prog *, enum bpf_prog_type *, bool);
+
+ int bpf_prog_offload_compile(struct bpf_prog *prog);
+--
+2.27.0
+
--- /dev/null
+From a64324a9ef56dff425b766be3c507a74bb5f660a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 08:24:52 +0000
+Subject: bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jun'ichi Nomura <junichi.nomura@nec.com>
+
+[ Upstream commit 7d4553b69fb335496c597c31590e982485ebe071 ]
+
+The devmap bulk queue is allocated with GFP_ATOMIC and the allocation
+may fail if there is no available space in existing percpu pool.
+
+Since commit 75ccae62cb8d42 ("xdp: Move devmap bulk queue into struct net_device")
+moved the bulk queue allocation to NETDEV_REGISTER callback, whose context
+is allowed to sleep, use GFP_KERNEL instead of GFP_ATOMIC to let percpu
+allocator extend the pool when needed and avoid possible failure of netdev
+registration.
+
+As the required alignment is natural, we can simply use alloc_percpu().
+
+Fixes: 75ccae62cb8d42 ("xdp: Move devmap bulk queue into struct net_device")
+Signed-off-by: Jun'ichi Nomura <junichi.nomura@nec.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/bpf/20210209082451.GA44021@jeru.linux.bs1.fc.nec.co.jp
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/devmap.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index f6e9c68afdd42..85d9d1b72a33a 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -802,9 +802,7 @@ static int dev_map_notification(struct notifier_block *notifier,
+ break;
+
+ /* will be freed in free_netdev() */
+- netdev->xdp_bulkq =
+- __alloc_percpu_gfp(sizeof(struct xdp_dev_bulk_queue),
+- sizeof(void *), GFP_ATOMIC);
++ netdev->xdp_bulkq = alloc_percpu(struct xdp_dev_bulk_queue);
+ if (!netdev->xdp_bulkq)
+ return NOTIFY_BAD;
+
+--
+2.27.0
+
--- /dev/null
+From fb74a9dfc107bb4d22563dbdff474c3896bb3db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 16:59:26 -0800
+Subject: bpf: Fix an unitialized value in bpf_iter
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 17d8beda277a36203585943e70c7909b60775fd5 ]
+
+Commit 15d83c4d7cef ("bpf: Allow loading of a bpf_iter program")
+cached btf_id in struct bpf_iter_target_info so later on
+if it can be checked cheaply compared to checking registered names.
+
+syzbot found a bug that uninitialized value may occur to
+bpf_iter_target_info->btf_id. This is because we allocated
+bpf_iter_target_info structure with kmalloc and never initialized
+field btf_id afterwards. This uninitialized btf_id is typically
+compared to a u32 bpf program func proto btf_id, and the chance
+of being equal is extremely slim.
+
+This patch fixed the issue by using kzalloc which will also
+prevent future likely instances due to adding new fields.
+
+Fixes: 15d83c4d7cef ("bpf: Allow loading of a bpf_iter program")
+Reported-by: syzbot+580f4f2a272e452d55cb@syzkaller.appspotmail.com
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210212005926.2875002-1-yhs@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/bpf_iter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/bpf_iter.c b/kernel/bpf/bpf_iter.c
+index 5454161407f1f..a0d9eade9c804 100644
+--- a/kernel/bpf/bpf_iter.c
++++ b/kernel/bpf/bpf_iter.c
+@@ -287,7 +287,7 @@ int bpf_iter_reg_target(const struct bpf_iter_reg *reg_info)
+ {
+ struct bpf_iter_target_info *tinfo;
+
+- tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL);
++ tinfo = kzalloc(sizeof(*tinfo), GFP_KERNEL);
+ if (!tinfo)
+ return -ENOMEM;
+
+--
+2.27.0
+
--- /dev/null
+From 008575f7646b1416b7d14b4c56fb126213ba10b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 14:38:14 +0100
+Subject: bpf: Fix bpf_fib_lookup helper MTU check for SKB ctx
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 2c0a10af688c02adcf127aad29e923e0056c6b69 ]
+
+BPF end-user on Cilium slack-channel (Carlo Carraro) wants to use
+bpf_fib_lookup for doing MTU-check, but *prior* to extending packet size,
+by adjusting fib_params 'tot_len' with the packet length plus the expected
+encap size. (Just like the bpf_check_mtu helper supports). He discovered
+that for SKB ctx the param->tot_len was not used, instead skb->len was used
+(via MTU check in is_skb_forwardable() that checks against netdev MTU).
+
+Fix this by using fib_params 'tot_len' for MTU check. If not provided (e.g.
+zero) then keep existing TC behaviour intact. Notice that 'tot_len' for MTU
+check is done like XDP code-path, which checks against FIB-dst MTU.
+
+V16:
+- Revert V13 optimization, 2nd lookup is against egress/resulting netdev
+
+V13:
+- Only do ifindex lookup one time, calling dev_get_by_index_rcu().
+
+V10:
+- Use same method as XDP for 'tot_len' MTU check
+
+Fixes: 4c79579b44b1 ("bpf: Change bpf_fib_lookup to return lookup status")
+Reported-by: Carlo Carraro <colrack@gmail.com>
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/161287789444.790810.15247494756551413508.stgit@firesoul
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 255aeee724026..ee665720a41a0 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -5552,6 +5552,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ {
+ struct net *net = dev_net(skb->dev);
+ int rc = -EAFNOSUPPORT;
++ bool check_mtu = false;
+
+ if (plen < sizeof(*params))
+ return -EINVAL;
+@@ -5559,22 +5560,28 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
+ if (flags & ~(BPF_FIB_LOOKUP_DIRECT | BPF_FIB_LOOKUP_OUTPUT))
+ return -EINVAL;
+
++ if (params->tot_len)
++ check_mtu = true;
++
+ switch (params->family) {
+ #if IS_ENABLED(CONFIG_INET)
+ case AF_INET:
+- rc = bpf_ipv4_fib_lookup(net, params, flags, false);
++ rc = bpf_ipv4_fib_lookup(net, params, flags, check_mtu);
+ break;
+ #endif
+ #if IS_ENABLED(CONFIG_IPV6)
+ case AF_INET6:
+- rc = bpf_ipv6_fib_lookup(net, params, flags, false);
++ rc = bpf_ipv6_fib_lookup(net, params, flags, check_mtu);
+ break;
+ #endif
+ }
+
+- if (!rc) {
++ if (rc == BPF_FIB_LKUP_RET_SUCCESS && !check_mtu) {
+ struct net_device *dev;
+
++ /* When tot_len isn't provided by user, check skb
++ * against MTU of FIB lookup resulting net_device
++ */
+ dev = dev_get_by_index_rcu(net, params->ifindex);
+ if (!is_skb_forwardable(dev, skb))
+ rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
+--
+2.27.0
+
--- /dev/null
+From 7256cd11d3146774c3e3206574c04bdf394104ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 12:27:01 +0100
+Subject: bpf_lru_list: Read double-checked variable once without lock
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 6df8fb83301d68ea0a0c0e1cbcc790fcc333ed12 ]
+
+For double-checked locking in bpf_common_lru_push_free(), node->type is
+read outside the critical section and then re-checked under the lock.
+However, concurrent writes to node->type result in data races.
+
+For example, the following concurrent access was observed by KCSAN:
+
+ write to 0xffff88801521bc22 of 1 bytes by task 10038 on cpu 1:
+ __bpf_lru_node_move_in kernel/bpf/bpf_lru_list.c:91
+ __local_list_flush kernel/bpf/bpf_lru_list.c:298
+ ...
+ read to 0xffff88801521bc22 of 1 bytes by task 10043 on cpu 0:
+ bpf_common_lru_push_free kernel/bpf/bpf_lru_list.c:507
+ bpf_lru_push_free kernel/bpf/bpf_lru_list.c:555
+ ...
+
+Fix the data races where node->type is read outside the critical section
+(for double-checked locking) by marking the access with READ_ONCE() as
+well as ensuring the variable is only accessed once.
+
+Fixes: 3a08c2fd7634 ("bpf: LRU List")
+Reported-by: syzbot+3536db46dfa58c573458@syzkaller.appspotmail.com
+Reported-by: syzbot+516acdb03d3e27d91bcd@syzkaller.appspotmail.com
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Link: https://lore.kernel.org/bpf/20210209112701.3341724-1-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/bpf_lru_list.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c
+index 1b6b9349cb857..d99e89f113c43 100644
+--- a/kernel/bpf/bpf_lru_list.c
++++ b/kernel/bpf/bpf_lru_list.c
+@@ -502,13 +502,14 @@ struct bpf_lru_node *bpf_lru_pop_free(struct bpf_lru *lru, u32 hash)
+ static void bpf_common_lru_push_free(struct bpf_lru *lru,
+ struct bpf_lru_node *node)
+ {
++ u8 node_type = READ_ONCE(node->type);
+ unsigned long flags;
+
+- if (WARN_ON_ONCE(node->type == BPF_LRU_LIST_T_FREE) ||
+- WARN_ON_ONCE(node->type == BPF_LRU_LOCAL_LIST_T_FREE))
++ if (WARN_ON_ONCE(node_type == BPF_LRU_LIST_T_FREE) ||
++ WARN_ON_ONCE(node_type == BPF_LRU_LOCAL_LIST_T_FREE))
+ return;
+
+- if (node->type == BPF_LRU_LOCAL_LIST_T_PENDING) {
++ if (node_type == BPF_LRU_LOCAL_LIST_T_PENDING) {
+ struct bpf_lru_locallist *loc_l;
+
+ loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu);
+--
+2.27.0
+
--- /dev/null
+From 51833434dfd34f1b2c288f1995fdaf58a63ee9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 04:33:11 -0800
+Subject: bsg: free the request before return error code
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 0f7b4bc6bb1e57c48ef14f1818df947c1612b206 ]
+
+Free the request rq before returning error code.
+
+Fixes: 972248e9111e ("scsi: bsg-lib: handle bidi requests without block layer help")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bsg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/bsg.c b/block/bsg.c
+index d7bae94b64d95..3d78e843a83f6 100644
+--- a/block/bsg.c
++++ b/block/bsg.c
+@@ -157,8 +157,10 @@ static int bsg_sg_io(struct request_queue *q, fmode_t mode, void __user *uarg)
+ return PTR_ERR(rq);
+
+ ret = q->bsg_dev.ops->fill_hdr(rq, &hdr, mode);
+- if (ret)
++ if (ret) {
++ blk_put_request(rq);
+ return ret;
++ }
+
+ rq->timeout = msecs_to_jiffies(hdr.timeout);
+ if (!rq->timeout)
+--
+2.27.0
+
--- /dev/null
+From d8299413f0d742fe66e5924d908eabe9ee120d90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 09:08:04 +0800
+Subject: btrfs: clarify error returns values in __load_free_space_cache
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 3cc64e7ebfb0d7faaba2438334c43466955a96e8 ]
+
+Return value in __load_free_space_cache is not properly set after
+(unlikely) memory allocation failures and 0 is returned instead.
+This is not a problem for the caller load_free_space_cache because only
+value 1 is considered as 'cache loaded' but for clarity it's better
+to set the errors accordingly.
+
+Fixes: a67509c30079 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/free-space-cache.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 4d8897879c9cb..71d0d14bc18b3 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -775,8 +775,10 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ while (num_entries) {
+ e = kmem_cache_zalloc(btrfs_free_space_cachep,
+ GFP_NOFS);
+- if (!e)
++ if (!e) {
++ ret = -ENOMEM;
+ goto free_cache;
++ }
+
+ ret = io_ctl_read_entry(&io_ctl, e, &type);
+ if (ret) {
+@@ -785,6 +787,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ }
+
+ if (!e->bytes) {
++ ret = -1;
+ kmem_cache_free(btrfs_free_space_cachep, e);
+ goto free_cache;
+ }
+@@ -805,6 +808,7 @@ static int __load_free_space_cache(struct btrfs_root *root, struct inode *inode,
+ e->bitmap = kmem_cache_zalloc(
+ btrfs_free_space_bitmap_cachep, GFP_NOFS);
+ if (!e->bitmap) {
++ ret = -ENOMEM;
+ kmem_cache_free(
+ btrfs_free_space_cachep, e);
+ goto free_cache;
+--
+2.27.0
+
--- /dev/null
+From b826338e19565f0a9cb18cf2c615f36cf61db316 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 14:38:48 +0800
+Subject: btrfs: fix double accounting of ordered extent for subpage case in
+ btrfs_invalidapge
+
+From: Qu Wenruo <wqu@suse.com>
+
+[ Upstream commit 951c80f83d61bd4b21794c8aba829c3c1a45c2d0 ]
+
+Commit dbfdb6d1b369 ("Btrfs: Search for all ordered extents that could
+span across a page") make btrfs_invalidapage() to search all ordered
+extents.
+
+The offending code looks like this:
+
+ again:
+ start = page_start;
+ ordered = btrfs_lookup_ordered_range(inode, start, page_end - start + 1);
+ if (ordred) {
+ end = min(page_end,
+ ordered->file_offset + ordered->num_bytes - 1);
+
+ /* Do the cleanup */
+
+ start = end + 1;
+ if (start < page_end)
+ goto again;
+ }
+
+The behavior is indeed necessary for the incoming subpage support, but
+when it iterates through all the ordered extents, it also resets the
+search range @start.
+
+This means, for the following cases, we can double account the ordered
+extents, causing its bytes_left underflow:
+
+ Page offset
+ 0 16K 32K
+ |<--- OE 1 --->|<--- OE 2 ---->|
+
+As the first iteration will find ordered extent (OE) 1, which doesn't
+cover the full page, thus after cleanup code, we need to retry again.
+But again label will reset start to page_start, and we got OE 1 again,
+which causes double accounting on OE 1, and cause OE 1's byte_left to
+underflow.
+
+This problem can only happen for subpage case, as for regular sectorsize
+== PAGE_SIZE case, we will always find a OE ends at or after page end,
+thus no way to trigger the problem.
+
+Move the again label after start = page_start. There will be more
+comprehensive rework to convert the open coded loop to a proper while
+loop for subpage support.
+
+Fixes: dbfdb6d1b369 ("Btrfs: Search for all ordered extents that could span across a page")
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index a8e0a6b038d3e..ad34c5a09befc 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -8186,8 +8186,9 @@ static void btrfs_invalidatepage(struct page *page, unsigned int offset,
+
+ if (!inode_evicting)
+ lock_extent_bits(tree, page_start, page_end, &cached_state);
+-again:
++
+ start = page_start;
++again:
+ ordered = btrfs_lookup_ordered_range(inode, start, page_end - start + 1);
+ if (ordered) {
+ found_ordered = true;
+--
+2.27.0
+
--- /dev/null
+From 03e7430b6cfdfa638e0a34c4b1306a363880cb7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 23:06:31 +0200
+Subject: can: mcp251xfd: mcp251xfd_probe(): fix errata reference
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 28eb119c042e8d3420b577b5b3ea851a111e7b2d ]
+
+This patch fixes the reference to the errata for both the mcp2517fd
+and the mcp2518fd.
+
+Fixes: f5b84dedf7eb ("can: mcp25xxfd: mcp25xxfd_probe(): add SPI clk limit related errata information")
+Link: https://lore.kernel.org/r/20210128104644.2982125-2-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+index f07e8b737d31e..ee39e79927efb 100644
+--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
++++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+@@ -2901,7 +2901,7 @@ static int mcp251xfd_probe(struct spi_device *spi)
+ spi_get_device_id(spi)->driver_data;
+
+ /* Errata Reference:
+- * mcp2517fd: DS80000789B, mcp2518fd: DS80000792C 4.
++ * mcp2517fd: DS80000792C 5., mcp2518fd: DS80000789C 4.
+ *
+ * The SPI can write corrupted data to the RAM at fast SPI
+ * speeds:
+--
+2.27.0
+
--- /dev/null
+From 57e1e3b95c3e964b9e52fc9846764825cb1db1ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 09:42:00 -0600
+Subject: capabilities: Don't allow writing ambiguous v3 file capabilities
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 95ebabde382c371572297915b104e55403674e73 ]
+
+The v3 file capabilities have a uid field that records the filesystem
+uid of the root user of the user namespace the file capabilities are
+valid in.
+
+When someone is silly enough to have the same underlying uid as the
+root uid of multiple nested containers a v3 filesystem capability can
+be ambiguous.
+
+In the spirit of don't do that then, forbid writing a v3 filesystem
+capability if it is ambiguous.
+
+Fixes: 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
+Reviewed-by: Andrew G. Morgan <morgan@kernel.org>
+Reviewed-by: Serge Hallyn <serge@hallyn.com>
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 26c1cb725dcbe..78598be45f101 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -500,7 +500,8 @@ int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size)
+ __u32 magic, nsmagic;
+ struct inode *inode = d_backing_inode(dentry);
+ struct user_namespace *task_ns = current_user_ns(),
+- *fs_ns = inode->i_sb->s_user_ns;
++ *fs_ns = inode->i_sb->s_user_ns,
++ *ancestor;
+ kuid_t rootid;
+ size_t newsize;
+
+@@ -523,6 +524,15 @@ int cap_convert_nscap(struct dentry *dentry, const void **ivalue, size_t size)
+ if (nsrootid == -1)
+ return -EINVAL;
+
++ /*
++ * Do not allow allow adding a v3 filesystem capability xattr
++ * if the rootid field is ambiguous.
++ */
++ for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
++ if (from_kuid(ancestor, rootid) == 0)
++ return -EINVAL;
++ }
++
+ newsize = sizeof(struct vfs_ns_cap_data);
+ nscap = kmalloc(newsize, GFP_ATOMIC);
+ if (!nscap)
+--
+2.27.0
+
--- /dev/null
+From 64dab5394c550ea36bf9f3002678a05a41956a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 13:35:46 -0500
+Subject: ceph: fix flush_snap logic after putting caps
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit 64f36da5625f7f9853b86750eaa89d499d16a2e9 ]
+
+A primary reason for skipping ceph_check_caps after putting the
+references was to avoid the locking in ceph_check_caps during a
+reconnect. __ceph_put_cap_refs can still call ceph_flush_snaps in that
+case though, and that takes many of the same inconvenient locks.
+
+Fix the logic in __ceph_put_cap_refs to skip flushing snaps when the
+skip_checking_caps flag is set.
+
+Fixes: e64f44a88465 ("ceph: skip checking caps when session reconnecting and releasing reqs")
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 255a512f1277e..638d18c198ea7 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3093,10 +3093,12 @@ static void __ceph_put_cap_refs(struct ceph_inode_info *ci, int had,
+ dout("put_cap_refs %p had %s%s%s\n", inode, ceph_cap_string(had),
+ last ? " last" : "", put ? " put" : "");
+
+- if (last && !skip_checking_caps)
+- ceph_check_caps(ci, 0, NULL);
+- else if (flushsnaps)
+- ceph_flush_snaps(ci, NULL);
++ if (!skip_checking_caps) {
++ if (last)
++ ceph_check_caps(ci, 0, NULL);
++ else if (flushsnaps)
++ ceph_flush_snaps(ci, NULL);
++ }
+ if (wake)
+ wake_up_all(&ci->i_cap_wq);
+ while (put-- > 0)
+--
+2.27.0
+
--- /dev/null
+From 65ae5f0cd45661061519b302e5eed0eb2ae72443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 19:04:23 +0100
+Subject: certs: Fix blacklist flag type confusion
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4993e1f9479a4161fd7d93e2b8b30b438f00cb0f ]
+
+KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(),
+as these only take KEY_ALLOC_* flags. KEY_FLAG_KEEP has the same value as
+KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update()
+uses it. LSMs using the key_alloc hook don't check that flag.
+
+KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot
+write to the blacklist keyring, so it is not possible to remove a key/hash
+from it.
+
+Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set
+KEY_FLAG_KEEP on the new key. blacklist_init() can then, correctly, pass
+this to keyring_alloc().
+
+We can also use this in ima_mok_init() rather than setting the flag
+manually.
+
+Note that this doesn't fix an observable bug with the current
+implementation but it is required to allow addition of new hashes to the
+blacklist in the future without making it possible for them to be removed.
+
+Fixes: 734114f8782f ("KEYS: Add a system blacklist keyring")
+Reported-by: Mickaël Salaün <mic@linux.microsoft.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Mickaël Salaün <mic@linux.microsoft.com>
+cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ certs/blacklist.c | 2 +-
+ include/linux/key.h | 1 +
+ security/integrity/ima/ima_mok.c | 5 ++---
+ security/keys/key.c | 2 ++
+ 4 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/certs/blacklist.c b/certs/blacklist.c
+index 6514f9ebc943f..f1c434b04b5e4 100644
+--- a/certs/blacklist.c
++++ b/certs/blacklist.c
+@@ -162,7 +162,7 @@ static int __init blacklist_init(void)
+ KEY_USR_VIEW | KEY_USR_READ |
+ KEY_USR_SEARCH,
+ KEY_ALLOC_NOT_IN_QUOTA |
+- KEY_FLAG_KEEP,
++ KEY_ALLOC_SET_KEEP,
+ NULL, NULL);
+ if (IS_ERR(blacklist_keyring))
+ panic("Can't allocate system blacklist keyring\n");
+diff --git a/include/linux/key.h b/include/linux/key.h
+index 0f2e24f13c2bd..eed3ce139a32e 100644
+--- a/include/linux/key.h
++++ b/include/linux/key.h
+@@ -289,6 +289,7 @@ extern struct key *key_alloc(struct key_type *type,
+ #define KEY_ALLOC_BUILT_IN 0x0004 /* Key is built into kernel */
+ #define KEY_ALLOC_BYPASS_RESTRICTION 0x0008 /* Override the check on restricted keyrings */
+ #define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */
++#define KEY_ALLOC_SET_KEEP 0x0020 /* Set the KEEP flag on the key/keyring */
+
+ extern void key_revoke(struct key *key);
+ extern void key_invalidate(struct key *key);
+diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
+index 36cadadbfba47..1e5c019161738 100644
+--- a/security/integrity/ima/ima_mok.c
++++ b/security/integrity/ima/ima_mok.c
+@@ -38,13 +38,12 @@ __init int ima_mok_init(void)
+ (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+ KEY_USR_VIEW | KEY_USR_READ |
+ KEY_USR_WRITE | KEY_USR_SEARCH,
+- KEY_ALLOC_NOT_IN_QUOTA,
++ KEY_ALLOC_NOT_IN_QUOTA |
++ KEY_ALLOC_SET_KEEP,
+ restriction, NULL);
+
+ if (IS_ERR(ima_blacklist_keyring))
+ panic("Can't allocate IMA blacklist keyring.");
+-
+- set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
+ return 0;
+ }
+ device_initcall(ima_mok_init);
+diff --git a/security/keys/key.c b/security/keys/key.c
+index ebe752b137aa1..c45afdd1dfbb4 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -303,6 +303,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ key->flags |= 1 << KEY_FLAG_BUILTIN;
+ if (flags & KEY_ALLOC_UID_KEYRING)
+ key->flags |= 1 << KEY_FLAG_UID_KEYRING;
++ if (flags & KEY_ALLOC_SET_KEEP)
++ key->flags |= 1 << KEY_FLAG_KEEP;
+
+ #ifdef KEY_DEBUGGING
+ key->magic = KEY_DEBUG_MAGIC;
+--
+2.27.0
+
--- /dev/null
+From 1f0cdbd9f18e25f9bdac4cefa68fc807948a597d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 17:28:12 +0800
+Subject: cifs: Fix inconsistent IS_ERR and PTR_ERR
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit af982da9a612295a91f367469f8945c916a20dfd ]
+
+Fix inconsistent IS_ERR and PTR_ERR in cifs_find_swn_reg(). The proper
+pointer to be passed as argument to PTR_ERR() is share_name.
+
+This bug was detected with the help of Coccinelle.
+
+Fixes: bf80e5d4259a ("cifs: Send witness register and unregister commands to userspace daemon")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Samuel Cabrero <scabrero@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_swn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/cifs_swn.c b/fs/cifs/cifs_swn.c
+index d35f599aa00e6..f2d730fffccb3 100644
+--- a/fs/cifs/cifs_swn.c
++++ b/fs/cifs/cifs_swn.c
+@@ -272,7 +272,7 @@ static struct cifs_swn_reg *cifs_find_swn_reg(struct cifs_tcon *tcon)
+ if (IS_ERR(share_name)) {
+ int ret;
+
+- ret = PTR_ERR(net_name);
++ ret = PTR_ERR(share_name);
+ cifs_dbg(VFS, "%s: failed to extract share name from target '%s': %d\n",
+ __func__, tcon->treeName, ret);
+ kfree(net_name);
+--
+2.27.0
+
--- /dev/null
+From 5c54839b53e8829b5e063de66c9bd7dabc72c425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 14:17:15 +0800
+Subject: clk: aspeed: Fix APLL calculate formula from ast2600-A2
+
+From: Ryan Chen <ryan_chen@aspeedtech.com>
+
+[ Upstream commit 6286ce1e3ece54799f12775f8ce2a1cba9cbcfc5 ]
+
+Starting from A2, the A-PLL calculation has changed. Use the
+existing formula for A0/A1 and the new formula for A2 onwards.
+
+Fixes: d3d04f6c330a ("clk: Add support for AST2600 SoC")
+Signed-off-by: Ryan Chen <ryan_chen@aspeedtech.com>
+Link: https://lore.kernel.org/r/20210119061715.6043-1-ryan_chen@aspeedtech.com
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-ast2600.c | 37 +++++++++++++++++++++++++++----------
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c
+index 177368cac6dd6..a55b37fc2c8bd 100644
+--- a/drivers/clk/clk-ast2600.c
++++ b/drivers/clk/clk-ast2600.c
+@@ -17,7 +17,8 @@
+
+ #define ASPEED_G6_NUM_CLKS 71
+
+-#define ASPEED_G6_SILICON_REV 0x004
++#define ASPEED_G6_SILICON_REV 0x014
++#define CHIP_REVISION_ID GENMASK(23, 16)
+
+ #define ASPEED_G6_RESET_CTRL 0x040
+ #define ASPEED_G6_RESET_CTRL2 0x050
+@@ -190,18 +191,34 @@ static struct clk_hw *ast2600_calc_pll(const char *name, u32 val)
+ static struct clk_hw *ast2600_calc_apll(const char *name, u32 val)
+ {
+ unsigned int mult, div;
++ u32 chip_id = readl(scu_g6_base + ASPEED_G6_SILICON_REV);
+
+- if (val & BIT(20)) {
+- /* Pass through mode */
+- mult = div = 1;
++ if (((chip_id & CHIP_REVISION_ID) >> 16) >= 2) {
++ if (val & BIT(24)) {
++ /* Pass through mode */
++ mult = div = 1;
++ } else {
++ /* F = 25Mhz * [(m + 1) / (n + 1)] / (p + 1) */
++ u32 m = val & 0x1fff;
++ u32 n = (val >> 13) & 0x3f;
++ u32 p = (val >> 19) & 0xf;
++
++ mult = (m + 1);
++ div = (n + 1) * (p + 1);
++ }
+ } else {
+- /* F = 25Mhz * (2-od) * [(m + 2) / (n + 1)] */
+- u32 m = (val >> 5) & 0x3f;
+- u32 od = (val >> 4) & 0x1;
+- u32 n = val & 0xf;
++ if (val & BIT(20)) {
++ /* Pass through mode */
++ mult = div = 1;
++ } else {
++ /* F = 25Mhz * (2-od) * [(m + 2) / (n + 1)] */
++ u32 m = (val >> 5) & 0x3f;
++ u32 od = (val >> 4) & 0x1;
++ u32 n = val & 0xf;
+
+- mult = (2 - od) * (m + 2);
+- div = n + 1;
++ mult = (2 - od) * (m + 2);
++ div = n + 1;
++ }
+ }
+ return clk_hw_register_fixed_factor(NULL, name, "clkin", 0,
+ mult, div);
+--
+2.27.0
+
--- /dev/null
+From 53ebfc6800c29bccbf3aa3b8a54e239dfa76f5b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 08:16:46 +0100
+Subject: clk: divider: fix initialization with parent_hw
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+[ Upstream commit 0225daea08141b1dff681502d5af70b71e8b11ec ]
+
+If a driver registers a divider clock with a parent_hw instead of the
+parent_name, the parent_hw is ignored and the clock does not have a
+parent.
+
+Fix this by initializing the parents the same way they are initialized
+for clock gates.
+
+Fixes: ff258817137a ("clk: divider: Add support for specifying parents via DT/pointers")
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Link: https://lore.kernel.org/r/20210121071659.1226489-3-m.tretter@pengutronix.de
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-divider.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
+index c499799693ccc..344997203f0e7 100644
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -494,8 +494,13 @@ struct clk_hw *__clk_hw_register_divider(struct device *dev,
+ else
+ init.ops = &clk_divider_ops;
+ init.flags = flags;
+- init.parent_names = (parent_name ? &parent_name: NULL);
+- init.num_parents = (parent_name ? 1 : 0);
++ init.parent_names = parent_name ? &parent_name : NULL;
++ init.parent_hws = parent_hw ? &parent_hw : NULL;
++ init.parent_data = parent_data;
++ if (parent_name || parent_hw || parent_data)
++ init.num_parents = 1;
++ else
++ init.num_parents = 0;
+
+ /* struct clk_divider assignments */
+ div->reg = reg;
+--
+2.27.0
+
--- /dev/null
+From e33e73dc3dc993a090c8a076ba9ca753a6cb6f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:54 +0100
+Subject: clk: meson: clk-pll: fix initializing the old rate (fallback) for a
+ PLL
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 2f290b7c67adf6459a17a4c978102af35cd62e4a ]
+
+The "rate" parameter in meson_clk_pll_set_rate() contains the new rate.
+Retrieve the old rate with clk_hw_get_rate() so we don't inifinitely try
+to switch from the new rate to the same rate again.
+
+Fixes: 7a29a869434e8b ("clk: meson: Add support for Meson clock controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index b17a13e9337c4..9404609b5ebfa 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -371,7 +371,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ if (parent_rate == 0 || rate == 0)
+ return -EINVAL;
+
+- old_rate = rate;
++ old_rate = clk_hw_get_rate(hw);
+
+ ret = meson_clk_get_pll_settings(rate, parent_rate, &m, &n, pll);
+ if (ret)
+--
+2.27.0
+
--- /dev/null
+From eded41823b46b34efcbfe8a5e24689108c5102e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:55 +0100
+Subject: clk: meson: clk-pll: make "ret" a signed integer
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 9e717285f0bd591d716fa0e7418f2cdaf756dd25 ]
+
+The error codes returned by meson_clk_get_pll_settings() are all
+negative. Make "ret" a signed integer in meson_clk_pll_set_rate() to
+make it match with the clk_ops.set_rate API as well as the data type
+returned by meson_clk_get_pll_settings().
+
+Fixes: 8eed1db1adec6a ("clk: meson: pll: update driver for the g12a")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index 9404609b5ebfa..5b932976483fd 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -365,8 +365,9 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ {
+ struct clk_regmap *clk = to_clk_regmap(hw);
+ struct meson_clk_pll_data *pll = meson_clk_pll_data(clk);
+- unsigned int enabled, m, n, frac = 0, ret;
++ unsigned int enabled, m, n, frac = 0;
+ unsigned long old_rate;
++ int ret;
+
+ if (parent_rate == 0 || rate == 0)
+ return -EINVAL;
+--
+2.27.0
+
--- /dev/null
+From 6922e516a39d2449a00e9a995aa99de6db65a182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 13:15:56 +0100
+Subject: clk: meson: clk-pll: propagate the error from
+ meson_clk_pll_set_rate()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit ccdc1f0836f8e37b558a424f1e491f929b2e7ede ]
+
+Popagate the error code from meson_clk_pll_set_rate() when the PLL does
+not lock with the new settings.
+
+Fixes: 722825dcd54b2e ("clk: meson: migrate plls clocks to clk_regmap")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201226121556.975418-4-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index 5b932976483fd..49f27fe532139 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -394,7 +394,8 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ if (!enabled)
+ return 0;
+
+- if (meson_clk_pll_enable(hw)) {
++ ret = meson_clk_pll_enable(hw);
++ if (ret) {
+ pr_warn("%s: pll did not lock, trying to restore old rate %lu\n",
+ __func__, old_rate);
+ /*
+@@ -406,7 +407,7 @@ static int meson_clk_pll_set_rate(struct clk_hw *hw, unsigned long rate,
+ meson_clk_pll_set_rate(hw, old_rate, parent_rate);
+ }
+
+- return 0;
++ return ret;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 393ba41e245a8bb2b22700a0d2b0e9be529e5e62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 23:10:54 +0100
+Subject: clk: qcom: gcc-msm8998: Fix Alpha PLL type for all GPLLs
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+
+[ Upstream commit 292f75ecff07e8a07fe2e3e19b4b567d0b698842 ]
+
+All of the GPLLs in the MSM8998 Global Clock Controller are Fabia PLLs
+and not generic alphas: this was producing bad effects over the entire
+clock tree of MSM8998, where any GPLL child clock was declaring a false
+clock rate, due to their parent also showing the same.
+
+The issue resides in the calculation of the clock rate for the specific
+Alpha PLL type, where Fabia has a different register layout; switching
+the MSM8998 GPLLs to the correct Alpha Fabia PLL type fixes the rate
+(calculation) reading. While at it, also make these PLLs fixed since
+their rate is supposed to *never* be changed while the system runs, as
+this would surely crash the entire SoC.
+
+Now all the children of all the PLLs are also complying with their
+specified clock table and system stability is improved.
+
+Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
+Link: https://lore.kernel.org/r/20210114221059.483390-7-angelogioacchino.delregno@somainline.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c | 100 ++++++++++++++++-----------------
+ 1 file changed, 50 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 9d7016bcd6800..b8dcfe62312bb 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -135,7 +135,7 @@ static struct pll_vco fabia_vco[] = {
+
+ static struct clk_alpha_pll gpll0 = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -145,58 +145,58 @@ static struct clk_alpha_pll gpll0 = {
+ .name = "gpll0",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_even = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_even",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_main = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_main",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_odd = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_odd",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll0_out_test = {
+ .offset = 0x0,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_test",
+ .parent_names = (const char *[]){ "gpll0" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll1 = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -206,58 +206,58 @@ static struct clk_alpha_pll gpll1 = {
+ .name = "gpll1",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_even = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_even",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_main = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_main",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_odd = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_odd",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll1_out_test = {
+ .offset = 0x1000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll1_out_test",
+ .parent_names = (const char *[]){ "gpll1" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll2 = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -267,58 +267,58 @@ static struct clk_alpha_pll gpll2 = {
+ .name = "gpll2",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_even = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_even",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_main = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_main",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_odd = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_odd",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll2_out_test = {
+ .offset = 0x2000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll2_out_test",
+ .parent_names = (const char *[]){ "gpll2" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll3 = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -328,58 +328,58 @@ static struct clk_alpha_pll gpll3 = {
+ .name = "gpll3",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_even = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_even",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_main = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_main",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_odd = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_odd",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll3_out_test = {
+ .offset = 0x3000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll3_out_test",
+ .parent_names = (const char *[]){ "gpll3" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll gpll4 = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .vco_table = fabia_vco,
+ .num_vco = ARRAY_SIZE(fabia_vco),
+ .clkr = {
+@@ -389,52 +389,52 @@ static struct clk_alpha_pll gpll4 = {
+ .name = "gpll4",
+ .parent_names = (const char *[]){ "xo" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_ops,
++ .ops = &clk_alpha_pll_fixed_fabia_ops,
+ }
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_even = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_even",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_main = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_main",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_odd = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_odd",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+ static struct clk_alpha_pll_postdiv gpll4_out_test = {
+ .offset = 0x77000,
+- .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT],
++ .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_FABIA],
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll4_out_test",
+ .parent_names = (const char *[]){ "gpll4" },
+ .num_parents = 1,
+- .ops = &clk_alpha_pll_postdiv_ops,
++ .ops = &clk_alpha_pll_postdiv_fabia_ops,
+ },
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 011223f625950f086423a60b35026f0d61c29caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 13:17:51 +0530
+Subject: clk: qcom: gcc-sc7180: Mark the MM XO clocks to be always ON
+
+From: Taniya Das <tdas@codeaurora.org>
+
+[ Upstream commit d79dfa19ca4235c28be62952bda6091babdcf8f3 ]
+
+There are intermittent GDSC power-up failures observed for titan top
+gdsc, which requires the XO clock. Thus mark all the MM XO clocks always
+enabled from probe.
+
+Fixes: 8d4025943e13 ("clk: qcom: camcc-sc7180: Use runtime PM ops instead of clk ones")
+Signed-off-by: Taniya Das <tdas@codeaurora.org>
+Link: https://lore.kernel.org/r/1611128871-5898-1-git-send-email-tdas@codeaurora.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sc7180.c | 47 +++--------------------------------
+ 1 file changed, 4 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
+index b05901b249172..88e896abb6631 100644
+--- a/drivers/clk/qcom/gcc-sc7180.c
++++ b/drivers/clk/qcom/gcc-sc7180.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
++ * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
+ */
+
+ #include <linux/clk-provider.h>
+@@ -919,19 +919,6 @@ static struct clk_branch gcc_camera_throttle_hf_axi_clk = {
+ },
+ };
+
+-static struct clk_branch gcc_camera_xo_clk = {
+- .halt_reg = 0xb02c,
+- .halt_check = BRANCH_HALT,
+- .clkr = {
+- .enable_reg = 0xb02c,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "gcc_camera_xo_clk",
+- .ops = &clk_branch2_ops,
+- },
+- },
+-};
+-
+ static struct clk_branch gcc_ce1_ahb_clk = {
+ .halt_reg = 0x4100c,
+ .halt_check = BRANCH_HALT_VOTED,
+@@ -1096,19 +1083,6 @@ static struct clk_branch gcc_disp_throttle_hf_axi_clk = {
+ },
+ };
+
+-static struct clk_branch gcc_disp_xo_clk = {
+- .halt_reg = 0xb030,
+- .halt_check = BRANCH_HALT,
+- .clkr = {
+- .enable_reg = 0xb030,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "gcc_disp_xo_clk",
+- .ops = &clk_branch2_ops,
+- },
+- },
+-};
+-
+ static struct clk_branch gcc_gp1_clk = {
+ .halt_reg = 0x64000,
+ .halt_check = BRANCH_HALT,
+@@ -2159,19 +2133,6 @@ static struct clk_branch gcc_video_throttle_axi_clk = {
+ },
+ };
+
+-static struct clk_branch gcc_video_xo_clk = {
+- .halt_reg = 0xb028,
+- .halt_check = BRANCH_HALT,
+- .clkr = {
+- .enable_reg = 0xb028,
+- .enable_mask = BIT(0),
+- .hw.init = &(struct clk_init_data){
+- .name = "gcc_video_xo_clk",
+- .ops = &clk_branch2_ops,
+- },
+- },
+-};
+-
+ static struct clk_branch gcc_mss_cfg_ahb_clk = {
+ .halt_reg = 0x8a000,
+ .halt_check = BRANCH_HALT,
+@@ -2304,7 +2265,6 @@ static struct clk_regmap *gcc_sc7180_clocks[] = {
+ [GCC_BOOT_ROM_AHB_CLK] = &gcc_boot_rom_ahb_clk.clkr,
+ [GCC_CAMERA_HF_AXI_CLK] = &gcc_camera_hf_axi_clk.clkr,
+ [GCC_CAMERA_THROTTLE_HF_AXI_CLK] = &gcc_camera_throttle_hf_axi_clk.clkr,
+- [GCC_CAMERA_XO_CLK] = &gcc_camera_xo_clk.clkr,
+ [GCC_CE1_AHB_CLK] = &gcc_ce1_ahb_clk.clkr,
+ [GCC_CE1_AXI_CLK] = &gcc_ce1_axi_clk.clkr,
+ [GCC_CE1_CLK] = &gcc_ce1_clk.clkr,
+@@ -2317,7 +2277,6 @@ static struct clk_regmap *gcc_sc7180_clocks[] = {
+ [GCC_DISP_GPLL0_DIV_CLK_SRC] = &gcc_disp_gpll0_div_clk_src.clkr,
+ [GCC_DISP_HF_AXI_CLK] = &gcc_disp_hf_axi_clk.clkr,
+ [GCC_DISP_THROTTLE_HF_AXI_CLK] = &gcc_disp_throttle_hf_axi_clk.clkr,
+- [GCC_DISP_XO_CLK] = &gcc_disp_xo_clk.clkr,
+ [GCC_GP1_CLK] = &gcc_gp1_clk.clkr,
+ [GCC_GP1_CLK_SRC] = &gcc_gp1_clk_src.clkr,
+ [GCC_GP2_CLK] = &gcc_gp2_clk.clkr,
+@@ -2413,7 +2372,6 @@ static struct clk_regmap *gcc_sc7180_clocks[] = {
+ [GCC_VIDEO_AXI_CLK] = &gcc_video_axi_clk.clkr,
+ [GCC_VIDEO_GPLL0_DIV_CLK_SRC] = &gcc_video_gpll0_div_clk_src.clkr,
+ [GCC_VIDEO_THROTTLE_AXI_CLK] = &gcc_video_throttle_axi_clk.clkr,
+- [GCC_VIDEO_XO_CLK] = &gcc_video_xo_clk.clkr,
+ [GPLL0] = &gpll0.clkr,
+ [GPLL0_OUT_EVEN] = &gpll0_out_even.clkr,
+ [GPLL6] = &gpll6.clkr,
+@@ -2510,6 +2468,9 @@ static int gcc_sc7180_probe(struct platform_device *pdev)
+ regmap_update_bits(regmap, 0x0b004, BIT(0), BIT(0));
+ regmap_update_bits(regmap, 0x0b008, BIT(0), BIT(0));
+ regmap_update_bits(regmap, 0x0b00c, BIT(0), BIT(0));
++ regmap_update_bits(regmap, 0x0b02c, BIT(0), BIT(0));
++ regmap_update_bits(regmap, 0x0b028, BIT(0), BIT(0));
++ regmap_update_bits(regmap, 0x0b030, BIT(0), BIT(0));
+ regmap_update_bits(regmap, 0x71004, BIT(0), BIT(0));
+
+ ret = qcom_cc_register_rcg_dfs(regmap, gcc_dfs_clocks,
+--
+2.27.0
+
--- /dev/null
+From f17d4a694fe47c1206a2e426a6267d79e3320b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 11:38:51 +0000
+Subject: clk: qcom: gfm-mux: fix clk mask
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 78ddb79cab178534b2c1d9ab95823f2af882ee8e ]
+
+For some reason global GFM_MASK ended up with bit 1 instead of bit 0.
+Remove the global GFM_MASK and reuse mux_mask field.
+
+Fixes: a2d8f507803e ("clk: qcom: Add support to LPASS AUDIO_CC Glitch Free Mux clocks")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210119113851.18946-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/lpass-gfm-sm8250.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/qcom/lpass-gfm-sm8250.c b/drivers/clk/qcom/lpass-gfm-sm8250.c
+index d366c7c2abc77..f5e31e692b9b4 100644
+--- a/drivers/clk/qcom/lpass-gfm-sm8250.c
++++ b/drivers/clk/qcom/lpass-gfm-sm8250.c
+@@ -33,14 +33,13 @@ struct clk_gfm {
+ void __iomem *gfm_mux;
+ };
+
+-#define GFM_MASK BIT(1)
+ #define to_clk_gfm(_hw) container_of(_hw, struct clk_gfm, hw)
+
+ static u8 clk_gfm_get_parent(struct clk_hw *hw)
+ {
+ struct clk_gfm *clk = to_clk_gfm(hw);
+
+- return readl(clk->gfm_mux) & GFM_MASK;
++ return readl(clk->gfm_mux) & clk->mux_mask;
+ }
+
+ static int clk_gfm_set_parent(struct clk_hw *hw, u8 index)
+@@ -51,9 +50,10 @@ static int clk_gfm_set_parent(struct clk_hw *hw, u8 index)
+ val = readl(clk->gfm_mux);
+
+ if (index)
+- val |= GFM_MASK;
++ val |= clk->mux_mask;
+ else
+- val &= ~GFM_MASK;
++ val &= ~clk->mux_mask;
++
+
+ writel(val, clk->gfm_mux);
+
+--
+2.27.0
+
--- /dev/null
+From 02773d2e1d03a23bec1fdb89310cce6da850b7d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 14:06:10 +0200
+Subject: clk: renesas: r8a779a0: Fix parent of CBFUSA clock
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 80d3e07ec509c5098d44e4f1416cc9f133fd436f ]
+
+According to Figure 8.1.1 ("Block Diagram of CPG (R-Car V3U-AD)") in the
+R-Car V3U Series User's Manual Rev. 0.5, the parent of the CBFUSA clock
+is EXTAL.
+
+Fixes: 17bcc8035d2d19fc ("clk: renesas: cpg-mssr: Add support for R-Car V3U")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20201019120614.22149-3-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779a0-cpg-mssr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r8a779a0-cpg-mssr.c b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+index 9ccefc36b7ca8..7b2c640c3de0c 100644
+--- a/drivers/clk/renesas/r8a779a0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+@@ -136,7 +136,7 @@ static const struct cpg_core_clk r8a779a0_core_clks[] __initconst = {
+ DEF_FIXED("icu", R8A779A0_CLK_ICU, CLK_PLL5_DIV4, 2, 1),
+ DEF_FIXED("icud2", R8A779A0_CLK_ICUD2, CLK_PLL5_DIV4, 4, 1),
+ DEF_FIXED("vcbus", R8A779A0_CLK_VCBUS, CLK_PLL5_DIV4, 1, 1),
+- DEF_FIXED("cbfusa", R8A779A0_CLK_CBFUSA, CLK_MAIN, 2, 1),
++ DEF_FIXED("cbfusa", R8A779A0_CLK_CBFUSA, CLK_EXTAL, 2, 1),
+
+ DEF_DIV6P1("mso", R8A779A0_CLK_MSO, CLK_PLL5_DIV4, 0x87c),
+ DEF_DIV6P1("canfd", R8A779A0_CLK_CANFD, CLK_PLL5_DIV4, 0x878),
+--
+2.27.0
+
--- /dev/null
+From 3ea5c7a2bbfd6f52410638be81f727cfe81d320c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 14:06:09 +0200
+Subject: clk: renesas: r8a779a0: Remove non-existent S2 clock
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 5b30be15ca262d9cb2c36b173bb488e8d1952ea0 ]
+
+The S2 internal core clock does not exist on R-Car V3U. Remove it.
+
+Fixes: 17bcc8035d2d19fc ("clk: renesas: cpg-mssr: Add support for R-Car V3U")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20201019120614.22149-2-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779a0-cpg-mssr.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r8a779a0-cpg-mssr.c b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+index aa5389b04d742..9ccefc36b7ca8 100644
+--- a/drivers/clk/renesas/r8a779a0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779a0-cpg-mssr.c
+@@ -69,7 +69,6 @@ enum clk_ids {
+ CLK_PLL5_DIV2,
+ CLK_PLL5_DIV4,
+ CLK_S1,
+- CLK_S2,
+ CLK_S3,
+ CLK_SDSRC,
+ CLK_RPCSRC,
+--
+2.27.0
+
--- /dev/null
+From e6e6813e3310d5337242aa49857ed5cf858d64d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 14:32:46 +0000
+Subject: clk: sunxi-ng: h6: Fix CEC clock
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 756650820abd4770c4200763505b634a3c04e05e ]
+
+The CEC clock on the H6 SoC is a bit special, since it uses a fixed
+pre-dividier for one source clock (the PLL), but conveys the other clock
+(32K OSC) directly.
+We are using a fixed predivider array for that, but fail to use the right
+flag to actually activate that.
+
+Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU")
+Reported-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210106143246.11255-1-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index f2497d0a4683a..a26dbbdff80d1 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -682,7 +682,7 @@ static struct ccu_mux hdmi_cec_clk = {
+
+ .common = {
+ .reg = 0xb10,
+- .features = CCU_FEATURE_VARIABLE_PREDIV,
++ .features = CCU_FEATURE_FIXED_PREDIV,
+ .hw.init = CLK_HW_INIT_PARENTS("hdmi-cec",
+ hdmi_cec_parents,
+ &ccu_mux_ops,
+--
+2.27.0
+
--- /dev/null
+From eb7bffb68949d7568456c59abb2879a96d62f6f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 00:09:12 +0000
+Subject: clk: sunxi-ng: h6: Fix clock divider range on some clocks
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 04ef679591c76571a9e7d5ca48316cc86fa0ef12 ]
+
+While comparing clocks between the H6 and H616, some of the M factor
+ranges were found to be wrong: the manual says they are only covering
+two bits [1:0], but our code had "5" in the number-of-bits field.
+
+By writing 0xff into that register in U-Boot and via FEL, it could be
+confirmed that bits [4:2] are indeed masked off, so the manual is right.
+
+Change to number of bits in the affected clock's description.
+
+Fixes: 524353ea480b ("clk: sunxi-ng: add support for the Allwinner H6 CCU")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20210118000912.28116-1-andre.przywara@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index a26dbbdff80d1..bff446b782907 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -237,7 +237,7 @@ static const char * const psi_ahb1_ahb2_parents[] = { "osc24M", "osc32k",
+ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2",
+ psi_ahb1_ahb2_parents,
+ 0x510,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+@@ -246,19 +246,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k",
+ "psi-ahb1-ahb2",
+ "pll-periph0" };
+ static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,
+- 0, 5, /* M */
++ 0, 2, /* M */
+ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+--
+2.27.0
+
--- /dev/null
+From 3a7006b77c523d2ee33c6176cc12ac6c3c74447c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 14:59:24 +0100
+Subject: clocksource/drivers/ixp4xx: Select TIMER_OF when needed
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7a3b8758bd6e45f7b671723b5c9fa2b69d0787ae ]
+
+Compile-testing the ixp4xx timer with CONFIG_OF enabled but
+CONFIG_TIMER_OF disabled leads to a harmless warning:
+
+arm-linux-gnueabi-ld: warning: orphan section `__timer_of_table' from `drivers/clocksource/timer-ixp4xx.o' being placed in section `__timer_of_table'
+
+Move the select statement from the platform code into the driver
+so it always gets enabled in configurations that rely on it.
+
+Fixes: 40df14cc5cc0 ("clocksource/drivers/ixp4xx: Add OF initialization support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210103135955.3808976-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ixp4xx/Kconfig | 1 -
+ drivers/clocksource/Kconfig | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig
+index f7211b57b1e78..165c184801e19 100644
+--- a/arch/arm/mach-ixp4xx/Kconfig
++++ b/arch/arm/mach-ixp4xx/Kconfig
+@@ -13,7 +13,6 @@ config MACH_IXP4XX_OF
+ select I2C
+ select I2C_IOP3XX
+ select PCI
+- select TIMER_OF
+ select USE_OF
+ help
+ Say 'Y' here to support Device Tree-based IXP4xx platforms.
+diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
+index 14c7c47124787..66be9ea69e332 100644
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -79,6 +79,7 @@ config IXP4XX_TIMER
+ bool "Intel XScale IXP4xx timer driver" if COMPILE_TEST
+ depends on HAS_IOMEM
+ select CLKSRC_MMIO
++ select TIMER_OF if OF
+ help
+ Enables support for the Intel XScale IXP4xx SoC timer.
+
+--
+2.27.0
+
--- /dev/null
+From ebeb13b9e398c9dc957b265057d5a50065771ef8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:19:55 -0800
+Subject: clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is
+ defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 7da390694afbaed8e0f05717a541dfaf1077ba51 ]
+
+When DEBUG is defined this error occurs
+
+drivers/clocksource/mxs_timer.c:138:1: error:
+ expected ‘;’ before ‘}’ token
+
+The preceding statement needs a semicolon.
+Replace pr_info() with pr_debug() and remove the unneeded ifdef.
+
+Fixes: eb8703e2ef7c ("clockevents/drivers/mxs: Migrate to new 'set-state' interface")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210118211955.763609-1-trix@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/mxs_timer.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/clocksource/mxs_timer.c b/drivers/clocksource/mxs_timer.c
+index bc96a4cbf26c6..e52e12d27d2aa 100644
+--- a/drivers/clocksource/mxs_timer.c
++++ b/drivers/clocksource/mxs_timer.c
+@@ -131,10 +131,7 @@ static void mxs_irq_clear(char *state)
+
+ /* Clear pending interrupt */
+ timrot_irq_acknowledge();
+-
+-#ifdef DEBUG
+- pr_info("%s: changing mode to %s\n", __func__, state)
+-#endif /* DEBUG */
++ pr_debug("%s: changing mode to %s\n", __func__, state);
+ }
+
+ static int mxs_shutdown(struct clock_event_device *evt)
+--
+2.27.0
+
--- /dev/null
+From 546b13d7b5bee30856d582726f446ec0932bca16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 11:13:24 -0700
+Subject: coresight: etm4x: Skip accessing TRCPDCR in save/restore
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit df81b43802f43c0954a55e5d513e8750a1ab4d31 ]
+
+When the ETM is affected by Qualcomm errata, modifying the
+TRCPDCR could cause the system hang. Even though this is
+taken care of during enable/disable ETM, the ETM state
+save/restore could still access the TRCPDCR. Make sure
+we skip the access during the save/restore.
+
+Found by code inspection.
+
+Link: https://lore.kernel.org/r/20210110224850.1880240-3-suzuki.poulose@arm.com
+Fixes: 02510a5aa78d ("coresight: etm4x: Add support to skip trace unit power up")
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Cc: Tingwei Zhang <tingwei@codeaurora.org>
+Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Link: https://lore.kernel.org/r/20210201181351.1475223-5-mathieu.poirier@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x-core.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+index b20b6ff17cf65..200fa1c8aa0be 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
+@@ -1355,7 +1355,8 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
+
+ state->trcclaimset = readl(drvdata->base + TRCCLAIMCLR);
+
+- state->trcpdcr = readl(drvdata->base + TRCPDCR);
++ if (!drvdata->skip_power_up)
++ state->trcpdcr = readl(drvdata->base + TRCPDCR);
+
+ /* wait for TRCSTATR.IDLE to go up */
+ if (coresight_timeout(drvdata->base, TRCSTATR, TRCSTATR_IDLE_BIT, 1)) {
+@@ -1373,9 +1374,9 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata)
+ * potentially save power on systems that respect the TRCPDCR_PU
+ * despite requesting software to save/restore state.
+ */
+- writel_relaxed((state->trcpdcr & ~TRCPDCR_PU),
+- drvdata->base + TRCPDCR);
+-
++ if (!drvdata->skip_power_up)
++ writel_relaxed((state->trcpdcr & ~TRCPDCR_PU),
++ drvdata->base + TRCPDCR);
+ out:
+ CS_LOCK(drvdata->base);
+ return ret;
+@@ -1469,7 +1470,8 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata)
+
+ writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET);
+
+- writel_relaxed(state->trcpdcr, drvdata->base + TRCPDCR);
++ if (!drvdata->skip_power_up)
++ writel_relaxed(state->trcpdcr, drvdata->base + TRCPDCR);
+
+ drvdata->state_needs_restore = false;
+
+--
+2.27.0
+
--- /dev/null
+From dcd4d1ddcefa82f0eb525bc86184348db6a427c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 15:26:44 +0100
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix resource leaks in ->remove()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3657f729b6fb5f2c0bf693742de2dcd49c572aa1 ]
+
+If 'cpufreq_unregister_driver()' fails, just WARN and continue, so that
+other resources are freed.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[ Viresh: Updated Subject ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index e25ccb744187d..4153150e20db5 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -754,8 +754,7 @@ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
+ int ret;
+
+ ret = cpufreq_unregister_driver(&brcm_avs_driver);
+- if (ret)
+- return ret;
++ WARN_ON(ret);
+
+ brcm_avs_prepare_uninit(pdev);
+
+--
+2.27.0
+
--- /dev/null
+From 5914cf6357c9d65a48102123b8dcc274399e25b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 15:26:35 +0100
+Subject: cpufreq: brcmstb-avs-cpufreq: Free resources in error path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 05f456286fd489558c72a4711d22a5612c965685 ]
+
+If 'cpufreq_register_driver()' fails, we must release the resources
+allocated in 'brcm_avs_prepare_init()' as already done in the remove
+function.
+
+To do that, introduce a new function 'brcm_avs_prepare_uninit()' in order
+to avoid code duplication. This also makes the code more readable (IMHO).
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+[ Viresh: Updated Subject ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 3e31e5d28b79c..e25ccb744187d 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -597,6 +597,16 @@ unmap_base:
+ return ret;
+ }
+
++static void brcm_avs_prepare_uninit(struct platform_device *pdev)
++{
++ struct private_data *priv;
++
++ priv = platform_get_drvdata(pdev);
++
++ iounmap(priv->avs_intr_base);
++ iounmap(priv->base);
++}
++
+ static int brcm_avs_cpufreq_init(struct cpufreq_policy *policy)
+ {
+ struct cpufreq_frequency_table *freq_table;
+@@ -732,21 +742,22 @@ static int brcm_avs_cpufreq_probe(struct platform_device *pdev)
+
+ brcm_avs_driver.driver_data = pdev;
+
+- return cpufreq_register_driver(&brcm_avs_driver);
++ ret = cpufreq_register_driver(&brcm_avs_driver);
++ if (ret)
++ brcm_avs_prepare_uninit(pdev);
++
++ return ret;
+ }
+
+ static int brcm_avs_cpufreq_remove(struct platform_device *pdev)
+ {
+- struct private_data *priv;
+ int ret;
+
+ ret = cpufreq_unregister_driver(&brcm_avs_driver);
+ if (ret)
+ return ret;
+
+- priv = platform_get_drvdata(pdev);
+- iounmap(priv->base);
+- iounmap(priv->avs_intr_base);
++ brcm_avs_prepare_uninit(pdev);
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 30057b79db45a5776cd94ba201c4b10a699c8fcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 19:55:15 +0100
+Subject: crypto: arm64/aes-ce - really hide slower algos when faster ones are
+ enabled
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 15deb4333cd6d4e1e3216582e4c531ec40a6b060 ]
+
+Commit 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if
+faster driver is enabled") intended to hide modes from the plain NEON
+driver that are also implemented by the faster bit sliced NEON one if
+both are enabled. However, the defined() CPP function does not detect
+if the bit sliced NEON driver is enabled as a module. So instead, let's
+use IS_ENABLED() here.
+
+Fixes: 69b6f2e817e5b ("crypto: arm64/aes-neon - limit exposed routines if ...")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/crypto/aes-glue.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
+index 34b8a89197be3..cafb5b96be0e6 100644
+--- a/arch/arm64/crypto/aes-glue.c
++++ b/arch/arm64/crypto/aes-glue.c
+@@ -55,7 +55,7 @@ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 Crypto Extensions");
+ #define aes_mac_update neon_aes_mac_update
+ MODULE_DESCRIPTION("AES-ECB/CBC/CTR/XTS using ARMv8 NEON");
+ #endif
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
+ MODULE_ALIAS_CRYPTO("ecb(aes)");
+ MODULE_ALIAS_CRYPTO("cbc(aes)");
+ MODULE_ALIAS_CRYPTO("ctr(aes)");
+@@ -650,7 +650,7 @@ static int __maybe_unused xts_decrypt(struct skcipher_request *req)
+ }
+
+ static struct skcipher_alg aes_algs[] = { {
+-#if defined(USE_V8_CRYPTO_EXTENSIONS) || !defined(CONFIG_CRYPTO_AES_ARM64_BS)
++#if defined(USE_V8_CRYPTO_EXTENSIONS) || !IS_ENABLED(CONFIG_CRYPTO_AES_ARM64_BS)
+ .base = {
+ .cra_name = "__ecb(aes)",
+ .cra_driver_name = "__ecb-aes-" MODE,
+--
+2.27.0
+
--- /dev/null
+From ecaf7cd6b3cb37e74d4f375ab1e0e19e7cc1704a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 00:02:37 +0100
+Subject: crypto: bcm - Rename struct device_private to bcm_device_private
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit f7f2b43eaf6b4cfe54c75100709be31d5c4b52c8 ]
+
+Renaming 'struct device_private' to 'struct bcm_device_private',
+because it clashes with 'struct device_private' from
+'drivers/base/base.h'.
+
+While it's not a functional problem, it's causing two distinct
+type hierarchies in BTF data. It also breaks build with options:
+ CONFIG_DEBUG_INFO_BTF=y
+ CONFIG_CRYPTO_DEV_BCM_SPU=y
+
+as reported by Qais Yousef [1].
+
+[1] https://lore.kernel.org/lkml/20201229151352.6hzmjvu3qh6p2qgg@e107158-lin/
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Tested-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 2 +-
+ drivers/crypto/bcm/cipher.h | 4 ++--
+ drivers/crypto/bcm/util.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 30390a7324b29..0e5537838ef36 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -42,7 +42,7 @@
+
+ /* ================= Device Structure ================== */
+
+-struct device_private iproc_priv;
++struct bcm_device_private iproc_priv;
+
+ /* ==================== Parameters ===================== */
+
+diff --git a/drivers/crypto/bcm/cipher.h b/drivers/crypto/bcm/cipher.h
+index 0ad5892b445d3..71281a3bdbdc0 100644
+--- a/drivers/crypto/bcm/cipher.h
++++ b/drivers/crypto/bcm/cipher.h
+@@ -420,7 +420,7 @@ struct spu_hw {
+ u32 num_chan;
+ };
+
+-struct device_private {
++struct bcm_device_private {
+ struct platform_device *pdev;
+
+ struct spu_hw spu;
+@@ -467,6 +467,6 @@ struct device_private {
+ struct mbox_chan **mbox;
+ };
+
+-extern struct device_private iproc_priv;
++extern struct bcm_device_private iproc_priv;
+
+ #endif
+diff --git a/drivers/crypto/bcm/util.c b/drivers/crypto/bcm/util.c
+index 2b304fc780595..77aeedb840555 100644
+--- a/drivers/crypto/bcm/util.c
++++ b/drivers/crypto/bcm/util.c
+@@ -348,7 +348,7 @@ char *spu_alg_name(enum spu_cipher_alg alg, enum spu_cipher_mode mode)
+ static ssize_t spu_debugfs_read(struct file *filp, char __user *ubuf,
+ size_t count, loff_t *offp)
+ {
+- struct device_private *ipriv;
++ struct bcm_device_private *ipriv;
+ char *buf;
+ ssize_t ret, out_offset, out_count;
+ int i;
+--
+2.27.0
+
--- /dev/null
+From 846487bff56518857cc915a0312bd6d3fda9f157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 11:28:37 +0000
+Subject: crypto: ecdh_helper - Ensure 'len >= secret.len' in decode_key()
+
+From: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+
+[ Upstream commit a53ab94eb6850c3657392e2d2ce9b38c387a2633 ]
+
+The length ('len' parameter) passed to crypto_ecdh_decode_key() is never
+checked against the length encoded in the passed buffer ('buf'
+parameter). This could lead to an out-of-bounds access when the passed
+length is less than the encoded length.
+
+Add a check to prevent that.
+
+Fixes: 3c4b23901a0c7 ("crypto: ecdh - Add ECDH software support")
+Signed-off-by: Daniele Alessandrelli <daniele.alessandrelli@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecdh_helper.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/crypto/ecdh_helper.c b/crypto/ecdh_helper.c
+index 66fcb2ea81544..fca63b559f655 100644
+--- a/crypto/ecdh_helper.c
++++ b/crypto/ecdh_helper.c
+@@ -67,6 +67,9 @@ int crypto_ecdh_decode_key(const char *buf, unsigned int len,
+ if (secret.type != CRYPTO_KPP_SECRET_TYPE_ECDH)
+ return -EINVAL;
+
++ if (unlikely(len < secret.len))
++ return -EINVAL;
++
+ ptr = ecdh_unpack_data(¶ms->curve_id, ptr, sizeof(params->curve_id));
+ ptr = ecdh_unpack_data(¶ms->key_size, ptr, sizeof(params->key_size));
+ if (secret.len != crypto_ecdh_key_len(params))
+--
+2.27.0
+
--- /dev/null
+From 074fc0cd9d4de6ece1962e908171685907ee5d8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:35:15 +0000
+Subject: crypto: qat - replace CRYPTO_AES with CRYPTO_LIB_AES in Kconfig
+
+From: Marco Chiappero <marco.chiappero@intel.com>
+
+[ Upstream commit 4f1a02e75a2eedfddd10222c0fe61d2a04d80099 ]
+
+Use CRYPTO_LIB_AES in place of CRYPTO_AES in the dependences for the QAT
+common code.
+
+Fixes: c0e583ab2016 ("crypto: qat - add CRYPTO_AES to Kconfig dependencies")
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/Kconfig b/drivers/crypto/qat/Kconfig
+index 846a3d90b41a3..77783feb62b25 100644
+--- a/drivers/crypto/qat/Kconfig
++++ b/drivers/crypto/qat/Kconfig
+@@ -11,7 +11,7 @@ config CRYPTO_DEV_QAT
+ select CRYPTO_SHA1
+ select CRYPTO_SHA256
+ select CRYPTO_SHA512
+- select CRYPTO_AES
++ select CRYPTO_LIB_AES
+ select FW_LOADER
+
+ config CRYPTO_DEV_QAT_DH895xCC
+--
+2.27.0
+
--- /dev/null
+From d8be8f5b765060fad9f7554b6c692328a71d667d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 20:02:30 +0000
+Subject: crypto: sun4i-ss - fix kmap usage
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 9bc3dd24e7dccd50757db743a3635ad5b0497e6e ]
+
+With the recent kmap change, some tests which were conditional on
+CONFIG_DEBUG_HIGHMEM now are enabled by default.
+This permit to detect a problem in sun4i-ss usage of kmap.
+
+sun4i-ss uses two kmap via sg_miter (one for input, one for output), but
+using two kmap at the same time is hard:
+"the ordering has to be correct and with sg_miter that's probably hard to get
+right." (quoting Tlgx)
+
+So the easiest solution is to never have two sg_miter/kmap open at the same time.
+After each use of sg_miter, I store the current index, for being able to
+resume sg_miter to the right place.
+
+Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../allwinner/sun4i-ss/sun4i-ss-cipher.c | 109 +++++++++++-------
+ 1 file changed, 65 insertions(+), 44 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+index 19f1aa577ed4d..1f8a38d131928 100644
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -30,6 +30,8 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ unsigned int ileft = areq->cryptlen;
+ unsigned int oleft = areq->cryptlen;
+ unsigned int todo;
++ unsigned long pi = 0, po = 0; /* progress for in and out */
++ bool miter_err;
+ struct sg_mapping_iter mi, mo;
+ unsigned int oi, oo; /* offset for in and out */
+ unsigned long flags;
+@@ -55,39 +57,51 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ }
+ writel(mode, ss->base + SS_CTL);
+
+- sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+- SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+- SG_MITER_TO_SG | SG_MITER_ATOMIC);
+- sg_miter_next(&mi);
+- sg_miter_next(&mo);
+- if (!mi.addr || !mo.addr) {
+- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+- err = -EINVAL;
+- goto release_ss;
+- }
+
+ ileft = areq->cryptlen / 4;
+ oleft = areq->cryptlen / 4;
+ oi = 0;
+ oo = 0;
+ do {
+- todo = min(rx_cnt, ileft);
+- todo = min_t(size_t, todo, (mi.length - oi) / 4);
+- if (todo) {
+- ileft -= todo;
+- writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
+- oi += todo * 4;
+- }
+- if (oi == mi.length) {
+- sg_miter_next(&mi);
+- oi = 0;
++ if (ileft) {
++ sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++ SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++ if (pi)
++ sg_miter_skip(&mi, pi);
++ miter_err = sg_miter_next(&mi);
++ if (!miter_err || !mi.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
++ todo = min(rx_cnt, ileft);
++ todo = min_t(size_t, todo, (mi.length - oi) / 4);
++ if (todo) {
++ ileft -= todo;
++ writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo);
++ oi += todo * 4;
++ }
++ if (oi == mi.length) {
++ pi += mi.length;
++ oi = 0;
++ }
++ sg_miter_stop(&mi);
+ }
+
+ spaces = readl(ss->base + SS_FCSR);
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+
++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++ SG_MITER_TO_SG | SG_MITER_ATOMIC);
++ if (po)
++ sg_miter_skip(&mo, po);
++ miter_err = sg_miter_next(&mo);
++ if (!miter_err || !mo.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ todo = min(tx_cnt, oleft);
+ todo = min_t(size_t, todo, (mo.length - oo) / 4);
+ if (todo) {
+@@ -96,9 +110,10 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ oo += todo * 4;
+ }
+ if (oo == mo.length) {
+- sg_miter_next(&mo);
+ oo = 0;
++ po += mo.length;
+ }
++ sg_miter_stop(&mo);
+ } while (oleft);
+
+ if (areq->iv) {
+@@ -109,8 +124,6 @@ static int noinline_for_stack sun4i_ss_opti_poll(struct skcipher_request *areq)
+ }
+
+ release_ss:
+- sg_miter_stop(&mi);
+- sg_miter_stop(&mo);
+ writel(0, ss->base + SS_CTL);
+ spin_unlock_irqrestore(&ss->slock, flags);
+ return err;
+@@ -162,6 +175,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ unsigned int oleft = areq->cryptlen;
+ unsigned int todo;
+ struct sg_mapping_iter mi, mo;
++ unsigned long pi = 0, po = 0; /* progress for in and out */
++ bool miter_err;
+ unsigned int oi, oo; /* offset for in and out */
+ unsigned int ob = 0; /* offset in buf */
+ unsigned int obo = 0; /* offset in bufo*/
+@@ -215,17 +230,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ }
+ writel(mode, ss->base + SS_CTL);
+
+- sg_miter_start(&mi, areq->src, sg_nents(areq->src),
+- SG_MITER_FROM_SG | SG_MITER_ATOMIC);
+- sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
+- SG_MITER_TO_SG | SG_MITER_ATOMIC);
+- sg_miter_next(&mi);
+- sg_miter_next(&mo);
+- if (!mi.addr || !mo.addr) {
+- dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
+- err = -EINVAL;
+- goto release_ss;
+- }
+ ileft = areq->cryptlen;
+ oleft = areq->cryptlen;
+ oi = 0;
+@@ -233,6 +237,16 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+
+ while (oleft) {
+ if (ileft) {
++ sg_miter_start(&mi, areq->src, sg_nents(areq->src),
++ SG_MITER_FROM_SG | SG_MITER_ATOMIC);
++ if (pi)
++ sg_miter_skip(&mi, pi);
++ miter_err = sg_miter_next(&mi);
++ if (!miter_err || !mi.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ /*
+ * todo is the number of consecutive 4byte word that we
+ * can read from current SG
+@@ -265,31 +279,38 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ }
+ }
+ if (oi == mi.length) {
+- sg_miter_next(&mi);
++ pi += mi.length;
+ oi = 0;
+ }
++ sg_miter_stop(&mi);
+ }
+
+ spaces = readl(ss->base + SS_FCSR);
+ rx_cnt = SS_RXFIFO_SPACES(spaces);
+ tx_cnt = SS_TXFIFO_SPACES(spaces);
+- dev_dbg(ss->dev,
+- "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n",
+- mode,
+- oi, mi.length, ileft, areq->cryptlen, rx_cnt,
+- oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob);
+
+ if (!tx_cnt)
+ continue;
++ sg_miter_start(&mo, areq->dst, sg_nents(areq->dst),
++ SG_MITER_TO_SG | SG_MITER_ATOMIC);
++ if (po)
++ sg_miter_skip(&mo, po);
++ miter_err = sg_miter_next(&mo);
++ if (!miter_err || !mo.addr) {
++ dev_err_ratelimited(ss->dev, "ERROR: sg_miter return null\n");
++ err = -EINVAL;
++ goto release_ss;
++ }
+ /* todo in 4bytes word */
+ todo = min(tx_cnt, oleft / 4);
+ todo = min_t(size_t, todo, (mo.length - oo) / 4);
++
+ if (todo) {
+ readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo);
+ oleft -= todo * 4;
+ oo += todo * 4;
+ if (oo == mo.length) {
+- sg_miter_next(&mo);
++ po += mo.length;
+ oo = 0;
+ }
+ } else {
+@@ -314,12 +335,14 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ obo += todo;
+ oo += todo;
+ if (oo == mo.length) {
++ po += mo.length;
+ sg_miter_next(&mo);
+ oo = 0;
+ }
+ } while (obo < obl);
+ /* bufo must be fully used here */
+ }
++ sg_miter_stop(&mo);
+ }
+ if (areq->iv) {
+ for (i = 0; i < 4 && i < ivsize / 4; i++) {
+@@ -329,8 +352,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ }
+
+ release_ss:
+- sg_miter_stop(&mi);
+- sg_miter_stop(&mo);
+ writel(0, ss->base + SS_CTL);
+ spin_unlock_irqrestore(&ss->slock, flags);
+
+--
+2.27.0
+
--- /dev/null
+From a2a520513e02565ec7aa2141392f5613b4f6b876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 20:02:25 +0000
+Subject: crypto: sun4i-ss - linearize buffers content must be kept
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 583513510a7acd2306787865bcd19ebb2f629d42 ]
+
+When running the non-optimized cipher function, SS produce partial random
+output.
+This is due to linearize buffers being reseted after each loop.
+
+For preserving stack, instead of moving them back to start of function,
+I move them in sun4i_ss_ctx.
+
+Fixes: 8d3bcb9900ca ("crypto: sun4i-ss - reduce stack usage")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 12 ++++--------
+ drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h | 2 ++
+ 2 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+index b72de8939497b..19f1aa577ed4d 100644
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c
+@@ -233,8 +233,6 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+
+ while (oleft) {
+ if (ileft) {
+- char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
+-
+ /*
+ * todo is the number of consecutive 4byte word that we
+ * can read from current SG
+@@ -256,12 +254,12 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ */
+ todo = min(rx_cnt * 4 - ob, ileft);
+ todo = min_t(size_t, todo, mi.length - oi);
+- memcpy(buf + ob, mi.addr + oi, todo);
++ memcpy(ss->buf + ob, mi.addr + oi, todo);
+ ileft -= todo;
+ oi += todo;
+ ob += todo;
+ if (!(ob % 4)) {
+- writesl(ss->base + SS_RXFIFO, buf,
++ writesl(ss->base + SS_RXFIFO, ss->buf,
+ ob / 4);
+ ob = 0;
+ }
+@@ -295,13 +293,11 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ oo = 0;
+ }
+ } else {
+- char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
+-
+ /*
+ * read obl bytes in bufo, we read at maximum for
+ * emptying the device
+ */
+- readsl(ss->base + SS_TXFIFO, bufo, tx_cnt);
++ readsl(ss->base + SS_TXFIFO, ss->bufo, tx_cnt);
+ obl = tx_cnt * 4;
+ obo = 0;
+ do {
+@@ -313,7 +309,7 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq)
+ */
+ todo = min_t(size_t,
+ mo.length - oo, obl - obo);
+- memcpy(mo.addr + oo, bufo + obo, todo);
++ memcpy(mo.addr + oo, ss->bufo + obo, todo);
+ oleft -= todo;
+ obo += todo;
+ oo += todo;
+diff --git a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
+index 5c291e4a6857b..c242fccb2ab67 100644
+--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss.h
+@@ -148,6 +148,8 @@ struct sun4i_ss_ctx {
+ struct reset_control *reset;
+ struct device *dev;
+ struct resource *res;
++ char buf[4 * SS_RX_MAX];/* buffer for linearize SG src */
++ char bufo[4 * SS_TX_MAX]; /* buffer for linearize SG dst */
+ spinlock_t slock; /* control the use of the device */
+ #ifdef CONFIG_CRYPTO_DEV_SUN4I_SS_PRNG
+ u32 seed[SS_SEED_LEN / BITS_PER_LONG];
+--
+2.27.0
+
--- /dev/null
+From cf2dda4885bb265a288e90e87652bfbd6cd6f575 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 18:57:25 +0000
+Subject: crypto: talitos - Fix ctr(aes) on SEC1
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 43a942d27eaaf33bca560121cbe42f3637e92880 ]
+
+While ctr(aes) requires the use of a special descriptor on SEC2 (see
+commit 70d355ccea89 ("crypto: talitos - fix ctr-aes-talitos")), that
+special descriptor doesn't work on SEC1, see commit e738c5f15562
+("powerpc/8xx: Add DT node for using the SEC engine of the MPC885").
+
+However, the common nonsnoop descriptor works properly on SEC1 for
+ctr(aes).
+
+Add a second template for ctr(aes) that will be registered
+only on SEC1.
+
+Fixes: 70d355ccea89 ("crypto: talitos - fix ctr-aes-talitos")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index b656983c1ef4e..25c9f825b8b54 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -2765,6 +2765,22 @@ static struct talitos_alg_template driver_algs[] = {
+ DESC_HDR_SEL0_AESU |
+ DESC_HDR_MODE0_AESU_CTR,
+ },
++ { .type = CRYPTO_ALG_TYPE_SKCIPHER,
++ .alg.skcipher = {
++ .base.cra_name = "ctr(aes)",
++ .base.cra_driver_name = "ctr-aes-talitos",
++ .base.cra_blocksize = 1,
++ .base.cra_flags = CRYPTO_ALG_ASYNC |
++ CRYPTO_ALG_ALLOCATES_MEMORY,
++ .min_keysize = AES_MIN_KEY_SIZE,
++ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
++ .setkey = skcipher_aes_setkey,
++ },
++ .desc_hdr_template = DESC_HDR_TYPE_COMMON_NONSNOOP_NO_AFEU |
++ DESC_HDR_SEL0_AESU |
++ DESC_HDR_MODE0_AESU_CTR,
++ },
+ { .type = CRYPTO_ALG_TYPE_SKCIPHER,
+ .alg.skcipher = {
+ .base.cra_name = "ecb(des)",
+@@ -3182,6 +3198,12 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ t_alg->algt.alg.skcipher.setkey ?: skcipher_setkey;
+ t_alg->algt.alg.skcipher.encrypt = skcipher_encrypt;
+ t_alg->algt.alg.skcipher.decrypt = skcipher_decrypt;
++ if (!strcmp(alg->cra_name, "ctr(aes)") && !has_ftr_sec1(priv) &&
++ DESC_TYPE(t_alg->algt.desc_hdr_template) !=
++ DESC_TYPE(DESC_HDR_TYPE_AESU_CTR_NONSNOOP)) {
++ devm_kfree(dev, t_alg);
++ return ERR_PTR(-ENOTSUPP);
++ }
+ break;
+ case CRYPTO_ALG_TYPE_AEAD:
+ alg = &t_alg->algt.alg.aead.base;
+--
+2.27.0
+
--- /dev/null
+From e23ebafb9c1ec6ce073a3fd75df4b46e80429993 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 18:57:24 +0000
+Subject: crypto: talitos - Work around SEC6 ERRATA (AES-CTR mode data size
+ error)
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 416b846757bcea20006a9197e67ba3a8b5b2a680 ]
+
+Talitos Security Engine AESU considers any input
+data size that is not a multiple of 16 bytes to be an error.
+This is not a problem in general, except for Counter mode
+that is a stream cipher and can have an input of any size.
+
+Test Manager for ctr(aes) fails on 4th test vector which has
+a length of 499 while all previous vectors which have a 16 bytes
+multiple length succeed.
+
+As suggested by Freescale, round up the input data length to the
+nearest 16 bytes.
+
+Fixes: 5e75ae1b3cef ("crypto: talitos - add new crypto modes")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 28 ++++++++++++++++------------
+ drivers/crypto/talitos.h | 1 +
+ 2 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 4fd85f31630ac..b656983c1ef4e 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1093,11 +1093,12 @@ static void ipsec_esp_decrypt_hwauth_done(struct device *dev,
+ */
+ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ unsigned int offset, int datalen, int elen,
+- struct talitos_ptr *link_tbl_ptr)
++ struct talitos_ptr *link_tbl_ptr, int align)
+ {
+ int n_sg = elen ? sg_count + 1 : sg_count;
+ int count = 0;
+ int cryptlen = datalen + elen;
++ int padding = ALIGN(cryptlen, align) - cryptlen;
+
+ while (cryptlen && sg && n_sg--) {
+ unsigned int len = sg_dma_len(sg);
+@@ -1121,7 +1122,7 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ offset += datalen;
+ }
+ to_talitos_ptr(link_tbl_ptr + count,
+- sg_dma_address(sg) + offset, len, 0);
++ sg_dma_address(sg) + offset, sg_next(sg) ? len : len + padding, 0);
+ to_talitos_ptr_ext_set(link_tbl_ptr + count, 0, 0);
+ count++;
+ cryptlen -= len;
+@@ -1144,10 +1145,11 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ unsigned int len, struct talitos_edesc *edesc,
+ struct talitos_ptr *ptr, int sg_count,
+ unsigned int offset, int tbl_off, int elen,
+- bool force)
++ bool force, int align)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
++ int aligned_len = ALIGN(len, align);
+
+ if (!src) {
+ to_talitos_ptr(ptr, 0, 0, is_sec1);
+@@ -1155,22 +1157,22 @@ static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
+ }
+ to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+ if (sg_count == 1 && !force) {
+- to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
++ to_talitos_ptr(ptr, sg_dma_address(src) + offset, aligned_len, is_sec1);
+ return sg_count;
+ }
+ if (is_sec1) {
+- to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
++ to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, aligned_len, is_sec1);
+ return sg_count;
+ }
+ sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, elen,
+- &edesc->link_tbl[tbl_off]);
++ &edesc->link_tbl[tbl_off], align);
+ if (sg_count == 1 && !force) {
+ /* Only one segment now, so no link tbl needed*/
+ copy_talitos_ptr(ptr, &edesc->link_tbl[tbl_off], is_sec1);
+ return sg_count;
+ }
+ to_talitos_ptr(ptr, edesc->dma_link_tbl +
+- tbl_off * sizeof(struct talitos_ptr), len, is_sec1);
++ tbl_off * sizeof(struct talitos_ptr), aligned_len, is_sec1);
+ to_talitos_ptr_ext_or(ptr, DESC_PTR_LNKTBL_JUMP, is_sec1);
+
+ return sg_count;
+@@ -1182,7 +1184,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ unsigned int offset, int tbl_off)
+ {
+ return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
+- tbl_off, 0, false);
++ tbl_off, 0, false, 1);
+ }
+
+ /*
+@@ -1251,7 +1253,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+
+ ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
+ sg_count, areq->assoclen, tbl_off, elen,
+- false);
++ false, 1);
+
+ if (ret > 1) {
+ tbl_off += ret;
+@@ -1271,7 +1273,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ elen = 0;
+ ret = talitos_sg_map_ext(dev, areq->dst, cryptlen, edesc, &desc->ptr[5],
+ sg_count, areq->assoclen, tbl_off, elen,
+- is_ipsec_esp && !encrypt);
++ is_ipsec_esp && !encrypt, 1);
+ tbl_off += ret;
+
+ if (!encrypt && is_ipsec_esp) {
+@@ -1577,6 +1579,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ bool sync_needed = false;
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
++ bool is_ctr = (desc->hdr & DESC_HDR_SEL0_MASK) == DESC_HDR_SEL0_AESU &&
++ (desc->hdr & DESC_HDR_MODE0_AESU_MASK) == DESC_HDR_MODE0_AESU_CTR;
+
+ /* first DWORD empty */
+
+@@ -1597,8 +1601,8 @@ static int common_nonsnoop(struct talitos_edesc *edesc,
+ /*
+ * cipher in
+ */
+- sg_count = talitos_sg_map(dev, areq->src, cryptlen, edesc,
+- &desc->ptr[3], sg_count, 0, 0);
++ sg_count = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[3],
++ sg_count, 0, 0, 0, false, is_ctr ? 16 : 1);
+ if (sg_count > 1)
+ sync_needed = true;
+
+diff --git a/drivers/crypto/talitos.h b/drivers/crypto/talitos.h
+index 1469b956948ab..32825119e8805 100644
+--- a/drivers/crypto/talitos.h
++++ b/drivers/crypto/talitos.h
+@@ -344,6 +344,7 @@ static inline bool has_ftr_sec1(struct talitos_private *priv)
+
+ /* primary execution unit mode (MODE0) and derivatives */
+ #define DESC_HDR_MODE0_ENCRYPT cpu_to_be32(0x00100000)
++#define DESC_HDR_MODE0_AESU_MASK cpu_to_be32(0x00600000)
+ #define DESC_HDR_MODE0_AESU_CBC cpu_to_be32(0x00200000)
+ #define DESC_HDR_MODE0_AESU_CTR cpu_to_be32(0x00600000)
+ #define DESC_HDR_MODE0_DEU_CBC cpu_to_be32(0x00400000)
+--
+2.27.0
+
--- /dev/null
+From 2c8a2ffcc24d5c78f15ad106c0845ccdbaf89ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 17:15:05 +0800
+Subject: csky: Fix a size determination in gpr_get()
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit 8bfb676492da208bd6dde0f22dff79840dbb5051 ]
+
+"*" is missed in size determination as we are passing register set
+rather than a pointer.
+
+Fixes: dcad7854fcce ("sky: switch to ->regset_get()")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
+index d822144906ac1..a4cf2e2ac15ac 100644
+--- a/arch/csky/kernel/ptrace.c
++++ b/arch/csky/kernel/ptrace.c
+@@ -83,7 +83,7 @@ static int gpr_get(struct task_struct *target,
+ /* Abiv1 regs->tls is fake and we need sync here. */
+ regs->tls = task_thread_info(target)->tp_value;
+
+- return membuf_write(&to, regs, sizeof(regs));
++ return membuf_write(&to, regs, sizeof(*regs));
+ }
+
+ static int gpr_set(struct task_struct *target,
+--
+2.27.0
+
--- /dev/null
+From dbbe75f03b8471037a729cf91610615f79337f29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 17:12:26 +0530
+Subject: cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in
+ cxgb4 and ulds
+
+From: Ayush Sawal <ayush.sawal@chelsio.com>
+
+[ Upstream commit 2355a6773a2cb0d2dce13432dde78497f1d6617b ]
+
+The Max imm data size in cxgb4 is not similar to the max imm data size
+in the chtls. This caused an mismatch in output of is_ofld_imm() of
+cxgb4 and chtls. So fixed this by keeping the max wreq size of imm data
+same in both chtls and cxgb4 as MAX_IMM_OFLD_TX_DATA_WR_LEN.
+
+As cxgb4's max imm. data value for ofld packets is changed to
+MAX_IMM_OFLD_TX_DATA_WR_LEN. Using the same in cxgbit also.
+
+Fixes: 36bedb3f2e5b8 ("crypto: chtls - Inline TLS record Tx")
+Signed-off-by: Ayush Sawal <ayush.sawal@chelsio.com>
+Acked-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 3 +++
+ drivers/net/ethernet/chelsio/cxgb4/sge.c | 11 ++++++++---
+ .../ethernet/chelsio/inline_crypto/chtls/chtls_cm.h | 3 ---
+ drivers/target/iscsi/cxgbit/cxgbit_target.c | 3 +--
+ 4 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+index 1b49f2fa9b185..34546f5312eee 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+@@ -46,6 +46,9 @@
+ #define MAX_ULD_QSETS 16
+ #define MAX_ULD_NPORTS 4
+
++/* ulp_mem_io + ulptx_idata + payload + padding */
++#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
++
+ /* CPL message priority levels */
+ enum {
+ CPL_PRIORITY_DATA = 0, /* data messages */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+index 196652a114c5f..3334c9e2152ab 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
+@@ -2842,17 +2842,22 @@ int t4_mgmt_tx(struct adapter *adap, struct sk_buff *skb)
+ * @skb: the packet
+ *
+ * Returns true if a packet can be sent as an offload WR with immediate
+- * data. We currently use the same limit as for Ethernet packets.
++ * data.
++ * FW_OFLD_TX_DATA_WR limits the payload to 255 bytes due to 8-bit field.
++ * However, FW_ULPTX_WR commands have a 256 byte immediate only
++ * payload limit.
+ */
+ static inline int is_ofld_imm(const struct sk_buff *skb)
+ {
+ struct work_request_hdr *req = (struct work_request_hdr *)skb->data;
+ unsigned long opcode = FW_WR_OP_G(ntohl(req->wr_hi));
+
+- if (opcode == FW_CRYPTO_LOOKASIDE_WR)
++ if (unlikely(opcode == FW_ULPTX_WR))
++ return skb->len <= MAX_IMM_ULPTX_WR_LEN;
++ else if (opcode == FW_CRYPTO_LOOKASIDE_WR)
+ return skb->len <= SGE_MAX_WR_LEN;
+ else
+- return skb->len <= MAX_IMM_TX_PKT_LEN;
++ return skb->len <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
+index 47ba81e42f5d0..b1161bdeda4dc 100644
+--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
++++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
+@@ -50,9 +50,6 @@
+ #define MIN_RCV_WND (24 * 1024U)
+ #define LOOPBACK(x) (((x) & htonl(0xff000000)) == htonl(0x7f000000))
+
+-/* ulp_mem_io + ulptx_idata + payload + padding */
+-#define MAX_IMM_ULPTX_WR_LEN (32 + 8 + 256 + 8)
+-
+ /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
+ #define TX_HEADER_LEN \
+ (sizeof(struct fw_ofld_tx_data_wr) + sizeof(struct sge_opaque_hdr))
+diff --git a/drivers/target/iscsi/cxgbit/cxgbit_target.c b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+index 9b3eb2e8c92ad..b926e1d6c7b8e 100644
+--- a/drivers/target/iscsi/cxgbit/cxgbit_target.c
++++ b/drivers/target/iscsi/cxgbit/cxgbit_target.c
+@@ -86,8 +86,7 @@ static int cxgbit_is_ofld_imm(const struct sk_buff *skb)
+ if (likely(cxgbit_skcb_flags(skb) & SKCBF_TX_ISO))
+ length += sizeof(struct cpl_tx_data_iso);
+
+-#define MAX_IMM_TX_PKT_LEN 256
+- return length <= MAX_IMM_TX_PKT_LEN;
++ return length <= MAX_IMM_OFLD_TX_DATA_WR_LEN;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 0f8aa169ddfa7d9d4e64f45031d33d1197fa52c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 10:13:31 +0800
+Subject: device-dax: Fix default return code of range_parse()
+
+From: Shiyang Ruan <ruansy.fnst@cn.fujitsu.com>
+
+[ Upstream commit 7323fb22f05ff1d20498d267828870a5fbbaebd6 ]
+
+The return value of range_parse() indicates the size when it is
+positive. The error code should be negative.
+
+Signed-off-by: Shiyang Ruan <ruansy.fnst@cn.fujitsu.com>
+Reviewed-by: Joao Martins <joao.m.martins@oracle.com>
+Link: https://lore.kernel.org/r/20210126021331.1059933-1-ruansy.fnst@cn.fujitsu.com
+Reported-by: Zhang Qilong <zhangqilong3@huawei.com>
+Fixes: 8490e2e25b5a ("device-dax: add a range mapping allocation attribute")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dax/bus.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dax/bus.c b/drivers/dax/bus.c
+index 737b207c9e30d..3003558c1a8bb 100644
+--- a/drivers/dax/bus.c
++++ b/drivers/dax/bus.c
+@@ -1038,7 +1038,7 @@ static ssize_t range_parse(const char *opt, size_t len, struct range *range)
+ {
+ unsigned long long addr = 0;
+ char *start, *end, *str;
+- ssize_t rc = EINVAL;
++ ssize_t rc = -EINVAL;
+
+ str = kstrdup(opt, GFP_KERNEL);
+ if (!str)
+--
+2.27.0
+
--- /dev/null
+From 5d757dc7aeedcf05aa77c3ed0d88018359af6641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:06:14 +0100
+Subject: dmaengine: fsldma: Fix a resource leak in an error handling path of
+ the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b202d4e82531a62a33a6b14d321dd2aad491578e ]
+
+In case of error, the previous 'fsl_dma_chan_probe()' calls must be undone
+by some 'fsl_dma_chan_remove()', as already done in the remove function.
+
+It was added in the remove function in commit 77cd62e8082b ("fsldma: allow
+Freescale Elo DMA driver to be compiled as a module")
+
+Fixes: d3f620b2c4fe ("fsldma: simplify IRQ probing and handling")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212160614.92576-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsldma.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
+index 554f70a0c18c0..f8459cc5315df 100644
+--- a/drivers/dma/fsldma.c
++++ b/drivers/dma/fsldma.c
+@@ -1214,6 +1214,7 @@ static int fsldma_of_probe(struct platform_device *op)
+ {
+ struct fsldma_device *fdev;
+ struct device_node *child;
++ unsigned int i;
+ int err;
+
+ fdev = kzalloc(sizeof(*fdev), GFP_KERNEL);
+@@ -1292,6 +1293,10 @@ static int fsldma_of_probe(struct platform_device *op)
+ return 0;
+
+ out_free_fdev:
++ for (i = 0; i < FSL_DMA_MAX_CHANS_PER_DEVICE; i++) {
++ if (fdev->chan[i])
++ fsl_dma_chan_remove(fdev->chan[i]);
++ }
+ irq_dispose_mapping(fdev->irq);
+ iounmap(fdev->regs);
+ out_free:
+--
+2.27.0
+
--- /dev/null
+From 0d289662689bf17d255ecffc360dcef339b99091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:05:16 +0100
+Subject: dmaengine: fsldma: Fix a resource leak in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit cbc0ad004c03ad7971726a5db3ec84dba3dcb857 ]
+
+A 'irq_dispose_mapping()' call is missing in the remove function.
+Add it.
+
+This is needed to undo the 'irq_of_parse_and_map() call from the probe
+function and already part of the error handling path of the probe function.
+
+It was added in the probe function only in commit d3f620b2c4fe ("fsldma:
+simplify IRQ probing and handling")
+
+Fixes: 77cd62e8082b ("fsldma: allow Freescale Elo DMA driver to be compiled as a module")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212160516.92515-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsldma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
+index 0feb323bae1e3..554f70a0c18c0 100644
+--- a/drivers/dma/fsldma.c
++++ b/drivers/dma/fsldma.c
+@@ -1314,6 +1314,7 @@ static int fsldma_of_remove(struct platform_device *op)
+ if (fdev->chan[i])
+ fsl_dma_chan_remove(fdev->chan[i]);
+ }
++ irq_dispose_mapping(fdev->irq);
+
+ iounmap(fdev->regs);
+ kfree(fdev);
+--
+2.27.0
+
--- /dev/null
+From cad44613ab6c27ca70a5d998108ba2d4c325b0bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 23:37:49 +0100
+Subject: dmaengine: hsu: disable spurious interrupt
+
+From: Ferry Toth <ftoth@exalondelft.nl>
+
+[ Upstream commit 035b73b2b3b2e074a56489a7bf84b6a8012c0e0d ]
+
+On Intel Tangier B0 and Anniedale the interrupt line, disregarding
+to have different numbers, is shared between HSU DMA and UART IPs.
+Thus on such SoCs we are expecting that IRQ handler is called in
+UART driver only. hsu_pci_irq was handling the spurious interrupt
+from HSU DMA by returning immediately. This wastes CPU time and
+since HSU DMA and HSU UART interrupt occur simultaneously they race
+to be handled causing delay to the HSU UART interrupt handling.
+Fix this by disabling the interrupt entirely.
+
+Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case")
+Signed-off-by: Ferry Toth <ftoth@exalondelft.nl>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20210112223749.97036-1-ftoth@exalondelft.nl
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hsu/pci.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/dma/hsu/pci.c b/drivers/dma/hsu/pci.c
+index 07cc7320a614f..9045a6f7f5893 100644
+--- a/drivers/dma/hsu/pci.c
++++ b/drivers/dma/hsu/pci.c
+@@ -26,22 +26,12 @@
+ static irqreturn_t hsu_pci_irq(int irq, void *dev)
+ {
+ struct hsu_dma_chip *chip = dev;
+- struct pci_dev *pdev = to_pci_dev(chip->dev);
+ u32 dmaisr;
+ u32 status;
+ unsigned short i;
+ int ret = 0;
+ int err;
+
+- /*
+- * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
+- * to have different numbers, is shared between HSU DMA and UART IPs.
+- * Thus on such SoCs we are expecting that IRQ handler is called in
+- * UART driver only.
+- */
+- if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
+- return IRQ_HANDLED;
+-
+ dmaisr = readl(chip->regs + HSU_PCI_DMAISR);
+ for (i = 0; i < chip->hsu->nr_channels; i++) {
+ if (dmaisr & 0x1) {
+@@ -105,6 +95,17 @@ static int hsu_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (ret)
+ goto err_register_irq;
+
++ /*
++ * On Intel Tangier B0 and Anniedale the interrupt line, disregarding
++ * to have different numbers, is shared between HSU DMA and UART IPs.
++ * Thus on such SoCs we are expecting that IRQ handler is called in
++ * UART driver only. Instead of handling the spurious interrupt
++ * from HSU DMA here and waste CPU time and delay HSU UART interrupt
++ * handling, disable the interrupt entirely.
++ */
++ if (pdev->device == PCI_DEVICE_ID_INTEL_MRFLD_HSU_DMA)
++ disable_irq_nosync(chip->irq);
++
+ pci_set_drvdata(pdev, chip);
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 917f5de20b91a83ce6ffb91ff5e814ce5bdc7b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 14:53:07 -0700
+Subject: dmaengine: idxd: set DMA channel to be private
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit c06e424be5f5184468c5f761c0d2cf1ed0a4e0fc ]
+
+Add DMA_PRIVATE attribute flag to idxd DMA channels. The dedicated WQs are
+expected to be used by a single client and not shared. While doing NTB
+testing this mistake was discovered, which prevented ntb_transport from
+requesting DSA wqs as DMA channels via dma_request_channel().
+
+Reported-by: Srinijia Kambham <srinija.kambham@intel.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Tested-by: Srinijia Kambham <srinija.kambham@intel.com>
+Fixes: 8f47d1a5e545 ("dmaengine: idxd: connect idxd to dmaengine subsystem")
+Link: https://lore.kernel.org/r/161074758743.2184057.3388557138816350980.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c
+index 71fd6e4c42cd7..a15e50126434e 100644
+--- a/drivers/dma/idxd/dma.c
++++ b/drivers/dma/idxd/dma.c
+@@ -165,6 +165,7 @@ int idxd_register_dma_device(struct idxd_device *idxd)
+ INIT_LIST_HEAD(&dma->channels);
+ dma->dev = &idxd->pdev->dev;
+
++ dma_cap_set(DMA_PRIVATE, dma->cap_mask);
+ dma_cap_set(DMA_COMPLETION_NO_ORDER, dma->cap_mask);
+ dma->device_release = idxd_dma_release;
+
+--
+2.27.0
+
--- /dev/null
+From 94f915c6e70a7515fccb91b96f7af0ec82fefc0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 17:25:35 +0100
+Subject: dmaengine: owl-dma: Fix a resource leak in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 1f0a16f04113f9f0ab0c8e6d3abe661edab549e6 ]
+
+A 'dma_pool_destroy()' call is missing in the remove function.
+Add it.
+
+This call is already made in the error handling path of the probe function.
+
+Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212162535.95727-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/owl-dma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/owl-dma.c b/drivers/dma/owl-dma.c
+index 9fede32641e9e..04202d75f4eed 100644
+--- a/drivers/dma/owl-dma.c
++++ b/drivers/dma/owl-dma.c
+@@ -1245,6 +1245,7 @@ static int owl_dma_remove(struct platform_device *pdev)
+ owl_dma_free(od);
+
+ clk_disable_unprepare(od->clk);
++ dma_pool_destroy(od->lli_pool);
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 50541020f819f61f4b16081ef00f49a36b6e8aeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 12:12:14 -0700
+Subject: dmaengine: qcom: Always inline gpi_update_reg
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 0a6d3038d914b51d6860f23ea2b508590e8340de ]
+
+When building with CONFIG_UBSAN_UNSIGNED_OVERFLOW, clang decides not to
+inline gpi_update_reg, which causes a linkage failure around __bad_mask:
+
+ld.lld: error: undefined symbol: __bad_mask
+>>> referenced by bitfield.h:119 (include/linux/bitfield.h:119)
+>>> dma/qcom/gpi.o:(gpi_update_reg) in archive drivers/built-in.a
+>>> referenced by bitfield.h:119 (include/linux/bitfield.h:119)
+>>> dma/qcom/gpi.o:(gpi_update_reg) in archive drivers/built-in.a
+
+If gpi_update_reg is not inlined, the mask value will not be known at
+compile time so the check in field_multiplier stays in the final
+object file, causing the above linkage failure. Always inline
+gpi_update_reg so that this check can never fail.
+
+Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1243
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20210112191214.1264793-1-natechancellor@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/qcom/gpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/qcom/gpi.c b/drivers/dma/qcom/gpi.c
+index 1a0bf6b0567a5..e48eb397f433d 100644
+--- a/drivers/dma/qcom/gpi.c
++++ b/drivers/dma/qcom/gpi.c
+@@ -584,7 +584,7 @@ static inline void gpi_write_reg_field(struct gpii *gpii, void __iomem *addr,
+ gpi_write_reg(gpii, addr, val);
+ }
+
+-static inline void
++static __always_inline void
+ gpi_update_reg(struct gpii *gpii, u32 offset, u32 mask, u32 val)
+ {
+ void __iomem *addr = gpii->regs + offset;
+--
+2.27.0
+
--- /dev/null
+From f91f27f7e4634b5d1afa4f78fc31fe1eebc62a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 19:44:03 +0530
+Subject: dmaengine: ti: k3-udma: Set rflow count for BCDMA split channels
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit aecf9d38361090857aa58708e500ee79bed1e273 ]
+
+BCDMA RX channels have one flow per channel, therefore set the rflow_cnt
+to rchan_cnt.
+
+Without this patch, request for BCDMA RX channel allocation fails as
+rflow_cnt is 0 thus fails to reserve a rflow for the channel.
+
+Fixes: 8844898028d4 ("dmaengine: ti: k3-udma: Add support for BCDMA channel TPL handling")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20210112141403.30286-1-vigneshr@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/k3-udma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c
+index f474a12323354..46bc1a419bdfb 100644
+--- a/drivers/dma/ti/k3-udma.c
++++ b/drivers/dma/ti/k3-udma.c
+@@ -4306,6 +4306,7 @@ static int udma_get_mmrs(struct platform_device *pdev, struct udma_dev *ud)
+ ud->bchan_cnt = BCDMA_CAP2_BCHAN_CNT(cap2);
+ ud->tchan_cnt = BCDMA_CAP2_TCHAN_CNT(cap2);
+ ud->rchan_cnt = BCDMA_CAP2_RCHAN_CNT(cap2);
++ ud->rflow_cnt = ud->rchan_cnt;
+ break;
+ case DMA_TYPE_PKTDMA:
+ cap4 = udma_read(ud->mmrs[MMR_GCFG], 0x30);
+--
+2.27.0
+
--- /dev/null
+From 85c38cfabd542c744f45a9d2824b7c29b7c865bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 21:51:22 +0200
+Subject: dpaa2-eth: fix memory leak in XDP_REDIRECT
+
+From: Ioana Ciornei <ioana.ciornei@nxp.com>
+
+[ Upstream commit e12be9139cca26d689fe1a9257054b76752f725b ]
+
+If xdp_do_redirect() fails, the calling driver should handle recycling
+or freeing of the page associated with the frame. The dpaa2-eth driver
+didn't do either of them and just incremented a counter.
+Fix this by trying to DMA map back the page and recycle it or, if the
+mapping fails, just free it.
+
+Fixes: d678be1dc1ec ("dpaa2-eth: add XDP_REDIRECT support")
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index fb0bcd18ec0c1..f1c2b3c7f7e99 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -399,10 +399,20 @@ static u32 dpaa2_eth_run_xdp(struct dpaa2_eth_priv *priv,
+ xdp.frame_sz = DPAA2_ETH_RX_BUF_RAW_SIZE;
+
+ err = xdp_do_redirect(priv->net_dev, &xdp, xdp_prog);
+- if (unlikely(err))
++ if (unlikely(err)) {
++ addr = dma_map_page(priv->net_dev->dev.parent,
++ virt_to_page(vaddr), 0,
++ priv->rx_buf_size, DMA_BIDIRECTIONAL);
++ if (unlikely(dma_mapping_error(priv->net_dev->dev.parent, addr))) {
++ free_pages((unsigned long)vaddr, 0);
++ } else {
++ ch->buf_count++;
++ dpaa2_eth_xdp_release_buf(priv, ch, addr);
++ }
+ ch->stats.xdp_drop++;
+- else
++ } else {
+ ch->stats.xdp_redirect++;
++ }
+ break;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From f40ca77d1893bbf7e9d958f393e524e7738393bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 20:21:06 +0200
+Subject: dpaa_eth: fix the access method for the dpaa_napi_portal
+
+From: Camelia Groza <camelia.groza@nxp.com>
+
+[ Upstream commit 433dfc99aa3e0acbf655b961d98eb690162f758f ]
+
+The current use of container_of is flawed and unnecessary. Obtain
+the dpaa_napi_portal reference from the private percpu data instead.
+
+Fixes: a1e031ffb422 ("dpaa_eth: add XDP_REDIRECT support")
+Reported-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
+Acked-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Link: https://lore.kernel.org/r/20210218182106.22613-1-camelia.groza@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 6faa20bed4885..9905caeaeee3e 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -2672,7 +2672,6 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
+ u32 hash;
+ u64 ns;
+
+- np = container_of(&portal, struct dpaa_napi_portal, p);
+ dpaa_fq = container_of(fq, struct dpaa_fq, fq_base);
+ fd_status = be32_to_cpu(fd->status);
+ fd_format = qm_fd_get_format(fd);
+@@ -2687,6 +2686,7 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal,
+
+ percpu_priv = this_cpu_ptr(priv->percpu_priv);
+ percpu_stats = &percpu_priv->stats;
++ np = &percpu_priv->np;
+
+ if (unlikely(dpaa_eth_napi_schedule(percpu_priv, portal, sched_napi)))
+ return qman_cb_dqrr_stop;
+--
+2.27.0
+
--- /dev/null
+From 47b1aca43ecc0c102f5ca1b00e31955a362c397a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 08:08:25 +0100
+Subject: Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind()
+
+From: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+
+[ Upstream commit e3fa4b747f085d2cda09bba0533b86fa76038635 ]
+
+When channel->device_obj is non-NULL, vmbus_onoffer_rescind() could
+invoke put_device(), that will eventually release the device and free
+the channel object (cf. vmbus_device_release()). However, a pointer
+to the object is dereferenced again later to load the primary_channel.
+The use-after-free can be avoided by noticing that this load/check is
+redundant if device_obj is non-NULL: primary_channel must be NULL if
+device_obj is non-NULL, cf. vmbus_add_channel_work().
+
+Fixes: 54a66265d6754b ("Drivers: hv: vmbus: Fix rescind handling")
+Reported-by: Juan Vazquez <juvazq@microsoft.com>
+Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Link: https://lore.kernel.org/r/20201209070827.29335-5-parri.andrea@gmail.com
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hv/channel_mgmt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 1d44bb635bb84..6be9f56cb6270 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -1102,8 +1102,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
+ vmbus_device_unregister(channel->device_obj);
+ put_device(dev);
+ }
+- }
+- if (channel->primary_channel != NULL) {
++ } else if (channel->primary_channel != NULL) {
+ /*
+ * Sub-channel is being rescinded. Following is the channel
+ * close sequence when initiated from the driveri (refer to
+--
+2.27.0
+
--- /dev/null
+From 3918a96fd8566490f6f6824e7c9e240e5d5e08e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 07:17:02 +0100
+Subject: drm/amd/display: Fix 10/12 bpc setup in DCE output bit depth
+ reduction.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+[ Upstream commit 1916866dfa4aaceba1a70db83fde569387649d93 ]
+
+In set_clamp(), the comments and definitions for the COLOR_DEPTH_101010
+and COLOR_DEPTH_121212 cases directly contradict the code comment which
+explains how this should work, whereas the COLOR_DEPTH_888 case
+is consistent with the code comments. Comment says the bitmask should
+be chosen to align to the top-most 10 or 12 MSB's on a 14 bit bus, but
+the implementation contradicts that: 10 bit case sets a mask for 12 bpc
+clamping, whereas 12 bit case sets a mask for 14 bpc clamping.
+
+Note that during my limited testing on DCE-8.3 (HDMI deep color)
+and DCE-11.2 (DP deep color), this didn't have any obvious ill
+effects, neither did fixing it change anything obvious for the
+better, so this fix may be inconsequential on DCE, and just
+reduce the confusion of innocent bystanders when reading the code
+and trying to investigate problems with 10 bpc+ output.
+
+Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
+
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+index 130a0a0c83329..68028ec995e74 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_transform.c
+@@ -601,12 +601,12 @@ static void set_clamp(
+ clamp_max = 0x3FC0;
+ break;
+ case COLOR_DEPTH_101010:
+- /* 10bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
+- clamp_max = 0x3FFC;
++ /* 10bit MSB aligned on 14 bit bus '11 1111 1111 0000' */
++ clamp_max = 0x3FF0;
+ break;
+ case COLOR_DEPTH_121212:
+- /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1111' */
+- clamp_max = 0x3FFF;
++ /* 12bit MSB aligned on 14 bit bus '11 1111 1111 1100' */
++ clamp_max = 0x3FFC;
+ break;
+ default:
+ clamp_max = 0x3FC0;
+--
+2.27.0
+
--- /dev/null
+From a90edb4fd581e35fa3d8578d5f5cced957e7b7f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 07:17:03 +0100
+Subject: drm/amd/display: Fix HDMI deep color output for DCE 6-11.
+
+From: Mario Kleiner <mario.kleiner.de@gmail.com>
+
+[ Upstream commit efa18405baa55a864c61d2f3cc6fe4d363818eb3 ]
+
+This fixes corrupted display output in HDMI deep color
+10/12 bpc mode at least as observed on AMD Mullins, DCE-8.3.
+
+It will hopefully also provide fixes for other DCE's up to
+DCE-11, assuming those will need similar fixes, but i could
+not test that for HDMI due to lack of suitable hw, so viewer
+discretion is advised.
+
+dce110_stream_encoder_hdmi_set_stream_attribute() is used for
+HDMI setup on all DCE's and is missing color_depth assignment.
+
+dce110_program_pix_clk() is used for pixel clock setup on HDMI
+for DCE 6-11, and is missing color_depth assignment.
+
+Additionally some of the underlying Atombios specific encoder
+and pixelclock setup functions are missing code which is in
+the classic amdgpu kms modesetting path and the in the radeon
+kms driver for DCE6/DCE8.
+
+encoder_control_digx_v3() - Was missing setup code wrt. amdgpu
+and radeon kms classic drivers. Added here, but untested due to
+lack of suitable test hw.
+
+encoder_control_digx_v4() - Added missing setup code.
+Successfully tested on AMD mullins / DCE-8.3 with HDMI deep color
+output at 10 bpc and 12 bpc.
+
+Note that encoder_control_digx_v5() has proper setup code in place
+and is used, e.g., by DCE-11.2, but this code wasn't used for deep
+color setup due to the missing cntl.color_depth setup in the calling
+function for HDMI.
+
+set_pixel_clock_v5() - Missing setup code wrt. classic amdgpu/radeon
+kms. Added here, but untested due to lack of hw.
+
+set_pixel_clock_v6() - Missing setup code added. Successfully tested
+on AMD mullins DCE-8.3. This fixes corrupted display output at HDMI
+deep color output with 10 bpc or 12 bpc.
+
+Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/bios/command_table.c | 61 +++++++++++++++++++
+ .../drm/amd/display/dc/dce/dce_clock_source.c | 14 +++++
+ .../amd/display/dc/dce/dce_stream_encoder.c | 1 +
+ 3 files changed, 76 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/bios/command_table.c b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+index 070459e3e4070..afc10b954ffa7 100644
+--- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c
++++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+@@ -245,6 +245,23 @@ static enum bp_result encoder_control_digx_v3(
+ cntl->enable_dp_audio);
+ params.ucLaneNum = (uint8_t)(cntl->lanes_number);
+
++ switch (cntl->color_depth) {
++ case COLOR_DEPTH_888:
++ params.ucBitPerColor = PANEL_8BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_101010:
++ params.ucBitPerColor = PANEL_10BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_121212:
++ params.ucBitPerColor = PANEL_12BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_161616:
++ params.ucBitPerColor = PANEL_16BIT_PER_COLOR;
++ break;
++ default:
++ break;
++ }
++
+ if (EXEC_BIOS_CMD_TABLE(DIGxEncoderControl, params))
+ result = BP_RESULT_OK;
+
+@@ -274,6 +291,23 @@ static enum bp_result encoder_control_digx_v4(
+ cntl->enable_dp_audio));
+ params.ucLaneNum = (uint8_t)(cntl->lanes_number);
+
++ switch (cntl->color_depth) {
++ case COLOR_DEPTH_888:
++ params.ucBitPerColor = PANEL_8BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_101010:
++ params.ucBitPerColor = PANEL_10BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_121212:
++ params.ucBitPerColor = PANEL_12BIT_PER_COLOR;
++ break;
++ case COLOR_DEPTH_161616:
++ params.ucBitPerColor = PANEL_16BIT_PER_COLOR;
++ break;
++ default:
++ break;
++ }
++
+ if (EXEC_BIOS_CMD_TABLE(DIGxEncoderControl, params))
+ result = BP_RESULT_OK;
+
+@@ -1057,6 +1091,19 @@ static enum bp_result set_pixel_clock_v5(
+ * driver choose program it itself, i.e. here we program it
+ * to 888 by default.
+ */
++ if (bp_params->signal_type == SIGNAL_TYPE_HDMI_TYPE_A)
++ switch (bp_params->color_depth) {
++ case TRANSMITTER_COLOR_DEPTH_30:
++ /* yes this is correct, the atom define is wrong */
++ clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_32BPP;
++ break;
++ case TRANSMITTER_COLOR_DEPTH_36:
++ /* yes this is correct, the atom define is wrong */
++ clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
++ break;
++ default:
++ break;
++ }
+
+ if (EXEC_BIOS_CMD_TABLE(SetPixelClock, clk))
+ result = BP_RESULT_OK;
+@@ -1135,6 +1182,20 @@ static enum bp_result set_pixel_clock_v6(
+ * driver choose program it itself, i.e. here we pass required
+ * target rate that includes deep color.
+ */
++ if (bp_params->signal_type == SIGNAL_TYPE_HDMI_TYPE_A)
++ switch (bp_params->color_depth) {
++ case TRANSMITTER_COLOR_DEPTH_30:
++ clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP_V6;
++ break;
++ case TRANSMITTER_COLOR_DEPTH_36:
++ clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP_V6;
++ break;
++ case TRANSMITTER_COLOR_DEPTH_48:
++ clk.sPCLKInput.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
++ break;
++ default:
++ break;
++ }
+
+ if (EXEC_BIOS_CMD_TABLE(SetPixelClock, clk))
+ result = BP_RESULT_OK;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+index fb733f573715e..466f8f5803c9c 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c
+@@ -871,6 +871,20 @@ static bool dce110_program_pix_clk(
+ bp_pc_params.flags.SET_EXTERNAL_REF_DIV_SRC =
+ pll_settings->use_external_clk;
+
++ switch (pix_clk_params->color_depth) {
++ case COLOR_DEPTH_101010:
++ bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_30;
++ break;
++ case COLOR_DEPTH_121212:
++ bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_36;
++ break;
++ case COLOR_DEPTH_161616:
++ bp_pc_params.color_depth = TRANSMITTER_COLOR_DEPTH_48;
++ break;
++ default:
++ break;
++ }
++
+ if (clk_src->bios->funcs->set_pixel_clock(
+ clk_src->bios, &bp_pc_params) != BP_RESULT_OK)
+ return false;
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
+index ada57f745fd76..19e380e0a3301 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_stream_encoder.c
+@@ -564,6 +564,7 @@ static void dce110_stream_encoder_hdmi_set_stream_attribute(
+ cntl.enable_dp_audio = enable_audio;
+ cntl.pixel_clock = actual_pix_clk_khz;
+ cntl.lanes_number = LANE_COUNT_FOUR;
++ cntl.color_depth = crtc_timing->display_color_depth;
+
+ if (enc110->base.bp->funcs->encoder_control(
+ enc110->base.bp, &cntl) != BP_RESULT_OK)
+--
+2.27.0
+
--- /dev/null
+From bb47fac2bac8c408637794c26e7e218078181d6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 18:11:04 +0100
+Subject: drm/amdgpu/display: remove hdcp_srm sysfs on device removal
+
+From: Nirmoy Das <nirmoy.das@amd.com>
+
+[ Upstream commit e96b1b2974989c6a25507b527843ede7594efc85 ]
+
+Fixes: 9037246bb2da5 ("drm/amd/display: Add sysfs interface for set/get srm")
+
+Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 3 ++-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h | 2 +-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 961abf1cf040c..6a336cce6b7c6 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1131,7 +1131,7 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
+
+ #ifdef CONFIG_DRM_AMD_DC_HDCP
+ if (adev->dm.hdcp_workqueue) {
+- hdcp_destroy(adev->dm.hdcp_workqueue);
++ hdcp_destroy(&adev->dev->kobj, adev->dm.hdcp_workqueue);
+ adev->dm.hdcp_workqueue = NULL;
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+index c2cd184f0bbd4..79de68ac03f20 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
+@@ -376,7 +376,7 @@ static void event_cpirq(struct work_struct *work)
+ }
+
+
+-void hdcp_destroy(struct hdcp_workqueue *hdcp_work)
++void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *hdcp_work)
+ {
+ int i = 0;
+
+@@ -385,6 +385,7 @@ void hdcp_destroy(struct hdcp_workqueue *hdcp_work)
+ cancel_delayed_work_sync(&hdcp_work[i].watchdog_timer_dwork);
+ }
+
++ sysfs_remove_bin_file(kobj, &hdcp_work[0].attr);
+ kfree(hdcp_work->srm);
+ kfree(hdcp_work->srm_temp);
+ kfree(hdcp_work);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
+index 5159b3a5e5b03..09294ff122fea 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.h
+@@ -69,7 +69,7 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work,
+
+ void hdcp_reset_display(struct hdcp_workqueue *work, unsigned int link_index);
+ void hdcp_handle_cpirq(struct hdcp_workqueue *work, unsigned int link_index);
+-void hdcp_destroy(struct hdcp_workqueue *work);
++void hdcp_destroy(struct kobject *kobj, struct hdcp_workqueue *work);
+
+ struct hdcp_workqueue *hdcp_create_workqueue(struct amdgpu_device *adev, struct cp_psp *cp_psp, struct dc *dc);
+
+--
+2.27.0
+
--- /dev/null
+From 66d9354c9b34cdb7bccf3f06d7d3b1ae33010953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Dec 2020 16:56:07 +0800
+Subject: drm/amdgpu: Fix macro name _AMDGPU_TRACE_H_ in preprocessor if
+ condition
+
+From: Chenyang Li <lichenyang@loongson.cn>
+
+[ Upstream commit 956e20eb0fbb206e5e795539db5469db099715c8 ]
+
+Add an underscore in amdgpu_trace.h line 24 "_AMDGPU_TRACE_H".
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Reviewed-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Chenyang Li <lichenyang@loongson.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+index 6752d8b131188..ce8dc995c10cf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h
+@@ -21,7 +21,7 @@
+ *
+ */
+
+-#if !defined(_AMDGPU_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
++#if !defined(_AMDGPU_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+ #define _AMDGPU_TRACE_H_
+
+ #include <linux/stringify.h>
+--
+2.27.0
+
--- /dev/null
+From c9a052189a42ea371d78c59e0daa98458436fe22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 08:56:36 +0300
+Subject: drm/amdgpu: Prevent shift wrapping in amdgpu_read_mask()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c915ef890d5dc79f483e1ca3b3a5b5f1a170690c ]
+
+If the user passes a "level" value which is higher than 31 then that
+leads to shift wrapping. The undefined behavior will lead to a
+syzkaller stack dump.
+
+Fixes: 5632708f4452 ("drm/amd/powerplay: add dpm force multiple levels on cz/tonga/fiji/polaris (v2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+index 7b6ef05a1d35a..0b5be50b2eeeb 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -1074,7 +1074,7 @@ static ssize_t amdgpu_get_pp_dpm_sclk(struct device *dev,
+ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ {
+ int ret;
+- long level;
++ unsigned long level;
+ char *sub_str = NULL;
+ char *tmp;
+ char buf_cpy[AMDGPU_MASK_BUF_MAX + 1];
+@@ -1090,8 +1090,8 @@ static ssize_t amdgpu_read_mask(const char *buf, size_t count, uint32_t *mask)
+ while (tmp[0]) {
+ sub_str = strsep(&tmp, delimiter);
+ if (strlen(sub_str)) {
+- ret = kstrtol(sub_str, 0, &level);
+- if (ret)
++ ret = kstrtoul(sub_str, 0, &level);
++ if (ret || level > 31)
+ return -EINVAL;
+ *mask |= 1 << level;
+ } else
+--
+2.27.0
+
--- /dev/null
+From cc2b9c8c059c2349727fc762c57fe35f6c7e1b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 15:45:48 +0800
+Subject: drm/amdgpu: toggle on DF Cstate after finishing xgmi injection
+
+From: Guchun Chen <guchun.chen@amd.com>
+
+[ Upstream commit fe2d9f5abf19f2b3688b3b8da4e42f8d07886847 ]
+
+Fixes: 5c23e9e05e42 ("drm/amdgpu: Update RAS XGMI error inject sequence")
+Signed-off-by: Guchun Chen <guchun.chen@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 82e952696d24f..1fb2a91ad30ad 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -846,7 +846,7 @@ static int amdgpu_ras_error_inject_xgmi(struct amdgpu_device *adev,
+ if (amdgpu_dpm_allow_xgmi_power_down(adev, true))
+ dev_warn(adev->dev, "Failed to allow XGMI power down");
+
+- if (amdgpu_dpm_set_df_cstate(adev, DF_CSTATE_DISALLOW))
++ if (amdgpu_dpm_set_df_cstate(adev, DF_CSTATE_ALLOW))
+ dev_warn(adev->dev, "Failed to allow df cstate");
+
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 99ea95a8b0ae5283abdf054e264720a2a46c915c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 16:26:12 +0000
+Subject: drm: document that user-space should force-probe connectors
+
+From: Simon Ser <contact@emersion.fr>
+
+[ Upstream commit a7e2e1c50450c6a0f020b35960edecbe25dde520 ]
+
+It seems like we can't have nice things, so let's just document the
+disappointing behaviour instead.
+
+The previous version assumed the kernel would perform the probing work
+when appropriate, however this is not the case today. Update the
+documentation to reflect reality.
+
+v2:
+
+- Improve commit message to explain why this change is made (Pekka)
+- Keep the bit about flickering (Daniel)
+- Explain when user-space should force-probe, and when it shouldn't (Daniel)
+
+Signed-off-by: Simon Ser <contact@emersion.fr>
+Fixes: 2ac5ef3b2362 ("drm: document drm_mode_get_connector")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.com>
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/AxqLnTAsFCRishOVB5CLsqIesmrMrm7oytnOVB7oPA@cp7-web-043.plabs.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/drm/drm_mode.h | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/include/uapi/drm/drm_mode.h b/include/uapi/drm/drm_mode.h
+index b49fbf2bdc408..1c064627e6c33 100644
+--- a/include/uapi/drm/drm_mode.h
++++ b/include/uapi/drm/drm_mode.h
+@@ -414,15 +414,12 @@ enum drm_mode_subconnector {
+ *
+ * If the @count_modes field is set to zero, the kernel will perform a forced
+ * probe on the connector to refresh the connector status, modes and EDID.
+- * A forced-probe can be slow and the ioctl will block. A force-probe can cause
+- * flickering and temporary freezes, so it should not be performed
+- * automatically.
++ * A forced-probe can be slow, might cause flickering and the ioctl will block.
+ *
+- * User-space shouldn't need to force-probe connectors in general: the kernel
+- * will automatically take care of probing connectors that don't support
+- * hot-plug detection when appropriate. However, user-space may force-probe
+- * connectors on user request (e.g. clicking a "Scan connectors" button, or
+- * opening a UI to manage screens).
++ * User-space needs to force-probe connectors to ensure their metadata is
++ * up-to-date at startup and after receiving a hot-plug event. User-space
++ * may perform a forced-probe when the user explicitly requests it. User-space
++ * shouldn't perform a forced-probe in other situations.
+ */
+ struct drm_mode_get_connector {
+ /** @encoders_ptr: Pointer to ``__u32`` array of object IDs. */
+--
+2.27.0
+
--- /dev/null
+From 6955567c13fdfb9c2add0d7b5dd0c62d389e554d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 14:01:43 +0200
+Subject: drm/dp_mst: Don't cache EDIDs for physical ports
+
+From: Imre Deak <imre.deak@intel.com>
+
+[ Upstream commit 4b8878eefa0a3b65e2e016db49014ea66fb9fd45 ]
+
+Caching EDIDs for physical ports prevents updating the EDID if a port
+gets reconnected via a Connection Status Notification message, fix this.
+
+Fixes: db1a07956968 ("drm/dp_mst: Handle SST-only branch device case")
+Cc: Wayne Lin <Wayne.Lin@amd.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210201120145.350258-2-imre.deak@intel.com
+(cherry picked from commit 468091531c2e5c49f55d8c6f1d036ce997d24e13)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index b11c0522a4410..405501c74e400 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -2302,7 +2302,8 @@ drm_dp_mst_port_add_connector(struct drm_dp_mst_branch *mstb,
+ }
+
+ if (port->pdt != DP_PEER_DEVICE_NONE &&
+- drm_dp_mst_is_end_device(port->pdt, port->mcs)) {
++ drm_dp_mst_is_end_device(port->pdt, port->mcs) &&
++ port->port_num >= DP_MST_LOGICAL_PORT_0) {
+ port->cached_edid = drm_get_edid(port->connector,
+ &port->aux.ddc);
+ drm_connector_set_tile_property(port->connector);
+--
+2.27.0
+
--- /dev/null
+From b57f3693536d1b18176bb6c8301c1edf2515a0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 22:42:48 +0800
+Subject: drm/fb-helper: Add missed unlocks in setcmap_legacy()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 0a260e731d6c4c17547ac275a2cde888a9eb4a3d ]
+
+setcmap_legacy() does not call drm_modeset_unlock_all() in some exits,
+add the missed unlocks with goto to fix it.
+
+Fixes: 964c60063bff ("drm/fb-helper: separate the fb_setcmap helper into atomic and legacy paths")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201203144248.418281-1-hslester96@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_fb_helper.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 4b81195106875..e82db0f4e7715 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -946,11 +946,15 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
+ drm_modeset_lock_all(fb_helper->dev);
+ drm_client_for_each_modeset(modeset, &fb_helper->client) {
+ crtc = modeset->crtc;
+- if (!crtc->funcs->gamma_set || !crtc->gamma_size)
+- return -EINVAL;
++ if (!crtc->funcs->gamma_set || !crtc->gamma_size) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+- if (cmap->start + cmap->len > crtc->gamma_size)
+- return -EINVAL;
++ if (cmap->start + cmap->len > crtc->gamma_size) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ r = crtc->gamma_store;
+ g = r + crtc->gamma_size;
+@@ -963,8 +967,9 @@ static int setcmap_legacy(struct fb_cmap *cmap, struct fb_info *info)
+ ret = crtc->funcs->gamma_set(crtc, r, g, b,
+ crtc->gamma_size, NULL);
+ if (ret)
+- return ret;
++ goto out;
+ }
++out:
+ drm_modeset_unlock_all(fb_helper->dev);
+
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 9706b28c3d7cd2065e093489aeceb92f044e86a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 13:51:03 +0100
+Subject: drm/fourcc: fix Amlogic format modifier masks
+
+From: Simon Ser <contact@emersion.fr>
+
+[ Upstream commit cc3283f8f41f741fbaef63d0503d8fb4a7919100 ]
+
+The comment says the layout and options use 8 bits, and the shift
+uses 8 bits. However the mask is 0xf, ie. 0b00001111 (4 bits).
+
+This could be surprising when introducing new layouts or options
+that take more than 4 bits, as this would silently drop the high
+bits.
+
+Make the masks consistent with the comment and the shift.
+
+Found when writing a drm_info patch [1].
+
+[1]: https://github.com/ascent12/drm_info/pull/67
+
+Signed-off-by: Simon Ser <contact@emersion.fr>
+Fixes: d6528ec88309 ("drm/fourcc: Add modifier definitions for describing Amlogic Video Framebuffer Compression")
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Kevin Hilman <khilman@baylibre.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210110125103.15447-1-contact@emersion.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/drm/drm_fourcc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h
+index 723c8e23ca87d..5f42a14481bd4 100644
+--- a/include/uapi/drm/drm_fourcc.h
++++ b/include/uapi/drm/drm_fourcc.h
+@@ -1036,9 +1036,9 @@ drm_fourcc_canonicalize_nvidia_format_mod(__u64 modifier)
+ * Not all combinations are valid, and different SoCs may support different
+ * combinations of layout and options.
+ */
+-#define __fourcc_mod_amlogic_layout_mask 0xf
++#define __fourcc_mod_amlogic_layout_mask 0xff
+ #define __fourcc_mod_amlogic_options_shift 8
+-#define __fourcc_mod_amlogic_options_mask 0xf
++#define __fourcc_mod_amlogic_options_mask 0xff
+
+ #define DRM_FORMAT_MOD_AMLOGIC_FBC(__layout, __options) \
+ fourcc_mod_code(AMLOGIC, \
+--
+2.27.0
+
--- /dev/null
+From 637c25ac4634aaa202db6397d9644d9653162b4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Nov 2020 10:02:16 +0800
+Subject: drm/gma500: Fix error return code in psb_driver_load()
+
+From: Jialin Zhang <zhangjialin11@huawei.com>
+
+[ Upstream commit 6926872ae24452d4f2176a3ba2dee659497de2c4 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Jialin Zhang <zhangjialin11@huawei.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201130020216.1906141-1-zhangjialin11@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/psb_drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index cc2d59e8471da..134068f9328d5 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -312,6 +312,8 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
+ if (ret)
+ goto out_err;
+
++ ret = -ENOMEM;
++
+ dev_priv->mmu = psb_mmu_driver_init(dev, 1, 0, 0);
+ if (!dev_priv->mmu)
+ goto out_err;
+--
+2.27.0
+
--- /dev/null
+From 12936e86fff0246bcd8509becc8eca77a6ea5e79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 17:44:38 +0800
+Subject: drm/lima: fix reference leak in lima_pm_busy
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit de4248b744e8394f239c0dd0af34088399d27d94 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to putting operation will result in a
+reference leak here.
+
+A new function pm_runtime_resume_and_get is introduced in
+[0] to keep usage counter balanced. So We fix the reference
+leak by replacing it with new function.
+
+[0] commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+
+Fixes: 50de2e9ebbc0 ("drm/lima: enable runtime pm")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201127094438.121003-1-miaoqinglang@huawei.com
+(cherry picked from commit de499781c97d96703af8a32d2b5e37fdb5b51568)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
+index 63b4c5643f9cd..5cc20b403a252 100644
+--- a/drivers/gpu/drm/lima/lima_sched.c
++++ b/drivers/gpu/drm/lima/lima_sched.c
+@@ -201,7 +201,7 @@ static int lima_pm_busy(struct lima_device *ldev)
+ int ret;
+
+ /* resume GPU if it has been suspended by runtime PM */
+- ret = pm_runtime_get_sync(ldev->dev);
++ ret = pm_runtime_resume_and_get(ldev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.27.0
+
--- /dev/null
+From ea478f99e0d693ea6b7fa0af6296d1e26313c466 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:43:44 +0800
+Subject: drm/mediatek: Check if fb is null
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit b1d685b6467ac0d98fc63989f71b4ca9186be5d4 ]
+
+It's possible that state->base.fb is null. Add a check before access its
+format.
+
+Fixes: b6b1bb980ec4 ("drm/mediatek: Turn off Alpha bit when plane format has no alpha")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+index 74ef6fc0528b6..523716e3c278a 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
+@@ -267,7 +267,7 @@ static void mtk_ovl_layer_config(struct mtk_ddp_comp *comp, unsigned int idx,
+ }
+
+ con = ovl_fmt_convert(ovl, fmt);
+- if (state->base.fb->format->has_alpha)
++ if (state->base.fb && state->base.fb->format->has_alpha)
+ con |= OVL_CON_AEN | OVL_CON_ALPHA;
+
+ if (pending->rotation & DRM_MODE_REFLECT_Y) {
+--
+2.27.0
+
--- /dev/null
+From d31e82c4f1147bd756fe4e509d101d720a47d4a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 18:14:07 -0500
+Subject: drm/mediatek: Fix aal size config
+
+[ Upstream commit 71dcadba34203d8dd35152e368720f977e9cdb81 ]
+
+The orginal setting is not correct, fix it to follow hardware data sheet.
+If keep this error setting, mt8173/mt8183 display ok
+but mt8192 display abnormal.
+
+Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function")
+
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+index 3064eac1a7507..7fcb717f256c9 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c
+@@ -180,7 +180,9 @@ static void mtk_aal_config(struct mtk_ddp_comp *comp, unsigned int w,
+ unsigned int h, unsigned int vrefresh,
+ unsigned int bpc, struct cmdq_pkt *cmdq_pkt)
+ {
+- mtk_ddp_write(cmdq_pkt, h << 16 | w, comp, DISP_AAL_SIZE);
++ struct mtk_ddp_comp_dev *priv = dev_get_drvdata(comp->dev);
++
++ mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_AAL_SIZE);
+ }
+
+ static void mtk_aal_start(struct mtk_ddp_comp *comp)
+--
+2.27.0
+
--- /dev/null
+From 09ff9a97efd35a4247c6022585ae80d0e1690809 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 17:34:08 +0530
+Subject: drm/msm: Add proper checks for GPU LLCC support
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+[ Upstream commit 276619c0923f8fa6a82e60edb88a82468645362d ]
+
+Domain attribute setting for LLCC is guarded by !IS_ERR
+check which works fine only when CONFIG_QCOM_LLCC=y but
+when it is disabled, the LLCC apis return NULL and that
+is not handled by IS_ERR check. Due to this, domain attribute
+for LLCC will be set even on GPUs which do not support it
+and cause issues, so correct this by using IS_ERR_OR_NULL
+checks appropriately. Meanwhile also cleanup comment block
+and remove unwanted blank line.
+
+Fixes: 00fd44a1a470 ("drm/msm: Only enable A6xx LLCC code on A6xx")
+Fixes: 474dadb8b0d5 ("drm/msm/a6xx: Add support for using system cache(LLC)")
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +-
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 130661898546a..3b798e883f822 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1117,7 +1117,7 @@ static void a6xx_llc_slices_init(struct platform_device *pdev,
+ a6xx_gpu->llc_slice = llcc_slice_getd(LLCC_GPU);
+ a6xx_gpu->htw_llc_slice = llcc_slice_getd(LLCC_GPUHTW);
+
+- if (IS_ERR(a6xx_gpu->llc_slice) && IS_ERR(a6xx_gpu->htw_llc_slice))
++ if (IS_ERR_OR_NULL(a6xx_gpu->llc_slice) && IS_ERR_OR_NULL(a6xx_gpu->htw_llc_slice))
+ a6xx_gpu->llc_mmio = ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index f09175698827a..b35914de1b275 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -200,15 +200,15 @@ adreno_iommu_create_address_space(struct msm_gpu *gpu,
+ if (!iommu)
+ return NULL;
+
+-
+ if (adreno_is_a6xx(adreno_gpu)) {
+ struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+ struct io_pgtable_domain_attr pgtbl_cfg;
++
+ /*
+- * This allows GPU to set the bus attributes required to use system
+- * cache on behalf of the iommu page table walker.
+- */
+- if (!IS_ERR(a6xx_gpu->htw_llc_slice)) {
++ * This allows GPU to set the bus attributes required to use system
++ * cache on behalf of the iommu page table walker.
++ */
++ if (!IS_ERR_OR_NULL(a6xx_gpu->htw_llc_slice)) {
+ pgtbl_cfg.quirks = IO_PGTABLE_QUIRK_ARM_OUTER_WBWA;
+ iommu_domain_set_attr(iommu, DOMAIN_ATTR_IO_PGTABLE_CFG, &pgtbl_cfg);
+ }
+--
+2.27.0
+
--- /dev/null
+From 069d26fc7a71db9fbe638204ee4052040b76f090 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Feb 2021 20:18:58 -0800
+Subject: drm/msm/dp: Add a missing semi-colon
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 182b4a2d251305201b6f9cae29067f7112f05835 ]
+
+A missing semicolon here causes my external display to stop working.
+Indeed, missing the semicolon on the return statement leads to
+dp_panel_update_tu_timings() not existing because the compiler thinks
+it's part of the return statement of a void function, so it must not be
+important.
+
+ $ ./scripts/bloat-o-meter before.o after.o
+ add/remove: 1/1 grow/shrink: 0/1 up/down: 7400/-7540 (-140)
+ Function old new delta
+ dp_panel_update_tu_timings - 7400 +7400
+ _dp_ctrl_calc_tu.constprop 18024 17900 -124
+ dp_panel_update_tu_timings.constprop 7416 - -7416
+ Total: Before=54440, After=54300, chg -0.26%
+
+Add a semicolon so this function works like it used to.
+
+Cc: Sean Paul <sean@poorly.run>
+Cc: Kuogee Hsieh <khsieh@codeaurora.org>
+Cc: linux-arm-msm@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: freedreno@lists.freedesktop.org
+Cc: Lee Jones <lee.jones@linaro.org>
+Fixes: cc9014bf63a4 ("drm/msm/dp/dp_ctrl: Move 'tu' from the stack to the heap")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+index e3462f5d96d75..6cbe10af0a7af 100644
+--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
+@@ -631,7 +631,7 @@ static void _dp_ctrl_calc_tu(struct dp_tu_calc_input *in,
+
+ tu = kzalloc(sizeof(*tu), GFP_KERNEL);
+ if (!tu)
+- return
++ return;
+
+ dp_panel_update_tu_timings(in, tu);
+
+--
+2.27.0
+
--- /dev/null
+From 36b49634240d8c1d122bb0871a5959b5679de063 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 18:16:03 +0800
+Subject: drm/msm/dp: trigger unplug event in msm_dp_display_disable
+
+From: Judy Hsiao <judyhsiao@google.com>
+
+[ Upstream commit c703d5789590935c573bbd080a2166b72d51a017 ]
+
+1. Trigger the unplug event in msm_dp_display_disable() to shutdown audio
+ properly.
+2. Reset the completion before signal the disconnect event.
+
+Fixes: 158b9aa74479 ("drm/msm/dp: wait for audio notification before disabling clocks")
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Tested-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Judy Hsiao <judyhsiao@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index 3bc7ed21de286..81f6794a25100 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -651,8 +651,8 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data)
+ dp_add_event(dp, EV_DISCONNECT_PENDING_TIMEOUT, 0, DP_TIMEOUT_5_SECOND);
+
+ /* signal the disconnect event early to ensure proper teardown */
+- dp_display_handle_plugged_change(g_dp_display, false);
+ reinit_completion(&dp->audio_comp);
++ dp_display_handle_plugged_change(g_dp_display, false);
+
+ dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK |
+ DP_DP_IRQ_HPD_INT_MASK, true);
+@@ -890,6 +890,9 @@ static int dp_display_disable(struct dp_display_private *dp, u32 data)
+
+ /* wait only if audio was enabled */
+ if (dp_display->audio_enabled) {
++ /* signal the disconnect event */
++ reinit_completion(&dp->audio_comp);
++ dp_display_handle_plugged_change(dp_display, false);
+ if (!wait_for_completion_timeout(&dp->audio_comp,
+ HZ * 5))
+ DRM_ERROR("audio comp timeout\n");
+--
+2.27.0
+
--- /dev/null
+From 5f99a374515d94ae2f48dbcfc634d4426111feaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 17:15:58 +0100
+Subject: drm/msm/dsi: Correct io_start for MSM8994 (20nm PHY)
+
+From: Konrad Dybcio <konrad.dybcio@somainline.org>
+
+[ Upstream commit 33a7808ce1aea6e2edc1af25db25928137940c02 ]
+
+The previous registers were *almost* correct, but instead of
+PHYs, they were pointing at DSI PLLs, resulting in the PHY id
+autodetection failing miserably.
+
+Fixes: dcefc117cc19 ("drm/msm/dsi: Add support for msm8x94")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+index 1afb7c579dbbb..eca86bf448f74 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_20nm.c
+@@ -139,7 +139,7 @@ const struct msm_dsi_phy_cfg dsi_phy_20nm_cfgs = {
+ .disable = dsi_20nm_phy_disable,
+ .init = msm_dsi_phy_init_common,
+ },
+- .io_start = { 0xfd998300, 0xfd9a0300 },
++ .io_start = { 0xfd998500, 0xfd9a0500 },
+ .num_dsi_phy = 2,
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 0402eff84e4aefaa87031d006a54b711756b1083 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 14:53:11 -0800
+Subject: drm/msm: Fix legacy relocs path
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit c8d99bb938d3303989c4988caf090084073e85a2 ]
+
+In moving code around, we ended up using the same pointer to
+copy_from_user() the relocs tables as we used for the cmd table
+entry, which is clearly not right. This went unnoticed because
+modern mesa on non-ancent kernels does not actually use relocs.
+But this broke ancient mesa on modern kernels.
+
+Reported-by: Emil Velikov <emil.velikov@collabora.com>
+Fixes: 20224d715a88 ("drm/msm/submit: Move copy_from_user ahead of locking bos")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Akhil P Oommen <akhilpo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem_submit.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
+index d04c349d8112a..5480852bdedaf 100644
+--- a/drivers/gpu/drm/msm/msm_gem_submit.c
++++ b/drivers/gpu/drm/msm/msm_gem_submit.c
+@@ -198,6 +198,8 @@ static int submit_lookup_cmds(struct msm_gem_submit *submit,
+ submit->cmd[i].idx = submit_cmd.submit_idx;
+ submit->cmd[i].nr_relocs = submit_cmd.nr_relocs;
+
++ userptr = u64_to_user_ptr(submit_cmd.relocs);
++
+ sz = array_size(submit_cmd.nr_relocs,
+ sizeof(struct drm_msm_gem_submit_reloc));
+ /* check for overflow: */
+--
+2.27.0
+
--- /dev/null
+From b623d33523de52a421914e55d7bcab160f75dbb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 22:24:37 +0200
+Subject: drm/msm: Fix MSM_INFO_GET_IOVA with carveout
+
+From: Iskren Chernev <iskren.chernev@gmail.com>
+
+[ Upstream commit 6cefa31e810404dafdfcdb94874146cea11626c2 ]
+
+The msm_gem_get_iova should be guarded with gpu != NULL and not aspace
+!= NULL, because aspace is NULL when using vram carveout.
+
+Fixes: 933415e24bd0d ("drm/msm: Add support for private address space instances")
+
+Signed-off-by: Iskren Chernev <iskren.chernev@gmail.com>
+Tested-by: Alexey Minnekhanov <alexeymin@postmarketos.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_drv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
+index 108c405e03dd9..94525ac76d4e6 100644
+--- a/drivers/gpu/drm/msm/msm_drv.c
++++ b/drivers/gpu/drm/msm/msm_drv.c
+@@ -788,9 +788,10 @@ static int msm_ioctl_gem_info_iova(struct drm_device *dev,
+ struct drm_file *file, struct drm_gem_object *obj,
+ uint64_t *iova)
+ {
++ struct msm_drm_private *priv = dev->dev_private;
+ struct msm_file_private *ctx = file->driver_priv;
+
+- if (!ctx->aspace)
++ if (!priv->gpu)
+ return -EINVAL;
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 6b5ebba5808ca636cd33869a6b5d460471a89714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 13:03:30 -0800
+Subject: drm/msm: Fix race of GPU init vs timestamp power management.
+
+From: Eric Anholt <eric@anholt.net>
+
+[ Upstream commit 7a7cbf2a819740674455ad36155c662367261296 ]
+
+We were using the same force-poweron bit in the two codepaths, so they
+could race to have one of them lose GPU power early.
+
+freedreno CI was seeing intermittent errors like:
+[drm:_a6xx_gmu_set_oob] *ERROR* Timeout waiting for GMU OOB set GPU_SET: 0x0
+and this issue could have contributed to it.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 25 ++++++++++++++++++++++---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.h | 8 ++++++++
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 ++--
+ 3 files changed, 32 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+index e6703ae987608..b3318f86aabc0 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -264,6 +264,16 @@ int a6xx_gmu_set_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+ }
+ name = "GPU_SET";
+ break;
++ case GMU_OOB_PERFCOUNTER_SET:
++ if (gmu->legacy) {
++ request = GMU_OOB_PERFCOUNTER_REQUEST;
++ ack = GMU_OOB_PERFCOUNTER_ACK;
++ } else {
++ request = GMU_OOB_PERFCOUNTER_REQUEST_NEW;
++ ack = GMU_OOB_PERFCOUNTER_ACK_NEW;
++ }
++ name = "PERFCOUNTER";
++ break;
+ case GMU_OOB_BOOT_SLUMBER:
+ request = GMU_OOB_BOOT_SLUMBER_REQUEST;
+ ack = GMU_OOB_BOOT_SLUMBER_ACK;
+@@ -301,9 +311,14 @@ int a6xx_gmu_set_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+ void a6xx_gmu_clear_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+ {
+ if (!gmu->legacy) {
+- WARN_ON(state != GMU_OOB_GPU_SET);
+- gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
+- 1 << GMU_OOB_GPU_SET_CLEAR_NEW);
++ if (state == GMU_OOB_GPU_SET) {
++ gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
++ 1 << GMU_OOB_GPU_SET_CLEAR_NEW);
++ } else {
++ WARN_ON(state != GMU_OOB_PERFCOUNTER_SET);
++ gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
++ 1 << GMU_OOB_PERFCOUNTER_CLEAR_NEW);
++ }
+ return;
+ }
+
+@@ -312,6 +327,10 @@ void a6xx_gmu_clear_oob(struct a6xx_gmu *gmu, enum a6xx_gmu_oob_state state)
+ gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
+ 1 << GMU_OOB_GPU_SET_CLEAR);
+ break;
++ case GMU_OOB_PERFCOUNTER_SET:
++ gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
++ 1 << GMU_OOB_PERFCOUNTER_CLEAR);
++ break;
+ case GMU_OOB_BOOT_SLUMBER:
+ gmu_write(gmu, REG_A6XX_GMU_HOST2GMU_INTR_SET,
+ 1 << GMU_OOB_BOOT_SLUMBER_CLEAR);
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h
+index c6d2bced8e5de..9fa278de2106a 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h
+@@ -156,6 +156,7 @@ enum a6xx_gmu_oob_state {
+ GMU_OOB_BOOT_SLUMBER = 0,
+ GMU_OOB_GPU_SET,
+ GMU_OOB_DCVS_SET,
++ GMU_OOB_PERFCOUNTER_SET,
+ };
+
+ /* These are the interrupt / ack bits for each OOB request that are set
+@@ -190,6 +191,13 @@ enum a6xx_gmu_oob_state {
+ #define GMU_OOB_GPU_SET_ACK_NEW 31
+ #define GMU_OOB_GPU_SET_CLEAR_NEW 31
+
++#define GMU_OOB_PERFCOUNTER_REQUEST 17
++#define GMU_OOB_PERFCOUNTER_ACK 25
++#define GMU_OOB_PERFCOUNTER_CLEAR 25
++
++#define GMU_OOB_PERFCOUNTER_REQUEST_NEW 28
++#define GMU_OOB_PERFCOUNTER_ACK_NEW 30
++#define GMU_OOB_PERFCOUNTER_CLEAR_NEW 30
+
+ void a6xx_hfi_init(struct a6xx_gmu *gmu);
+ int a6xx_hfi_start(struct a6xx_gmu *gmu, int boot_state);
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 3b798e883f822..2dc6b342cf9b5 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1171,12 +1171,12 @@ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+
+ /* Force the GPU power on so we can read this register */
+- a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
++ a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+
+ *value = gpu_read64(gpu, REG_A6XX_RBBM_PERFCTR_CP_0_LO,
+ REG_A6XX_RBBM_PERFCTR_CP_0_HI);
+
+- a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
++ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From f50bd13924b3c51f25f9a350da6c94b3f06b3620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 13:03:31 -0800
+Subject: drm/msm: Fix races managing the OOB state for timestamp vs
+ timestamps.
+
+From: Eric Anholt <eric@anholt.net>
+
+[ Upstream commit 5f98b33b04c02c0d9088c7486c59d058696782f9 ]
+
+Now that we're not racing with GPU setup, also fix races of timestamps
+against other timestamps. In freedreno CI, we were seeing this path trigger
+timeouts on setting the GMU bit, producing:
+
+[drm:_a6xx_gmu_set_oob] *ERROR* Timeout waiting for GMU OOB set GPU_SET: 0x0
+
+and this triggered especially on the first set of tests right after
+boot (it's probably easier to lose the race than one might think,
+given that we start many tests in parallel, and waiting for NFS to
+page in code probably means that lots of tests hit the same point of
+screen init at the same time). As of this patch, the message seems to
+have completely gone away.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 2dc6b342cf9b5..0366419d8bfed 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1169,6 +1169,9 @@ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ {
+ struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+ struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
++ static DEFINE_MUTEX(perfcounter_oob);
++
++ mutex_lock(&perfcounter_oob);
+
+ /* Force the GPU power on so we can read this register */
+ a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+@@ -1177,6 +1180,7 @@ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ REG_A6XX_RBBM_PERFCTR_CP_0_HI);
+
+ a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
++ mutex_unlock(&perfcounter_oob);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 0b8db3c8fc168dc7c0a96c4ee12f1cb599b6b47f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 09:09:29 -0800
+Subject: drm/msm/kms: Make a lock_class_key for each crtc mutex
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 6ec9351809612fa1c0256fb3e39b49b6100e2983 ]
+
+Lockdep complains about an AA deadlock when rebooting the device.
+
+base-commit: 19c329f6808995b142b3966301f217c831e7cf31
+
+============================================
+WARNING: possible recursive locking detected
+5.4.91 #1 Not tainted
+--------------------------------------------
+reboot/5213 is trying to acquire lock:
+ffffff80d13391b0 (&kms->commit_lock[i]){+.+.}, at: lock_crtcs+0x60/0xa4
+
+but task is already holding lock:
+ffffff80d1339110 (&kms->commit_lock[i]){+.+.}, at: lock_crtcs+0x60/0xa4
+
+other info that might help us debug this:
+Possible unsafe locking scenario:
+
+CPU0
+----
+lock(&kms->commit_lock[i]);
+lock(&kms->commit_lock[i]);
+
+*** DEADLOCK ***
+
+May be due to missing lock nesting notation
+
+6 locks held by reboot/5213:
+__arm64_sys_reboot+0x148/0x2a0
+device_shutdown+0x10c/0x2c4
+drm_atomic_helper_shutdown+0x48/0xfc
+modeset_lock+0x120/0x24c
+lock_crtcs+0x60/0xa4
+
+stack backtrace:
+CPU: 4 PID: 5213 Comm: reboot Not tainted 5.4.91 #1
+Hardware name: Google Pompom (rev1) with LTE (DT)
+Call trace:
+dump_backtrace+0x0/0x1dc
+show_stack+0x24/0x30
+dump_stack+0xfc/0x1a8
+__lock_acquire+0xcd0/0x22b8
+lock_acquire+0x1ec/0x240
+__mutex_lock_common+0xe0/0xc84
+mutex_lock_nested+0x48/0x58
+lock_crtcs+0x60/0xa4
+msm_atomic_commit_tail+0x348/0x570
+commit_tail+0xdc/0x178
+drm_atomic_helper_commit+0x160/0x168
+drm_atomic_commit+0x68/0x80
+
+This is because lockdep thinks all the locks taken in lock_crtcs() are
+the same lock, when they actually aren't. That's because we call
+mutex_init() in msm_kms_init() and that assigns one static key for every
+lock initialized in this loop. Let's allocate a dynamic number of
+lock_class_keys and assign them to each lock so that lockdep can figure
+out an AA deadlock isn't possible here.
+
+Fixes: b3d91800d9ac ("drm/msm: Fix race condition in msm driver with async layer updates")
+Cc: Krishna Manikandan <mkrishn@codeaurora.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_kms.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
+index d8151a89e1631..4735251a394d8 100644
+--- a/drivers/gpu/drm/msm/msm_kms.h
++++ b/drivers/gpu/drm/msm/msm_kms.h
+@@ -157,6 +157,7 @@ struct msm_kms {
+ * from the crtc's pending_timer close to end of the frame:
+ */
+ struct mutex commit_lock[MAX_CRTCS];
++ struct lock_class_key commit_lock_keys[MAX_CRTCS];
+ unsigned pending_crtc_mask;
+ struct msm_pending_timer pending_timers[MAX_CRTCS];
+ };
+@@ -166,8 +167,11 @@ static inline int msm_kms_init(struct msm_kms *kms,
+ {
+ unsigned i, ret;
+
+- for (i = 0; i < ARRAY_SIZE(kms->commit_lock); i++)
+- mutex_init(&kms->commit_lock[i]);
++ for (i = 0; i < ARRAY_SIZE(kms->commit_lock); i++) {
++ lockdep_register_key(&kms->commit_lock_keys[i]);
++ __mutex_init(&kms->commit_lock[i], "&kms->commit_lock[i]",
++ &kms->commit_lock_keys[i]);
++ }
+
+ kms->funcs = funcs;
+
+--
+2.27.0
+
--- /dev/null
+From c42ec55d419c986d7e6a7daa7dacd34faa873db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:24:40 +0200
+Subject: drm/msm/mdp5: Fix wait-for-commit for cmd panels
+
+From: Iskren Chernev <iskren.chernev@gmail.com>
+
+[ Upstream commit 68e4f01fddb4ead80e8c7084db489307f22c9cbb ]
+
+Before the offending commit in msm_atomic_commit_tail wait_flush was
+called once per frame, after the commit was submitted. After it
+wait_flush is also called at the beginning to ensure previous
+potentially async commits are done.
+
+For cmd panels the source of wait_flush is a ping-pong irq notifying
+a completion. The completion needs to be notified with complete_all so
+multiple waiting parties (new async committers) can proceed.
+
+Signed-off-by: Iskren Chernev <iskren.chernev@gmail.com>
+Suggested-by: Rob Clark <robdclark@gmail.com>
+Fixes: 2d99ced787e3d ("drm/msm: async commit support")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+index 0c8f9f88301fa..f5d71b2740793 100644
+--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+@@ -1180,7 +1180,7 @@ static void mdp5_crtc_pp_done_irq(struct mdp_irq *irq, uint32_t irqstatus)
+ struct mdp5_crtc *mdp5_crtc = container_of(irq, struct mdp5_crtc,
+ pp_done);
+
+- complete(&mdp5_crtc->pp_completion);
++ complete_all(&mdp5_crtc->pp_completion);
+ }
+
+ static void mdp5_crtc_wait_for_pp_done(struct drm_crtc *crtc)
+--
+2.27.0
+
--- /dev/null
+From 3ebebedae812099dc2a2794600bf43e40299645b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 11:28:46 +0200
+Subject: drm/nouveau: bail out of nouveau_channel_new if channel init fails
+
+From: Frantisek Hrbata <frantisek@hrbata.com>
+
+[ Upstream commit eaba3b28401f50e22d64351caa8afe8d29509f27 ]
+
+Unprivileged user can crash kernel by using DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC
+ioctl. This was reported by trinity[1] fuzzer.
+
+[ 71.073906] nouveau 0000:01:00.0: crashme[1329]: channel failed to initialise, -17
+[ 71.081730] BUG: kernel NULL pointer dereference, address: 00000000000000a0
+[ 71.088928] #PF: supervisor read access in kernel mode
+[ 71.094059] #PF: error_code(0x0000) - not-present page
+[ 71.099189] PGD 119590067 P4D 119590067 PUD 1054f5067 PMD 0
+[ 71.104842] Oops: 0000 [#1] SMP NOPTI
+[ 71.108498] CPU: 2 PID: 1329 Comm: crashme Not tainted 5.8.0-rc6+ #2
+[ 71.114993] Hardware name: AMD Pike/Pike, BIOS RPK1506A 09/03/2014
+[ 71.121213] RIP: 0010:nouveau_abi16_ioctl_channel_alloc+0x108/0x380 [nouveau]
+[ 71.128339] Code: 48 89 9d f0 00 00 00 41 8b 4c 24 04 41 8b 14 24 45 31 c0 4c 8d 4b 10 48 89 ee 4c 89 f7 e8 10 11 00 00 85 c0 75 78 48 8b 43 10 <8b> 90 a0 00 00 00 41 89 54 24 08 80 7d 3d 05 0f 86 bb 01 00 00 41
+[ 71.147074] RSP: 0018:ffffb4a1809cfd38 EFLAGS: 00010246
+[ 71.152526] RAX: 0000000000000000 RBX: ffff98cedbaa1d20 RCX: 00000000000003bf
+[ 71.159651] RDX: 00000000000003be RSI: 0000000000000000 RDI: 0000000000030160
+[ 71.166774] RBP: ffff98cee776de00 R08: ffffdc0144198a08 R09: ffff98ceeefd4000
+[ 71.173901] R10: ffff98cee7e81780 R11: 0000000000000001 R12: ffffb4a1809cfe08
+[ 71.181214] R13: ffff98cee776d000 R14: ffff98cec519e000 R15: ffff98cee776def0
+[ 71.188339] FS: 00007fd926250500(0000) GS:ffff98ceeac80000(0000) knlGS:0000000000000000
+[ 71.196418] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 71.202155] CR2: 00000000000000a0 CR3: 0000000106622000 CR4: 00000000000406e0
+[ 71.209297] Call Trace:
+[ 71.211777] ? nouveau_abi16_ioctl_getparam+0x1f0/0x1f0 [nouveau]
+[ 71.218053] drm_ioctl_kernel+0xac/0xf0 [drm]
+[ 71.222421] drm_ioctl+0x211/0x3c0 [drm]
+[ 71.226379] ? nouveau_abi16_ioctl_getparam+0x1f0/0x1f0 [nouveau]
+[ 71.232500] nouveau_drm_ioctl+0x57/0xb0 [nouveau]
+[ 71.237285] ksys_ioctl+0x86/0xc0
+[ 71.240595] __x64_sys_ioctl+0x16/0x20
+[ 71.244340] do_syscall_64+0x4c/0x90
+[ 71.248110] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 71.253162] RIP: 0033:0x7fd925d4b88b
+[ 71.256731] Code: Bad RIP value.
+[ 71.259955] RSP: 002b:00007ffc743592d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
+[ 71.267514] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd925d4b88b
+[ 71.274637] RDX: 0000000000601080 RSI: 00000000c0586442 RDI: 0000000000000003
+[ 71.281986] RBP: 00007ffc74359340 R08: 00007fd926016ce0 R09: 00007fd926016ce0
+[ 71.289111] R10: 0000000000000003 R11: 0000000000000206 R12: 0000000000400620
+[ 71.296235] R13: 00007ffc74359420 R14: 0000000000000000 R15: 0000000000000000
+[ 71.303361] Modules linked in: rfkill sunrpc snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core edac_mce_amd snd_hwdep kvm_amd snd_seq ccp snd_seq_device snd_pcm kvm snd_timer snd irqbypass soundcore sp5100_tco pcspkr crct10dif_pclmul crc32_pclmul ghash_clmulni_intel wmi_bmof joydev i2c_piix4 fam15h_power k10temp acpi_cpufreq ip_tables xfs libcrc32c sd_mod t10_pi sg nouveau video mxm_wmi i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm broadcom bcm_phy_lib ata_generic ahci drm e1000 crc32c_intel libahci serio_raw tg3 libata firewire_ohci firewire_core wmi crc_itu_t dm_mirror dm_region_hash dm_log dm_mod
+[ 71.365269] CR2: 00000000000000a0
+
+simplified reproducer
+---------------------------------8<----------------------------------------
+/*
+ * gcc -o crashme crashme.c
+ * ./crashme /dev/dri/renderD128
+ */
+
+struct drm_nouveau_channel_alloc {
+ uint32_t fb_ctxdma_handle;
+ uint32_t tt_ctxdma_handle;
+
+ int channel;
+ uint32_t pushbuf_domains;
+
+ /* Notifier memory */
+ uint32_t notifier_handle;
+
+ /* DRM-enforced subchannel assignments */
+ struct {
+ uint32_t handle;
+ uint32_t grclass;
+ } subchan[8];
+ uint32_t nr_subchan;
+};
+
+static struct drm_nouveau_channel_alloc channel;
+
+int main(int argc, char *argv[]) {
+ int fd;
+ int rv;
+
+ if (argc != 2)
+ die("usage: %s <dev>", 0, argv[0]);
+
+ if ((fd = open(argv[1], O_RDONLY)) == -1)
+ die("open %s", errno, argv[1]);
+
+ if (ioctl(fd, DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC, &channel) == -1 &&
+ errno == EACCES)
+ die("ioctl %s", errno, argv[1]);
+
+ close(fd);
+
+ printf("PASS\n");
+
+ return 0;
+}
+---------------------------------8<----------------------------------------
+
+[1] https://github.com/kernelslacker/trinity
+
+Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared virtual memory")
+Signed-off-by: Frantisek Hrbata <frantisek@hrbata.com>
+Reviewed-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_chan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_chan.c b/drivers/gpu/drm/nouveau/nouveau_chan.c
+index 5d191e58edf11..e48f1f7eb3705 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_chan.c
++++ b/drivers/gpu/drm/nouveau/nouveau_chan.c
+@@ -533,6 +533,7 @@ nouveau_channel_new(struct nouveau_drm *drm, struct nvif_device *device,
+ if (ret) {
+ NV_PRINTK(err, cli, "channel failed to initialise, %d\n", ret);
+ nouveau_channel_del(pchan);
++ goto done;
+ }
+
+ ret = nouveau_svmm_join((*pchan)->vmm->svmm, (*pchan)->inst);
+--
+2.27.0
+
--- /dev/null
+From 2d57d5b00295c99ae57c712c0f7719cdb3f44c0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:29:49 +0100
+Subject: drm/panel: mantix: Tweak init sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guido Günther <agx@sigxcpu.org>
+
+[ Upstream commit dd396dbc4d7811c1567cc43faa4b9ad68094c44d ]
+
+We've seen some (non permanent) burn in and bad white balance
+on some of the panels. Adding this bit from a vendor supplied
+sequence fixes it.
+
+Fixes: 72967d5616d3 ("drm/panel: Add panel driver for the Mantix MLAF057WE51-X DSI panel")
+Signed-off-by: Guido Günther <agx@sigxcpu.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/8451831b60d5ecb73a156613d98218a31bd55680.1605688147.git.agx@sigxcpu.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c b/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
+index 0c5f22e95c2db..624d17b96a693 100644
+--- a/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
++++ b/drivers/gpu/drm/panel/panel-mantix-mlaf057we51.c
+@@ -22,6 +22,7 @@
+ /* Manufacturer specific Commands send via DSI */
+ #define MANTIX_CMD_OTP_STOP_RELOAD_MIPI 0x41
+ #define MANTIX_CMD_INT_CANCEL 0x4C
++#define MANTIX_CMD_SPI_FINISH 0x90
+
+ struct mantix {
+ struct device *dev;
+@@ -66,6 +67,10 @@ static int mantix_init_sequence(struct mantix *ctx)
+ dsi_generic_write_seq(dsi, 0x80, 0x64, 0x00, 0x64, 0x00, 0x00);
+ msleep(20);
+
++ dsi_generic_write_seq(dsi, MANTIX_CMD_SPI_FINISH, 0xA5);
++ dsi_generic_write_seq(dsi, MANTIX_CMD_OTP_STOP_RELOAD_MIPI, 0x00, 0x2F);
++ msleep(20);
++
+ dev_dbg(dev, "Panel init sequence done\n");
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 390b665af13cc7ae92e082bb43eb37ef741fe178 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 13:22:29 +0100
+Subject: drm/panel: s6e63m0: Fix init sequence again
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 47b1adc1d2a3b39233a56e183296b335222c9a6d ]
+
+The DSI version of the panel behaved instable and close
+scrutiny of the vendor driver from the Samsung
+GT-S8190 shows a different initialization sequence for
+the DSI mode panel than the DPI mode panel.
+
+Make the initialization depend on whether we are in
+DSI or DPI mode and handle the differences.
+
+After this the panel on the GT-I8190 becomes much more
+stable.
+
+Also spell out some more custom DCS commands found in
+the vendor source code to cut down a bit on magic
+where we can.
+
+Fixes: f0aee45ffc8b ("drm/panel: s6e63m0: Fix init sequence")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201205122229.1952980-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-samsung-s6e63m0.c | 42 ++++++++++++++-----
+ 1 file changed, 32 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
+index 6b4e97bfd46ee..bf6d704d4d272 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
+@@ -25,6 +25,14 @@
+ /* Manufacturer Command Set */
+ #define MCS_ELVSS_ON 0xb1
+ #define MCS_TEMP_SWIRE 0xb2
++#define MCS_PENTILE_1 0xb3
++#define MCS_PENTILE_2 0xb4
++#define MCS_GAMMA_DELTA_Y_RED 0xb5
++#define MCS_GAMMA_DELTA_X_RED 0xb6
++#define MCS_GAMMA_DELTA_Y_GREEN 0xb7
++#define MCS_GAMMA_DELTA_X_GREEN 0xb8
++#define MCS_GAMMA_DELTA_Y_BLUE 0xb9
++#define MCS_GAMMA_DELTA_X_BLUE 0xba
+ #define MCS_MIECTL1 0xc0
+ #define MCS_BCMODE 0xc1
+ #define MCS_ERROR_CHECK 0xd5
+@@ -281,6 +289,7 @@ struct s6e63m0 {
+ struct backlight_device *bl_dev;
+ u8 lcd_type;
+ u8 elvss_pulse;
++ bool dsi_mode;
+
+ struct regulator_bulk_data supplies[2];
+ struct gpio_desc *reset_gpio;
+@@ -395,9 +404,21 @@ static int s6e63m0_check_lcd_type(struct s6e63m0 *ctx)
+
+ static void s6e63m0_init(struct s6e63m0 *ctx)
+ {
+- s6e63m0_dcs_write_seq_static(ctx, MCS_PANELCTL,
+- 0x01, 0x27, 0x27, 0x07, 0x07, 0x54, 0x9f,
+- 0x63, 0x8f, 0x1a, 0x33, 0x0d, 0x00, 0x00);
++ /*
++ * We do not know why there is a difference in the DSI mode.
++ * (No datasheet.)
++ *
++ * In the vendor driver this sequence is called
++ * "SEQ_PANEL_CONDITION_SET" or "DCS_CMD_SEQ_PANEL_COND_SET".
++ */
++ if (ctx->dsi_mode)
++ s6e63m0_dcs_write_seq_static(ctx, MCS_PANELCTL,
++ 0x01, 0x2c, 0x2c, 0x07, 0x07, 0x5f, 0xb3,
++ 0x6d, 0x97, 0x1d, 0x3a, 0x0f, 0x00, 0x00);
++ else
++ s6e63m0_dcs_write_seq_static(ctx, MCS_PANELCTL,
++ 0x01, 0x27, 0x27, 0x07, 0x07, 0x54, 0x9f,
++ 0x63, 0x8f, 0x1a, 0x33, 0x0d, 0x00, 0x00);
+
+ s6e63m0_dcs_write_seq_static(ctx, MCS_DISCTL,
+ 0x02, 0x03, 0x1c, 0x10, 0x10);
+@@ -414,40 +435,40 @@ static void s6e63m0_init(struct s6e63m0 *ctx)
+
+ s6e63m0_dcs_write_seq_static(ctx, MCS_SRCCTL,
+ 0x00, 0x8e, 0x07);
+- s6e63m0_dcs_write_seq_static(ctx, 0xb3, 0x6c);
++ s6e63m0_dcs_write_seq_static(ctx, MCS_PENTILE_1, 0x6c);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xb5,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_Y_RED,
+ 0x2c, 0x12, 0x0c, 0x0a, 0x10, 0x0e, 0x17,
+ 0x13, 0x1f, 0x1a, 0x2a, 0x24, 0x1f, 0x1b,
+ 0x1a, 0x17, 0x2b, 0x26, 0x22, 0x20, 0x3a,
+ 0x34, 0x30, 0x2c, 0x29, 0x26, 0x25, 0x23,
+ 0x21, 0x20, 0x1e, 0x1e);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xb6,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_X_RED,
+ 0x00, 0x00, 0x11, 0x22, 0x33, 0x44, 0x44,
+ 0x44, 0x55, 0x55, 0x66, 0x66, 0x66, 0x66,
+ 0x66, 0x66);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xb7,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_Y_GREEN,
+ 0x2c, 0x12, 0x0c, 0x0a, 0x10, 0x0e, 0x17,
+ 0x13, 0x1f, 0x1a, 0x2a, 0x24, 0x1f, 0x1b,
+ 0x1a, 0x17, 0x2b, 0x26, 0x22, 0x20, 0x3a,
+ 0x34, 0x30, 0x2c, 0x29, 0x26, 0x25, 0x23,
+ 0x21, 0x20, 0x1e, 0x1e);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xb8,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_X_GREEN,
+ 0x00, 0x00, 0x11, 0x22, 0x33, 0x44, 0x44,
+ 0x44, 0x55, 0x55, 0x66, 0x66, 0x66, 0x66,
+ 0x66, 0x66);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xb9,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_Y_BLUE,
+ 0x2c, 0x12, 0x0c, 0x0a, 0x10, 0x0e, 0x17,
+ 0x13, 0x1f, 0x1a, 0x2a, 0x24, 0x1f, 0x1b,
+ 0x1a, 0x17, 0x2b, 0x26, 0x22, 0x20, 0x3a,
+ 0x34, 0x30, 0x2c, 0x29, 0x26, 0x25, 0x23,
+ 0x21, 0x20, 0x1e, 0x1e);
+
+- s6e63m0_dcs_write_seq_static(ctx, 0xba,
++ s6e63m0_dcs_write_seq_static(ctx, MCS_GAMMA_DELTA_X_BLUE,
+ 0x00, 0x00, 0x11, 0x22, 0x33, 0x44, 0x44,
+ 0x44, 0x55, 0x55, 0x66, 0x66, 0x66, 0x66,
+ 0x66, 0x66);
+@@ -704,6 +725,7 @@ int s6e63m0_probe(struct device *dev,
+ if (!ctx)
+ return -ENOMEM;
+
++ ctx->dsi_mode = dsi_mode;
+ ctx->dcs_read = dcs_read;
+ ctx->dcs_write = dcs_write;
+ dev_set_drvdata(dev, ctx);
+--
+2.27.0
+
--- /dev/null
+From a66f7c8dd9a001893f20d7e091ec99bcdf78de71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 23:22:10 +0100
+Subject: drm/panel: s6e63m0: Support max-brightness
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 1f20bf5921de420071fdb1d55cda7550ae137bcd ]
+
+The "max-brightness" is a standard backlight property that
+we need to support for the Samsung GT-I8190 Golden because
+the display will go black if we crank up the brightness
+too high.
+
+As the platform needs this ability to give picture this is
+a regression fix along with the addition of the property
+to the GT-I8190 device tree.
+
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Fixes: 9c3f0a0dd6a1 ("drm/panel: s6e63m0: Implement 28 backlight levels")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201214222210.238081-1-linus.walleij@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-samsung-s6e63m0.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
+index bf6d704d4d272..603c5dfe87682 100644
+--- a/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
++++ b/drivers/gpu/drm/panel/panel-samsung-s6e63m0.c
+@@ -692,12 +692,12 @@ static const struct backlight_ops s6e63m0_backlight_ops = {
+ .update_status = s6e63m0_set_brightness,
+ };
+
+-static int s6e63m0_backlight_register(struct s6e63m0 *ctx)
++static int s6e63m0_backlight_register(struct s6e63m0 *ctx, u32 max_brightness)
+ {
+ struct backlight_properties props = {
+ .type = BACKLIGHT_RAW,
+- .brightness = MAX_BRIGHTNESS,
+- .max_brightness = MAX_BRIGHTNESS
++ .brightness = max_brightness,
++ .max_brightness = max_brightness,
+ };
+ struct device *dev = ctx->dev;
+ int ret = 0;
+@@ -719,6 +719,7 @@ int s6e63m0_probe(struct device *dev,
+ bool dsi_mode)
+ {
+ struct s6e63m0 *ctx;
++ u32 max_brightness;
+ int ret;
+
+ ctx = devm_kzalloc(dev, sizeof(struct s6e63m0), GFP_KERNEL);
+@@ -734,6 +735,14 @@ int s6e63m0_probe(struct device *dev,
+ ctx->enabled = false;
+ ctx->prepared = false;
+
++ ret = device_property_read_u32(dev, "max-brightness", &max_brightness);
++ if (ret)
++ max_brightness = MAX_BRIGHTNESS;
++ if (max_brightness > MAX_BRIGHTNESS) {
++ dev_err(dev, "illegal max brightness specified\n");
++ max_brightness = MAX_BRIGHTNESS;
++ }
++
+ ctx->supplies[0].supply = "vdd3";
+ ctx->supplies[1].supply = "vci";
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(ctx->supplies),
+@@ -753,7 +762,7 @@ int s6e63m0_probe(struct device *dev,
+ dsi_mode ? DRM_MODE_CONNECTOR_DSI :
+ DRM_MODE_CONNECTOR_DPI);
+
+- ret = s6e63m0_backlight_register(ctx);
++ ret = s6e63m0_backlight_register(ctx, max_brightness);
+ if (ret < 0)
+ return ret;
+
+--
+2.27.0
+
--- /dev/null
+From 28bed991cc19595f4e1eeb05064fffec1e64f560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 13:43:58 +0200
+Subject: drm: rcar-du: Fix crash when using LVDS1 clock for CRTC
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 53ced169373aab52d3b5da0fee6a342002d1876d ]
+
+On D3 and E3 platforms, the LVDS encoder includes a PLL that can
+generate a clock for the corresponding CRTC, used even when the CRTC
+output to a non-LVDS port. This mechanism is supported by the driver,
+but the implementation is broken in dual-link LVDS mode. In that case,
+the LVDS1 drm_encoder is skipped, which causes a crash when trying to
+access its bridge later on.
+
+Fix this by storing bridge pointers internally instead of retrieving
+them from the encoder. The rcar_du_device encoders field isn't used
+anymore and can be dropped.
+
+Fixes: 8e8fddab0d0a ("drm: rcar-du: Skip LVDS1 output on Gen3 when using dual-link LVDS mode")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 10 ++--------
+ drivers/gpu/drm/rcar-du/rcar_du_drv.h | 6 +++---
+ drivers/gpu/drm/rcar-du/rcar_du_encoder.c | 5 ++++-
+ 3 files changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index b5fb941e0f534..e23b9c7b4afeb 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -730,13 +730,10 @@ static void rcar_du_crtc_atomic_enable(struct drm_crtc *crtc,
+ */
+ if (rcdu->info->lvds_clk_mask & BIT(rcrtc->index) &&
+ rstate->outputs == BIT(RCAR_DU_OUTPUT_DPAD0)) {
+- struct rcar_du_encoder *encoder =
+- rcdu->encoders[RCAR_DU_OUTPUT_LVDS0 + rcrtc->index];
++ struct drm_bridge *bridge = rcdu->lvds[rcrtc->index];
+ const struct drm_display_mode *mode =
+ &crtc->state->adjusted_mode;
+- struct drm_bridge *bridge;
+
+- bridge = drm_bridge_chain_get_first_bridge(&encoder->base);
+ rcar_lvds_clk_enable(bridge, mode->clock * 1000);
+ }
+
+@@ -764,15 +761,12 @@ static void rcar_du_crtc_atomic_disable(struct drm_crtc *crtc,
+
+ if (rcdu->info->lvds_clk_mask & BIT(rcrtc->index) &&
+ rstate->outputs == BIT(RCAR_DU_OUTPUT_DPAD0)) {
+- struct rcar_du_encoder *encoder =
+- rcdu->encoders[RCAR_DU_OUTPUT_LVDS0 + rcrtc->index];
+- struct drm_bridge *bridge;
++ struct drm_bridge *bridge = rcdu->lvds[rcrtc->index];
+
+ /*
+ * Disable the LVDS clock output, see
+ * rcar_du_crtc_atomic_enable().
+ */
+- bridge = drm_bridge_chain_get_first_bridge(&encoder->base);
+ rcar_lvds_clk_disable(bridge);
+ }
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.h b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+index 61504c54e2ecf..3597a179bfb78 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.h
+@@ -20,10 +20,10 @@
+
+ struct clk;
+ struct device;
++struct drm_bridge;
+ struct drm_device;
+ struct drm_property;
+ struct rcar_du_device;
+-struct rcar_du_encoder;
+
+ #define RCAR_DU_FEATURE_CRTC_IRQ_CLOCK BIT(0) /* Per-CRTC IRQ and clock */
+ #define RCAR_DU_FEATURE_VSP1_SOURCE BIT(1) /* Has inputs from VSP1 */
+@@ -71,6 +71,7 @@ struct rcar_du_device_info {
+ #define RCAR_DU_MAX_CRTCS 4
+ #define RCAR_DU_MAX_GROUPS DIV_ROUND_UP(RCAR_DU_MAX_CRTCS, 2)
+ #define RCAR_DU_MAX_VSPS 4
++#define RCAR_DU_MAX_LVDS 2
+
+ struct rcar_du_device {
+ struct device *dev;
+@@ -83,11 +84,10 @@ struct rcar_du_device {
+ struct rcar_du_crtc crtcs[RCAR_DU_MAX_CRTCS];
+ unsigned int num_crtcs;
+
+- struct rcar_du_encoder *encoders[RCAR_DU_OUTPUT_MAX];
+-
+ struct rcar_du_group groups[RCAR_DU_MAX_GROUPS];
+ struct platform_device *cmms[RCAR_DU_MAX_CRTCS];
+ struct rcar_du_vsp vsps[RCAR_DU_MAX_VSPS];
++ struct drm_bridge *lvds[RCAR_DU_MAX_LVDS];
+
+ struct {
+ struct drm_property *colorkey;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
+index b0335da0c1614..50fc14534fa4d 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_encoder.c
+@@ -57,7 +57,6 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
+ if (renc == NULL)
+ return -ENOMEM;
+
+- rcdu->encoders[output] = renc;
+ renc->output = output;
+ encoder = rcar_encoder_to_drm_encoder(renc);
+
+@@ -91,6 +90,10 @@ int rcar_du_encoder_init(struct rcar_du_device *rcdu,
+ ret = -EPROBE_DEFER;
+ goto done;
+ }
++
++ if (output == RCAR_DU_OUTPUT_LVDS0 ||
++ output == RCAR_DU_OUTPUT_LVDS1)
++ rcdu->lvds[output - RCAR_DU_OUTPUT_LVDS0] = bridge;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 325f040d5f8b69f1c68bdca1d73757f567424d4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 03:19:46 +0200
+Subject: drm: rcar-du: Fix leak of CMM platform device reference
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 9fa120458da142da0d1d3eaf6f6a3a2c2c91d27b ]
+
+The device references acquired by of_find_device_by_node() are not
+released by the driver. Fix this by registering a cleanup action.
+
+Fixes: 8de707aeb452 ("drm: rcar-du: kms: Initialize CMM instances")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_kms.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 7015e22872bbe..ecc894f0bc430 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -14,6 +14,7 @@
+ #include <drm/drm_fb_cma_helper.h>
+ #include <drm/drm_gem_cma_helper.h>
+ #include <drm/drm_gem_framebuffer_helper.h>
++#include <drm/drm_managed.h>
+ #include <drm/drm_probe_helper.h>
+ #include <drm/drm_vblank.h>
+
+@@ -726,8 +727,12 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
+ * disabled: return 0 and let the DU continue probing.
+ */
+ ret = rcar_cmm_init(pdev);
+- if (ret)
++ if (ret) {
++ platform_device_put(pdev);
+ return ret == -ENODEV ? 0 : ret;
++ }
++
++ rcdu->cmms[i] = pdev;
+
+ /*
+ * Enforce suspend/resume ordering by making the CMM a provider
+@@ -739,13 +744,20 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
+ "Failed to create device link to CMM%u\n", i);
+ return -EINVAL;
+ }
+-
+- rcdu->cmms[i] = pdev;
+ }
+
+ return 0;
+ }
+
++static void rcar_du_modeset_cleanup(struct drm_device *dev, void *res)
++{
++ struct rcar_du_device *rcdu = to_rcar_du_device(dev);
++ unsigned int i;
++
++ for (i = 0; i < ARRAY_SIZE(rcdu->cmms); ++i)
++ platform_device_put(rcdu->cmms[i]);
++}
++
+ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+ {
+ static const unsigned int mmio_offsets[] = {
+@@ -766,6 +778,10 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+ if (ret)
+ return ret;
+
++ ret = drmm_add_action(&rcdu->ddev, rcar_du_modeset_cleanup, NULL);
++ if (ret)
++ return ret;
++
+ dev->mode_config.min_width = 0;
+ dev->mode_config.min_height = 0;
+ dev->mode_config.normalize_zpos = true;
+--
+2.27.0
+
--- /dev/null
+From 5008529c2a5971f2d2f7e6212e3dc4ac5c1068ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 17:44:44 +0800
+Subject: drm: rcar-du: Fix PM reference leak in rcar_cmm_enable()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 136ce7684bc1ff4a088812f600c63daca50b32c2 ]
+
+pm_runtime_get_sync will increment pm usage counter even it failed.
+Forgetting to putting operation will result in a reference leak here.
+
+A new function pm_runtime_resume_and_get is introduced in [0] to keep
+usage counter balanced. So We fix the reference leak by replacing it
+with new funtion.
+
+[0] dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+
+Fixes: e08e934d6c28 ("drm: rcar-du: Add support for CMM")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Acked-by: Jacopo Mondi <jacopo@jmondi.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_cmm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_cmm.c b/drivers/gpu/drm/rcar-du/rcar_cmm.c
+index c578095b09a53..382d53f8a22e8 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_cmm.c
++++ b/drivers/gpu/drm/rcar-du/rcar_cmm.c
+@@ -122,7 +122,7 @@ int rcar_cmm_enable(struct platform_device *pdev)
+ {
+ int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.27.0
+
--- /dev/null
+From c424bee4a1d2e9145771e8d875d150092b96f2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 11:14:52 +0800
+Subject: drm: rcar-du: Fix the return check of of_parse_phandle and
+ of_find_device_by_node
+
+From: Wang Xiaojun <wangxiaojun11@huawei.com>
+
+[ Upstream commit 8d7d33f6be06f929ac2c5e8ea2323fec272790d4 ]
+
+of_parse_phandle and of_find_device_by_node may return NULL
+which cannot be checked by IS_ERR.
+
+Fixes: 8de707aeb452 ("drm: rcar-du: kms: Initialize CMM instances")
+Signed-off-by: Wang Xiaojun <wangxiaojun11@huawei.com>
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+
+[Replace -ENODEV with -EINVAL]
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_kms.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 72dda446355fe..7015e22872bbe 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -700,10 +700,10 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
+ int ret;
+
+ cmm = of_parse_phandle(np, "renesas,cmms", i);
+- if (IS_ERR(cmm)) {
++ if (!cmm) {
+ dev_err(rcdu->dev,
+ "Failed to parse 'renesas,cmms' property\n");
+- return PTR_ERR(cmm);
++ return -EINVAL;
+ }
+
+ if (!of_device_is_available(cmm)) {
+@@ -713,10 +713,10 @@ static int rcar_du_cmm_init(struct rcar_du_device *rcdu)
+ }
+
+ pdev = of_find_device_by_node(cmm);
+- if (IS_ERR(pdev)) {
++ if (!pdev) {
+ dev_err(rcdu->dev, "No device found for CMM%u\n", i);
+ of_node_put(cmm);
+- return PTR_ERR(pdev);
++ return -EINVAL;
+ }
+
+ of_node_put(cmm);
+--
+2.27.0
+
--- /dev/null
+From 315c0a9d1d27ffb05641091330c8b1f5ae5e5787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 09:17:32 +0100
+Subject: drm/sun4i: tcon: fix inverted DCLK polarity
+
+From: Giulio Benetti <giulio.benetti@micronovasrl.com>
+
+[ Upstream commit 67f4aeb2b41a0629abde3794d463547f60b0cbdd ]
+
+During commit 88bc4178568b ("drm: Use new
+DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags") DRM_BUS_FLAG_*
+macros have been changed to avoid ambiguity but just because of this
+ambiguity previous DRM_BUS_FLAG_PIXDATA_(POS/NEG)EDGE were used meaning
+_SAMPLE_ not _DRIVE_. This leads to DLCK inversion and need to fix but
+instead of swapping phase values, let's adopt an easier approach Maxime
+suggested:
+It turned out that bit 26 of SUN4I_TCON0_IO_POL_REG is dedicated to
+invert DCLK polarity and this makes things really easier than before. So
+let's handle DCLK polarity by adding SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE
+as bit 26 and activating according to bus_flags the same way it is done
+for all the other signals polarity.
+
+Fixes: 88bc4178568b ("drm: Use new DRM_BUS_FLAG_*_(DRIVE|SAMPLE)_(POS|NEG)EDGE flags")
+Suggested-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210114081732.9386-1-giulio.benetti@benettiengineering.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 21 ++-------------------
+ drivers/gpu/drm/sun4i/sun4i_tcon.h | 1 +
+ 2 files changed, 3 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 1e643bc7e786a..9f06dec0fc61d 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -569,30 +569,13 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
+ if (info->bus_flags & DRM_BUS_FLAG_DE_LOW)
+ val |= SUN4I_TCON0_IO_POL_DE_NEGATIVE;
+
+- /*
+- * On A20 and similar SoCs, the only way to achieve Positive Edge
+- * (Rising Edge), is setting dclk clock phase to 2/3(240°).
+- * By default TCON works in Negative Edge(Falling Edge),
+- * this is why phase is set to 0 in that case.
+- * Unfortunately there's no way to logically invert dclk through
+- * IO_POL register.
+- * The only acceptable way to work, triple checked with scope,
+- * is using clock phase set to 0° for Negative Edge and set to 240°
+- * for Positive Edge.
+- * On A33 and similar SoCs there would be a 90° phase option,
+- * but it divides also dclk by 2.
+- * Following code is a way to avoid quirks all around TCON
+- * and DOTCLOCK drivers.
+- */
+- if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE)
+- clk_set_phase(tcon->dclk, 240);
+-
+ if (info->bus_flags & DRM_BUS_FLAG_PIXDATA_DRIVE_NEGEDGE)
+- clk_set_phase(tcon->dclk, 0);
++ val |= SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE;
+
+ regmap_update_bits(tcon->regs, SUN4I_TCON0_IO_POL_REG,
+ SUN4I_TCON0_IO_POL_HSYNC_POSITIVE |
+ SUN4I_TCON0_IO_POL_VSYNC_POSITIVE |
++ SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE |
+ SUN4I_TCON0_IO_POL_DE_NEGATIVE,
+ val);
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.h b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+index ee555318e3c2f..e624f6977eb84 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.h
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.h
+@@ -113,6 +113,7 @@
+ #define SUN4I_TCON0_IO_POL_REG 0x88
+ #define SUN4I_TCON0_IO_POL_DCLK_PHASE(phase) ((phase & 3) << 28)
+ #define SUN4I_TCON0_IO_POL_DE_NEGATIVE BIT(27)
++#define SUN4I_TCON0_IO_POL_DCLK_DRIVE_NEGEDGE BIT(26)
+ #define SUN4I_TCON0_IO_POL_HSYNC_POSITIVE BIT(25)
+ #define SUN4I_TCON0_IO_POL_VSYNC_POSITIVE BIT(24)
+
+--
+2.27.0
+
--- /dev/null
+From 99028b1976660e3b1471accbdb9c120e2ed21c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 20:56:31 +0800
+Subject: drm/tegra: Fix reference leak when pm_runtime_get_sync() fails
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit dcdfe2712b68f1e9dbf4f1a96ad59b80e5cc0ef7 ]
+
+The PM reference count is not expected to be incremented on return in
+these Tegra functions.
+
+However, pm_runtime_get_sync() will increment the PM reference count
+even on failure. Forgetting to put the reference again will result in
+a leak.
+
+Replace it with pm_runtime_resume_and_get() to keep the usage counter
+balanced.
+
+Fixes: fd67e9c6ed5a ("drm/tegra: Do not implement runtime PM")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dc.c | 2 +-
+ drivers/gpu/drm/tegra/dsi.c | 2 +-
+ drivers/gpu/drm/tegra/hdmi.c | 2 +-
+ drivers/gpu/drm/tegra/hub.c | 2 +-
+ drivers/gpu/drm/tegra/sor.c | 2 +-
+ drivers/gpu/drm/tegra/vic.c | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
+index 85dd7131553af..0ae3a025efe9d 100644
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -2186,7 +2186,7 @@ static int tegra_dc_runtime_resume(struct host1x_client *client)
+ struct device *dev = client->dev;
+ int err;
+
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+ dev_err(dev, "failed to get runtime PM: %d\n", err);
+ return err;
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index 5691ef1b0e586..f46d377f0c304 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1111,7 +1111,7 @@ static int tegra_dsi_runtime_resume(struct host1x_client *client)
+ struct device *dev = client->dev;
+ int err;
+
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+ dev_err(dev, "failed to get runtime PM: %d\n", err);
+ return err;
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index d09a24931c87c..e5d2a40260288 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -1510,7 +1510,7 @@ static int tegra_hdmi_runtime_resume(struct host1x_client *client)
+ struct device *dev = client->dev;
+ int err;
+
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+ dev_err(dev, "failed to get runtime PM: %d\n", err);
+ return err;
+diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
+index 22a03f7ffdc12..5ce771cba1335 100644
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -789,7 +789,7 @@ static int tegra_display_hub_runtime_resume(struct host1x_client *client)
+ unsigned int i;
+ int err;
+
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+ dev_err(dev, "failed to get runtime PM: %d\n", err);
+ return err;
+diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c
+index cc2aa2308a515..f02a035dda453 100644
+--- a/drivers/gpu/drm/tegra/sor.c
++++ b/drivers/gpu/drm/tegra/sor.c
+@@ -3218,7 +3218,7 @@ static int tegra_sor_runtime_resume(struct host1x_client *client)
+ struct device *dev = client->dev;
+ int err;
+
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+ dev_err(dev, "failed to get runtime PM: %d\n", err);
+ return err;
+diff --git a/drivers/gpu/drm/tegra/vic.c b/drivers/gpu/drm/tegra/vic.c
+index ade56b860cf9d..b77f726303d89 100644
+--- a/drivers/gpu/drm/tegra/vic.c
++++ b/drivers/gpu/drm/tegra/vic.c
+@@ -314,7 +314,7 @@ static int vic_open_channel(struct tegra_drm_client *client,
+ struct vic *vic = to_vic(client);
+ int err;
+
+- err = pm_runtime_get_sync(vic->dev);
++ err = pm_runtime_resume_and_get(vic->dev);
+ if (err < 0)
+ return err;
+
+--
+2.27.0
+
--- /dev/null
+From 64020186d1f8d07d8d19f2b757b719c688d81e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:23:00 +0100
+Subject: drm/vc4: hdmi: Compute the CEC clock divider from the clock rate
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 163a3ef681e5e9d5df558e855d86ccd4708d6200 ]
+
+The CEC clock divider needs to output a frequency of 40kHz from the HSM
+rate on the BCM2835. The driver used to have a fixed frequency for it,
+but that changed for the BCM2711 and we now need to compute it
+dynamically to maintain the proper rate.
+
+Fixes: cd4cb49dc5bb ("drm/vc4: hdmi: Adjust HSM clock rate depending on pixel rate")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-7-maxime@cerno.tech
+(cherry picked from commit f1ceb9d10043683b89e5e5e5848fb4e855295762)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index a9a6552bdae93..eff9014750e2d 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1467,6 +1467,7 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
+ {
+ struct cec_connector_info conn_info;
+ struct platform_device *pdev = vc4_hdmi->pdev;
++ u16 clk_cnt;
+ u32 value;
+ int ret;
+
+@@ -1492,8 +1493,9 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
+ * divider: the hsm_clock rate and this divider setting will
+ * give a 40 kHz CEC clock.
+ */
++ clk_cnt = clk_get_rate(vc4_hdmi->hsm_clock) / CEC_CLOCK_FREQ;
+ value |= VC4_HDMI_CEC_ADDR_MASK |
+- (4091 << VC4_HDMI_CEC_DIV_CLK_CNT_SHIFT);
++ (clk_cnt << VC4_HDMI_CEC_DIV_CLK_CNT_SHIFT);
+ HDMI_WRITE(HDMI_CEC_CNTRL_1, value);
+ ret = devm_request_threaded_irq(&pdev->dev, platform_get_irq(pdev, 0),
+ vc4_cec_irq_handler,
+--
+2.27.0
+
--- /dev/null
+From 1ed318374c9878b42102150e23cba662286a9864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:22:57 +0100
+Subject: drm/vc4: hdmi: Fix register offset with longer CEC messages
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 4a59ed546c0511f01a4bf6b886fe34b6cce2513f ]
+
+The code prior to 311e305fdb4e ("drm/vc4: hdmi: Implement a register
+layout abstraction") was relying on the fact that the register offset
+was incremented by 4 for each readl call. That worked since the register
+width is 4 bytes.
+
+However, since that commit the HDMI_READ macro is now taking an enum,
+and the offset doesn't increment by 4 but 1 now. Divide the index by 4
+to fix this.
+
+Fixes: 311e305fdb4e ("drm/vc4: hdmi: Implement a register layout abstraction")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-4-maxime@cerno.tech
+(cherry picked from commit e9c9481f373eb7344f9e973eb28fc6e9d0f46485)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index ea50ecf985d1c..3d473638dbe18 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -1312,13 +1312,20 @@ static irqreturn_t vc4_cec_irq_handler_thread(int irq, void *priv)
+
+ static void vc4_cec_read_msg(struct vc4_hdmi *vc4_hdmi, u32 cntrl1)
+ {
++ struct drm_device *dev = vc4_hdmi->connector.dev;
+ struct cec_msg *msg = &vc4_hdmi->cec_rx_msg;
+ unsigned int i;
+
+ msg->len = 1 + ((cntrl1 & VC4_HDMI_CEC_REC_WRD_CNT_MASK) >>
+ VC4_HDMI_CEC_REC_WRD_CNT_SHIFT);
++
++ if (msg->len > 16) {
++ drm_err(dev, "Attempting to read too much data (%d)\n", msg->len);
++ return;
++ }
++
+ for (i = 0; i < msg->len; i += 4) {
+- u32 val = HDMI_READ(HDMI_CEC_RX_DATA_1 + i);
++ u32 val = HDMI_READ(HDMI_CEC_RX_DATA_1 + (i >> 2));
+
+ msg->msg[i] = val & 0xff;
+ msg->msg[i + 1] = (val >> 8) & 0xff;
+@@ -1411,11 +1418,17 @@ static int vc4_hdmi_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+ u32 signal_free_time, struct cec_msg *msg)
+ {
+ struct vc4_hdmi *vc4_hdmi = cec_get_drvdata(adap);
++ struct drm_device *dev = vc4_hdmi->connector.dev;
+ u32 val;
+ unsigned int i;
+
++ if (msg->len > 16) {
++ drm_err(dev, "Attempting to transmit too much data (%d)\n", msg->len);
++ return -ENOMEM;
++ }
++
+ for (i = 0; i < msg->len; i += 4)
+- HDMI_WRITE(HDMI_CEC_TX_DATA_1 + i,
++ HDMI_WRITE(HDMI_CEC_TX_DATA_1 + (i >> 2),
+ (msg->msg[i]) |
+ (msg->msg[i + 1] << 8) |
+ (msg->msg[i + 2] << 16) |
+--
+2.27.0
+
--- /dev/null
+From 23d09eb510029fbb6903505fdfab00fbc93dd69e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:22:58 +0100
+Subject: drm/vc4: hdmi: Fix up CEC registers
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 5a32bfd563e8b5766e57475c2c81c769e5a13f5d ]
+
+The commit 311e305fdb4e ("drm/vc4: hdmi: Implement a register layout
+abstraction") forgot one CEC register, and made a copy and paste mistake
+for another one. Fix those mistakes.
+
+Fixes: 311e305fdb4e ("drm/vc4: hdmi: Implement a register layout abstraction")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-5-maxime@cerno.tech
+(cherry picked from commit 303085bc11bb7aebeeaaf09213f99fd7aa539a34)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi_regs.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi_regs.h b/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
+index 96d764ebfe675..5379c36f09923 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
++++ b/drivers/gpu/drm/vc4/vc4_hdmi_regs.h
+@@ -29,6 +29,7 @@ enum vc4_hdmi_field {
+ HDMI_CEC_CPU_MASK_SET,
+ HDMI_CEC_CPU_MASK_STATUS,
+ HDMI_CEC_CPU_STATUS,
++ HDMI_CEC_CPU_SET,
+
+ /*
+ * Transmit data, first byte is low byte of the 32-bit reg.
+@@ -196,9 +197,10 @@ static const struct vc4_hdmi_register __maybe_unused vc4_hdmi_fields[] = {
+ VC4_HDMI_REG(HDMI_TX_PHY_RESET_CTL, 0x02c0),
+ VC4_HDMI_REG(HDMI_TX_PHY_CTL_0, 0x02c4),
+ VC4_HDMI_REG(HDMI_CEC_CPU_STATUS, 0x0340),
++ VC4_HDMI_REG(HDMI_CEC_CPU_SET, 0x0344),
+ VC4_HDMI_REG(HDMI_CEC_CPU_CLEAR, 0x0348),
+ VC4_HDMI_REG(HDMI_CEC_CPU_MASK_STATUS, 0x034c),
+- VC4_HDMI_REG(HDMI_CEC_CPU_MASK_SET, 0x034c),
++ VC4_HDMI_REG(HDMI_CEC_CPU_MASK_SET, 0x0350),
+ VC4_HDMI_REG(HDMI_CEC_CPU_MASK_CLEAR, 0x0354),
+ VC4_HDMI_REG(HDMI_RAM_PACKET_START, 0x0400),
+ };
+--
+2.27.0
+
--- /dev/null
+From e2d3f143bcaccfc686af6c3d08d1467c0e8613d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:22:56 +0100
+Subject: drm/vc4: hdmi: Move hdmi reset to bind
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 902dc5c19a8fecd3113dd41cc601b34557bdede9 ]
+
+The hdmi reset got moved to a later point in the commit 9045e91a476b
+("drm/vc4: hdmi: Add reset callback").
+
+However, the reset now occurs after vc4_hdmi_cec_init and so tramples
+the setup of registers like HDMI_CEC_CNTRL_1
+
+This only affects pi0-3 as on pi4 the cec registers are in a separate
+block
+
+Fixes: 9045e91a476b ("drm/vc4: hdmi: Add reset callback")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-3-maxime@cerno.tech
+(cherry picked from commit 7155334f15f360f5c98391c5c7e12af4c13395c4)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 2013f83ef50b6..ea50ecf985d1c 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -660,9 +660,6 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder)
+ return;
+ }
+
+- if (vc4_hdmi->variant->reset)
+- vc4_hdmi->variant->reset(vc4_hdmi);
+-
+ if (vc4_hdmi->variant->phy_init)
+ vc4_hdmi->variant->phy_init(vc4_hdmi, mode);
+
+@@ -1743,6 +1740,9 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data)
+ vc4_hdmi->disable_wifi_frequencies =
+ of_property_read_bool(dev->of_node, "wifi-2.4ghz-coexistence");
+
++ if (vc4_hdmi->variant->reset)
++ vc4_hdmi->variant->reset(vc4_hdmi);
++
+ pm_runtime_enable(dev);
+
+ drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
+--
+2.27.0
+
--- /dev/null
+From f7123c44e61e1a9b45d6fd2027207c56de429e9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:22:59 +0100
+Subject: drm/vc4: hdmi: Restore cec physical address on reconnect
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit 4d8602b8ec16f5721a4d1339c610a81f95df1856 ]
+
+Currently we call cec_phys_addr_invalidate on a hotplug deassert.
+That may be due to a TV power cycling, or an AVR being switched
+on (and switching edid).
+
+This makes CEC unusable since our controller wouldn't have a physical
+address anymore.
+
+Set it back up again on the hotplug assert.
+
+Fixes: 15b4511a4af6 ("drm/vc4: add HDMI CEC support")
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-6-maxime@cerno.tech
+(cherry picked from commit b06eecb5158e5f3eb47b9d05aea8c259985cc5f7)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 3d473638dbe18..a9a6552bdae93 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -123,20 +123,32 @@ static enum drm_connector_status
+ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ {
+ struct vc4_hdmi *vc4_hdmi = connector_to_vc4_hdmi(connector);
++ bool connected = false;
+
+ if (vc4_hdmi->hpd_gpio) {
+ if (gpio_get_value_cansleep(vc4_hdmi->hpd_gpio) ^
+ vc4_hdmi->hpd_active_low)
+- return connector_status_connected;
+- cec_phys_addr_invalidate(vc4_hdmi->cec_adap);
+- return connector_status_disconnected;
++ connected = true;
++ } else if (drm_probe_ddc(vc4_hdmi->ddc)) {
++ connected = true;
++ } else if (HDMI_READ(HDMI_HOTPLUG) & VC4_HDMI_HOTPLUG_CONNECTED) {
++ connected = true;
+ }
+
+- if (drm_probe_ddc(vc4_hdmi->ddc))
+- return connector_status_connected;
++ if (connected) {
++ if (connector->status != connector_status_connected) {
++ struct edid *edid = drm_get_edid(connector, vc4_hdmi->ddc);
++
++ if (edid) {
++ cec_s_phys_addr_from_edid(vc4_hdmi->cec_adap, edid);
++ vc4_hdmi->encoder.hdmi_monitor = drm_detect_hdmi_monitor(edid);
++ kfree(edid);
++ }
++ }
+
+- if (HDMI_READ(HDMI_HOTPLUG) & VC4_HDMI_HOTPLUG_CONNECTED)
+ return connector_status_connected;
++ }
++
+ cec_phys_addr_invalidate(vc4_hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+--
+2.27.0
+
--- /dev/null
+From 7593759c1960502a9f3783f303fdcdd3c8944a58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 16:42:37 +0100
+Subject: drm/vc4: hdmi: Take into account the clock doubling flag in
+ atomic_check
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 320e84dc6111ecc1c957e2b186d4d2bafee6bde2 ]
+
+Commit 63495f6b4aed ("drm/vc4: hdmi: Make sure our clock rate is within
+limits") was intended to compute the pixel rate to make sure we remain
+within the boundaries of what the hardware can provide.
+
+However, unlike what mode_valid was checking for, we forgot to take
+into account the clock doubling flag that can be set for modes. Let's
+honor that flag if it's there.
+
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reported-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Fixes: 63495f6b4aed ("drm/vc4: hdmi: Make sure our clock rate is within limits")
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201215154243.540115-4-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index 98cab0bbe92d8..2013f83ef50b6 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -790,6 +790,9 @@ static int vc4_hdmi_encoder_atomic_check(struct drm_encoder *encoder,
+ pixel_rate = mode->clock * 1000;
+ }
+
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
++ pixel_rate = pixel_rate * 2;
++
+ if (pixel_rate > vc4_hdmi->variant->max_pixel_clock)
+ return -EINVAL;
+
+--
+2.27.0
+
--- /dev/null
+From 7823bfa6823f9524fbb4a05435c999c633c0e9a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 15:23:01 +0100
+Subject: drm/vc4: hdmi: Update the CEC clock divider on HSM rate change
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit 47fa9a80270e20a0c4ddaffca1f144d22cc59620 ]
+
+As part of the enable sequence we might change the HSM clock rate if the
+pixel rate is different than the one we were already dealing with.
+
+On the BCM2835 however, the CEC clock derives from the HSM clock so any
+rate change will need to be reflected in the CEC clock divider to output
+40kHz.
+
+Fixes: cd4cb49dc5bb ("drm/vc4: hdmi: Adjust HSM clock rate depending on pixel rate")
+Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111142309.193441-8-maxime@cerno.tech
+(cherry picked from commit a9dd0b9a5c3e11c79e6ff9c7fdf07c471732dcb6)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vc4/vc4_hdmi.c | 39 +++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
+index eff9014750e2d..a9f494590c578 100644
+--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
+@@ -119,6 +119,27 @@ static void vc5_hdmi_reset(struct vc4_hdmi *vc4_hdmi)
+ HDMI_READ(HDMI_CLOCK_STOP) | VC4_DVP_HT_CLOCK_STOP_PIXEL);
+ }
+
++#ifdef CONFIG_DRM_VC4_HDMI_CEC
++static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi)
++{
++ u16 clk_cnt;
++ u32 value;
++
++ value = HDMI_READ(HDMI_CEC_CNTRL_1);
++ value &= ~VC4_HDMI_CEC_DIV_CLK_CNT_MASK;
++
++ /*
++ * Set the clock divider: the hsm_clock rate and this divider
++ * setting will give a 40 kHz CEC clock.
++ */
++ clk_cnt = clk_get_rate(vc4_hdmi->hsm_clock) / CEC_CLOCK_FREQ;
++ value |= clk_cnt << VC4_HDMI_CEC_DIV_CLK_CNT_SHIFT;
++ HDMI_WRITE(HDMI_CEC_CNTRL_1, value);
++}
++#else
++static void vc4_hdmi_cec_update_clk_div(struct vc4_hdmi *vc4_hdmi) {}
++#endif
++
+ static enum drm_connector_status
+ vc4_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ {
+@@ -651,6 +672,8 @@ static void vc4_hdmi_encoder_pre_crtc_configure(struct drm_encoder *encoder)
+ return;
+ }
+
++ vc4_hdmi_cec_update_clk_div(vc4_hdmi);
++
+ /*
+ * FIXME: When the pixel freq is 594MHz (4k60), this needs to be setup
+ * at 300MHz.
+@@ -1467,7 +1490,6 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
+ {
+ struct cec_connector_info conn_info;
+ struct platform_device *pdev = vc4_hdmi->pdev;
+- u16 clk_cnt;
+ u32 value;
+ int ret;
+
+@@ -1486,17 +1508,14 @@ static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
+ cec_s_conn_info(vc4_hdmi->cec_adap, &conn_info);
+
+ HDMI_WRITE(HDMI_CEC_CPU_MASK_SET, 0xffffffff);
++
+ value = HDMI_READ(HDMI_CEC_CNTRL_1);
+- value &= ~VC4_HDMI_CEC_DIV_CLK_CNT_MASK;
+- /*
+- * Set the logical address to Unregistered and set the clock
+- * divider: the hsm_clock rate and this divider setting will
+- * give a 40 kHz CEC clock.
+- */
+- clk_cnt = clk_get_rate(vc4_hdmi->hsm_clock) / CEC_CLOCK_FREQ;
+- value |= VC4_HDMI_CEC_ADDR_MASK |
+- (clk_cnt << VC4_HDMI_CEC_DIV_CLK_CNT_SHIFT);
++ /* Set the logical address to Unregistered */
++ value |= VC4_HDMI_CEC_ADDR_MASK;
+ HDMI_WRITE(HDMI_CEC_CNTRL_1, value);
++
++ vc4_hdmi_cec_update_clk_div(vc4_hdmi);
++
+ ret = devm_request_threaded_irq(&pdev->dev, platform_get_irq(pdev, 0),
+ vc4_cec_irq_handler,
+ vc4_cec_irq_handler_thread, 0,
+--
+2.27.0
+
--- /dev/null
+From e7d624925d625f43a2c13278d6eac183f72bf5f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 12:54:24 +0300
+Subject: drm/virtio: fix an error code in virtio_gpu_init()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8d0cb8860a4551fa5998acd67ca6d9ce3015b1e2 ]
+
+If devm_request_mem_region() fails this code currently returns success
+but it should return -EBUSY.
+
+Fixes: 6076a9711dc5 ("drm/virtio: implement blob resources: probe for host visible region")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/YBpy0GS7GfmafMfe@mwanda
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+(cherry picked from commit eb988a2ee500d3297a1de048dc3c77b6c354e650)
+Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
+index b4ec479c32cda..b375394193be8 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
+@@ -163,6 +163,7 @@ int virtio_gpu_init(struct drm_device *dev)
+ vgdev->host_visible_region.len,
+ dev_name(&vgdev->vdev->dev))) {
+ DRM_ERROR("Could not reserve host visible region\n");
++ ret = -EBUSY;
+ goto err_vqs;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From eac42b276a72d92c8f4d778d067f04e99d9f3522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 13:07:26 -0800
+Subject: drm/virtio: make sure context is created in gem open
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 8aeef9d4f48917ce85710949b079548974b4a638 ]
+
+The context might still be missing when DRM_IOCTL_PRIME_FD_TO_HANDLE is
+the first ioctl on the drm_file.
+
+Fixes: 72b48ae800da ("drm/virtio: enqueue virtio_gpu_create_context after the first 3D ioctl")
+Cc: Gurchetan Singh <gurchetansingh@chromium.org>
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20210107210726.269584-1-olvaffe@gmail.com
+Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_gem.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_gem.c b/drivers/gpu/drm/virtio/virtgpu_gem.c
+index c30c75ee83fce..8502400b2f9c9 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_gem.c
++++ b/drivers/gpu/drm/virtio/virtgpu_gem.c
+@@ -39,9 +39,6 @@ static int virtio_gpu_gem_create(struct drm_file *file,
+ int ret;
+ u32 handle;
+
+- if (vgdev->has_virgl_3d)
+- virtio_gpu_create_context(dev, file);
+-
+ ret = virtio_gpu_object_create(vgdev, params, &obj, NULL);
+ if (ret < 0)
+ return ret;
+@@ -119,6 +116,11 @@ int virtio_gpu_gem_object_open(struct drm_gem_object *obj,
+ if (!vgdev->has_virgl_3d)
+ goto out_notify;
+
++ /* the context might still be missing when the first ioctl is
++ * DRM_IOCTL_MODE_CREATE_DUMB or DRM_IOCTL_PRIME_FD_TO_HANDLE
++ */
++ virtio_gpu_create_context(obj->dev, file);
++
+ objs = virtio_gpu_array_alloc(1);
+ if (!objs)
+ return -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 363a8ea26ef327f9931832a76ed8b38eccc3043b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 16:02:53 +0800
+Subject: evm: Fix memleak in init_desc
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit ccf11dbaa07b328fa469415c362d33459c140a37 ]
+
+tmp_tfm is allocated, but not freed on subsequent kmalloc failure, which
+leads to a memory leak. Free tmp_tfm.
+
+Fixes: d46eb3699502b ("evm: crypto hash replaced by shash")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+[zohar@linux.ibm.com: formatted/reworded patch description]
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/evm/evm_crypto.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
+index 168c3b78ac47b..a6dd47eb086da 100644
+--- a/security/integrity/evm/evm_crypto.c
++++ b/security/integrity/evm/evm_crypto.c
+@@ -73,7 +73,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo)
+ {
+ long rc;
+ const char *algo;
+- struct crypto_shash **tfm, *tmp_tfm;
++ struct crypto_shash **tfm, *tmp_tfm = NULL;
+ struct shash_desc *desc;
+
+ if (type == EVM_XATTR_HMAC) {
+@@ -118,13 +118,16 @@ unlock:
+ alloc:
+ desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm),
+ GFP_KERNEL);
+- if (!desc)
++ if (!desc) {
++ crypto_free_shash(tmp_tfm);
+ return ERR_PTR(-ENOMEM);
++ }
+
+ desc->tfm = *tfm;
+
+ rc = crypto_shash_init(desc);
+ if (rc) {
++ crypto_free_shash(tmp_tfm);
+ kfree(desc);
+ return ERR_PTR(rc);
+ }
+--
+2.27.0
+
--- /dev/null
+From 27fd0858ea1616df707453a87da7dd9d2d709e97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 12:02:34 +0100
+Subject: ext: EXT4_KUNIT_TESTS should depend on EXT4_FS instead of selecting
+ it
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 302fdadeafe4be539f247abf25f61822e4a5a577 ]
+
+EXT4_KUNIT_TESTS selects EXT4_FS, thus enabling an optional feature the
+user may not want to enable. Fix this by making the test depend on
+EXT4_FS instead.
+
+Fixes: 1cbeab1b242d16fd ("ext4: add kunit test for decoding extended timestamps")
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/r/20210122110234.2825685-1-geert@linux-m68k.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
+index 619dd35ddd48a..86699c8cab281 100644
+--- a/fs/ext4/Kconfig
++++ b/fs/ext4/Kconfig
+@@ -103,8 +103,7 @@ config EXT4_DEBUG
+
+ config EXT4_KUNIT_TESTS
+ tristate "KUnit tests for ext4" if !KUNIT_ALL_TESTS
+- select EXT4_FS
+- depends on KUNIT
++ depends on EXT4_FS && KUNIT
+ default KUNIT_ALL_TESTS
+ help
+ This builds the ext4 KUnit tests.
+--
+2.27.0
+
--- /dev/null
+From e98e51673ab601f00379e9636645064ab20dffc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 00:05:20 -0500
+Subject: ext4: fix potential htree index checksum corruption
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit b5776e7524afbd4569978ff790864755c438bba7 ]
+
+In the case where we need to do an interior node split, and
+immediately afterwards, we are unable to allocate a new directory leaf
+block due to ENOSPC, the directory index checksum's will not be filled
+in correctly (and indeed, will not be correctly journalled).
+
+This looks like a bug that was introduced when we added largedir
+support. The original code doesn't make any sense (and should have
+been caught in code review), but it was hidden because most of the
+time, the index node checksum will be set by do_split(). But if
+do_split bails out due to ENOSPC, then ext4_handle_dirty_dx_node()
+won't get called, and so the directory index checksum field will not
+get set, leading to:
+
+EXT4-fs error (device sdb): dx_probe:858: inode #6635543: block 4022: comm nfsd: Directory index failed checksum
+
+Google-Bug-Id: 176345532
+Fixes: e08ac99fa2a2 ("ext4: add largedir feature")
+Cc: Artem Blagodarenko <artem.blagodarenko@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/namei.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index cf652ba3e74d2..df0368d578b16 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2401,11 +2401,10 @@ again:
+ (frame - 1)->bh);
+ if (err)
+ goto journal_error;
+- if (restart) {
+- err = ext4_handle_dirty_dx_node(handle, dir,
+- frame->bh);
++ err = ext4_handle_dirty_dx_node(handle, dir,
++ frame->bh);
++ if (err)
+ goto journal_error;
+- }
+ } else {
+ struct dx_root *dxroot;
+ memcpy((char *) entries2, (char *) entries,
+--
+2.27.0
+
--- /dev/null
+From a4c0253c6fd4d0c2e1b0323dd1ec7d3e68ad22a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 17:42:53 +0800
+Subject: f2fs: compress: fix potential deadlock
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit 3afae09ffea5e08f523823be99a784675995d6bb ]
+
+generic/269 reports a hangtask issue, the root cause is ABBA deadlock
+described as below:
+
+Thread A Thread B
+- down_write(&sbi->gc_lock) -- A
+ - f2fs_write_data_pages
+ - lock all pages in cluster -- B
+ - f2fs_write_multi_pages
+ - f2fs_write_raw_pages
+ - f2fs_write_single_data_page
+ - f2fs_balance_fs
+ - down_write(&sbi->gc_lock) -- A
+- f2fs_gc
+ - do_garbage_collect
+ - ra_data_block
+ - pagecache_get_page -- B
+
+To fix this, it needs to avoid calling f2fs_balance_fs() if there is
+still cluster pages been locked in context of cluster writeback, so
+instead, let's call f2fs_balance_fs() in the end of
+f2fs_write_raw_pages() when all cluster pages were unlocked.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 5 ++++-
+ fs/f2fs/data.c | 10 ++++++----
+ fs/f2fs/f2fs.h | 2 +-
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 4bcbacfe33259..7a774c9e4cb89 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1415,7 +1415,7 @@ retry_write:
+
+ ret = f2fs_write_single_data_page(cc->rpages[i], &_submitted,
+ NULL, NULL, wbc, io_type,
+- compr_blocks);
++ compr_blocks, false);
+ if (ret) {
+ if (ret == AOP_WRITEPAGE_ACTIVATE) {
+ unlock_page(cc->rpages[i]);
+@@ -1450,6 +1450,9 @@ retry_write:
+
+ *submitted += _submitted;
+ }
++
++ f2fs_balance_fs(F2FS_M_SB(mapping), true);
++
+ return 0;
+ out_err:
+ for (++i; i < cc->cluster_size; i++) {
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index aa34d620bec98..d72c99d9bd1f4 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2743,7 +2743,8 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ sector_t *last_block,
+ struct writeback_control *wbc,
+ enum iostat_type io_type,
+- int compr_blocks)
++ int compr_blocks,
++ bool allow_balance)
+ {
+ struct inode *inode = page->mapping->host;
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+@@ -2881,7 +2882,7 @@ out:
+ }
+ unlock_page(page);
+ if (!S_ISDIR(inode->i_mode) && !IS_NOQUOTA(inode) &&
+- !F2FS_I(inode)->cp_task)
++ !F2FS_I(inode)->cp_task && allow_balance)
+ f2fs_balance_fs(sbi, need_balance_fs);
+
+ if (unlikely(f2fs_cp_error(sbi))) {
+@@ -2928,7 +2929,7 @@ out:
+ #endif
+
+ return f2fs_write_single_data_page(page, NULL, NULL, NULL,
+- wbc, FS_DATA_IO, 0);
++ wbc, FS_DATA_IO, 0, true);
+ }
+
+ /*
+@@ -3096,7 +3097,8 @@ continue_unlock:
+ }
+ #endif
+ ret = f2fs_write_single_data_page(page, &submitted,
+- &bio, &last_block, wbc, io_type, 0);
++ &bio, &last_block, wbc, io_type,
++ 0, true);
+ if (ret == AOP_WRITEPAGE_ACTIVATE)
+ unlock_page(page);
+ #ifdef CONFIG_F2FS_FS_COMPRESSION
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index bb11759191dcc..1578402c58444 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3469,7 +3469,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ struct bio **bio, sector_t *last_block,
+ struct writeback_control *wbc,
+ enum iostat_type io_type,
+- int compr_blocks);
++ int compr_blocks, bool allow_balance);
+ void f2fs_invalidate_page(struct page *page, unsigned int offset,
+ unsigned int length);
+ int f2fs_release_page(struct page *page, gfp_t wait);
+--
+2.27.0
+
--- /dev/null
+From ad27f17839918b1505c887fa716763f692d35e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:39:22 +0800
+Subject: f2fs: fix a wrong condition in __submit_bio
+
+From: Dehe Gu <gudehe@huawei.com>
+
+[ Upstream commit 39f71b7e40e21805d6b15fc7750bdd9cab6a5010 ]
+
+We should use !F2FS_IO_ALIGNED() to check and submit_io directly.
+
+Fixes: 8223ecc456d0 ("f2fs: fix to add missing F2FS_IO_ALIGNED() condition")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Dehe Gu <gudehe@huawei.com>
+Signed-off-by: Ge Qiu <qiuge@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index d72c99d9bd1f4..4d3ebf094f6d7 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -499,7 +499,7 @@ static inline void __submit_bio(struct f2fs_sb_info *sbi,
+ if (f2fs_lfs_mode(sbi) && current->plug)
+ blk_finish_plug(current->plug);
+
+- if (F2FS_IO_ALIGNED(sbi))
++ if (!F2FS_IO_ALIGNED(sbi))
+ goto submit_io;
+
+ start = bio->bi_iter.bi_size >> F2FS_BLKSIZE_BITS;
+--
+2.27.0
+
--- /dev/null
+From 59ab76ceae12651320f0f4d5c3ebed2e622afec4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 08:49:28 +0900
+Subject: f2fs: fix null page reference in redirty_blocks
+
+From: Daeho Jeong <daehojeong@google.com>
+
+[ Upstream commit df0736d70c4fa6ed711ba103b61880fe72bb4777 ]
+
+By Colin's static analysis, we found out there is a null page reference
+under low memory situation in redirty_blocks. I've made the page finding
+loop stop immediately and return an error not to cause further memory
+pressure when we run into a failure to find a page under low memory
+condition.
+
+Signed-off-by: Daeho Jeong <daehojeong@google.com>
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Fixes: 5fdb322ff2c2 ("f2fs: add F2FS_IOC_DECOMPRESS_FILE and F2FS_IOC_COMPRESS_FILE")
+Reviewed-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index f585545277d77..cd62b0d3369ab 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -4043,8 +4043,10 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len)
+
+ for (i = 0; i < page_len; i++, redirty_idx++) {
+ page = find_lock_page(mapping, redirty_idx);
+- if (!page)
+- ret = -ENOENT;
++ if (!page) {
++ ret = -ENOMEM;
++ break;
++ }
+ set_page_dirty(page);
+ f2fs_put_page(page, 1);
+ f2fs_put_page(page, 0);
+--
+2.27.0
+
--- /dev/null
+From 9c398434b25ddb6edaaaa1f01a9a96a25490719a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 17:02:56 +0800
+Subject: f2fs: fix to avoid inconsistent quota data
+
+From: Yi Chen <chenyi77@huawei.com>
+
+[ Upstream commit 25fb04dbce6a0e165d28fd1fa8a1d7018c637fe8 ]
+
+Occasionally, quota data may be corrupted detected by fsck:
+
+Info: checkpoint state = 45 : crc compacted_summary unmount
+[QUOTA WARNING] Usage inconsistent for ID 0:actual (1543036928, 762) != expected (1543032832, 762)
+[ASSERT] (fsck_chk_quota_files:1986) --> Quota file is missing or invalid quota file content found.
+[QUOTA WARNING] Usage inconsistent for ID 0:actual (1352478720, 344) != expected (1352474624, 344)
+[ASSERT] (fsck_chk_quota_files:1986) --> Quota file is missing or invalid quota file content found.
+
+[FSCK] Unreachable nat entries [Ok..] [0x0]
+[FSCK] SIT valid block bitmap checking [Ok..]
+[FSCK] Hard link checking for regular file [Ok..] [0x0]
+[FSCK] valid_block_count matching with CP [Ok..] [0xdf299]
+[FSCK] valid_node_count matcing with CP (de lookup) [Ok..] [0x2b01]
+[FSCK] valid_node_count matcing with CP (nat lookup) [Ok..] [0x2b01]
+[FSCK] valid_inode_count matched with CP [Ok..] [0x2665]
+[FSCK] free segment_count matched with CP [Ok..] [0xcb04]
+[FSCK] next block offset is free [Ok..]
+[FSCK] fixing SIT types
+[FSCK] other corrupted bugs [Fail]
+
+The root cause is:
+If we open file w/ readonly flag, disk quota info won't be initialized
+for this file, however, following mmap() will force to convert inline
+inode via f2fs_convert_inline_inode(), which may increase block usage
+for this inode w/o updating quota data, it causes inconsistent disk quota
+info.
+
+The issue will happen in following stack:
+open(file, O_RDONLY)
+mmap(file)
+- f2fs_convert_inline_inode
+ - f2fs_convert_inline_page
+ - f2fs_reserve_block
+ - f2fs_reserve_new_block
+ - f2fs_reserve_new_blocks
+ - f2fs_i_blocks_write
+ - dquot_claim_block
+inode->i_blocks increase, but the dqb_curspace keep the size for the dquots
+is NULL.
+
+To fix this issue, let's call dquot_initialize() anyway in both
+f2fs_truncate() and f2fs_convert_inline_inode() functions to avoid potential
+inconsistent quota data issue.
+
+Fixes: 0abd675e97e6 ("f2fs: support plain user/group quota")
+Signed-off-by: Daiyue Zhang <zhangdaiyue1@huawei.com>
+Signed-off-by: Dehe Gu <gudehe@huawei.com>
+Signed-off-by: Junchao Jiang <jiangjunchao1@huawei.com>
+Signed-off-by: Ge Qiu <qiuge@huawei.com>
+Signed-off-by: Yi Chen <chenyi77@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 4 ++++
+ fs/f2fs/inline.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index cd62b0d3369ab..18ea529ef5ea0 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -767,6 +767,10 @@ int f2fs_truncate(struct inode *inode)
+ return -EIO;
+ }
+
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
++
+ /* we should check inline_data size */
+ if (!f2fs_may_inline_data(inode)) {
+ err = f2fs_convert_inline_inode(inode);
+diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
+index 806ebabf58706..993caefcd2bb0 100644
+--- a/fs/f2fs/inline.c
++++ b/fs/f2fs/inline.c
+@@ -192,6 +192,10 @@ int f2fs_convert_inline_inode(struct inode *inode)
+ f2fs_hw_is_readonly(sbi) || f2fs_readonly(sbi->sb))
+ return 0;
+
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
++
+ page = f2fs_grab_cache_page(inode->i_mapping, 0, false);
+ if (!page)
+ return -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 32893d92988f11909758528ad2f6bd587d831463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 19:17:52 -0800
+Subject: fbdev: aty: SPARC64 requires FB_ATY_CT
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c6c90c70db4d9a0989111d6b994d545659410f7a ]
+
+It looks like SPARC64 requires FB_ATY_CT to build without errors,
+so have FB_ATY select FB_ATY_CT if both SPARC64 and PCI are enabled
+instead of using "default y if SPARC64 && PCI", which is not strong
+enough to prevent build errors.
+
+As it currently is, FB_ATY_CT can be disabled, resulting in build
+errors:
+
+ERROR: modpost: "aty_postdividers" [drivers/video/fbdev/aty/atyfb.ko] undefined!
+ERROR: modpost: "aty_ld_pll_ct" [drivers/video/fbdev/aty/atyfb.ko] undefined!
+
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Fixes: f7018c213502 ("video: move fbdev to drivers/video/fbdev")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: sparclinux@vger.kernel.org
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201127031752.10371-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
+index cfb7f5612ef0f..4f02db65dedec 100644
+--- a/drivers/video/fbdev/Kconfig
++++ b/drivers/video/fbdev/Kconfig
+@@ -1269,6 +1269,7 @@ config FB_ATY
+ select FB_CFB_IMAGEBLIT
+ select FB_BACKLIGHT if FB_ATY_BACKLIGHT
+ select FB_MACMODES if PPC
++ select FB_ATY_CT if SPARC64 && PCI
+ help
+ This driver supports graphics boards with the ATI Mach64 chips.
+ Say Y if you have such a graphics board.
+@@ -1279,7 +1280,6 @@ config FB_ATY
+ config FB_ATY_CT
+ bool "Mach64 CT/VT/GT/LT (incl. 3D RAGE) support"
+ depends on PCI && FB_ATY
+- default y if SPARC64 && PCI
+ help
+ Say Y here to support use of ATI's 64-bit Rage boards (or other
+ boards based on the Mach64 CT, VT, GT, and LT chipsets) as a
+--
+2.27.0
+
--- /dev/null
+From db5f9c6be4e6382d6aa3880274013f44868c696e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:45:43 +0000
+Subject: fdt: Properly handle "no-map" field in the memory region
+
+From: KarimAllah Ahmed <karahmed@amazon.de>
+
+[ Upstream commit 86588296acbfb1591e92ba60221e95677ecadb43 ]
+
+Mark the memory region with NOMAP flag instead of completely removing it
+from the memory blocks. That makes the FDT handling consistent with the EFI
+memory map handling.
+
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Frank Rowand <frowand.list@gmail.com>
+Cc: devicetree@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Link: https://lore.kernel.org/r/20210115114544.1830068-2-qperret@google.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index feb0f2d67fc5f..427b534d60d2d 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1147,7 +1147,7 @@ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ phys_addr_t size, bool nomap)
+ {
+ if (nomap)
+- return memblock_remove(base, size);
++ return memblock_mark_nomap(base, size);
+ return memblock_reserve(base, size);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 5dc68d3c24cde4d41e6be2e12cfe43c8029085ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 19:13:26 +0000
+Subject: firmware: arm_scmi: Fix call site of scmi_notification_exit
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit a90b6543bf062d65292b2c76f1630507d1c9d8ec ]
+
+Call scmi_notification_exit() only when SCMI platform driver instance has
+been really successfully removed.
+
+Link: https://lore.kernel.org/r/20210112191326.29091-1-cristian.marussi@arm.com
+Fixes: 6b8a69131dc63 ("firmware: arm_scmi: Enable notification core")
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+[sudeep.holla: Move the call outside the list mutex locking]
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/driver.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c
+index 5392e1fc6b4ef..cacdf1589b101 100644
+--- a/drivers/firmware/arm_scmi/driver.c
++++ b/drivers/firmware/arm_scmi/driver.c
+@@ -848,8 +848,6 @@ static int scmi_remove(struct platform_device *pdev)
+ struct scmi_info *info = platform_get_drvdata(pdev);
+ struct idr *idr = &info->tx_idr;
+
+- scmi_notification_exit(&info->handle);
+-
+ mutex_lock(&scmi_list_mutex);
+ if (info->users)
+ ret = -EBUSY;
+@@ -860,6 +858,8 @@ static int scmi_remove(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ scmi_notification_exit(&info->handle);
++
+ /* Safe to free channels since no more users */
+ ret = idr_for_each(idr, info->desc->ops->chan_free, idr);
+ idr_destroy(&info->tx_idr);
+--
+2.27.0
+
--- /dev/null
+From 4f8672fe0da15d2583f3d14ff010e903f9c59b3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 13:01:08 +0000
+Subject: fs/jfs: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 4208c398aae4c2290864ba15c3dab7111f32bec1 ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit integer. In the case where
+l2nb is 32 or more this can lead to an overflow. Avoid this by shifting
+the value 1LL instead.
+
+Addresses-Coverity: ("Uninitentional integer overflow")
+Fixes: b40c2e665cd5 ("fs/jfs: TRIM support for JFS Filesystem")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_dmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
+index 94b7c1cb5ceb3..7aee156086198 100644
+--- a/fs/jfs/jfs_dmap.c
++++ b/fs/jfs/jfs_dmap.c
+@@ -1656,7 +1656,7 @@ s64 dbDiscardAG(struct inode *ip, int agno, s64 minlen)
+ } else if (rc == -ENOSPC) {
+ /* search for next smaller log2 block */
+ l2nb = BLKSTOL2(nblocks) - 1;
+- nblocks = 1 << l2nb;
++ nblocks = 1LL << l2nb;
+ } else {
+ /* Trim any already allocated blocks */
+ jfs_error(bmp->db_ipbmap->i_sb, "-EIO\n");
+--
+2.27.0
+
--- /dev/null
+From aa6652c1c15a592165946ec0ca2abea358cc56ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 11:40:48 +0300
+Subject: gma500: clean up error handling in init
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 15ccc39b3aab667c6fa131206f01f31bfbccdf6a ]
+
+The main problem with this error handling was that it didn't clean up if
+i2c_add_numbered_adapter() failed. This code is pretty old, and doesn't
+match with today's checkpatch.pl standards so I took the opportunity to
+tidy it up a bit. I changed the NULL comparison, and removed the
+WARNING message if kzalloc() fails and updated the label names.
+
+Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/X8ikkAqZfnDO2lu6@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+index e281070611480..fc9a34ed58bd1 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
++++ b/drivers/gpu/drm/gma500/oaktrail_hdmi_i2c.c
+@@ -279,11 +279,8 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ hdmi_dev = pci_get_drvdata(dev);
+
+ i2c_dev = kzalloc(sizeof(struct hdmi_i2c_dev), GFP_KERNEL);
+- if (i2c_dev == NULL) {
+- DRM_ERROR("Can't allocate interface\n");
+- ret = -ENOMEM;
+- goto exit;
+- }
++ if (!i2c_dev)
++ return -ENOMEM;
+
+ i2c_dev->adap = &oaktrail_hdmi_i2c_adapter;
+ i2c_dev->status = I2C_STAT_INIT;
+@@ -300,16 +297,23 @@ int oaktrail_hdmi_i2c_init(struct pci_dev *dev)
+ oaktrail_hdmi_i2c_adapter.name, hdmi_dev);
+ if (ret) {
+ DRM_ERROR("Failed to request IRQ for I2C controller\n");
+- goto err;
++ goto free_dev;
+ }
+
+ /* Adapter registration */
+ ret = i2c_add_numbered_adapter(&oaktrail_hdmi_i2c_adapter);
+- return ret;
++ if (ret) {
++ DRM_ERROR("Failed to add I2C adapter\n");
++ goto free_irq;
++ }
+
+-err:
++ return 0;
++
++free_irq:
++ free_irq(dev->irq, hdmi_dev);
++free_dev:
+ kfree(i2c_dev);
+-exit:
++
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 41b57b2c88f9b5a2c044b6aab2f9950250324db3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 17:12:21 -0800
+Subject: HID: core: detect and skip invalid inputs to snto32()
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a0312af1f94d13800e63a7d0a66e563582e39aec ]
+
+Prevent invalid (0, 0) inputs to hid-core's snto32() function.
+
+Maybe it is just the dummy device here that is causing this, but
+there are hundreds of calls to snto32(0, 0). Having n (bits count)
+of 0 is causing the current UBSAN trap with a shift value of
+0xffffffff (-1, or n - 1 in this function).
+
+Either of the value to shift being 0 or the bits count being 0 can be
+handled by just returning 0 to the caller, avoiding the following
+complex shift + OR operations:
+
+ return value & (1 << (n - 1)) ? value | (~0U << n) : value;
+
+Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: syzbot+1e911ad71dd4ea72e04a@syzkaller.appspotmail.com
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: linux-input@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 8a8b2b982f83c..097cb1ee31268 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1307,6 +1307,9 @@ EXPORT_SYMBOL_GPL(hid_open_report);
+
+ static s32 snto32(__u32 value, unsigned n)
+ {
++ if (!value || !n)
++ return 0;
++
+ switch (n) {
+ case 8: return ((__s8)value);
+ case 16: return ((__s16)value);
+--
+2.27.0
+
--- /dev/null
+From fa68dc0492fa600f6a68ba9b4043a8c1904a7ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:18:27 +0800
+Subject: HSI: Fix PM usage counter unbalance in ssi_hw_init
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit aa57e77b3d28f0df07149d88c47bc0f3aa77330b ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: b209e047bc743 ("HSI: Introduce OMAP SSI driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/controllers/omap_ssi_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 7596dc1646484..44a3f5660c109 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -424,7 +424,7 @@ static int ssi_hw_init(struct hsi_controller *ssi)
+ struct omap_ssi_controller *omap_ssi = hsi_controller_drvdata(ssi);
+ int err;
+
+- err = pm_runtime_get_sync(ssi->device.parent);
++ err = pm_runtime_resume_and_get(ssi->device.parent);
+ if (err < 0) {
+ dev_err(&ssi->device, "runtime PM failed %d\n", err);
+ return err;
+--
+2.27.0
+
--- /dev/null
+From f02f42aecfc392716920f6573b2f3d701eb3d9e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Dec 2020 08:52:07 +0100
+Subject: hwrng: ingenic - Fix a resource leak in an error handling path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit c4ff41b93d1f10d1b8be258c31a0436c5769fc00 ]
+
+In case of error, we should call 'clk_disable_unprepare()' to undo a
+previous 'clk_prepare_enable()' call, as already done in the remove
+function.
+
+Fixes: 406346d22278 ("hwrng: ingenic - Add hardware TRNG for Ingenic X1830")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/ingenic-trng.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/ingenic-trng.c b/drivers/char/hw_random/ingenic-trng.c
+index 954a8411d67d2..0eb80f786f4dd 100644
+--- a/drivers/char/hw_random/ingenic-trng.c
++++ b/drivers/char/hw_random/ingenic-trng.c
+@@ -113,13 +113,17 @@ static int ingenic_trng_probe(struct platform_device *pdev)
+ ret = hwrng_register(&trng->rng);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to register hwrng\n");
+- return ret;
++ goto err_unprepare_clk;
+ }
+
+ platform_set_drvdata(pdev, trng);
+
+ dev_info(&pdev->dev, "Ingenic DTRNG driver registered\n");
+ return 0;
++
++err_unprepare_clk:
++ clk_disable_unprepare(trng->clk);
++ return ret;
+ }
+
+ static int ingenic_trng_remove(struct platform_device *pdev)
+--
+2.27.0
+
--- /dev/null
+From 441b84dbdc6d990fb4d027321858fb7da61cfc95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 16:14:59 +0100
+Subject: hwrng: timeriomem - Fix cooldown period calculation
+
+From: Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
+
+[ Upstream commit e145f5565dc48ccaf4cb50b7cfc48777bed8c100 ]
+
+Ensure cooldown period tolerance of 1% is actually accounted for.
+
+Fixes: ca3bff70ab32 ("hwrng: timeriomem - Improve performance...")
+Signed-off-by: Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/timeriomem-rng.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c
+index e262445fed5f5..f35f0f31f52ad 100644
+--- a/drivers/char/hw_random/timeriomem-rng.c
++++ b/drivers/char/hw_random/timeriomem-rng.c
+@@ -69,7 +69,7 @@ static int timeriomem_rng_read(struct hwrng *hwrng, void *data,
+ */
+ if (retval > 0)
+ usleep_range(period_us,
+- period_us + min(1, period_us / 100));
++ period_us + max(1, period_us / 100));
+
+ *(u32 *)data = readl(priv->io_base);
+ retval += sizeof(u32);
+--
+2.27.0
+
--- /dev/null
+From 733e70f69cfb788233ce98674ac7a4440de7ba6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:11:01 +0100
+Subject: i2c: brcmstb: Fix brcmstd_send_i2c_cmd condition
+
+From: Maxime Ripard <maxime@cerno.tech>
+
+[ Upstream commit a1858ce0cfe31368b23ba55794e409fb57ced4a4 ]
+
+The brcmstb_send_i2c_cmd currently has a condition that is (CMD_RD ||
+CMD_WR) which always evaluates to true, while the obvious fix is to test
+whether the cmd variable passed as parameter holds one of these two
+values.
+
+Fixes: dd1aa2524bc5 ("i2c: brcmstb: Add Broadcom settop SoC i2c controller driver")
+Reported-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-brcmstb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
+index d4e0a0f6732ae..ba766d24219ef 100644
+--- a/drivers/i2c/busses/i2c-brcmstb.c
++++ b/drivers/i2c/busses/i2c-brcmstb.c
+@@ -316,7 +316,7 @@ static int brcmstb_send_i2c_cmd(struct brcmstb_i2c_dev *dev,
+ goto cmd_out;
+ }
+
+- if ((CMD_RD || CMD_WR) &&
++ if ((cmd == CMD_RD || cmd == CMD_WR) &&
+ bsc_readl(dev, iic_enable) & BSC_IIC_EN_NOACK_MASK) {
+ rc = -EREMOTEIO;
+ dev_dbg(dev->device, "controller received NOACK intr for %s\n",
+--
+2.27.0
+
--- /dev/null
+From c42477a541da3182379f979aa40e5616199c069d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 23:25:38 +0100
+Subject: i2c: exynos5: Preserve high speed master code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mårten Lindahl <martenli@axis.com>
+
+[ Upstream commit f4ff0104d4c807a7f96aa3358c03d694895ee8ea ]
+
+When the driver starts to send a message with the MASTER_ID field
+set (high speed), the whole I2C_ADDR register is overwritten including
+MASTER_ID as the SLV_ADDR_MAS field is set.
+
+This patch preserves already written fields in I2C_ADDR when writing
+SLV_ADDR_MAS.
+
+Fixes: 8a73cd4cfa15 ("i2c: exynos5: add High Speed I2C controller driver")
+Signed-off-by: Mårten Lindahl <martenli@axis.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-exynos5.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-exynos5.c b/drivers/i2c/busses/i2c-exynos5.c
+index 20a9881a0d6cd..5ac30d95650cc 100644
+--- a/drivers/i2c/busses/i2c-exynos5.c
++++ b/drivers/i2c/busses/i2c-exynos5.c
+@@ -606,6 +606,7 @@ static void exynos5_i2c_message_start(struct exynos5_i2c *i2c, int stop)
+ u32 i2c_ctl;
+ u32 int_en = 0;
+ u32 i2c_auto_conf = 0;
++ u32 i2c_addr = 0;
+ u32 fifo_ctl;
+ unsigned long flags;
+ unsigned short trig_lvl;
+@@ -640,7 +641,12 @@ static void exynos5_i2c_message_start(struct exynos5_i2c *i2c, int stop)
+ int_en |= HSI2C_INT_TX_ALMOSTEMPTY_EN;
+ }
+
+- writel(HSI2C_SLV_ADDR_MAS(i2c->msg->addr), i2c->regs + HSI2C_ADDR);
++ i2c_addr = HSI2C_SLV_ADDR_MAS(i2c->msg->addr);
++
++ if (i2c->op_clock >= I2C_MAX_FAST_MODE_PLUS_FREQ)
++ i2c_addr |= HSI2C_MASTER_ID(MASTER_ID(i2c->adap.nr));
++
++ writel(i2c_addr, i2c->regs + HSI2C_ADDR);
+
+ writel(fifo_ctl, i2c->regs + HSI2C_FIFO_CTL);
+ writel(i2c_ctl, i2c->regs + HSI2C_CTL);
+--
+2.27.0
+
--- /dev/null
+From 0bf33f7664dba5df567a84e883e58f9f024d102e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 20:35:45 +0530
+Subject: i2c: i2c-qcom-geni: Add shutdown callback for i2c
+
+From: Roja Rani Yarubandi <rojay@codeaurora.org>
+
+[ Upstream commit e0371298ddc51761be257698554ea507ac8bf831 ]
+
+If the hardware is still accessing memory after SMMU translation
+is disabled (as part of smmu shutdown callback), then the
+IOVAs (I/O virtual address) which it was using will go on the bus
+as the physical addresses which will result in unknown crashes
+like NoC/interconnect errors.
+
+So, implement shutdown callback to i2c driver to stop on-going transfer
+and unmap DMA mappings during system "reboot" or "shutdown".
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 34 ++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 214b4c913a139..c3f5847959116 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -375,6 +375,32 @@ static void geni_i2c_tx_msg_cleanup(struct geni_i2c_dev *gi2c,
+ }
+ }
+
++static void geni_i2c_stop_xfer(struct geni_i2c_dev *gi2c)
++{
++ int ret;
++ u32 geni_status;
++ struct i2c_msg *cur;
++
++ /* Resume device, as runtime suspend can happen anytime during transfer */
++ ret = pm_runtime_get_sync(gi2c->se.dev);
++ if (ret < 0) {
++ dev_err(gi2c->se.dev, "Failed to resume device: %d\n", ret);
++ return;
++ }
++
++ geni_status = readl_relaxed(gi2c->se.base + SE_GENI_STATUS);
++ if (geni_status & M_GENI_CMD_ACTIVE) {
++ cur = gi2c->cur;
++ geni_i2c_abort_xfer(gi2c);
++ if (cur->flags & I2C_M_RD)
++ geni_i2c_rx_msg_cleanup(gi2c, cur);
++ else
++ geni_i2c_tx_msg_cleanup(gi2c, cur);
++ }
++
++ pm_runtime_put_sync_suspend(gi2c->se.dev);
++}
++
+ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ u32 m_param)
+ {
+@@ -650,6 +676,13 @@ static int geni_i2c_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void geni_i2c_shutdown(struct platform_device *pdev)
++{
++ struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev);
++
++ geni_i2c_stop_xfer(gi2c);
++}
++
+ static int __maybe_unused geni_i2c_runtime_suspend(struct device *dev)
+ {
+ int ret;
+@@ -714,6 +747,7 @@ MODULE_DEVICE_TABLE(of, geni_i2c_dt_match);
+ static struct platform_driver geni_i2c_driver = {
+ .probe = geni_i2c_probe,
+ .remove = geni_i2c_remove,
++ .shutdown = geni_i2c_shutdown,
+ .driver = {
+ .name = "geni_i2c",
+ .pm = &geni_i2c_pm_ops,
+--
+2.27.0
+
--- /dev/null
+From 23d1a13a33219b77daf954e10d14b62f1bbb53a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:32 +0530
+Subject: i2c: iproc: handle master read request
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit e21d79778768e4e187b2892d662c6aaa01e1d399 ]
+
+Handle single or multi byte master read request with or without
+repeated start.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 215 +++++++++++++++++++++++------
+ 1 file changed, 170 insertions(+), 45 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index 68db2068f38b0..35baca2f62c4e 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -159,6 +159,11 @@
+
+ #define IE_S_ALL_INTERRUPT_SHIFT 21
+ #define IE_S_ALL_INTERRUPT_MASK 0x3f
++/*
++ * It takes ~18us to reading 10bytes of data, hence to keep tasklet
++ * running for less time, max slave read per tasklet is set to 10 bytes.
++ */
++#define MAX_SLAVE_RX_PER_INT 10
+
+ enum i2c_slave_read_status {
+ I2C_SLAVE_RX_FIFO_EMPTY = 0,
+@@ -205,8 +210,18 @@ struct bcm_iproc_i2c_dev {
+ /* bytes that have been read */
+ unsigned int rx_bytes;
+ unsigned int thld_bytes;
++
++ bool slave_rx_only;
++ bool rx_start_rcvd;
++ bool slave_read_complete;
++ u32 tx_underrun;
++ u32 slave_int_mask;
++ struct tasklet_struct slave_rx_tasklet;
+ };
+
++/* tasklet to process slave rx data */
++static void slave_rx_tasklet_fn(unsigned long);
++
+ /*
+ * Can be expanded in the future if more interrupt status bits are utilized
+ */
+@@ -260,6 +275,7 @@ static void bcm_iproc_i2c_slave_init(
+ {
+ u32 val;
+
++ iproc_i2c->tx_underrun = 0;
+ if (need_reset) {
+ /* put controller in reset */
+ val = iproc_i2c_rd_reg(iproc_i2c, CFG_OFFSET);
+@@ -296,8 +312,11 @@ static void bcm_iproc_i2c_slave_init(
+
+ /* Enable interrupt register to indicate a valid byte in receive fifo */
+ val = BIT(IE_S_RX_EVENT_SHIFT);
++ /* Enable interrupt register to indicate a Master read transaction */
++ val |= BIT(IE_S_RD_EVENT_SHIFT);
+ /* Enable interrupt register for the Slave BUSY command */
+ val |= BIT(IE_S_START_BUSY_SHIFT);
++ iproc_i2c->slave_int_mask = val;
+ iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
+ }
+
+@@ -322,76 +341,176 @@ static void bcm_iproc_i2c_check_slave_status(
+ }
+ }
+
+-static bool bcm_iproc_i2c_slave_isr(struct bcm_iproc_i2c_dev *iproc_i2c,
+- u32 status)
++static void bcm_iproc_i2c_slave_read(struct bcm_iproc_i2c_dev *iproc_i2c)
+ {
++ u8 rx_data, rx_status;
++ u32 rx_bytes = 0;
+ u32 val;
+- u8 value, rx_status;
+
+- /* Slave RX byte receive */
+- if (status & BIT(IS_S_RX_EVENT_SHIFT)) {
++ while (rx_bytes < MAX_SLAVE_RX_PER_INT) {
+ val = iproc_i2c_rd_reg(iproc_i2c, S_RX_OFFSET);
+ rx_status = (val >> S_RX_STATUS_SHIFT) & S_RX_STATUS_MASK;
+- if (rx_status == I2C_SLAVE_RX_START) {
+- /* Start of SMBUS for Master write */
+- i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_WRITE_REQUESTED, &value);
++ rx_data = ((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
+
+- val = iproc_i2c_rd_reg(iproc_i2c, S_RX_OFFSET);
+- value = (u8)((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
++ if (rx_status == I2C_SLAVE_RX_START) {
++ /* Start of SMBUS Master write */
+ i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_WRITE_RECEIVED, &value);
+- } else if (status & BIT(IS_S_RD_EVENT_SHIFT)) {
+- /* Start of SMBUS for Master Read */
++ I2C_SLAVE_WRITE_REQUESTED, &rx_data);
++ iproc_i2c->rx_start_rcvd = true;
++ iproc_i2c->slave_read_complete = false;
++ } else if (rx_status == I2C_SLAVE_RX_DATA &&
++ iproc_i2c->rx_start_rcvd) {
++ /* Middle of SMBUS Master write */
+ i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_READ_REQUESTED, &value);
+- iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, value);
++ I2C_SLAVE_WRITE_RECEIVED, &rx_data);
++ } else if (rx_status == I2C_SLAVE_RX_END &&
++ iproc_i2c->rx_start_rcvd) {
++ /* End of SMBUS Master write */
++ if (iproc_i2c->slave_rx_only)
++ i2c_slave_event(iproc_i2c->slave,
++ I2C_SLAVE_WRITE_RECEIVED,
++ &rx_data);
++
++ i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP,
++ &rx_data);
++ } else if (rx_status == I2C_SLAVE_RX_FIFO_EMPTY) {
++ iproc_i2c->rx_start_rcvd = false;
++ iproc_i2c->slave_read_complete = true;
++ break;
++ }
+
+- val = BIT(S_CMD_START_BUSY_SHIFT);
+- iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++ rx_bytes++;
++ }
++}
+
+- /*
+- * Enable interrupt for TX FIFO becomes empty and
+- * less than PKT_LENGTH bytes were output on the SMBUS
+- */
+- val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+- val |= BIT(IE_S_TX_UNDERRUN_SHIFT);
+- iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
+- } else {
+- /* Master write other than start */
+- value = (u8)((val >> S_RX_DATA_SHIFT) & S_RX_DATA_MASK);
++static void slave_rx_tasklet_fn(unsigned long data)
++{
++ struct bcm_iproc_i2c_dev *iproc_i2c = (struct bcm_iproc_i2c_dev *)data;
++ u32 int_clr;
++
++ bcm_iproc_i2c_slave_read(iproc_i2c);
++
++ /* clear pending IS_S_RX_EVENT_SHIFT interrupt */
++ int_clr = BIT(IS_S_RX_EVENT_SHIFT);
++
++ if (!iproc_i2c->slave_rx_only && iproc_i2c->slave_read_complete) {
++ /*
++ * In case of single byte master-read request,
++ * IS_S_TX_UNDERRUN_SHIFT event is generated before
++ * IS_S_START_BUSY_SHIFT event. Hence start slave data send
++ * from first IS_S_TX_UNDERRUN_SHIFT event.
++ *
++ * This means don't send any data from slave when
++ * IS_S_RD_EVENT_SHIFT event is generated else it will increment
++ * eeprom or other backend slave driver read pointer twice.
++ */
++ iproc_i2c->tx_underrun = 0;
++ iproc_i2c->slave_int_mask |= BIT(IE_S_TX_UNDERRUN_SHIFT);
++
++ /* clear IS_S_RD_EVENT_SHIFT interrupt */
++ int_clr |= BIT(IS_S_RD_EVENT_SHIFT);
++ }
++
++ /* clear slave interrupt */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, int_clr);
++ /* enable slave interrupts */
++ iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, iproc_i2c->slave_int_mask);
++}
++
++static bool bcm_iproc_i2c_slave_isr(struct bcm_iproc_i2c_dev *iproc_i2c,
++ u32 status)
++{
++ u32 val;
++ u8 value;
++
++ /*
++ * Slave events in case of master-write, master-write-read and,
++ * master-read
++ *
++ * Master-write : only IS_S_RX_EVENT_SHIFT event
++ * Master-write-read: both IS_S_RX_EVENT_SHIFT and IS_S_RD_EVENT_SHIFT
++ * events
++ * Master-read : both IS_S_RX_EVENT_SHIFT and IS_S_RD_EVENT_SHIFT
++ * events or only IS_S_RD_EVENT_SHIFT
++ */
++ if (status & BIT(IS_S_RX_EVENT_SHIFT) ||
++ status & BIT(IS_S_RD_EVENT_SHIFT)) {
++ /* disable slave interrupts */
++ val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
++ val &= ~iproc_i2c->slave_int_mask;
++ iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
++
++ if (status & BIT(IS_S_RD_EVENT_SHIFT))
++ /* Master-write-read request */
++ iproc_i2c->slave_rx_only = false;
++ else
++ /* Master-write request only */
++ iproc_i2c->slave_rx_only = true;
++
++ /* schedule tasklet to read data later */
++ tasklet_schedule(&iproc_i2c->slave_rx_tasklet);
++
++ /* clear only IS_S_RX_EVENT_SHIFT interrupt */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++ BIT(IS_S_RX_EVENT_SHIFT));
++ }
++
++ if (status & BIT(IS_S_TX_UNDERRUN_SHIFT)) {
++ iproc_i2c->tx_underrun++;
++ if (iproc_i2c->tx_underrun == 1)
++ /* Start of SMBUS for Master Read */
+ i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_WRITE_RECEIVED, &value);
+- if (rx_status == I2C_SLAVE_RX_END)
+- i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_STOP, &value);
+- }
+- } else if (status & BIT(IS_S_TX_UNDERRUN_SHIFT)) {
+- /* Master read other than start */
+- i2c_slave_event(iproc_i2c->slave,
+- I2C_SLAVE_READ_PROCESSED, &value);
++ I2C_SLAVE_READ_REQUESTED,
++ &value);
++ else
++ /* Master read other than start */
++ i2c_slave_event(iproc_i2c->slave,
++ I2C_SLAVE_READ_PROCESSED,
++ &value);
+
+ iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, value);
++ /* start transfer */
+ val = BIT(S_CMD_START_BUSY_SHIFT);
+ iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++
++ /* clear interrupt */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++ BIT(IS_S_TX_UNDERRUN_SHIFT));
+ }
+
+- /* Stop */
++ /* Stop received from master in case of master read transaction */
+ if (status & BIT(IS_S_START_BUSY_SHIFT)) {
+- i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP, &value);
+ /*
+ * Enable interrupt for TX FIFO becomes empty and
+ * less than PKT_LENGTH bytes were output on the SMBUS
+ */
+- val = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET);
+- val &= ~BIT(IE_S_TX_UNDERRUN_SHIFT);
+- iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, val);
++ iproc_i2c->slave_int_mask &= ~BIT(IE_S_TX_UNDERRUN_SHIFT);
++ iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET,
++ iproc_i2c->slave_int_mask);
++
++ /* End of SMBUS for Master Read */
++ val = BIT(S_TX_WR_STATUS_SHIFT);
++ iproc_i2c_wr_reg(iproc_i2c, S_TX_OFFSET, val);
++
++ val = BIT(S_CMD_START_BUSY_SHIFT);
++ iproc_i2c_wr_reg(iproc_i2c, S_CMD_OFFSET, val);
++
++ /* flush TX FIFOs */
++ val = iproc_i2c_rd_reg(iproc_i2c, S_FIFO_CTRL_OFFSET);
++ val |= (BIT(S_FIFO_TX_FLUSH_SHIFT));
++ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, val);
++
++ i2c_slave_event(iproc_i2c->slave, I2C_SLAVE_STOP, &value);
++
++ /* clear interrupt */
++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET,
++ BIT(IS_S_START_BUSY_SHIFT));
+ }
+
+- /* clear interrupt status */
+- iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, status);
++ /* check slave transmit status only if slave is transmitting */
++ if (!iproc_i2c->slave_rx_only)
++ bcm_iproc_i2c_check_slave_status(iproc_i2c);
+
+- bcm_iproc_i2c_check_slave_status(iproc_i2c);
+ return true;
+ }
+
+@@ -1072,6 +1191,10 @@ static int bcm_iproc_i2c_reg_slave(struct i2c_client *slave)
+ return -EAFNOSUPPORT;
+
+ iproc_i2c->slave = slave;
++
++ tasklet_init(&iproc_i2c->slave_rx_tasklet, slave_rx_tasklet_fn,
++ (unsigned long)iproc_i2c);
++
+ bcm_iproc_i2c_slave_init(iproc_i2c, false);
+ return 0;
+ }
+@@ -1092,6 +1215,8 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave)
+ IE_S_ALL_INTERRUPT_SHIFT);
+ iproc_i2c_wr_reg(iproc_i2c, IE_OFFSET, tmp);
+
++ tasklet_kill(&iproc_i2c->slave_rx_tasklet);
++
+ /* Erase the slave address programmed */
+ tmp = iproc_i2c_rd_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET);
+ tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT);
+--
+2.27.0
+
--- /dev/null
+From 67cee37a8e66a3a2bafa2cad27839ed09cb4961b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:29 +0530
+Subject: i2c: iproc: handle only slave interrupts which are enabled
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 545f4011e156554d704d6278245d54543f6680d1 ]
+
+Handle only slave interrupts which are enabled.
+
+The IS_OFFSET register contains the interrupt status bits which will be
+set regardless of the enabling of the corresponding interrupt condition.
+One must therefore look at both IS_OFFSET and IE_OFFSET to determine
+whether an interrupt condition is set and enabled.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index d8295b1c379d1..b98433c04d184 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -505,12 +505,17 @@ static void bcm_iproc_i2c_process_m_event(struct bcm_iproc_i2c_dev *iproc_i2c,
+ static irqreturn_t bcm_iproc_i2c_isr(int irq, void *data)
+ {
+ struct bcm_iproc_i2c_dev *iproc_i2c = data;
+- u32 status = iproc_i2c_rd_reg(iproc_i2c, IS_OFFSET);
++ u32 slave_status;
++ u32 status;
+ bool ret;
+- u32 sl_status = status & ISR_MASK_SLAVE;
+
+- if (sl_status) {
+- ret = bcm_iproc_i2c_slave_isr(iproc_i2c, sl_status);
++ status = iproc_i2c_rd_reg(iproc_i2c, IS_OFFSET);
++ /* process only slave interrupt which are enabled */
++ slave_status = status & iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET) &
++ ISR_MASK_SLAVE;
++
++ if (slave_status) {
++ ret = bcm_iproc_i2c_slave_isr(iproc_i2c, slave_status);
+ if (ret)
+ return IRQ_HANDLED;
+ else
+--
+2.27.0
+
--- /dev/null
+From b31879c66431e70e7d53066bdb95fe0710a05fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 09:24:30 +0530
+Subject: i2c: iproc: update slave isr mask (ISR_MASK_SLAVE)
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 603e77af7b0704bdb057de0368f1f2b04fc9552c ]
+
+Update slave isr mask (ISR_MASK_SLAVE) to include remaining
+two slave interrupts.
+
+Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Acked-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-bcm-iproc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
+index b98433c04d184..68db2068f38b0 100644
+--- a/drivers/i2c/busses/i2c-bcm-iproc.c
++++ b/drivers/i2c/busses/i2c-bcm-iproc.c
+@@ -215,7 +215,8 @@ struct bcm_iproc_i2c_dev {
+
+ #define ISR_MASK_SLAVE (BIT(IS_S_START_BUSY_SHIFT)\
+ | BIT(IS_S_RX_EVENT_SHIFT) | BIT(IS_S_RD_EVENT_SHIFT)\
+- | BIT(IS_S_TX_UNDERRUN_SHIFT))
++ | BIT(IS_S_TX_UNDERRUN_SHIFT) | BIT(IS_S_RX_FIFO_FULL_SHIFT)\
++ | BIT(IS_S_RX_THLD_SHIFT))
+
+ static int bcm_iproc_i2c_reg_slave(struct i2c_client *slave);
+ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave);
+--
+2.27.0
+
--- /dev/null
+From eed0ca55470b79dcff4171e8ea2caee3e9d619f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 18:08:00 +0530
+Subject: i2c: qcom-geni: Store DMA mapping data in geni_i2c_dev struct
+
+From: Roja Rani Yarubandi <rojay@codeaurora.org>
+
+[ Upstream commit 357ee8841d0b7bd822f25fc768afbc0c2ab7e47b ]
+
+Store DMA mapping data in geni_i2c_dev struct to enhance DMA mapping
+data scope. For example during shutdown callback to unmap DMA mapping,
+this stored DMA mapping data can be used to call geni_se_tx_dma_unprep
+and geni_se_rx_dma_unprep functions.
+
+Add two helper functions geni_i2c_rx_msg_cleanup and
+geni_i2c_tx_msg_cleanup to unwrap the things after rx/tx FIFO/DMA
+transfers, so that the same can be used in geni_i2c_stop_xfer()
+function during shutdown callback.
+
+Signed-off-by: Roja Rani Yarubandi <rojay@codeaurora.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 59 ++++++++++++++++++++++--------
+ 1 file changed, 43 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 046d241183c58..214b4c913a139 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -86,6 +86,9 @@ struct geni_i2c_dev {
+ u32 clk_freq_out;
+ const struct geni_i2c_clk_fld *clk_fld;
+ int suspended;
++ void *dma_buf;
++ size_t xfer_len;
++ dma_addr_t dma_addr;
+ };
+
+ struct geni_i2c_err_log {
+@@ -348,14 +351,39 @@ static void geni_i2c_tx_fsm_rst(struct geni_i2c_dev *gi2c)
+ dev_err(gi2c->se.dev, "Timeout resetting TX_FSM\n");
+ }
+
++static void geni_i2c_rx_msg_cleanup(struct geni_i2c_dev *gi2c,
++ struct i2c_msg *cur)
++{
++ gi2c->cur_rd = 0;
++ if (gi2c->dma_buf) {
++ if (gi2c->err)
++ geni_i2c_rx_fsm_rst(gi2c);
++ geni_se_rx_dma_unprep(&gi2c->se, gi2c->dma_addr, gi2c->xfer_len);
++ i2c_put_dma_safe_msg_buf(gi2c->dma_buf, cur, !gi2c->err);
++ }
++}
++
++static void geni_i2c_tx_msg_cleanup(struct geni_i2c_dev *gi2c,
++ struct i2c_msg *cur)
++{
++ gi2c->cur_wr = 0;
++ if (gi2c->dma_buf) {
++ if (gi2c->err)
++ geni_i2c_tx_fsm_rst(gi2c);
++ geni_se_tx_dma_unprep(&gi2c->se, gi2c->dma_addr, gi2c->xfer_len);
++ i2c_put_dma_safe_msg_buf(gi2c->dma_buf, cur, !gi2c->err);
++ }
++}
++
+ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ u32 m_param)
+ {
+- dma_addr_t rx_dma;
++ dma_addr_t rx_dma = 0;
+ unsigned long time_left;
+ void *dma_buf;
+ struct geni_se *se = &gi2c->se;
+ size_t len = msg->len;
++ struct i2c_msg *cur;
+
+ dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+ if (dma_buf)
+@@ -370,19 +398,18 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ geni_se_select_mode(se, GENI_SE_FIFO);
+ i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
+ dma_buf = NULL;
++ } else {
++ gi2c->xfer_len = len;
++ gi2c->dma_addr = rx_dma;
++ gi2c->dma_buf = dma_buf;
+ }
+
++ cur = gi2c->cur;
+ time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ if (!time_left)
+ geni_i2c_abort_xfer(gi2c);
+
+- gi2c->cur_rd = 0;
+- if (dma_buf) {
+- if (gi2c->err)
+- geni_i2c_rx_fsm_rst(gi2c);
+- geni_se_rx_dma_unprep(se, rx_dma, len);
+- i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
+- }
++ geni_i2c_rx_msg_cleanup(gi2c, cur);
+
+ return gi2c->err;
+ }
+@@ -390,11 +417,12 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ u32 m_param)
+ {
+- dma_addr_t tx_dma;
++ dma_addr_t tx_dma = 0;
+ unsigned long time_left;
+ void *dma_buf;
+ struct geni_se *se = &gi2c->se;
+ size_t len = msg->len;
++ struct i2c_msg *cur;
+
+ dma_buf = i2c_get_dma_safe_msg_buf(msg, 32);
+ if (dma_buf)
+@@ -409,22 +437,21 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ geni_se_select_mode(se, GENI_SE_FIFO);
+ i2c_put_dma_safe_msg_buf(dma_buf, msg, false);
+ dma_buf = NULL;
++ } else {
++ gi2c->xfer_len = len;
++ gi2c->dma_addr = tx_dma;
++ gi2c->dma_buf = dma_buf;
+ }
+
+ if (!dma_buf) /* Get FIFO IRQ */
+ writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
+
++ cur = gi2c->cur;
+ time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ if (!time_left)
+ geni_i2c_abort_xfer(gi2c);
+
+- gi2c->cur_wr = 0;
+- if (dma_buf) {
+- if (gi2c->err)
+- geni_i2c_tx_fsm_rst(gi2c);
+- geni_se_tx_dma_unprep(se, tx_dma, len);
+- i2c_put_dma_safe_msg_buf(dma_buf, msg, !gi2c->err);
+- }
++ geni_i2c_tx_msg_cleanup(gi2c, cur);
+
+ return gi2c->err;
+ }
+--
+2.27.0
+
--- /dev/null
+From 92b601df8bb4c9f00707d64c4264446bcbcfece9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 20:06:37 -0800
+Subject: i3c/master/mipi-i3c-hci: Specify HAS_IOMEM dependency
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 9d909f1b1e91b4aa7d016ed14b7b76dbf2675414 ]
+
+The MIPI i3c HCI driver makes use of IOMEM functions like
+devm_platform_ioremap_resource(), which are only available if
+CONFIG_HAS_IOMEM is defined.
+
+This causes the driver to be enabled under make ARCH=um allyesconfig,
+even though it won't build.
+
+By adding a dependency on HAS_IOMEM, the driver will not be enabled on
+architectures which don't support it.
+
+Fixes: 9ad9a52cce28 ("i3c/master: introduce the mipi-i3c-hci driver")
+Signed-off-by: David Gow <davidgow@google.com>
+Acked-by: Nicolas Pitre <npitre@baylibre.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210127040636.1535722-1-davidgow@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/i3c/master/Kconfig b/drivers/i3c/master/Kconfig
+index e68f15f4b4d0c..afff0e2320f74 100644
+--- a/drivers/i3c/master/Kconfig
++++ b/drivers/i3c/master/Kconfig
+@@ -25,6 +25,7 @@ config DW_I3C_MASTER
+ config MIPI_I3C_HCI
+ tristate "MIPI I3C Host Controller Interface driver (EXPERIMENTAL)"
+ depends on I3C
++ depends on HAS_IOMEM
+ help
+ Support for hardware following the MIPI Aliance's I3C Host Controller
+ Interface specification.
+--
+2.27.0
+
--- /dev/null
+From 8c4309f1b44aa7a295538af6c4e4e29b16793b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 10:35:37 +0000
+Subject: i40e: Add zero-initialization of AQ command structures
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit d2c788f739b6f68090e968a2ee31b543701e795f ]
+
+Zero-initialize AQ command data structures to comply with
+API specifications.
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Fixes: f4492db16df8 ("i40e: Add NPAR BW get and set functions")
+Signed-off-by: Andrzej Sawuła <andrzej.sawula@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 1db482d310c2d..9b1251a710c09 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7667,6 +7667,8 @@ int i40e_add_del_cloud_filter(struct i40e_vsi *vsi,
+ if (filter->flags >= ARRAY_SIZE(flag_table))
+ return I40E_ERR_CONFIG;
+
++ memset(&cld_filter, 0, sizeof(cld_filter));
++
+ /* copy element needed to add cloud filter from filter */
+ i40e_set_cld_element(filter, &cld_filter);
+
+@@ -7734,6 +7736,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ !ipv6_addr_any(&filter->ip.v6.src_ip6))
+ return -EOPNOTSUPP;
+
++ memset(&cld_filter, 0, sizeof(cld_filter));
++
+ /* copy element needed to add cloud filter from filter */
+ i40e_set_cld_element(filter, &cld_filter.element);
+
+@@ -11709,6 +11713,8 @@ i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf)
+ struct i40e_aqc_configure_partition_bw_data bw_data;
+ i40e_status status;
+
++ memset(&bw_data, 0, sizeof(bw_data));
++
+ /* Set the valid bit for this PF */
+ bw_data.pf_valid_bits = cpu_to_le16(BIT(pf->hw.pf_id));
+ bw_data.max_bw[pf->hw.pf_id] = pf->max_bw & I40E_ALT_BW_VALUE_MASK;
+--
+2.27.0
+
--- /dev/null
+From 6a846f20b853a382540441a6a26cb2eb1ab0097e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 11:38:00 +0100
+Subject: i40e: Fix add TC filter for IPv6
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 61c1e0eb8375def7c891bfe857bb795a57090526 ]
+
+Fix insufficient distinction between IPv4 and IPv6 addresses
+when creating a filter.
+IPv4 and IPv6 are kept in the same memory area. If IPv6 is added,
+then it's caught by IPv4 check, which leads to err -95.
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 3ca5644785556..59971f62e6268 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -7731,7 +7731,8 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ return -EOPNOTSUPP;
+
+ /* adding filter using src_port/src_ip is not supported at this stage */
+- if (filter->src_port || filter->src_ipv4 ||
++ if (filter->src_port ||
++ (filter->src_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ !ipv6_addr_any(&filter->ip.v6.src_ip6))
+ return -EOPNOTSUPP;
+
+@@ -7760,7 +7761,7 @@ int i40e_add_del_cloud_filter_big_buf(struct i40e_vsi *vsi,
+ cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_MAC_VLAN_PORT);
+ }
+
+- } else if (filter->dst_ipv4 ||
++ } else if ((filter->dst_ipv4 && filter->n_proto != ETH_P_IPV6) ||
+ !ipv6_addr_any(&filter->ip.v6.dst_ip6)) {
+ cld_filter.element.flags =
+ cpu_to_le16(I40E_AQC_ADD_CLOUD_FILTER_IP_PORT);
+--
+2.27.0
+
--- /dev/null
+From 8961162452f71c0432a0b4521c785224de13839d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:39:03 +0000
+Subject: i40e: Fix addition of RX filters after enabling FW LLDP agent
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 28b1208e7a7fa3ddc9345b022bb93e53d9dcc28a ]
+
+Fix addition of VLAN filter for PF after enabling FW LLDP agent.
+Changing LLDP Agent causes FW to re-initialize per NVM settings.
+Remove default PF filter and move "Enable/Disable" to currently used
+reset flag.
+Without this patch PF would try to add MAC VLAN filter with default
+switch filter present. This causes AQ error and sets promiscuous mode
+on.
+
+Fixes: c65e78f87f81 ("i40e: Further implementation of LLDP")
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 16 +++++++++-------
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 9 ++++-----
+ 2 files changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 26ba1f3eb2d85..9e81f85ee2d8d 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -4878,7 +4878,7 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
+ enum i40e_admin_queue_err adq_err;
+ struct i40e_vsi *vsi = np->vsi;
+ struct i40e_pf *pf = vsi->back;
+- bool is_reset_needed;
++ u32 reset_needed = 0;
+ i40e_status status;
+ u32 i, j;
+
+@@ -4923,9 +4923,11 @@ static int i40e_set_priv_flags(struct net_device *dev, u32 flags)
+ flags_complete:
+ changed_flags = orig_flags ^ new_flags;
+
+- is_reset_needed = !!(changed_flags & (I40E_FLAG_VEB_STATS_ENABLED |
+- I40E_FLAG_LEGACY_RX | I40E_FLAG_SOURCE_PRUNING_DISABLED |
+- I40E_FLAG_DISABLE_FW_LLDP));
++ if (changed_flags & I40E_FLAG_DISABLE_FW_LLDP)
++ reset_needed = I40E_PF_RESET_AND_REBUILD_FLAG;
++ if (changed_flags & (I40E_FLAG_VEB_STATS_ENABLED |
++ I40E_FLAG_LEGACY_RX | I40E_FLAG_SOURCE_PRUNING_DISABLED))
++ reset_needed = BIT(__I40E_PF_RESET_REQUESTED);
+
+ /* Before we finalize any flag changes, we need to perform some
+ * checks to ensure that the changes are supported and safe.
+@@ -5057,7 +5059,7 @@ flags_complete:
+ case I40E_AQ_RC_EEXIST:
+ dev_warn(&pf->pdev->dev,
+ "FW LLDP agent is already running\n");
+- is_reset_needed = false;
++ reset_needed = 0;
+ break;
+ case I40E_AQ_RC_EPERM:
+ dev_warn(&pf->pdev->dev,
+@@ -5086,8 +5088,8 @@ flags_complete:
+ /* Issue reset to cause things to take effect, as additional bits
+ * are added we will need to create a mask of bits requiring reset
+ */
+- if (is_reset_needed)
+- i40e_do_reset(pf, BIT(__I40E_PF_RESET_REQUESTED), true);
++ if (reset_needed)
++ i40e_do_reset(pf, reset_needed, true);
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index bcfa6dcac29f7..b268adb3e1d44 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -8537,11 +8537,6 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired)
+ dev_dbg(&pf->pdev->dev, "PFR requested\n");
+ i40e_handle_reset_warning(pf, lock_acquired);
+
+- dev_info(&pf->pdev->dev,
+- pf->flags & I40E_FLAG_DISABLE_FW_LLDP ?
+- "FW LLDP is disabled\n" :
+- "FW LLDP is enabled\n");
+-
+ } else if (reset_flags & I40E_PF_RESET_AND_REBUILD_FLAG) {
+ /* Request a PF Reset
+ *
+@@ -8549,6 +8544,10 @@ void i40e_do_reset(struct i40e_pf *pf, u32 reset_flags, bool lock_acquired)
+ */
+ i40e_prep_for_reset(pf, lock_acquired);
+ i40e_reset_and_rebuild(pf, true, lock_acquired);
++ dev_info(&pf->pdev->dev,
++ pf->flags & I40E_FLAG_DISABLE_FW_LLDP ?
++ "FW LLDP is disabled\n" :
++ "FW LLDP is enabled\n");
+
+ } else if (reset_flags & BIT_ULL(__I40E_REINIT_REQUESTED)) {
+ int v;
+--
+2.27.0
+
--- /dev/null
+From ebb4d9a51764f88b93dcd597cda2c00eb0d74cba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 08:48:52 +0000
+Subject: i40e: Fix endianness conversions
+
+From: Norbert Ciosek <norbertx.ciosek@intel.com>
+
+[ Upstream commit b32cddd2247cf730731f93f1967d0147a40682c7 ]
+
+Fixes the following sparse warnings:
+i40e_main.c:5953:32: warning: cast from restricted __le16
+i40e_main.c:8008:29: warning: incorrect type in assignment (different base types)
+i40e_main.c:8008:29: expected unsigned int [assigned] [usertype] ipa
+i40e_main.c:8008:29: got restricted __le32 [usertype]
+i40e_main.c:8008:29: warning: incorrect type in assignment (different base types)
+i40e_main.c:8008:29: expected unsigned int [assigned] [usertype] ipa
+i40e_main.c:8008:29: got restricted __le32 [usertype]
+i40e_txrx.c:1950:59: warning: incorrect type in initializer (different base types)
+i40e_txrx.c:1950:59: expected unsigned short [usertype] vlan_tag
+i40e_txrx.c:1950:59: got restricted __le16 [usertype] l2tag1
+i40e_txrx.c:1953:40: warning: cast to restricted __le16
+i40e_xsk.c:448:38: warning: invalid assignment: |=
+i40e_xsk.c:448:38: left side has type restricted __le64
+i40e_xsk.c:448:38: right side has type int
+
+Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower")
+Fixes: 2a508c64ad27 ("i40e: fix VLAN.TCI == 0 RX HW offload")
+Fixes: 3106c580fb7c ("i40e: Use batched xsk Tx interfaces to increase performance")
+Fixes: 8f88b3034db3 ("i40e: Add infrastructure for queue channel support")
+Signed-off-by: Norbert Ciosek <norbertx.ciosek@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 12 ++++++------
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +-
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 59971f62e6268..fcd6f623f2fd8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -5920,7 +5920,7 @@ static int i40e_add_channel(struct i40e_pf *pf, u16 uplink_seid,
+ ch->enabled_tc = !i40e_is_channel_macvlan(ch) && enabled_tc;
+ ch->seid = ctxt.seid;
+ ch->vsi_number = ctxt.vsi_number;
+- ch->stat_counter_idx = cpu_to_le16(ctxt.info.stat_counter_idx);
++ ch->stat_counter_idx = le16_to_cpu(ctxt.info.stat_counter_idx);
+
+ /* copy just the sections touched not the entire info
+ * since not all sections are valid as returned by
+@@ -7599,8 +7599,8 @@ static inline void
+ i40e_set_cld_element(struct i40e_cloud_filter *filter,
+ struct i40e_aqc_cloud_filters_element_data *cld)
+ {
+- int i, j;
+ u32 ipa;
++ int i;
+
+ memset(cld, 0, sizeof(*cld));
+ ether_addr_copy(cld->outer_mac, filter->dst_mac);
+@@ -7611,14 +7611,14 @@ i40e_set_cld_element(struct i40e_cloud_filter *filter,
+
+ if (filter->n_proto == ETH_P_IPV6) {
+ #define IPV6_MAX_INDEX (ARRAY_SIZE(filter->dst_ipv6) - 1)
+- for (i = 0, j = 0; i < ARRAY_SIZE(filter->dst_ipv6);
+- i++, j += 2) {
++ for (i = 0; i < ARRAY_SIZE(filter->dst_ipv6); i++) {
+ ipa = be32_to_cpu(filter->dst_ipv6[IPV6_MAX_INDEX - i]);
+- ipa = cpu_to_le32(ipa);
+- memcpy(&cld->ipaddr.raw_v6.data[j], &ipa, sizeof(ipa));
++
++ *(__le32 *)&cld->ipaddr.raw_v6.data[i * 2] = cpu_to_le32(ipa);
+ }
+ } else {
+ ipa = be32_to_cpu(filter->dst_ipv4);
++
+ memcpy(&cld->ipaddr.v4.data, &ipa, sizeof(ipa));
+ }
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 32d97315f3f52..903d4e8cb0a11 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -1793,7 +1793,7 @@ void i40e_process_skb_fields(struct i40e_ring *rx_ring,
+ skb_record_rx_queue(skb, rx_ring->queue_index);
+
+ if (qword & BIT(I40E_RX_DESC_STATUS_L2TAG1P_SHIFT)) {
+- u16 vlan_tag = rx_desc->wb.qword0.lo_dword.l2tag1;
++ __le16 vlan_tag = rx_desc->wb.qword0.lo_dword.l2tag1;
+
+ __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q),
+ le16_to_cpu(vlan_tag));
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index 492ce213208d2..37a21fb999221 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -444,7 +444,7 @@ static void i40e_set_rs_bit(struct i40e_ring *xdp_ring)
+ struct i40e_tx_desc *tx_desc;
+
+ tx_desc = I40E_TX_DESC(xdp_ring, ntu);
+- tx_desc->cmd_type_offset_bsz |= (I40E_TX_DESC_CMD_RS << I40E_TXD_QW1_CMD_SHIFT);
++ tx_desc->cmd_type_offset_bsz |= cpu_to_le64(I40E_TX_DESC_CMD_RS << I40E_TXD_QW1_CMD_SHIFT);
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From 6736ea036396cafb43b93ea3fb523563748e0b65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Sep 2020 07:57:04 +0000
+Subject: i40e: Fix flow for IPv6 next header (extension header)
+
+From: Slawomir Laba <slawomirx.laba@intel.com>
+
+[ Upstream commit 92c6058024e87087cf1b99b0389d67c0a886360e ]
+
+When a packet contains an IPv6 header with next header which is
+an extension header and not a protocol one, the kernel function
+skb_transport_header called with such sk_buff will return a
+pointer to the extension header and not to the TCP one.
+
+The above explained call caused a problem with packet processing
+for skb with encapsulation for tunnel with I40E_TX_CTX_EXT_IP_IPV6.
+The extension header was not skipped at all.
+
+The ipv6_skip_exthdr function does check if next header of the IPV6
+header is an extension header and doesn't modify the l4_proto pointer
+if it points to a protocol header value so its safe to omit the
+comparison of exthdr and l4.hdr pointers. The ipv6_skip_exthdr can
+return value -1. This means that the skipping process failed
+and there is something wrong with the packet so it will be dropped.
+
+Fixes: a3fd9d8876a5 ("i40e/i40evf: Handle IPv6 extension headers in checksum offload")
+Signed-off-by: Slawomir Laba <slawomirx.laba@intel.com>
+Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_txrx.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index 4aca637d4a23c..32d97315f3f52 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -3113,13 +3113,16 @@ static int i40e_tx_enable_csum(struct sk_buff *skb, u32 *tx_flags,
+
+ l4_proto = ip.v4->protocol;
+ } else if (*tx_flags & I40E_TX_FLAGS_IPV6) {
++ int ret;
++
+ tunnel |= I40E_TX_CTX_EXT_IP_IPV6;
+
+ exthdr = ip.hdr + sizeof(*ip.v6);
+ l4_proto = ip.v6->nexthdr;
+- if (l4.hdr != exthdr)
+- ipv6_skip_exthdr(skb, exthdr - skb->data,
+- &l4_proto, &frag_off);
++ ret = ipv6_skip_exthdr(skb, exthdr - skb->data,
++ &l4_proto, &frag_off);
++ if (ret < 0)
++ return -1;
+ }
+
+ /* define outer transport */
+--
+2.27.0
+
--- /dev/null
+From bfa0a603fe23118ebe7c159026b2c844aa159061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 15:08:27 +0000
+Subject: i40e: Fix overwriting flow control settings during driver loading
+
+From: Mateusz Palczewski <mateusz.palczewski@intel.com>
+
+[ Upstream commit 4cdb9f80dcd46aab3c0020b4a6920c22735c5d6e ]
+
+During driver loading flow control settings were written to FW
+using a variable which was always zero, since it was being set
+only by ethtool. This behavior has been corrected and driver
+no longer overwrites the default FW/NVM settings.
+
+Fixes: 373149fc99a0 ("i40e: Decrease the scope of rtnl lock")
+Signed-off-by: Dawid Lukwinski <dawid.lukwinski@intel.com>
+Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ---------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index 9b1251a710c09..bcfa6dcac29f7 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -10005,7 +10005,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ int old_recovery_mode_bit = test_bit(__I40E_RECOVERY_MODE, pf->state);
+ struct i40e_vsi *vsi = pf->vsi[pf->lan_vsi];
+ struct i40e_hw *hw = &pf->hw;
+- u8 set_fc_aq_fail = 0;
+ i40e_status ret;
+ u32 val;
+ int v;
+@@ -10131,13 +10130,6 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired)
+ i40e_stat_str(&pf->hw, ret),
+ i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+
+- /* make sure our flow control settings are restored */
+- ret = i40e_set_fc(&pf->hw, &set_fc_aq_fail, true);
+- if (ret)
+- dev_dbg(&pf->pdev->dev, "setting flow control: ret = %s last_status = %s\n",
+- i40e_stat_str(&pf->hw, ret),
+- i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));
+-
+ /* Rebuild the VSIs and VEBs that existed before reset.
+ * They are still in our local switch element arrays, so only
+ * need to rebuild the switch model in the HW.
+@@ -14720,7 +14712,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int err;
+ u32 val;
+ u32 i;
+- u8 set_fc_aq_fail;
+
+ err = pci_enable_device_mem(pdev);
+ if (err)
+@@ -15054,24 +15045,6 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ }
+ INIT_LIST_HEAD(&pf->vsi[pf->lan_vsi]->ch_list);
+
+- /* Make sure flow control is set according to current settings */
+- err = i40e_set_fc(hw, &set_fc_aq_fail, true);
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_GET)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on get_phy_cap\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_SET)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on set_phy_config\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+- if (set_fc_aq_fail & I40E_SET_FC_AQ_FAIL_UPDATE)
+- dev_dbg(&pf->pdev->dev,
+- "Set fc with err %s aq_err %s on get_link_info\n",
+- i40e_stat_str(hw, err),
+- i40e_aq_str(hw, hw->aq.asq_last_status));
+-
+ /* if FDIR VSI was set up, start it now */
+ for (i = 0; i < pf->num_alloc_vsi; i++) {
+ if (pf->vsi[i] && pf->vsi[i]->type == I40E_VSI_FDIR) {
+--
+2.27.0
+
--- /dev/null
+From dac54f073eceafea3020d4ae19a02fad113b4067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 11:23:01 +0000
+Subject: i40e: Fix VFs not created
+
+From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+
+[ Upstream commit dc8812626440fa6a27f1f3f654f6dc435e042e42 ]
+
+When creating VFs they were sometimes not getting resources.
+It was caused by not executing i40e_reset_all_vfs due to
+flag __I40E_VF_DISABLE being set on PF. Because of this
+IAVF was never able to finish setup sequence never
+getting reset indication from PF.
+Changed test_and_set_bit __I40E_VF_DISABLE in
+i40e_sync_filters_subtask to test_bit and removed clear_bit.
+This function should not set this bit it should only check
+if it hasn't been already set.
+
+Fixes: a7542b876075 ("i40e: check __I40E_VF_DISABLE bit in i40e_sync_filters_subtask")
+Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
+index b268adb3e1d44..3ca5644785556 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
+@@ -2616,7 +2616,7 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ return;
+ if (!test_and_clear_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state))
+ return;
+- if (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) {
++ if (test_bit(__I40E_VF_DISABLE, pf->state)) {
+ set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
+ return;
+ }
+@@ -2634,7 +2634,6 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf)
+ }
+ }
+ }
+- clear_bit(__I40E_VF_DISABLE, pf->state);
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From 7e880b6a2eed7f6a5318b8dae16beb40379f4e69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:00:08 +0200
+Subject: IB/cm: Avoid a loop when device has 255 ports
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 131be26750379592f0dd6244b2a90bbb504a10bb ]
+
+When RDMA device has 255 ports, loop iterator i overflows. Due to which
+cm_add_one() port iterator loops infinitely. Use core provided port
+iterator to avoid the infinite loop.
+
+Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
+Link: https://lore.kernel.org/r/20210127150010.1876121-9-leon@kernel.org
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index 98165589c8ab6..be996dba040cc 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -4333,7 +4333,7 @@ static int cm_add_one(struct ib_device *ib_device)
+ unsigned long flags;
+ int ret;
+ int count = 0;
+- u8 i;
++ unsigned int i;
+
+ cm_dev = kzalloc(struct_size(cm_dev, port, ib_device->phys_port_cnt),
+ GFP_KERNEL);
+@@ -4345,7 +4345,7 @@ static int cm_add_one(struct ib_device *ib_device)
+ cm_dev->going_down = 0;
+
+ set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
+- for (i = 1; i <= ib_device->phys_port_cnt; i++) {
++ rdma_for_each_port (ib_device, i) {
+ if (!rdma_cap_ib_cm(ib_device, i))
+ continue;
+
+@@ -4431,7 +4431,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
+ .clr_port_cap_mask = IB_PORT_CM_SUP
+ };
+ unsigned long flags;
+- int i;
++ unsigned int i;
+
+ write_lock_irqsave(&cm.device_lock, flags);
+ list_del(&cm_dev->list);
+@@ -4441,7 +4441,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
+ cm_dev->going_down = 1;
+ spin_unlock_irq(&cm.lock);
+
+- for (i = 1; i <= ib_device->phys_port_cnt; i++) {
++ rdma_for_each_port (ib_device, i) {
+ if (!rdma_cap_ib_cm(ib_device, i))
+ continue;
+
+--
+2.27.0
+
--- /dev/null
+From 1ece995519284b12d826f2ffba88ceee8ad3315f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 14:17:01 +0200
+Subject: IB/mlx5: Add mutex destroy call to cap_mask_mutex mutex
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit ab40530a2e0a7aca9a5187824c4fb072f3916e85 ]
+
+mutex_destroy() call for device's cap_mask_mutex mutex is missing, let's
+add it to annotate destruction.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Link: https://lore.kernel.org/r/20210113121703.559778-4-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index aabdc07e47537..9b772457286f2 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3927,7 +3927,7 @@ static void mlx5_ib_stage_init_cleanup(struct mlx5_ib_dev *dev)
+ mlx5_ib_cleanup_multiport_master(dev);
+ WARN_ON(!xa_empty(&dev->odp_mkeys));
+ cleanup_srcu_struct(&dev->odp_srcu);
+-
++ mutex_destroy(&dev->cap_mask_mutex);
+ WARN_ON(!xa_empty(&dev->sig_mrs));
+ WARN_ON(!bitmap_empty(dev->dm.memic_alloc_pages, MLX5_MAX_MEMIC_PAGES));
+ }
+@@ -3978,6 +3978,10 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
+ dev->ib_dev.dev.parent = mdev->device;
+ dev->ib_dev.lag_flags = RDMA_LAG_FLAGS_HASH_ALL_SLAVES;
+
++ err = init_srcu_struct(&dev->odp_srcu);
++ if (err)
++ goto err_mp;
++
+ mutex_init(&dev->cap_mask_mutex);
+ INIT_LIST_HEAD(&dev->qp_list);
+ spin_lock_init(&dev->reset_flow_resource_lock);
+@@ -3987,11 +3991,6 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
+
+ spin_lock_init(&dev->dm.lock);
+ dev->dm.dev = mdev;
+-
+- err = init_srcu_struct(&dev->odp_srcu);
+- if (err)
+- goto err_mp;
+-
+ return 0;
+
+ err_mp:
+--
+2.27.0
+
--- /dev/null
+From 91979052fbabcc31ad49acd6b86433d2a7885c1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 17:00:07 +0200
+Subject: IB/mlx5: Return appropriate error code instead of ENOMEM
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit d286ac1d05210695c312b9018b3aa7c2048e9aca ]
+
+When mlx5_ib_stage_init_init() fails, return the error code related to
+failure instead of -ENOMEM.
+
+Fixes: 16c1975f1032 ("IB/mlx5: Create profile infrastructure to add and remove stages")
+Link: https://lore.kernel.org/r/20210127150010.1876121-8-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index 9b772457286f2..3562e69eacb14 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3995,8 +3995,7 @@ static int mlx5_ib_stage_init_init(struct mlx5_ib_dev *dev)
+
+ err_mp:
+ mlx5_ib_cleanup_multiport_master(dev);
+-
+- return -ENOMEM;
++ return err;
+ }
+
+ static int mlx5_ib_enable_driver(struct ib_device *dev)
+--
+2.27.0
+
--- /dev/null
+From 493d15b3dc8e0759e54bdcc96405689690d0eadf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:13:38 +0200
+Subject: IB/umad: Return EIO in case of when device disassociated
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 4fc5461823c9cad547a9bdfbf17d13f0da0d6bb5 ]
+
+MAD message received by the user has EINVAL error in all flows
+including when the device is disassociated. That makes it impossible
+for the applications to treat such flow differently.
+
+Change it to return EIO, so the applications will be able to perform
+disassociation recovery.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/20210125121339.837518-2-leon@kernel.org
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/user_mad.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 19104a6756915..7ec1918431f70 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -379,6 +379,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+
+ mutex_lock(&file->mutex);
+
++ if (file->agents_dead) {
++ mutex_unlock(&file->mutex);
++ return -EIO;
++ }
++
+ while (list_empty(&file->recv_list)) {
+ mutex_unlock(&file->mutex);
+
+@@ -524,7 +529,7 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
+
+ agent = __get_agent(file, packet->mad.hdr.id);
+ if (!agent) {
+- ret = -EINVAL;
++ ret = -EIO;
+ goto err_up;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 75105106c3b329ed258e93e53c5c1bed2e679b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:13:39 +0200
+Subject: IB/umad: Return EPOLLERR in case of when device disassociated
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit def4cd43f522253645b72c97181399c241b54536 ]
+
+Currently, polling a umad device will always works, even if the device was
+disassociated. A disassociated device should immediately return EPOLLERR
+from poll(). Otherwise userspace is endlessly hung on poll() with no idea
+that the device has been removed from the system.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Link: https://lore.kernel.org/r/20210125121339.837518-3-leon@kernel.org
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/user_mad.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index 7ec1918431f70..dd7f3b437c6be 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -397,6 +397,11 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
+ mutex_lock(&file->mutex);
+ }
+
++ if (file->agents_dead) {
++ mutex_unlock(&file->mutex);
++ return -EIO;
++ }
++
+ packet = list_entry(file->recv_list.next, struct ib_umad_packet, list);
+ list_del(&packet->list);
+
+@@ -658,10 +663,14 @@ static __poll_t ib_umad_poll(struct file *filp, struct poll_table_struct *wait)
+ /* we will always be able to post a MAD send */
+ __poll_t mask = EPOLLOUT | EPOLLWRNORM;
+
++ mutex_lock(&file->mutex);
+ poll_wait(filp, &file->recv_wait, wait);
+
+ if (!list_empty(&file->recv_list))
+ mask |= EPOLLIN | EPOLLRDNORM;
++ if (file->agents_dead)
++ mask = EPOLLERR;
++ mutex_unlock(&file->mutex);
+
+ return mask;
+ }
+@@ -1341,6 +1350,7 @@ static void ib_umad_kill_port(struct ib_umad_port *port)
+ list_for_each_entry(file, &port->file_list, port_list) {
+ mutex_lock(&file->mutex);
+ file->agents_dead = 1;
++ wake_up_interruptible(&file->recv_wait);
+ mutex_unlock(&file->mutex);
+
+ for (id = 0; id < IB_UMAD_MAX_AGENTS; ++id)
+--
+2.27.0
+
--- /dev/null
+From 218b73ad84884d9ab52a80cf464d1367c2f0e10e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:48:40 -0600
+Subject: ibmvnic: add memory barrier to protect long term buffer
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 42557dab78edc8235aba5b441f2eb35f725a0ede ]
+
+dma_rmb() barrier is added to load the long term buffer before copying
+it to socket buffer; and dma_wmb() barrier is added to update the
+long term buffer before it being accessed by VIOS (virtual i/o server).
+
+Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Acked-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 621be6d2da971..f6402a20ba320 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1700,6 +1700,9 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
+ skb_copy_from_linear_data(skb, dst, skb->len);
+ }
+
++ /* post changes to long_term_buff *dst before VIOS accessing it */
++ dma_wmb();
++
+ tx_pool->consumer_index =
+ (tx_pool->consumer_index + 1) % tx_pool->num_buffers;
+
+@@ -2539,6 +2542,8 @@ restart_poll:
+ offset = be16_to_cpu(next->rx_comp.off_frame_data);
+ flags = next->rx_comp.flags;
+ skb = rx_buff->skb;
++ /* load long_term_buff before copying to skb */
++ dma_rmb();
+ skb_copy_to_linear_data(skb, rx_buff->data + offset,
+ length);
+
+--
+2.27.0
+
--- /dev/null
+From 314553ffaf73edcc742b9a53e7ef45541db9ed47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 15:16:30 -0500
+Subject: ibmvnic: change IBMVNIC_MAX_IND_DESCS to 16
+
+From: Dany Madden <drt@linux.ibm.com>
+
+[ Upstream commit a6f2fe5f108c11ff8023d07f9c00cc3c9c3203b8 ]
+
+The supported indirect subcrq entries on Power8 is 16. Power9
+supports 128. Redefined this value to 16 to minimize the driver from
+having to reset when migrating between Power9 and Power8. In our rx/tx
+performance testing, we found no performance difference between 16 and
+128 at this time.
+
+Fixes: f019fb6392e5 ("ibmvnic: Introduce indirect subordinate Command Response Queue buffer")
+Signed-off-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 3cccbba703658..72fea3b1c87d9 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -31,7 +31,7 @@
+ #define IBMVNIC_BUFFS_PER_POOL 100
+ #define IBMVNIC_MAX_QUEUES 16
+ #define IBMVNIC_MAX_QUEUE_SZ 4096
+-#define IBMVNIC_MAX_IND_DESCS 128
++#define IBMVNIC_MAX_IND_DESCS 16
+ #define IBMVNIC_IND_ARR_SZ (IBMVNIC_MAX_IND_DESCS * 32)
+
+ #define IBMVNIC_TSO_BUF_SZ 65536
+--
+2.27.0
+
--- /dev/null
+From 38e25afdb018724275923b0a0757824c06c239a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:42:50 -0800
+Subject: ibmvnic: serialize access to work queue on remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit 4a41c421f3676fdeea91733cf434dcf319c4c351 ]
+
+The work queue is used to queue reset requests like CHANGE-PARAM or
+FAILOVER resets for the worker thread. When the adapter is being removed
+the adapter state is set to VNIC_REMOVING and the work queue is flushed
+so no new work is added. However the check for adapter being removed is
+racy in that the adapter can go into REMOVING state just after we check
+and we might end up adding work just as it is being flushed (or after).
+
+The ->rwi_lock is already being used to serialize queue/dequeue work.
+Extend its usage ensure there is no race when scheduling/flushing work.
+
+Fixes: 6954a9e4192b ("ibmvnic: Flush existing work items before device removal")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Cc:Uwe Kleine-König <uwe@kleine-koenig.org>
+Cc:Saeed Mahameed <saeed@kernel.org>
+Reviewed-by: Dany Madden <drt@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 27 ++++++++++++++++++++-------
+ drivers/net/ethernet/ibm/ibmvnic.h | 5 ++++-
+ 2 files changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index cd201f89ce6c0..13ae7eee7ef5f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2395,6 +2395,8 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ unsigned long flags;
+ int ret;
+
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
++
+ /*
+ * If failover is pending don't schedule any other reset.
+ * Instead let the failover complete. If there is already a
+@@ -2415,14 +2417,11 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ goto err;
+ }
+
+- spin_lock_irqsave(&adapter->rwi_lock, flags);
+-
+ list_for_each(entry, &adapter->rwi_list) {
+ tmp = list_entry(entry, struct ibmvnic_rwi, list);
+ if (tmp->reset_reason == reason) {
+ netdev_dbg(netdev, "Skipping matching reset, reason=%d\n",
+ reason);
+- spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ret = EBUSY;
+ goto err;
+ }
+@@ -2430,8 +2429,6 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+
+ rwi = kzalloc(sizeof(*rwi), GFP_ATOMIC);
+ if (!rwi) {
+- spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+- ibmvnic_close(netdev);
+ ret = ENOMEM;
+ goto err;
+ }
+@@ -2444,12 +2441,17 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ rwi->reset_reason = reason;
+ list_add_tail(&rwi->list, &adapter->rwi_list);
+- spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ netdev_dbg(adapter->netdev, "Scheduling reset (reason %d)\n", reason);
+ schedule_work(&adapter->ibmvnic_reset);
+
+- return 0;
++ ret = 0;
+ err:
++ /* ibmvnic_close() below can block, so drop the lock first */
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
++
++ if (ret == ENOMEM)
++ ibmvnic_close(netdev);
++
+ return -ret;
+ }
+
+@@ -5467,7 +5469,18 @@ static int ibmvnic_remove(struct vio_dev *dev)
+ unsigned long flags;
+
+ spin_lock_irqsave(&adapter->state_lock, flags);
++
++ /* If ibmvnic_reset() is scheduling a reset, wait for it to
++ * finish. Then, set the state to REMOVING to prevent it from
++ * scheduling any more work and to have reset functions ignore
++ * any resets that have already been scheduled. Drop the lock
++ * after setting state, so __ibmvnic_reset() which is called
++ * from the flush_work() below, can make progress.
++ */
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+ adapter->state = VNIC_REMOVING;
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
++
+ spin_unlock_irqrestore(&adapter->state_lock, flags);
+
+ flush_work(&adapter->ibmvnic_reset);
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index c09c3f6bba9f2..3cccbba703658 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1081,6 +1081,7 @@ struct ibmvnic_adapter {
+ struct tasklet_struct tasklet;
+ enum vnic_state state;
+ enum ibmvnic_reset_reason reset_reason;
++ /* when taking both state and rwi locks, take state lock first */
+ spinlock_t rwi_lock;
+ struct list_head rwi_list;
+ struct work_struct ibmvnic_reset;
+@@ -1097,6 +1098,8 @@ struct ibmvnic_adapter {
+ struct ibmvnic_tunables desired;
+ struct ibmvnic_tunables fallback;
+
+- /* Used for serializatin of state field */
++ /* Used for serialization of state field. When taking both state
++ * and rwi locks, take state lock first.
++ */
+ spinlock_t state_lock;
+ };
+--
+2.27.0
+
--- /dev/null
+From 61170c826b43897d6c3733601f6b3f1a02486bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 17:41:43 -0800
+Subject: ibmvnic: Set to CLOSED state even on error
+
+From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+
+[ Upstream commit d4083d3c00f60a09ad82e3bf17ff57fec69c8aa6 ]
+
+If set_link_state() fails for any reason, we still cleanup the adapter
+state and cannot recover from a partial close anyway. So set the adapter
+to CLOSED state. That way if a new soft/hard reset is processed, the
+adapter will remain in the CLOSED state until the next ibmvnic_open().
+
+Fixes: 01d9bd792d16 ("ibmvnic: Reorganize device close")
+Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
+Reported-by: Abdul Haleem <abdhalee@in.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index a536fdbf05e19..621be6d2da971 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1353,10 +1353,8 @@ static int __ibmvnic_close(struct net_device *netdev)
+
+ adapter->state = VNIC_CLOSING;
+ rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_DN);
+- if (rc)
+- return rc;
+ adapter->state = VNIC_CLOSED;
+- return 0;
++ return rc;
+ }
+
+ static int ibmvnic_close(struct net_device *netdev)
+--
+2.27.0
+
--- /dev/null
+From fa2aa0ebafcd973eda4e00715a166db539d526e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 20:49:00 -0600
+Subject: ibmvnic: skip send_request_unmap for timeout reset
+
+From: Lijun Pan <ljp@linux.ibm.com>
+
+[ Upstream commit 7d3a7b9ea59ddb223aec59b45fa1713c633aaed4 ]
+
+Timeout reset will trigger the VIOS to unmap it automatically,
+similarly as FAILVOER and MOBILITY events. If we unmap it
+in the linux side, we will see errors like
+"30000003: Error 4 in REQUEST_UNMAP_RSP".
+So, don't call send_request_unmap for timeout reset.
+
+Fixes: ed651a10875f ("ibmvnic: Updated reset handling")
+Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index f6402a20ba320..cd201f89ce6c0 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -247,8 +247,13 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter,
+ if (!ltb->buff)
+ return;
+
++ /* VIOS automatically unmaps the long term buffer at remote
++ * end for the following resets:
++ * FAILOVER, MOBILITY, TIMEOUT.
++ */
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+- adapter->reset_reason != VNIC_RESET_MOBILITY)
++ adapter->reset_reason != VNIC_RESET_MOBILITY &&
++ adapter->reset_reason != VNIC_RESET_TIMEOUT)
+ send_request_unmap(adapter, ltb->map_id);
+ dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr);
+ }
+--
+2.27.0
+
--- /dev/null
+From 26f549ed2796863f047d8a27e69dde4a0c71e04c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Sep 2020 13:13:38 -0700
+Subject: ice: Account for port VLAN in VF max packet size calculation
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit a6aa7c8f998f4afddd73410aa043dad38162ce9e ]
+
+Currently if an AVF driver doesn't account for the possibility of a
+port VLAN when determining its max packet size then packets at MTU will
+be dropped. It is not the VF driver's responsibility to account for a
+port VLAN so fix this. To fix this, do the following:
+
+1. Add a function that determines the max packet size a VF is allowed by
+ using the port's max packet size and whether the VF is in a port
+ VLAN. If a port VLAN is configured then a VF's max packet size will
+ always be the port's max packet size minus VLAN_HLEN. Otherwise it
+ will be the port's max packet size.
+
+2. Use this function to verify the max packet size from the VF.
+
+3. If there is a port VLAN configured then add 4 bytes (VLAN_HLEN) to
+ the VF's max packet size configuration.
+
+Also, the VIRTCHNL_OP_GET_VF_RESOURCES message provides the capability
+to communicate a VF's max packet size. Use the new function for this
+purpose.
+
+Fixes: 1071a8358a28 ("ice: Implement virtchnl commands for AVF support")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 33 ++++++++++++++++++-
+ 1 file changed, 32 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+index ec7f6c64132ee..b3161c5def465 100644
+--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+@@ -1878,6 +1878,29 @@ static int ice_vc_get_ver_msg(struct ice_vf *vf, u8 *msg)
+ sizeof(struct virtchnl_version_info));
+ }
+
++/**
++ * ice_vc_get_max_frame_size - get max frame size allowed for VF
++ * @vf: VF used to determine max frame size
++ *
++ * Max frame size is determined based on the current port's max frame size and
++ * whether a port VLAN is configured on this VF. The VF is not aware whether
++ * it's in a port VLAN so the PF needs to account for this in max frame size
++ * checks and sending the max frame size to the VF.
++ */
++static u16 ice_vc_get_max_frame_size(struct ice_vf *vf)
++{
++ struct ice_vsi *vsi = vf->pf->vsi[vf->lan_vsi_idx];
++ struct ice_port_info *pi = vsi->port_info;
++ u16 max_frame_size;
++
++ max_frame_size = pi->phy.link_info.max_frame_size;
++
++ if (vf->port_vlan_info)
++ max_frame_size -= VLAN_HLEN;
++
++ return max_frame_size;
++}
++
+ /**
+ * ice_vc_get_vf_res_msg
+ * @vf: pointer to the VF info
+@@ -1960,6 +1983,7 @@ static int ice_vc_get_vf_res_msg(struct ice_vf *vf, u8 *msg)
+ vfres->max_vectors = pf->num_msix_per_vf;
+ vfres->rss_key_size = ICE_VSIQF_HKEY_ARRAY_SIZE;
+ vfres->rss_lut_size = ICE_VSIQF_HLUT_ARRAY_SIZE;
++ vfres->max_mtu = ice_vc_get_max_frame_size(vf);
+
+ vfres->vsi_res[0].vsi_id = vf->lan_vsi_num;
+ vfres->vsi_res[0].vsi_type = VIRTCHNL_VSI_SRIOV;
+@@ -2952,6 +2976,8 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+
+ /* copy Rx queue info from VF into VSI */
+ if (qpi->rxq.ring_len > 0) {
++ u16 max_frame_size = ice_vc_get_max_frame_size(vf);
++
+ num_rxq++;
+ vsi->rx_rings[i]->dma = qpi->rxq.dma_ring_addr;
+ vsi->rx_rings[i]->count = qpi->rxq.ring_len;
+@@ -2964,7 +2990,7 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ }
+ vsi->rx_buf_len = qpi->rxq.databuffer_size;
+ vsi->rx_rings[i]->rx_buf_len = vsi->rx_buf_len;
+- if (qpi->rxq.max_pkt_size >= (16 * 1024) ||
++ if (qpi->rxq.max_pkt_size > max_frame_size ||
+ qpi->rxq.max_pkt_size < 64) {
+ v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ goto error_param;
+@@ -2972,6 +2998,11 @@ static int ice_vc_cfg_qs_msg(struct ice_vf *vf, u8 *msg)
+ }
+
+ vsi->max_frame = qpi->rxq.max_pkt_size;
++ /* add space for the port VLAN since the VF driver is not
++ * expected to account for it in the MTU calculation
++ */
++ if (vf->port_vlan_info)
++ vsi->max_frame += VLAN_HLEN;
+ }
+
+ /* VF can request to configure less than allocated queues or default
+--
+2.27.0
+
--- /dev/null
+From 2e9a193318c1d45fc94e913b7234c64006f722c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:38:35 -0800
+Subject: ice: Fix state bits on LLDP mode switch
+
+From: Dave Ertman <david.m.ertman@intel.com>
+
+[ Upstream commit 0d4907f65dc8fc5e897ad19956fca1acb3b33bc8 ]
+
+DCBX_CAP bits were not being adjusted when switching
+between SW and FW controlled LLDP.
+
+Adjust bits to correctly indicate which mode the
+LLDP logic is in.
+
+Fixes: b94b013eb626 ("ice: Implement DCBNL support")
+Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice.h | 2 --
+ drivers/net/ethernet/intel/ice/ice_dcb_nl.c | 4 ++++
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 7 +++++++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index fa1e128c24eca..619d93f8b54c4 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -443,9 +443,7 @@ struct ice_pf {
+ struct ice_hw_port_stats stats_prev;
+ struct ice_hw hw;
+ u8 stat_prev_loaded:1; /* has previous stats been loaded */
+-#ifdef CONFIG_DCB
+ u16 dcbx_cap;
+-#endif /* CONFIG_DCB */
+ u32 tx_timeout_count;
+ unsigned long tx_timeout_last_recovery;
+ u32 tx_timeout_recovery_level;
+diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_nl.c b/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
+index 842d44b63480f..8c133a8be6add 100644
+--- a/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
++++ b/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
+@@ -160,6 +160,10 @@ static u8 ice_dcbnl_setdcbx(struct net_device *netdev, u8 mode)
+ {
+ struct ice_pf *pf = ice_netdev_to_pf(netdev);
+
++ /* if FW LLDP agent is running, DCBNL not allowed to change mode */
++ if (test_bit(ICE_FLAG_FW_LLDP_AGENT, pf->flags))
++ return ICE_DCB_NO_HW_CHG;
++
+ /* No support for LLD_MANAGED modes or CEE+IEEE */
+ if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
+ ((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) ||
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index 69c113a4de7e6..d27b9cb3e8082 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -8,6 +8,7 @@
+ #include "ice_fltr.h"
+ #include "ice_lib.h"
+ #include "ice_dcb_lib.h"
++#include <net/dcbnl.h>
+
+ struct ice_stats {
+ char stat_string[ETH_GSTRING_LEN];
+@@ -1238,6 +1239,9 @@ static int ice_set_priv_flags(struct net_device *netdev, u32 flags)
+ status = ice_init_pf_dcb(pf, true);
+ if (status)
+ dev_warn(dev, "Fail to init DCB\n");
++
++ pf->dcbx_cap &= ~DCB_CAP_DCBX_LLD_MANAGED;
++ pf->dcbx_cap |= DCB_CAP_DCBX_HOST;
+ } else {
+ enum ice_status status;
+ bool dcbx_agent_status;
+@@ -1280,6 +1284,9 @@ static int ice_set_priv_flags(struct net_device *netdev, u32 flags)
+ if (status)
+ dev_dbg(dev, "Fail to enable MIB change events\n");
+
++ pf->dcbx_cap &= ~DCB_CAP_DCBX_HOST;
++ pf->dcbx_cap |= DCB_CAP_DCBX_LLD_MANAGED;
++
+ ice_nway_reset(netdev);
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From 9b13b8f43c53e2b48377adacf6641e691a0dde97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Sep 2020 08:53:44 -0700
+Subject: ice: report correct max number of TCs
+
+From: Dave Ertman <david.m.ertman@intel.com>
+
+[ Upstream commit 7dcf7aa01c7b9f18727cbe0f9cb4136f1c6cdcc2 ]
+
+In the driver currently, we are reporting max number of TCs
+to the DCBNL callback as a kernel define set to 8. This is
+preventing userspace applications performing DCBx to correctly
+down map the TCs from requested to actual values.
+
+Report the actual max TC value to userspace from the capability
+struct.
+
+Fixes: b94b013eb626 ("ice: Implement DCBNL support")
+Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_dcb_nl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_dcb_nl.c b/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
+index 87f91b750d59a..842d44b63480f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
++++ b/drivers/net/ethernet/intel/ice/ice_dcb_nl.c
+@@ -136,7 +136,7 @@ ice_dcbnl_getnumtcs(struct net_device *dev, int __always_unused tcid, u8 *num)
+ if (!test_bit(ICE_FLAG_DCB_CAPABLE, pf->flags))
+ return -EINVAL;
+
+- *num = IEEE_8021QAZ_MAX_TCS;
++ *num = pf->hw.func_caps.common_cap.maxtc;
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From fabf9653b90cc22e720bf6266bb7ab1d4bcce21d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 09:20:24 -0800
+Subject: ice: update the number of available RSS queues
+
+From: Henry Tieman <henry.w.tieman@intel.com>
+
+[ Upstream commit 0393e46ac48a6832b1011c233ebcef84f8dbe4f5 ]
+
+It was possible to have Rx queues that were not available for use
+by RSS. This would happen when increasing the number of Rx queues
+while there was a user defined RSS LUT.
+
+Always update the number of available RSS queues when changing the
+number of Rx queues.
+
+Fixes: 87324e747fde ("ice: Implement ethtool ops for channels")
+Signed-off-by: Henry Tieman <henry.w.tieman@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ethtool.c | 27 ++++++++++++++------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index d27b9cb3e8082..aebebd2102da0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -3328,6 +3328,18 @@ ice_get_channels(struct net_device *dev, struct ethtool_channels *ch)
+ ch->max_other = ch->other_count;
+ }
+
++/**
++ * ice_get_valid_rss_size - return valid number of RSS queues
++ * @hw: pointer to the HW structure
++ * @new_size: requested RSS queues
++ */
++static int ice_get_valid_rss_size(struct ice_hw *hw, int new_size)
++{
++ struct ice_hw_common_caps *caps = &hw->func_caps.common_cap;
++
++ return min_t(int, new_size, BIT(caps->rss_table_entry_width));
++}
++
+ /**
+ * ice_vsi_set_dflt_rss_lut - set default RSS LUT with requested RSS size
+ * @vsi: VSI to reconfigure RSS LUT on
+@@ -3355,14 +3367,10 @@ static int ice_vsi_set_dflt_rss_lut(struct ice_vsi *vsi, int req_rss_size)
+ return -ENOMEM;
+
+ /* set RSS LUT parameters */
+- if (!test_bit(ICE_FLAG_RSS_ENA, pf->flags)) {
++ if (!test_bit(ICE_FLAG_RSS_ENA, pf->flags))
+ vsi->rss_size = 1;
+- } else {
+- struct ice_hw_common_caps *caps = &hw->func_caps.common_cap;
+-
+- vsi->rss_size = min_t(int, req_rss_size,
+- BIT(caps->rss_table_entry_width));
+- }
++ else
++ vsi->rss_size = ice_get_valid_rss_size(hw, req_rss_size);
+
+ /* create/set RSS LUT */
+ ice_fill_rss_lut(lut, vsi->rss_table_size, vsi->rss_size);
+@@ -3441,9 +3449,12 @@ static int ice_set_channels(struct net_device *dev, struct ethtool_channels *ch)
+
+ ice_vsi_recfg_qs(vsi, new_rx, new_tx);
+
+- if (new_rx && !netif_is_rxfh_configured(dev))
++ if (!netif_is_rxfh_configured(dev))
+ return ice_vsi_set_dflt_rss_lut(vsi, new_rx);
+
++ /* Update rss_size due to change in Rx queues */
++ vsi->rss_size = ice_get_valid_rss_size(&pf->hw, new_rx);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7866160d8674851982fe6d18b0da580fa531a8a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:39:56 +1100
+Subject: ide/falconide: Fix module unload
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 07f1dc8cc85bbfb2f9270f25060c4755f4509f45 ]
+
+Unloading the falconide module results in a crash:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000
+Oops: 00000000
+Modules linked in: falconide(-)
+PC: [<002930b2>] ide_host_remove+0x2e/0x1d2
+SR: 2000 SP: 00b49e28 a2: 009b0f90
+d0: 00000000 d1: 009b0f90 d2: 00000000 d3: 00b48000
+d4: 003cef32 d5: 00299188 a0: 0086d000 a1: 0086d000
+Process rmmod (pid: 322, task=009b0f90)
+Frame format=7 eff addr=00000000 ssw=0505 faddr=00000000
+wb 1 stat/addr/data: 0000 00000000 00000000
+wb 2 stat/addr/data: 0000 00000000 00000000
+wb 3 stat/addr/data: 0000 00000000 00018da9
+push data: 00000000 00000000 00000000 00000000
+Stack from 00b49e90:
+ 004c456a 0027f176 0027cb0a 0027cb9e 00000000 0086d00a 2187d3f0 0027f0e0
+ 00b49ebc 2187d1f6 00000000 00b49ec8 002811e8 0086d000 00b49ef0 0028024c
+ 0086d00a 002800d6 00279a1a 00000001 00000001 0086d00a 2187d3f0 00279a58
+ 00b49f1c 002802e0 0086d00a 2187d3f0 004c456a 0086d00a ef96af74 00000000
+ 2187d3f0 002805d2 800de064 00b49f44 0027f088 2187d3f0 00ac1cf4 2187d3f0
+ 004c43be 2187d3f0 00000000 2187d3f0 800b66a8 00b49f5c 00280776 2187d3f0
+Call Trace: [<0027f176>] __device_driver_unlock+0x0/0x48
+ [<0027cb0a>] device_links_busy+0x0/0x94
+ [<0027cb9e>] device_links_unbind_consumers+0x0/0x130
+ [<0027f0e0>] __device_driver_lock+0x0/0x5a
+ [<2187d1f6>] falconide_remove+0x12/0x18 [falconide]
+ [<002811e8>] platform_drv_remove+0x1c/0x28
+ [<0028024c>] device_release_driver_internal+0x176/0x17c
+ [<002800d6>] device_release_driver_internal+0x0/0x17c
+ [<00279a1a>] get_device+0x0/0x22
+ [<00279a58>] put_device+0x0/0x18
+ [<002802e0>] driver_detach+0x56/0x82
+ [<002805d2>] driver_remove_file+0x0/0x24
+ [<0027f088>] bus_remove_driver+0x4c/0xa4
+ [<00280776>] driver_unregister+0x28/0x5a
+ [<00281a00>] platform_driver_unregister+0x12/0x18
+ [<2187d2a0>] ide_falcon_driver_exit+0x10/0x16 [falconide]
+ [<000764f0>] sys_delete_module+0x110/0x1f2
+ [<000e83ea>] sys_rename+0x1a/0x1e
+ [<00002e0c>] syscall+0x8/0xc
+ [<00188004>] ext4_multi_mount_protect+0x35a/0x3ce
+Code: 0029 9188 4bf9 0027 aa1c 283c 003c ef32 <265c> 4a8b 6700 00b8 2043 2028 000c 0280 00ff ff00 6600 0176 40c0 7202 b2b9 004c
+Disabling lock debugging due to kernel taint
+
+This happens because the driver_data pointer is uninitialized.
+Add the missing platform_set_drvdata() call. For clarity, use the
+matching platform_get_drvdata() as well.
+
+Cc: Michael Schmitz <schmitzmic@gmail.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Fixes: 5ed0794cde593 ("m68k/atari: Convert Falcon IDE drivers to platform drivers")
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/falconide.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ide/falconide.c b/drivers/ide/falconide.c
+index 77af4c1a3f38c..bb86d84558d9a 100644
+--- a/drivers/ide/falconide.c
++++ b/drivers/ide/falconide.c
+@@ -164,6 +164,7 @@ static int __init falconide_init(struct platform_device *pdev)
+ if (rc)
+ goto err_free;
+
++ platform_set_drvdata(pdev, host);
+ return 0;
+ err_free:
+ ide_host_free(host);
+@@ -174,7 +175,7 @@ err:
+
+ static int falconide_remove(struct platform_device *pdev)
+ {
+- struct ide_host *host = dev_get_drvdata(&pdev->dev);
++ struct ide_host *host = platform_get_drvdata(pdev);
+
+ ide_host_remove(host);
+
+--
+2.27.0
+
--- /dev/null
+From 10d6ba3327e9887dbbc6dc9700b36df732149e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 09:49:51 -0800
+Subject: ima: Free IMA measurement buffer after kexec syscall
+
+From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+
+[ Upstream commit f31e3386a4e92ba6eda7328cb508462956c94c64 ]
+
+IMA allocates kernel virtual memory to carry forward the measurement
+list, from the current kernel to the next kernel on kexec system call,
+in ima_add_kexec_buffer() function. This buffer is not freed before
+completing the kexec system call resulting in memory leak.
+
+Add ima_buffer field in "struct kimage" to store the virtual address
+of the buffer allocated for the IMA measurement list.
+Free the memory allocated for the IMA measurement list in
+kimage_file_post_load_cleanup() function.
+
+Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Suggested-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list")
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kexec.h | 5 +++++
+ kernel/kexec_file.c | 5 +++++
+ security/integrity/ima/ima_kexec.c | 2 ++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/include/linux/kexec.h b/include/linux/kexec.h
+index 9e93bef529680..5f61389f5f361 100644
+--- a/include/linux/kexec.h
++++ b/include/linux/kexec.h
+@@ -300,6 +300,11 @@ struct kimage {
+ /* Information for loading purgatory */
+ struct purgatory_info purgatory_info;
+ #endif
++
++#ifdef CONFIG_IMA_KEXEC
++ /* Virtual address of IMA measurement buffer for kexec syscall */
++ void *ima_buffer;
++#endif
+ };
+
+ /* kexec interface functions */
+diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
+index b02086d704923..5c3447cf7ad58 100644
+--- a/kernel/kexec_file.c
++++ b/kernel/kexec_file.c
+@@ -166,6 +166,11 @@ void kimage_file_post_load_cleanup(struct kimage *image)
+ vfree(pi->sechdrs);
+ pi->sechdrs = NULL;
+
++#ifdef CONFIG_IMA_KEXEC
++ vfree(image->ima_buffer);
++ image->ima_buffer = NULL;
++#endif /* CONFIG_IMA_KEXEC */
++
+ /* See if architecture has anything to cleanup post load */
+ arch_kimage_file_post_load_cleanup(image);
+
+diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
+index 206ddcaa5c67a..e29bea3dd4ccd 100644
+--- a/security/integrity/ima/ima_kexec.c
++++ b/security/integrity/ima/ima_kexec.c
+@@ -129,6 +129,8 @@ void ima_add_kexec_buffer(struct kimage *image)
+ return;
+ }
+
++ image->ima_buffer = kexec_buffer;
++
+ pr_debug("kexec measurement buffer for the loaded kernel at 0x%lx.\n",
+ kbuf.mem);
+ }
+--
+2.27.0
+
--- /dev/null
+From e28dab13aa712d8d0fe864d77ba6afd51d1890d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 09:49:50 -0800
+Subject: ima: Free IMA measurement buffer on error
+
+From: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+
+[ Upstream commit 6d14c6517885fa68524238787420511b87d671df ]
+
+IMA allocates kernel virtual memory to carry forward the measurement
+list, from the current kernel to the next kernel on kexec system call,
+in ima_add_kexec_buffer() function. In error code paths this memory
+is not freed resulting in memory leak.
+
+Free the memory allocated for the IMA measurement list in
+the error code paths in ima_add_kexec_buffer() function.
+
+Signed-off-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
+Suggested-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Fixes: 7b8589cc29e7 ("ima: on soft reboot, save the measurement list")
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_kexec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/integrity/ima/ima_kexec.c b/security/integrity/ima/ima_kexec.c
+index 121de3e04af23..206ddcaa5c67a 100644
+--- a/security/integrity/ima/ima_kexec.c
++++ b/security/integrity/ima/ima_kexec.c
+@@ -119,6 +119,7 @@ void ima_add_kexec_buffer(struct kimage *image)
+ ret = kexec_add_buffer(&kbuf);
+ if (ret) {
+ pr_err("Error passing over kexec measurement buffer.\n");
++ vfree(kexec_buffer);
+ return;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From b3760ba608b8f0122315982a1d4302c253d89806 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 17:41:16 -0800
+Subject: Input: da7280 - fix missing error test
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 1e2020aa0da00051d94c4690c023c45d8f3834bd ]
+
+An "if" testing for error condition has accidentally been dropped from
+the code.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: cd3f609823a5 ("Input: new da7280 haptic driver")
+Reviewed-by: Roy Im <Roy.Im.Opensource@diasemi.com>
+Link: https://lore.kernel.org/r/X9j8lGFgijzHyYZZ@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/da7280.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/misc/da7280.c b/drivers/input/misc/da7280.c
+index 37568b00873d4..2f698a8c1d650 100644
+--- a/drivers/input/misc/da7280.c
++++ b/drivers/input/misc/da7280.c
+@@ -863,6 +863,7 @@ static void da7280_parse_properties(struct device *dev,
+ gpi_str3[7] = '0' + i;
+ haptics->gpi_ctl[i].polarity = 0;
+ error = device_property_read_string(dev, gpi_str3, &str);
++ if (!error)
+ haptics->gpi_ctl[i].polarity =
+ da7280_haptic_of_gpi_pol_str(dev, str);
+ }
+--
+2.27.0
+
--- /dev/null
+From 3161079cdd695d9da762bf0f5ee13b97af3e1f95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 10:01:33 -0800
+Subject: Input: da7280 - protect OF match table with CONFIG_OF
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 6d2ad82fece2f5adcafe77252614fcf7211dec28 ]
+
+The OF match table is only used when OF is enabled.
+
+Fixes: cd3f609823a5 ("Input: new da7280 haptic driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Acked-by: Roy Im <roy.im.opensource@diasemi.com>
+Link: https://lore.kernel.org/r/X9xRLVPt9eBi0CT6@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/da7280.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/misc/da7280.c b/drivers/input/misc/da7280.c
+index 2f698a8c1d650..b08610d6e575e 100644
+--- a/drivers/input/misc/da7280.c
++++ b/drivers/input/misc/da7280.c
+@@ -1300,11 +1300,13 @@ static int __maybe_unused da7280_resume(struct device *dev)
+ return retval;
+ }
+
++#ifdef CONFIG_OF
+ static const struct of_device_id da7280_of_match[] = {
+ { .compatible = "dlg,da7280", },
+ { }
+ };
+ MODULE_DEVICE_TABLE(of, da7280_of_match);
++#endif
+
+ static const struct i2c_device_id da7280_i2c_id[] = {
+ { "da7280", },
+--
+2.27.0
+
--- /dev/null
+From eb23e7f93752ad5885831f7d0234786ebef8c417 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 20:29:05 -0800
+Subject: Input: elo - fix an error code in elo_connect()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0958351e93fa0ac142f6dd8bd844441594f30a57 ]
+
+If elo_setup_10() fails then this should return an error code instead
+of success.
+
+Fixes: fae3006e4b42 ("Input: elo - add support for non-pressure-sensitive touchscreens")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YBKFd5CvDu+jVmfW@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/elo.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/elo.c b/drivers/input/touchscreen/elo.c
+index e0bacd34866ad..96173232e53fe 100644
+--- a/drivers/input/touchscreen/elo.c
++++ b/drivers/input/touchscreen/elo.c
+@@ -341,8 +341,10 @@ static int elo_connect(struct serio *serio, struct serio_driver *drv)
+ switch (elo->id) {
+
+ case 0: /* 10-byte protocol */
+- if (elo_setup_10(elo))
++ if (elo_setup_10(elo)) {
++ err = -EIO;
+ goto fail3;
++ }
+
+ break;
+
+--
+2.27.0
+
--- /dev/null
+From d5f84992fbb6b1f55bf99adac6de51865b223fe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 10:03:12 -0800
+Subject: Input: imx_keypad - add dependency on HAS_IOMEM
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit f5cace4b93d736cef348211ae0814cabdd26d86a ]
+
+devm_platform_ioremap_resource() depends on CONFIG_HAS_IOMEM, so let's add
+it to the dependencies when COMPILE_TEST is enabled.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Fixes: c8834032ffe2 ("Input: imx_keypad - add COMPILE_TEST support")
+Link: https://lore.kernel.org/r/X9llpA3w1zlZCHXU@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
+index 2b321c17054ad..94eab82086b27 100644
+--- a/drivers/input/keyboard/Kconfig
++++ b/drivers/input/keyboard/Kconfig
+@@ -446,7 +446,7 @@ config KEYBOARD_MPR121
+
+ config KEYBOARD_SNVS_PWRKEY
+ tristate "IMX SNVS Power Key Driver"
+- depends on ARCH_MXC || COMPILE_TEST
++ depends on ARCH_MXC || (COMPILE_TEST && HAS_IOMEM)
+ depends on OF
+ help
+ This is the snvs powerkey driver for the Freescale i.MX application
+--
+2.27.0
+
--- /dev/null
+From 1abc7b445e080c232d11337c2d977c45575361e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 10:37:00 -0800
+Subject: Input: st1232 - add IDLE state as ready condition
+
+From: Michael Tretter <m.tretter@pengutronix.de>
+
+[ Upstream commit 6524d8eac258452e547f8a49c8a965ac6dd8a161 ]
+
+The st1232 can switch from NORMAL to IDLE state after the configured
+idle time (by default 8 s). If the st1232 is not reset during probe, it
+might already be ready but in IDLE state. Since it does not enter NORMAL
+state in this case, probe fails.
+
+Fix the wait function to report the IDLE state as ready, too.
+
+Fixes: f605be6a57b4 ("Input: st1232 - wait until device is ready before reading resolution")
+Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
+Link: https://lore.kernel.org/r/20210219110556.1858969-1-m.tretter@pengutronix.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/st1232.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
+index b4e7bcbe9b91d..885f0572488dd 100644
+--- a/drivers/input/touchscreen/st1232.c
++++ b/drivers/input/touchscreen/st1232.c
+@@ -94,7 +94,7 @@ static int st1232_ts_wait_ready(struct st1232_ts_data *ts)
+
+ for (retries = 10; retries; retries--) {
+ error = st1232_ts_read_data(ts, REG_STATUS, 1);
+- if (!error && ts->read_buf[0] == (STATUS_NORMAL | ERROR_NONE))
++ if (!error && ts->read_buf[0] == (STATUS_NORMAL | STATUS_IDLE | ERROR_NONE))
+ return 0;
+
+ usleep_range(1000, 2000);
+--
+2.27.0
+
--- /dev/null
+From 619ef8e1c8e75ba4eb764c2ed3cccde72006f6aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Feb 2021 09:30:09 -0800
+Subject: Input: st1232 - fix NORMAL vs. IDLE state handling
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1bff77f41a805b16b5355497c217656711601282 ]
+
+NORMAL (0x0) and IDLE (0x4) are really two different states. Hence you
+cannot check for both using a bitmask, as that checks for IDLE only,
+breaking operation for devices that are in NORMAL state.
+
+Fix the wait function to report either state as ready.
+
+Fixes: 6524d8eac258452e ("Input: st1232 - add IDLE state as ready condition")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
+Link: https://lore.kernel.org/r/20210223090201.1430542-1-geert+renesas@glider.be
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/st1232.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c
+index 885f0572488dd..6abae665ca71d 100644
+--- a/drivers/input/touchscreen/st1232.c
++++ b/drivers/input/touchscreen/st1232.c
+@@ -94,8 +94,13 @@ static int st1232_ts_wait_ready(struct st1232_ts_data *ts)
+
+ for (retries = 10; retries; retries--) {
+ error = st1232_ts_read_data(ts, REG_STATUS, 1);
+- if (!error && ts->read_buf[0] == (STATUS_NORMAL | STATUS_IDLE | ERROR_NONE))
+- return 0;
++ if (!error) {
++ switch (ts->read_buf[0]) {
++ case STATUS_NORMAL | ERROR_NONE:
++ case STATUS_IDLE | ERROR_NONE:
++ return 0;
++ }
++ }
+
+ usleep_range(1000, 2000);
+ }
+--
+2.27.0
+
--- /dev/null
+From a49361d547c9b7bcdccd63e4ccc07abd0a500dc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 20:30:45 -0800
+Subject: Input: sur40 - fix an error code in sur40_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b0b7d2815839024e5181bd2572f5d8d4f65363b3 ]
+
+If v4l2_ctrl_handler_setup() fails then probe() should return an error
+code instead of returning success.
+
+Fixes: cee1e3e2ef39 ("media: add video control handlers using V4L2 control framework")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YBKFkbATXa5fA3xj@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/sur40.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
+index 620cdd7d214a6..12f2562b0141b 100644
+--- a/drivers/input/touchscreen/sur40.c
++++ b/drivers/input/touchscreen/sur40.c
+@@ -787,6 +787,7 @@ static int sur40_probe(struct usb_interface *interface,
+ dev_err(&interface->dev,
+ "Unable to register video controls.");
+ v4l2_ctrl_handler_free(&sur40->hdl);
++ error = sur40->hdl.error;
+ goto err_unreg_v4l2;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 6cd5762c68978df49f09e9b26bd88cac096749fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 10:36:48 -0800
+Subject: Input: zinitix - fix return type of zinitix_init_touch()
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 836f308cb5c72d48e2dff8d3e64c3adb94f4710d ]
+
+zinitix_init_touch() returns error code or 0 for success and therefore
+return type must be int, not bool.
+
+Fixes: 26822652c85e ("Input: add zinitix touchscreen driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Link: https://lore.kernel.org/r/YC8z2bXc3Oy8pABa@google.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/zinitix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscreen/zinitix.c
+index a3e3adbabc673..b1548971d683e 100644
+--- a/drivers/input/touchscreen/zinitix.c
++++ b/drivers/input/touchscreen/zinitix.c
+@@ -190,7 +190,7 @@ static int zinitix_write_cmd(struct i2c_client *client, u16 reg)
+ return 0;
+ }
+
+-static bool zinitix_init_touch(struct bt541_ts_data *bt541)
++static int zinitix_init_touch(struct bt541_ts_data *bt541)
+ {
+ struct i2c_client *client = bt541->client;
+ int i;
+--
+2.27.0
+
--- /dev/null
+From 3199d2deb946019f95232f69010176978b30506d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 16:34:21 +0800
+Subject: io_uring: fix possible deadlock in io_uring_poll
+
+From: Hao Xu <haoxu@linux.alibaba.com>
+
+[ Upstream commit ed670c3f90a67d9e16ab6d8893be6f072d79cd4c ]
+
+Abaci reported follow issue:
+
+[ 30.615891] ======================================================
+[ 30.616648] WARNING: possible circular locking dependency detected
+[ 30.617423] 5.11.0-rc3-next-20210115 #1 Not tainted
+[ 30.618035] ------------------------------------------------------
+[ 30.618914] a.out/1128 is trying to acquire lock:
+[ 30.619520] ffff88810b063868 (&ep->mtx){+.+.}-{3:3}, at: __ep_eventpoll_poll+0x9f/0x220
+[ 30.620505]
+[ 30.620505] but task is already holding lock:
+[ 30.621218] ffff88810e952be8 (&ctx->uring_lock){+.+.}-{3:3}, at: __x64_sys_io_uring_enter+0x3f0/0x5b0
+[ 30.622349]
+[ 30.622349] which lock already depends on the new lock.
+[ 30.622349]
+[ 30.623289]
+[ 30.623289] the existing dependency chain (in reverse order) is:
+[ 30.624243]
+[ 30.624243] -> #1 (&ctx->uring_lock){+.+.}-{3:3}:
+[ 30.625263] lock_acquire+0x2c7/0x390
+[ 30.625868] __mutex_lock+0xae/0x9f0
+[ 30.626451] io_cqring_overflow_flush.part.95+0x6d/0x70
+[ 30.627278] io_uring_poll+0xcb/0xd0
+[ 30.627890] ep_item_poll.isra.14+0x4e/0x90
+[ 30.628531] do_epoll_ctl+0xb7e/0x1120
+[ 30.629122] __x64_sys_epoll_ctl+0x70/0xb0
+[ 30.629770] do_syscall_64+0x2d/0x40
+[ 30.630332] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 30.631187]
+[ 30.631187] -> #0 (&ep->mtx){+.+.}-{3:3}:
+[ 30.631985] check_prevs_add+0x226/0xb00
+[ 30.632584] __lock_acquire+0x1237/0x13a0
+[ 30.633207] lock_acquire+0x2c7/0x390
+[ 30.633740] __mutex_lock+0xae/0x9f0
+[ 30.634258] __ep_eventpoll_poll+0x9f/0x220
+[ 30.634879] __io_arm_poll_handler+0xbf/0x220
+[ 30.635462] io_issue_sqe+0xa6b/0x13e0
+[ 30.635982] __io_queue_sqe+0x10b/0x550
+[ 30.636648] io_queue_sqe+0x235/0x470
+[ 30.637281] io_submit_sqes+0xcce/0xf10
+[ 30.637839] __x64_sys_io_uring_enter+0x3fb/0x5b0
+[ 30.638465] do_syscall_64+0x2d/0x40
+[ 30.638999] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 30.639643]
+[ 30.639643] other info that might help us debug this:
+[ 30.639643]
+[ 30.640618] Possible unsafe locking scenario:
+[ 30.640618]
+[ 30.641402] CPU0 CPU1
+[ 30.641938] ---- ----
+[ 30.642664] lock(&ctx->uring_lock);
+[ 30.643425] lock(&ep->mtx);
+[ 30.644498] lock(&ctx->uring_lock);
+[ 30.645668] lock(&ep->mtx);
+[ 30.646321]
+[ 30.646321] *** DEADLOCK ***
+[ 30.646321]
+[ 30.647642] 1 lock held by a.out/1128:
+[ 30.648424] #0: ffff88810e952be8 (&ctx->uring_lock){+.+.}-{3:3}, at: __x64_sys_io_uring_enter+0x3f0/0x5b0
+[ 30.649954]
+[ 30.649954] stack backtrace:
+[ 30.650592] CPU: 1 PID: 1128 Comm: a.out Not tainted 5.11.0-rc3-next-20210115 #1
+[ 30.651554] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
+[ 30.652290] Call Trace:
+[ 30.652688] dump_stack+0xac/0xe3
+[ 30.653164] check_noncircular+0x11e/0x130
+[ 30.653747] ? check_prevs_add+0x226/0xb00
+[ 30.654303] check_prevs_add+0x226/0xb00
+[ 30.654845] ? add_lock_to_list.constprop.49+0xac/0x1d0
+[ 30.655564] __lock_acquire+0x1237/0x13a0
+[ 30.656262] lock_acquire+0x2c7/0x390
+[ 30.656788] ? __ep_eventpoll_poll+0x9f/0x220
+[ 30.657379] ? __io_queue_proc.isra.88+0x180/0x180
+[ 30.658014] __mutex_lock+0xae/0x9f0
+[ 30.658524] ? __ep_eventpoll_poll+0x9f/0x220
+[ 30.659112] ? mark_held_locks+0x5a/0x80
+[ 30.659648] ? __ep_eventpoll_poll+0x9f/0x220
+[ 30.660229] ? _raw_spin_unlock_irqrestore+0x2d/0x40
+[ 30.660885] ? trace_hardirqs_on+0x46/0x110
+[ 30.661471] ? __io_queue_proc.isra.88+0x180/0x180
+[ 30.662102] ? __ep_eventpoll_poll+0x9f/0x220
+[ 30.662696] __ep_eventpoll_poll+0x9f/0x220
+[ 30.663273] ? __ep_eventpoll_poll+0x220/0x220
+[ 30.663875] __io_arm_poll_handler+0xbf/0x220
+[ 30.664463] io_issue_sqe+0xa6b/0x13e0
+[ 30.664984] ? __lock_acquire+0x782/0x13a0
+[ 30.665544] ? __io_queue_proc.isra.88+0x180/0x180
+[ 30.666170] ? __io_queue_sqe+0x10b/0x550
+[ 30.666725] __io_queue_sqe+0x10b/0x550
+[ 30.667252] ? __fget_files+0x131/0x260
+[ 30.667791] ? io_req_prep+0xd8/0x1090
+[ 30.668316] ? io_queue_sqe+0x235/0x470
+[ 30.668868] io_queue_sqe+0x235/0x470
+[ 30.669398] io_submit_sqes+0xcce/0xf10
+[ 30.669931] ? xa_load+0xe4/0x1c0
+[ 30.670425] __x64_sys_io_uring_enter+0x3fb/0x5b0
+[ 30.671051] ? lockdep_hardirqs_on_prepare+0xde/0x180
+[ 30.671719] ? syscall_enter_from_user_mode+0x2b/0x80
+[ 30.672380] do_syscall_64+0x2d/0x40
+[ 30.672901] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 30.673503] RIP: 0033:0x7fd89c813239
+[ 30.673962] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 8b 0d 27 ec 2c 00 f7 d8 64 89 01 48
+[ 30.675920] RSP: 002b:00007ffc65a7c628 EFLAGS: 00000217 ORIG_RAX: 00000000000001aa
+[ 30.676791] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd89c813239
+[ 30.677594] RDX: 0000000000000000 RSI: 0000000000000014 RDI: 0000000000000003
+[ 30.678678] RBP: 00007ffc65a7c720 R08: 0000000000000000 R09: 0000000003000000
+[ 30.679492] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000400ff0
+[ 30.680282] R13: 00007ffc65a7c840 R14: 0000000000000000 R15: 0000000000000000
+
+This might happen if we do epoll_wait on a uring fd while reading/writing
+the former epoll fd in a sqe in the former uring instance.
+So let's don't flush cqring overflow list, just do a simple check.
+
+Reported-by: Abaci <abaci@linux.alibaba.com>
+Fixes: 6c503150ae33 ("io_uring: patch up IOPOLL overflow_flush sync")
+Signed-off-by: Hao Xu <haoxu@linux.alibaba.com>
+Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 931671082e615..4d0ede0418571 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -8723,8 +8723,21 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait)
+ smp_rmb();
+ if (!io_sqring_full(ctx))
+ mask |= EPOLLOUT | EPOLLWRNORM;
+- io_cqring_overflow_flush(ctx, false, NULL, NULL);
+- if (io_cqring_events(ctx))
++
++ /*
++ * Don't flush cqring overflow list here, just do a simple check.
++ * Otherwise there could possible be ABBA deadlock:
++ * CPU0 CPU1
++ * ---- ----
++ * lock(&ctx->uring_lock);
++ * lock(&ep->mtx);
++ * lock(&ctx->uring_lock);
++ * lock(&ep->mtx);
++ *
++ * Users may get EPOLLIN meanwhile seeing nothing in cqring, this
++ * pushs them to do the flush.
++ */
++ if (io_cqring_events(ctx) || test_bit(0, &ctx->cq_check_overflow))
+ mask |= EPOLLIN | EPOLLRDNORM;
+
+ return mask;
+--
+2.27.0
+
--- /dev/null
+From d741ae52db62f84f250ddcfb360b2689b0dae15d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 20:29:03 +0800
+Subject: iommu: Move iotlb_sync_map out from __iommu_map
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit d8c1df02ac7f2c802a9b2afc0f5c888c4217f1d5 ]
+
+In the end of __iommu_map, It alway call iotlb_sync_map.
+
+This patch moves iotlb_sync_map out from __iommu_map since it is
+unnecessary to call this for each sg segment especially iotlb_sync_map
+is flush tlb all currently. Add a little helper _iommu_map for this.
+
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20210107122909.16317-2-yong.wu@mediatek.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index ffeebda8d6def..c304a6a30d42e 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -2426,9 +2426,6 @@ static int __iommu_map(struct iommu_domain *domain, unsigned long iova,
+ size -= pgsize;
+ }
+
+- if (ops->iotlb_sync_map)
+- ops->iotlb_sync_map(domain);
+-
+ /* unroll mapping in case something went wrong */
+ if (ret)
+ iommu_unmap(domain, orig_iova, orig_size - size);
+@@ -2438,18 +2435,31 @@ static int __iommu_map(struct iommu_domain *domain, unsigned long iova,
+ return ret;
+ }
+
++static int _iommu_map(struct iommu_domain *domain, unsigned long iova,
++ phys_addr_t paddr, size_t size, int prot, gfp_t gfp)
++{
++ const struct iommu_ops *ops = domain->ops;
++ int ret;
++
++ ret = __iommu_map(domain, iova, paddr, size, prot, GFP_KERNEL);
++ if (ret == 0 && ops->iotlb_sync_map)
++ ops->iotlb_sync_map(domain);
++
++ return ret;
++}
++
+ int iommu_map(struct iommu_domain *domain, unsigned long iova,
+ phys_addr_t paddr, size_t size, int prot)
+ {
+ might_sleep();
+- return __iommu_map(domain, iova, paddr, size, prot, GFP_KERNEL);
++ return _iommu_map(domain, iova, paddr, size, prot, GFP_KERNEL);
+ }
+ EXPORT_SYMBOL_GPL(iommu_map);
+
+ int iommu_map_atomic(struct iommu_domain *domain, unsigned long iova,
+ phys_addr_t paddr, size_t size, int prot)
+ {
+- return __iommu_map(domain, iova, paddr, size, prot, GFP_ATOMIC);
++ return _iommu_map(domain, iova, paddr, size, prot, GFP_ATOMIC);
+ }
+ EXPORT_SYMBOL_GPL(iommu_map_atomic);
+
+@@ -2533,6 +2543,7 @@ static size_t __iommu_map_sg(struct iommu_domain *domain, unsigned long iova,
+ struct scatterlist *sg, unsigned int nents, int prot,
+ gfp_t gfp)
+ {
++ const struct iommu_ops *ops = domain->ops;
+ size_t len = 0, mapped = 0;
+ phys_addr_t start;
+ unsigned int i = 0;
+@@ -2563,6 +2574,8 @@ static size_t __iommu_map_sg(struct iommu_domain *domain, unsigned long iova,
+ sg = sg_next(sg);
+ }
+
++ if (ops->iotlb_sync_map)
++ ops->iotlb_sync_map(domain);
+ return mapped;
+
+ out_err:
+--
+2.27.0
+
--- /dev/null
+From 4dfc613f58a191c45caf190d903cbcf2205259ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 17:06:23 -0800
+Subject: iommu: Properly pass gfp_t in _iommu_map() to avoid atomic sleeping
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b8437a3ef8c485903d05d1f261328aaf0c0a6cc2 ]
+
+Sleeping while atomic = bad. Let's fix an obvious typo to try to avoid it.
+
+The warning that was seen (on a downstream kernel with the problematic
+patch backported):
+
+ BUG: sleeping function called from invalid context at mm/page_alloc.c:4726
+ in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: ksoftirqd/0
+ CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.4.93-12508-gc10c93e28e39 #1
+ Call trace:
+ dump_backtrace+0x0/0x154
+ show_stack+0x20/0x2c
+ dump_stack+0xa0/0xfc
+ ___might_sleep+0x11c/0x12c
+ __might_sleep+0x50/0x84
+ __alloc_pages_nodemask+0xf8/0x2bc
+ __arm_lpae_alloc_pages+0x48/0x1b4
+ __arm_lpae_map+0x124/0x274
+ __arm_lpae_map+0x1cc/0x274
+ arm_lpae_map+0x140/0x170
+ arm_smmu_map+0x78/0xbc
+ __iommu_map+0xd4/0x210
+ _iommu_map+0x4c/0x84
+ iommu_map_atomic+0x44/0x58
+ __iommu_dma_map+0x8c/0xc4
+ iommu_dma_map_page+0xac/0xf0
+
+Fixes: d8c1df02ac7f ("iommu: Move iotlb_sync_map out from __iommu_map")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Yong Wu <yong.wu@mediatek.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20210201170611.1.I64a7b62579287d668d7c89e105dcedf45d641063@changeid
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index c304a6a30d42e..fd5f59373fc62 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -2441,7 +2441,7 @@ static int _iommu_map(struct iommu_domain *domain, unsigned long iova,
+ const struct iommu_ops *ops = domain->ops;
+ int ret;
+
+- ret = __iommu_map(domain, iova, paddr, size, prot, GFP_KERNEL);
++ ret = __iommu_map(domain, iova, paddr, size, prot, gfp);
+ if (ret == 0 && ops->iotlb_sync_map)
+ ops->iotlb_sync_map(domain);
+
+--
+2.27.0
+
--- /dev/null
+From d922b13eef1f97ab9df774c69c7cc3698a51989c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 20:29:06 +0800
+Subject: iommu: Switch gather->end to the inclusive end
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 862c3715de8f3e5350489240c951d697f04bd8c9 ]
+
+Currently gather->end is "unsigned long" which may be overflow in
+arch32 in the corner case: 0xfff00000 + 0x100000(iova + size).
+Although it doesn't affect the size(end - start), it affects the checking
+"gather->end < end"
+
+This patch changes this "end" to the real end address
+(end = start + size - 1). Correspondingly, update the length to
+"end - start + 1".
+
+Fixes: a7d20dc19d9e ("iommu: Introduce struct iommu_iotlb_gather for batching TLB flushes")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20210107122909.16317-5-yong.wu@mediatek.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
+ drivers/iommu/mtk_iommu.c | 2 +-
+ include/linux/iommu.h | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+index 8ca7415d785d9..c70d6e79f5346 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+@@ -2280,7 +2280,7 @@ static void arm_smmu_iotlb_sync(struct iommu_domain *domain,
+ {
+ struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
+
+- arm_smmu_tlb_inv_range(gather->start, gather->end - gather->start,
++ arm_smmu_tlb_inv_range(gather->start, gather->end - gather->start + 1,
+ gather->pgsize, true, smmu_domain);
+ }
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index 8e56cec532e71..bfe6ec329f8d5 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -444,7 +444,7 @@ static void mtk_iommu_iotlb_sync(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather)
+ {
+ struct mtk_iommu_data *data = mtk_iommu_get_m4u_data();
+- size_t length = gather->end - gather->start;
++ size_t length = gather->end - gather->start + 1;
+
+ if (gather->start == ULONG_MAX)
+ return;
+diff --git a/include/linux/iommu.h b/include/linux/iommu.h
+index efa96263b81b3..d63d3e9cc7b67 100644
+--- a/include/linux/iommu.h
++++ b/include/linux/iommu.h
+@@ -170,7 +170,7 @@ enum iommu_dev_features {
+ * struct iommu_iotlb_gather - Range information for a pending IOTLB flush
+ *
+ * @start: IOVA representing the start of the range to be flushed
+- * @end: IOVA representing the end of the range to be flushed (exclusive)
++ * @end: IOVA representing the end of the range to be flushed (inclusive)
+ * @pgsize: The interval at which to perform the flush
+ *
+ * This structure is intended to be updated by multiple calls to the
+@@ -538,7 +538,7 @@ static inline void iommu_iotlb_gather_add_page(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather,
+ unsigned long iova, size_t size)
+ {
+- unsigned long start = iova, end = start + size;
++ unsigned long start = iova, end = start + size - 1;
+
+ /*
+ * If the new page is disjoint from the current range or is mapped at
+--
+2.27.0
+
--- /dev/null
+From f57fd1bf5422314be2864bd49665cb3c99cdb9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 15:56:05 +0100
+Subject: irqchip/imx: IMX_INTMUX should not default to y, unconditionally
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a890caeb2ba40ca183969230e204ab144f258357 ]
+
+Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
+To fix this, restrict the automatic enabling of IMX_INTMUX to ARCH_MXC,
+and ask the user in case of compile-testing.
+
+Fixes: 66968d7dfc3f5451 ("irqchip: Add COMPILE_TEST support for IMX_INTMUX")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210208145605.422943-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
+index b147f22a78f48..d7d1a0fab2c1a 100644
+--- a/drivers/irqchip/Kconfig
++++ b/drivers/irqchip/Kconfig
+@@ -457,7 +457,8 @@ config IMX_IRQSTEER
+ Support for the i.MX IRQSTEER interrupt multiplexer/remapper.
+
+ config IMX_INTMUX
+- def_bool y if ARCH_MXC || COMPILE_TEST
++ bool "i.MX INTMUX support" if COMPILE_TEST
++ default y if ARCH_MXC
+ select IRQ_DOMAIN
+ help
+ Support for the i.MX INTMUX interrupt multiplexer.
+--
+2.27.0
+
--- /dev/null
+From 27d36efd65f222f0964712c9a554d81a333b8b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:50:34 +0800
+Subject: irqchip/ls-extirq: add IRQCHIP_SKIP_SET_WAKE to the irqchip flags
+
+From: Biwen Li <biwen.li@nxp.com>
+
+[ Upstream commit c60767421e102dfd1f4d99ad0cc7f8ba24461eb8 ]
+
+The ls-extirq driver doesn't implement the irq_set_wake()
+callback, while being wake-up capable. This results in
+ugly behaviours across suspend/resume cycles.
+
+Advertise this by adding IRQCHIP_SKIP_SET_WAKE to
+the irqchip flags
+
+Fixes: b16a1caf4686 ("irqchip/ls-extirq: Add LS1043A, LS1088A external interrupt support")
+Signed-off-by: Biwen Li <biwen.li@nxp.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210129095034.33821-1-biwen.li@oss.nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-ls-extirq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-ls-extirq.c b/drivers/irqchip/irq-ls-extirq.c
+index f94f974a87645..853b3972dbe78 100644
+--- a/drivers/irqchip/irq-ls-extirq.c
++++ b/drivers/irqchip/irq-ls-extirq.c
+@@ -64,7 +64,7 @@ static struct irq_chip ls_extirq_chip = {
+ .irq_set_type = ls_extirq_set_type,
+ .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+- .flags = IRQCHIP_SET_TYPE_MASKED,
++ .flags = IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE,
+ };
+
+ static int
+--
+2.27.0
+
--- /dev/null
+From f9103bf024e38f19d170ca42ec5c88c8bbfbf821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 04:04:55 -0800
+Subject: isofs: release buffer head before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 0a6dc67a6aa45f19bd4ff89b4f468fc50c4b8daa ]
+
+Release the buffer_head before returning error code in
+do_isofs_readdir() and isofs_find_entry().
+
+Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem")
+Link: https://lore.kernel.org/r/20210118120455.118955-1-bianpan2016@163.com
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/isofs/dir.c | 1 +
+ fs/isofs/namei.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
+index f0fe641893a5e..b9e6a7ec78be4 100644
+--- a/fs/isofs/dir.c
++++ b/fs/isofs/dir.c
+@@ -152,6 +152,7 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
+ printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ " in block %lu of inode %lu\n", block,
+ inode->i_ino);
++ brelse(bh);
+ return -EIO;
+ }
+
+diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
+index 402769881c32b..58f80e1b3ac0d 100644
+--- a/fs/isofs/namei.c
++++ b/fs/isofs/namei.c
+@@ -102,6 +102,7 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
+ printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+ " in block %lu of inode %lu\n", block,
+ dir->i_ino);
++ brelse(bh);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8951e170593ce40ba92aff6c976d272385149edc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 13:56:34 +0200
+Subject: iwlwifi: mvm: assign SAR table revision to the command later
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 28db1862067cb09ebfdccfbc129a52c6fdb4c4d7 ]
+
+The call to iwl_sar_geo_init() was moved to the end of the
+iwl_mvm_sar_geo_init() function, after the table revision is assigned
+to the FW command. But the revision is only known after
+iwl_sar_geo_init() is called, so we were always assigning zero to it.
+
+Fix that by moving the assignment code after the iwl_sar_geo_init()
+function is called.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: 45acebf8d6a6 ("iwlwifi: fix sar geo table initialization")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210135352.cef55ef3a065.If96c60f08d24c2262c287168a6f0dbd7cf0f8f5c@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 045765fa67bea..4c5609cdcbdee 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -859,12 +859,10 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ if (cmd_ver == 3) {
+ len = sizeof(cmd.v3);
+ n_bands = ARRAY_SIZE(cmd.v3.table[0]);
+- cmd.v3.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
+ } else if (fw_has_api(&mvm->fwrt.fw->ucode_capa,
+ IWL_UCODE_TLV_API_SAR_TABLE_VER)) {
+ len = sizeof(cmd.v2);
+ n_bands = ARRAY_SIZE(cmd.v2.table[0]);
+- cmd.v2.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
+ } else {
+ len = sizeof(cmd.v1);
+ n_bands = ARRAY_SIZE(cmd.v1.table[0]);
+@@ -884,6 +882,16 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ if (ret)
+ return 0;
+
++ /*
++ * Set the revision on versions that contain it.
++ * This must be done after calling iwl_sar_geo_init().
++ */
++ if (cmd_ver == 3)
++ cmd.v3.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
++ else if (fw_has_api(&mvm->fwrt.fw->ucode_capa,
++ IWL_UCODE_TLV_API_SAR_TABLE_VER))
++ cmd.v2.table_revision = cpu_to_le32(mvm->fwrt.geo_rev);
++
+ return iwl_mvm_send_cmd_pdu(mvm,
+ WIDE_ID(PHY_OPS_GROUP, GEO_TX_POWER_LIMIT),
+ 0, len, &cmd);
+--
+2.27.0
+
--- /dev/null
+From a77acfef70316a16c28acaabd90c6a8abe3e50de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 17:15:09 +0200
+Subject: iwlwifi: mvm: don't check if CSA event is running before removing
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit b8a86164454aa745ecb534d7477d50d440ea05b6 ]
+
+We may want to remove it before it started (i.e. before the
+actual switch time).
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 58ddd9b6d194 ("iwlwifi: mvm: don't send a CSA command the firmware doesn't know")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210171218.835db8987b8a.Ic6c5d28d744302db1bc6c4314bd3138ba472f834@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index 4e1bdf13e5e71..0b012f8c9eb22 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -999,9 +999,6 @@ void iwl_mvm_remove_csa_period(struct iwl_mvm *mvm,
+
+ lockdep_assert_held(&mvm->mutex);
+
+- if (!te_data->running)
+- return;
+-
+ spin_lock_bh(&mvm->time_event_lock);
+ id = te_data->id;
+ spin_unlock_bh(&mvm->time_event_lock);
+--
+2.27.0
+
--- /dev/null
+From ae2986e83319f3c7b1afad47fb951e3dfa291519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 13:56:29 +0200
+Subject: iwlwifi: mvm: fix the type we use in the PPAG table validity checks
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 5a6842455c113920001df83cffa28accceeb0927 ]
+
+The value we receive from ACPI is a long long unsigned integer but the
+values should be treated as signed char. When comparing the received
+value with ACPI_PPAG_MIN_LB/HB, we were doing an unsigned comparison,
+so the negative value would actually be treated as a very high number.
+
+To solve this issue, assign the value to our table of s8's before
+making the comparison, so the value is already converted when we do
+so.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210135352.b0ec69f312bc.If77fd9c61a96aa7ef2ac96d935b7efd7df502399@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 9e150c01f7b37..522d547f35d58 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -962,16 +962,23 @@ read_table:
+ union acpi_object *ent;
+
+ ent = &wifi_pkg->package.elements[idx++];
+- if (ent->type != ACPI_TYPE_INTEGER ||
+- (j == 0 && ent->integer.value > ACPI_PPAG_MAX_LB) ||
+- (j == 0 && ent->integer.value < ACPI_PPAG_MIN_LB) ||
+- (j != 0 && ent->integer.value > ACPI_PPAG_MAX_HB) ||
+- (j != 0 && ent->integer.value < ACPI_PPAG_MIN_HB)) {
+- ppag_table.v1.enabled = cpu_to_le32(0);
++ if (ent->type != ACPI_TYPE_INTEGER) {
+ ret = -EINVAL;
+ goto out_free;
+ }
++
+ gain[i * num_sub_bands + j] = ent->integer.value;
++
++ if ((j == 0 &&
++ (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_LB ||
++ gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_LB)) ||
++ (j != 0 &&
++ (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_HB ||
++ gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_HB))) {
++ ppag_table.v1.enabled = cpu_to_le32(0);
++ ret = -EINVAL;
++ goto out_free;
++ }
+ }
+ }
+ ret = 0;
+--
+2.27.0
+
--- /dev/null
+From a6436d209a984f638e6d7e83fe30b93f58d1f45e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 13:56:31 +0200
+Subject: iwlwifi: mvm: send stored PPAG command instead of local
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 659844d391826bfc5c8b4d9a06869ed51d859c76 ]
+
+Some change conflicts apparently cause a confusion between a local
+variable being used to send the PPAG command and the introduction of a
+union for this command. Most parts of the local command were never
+copied from the stored data, so the FW was getting garbage in the
+tables instead of getting valid values.
+
+Fix this by completely removing the local and using only the union
+that we have stored in fwrt.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210135352.d090e0301023.I7d57f4d7da9a3297734c51cf988199323c76916d@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 4d527409428d3..045765fa67bea 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -990,7 +990,6 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ {
+ u8 cmd_ver;
+ int i, j, ret, num_sub_bands, cmd_size;
+- union iwl_ppag_table_cmd ppag_table;
+ s8 *gain;
+
+ if (!fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) {
+@@ -1003,15 +1002,13 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ return 0;
+ }
+
+- ppag_table.v1.enabled = mvm->fwrt.ppag_table.v1.enabled;
+-
+ cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, PHY_OPS_GROUP,
+ PER_PLATFORM_ANT_GAIN_CMD,
+ IWL_FW_CMD_VER_UNKNOWN);
+ if (cmd_ver == 1) {
+ num_sub_bands = IWL_NUM_SUB_BANDS;
+ gain = mvm->fwrt.ppag_table.v1.gain[0];
+- cmd_size = sizeof(ppag_table.v1);
++ cmd_size = sizeof(mvm->fwrt.ppag_table.v1);
+ if (mvm->fwrt.ppag_ver == 2) {
+ IWL_DEBUG_RADIO(mvm,
+ "PPAG table is v2 but FW supports v1, sending truncated table\n");
+@@ -1019,7 +1016,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ } else if (cmd_ver == 2) {
+ num_sub_bands = IWL_NUM_SUB_BANDS_V2;
+ gain = mvm->fwrt.ppag_table.v2.gain[0];
+- cmd_size = sizeof(ppag_table.v2);
++ cmd_size = sizeof(mvm->fwrt.ppag_table.v2);
+ if (mvm->fwrt.ppag_ver == 1) {
+ IWL_DEBUG_RADIO(mvm,
+ "PPAG table is v1 but FW supports v2, sending padded table\n");
+@@ -1039,7 +1036,7 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ IWL_DEBUG_RADIO(mvm, "Sending PER_PLATFORM_ANT_GAIN_CMD\n");
+ ret = iwl_mvm_send_cmd_pdu(mvm, WIDE_ID(PHY_OPS_GROUP,
+ PER_PLATFORM_ANT_GAIN_CMD),
+- 0, cmd_size, &ppag_table);
++ 0, cmd_size, &mvm->fwrt.ppag_table);
+ if (ret < 0)
+ IWL_ERR(mvm, "failed to send PER_PLATFORM_ANT_GAIN_CMD (%d)\n",
+ ret);
+--
+2.27.0
+
--- /dev/null
+From c32495dc78b2499638ab0e88f946266ee6938e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Jan 2021 20:22:06 +0200
+Subject: iwlwifi: mvm: set enabled in the PPAG command properly
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit efaa85cf2294d5e10a724e24356507eeb3836f72 ]
+
+When version 2 of the PER_PLATFORM_ANT_GAIN_CMD was implemented, we
+started copying the values from the command that we have stored into a
+local instance. But we accidentally forgot to copy the enabled flag,
+so in practice PPAG is never really enabled. Fix this by copying the
+flag from our stored data a we should.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210131201908.24d7bf754ad5.I0e8abc2b8747508b6118242533d68c856ca6dffb@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 313e9f106f465..9e150c01f7b37 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -997,6 +997,8 @@ int iwl_mvm_ppag_send_cmd(struct iwl_mvm *mvm)
+ return 0;
+ }
+
++ ppag_table.v1.enabled = mvm->fwrt.ppag_table.v1.enabled;
++
+ cmd_ver = iwl_fw_lookup_cmd_ver(mvm->fw, PHY_OPS_GROUP,
+ PER_PLATFORM_ANT_GAIN_CMD,
+ IWL_FW_CMD_VER_UNKNOWN);
+--
+2.27.0
+
--- /dev/null
+From 1a8d02b86882e97574d581f36c1e80c90a914892 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 13:56:30 +0200
+Subject: iwlwifi: mvm: store PPAG enabled/disabled flag properly
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 551d793f65364c904921ac168d4b4028bb51be69 ]
+
+When reading the PPAG table from ACPI, we should store everything in
+our fwrt structure, so it can be accessed later. But we had a local
+ppag_table variable in the function and were erroneously storing the
+enabled/disabled flag in it instead of storing it in the fwrt. Fix
+this by removing the local variable and storing everything directly in
+fwrt.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: f2134f66f40e ("iwlwifi: acpi: support ppag table command v2")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210135352.889862e6d393.I8b894c1b2b3fe0ad2fb39bf438273ea47eb5afa4@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 522d547f35d58..4d527409428d3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -892,7 +892,6 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ static int iwl_mvm_get_ppag_table(struct iwl_mvm *mvm)
+ {
+ union acpi_object *wifi_pkg, *data, *enabled;
+- union iwl_ppag_table_cmd ppag_table;
+ int i, j, ret, tbl_rev, num_sub_bands;
+ int idx = 2;
+ s8 *gain;
+@@ -946,8 +945,8 @@ read_table:
+ goto out_free;
+ }
+
+- ppag_table.v1.enabled = cpu_to_le32(enabled->integer.value);
+- if (!ppag_table.v1.enabled) {
++ mvm->fwrt.ppag_table.v1.enabled = cpu_to_le32(enabled->integer.value);
++ if (!mvm->fwrt.ppag_table.v1.enabled) {
+ ret = 0;
+ goto out_free;
+ }
+@@ -975,7 +974,7 @@ read_table:
+ (j != 0 &&
+ (gain[i * num_sub_bands + j] > ACPI_PPAG_MAX_HB ||
+ gain[i * num_sub_bands + j] < ACPI_PPAG_MIN_HB))) {
+- ppag_table.v1.enabled = cpu_to_le32(0);
++ mvm->fwrt.ppag_table.v1.enabled = cpu_to_le32(0);
+ ret = -EINVAL;
+ goto out_free;
+ }
+--
+2.27.0
+
--- /dev/null
+From cd9b32921b712f581f8a61dae9d4ff50065f7b8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 17:23:52 +0200
+Subject: iwlwifi: pnvm: increment the pointer before checking the TLV
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit ff11a8ee2d2d0f78514ac9b42fb50c525ca695c7 ]
+
+If the SKU_ID doesn't match, we don't increment the pointer and keep
+checking the same TLV over and over again.
+
+We need to increment the pointer in all situtations, namely if the TLV
+is not a SKU_ID, if the SKU_ID matched or if the SKU_ID didn't match.
+So we can increment the pointer already before checking for these
+conditions to solve the problem.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210172142.de94d366f3ff.I9a5a54906cf0f4ec8af981d6066bfd771152ffb9@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 1e16f83b402b8..37ce4fe136c5e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -198,14 +198,14 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
+ le32_to_cpu(sku_id->data[1]),
+ le32_to_cpu(sku_id->data[2]));
+
++ data += sizeof(*tlv) + ALIGN(tlv_len, 4);
++ len -= ALIGN(tlv_len, 4);
++
+ if (trans->sku_id[0] == le32_to_cpu(sku_id->data[0]) &&
+ trans->sku_id[1] == le32_to_cpu(sku_id->data[1]) &&
+ trans->sku_id[2] == le32_to_cpu(sku_id->data[2])) {
+ int ret;
+
+- data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+- len -= ALIGN(tlv_len, 4);
+-
+ ret = iwl_pnvm_handle_section(trans, data, len);
+ if (!ret)
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 71364a9571ac30f81bcd12d1bf67cb1d8a8e3aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 17:23:50 +0200
+Subject: iwlwifi: pnvm: set the PNVM again if it was already loaded
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 4a81598f0f39cffbf1c29c4a184063d513661c4a ]
+
+When the interface goes up, we have already loaded the PNVM during
+init, so we don't load it anymore. But we still need to set the PNVM
+values in the context so that the FW can load it again.
+
+Call set_pnvm when the PNVM is already loaded and change the
+trans_pcie implementation to accept a second call to set_pnvm when we
+have already allocated and, in this case, only set the values without
+allocating again.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Fixes: 6972592850c0 ("iwlwifi: read and parse PNVM file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210210172142.622546a3566f.I659a8b9aa944d213c4ba446e142d74f3f6db9c64@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 7 ++++++-
+ .../intel/iwlwifi/pcie/ctxt-info-gen3.c | 21 +++++++++++--------
+ 2 files changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 895a907acdf0f..1e16f83b402b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -227,6 +227,7 @@ int iwl_pnvm_load(struct iwl_trans *trans,
+ struct iwl_notification_wait pnvm_wait;
+ static const u16 ntf_cmds[] = { WIDE_ID(REGULATORY_AND_NVM_GROUP,
+ PNVM_INIT_COMPLETE_NTFY) };
++ int ret;
+
+ /* if the SKU_ID is empty, there's nothing to do */
+ if (!trans->sku_id[0] && !trans->sku_id[1] && !trans->sku_id[2])
+@@ -236,7 +237,6 @@ int iwl_pnvm_load(struct iwl_trans *trans,
+ if (!trans->pnvm_loaded) {
+ const struct firmware *pnvm;
+ char pnvm_name[64];
+- int ret;
+
+ /*
+ * The prefix unfortunately includes a hyphen at the end, so
+@@ -264,6 +264,11 @@ int iwl_pnvm_load(struct iwl_trans *trans,
+
+ release_firmware(pnvm);
+ }
++ } else {
++ /* if we already loaded, we need to set it again */
++ ret = iwl_trans_set_pnvm(trans, NULL, 0);
++ if (ret)
++ return ret;
+ }
+
+ iwl_init_notification_wait(notif_wait, &pnvm_wait,
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+index 5b5134dd49af8..8fba190e84cf3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -298,17 +298,20 @@ int iwl_trans_pcie_ctx_info_gen3_set_pnvm(struct iwl_trans *trans,
+ if (trans->trans_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
+ return 0;
+
+- ret = iwl_pcie_ctxt_info_alloc_dma(trans, data, len,
+- &trans_pcie->pnvm_dram);
+- if (ret < 0) {
+- IWL_DEBUG_FW(trans, "Failed to allocate PNVM DMA %d.\n",
+- ret);
+- return ret;
++ /* only allocate the DRAM if not allocated yet */
++ if (!trans->pnvm_loaded) {
++ if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
++ return -EBUSY;
++
++ ret = iwl_pcie_ctxt_info_alloc_dma(trans, data, len,
++ &trans_pcie->pnvm_dram);
++ if (ret < 0) {
++ IWL_DEBUG_FW(trans, "Failed to allocate PNVM DMA %d.\n",
++ ret);
++ return ret;
++ }
+ }
+
+- if (WARN_ON(prph_sc_ctrl->pnvm_cfg.pnvm_size))
+- return -EBUSY;
+-
+ prph_sc_ctrl->pnvm_cfg.pnvm_base_addr =
+ cpu_to_le64(trans_pcie->pnvm_dram.physical);
+ prph_sc_ctrl->pnvm_cfg.pnvm_size =
+--
+2.27.0
+
--- /dev/null
+From e5bb64314452d85d7fb77d9b076ec960de796f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 06:56:04 -0800
+Subject: jffs2: fix use after free in jffs2_sum_write_data()
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 19646447ad3a680d2ab08c097585b7d96a66126b ]
+
+clang static analysis reports this problem
+
+fs/jffs2/summary.c:794:31: warning: Use of memory after it is freed
+ c->summary->sum_list_head = temp->u.next;
+ ^~~~~~~~~~~~
+
+In jffs2_sum_write_data(), in a loop summary data is handles a node at
+a time. When it has written out the node it is removed the summary list,
+and the node is deleted. In the corner case when a
+JFFS2_FEATURE_RWCOMPAT_COPY is seen, a call is made to
+jffs2_sum_disable_collecting(). jffs2_sum_disable_collecting() deletes
+the whole list which conflicts with the loop's deleting the list by parts.
+
+To preserve the old behavior of stopping the write midway, bail out of
+the loop after disabling summary collection.
+
+Fixes: 6171586a7ae5 ("[JFFS2] Correct handling of JFFS2_FEATURE_RWCOMPAT_COPY nodes.")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jffs2/summary.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/jffs2/summary.c b/fs/jffs2/summary.c
+index be7c8a6a57480..4fe64519870f1 100644
+--- a/fs/jffs2/summary.c
++++ b/fs/jffs2/summary.c
+@@ -783,6 +783,8 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+ dbg_summary("Writing unknown RWCOMPAT_COPY node type %x\n",
+ je16_to_cpu(temp->u.nodetype));
+ jffs2_sum_disable_collecting(c->summary);
++ /* The above call removes the list, nothing more to do */
++ goto bail_rwcompat;
+ } else {
+ BUG(); /* unknown node in summary information */
+ }
+@@ -794,6 +796,7 @@ static int jffs2_sum_write_data(struct jffs2_sb_info *c, struct jffs2_eraseblock
+
+ c->summary->sum_num--;
+ }
++ bail_rwcompat:
+
+ jffs2_sum_reset_collected(c->summary);
+
+--
+2.27.0
+
--- /dev/null
+From e17e0b96195ed4df7aa4daaac2170f710ae0651c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 12:02:09 +0100
+Subject: kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 71a076f4a61a6c779794ad286f356b39725edc3b ]
+
+Rewrite kcsan_prandom_u32_max() to not depend on code that might be
+instrumented, removing any dependency on lib/random32.c. The rewrite
+implements a simple linear congruential generator, that is sufficient
+for our purposes (for udelay() and skip_watch counter randomness).
+
+The initial motivation for this was to allow enabling KCSAN for
+kernel/sched (remove KCSAN_SANITIZE := n from kernel/sched/Makefile),
+with CONFIG_DEBUG_PREEMPT=y. Without this change, we could observe
+recursion:
+
+ check_access() [via instrumentation]
+ kcsan_setup_watchpoint()
+ reset_kcsan_skip()
+ kcsan_prandom_u32_max()
+ get_cpu_var()
+ preempt_disable()
+ preempt_count_add() [in kernel/sched/core.c]
+ check_access() [via instrumentation]
+
+Note, while this currently does not affect an unmodified kernel, it'd be
+good to keep a KCSAN kernel working when KCSAN_SANITIZE := n is removed
+from kernel/sched/Makefile to permit testing scheduler code with KCSAN
+if desired.
+
+Fixes: cd290ec24633 ("kcsan: Use tracing-safe version of prandom")
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/kcsan/core.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/kcsan/core.c b/kernel/kcsan/core.c
+index 3994a217bde76..3bf98db9c702d 100644
+--- a/kernel/kcsan/core.c
++++ b/kernel/kcsan/core.c
+@@ -12,7 +12,6 @@
+ #include <linux/moduleparam.h>
+ #include <linux/percpu.h>
+ #include <linux/preempt.h>
+-#include <linux/random.h>
+ #include <linux/sched.h>
+ #include <linux/uaccess.h>
+
+@@ -101,7 +100,7 @@ static atomic_long_t watchpoints[CONFIG_KCSAN_NUM_WATCHPOINTS + NUM_SLOTS-1];
+ static DEFINE_PER_CPU(long, kcsan_skip);
+
+ /* For kcsan_prandom_u32_max(). */
+-static DEFINE_PER_CPU(struct rnd_state, kcsan_rand_state);
++static DEFINE_PER_CPU(u32, kcsan_rand_state);
+
+ static __always_inline atomic_long_t *find_watchpoint(unsigned long addr,
+ size_t size,
+@@ -275,20 +274,17 @@ should_watch(const volatile void *ptr, size_t size, int type, struct kcsan_ctx *
+ }
+
+ /*
+- * Returns a pseudo-random number in interval [0, ep_ro). See prandom_u32_max()
+- * for more details.
+- *
+- * The open-coded version here is using only safe primitives for all contexts
+- * where we can have KCSAN instrumentation. In particular, we cannot use
+- * prandom_u32() directly, as its tracepoint could cause recursion.
++ * Returns a pseudo-random number in interval [0, ep_ro). Simple linear
++ * congruential generator, using constants from "Numerical Recipes".
+ */
+ static u32 kcsan_prandom_u32_max(u32 ep_ro)
+ {
+- struct rnd_state *state = &get_cpu_var(kcsan_rand_state);
+- const u32 res = prandom_u32_state(state);
++ u32 state = this_cpu_read(kcsan_rand_state);
++
++ state = 1664525 * state + 1013904223;
++ this_cpu_write(kcsan_rand_state, state);
+
+- put_cpu_var(kcsan_rand_state);
+- return (u32)(((u64) res * ep_ro) >> 32);
++ return state % ep_ro;
+ }
+
+ static inline void reset_kcsan_skip(void)
+@@ -639,10 +635,14 @@ static __always_inline void check_access(const volatile void *ptr, size_t size,
+
+ void __init kcsan_init(void)
+ {
++ int cpu;
++
+ BUG_ON(!in_task());
+
+ kcsan_debugfs_init();
+- prandom_seed_full_state(&kcsan_rand_state);
++
++ for_each_possible_cpu(cpu)
++ per_cpu(kcsan_rand_state, cpu) = (u32)get_cycles();
+
+ /*
+ * We are in the init task, and no other tasks should be running;
+--
+2.27.0
+
--- /dev/null
+From 9f74290295356dc556b6254c0ccc94668699ac10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 03:05:10 +0000
+Subject: kselftests: dmabuf-heaps: Fix Makefile's inclusion of the kernel's
+ usr/include dir
+
+From: John Stultz <john.stultz@linaro.org>
+
+[ Upstream commit 64ba3d591c9d2be2a9c09e99b00732afe002ad0d ]
+
+Copied in from somewhere else, the makefile was including
+the kerne's usr/include dir, which caused the asm/ioctl.h file
+to be used.
+
+Unfortunately, that file has different values for _IOC_SIZEBITS
+and _IOC_WRITE than include/uapi/asm-generic/ioctl.h which then
+causes the _IOCW macros to give the wrong ioctl numbers,
+specifically for DMA_BUF_IOCTL_SYNC.
+
+This patch simply removes the extra include from the Makefile
+
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Brian Starkey <brian.starkey@arm.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Laura Abbott <labbott@kernel.org>
+Cc: Hridya Valsaraju <hridya@google.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Sandeep Patil <sspatil@google.com>
+Cc: Daniel Mentz <danielmentz@google.com>
+Cc: linux-media@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-kselftest@vger.kernel.org
+Fixes: a8779927fd86c ("kselftests: Add dma-heap test")
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/dmabuf-heaps/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/dmabuf-heaps/Makefile b/tools/testing/selftests/dmabuf-heaps/Makefile
+index 607c2acd20829..604b43ece15f5 100644
+--- a/tools/testing/selftests/dmabuf-heaps/Makefile
++++ b/tools/testing/selftests/dmabuf-heaps/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0
+-CFLAGS += -static -O3 -Wl,-no-as-needed -Wall -I../../../../usr/include
++CFLAGS += -static -O3 -Wl,-no-as-needed -Wall
+
+ TEST_GEN_PROGS = dmabuf-heap
+
+--
+2.27.0
+
--- /dev/null
+From e302a5b76f2e9dabd20082a57e4f7f861a8925f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:08:21 -0800
+Subject: kunit: tool: fix unit test cleanup handling
+
+From: Daniel Latypov <dlatypov@google.com>
+
+[ Upstream commit cfd607e43da4a20753744f134e201310262b827a ]
+
+* Stop leaking file objects.
+* Use self.addCleanup() to ensure we call cleanup functions even if
+setUp() fails.
+* use mock.patch.stopall instead of more error-prone manual approach
+
+Signed-off-by: Daniel Latypov <dlatypov@google.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Tested-by: Brendan Higgins <brendanhiggins@google.com>
+Acked-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/kunit/kunit_tool_test.py | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/kunit/kunit_tool_test.py b/tools/testing/kunit/kunit_tool_test.py
+index b593f4448e839..9a036e9d44554 100755
+--- a/tools/testing/kunit/kunit_tool_test.py
++++ b/tools/testing/kunit/kunit_tool_test.py
+@@ -288,19 +288,17 @@ class StrContains(str):
+ class KUnitMainTest(unittest.TestCase):
+ def setUp(self):
+ path = get_absolute_path('test_data/test_is_test_passed-all_passed.log')
+- file = open(path)
+- all_passed_log = file.readlines()
+- self.print_patch = mock.patch('builtins.print')
+- self.print_mock = self.print_patch.start()
++ with open(path) as file:
++ all_passed_log = file.readlines()
++
++ self.print_mock = mock.patch('builtins.print').start()
++ self.addCleanup(mock.patch.stopall)
++
+ self.linux_source_mock = mock.Mock()
+ self.linux_source_mock.build_reconfig = mock.Mock(return_value=True)
+ self.linux_source_mock.build_um_kernel = mock.Mock(return_value=True)
+ self.linux_source_mock.run_kernel = mock.Mock(return_value=all_passed_log)
+
+- def tearDown(self):
+- self.print_patch.stop()
+- pass
+-
+ def test_config_passes_args_pass(self):
+ kunit.main(['config', '--build_dir=.kunit'], self.linux_source_mock)
+ assert self.linux_source_mock.build_reconfig.call_count == 1
+--
+2.27.0
+
--- /dev/null
+From 235d2ce3248db98f1698fcd751e6fa60e1bbccdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 16:01:07 -0800
+Subject: KVM: nSVM: Don't strip host's C-bit from guest's CR3 when reading
+ PDPTRs
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 2732be90235347a3be4babdc9f88a1ea93970b0b ]
+
+Don't clear the SME C-bit when reading a guest PDPTR, as the GPA (CR3) is
+in the guest domain.
+
+Barring a bizarre paravirtual use case, this is likely a benign bug. SME
+is not emulated by KVM, loading SEV guest PDPTRs is doomed as KVM can't
+use the correct key to read guest memory, and setting guest MAXPHYADDR
+higher than the host, i.e. overlapping the C-bit, would cause faults in
+the guest.
+
+Note, for SEV guests, stripping the C-bit is technically aligned with CPU
+behavior, but for KVM it's the greater of two evils. Because KVM doesn't
+have access to the guest's encryption key, ignoring the C-bit would at
+best result in KVM reading garbage. By keeping the C-bit, KVM will
+fail its read (unless userspace creates a memslot with the C-bit set).
+The guest will still undoubtedly die, as KVM will use '0' for the PDPTR
+value, but that's preferable to interpreting encrypted data as a PDPTR.
+
+Fixes: d0ec49d4de90 ("kvm/x86/svm: Support Secure Memory Encryption within KVM")
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210204000117.3303214-3-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/nested.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
+index db30670dd8c4a..8ded795a18151 100644
+--- a/arch/x86/kvm/svm/nested.c
++++ b/arch/x86/kvm/svm/nested.c
+@@ -58,7 +58,7 @@ static u64 nested_svm_get_tdp_pdptr(struct kvm_vcpu *vcpu, int index)
+ u64 pdpte;
+ int ret;
+
+- ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(__sme_clr(cr3)), &pdpte,
++ ret = kvm_vcpu_read_guest_page(vcpu, gpa_to_gfn(cr3), &pdpte,
+ offset_in_page(cr3) + index * 8, 8);
+ if (ret)
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 498623480125f02b45e969c844da3dd6d3b4264d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 15:32:01 +0100
+Subject: KVM: PPC: Make the VMX instruction emulation routines static
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cédric Le Goater <clg@kaod.org>
+
+[ Upstream commit 9236f57a9e51c72ce426ccd2e53e123de7196a0f ]
+
+These are only used locally. It fixes these W=1 compile errors :
+
+../arch/powerpc/kvm/powerpc.c:1521:5: error: no previous prototype for ‘kvmppc_get_vmx_dword’ [-Werror=missing-prototypes]
+ 1521 | int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ | ^~~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1539:5: error: no previous prototype for ‘kvmppc_get_vmx_word’ [-Werror=missing-prototypes]
+ 1539 | int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ | ^~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1557:5: error: no previous prototype for ‘kvmppc_get_vmx_hword’ [-Werror=missing-prototypes]
+ 1557 | int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ | ^~~~~~~~~~~~~~~~~~~~
+../arch/powerpc/kvm/powerpc.c:1575:5: error: no previous prototype for ‘kvmppc_get_vmx_byte’ [-Werror=missing-prototypes]
+ 1575 | int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
+ | ^~~~~~~~~~~~~~~~~~~
+
+Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction mmio emulation with analyse_instr() input")
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210104143206.695198-19-clg@kaod.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/powerpc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
+index cf52d26f49cd7..25966ae3271ef 100644
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -1518,7 +1518,7 @@ int kvmppc_handle_vmx_load(struct kvm_vcpu *vcpu,
+ return emulated;
+ }
+
+-int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1536,7 +1536,7 @@ int kvmppc_get_vmx_dword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1554,7 +1554,7 @@ int kvmppc_get_vmx_word(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+@@ -1572,7 +1572,7 @@ int kvmppc_get_vmx_hword(struct kvm_vcpu *vcpu, int index, u64 *val)
+ return result;
+ }
+
+-int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
++static int kvmppc_get_vmx_byte(struct kvm_vcpu *vcpu, int index, u64 *val)
+ {
+ union kvmppc_one_reg reg;
+ int vmx_offset = 0;
+--
+2.27.0
+
--- /dev/null
+From adda6a01e0143ecef1148eb2d3e0fc9c289530e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 16:34:09 -0800
+Subject: KVM: SVM: Intercept INVPCID when it's disabled to inject #UD
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 0a8ed2eaac102c746d8d114f2787f06cb3e55dfb ]
+
+Intercept INVPCID if it's disabled in the guest, even when using NPT,
+as KVM needs to inject #UD in this case.
+
+Fixes: 4407a797e941 ("KVM: SVM: Enable INVPCID feature on AMD")
+Cc: Babu Moger <babu.moger@amd.com>
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210212003411.1102677-2-seanjc@google.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/svm/svm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
+index 3442d44ca53b8..825ef6d281c98 100644
+--- a/arch/x86/kvm/svm/svm.c
++++ b/arch/x86/kvm/svm/svm.c
+@@ -1105,12 +1105,12 @@ static u64 svm_write_l1_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
+ static void svm_check_invpcid(struct vcpu_svm *svm)
+ {
+ /*
+- * Intercept INVPCID instruction only if shadow page table is
+- * enabled. Interception is not required with nested page table
+- * enabled.
++ * Intercept INVPCID if shadow paging is enabled to sync/free shadow
++ * roots, or if INVPCID is disabled in the guest to inject #UD.
+ */
+ if (kvm_cpu_cap_has(X86_FEATURE_INVPCID)) {
+- if (!npt_enabled)
++ if (!npt_enabled ||
++ !guest_cpuid_has(&svm->vcpu, X86_FEATURE_INVPCID))
+ svm_set_intercept(svm, INTERCEPT_INVPCID);
+ else
+ svm_clr_intercept(svm, INTERCEPT_INVPCID);
+--
+2.27.0
+
--- /dev/null
+From bfa0f7ac9399c6b0ca3df79b2412c74ed04532da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 16:50:02 -0800
+Subject: KVM: x86/mmu: Expand collapsible SPTE zap for TDP MMU to ZONE_DEVICE
+ and HugeTLB pages
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit c060c72ffeb448fbb5864faa1f672ebfe14dd25f ]
+
+Zap SPTEs that are backed by ZONE_DEVICE pages when zappings SPTEs to
+rebuild them as huge pages in the TDP MMU. ZONE_DEVICE huge pages are
+managed differently than "regular" pages and are not compound pages.
+Likewise, PageTransCompoundMap() will not detect HugeTLB, so switch
+to PageCompound().
+
+This matches the similar check in kvm_mmu_zap_collapsible_spte.
+
+Cc: Ben Gardon <bgardon@google.com>
+Fixes: 14881998566d ("kvm: x86/mmu: Support disabling dirty logging for the tdp MMU")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210213005015.1651772-2-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/mmu/tdp_mmu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
+index b56d604809b8a..17976998bffbc 100644
+--- a/arch/x86/kvm/mmu/tdp_mmu.c
++++ b/arch/x86/kvm/mmu/tdp_mmu.c
+@@ -1067,7 +1067,8 @@ static void zap_collapsible_spte_range(struct kvm *kvm,
+
+ pfn = spte_to_pfn(iter.old_spte);
+ if (kvm_is_reserved_pfn(pfn) ||
+- !PageTransCompoundMap(pfn_to_page(pfn)))
++ (!PageCompound(pfn_to_page(pfn)) &&
++ !kvm_is_zone_device_pfn(pfn)))
+ continue;
+
+ tdp_mmu_set_spte(kvm, &iter, 0);
+--
+2.27.0
+
--- /dev/null
+From 15b1f677411c16e072133a9621adb506b446836c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 17:24:58 -0800
+Subject: KVM: x86: Restore all 64 bits of DR6 and DR7 during RSM on x86-64
+
+From: Sean Christopherson <seanjc@google.com>
+
+[ Upstream commit 2644312052d54e2e7543c7d186899a36ed22f0bf ]
+
+Restore the full 64-bit values of DR6 and DR7 when emulating RSM on
+x86-64, as defined by both Intel's SDM and AMD's APM.
+
+Note, bits 63:32 of DR6 and DR7 are reserved, so this is a glorified nop
+unless the SMM handler is poking into SMRAM, which it most definitely
+shouldn't be doing since both Intel and AMD list the DR6 and DR7 fields
+as read-only.
+
+Fixes: 660a5d517aaa ("KVM: x86: save/load state on SMM switch")
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20210205012458.3872687-3-seanjc@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/emulate.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 66a08322988f2..1453b9b794425 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2564,12 +2564,12 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt,
+ ctxt->_eip = GET_SMSTATE(u64, smstate, 0x7f78);
+ ctxt->eflags = GET_SMSTATE(u32, smstate, 0x7f70) | X86_EFLAGS_FIXED;
+
+- val = GET_SMSTATE(u32, smstate, 0x7f68);
++ val = GET_SMSTATE(u64, smstate, 0x7f68);
+
+ if (ctxt->ops->set_dr(ctxt, 6, (val & DR6_VOLATILE) | DR6_FIXED_1))
+ return X86EMUL_UNHANDLEABLE;
+
+- val = GET_SMSTATE(u32, smstate, 0x7f60);
++ val = GET_SMSTATE(u64, smstate, 0x7f60);
+
+ if (ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1))
+ return X86EMUL_UNHANDLEABLE;
+--
+2.27.0
+
--- /dev/null
+From 4017f2f93f88afb2fd908ec745aa0c35185f3bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 18:10:30 -0800
+Subject: libbpf: Ignore non function pointer member in struct_ops
+
+From: Martin KaFai Lau <kafai@fb.com>
+
+[ Upstream commit d2836dddc95d5dd82c7cb23726c97d8c9147f050 ]
+
+When libbpf initializes the kernel's struct_ops in
+"bpf_map__init_kern_struct_ops()", it enforces all
+pointer types must be a function pointer and rejects
+others. It turns out to be too strict. For example,
+when directly using "struct tcp_congestion_ops" from vmlinux.h,
+it has a "struct module *owner" member and it is set to NULL
+in a bpf_tcp_cc.o.
+
+Instead, it only needs to ensure the member is a function
+pointer if it has been set (relocated) to a bpf-prog.
+This patch moves the "btf_is_func_proto(kern_mtype)" check
+after the existing "if (!prog) { continue; }". The original debug
+message in "if (!prog) { continue; }" is also removed since it is
+no longer valid. Beside, there is a later debug message to tell
+which function pointer is set.
+
+The "btf_is_func_proto(mtype)" has already been guaranteed
+in "bpf_object__collect_st_ops_relos()" which has been run
+before "bpf_map__init_kern_struct_ops()". Thus, this check
+is removed.
+
+v2:
+- Remove outdated debug message (Andrii)
+ Remove because there is a later debug message to tell
+ which function pointer is set.
+- Following mtype->type is no longer needed. Remove:
+ "skip_mods_and_typedefs(btf, mtype->type, &mtype_id)"
+- Do "if (!prog)" test before skip_mods_and_typedefs.
+
+Fixes: 590a00888250 ("bpf: libbpf: Add STRUCT_OPS support")
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210212021030.266932-1-kafai@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 6ae748f6ea118..a0d4fc4de4027 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -883,24 +883,24 @@ static int bpf_map__init_kern_struct_ops(struct bpf_map *map,
+ if (btf_is_ptr(mtype)) {
+ struct bpf_program *prog;
+
+- mtype = skip_mods_and_typedefs(btf, mtype->type, &mtype_id);
++ prog = st_ops->progs[i];
++ if (!prog)
++ continue;
++
+ kern_mtype = skip_mods_and_typedefs(kern_btf,
+ kern_mtype->type,
+ &kern_mtype_id);
+- if (!btf_is_func_proto(mtype) ||
+- !btf_is_func_proto(kern_mtype)) {
+- pr_warn("struct_ops init_kern %s: non func ptr %s is not supported\n",
++
++ /* mtype->type must be a func_proto which was
++ * guaranteed in bpf_object__collect_st_ops_relos(),
++ * so only check kern_mtype for func_proto here.
++ */
++ if (!btf_is_func_proto(kern_mtype)) {
++ pr_warn("struct_ops init_kern %s: kernel member %s is not a func ptr\n",
+ map->name, mname);
+ return -ENOTSUP;
+ }
+
+- prog = st_ops->progs[i];
+- if (!prog) {
+- pr_debug("struct_ops init_kern %s: func ptr %s is not set\n",
+- map->name, mname);
+- continue;
+- }
+-
+ prog->attach_btf_id = kern_type_id;
+ prog->expected_attach_type = kern_member_idx;
+
+--
+2.27.0
+
--- /dev/null
+From 549a27e048de8bdbbd1c87275c8db0e925568adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 11:55:38 +0100
+Subject: locking/lockdep: Avoid unmatched unlock
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 7f82e631d236cafd28518b998c6d4d8dc2ef68f6 ]
+
+Commit f6f48e180404 ("lockdep: Teach lockdep about "USED" <- "IN-NMI"
+inversions") overlooked that print_usage_bug() releases the graph_lock
+and called it without the graph lock held.
+
+Fixes: f6f48e180404 ("lockdep: Teach lockdep about "USED" <- "IN-NMI" inversions")
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Waiman Long <longman@redhat.com>
+Link: https://lkml.kernel.org/r/YBfkuyIfB1+VRxXP@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/lockdep.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index bdaf4829098c0..780012eb2f3fe 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3707,7 +3707,7 @@ static void
+ print_usage_bug(struct task_struct *curr, struct held_lock *this,
+ enum lock_usage_bit prev_bit, enum lock_usage_bit new_bit)
+ {
+- if (!debug_locks_off_graph_unlock() || debug_locks_silent)
++ if (!debug_locks_off() || debug_locks_silent)
+ return;
+
+ pr_warn("\n");
+@@ -3748,6 +3748,7 @@ valid_state(struct task_struct *curr, struct held_lock *this,
+ enum lock_usage_bit new_bit, enum lock_usage_bit bad_bit)
+ {
+ if (unlikely(hlock_class(this)->usage_mask & (1 << bad_bit))) {
++ graph_unlock();
+ print_usage_bug(curr, this, bad_bit, new_bit);
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From ffe781a802ad3ce1265b93a768ba91f21b7c8b08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:53:52 +0000
+Subject: mac80211: fix potential overflow when multiplying to u32 integers
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 6194f7e6473be78acdc5d03edd116944bdbb2c4e ]
+
+The multiplication of the u32 variables tx_time and estimated_retx is
+performed using a 32 bit multiplication and the result is stored in
+a u64 result. This has a potential u32 overflow issue, so avoid this
+by casting tx_time to a u64 to force a 64 bit multiply.
+
+Addresses-Coverity: ("Unintentional integer overflow")
+Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20210205175352.208841-1-colin.king@canonical.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 313eee12410ec..3db514c4c63ab 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -356,7 +356,7 @@ u32 airtime_link_metric_get(struct ieee80211_local *local,
+ */
+ tx_time = (device_constant + 10 * test_frame_len / rate);
+ estimated_retx = ((1 << (2 * ARITH_SHIFT)) / (s_unit - err));
+- result = (tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
++ result = ((u64)tx_time * estimated_retx) >> (2 * ARITH_SHIFT);
+ return (u32)result;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c9ca60b0f37055d03144203025cd0bc45adee3e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 17:19:40 +1100
+Subject: macintosh/adb-iop: Use big-endian autopoll mask
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit c396dd2ec5bbd1cb80eafe32a72ab6bd6b17cb5a ]
+
+As usual, the available documentation is inadequate and leaves endianness
+unspecified for message data. However, testing shows that this patch does
+improve correctness. The mistake should have been detected earlier but it
+was obscured by other bugs. In testing, this patch reinstated pre-v5.9
+behaviour. The old driver bugs remain and ADB input devices may stop
+working. But that appears to be unrelated.
+
+Cc: Joshua Thompson <funaho@jurai.org>
+Fixes: c66da95a39ec ("macintosh/adb-iop: Implement SRQ autopolling")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Link: https://lore.kernel.org/r/20210125074524.3027452-1-geert@linux-m68k.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/adb-iop.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
+index 0ee3272491501..2633bc254935c 100644
+--- a/drivers/macintosh/adb-iop.c
++++ b/drivers/macintosh/adb-iop.c
+@@ -19,6 +19,7 @@
+ #include <asm/macints.h>
+ #include <asm/mac_iop.h>
+ #include <asm/adb_iop.h>
++#include <asm/unaligned.h>
+
+ #include <linux/adb.h>
+
+@@ -249,7 +250,7 @@ static void adb_iop_set_ap_complete(struct iop_msg *msg)
+ {
+ struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
+
+- autopoll_devs = (amsg->data[1] << 8) | amsg->data[0];
++ autopoll_devs = get_unaligned_be16(amsg->data);
+ if (autopoll_devs & (1 << autopoll_addr))
+ return;
+ autopoll_addr = autopoll_devs ? (ffs(autopoll_devs) - 1) : 0;
+@@ -266,8 +267,7 @@ static int adb_iop_autopoll(int devs)
+ amsg.flags = ADB_IOP_SET_AUTOPOLL | (mask ? ADB_IOP_AUTOPOLL : 0);
+ amsg.count = 2;
+ amsg.cmd = 0;
+- amsg.data[0] = mask & 0xFF;
+- amsg.data[1] = (mask >> 8) & 0xFF;
++ put_unaligned_be16(mask, amsg.data);
+
+ iop_send_message(ADB_IOP, ADB_CHAN, NULL, sizeof(amsg), (__u8 *)&amsg,
+ adb_iop_set_ap_complete);
+--
+2.27.0
+
--- /dev/null
+From 8daf51bd2b02927222a1fee8e63ccafdee8cab22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 16:18:19 +0800
+Subject: mailbox: sprd: correct definition of SPRD_OUTBOX_FIFO_FULL
+
+From: Magnum Shan <magnum.shan@unisoc.com>
+
+[ Upstream commit 4450f128c51160bfded6b483eba37d0628d7adb2 ]
+
+According to the specification, bit[2] represents SPRD_OUTBOX_FIFO_FULL,
+not bit[0], so correct it.
+
+Fixes: ca27fc26cd22 ("mailbox: sprd: Add Spreadtrum mailbox driver")
+Signed-off-by: Magnum Shan <magnum.shan@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mailbox/sprd-mailbox.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mailbox/sprd-mailbox.c b/drivers/mailbox/sprd-mailbox.c
+index f6fab24ae8a9a..4c325301a2fe8 100644
+--- a/drivers/mailbox/sprd-mailbox.c
++++ b/drivers/mailbox/sprd-mailbox.c
+@@ -35,7 +35,7 @@
+ #define SPRD_MBOX_IRQ_CLR BIT(0)
+
+ /* Bit and mask definiation for outbox's SPRD_MBOX_FIFO_STS register */
+-#define SPRD_OUTBOX_FIFO_FULL BIT(0)
++#define SPRD_OUTBOX_FIFO_FULL BIT(2)
+ #define SPRD_OUTBOX_FIFO_WR_SHIFT 16
+ #define SPRD_OUTBOX_FIFO_RD_SHIFT 24
+ #define SPRD_OUTBOX_FIFO_POS_MASK GENMASK(7, 0)
+--
+2.27.0
+
--- /dev/null
+From c2ca56c77bc86561d598cc7b4b520e6d62bbefff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 12:54:47 +0100
+Subject: media: allegro: Fix use after free on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ce814ad4bb52bfc7c0472e6da0aa742ab88f4361 ]
+
+The "channel" is added to the "dev->channels" but then if
+v4l2_m2m_ctx_init() fails then we free "channel" but it's still on the
+list so it could lead to a use after free. Let's not add it to the
+list until after v4l2_m2m_ctx_init() succeeds.
+
+Fixes: cc62c74749a3 ("media: allegro: add missed checks in allegro_open()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/allegro-dvt/allegro-core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c
+index 9f718f43282bc..640451134072b 100644
+--- a/drivers/staging/media/allegro-dvt/allegro-core.c
++++ b/drivers/staging/media/allegro-dvt/allegro-core.c
+@@ -2483,8 +2483,6 @@ static int allegro_open(struct file *file)
+ INIT_LIST_HEAD(&channel->buffers_reference);
+ INIT_LIST_HEAD(&channel->buffers_intermediate);
+
+- list_add(&channel->list, &dev->channels);
+-
+ channel->fh.m2m_ctx = v4l2_m2m_ctx_init(dev->m2m_dev, channel,
+ allegro_queue_init);
+
+@@ -2493,6 +2491,7 @@ static int allegro_open(struct file *file)
+ goto error;
+ }
+
++ list_add(&channel->list, &dev->channels);
+ file->private_data = &channel->fh;
+ v4l2_fh_add(&channel->fh);
+
+--
+2.27.0
+
--- /dev/null
+From 8f664408d0fe5784550ea217cb389fc43753a182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 09:27:58 +0100
+Subject: media: aspeed: fix error return code in aspeed_video_setup_video()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit d497fcdab02996a4510d5dd0d743447c737c317a ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/aspeed-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c
+index c46a79eace98b..f2c4dadd6a0eb 100644
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -1551,12 +1551,12 @@ static int aspeed_video_setup_video(struct aspeed_video *video)
+ V4L2_JPEG_CHROMA_SUBSAMPLING_420, mask,
+ V4L2_JPEG_CHROMA_SUBSAMPLING_444);
+
+- if (video->ctrl_handler.error) {
++ rc = video->ctrl_handler.error;
++ if (rc) {
+ v4l2_ctrl_handler_free(&video->ctrl_handler);
+ v4l2_device_unregister(v4l2_dev);
+
+- dev_err(video->dev, "Failed to init controls: %d\n",
+- video->ctrl_handler.error);
++ dev_err(video->dev, "Failed to init controls: %d\n", rc);
+ return rc;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c8539348211eeffaf12ab4f7da3d2400b6cf5be8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 17:27:18 +0100
+Subject: media: atomisp: Fix a buffer overflow in debug code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 625993166b551d633917ca35d4afb7b46d7451b4 ]
+
+The "pad" variable is a user controlled string and we haven't properly
+clamped it at this point so the debug code could print from beyond the
+of the array.
+
+Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/atomisp/pci/atomisp_subdev.c | 24 ++++++++++++-------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.c b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
+index b666cb23e5ca1..2ef5f44e4b6b6 100644
+--- a/drivers/staging/media/atomisp/pci/atomisp_subdev.c
++++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
+@@ -349,12 +349,20 @@ static int isp_subdev_get_selection(struct v4l2_subdev *sd,
+ return 0;
+ }
+
+-static char *atomisp_pad_str[] = { "ATOMISP_SUBDEV_PAD_SINK",
+- "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
+- "ATOMISP_SUBDEV_PAD_SOURCE_VF",
+- "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
+- "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO"
+- };
++static const char *atomisp_pad_str(unsigned int pad)
++{
++ static const char *const pad_str[] = {
++ "ATOMISP_SUBDEV_PAD_SINK",
++ "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
++ "ATOMISP_SUBDEV_PAD_SOURCE_VF",
++ "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
++ "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO",
++ };
++
++ if (pad >= ARRAY_SIZE(pad_str))
++ return "ATOMISP_INVALID_PAD";
++ return pad_str[pad];
++}
+
+ int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
+ struct v4l2_subdev_pad_config *cfg,
+@@ -378,7 +386,7 @@ int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
+
+ dev_dbg(isp->dev,
+ "sel: pad %s tgt %s l %d t %d w %d h %d which %s f 0x%8.8x\n",
+- atomisp_pad_str[pad], target == V4L2_SEL_TGT_CROP
++ atomisp_pad_str(pad), target == V4L2_SEL_TGT_CROP
+ ? "V4L2_SEL_TGT_CROP" : "V4L2_SEL_TGT_COMPOSE",
+ r->left, r->top, r->width, r->height,
+ which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
+@@ -612,7 +620,7 @@ void atomisp_subdev_set_ffmt(struct v4l2_subdev *sd,
+ enum atomisp_input_stream_id stream_id;
+
+ dev_dbg(isp->dev, "ffmt: pad %s w %d h %d code 0x%8.8x which %s\n",
+- atomisp_pad_str[pad], ffmt->width, ffmt->height, ffmt->code,
++ atomisp_pad_str(pad), ffmt->width, ffmt->height, ffmt->code,
+ which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
+ : "V4L2_SUBDEV_FORMAT_ACTIVE");
+
+--
+2.27.0
+
--- /dev/null
+From a2d5bfbe2ae0eadd49d12ddfa5bbc80bbf646786 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 07:50:34 +0100
+Subject: media: camss: Fix signedness bug in video_enum_fmt()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b00481bdca2d77fdae5f71517c09fd3b30eba57d ]
+
+This test has a problem because we want to know if "k" is -1 or a
+positive value less than "f->index". But the "f->index" variable is a
+u32 so if "k == -1" then -1 gets type promoted to UINT_MAX which is
+larger than "f->index". I've added an explicit test to check for -1.
+
+Fixes: a3d412d4b9f3 ("media: Revert "media: camss: Make use of V4L2_CAP_IO_MC"")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Reviewed-by: Andrey Konovalov <andrey.konovalov@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
+index bd9334af1c734..2fa3214775d58 100644
+--- a/drivers/media/platform/qcom/camss/camss-video.c
++++ b/drivers/media/platform/qcom/camss/camss-video.c
+@@ -579,7 +579,7 @@ static int video_enum_fmt(struct file *file, void *fh, struct v4l2_fmtdesc *f)
+ break;
+ }
+
+- if (k < f->index)
++ if (k == -1 || k < f->index)
+ /*
+ * All the unique pixel formats matching the arguments
+ * have been enumerated (k >= 0 and f->index > 0), or
+--
+2.27.0
+
--- /dev/null
+From ee7daac747e8cf07c6d61431571a23ddc16c335d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 07:51:30 +0100
+Subject: media: camss: missing error code in msm_video_register()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9c67ed2ab299123872be14a3dc2ea44ce7e4538b ]
+
+This error path returns success but it should return -EINVAL.
+
+Fixes: cba3819d1e93 ("media: camss: Format configuration per hardware version")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Robert Foss <robert.foss@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/camss/camss-video.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c
+index 2fa3214775d58..97cea7c4d7697 100644
+--- a/drivers/media/platform/qcom/camss/camss-video.c
++++ b/drivers/media/platform/qcom/camss/camss-video.c
+@@ -961,6 +961,7 @@ int msm_video_register(struct camss_video *video, struct v4l2_device *v4l2_dev,
+ video->nformats = ARRAY_SIZE(formats_rdi_8x96);
+ }
+ } else {
++ ret = -EINVAL;
+ goto error_video_register;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c3fa0687aadd21d28893971ec35f7f5f26e7730e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Jan 2021 22:21:46 +0100
+Subject: media: cx25821: Fix a bug when reallocating some dma memory
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b2de3643c5024fc4fd128ba7767c7fb8b714bea7 ]
+
+This function looks like a realloc.
+
+However, if 'risc->cpu != NULL', the memory will be freed, but never
+reallocated with the bigger 'size'.
+Explicitly set 'risc->cpu' to NULL, so that the reallocation is
+correctly performed a few lines below.
+
+[hverkuil: NULL != risc->cpu -> risc->cpu]
+
+Fixes: 5ede94c70553 ("[media] cx25821: remove bogus btcx_risc dependency)
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx25821/cx25821-core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c
+index 6f8ffab8840f4..07b6d0c49bbfa 100644
+--- a/drivers/media/pci/cx25821/cx25821-core.c
++++ b/drivers/media/pci/cx25821/cx25821-core.c
+@@ -976,8 +976,10 @@ int cx25821_riscmem_alloc(struct pci_dev *pci,
+ __le32 *cpu;
+ dma_addr_t dma = 0;
+
+- if (NULL != risc->cpu && risc->size < size)
++ if (risc->cpu && risc->size < size) {
+ pci_free_consistent(pci, risc->size, risc->cpu, risc->dma);
++ risc->cpu = NULL;
++ }
+ if (NULL == risc->cpu) {
+ cpu = pci_zalloc_consistent(pci, size, &dma);
+ if (NULL == cpu)
+--
+2.27.0
+
--- /dev/null
+From 120e375f4036fd299dc1c06b54d6d3c82a4567d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 14:02:05 +0100
+Subject: media: em28xx: Fix use-after-free in em28xx_alloc_urbs
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]
+
+When kzalloc() fails, em28xx_uninit_usb_xfer() will free
+usb_bufs->buf and set it to NULL. Thus the later access
+to usb_bufs->buf[i] will lead to null pointer dereference.
+Also the kfree(usb_bufs->buf) after that is redundant.
+
+Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
+index e6088b5d1b805..3daa64bb1e1d9 100644
+--- a/drivers/media/usb/em28xx/em28xx-core.c
++++ b/drivers/media/usb/em28xx/em28xx-core.c
+@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
+
+ usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
+ if (!usb_bufs->buf[i]) {
+- em28xx_uninit_usb_xfer(dev, mode);
+-
+ for (i--; i >= 0; i--)
+ kfree(usb_bufs->buf[i]);
+
+- kfree(usb_bufs->buf);
+- usb_bufs->buf = NULL;
+-
++ em28xx_uninit_usb_xfer(dev, mode);
+ return -ENOMEM;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 27464f3742f47f31d84ca6c6e2aa349847a71ba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 10:01:48 +0100
+Subject: media: i2c/Kconfig: Select FWNODE for OV772x sensor
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit b7cdd6453ca2c2449c5270f2d0ae88b644a1d2fb ]
+
+Fix OV772x build breakage by selecting V4L2_FWNODE config:
+
+ia64-linux-ld: drivers/media/i2c/ov772x.o: in function `ov772x_probe':
+ov772x.c:(.text+0x1ee2): undefined reference to `v4l2_fwnode_endpoint_alloc_parse'
+ia64-linux-ld: ov772x.c:(.text+0x1f12): undefined reference to `v4l2_fwnode_endpoint_free'
+ia64-linux-ld: ov772x.c:(.text+0x2212): undefined reference to `v4l2_fwnode_endpoint_alloc_parse'
+
+Fixes: 8a10b4e3601e ("media: i2c: ov772x: Parse endpoint properties")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 2b9d81e4794a4..6eed3209ee2d3 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -1000,6 +1000,7 @@ config VIDEO_OV772X
+ tristate "OmniVision OV772x sensor support"
+ depends on I2C && VIDEO_V4L2
+ select REGMAP_SCCB
++ select V4L2_FWNODE
+ help
+ This is a Video4Linux2 sensor driver for the OmniVision
+ OV772x camera.
+--
+2.27.0
+
--- /dev/null
+From 70d7cfac98390b8fe6df99cdb5f17d6a6304479a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Dec 2020 18:52:20 +0100
+Subject: media: i2c: ov5670: Fix PIXEL_RATE minimum value
+
+From: Jacopo Mondi <jacopo@jmondi.org>
+
+[ Upstream commit dc1eb7c9c290cba52937c9a224b22a400bb0ffd7 ]
+
+The driver currently reports a single supported value for
+V4L2_CID_PIXEL_RATE and initializes the control's minimum value to 0,
+which is very risky, as userspace might accidentally use it as divider
+when calculating the time duration of a line.
+
+Fix this by using as minimum the only supported value when registering
+the control.
+
+Fixes: 5de35c9b8dcd1 ("media: i2c: Add Omnivision OV5670 5M sensor support")
+Signed-off-by: Jacopo Mondi <jacopo@jmondi.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5670.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5670.c b/drivers/media/i2c/ov5670.c
+index 148fd4e05029a..866c8c2e8f59a 100644
+--- a/drivers/media/i2c/ov5670.c
++++ b/drivers/media/i2c/ov5670.c
+@@ -2084,7 +2084,8 @@ static int ov5670_init_controls(struct ov5670 *ov5670)
+
+ /* By default, V4L2_CID_PIXEL_RATE is read only */
+ ov5670->pixel_rate = v4l2_ctrl_new_std(ctrl_hdlr, &ov5670_ctrl_ops,
+- V4L2_CID_PIXEL_RATE, 0,
++ V4L2_CID_PIXEL_RATE,
++ link_freq_configs[0].pixel_rate,
+ link_freq_configs[0].pixel_rate,
+ 1,
+ link_freq_configs[0].pixel_rate);
+--
+2.27.0
+
--- /dev/null
+From 9d9b30813c06491a6bbb8359bbae553aa96f4d32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 21:34:40 +0100
+Subject: media: imx: Fix csc/scaler unregister
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit 89b14485caa4b7b2eaf70be0064f0978e68ebeee ]
+
+The csc/scaler device private struct is released by
+ipu_csc_scaler_video_device_release(), which can be called
+by video_unregister_device() if there are no users
+of the underlying struct video device.
+
+Therefore, the mutex can't be held when calling
+video_unregister_device() as its memory may be freed
+by it, leading to a kernel oops.
+
+Fortunately, the fix is quite simple as no locking
+is needed when calling video_unregister_device(): v4l2-core
+already has its own internal locking, and the structures
+are also properly refcounted.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-csc-scaler.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
+index fab1155a5958c..63a0204502a8b 100644
+--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
++++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
+@@ -869,11 +869,7 @@ void imx_media_csc_scaler_device_unregister(struct imx_media_video_dev *vdev)
+ struct ipu_csc_scaler_priv *priv = vdev_to_priv(vdev);
+ struct video_device *vfd = priv->vdev.vfd;
+
+- mutex_lock(&priv->mutex);
+-
+ video_unregister_device(vfd);
+-
+- mutex_unlock(&priv->mutex);
+ }
+
+ struct imx_media_video_dev *
+--
+2.27.0
+
--- /dev/null
+From 2dbb48ab6b92466789d15ce07b37f94f10773586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 21:34:39 +0100
+Subject: media: imx: Unregister csc/scaler only if registered
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+[ Upstream commit bb2216548a2b13cf2942a058b475438a7a6bb028 ]
+
+The csc/scaler device pointer (imxmd->m2m_vdev) is assigned
+after the imx media device v4l2-async probe completes,
+therefore we need to check if the device is non-NULL
+before trying to unregister it.
+
+This can be the case if the non-completed imx media device
+is unbinded (or the driver is removed), leading to a kernel oops.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-dev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
+index 6d2205461e565..338b8bd0bb076 100644
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -53,6 +53,7 @@ static int imx6_media_probe_complete(struct v4l2_async_notifier *notifier)
+ imxmd->m2m_vdev = imx_media_csc_scaler_device_init(imxmd);
+ if (IS_ERR(imxmd->m2m_vdev)) {
+ ret = PTR_ERR(imxmd->m2m_vdev);
++ imxmd->m2m_vdev = NULL;
+ goto unlock;
+ }
+
+@@ -107,10 +108,14 @@ static int imx_media_remove(struct platform_device *pdev)
+
+ v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
+
++ if (imxmd->m2m_vdev) {
++ imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
++ imxmd->m2m_vdev = NULL;
++ }
++
+ v4l2_async_notifier_unregister(&imxmd->notifier);
+ imx_media_unregister_ipu_internal_subdevs(imxmd);
+ v4l2_async_notifier_cleanup(&imxmd->notifier);
+- imx_media_csc_scaler_device_unregister(imxmd->m2m_vdev);
+ media_device_unregister(&imxmd->md);
+ v4l2_device_unregister(&imxmd->v4l2_dev);
+ media_device_cleanup(&imxmd->md);
+--
+2.27.0
+
--- /dev/null
+From 95b2ad4c0dfb8a149a068bb0ccd8f5b57681338b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 11:47:26 +0100
+Subject: media: imx7: csi: Fix pad link validation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rui Miguel Silva <rmfrfs@gmail.com>
+
+[ Upstream commit f5ffb81f51376eb5a12e8c4cb4871426c65bb2af ]
+
+We can not make the assumption that the bound subdev is always a CSI
+mux, in i.MX6UL/i.MX6ULL that is not the case. So, just get the entity
+selected by source directly upstream from the CSI.
+
+Fixes: 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as a CSI mux")
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Tested-by: Fabio Estevam <festevam@gmail.com>
+Tested-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx7-media-csi.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
+index 31e36168f9d0f..ac52b1daf9914 100644
+--- a/drivers/staging/media/imx/imx7-media-csi.c
++++ b/drivers/staging/media/imx/imx7-media-csi.c
+@@ -499,6 +499,7 @@ static int imx7_csi_pad_link_validate(struct v4l2_subdev *sd,
+ struct v4l2_subdev_format *sink_fmt)
+ {
+ struct imx7_csi *csi = v4l2_get_subdevdata(sd);
++ struct media_entity *src;
+ struct media_pad *pad;
+ int ret;
+
+@@ -509,11 +510,21 @@ static int imx7_csi_pad_link_validate(struct v4l2_subdev *sd,
+ if (!csi->src_sd)
+ return -EPIPE;
+
++ src = &csi->src_sd->entity;
++
++ /*
++ * if the source is neither a CSI MUX or CSI-2 get the one directly
++ * upstream from this CSI
++ */
++ if (src->function != MEDIA_ENT_F_VID_IF_BRIDGE &&
++ src->function != MEDIA_ENT_F_VID_MUX)
++ src = &csi->sd.entity;
++
+ /*
+- * find the entity that is selected by the CSI mux. This is needed
++ * find the entity that is selected by the source. This is needed
+ * to distinguish between a parallel or CSI-2 pipeline.
+ */
+- pad = imx_media_pipeline_pad(&csi->src_sd->entity, 0, 0, true);
++ pad = imx_media_pipeline_pad(src, 0, 0, true);
+ if (!pad)
+ return -ENODEV;
+
+--
+2.27.0
+
--- /dev/null
+From a8f85a075e4956b13a1370e161e4a42bb4685336 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 11:47:25 +0100
+Subject: media: imx7: csi: Fix regression for parallel cameras on i.MX6UL
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 9bac67214fbf4b5f23463f7742ccf69bfe684cbd ]
+
+Commit 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as
+a CSI mux") made an incorrect assumption that for imx7-media-csi,
+the bound subdev must always be a CSI mux. On i.MX6UL/i.MX6ULL there
+is no CSI mux at all, so do not return an error when the entity is not a
+video mux and assign the IMX_MEDIA_GRP_ID_CSI_MUX group id only when
+appropriate.
+
+This is the same approach as done in imx-media-csi.c and it fixes the
+csi probe regression on i.MX6UL.
+
+Tested on a imx6ull-evk board.
+
+Fixes: 86e02d07871c ("media: imx5/6/7: csi: Mark a bound video mux as a CSI mux")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx7-media-csi.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
+index a3f3df9017046..31e36168f9d0f 100644
+--- a/drivers/staging/media/imx/imx7-media-csi.c
++++ b/drivers/staging/media/imx/imx7-media-csi.c
+@@ -1164,12 +1164,12 @@ static int imx7_csi_notify_bound(struct v4l2_async_notifier *notifier,
+ struct imx7_csi *csi = imx7_csi_notifier_to_dev(notifier);
+ struct media_pad *sink = &csi->sd.entity.pads[IMX7_CSI_PAD_SINK];
+
+- /* The bound subdev must always be the CSI mux */
+- if (WARN_ON(sd->entity.function != MEDIA_ENT_F_VID_MUX))
+- return -ENXIO;
+-
+- /* Mark it as such via its group id */
+- sd->grp_id = IMX_MEDIA_GRP_ID_CSI_MUX;
++ /*
++ * If the subdev is a video mux, it must be one of the CSI
++ * muxes. Mark it as such via its group id.
++ */
++ if (sd->entity.function == MEDIA_ENT_F_VID_MUX)
++ sd->grp_id = IMX_MEDIA_GRP_ID_CSI_MUX;
+
+ return v4l2_create_fwnode_links_to_pad(sd, sink);
+ }
+--
+2.27.0
+
--- /dev/null
+From e6e72408f27d2d8871e635ab0641179df8ed2c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 16:28:32 +0100
+Subject: media: ipu3-cio2: Build only for x86
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3ef5e42d281ea108f4ccdca186de4ce20a346326 ]
+
+According to the original code in the driver it was never assumed to work
+with big page sizes: unsigned short type followed by PAGE_SHIFT and
+PAGE_MASK which may be different on non-x86 architectures.
+
+Recently LKP found an issue on non-x86 architectures due to above
+mentioned limitations. Since Sakari acknowledges that it's not really
+useful to be able to compile this elsewhere, mark it x86 only.
+
+Fixes: a31d19f88932 ("media: ipu3: allow building it with COMPILE_TEST on non-x86 archs")
+Reported-by: kernel test robot <lkp@intel.com>
+Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu3/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/intel/ipu3/Kconfig b/drivers/media/pci/intel/ipu3/Kconfig
+index 82d7f17e6a024..7a805201034b7 100644
+--- a/drivers/media/pci/intel/ipu3/Kconfig
++++ b/drivers/media/pci/intel/ipu3/Kconfig
+@@ -2,7 +2,8 @@
+ config VIDEO_IPU3_CIO2
+ tristate "Intel ipu3-cio2 driver"
+ depends on VIDEO_V4L2 && PCI
+- depends on (X86 && ACPI) || COMPILE_TEST
++ depends on ACPI || COMPILE_TEST
++ depends on X86
+ select MEDIA_CONTROLLER
+ select VIDEO_V4L2_SUBDEV_API
+ select V4L2_FWNODE
+--
+2.27.0
+
--- /dev/null
+From a957dba42186f58438956c45c0c7644ac9d82994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Aug 2020 20:13:31 +0200
+Subject: media: lmedm04: Fix misuse of comma
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit 59a3e78f8cc33901fe39035c1ab681374bba95ad ]
+
+There's a comma used instead of a semicolon that causes multiple
+statements to be executed after an if instead of just the intended
+single statement.
+
+Replace the comma with a semicolon.
+
+Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 5a7a9522d46da..9ddda8d68ee0f 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -391,7 +391,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
+
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+- lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa),
++ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+
+ usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
+ info("INT Interrupt Service Started");
+--
+2.27.0
+
--- /dev/null
+From fb2ce784028448410d40ffa45e96fdb6ab88eb4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 07:27:22 +0100
+Subject: media: media/pci: Fix memleak in empress_init
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 15d0c52241ecb1c9d802506bff6f5c3f7872c0df ]
+
+When vb2_queue_init() fails, dev->empress_dev
+should be released just like other error handling
+paths.
+
+Fixes: 2ada815fc48bb ("[media] saa7134: convert to vb2")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-empress.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
+index 39e3c7f8c5b46..76a37fbd84587 100644
+--- a/drivers/media/pci/saa7134/saa7134-empress.c
++++ b/drivers/media/pci/saa7134/saa7134-empress.c
+@@ -282,8 +282,11 @@ static int empress_init(struct saa7134_dev *dev)
+ q->lock = &dev->lock;
+ q->dev = &dev->pci->dev;
+ err = vb2_queue_init(q);
+- if (err)
++ if (err) {
++ video_device_release(dev->empress_dev);
++ dev->empress_dev = NULL;
+ return err;
++ }
+ dev->empress_dev->queue = q;
+ dev->empress_dev->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING |
+ V4L2_CAP_VIDEO_CAPTURE;
+--
+2.27.0
+
--- /dev/null
+From a5bf48994fb5c19b6c668985784063e01cf7cd2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Jan 2021 23:21:38 +0100
+Subject: media: mtk-vcodec: fix argument used when DEBUG is defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit a04e187d231086a1313fd635ac42bdbc997137ad ]
+
+When DEBUG is defined this error occurs
+
+drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c:306:41:
+ error: ‘i’ undeclared (first use in this function)
+ mtk_v4l2_debug(2, "reg[%d] base=0x%p", i, dev->reg_base[VENC_SYS]);
+
+Reviewing the old line
+
+ mtk_v4l2_debug(2, "reg[%d] base=0x%p", i, dev->reg_base[i]);
+
+All the i's need to be changed to VENC_SYS.
+Fix a similar error for VENC_LT_SYS.
+
+Fixes: 0dc4b3286125 ("media: mtk-vcodec: venc: support SCP firmware")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+index dfb42e19bf813..be3842e6ca475 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+@@ -303,7 +303,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+ ret = PTR_ERR((__force void *)dev->reg_base[VENC_SYS]);
+ goto err_res;
+ }
+- mtk_v4l2_debug(2, "reg[%d] base=0x%p", i, dev->reg_base[VENC_SYS]);
++ mtk_v4l2_debug(2, "reg[%d] base=0x%p", VENC_SYS, dev->reg_base[VENC_SYS]);
+
+ res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (res == NULL) {
+@@ -332,7 +332,7 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
+ ret = PTR_ERR((__force void *)dev->reg_base[VENC_LT_SYS]);
+ goto err_res;
+ }
+- mtk_v4l2_debug(2, "reg[%d] base=0x%p", i, dev->reg_base[VENC_LT_SYS]);
++ mtk_v4l2_debug(2, "reg[%d] base=0x%p", VENC_LT_SYS, dev->reg_base[VENC_LT_SYS]);
+
+ dev->enc_lt_irq = platform_get_irq(pdev, 1);
+ irq_set_status_flags(dev->enc_lt_irq, IRQ_NOAUTOEN);
+--
+2.27.0
+
--- /dev/null
+From dbff146e09d84aa1a58bb2461707b075da3c8ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 09:29:34 +0100
+Subject: media: mtk-vcodec: fix error return code in vdec_vp9_decode()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 4397efebf039be58e98c81a194a26100eba597bb ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: dea42fb79f4f ("media: mtk-vcodec: reset segment data then trig decoder")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+index 5ea153a685225..d9880210b2ab6 100644
+--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
++++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+@@ -890,7 +890,8 @@ static int vdec_vp9_decode(void *h_vdec, struct mtk_vcodec_mem *bs,
+ memset(inst->seg_id_buf.va, 0, inst->seg_id_buf.size);
+
+ if (vsi->show_frame & BIT(2)) {
+- if (vpu_dec_start(&inst->vpu, NULL, 0)) {
++ ret = vpu_dec_start(&inst->vpu, NULL, 0);
++ if (ret) {
+ mtk_vcodec_err(inst, "vpu trig decoder failed");
+ goto DECODE_ERROR;
+ }
+--
+2.27.0
+
--- /dev/null
+From 962da4dd8649f53b937123210bb9c5772fa859c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 14:45:13 +0100
+Subject: media: pxa_camera: declare variable when DEBUG is defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 031b9212eeee365443aaef013360ea6cded7b2c4 ]
+
+When DEBUG is defined this error occurs
+
+drivers/media/platform/pxa_camera.c:1410:7: error:
+ ‘i’ undeclared (first use in this function)
+ for (i = 0; i < vb->num_planes; i++)
+ ^
+The variable 'i' is missing, so declare it.
+
+Fixes: 6f28435d1c15 ("[media] media: platform: pxa_camera: trivial move of functions")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/pxa_camera.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
+index b664ce7558a1a..75fad9689c901 100644
+--- a/drivers/media/platform/pxa_camera.c
++++ b/drivers/media/platform/pxa_camera.c
+@@ -1386,6 +1386,9 @@ static int pxac_vb2_prepare(struct vb2_buffer *vb)
+ struct pxa_camera_dev *pcdev = vb2_get_drv_priv(vb->vb2_queue);
+ struct pxa_buffer *buf = vb2_to_pxa_buffer(vb);
+ int ret = 0;
++#ifdef DEBUG
++ int i;
++#endif
+
+ switch (pcdev->channels) {
+ case 1:
+--
+2.27.0
+
--- /dev/null
+From 6e98d5088bde98432ac8914b42d417a1a6c67247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 02:34:37 +0100
+Subject: media: qm1d1c0042: fix error return code in qm1d1c0042_init()
+
+From: Luo Meng <luomeng12@huawei.com>
+
+[ Upstream commit fcf8d018bdca0453b8d6359062e6bc1512d04c38 ]
+
+Fix to return a negative error code from the error handling case
+instead of 0 in function qm1d1c0042_init(), as done elsewhere
+in this function.
+
+Fixes: ab4d14528fdf ("[media] em28xx: add support for PLEX PX-BCUD (ISDB-S)")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Luo Meng <luomeng12@huawei.com>
+Acked-by: Akihiro Tsukada <tskd08@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/tuners/qm1d1c0042.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/tuners/qm1d1c0042.c b/drivers/media/tuners/qm1d1c0042.c
+index 0e26d22f0b268..53aa2558f71e1 100644
+--- a/drivers/media/tuners/qm1d1c0042.c
++++ b/drivers/media/tuners/qm1d1c0042.c
+@@ -343,8 +343,10 @@ static int qm1d1c0042_init(struct dvb_frontend *fe)
+ if (val == reg_initval[reg_index][0x00])
+ break;
+ }
+- if (reg_index >= QM1D1C0042_NUM_REG_ROWS)
++ if (reg_index >= QM1D1C0042_NUM_REG_ROWS) {
++ ret = -EINVAL;
+ goto failed;
++ }
+ memcpy(state->regs, reg_initval[reg_index], QM1D1C0042_NUM_REGS);
+ usleep_range(2000, 3000);
+
+--
+2.27.0
+
--- /dev/null
+From 1aabcd3ba59862316772c1a21c6667cdf64c04c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 14:28:24 +0100
+Subject: media: software_node: Fix refcounts in software_node_get_next_child()
+
+From: Daniel Scally <djrscally@gmail.com>
+
+[ Upstream commit fb5ec981adf08b94e6ce27ca16b7765c94f4513c ]
+
+The software_node_get_next_child() function currently does not hold
+references to the child software_node that it finds or put the ref that
+is held against the old child - fix that.
+
+Fixes: 59abd83672f7 ("drivers: base: Introducing software nodes to the firmware node framework")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Daniel Scally <djrscally@gmail.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index 4a4b2008fbc26..4fcc1a6fb724c 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -443,14 +443,18 @@ software_node_get_next_child(const struct fwnode_handle *fwnode,
+ struct swnode *c = to_swnode(child);
+
+ if (!p || list_empty(&p->children) ||
+- (c && list_is_last(&c->entry, &p->children)))
++ (c && list_is_last(&c->entry, &p->children))) {
++ fwnode_handle_put(child);
+ return NULL;
++ }
+
+ if (c)
+ c = list_next_entry(c, entry);
+ else
+ c = list_first_entry(&p->children, struct swnode, entry);
+- return &c->fwnode;
++
++ fwnode_handle_put(child);
++ return fwnode_handle_get(&c->fwnode);
+ }
+
+ static struct fwnode_handle *
+--
+2.27.0
+
--- /dev/null
+From eba903a2b4452033615d675e85d7e0c2a0b52986 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 10:00:27 +0100
+Subject: media: ti-vpe: cal: fix write to unallocated memory
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 5a402af5e19f215689e8bf3cc244c21d94eba3c4 ]
+
+The asd allocated with v4l2_async_notifier_add_fwnode_subdev() must be
+of size cal_v4l2_async_subdev, otherwise access to
+cal_v4l2_async_subdev->phy will go to unallocated memory.
+
+Fixes: 8fcb7576ad19 ("media: ti-vpe: cal: Allow multiple contexts per subdev notifier")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/ti-vpe/cal.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/ti-vpe/cal.c b/drivers/media/platform/ti-vpe/cal.c
+index 59a0266b1f399..2eef245c31a17 100644
+--- a/drivers/media/platform/ti-vpe/cal.c
++++ b/drivers/media/platform/ti-vpe/cal.c
+@@ -406,7 +406,7 @@ static irqreturn_t cal_irq(int irq_cal, void *data)
+ */
+
+ struct cal_v4l2_async_subdev {
+- struct v4l2_async_subdev asd;
++ struct v4l2_async_subdev asd; /* Must be first */
+ struct cal_camerarx *phy;
+ };
+
+@@ -472,7 +472,7 @@ static int cal_async_notifier_register(struct cal_dev *cal)
+ fwnode = of_fwnode_handle(phy->sensor_node);
+ asd = v4l2_async_notifier_add_fwnode_subdev(&cal->notifier,
+ fwnode,
+- sizeof(*asd));
++ sizeof(*casd));
+ if (IS_ERR(asd)) {
+ phy_err(phy, "Failed to add subdev to notifier\n");
+ ret = PTR_ERR(asd);
+--
+2.27.0
+
--- /dev/null
+From 28b654bf52d86d14f684f953114043dcefd96e5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Jan 2021 09:26:37 +0100
+Subject: media: tm6000: Fix memleak in tm6000_start_stream
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 76aaf8a96771c16365b8510f1fb97738dc88026e ]
+
+When usb_clear_halt() fails, dvb->bulk_urb->transfer_buffer
+and dvb->bulk_urb should be freed just like when
+usb_submit_urb() fails.
+
+Fixes: 3169c9b26fffa ("V4L/DVB (12788): tm6000: Add initial DVB-T support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/tm6000/tm6000-dvb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
+index 19c90fa9e443d..293a460f4616c 100644
+--- a/drivers/media/usb/tm6000/tm6000-dvb.c
++++ b/drivers/media/usb/tm6000/tm6000-dvb.c
+@@ -141,6 +141,10 @@ static int tm6000_start_stream(struct tm6000_core *dev)
+ if (ret < 0) {
+ printk(KERN_ERR "tm6000: error %i in %s during pipe reset\n",
+ ret, __func__);
++
++ kfree(dvb->bulk_urb->transfer_buffer);
++ usb_free_urb(dvb->bulk_urb);
++ dvb->bulk_urb = NULL;
+ return ret;
+ } else
+ printk(KERN_ERR "tm6000: pipe reset\n");
+--
+2.27.0
+
--- /dev/null
+From dbc3e3e6c79e50547b4dfc00248f15bc7669439f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Dec 2020 15:11:13 +0100
+Subject: media: uvcvideo: Accept invalid bFormatIndex and bFrameIndex values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit dc9455ffae02d7b7fb51ba1e007fffcb9dc5d890 ]
+
+The Renkforce RF AC4K 300 Action Cam 4K reports invalid bFormatIndex and
+bFrameIndex values when negotiating the video probe and commit controls.
+The UVC descriptors report a single supported format and frame size,
+with bFormatIndex and bFrameIndex both equal to 2, but the video probe
+and commit controls report bFormatIndex and bFrameIndex set to 1.
+
+The device otherwise operates correctly, but the driver rejects the
+values and fails the format try operation. Fix it by ignoring the
+invalid indices, and assuming that the format and frame requested by the
+driver are accepted by the device.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210767
+
+Fixes: 8a652a17e3c0 ("media: uvcvideo: Ensure all probed info is returned to v4l2")
+Reported-by: Till Dörges <doerges@pre-sense.de>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_v4l2.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
+index fa06bfa174ad3..c7172b8952a96 100644
+--- a/drivers/media/usb/uvc/uvc_v4l2.c
++++ b/drivers/media/usb/uvc/uvc_v4l2.c
+@@ -248,7 +248,9 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ goto done;
+
+ /* After the probe, update fmt with the values returned from
+- * negotiation with the device.
++ * negotiation with the device. Some devices return invalid bFormatIndex
++ * and bFrameIndex values, in which case we can only assume they have
++ * accepted the requested format as-is.
+ */
+ for (i = 0; i < stream->nformats; ++i) {
+ if (probe->bFormatIndex == stream->format[i].index) {
+@@ -257,11 +259,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ }
+ }
+
+- if (i == stream->nformats) {
+- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
++ if (i == stream->nformats)
++ uvc_trace(UVC_TRACE_FORMAT,
++ "Unknown bFormatIndex %u, using default\n",
+ probe->bFormatIndex);
+- return -EINVAL;
+- }
+
+ for (i = 0; i < format->nframes; ++i) {
+ if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
+@@ -270,11 +271,10 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
+ }
+ }
+
+- if (i == format->nframes) {
+- uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
++ if (i == format->nframes)
++ uvc_trace(UVC_TRACE_FORMAT,
++ "Unknown bFrameIndex %u, using default\n",
+ probe->bFrameIndex);
+- return -EINVAL;
+- }
+
+ fmt->fmt.pix.width = frame->wWidth;
+ fmt->fmt.pix.height = frame->wHeight;
+--
+2.27.0
+
--- /dev/null
+From 411e206c7616a8ba49b957b4d90277d48c364ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Dec 2020 16:04:00 +0100
+Subject: media: vidtv: psi: fix missing crc for PMT
+
+From: Daniel W. S. Almeida <dwlsalmeida@gmail.com>
+
+[ Upstream commit 0a933a7f73d6c545dcbecb4f7a92d272aef4417b ]
+
+The PMT write function was refactored and this broke the CRC computation.
+
+Fix it.
+
+Fixes: db9569f67e2e ("media: vidtv: cleanup PMT write table function")
+Signed-off-by: Daniel W. S. Almeida <dwlsalmeida@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/vidtv/vidtv_psi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c
+index 4511a2a98405d..1724bb485e670 100644
+--- a/drivers/media/test-drivers/vidtv/vidtv_psi.c
++++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c
+@@ -1164,6 +1164,8 @@ u32 vidtv_psi_pmt_write_into(struct vidtv_psi_pmt_write_args *args)
+ struct vidtv_psi_desc *table_descriptor = args->pmt->descriptor;
+ struct vidtv_psi_table_pmt_stream *stream = args->pmt->stream;
+ struct vidtv_psi_desc *stream_descriptor;
++ u32 crc = INITIAL_CRC;
++ u32 nbytes = 0;
+ struct header_write_args h_args = {
+ .dest_buf = args->buf,
+ .dest_offset = args->offset,
+@@ -1181,6 +1183,7 @@ u32 vidtv_psi_pmt_write_into(struct vidtv_psi_pmt_write_args *args)
+ .new_psi_section = false,
+ .is_crc = false,
+ .dest_buf_sz = args->buf_sz,
++ .crc = &crc,
+ };
+ struct desc_write_args d_args = {
+ .dest_buf = args->buf,
+@@ -1193,8 +1196,6 @@ u32 vidtv_psi_pmt_write_into(struct vidtv_psi_pmt_write_args *args)
+ .pid = args->pid,
+ .dest_buf_sz = args->buf_sz,
+ };
+- u32 crc = INITIAL_CRC;
+- u32 nbytes = 0;
+
+ vidtv_psi_pmt_table_update_sec_len(args->pmt);
+
+--
+2.27.0
+
--- /dev/null
+From 84b29dae38bd30dce3218a9e3dd53dec32088bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 18:41:19 +0100
+Subject: media: vsp1: Fix an error handling path in the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 7113469dafc2d545fa4fa9bc649c31dc27db492e ]
+
+A previous 'rcar_fcp_get()' call must be undone in the error handling path,
+as already done in the remove function.
+
+Fixes: 94fcdf829793 ("[media] v4l: vsp1: Add FCP support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vsp1/vsp1_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
+index dc62533cf32ce..aa66e4f5f3f34 100644
+--- a/drivers/media/platform/vsp1/vsp1_drv.c
++++ b/drivers/media/platform/vsp1/vsp1_drv.c
+@@ -882,8 +882,10 @@ static int vsp1_probe(struct platform_device *pdev)
+ }
+
+ done:
+- if (ret)
++ if (ret) {
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(vsp1->fcp);
++ }
+
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 593f90c65a9b842b691a3f24cf985ade5c184ecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 14:07:48 +0200
+Subject: mei: hbm: call mei_set_devstate() on hbm stop response
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+[ Upstream commit 3a77df62deb2e62de0dc26c1cb763cc152329287 ]
+
+Use mei_set_devstate() wrapper upon hbm stop command response,
+to trigger sysfs event.
+
+Fixes: 43b8a7ed4739 ("mei: expose device state in sysfs")
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20210129120752.850325-3-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/hbm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
+index 686e8b6a4c55e..0cba3c6dfb148 100644
+--- a/drivers/misc/mei/hbm.c
++++ b/drivers/misc/mei/hbm.c
+@@ -1373,7 +1373,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+ return -EPROTO;
+ }
+
+- dev->dev_state = MEI_DEV_POWER_DOWN;
++ mei_set_devstate(dev, MEI_DEV_POWER_DOWN);
+ dev_info(dev->dev, "hbm: stop response: resetting.\n");
+ /* force the reset */
+ return -EPROTO;
+--
+2.27.0
+
--- /dev/null
+From ce53cd3c581c1d334c2d2f83f50c577818fe8c8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 18:21:18 +0800
+Subject: memory: mtk-smi: Fix PM usage counter unbalance in mtk_smi ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit a2d522ff0f5cc26915c4ccee9457fd4b4e1edc48 ]
+
+pm_runtime_get_sync will increment pm usage counter
+even it failed. Forgetting to putting operation will
+result in reference leak here. We fix it by replacing
+it with pm_runtime_resume_and_get to keep usage counter
+balanced.
+
+Fixes: 4f0a1a1ae3519 ("memory: mtk-smi: Invoke pm runtime_callback to enable clocks")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123102118.3866195-1-zhangqilong3@huawei.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/mtk-smi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/mtk-smi.c b/drivers/memory/mtk-smi.c
+index ac350f8d1e20f..82d09b88240e1 100644
+--- a/drivers/memory/mtk-smi.c
++++ b/drivers/memory/mtk-smi.c
+@@ -130,7 +130,7 @@ static void mtk_smi_clk_disable(const struct mtk_smi *smi)
+
+ int mtk_smi_larb_get(struct device *larbdev)
+ {
+- int ret = pm_runtime_get_sync(larbdev);
++ int ret = pm_runtime_resume_and_get(larbdev);
+
+ return (ret < 0) ? ret : 0;
+ }
+@@ -374,7 +374,7 @@ static int __maybe_unused mtk_smi_larb_resume(struct device *dev)
+ int ret;
+
+ /* Power on smi-common. */
+- ret = pm_runtime_get_sync(larb->smi_common_dev);
++ ret = pm_runtime_resume_and_get(larb->smi_common_dev);
+ if (ret < 0) {
+ dev_err(dev, "Failed to pm get for smi-common(%d).\n", ret);
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 90bfa6397aab6971305a3f4609131019df6de791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 01:03:59 -0800
+Subject: memory: ti-aemif: Drop child node when jumping out loop
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 94e9dd43cf327366388c8f146bccdc6322c0d999 ]
+
+Call of_node_put() to decrement the reference count of the child node
+child_np when jumping out of the loop body of
+for_each_available_child_of_node(), which is a macro that increments and
+decrements the reference count of child node. If the loop is broken, the
+reference of the child node should be dropped manually.
+
+Fixes: 5a7c81547c1d ("memory: ti-aemif: introduce AEMIF driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210121090359.61763-1-bianpan2016@163.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/ti-aemif.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c
+index 159a16f5e7d67..51d20c2ccb755 100644
+--- a/drivers/memory/ti-aemif.c
++++ b/drivers/memory/ti-aemif.c
+@@ -378,8 +378,10 @@ static int aemif_probe(struct platform_device *pdev)
+ */
+ for_each_available_child_of_node(np, child_np) {
+ ret = of_aemif_parse_abus_config(pdev, child_np);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(child_np);
+ goto error;
++ }
+ }
+ } else if (pdata && pdata->num_abus_data > 0) {
+ for (i = 0; i < pdata->num_abus_data; i++, aemif->num_cs++) {
+@@ -405,8 +407,10 @@ static int aemif_probe(struct platform_device *pdev)
+ for_each_available_child_of_node(np, child_np) {
+ ret = of_platform_populate(child_np, NULL,
+ dev_lookup, dev);
+- if (ret < 0)
++ if (ret < 0) {
++ of_node_put(child_np);
+ goto error;
++ }
+ }
+ } else if (pdata) {
+ for (i = 0; i < pdata->num_sub_devices; i++) {
+--
+2.27.0
+
--- /dev/null
+From 8fa5a539a2f83447616335c9b15f56bab33aa042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:52:48 +0100
+Subject: mfd: altera-sysmgr: Fix physical address storing more
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b0b5b16b78cea1b2b990a69ab8e07a42ccf7a2ed ]
+
+A recent fix improved the way the resource gets passed to
+the low-level accessors, but left one warning that appears
+in configurations with a resource_size_t that is wider than
+a pointer:
+
+In file included from drivers/mfd/altera-sysmgr.c:19:
+drivers/mfd/altera-sysmgr.c: In function 'sysmgr_probe':
+drivers/mfd/altera-sysmgr.c:148:40: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
+ 148 | regmap = devm_regmap_init(dev, NULL, (void *)res->start,
+ | ^
+include/linux/regmap.h:646:6: note: in definition of macro '__regmap_lockdep_wrapper'
+ 646 | fn(__VA_ARGS__, &_key, \
+ | ^~~~~~~~~~~
+drivers/mfd/altera-sysmgr.c:148:12: note: in expansion of macro 'devm_regmap_init'
+ 148 | regmap = devm_regmap_init(dev, NULL, (void *)res->start,
+ | ^~~~~~~~~~~~~~~~
+
+I had tried a different approach that would store the address
+in the private data as a phys_addr_t, but the easiest solution
+now seems to be to add a double cast to shut up the warning.
+
+As the address is passed to an inline assembly, it is guaranteed
+to not be wider than a register anyway.
+
+Fixes: d9ca7801b6e5 ("mfd: altera-sysmgr: Fix physical address storing hacks")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/altera-sysmgr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/altera-sysmgr.c b/drivers/mfd/altera-sysmgr.c
+index 193a96c8b1eab..20cb294c75122 100644
+--- a/drivers/mfd/altera-sysmgr.c
++++ b/drivers/mfd/altera-sysmgr.c
+@@ -145,7 +145,8 @@ static int sysmgr_probe(struct platform_device *pdev)
+ sysmgr_config.reg_write = s10_protected_reg_write;
+
+ /* Need physical address for SMCC call */
+- regmap = devm_regmap_init(dev, NULL, (void *)res->start,
++ regmap = devm_regmap_init(dev, NULL,
++ (void *)(uintptr_t)res->start,
+ &sysmgr_config);
+ } else {
+ base = devm_ioremap(dev, res->start, resource_size(res));
+--
+2.27.0
+
--- /dev/null
+From 5b7036347cb3cca5b9f90589f09f4a183d5b18c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 18:00:56 +0900
+Subject: mfd: bd9571mwv: Use devm_mfd_add_devices()
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit c58ad0f2b052b5675d6394e03713ee41e721b44c ]
+
+To remove mfd devices when unload this driver, should use
+devm_mfd_add_devices() instead.
+
+Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Acked-for-MFD-by: Lee Jones <lee.jones@linaro.org>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/bd9571mwv.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index fab3cdc27ed64..19d57a45134c6 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -185,9 +185,9 @@ static int bd9571mwv_probe(struct i2c_client *client,
+ return ret;
+ }
+
+- ret = mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO, bd9571mwv_cells,
+- ARRAY_SIZE(bd9571mwv_cells), NULL, 0,
+- regmap_irq_get_domain(bd->irq_data));
++ ret = devm_mfd_add_devices(bd->dev, PLATFORM_DEVID_AUTO,
++ bd9571mwv_cells, ARRAY_SIZE(bd9571mwv_cells),
++ NULL, 0, regmap_irq_get_domain(bd->irq_data));
+ if (ret) {
+ regmap_del_irq_chip(bd->irq, bd->irq_data);
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 8046d3c430fcc1d97b856823db1164c2f14edabf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:37:24 +0300
+Subject: mfd: wm831x-auxadc: Prevent use after free in
+ wm831x_auxadc_read_irq()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 26783d74cc6a440ee3ef9836a008a697981013d0 ]
+
+The "req" struct is always added to the "wm831x->auxadc_pending" list,
+but it's only removed from the list on the success path. If a failure
+occurs then the "req" struct is freed but it's still on the list,
+leading to a use after free.
+
+Fixes: 78bb3688ea18 ("mfd: Support multiple active WM831x AUXADC conversions")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/wm831x-auxadc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/wm831x-auxadc.c b/drivers/mfd/wm831x-auxadc.c
+index 8a7cc0f86958b..65b98f3fbd929 100644
+--- a/drivers/mfd/wm831x-auxadc.c
++++ b/drivers/mfd/wm831x-auxadc.c
+@@ -93,11 +93,10 @@ static int wm831x_auxadc_read_irq(struct wm831x *wm831x,
+ wait_for_completion_timeout(&req->done, msecs_to_jiffies(500));
+
+ mutex_lock(&wm831x->auxadc_lock);
+-
+- list_del(&req->list);
+ ret = req->val;
+
+ out:
++ list_del(&req->list);
+ mutex_unlock(&wm831x->auxadc_lock);
+
+ kfree(req);
+--
+2.27.0
+
--- /dev/null
+From 4d8af0ac6f9cb6fd7433ad682834390149fb7b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 13:55:38 +0530
+Subject: mhi: Fix double dma free
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit db4e8de1935b0202960e9ebb88ab93e8bd1e66b1 ]
+
+mhi_deinit_chan_ctxt functionthat takes care of unitializing channel
+resources, including unmapping coherent MHI areas, can be called
+from different path in case of controller unregistering/removal:
+ - From a client driver remove callback, via mhi_unprepare_channel
+ - From mhi_driver_remove that unitialize all channels
+
+mhi_driver_remove()
+|-> driver->remove()
+| |-> mhi_unprepare_channel()
+| |-> mhi_deinit_chan_ctxt()
+|...
+|-> mhi_deinit_chan_ctxt()
+
+This leads to double dma freeing...
+
+Fix that by preventing deinit for already uninitialized channel.
+
+Link: https://lore.kernel.org/r/1612894264-15956-1-git-send-email-loic.poulain@linaro.org
+Fixes: a7f422f2f89e ("bus: mhi: Fix channel close issue on driver remove")
+Reported-by: Kalle Valo <kvalo@codeaurora.org>
+Tested-by: Kalle Valo <kvalo@codeaurora.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210210082538.2494-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/core/init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bus/mhi/core/init.c b/drivers/bus/mhi/core/init.c
+index f0697f433c2f1..08c45457c90fe 100644
+--- a/drivers/bus/mhi/core/init.c
++++ b/drivers/bus/mhi/core/init.c
+@@ -552,6 +552,9 @@ void mhi_deinit_chan_ctxt(struct mhi_controller *mhi_cntrl,
+ tre_ring = &mhi_chan->tre_ring;
+ chan_ctxt = &mhi_cntrl->mhi_ctxt->chan_ctxt[mhi_chan->chan];
+
++ if (!chan_ctxt->rbase) /* Already uninitialized */
++ return;
++
+ mhi_free_coherent(mhi_cntrl, tre_ring->alloc_size,
+ tre_ring->pre_aligned, tre_ring->dma_handle);
+ vfree(buf_ring->base);
+--
+2.27.0
+
--- /dev/null
+From aa394eb0aceefdf0d885be6e4e6691976b11a15a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 13:34:56 -0700
+Subject: MIPS: c-r4k: Fix section mismatch for loongson2_sc_init
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c58734eee6a2151ba033c0dcb31902c89e310374 ]
+
+When building with clang, the following section mismatch warning occurs:
+
+WARNING: modpost: vmlinux.o(.text+0x24490): Section mismatch in
+reference from the function r4k_cache_init() to the function
+.init.text:loongson2_sc_init()
+
+This should have been fixed with commit ad4fddef5f23 ("mips: fix Section
+mismatch in reference") but it was missed. Remove the improper __init
+annotation like that commit did.
+
+Fixes: 078a55fc824c ("MIPS: Delete __cpuinit/__CPUINIT usage from MIPS code")
+Link: https://github.com/ClangBuiltLinux/linux/issues/787
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/c-r4k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 4f976d687ab00..f67297b3175fe 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -1593,7 +1593,7 @@ static int probe_scache(void)
+ return 1;
+ }
+
+-static void __init loongson2_sc_init(void)
++static void loongson2_sc_init(void)
+ {
+ struct cpuinfo_mips *c = ¤t_cpu_data;
+
+--
+2.27.0
+
--- /dev/null
+From f7af909725e1ed302ff61893dbb94537d8fe9e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 10:34:16 -0700
+Subject: MIPS: Compare __SYNC_loongson3_war against 0
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8790ccf8daf1a8c53b6cb8ce0c9a109274bd3fa8 ]
+
+When building with clang when CONFIG_CPU_LOONGSON3_WORKAROUNDS is
+enabled:
+
+ In file included from lib/errseq.c:4:
+ In file included from ./include/linux/atomic.h:7:
+ ./arch/mips/include/asm/atomic.h:52:1: warning: converting the result of
+ '<<' to a boolean always evaluates to true
+ [-Wtautological-constant-compare]
+ ATOMIC_OPS(atomic64, s64)
+ ^
+ ./arch/mips/include/asm/atomic.h:40:9: note: expanded from macro
+ 'ATOMIC_OPS'
+ return cmpxchg(&v->counter, o, n);
+ ^
+ ./arch/mips/include/asm/cmpxchg.h:194:7: note: expanded from macro
+ 'cmpxchg'
+ if (!__SYNC_loongson3_war)
+ ^
+ ./arch/mips/include/asm/sync.h:147:34: note: expanded from macro
+ '__SYNC_loongson3_war'
+ # define __SYNC_loongson3_war (1 << 31)
+ ^
+
+While it is not wrong that the result of this shift is always true in a
+boolean context, it is not a problem here. Regardless, the warning is
+really noisy so rather than making the shift a boolean implicitly, use
+it in an equality comparison so the shift is used as an integer value.
+
+Fixes: 4d1dbfe6cbec ("MIPS: atomic: Emit Loongson3 sync workarounds within asm")
+Fixes: a91f2a1dba44 ("MIPS: cmpxchg: Omit redundant barriers for Loongson3")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/atomic.h | 2 +-
+ arch/mips/include/asm/cmpxchg.h | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index f904084fcb1fd..27ad767915390 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -248,7 +248,7 @@ static __inline__ int pfx##_sub_if_positive(type i, pfx##_t * v) \
+ * bltz that can branch to code outside of the LL/SC loop. As \
+ * such, we don't need to emit another barrier here. \
+ */ \
+- if (!__SYNC_loongson3_war) \
++ if (__SYNC_loongson3_war == 0) \
+ smp_mb__after_atomic(); \
+ \
+ return result; \
+diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
+index 5b0b3a6777ea5..ed8f3f3c4304a 100644
+--- a/arch/mips/include/asm/cmpxchg.h
++++ b/arch/mips/include/asm/cmpxchg.h
+@@ -99,7 +99,7 @@ unsigned long __xchg(volatile void *ptr, unsigned long x, int size)
+ * contains a completion barrier prior to the LL, so we don't \
+ * need to emit an extra one here. \
+ */ \
+- if (!__SYNC_loongson3_war) \
++ if (__SYNC_loongson3_war == 0) \
+ smp_mb__before_llsc(); \
+ \
+ __res = (__typeof__(*(ptr))) \
+@@ -191,7 +191,7 @@ unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+ * contains a completion barrier prior to the LL, so we don't \
+ * need to emit an extra one here. \
+ */ \
+- if (!__SYNC_loongson3_war) \
++ if (__SYNC_loongson3_war == 0) \
+ smp_mb__before_llsc(); \
+ \
+ __res = cmpxchg_local((ptr), (old), (new)); \
+@@ -201,7 +201,7 @@ unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
+ * contains a completion barrier after the SC, so we don't \
+ * need to emit an extra one here. \
+ */ \
+- if (!__SYNC_loongson3_war) \
++ if (__SYNC_loongson3_war == 0) \
+ smp_llsc_mb(); \
+ \
+ __res; \
+--
+2.27.0
+
--- /dev/null
+From 5e8b6edcd8c6b1c4b134e5b4d61f91188e43a8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 13:15:48 -0700
+Subject: MIPS: lantiq: Explicitly compare LTQ_EBU_PCC_ISTAT against 0
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit c6f2a9e17b9bef7677caddb1626c2402f3e9d2bd ]
+
+When building xway_defconfig with clang:
+
+arch/mips/lantiq/irq.c:305:48: error: use of logical '&&' with constant
+operand [-Werror,-Wconstant-logical-operand]
+ if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+ ^ ~~~~~~~~~~~~~~~~~
+arch/mips/lantiq/irq.c:305:48: note: use '&' for a bitwise operation
+ if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+ ^~
+ &
+arch/mips/lantiq/irq.c:305:48: note: remove constant to silence this
+warning
+ if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
+ ~^~~~~~~~~~~~~~~~~~~~
+1 error generated.
+
+Explicitly compare the constant LTQ_EBU_PCC_ISTAT against 0 to fix the
+warning. Additionally, remove the unnecessary parentheses as this is a
+simple conditional statement and shorthand '== 0' to '!'.
+
+Fixes: 3645da0276ae ("OF: MIPS: lantiq: implement irq_domain support")
+Link: https://github.com/ClangBuiltLinux/linux/issues/807
+Reported-by: Dmitry Golovin <dima@golovin.in>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index df8eed3875f6d..43c2f271e6ab4 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -302,7 +302,7 @@ static void ltq_hw_irq_handler(struct irq_desc *desc)
+ generic_handle_irq(irq_linear_revmap(ltq_domain, hwirq));
+
+ /* if this is a EBU irq, we need to ack it or get a deadlock */
+- if ((irq == LTQ_ICU_EBU_IRQ) && (module == 0) && LTQ_EBU_PCC_ISTAT)
++ if (irq == LTQ_ICU_EBU_IRQ && !module && LTQ_EBU_PCC_ISTAT != 0)
+ ltq_ebu_w32(ltq_ebu_r32(LTQ_EBU_PCC_ISTAT) | 0x10,
+ LTQ_EBU_PCC_ISTAT);
+ }
+--
+2.27.0
+
--- /dev/null
+From 459b42da7b003c01ec2f32d4e35bd56ae6ea56a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 11:56:28 +0000
+Subject: MIPS: properly stop .eh_frame generation
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+[ Upstream commit 894ef530012fb5078466efdfb2c15d8b2f1565cd ]
+
+Commit 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly") added
+-fno-asynchronous-unwind-tables to KBUILD_CFLAGS to prevent compiler
+from emitting .eh_frame symbols.
+However, as MIPS heavily uses CFI, that's not enough. Use the
+approach taken for x86 (as it also uses CFI) and explicitly put CFI
+symbols into the .debug_frame section (except for VDSO).
+This allows us to drop .eh_frame from DISCARDS as it's no longer
+being generated.
+
+Fixes: 866b6a89c6d1 ("MIPS: Add DWARF unwinding to assembly")
+Suggested-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/asm.h | 18 ++++++++++++++++++
+ arch/mips/kernel/vmlinux.lds.S | 1 -
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/include/asm/asm.h b/arch/mips/include/asm/asm.h
+index 3682d1a0bb808..ea4b62ece3366 100644
+--- a/arch/mips/include/asm/asm.h
++++ b/arch/mips/include/asm/asm.h
+@@ -20,10 +20,27 @@
+ #include <asm/sgidefs.h>
+ #include <asm/asm-eva.h>
+
++#ifndef __VDSO__
++/*
++ * Emit CFI data in .debug_frame sections, not .eh_frame sections.
++ * We don't do DWARF unwinding at runtime, so only the offline DWARF
++ * information is useful to anyone. Note we should change this if we
++ * ever decide to enable DWARF unwinding at runtime.
++ */
++#define CFI_SECTIONS .cfi_sections .debug_frame
++#else
++ /*
++ * For the vDSO, emit both runtime unwind information and debug
++ * symbols for the .dbg file.
++ */
++#define CFI_SECTIONS
++#endif
++
+ /*
+ * LEAF - declare leaf routine
+ */
+ #define LEAF(symbol) \
++ CFI_SECTIONS; \
+ .globl symbol; \
+ .align 2; \
+ .type symbol, @function; \
+@@ -36,6 +53,7 @@ symbol: .frame sp, 0, ra; \
+ * NESTED - declare nested routine entry point
+ */
+ #define NESTED(symbol, framesize, rpc) \
++ CFI_SECTIONS; \
+ .globl symbol; \
+ .align 2; \
+ .type symbol, @function; \
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 83e27a181206a..09fa4705ce8eb 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -224,6 +224,5 @@ SECTIONS
+ *(.options)
+ *(.pdr)
+ *(.reginfo)
+- *(.eh_frame)
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From 890caf3a6fcbf39dfb86d05751ec560c03d2dd0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 18:11:21 +0800
+Subject: MIPS: relocatable: Provide kaslr_offset() to get the kernel offset
+
+From: Jinyang He <hejinyang@loongson.cn>
+
+[ Upstream commit d4d3ef8b347b73aa60f60f4be06acf1643e79f34 ]
+
+Provide kaslr_offset() to get the kernel offset when KASLR is enabled.
+Error may occur before update_kaslr_offset(), so put it at the end of
+the offset branch.
+
+Fixes: a307a4ce9ecd ("MIPS: Loongson64: Add KASLR support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Jinyang He <hejinyang@loongson.cn>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/page.h | 6 ++++++
+ arch/mips/kernel/relocate.c | 10 ++++++++++
+ arch/mips/kernel/setup.c | 3 +++
+ 3 files changed, 19 insertions(+)
+
+diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
+index 6a77bc4a6eec4..74082e35d57c8 100644
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -255,6 +255,12 @@ extern bool __virt_addr_valid(const volatile void *kaddr);
+
+ #define VM_DATA_DEFAULT_FLAGS VM_DATA_FLAGS_TSK_EXEC
+
++extern unsigned long __kaslr_offset;
++static inline unsigned long kaslr_offset(void)
++{
++ return __kaslr_offset;
++}
++
+ #include <asm-generic/memory_model.h>
+ #include <asm-generic/getorder.h>
+
+diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
+index 0e365b7c742d9..ac16cf2716df5 100644
+--- a/arch/mips/kernel/relocate.c
++++ b/arch/mips/kernel/relocate.c
+@@ -300,6 +300,13 @@ static inline int __init relocation_addr_valid(void *loc_new)
+ return 1;
+ }
+
++static inline void __init update_kaslr_offset(unsigned long *addr, long offset)
++{
++ unsigned long *new_addr = (unsigned long *)RELOCATED(addr);
++
++ *new_addr = (unsigned long)offset;
++}
++
+ #if defined(CONFIG_USE_OF)
+ void __weak *plat_get_fdt(void)
+ {
+@@ -410,6 +417,9 @@ void *__init relocate_kernel(void)
+
+ /* Return the new kernel's entry point */
+ kernel_entry = RELOCATED(start_kernel);
++
++ /* Error may occur before, so keep it at last */
++ update_kaslr_offset(&__kaslr_offset, offset);
+ }
+ out:
+ return kernel_entry;
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 7e1f8e2774373..83ec0d5a0918b 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -84,6 +84,9 @@ static struct resource code_resource = { .name = "Kernel code", };
+ static struct resource data_resource = { .name = "Kernel data", };
+ static struct resource bss_resource = { .name = "Kernel bss", };
+
++unsigned long __kaslr_offset __ro_after_init;
++EXPORT_SYMBOL(__kaslr_offset);
++
+ static void *detect_magic __initdata = detect_memory_region;
+
+ #ifdef CONFIG_MIPS_AUTO_PFN_OFFSET
+--
+2.27.0
+
--- /dev/null
+From 65fbe1fb3c4bb17672e51bdca0f2283573f393f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 10:42:52 +0530
+Subject: misc: eeprom_93xx46: Add module alias to avoid breaking support for
+ non device tree users
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 4540b9fbd8ebb21bb3735796d300a1589ee5fbf2 ]
+
+Module alias "spi:93xx46" is used by non device tree users like
+drivers/misc/eeprom/digsy_mtc_eeprom.c and removing it will
+break support for them.
+
+Fix this by adding back the module alias "spi:93xx46".
+
+Fixes: 13613a2246bf ("misc: eeprom_93xx46: Fix module alias to enable module autoprobe")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Link: https://lore.kernel.org/r/20210113051253.15061-1-a-govindraju@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 206d920dc92fc..d92c4d2c521a3 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -511,4 +511,5 @@ module_spi_driver(eeprom_93xx46_driver);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
++MODULE_ALIAS("spi:93xx46");
+ MODULE_ALIAS("spi:eeprom-93xx46");
+--
+2.27.0
+
--- /dev/null
+From 2c3a7f8917aac53bb3e8a42ec95b65121e3c2c87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jan 2021 22:09:53 +0530
+Subject: misc: eeprom_93xx46: Fix module alias to enable module autoprobe
+
+From: Aswath Govindraju <a-govindraju@ti.com>
+
+[ Upstream commit 13613a2246bf531f5fc04e8e62e8f21a3d39bf1c ]
+
+Fix module autoprobe by correcting module alias to match the string from
+/sys/class/.../spi1.0/modalias content.
+
+Fixes: 06b4501e88ad ("misc/eeprom: add driver for microwire 93xx46 EEPROMs")
+Signed-off-by: Aswath Govindraju <a-govindraju@ti.com>
+Link: https://lore.kernel.org/r/20210107163957.28664-2-a-govindraju@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/eeprom_93xx46.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
+index 7c45f82b43027..206d920dc92fc 100644
+--- a/drivers/misc/eeprom/eeprom_93xx46.c
++++ b/drivers/misc/eeprom/eeprom_93xx46.c
+@@ -511,4 +511,4 @@ module_spi_driver(eeprom_93xx46_driver);
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Driver for 93xx46 EEPROMs");
+ MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
+-MODULE_ALIAS("spi:93xx46");
++MODULE_ALIAS("spi:eeprom-93xx46");
+--
+2.27.0
+
--- /dev/null
+From 0c3a138bf7f823d93964b577e4ae6982cfd2f373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 15:04:01 -0500
+Subject: misc: fastrpc: fix incorrect usage of dma_map_sgtable
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit b212658aebda82f92967bcbd4c7380d607c3d803 ]
+
+dma_map_sgtable() returns 0 on success, which is the opposite of what this
+code was doing.
+
+Fixes: 7cd7edb89437 ("misc: fastrpc: fix common struct sg_table related issues")
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Link: https://lore.kernel.org/r/20210208200401.31100-1-jonathan@marek.ca
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/fastrpc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
+index 70eb5ed942d03..f12e909034ac0 100644
+--- a/drivers/misc/fastrpc.c
++++ b/drivers/misc/fastrpc.c
+@@ -520,12 +520,13 @@ fastrpc_map_dma_buf(struct dma_buf_attachment *attachment,
+ {
+ struct fastrpc_dma_buf_attachment *a = attachment->priv;
+ struct sg_table *table;
++ int ret;
+
+ table = &a->sgt;
+
+- if (!dma_map_sgtable(attachment->dev, table, dir, 0))
+- return ERR_PTR(-ENOMEM);
+-
++ ret = dma_map_sgtable(attachment->dev, table, dir, 0);
++ if (ret)
++ table = ERR_PTR(ret);
+ return table;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From fa015008f4285e0e5d8f86f7116c05ab7dfc8d37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:09:36 -0800
+Subject: mm/compaction: fix misbehaviors of fast_find_migrateblock()
+
+From: Wonhyuk Yang <vvghjk1234@gmail.com>
+
+[ Upstream commit 15d28d0d11609c7a4f217b3d85e26456d9beb134 ]
+
+In the fast_find_migrateblock(), it iterates ocer the freelist to find the
+proper pageblock. But there are some misbehaviors.
+
+First, if the page we found is equal to cc->migrate_pfn, it is considered
+that we didn't find a suitable pageblock. Secondly, if the loop was
+terminated because order is less than PAGE_ALLOC_COSTLY_ORDER, it could be
+considered that we found a suitable one. Thirdly, if the skip bit is set
+on the page block and we goto continue, it doesn't check nr_scanned.
+Fourthly, if the page block's skip bit is set, it checks that page block
+is the last of list, which is unnecessary.
+
+Link: https://lkml.kernel.org/r/20210128130411.6125-1-vvghjk1234@gmail.com
+Fixes: 70b44595eafe9 ("mm, compaction: use free lists to quickly locate a migration source")
+Signed-off-by: Wonhyuk Yang <vvghjk1234@gmail.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/compaction.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/mm/compaction.c b/mm/compaction.c
+index 190ccdaa6c192..2135c32efe8be 100644
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -1702,6 +1702,7 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ unsigned long pfn = cc->migrate_pfn;
+ unsigned long high_pfn;
+ int order;
++ bool found_block = false;
+
+ /* Skip hints are relied on to avoid repeats on the fast search */
+ if (cc->ignore_skip_hint)
+@@ -1744,7 +1745,7 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ high_pfn = pageblock_start_pfn(cc->migrate_pfn + distance);
+
+ for (order = cc->order - 1;
+- order >= PAGE_ALLOC_COSTLY_ORDER && pfn == cc->migrate_pfn && nr_scanned < limit;
++ order >= PAGE_ALLOC_COSTLY_ORDER && !found_block && nr_scanned < limit;
+ order--) {
+ struct free_area *area = &cc->zone->free_area[order];
+ struct list_head *freelist;
+@@ -1759,7 +1760,11 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ list_for_each_entry(freepage, freelist, lru) {
+ unsigned long free_pfn;
+
+- nr_scanned++;
++ if (nr_scanned++ >= limit) {
++ move_freelist_tail(freelist, freepage);
++ break;
++ }
++
+ free_pfn = page_to_pfn(freepage);
+ if (free_pfn < high_pfn) {
+ /*
+@@ -1768,12 +1773,8 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ * the list assumes an entry is deleted, not
+ * reordered.
+ */
+- if (get_pageblock_skip(freepage)) {
+- if (list_is_last(freelist, &freepage->lru))
+- break;
+-
++ if (get_pageblock_skip(freepage))
+ continue;
+- }
+
+ /* Reorder to so a future search skips recent pages */
+ move_freelist_tail(freelist, freepage);
+@@ -1781,15 +1782,10 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ update_fast_start_pfn(cc, free_pfn);
+ pfn = pageblock_start_pfn(free_pfn);
+ cc->fast_search_fail = 0;
++ found_block = true;
+ set_pageblock_skip(freepage);
+ break;
+ }
+-
+- if (nr_scanned >= limit) {
+- cc->fast_search_fail++;
+- move_freelist_tail(freelist, freepage);
+- break;
+- }
+ }
+ spin_unlock_irqrestore(&cc->zone->lock, flags);
+ }
+@@ -1800,9 +1796,10 @@ static unsigned long fast_find_migrateblock(struct compact_control *cc)
+ * If fast scanning failed then use a cached entry for a page block
+ * that had free pages as the basis for starting a linear scan.
+ */
+- if (pfn == cc->migrate_pfn)
++ if (!found_block) {
++ cc->fast_search_fail++;
+ pfn = reinit_migrate_pfn(cc);
+-
++ }
+ return pfn;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From e76862967cf8a88defced975ec96d76ea3e05058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:17:08 -0800
+Subject: mm: fix memory_failure() handling of dax-namespace metadata
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+[ Upstream commit 34dc45be4563f344d59ba0428416d0d265aa4f4d ]
+
+Given 'struct dev_pagemap' spans both data pages and metadata pages be
+careful to consult the altmap if present to delineate metadata. In fact
+the pfn_first() helper already identifies the first valid data pfn, so
+export that helper for other code paths via pgmap_pfn_valid().
+
+Other usage of get_dev_pagemap() are not a concern because those are
+operating on known data pfns having been looked up by get_user_pages().
+I.e. metadata pfns are never user mapped.
+
+Link: https://lkml.kernel.org/r/161058501758.1840162.4239831989762604527.stgit@dwillia2-desk3.amr.corp.intel.com
+Fixes: 6100e34b2526 ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reported-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Qian Cai <cai@lca.pw>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/memremap.h | 6 ++++++
+ mm/memory-failure.c | 6 ++++++
+ mm/memremap.c | 15 +++++++++++++++
+ 3 files changed, 27 insertions(+)
+
+diff --git a/include/linux/memremap.h b/include/linux/memremap.h
+index 79c49e7f5c304..f5b464daeeca5 100644
+--- a/include/linux/memremap.h
++++ b/include/linux/memremap.h
+@@ -137,6 +137,7 @@ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap);
+ void devm_memunmap_pages(struct device *dev, struct dev_pagemap *pgmap);
+ struct dev_pagemap *get_dev_pagemap(unsigned long pfn,
+ struct dev_pagemap *pgmap);
++bool pgmap_pfn_valid(struct dev_pagemap *pgmap, unsigned long pfn);
+
+ unsigned long vmem_altmap_offset(struct vmem_altmap *altmap);
+ void vmem_altmap_free(struct vmem_altmap *altmap, unsigned long nr_pfns);
+@@ -165,6 +166,11 @@ static inline struct dev_pagemap *get_dev_pagemap(unsigned long pfn,
+ return NULL;
+ }
+
++static inline bool pgmap_pfn_valid(struct dev_pagemap *pgmap, unsigned long pfn)
++{
++ return false;
++}
++
+ static inline unsigned long vmem_altmap_offset(struct vmem_altmap *altmap)
+ {
+ return 0;
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index e9481632fcd1b..4e3684d694c12 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1308,6 +1308,12 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,
+ */
+ put_page(page);
+
++ /* device metadata space is not recoverable */
++ if (!pgmap_pfn_valid(pgmap, pfn)) {
++ rc = -ENXIO;
++ goto out;
++ }
++
+ /*
+ * Prevent the inode from being freed while we are interrogating
+ * the address_space, typically this would be handled by
+diff --git a/mm/memremap.c b/mm/memremap.c
+index 16b2fb482da11..2455bac895066 100644
+--- a/mm/memremap.c
++++ b/mm/memremap.c
+@@ -80,6 +80,21 @@ static unsigned long pfn_first(struct dev_pagemap *pgmap, int range_id)
+ return pfn + vmem_altmap_offset(pgmap_altmap(pgmap));
+ }
+
++bool pgmap_pfn_valid(struct dev_pagemap *pgmap, unsigned long pfn)
++{
++ int i;
++
++ for (i = 0; i < pgmap->nr_range; i++) {
++ struct range *range = &pgmap->ranges[i];
++
++ if (pfn >= PHYS_PFN(range->start) &&
++ pfn <= PHYS_PFN(range->end))
++ return pfn >= pfn_first(pgmap, i);
++ }
++
++ return false;
++}
++
+ static unsigned long pfn_end(struct dev_pagemap *pgmap, int range_id)
+ {
+ const struct range *range = &pgmap->ranges[range_id];
+--
+2.27.0
+
--- /dev/null
+From 9c07297f5d70434c447b27edd5c4c53f12101215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:06:50 -0800
+Subject: mm/hugetlb: fix potential double free in hugetlb_register_node()
+ error path
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit cc2205a67dec5a700227a693fc113441e73e4641 ]
+
+In hugetlb_sysfs_add_hstate(), we would do kobject_put() on hstate_kobjs
+when failed to create sysfs group but forget to set hstate_kobjs to NULL.
+Then in hugetlb_register_node() error path, we may free it again via
+hugetlb_unregister_node().
+
+Link: https://lkml.kernel.org/r/20210107123249.36964-1-linmiaohe@huawei.com
+Fixes: a3437870160c ("hugetlb: new sysfs interface")
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Reviewed-by: Muchun Song <smuchun@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/hugetlb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 4bdb58ab14cbb..bc61eea60e07e 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2988,8 +2988,10 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
+ return -ENOMEM;
+
+ retval = sysfs_create_group(hstate_kobjs[hi], hstate_attr_group);
+- if (retval)
++ if (retval) {
+ kobject_put(hstate_kobjs[hi]);
++ hstate_kobjs[hi] = NULL;
++ }
+
+ return retval;
+ }
+--
+2.27.0
+
--- /dev/null
+From 1d579808a2adce35d818078ed3351e465594633b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:07:58 -0800
+Subject: mm/hugetlb: suppress wrong warning info when alloc gigantic page
+
+From: Chen Wandun <chenwandun@huawei.com>
+
+[ Upstream commit 7ecc956551f8a66618f71838c790a9b0b4f9ca10 ]
+
+If hugetlb_cma is enabled, it will skip boot time allocation when
+allocating gigantic page, that doesn't means allocation failure, so
+suppress this warning info.
+
+Link: https://lkml.kernel.org/r/20210219123909.13130-1-chenwandun@huawei.com
+Fixes: cf11e85fc08c ("mm: hugetlb: optionally allocate gigantic hugepages using cma")
+Signed-off-by: Chen Wandun <chenwandun@huawei.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Roman Gushchin <guro@fb.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/hugetlb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index bc61eea60e07e..63d15f0a6629f 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2520,7 +2520,7 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h)
+ if (hstate_is_gigantic(h)) {
+ if (hugetlb_cma_size) {
+ pr_warn_once("HugeTLB: hugetlb_cma is enabled, skip boot time allocation\n");
+- break;
++ goto free;
+ }
+ if (!alloc_bootmem_huge_page(h))
+ break;
+@@ -2538,7 +2538,7 @@ static void __init hugetlb_hstate_alloc_pages(struct hstate *h)
+ h->max_huge_pages, buf, i);
+ h->max_huge_pages = i;
+ }
+-
++free:
+ kfree(node_alloc_noretry);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7da59cb54437d1f9a30650404254b230f9226449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:03:19 -0800
+Subject: mm: memcontrol: fix NR_ANON_THPS accounting in charge moving
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit b0ba3bff3e7bb6b58bb248bdd2f3d8ad52fd10c3 ]
+
+Patch series "Convert all THP vmstat counters to pages", v6.
+
+This patch series is aimed to convert all THP vmstat counters to pages.
+
+The unit of some vmstat counters are pages, some are bytes, some are
+HPAGE_PMD_NR, and some are KiB. When we want to expose these vmstat
+counters to the userspace, we have to know the unit of the vmstat counters
+is which one. When the unit is bytes or kB, both clearly distinguishable
+by the B/KB suffix. But for the THP vmstat counters, we may make mistakes.
+
+For example, the below is some bug fix for the THP vmstat counters:
+
+ - 7de2e9f195b9 ("mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg")
+ - The first commit in this series ("fix NR_ANON_THPS accounting in charge moving")
+
+This patch series can make the code clear. And make all the unit of the THP
+vmstat counters in pages. Finally, the unit of the vmstat counters are
+pages, kB and bytes. The B/KB suffix can tell us that the unit is bytes
+or kB. The rest which is without suffix are pages.
+
+In this series, I changed the following vmstat counters unit from HPAGE_PMD_NR
+to pages. However, there is no change to the print format of output to user
+space.
+
+ - NR_ANON_THPS
+ - NR_FILE_THPS
+ - NR_SHMEM_THPS
+ - NR_SHMEM_PMDMAPPED
+ - NR_FILE_PMDMAPPED
+
+Doing this also can make the statistics more accuracy for the THP vmstat
+counters. This series is consistent with 8f182270dfec ("mm/swap.c: flush lru
+pvecs on compound page arrival").
+
+Because we use struct per_cpu_nodestat to cache the vmstat counters, which
+leads to inaccurate statistics especially THP vmstat counters. In the systems
+with hundreds of processors it can be GBs of memory. For example, for a 96
+CPUs system, the threshold is the maximum number of 125. And the per cpu
+counters can cache 23.4375 GB in total.
+
+The THP page is already a form of batched addition (it will add 512 worth of
+memory in one go) so skipping the batching seems like sensible. Although every
+THP stats update overflows the per-cpu counter, resorting to atomic global
+updates. But it can make the statistics more accuracy for the THP vmstat
+counters. From this point of view, I think that do this converting is
+reasonable.
+
+Thanks Hugh for mentioning this. This was inspired by Johannes and Roman.
+Thanks to them.
+
+This patch (of 7):
+
+The unit of NR_ANON_THPS is HPAGE_PMD_NR already. So it should inc/dec by
+one rather than nr_pages.
+
+Link: https://lkml.kernel.org/r/20201228164110.2838-1-songmuchun@bytedance.com
+Link: https://lkml.kernel.org/r/20201228164110.2838-2-songmuchun@bytedance.com
+Fixes: 468c398233da ("mm: memcontrol: switch to native NR_ANON_THPS counter")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Feng Tang <feng.tang@intel.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: NeilBrown <neilb@suse.de>
+Cc: Rafael. J. Wysocki <rafael@kernel.org>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Sami Tolvanen <samitolvanen@google.com>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memcontrol.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 913c2b9e5c72d..9f4db41d8e161 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -5637,10 +5637,8 @@ static int mem_cgroup_move_account(struct page *page,
+ __mod_lruvec_state(from_vec, NR_ANON_MAPPED, -nr_pages);
+ __mod_lruvec_state(to_vec, NR_ANON_MAPPED, nr_pages);
+ if (PageTransHuge(page)) {
+- __mod_lruvec_state(from_vec, NR_ANON_THPS,
+- -nr_pages);
+- __mod_lruvec_state(to_vec, NR_ANON_THPS,
+- nr_pages);
++ __dec_lruvec_state(from_vec, NR_ANON_THPS);
++ __inc_lruvec_state(to_vec, NR_ANON_THPS);
+ }
+
+ }
+--
+2.27.0
+
--- /dev/null
+From 15b27af9397053e684ba3874b6be7d0517cf4374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:04:26 -0800
+Subject: mm: memcontrol: fix slub memory accounting
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Muchun Song <songmuchun@bytedance.com>
+
+[ Upstream commit 96403bfe50c344b587ea53894954a9d152af1c9d ]
+
+SLUB currently account kmalloc() and kmalloc_node() allocations larger
+than order-1 page per-node. But it forget to update the per-memcg
+vmstats. So it can lead to inaccurate statistics of "slab_unreclaimable"
+which is from memory.stat. Fix it by using mod_lruvec_page_state instead
+of mod_node_page_state.
+
+Link: https://lkml.kernel.org/r/20210223092423.42420-1-songmuchun@bytedance.com
+Fixes: 6a486c0ad4dc ("mm, sl[ou]b: improve memory accounting")
+Signed-off-by: Muchun Song <songmuchun@bytedance.com>
+Reviewed-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Reviewed-by: Michal Koutný <mkoutny@suse.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/slab_common.c | 4 ++--
+ mm/slub.c | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index e981c80d216c2..0b775cb5c1089 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -837,8 +837,8 @@ void *kmalloc_order(size_t size, gfp_t flags, unsigned int order)
+ page = alloc_pages(flags, order);
+ if (likely(page)) {
+ ret = page_address(page);
+- mod_node_page_state(page_pgdat(page), NR_SLAB_UNRECLAIMABLE_B,
+- PAGE_SIZE << order);
++ mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B,
++ PAGE_SIZE << order);
+ }
+ ret = kasan_kmalloc_large(ret, size, flags);
+ /* As ret might get tagged, call kmemleak hook after KASAN. */
+diff --git a/mm/slub.c b/mm/slub.c
+index b22a4b101c846..69dacc61b8435 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -3999,8 +3999,8 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
+ page = alloc_pages_node(node, flags, order);
+ if (page) {
+ ptr = page_address(page);
+- mod_node_page_state(page_pgdat(page), NR_SLAB_UNRECLAIMABLE_B,
+- PAGE_SIZE << order);
++ mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B,
++ PAGE_SIZE << order);
+ }
+
+ return kmalloc_large_node_hook(ptr, size, flags);
+@@ -4131,8 +4131,8 @@ void kfree(const void *x)
+
+ BUG_ON(!PageCompound(page));
+ kfree_hook(object);
+- mod_node_page_state(page_pgdat(page), NR_SLAB_UNRECLAIMABLE_B,
+- -(PAGE_SIZE << order));
++ mod_lruvec_page_state(page, NR_SLAB_UNRECLAIMABLE_B,
++ -(PAGE_SIZE << order));
+ __free_pages(page, order);
+ return;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4b3e56fb0247270c71c847e6da53c865784ba724 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:04:33 -0800
+Subject: mm/memory.c: fix potential pte_unmap_unlock pte error
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit 90a3e375d324b2255b83e3dd29e99e2b05d82aaf ]
+
+Since commit 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged
+high MMIO PROT_NONE mappings"), when the first pfn modify is not allowed,
+we would break the loop with pte unchanged. Then the wrong pte - 1 would
+be passed to pte_unmap_unlock.
+
+Andi said:
+
+ "While the fix is correct, I'm not sure if it actually is a real bug.
+ Is there any architecture that would do something else than unlocking
+ the underlying page? If it's just the underlying page then it should
+ be always the same page, so no bug"
+
+Link: https://lkml.kernel.org/r/20210109080118.20885-1-linmiaohe@huawei.com
+Fixes: 42e4089c789 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
+Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memory.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 985dac0958dcf..db2a50637569f 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2165,11 +2165,11 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long addr, unsigned long end,
+ unsigned long pfn, pgprot_t prot)
+ {
+- pte_t *pte;
++ pte_t *pte, *mapped_pte;
+ spinlock_t *ptl;
+ int err = 0;
+
+- pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
++ mapped_pte = pte = pte_alloc_map_lock(mm, pmd, addr, &ptl);
+ if (!pte)
+ return -ENOMEM;
+ arch_enter_lazy_mmu_mode();
+@@ -2183,7 +2183,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ pfn++;
+ } while (pte++, addr += PAGE_SIZE, addr != end);
+ arch_leave_lazy_mmu_mode();
+- pte_unmap_unlock(pte - 1, ptl);
++ pte_unmap_unlock(mapped_pte, ptl);
+ return err;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 62af796a1b3067eff674521052ab104941e76912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 23:53:42 +0000
+Subject: mm: proc: Invalidate TLB after clearing soft-dirty page state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 912efa17e5121693dfbadae29768f4144a3f9e62 ]
+
+Since commit 0758cd830494 ("asm-generic/tlb: avoid potential double
+flush"), TLB invalidation is elided in tlb_finish_mmu() if no entries
+were batched via the tlb_remove_*() functions. Consequently, the
+page-table modifications performed by clear_refs_write() in response to
+a write to /proc/<pid>/clear_refs do not perform TLB invalidation.
+Although this is fine when simply aging the ptes, in the case of
+clearing the "soft-dirty" state we can end up with entries where
+pte_write() is false, yet a writable mapping remains in the TLB.
+
+Fix this by avoiding the mmu_gather API altogether: managing both the
+'tlb_flush_pending' flag on the 'mm_struct' and explicit TLB
+invalidation for the sort-dirty path, much like mprotect() does already.
+
+Fixes: 0758cd830494 ("asm-generic/tlb: avoid potential double flush”)
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Yu Zhao <yuzhao@google.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
+Link: https://lkml.kernel.org/r/20210127235347.1402-2-will@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/task_mmu.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 602e3a52884d8..3cec6fbef725e 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -1210,7 +1210,6 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
+ struct mm_struct *mm;
+ struct vm_area_struct *vma;
+ enum clear_refs_types type;
+- struct mmu_gather tlb;
+ int itype;
+ int rv;
+
+@@ -1249,7 +1248,6 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
+ goto out_unlock;
+ }
+
+- tlb_gather_mmu(&tlb, mm, 0, -1);
+ if (type == CLEAR_REFS_SOFT_DIRTY) {
+ for (vma = mm->mmap; vma; vma = vma->vm_next) {
+ if (!(vma->vm_flags & VM_SOFTDIRTY))
+@@ -1258,15 +1256,18 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf,
+ vma_set_page_prot(vma);
+ }
+
++ inc_tlb_flush_pending(mm);
+ mmu_notifier_range_init(&range, MMU_NOTIFY_SOFT_DIRTY,
+ 0, NULL, mm, 0, -1UL);
+ mmu_notifier_invalidate_range_start(&range);
+ }
+ walk_page_range(mm, 0, mm->highest_vm_end, &clear_refs_walk_ops,
+ &cp);
+- if (type == CLEAR_REFS_SOFT_DIRTY)
++ if (type == CLEAR_REFS_SOFT_DIRTY) {
+ mmu_notifier_invalidate_range_end(&range);
+- tlb_finish_mmu(&tlb, 0, -1);
++ flush_tlb_mm(mm);
++ dec_tlb_flush_pending(mm);
++ }
+ out_unlock:
+ mmap_write_unlock(mm);
+ out_mm:
+--
+2.27.0
+
--- /dev/null
+From 06b6b91c811ad9ac23fab05bc1292174b5b46648 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:18:09 -0800
+Subject: mm/rmap: fix potential pte_unmap on an not mapped pte
+
+From: Miaohe Lin <linmiaohe@huawei.com>
+
+[ Upstream commit 5d5d19eda6b0ee790af89c45e3f678345be6f50f ]
+
+For PMD-mapped page (usually THP), pvmw->pte is NULL. For PTE-mapped THP,
+pvmw->pte is mapped. But for HugeTLB pages, pvmw->pte is not mapped and
+set to the relevant page table entry. So in page_vma_mapped_walk_done(),
+we may do pte_unmap() for HugeTLB pte which is not mapped. Fix this by
+checking pvmw->page against PageHuge before trying to do pte_unmap().
+
+Link: https://lkml.kernel.org/r/20210127093349.39081-1-linmiaohe@huawei.com
+Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
+Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com>
+Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
+Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Nathan Chancellor <natechancellor@gmail.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Shakeel Butt <shakeelb@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
+Cc: Dmitry Safonov <0x7f454c46@gmail.com>
+Cc: Brian Geffon <bgeffon@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/rmap.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index 70085ca1a3fc9..def5c62c93b3b 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -213,7 +213,8 @@ struct page_vma_mapped_walk {
+
+ static inline void page_vma_mapped_walk_done(struct page_vma_mapped_walk *pvmw)
+ {
+- if (pvmw->pte)
++ /* HugeTLB pte is set to the relevant page table entry without pte_mapped. */
++ if (pvmw->pte && !PageHuge(pvmw->page))
+ pte_unmap(pvmw->pte);
+ if (pvmw->ptl)
+ spin_unlock(pvmw->ptl);
+--
+2.27.0
+
--- /dev/null
+From 7507315d38e7f2a6f6725a4d8141eaefcc037cf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:16:25 -0800
+Subject: mm,thp,shmem: make khugepaged obey tmpfs mount flags
+
+From: Rik van Riel <riel@surriel.com>
+
+[ Upstream commit cd89fb06509903f942a0ffe97ffa63034671ed0c ]
+
+Currently if thp enabled=[madvise], mounting a tmpfs filesystem with
+huge=always and mmapping files from that tmpfs does not result in
+khugepaged collapsing those mappings, despite the mount flag indicating
+that it should.
+
+Fix that by breaking up the blocks of tests in hugepage_vma_check a little
+bit, and testing things in the correct order.
+
+Link: https://lkml.kernel.org/r/20201124194925.623931-4-riel@surriel.com
+Fixes: c2231020ea7b ("mm: thp: register mm for khugepaged when merging vma for shmem")
+Signed-off-by: Rik van Riel <riel@surriel.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Xu Yu <xuyu@linux.alibaba.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/khugepaged.h | 2 ++
+ mm/khugepaged.c | 22 ++++++++++++++++------
+ 2 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index c941b73773216..2fcc01891b474 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -3,6 +3,7 @@
+ #define _LINUX_KHUGEPAGED_H
+
+ #include <linux/sched/coredump.h> /* MMF_VM_HUGEPAGE */
++#include <linux/shmem_fs.h>
+
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+@@ -57,6 +58,7 @@ static inline int khugepaged_enter(struct vm_area_struct *vma,
+ {
+ if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags))
+ if ((khugepaged_always() ||
++ (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) ||
+ (khugepaged_req_madv() && (vm_flags & VM_HUGEPAGE))) &&
+ !(vm_flags & VM_NOHUGEPAGE) &&
+ !test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags))
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 67ab391a53739..494d3cb0b58a3 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -442,18 +442,28 @@ static inline int khugepaged_test_exit(struct mm_struct *mm)
+ static bool hugepage_vma_check(struct vm_area_struct *vma,
+ unsigned long vm_flags)
+ {
+- if ((!(vm_flags & VM_HUGEPAGE) && !khugepaged_always()) ||
+- (vm_flags & VM_NOHUGEPAGE) ||
++ /* Explicitly disabled through madvise. */
++ if ((vm_flags & VM_NOHUGEPAGE) ||
+ test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags))
+ return false;
+
+- if (shmem_file(vma->vm_file) ||
+- (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) &&
+- vma->vm_file &&
+- (vm_flags & VM_DENYWRITE))) {
++ /* Enabled via shmem mount options or sysfs settings. */
++ if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
+ return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
+ HPAGE_PMD_NR);
+ }
++
++ /* THP settings require madvise. */
++ if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
++ return false;
++
++ /* Read-only file mappings need to be aligned for THP to work. */
++ if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
++ (vm_flags & VM_DENYWRITE)) {
++ return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
++ HPAGE_PMD_NR);
++ }
++
+ if (!vma->anon_vma || vma->vm_ops)
+ return false;
+ if (vma_is_temporary_stack(vma))
+--
+2.27.0
+
--- /dev/null
+From f25de5546968eee5687e59116a2f9e9b4f209449 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 20:42:02 +0100
+Subject: mmc: owl-mmc: Fix a resource leak in an error handling path and in
+ the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5d15cbf63515c6183d2ed7c9dd0586b4db23ffb1 ]
+
+'dma_request_chan()' calls should be balanced by a corresponding
+'dma_release_channel()' call.
+
+Add the missing call both in the error handling path of the probe function
+and in the remove function.
+
+Fixes: ff65ffe46d28 ("mmc: Add Actions Semi Owl SoCs SD/MMC driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201209194202.54099-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/owl-mmc.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/owl-mmc.c b/drivers/mmc/host/owl-mmc.c
+index 53b81582f1afe..5490962dc8e53 100644
+--- a/drivers/mmc/host/owl-mmc.c
++++ b/drivers/mmc/host/owl-mmc.c
+@@ -640,7 +640,7 @@ static int owl_mmc_probe(struct platform_device *pdev)
+ owl_host->irq = platform_get_irq(pdev, 0);
+ if (owl_host->irq < 0) {
+ ret = -EINVAL;
+- goto err_free_host;
++ goto err_release_channel;
+ }
+
+ ret = devm_request_irq(&pdev->dev, owl_host->irq, owl_irq_handler,
+@@ -648,19 +648,21 @@ static int owl_mmc_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to request irq %d\n",
+ owl_host->irq);
+- goto err_free_host;
++ goto err_release_channel;
+ }
+
+ ret = mmc_add_host(mmc);
+ if (ret) {
+ dev_err(&pdev->dev, "Failed to add host\n");
+- goto err_free_host;
++ goto err_release_channel;
+ }
+
+ dev_dbg(&pdev->dev, "Owl MMC Controller Initialized\n");
+
+ return 0;
+
++err_release_channel:
++ dma_release_channel(owl_host->dma);
+ err_free_host:
+ mmc_free_host(mmc);
+
+@@ -674,6 +676,7 @@ static int owl_mmc_remove(struct platform_device *pdev)
+
+ mmc_remove_host(mmc);
+ disable_irq(owl_host->irq);
++ dma_release_channel(owl_host->dma);
+ mmc_free_host(mmc);
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From f0bdfd3b51878cbd8763bb8d47d01a45f9749398 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 19:29:31 +0900
+Subject: mmc: renesas_sdhi_internal_dmac: Fix DMA buffer alignment from 8 to
+ 128-bytes
+
+From: Takeshi Saito <takeshi.saito.xv@renesas.com>
+
+[ Upstream commit d7aefb2887601cf1fc3f86f55d43b2c9aece5e8f ]
+
+According to the latest datasheet, the internal DMAC buffer alignment
+R-Car Gen3 SDHI HW should be 128-bytes. So, fix it.
+
+Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com>
+[shimoda: revise commit description, rebase]
+Fixes: 2a68ea7896e3 ("mmc: renesas-sdhi: add support for R-Car Gen3 SDHI DMAC")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/1608114572-1892-2-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_internal_dmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index fe13e1ea22dcc..f3e76d6b3e3fe 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -186,8 +186,8 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
+ mmc_get_dma_dir(data)))
+ goto force_pio;
+
+- /* This DMAC cannot handle if buffer is not 8-bytes alignment */
+- if (!IS_ALIGNED(sg_dma_address(sg), 8))
++ /* This DMAC cannot handle if buffer is not 128-bytes alignment */
++ if (!IS_ALIGNED(sg_dma_address(sg), 128))
+ goto force_pio_with_unmap;
+
+ if (data->flags & MMC_DATA_READ) {
+--
+2.27.0
+
--- /dev/null
+From 54f61bafb1ab68fa79215a88fb8faae4618ea79f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 21:42:36 +0100
+Subject: mmc: sdhci-sprd: Fix some resource leaks in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit c9c256a8b0dc09c305c409d6264cc016af2ba38d ]
+
+'sdhci_remove_host()' and 'sdhci_pltfm_free()' should be used in place of
+'mmc_remove_host()' and 'mmc_free_host()'.
+
+This avoids some resource leaks, is more in line with the error handling
+path of the probe function, and is more consistent with other drivers.
+
+Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Orson Zhai <orson.zhai@gmail.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20201217204236.163446-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-sprd.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c
+index f85171edabeb9..5dc36efff47ff 100644
+--- a/drivers/mmc/host/sdhci-sprd.c
++++ b/drivers/mmc/host/sdhci-sprd.c
+@@ -708,14 +708,14 @@ static int sdhci_sprd_remove(struct platform_device *pdev)
+ {
+ struct sdhci_host *host = platform_get_drvdata(pdev);
+ struct sdhci_sprd_host *sprd_host = TO_SPRD_HOST(host);
+- struct mmc_host *mmc = host->mmc;
+
+- mmc_remove_host(mmc);
++ sdhci_remove_host(host, 0);
++
+ clk_disable_unprepare(sprd_host->clk_sdio);
+ clk_disable_unprepare(sprd_host->clk_enable);
+ clk_disable_unprepare(sprd_host->clk_2x_enable);
+
+- mmc_free_host(mmc);
++ sdhci_pltfm_free(pdev);
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 15b3b754734fbe407076639c6ed2c5eabb3302c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 22:09:22 +0100
+Subject: mmc: usdhi6rol0: Fix a resource leak in the error handling path of
+ the probe
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6052b3c370fb82dec28bcfff6d7ec0da84ac087a ]
+
+A call to 'ausdhi6_dma_release()' to undo a previous call to
+'usdhi6_dma_request()' is missing in the error handling path of the probe
+function.
+
+It is already present in the remove function.
+
+Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201217210922.165340-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/usdhi6rol0.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c
+index e2d5112d809dc..615f3d008af1e 100644
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1858,10 +1858,12 @@ static int usdhi6_probe(struct platform_device *pdev)
+
+ ret = mmc_add_host(mmc);
+ if (ret < 0)
+- goto e_clk_off;
++ goto e_release_dma;
+
+ return 0;
+
++e_release_dma:
++ usdhi6_dma_release(host);
+ e_clk_off:
+ clk_disable_unprepare(host->clk);
+ e_free_mmc:
+--
+2.27.0
+
--- /dev/null
+From 42f15ed46ba8a615e91d8608cea162e96bacc08a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 22:21:46 +0000
+Subject: module: harden ELF info handling
+
+From: Frank van der Linden <fllinden@amazon.com>
+
+[ Upstream commit ec2a29593c83ed71a7f16e3243941ebfcf75fdf6 ]
+
+5fdc7db644 ("module: setup load info before module_sig_check()")
+moved the ELF setup, so that it was done before the signature
+check. This made the module name available to signature error
+messages.
+
+However, the checks for ELF correctness in setup_load_info
+are not sufficient to prevent bad memory references due to
+corrupted offset fields, indices, etc.
+
+So, there's a regression in behavior here: a corrupt and unsigned
+(or badly signed) module, which might previously have been rejected
+immediately, can now cause an oops/crash.
+
+Harden ELF handling for module loading by doing the following:
+
+- Move the signature check back up so that it comes before ELF
+ initialization. It's best to do the signature check to see
+ if we can trust the module, before using the ELF structures
+ inside it. This also makes checks against info->len
+ more accurate again, as this field will be reduced by the
+ length of the signature in mod_check_sig().
+
+ The module name is now once again not available for error
+ messages during the signature check, but that seems like
+ a fair tradeoff.
+
+- Check if sections have offset / size fields that at least don't
+ exceed the length of the module.
+
+- Check if sections have section name offsets that don't fall
+ outside the section name table.
+
+- Add a few other sanity checks against invalid section indices,
+ etc.
+
+This is not an exhaustive consistency check, but the idea is to
+at least get through the signature and blacklist checks without
+crashing because of corrupted ELF info, and to error out gracefully
+for most issues that would have caused problems later on.
+
+Fixes: 5fdc7db6448a ("module: setup load info before module_sig_check()")
+Signed-off-by: Frank van der Linden <fllinden@amazon.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 143 +++++++++++++++++++++++++++++++++-----
+ kernel/module_signature.c | 2 +-
+ kernel/module_signing.c | 2 +-
+ 3 files changed, 126 insertions(+), 21 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 4bf30e4b3eaaa..fda42c0064db9 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2964,7 +2964,7 @@ static int module_sig_check(struct load_info *info, int flags)
+ }
+
+ if (is_module_sig_enforced()) {
+- pr_notice("%s: loading of %s is rejected\n", info->name, reason);
++ pr_notice("Loading of %s is rejected\n", reason);
+ return -EKEYREJECTED;
+ }
+
+@@ -2977,9 +2977,33 @@ static int module_sig_check(struct load_info *info, int flags)
+ }
+ #endif /* !CONFIG_MODULE_SIG */
+
+-/* Sanity checks against invalid binaries, wrong arch, weird elf version. */
+-static int elf_header_check(struct load_info *info)
++static int validate_section_offset(struct load_info *info, Elf_Shdr *shdr)
+ {
++ unsigned long secend;
++
++ /*
++ * Check for both overflow and offset/size being
++ * too large.
++ */
++ secend = shdr->sh_offset + shdr->sh_size;
++ if (secend < shdr->sh_offset || secend > info->len)
++ return -ENOEXEC;
++
++ return 0;
++}
++
++/*
++ * Sanity checks against invalid binaries, wrong arch, weird elf version.
++ *
++ * Also do basic validity checks against section offsets and sizes, the
++ * section name string table, and the indices used for it (sh_name).
++ */
++static int elf_validity_check(struct load_info *info)
++{
++ unsigned int i;
++ Elf_Shdr *shdr, *strhdr;
++ int err;
++
+ if (info->len < sizeof(*(info->hdr)))
+ return -ENOEXEC;
+
+@@ -2989,11 +3013,78 @@ static int elf_header_check(struct load_info *info)
+ || info->hdr->e_shentsize != sizeof(Elf_Shdr))
+ return -ENOEXEC;
+
++ /*
++ * e_shnum is 16 bits, and sizeof(Elf_Shdr) is
++ * known and small. So e_shnum * sizeof(Elf_Shdr)
++ * will not overflow unsigned long on any platform.
++ */
+ if (info->hdr->e_shoff >= info->len
+ || (info->hdr->e_shnum * sizeof(Elf_Shdr) >
+ info->len - info->hdr->e_shoff))
+ return -ENOEXEC;
+
++ info->sechdrs = (void *)info->hdr + info->hdr->e_shoff;
++
++ /*
++ * Verify if the section name table index is valid.
++ */
++ if (info->hdr->e_shstrndx == SHN_UNDEF
++ || info->hdr->e_shstrndx >= info->hdr->e_shnum)
++ return -ENOEXEC;
++
++ strhdr = &info->sechdrs[info->hdr->e_shstrndx];
++ err = validate_section_offset(info, strhdr);
++ if (err < 0)
++ return err;
++
++ /*
++ * The section name table must be NUL-terminated, as required
++ * by the spec. This makes strcmp and pr_* calls that access
++ * strings in the section safe.
++ */
++ info->secstrings = (void *)info->hdr + strhdr->sh_offset;
++ if (info->secstrings[strhdr->sh_size - 1] != '\0')
++ return -ENOEXEC;
++
++ /*
++ * The code assumes that section 0 has a length of zero and
++ * an addr of zero, so check for it.
++ */
++ if (info->sechdrs[0].sh_type != SHT_NULL
++ || info->sechdrs[0].sh_size != 0
++ || info->sechdrs[0].sh_addr != 0)
++ return -ENOEXEC;
++
++ for (i = 1; i < info->hdr->e_shnum; i++) {
++ shdr = &info->sechdrs[i];
++ switch (shdr->sh_type) {
++ case SHT_NULL:
++ case SHT_NOBITS:
++ continue;
++ case SHT_SYMTAB:
++ if (shdr->sh_link == SHN_UNDEF
++ || shdr->sh_link >= info->hdr->e_shnum)
++ return -ENOEXEC;
++ fallthrough;
++ default:
++ err = validate_section_offset(info, shdr);
++ if (err < 0) {
++ pr_err("Invalid ELF section in module (section %u type %u)\n",
++ i, shdr->sh_type);
++ return err;
++ }
++
++ if (shdr->sh_flags & SHF_ALLOC) {
++ if (shdr->sh_name >= strhdr->sh_size) {
++ pr_err("Invalid ELF section name in module (section %u type %u)\n",
++ i, shdr->sh_type);
++ return -ENOEXEC;
++ }
++ }
++ break;
++ }
++ }
++
+ return 0;
+ }
+
+@@ -3095,11 +3186,6 @@ static int rewrite_section_headers(struct load_info *info, int flags)
+
+ for (i = 1; i < info->hdr->e_shnum; i++) {
+ Elf_Shdr *shdr = &info->sechdrs[i];
+- if (shdr->sh_type != SHT_NOBITS
+- && info->len < shdr->sh_offset + shdr->sh_size) {
+- pr_err("Module len %lu truncated\n", info->len);
+- return -ENOEXEC;
+- }
+
+ /*
+ * Mark all sections sh_addr with their address in the
+@@ -3133,11 +3219,6 @@ static int setup_load_info(struct load_info *info, int flags)
+ {
+ unsigned int i;
+
+- /* Set up the convenience variables */
+- info->sechdrs = (void *)info->hdr + info->hdr->e_shoff;
+- info->secstrings = (void *)info->hdr
+- + info->sechdrs[info->hdr->e_shstrndx].sh_offset;
+-
+ /* Try to find a name early so we can log errors with a module name */
+ info->index.info = find_sec(info, ".modinfo");
+ if (info->index.info)
+@@ -3894,26 +3975,50 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ long err = 0;
+ char *after_dashes;
+
+- err = elf_header_check(info);
++ /*
++ * Do the signature check (if any) first. All that
++ * the signature check needs is info->len, it does
++ * not need any of the section info. That can be
++ * set up later. This will minimize the chances
++ * of a corrupt module causing problems before
++ * we even get to the signature check.
++ *
++ * The check will also adjust info->len by stripping
++ * off the sig length at the end of the module, making
++ * checks against info->len more correct.
++ */
++ err = module_sig_check(info, flags);
++ if (err)
++ goto free_copy;
++
++ /*
++ * Do basic sanity checks against the ELF header and
++ * sections.
++ */
++ err = elf_validity_check(info);
+ if (err) {
+- pr_err("Module has invalid ELF header\n");
++ pr_err("Module has invalid ELF structures\n");
+ goto free_copy;
+ }
+
++ /*
++ * Everything checks out, so set up the section info
++ * in the info structure.
++ */
+ err = setup_load_info(info, flags);
+ if (err)
+ goto free_copy;
+
++ /*
++ * Now that we know we have the correct module name, check
++ * if it's blacklisted.
++ */
+ if (blacklisted(info->name)) {
+ err = -EPERM;
+ pr_err("Module %s is blacklisted\n", info->name);
+ goto free_copy;
+ }
+
+- err = module_sig_check(info, flags);
+- if (err)
+- goto free_copy;
+-
+ err = rewrite_section_headers(info, flags);
+ if (err)
+ goto free_copy;
+diff --git a/kernel/module_signature.c b/kernel/module_signature.c
+index 4224a1086b7d8..00132d12487cd 100644
+--- a/kernel/module_signature.c
++++ b/kernel/module_signature.c
+@@ -25,7 +25,7 @@ int mod_check_sig(const struct module_signature *ms, size_t file_len,
+ return -EBADMSG;
+
+ if (ms->id_type != PKEY_ID_PKCS7) {
+- pr_err("%s: Module is not signed with expected PKCS#7 message\n",
++ pr_err("%s: not signed with expected PKCS#7 message\n",
+ name);
+ return -ENOPKG;
+ }
+diff --git a/kernel/module_signing.c b/kernel/module_signing.c
+index 9d9fc678c91d6..8723ae70ea1fe 100644
+--- a/kernel/module_signing.c
++++ b/kernel/module_signing.c
+@@ -30,7 +30,7 @@ int mod_verify_sig(const void *mod, struct load_info *info)
+
+ memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
+
+- ret = mod_check_sig(&ms, modlen, info->name);
++ ret = mod_check_sig(&ms, modlen, "module");
+ if (ret)
+ return ret;
+
+--
+2.27.0
+
--- /dev/null
+From b4c2bd5922c2824bb46f4f5c22711798e340a50e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 12:36:52 +0300
+Subject: mtd: parser: imagetag: fix error codes in
+ bcm963xx_parse_imagetag_partitions()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 12ba8f8ce29fdd277f3100052eddc1afd2f5ea3f ]
+
+If the kstrtouint() calls fail, then this should return a negative
+error code but it currently returns success.
+
+Fixes: dd84cb022b31 ("mtd: bcm63xxpart: move imagetag parsing to its own parser")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/YBKFtNaFHGYBj+u4@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/parser_imagetag.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/mtd/parsers/parser_imagetag.c b/drivers/mtd/parsers/parser_imagetag.c
+index d69607b482272..fab0949aabba1 100644
+--- a/drivers/mtd/parsers/parser_imagetag.c
++++ b/drivers/mtd/parsers/parser_imagetag.c
+@@ -83,6 +83,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ pr_err("invalid rootfs address: %*ph\n",
+ (int)sizeof(buf->flash_image_start),
+ buf->flash_image_start);
++ ret = -EINVAL;
+ goto out;
+ }
+
+@@ -92,6 +93,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ pr_err("invalid kernel address: %*ph\n",
+ (int)sizeof(buf->kernel_address),
+ buf->kernel_address);
++ ret = -EINVAL;
+ goto out;
+ }
+
+@@ -100,6 +102,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ pr_err("invalid kernel length: %*ph\n",
+ (int)sizeof(buf->kernel_length),
+ buf->kernel_length);
++ ret = -EINVAL;
+ goto out;
+ }
+
+@@ -108,6 +111,7 @@ static int bcm963xx_parse_imagetag_partitions(struct mtd_info *master,
+ pr_err("invalid total length: %*ph\n",
+ (int)sizeof(buf->total_length),
+ buf->total_length);
++ ret = -EINVAL;
+ goto out;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 2d5c32b690bd18f28cbef4917bde47c6a11809e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Jan 2021 09:41:37 +0530
+Subject: mtd: parsers: afs: Fix freeing the part name memory in failure
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 7b844cf445f0a7daa68be0ce71eb2c88d68b0c5d ]
+
+In the case of failure while parsing the partitions, the iterator should
+be pre decremented by one before starting to free the memory allocated
+by kstrdup(). Because in the failure case, kstrdup() will not succeed
+and thus no memory will be allocated for the current iteration.
+
+Fixes: 1fca1f6abb38 ("mtd: afs: simplify partition parsing")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210104041137.113075-5-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/parsers/afs.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c
+index 980e332bdac48..26116694c821b 100644
+--- a/drivers/mtd/parsers/afs.c
++++ b/drivers/mtd/parsers/afs.c
+@@ -370,10 +370,8 @@ static int parse_afs_partitions(struct mtd_info *mtd,
+ return i;
+
+ out_free_parts:
+- while (i >= 0) {
++ while (--i >= 0)
+ kfree(parts[i].name);
+- i--;
+- }
+ kfree(parts);
+ *pparts = NULL;
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 8767831f67d99e60d0027f1dc47a1949ecc693b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 20:49:36 +0800
+Subject: mtd: phram: use div_u64_rem to stop overwrite len in phram_setup
+
+From: yangerkun <yangerkun@huawei.com>
+
+[ Upstream commit dc2b3e5cbc8087224fcd8698b0dc56131e0bf37d ]
+
+We now support user to set erase page size, and use do_div between len
+and erase size to determine the reasonableness for the erase size.
+However, do_div is a macro and will overwrite the value of len. Which
+results a mtd device with unexcepted size. Fix it by use div_u64_rem.
+
+Fixes: ffad560394de ("mtd: phram: Allow the user to set the erase page size.")
+Signed-off-by: yangerkun <yangerkun@huawei.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210125124936.651812-1-yangerkun@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/devices/phram.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
+index cfd170946ba48..5b04ae6c30573 100644
+--- a/drivers/mtd/devices/phram.c
++++ b/drivers/mtd/devices/phram.c
+@@ -222,6 +222,7 @@ static int phram_setup(const char *val)
+ uint64_t start;
+ uint64_t len;
+ uint64_t erasesize = PAGE_SIZE;
++ uint32_t rem;
+ int i, ret;
+
+ if (strnlen(val, sizeof(buf)) >= sizeof(buf))
+@@ -263,8 +264,11 @@ static int phram_setup(const char *val)
+ }
+ }
+
++ if (erasesize)
++ div_u64_rem(len, (uint32_t)erasesize, &rem);
++
+ if (len == 0 || erasesize == 0 || erasesize > len
+- || erasesize > UINT_MAX || do_div(len, (uint32_t)erasesize) != 0) {
++ || erasesize > UINT_MAX || rem) {
+ parse_err("illegal erasesize or len\n");
+ goto error;
+ }
+--
+2.27.0
+
--- /dev/null
+From 3286b8aa1ca94ad1f4b0c26271d3249068cd60c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 08:39:55 +0100
+Subject: mtd: rawnand: intel: Fix an error handling path in 'ebu_dma_start()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 073abfa7ea9a5b0537d6f92b42baedaf82a04c53 ]
+
+If 'dmaengine_prep_slave_single()' fails, we must undo a previous
+'dma_map_single()' call, as already done in all the other error handling
+paths of this function.
+
+Fixes: 0b1039f016e8 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210124073955.728797-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/intel-nand-controller.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c
+index a304fda5d1fa5..8b49fd56cf964 100644
+--- a/drivers/mtd/nand/raw/intel-nand-controller.c
++++ b/drivers/mtd/nand/raw/intel-nand-controller.c
+@@ -318,8 +318,10 @@ static int ebu_dma_start(struct ebu_nand_controller *ebu_host, u32 dir,
+ }
+
+ tx = dmaengine_prep_slave_single(chan, buf_dma, len, dir, flags);
+- if (!tx)
+- return -ENXIO;
++ if (!tx) {
++ ret = -ENXIO;
++ goto err_unmap;
++ }
+
+ tx->callback = callback;
+ tx->callback_param = ebu_host;
+--
+2.27.0
+
--- /dev/null
+From c598e2571314ec2e384048aefd18346bcaaa1f81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:08 +0530
+Subject: net: amd-xgbe: Fix NETDEV WATCHDOG transmit queue timeout warning
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 186edbb510bd60e748f93975989ccba25ee99c50 ]
+
+The current driver calls netif_carrier_off() late in the link tear down
+which can result in a netdev watchdog timeout.
+
+Calling netif_carrier_off() immediately after netif_tx_stop_all_queues()
+avoids the warning.
+
+ ------------[ cut here ]------------
+ NETDEV WATCHDOG: enp3s0f2 (amd-xgbe): transmit queue 0 timed out
+ WARNING: CPU: 3 PID: 0 at net/sched/sch_generic.c:461 dev_watchdog+0x20d/0x220
+ Modules linked in: amd_xgbe(E) amd-xgbe 0000:03:00.2 enp3s0f2: Link is Down
+ CPU: 3 PID: 0 Comm: swapper/3 Tainted: G E
+ Hardware name: AMD Bilby-RV2/Bilby-RV2, BIOS RBB1202A 10/18/2019
+ RIP: 0010:dev_watchdog+0x20d/0x220
+ Code: 00 49 63 4e e0 eb 92 4c 89 e7 c6 05 c6 e2 c1 00 01 e8 e7 ce fc ff 89 d9 48
+ RSP: 0018:ffff90cfc28c3e88 EFLAGS: 00010286
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000006
+ RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff90cfc28d63c0
+ RBP: ffff90cfb977845c R08: 0000000000000050 R09: 0000000000196018
+ R10: ffff90cfc28c3ef8 R11: 0000000000000000 R12: ffff90cfb9778000
+ R13: 0000000000000003 R14: ffff90cfb9778480 R15: 0000000000000010
+ FS: 0000000000000000(0000) GS:ffff90cfc28c0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f240ff2d9d0 CR3: 00000001e3e0a000 CR4: 00000000003406e0
+ Call Trace:
+ <IRQ>
+ ? pfifo_fast_reset+0x100/0x100
+ call_timer_fn+0x2b/0x130
+ run_timer_softirq+0x3e8/0x440
+ ? enqueue_hrtimer+0x39/0x90
+
+Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 1 +
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 1 -
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+index 2709a2db56577..395eb0b526802 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+@@ -1368,6 +1368,7 @@ static void xgbe_stop(struct xgbe_prv_data *pdata)
+ return;
+
+ netif_tx_stop_all_queues(netdev);
++ netif_carrier_off(pdata->netdev);
+
+ xgbe_stop_timers(pdata);
+ flush_workqueue(pdata->dev_workqueue);
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 93ef5a30cb8d9..19ee4db0156d6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1396,7 +1396,6 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ pdata->phy_if.phy_impl.stop(pdata);
+
+ pdata->phy.link = 0;
+- netif_carrier_off(pdata->netdev);
+
+ xgbe_phy_adjust_link(pdata);
+ }
+--
+2.27.0
+
--- /dev/null
+From e4538f1e4d009948cf8d1a18e7366638ab640a03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:10 +0530
+Subject: net: amd-xgbe: Fix network fluctuations when using 1G BELFUSE SFP
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 9eab3fdb419916f66a72d1572f68d82cd9b3f963 ]
+
+Frequent link up/down events can happen when a Bel Fuse SFP part is
+connected to the amd-xgbe device. Try to avoid the frequent link
+issues by resetting the PHY as documented in Bel Fuse SFP datasheets.
+
+Fixes: e722ec82374b ("amd-xgbe: Update the BelFuse quirk to support SGMII")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index d3f72faecd1da..18e48b3bc402b 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -922,6 +922,9 @@ static bool xgbe_phy_belfuse_phy_quirks(struct xgbe_prv_data *pdata)
+ if ((phy_id & 0xfffffff0) != 0x03625d10)
+ return false;
+
++ /* Reset PHY - wait for self-clearing reset bit to clear */
++ genphy_soft_reset(phy_data->phydev);
++
+ /* Disable RGMII mode */
+ phy_write(phy_data->phydev, 0x18, 0x7007);
+ reg = phy_read(phy_data->phydev, 0x18);
+--
+2.27.0
+
--- /dev/null
+From d93c5aa3cbb27ee4a91f1fe93900c88689ee260d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:09 +0530
+Subject: net: amd-xgbe: Reset link when the link never comes back
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 84fe68eb67f9499309cffd97c1ba269de125ff14 ]
+
+Normally, auto negotiation and reconnect should be automatically done by
+the hardware. But there seems to be an issue where auto negotiation has
+to be restarted manually. This happens because of link training and so
+even though still connected to the partner the link never "comes back".
+This needs an auto-negotiation restart.
+
+Also, a change in xgbe-mdio is needed to get ethtool to recognize the
+link down and get the link change message. This change is only
+required in a backplane connection mode.
+
+Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 2 +-
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 19ee4db0156d6..4e97b48695220 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -1345,7 +1345,7 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
+ &an_restart);
+ if (an_restart) {
+ xgbe_phy_config_aneg(pdata);
+- return;
++ goto adjust_link;
+ }
+
+ if (pdata->phy.link) {
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 087948085ae19..d3f72faecd1da 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -2610,6 +2610,14 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ if (reg & MDIO_STAT1_LSTATUS)
+ return 1;
+
++ if (pdata->phy.autoneg == AUTONEG_ENABLE &&
++ phy_data->port_mode == XGBE_PORT_MODE_BACKPLANE) {
++ if (!test_bit(XGBE_LINK_INIT, &pdata->dev_state)) {
++ netif_carrier_off(pdata->netdev);
++ *an_restart = 1;
++ }
++ }
++
+ /* No link, attempt a receiver reset cycle */
+ if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ phy_data->rrc_count = 0;
+--
+2.27.0
+
--- /dev/null
+From 3e6d752b62e201178ace346409fd30e6d1d6bffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 00:37:07 +0530
+Subject: net: amd-xgbe: Reset the PHY rx data path when mailbox command
+ timeout
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit 30b7edc82ec82578f4f5e6706766f0a9535617d3 ]
+
+Sometimes mailbox commands timeout when the RX data path becomes
+unresponsive. This prevents the submission of new mailbox commands to DXIO.
+This patch identifies the timeout and resets the RX data path so that the
+next message can be submitted properly.
+
+Fixes: 549b32af9f7c ("amd-xgbe: Simplify mailbox interface rate change code")
+Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe-common.h | 14 +++++++++++
+ drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 28 ++++++++++++++++++++-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index b40d4377cc71d..b2cd3bdba9f89 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1279,10 +1279,18 @@
+ #define MDIO_PMA_10GBR_FECCTRL 0x00ab
+ #endif
+
++#ifndef MDIO_PMA_RX_CTRL1
++#define MDIO_PMA_RX_CTRL1 0x8051
++#endif
++
+ #ifndef MDIO_PCS_DIG_CTRL
+ #define MDIO_PCS_DIG_CTRL 0x8000
+ #endif
+
++#ifndef MDIO_PCS_DIGITAL_STAT
++#define MDIO_PCS_DIGITAL_STAT 0x8010
++#endif
++
+ #ifndef MDIO_AN_XNP
+ #define MDIO_AN_XNP 0x0016
+ #endif
+@@ -1358,6 +1366,8 @@
+ #define XGBE_KR_TRAINING_ENABLE BIT(1)
+
+ #define XGBE_PCS_CL37_BP BIT(12)
++#define XGBE_PCS_PSEQ_STATE_MASK 0x1c
++#define XGBE_PCS_PSEQ_STATE_POWER_GOOD 0x10
+
+ #define XGBE_AN_CL37_INT_CMPLT BIT(0)
+ #define XGBE_AN_CL37_INT_MASK 0x01
+@@ -1375,6 +1385,10 @@
+ #define XGBE_PMA_CDR_TRACK_EN_OFF 0x00
+ #define XGBE_PMA_CDR_TRACK_EN_ON 0x01
+
++#define XGBE_PMA_RX_RST_0_MASK BIT(4)
++#define XGBE_PMA_RX_RST_0_RESET_ON 0x10
++#define XGBE_PMA_RX_RST_0_RESET_OFF 0x00
++
+ /* Bit setting and getting macros
+ * The get macro will extract the current bit field value from within
+ * the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 859ded0c06b05..087948085ae19 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -1953,6 +1953,27 @@ static void xgbe_phy_set_redrv_mode(struct xgbe_prv_data *pdata)
+ xgbe_phy_put_comm_ownership(pdata);
+ }
+
++static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
++{
++ int reg;
++
++ reg = XMDIO_READ_BITS(pdata, MDIO_MMD_PCS, MDIO_PCS_DIGITAL_STAT,
++ XGBE_PCS_PSEQ_STATE_MASK);
++ if (reg == XGBE_PCS_PSEQ_STATE_POWER_GOOD) {
++ /* Mailbox command timed out, reset of RX block is required.
++ * This can be done by asseting the reset bit and wait for
++ * its compeletion.
++ */
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_ON);
++ ndelay(20);
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_RX_CTRL1,
++ XGBE_PMA_RX_RST_0_MASK, XGBE_PMA_RX_RST_0_RESET_OFF);
++ usleep_range(40, 50);
++ netif_err(pdata, link, pdata->netdev, "firmware mailbox reset performed\n");
++ }
++}
++
+ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ unsigned int cmd, unsigned int sub_cmd)
+ {
+@@ -1960,9 +1981,11 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+ unsigned int wait;
+
+ /* Log if a previous command did not complete */
+- if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
++ if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
+ netif_dbg(pdata, link, pdata->netdev,
+ "firmware mailbox not ready for command\n");
++ xgbe_phy_rx_reset(pdata);
++ }
+
+ /* Construct the command */
+ XP_SET_BITS(s0, XP_DRIVER_SCRATCH_0, COMMAND, cmd);
+@@ -1984,6 +2007,9 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
+
+ netif_dbg(pdata, link, pdata->netdev,
+ "firmware mailbox command did not complete\n");
++
++ /* Reset on error */
++ xgbe_phy_rx_reset(pdata);
+ }
+
+ static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)
+--
+2.27.0
+
--- /dev/null
+From 0a0e7f7dd07ccdf33dde9691e666994632f5d6f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 18:17:48 -0600
+Subject: net: axienet: Handle deferred probe on clock properly
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 57baf8cc70ea4cf5503c9d42f31f6a86d7f5ff1a ]
+
+This driver is set up to use a clock mapping in the device tree if it is
+present, but still work without one for backward compatibility. However,
+if getting the clock returns -EPROBE_DEFER, then we need to abort and
+return that error from our driver initialization so that the probe can
+be retried later after the clock is set up.
+
+Move clock initialization to earlier in the process so we do not waste as
+much effort if the clock is not yet available. Switch to use
+devm_clk_get_optional and abort initialization on any error reported.
+Also enable the clock regardless of whether the controller is using an MDIO
+bus, as the clock is required in any case.
+
+Fixes: 09a0354cadec267be7f ("net: axienet: Use clock framework to get device clock rate")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/xilinx/xilinx_axienet_main.c | 26 +++++++++----------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 6fea980acf646..b4a0bfce5b762 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1817,6 +1817,18 @@ static int axienet_probe(struct platform_device *pdev)
+ lp->options = XAE_OPTION_DEFAULTS;
+ lp->rx_bd_num = RX_BD_NUM_DEFAULT;
+ lp->tx_bd_num = TX_BD_NUM_DEFAULT;
++
++ lp->clk = devm_clk_get_optional(&pdev->dev, NULL);
++ if (IS_ERR(lp->clk)) {
++ ret = PTR_ERR(lp->clk);
++ goto free_netdev;
++ }
++ ret = clk_prepare_enable(lp->clk);
++ if (ret) {
++ dev_err(&pdev->dev, "Unable to enable clock: %d\n", ret);
++ goto free_netdev;
++ }
++
+ /* Map device registers */
+ ethres = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ lp->regs = devm_ioremap_resource(&pdev->dev, ethres);
+@@ -1992,20 +2004,6 @@ static int axienet_probe(struct platform_device *pdev)
+
+ lp->phy_node = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);
+ if (lp->phy_node) {
+- lp->clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(lp->clk)) {
+- dev_warn(&pdev->dev, "Failed to get clock: %ld\n",
+- PTR_ERR(lp->clk));
+- lp->clk = NULL;
+- } else {
+- ret = clk_prepare_enable(lp->clk);
+- if (ret) {
+- dev_err(&pdev->dev, "Unable to enable clock: %d\n",
+- ret);
+- goto free_netdev;
+- }
+- }
+-
+ ret = axienet_mdio_setup(lp);
+ if (ret)
+ dev_warn(&pdev->dev,
+--
+2.27.0
+
--- /dev/null
+From 46495d5c273603f296d1e1633093eea13d2f49ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 13:14:46 +0200
+Subject: net: dsa: felix: don't deinitialize unused ports
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 42b5adbbac03bdb396192316c015fa3e64ffd5a1 ]
+
+ocelot_init_port is called only if dsa_is_unused_port == false, however
+ocelot_deinit_port is called unconditionally. This causes a warning in
+the skb_queue_purge inside ocelot_deinit_port saying that the spin lock
+protecting ocelot_port->tx_skbs was not initialized.
+
+Fixes: e5fb512d81d0 ("net: mscc: ocelot: deinitialize only initialized ports")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 4aa81034347e2..0f1ee4a4fa55a 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -657,8 +657,12 @@ static void felix_teardown(struct dsa_switch *ds)
+ ocelot_deinit_timestamp(ocelot);
+ ocelot_deinit(ocelot);
+
+- for (port = 0; port < ocelot->num_phys_ports; port++)
++ for (port = 0; port < ocelot->num_phys_ports; port++) {
++ if (dsa_is_unused_port(ds, port))
++ continue;
++
+ ocelot_deinit_port(ocelot, port);
++ }
+
+ if (felix->info->mdio_bus_free)
+ felix->info->mdio_bus_free(ocelot);
+--
+2.27.0
+
--- /dev/null
+From 7b903daede1d839dcc91ca9fb29326b68c57461f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 04:11:15 +0200
+Subject: net: dsa: felix: perform teardown in reverse order of setup
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit d19741b0f54487cf3a11307900f8633935cd2849 ]
+
+In general it is desirable that cleanup is the reverse process of setup.
+In this case I am not seeing any particular issue, but with the
+introduction of devlink-sb for felix, a non-obvious decision had to be
+made as to where to put its cleanup method. When there's a convention in
+place, that decision becomes obvious.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 45fdb1256dbfe..4aa81034347e2 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -654,14 +654,14 @@ static void felix_teardown(struct dsa_switch *ds)
+ struct felix *felix = ocelot_to_felix(ocelot);
+ int port;
+
+- if (felix->info->mdio_bus_free)
+- felix->info->mdio_bus_free(ocelot);
++ ocelot_deinit_timestamp(ocelot);
++ ocelot_deinit(ocelot);
+
+ for (port = 0; port < ocelot->num_phys_ports; port++)
+ ocelot_deinit_port(ocelot, port);
+- ocelot_deinit_timestamp(ocelot);
+- /* stop workqueue thread */
+- ocelot_deinit(ocelot);
++
++ if (felix->info->mdio_bus_free)
++ felix->info->mdio_bus_free(ocelot);
+ }
+
+ static int felix_hwtstamp_get(struct dsa_switch *ds, int port,
+--
+2.27.0
+
--- /dev/null
+From fc78410daa1075103ecf09539e323c795d91fa4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 12:16:28 +0200
+Subject: net: enetc: fix destroyed phylink dereference during unbind
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 3af409ca278d4a8d50e91f9f7c4c33b175645cf3 ]
+
+The following call path suggests that calling unregister_netdev on an
+interface that is up will first bring it down.
+
+enetc_pf_remove
+-> unregister_netdev
+ -> unregister_netdevice_queue
+ -> unregister_netdevice_many
+ -> dev_close_many
+ -> __dev_close_many
+ -> enetc_close
+ -> enetc_stop
+ -> phylink_stop
+
+However, enetc first destroys the phylink instance, then calls
+unregister_netdev. This is already dissimilar to the setup (and error
+path teardown path) from enetc_pf_probe, but more than that, it is buggy
+because it is invalid to call phylink_stop after phylink_destroy.
+
+So let's first unregister the netdev (and let the .ndo_stop events
+consume themselves), then destroy the phylink instance, then free the
+netdev.
+
+Fixes: 71b77a7a27a3 ("enetc: Migrate to PHYLINK and PCS_LYNX")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_pf.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index 3eb5f1375bd4c..515c5b29d7aab 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -1157,14 +1157,15 @@ static void enetc_pf_remove(struct pci_dev *pdev)
+ struct enetc_ndev_priv *priv;
+
+ priv = netdev_priv(si->ndev);
+- enetc_phylink_destroy(priv);
+- enetc_mdiobus_destroy(pf);
+
+ if (pf->num_vfs)
+ enetc_sriov_configure(pdev, 0);
+
+ unregister_netdev(si->ndev);
+
++ enetc_phylink_destroy(priv);
++ enetc_mdiobus_destroy(pf);
++
+ enetc_free_msix(priv);
+
+ enetc_free_si_resources(priv);
+--
+2.27.0
+
--- /dev/null
+From 7ba4c735f27dd1def3c8886b0b6115a1370a3581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Feb 2021 15:54:34 -0600
+Subject: net: ipa: initialize all resources
+
+From: Alex Elder <elder@linaro.org>
+
+[ Upstream commit 25c5a7e89b1de80f4b04ad5365b2e05fefd92279 ]
+
+We configure the minimum and maximum number of various types of IPA
+resources in ipa_resource_config(). It iterates over resource types
+in the configuration data and assigns resource limits to each
+resource group for each type.
+
+Unfortunately, we are repeatedly initializing the resource data for
+the first type, rather than initializing each of the types whose
+limits are specified.
+
+Fix this bug.
+
+Fixes: 4a0d7579d466e ("net: ipa: avoid going past end of resource group array")
+Signed-off-by: Alex Elder <elder@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ipa/ipa_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
+index 84bb8ae927252..eb1c8396bcdd9 100644
+--- a/drivers/net/ipa/ipa_main.c
++++ b/drivers/net/ipa/ipa_main.c
+@@ -581,10 +581,10 @@ ipa_resource_config(struct ipa *ipa, const struct ipa_resource_data *data)
+ return -EINVAL;
+
+ for (i = 0; i < data->resource_src_count; i++)
+- ipa_resource_config_src(ipa, data->resource_src);
++ ipa_resource_config_src(ipa, &data->resource_src[i]);
+
+ for (i = 0; i < data->resource_dst_count; i++)
+- ipa_resource_config_dst(ipa, data->resource_dst);
++ ipa_resource_config_dst(ipa, &data->resource_dst[i]);
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From d30252955f26718b05ad34d4f36cfe4ec1c1def3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Feb 2021 22:35:59 +0800
+Subject: net/mlx4_core: Add missed mlx4_free_cmd_mailbox()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 8eb65fda4a6dbd59cd5de24b106a10b6ee0d2176 ]
+
+mlx4_do_mirror_rule() forgets to call mlx4_free_cmd_mailbox() to
+free the memory region allocated by mlx4_alloc_cmd_mailbox() before
+an exit.
+Add the missed call to fix it.
+
+Fixes: 78efed275117 ("net/mlx4_core: Support mirroring VF DMFS rules on both ports")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20210221143559.390277-1-hslester96@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index 394f43add85cf..a99e71bc7b3c9 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -4986,6 +4986,7 @@ static int mlx4_do_mirror_rule(struct mlx4_dev *dev, struct res_fs_rule *fs_rule
+
+ if (!fs_rule->mirr_mbox) {
+ mlx4_err(dev, "rule mirroring mailbox is null\n");
++ mlx4_free_cmd_mailbox(dev, mailbox);
+ return -EINVAL;
+ }
+ memcpy(mailbox->buf, fs_rule->mirr_mbox, fs_rule->mirr_mbox_size);
+--
+2.27.0
+
--- /dev/null
+From 70041abf3f0947e7c9d2dbb15b42d0d02345f3f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 15:04:08 +0200
+Subject: net/mlx5: Disable devlink reload for lag devices
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit edac23c2b3d3ac64cfcd351087295893671adbf5 ]
+
+Devlink reload can't be allowed on lag devices since reloading one lag
+device will cause traffic on the bond to get stucked.
+Users who wish to reload a lag device, need to remove the device from
+the bond, and only then reload it.
+
+Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+index c7073193db140..41474e42a819a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+@@ -128,6 +128,11 @@ static int mlx5_devlink_reload_down(struct devlink *devlink, bool netns_change,
+ {
+ struct mlx5_core_dev *dev = devlink_priv(devlink);
+
++ if (mlx5_lag_is_active(dev)) {
++ NL_SET_ERR_MSG_MOD(extack, "reload is unsupported in Lag mode\n");
++ return -EOPNOTSUPP;
++ }
++
+ switch (action) {
+ case DEVLINK_RELOAD_ACTION_DRIVER_REINIT:
+ mlx5_unload_one(dev, false);
+--
+2.27.0
+
--- /dev/null
+From 4eea08a71b3d3b7ceebe2b858892374ab96ccc4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 09:58:32 +0200
+Subject: net/mlx5: Disable devlink reload for multi port slave device
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit d89ddaae1766f8fe571ea6eb63ec098ff556f1dd ]
+
+Devlink reload can't be allowed on a multi port slave device, because
+reload of slave device doesn't take effect.
+
+The right flow is to disable devlink reload for multi port slave
+device. Hence, disabling it in mlx5_core probing.
+
+Fixes: 4383cfcc65e7 ("net/mlx5: Add devlink reload")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index ca6f2fc39ea0a..ba1a4ae28097d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1396,7 +1396,8 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ dev_err(&pdev->dev, "mlx5_crdump_enable failed with error code %d\n", err);
+
+ pci_save_state(pdev);
+- devlink_reload_enable(devlink);
++ if (!mlx5_core_is_mp_slave(dev))
++ devlink_reload_enable(devlink);
+ return 0;
+
+ err_load_one:
+--
+2.27.0
+
--- /dev/null
+From 9077c38f60093a966c4702801dd12efd264510d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Jan 2021 10:09:59 +0200
+Subject: net/mlx5: Disallow RoCE on lag device
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 7ab91f2b03367f9d25dd807ebdfb0d67295e0e41 ]
+
+In lag mode, setting roce enabled/disable of lag device have no effect.
+e.g.: bond device (roce/vf_lag) roce status remain unchanged.
+Therefore disable it and add an error message.
+
+Fixes: cc9defcbb8fa ("net/mlx5: Handle "enable_roce" devlink param")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+index 317ce6b80b23b..c7073193db140 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+@@ -273,8 +273,8 @@ static int mlx5_devlink_enable_roce_validate(struct devlink *devlink, u32 id,
+ NL_SET_ERR_MSG_MOD(extack, "Device doesn't support RoCE");
+ return -EOPNOTSUPP;
+ }
+- if (mlx5_core_is_mp_slave(dev)) {
+- NL_SET_ERR_MSG_MOD(extack, "Multi port slave device can't configure RoCE");
++ if (mlx5_core_is_mp_slave(dev) || mlx5_lag_is_active(dev)) {
++ NL_SET_ERR_MSG_MOD(extack, "Multi port slave/Lag device can't configure RoCE");
+ return -EOPNOTSUPP;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7fcd8add44c8965509d906b38ea982143e2775c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 10:58:34 +0200
+Subject: net/mlx5: Disallow RoCE on multi port slave device
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit c70f8597fcc1399ef6d5b5ce648a31d887d5dba2 ]
+
+In dual port mode, setting roce enabled/disable for the slave device
+have no effect. e.g.: the slave device roce status remain unchanged.
+Therefore disable it and add an error message.
+Enable or disable roce of the master device affect both master and slave
+devices.
+
+Fixes: cc9defcbb8fa ("net/mlx5: Handle "enable_roce" devlink param")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+index 3261d0dc11044..317ce6b80b23b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+@@ -273,6 +273,10 @@ static int mlx5_devlink_enable_roce_validate(struct devlink *devlink, u32 id,
+ NL_SET_ERR_MSG_MOD(extack, "Device doesn't support RoCE");
+ return -EOPNOTSUPP;
+ }
++ if (mlx5_core_is_mp_slave(dev)) {
++ NL_SET_ERR_MSG_MOD(extack, "Multi port slave device can't configure RoCE");
++ return -EOPNOTSUPP;
++ }
+
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 79dd4e3c1030363083cf4798a5ceb648f8237779 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 08:39:10 +0200
+Subject: net/mlx5: Fix health error state handling
+
+From: Shay Drory <shayd@nvidia.com>
+
+[ Upstream commit 51d138c2610a236c1ed0059d034ee4c74f452b86 ]
+
+Currently, when we discover a fatal error, we are queueing a work that
+will wait for a lock in order to enter the device to error state.
+Meanwhile, FW commands are still being processed, and gets timeouts.
+This can block the driver for few minutes before the work will manage
+to get the lock and enter to error state.
+
+Setting the device to error state before queueing health work, in order
+to avoid FW commands being processed while the work is waiting for the
+lock.
+
+Fixes: c1d4d2e92ad6 ("net/mlx5: Avoid calling sleeping function by the health poll thread")
+Signed-off-by: Shay Drory <shayd@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/health.c | 22 ++++++++++++-------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+index 54523bed16cd3..0c32c485eb588 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+@@ -190,6 +190,16 @@ static bool reset_fw_if_needed(struct mlx5_core_dev *dev)
+ return true;
+ }
+
++static void enter_error_state(struct mlx5_core_dev *dev, bool force)
++{
++ if (mlx5_health_check_fatal_sensors(dev) || force) { /* protected state setting */
++ dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
++ mlx5_cmd_flush(dev);
++ }
++
++ mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
++}
++
+ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
+ {
+ bool err_detected = false;
+@@ -208,12 +218,7 @@ void mlx5_enter_error_state(struct mlx5_core_dev *dev, bool force)
+ goto unlock;
+ }
+
+- if (mlx5_health_check_fatal_sensors(dev) || force) { /* protected state setting */
+- dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
+- mlx5_cmd_flush(dev);
+- }
+-
+- mlx5_notifier_call_chain(dev->priv.events, MLX5_DEV_EVENT_SYS_ERROR, (void *)1);
++ enter_error_state(dev, force);
+ unlock:
+ mutex_unlock(&dev->intf_state_mutex);
+ }
+@@ -613,7 +618,7 @@ static void mlx5_fw_fatal_reporter_err_work(struct work_struct *work)
+ priv = container_of(health, struct mlx5_priv, health);
+ dev = container_of(priv, struct mlx5_core_dev, priv);
+
+- mlx5_enter_error_state(dev, false);
++ enter_error_state(dev, false);
+ if (IS_ERR_OR_NULL(health->fw_fatal_reporter)) {
+ if (mlx5_health_try_recover(dev))
+ mlx5_core_err(dev, "health recovery failed\n");
+@@ -707,8 +712,9 @@ static void poll_health(struct timer_list *t)
+ mlx5_core_err(dev, "Fatal error %u detected\n", fatal_error);
+ dev->priv.health.fatal_error = fatal_error;
+ print_health_info(dev);
++ dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
+ mlx5_trigger_health_work(dev);
+- goto out;
++ return;
+ }
+
+ count = ioread32be(health->health_counter);
+--
+2.27.0
+
--- /dev/null
+From 79dd26f90d897baf282770c250e567b420a57031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 18:01:03 +0200
+Subject: net/mlx5e: Change interrupt moderation channel params also when
+ channels are closed
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 65ba8594a238c20e458b3d2d39d91067cbffd0b1 ]
+
+struct mlx5e_params contains fields ({rx,tx}_cq_moderation) that depend
+on two things: whether DIM is enabled and the state of a private flag
+(MLX5E_PFLAG_{RX,TX}_CQE_BASED_MODER). Whenever the DIM state changes,
+mlx5e_reset_{rx,tx}_moderation is called to update the fields, however,
+only if the channels are open. The flow where the channels are closed
+misses the required update of the fields. This commit moves the calls of
+mlx5e_reset_{rx,tx}_moderation, so that they run in both flows.
+
+Fixes: ebeaf084ad5c ("net/mlx5e: Properly set default values when disabling adaptive moderation")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en_ethtool.c | 29 +++++++++----------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index d7ff5fa45cb7d..8612c388db7d3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -597,24 +597,9 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
+ tx_moder->pkts = coal->tx_max_coalesced_frames;
+ new_channels.params.tx_dim_enabled = !!coal->use_adaptive_tx_coalesce;
+
+- if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+- priv->channels.params = new_channels.params;
+- goto out;
+- }
+- /* we are opened */
+-
+ reset_rx = !!coal->use_adaptive_rx_coalesce != priv->channels.params.rx_dim_enabled;
+ reset_tx = !!coal->use_adaptive_tx_coalesce != priv->channels.params.tx_dim_enabled;
+
+- if (!reset_rx && !reset_tx) {
+- if (!coal->use_adaptive_rx_coalesce)
+- mlx5e_set_priv_channels_rx_coalesce(priv, coal);
+- if (!coal->use_adaptive_tx_coalesce)
+- mlx5e_set_priv_channels_tx_coalesce(priv, coal);
+- priv->channels.params = new_channels.params;
+- goto out;
+- }
+-
+ if (reset_rx) {
+ u8 mode = MLX5E_GET_PFLAG(&new_channels.params,
+ MLX5E_PFLAG_RX_CQE_BASED_MODER);
+@@ -628,6 +613,20 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
+ mlx5e_reset_tx_moderation(&new_channels.params, mode);
+ }
+
++ if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
++ priv->channels.params = new_channels.params;
++ goto out;
++ }
++
++ if (!reset_rx && !reset_tx) {
++ if (!coal->use_adaptive_rx_coalesce)
++ mlx5e_set_priv_channels_rx_coalesce(priv, coal);
++ if (!coal->use_adaptive_tx_coalesce)
++ mlx5e_set_priv_channels_tx_coalesce(priv, coal);
++ priv->channels.params = new_channels.params;
++ goto out;
++ }
++
+ err = mlx5e_safe_switch_channels(priv, &new_channels, NULL, NULL);
+
+ out:
+--
+2.27.0
+
--- /dev/null
+From b58b3fe57795e74c5b90c360426e4bbb9d54f7c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 16:46:11 +0200
+Subject: net/mlx5e: Check tunnel offload is required before setting SWP
+
+From: Moshe Shemesh <moshe@nvidia.com>
+
+[ Upstream commit e1c3940c6003d820c787473c65711b49c2d1bc42 ]
+
+Check that tunnel offload is required before setting Software Parser
+offsets to get Geneve HW offload. In case of Geneve packet we check HW
+offload support of SWP in mlx5e_tunnel_features_check() and set features
+accordingly, this should be reflected in skb offload requested by the
+kernel and we should add the Software Parser offsets only if requested.
+Otherwise, in case HW doesn't support SWP for Geneve, data path will
+mistakenly try to offload Geneve SKBs with skb->encapsulation set,
+regardless of whether offload was requested or not on this specific SKB.
+
+Fixes: e3cfc7e6b7bd ("net/mlx5e: TX, Add geneve tunnel stateless offload support")
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
+index 1fae7fab8297e..ff81b69a59a9b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h
+@@ -173,7 +173,7 @@ static inline bool mlx5e_accel_tx_eseg(struct mlx5e_priv *priv,
+ #endif
+
+ #if IS_ENABLED(CONFIG_GENEVE)
+- if (skb->encapsulation)
++ if (skb->encapsulation && skb->ip_summed == CHECKSUM_PARTIAL)
+ mlx5e_tx_tunnel_accel(skb, eseg, ihs);
+ #endif
+
+--
+2.27.0
+
--- /dev/null
+From 8e8dc733b6430510c7ea290874c5a2a684780ff0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 12:37:37 +0000
+Subject: net/mlx5e: CT: manage the lifetime of the ct entry object
+
+From: Oz Shlomo <ozsh@nvidia.com>
+
+[ Upstream commit a2173131526dc845eb1968a15bc192b3fc2ff000 ]
+
+The ct entry object is accessed by the ct add, del, stats and restore
+methods. In addition, it is referenced from several hash tables.
+
+The lifetime of the ct entry object was not managed which triggered race
+conditions as in the following kasan dump:
+[ 3374.973945] ==================================================================
+[ 3374.988552] BUG: KASAN: use-after-free in memcmp+0x4c/0x98
+[ 3374.999590] Read of size 1 at addr ffff00036129ea55 by task ksoftirqd/1/15
+[ 3375.016415] CPU: 1 PID: 15 Comm: ksoftirqd/1 Tainted: G O 5.4.31+ #1
+[ 3375.055301] Call trace:
+[ 3375.060214] dump_backtrace+0x0/0x238
+[ 3375.067580] show_stack+0x24/0x30
+[ 3375.074244] dump_stack+0xe0/0x118
+[ 3375.081085] print_address_description.isra.9+0x74/0x3d0
+[ 3375.091771] __kasan_report+0x198/0x1e8
+[ 3375.099486] kasan_report+0xc/0x18
+[ 3375.106324] __asan_load1+0x60/0x68
+[ 3375.113338] memcmp+0x4c/0x98
+[ 3375.119409] mlx5e_tc_ct_restore_flow+0x3a4/0x6f8 [mlx5_core]
+[ 3375.131073] mlx5e_rep_tc_update_skb+0x1d4/0x2f0 [mlx5_core]
+[ 3375.142553] mlx5e_handle_rx_cqe_rep+0x198/0x308 [mlx5_core]
+[ 3375.154034] mlx5e_poll_rx_cq+0x2a0/0x1060 [mlx5_core]
+[ 3375.164459] mlx5e_napi_poll+0x1d4/0xa78 [mlx5_core]
+[ 3375.174453] net_rx_action+0x28c/0x7a8
+[ 3375.182004] __do_softirq+0x1b4/0x5d0
+
+Manage the lifetime of the ct entry object by using synchornization
+mechanisms for concurrent access.
+
+Fixes: ac991b48d43c ("net/mlx5e: CT: Offload established flows")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Oz Shlomo <ozsh@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 259 +++++++++++++-----
+ 1 file changed, 192 insertions(+), 67 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+index 6bc6b48a56dc7..24e2c0d955b99 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+@@ -12,6 +12,7 @@
+ #include <net/flow_offload.h>
+ #include <net/netfilter/nf_flow_table.h>
+ #include <linux/workqueue.h>
++#include <linux/refcount.h>
+ #include <linux/xarray.h>
+
+ #include "lib/fs_chains.h"
+@@ -51,11 +52,11 @@ struct mlx5_tc_ct_priv {
+ struct mlx5_flow_table *ct_nat;
+ struct mlx5_flow_table *post_ct;
+ struct mutex control_lock; /* guards parallel adds/dels */
+- struct mutex shared_counter_lock;
+ struct mapping_ctx *zone_mapping;
+ struct mapping_ctx *labels_mapping;
+ enum mlx5_flow_namespace_type ns_type;
+ struct mlx5_fs_chains *chains;
++ spinlock_t ht_lock; /* protects ft entries */
+ };
+
+ struct mlx5_ct_flow {
+@@ -124,6 +125,10 @@ struct mlx5_ct_counter {
+ bool is_shared;
+ };
+
++enum {
++ MLX5_CT_ENTRY_FLAG_VALID,
++};
++
+ struct mlx5_ct_entry {
+ struct rhash_head node;
+ struct rhash_head tuple_node;
+@@ -134,6 +139,12 @@ struct mlx5_ct_entry {
+ struct mlx5_ct_tuple tuple;
+ struct mlx5_ct_tuple tuple_nat;
+ struct mlx5_ct_zone_rule zone_rules[2];
++
++ struct mlx5_tc_ct_priv *ct_priv;
++ struct work_struct work;
++
++ refcount_t refcnt;
++ unsigned long flags;
+ };
+
+ static const struct rhashtable_params cts_ht_params = {
+@@ -740,6 +751,87 @@ err_attr:
+ return err;
+ }
+
++static bool
++mlx5_tc_ct_entry_valid(struct mlx5_ct_entry *entry)
++{
++ return test_bit(MLX5_CT_ENTRY_FLAG_VALID, &entry->flags);
++}
++
++static struct mlx5_ct_entry *
++mlx5_tc_ct_entry_get(struct mlx5_tc_ct_priv *ct_priv, struct mlx5_ct_tuple *tuple)
++{
++ struct mlx5_ct_entry *entry;
++
++ entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, tuple,
++ tuples_ht_params);
++ if (entry && mlx5_tc_ct_entry_valid(entry) &&
++ refcount_inc_not_zero(&entry->refcnt)) {
++ return entry;
++ } else if (!entry) {
++ entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_nat_ht,
++ tuple, tuples_nat_ht_params);
++ if (entry && mlx5_tc_ct_entry_valid(entry) &&
++ refcount_inc_not_zero(&entry->refcnt))
++ return entry;
++ }
++
++ return entry ? ERR_PTR(-EINVAL) : NULL;
++}
++
++static void mlx5_tc_ct_entry_remove_from_tuples(struct mlx5_ct_entry *entry)
++{
++ struct mlx5_tc_ct_priv *ct_priv = entry->ct_priv;
++
++ rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
++ &entry->tuple_nat_node,
++ tuples_nat_ht_params);
++ rhashtable_remove_fast(&ct_priv->ct_tuples_ht, &entry->tuple_node,
++ tuples_ht_params);
++}
++
++static void mlx5_tc_ct_entry_del(struct mlx5_ct_entry *entry)
++{
++ struct mlx5_tc_ct_priv *ct_priv = entry->ct_priv;
++
++ mlx5_tc_ct_entry_del_rules(ct_priv, entry);
++
++ spin_lock_bh(&ct_priv->ht_lock);
++ mlx5_tc_ct_entry_remove_from_tuples(entry);
++ spin_unlock_bh(&ct_priv->ht_lock);
++
++ mlx5_tc_ct_counter_put(ct_priv, entry);
++ kfree(entry);
++}
++
++static void
++mlx5_tc_ct_entry_put(struct mlx5_ct_entry *entry)
++{
++ if (!refcount_dec_and_test(&entry->refcnt))
++ return;
++
++ mlx5_tc_ct_entry_del(entry);
++}
++
++static void mlx5_tc_ct_entry_del_work(struct work_struct *work)
++{
++ struct mlx5_ct_entry *entry = container_of(work, struct mlx5_ct_entry, work);
++
++ mlx5_tc_ct_entry_del(entry);
++}
++
++static void
++__mlx5_tc_ct_entry_put(struct mlx5_ct_entry *entry)
++{
++ struct mlx5e_priv *priv;
++
++ if (!refcount_dec_and_test(&entry->refcnt))
++ return;
++
++ priv = netdev_priv(entry->ct_priv->netdev);
++ INIT_WORK(&entry->work, mlx5_tc_ct_entry_del_work);
++ queue_work(priv->wq, &entry->work);
++}
++
+ static struct mlx5_ct_counter *
+ mlx5_tc_ct_counter_create(struct mlx5_tc_ct_priv *ct_priv)
+ {
+@@ -792,16 +884,26 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
+ }
+
+ /* Use the same counter as the reverse direction */
+- mutex_lock(&ct_priv->shared_counter_lock);
+- rev_entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, &rev_tuple,
+- tuples_ht_params);
+- if (rev_entry) {
+- if (refcount_inc_not_zero(&rev_entry->counter->refcount)) {
+- mutex_unlock(&ct_priv->shared_counter_lock);
+- return rev_entry->counter;
+- }
++ spin_lock_bh(&ct_priv->ht_lock);
++ rev_entry = mlx5_tc_ct_entry_get(ct_priv, &rev_tuple);
++
++ if (IS_ERR(rev_entry)) {
++ spin_unlock_bh(&ct_priv->ht_lock);
++ goto create_counter;
++ }
++
++ if (rev_entry && refcount_inc_not_zero(&rev_entry->counter->refcount)) {
++ ct_dbg("Using shared counter entry=0x%p rev=0x%p\n", entry, rev_entry);
++ shared_counter = rev_entry->counter;
++ spin_unlock_bh(&ct_priv->ht_lock);
++
++ mlx5_tc_ct_entry_put(rev_entry);
++ return shared_counter;
+ }
+- mutex_unlock(&ct_priv->shared_counter_lock);
++
++ spin_unlock_bh(&ct_priv->ht_lock);
++
++create_counter:
+
+ shared_counter = mlx5_tc_ct_counter_create(ct_priv);
+ if (IS_ERR(shared_counter)) {
+@@ -866,10 +968,14 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
+ if (!meta_action)
+ return -EOPNOTSUPP;
+
+- entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
+- cts_ht_params);
+- if (entry)
+- return 0;
++ spin_lock_bh(&ct_priv->ht_lock);
++ entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
++ if (entry && refcount_inc_not_zero(&entry->refcnt)) {
++ spin_unlock_bh(&ct_priv->ht_lock);
++ mlx5_tc_ct_entry_put(entry);
++ return -EEXIST;
++ }
++ spin_unlock_bh(&ct_priv->ht_lock);
+
+ entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+ if (!entry)
+@@ -878,6 +984,8 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
+ entry->tuple.zone = ft->zone;
+ entry->cookie = flow->cookie;
+ entry->restore_cookie = meta_action->ct_metadata.cookie;
++ refcount_set(&entry->refcnt, 2);
++ entry->ct_priv = ct_priv;
+
+ err = mlx5_tc_ct_rule_to_tuple(&entry->tuple, flow_rule);
+ if (err)
+@@ -888,35 +996,40 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft,
+ if (err)
+ goto err_set;
+
+- err = rhashtable_insert_fast(&ct_priv->ct_tuples_ht,
+- &entry->tuple_node,
+- tuples_ht_params);
++ spin_lock_bh(&ct_priv->ht_lock);
++
++ err = rhashtable_lookup_insert_fast(&ft->ct_entries_ht, &entry->node,
++ cts_ht_params);
++ if (err)
++ goto err_entries;
++
++ err = rhashtable_lookup_insert_fast(&ct_priv->ct_tuples_ht,
++ &entry->tuple_node,
++ tuples_ht_params);
+ if (err)
+ goto err_tuple;
+
+ if (memcmp(&entry->tuple, &entry->tuple_nat, sizeof(entry->tuple))) {
+- err = rhashtable_insert_fast(&ct_priv->ct_tuples_nat_ht,
+- &entry->tuple_nat_node,
+- tuples_nat_ht_params);
++ err = rhashtable_lookup_insert_fast(&ct_priv->ct_tuples_nat_ht,
++ &entry->tuple_nat_node,
++ tuples_nat_ht_params);
+ if (err)
+ goto err_tuple_nat;
+ }
++ spin_unlock_bh(&ct_priv->ht_lock);
+
+ err = mlx5_tc_ct_entry_add_rules(ct_priv, flow_rule, entry,
+ ft->zone_restore_id);
+ if (err)
+ goto err_rules;
+
+- err = rhashtable_insert_fast(&ft->ct_entries_ht, &entry->node,
+- cts_ht_params);
+- if (err)
+- goto err_insert;
++ set_bit(MLX5_CT_ENTRY_FLAG_VALID, &entry->flags);
++ mlx5_tc_ct_entry_put(entry); /* this function reference */
+
+ return 0;
+
+-err_insert:
+- mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+ err_rules:
++ spin_lock_bh(&ct_priv->ht_lock);
+ if (mlx5_tc_ct_entry_has_nat(entry))
+ rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+ &entry->tuple_nat_node, tuples_nat_ht_params);
+@@ -925,47 +1038,43 @@ err_tuple_nat:
+ &entry->tuple_node,
+ tuples_ht_params);
+ err_tuple:
++ rhashtable_remove_fast(&ft->ct_entries_ht,
++ &entry->node,
++ cts_ht_params);
++err_entries:
++ spin_unlock_bh(&ct_priv->ht_lock);
+ err_set:
+ kfree(entry);
+- netdev_warn(ct_priv->netdev,
+- "Failed to offload ct entry, err: %d\n", err);
++ if (err != -EEXIST)
++ netdev_warn(ct_priv->netdev, "Failed to offload ct entry, err: %d\n", err);
+ return err;
+ }
+
+-static void
+-mlx5_tc_ct_del_ft_entry(struct mlx5_tc_ct_priv *ct_priv,
+- struct mlx5_ct_entry *entry)
+-{
+- mlx5_tc_ct_entry_del_rules(ct_priv, entry);
+- mutex_lock(&ct_priv->shared_counter_lock);
+- if (mlx5_tc_ct_entry_has_nat(entry))
+- rhashtable_remove_fast(&ct_priv->ct_tuples_nat_ht,
+- &entry->tuple_nat_node,
+- tuples_nat_ht_params);
+- rhashtable_remove_fast(&ct_priv->ct_tuples_ht, &entry->tuple_node,
+- tuples_ht_params);
+- mutex_unlock(&ct_priv->shared_counter_lock);
+- mlx5_tc_ct_counter_put(ct_priv, entry);
+-
+-}
+-
+ static int
+ mlx5_tc_ct_block_flow_offload_del(struct mlx5_ct_ft *ft,
+ struct flow_cls_offload *flow)
+ {
++ struct mlx5_tc_ct_priv *ct_priv = ft->ct_priv;
+ unsigned long cookie = flow->cookie;
+ struct mlx5_ct_entry *entry;
+
+- entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
+- cts_ht_params);
+- if (!entry)
++ spin_lock_bh(&ct_priv->ht_lock);
++ entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
++ if (!entry) {
++ spin_unlock_bh(&ct_priv->ht_lock);
+ return -ENOENT;
++ }
+
+- mlx5_tc_ct_del_ft_entry(ft->ct_priv, entry);
+- WARN_ON(rhashtable_remove_fast(&ft->ct_entries_ht,
+- &entry->node,
+- cts_ht_params));
+- kfree(entry);
++ if (!mlx5_tc_ct_entry_valid(entry)) {
++ spin_unlock_bh(&ct_priv->ht_lock);
++ return -EINVAL;
++ }
++
++ rhashtable_remove_fast(&ft->ct_entries_ht, &entry->node, cts_ht_params);
++ mlx5_tc_ct_entry_remove_from_tuples(entry);
++ spin_unlock_bh(&ct_priv->ht_lock);
++
++ mlx5_tc_ct_entry_put(entry);
+
+ return 0;
+ }
+@@ -974,19 +1083,30 @@ static int
+ mlx5_tc_ct_block_flow_offload_stats(struct mlx5_ct_ft *ft,
+ struct flow_cls_offload *f)
+ {
++ struct mlx5_tc_ct_priv *ct_priv = ft->ct_priv;
+ unsigned long cookie = f->cookie;
+ struct mlx5_ct_entry *entry;
+ u64 lastuse, packets, bytes;
+
+- entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie,
+- cts_ht_params);
+- if (!entry)
++ spin_lock_bh(&ct_priv->ht_lock);
++ entry = rhashtable_lookup_fast(&ft->ct_entries_ht, &cookie, cts_ht_params);
++ if (!entry) {
++ spin_unlock_bh(&ct_priv->ht_lock);
+ return -ENOENT;
++ }
++
++ if (!mlx5_tc_ct_entry_valid(entry) || !refcount_inc_not_zero(&entry->refcnt)) {
++ spin_unlock_bh(&ct_priv->ht_lock);
++ return -EINVAL;
++ }
++
++ spin_unlock_bh(&ct_priv->ht_lock);
+
+ mlx5_fc_query_cached(entry->counter->counter, &bytes, &packets, &lastuse);
+ flow_stats_update(&f->stats, bytes, packets, 0, lastuse,
+ FLOW_ACTION_HW_STATS_DELAYED);
+
++ mlx5_tc_ct_entry_put(entry);
+ return 0;
+ }
+
+@@ -1478,11 +1598,9 @@ err_mapping:
+ static void
+ mlx5_tc_ct_flush_ft_entry(void *ptr, void *arg)
+ {
+- struct mlx5_tc_ct_priv *ct_priv = arg;
+ struct mlx5_ct_entry *entry = ptr;
+
+- mlx5_tc_ct_del_ft_entry(ct_priv, entry);
+- kfree(entry);
++ mlx5_tc_ct_entry_put(entry);
+ }
+
+ static void
+@@ -1960,6 +2078,7 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains,
+ goto err_mapping_labels;
+ }
+
++ spin_lock_init(&ct_priv->ht_lock);
+ ct_priv->ns_type = ns_type;
+ ct_priv->chains = chains;
+ ct_priv->netdev = priv->netdev;
+@@ -1994,7 +2113,6 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains,
+
+ idr_init(&ct_priv->fte_ids);
+ mutex_init(&ct_priv->control_lock);
+- mutex_init(&ct_priv->shared_counter_lock);
+ rhashtable_init(&ct_priv->zone_ht, &zone_params);
+ rhashtable_init(&ct_priv->ct_tuples_ht, &tuples_ht_params);
+ rhashtable_init(&ct_priv->ct_tuples_nat_ht, &tuples_nat_ht_params);
+@@ -2037,7 +2155,6 @@ mlx5_tc_ct_clean(struct mlx5_tc_ct_priv *ct_priv)
+ rhashtable_destroy(&ct_priv->ct_tuples_nat_ht);
+ rhashtable_destroy(&ct_priv->zone_ht);
+ mutex_destroy(&ct_priv->control_lock);
+- mutex_destroy(&ct_priv->shared_counter_lock);
+ idr_destroy(&ct_priv->fte_ids);
+ kfree(ct_priv);
+ }
+@@ -2059,14 +2176,22 @@ mlx5e_tc_ct_restore_flow(struct mlx5_tc_ct_priv *ct_priv,
+ if (!mlx5_tc_ct_skb_to_tuple(skb, &tuple, zone))
+ return false;
+
+- entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_ht, &tuple,
+- tuples_ht_params);
+- if (!entry)
+- entry = rhashtable_lookup_fast(&ct_priv->ct_tuples_nat_ht,
+- &tuple, tuples_nat_ht_params);
+- if (!entry)
++ spin_lock(&ct_priv->ht_lock);
++
++ entry = mlx5_tc_ct_entry_get(ct_priv, &tuple);
++ if (!entry) {
++ spin_unlock(&ct_priv->ht_lock);
++ return false;
++ }
++
++ if (IS_ERR(entry)) {
++ spin_unlock(&ct_priv->ht_lock);
+ return false;
++ }
++ spin_unlock(&ct_priv->ht_lock);
+
+ tcf_ct_flow_table_restore_skb(skb, entry->restore_cookie);
++ __mlx5_tc_ct_entry_put(entry);
++
+ return true;
+ }
+--
+2.27.0
+
--- /dev/null
+From 678e374ce6a3e5fc3ec6ce685b060e92bc5e3284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 17:55:58 +0200
+Subject: net/mlx5e: Don't change interrupt moderation params when DIM is
+ enabled
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 019f93bc4ba3a0dcb77f448ee77fc4c9c1b89565 ]
+
+When mlx5e_ethtool_set_coalesce doesn't change DIM state
+(enabled/disabled), it calls mlx5e_set_priv_channels_coalesce
+unconditionally, which in turn invokes a firmware command to set
+interrupt moderation parameters. It shouldn't happen while DIM manages
+those parameters dynamically (it might even be happening at the same
+time).
+
+This patch fixes it by splitting mlx5e_set_priv_channels_coalesce into
+two functions (for RX and TX) and calling them only when DIM is disabled
+(for RX and TX respectively).
+
+Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlx5/core/en_ethtool.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 302001d6661ea..d7ff5fa45cb7d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -525,7 +525,7 @@ static int mlx5e_get_coalesce(struct net_device *netdev,
+ #define MLX5E_MAX_COAL_FRAMES MLX5_MAX_CQ_COUNT
+
+ static void
+-mlx5e_set_priv_channels_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
++mlx5e_set_priv_channels_tx_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
+ {
+ struct mlx5_core_dev *mdev = priv->mdev;
+ int tc;
+@@ -540,6 +540,17 @@ mlx5e_set_priv_channels_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesc
+ coal->tx_coalesce_usecs,
+ coal->tx_max_coalesced_frames);
+ }
++ }
++}
++
++static void
++mlx5e_set_priv_channels_rx_coalesce(struct mlx5e_priv *priv, struct ethtool_coalesce *coal)
++{
++ struct mlx5_core_dev *mdev = priv->mdev;
++ int i;
++
++ for (i = 0; i < priv->channels.num; ++i) {
++ struct mlx5e_channel *c = priv->channels.c[i];
+
+ mlx5_core_modify_cq_moderation(mdev, &c->rq.cq.mcq,
+ coal->rx_coalesce_usecs,
+@@ -596,7 +607,10 @@ int mlx5e_ethtool_set_coalesce(struct mlx5e_priv *priv,
+ reset_tx = !!coal->use_adaptive_tx_coalesce != priv->channels.params.tx_dim_enabled;
+
+ if (!reset_rx && !reset_tx) {
+- mlx5e_set_priv_channels_coalesce(priv, coal);
++ if (!coal->use_adaptive_rx_coalesce)
++ mlx5e_set_priv_channels_rx_coalesce(priv, coal);
++ if (!coal->use_adaptive_tx_coalesce)
++ mlx5e_set_priv_channels_tx_coalesce(priv, coal);
+ priv->channels.params = new_channels.params;
+ goto out;
+ }
+--
+2.27.0
+
--- /dev/null
+From a4ee06ebdb5a13a8b4bb832f27d1857288ec8b08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jan 2021 16:13:22 +0200
+Subject: net/mlx5e: E-switch, Fix rate calculation for overflow
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 0e22bfb7c046e7c8ae339f396e78a0976633698c ]
+
+rate_bytes_ps is a 64-bit field. It passed as 32-bit field to
+apply_police_params(). Due to this when police rate is higher
+than 4Gbps, 32-bit calculation ignores the carry. This results
+in incorrect rate configurationn the device.
+
+Fix it by performing 64-bit calculation.
+
+Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Eli Cohen <elic@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index dd0bfbacad474..717fbaa6ce736 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -5040,7 +5040,7 @@ static int apply_police_params(struct mlx5e_priv *priv, u64 rate,
+ */
+ if (rate) {
+ rate = (rate * BITS_PER_BYTE) + 500000;
+- rate_mbps = max_t(u32, do_div(rate, 1000000), 1);
++ rate_mbps = max_t(u64, do_div(rate, 1000000), 1);
+ }
+
+ err = mlx5_esw_modify_vport_rate(esw, vport_num, rate_mbps);
+--
+2.27.0
+
--- /dev/null
+From ef277198fd63fac27a8f65d93397be40d26a56cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 22:40:23 +0200
+Subject: net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices
+
+From: Raed Salem <raeds@nvidia.com>
+
+[ Upstream commit e4484d9df5000a18916e0bbcee50828eac8e293e ]
+
+This limitation was inherited by previous Innova (FPGA) IPsec
+implementation, it uses its private set of RQ handlers which does
+not support striding rq, for Connect-X this is no longer true.
+
+Fix by keeping this limitation only for Innova IPsec supporting devices,
+as otherwise this limitation effectively wrongly blocks striding RQs for
+all future Connect-X devices for all flows even if IPsec offload is not
+used.
+
+Fixes: 2d64663cd559 ("net/mlx5: IPsec: Add HW crypto offload support")
+Signed-off-by: Raed Salem <raeds@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++--
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 ++--
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.h | 2 ++
+ 4 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 5fb0ab71d79ce..3edc826cc6bbe 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -65,6 +65,7 @@
+ #include "en/devlink.h"
+ #include "lib/mlx5.h"
+ #include "en/ptp.h"
++#include "fpga/ipsec.h"
+
+ bool mlx5e_check_fragmented_striding_rq_cap(struct mlx5_core_dev *mdev)
+ {
+@@ -106,7 +107,7 @@ bool mlx5e_striding_rq_possible(struct mlx5_core_dev *mdev,
+ if (!mlx5e_check_fragmented_striding_rq_cap(mdev))
+ return false;
+
+- if (MLX5_IPSEC_DEV(mdev))
++ if (mlx5_fpga_is_ipsec_device(mdev))
+ return false;
+
+ if (params->xdp_prog) {
+@@ -2069,7 +2070,7 @@ static void mlx5e_build_rq_frags_info(struct mlx5_core_dev *mdev,
+ int i;
+
+ #ifdef CONFIG_MLX5_EN_IPSEC
+- if (MLX5_IPSEC_DEV(mdev))
++ if (mlx5_fpga_is_ipsec_device(mdev))
+ byte_count += MLX5E_METADATA_ETHER_LEN;
+ #endif
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+index ca4b55839a8a7..4864deed9dc94 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1795,8 +1795,8 @@ int mlx5e_rq_set_handlers(struct mlx5e_rq *rq, struct mlx5e_params *params, bool
+
+ rq->handle_rx_cqe = priv->profile->rx_handlers->handle_rx_cqe_mpwqe;
+ #ifdef CONFIG_MLX5_EN_IPSEC
+- if (MLX5_IPSEC_DEV(mdev)) {
+- netdev_err(netdev, "MPWQE RQ with IPSec offload not supported\n");
++ if (mlx5_fpga_is_ipsec_device(mdev)) {
++ netdev_err(netdev, "MPWQE RQ with Innova IPSec offload not supported\n");
+ return -EINVAL;
+ }
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+index cc67366495b09..22bee49902327 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c
+@@ -124,7 +124,7 @@ struct mlx5_fpga_ipsec {
+ struct ida halloc;
+ };
+
+-static bool mlx5_fpga_is_ipsec_device(struct mlx5_core_dev *mdev)
++bool mlx5_fpga_is_ipsec_device(struct mlx5_core_dev *mdev)
+ {
+ if (!mdev->fpga || !MLX5_CAP_GEN(mdev, fpga))
+ return false;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.h
+index db88eb4c49e34..8931b55844773 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.h
+@@ -43,6 +43,7 @@ u32 mlx5_fpga_ipsec_device_caps(struct mlx5_core_dev *mdev);
+ const struct mlx5_flow_cmds *
+ mlx5_fs_cmd_get_default_ipsec_fpga_cmds(enum fs_flow_table_type type);
+ void mlx5_fpga_ipsec_build_fs_cmds(void);
++bool mlx5_fpga_is_ipsec_device(struct mlx5_core_dev *mdev);
+ #else
+ static inline
+ const struct mlx5_accel_ipsec_ops *mlx5_fpga_ipsec_ops(struct mlx5_core_dev *mdev)
+@@ -55,6 +56,7 @@ mlx5_fs_cmd_get_default_ipsec_fpga_cmds(enum fs_flow_table_type type)
+ }
+
+ static inline void mlx5_fpga_ipsec_build_fs_cmds(void) {};
++static inline bool mlx5_fpga_is_ipsec_device(struct mlx5_core_dev *mdev) { return false; }
+
+ #endif /* CONFIG_MLX5_FPGA_IPSEC */
+ #endif /* __MLX5_FPGA_IPSEC_H__ */
+--
+2.27.0
+
--- /dev/null
+From 05f034919077253f9b9f8891695d006b8ad9b287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 09:58:22 +0200
+Subject: net/mlx5e: Enable XDP for Connect-X IPsec capable devices
+
+From: Raed Salem <raeds@nvidia.com>
+
+[ Upstream commit e33f9f5f2d3a5fa97728a43708f41da2d4faae65 ]
+
+This limitation was inherited by previous Innova (FPGA) IPsec
+implementation, it uses its private set of RQ handlers which
+does not support XDP, for Connect-X this is no longer true.
+
+Fix by keeping this limitation only for Innova IPsec supporting devices,
+as otherwise this limitation effectively wrongly blocks XDP for all
+future Connect-X devices for all flows even if IPsec offload is not
+used.
+
+Fixes: 2d64663cd559 ("net/mlx5: IPsec: Add HW crypto offload support")
+Signed-off-by: Raed Salem <raeds@nvidia.com>
+Reviewed-by: Alaa Hleihel <alaa@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 3fc7d18ac868b..92436569ce86b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -4455,8 +4455,9 @@ static int mlx5e_xdp_allowed(struct mlx5e_priv *priv, struct bpf_prog *prog)
+ return -EINVAL;
+ }
+
+- if (MLX5_IPSEC_DEV(priv->mdev)) {
+- netdev_warn(netdev, "can't set XDP with IPSec offload\n");
++ if (mlx5_fpga_is_ipsec_device(priv->mdev)) {
++ netdev_warn(netdev,
++ "XDP is not available on Innova cards with IPsec support\n");
+ return -EINVAL;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 42094cad55de868063f487713e4abdc7ed057111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 09:25:28 +0200
+Subject: net/mlx5e: Fix CQ params of ICOSQ and async ICOSQ
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit ebf79b6be67c0a77a9ab7cdf74c43fd7d9619f0c ]
+
+The commit mentioned below has split the parameters of ICOSQ and async
+ICOSQ, but it contained a typo: the CQ parameters were swapped for ICOSQ
+and async ICOSQ. Async ICOSQ is longer than the normal ICOSQ, and the CQ
+size must be the same as the size of the corresponding SQ, but due to
+this bug, the CQ of async ICOSQ was much shorter than async ICOSQ
+itself. It led to overflows of the CQ with such messages in dmesg, in
+particular, when running multiple kTLS-offloaded streams:
+
+mlx5_core 0000:08:00.0: cq_err_event_notifier:529:(pid 9422): CQ error
+on CQN 0x406, syndrome 0x1
+mlx5_core 0000:08:00.0 eth2: mlx5e_cq_error_event: cqn=0x000406
+event=0x04
+
+This commit fixes the issue by using the corresponding parameters for
+ICOSQ and async ICOSQ.
+
+Fixes: c293ac927fbb ("net/mlx5e: Refactor build channel params")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 3edc826cc6bbe..a2e0b548bf570 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -1827,12 +1827,12 @@ static int mlx5e_open_queues(struct mlx5e_channel *c,
+
+ mlx5e_build_create_cq_param(&ccp, c);
+
+- err = mlx5e_open_cq(c->priv, icocq_moder, &cparam->icosq.cqp, &ccp,
++ err = mlx5e_open_cq(c->priv, icocq_moder, &cparam->async_icosq.cqp, &ccp,
+ &c->async_icosq.cq);
+ if (err)
+ return err;
+
+- err = mlx5e_open_cq(c->priv, icocq_moder, &cparam->async_icosq.cqp, &ccp,
++ err = mlx5e_open_cq(c->priv, icocq_moder, &cparam->icosq.cqp, &ccp,
+ &c->icosq.cq);
+ if (err)
+ goto err_close_async_icosq_cq;
+--
+2.27.0
+
--- /dev/null
+From 70fad866897147d05a607f583c93b74cd3f2384a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 18:42:29 +0200
+Subject: net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit b850bbff965129c34f50962638c0a66c82563536 ]
+
+wait_for_resync is unreliable - if it timeouts, priv_rx will be freed
+anyway. However, mlx5e_ktls_handle_get_psv_completion will be called
+sooner or later, leading to use-after-free. For example, it can happen
+if a CQ error happened, and ICOSQ stopped, but later on the queues are
+destroyed, and ICOSQ is flushed with mlx5e_free_icosq_descs.
+
+This patch converts the lifecycle of priv_rx to fully refcount-based, so
+that the struct won't be freed before the refcount goes to zero.
+
+Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en_accel/ktls_rx.c | 64 +++++++++----------
+ 1 file changed, 30 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+index 0f13b661f7f98..d06532d0baa43 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+@@ -57,6 +57,20 @@ struct mlx5e_ktls_offload_context_rx {
+ struct mlx5e_ktls_rx_resync_ctx resync;
+ };
+
++static bool mlx5e_ktls_priv_rx_put(struct mlx5e_ktls_offload_context_rx *priv_rx)
++{
++ if (!refcount_dec_and_test(&priv_rx->resync.refcnt))
++ return false;
++
++ kfree(priv_rx);
++ return true;
++}
++
++static void mlx5e_ktls_priv_rx_get(struct mlx5e_ktls_offload_context_rx *priv_rx)
++{
++ refcount_inc(&priv_rx->resync.refcnt);
++}
++
+ static int mlx5e_ktls_create_tir(struct mlx5_core_dev *mdev, u32 *tirn, u32 rqtn)
+ {
+ int err, inlen;
+@@ -326,7 +340,7 @@ static void resync_handle_work(struct work_struct *work)
+ priv_rx = container_of(resync, struct mlx5e_ktls_offload_context_rx, resync);
+
+ if (unlikely(test_bit(MLX5E_PRIV_RX_FLAG_DELETING, priv_rx->flags))) {
+- refcount_dec(&resync->refcnt);
++ mlx5e_ktls_priv_rx_put(priv_rx);
+ return;
+ }
+
+@@ -334,7 +348,7 @@ static void resync_handle_work(struct work_struct *work)
+ sq = &c->async_icosq;
+
+ if (resync_post_get_progress_params(sq, priv_rx))
+- refcount_dec(&resync->refcnt);
++ mlx5e_ktls_priv_rx_put(priv_rx);
+ }
+
+ static void resync_init(struct mlx5e_ktls_rx_resync_ctx *resync,
+@@ -377,7 +391,11 @@ unlock:
+ return err;
+ }
+
+-/* Function is called with elevated refcount, it decreases it. */
++/* Function can be called with the refcount being either elevated or not.
++ * It decreases the refcount and may free the kTLS priv context.
++ * Refcount is not elevated only if tls_dev_del has been called, but GET_PSV was
++ * already in flight.
++ */
+ void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi,
+ struct mlx5e_icosq *sq)
+ {
+@@ -410,7 +428,7 @@ void mlx5e_ktls_handle_get_psv_completion(struct mlx5e_icosq_wqe_info *wi,
+ tls_offload_rx_resync_async_request_end(priv_rx->sk, cpu_to_be32(hw_seq));
+ priv_rx->stats->tls_resync_req_end++;
+ out:
+- refcount_dec(&resync->refcnt);
++ mlx5e_ktls_priv_rx_put(priv_rx);
+ dma_unmap_single(dev, buf->dma_addr, PROGRESS_PARAMS_PADDED_SIZE, DMA_FROM_DEVICE);
+ kfree(buf);
+ }
+@@ -431,9 +449,9 @@ static bool resync_queue_get_psv(struct sock *sk)
+ return false;
+
+ resync = &priv_rx->resync;
+- refcount_inc(&resync->refcnt);
++ mlx5e_ktls_priv_rx_get(priv_rx);
+ if (unlikely(!queue_work(resync->priv->tls->rx_wq, &resync->work)))
+- refcount_dec(&resync->refcnt);
++ mlx5e_ktls_priv_rx_put(priv_rx);
+
+ return true;
+ }
+@@ -625,31 +643,6 @@ err_create_key:
+ return err;
+ }
+
+-/* Elevated refcount on the resync object means there are
+- * outstanding operations (uncompleted GET_PSV WQEs) that
+- * will read the resync / priv_rx objects once completed.
+- * Wait for them to avoid use-after-free.
+- */
+-static void wait_for_resync(struct net_device *netdev,
+- struct mlx5e_ktls_rx_resync_ctx *resync)
+-{
+-#define MLX5E_KTLS_RX_RESYNC_TIMEOUT 20000 /* msecs */
+- unsigned long exp_time = jiffies + msecs_to_jiffies(MLX5E_KTLS_RX_RESYNC_TIMEOUT);
+- unsigned int refcnt;
+-
+- do {
+- refcnt = refcount_read(&resync->refcnt);
+- if (refcnt == 1)
+- return;
+-
+- msleep(20);
+- } while (time_before(jiffies, exp_time));
+-
+- netdev_warn(netdev,
+- "Failed waiting for kTLS RX resync refcnt to be released (%u).\n",
+- refcnt);
+-}
+-
+ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
+ {
+ struct mlx5e_ktls_offload_context_rx *priv_rx;
+@@ -671,8 +664,7 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
+ wait_for_completion(&priv_rx->add_ctx);
+ resync = &priv_rx->resync;
+ if (cancel_work_sync(&resync->work))
+- refcount_dec(&resync->refcnt);
+- wait_for_resync(netdev, resync);
++ mlx5e_ktls_priv_rx_put(priv_rx);
+
+ priv_rx->stats->tls_del++;
+ if (priv_rx->rule.rule)
+@@ -680,5 +672,9 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
+
+ mlx5_core_destroy_tir(mdev, priv_rx->tirn);
+ mlx5_ktls_destroy_key(mdev, priv_rx->key_id);
+- kfree(priv_rx);
++ /* priv_rx should normally be freed here, but if there is an outstanding
++ * GET_PSV, deallocation will be delayed until the CQE for GET_PSV is
++ * processed.
++ */
++ mlx5e_ktls_priv_rx_put(priv_rx);
+ }
+--
+2.27.0
+
--- /dev/null
+From 24511598f0f901da0863dda7bc45327b52b11b16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 14:01:27 +0200
+Subject: net/mlx5e: Replace synchronize_rcu with synchronize_net
+
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+
+[ Upstream commit 4d6e6b0c6d4bed8a7128500701354e2dc6098fa3 ]
+
+The commit cited below switched from using napi_synchronize to
+synchronize_rcu to have a guarantee that it will finish in finite time.
+However, on average, synchronize_rcu takes more time than
+napi_synchronize. Given that it's called multiple times per channel on
+deactivation, it accumulates to a significant amount, which causes
+timeouts in some applications (for example, when using bonding with
+NetworkManager).
+
+This commit replaces synchronize_rcu with synchronize_net, which is
+faster when called under rtnl_lock, allowing to speed up the described
+flow.
+
+Fixes: 9c25a22dfb00 ("net/mlx5e: Use synchronize_rcu to sync with NAPI")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 2 +-
+ .../net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 ++++----
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+index d487e5e371625..8d991c3b7a503 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+@@ -83,7 +83,7 @@ static inline void mlx5e_xdp_tx_disable(struct mlx5e_priv *priv)
+
+ clear_bit(MLX5E_STATE_XDP_TX_ENABLED, &priv->state);
+ /* Let other device's napi(s) and XSK wakeups see our new state. */
+- synchronize_rcu();
++ synchronize_net();
+ }
+
+ static inline bool mlx5e_xdp_tx_is_enabled(struct mlx5e_priv *priv)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+index d87c345878d3d..f4bce1365639e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c
+@@ -111,7 +111,7 @@ err_free_cparam:
+ void mlx5e_close_xsk(struct mlx5e_channel *c)
+ {
+ clear_bit(MLX5E_CHANNEL_STATE_XSK, c->state);
+- synchronize_rcu(); /* Sync with the XSK wakeup and with NAPI. */
++ synchronize_net(); /* Sync with the XSK wakeup and with NAPI. */
+
+ mlx5e_close_rq(&c->xskrq);
+ mlx5e_close_cq(&c->xskrq.cq);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+index 6a1d82503ef8f..0f13b661f7f98 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c
+@@ -663,7 +663,7 @@ void mlx5e_ktls_del_rx(struct net_device *netdev, struct tls_context *tls_ctx)
+ priv_rx = mlx5e_get_ktls_rx_priv_ctx(tls_ctx);
+ set_bit(MLX5E_PRIV_RX_FLAG_DELETING, priv_rx->flags);
+ mlx5e_set_ktls_rx_priv_ctx(tls_ctx, NULL);
+- synchronize_rcu(); /* Sync with NAPI */
++ synchronize_net(); /* Sync with NAPI */
+ if (!cancel_work_sync(&priv_rx->rule.work))
+ /* completion is needed, as the priv_rx in the add flow
+ * is maintained on the wqe info (wi), not on the socket.
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 92436569ce86b..5fb0ab71d79ce 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -914,7 +914,7 @@ void mlx5e_activate_rq(struct mlx5e_rq *rq)
+ void mlx5e_deactivate_rq(struct mlx5e_rq *rq)
+ {
+ clear_bit(MLX5E_RQ_STATE_ENABLED, &rq->state);
+- synchronize_rcu(); /* Sync with NAPI to prevent mlx5e_post_rx_wqes. */
++ synchronize_net(); /* Sync with NAPI to prevent mlx5e_post_rx_wqes. */
+ }
+
+ void mlx5e_close_rq(struct mlx5e_rq *rq)
+@@ -1348,7 +1348,7 @@ void mlx5e_deactivate_txqsq(struct mlx5e_txqsq *sq)
+ struct mlx5_wq_cyc *wq = &sq->wq;
+
+ clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
+- synchronize_rcu(); /* Sync with NAPI to prevent netif_tx_wake_queue. */
++ synchronize_net(); /* Sync with NAPI to prevent netif_tx_wake_queue. */
+
+ mlx5e_tx_disable_queue(sq->txq);
+
+@@ -1423,7 +1423,7 @@ void mlx5e_activate_icosq(struct mlx5e_icosq *icosq)
+ void mlx5e_deactivate_icosq(struct mlx5e_icosq *icosq)
+ {
+ clear_bit(MLX5E_SQ_STATE_ENABLED, &icosq->state);
+- synchronize_rcu(); /* Sync with NAPI. */
++ synchronize_net(); /* Sync with NAPI. */
+ }
+
+ void mlx5e_close_icosq(struct mlx5e_icosq *sq)
+@@ -1502,7 +1502,7 @@ void mlx5e_close_xdpsq(struct mlx5e_xdpsq *sq)
+ struct mlx5e_channel *c = sq->channel;
+
+ clear_bit(MLX5E_SQ_STATE_ENABLED, &sq->state);
+- synchronize_rcu(); /* Sync with NAPI. */
++ synchronize_net(); /* Sync with NAPI. */
+
+ mlx5e_destroy_sq(c->mdev, sq->sqn);
+ mlx5e_free_xdpsq_descs(sq);
+--
+2.27.0
+
--- /dev/null
+From e10d05461a9f6c9296b7e915d5938d403586fa0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 10:25:35 +0100
+Subject: net: mvneta: Remove per-cpu queue mapping for Armada 3700
+
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+
+[ Upstream commit cf9bf871280d9e0a8869d98c2602d29caf69dfa3 ]
+
+According to Errata #23 "The per-CPU GbE interrupt is limited to Core
+0", we can't use the per-cpu interrupt mechanism on the Armada 3700
+familly.
+
+This is correctly checked for RSS configuration, but the initial queue
+mapping is still done by having the queues spread across all the CPUs in
+the system, both in the init path and in the cpu_hotplug path.
+
+Fixes: 2636ac3cc2b4 ("net: mvneta: Add network support for Armada 3700 SoC")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvneta.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
+index bc4d8d1444019..fd5b33646ea71 100644
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3432,7 +3432,9 @@ static int mvneta_txq_sw_init(struct mvneta_port *pp,
+ return -ENOMEM;
+
+ /* Setup XPS mapping */
+- if (txq_number > 1)
++ if (pp->neta_armada3700)
++ cpu = 0;
++ else if (txq_number > 1)
+ cpu = txq->id % num_present_cpus();
+ else
+ cpu = pp->rxq_def % num_present_cpus();
+@@ -4210,6 +4212,11 @@ static int mvneta_cpu_online(unsigned int cpu, struct hlist_node *node)
+ node_online);
+ struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu);
+
++ /* Armada 3700's per-cpu interrupt for mvneta is broken, all interrupts
++ * are routed to CPU 0, so we don't need all the cpu-hotplug support
++ */
++ if (pp->neta_armada3700)
++ return 0;
+
+ spin_lock(&pp->lock);
+ /*
+--
+2.27.0
+
--- /dev/null
+From ee4faa8b4d8bec11be2b003f1aa49db304c9a445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 22:32:52 +0100
+Subject: net: phy: consider that suspend2ram may cut off PHY power
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 4c0d2e96ba055bd8911bb8287def4f8ebbad15b6 ]
+
+Claudiu reported that on his system S2R cuts off power to the PHY and
+after resuming certain PHY settings are lost. The PM folks confirmed
+that cutting off power to selected components in S2R is a valid case.
+Therefore resuming from S2R, same as from hibernation, has to assume
+that the PHY has power-on defaults. As a consequence use the restore
+callback also as resume callback.
+In addition make sure that the interrupt configuration is restored.
+Let's do this in phy_init_hw() and ensure that after this call
+actual interrupt configuration is in sync with phydev->interrupts.
+Currently, if interrupt was enabled before hibernation, we would
+resume with interrupt disabled because that's the power-on default.
+
+This fix applies cleanly only after the commit marked as fixed.
+
+I don't have an affected system, therefore change is compile-tested
+only.
+
+[0] https://lore.kernel.org/netdev/1610120754-14331-1-git-send-email-claudiu.beznea@microchip.com/
+
+Fixes: 611d779af7ca ("net: phy: fix MDIO bus PM PHY resuming")
+Reported-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 53 ++++++++++++------------------------
+ 1 file changed, 17 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 80c2e646c0934..71169e7d6177d 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -300,50 +300,22 @@ static int mdio_bus_phy_resume(struct device *dev)
+
+ phydev->suspended_by_mdio_bus = 0;
+
+- ret = phy_resume(phydev);
++ ret = phy_init_hw(phydev);
+ if (ret < 0)
+ return ret;
+
+-no_resume:
+- if (phydev->attached_dev && phydev->adjust_link)
+- phy_start_machine(phydev);
+-
+- return 0;
+-}
+-
+-static int mdio_bus_phy_restore(struct device *dev)
+-{
+- struct phy_device *phydev = to_phy_device(dev);
+- struct net_device *netdev = phydev->attached_dev;
+- int ret;
+-
+- if (!netdev)
+- return 0;
+-
+- ret = phy_init_hw(phydev);
++ ret = phy_resume(phydev);
+ if (ret < 0)
+ return ret;
+-
++no_resume:
+ if (phydev->attached_dev && phydev->adjust_link)
+ phy_start_machine(phydev);
+
+ return 0;
+ }
+
+-static const struct dev_pm_ops mdio_bus_phy_pm_ops = {
+- .suspend = mdio_bus_phy_suspend,
+- .resume = mdio_bus_phy_resume,
+- .freeze = mdio_bus_phy_suspend,
+- .thaw = mdio_bus_phy_resume,
+- .restore = mdio_bus_phy_restore,
+-};
+-
+-#define MDIO_BUS_PHY_PM_OPS (&mdio_bus_phy_pm_ops)
+-
+-#else
+-
+-#define MDIO_BUS_PHY_PM_OPS NULL
+-
++static SIMPLE_DEV_PM_OPS(mdio_bus_phy_pm_ops, mdio_bus_phy_suspend,
++ mdio_bus_phy_resume);
+ #endif /* CONFIG_PM */
+
+ /**
+@@ -554,7 +526,7 @@ static const struct device_type mdio_bus_phy_type = {
+ .name = "PHY",
+ .groups = phy_dev_groups,
+ .release = phy_device_release,
+- .pm = MDIO_BUS_PHY_PM_OPS,
++ .pm = pm_ptr(&mdio_bus_phy_pm_ops),
+ };
+
+ static int phy_request_driver_module(struct phy_device *dev, u32 phy_id)
+@@ -1143,10 +1115,19 @@ int phy_init_hw(struct phy_device *phydev)
+ if (ret < 0)
+ return ret;
+
+- if (phydev->drv->config_init)
++ if (phydev->drv->config_init) {
+ ret = phydev->drv->config_init(phydev);
++ if (ret < 0)
++ return ret;
++ }
+
+- return ret;
++ if (phydev->drv->config_intr) {
++ ret = phydev->drv->config_intr(phydev);
++ if (ret < 0)
++ return ret;
++ }
++
++ return 0;
+ }
+ EXPORT_SYMBOL(phy_init_hw);
+
+--
+2.27.0
+
--- /dev/null
+From 41ff7ccf226be414d2aa6566f7beb35c5b313590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 21:55:36 +0100
+Subject: net: phy: micrel: set soft_reset callback to genphy_soft_reset for
+ KSZ8081
+
+From: Christian Melki <christian.melki@t2data.com>
+
+[ Upstream commit 764d31cacfe48440745c4bbb55a62ac9471c9f19 ]
+
+Following a similar reinstate for the KSZ9031.
+
+Older kernels would use the genphy_soft_reset if the PHY did not implement
+a .soft_reset.
+
+Bluntly removing that default may expose a lot of situations where various
+PHYs/board implementations won't recover on various changes.
+Like with this implementation during a 4.9.x to 5.4.x LTS transition.
+I think it's a good thing to remove unwanted soft resets but wonder if it
+did open a can of worms?
+
+Atleast this fixes one iMX6 FEC/RMII/8081 combo.
+
+Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
+Signed-off-by: Christian Melki <christian.melki@t2data.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20210224205536.9349-1-christian.melki@t2data.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/micrel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 54e0d75203dac..57f8021b70af5 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -1295,6 +1295,7 @@ static struct phy_driver ksphy_driver[] = {
+ .driver_data = &ksz8081_type,
+ .probe = kszphy_probe,
+ .config_init = ksz8081_config_init,
++ .soft_reset = genphy_soft_reset,
+ .config_intr = kszphy_config_intr,
+ .handle_interrupt = kszphy_handle_interrupt,
+ .get_sset_count = kszphy_get_sset_count,
+--
+2.27.0
+
--- /dev/null
+From d55e3f49501d0ffdffebf59f5e08390f71f76cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 16:29:42 +0100
+Subject: net: phy: mscc: adding LCPLL reset to VSC8514
+
+From: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+
+[ Upstream commit 3cc2c646be0b22037f31c958e96c0544a073d108 ]
+
+At Power-On Reset, transients may cause the LCPLL to lock onto a
+clock that is momentarily unstable. This is normally seen in QSGMII
+setups where the higher speed 6G SerDes is being used.
+This patch adds an initial LCPLL Reset to the PHY (first instance)
+to avoid this issue.
+
+Fixes: e4f9ba642f0b ("net: phy: mscc: add support for VSC8514 PHY.")
+Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
+Signed-off-by: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc/mscc.h | 8 +
+ drivers/net/phy/mscc/mscc_main.c | 350 ++++++++++++++++++++-----------
+ 2 files changed, 236 insertions(+), 122 deletions(-)
+
+diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h
+index 9481bce94c2ed..c2023f93c0b24 100644
+--- a/drivers/net/phy/mscc/mscc.h
++++ b/drivers/net/phy/mscc/mscc.h
+@@ -102,6 +102,7 @@ enum rgmii_clock_delay {
+ #define PHY_MCB_S6G_READ BIT(30)
+
+ #define PHY_S6G_PLL5G_CFG0 0x06
++#define PHY_S6G_PLL5G_CFG2 0x08
+ #define PHY_S6G_LCPLL_CFG 0x11
+ #define PHY_S6G_PLL_CFG 0x2b
+ #define PHY_S6G_COMMON_CFG 0x2c
+@@ -121,6 +122,9 @@ enum rgmii_clock_delay {
+ #define PHY_S6G_PLL_FSM_CTRL_DATA_POS 8
+ #define PHY_S6G_PLL_FSM_ENA_POS 7
+
++#define PHY_S6G_CFG2_FSM_DIS 1
++#define PHY_S6G_CFG2_FSM_CLK_BP 23
++
+ #define MSCC_EXT_PAGE_ACCESS 31
+ #define MSCC_PHY_PAGE_STANDARD 0x0000 /* Standard registers */
+ #define MSCC_PHY_PAGE_EXTENDED 0x0001 /* Extended registers */
+@@ -412,6 +416,10 @@ struct vsc8531_edge_rate_table {
+ };
+ #endif /* CONFIG_OF_MDIO */
+
++enum csr_target {
++ MACRO_CTRL = 0x07,
++};
++
+ #if IS_ENABLED(CONFIG_MACSEC)
+ int vsc8584_macsec_init(struct phy_device *phydev);
+ void vsc8584_handle_macsec_interrupt(struct phy_device *phydev);
+diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
+index 2f2157e3deab5..7830340b9cdc8 100644
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -710,6 +710,113 @@ static int phy_base_read(struct phy_device *phydev, u32 regnum)
+ return __phy_package_read(phydev, regnum);
+ }
+
++static u32 vsc85xx_csr_read(struct phy_device *phydev,
++ enum csr_target target, u32 reg)
++{
++ unsigned long deadline;
++ u32 val, val_l, val_h;
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
++
++ /* CSR registers are grouped under different Target IDs.
++ * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
++ * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
++ * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
++ * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
++ */
++
++ /* Setup the Target ID */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
++ MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
++
++ if ((target >> 2 == 0x1) || (target >> 2 == 0x3))
++ /* non-MACsec access */
++ target &= 0x3;
++ else
++ target = 0;
++
++ /* Trigger CSR Action - Read into the CSR's */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
++ MSCC_PHY_CSR_CNTL_19_CMD | MSCC_PHY_CSR_CNTL_19_READ |
++ MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
++ MSCC_PHY_CSR_CNTL_19_TARGET(target));
++
++ /* Wait for register access*/
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
++ } while (time_before(jiffies, deadline) &&
++ !(val & MSCC_PHY_CSR_CNTL_19_CMD));
++
++ if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
++ return 0xffffffff;
++
++ /* Read the Least Significant Word (LSW) (17) */
++ val_l = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_17);
++
++ /* Read the Most Significant Word (MSW) (18) */
++ val_h = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_18);
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_STANDARD);
++
++ return (val_h << 16) | val_l;
++}
++
++static int vsc85xx_csr_write(struct phy_device *phydev,
++ enum csr_target target, u32 reg, u32 val)
++{
++ unsigned long deadline;
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
++
++ /* CSR registers are grouped under different Target IDs.
++ * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
++ * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
++ * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
++ * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
++ */
++
++ /* Setup the Target ID */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
++ MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
++
++ /* Write the Least Significant Word (LSW) (17) */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_17, (u16)val);
++
++ /* Write the Most Significant Word (MSW) (18) */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_18, (u16)(val >> 16));
++
++ if ((target >> 2 == 0x1) || (target >> 2 == 0x3))
++ /* non-MACsec access */
++ target &= 0x3;
++ else
++ target = 0;
++
++ /* Trigger CSR Action - Write into the CSR's */
++ phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
++ MSCC_PHY_CSR_CNTL_19_CMD |
++ MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
++ MSCC_PHY_CSR_CNTL_19_TARGET(target));
++
++ /* Wait for register access */
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
++ } while (time_before(jiffies, deadline) &&
++ !(val & MSCC_PHY_CSR_CNTL_19_CMD));
++
++ if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
++ return -ETIMEDOUT;
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_STANDARD);
++
++ return 0;
++}
++
+ /* bus->mdio_lock should be locked when using this function */
+ static void vsc8584_csr_write(struct phy_device *phydev, u16 addr, u32 val)
+ {
+@@ -1131,6 +1238,92 @@ out:
+ return ret;
+ }
+
++/* Access LCPLL Cfg_2 */
++static void vsc8584_pll5g_cfg2_wr(struct phy_device *phydev,
++ bool disable_fsm)
++{
++ u32 rd_dat;
++
++ rd_dat = vsc85xx_csr_read(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2);
++ rd_dat &= ~BIT(PHY_S6G_CFG2_FSM_DIS);
++ rd_dat |= (disable_fsm << PHY_S6G_CFG2_FSM_DIS);
++ vsc85xx_csr_write(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2, rd_dat);
++}
++
++/* trigger a read to the spcified MCB */
++static int vsc8584_mcb_rd_trig(struct phy_device *phydev,
++ u32 mcb_reg_addr, u8 mcb_slave_num)
++{
++ u32 rd_dat = 0;
++
++ /* read MCB */
++ vsc85xx_csr_write(phydev, MACRO_CTRL, mcb_reg_addr,
++ (0x40000000 | (1L << mcb_slave_num)));
++
++ return read_poll_timeout(vsc85xx_csr_read, rd_dat,
++ !(rd_dat & 0x40000000),
++ 4000, 200000, 0,
++ phydev, MACRO_CTRL, mcb_reg_addr);
++}
++
++/* trigger a write to the spcified MCB */
++static int vsc8584_mcb_wr_trig(struct phy_device *phydev,
++ u32 mcb_reg_addr,
++ u8 mcb_slave_num)
++{
++ u32 rd_dat = 0;
++
++ /* write back MCB */
++ vsc85xx_csr_write(phydev, MACRO_CTRL, mcb_reg_addr,
++ (0x80000000 | (1L << mcb_slave_num)));
++
++ return read_poll_timeout(vsc85xx_csr_read, rd_dat,
++ !(rd_dat & 0x80000000),
++ 4000, 200000, 0,
++ phydev, MACRO_CTRL, mcb_reg_addr);
++}
++
++/* Sequence to Reset LCPLL for the VIPER and ELISE PHY */
++static int vsc8584_pll5g_reset(struct phy_device *phydev)
++{
++ bool dis_fsm;
++ int ret = 0;
++
++ ret = vsc8584_mcb_rd_trig(phydev, 0x11, 0);
++ if (ret < 0)
++ goto done;
++ dis_fsm = 1;
++
++ /* Reset LCPLL */
++ vsc8584_pll5g_cfg2_wr(phydev, dis_fsm);
++
++ /* write back LCPLL MCB */
++ ret = vsc8584_mcb_wr_trig(phydev, 0x11, 0);
++ if (ret < 0)
++ goto done;
++
++ /* 10 mSec sleep while LCPLL is hold in reset */
++ usleep_range(10000, 20000);
++
++ /* read LCPLL MCB into CSRs */
++ ret = vsc8584_mcb_rd_trig(phydev, 0x11, 0);
++ if (ret < 0)
++ goto done;
++ dis_fsm = 0;
++
++ /* Release the Reset of LCPLL */
++ vsc8584_pll5g_cfg2_wr(phydev, dis_fsm);
++
++ /* write back LCPLL MCB */
++ ret = vsc8584_mcb_wr_trig(phydev, 0x11, 0);
++ if (ret < 0)
++ goto done;
++
++ usleep_range(110000, 200000);
++done:
++ return ret;
++}
++
+ /* bus->mdio_lock should be locked when using this function */
+ static int vsc8584_config_pre_init(struct phy_device *phydev)
+ {
+@@ -1569,8 +1762,16 @@ static int vsc8514_config_pre_init(struct phy_device *phydev)
+ {0x16b2, 0x00007000},
+ {0x16b4, 0x00000814},
+ };
++ struct device *dev = &phydev->mdio.dev;
+ unsigned int i;
+ u16 reg;
++ int ret;
++
++ ret = vsc8584_pll5g_reset(phydev);
++ if (ret < 0) {
++ dev_err(dev, "failed LCPLL reset, ret: %d\n", ret);
++ return ret;
++ }
+
+ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_STANDARD);
+
+@@ -1605,101 +1806,6 @@ static int vsc8514_config_pre_init(struct phy_device *phydev)
+ return 0;
+ }
+
+-static u32 vsc85xx_csr_ctrl_phy_read(struct phy_device *phydev,
+- u32 target, u32 reg)
+-{
+- unsigned long deadline;
+- u32 val, val_l, val_h;
+-
+- phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
+-
+- /* CSR registers are grouped under different Target IDs.
+- * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
+- * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
+- * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
+- * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
+- */
+-
+- /* Setup the Target ID */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
+- MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
+-
+- /* Trigger CSR Action - Read into the CSR's */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
+- MSCC_PHY_CSR_CNTL_19_CMD | MSCC_PHY_CSR_CNTL_19_READ |
+- MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
+- MSCC_PHY_CSR_CNTL_19_TARGET(target & 0x3));
+-
+- /* Wait for register access*/
+- deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+- do {
+- usleep_range(500, 1000);
+- val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
+- } while (time_before(jiffies, deadline) &&
+- !(val & MSCC_PHY_CSR_CNTL_19_CMD));
+-
+- if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
+- return 0xffffffff;
+-
+- /* Read the Least Significant Word (LSW) (17) */
+- val_l = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_17);
+-
+- /* Read the Most Significant Word (MSW) (18) */
+- val_h = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_18);
+-
+- phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+- MSCC_PHY_PAGE_STANDARD);
+-
+- return (val_h << 16) | val_l;
+-}
+-
+-static int vsc85xx_csr_ctrl_phy_write(struct phy_device *phydev,
+- u32 target, u32 reg, u32 val)
+-{
+- unsigned long deadline;
+-
+- phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_CSR_CNTL);
+-
+- /* CSR registers are grouped under different Target IDs.
+- * 6-bit Target_ID is split between MSCC_EXT_PAGE_CSR_CNTL_20 and
+- * MSCC_EXT_PAGE_CSR_CNTL_19 registers.
+- * Target_ID[5:2] maps to bits[3:0] of MSCC_EXT_PAGE_CSR_CNTL_20
+- * and Target_ID[1:0] maps to bits[13:12] of MSCC_EXT_PAGE_CSR_CNTL_19.
+- */
+-
+- /* Setup the Target ID */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_20,
+- MSCC_PHY_CSR_CNTL_20_TARGET(target >> 2));
+-
+- /* Write the Least Significant Word (LSW) (17) */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_17, (u16)val);
+-
+- /* Write the Most Significant Word (MSW) (18) */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_18, (u16)(val >> 16));
+-
+- /* Trigger CSR Action - Write into the CSR's */
+- phy_base_write(phydev, MSCC_EXT_PAGE_CSR_CNTL_19,
+- MSCC_PHY_CSR_CNTL_19_CMD |
+- MSCC_PHY_CSR_CNTL_19_REG_ADDR(reg) |
+- MSCC_PHY_CSR_CNTL_19_TARGET(target & 0x3));
+-
+- /* Wait for register access */
+- deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+- do {
+- usleep_range(500, 1000);
+- val = phy_base_read(phydev, MSCC_EXT_PAGE_CSR_CNTL_19);
+- } while (time_before(jiffies, deadline) &&
+- !(val & MSCC_PHY_CSR_CNTL_19_CMD));
+-
+- if (!(val & MSCC_PHY_CSR_CNTL_19_CMD))
+- return -ETIMEDOUT;
+-
+- phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+- MSCC_PHY_PAGE_STANDARD);
+-
+- return 0;
+-}
+-
+ static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
+ u32 op)
+ {
+@@ -1707,15 +1813,15 @@ static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
+ u32 val;
+ int ret;
+
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET, reg,
+- op | (1 << mcb));
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET, reg,
++ op | (1 << mcb));
+ if (ret)
+ return -EINVAL;
+
+ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+ do {
+ usleep_range(500, 1000);
+- val = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET, reg);
++ val = vsc85xx_csr_read(phydev, PHY_MCB_TARGET, reg);
+
+ if (val == 0xffffffff)
+ return -EIO;
+@@ -1796,41 +1902,41 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ /* lcpll mcb */
+ phy_update_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
+ /* pll5gcfg0 */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL5G_CFG0, 0x7036f145);
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_PLL5G_CFG0, 0x7036f145);
+ if (ret)
+ goto err;
+
+ phy_commit_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
+ /* pllcfg */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL_CFG,
+- (3 << PHY_S6G_PLL_ENA_OFFS_POS) |
+- (120 << PHY_S6G_PLL_FSM_CTRL_DATA_POS)
+- | (0 << PHY_S6G_PLL_FSM_ENA_POS));
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_PLL_CFG,
++ (3 << PHY_S6G_PLL_ENA_OFFS_POS) |
++ (120 << PHY_S6G_PLL_FSM_CTRL_DATA_POS)
++ | (0 << PHY_S6G_PLL_FSM_ENA_POS));
+ if (ret)
+ goto err;
+
+ /* commoncfg */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_COMMON_CFG,
+- (0 << PHY_S6G_SYS_RST_POS) |
+- (0 << PHY_S6G_ENA_LANE_POS) |
+- (0 << PHY_S6G_ENA_LOOP_POS) |
+- (0 << PHY_S6G_QRATE_POS) |
+- (3 << PHY_S6G_IF_MODE_POS));
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_COMMON_CFG,
++ (0 << PHY_S6G_SYS_RST_POS) |
++ (0 << PHY_S6G_ENA_LANE_POS) |
++ (0 << PHY_S6G_ENA_LOOP_POS) |
++ (0 << PHY_S6G_QRATE_POS) |
++ (3 << PHY_S6G_IF_MODE_POS));
+ if (ret)
+ goto err;
+
+ /* misccfg */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_MISC_CFG, 1);
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_MISC_CFG, 1);
+ if (ret)
+ goto err;
+
+ /* gpcfg */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_GPC_CFG, 768);
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_GPC_CFG, 768);
+ if (ret)
+ goto err;
+
+@@ -1841,8 +1947,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ usleep_range(500, 1000);
+ phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
+ 0); /* read 6G MCB into CSRs */
+- reg = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL_STATUS);
++ reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
++ PHY_S6G_PLL_STATUS);
+ if (reg == 0xffffffff) {
+ phy_unlock_mdio_bus(phydev);
+ return -EIO;
+@@ -1856,8 +1962,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ }
+
+ /* misccfg */
+- ret = vsc85xx_csr_ctrl_phy_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_MISC_CFG, 0);
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
++ PHY_S6G_MISC_CFG, 0);
+ if (ret)
+ goto err;
+
+@@ -1868,8 +1974,8 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ usleep_range(500, 1000);
+ phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
+ 0); /* read 6G MCB into CSRs */
+- reg = vsc85xx_csr_ctrl_phy_read(phydev, PHY_MCB_TARGET,
+- PHY_S6G_IB_STATUS0);
++ reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
++ PHY_S6G_IB_STATUS0);
+ if (reg == 0xffffffff) {
+ phy_unlock_mdio_bus(phydev);
+ return -EIO;
+--
+2.27.0
+
--- /dev/null
+From 894e87a0d9b769eda188a36c12c06e0fa651c3d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 16:29:44 +0100
+Subject: net: phy: mscc: coma mode disabled for VSC8514
+
+From: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+
+[ Upstream commit ca0d7fd0a58dfc9503775dae7daee341c115e0c7 ]
+
+The 'coma mode' (configurable through sw or hw) provides an
+optional feature that may be used to control when the PHYs become active.
+The typical usage is to synchronize the link-up time across
+all PHY instances. This patch releases coma mode if not done by hardware,
+otherwise the phys will not link-up.
+
+Fixes: e4f9ba642f0b ("net: phy: mscc: add support for VSC8514 PHY.")
+Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
+Signed-off-by: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc/mscc.h | 4 ++++
+ drivers/net/phy/mscc/mscc_main.c | 16 ++++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h
+index 2028c319f14dd..a50235fdf7d99 100644
+--- a/drivers/net/phy/mscc/mscc.h
++++ b/drivers/net/phy/mscc/mscc.h
+@@ -140,6 +140,10 @@ enum rgmii_clock_delay {
+ #define MSCC_PHY_PAGE_1588 0x1588 /* PTP (1588) */
+ #define MSCC_PHY_PAGE_TEST 0x2a30 /* Test reg */
+ #define MSCC_PHY_PAGE_TR 0x52b5 /* Token ring registers */
++#define MSCC_PHY_GPIO_CONTROL_2 14
++
++#define MSCC_PHY_COMA_MODE 0x2000 /* input(1) / output(0) */
++#define MSCC_PHY_COMA_OUTPUT 0x1000 /* value to output */
+
+ /* Extended Page 1 Registers */
+ #define MSCC_PHY_CU_MEDIA_CRC_VALID_CNT 18
+diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
+index 0e6e7076a740e..3a7705228ed59 100644
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -1516,6 +1516,21 @@ static void vsc8584_get_base_addr(struct phy_device *phydev)
+ vsc8531->addr = addr;
+ }
+
++static void vsc85xx_coma_mode_release(struct phy_device *phydev)
++{
++ /* The coma mode (pin or reg) provides an optional feature that
++ * may be used to control when the PHYs become active.
++ * Alternatively the COMA_MODE pin may be connected low
++ * so that the PHYs are fully active once out of reset.
++ */
++
++ /* Enable output (mode=0) and write zero to it */
++ vsc85xx_phy_write_page(phydev, MSCC_PHY_PAGE_EXTENDED_GPIO);
++ __phy_modify(phydev, MSCC_PHY_GPIO_CONTROL_2,
++ MSCC_PHY_COMA_MODE | MSCC_PHY_COMA_OUTPUT, 0);
++ vsc85xx_phy_write_page(phydev, MSCC_PHY_PAGE_STANDARD);
++}
++
+ static int vsc8584_config_init(struct phy_device *phydev)
+ {
+ struct vsc8531_private *vsc8531 = phydev->priv;
+@@ -1962,6 +1977,7 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ ret = vsc8514_config_host_serdes(phydev);
+ if (ret)
+ goto err;
++ vsc85xx_coma_mode_release(phydev);
+ }
+
+ phy_unlock_mdio_bus(phydev);
+--
+2.27.0
+
--- /dev/null
+From 8659f381b06f01051d32126e21a299fd9e218ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 16:29:43 +0100
+Subject: net: phy: mscc: improved serdes calibration applied to VSC8514
+
+From: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+
+[ Upstream commit 85e97f0b984eb36cba0ecaf87c66a9f7445d73dc ]
+
+The current IB serdes calibration algorithm (performed by the onboard 8051)
+has proven to be unstable for the VSC8514 QSGMII phy.
+A new algorithm has been developed based on
+'Frequency-offset Jittered-Injection' or 'FoJi' method which solves
+all known issues. This patch disables the 8051 algorithm and
+replaces it with the new FoJi algorithm.
+The calibration is now performed in a new file (mscc_serdes.c),
+which can act as an placeholder for future serdes configurations.
+
+Fixes: e4f9ba642f0b ("net: phy: mscc: add support for VSC8514 PHY.")
+Signed-off-by: Steen Hegelund <steen.hegelund@microchip.com>
+Signed-off-by: Bjarni Jonasson <bjarni.jonasson@microchip.com>
+Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc/Makefile | 1 +
+ drivers/net/phy/mscc/mscc.h | 16 +
+ drivers/net/phy/mscc/mscc_main.c | 308 +++++++-------
+ drivers/net/phy/mscc/mscc_serdes.c | 650 +++++++++++++++++++++++++++++
+ drivers/net/phy/mscc/mscc_serdes.h | 31 ++
+ 5 files changed, 840 insertions(+), 166 deletions(-)
+ create mode 100644 drivers/net/phy/mscc/mscc_serdes.c
+ create mode 100644 drivers/net/phy/mscc/mscc_serdes.h
+
+diff --git a/drivers/net/phy/mscc/Makefile b/drivers/net/phy/mscc/Makefile
+index d8e22a4eeeffa..78d84194f79ae 100644
+--- a/drivers/net/phy/mscc/Makefile
++++ b/drivers/net/phy/mscc/Makefile
+@@ -4,6 +4,7 @@
+
+ obj-$(CONFIG_MICROSEMI_PHY) := mscc.o
+ mscc-objs := mscc_main.o
++mscc-objs += mscc_serdes.o
+
+ ifdef CONFIG_MACSEC
+ mscc-objs += mscc_macsec.o
+diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h
+index c2023f93c0b24..2028c319f14dd 100644
+--- a/drivers/net/phy/mscc/mscc.h
++++ b/drivers/net/phy/mscc/mscc.h
+@@ -339,6 +339,10 @@ enum rgmii_clock_delay {
+ #define VSC8584_REVB 0x0001
+ #define MSCC_DEV_REV_MASK GENMASK(3, 0)
+
++#define MSCC_ROM_TRAP_SERDES_6G_CFG 0x1E48
++#define MSCC_RAM_TRAP_SERDES_6G_CFG 0x1E4F
++#define PATCH_VEC_ZERO_EN 0x0100
++
+ struct reg_val {
+ u16 reg;
+ u32 val;
+@@ -420,6 +424,18 @@ enum csr_target {
+ MACRO_CTRL = 0x07,
+ };
+
++u32 vsc85xx_csr_read(struct phy_device *phydev,
++ enum csr_target target, u32 reg);
++
++int vsc85xx_csr_write(struct phy_device *phydev,
++ enum csr_target target, u32 reg, u32 val);
++
++int phy_base_write(struct phy_device *phydev, u32 regnum, u16 val);
++int phy_base_read(struct phy_device *phydev, u32 regnum);
++int phy_update_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb);
++int phy_commit_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb);
++int vsc8584_cmd(struct phy_device *phydev, u16 val);
++
+ #if IS_ENABLED(CONFIG_MACSEC)
+ int vsc8584_macsec_init(struct phy_device *phydev);
+ void vsc8584_handle_macsec_interrupt(struct phy_device *phydev);
+diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
+index 7830340b9cdc8..0e6e7076a740e 100644
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -17,7 +17,7 @@
+ #include <linux/of.h>
+ #include <linux/netdevice.h>
+ #include <dt-bindings/net/mscc-phy-vsc8531.h>
+-
++#include "mscc_serdes.h"
+ #include "mscc.h"
+
+ static const struct vsc85xx_hw_stat vsc85xx_hw_stats[] = {
+@@ -689,7 +689,7 @@ out_unlock:
+ }
+
+ /* phydev->bus->mdio_lock should be locked when using this function */
+-static int phy_base_write(struct phy_device *phydev, u32 regnum, u16 val)
++int phy_base_write(struct phy_device *phydev, u32 regnum, u16 val)
+ {
+ if (unlikely(!mutex_is_locked(&phydev->mdio.bus->mdio_lock))) {
+ dev_err(&phydev->mdio.dev, "MDIO bus lock not held!\n");
+@@ -700,7 +700,7 @@ static int phy_base_write(struct phy_device *phydev, u32 regnum, u16 val)
+ }
+
+ /* phydev->bus->mdio_lock should be locked when using this function */
+-static int phy_base_read(struct phy_device *phydev, u32 regnum)
++int phy_base_read(struct phy_device *phydev, u32 regnum)
+ {
+ if (unlikely(!mutex_is_locked(&phydev->mdio.bus->mdio_lock))) {
+ dev_err(&phydev->mdio.dev, "MDIO bus lock not held!\n");
+@@ -710,8 +710,8 @@ static int phy_base_read(struct phy_device *phydev, u32 regnum)
+ return __phy_package_read(phydev, regnum);
+ }
+
+-static u32 vsc85xx_csr_read(struct phy_device *phydev,
+- enum csr_target target, u32 reg)
++u32 vsc85xx_csr_read(struct phy_device *phydev,
++ enum csr_target target, u32 reg)
+ {
+ unsigned long deadline;
+ u32 val, val_l, val_h;
+@@ -764,8 +764,8 @@ static u32 vsc85xx_csr_read(struct phy_device *phydev,
+ return (val_h << 16) | val_l;
+ }
+
+-static int vsc85xx_csr_write(struct phy_device *phydev,
+- enum csr_target target, u32 reg, u32 val)
++int vsc85xx_csr_write(struct phy_device *phydev,
++ enum csr_target target, u32 reg, u32 val)
+ {
+ unsigned long deadline;
+
+@@ -826,7 +826,7 @@ static void vsc8584_csr_write(struct phy_device *phydev, u16 addr, u32 val)
+ }
+
+ /* bus->mdio_lock should be locked when using this function */
+-static int vsc8584_cmd(struct phy_device *phydev, u16 val)
++int vsc8584_cmd(struct phy_device *phydev, u16 val)
+ {
+ unsigned long deadline;
+ u16 reg_val;
+@@ -1734,6 +1734,100 @@ static int vsc85xx_config_init(struct phy_device *phydev)
+ return 0;
+ }
+
++static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
++ u32 op)
++{
++ unsigned long deadline;
++ u32 val;
++ int ret;
++
++ ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET, reg,
++ op | (1 << mcb));
++ if (ret)
++ return -EINVAL;
++
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ val = vsc85xx_csr_read(phydev, PHY_MCB_TARGET, reg);
++
++ if (val == 0xffffffff)
++ return -EIO;
++
++ } while (time_before(jiffies, deadline) && (val & op));
++
++ if (val & op)
++ return -ETIMEDOUT;
++
++ return 0;
++}
++
++/* Trigger a read to the specified MCB */
++int phy_update_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb)
++{
++ return __phy_write_mcb_s6g(phydev, reg, mcb, PHY_MCB_S6G_READ);
++}
++
++/* Trigger a write to the specified MCB */
++int phy_commit_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb)
++{
++ return __phy_write_mcb_s6g(phydev, reg, mcb, PHY_MCB_S6G_WRITE);
++}
++
++static int vsc8514_config_host_serdes(struct phy_device *phydev)
++{
++ int ret;
++ u16 val;
++
++ ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_EXTENDED_GPIO);
++ if (ret)
++ return ret;
++
++ val = phy_base_read(phydev, MSCC_PHY_MAC_CFG_FASTLINK);
++ val &= ~MAC_CFG_MASK;
++ val |= MAC_CFG_QSGMII;
++ ret = phy_base_write(phydev, MSCC_PHY_MAC_CFG_FASTLINK, val);
++ if (ret)
++ return ret;
++
++ ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_STANDARD);
++ if (ret)
++ return ret;
++
++ ret = vsc8584_cmd(phydev, PROC_CMD_NOP);
++ if (ret)
++ return ret;
++
++ ret = vsc8584_cmd(phydev,
++ PROC_CMD_MCB_ACCESS_MAC_CONF |
++ PROC_CMD_RST_CONF_PORT |
++ PROC_CMD_READ_MOD_WRITE_PORT | PROC_CMD_QSGMII_MAC);
++ if (ret) {
++ dev_err(&phydev->mdio.dev, "%s: QSGMII error: %d\n",
++ __func__, ret);
++ return ret;
++ }
++
++ /* Apply 6G SerDes FOJI Algorithm
++ * Initial condition requirement:
++ * 1. hold 8051 in reset
++ * 2. disable patch vector 0, in order to allow IB cal poll during FoJi
++ * 3. deassert 8051 reset after change patch vector status
++ * 4. proceed with FoJi (vsc85xx_sd6g_config_v2)
++ */
++ vsc8584_micro_assert_reset(phydev);
++ val = phy_base_read(phydev, MSCC_INT_MEM_CNTL);
++ /* clear bit 8, to disable patch vector 0 */
++ val &= ~PATCH_VEC_ZERO_EN;
++ ret = phy_base_write(phydev, MSCC_INT_MEM_CNTL, val);
++ /* Enable 8051 clock, don't set patch present, disable PRAM clock override */
++ vsc8584_micro_deassert_reset(phydev, false);
++
++ return vsc85xx_sd6g_config_v2(phydev);
++}
++
+ static int vsc8514_config_pre_init(struct phy_device *phydev)
+ {
+ /* These are the settings to override the silicon default
+@@ -1803,56 +1897,48 @@ static int vsc8514_config_pre_init(struct phy_device *phydev)
+ reg &= ~SMI_BROADCAST_WR_EN;
+ phy_base_write(phydev, MSCC_PHY_EXT_CNTL_STATUS, reg);
+
+- return 0;
+-}
+-
+-static int __phy_write_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb,
+- u32 op)
+-{
+- unsigned long deadline;
+- u32 val;
+- int ret;
++ /* Add pre-patching commands to:
++ * 1. enable 8051 clock, operate 8051 clock at 125 MHz
++ * instead of HW default 62.5MHz
++ * 2. write patch vector 0, to skip IB cal polling executed
++ * as part of the 0x80E0 ROM command
++ */
++ vsc8584_micro_deassert_reset(phydev, false);
+
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET, reg,
+- op | (1 << mcb));
++ vsc8584_micro_assert_reset(phydev);
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
++ MSCC_PHY_PAGE_EXTENDED_GPIO);
++ /* ROM address to trap, for patch vector 0 */
++ reg = MSCC_ROM_TRAP_SERDES_6G_CFG;
++ ret = phy_base_write(phydev, MSCC_TRAP_ROM_ADDR(1), reg);
+ if (ret)
+- return -EINVAL;
+-
+- deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+- do {
+- usleep_range(500, 1000);
+- val = vsc85xx_csr_read(phydev, PHY_MCB_TARGET, reg);
+-
+- if (val == 0xffffffff)
+- return -EIO;
+-
+- } while (time_before(jiffies, deadline) && (val & op));
+-
+- if (val & op)
+- return -ETIMEDOUT;
+-
+- return 0;
+-}
+-
+-/* Trigger a read to the specified MCB */
+-static int phy_update_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb)
+-{
+- return __phy_write_mcb_s6g(phydev, reg, mcb, PHY_MCB_S6G_READ);
+-}
++ goto err;
++ /* RAM address to jump to, when patch vector 0 enabled */
++ reg = MSCC_RAM_TRAP_SERDES_6G_CFG;
++ ret = phy_base_write(phydev, MSCC_PATCH_RAM_ADDR(1), reg);
++ if (ret)
++ goto err;
++ reg = phy_base_read(phydev, MSCC_INT_MEM_CNTL);
++ reg |= PATCH_VEC_ZERO_EN; /* bit 8, enable patch vector 0 */
++ ret = phy_base_write(phydev, MSCC_INT_MEM_CNTL, reg);
++ if (ret)
++ goto err;
+
+-/* Trigger a write to the specified MCB */
+-static int phy_commit_mcb_s6g(struct phy_device *phydev, u32 reg, u8 mcb)
+-{
+- return __phy_write_mcb_s6g(phydev, reg, mcb, PHY_MCB_S6G_WRITE);
++ /* Enable 8051 clock, don't set patch present
++ * yet, disable PRAM clock override
++ */
++ vsc8584_micro_deassert_reset(phydev, false);
++ return ret;
++ err:
++ /* restore 8051 and bail w error */
++ vsc8584_micro_deassert_reset(phydev, false);
++ return ret;
+ }
+
+ static int vsc8514_config_init(struct phy_device *phydev)
+ {
+ struct vsc8531_private *vsc8531 = phydev->priv;
+- unsigned long deadline;
+ int ret, i;
+- u16 val;
+- u32 reg;
+
+ phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
+
+@@ -1869,123 +1955,13 @@ static int vsc8514_config_init(struct phy_device *phydev)
+ * do the correct init sequence for all PHYs that are package-critical
+ * in this pre-init function.
+ */
+- if (phy_package_init_once(phydev))
+- vsc8514_config_pre_init(phydev);
+-
+- ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+- MSCC_PHY_PAGE_EXTENDED_GPIO);
+- if (ret)
+- goto err;
+-
+- val = phy_base_read(phydev, MSCC_PHY_MAC_CFG_FASTLINK);
+-
+- val &= ~MAC_CFG_MASK;
+- val |= MAC_CFG_QSGMII;
+- ret = phy_base_write(phydev, MSCC_PHY_MAC_CFG_FASTLINK, val);
+- if (ret)
+- goto err;
+-
+- ret = phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS,
+- MSCC_PHY_PAGE_STANDARD);
+- if (ret)
+- goto err;
+-
+- ret = vsc8584_cmd(phydev,
+- PROC_CMD_MCB_ACCESS_MAC_CONF |
+- PROC_CMD_RST_CONF_PORT |
+- PROC_CMD_READ_MOD_WRITE_PORT | PROC_CMD_QSGMII_MAC);
+- if (ret)
+- goto err;
+-
+- /* 6g mcb */
+- phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
+- /* lcpll mcb */
+- phy_update_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
+- /* pll5gcfg0 */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL5G_CFG0, 0x7036f145);
+- if (ret)
+- goto err;
+-
+- phy_commit_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
+- /* pllcfg */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL_CFG,
+- (3 << PHY_S6G_PLL_ENA_OFFS_POS) |
+- (120 << PHY_S6G_PLL_FSM_CTRL_DATA_POS)
+- | (0 << PHY_S6G_PLL_FSM_ENA_POS));
+- if (ret)
+- goto err;
+-
+- /* commoncfg */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_COMMON_CFG,
+- (0 << PHY_S6G_SYS_RST_POS) |
+- (0 << PHY_S6G_ENA_LANE_POS) |
+- (0 << PHY_S6G_ENA_LOOP_POS) |
+- (0 << PHY_S6G_QRATE_POS) |
+- (3 << PHY_S6G_IF_MODE_POS));
+- if (ret)
+- goto err;
+-
+- /* misccfg */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_MISC_CFG, 1);
+- if (ret)
+- goto err;
+-
+- /* gpcfg */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_GPC_CFG, 768);
+- if (ret)
+- goto err;
+-
+- phy_commit_mcb_s6g(phydev, PHY_S6G_DFT_CFG2, 0);
+-
+- deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+- do {
+- usleep_range(500, 1000);
+- phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
+- 0); /* read 6G MCB into CSRs */
+- reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
+- PHY_S6G_PLL_STATUS);
+- if (reg == 0xffffffff) {
+- phy_unlock_mdio_bus(phydev);
+- return -EIO;
+- }
+-
+- } while (time_before(jiffies, deadline) && (reg & BIT(12)));
+-
+- if (reg & BIT(12)) {
+- phy_unlock_mdio_bus(phydev);
+- return -ETIMEDOUT;
+- }
+-
+- /* misccfg */
+- ret = vsc85xx_csr_write(phydev, PHY_MCB_TARGET,
+- PHY_S6G_MISC_CFG, 0);
+- if (ret)
+- goto err;
+-
+- phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
+-
+- deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
+- do {
+- usleep_range(500, 1000);
+- phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG,
+- 0); /* read 6G MCB into CSRs */
+- reg = vsc85xx_csr_read(phydev, PHY_MCB_TARGET,
+- PHY_S6G_IB_STATUS0);
+- if (reg == 0xffffffff) {
+- phy_unlock_mdio_bus(phydev);
+- return -EIO;
+- }
+-
+- } while (time_before(jiffies, deadline) && !(reg & BIT(8)));
+-
+- if (!(reg & BIT(8))) {
+- phy_unlock_mdio_bus(phydev);
+- return -ETIMEDOUT;
++ if (phy_package_init_once(phydev)) {
++ ret = vsc8514_config_pre_init(phydev);
++ if (ret)
++ goto err;
++ ret = vsc8514_config_host_serdes(phydev);
++ if (ret)
++ goto err;
+ }
+
+ phy_unlock_mdio_bus(phydev);
+diff --git a/drivers/net/phy/mscc/mscc_serdes.c b/drivers/net/phy/mscc/mscc_serdes.c
+new file mode 100644
+index 0000000000000..b3e854f53d675
+--- /dev/null
++++ b/drivers/net/phy/mscc/mscc_serdes.c
+@@ -0,0 +1,650 @@
++// SPDX-License-Identifier: (GPL-2.0 OR MIT)
++/*
++ * Driver for Microsemi VSC85xx PHYs
++ *
++ * Author: Bjarni Jonasson <bjarni.jonassoni@microchip.com>
++ * License: Dual MIT/GPL
++ * Copyright (c) 2021 Microsemi Corporation
++ */
++
++#include <linux/phy.h>
++#include "mscc_serdes.h"
++#include "mscc.h"
++
++static int pll5g_detune(struct phy_device *phydev)
++{
++ u32 rd_dat;
++ int ret;
++
++ rd_dat = vsc85xx_csr_read(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2);
++ rd_dat &= ~PHY_S6G_PLL5G_CFG2_GAIN_MASK;
++ rd_dat |= PHY_S6G_PLL5G_CFG2_ENA_GAIN;
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_PLL5G_CFG2, rd_dat);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int pll5g_tune(struct phy_device *phydev)
++{
++ u32 rd_dat;
++ int ret;
++
++ rd_dat = vsc85xx_csr_read(phydev, MACRO_CTRL, PHY_S6G_PLL5G_CFG2);
++ rd_dat &= ~PHY_S6G_PLL5G_CFG2_ENA_GAIN;
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_PLL5G_CFG2, rd_dat);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_pll_cfg_wr(struct phy_device *phydev,
++ const u32 pll_ena_offs,
++ const u32 pll_fsm_ctrl_data,
++ const u32 pll_fsm_ena)
++{
++ int ret;
++
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_PLL_CFG,
++ (pll_fsm_ena << PHY_S6G_PLL_ENA_OFFS_POS) |
++ (pll_fsm_ctrl_data << PHY_S6G_PLL_FSM_CTRL_DATA_POS) |
++ (pll_ena_offs << PHY_S6G_PLL_FSM_ENA_POS));
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_common_cfg_wr(struct phy_device *phydev,
++ const u32 sys_rst,
++ const u32 ena_lane,
++ const u32 ena_loop,
++ const u32 qrate,
++ const u32 if_mode,
++ const u32 pwd_tx)
++{
++ /* ena_loop = 8 for eloop */
++ /* = 4 for floop */
++ /* = 2 for iloop */
++ /* = 1 for ploop */
++ /* qrate = 1 for SGMII, 0 for QSGMII */
++ /* if_mode = 1 for SGMII, 3 for QSGMII */
++
++ int ret;
++
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_COMMON_CFG,
++ (sys_rst << PHY_S6G_SYS_RST_POS) |
++ (ena_lane << PHY_S6G_ENA_LANE_POS) |
++ (ena_loop << PHY_S6G_ENA_LOOP_POS) |
++ (qrate << PHY_S6G_QRATE_POS) |
++ (if_mode << PHY_S6G_IF_MODE_POS));
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_des_cfg_wr(struct phy_device *phydev,
++ const u32 des_phy_ctrl,
++ const u32 des_mbtr_ctrl,
++ const u32 des_bw_hyst,
++ const u32 des_bw_ana,
++ const u32 des_cpmd_sel)
++{
++ u32 reg_val;
++ int ret;
++
++ /* configurable terms */
++ reg_val = (des_phy_ctrl << PHY_S6G_DES_PHY_CTRL_POS) |
++ (des_mbtr_ctrl << PHY_S6G_DES_MBTR_CTRL_POS) |
++ (des_cpmd_sel << PHY_S6G_DES_CPMD_SEL_POS) |
++ (des_bw_hyst << PHY_S6G_DES_BW_HYST_POS) |
++ (des_bw_ana << PHY_S6G_DES_BW_ANA_POS);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_DES_CFG,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_ib_cfg0_wr(struct phy_device *phydev,
++ const u32 ib_rtrm_adj,
++ const u32 ib_sig_det_clk_sel,
++ const u32 ib_reg_pat_sel_offset,
++ const u32 ib_cal_ena)
++{
++ u32 base_val;
++ u32 reg_val;
++ int ret;
++
++ /* constant terms */
++ base_val = 0x60a85837;
++ /* configurable terms */
++ reg_val = base_val | (ib_rtrm_adj << 25) |
++ (ib_sig_det_clk_sel << 16) |
++ (ib_reg_pat_sel_offset << 8) |
++ (ib_cal_ena << 3);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_CFG0,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_ib_cfg1_wr(struct phy_device *phydev,
++ const u32 ib_tjtag,
++ const u32 ib_tsdet,
++ const u32 ib_scaly,
++ const u32 ib_frc_offset,
++ const u32 ib_filt_offset)
++{
++ u32 ib_filt_val;
++ u32 reg_val = 0;
++ int ret;
++
++ /* constant terms */
++ ib_filt_val = 0xe0;
++ /* configurable terms */
++ reg_val = (ib_tjtag << 17) + (ib_tsdet << 12) + (ib_scaly << 8) +
++ ib_filt_val + (ib_filt_offset << 4) + (ib_frc_offset << 0);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_CFG1,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_ib_cfg2_wr(struct phy_device *phydev,
++ const u32 ib_tinfv,
++ const u32 ib_tcalv,
++ const u32 ib_ureg)
++{
++ u32 ib_cfg2_val;
++ u32 base_val;
++ int ret;
++
++ /* constant terms */
++ base_val = 0x0f878010;
++ /* configurable terms */
++ ib_cfg2_val = base_val | ((ib_tinfv) << 28) | ((ib_tcalv) << 5) |
++ (ib_ureg << 0);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_CFG2,
++ ib_cfg2_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_ib_cfg3_wr(struct phy_device *phydev,
++ const u32 ib_ini_hp,
++ const u32 ib_ini_mid,
++ const u32 ib_ini_lp,
++ const u32 ib_ini_offset)
++{
++ u32 reg_val;
++ int ret;
++
++ reg_val = (ib_ini_hp << 24) + (ib_ini_mid << 16) +
++ (ib_ini_lp << 8) + (ib_ini_offset << 0);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_CFG3,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_ib_cfg4_wr(struct phy_device *phydev,
++ const u32 ib_max_hp,
++ const u32 ib_max_mid,
++ const u32 ib_max_lp,
++ const u32 ib_max_offset)
++{
++ u32 reg_val;
++ int ret;
++
++ reg_val = (ib_max_hp << 24) + (ib_max_mid << 16) +
++ (ib_max_lp << 8) + (ib_max_offset << 0);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_CFG4,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_misc_cfg_wr(struct phy_device *phydev,
++ const u32 lane_rst)
++{
++ int ret;
++
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_MISC_CFG,
++ lane_rst);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_gp_cfg_wr(struct phy_device *phydev, const u32 gp_cfg_val)
++{
++ int ret;
++
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_GP_CFG,
++ gp_cfg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_dft_cfg2_wr(struct phy_device *phydev,
++ const u32 rx_ji_ampl,
++ const u32 rx_step_freq,
++ const u32 rx_ji_ena,
++ const u32 rx_waveform_sel,
++ const u32 rx_freqoff_dir,
++ const u32 rx_freqoff_ena)
++{
++ u32 reg_val;
++ int ret;
++
++ /* configurable terms */
++ reg_val = (rx_ji_ampl << 8) | (rx_step_freq << 4) |
++ (rx_ji_ena << 3) | (rx_waveform_sel << 2) |
++ (rx_freqoff_dir << 1) | rx_freqoff_ena;
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_IB_DFT_CFG2,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++static int vsc85xx_sd6g_dft_cfg0_wr(struct phy_device *phydev,
++ const u32 prbs_sel,
++ const u32 test_mode,
++ const u32 rx_dft_ena)
++{
++ u32 reg_val;
++ int ret;
++
++ /* configurable terms */
++ reg_val = (prbs_sel << 20) | (test_mode << 16) | (rx_dft_ena << 2);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_DFT_CFG0,
++ reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++/* Access LCPLL Cfg_0 */
++static int vsc85xx_pll5g_cfg0_wr(struct phy_device *phydev,
++ const u32 selbgv820)
++{
++ u32 base_val;
++ u32 reg_val;
++ int ret;
++
++ /* constant terms */
++ base_val = 0x7036f145;
++ /* configurable terms */
++ reg_val = base_val | (selbgv820 << 23);
++ ret = vsc85xx_csr_write(phydev, MACRO_CTRL,
++ PHY_S6G_PLL5G_CFG0, reg_val);
++ if (ret)
++ dev_err(&phydev->mdio.dev, "%s: write error\n", __func__);
++ return ret;
++}
++
++int vsc85xx_sd6g_config_v2(struct phy_device *phydev)
++{
++ u32 ib_sig_det_clk_sel_cal = 0;
++ u32 ib_sig_det_clk_sel_mm = 7;
++ u32 pll_fsm_ctrl_data = 60;
++ unsigned long deadline;
++ u32 des_bw_ana_val = 3;
++ u32 ib_tsdet_cal = 16;
++ u32 ib_tsdet_mm = 5;
++ u32 ib_rtrm_adj;
++ u32 if_mode = 1;
++ u32 gp_iter = 5;
++ u32 val32 = 0;
++ u32 qrate = 1;
++ u32 iter;
++ int val = 0;
++ int ret;
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_STANDARD);
++
++ /* Detune/Unlock LCPLL */
++ ret = pll5g_detune(phydev);
++ if (ret)
++ return ret;
++
++ /* 0. Reset RCPLL */
++ ret = vsc85xx_sd6g_pll_cfg_wr(phydev, 3, pll_fsm_ctrl_data, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 0, 0, 0, qrate, if_mode, 0);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_des_cfg_wr(phydev, 6, 2, 5, des_bw_ana_val, 0);
++ if (ret)
++ return ret;
++
++ /* 1. Configure sd6g for SGMII prior to sd6g_IB_CAL */
++ ib_rtrm_adj = 13;
++ ret = vsc85xx_sd6g_ib_cfg0_wr(phydev, ib_rtrm_adj, ib_sig_det_clk_sel_mm, 0, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_mm, 15, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg2_wr(phydev, 3, 13, 5);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg3_wr(phydev, 0, 31, 1, 31);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg4_wr(phydev, 63, 63, 2, 63);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 1, 1, 0, qrate, if_mode, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_misc_cfg_wr(phydev, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 2. Start rcpll_fsm */
++ ret = vsc85xx_sd6g_pll_cfg_wr(phydev, 3, pll_fsm_ctrl_data, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ ret = phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ val32 = vsc85xx_csr_read(phydev, MACRO_CTRL,
++ PHY_S6G_PLL_STATUS);
++ /* wait for bit 12 to clear */
++ } while (time_before(jiffies, deadline) && (val32 & BIT(12)));
++
++ if (val32 & BIT(12))
++ return -ETIMEDOUT;
++
++ /* 4. Release digital reset and disable transmitter */
++ ret = vsc85xx_sd6g_misc_cfg_wr(phydev, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 1, 1, 0, qrate, if_mode, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 5. Apply a frequency offset on RX-side (using internal FoJi logic) */
++ ret = vsc85xx_sd6g_gp_cfg_wr(phydev, 768);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_dft_cfg2_wr(phydev, 0, 2, 0, 0, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_dft_cfg0_wr(phydev, 0, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_des_cfg_wr(phydev, 6, 2, 5, des_bw_ana_val, 2);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 6. Prepare required settings for IBCAL */
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_cal, 15, 1, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg0_wr(phydev, ib_rtrm_adj, ib_sig_det_clk_sel_cal, 0, 0);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 7. Start IB_CAL */
++ ret = vsc85xx_sd6g_ib_cfg0_wr(phydev, ib_rtrm_adj,
++ ib_sig_det_clk_sel_cal, 0, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ /* 11 cycles (for ViperA) or 5 cycles (for ViperB & Elise) w/ SW clock */
++ for (iter = 0; iter < gp_iter; iter++) {
++ /* set gp(0) */
++ ret = vsc85xx_sd6g_gp_cfg_wr(phydev, 769);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ /* clear gp(0) */
++ ret = vsc85xx_sd6g_gp_cfg_wr(phydev, 768);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ }
++
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_cal, 15, 1, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_cal, 15, 0, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 8. Wait for IB cal to complete */
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ ret = phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ val32 = vsc85xx_csr_read(phydev, MACRO_CTRL,
++ PHY_S6G_IB_STATUS0);
++ /* wait for bit 8 to set */
++ } while (time_before(jiffies, deadline) && (~val32 & BIT(8)));
++
++ if (~val32 & BIT(8))
++ return -ETIMEDOUT;
++
++ /* 9. Restore cfg values for mission mode */
++ ret = vsc85xx_sd6g_ib_cfg0_wr(phydev, ib_rtrm_adj, ib_sig_det_clk_sel_mm, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_mm, 15, 0, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 10. Re-enable transmitter */
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 1, 1, 0, qrate, if_mode, 0);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 11. Disable frequency offset generation (using internal FoJi logic) */
++ ret = vsc85xx_sd6g_dft_cfg2_wr(phydev, 0, 0, 0, 0, 0, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_dft_cfg0_wr(phydev, 0, 0, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_des_cfg_wr(phydev, 6, 2, 5, des_bw_ana_val, 0);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* Tune/Re-lock LCPLL */
++ ret = pll5g_tune(phydev);
++ if (ret)
++ return ret;
++
++ /* 12. Configure for Final Configuration and Settings */
++ /* a. Reset RCPLL */
++ ret = vsc85xx_sd6g_pll_cfg_wr(phydev, 3, pll_fsm_ctrl_data, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 0, 1, 0, qrate, if_mode, 0);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* b. Configure sd6g for desired operating mode */
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_EXTENDED_GPIO);
++ ret = phy_base_read(phydev, MSCC_PHY_MAC_CFG_FASTLINK);
++ if ((ret & MAC_CFG_MASK) == MAC_CFG_QSGMII) {
++ /* QSGMII */
++ pll_fsm_ctrl_data = 120;
++ qrate = 0;
++ if_mode = 3;
++ des_bw_ana_val = 5;
++ val = PROC_CMD_MCB_ACCESS_MAC_CONF | PROC_CMD_RST_CONF_PORT |
++ PROC_CMD_READ_MOD_WRITE_PORT | PROC_CMD_QSGMII_MAC;
++
++ ret = vsc8584_cmd(phydev, val);
++ if (ret) {
++ dev_err(&phydev->mdio.dev, "%s: QSGMII error: %d\n",
++ __func__, ret);
++ return ret;
++ }
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_STANDARD);
++ } else if ((ret & MAC_CFG_MASK) == MAC_CFG_SGMII) {
++ /* SGMII */
++ pll_fsm_ctrl_data = 60;
++ qrate = 1;
++ if_mode = 1;
++ des_bw_ana_val = 3;
++
++ val = PROC_CMD_MCB_ACCESS_MAC_CONF | PROC_CMD_RST_CONF_PORT |
++ PROC_CMD_READ_MOD_WRITE_PORT | PROC_CMD_SGMII_MAC;
++
++ ret = vsc8584_cmd(phydev, val);
++ if (ret) {
++ dev_err(&phydev->mdio.dev, "%s: SGMII error: %d\n",
++ __func__, ret);
++ return ret;
++ }
++
++ phy_base_write(phydev, MSCC_EXT_PAGE_ACCESS, MSCC_PHY_PAGE_STANDARD);
++ } else {
++ dev_err(&phydev->mdio.dev, "%s: invalid mac_if: %x\n",
++ __func__, ret);
++ }
++
++ ret = phy_update_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
++ if (ret)
++ return ret;
++ ret = phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_pll5g_cfg0_wr(phydev, 4);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_S6G_LCPLL_CFG, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_des_cfg_wr(phydev, 6, 2, 5, des_bw_ana_val, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg0_wr(phydev, ib_rtrm_adj, ib_sig_det_clk_sel_mm, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg1_wr(phydev, 8, ib_tsdet_mm, 15, 0, 1);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_common_cfg_wr(phydev, 1, 1, 0, qrate, if_mode, 0);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg2_wr(phydev, 3, 13, 5);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg3_wr(phydev, 0, 31, 1, 31);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_ib_cfg4_wr(phydev, 63, 63, 2, 63);
++ if (ret)
++ return ret;
++ ret = vsc85xx_sd6g_misc_cfg_wr(phydev, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 13. Start rcpll_fsm */
++ ret = vsc85xx_sd6g_pll_cfg_wr(phydev, 3, pll_fsm_ctrl_data, 1);
++ if (ret)
++ return ret;
++ ret = phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++
++ /* 14. Wait for PLL cal to complete */
++ deadline = jiffies + msecs_to_jiffies(PROC_CMD_NCOMPLETED_TIMEOUT_MS);
++ do {
++ usleep_range(500, 1000);
++ ret = phy_update_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++ if (ret)
++ return ret;
++ val32 = vsc85xx_csr_read(phydev, MACRO_CTRL,
++ PHY_S6G_PLL_STATUS);
++ /* wait for bit 12 to clear */
++ } while (time_before(jiffies, deadline) && (val32 & BIT(12)));
++
++ if (val32 & BIT(12))
++ return -ETIMEDOUT;
++
++ /* release lane reset */
++ ret = vsc85xx_sd6g_misc_cfg_wr(phydev, 0);
++ if (ret)
++ return ret;
++
++ return phy_commit_mcb_s6g(phydev, PHY_MCB_S6G_CFG, 0);
++}
+diff --git a/drivers/net/phy/mscc/mscc_serdes.h b/drivers/net/phy/mscc/mscc_serdes.h
+new file mode 100644
+index 0000000000000..2a6371322af91
+--- /dev/null
++++ b/drivers/net/phy/mscc/mscc_serdes.h
+@@ -0,0 +1,31 @@
++/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
++/*
++ * Driver for Microsemi VSC85xx PHYs
++ *
++ * Copyright (c) 2021 Microsemi Corporation
++ */
++
++#ifndef _MSCC_SERDES_PHY_H_
++#define _MSCC_SERDES_PHY_H_
++
++#define PHY_S6G_PLL5G_CFG2_GAIN_MASK GENMASK(9, 5)
++#define PHY_S6G_PLL5G_CFG2_ENA_GAIN 1
++
++#define PHY_S6G_DES_PHY_CTRL_POS 13
++#define PHY_S6G_DES_MBTR_CTRL_POS 10
++#define PHY_S6G_DES_CPMD_SEL_POS 8
++#define PHY_S6G_DES_BW_HYST_POS 5
++#define PHY_S6G_DES_BW_ANA_POS 1
++#define PHY_S6G_DES_CFG 0x21
++#define PHY_S6G_IB_CFG0 0x22
++#define PHY_S6G_IB_CFG1 0x23
++#define PHY_S6G_IB_CFG2 0x24
++#define PHY_S6G_IB_CFG3 0x25
++#define PHY_S6G_IB_CFG4 0x26
++#define PHY_S6G_GP_CFG 0x2E
++#define PHY_S6G_DFT_CFG0 0x35
++#define PHY_S6G_IB_DFT_CFG2 0x37
++
++int vsc85xx_sd6g_config_v2(struct phy_device *phydev);
++
++#endif /* _MSCC_PHY_SERDES_H_ */
+--
+2.27.0
+
--- /dev/null
+From d9cd407734aad5dc91b8a2e535d362fdee5a00c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 16:02:27 +0100
+Subject: net: sfp: add workaround for Realtek RTL8672 and RTL9601C chips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 426c6cbc409cbda9ab1a9dbf15d3c2ef947eb8c1 ]
+
+The workaround for VSOL V2801F brand based GPON SFP modules added in commit
+0d035bed2a4a ("net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0
+workaround") works only for IDs added explicitly to the list. Since there
+are rebranded modules where OEM vendors put different strings into the
+vendor name field, we cannot base workaround on IDs only.
+
+Moreover the issue which the above mentioned commit tried to work around is
+generic not only to VSOL based modules, but rather to all GPON modules
+based on Realtek RTL8672 and RTL9601C chips.
+
+These include at least the following GPON modules:
+* V-SOL V2801F
+* C-Data FD511GX-RM0
+* OPTON GP801R
+* BAUDCOM BD-1234-SFM
+* CPGOS03-0490 v2.0
+* Ubiquiti U-Fiber Instant
+* EXOT EGS1
+
+These Realtek chips have broken EEPROM emulator which for N-byte read
+operation returns just the first byte of EEPROM data, followed by N-1
+zeros.
+
+Introduce a new function, sfp_id_needs_byte_io(), which detects SFP modules
+with broken EEPROM emulator based on N-1 zeros and switch to 1 byte EEPROM
+reading operation.
+
+Function sfp_i2c_read() now always uses single byte reading when it is
+required and when function sfp_hwmon_probe() detects single byte access,
+it disables registration of hwmon device, because in this case we cannot
+reliably and atomically read 2 bytes as is required by the standard for
+retrieving values from diagnostic area.
+
+(These Realtek chips are broken in a way that violates SFP standards for
+diagnostic interface. Kernel in this case simply cannot do anything less
+of skipping registration of the hwmon interface.)
+
+This patch fixes reading of EEPROM content from SFP modules based on
+Realtek RTL8672 and RTL9601C chips. Diagnostic interface of EEPROM stays
+broken and cannot be fixed.
+
+Fixes: 0d035bed2a4a ("net: sfp: VSOL V2801F / CarlitoxxPro CPGOS03-0490 v2.0 workaround")
+Co-developed-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/sfp.c | 100 ++++++++++++++++++++++++++++--------------
+ 1 file changed, 67 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 91d74c1a920ab..f2b5e467a8001 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -336,19 +336,11 @@ static int sfp_i2c_read(struct sfp *sfp, bool a2, u8 dev_addr, void *buf,
+ size_t len)
+ {
+ struct i2c_msg msgs[2];
+- size_t block_size;
++ u8 bus_addr = a2 ? 0x51 : 0x50;
++ size_t block_size = sfp->i2c_block_size;
+ size_t this_len;
+- u8 bus_addr;
+ int ret;
+
+- if (a2) {
+- block_size = 16;
+- bus_addr = 0x51;
+- } else {
+- block_size = sfp->i2c_block_size;
+- bus_addr = 0x50;
+- }
+-
+ msgs[0].addr = bus_addr;
+ msgs[0].flags = 0;
+ msgs[0].len = 1;
+@@ -1282,6 +1274,20 @@ static void sfp_hwmon_probe(struct work_struct *work)
+ struct sfp *sfp = container_of(work, struct sfp, hwmon_probe.work);
+ int err, i;
+
++ /* hwmon interface needs to access 16bit registers in atomic way to
++ * guarantee coherency of the diagnostic monitoring data. If it is not
++ * possible to guarantee coherency because EEPROM is broken in such way
++ * that does not support atomic 16bit read operation then we have to
++ * skip registration of hwmon device.
++ */
++ if (sfp->i2c_block_size < 2) {
++ dev_info(sfp->dev,
++ "skipping hwmon device registration due to broken EEPROM\n");
++ dev_info(sfp->dev,
++ "diagnostic EEPROM area cannot be read atomically to guarantee data coherency\n");
++ return;
++ }
++
+ err = sfp_read(sfp, true, 0, &sfp->diag, sizeof(sfp->diag));
+ if (err < 0) {
+ if (sfp->hwmon_tries--) {
+@@ -1642,26 +1648,30 @@ static int sfp_sm_mod_hpower(struct sfp *sfp, bool enable)
+ return 0;
+ }
+
+-/* Some modules (Nokia 3FE46541AA) lock up if byte 0x51 is read as a
+- * single read. Switch back to reading 16 byte blocks unless we have
+- * a CarlitoxxPro module (rebranded VSOL V2801F). Even more annoyingly,
+- * some VSOL V2801F have the vendor name changed to OEM.
++/* GPON modules based on Realtek RTL8672 and RTL9601C chips (e.g. V-SOL
++ * V2801F, CarlitoxxPro CPGOS03-0490, Ubiquiti U-Fiber Instant, ...) do
++ * not support multibyte reads from the EEPROM. Each multi-byte read
++ * operation returns just one byte of EEPROM followed by zeros. There is
++ * no way to identify which modules are using Realtek RTL8672 and RTL9601C
++ * chips. Moreover every OEM of V-SOL V2801F module puts its own vendor
++ * name and vendor id into EEPROM, so there is even no way to detect if
++ * module is V-SOL V2801F. Therefore check for those zeros in the read
++ * data and then based on check switch to reading EEPROM to one byte
++ * at a time.
+ */
+-static int sfp_quirk_i2c_block_size(const struct sfp_eeprom_base *base)
++static bool sfp_id_needs_byte_io(struct sfp *sfp, void *buf, size_t len)
+ {
+- if (!memcmp(base->vendor_name, "VSOL ", 16))
+- return 1;
+- if (!memcmp(base->vendor_name, "OEM ", 16) &&
+- !memcmp(base->vendor_pn, "V2801F ", 16))
+- return 1;
++ size_t i, block_size = sfp->i2c_block_size;
+
+- /* Some modules can't cope with long reads */
+- return 16;
+-}
++ /* Already using byte IO */
++ if (block_size == 1)
++ return false;
+
+-static void sfp_quirks_base(struct sfp *sfp, const struct sfp_eeprom_base *base)
+-{
+- sfp->i2c_block_size = sfp_quirk_i2c_block_size(base);
++ for (i = 1; i < len; i += block_size) {
++ if (memchr_inv(buf + i, '\0', min(block_size - 1, len - i)))
++ return false;
++ }
++ return true;
+ }
+
+ static int sfp_cotsworks_fixup_check(struct sfp *sfp, struct sfp_eeprom_id *id)
+@@ -1705,11 +1715,11 @@ static int sfp_sm_mod_probe(struct sfp *sfp, bool report)
+ u8 check;
+ int ret;
+
+- /* Some modules (CarlitoxxPro CPGOS03-0490) do not support multibyte
+- * reads from the EEPROM, so start by reading the base identifying
+- * information one byte at a time.
++ /* Some SFP modules and also some Linux I2C drivers do not like reads
++ * longer than 16 bytes, so read the EEPROM in chunks of 16 bytes at
++ * a time.
+ */
+- sfp->i2c_block_size = 1;
++ sfp->i2c_block_size = 16;
+
+ ret = sfp_read(sfp, false, 0, &id.base, sizeof(id.base));
+ if (ret < 0) {
+@@ -1723,6 +1733,33 @@ static int sfp_sm_mod_probe(struct sfp *sfp, bool report)
+ return -EAGAIN;
+ }
+
++ /* Some SFP modules (e.g. Nokia 3FE46541AA) lock up if read from
++ * address 0x51 is just one byte at a time. Also SFF-8472 requires
++ * that EEPROM supports atomic 16bit read operation for diagnostic
++ * fields, so do not switch to one byte reading at a time unless it
++ * is really required and we have no other option.
++ */
++ if (sfp_id_needs_byte_io(sfp, &id.base, sizeof(id.base))) {
++ dev_info(sfp->dev,
++ "Detected broken RTL8672/RTL9601C emulated EEPROM\n");
++ dev_info(sfp->dev,
++ "Switching to reading EEPROM to one byte at a time\n");
++ sfp->i2c_block_size = 1;
++
++ ret = sfp_read(sfp, false, 0, &id.base, sizeof(id.base));
++ if (ret < 0) {
++ if (report)
++ dev_err(sfp->dev, "failed to read EEPROM: %d\n",
++ ret);
++ return -EAGAIN;
++ }
++
++ if (ret != sizeof(id.base)) {
++ dev_err(sfp->dev, "EEPROM short read: %d\n", ret);
++ return -EAGAIN;
++ }
++ }
++
+ /* Cotsworks do not seem to update the checksums when they
+ * do the final programming with the final module part number,
+ * serial number and date code.
+@@ -1757,9 +1794,6 @@ static int sfp_sm_mod_probe(struct sfp *sfp, bool report)
+ }
+ }
+
+- /* Apply any early module-specific quirks */
+- sfp_quirks_base(sfp, &id.base);
+-
+ ret = sfp_read(sfp, false, SFP_CC_BASE + 1, &id.ext, sizeof(id.ext));
+ if (ret < 0) {
+ if (report)
+--
+2.27.0
+
--- /dev/null
+From 51775e125518242d33cc2e5609a9e0aaae9400eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 14:42:48 +0100
+Subject: net: stmmac: dwmac-meson8b: fix enabling the timing-adjustment clock
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 025822884a4fd2d0af51dcf77ddc494e60c5ff63 ]
+
+The timing-adjustment clock only has to be enabled when a) there is a
+2ns RX delay configured using device-tree and b) the phy-mode indicates
+that the RX delay should be enabled.
+
+Only enable the RX delay if both are true, instead of (by accident) also
+enabling it when there's the 2ns RX delay configured but the phy-mode
+incicates that the RX delay is not used.
+
+Fixes: 9308c47640d515 ("net: stmmac: dwmac-meson8b: add support for the RX delay configuration")
+Reported-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index f184b00f51166..5f500141567d0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -301,7 +301,7 @@ static int meson8b_init_prg_eth(struct meson8b_dwmac *dwmac)
+ return -EINVAL;
+ }
+
+- if (rx_dly_config & PRG_ETH0_ADJ_ENABLE) {
++ if (delay_config & PRG_ETH0_ADJ_ENABLE) {
+ if (!dwmac->timing_adj_clk) {
+ dev_err(dwmac->dev,
+ "The timing-adjustment clock is mandatory for the RX delay re-timing\n");
+--
+2.27.0
+
--- /dev/null
+From 4ebab9d75bf52d2d41b7adbfe1774513927bd054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 21:40:53 +0800
+Subject: net: stmmac: fix CBS idleslope and sendslope calculation
+
+From: Song, Yoong Siang <yoong.siang.song@intel.com>
+
+[ Upstream commit 24877687b375f2c476ffb726ea915fc85df09e3d ]
+
+When link speed is not 100 Mbps, port transmit rate and speed divider
+are set to 8 and 1000000 respectively. These values are incorrect for
+CBS idleslope and sendslope HW values calculation if the link speed is
+not 1 Gbps.
+
+This patch adds switch statement to set the values of port transmit rate
+and speed divider for 10 Gbps, 5 Gbps, 2.5 Gbps, 1 Gbps, and 100 Mbps.
+Note that CBS is not supported at 10 Mbps.
+
+Fixes: bc41a6689b30 ("net: stmmac: tc: Remove the speed dependency")
+Fixes: 1f705bc61aee ("net: stmmac: Add support for CBS QDISC")
+Signed-off-by: Song, Yoong Siang <yoong.siang.song@intel.com>
+Link: https://lore.kernel.org/r/1613655653-11755-1-git-send-email-yoong.siang.song@intel.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 30 ++++++++++++++++---
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 56985542e2029..44bb133c30007 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -316,6 +316,32 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+ if (!priv->dma_cap.av)
+ return -EOPNOTSUPP;
+
++ /* Port Transmit Rate and Speed Divider */
++ switch (priv->speed) {
++ case SPEED_10000:
++ ptr = 32;
++ speed_div = 10000000;
++ break;
++ case SPEED_5000:
++ ptr = 32;
++ speed_div = 5000000;
++ break;
++ case SPEED_2500:
++ ptr = 8;
++ speed_div = 2500000;
++ break;
++ case SPEED_1000:
++ ptr = 8;
++ speed_div = 1000000;
++ break;
++ case SPEED_100:
++ ptr = 4;
++ speed_div = 100000;
++ break;
++ default:
++ return -EOPNOTSUPP;
++ }
++
+ mode_to_use = priv->plat->tx_queues_cfg[queue].mode_to_use;
+ if (mode_to_use == MTL_QUEUE_DCB && qopt->enable) {
+ ret = stmmac_dma_qmode(priv, priv->ioaddr, queue, MTL_QUEUE_AVB);
+@@ -332,10 +358,6 @@ static int tc_setup_cbs(struct stmmac_priv *priv,
+ priv->plat->tx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
+ }
+
+- /* Port Transmit Rate and Speed Divider */
+- ptr = (priv->speed == SPEED_100) ? 4 : 8;
+- speed_div = (priv->speed == SPEED_100) ? 100000 : 1000000;
+-
+ /* Final adjustments for HW */
+ value = div_s64(qopt->idleslope * 1024ll * ptr, speed_div);
+ priv->plat->tx_queues_cfg[queue].idle_slope = value & GENMASK(31, 0);
+--
+2.27.0
+
--- /dev/null
+From 015ddec9bba4852c2e92e3a9e46d60a019a19f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 11:42:13 -0500
+Subject: nfsd: register pernet ops last, unregister first
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit bd5ae9288d6451bd346a1b4a59d4fe7e62ba29b7 ]
+
+These pernet operations may depend on stuff set up or torn down in the
+module init/exit functions. And they may be called at any time in
+between. So it makes more sense for them to be the last to be
+registered in the init function, and the first to be unregistered in the
+exit function.
+
+In particular, without this, the drc slab is being destroyed before all
+the per-net drcs are shut down, resulting in an "Objects remaining in
+nfsd_drc on __kmem_cache_shutdown()" warning in exit_nfsd.
+
+Reported-by: Zhi Li <yieli@redhat.com>
+Fixes: 3ba75830ce17 "nfsd4: drc containerization"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfsctl.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index f6d5d783f4a45..0759e589ab52b 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1522,12 +1522,9 @@ static int __init init_nfsd(void)
+ int retval;
+ printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");
+
+- retval = register_pernet_subsys(&nfsd_net_ops);
+- if (retval < 0)
+- return retval;
+ retval = register_cld_notifier();
+ if (retval)
+- goto out_unregister_pernet;
++ return retval;
+ retval = nfsd4_init_slabs();
+ if (retval)
+ goto out_unregister_notifier;
+@@ -1544,9 +1541,14 @@ static int __init init_nfsd(void)
+ goto out_free_lockd;
+ retval = register_filesystem(&nfsd_fs_type);
+ if (retval)
++ goto out_free_exports;
++ retval = register_pernet_subsys(&nfsd_net_ops);
++ if (retval < 0)
+ goto out_free_all;
+ return 0;
+ out_free_all:
++ unregister_pernet_subsys(&nfsd_net_ops);
++out_free_exports:
+ remove_proc_entry("fs/nfs/exports", NULL);
+ remove_proc_entry("fs/nfs", NULL);
+ out_free_lockd:
+@@ -1559,13 +1561,12 @@ out_free_slabs:
+ nfsd4_free_slabs();
+ out_unregister_notifier:
+ unregister_cld_notifier();
+-out_unregister_pernet:
+- unregister_pernet_subsys(&nfsd_net_ops);
+ return retval;
+ }
+
+ static void __exit exit_nfsd(void)
+ {
++ unregister_pernet_subsys(&nfsd_net_ops);
+ nfsd_drc_slab_free();
+ remove_proc_entry("fs/nfs/exports", NULL);
+ remove_proc_entry("fs/nfs", NULL);
+@@ -1575,7 +1576,6 @@ static void __exit exit_nfsd(void)
+ nfsd4_exit_pnfs();
+ unregister_filesystem(&nfsd_fs_type);
+ unregister_cld_notifier();
+- unregister_pernet_subsys(&nfsd_net_ops);
+ }
+
+ MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
+--
+2.27.0
+
--- /dev/null
+From 861d856f49931aeab3d5baf84b5b4ca5fd7c218a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 08:49:32 -0500
+Subject: NFSv4: Fixes for nfs4_bitmask_adjust()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 45901a231723a5a513ff08477983f3a274a6a910 ]
+
+We don't want to ask for the ACL in a WRITE reply, since we don't have
+a preallocated buffer.
+
+Instead of checking NFS_INO_INVALID_ACCESS, which is really about
+managing the access cache, we should look at the value of
+NFS_INO_INVALID_OTHER. Also ensure we assign the mode, owner and
+owner_group flags to the correct bit mask.
+
+Finally, fix up the check for NFS_INO_INVALID_CTIME to retrieve the
+ctime, and add a check for NFS_INO_INVALID_CHANGE.
+
+Fixes: 76bd5c016ef4 ("NFSv4: make cache consistency bitmask dynamic")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 2f4679a62712a..fc8bbfd9beb36 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -5438,15 +5438,16 @@ static void nfs4_bitmask_adjust(__u32 *bitmask, struct inode *inode,
+
+ if (cache_validity & NFS_INO_INVALID_ATIME)
+ bitmask[1] |= FATTR4_WORD1_TIME_ACCESS;
+- if (cache_validity & NFS_INO_INVALID_ACCESS)
+- bitmask[0] |= FATTR4_WORD1_MODE | FATTR4_WORD1_OWNER |
+- FATTR4_WORD1_OWNER_GROUP;
+- if (cache_validity & NFS_INO_INVALID_ACL)
+- bitmask[0] |= FATTR4_WORD0_ACL;
+- if (cache_validity & NFS_INO_INVALID_LABEL)
++ if (cache_validity & NFS_INO_INVALID_OTHER)
++ bitmask[1] |= FATTR4_WORD1_MODE | FATTR4_WORD1_OWNER |
++ FATTR4_WORD1_OWNER_GROUP |
++ FATTR4_WORD1_NUMLINKS;
++ if (label && label->len && cache_validity & NFS_INO_INVALID_LABEL)
+ bitmask[2] |= FATTR4_WORD2_SECURITY_LABEL;
+- if (cache_validity & NFS_INO_INVALID_CTIME)
++ if (cache_validity & NFS_INO_INVALID_CHANGE)
+ bitmask[0] |= FATTR4_WORD0_CHANGE;
++ if (cache_validity & NFS_INO_INVALID_CTIME)
++ bitmask[1] |= FATTR4_WORD1_TIME_METADATA;
+ if (cache_validity & NFS_INO_INVALID_MTIME)
+ bitmask[1] |= FATTR4_WORD1_TIME_MODIFY;
+ if (cache_validity & NFS_INO_INVALID_SIZE)
+--
+2.27.0
+
--- /dev/null
+From 8cb3b5c951fbd6cda9f7c7ee58877ae977687629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 14:41:03 +0800
+Subject: nios2: fixed broken sys_clone syscall
+
+From: Andreas Oetken <andreas.oetken@siemens.com>
+
+[ Upstream commit 9abcfcb20320e8f693e89d86573b58e6289931cb ]
+
+The tls pointer must be pushed on the stack prior to calling nios2_clone
+as it is the 5th function argument. Prior handling of the tls pointer was
+done inside former called function copy_thread_tls using the r8 register
+from the current_pt_regs directly. This was a bad design and resulted in
+the current bug introduced in 04bd52fb.
+
+Fixes: 04bd52fb ("nios2: enable HAVE_COPY_THREAD_TLS, switch to kernel_clone_args")
+Signed-off-by: Andreas Oetken <andreas.oetken@siemens.com>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/entry.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/nios2/kernel/entry.S b/arch/nios2/kernel/entry.S
+index da8442450e460..0794cd7803dfe 100644
+--- a/arch/nios2/kernel/entry.S
++++ b/arch/nios2/kernel/entry.S
+@@ -389,7 +389,10 @@ ENTRY(ret_from_interrupt)
+ */
+ ENTRY(sys_clone)
+ SAVE_SWITCH_STACK
++ subi sp, sp, 4 /* make space for tls pointer */
++ stw r8, 0(sp) /* pass tls pointer (r8) via stack (5th argument) */
+ call nios2_clone
++ addi sp, sp, 4
+ RESTORE_SWITCH_STACK
+ ret
+
+--
+2.27.0
+
--- /dev/null
+From 9a07e62fc70cf103ad1360e36ba50e5cddc3c7c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 11:50:02 -0800
+Subject: nvme-multipath: set nr_zones for zoned namespaces
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 73a1a2298f3e9df24cea7a9aab412ba9470f6159 ]
+
+The bio based drivers only require the request_queue's nr_zones is set,
+so set this field in the head if the namespace path is zoned.
+
+Fixes: 240e6ee272c07 ("nvme: support for zoned namespaces")
+Reported-by: Minwoo Im <minwoo.im.dev@gmail.com>
+Cc: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index 282b7a4ea9a9a..fdfc18a222cc3 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -677,6 +677,10 @@ void nvme_mpath_add_disk(struct nvme_ns *ns, struct nvme_id_ns *id)
+ if (blk_queue_stable_writes(ns->queue) && ns->head->disk)
+ blk_queue_flag_set(QUEUE_FLAG_STABLE_WRITES,
+ ns->head->disk->queue);
++#ifdef CONFIG_BLK_DEV_ZONED
++ if (blk_queue_is_zoned(ns->queue) && ns->head->disk)
++ ns->head->disk->queue->nr_zones = ns->queue->nr_zones;
++#endif
+ }
+
+ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
+--
+2.27.0
+
--- /dev/null
+From 859d6d302d043756ee69a437b52e88c74ca49cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:14:26 +0000
+Subject: nvmem: core: Fix a resource leak on error in
+ nvmem_add_cells_from_of()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 72e008ce307fa2f35f6783997378b32e83122839 ]
+
+This doesn't call of_node_put() on the error path so it leads to a
+memory leak.
+
+Fixes: 0749aa25af82 ("nvmem: core: fix regression in of_nvmem_cell_get()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210129171430.11328-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 177f5bf27c6d5..68ae6f24b57fd 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -713,6 +713,7 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+ cell->name, nvmem->stride);
+ /* Cells already added will be freed later. */
+ kfree_const(cell->name);
++ of_node_put(cell->np);
+ kfree(cell);
+ return -EINVAL;
+ }
+--
+2.27.0
+
--- /dev/null
+From e2359e7219651e04ed48047f391c1acc64d5cd18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 17:14:30 +0000
+Subject: nvmem: core: skip child nodes not matching binding
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit 0445efacec75b85c2a3c176957ee050ba9be53f0 ]
+
+The nvmem cell binding applies to all eeprom child nodes matching
+"^.*@[0-9a-f]+$" without taking a compatible into account.
+
+Linux drivers, like at24, are even more extensive and assume
+_all_ at24 eeprom child nodes to be nvmem cells since e888d445ac33
+("nvmem: resolve cells from DT at registration time").
+
+Since df5f3b6f5357 ("dt-bindings: nvmem: stm32: new property for
+data access"), the additionalProperties: True means it's Ok to have
+other properties as long as they don't match "^.*@[0-9a-f]+$".
+
+The barebox bootloader extends the MTD partitions binding to
+EEPROM and can fix up following device tree node:
+
+ &eeprom {
+ partitions {
+ compatible = "fixed-partitions";
+ };
+ };
+
+This is allowed binding-wise, but drivers using nvmem_register()
+like at24 will fail to parse because the function expects all child
+nodes to have a reg property present. This results in the whole
+EEPROM driver probe failing despite the device tree being correct.
+
+Fix this by skipping nodes lacking a reg property instead of
+returning an error. This effectively makes the drivers adhere
+to the binding because all nodes with a unit address must have
+a reg property and vice versa.
+
+Fixes: e888d445ac33 ("nvmem: resolve cells from DT at registration time").
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210129171430.11328-6-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 68ae6f24b57fd..a5ab1e0c74cf6 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -682,7 +682,9 @@ static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+
+ for_each_child_of_node(parent, child) {
+ addr = of_get_property(child, "reg", &len);
+- if (!addr || (len < 2 * sizeof(u32))) {
++ if (!addr)
++ continue;
++ if (len < 2 * sizeof(u32)) {
+ dev_err(dev, "nvmem: invalid reg on %pOF\n", child);
+ return -EINVAL;
+ }
+--
+2.27.0
+
--- /dev/null
+From e6ccb5707b37e1117207fcc4aaad0edc4f2d0a4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 17:33:54 -0800
+Subject: nvmet: remove extra variable in identify ns
+
+From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+
+[ Upstream commit 3c7b224f1956ed232b24ed2eb2c54e4476c6acb2 ]
+
+We remove the extra local variable struct nvmet_ns in
+nvmet_execute_identify_ns() since req already has ns member that can be
+reused, this also eliminates the explicit call to nvmet_put_namespace()
+which is already present in the request completion path.
+
+Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index dc1ea468b182b..de6aaa4c96e53 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -469,7 +469,6 @@ out:
+ static void nvmet_execute_identify_ns(struct nvmet_req *req)
+ {
+ struct nvmet_ctrl *ctrl = req->sq->ctrl;
+- struct nvmet_ns *ns;
+ struct nvme_id_ns *id;
+ u16 status = 0;
+
+@@ -486,20 +485,21 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req)
+ }
+
+ /* return an all zeroed buffer if we can't find an active namespace */
+- ns = nvmet_find_namespace(ctrl, req->cmd->identify.nsid);
+- if (!ns) {
++ req->ns = nvmet_find_namespace(ctrl, req->cmd->identify.nsid);
++ if (!req->ns) {
+ status = NVME_SC_INVALID_NS;
+ goto done;
+ }
+
+- nvmet_ns_revalidate(ns);
++ nvmet_ns_revalidate(req->ns);
+
+ /*
+ * nuse = ncap = nsze isn't always true, but we have no way to find
+ * that out from the underlying device.
+ */
+- id->ncap = id->nsze = cpu_to_le64(ns->size >> ns->blksize_shift);
+- switch (req->port->ana_state[ns->anagrpid]) {
++ id->ncap = id->nsze =
++ cpu_to_le64(req->ns->size >> req->ns->blksize_shift);
++ switch (req->port->ana_state[req->ns->anagrpid]) {
+ case NVME_ANA_INACCESSIBLE:
+ case NVME_ANA_PERSISTENT_LOSS:
+ break;
+@@ -508,8 +508,8 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req)
+ break;
+ }
+
+- if (ns->bdev)
+- nvmet_bdev_set_limits(ns->bdev, id);
++ if (req->ns->bdev)
++ nvmet_bdev_set_limits(req->ns->bdev, id);
+
+ /*
+ * We just provide a single LBA format that matches what the
+@@ -523,25 +523,24 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req)
+ * controllers, but also with any other user of the block device.
+ */
+ id->nmic = (1 << 0);
+- id->anagrpid = cpu_to_le32(ns->anagrpid);
++ id->anagrpid = cpu_to_le32(req->ns->anagrpid);
+
+- memcpy(&id->nguid, &ns->nguid, sizeof(id->nguid));
++ memcpy(&id->nguid, &req->ns->nguid, sizeof(id->nguid));
+
+- id->lbaf[0].ds = ns->blksize_shift;
++ id->lbaf[0].ds = req->ns->blksize_shift;
+
+- if (ctrl->pi_support && nvmet_ns_has_pi(ns)) {
++ if (ctrl->pi_support && nvmet_ns_has_pi(req->ns)) {
+ id->dpc = NVME_NS_DPC_PI_FIRST | NVME_NS_DPC_PI_LAST |
+ NVME_NS_DPC_PI_TYPE1 | NVME_NS_DPC_PI_TYPE2 |
+ NVME_NS_DPC_PI_TYPE3;
+ id->mc = NVME_MC_EXTENDED_LBA;
+- id->dps = ns->pi_type;
++ id->dps = req->ns->pi_type;
+ id->flbas = NVME_NS_FLBAS_META_EXT;
+- id->lbaf[0].ms = cpu_to_le16(ns->metadata_size);
++ id->lbaf[0].ms = cpu_to_le16(req->ns->metadata_size);
+ }
+
+- if (ns->readonly)
++ if (req->ns->readonly)
+ id->nsattr |= (1 << 0);
+- nvmet_put_namespace(ns);
+ done:
+ if (!status)
+ status = nvmet_copy_to_sgl(req, 0, id, sizeof(*id));
+--
+2.27.0
+
--- /dev/null
+From 9d1fecdc3821d7478a8813c2a17ee5634d6f177a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 21:47:52 -0800
+Subject: nvmet: set status to 0 in case for invalid nsid
+
+From: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+
+[ Upstream commit 40244ad36bcfb796a6bb9e95bdcbf8ddf3134509 ]
+
+For unallocated namespace in nvmet_execute_identify_ns() don't set the
+status to NVME_SC_INVALID_NS, set it to zero.
+
+Fixes: bffcd507780e ("nvmet: set right status on error in id-ns handler")
+Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/admin-cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
+index de6aaa4c96e53..1827d8d8f3b00 100644
+--- a/drivers/nvme/target/admin-cmd.c
++++ b/drivers/nvme/target/admin-cmd.c
+@@ -487,7 +487,7 @@ static void nvmet_execute_identify_ns(struct nvmet_req *req)
+ /* return an all zeroed buffer if we can't find an active namespace */
+ req->ns = nvmet_find_namespace(ctrl, req->cmd->identify.nsid);
+ if (!req->ns) {
+- status = NVME_SC_INVALID_NS;
++ status = 0;
+ goto done;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 397229be57920584aa097b86647f3783f670f8ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 11:47:25 -0800
+Subject: nvmet-tcp: fix potential race of tcp socket closing accept_work
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 0fbcfb089a3f2f2a731d01f0aec8f7697a849c28 ]
+
+When we accept a TCP connection and allocate an nvmet-tcp queue we should
+make sure not to fully establish it or reference it as the connection may
+be already closing, which triggers queue release work, which does not
+fence against queue establishment.
+
+In order to address such a race, we make sure to check the sk_state and
+contain the queue reference to be done underneath the sk_callback_lock
+such that the queue release work correctly fences against it.
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Reported-by: Elad Grupi <elad.grupi@dell.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 577ce7d403ae9..8b0485ada315b 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1485,17 +1485,27 @@ static int nvmet_tcp_set_queue_sock(struct nvmet_tcp_queue *queue)
+ if (inet->rcv_tos > 0)
+ ip_sock_set_tos(sock->sk, inet->rcv_tos);
+
++ ret = 0;
+ write_lock_bh(&sock->sk->sk_callback_lock);
+- sock->sk->sk_user_data = queue;
+- queue->data_ready = sock->sk->sk_data_ready;
+- sock->sk->sk_data_ready = nvmet_tcp_data_ready;
+- queue->state_change = sock->sk->sk_state_change;
+- sock->sk->sk_state_change = nvmet_tcp_state_change;
+- queue->write_space = sock->sk->sk_write_space;
+- sock->sk->sk_write_space = nvmet_tcp_write_space;
++ if (sock->sk->sk_state != TCP_ESTABLISHED) {
++ /*
++ * If the socket is already closing, don't even start
++ * consuming it
++ */
++ ret = -ENOTCONN;
++ } else {
++ sock->sk->sk_user_data = queue;
++ queue->data_ready = sock->sk->sk_data_ready;
++ sock->sk->sk_data_ready = nvmet_tcp_data_ready;
++ queue->state_change = sock->sk->sk_state_change;
++ sock->sk->sk_state_change = nvmet_tcp_state_change;
++ queue->write_space = sock->sk->sk_write_space;
++ sock->sk->sk_write_space = nvmet_tcp_write_space;
++ queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);
++ }
+ write_unlock_bh(&sock->sk->sk_callback_lock);
+
+- return 0;
++ return ret;
+ }
+
+ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
+@@ -1543,8 +1553,6 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
+ if (ret)
+ goto out_destroy_sq;
+
+- queue_work_on(queue_cpu(queue), nvmet_tcp_wq, &queue->io_work);
+-
+ return 0;
+ out_destroy_sq:
+ mutex_lock(&nvmet_tcp_queue_mutex);
+--
+2.27.0
+
--- /dev/null
+From c50563408854b3e257541f4f2f79d2fe1232dd7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Feb 2021 15:00:01 -0800
+Subject: nvmet-tcp: fix receive data digest calculation for multiple h2cdata
+ PDUs
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit fda871c0ba5d2eed2cd1c881573168129da70058 ]
+
+When a host sends multiple h2cdata PDUs for a single command, we
+should verify the data digest calculation per PDU and not
+per command.
+
+Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
+Reported-by: Narayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
+Tested-by: Narayan Ayalasomayajula <Narayan.Ayalasomayajula@wdc.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 31 ++++++++++++++++++++++++-------
+ 1 file changed, 24 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index aacf06f0b4312..577ce7d403ae9 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -379,7 +379,7 @@ err:
+ return NVME_SC_INTERNAL;
+ }
+
+-static void nvmet_tcp_ddgst(struct ahash_request *hash,
++static void nvmet_tcp_send_ddgst(struct ahash_request *hash,
+ struct nvmet_tcp_cmd *cmd)
+ {
+ ahash_request_set_crypt(hash, cmd->req.sg,
+@@ -387,6 +387,23 @@ static void nvmet_tcp_ddgst(struct ahash_request *hash,
+ crypto_ahash_digest(hash);
+ }
+
++static void nvmet_tcp_recv_ddgst(struct ahash_request *hash,
++ struct nvmet_tcp_cmd *cmd)
++{
++ struct scatterlist sg;
++ struct kvec *iov;
++ int i;
++
++ crypto_ahash_init(hash);
++ for (i = 0, iov = cmd->iov; i < cmd->nr_mapped; i++, iov++) {
++ sg_init_one(&sg, iov->iov_base, iov->iov_len);
++ ahash_request_set_crypt(hash, &sg, NULL, iov->iov_len);
++ crypto_ahash_update(hash);
++ }
++ ahash_request_set_crypt(hash, NULL, (void *)&cmd->exp_ddgst, 0);
++ crypto_ahash_final(hash);
++}
++
+ static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd)
+ {
+ struct nvme_tcp_data_pdu *pdu = cmd->data_pdu;
+@@ -411,7 +428,7 @@ static void nvmet_setup_c2h_data_pdu(struct nvmet_tcp_cmd *cmd)
+
+ if (queue->data_digest) {
+ pdu->hdr.flags |= NVME_TCP_F_DDGST;
+- nvmet_tcp_ddgst(queue->snd_hash, cmd);
++ nvmet_tcp_send_ddgst(queue->snd_hash, cmd);
+ }
+
+ if (cmd->queue->hdr_digest) {
+@@ -1060,7 +1077,7 @@ static void nvmet_tcp_prep_recv_ddgst(struct nvmet_tcp_cmd *cmd)
+ {
+ struct nvmet_tcp_queue *queue = cmd->queue;
+
+- nvmet_tcp_ddgst(queue->rcv_hash, cmd);
++ nvmet_tcp_recv_ddgst(queue->rcv_hash, cmd);
+ queue->offset = 0;
+ queue->left = NVME_TCP_DIGEST_LENGTH;
+ queue->rcv_state = NVMET_TCP_RECV_DDGST;
+@@ -1081,14 +1098,14 @@ static int nvmet_tcp_try_recv_data(struct nvmet_tcp_queue *queue)
+ cmd->rbytes_done += ret;
+ }
+
++ if (queue->data_digest) {
++ nvmet_tcp_prep_recv_ddgst(cmd);
++ return 0;
++ }
+ nvmet_tcp_unmap_pdu_iovec(cmd);
+
+ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED) &&
+ cmd->rbytes_done == cmd->req.transfer_len) {
+- if (queue->data_digest) {
+- nvmet_tcp_prep_recv_ddgst(cmd);
+- return 0;
+- }
+ cmd->req.execute(&cmd->req);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 492a7b70baa790b5a6cb790c3aafcd097d0b076a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 15:29:19 -0600
+Subject: objtool: Fix ".cold" section suffix check for newer versions of GCC
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 34ca59e109bdf69704c33b8eeffaa4c9f71076e5 ]
+
+With my version of GCC 9.3.1 the ".cold" subfunctions no longer have a
+numbered suffix, so the trailing period is no longer there.
+
+Presumably this doesn't yet trigger a user-visible bug since most of the
+subfunction detection logic is duplicated. I only found it when
+testing vmlinux.o validation.
+
+Fixes: 54262aa28301 ("objtool: Fix sibling call detection")
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/ca0b5a57f08a2fbb48538dd915cc253b5edabb40.1611263461.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 48e22e3c6f186..dc24aac08edd6 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -850,8 +850,8 @@ static int add_jump_destinations(struct objtool_file *file)
+ * case where the parent function's only reference to a
+ * subfunction is through a jump table.
+ */
+- if (!strstr(insn->func->name, ".cold.") &&
+- strstr(insn->jump_dest->func->name, ".cold.")) {
++ if (!strstr(insn->func->name, ".cold") &&
++ strstr(insn->jump_dest->func->name, ".cold")) {
+ insn->func->cfunc = insn->jump_dest->func;
+ insn->jump_dest->func->pfunc = insn->func;
+
+--
+2.27.0
+
--- /dev/null
+From bfffc2ad2916a1c6db5fff9972c58fa9cccef97e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 15:29:17 -0600
+Subject: objtool: Fix error handling for STD/CLD warnings
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 6f567c9300a5ebd7b18c26dda1c8d6ffbdd0debd ]
+
+Actually return an error (and display a backtrace, if requested) for
+directional bit warnings.
+
+Fixes: 2f0f9e9ad7b3 ("objtool: Add Direction Flag validation")
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/dc70f2adbc72f09526f7cab5b6feb8bf7f6c5ad4.1611263461.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 4bd30315eb62b..2e154f00ccec2 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -2592,15 +2592,19 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
+ break;
+
+ case INSN_STD:
+- if (state.df)
++ if (state.df) {
+ WARN_FUNC("recursive STD", sec, insn->offset);
++ return 1;
++ }
+
+ state.df = true;
+ break;
+
+ case INSN_CLD:
+- if (!state.df && func)
++ if (!state.df && func) {
+ WARN_FUNC("redundant CLD", sec, insn->offset);
++ return 1;
++ }
+
+ state.df = false;
+ break;
+--
+2.27.0
+
--- /dev/null
+From cac84e9b4ef2caeb740ac08847d50f70272c1e4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 15:29:18 -0600
+Subject: objtool: Fix retpoline detection in asm code
+
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+
+[ Upstream commit 1f9a1b74942485a0a29e7c4a9a9f2fe8aea17766 ]
+
+The JMP_NOSPEC macro branches to __x86_retpoline_*() rather than the
+__x86_indirect_thunk_*() wrappers used by C code. Detect jumps to
+__x86_retpoline_*() as retpoline dynamic jumps.
+
+Presumably this doesn't trigger a user-visible bug. I only found it
+when testing vmlinux.o validation.
+
+Fixes: 39b735332cb8 ("objtool: Detect jumps to retpoline thunks")
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lore.kernel.org/r/31f5833e2e4f01e3d755889ac77e3661e906c09f.1611263461.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/arch/x86/special.c | 2 +-
+ tools/objtool/check.c | 3 ++-
+ tools/objtool/check.h | 11 +++++++++++
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/tools/objtool/arch/x86/special.c b/tools/objtool/arch/x86/special.c
+index fd4af88c0ea52..151b13d0a2676 100644
+--- a/tools/objtool/arch/x86/special.c
++++ b/tools/objtool/arch/x86/special.c
+@@ -48,7 +48,7 @@ bool arch_support_alt_relocation(struct special_alt *special_alt,
+ * replacement group.
+ */
+ return insn->offset == special_alt->new_off &&
+- (insn->type == INSN_CALL || is_static_jump(insn));
++ (insn->type == INSN_CALL || is_jump(insn));
+ }
+
+ /*
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 2e154f00ccec2..48e22e3c6f186 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -789,7 +789,8 @@ static int add_jump_destinations(struct objtool_file *file)
+ dest_sec = reloc->sym->sec;
+ dest_off = reloc->sym->sym.st_value +
+ arch_dest_reloc_offset(reloc->addend);
+- } else if (strstr(reloc->sym->name, "_indirect_thunk_")) {
++ } else if (!strncmp(reloc->sym->name, "__x86_indirect_thunk_", 21) ||
++ !strncmp(reloc->sym->name, "__x86_retpoline_", 16)) {
+ /*
+ * Retpoline jumps are really dynamic jumps in
+ * disguise, so convert them accordingly.
+diff --git a/tools/objtool/check.h b/tools/objtool/check.h
+index 5ec00a4b891b6..2804848e628e3 100644
+--- a/tools/objtool/check.h
++++ b/tools/objtool/check.h
+@@ -54,6 +54,17 @@ static inline bool is_static_jump(struct instruction *insn)
+ insn->type == INSN_JUMP_UNCONDITIONAL;
+ }
+
++static inline bool is_dynamic_jump(struct instruction *insn)
++{
++ return insn->type == INSN_JUMP_DYNAMIC ||
++ insn->type == INSN_JUMP_DYNAMIC_CONDITIONAL;
++}
++
++static inline bool is_jump(struct instruction *insn)
++{
++ return is_static_jump(insn) || is_dynamic_jump(insn);
++}
++
+ struct instruction *find_insn(struct objtool_file *file,
+ struct section *sec, unsigned long offset);
+
+--
+2.27.0
+
--- /dev/null
+From 94e3b0884f05c5d7579c916d42fd2354c7eb5fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Feb 2021 12:00:41 -0800
+Subject: ocfs2: fix a use after free on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit c57d117f2b2f2a19b570c36f2819ef8d8210af20 ]
+
+The error handling in this function frees "reg" but it is still on the
+"o2hb_all_regions" list so it will lead to a use after freew. Joseph Qi
+points out that we need to clear the bit in the "o2hb_region_bitmap" as
+well
+
+Link: https://lkml.kernel.org/r/YBk4M6HUG8jB/jc7@mwanda
+Fixes: 1cf257f51191 ("ocfs2: fix memory leak")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/cluster/heartbeat.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
+index 0179a73a3fa2c..12a7590601ddb 100644
+--- a/fs/ocfs2/cluster/heartbeat.c
++++ b/fs/ocfs2/cluster/heartbeat.c
+@@ -2042,7 +2042,7 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+ o2hb_nego_timeout_handler,
+ reg, NULL, ®->hr_handler_list);
+ if (ret)
+- goto free;
++ goto remove_item;
+
+ ret = o2net_register_handler(O2HB_NEGO_APPROVE_MSG, reg->hr_key,
+ sizeof(struct o2hb_nego_msg),
+@@ -2057,6 +2057,12 @@ static struct config_item *o2hb_heartbeat_group_make_item(struct config_group *g
+
+ unregister_handler:
+ o2net_unregister_handler_list(®->hr_handler_list);
++remove_item:
++ spin_lock(&o2hb_live_lock);
++ list_del(®->hr_all_item);
++ if (o2hb_global_heartbeat_active())
++ clear_bit(reg->hr_region_num, o2hb_region_bitmap);
++ spin_unlock(&o2hb_live_lock);
+ free:
+ kfree(reg);
+ return ERR_PTR(ret);
+--
+2.27.0
+
--- /dev/null
+From ba03296fe77e8240aa74ce0b031074c69478a8ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 12:56:32 +0300
+Subject: octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3a2eb515d1367c0f667b76089a6e727279c688b8 ]
+
+This code does not allocate enough memory for the NUL terminator so it
+ends up putting it one character beyond the end of the buffer.
+
+Fixes: 8756828a8148 ("octeontx2-af: Add NPA aura and pool contexts to debugfs")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+index d27543c1a166a..bb3fdaf337519 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+@@ -385,7 +385,7 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,
+ u16 pcifunc;
+ int ret, lf;
+
+- cmd_buf = memdup_user(buffer, count);
++ cmd_buf = memdup_user(buffer, count + 1);
+ if (IS_ERR(cmd_buf))
+ return -ENOMEM;
+
+--
+2.27.0
+
--- /dev/null
+From df0dc6b82ff53967e4a162cd9d7125da5eff8d68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 11:45:44 +0000
+Subject: of/fdt: Make sure no-map does not remove already reserved regions
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 8a5a75e5e9e55de1cef5d83ca3589cb4899193ef ]
+
+If the device tree is incorrectly configured, and attempts to
+define a "no-map" reserved memory that overlaps with the kernel
+data/code, the kernel would crash quickly after boot, with no
+obvious clue about the nature of the issue.
+
+For example, this would happen if we have the kernel mapped at
+these addresses (from /proc/iomem):
+40000000-41ffffff : System RAM
+ 40080000-40dfffff : Kernel code
+ 40e00000-411fffff : reserved
+ 41200000-413e0fff : Kernel data
+
+And we declare a no-map shared-dma-pool region at a fixed address
+within that range:
+mem_reserved: mem_region {
+ compatible = "shared-dma-pool";
+ reg = <0 0x40000000 0 0x01A00000>;
+ no-map;
+};
+
+To fix this, when removing memory regions at early boot (which is
+what "no-map" regions do), we need to make sure that the memory
+is not already reserved. If we do, __reserved_mem_reserve_reg
+will throw an error:
+[ 0.000000] OF: fdt: Reserved memory: failed to reserve memory
+ for node 'mem_region': base 0x0000000040000000, size 26 MiB
+and the code that will try to use the region should also fail,
+later on.
+
+We do not do anything for non-"no-map" regions, as memblock
+explicitly allows reserved regions to overlap, and the commit
+that this fixes removed the check for that precise reason.
+
+[ qperret: fixed conflicts caused by the usage of memblock_mark_nomap ]
+
+Fixes: 094cb98179f19b7 ("of/fdt: memblock_reserve /memreserve/ regions in the case of partial overlap")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Link: https://lore.kernel.org/r/20210115114544.1830068-3-qperret@google.com
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/fdt.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 427b534d60d2d..dcc1dd96911a9 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1146,8 +1146,16 @@ int __init __weak early_init_dt_mark_hotplug_memory_arch(u64 base, u64 size)
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ phys_addr_t size, bool nomap)
+ {
+- if (nomap)
++ if (nomap) {
++ /*
++ * If the memory is already reserved (by another region), we
++ * should not allow it to be marked nomap.
++ */
++ if (memblock_is_region_reserved(base, size))
++ return -EBUSY;
++
+ return memblock_mark_nomap(base, size);
++ }
+ return memblock_reserve(base, size);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 3dcd314bac8db02c347803803eec87e76cd74272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 03:55:15 +0300
+Subject: opp: Correct debug message in _opp_add_static_v2()
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit d7b9d9b31a3e55dcc9b5c289abfafe31efa5b5c4 ]
+
+The debug message always prints rate=0 instead of a proper value, fix it.
+
+Fixes: 6c591eec67cb ("OPP: Add helpers for reading the binding properties")
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Tested-by: Matt Merhar <mattmerhar@protonmail.com>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+[ Viresh: Added Fixes tag ]
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 03cb387236c4c..d0c0336be39b4 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -755,7 +755,6 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
+ struct device *dev, struct device_node *np)
+ {
+ struct dev_pm_opp *new_opp;
+- u64 rate = 0;
+ u32 val;
+ int ret;
+ bool rate_not_available = false;
+@@ -772,7 +771,8 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
+
+ /* Check if the OPP supports hardware's hierarchy of versions or not */
+ if (!_opp_is_supported(dev, opp_table, np)) {
+- dev_dbg(dev, "OPP not supported by hardware: %llu\n", rate);
++ dev_dbg(dev, "OPP not supported by hardware: %lu\n",
++ new_opp->rate);
+ goto free_opp;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 4a71620601a52cbf05de417a806e23ee730860c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 12:37:52 +0100
+Subject: optee: simplify i2c access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 67bc809752796acb2641ca343cad5b45eef31d7c ]
+
+Storing a bogus i2c_client structure on the stack adds overhead and
+causes a compile-time warning:
+
+drivers/tee/optee/rpc.c:493:6: error: stack frame size of 1056 bytes in function 'optee_handle_rpc' [-Werror,-Wframe-larger-than=]
+void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,
+
+Change the implementation of handle_rpc_func_cmd_i2c_transfer() to
+open-code the i2c_transfer() call, which makes it easier to read
+and avoids the warning.
+
+Fixes: c05210ab9757 ("drivers: optee: allow op-tee to access devices on the i2c bus")
+Tested-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/rpc.c | 31 ++++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/tee/optee/rpc.c b/drivers/tee/optee/rpc.c
+index 1e3614e4798f0..6cbb3643c6c48 100644
+--- a/drivers/tee/optee/rpc.c
++++ b/drivers/tee/optee/rpc.c
+@@ -54,8 +54,9 @@ bad:
+ static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
+ struct optee_msg_arg *arg)
+ {
+- struct i2c_client client = { 0 };
+ struct tee_param *params;
++ struct i2c_adapter *adapter;
++ struct i2c_msg msg = { };
+ size_t i;
+ int ret = -EOPNOTSUPP;
+ u8 attr[] = {
+@@ -85,48 +86,48 @@ static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
+ goto bad;
+ }
+
+- client.adapter = i2c_get_adapter(params[0].u.value.b);
+- if (!client.adapter)
++ adapter = i2c_get_adapter(params[0].u.value.b);
++ if (!adapter)
+ goto bad;
+
+ if (params[1].u.value.a & OPTEE_MSG_RPC_CMD_I2C_FLAGS_TEN_BIT) {
+- if (!i2c_check_functionality(client.adapter,
++ if (!i2c_check_functionality(adapter,
+ I2C_FUNC_10BIT_ADDR)) {
+- i2c_put_adapter(client.adapter);
++ i2c_put_adapter(adapter);
+ goto bad;
+ }
+
+- client.flags = I2C_CLIENT_TEN;
++ msg.flags = I2C_M_TEN;
+ }
+
+- client.addr = params[0].u.value.c;
+- snprintf(client.name, I2C_NAME_SIZE, "i2c%d", client.adapter->nr);
++ msg.addr = params[0].u.value.c;
++ msg.buf = params[2].u.memref.shm->kaddr;
++ msg.len = params[2].u.memref.size;
+
+ switch (params[0].u.value.a) {
+ case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD:
+- ret = i2c_master_recv(&client, params[2].u.memref.shm->kaddr,
+- params[2].u.memref.size);
++ msg.flags |= I2C_M_RD;
+ break;
+ case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR:
+- ret = i2c_master_send(&client, params[2].u.memref.shm->kaddr,
+- params[2].u.memref.size);
+ break;
+ default:
+- i2c_put_adapter(client.adapter);
++ i2c_put_adapter(adapter);
+ goto bad;
+ }
+
++ ret = i2c_transfer(adapter, &msg, 1);
++
+ if (ret < 0) {
+ arg->ret = TEEC_ERROR_COMMUNICATION;
+ } else {
+- params[3].u.value.a = ret;
++ params[3].u.value.a = msg.len;
+ if (optee_to_msg_param(arg->params, arg->num_params, params))
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ else
+ arg->ret = TEEC_SUCCESS;
+ }
+
+- i2c_put_adapter(client.adapter);
++ i2c_put_adapter(adapter);
+ kfree(params);
+ return;
+ bad:
+--
+2.27.0
+
--- /dev/null
+From 39b106d7e507cb0bafcc5fcec88a262e91f87235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 16:39:32 +0100
+Subject: PCI: Align checking of syscall user config accessors
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit ef9e4005cbaf022c6251263aa27836acccaef65d ]
+
+After 34e3207205ef ("PCI: handle positive error codes"),
+pci_user_read_config_*() and pci_user_write_config_*() return 0 or negative
+errno values, not PCIBIOS_* values like PCIBIOS_SUCCESSFUL or
+PCIBIOS_BAD_REGISTER_NUMBER.
+
+Remove comparisons with PCIBIOS_SUCCESSFUL and check only for non-zero. It
+happens that PCIBIOS_SUCCESSFUL is zero, so this is not a functional
+change, but it aligns this code with the user accessors.
+
+[bhelgaas: commit log]
+Fixes: 34e3207205ef ("PCI: handle positive error codes")
+Link: https://lore.kernel.org/r/f1220314-e518-1e18-bf94-8e6f8c703758@gmail.com
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/syscall.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
+index 31e39558d49d8..8b003c890b87b 100644
+--- a/drivers/pci/syscall.c
++++ b/drivers/pci/syscall.c
+@@ -20,7 +20,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ u16 word;
+ u32 dword;
+ long err;
+- long cfg_ret;
++ int cfg_ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+@@ -46,7 +46,7 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
+ }
+
+ err = -EIO;
+- if (cfg_ret != PCIBIOS_SUCCESSFUL)
++ if (cfg_ret)
+ goto error;
+
+ switch (len) {
+@@ -105,7 +105,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_byte(dev, off, byte);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+@@ -114,7 +114,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_word(dev, off, word);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+@@ -123,7 +123,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn,
+ if (err)
+ break;
+ err = pci_user_write_config_dword(dev, off, dword);
+- if (err != PCIBIOS_SUCCESSFUL)
++ if (err)
+ err = -EIO;
+ break;
+
+--
+2.27.0
+
--- /dev/null
+From 0fe17c86962dd2490cdb4487e58b5aa6f48c1ce2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 20:59:35 +0000
+Subject: PCI: cadence: Fix DMA range mapping early return error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Wilczyński <kw@linux.com>
+
+[ Upstream commit 1002573ee33efef0988a9a546c075a9fa37d2498 ]
+
+Function cdns_pcie_host_map_dma_ranges() iterates over a PCIe host bridge
+DMA ranges using the resource_list_for_each_entry() iterator, returning an
+error if cdns_pcie_host_bar_config() fails.
+
+49e427e6bdd1 ("Merge branch 'pci/host-probe-refactor'") botched a merge so
+it *always* returned after the first DMA range, even if no error occurred.
+
+Fix the error checking so we return early only when an error occurs.
+
+[bhelgaas: commit log]
+Fixes: 49e427e6bdd1 ("Merge branch 'pci/host-probe-refactor'")
+Link: https://lore.kernel.org/r/20210216205935.3112661-1-kw@linux.com
+Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 811c1cb2e8deb..1cb7cfc75d6e4 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -321,9 +321,10 @@ static int cdns_pcie_host_map_dma_ranges(struct cdns_pcie_rc *rc)
+
+ resource_list_for_each_entry(entry, &bridge->dma_ranges) {
+ err = cdns_pcie_host_bar_config(rc, entry);
+- if (err)
++ if (err) {
+ dev_err(dev, "Fail to configure IB using dma-ranges\n");
+- return err;
++ return err;
++ }
+ }
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 484ded3b33d5f4d386f77febf522d072fc371e0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 17:07:46 +0000
+Subject: PCI: pci-bridge-emul: Fix array overruns, improve safety
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit f8ee579d53aca887d93f5f411462f25c085a5106 ]
+
+We allow up to PCI_EXP_SLTSTA2 registers to be accessed, but the
+pcie_cap_regs_behavior[] array only covers up to PCI_EXP_RTSTA. Expand
+this array to avoid walking off the end of it.
+
+Do the same for pci_regs_behavior for consistency[], and add a
+BUILD_BUG_ON() to also check the bridge->conf structure size.
+
+Fixes: 23a5fba4d941 ("PCI: Introduce PCI bridge emulated config space common logic")
+Link: https://lore.kernel.org/r/E1l6z9W-0006Re-MQ@rmk-PC.armlinux.org.uk
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-bridge-emul.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c
+index 139869d50eb26..fdaf86a888b73 100644
+--- a/drivers/pci/pci-bridge-emul.c
++++ b/drivers/pci/pci-bridge-emul.c
+@@ -21,8 +21,9 @@
+ #include "pci-bridge-emul.h"
+
+ #define PCI_BRIDGE_CONF_END PCI_STD_HEADER_SIZEOF
++#define PCI_CAP_PCIE_SIZEOF (PCI_EXP_SLTSTA2 + 2)
+ #define PCI_CAP_PCIE_START PCI_BRIDGE_CONF_END
+-#define PCI_CAP_PCIE_END (PCI_CAP_PCIE_START + PCI_EXP_SLTSTA2 + 2)
++#define PCI_CAP_PCIE_END (PCI_CAP_PCIE_START + PCI_CAP_PCIE_SIZEOF)
+
+ /**
+ * struct pci_bridge_reg_behavior - register bits behaviors
+@@ -46,7 +47,8 @@ struct pci_bridge_reg_behavior {
+ u32 w1c;
+ };
+
+-static const struct pci_bridge_reg_behavior pci_regs_behavior[] = {
++static const
++struct pci_bridge_reg_behavior pci_regs_behavior[PCI_STD_HEADER_SIZEOF / 4] = {
+ [PCI_VENDOR_ID / 4] = { .ro = ~0 },
+ [PCI_COMMAND / 4] = {
+ .rw = (PCI_COMMAND_IO | PCI_COMMAND_MEMORY |
+@@ -164,7 +166,8 @@ static const struct pci_bridge_reg_behavior pci_regs_behavior[] = {
+ },
+ };
+
+-static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = {
++static const
++struct pci_bridge_reg_behavior pcie_cap_regs_behavior[PCI_CAP_PCIE_SIZEOF / 4] = {
+ [PCI_CAP_LIST_ID / 4] = {
+ /*
+ * Capability ID, Next Capability Pointer and
+@@ -260,6 +263,8 @@ static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = {
+ int pci_bridge_emul_init(struct pci_bridge_emul *bridge,
+ unsigned int flags)
+ {
++ BUILD_BUG_ON(sizeof(bridge->conf) != PCI_BRIDGE_CONF_END);
++
+ bridge->conf.class_revision |= cpu_to_le32(PCI_CLASS_BRIDGE_PCI << 16);
+ bridge->conf.header_type = PCI_HEADER_TYPE_BRIDGE;
+ bridge->conf.cache_line_size = 0x10;
+--
+2.27.0
+
--- /dev/null
+From 7a3588f43659b0adc6cacac8808a5647d8a84cb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 14:04:31 +0200
+Subject: PCI: rcar: Always allocate MSI addresses in 32bit space
+
+From: Marek Vasut <marek.vasut+renesas@gmail.com>
+
+[ Upstream commit c4e0fec2f7ee013dbf86445394ff47f719408f99 ]
+
+This fixes MSI operation on legacy PCI cards, which cannot issue 64bit MSIs.
+The R-Car controller only has one MSI trigger address instead of two, one
+for 64bit and one for 32bit MSI, set the address to 32bit PCIe space so that
+legacy PCI cards can also trigger MSIs.
+
+Link: https://lore.kernel.org/r/20201016120431.7062-1-marek.vasut@gmail.com
+Fixes: 290c1fb35860 ("PCI: rcar: Add MSI support for PCIe")
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Wolfram Sang <wsa@the-dreams.de>
+Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Cc: linux-renesas-soc@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rcar-host.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
+index 4d1c4b24e5370..a728e8f9ad3c8 100644
+--- a/drivers/pci/controller/pcie-rcar-host.c
++++ b/drivers/pci/controller/pcie-rcar-host.c
+@@ -735,7 +735,7 @@ static int rcar_pcie_enable_msi(struct rcar_pcie_host *host)
+ }
+
+ /* setup MSI data target */
+- msi->pages = __get_free_pages(GFP_KERNEL, 0);
++ msi->pages = __get_free_pages(GFP_KERNEL | GFP_DMA32, 0);
+ rcar_pcie_hw_enable_msi(host);
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 6b46332b247679d99057ea023976cafc41418f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 00:23:18 +0800
+Subject: PCI: rockchip: Make 'ep-gpios' DT property optional
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 58adbfb3ebec460e8b58875c682bafd866808e80 ]
+
+The Rockchip PCIe controller DT binding clearly states that 'ep-gpios' is
+an optional property. And indeed there are boards that don't require it.
+
+Make the driver follow the binding by using devm_gpiod_get_optional()
+instead of devm_gpiod_get().
+
+[bhelgaas: tidy whitespace]
+Link: https://lore.kernel.org/r/20210121162321.4538-2-wens@kernel.org
+Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
+Fixes: 956cd99b35a8 ("PCI: rockchip: Separate common code from RC driver")
+Fixes: 964bac9455be ("PCI: rockchip: Split out rockchip_pcie_parse_dt() to parse DT")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rockchip.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
+index 904dec0d3a88f..990a00e08bc5b 100644
+--- a/drivers/pci/controller/pcie-rockchip.c
++++ b/drivers/pci/controller/pcie-rockchip.c
+@@ -82,7 +82,7 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
+ }
+
+ rockchip->mgmt_sticky_rst = devm_reset_control_get_exclusive(dev,
+- "mgmt-sticky");
++ "mgmt-sticky");
+ if (IS_ERR(rockchip->mgmt_sticky_rst)) {
+ if (PTR_ERR(rockchip->mgmt_sticky_rst) != -EPROBE_DEFER)
+ dev_err(dev, "missing mgmt-sticky reset property in node\n");
+@@ -118,11 +118,11 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
+ }
+
+ if (rockchip->is_rc) {
+- rockchip->ep_gpio = devm_gpiod_get(dev, "ep", GPIOD_OUT_HIGH);
+- if (IS_ERR(rockchip->ep_gpio)) {
+- dev_err(dev, "missing ep-gpios property in node\n");
+- return PTR_ERR(rockchip->ep_gpio);
+- }
++ rockchip->ep_gpio = devm_gpiod_get_optional(dev, "ep",
++ GPIOD_OUT_HIGH);
++ if (IS_ERR(rockchip->ep_gpio))
++ return dev_err_probe(dev, PTR_ERR(rockchip->ep_gpio),
++ "failed to get ep GPIO\n");
+ }
+
+ rockchip->aclk_pcie = devm_clk_get(dev, "aclk");
+--
+2.27.0
+
--- /dev/null
+From aceec711a7991cbe67b00bd8c3dcc8831aebf131 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 06:37:45 -0800
+Subject: PCI: xilinx-cpm: Fix reference count leak on error path
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit ae191d2e513ae5274224777ae67018a584074a28 ]
+
+Also drop the reference count of the node on error path.
+
+Link: https://lore.kernel.org/r/20210120143745.699-1-bianpan2016@163.com
+Fixes: 508f610648b9 ("PCI: xilinx-cpm: Add Versal CPM Root Port driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-xilinx-cpm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/controller/pcie-xilinx-cpm.c b/drivers/pci/controller/pcie-xilinx-cpm.c
+index f92e0152e65e3..67937facd90cd 100644
+--- a/drivers/pci/controller/pcie-xilinx-cpm.c
++++ b/drivers/pci/controller/pcie-xilinx-cpm.c
+@@ -404,6 +404,7 @@ static int xilinx_cpm_pcie_init_irq_domain(struct xilinx_cpm_pcie_port *port)
+ return 0;
+ out:
+ xilinx_cpm_free_irq_domains(port);
++ of_node_put(pcie_intc_node);
+ dev_err(dev, "Failed to allocate IRQ domains\n");
+
+ return -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 89b556dd59fe17a9839f92e8936fa59d89bcb584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 13:12:43 +0000
+Subject: perf/arm-cmn: Fix PMU instance naming
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 79d7c3dca99fa96033695ddf5d495b775a3a137b ]
+
+Although it's neat to avoid the suffix for the typical case of a
+single PMU, it means systems with multiple CMN instances end up with
+inconsistent naming. I think it also breaks perf tool's "uncore alias"
+logic if the common instance prefix is also the full name of one.
+
+Avoid any surprises by not trying to be clever and simply numbering
+every instance, even when it might technically prove redundant.
+
+Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/649a2281233f193d59240b13ed91b57337c77b32.1611839564.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/perf/arm-cmn.rst | 2 +-
+ drivers/perf/arm-cmn.c | 13 ++++---------
+ 2 files changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/Documentation/admin-guide/perf/arm-cmn.rst b/Documentation/admin-guide/perf/arm-cmn.rst
+index 0e48093460140..796e25b7027b2 100644
+--- a/Documentation/admin-guide/perf/arm-cmn.rst
++++ b/Documentation/admin-guide/perf/arm-cmn.rst
+@@ -17,7 +17,7 @@ PMU events
+ ----------
+
+ The PMU driver registers a single PMU device for the whole interconnect,
+-see /sys/bus/event_source/devices/arm_cmn. Multi-chip systems may link
++see /sys/bus/event_source/devices/arm_cmn_0. Multi-chip systems may link
+ more than one CMN together via external CCIX links - in this situation,
+ each mesh counts its own events entirely independently, and additional
+ PMU devices will be named arm_cmn_{1..n}.
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index a76ff594f3ca4..f3071b5ddaaef 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -1502,7 +1502,7 @@ static int arm_cmn_probe(struct platform_device *pdev)
+ struct arm_cmn *cmn;
+ const char *name;
+ static atomic_t id;
+- int err, rootnode, this_id;
++ int err, rootnode;
+
+ cmn = devm_kzalloc(&pdev->dev, sizeof(*cmn), GFP_KERNEL);
+ if (!cmn)
+@@ -1549,14 +1549,9 @@ static int arm_cmn_probe(struct platform_device *pdev)
+ .cancel_txn = arm_cmn_end_txn,
+ };
+
+- this_id = atomic_fetch_inc(&id);
+- if (this_id == 0) {
+- name = "arm_cmn";
+- } else {
+- name = devm_kasprintf(cmn->dev, GFP_KERNEL, "arm_cmn_%d", this_id);
+- if (!name)
+- return -ENOMEM;
+- }
++ name = devm_kasprintf(cmn->dev, GFP_KERNEL, "arm_cmn_%d", atomic_fetch_inc(&id));
++ if (!name)
++ return -ENOMEM;
+
+ err = cpuhp_state_add_instance(arm_cmn_hp_state, &cmn->cpuhp_node);
+ if (err)
+--
+2.27.0
+
--- /dev/null
+From 079d296f044f79484c370897569bbbf2e65650e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 13:12:44 +0000
+Subject: perf/arm-cmn: Move IRQs when migrating context
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 1c8147ea89c883d1f4e20f1b1d9c879291430102 ]
+
+If we migrate the PMU context to another CPU, we need to remember to
+retarget the IRQs as well.
+
+Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/e080640aea4ed8dfa870b8549dfb31221803eb6b.1611839564.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index f3071b5ddaaef..46defb1dcf867 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -1150,7 +1150,7 @@ static int arm_cmn_commit_txn(struct pmu *pmu)
+ static int arm_cmn_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node)
+ {
+ struct arm_cmn *cmn;
+- unsigned int target;
++ unsigned int i, target;
+
+ cmn = hlist_entry_safe(node, struct arm_cmn, cpuhp_node);
+ if (cpu != cmn->cpu)
+@@ -1161,6 +1161,8 @@ static int arm_cmn_pmu_offline_cpu(unsigned int cpu, struct hlist_node *node)
+ return 0;
+
+ perf_pmu_migrate_context(&cmn->pmu, cpu, target);
++ for (i = 0; i < cmn->num_dtcs; i++)
++ irq_set_affinity_hint(cmn->dtc[i].irq, cpumask_of(target));
+ cmn->cpu = target;
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 92e011b45193fc87b7045b20a7bc6cf38e414d7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:53:49 +0200
+Subject: perf intel-pt: Fix IPC with CYC threshold
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 6af4b60033e0ce0332fcdf256c965ad41942821a ]
+
+The code assumed every CYC-eligible packet has a CYC packet, which is not
+the case when CYC thresholds are used. Fix by checking if a CYC packet is
+actually present in that case.
+
+Fixes: 5b1dc0fd1da06 ("perf intel-pt: Add support for samples to contain IPC ratio")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20210205175350.23817-4-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/intel-pt-decoder/intel-pt-decoder.c | 27 +++++++++++++++++++
+ .../util/intel-pt-decoder/intel-pt-decoder.h | 1 +
+ tools/perf/util/intel-pt.c | 13 +++++++++
+ 3 files changed, 41 insertions(+)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index ef29f6b25e60a..197eb58a39cb7 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -24,6 +24,13 @@
+ #include "intel-pt-decoder.h"
+ #include "intel-pt-log.h"
+
++#define BITULL(x) (1ULL << (x))
++
++/* IA32_RTIT_CTL MSR bits */
++#define INTEL_PT_CYC_ENABLE BITULL(1)
++#define INTEL_PT_CYC_THRESHOLD (BITULL(22) | BITULL(21) | BITULL(20) | BITULL(19))
++#define INTEL_PT_CYC_THRESHOLD_SHIFT 19
++
+ #define INTEL_PT_BLK_SIZE 1024
+
+ #define BIT63 (((uint64_t)1 << 63))
+@@ -167,6 +174,8 @@ struct intel_pt_decoder {
+ uint64_t sample_tot_cyc_cnt;
+ uint64_t base_cyc_cnt;
+ uint64_t cyc_cnt_timestamp;
++ uint64_t ctl;
++ uint64_t cyc_threshold;
+ double tsc_to_cyc;
+ bool continuous_period;
+ bool overflow;
+@@ -204,6 +213,14 @@ static uint64_t intel_pt_lower_power_of_2(uint64_t x)
+ return x << i;
+ }
+
++static uint64_t intel_pt_cyc_threshold(uint64_t ctl)
++{
++ if (!(ctl & INTEL_PT_CYC_ENABLE))
++ return 0;
++
++ return (ctl & INTEL_PT_CYC_THRESHOLD) >> INTEL_PT_CYC_THRESHOLD_SHIFT;
++}
++
+ static void intel_pt_setup_period(struct intel_pt_decoder *decoder)
+ {
+ if (decoder->period_type == INTEL_PT_PERIOD_TICKS) {
+@@ -245,12 +262,15 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
+
+ decoder->flags = params->flags;
+
++ decoder->ctl = params->ctl;
+ decoder->period = params->period;
+ decoder->period_type = params->period_type;
+
+ decoder->max_non_turbo_ratio = params->max_non_turbo_ratio;
+ decoder->max_non_turbo_ratio_fp = params->max_non_turbo_ratio;
+
++ decoder->cyc_threshold = intel_pt_cyc_threshold(decoder->ctl);
++
+ intel_pt_setup_period(decoder);
+
+ decoder->mtc_shift = params->mtc_period;
+@@ -2017,6 +2037,7 @@ static int intel_pt_hop_trace(struct intel_pt_decoder *decoder, bool *no_tip, in
+
+ static int intel_pt_walk_trace(struct intel_pt_decoder *decoder)
+ {
++ int last_packet_type = INTEL_PT_PAD;
+ bool no_tip = false;
+ int err;
+
+@@ -2025,6 +2046,12 @@ static int intel_pt_walk_trace(struct intel_pt_decoder *decoder)
+ if (err)
+ return err;
+ next:
++ if (decoder->cyc_threshold) {
++ if (decoder->sample_cyc && last_packet_type != INTEL_PT_CYC)
++ decoder->sample_cyc = false;
++ last_packet_type = decoder->packet.type;
++ }
++
+ if (decoder->hop) {
+ switch (intel_pt_hop_trace(decoder, &no_tip, &err)) {
+ case HOP_IGNORE:
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+index b52937b03c8c8..48adaa78acfc2 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+@@ -244,6 +244,7 @@ struct intel_pt_params {
+ void *data;
+ bool return_compression;
+ bool branch_enable;
++ uint64_t ctl;
+ uint64_t period;
+ enum intel_pt_period_type period_type;
+ unsigned max_non_turbo_ratio;
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index d6d93ee030190..2fff6f760457f 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -893,6 +893,18 @@ static bool intel_pt_sampling_mode(struct intel_pt *pt)
+ return false;
+ }
+
++static u64 intel_pt_ctl(struct intel_pt *pt)
++{
++ struct evsel *evsel;
++ u64 config;
++
++ evlist__for_each_entry(pt->session->evlist, evsel) {
++ if (intel_pt_get_config(pt, &evsel->core.attr, &config))
++ return config;
++ }
++ return 0;
++}
++
+ static u64 intel_pt_ns_to_ticks(const struct intel_pt *pt, u64 ns)
+ {
+ u64 quot, rem;
+@@ -1026,6 +1038,7 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct intel_pt *pt,
+ params.data = ptq;
+ params.return_compression = intel_pt_return_compression(pt);
+ params.branch_enable = intel_pt_branch_enable(pt);
++ params.ctl = intel_pt_ctl(pt);
+ params.max_non_turbo_ratio = pt->max_non_turbo_ratio;
+ params.mtc_period = intel_pt_mtc_period(pt);
+ params.tsc_ctc_ratio_n = pt->tsc_ctc_ratio_n;
+--
+2.27.0
+
--- /dev/null
+From 105599b633d7dbb0afc042e7aa457143d18bb63b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:53:47 +0200
+Subject: perf intel-pt: Fix missing CYC processing in PSB
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 03fb0f859b45d1eb05c984ab4bd3bef67e45ede2 ]
+
+Add missing CYC packet processing when walking through PSB+. This
+improves the accuracy of timestamps that follow PSB+, until the next
+MTC.
+
+Fixes: 3d49807870f08 ("perf tools: Add new Intel PT packet definitions")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20210205175350.23817-2-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 697513f351549..91cba05827369 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1761,6 +1761,9 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder)
+ break;
+
+ case INTEL_PT_CYC:
++ intel_pt_calc_cyc_timestamp(decoder);
++ break;
++
+ case INTEL_PT_VMCS:
+ case INTEL_PT_MNT:
+ case INTEL_PT_PAD:
+--
+2.27.0
+
--- /dev/null
+From 38776027432152f6ab61142328dc9eb23afeba46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:53:48 +0200
+Subject: perf intel-pt: Fix premature IPC
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+[ Upstream commit 20aa39708a5999b7921b27482a756766272286ac ]
+
+The code assumed a change in cycle count means accurate IPC. That is not
+correct, for example when sampling both branches and instructions, or at
+a FUP packet (which is not CYC-eligible) address. Fix by using an explicit
+flag to indicate when IPC can be sampled.
+
+Fixes: 5b1dc0fd1da06 ("perf intel-pt: Add support for samples to contain IPC ratio")
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20210205175350.23817-3-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../util/intel-pt-decoder/intel-pt-decoder.c | 11 ++++++++++-
+ .../util/intel-pt-decoder/intel-pt-decoder.h | 1 +
+ tools/perf/util/intel-pt.c | 16 ++++++----------
+ 3 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 91cba05827369..ef29f6b25e60a 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -2814,9 +2814,18 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ }
+ if (intel_pt_sample_time(decoder->pkt_state)) {
+ intel_pt_update_sample_time(decoder);
+- if (decoder->sample_cyc)
++ if (decoder->sample_cyc) {
+ decoder->sample_tot_cyc_cnt = decoder->tot_cyc_cnt;
++ decoder->state.flags |= INTEL_PT_SAMPLE_IPC;
++ decoder->sample_cyc = false;
++ }
+ }
++ /*
++ * When using only TSC/MTC to compute cycles, IPC can be
++ * sampled as soon as the cycle count changes.
++ */
++ if (!decoder->have_cyc)
++ decoder->state.flags |= INTEL_PT_SAMPLE_IPC;
+ }
+
+ decoder->state.timestamp = decoder->sample_timestamp;
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+index 8645fc2654811..b52937b03c8c8 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h
+@@ -17,6 +17,7 @@
+ #define INTEL_PT_ABORT_TX (1 << 1)
+ #define INTEL_PT_ASYNC (1 << 2)
+ #define INTEL_PT_FUP_IP (1 << 3)
++#define INTEL_PT_SAMPLE_IPC (1 << 4)
+
+ enum intel_pt_sample_type {
+ INTEL_PT_BRANCH = 1 << 0,
+diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
+index 60214de42f31b..d6d93ee030190 100644
+--- a/tools/perf/util/intel-pt.c
++++ b/tools/perf/util/intel-pt.c
+@@ -1381,7 +1381,8 @@ static int intel_pt_synth_branch_sample(struct intel_pt_queue *ptq)
+ sample.branch_stack = (struct branch_stack *)&dummy_bs;
+ }
+
+- sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_br_cyc_cnt;
++ if (ptq->state->flags & INTEL_PT_SAMPLE_IPC)
++ sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_br_cyc_cnt;
+ if (sample.cyc_cnt) {
+ sample.insn_cnt = ptq->ipc_insn_cnt - ptq->last_br_insn_cnt;
+ ptq->last_br_insn_cnt = ptq->ipc_insn_cnt;
+@@ -1431,7 +1432,8 @@ static int intel_pt_synth_instruction_sample(struct intel_pt_queue *ptq)
+ else
+ sample.period = ptq->state->tot_insn_cnt - ptq->last_insn_cnt;
+
+- sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_in_cyc_cnt;
++ if (ptq->state->flags & INTEL_PT_SAMPLE_IPC)
++ sample.cyc_cnt = ptq->ipc_cyc_cnt - ptq->last_in_cyc_cnt;
+ if (sample.cyc_cnt) {
+ sample.insn_cnt = ptq->ipc_insn_cnt - ptq->last_in_insn_cnt;
+ ptq->last_in_insn_cnt = ptq->ipc_insn_cnt;
+@@ -1966,14 +1968,8 @@ static int intel_pt_sample(struct intel_pt_queue *ptq)
+
+ ptq->have_sample = false;
+
+- if (ptq->state->tot_cyc_cnt > ptq->ipc_cyc_cnt) {
+- /*
+- * Cycle count and instruction count only go together to create
+- * a valid IPC ratio when the cycle count changes.
+- */
+- ptq->ipc_insn_cnt = ptq->state->tot_insn_cnt;
+- ptq->ipc_cyc_cnt = ptq->state->tot_cyc_cnt;
+- }
++ ptq->ipc_insn_cnt = ptq->state->tot_insn_cnt;
++ ptq->ipc_cyc_cnt = ptq->state->tot_cyc_cnt;
+
+ /*
+ * Do PEBS first to allow for the possibility that the PEBS timestamp
+--
+2.27.0
+
--- /dev/null
+From bd7179e5212069b839329871e0506468edc08a57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 14:50:01 +0800
+Subject: perf record: Fix continue profiling after draining the buffer
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit e16c2ce7c5ed5de881066c1fd10ba5c09af69559 ]
+
+Commit da231338ec9c0987 ("perf record: Use an eventfd to wakeup when
+done") uses eventfd() to solve a rare race where the setting and
+checking of 'done' which add done_fd to pollfd. When draining buffer,
+revents of done_fd is 0 and evlist__filter_pollfd function returns a
+non-zero value. As a result, perf record does not stop profiling.
+
+The following simple scenarios can trigger this condition:
+
+ # sleep 10 &
+ # perf record -p $!
+
+After the sleep process exits, perf record should stop profiling and exit.
+However, perf record keeps running.
+
+If pollfd revents contains only POLLERR or POLLHUP, perf record
+indicates that buffer is draining and need to stop profiling. Use
+fdarray_flag__nonfilterable() to set done eventfd to nonfilterable
+objects, so that evlist__filter_pollfd() does not filter and check done
+eventfd.
+
+Fixes: da231338ec9c0987 ("perf record: Use an eventfd to wakeup when done")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Tested-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: zhangjinhao2@huawei.com
+Link: http://lore.kernel.org/lkml/20210205065001.23252-1-yangjihong1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 2 +-
+ tools/perf/util/evlist.c | 8 ++++++++
+ tools/perf/util/evlist.h | 4 ++++
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index fd39116506123..51e593e896ea5 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -1663,7 +1663,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
+ status = -1;
+ goto out_delete_session;
+ }
+- err = evlist__add_pollfd(rec->evlist, done_fd);
++ err = evlist__add_wakeup_eventfd(rec->evlist, done_fd);
+ if (err < 0) {
+ pr_err("Failed to add wakeup eventfd to poll list\n");
+ status = err;
+diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
+index 05363a7247c41..fea4c1e8010d9 100644
+--- a/tools/perf/util/evlist.c
++++ b/tools/perf/util/evlist.c
+@@ -572,6 +572,14 @@ int evlist__filter_pollfd(struct evlist *evlist, short revents_and_mask)
+ return perf_evlist__filter_pollfd(&evlist->core, revents_and_mask);
+ }
+
++#ifdef HAVE_EVENTFD_SUPPORT
++int evlist__add_wakeup_eventfd(struct evlist *evlist, int fd)
++{
++ return perf_evlist__add_pollfd(&evlist->core, fd, NULL, POLLIN,
++ fdarray_flag__nonfilterable);
++}
++#endif
++
+ int evlist__poll(struct evlist *evlist, int timeout)
+ {
+ return perf_evlist__poll(&evlist->core, timeout);
+diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
+index 1aae75895dea0..6d4d62151bc89 100644
+--- a/tools/perf/util/evlist.h
++++ b/tools/perf/util/evlist.h
+@@ -142,6 +142,10 @@ struct evsel *evlist__find_tracepoint_by_name(struct evlist *evlist, const char
+ int evlist__add_pollfd(struct evlist *evlist, int fd);
+ int evlist__filter_pollfd(struct evlist *evlist, short revents_and_mask);
+
++#ifdef HAVE_EVENTFD_SUPPORT
++int evlist__add_wakeup_eventfd(struct evlist *evlist, int fd);
++#endif
++
+ int evlist__poll(struct evlist *evlist, int timeout);
+
+ struct evsel *evlist__id2evsel(struct evlist *evlist, u64 id);
+--
+2.27.0
+
--- /dev/null
+From 35b7a36cb04e0e34414baa13d96b211110e997d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 14:18:02 -0500
+Subject: perf symbols: Fix return value when loading PE DSO
+
+From: Nicholas Fraser <nfraser@codeweavers.com>
+
+[ Upstream commit 77771a97011fa9146ccfaf2983a3a2885dc57b6f ]
+
+The first time dso__load() was called on a PE file it always returned -1
+error. This caused the first call to map__find_symbol() to always fail
+on a PE file so the first sample from each PE file always had symbol
+<unknown>. Subsequent samples succeed however because the DSO is already
+loaded.
+
+This fixes dso__load() to return 0 when successfully loading a DSO with
+libbfd.
+
+Fixes: eac9a4342e5447ca ("perf symbols: Try reading the symbol table with libbfd")
+Signed-off-by: Nicholas Fraser <nfraser@codeweavers.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Frank Ch. Eigler <fche@redhat.com>
+Cc: Huw Davies <huw@codeweavers.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kim Phillips <kim.phillips@amd.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Remi Bernon <rbernon@codeweavers.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Tommi Rantala <tommi.t.rantala@nokia.com>
+Cc: Ulrich Czekalla <uczekalla@codeweavers.com>
+Link: http://lore.kernel.org/lkml/1671b43b-09c3-1911-dbf8-7f030242fbf7@codeweavers.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 1645fb4ec9ed4..7dcf3327c5f7d 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1866,8 +1866,10 @@ int dso__load(struct dso *dso, struct map *map)
+ if (nsexit)
+ nsinfo__mountns_enter(dso->nsinfo, &nsc);
+
+- if (bfdrc == 0)
++ if (bfdrc == 0) {
++ ret = 0;
+ break;
++ }
+
+ if (!is_reg || sirc < 0)
+ continue;
+--
+2.27.0
+
--- /dev/null
+From 547c374cd95782f5eae5c8aa2c02eb2a8b1ce1ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 14:51:48 +0000
+Subject: perf symbols: Use (long) for iterator for bfd symbols
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit 96de68fff5ded8833bf5832658cb43c54f86ff6c ]
+
+GCC (GCC) 8.4.0 20200304 fails to build perf with:
+: util/symbol.c: In function 'dso__load_bfd_symbols':
+: util/symbol.c:1626:16: error: comparison of integer expressions of different signednes
+: for (i = 0; i < symbols_count; ++i) {
+: ^
+: util/symbol.c:1632:16: error: comparison of integer expressions of different signednes
+: while (i + 1 < symbols_count &&
+: ^
+: util/symbol.c:1637:13: error: comparison of integer expressions of different signednes
+: if (i + 1 < symbols_count &&
+: ^
+: cc1: all warnings being treated as errors
+
+It's unlikely that the symtable will be that big, but the fix is an
+oneliner and as perf has CORE_CFLAGS += -Wextra, which makes build to
+fail together with CORE_CFLAGS += -Werror
+
+Fixes: eac9a4342e54 ("perf symbols: Try reading the symbol table with libbfd")
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Dmitry Safonov <0x7f454c46@gmail.com>
+Cc: Jacek Caban <jacek@codeweavers.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Remi Bernon <rbernon@codeweavers.com>
+Link: http://lore.kernel.org/lkml/20210209145148.178702-1-dima@arista.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/symbol.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 64a039cbba1b5..1645fb4ec9ed4 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1561,12 +1561,11 @@ static int bfd2elf_binding(asymbol *symbol)
+ int dso__load_bfd_symbols(struct dso *dso, const char *debugfile)
+ {
+ int err = -1;
+- long symbols_size, symbols_count;
++ long symbols_size, symbols_count, i;
+ asection *section;
+ asymbol **symbols, *sym;
+ struct symbol *symbol;
+ bfd *abfd;
+- u_int i;
+ u64 start, len;
+
+ abfd = bfd_openr(dso->long_name, NULL);
+--
+2.27.0
+
--- /dev/null
+From 4b3d8238998eb47b1fcf2db05e4a720d314a97ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Feb 2021 18:16:38 +0900
+Subject: perf test: Fix unaligned access in sample parsing test
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit c5c97cadd7ed13381cb6b4bef5c841a66938d350 ]
+
+The ubsan reported the following error. It was because sample's raw
+data missed u32 padding at the end. So it broke the alignment of the
+array after it.
+
+The raw data contains an u32 size prefix so the data size should have
+an u32 padding after 8-byte aligned data.
+
+27: Sample parsing :util/synthetic-events.c:1539:4:
+ runtime error: store to misaligned address 0x62100006b9bc for type
+ '__u64' (aka 'unsigned long long'), which requires 8 byte alignment
+0x62100006b9bc: note: pointer points here
+ 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
+ ^
+ #0 0x561532a9fc96 in perf_event__synthesize_sample util/synthetic-events.c:1539:13
+ #1 0x5615327f4a4f in do_test tests/sample-parsing.c:284:8
+ #2 0x5615327f3f50 in test__sample_parsing tests/sample-parsing.c:381:9
+ #3 0x56153279d3a1 in run_test tests/builtin-test.c:424:9
+ #4 0x56153279c836 in test_and_print tests/builtin-test.c:454:9
+ #5 0x56153279b7eb in __cmd_test tests/builtin-test.c:675:4
+ #6 0x56153279abf0 in cmd_test tests/builtin-test.c:821:9
+ #7 0x56153264e796 in run_builtin perf.c:312:11
+ #8 0x56153264cf03 in handle_internal_command perf.c:364:8
+ #9 0x56153264e47d in run_argv perf.c:408:2
+ #10 0x56153264c9a9 in main perf.c:538:3
+ #11 0x7f137ab6fbbc in __libc_start_main (/lib64/libc.so.6+0x38bbc)
+ #12 0x561532596828 in _start ...
+
+SUMMARY: UndefinedBehaviorSanitizer: misaligned-pointer-use
+ util/synthetic-events.c:1539:4 in
+
+Fixes: 045f8cd8542d ("perf tests: Add a sample parsing test")
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Link: https://lore.kernel.org/r/20210214091638.519643-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/tests/sample-parsing.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/tests/sample-parsing.c b/tools/perf/tests/sample-parsing.c
+index 2393916f6128a..92869eea5dbd4 100644
+--- a/tools/perf/tests/sample-parsing.c
++++ b/tools/perf/tests/sample-parsing.c
+@@ -196,7 +196,7 @@ static int do_test(u64 sample_type, u64 sample_regs, u64 read_format)
+ .data = {1, -1ULL, 211, 212, 213},
+ };
+ u64 regs[64];
+- const u64 raw_data[] = {0x123456780a0b0c0dULL, 0x1102030405060708ULL};
++ const u32 raw_data[] = {0x12345678, 0x0a0b0c0d, 0x11020304, 0x05060708, 0 };
+ const u64 data[] = {0x2211443366558877ULL, 0, 0xaabbccddeeff4321ULL};
+ const u64 aux_data[] = {0xa55a, 0, 0xeeddee, 0x0282028202820282};
+ struct perf_sample sample = {
+--
+2.27.0
+
--- /dev/null
+From e5c27fa4cf6ca4670a2e6d3e9f3dd214db6a7c60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 09:52:47 -0300
+Subject: perf tools: Fix DSO filtering when not finding a map for a sampled
+ address
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit c69bf11ad3d30b6bf01cfa538ddff1a59467c734 ]
+
+When we lookup an address and don't find a map we should filter that
+sample if the user specified a list of --dso entries to filter on, fix
+it.
+
+Before:
+
+ $ perf script
+ sleep 274800 2843.556162: 1 cycles:u: ffffffffbb26bff4 [unknown] ([unknown])
+ sleep 274800 2843.556168: 1 cycles:u: ffffffffbb2b047d [unknown] ([unknown])
+ sleep 274800 2843.556171: 1 cycles:u: ffffffffbb2706b2 [unknown] ([unknown])
+ sleep 274800 2843.556174: 6 cycles:u: ffffffffbb2b0267 [unknown] ([unknown])
+ sleep 274800 2843.556176: 59 cycles:u: ffffffffbb2b03b1 [unknown] ([unknown])
+ sleep 274800 2843.556180: 691 cycles:u: ffffffffbb26bff4 [unknown] ([unknown])
+ sleep 274800 2843.556189: 9160 cycles:u: 7fa9550eeaa3 __GI___tunables_init+0xf3 (/usr/lib64/ld-2.32.so)
+ sleep 274800 2843.556312: 86937 cycles:u: 7fa9550e157b _dl_lookup_symbol_x+0x4b (/usr/lib64/ld-2.32.so)
+ $
+
+So we have some samples we somehow didn't find in a map for, if we now
+do:
+
+ $ perf report --stdio --dso /usr/lib64/ld-2.32.so
+ # dso: /usr/lib64/ld-2.32.so
+ #
+ # Total Lost Samples: 0
+ #
+ # Samples: 8 of event 'cycles:u'
+ # Event count (approx.): 96856
+ #
+ # Overhead Command Symbol
+ # ........ ....... ........................
+ #
+ 89.76% sleep [.] _dl_lookup_symbol_x
+ 9.46% sleep [.] __GI___tunables_init
+ 0.71% sleep [k] 0xffffffffbb26bff4
+ 0.06% sleep [k] 0xffffffffbb2b03b1
+ 0.01% sleep [k] 0xffffffffbb2b0267
+ 0.00% sleep [k] 0xffffffffbb2706b2
+ 0.00% sleep [k] 0xffffffffbb2b047d
+ $
+
+After this patch we get the right output with just entries for the DSOs
+specified in --dso:
+
+ $ perf report --stdio --dso /usr/lib64/ld-2.32.so
+ # dso: /usr/lib64/ld-2.32.so
+ #
+ # Total Lost Samples: 0
+ #
+ # Samples: 8 of event 'cycles:u'
+ # Event count (approx.): 96856
+ #
+ # Overhead Command Symbol
+ # ........ ....... ........................
+ #
+ 89.76% sleep [.] _dl_lookup_symbol_x
+ 9.46% sleep [.] __GI___tunables_init
+ $
+ #
+
+Fixes: 96415e4d3f5fdf9c ("perf symbols: Avoid unnecessary symbol loading when dso list is specified")
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jin Yao <yao.jin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/20210128131209.GD775562@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/event.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 05616d4138a96..7e440fa90c938 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -673,6 +673,8 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
+ }
+
+ al->sym = map__find_symbol(al->map, al->addr);
++ } else if (symbol_conf.dso_list) {
++ al->filtered |= (1 << HIST_FILTER__DSO);
+ }
+
+ if (symbol_conf.sym_list) {
+--
+2.27.0
+
--- /dev/null
+From 463e8b428d3c0609d5e2fd631c3861f6d5193498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 16:56:54 +0000
+Subject: perf unwind: Set userdata for all __report_module() paths
+
+From: Dave Rigby <d.rigby@me.com>
+
+[ Upstream commit 4e1481445407b86a483616c4542ffdc810efb680 ]
+
+When locating the DWARF module for a given address, __find_debuginfo()
+requires a 'struct dso' passed via the userdata argument.
+
+However, this field is only set in __report_module() if the module is
+found in via dwfl_addrmodule(), not if it is found later via
+dwfl_report_elf().
+
+Set userdata irrespective of how the DWARF module was found, as long as
+we found a module.
+
+Fixes: bf53fc6b5f41 ("perf unwind: Fix separate debug info files when using elfutils' libdw's unwinder")
+Signed-off-by: Dave Rigby <d.rigby@me.com>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=211801
+Acked-by: Jan Kratochvil <jan.kratochvil@redhat.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/linux-perf-users/20210218165654.36604-1-d.rigby@me.com/
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/unwind-libdw.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 0ada907c60d49..a74b517f74974 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -60,10 +60,8 @@ static int __report_module(struct addr_location *al, u64 ip,
+ mod = dwfl_addrmodule(ui->dwfl, ip);
+ if (mod) {
+ Dwarf_Addr s;
+- void **userdatap;
+
+- dwfl_module_info(mod, &userdatap, &s, NULL, NULL, NULL, NULL, NULL);
+- *userdatap = dso;
++ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
+ if (s != al->map->start - al->map->pgoff)
+ mod = 0;
+ }
+@@ -79,6 +77,13 @@ static int __report_module(struct addr_location *al, u64 ip,
+ al->map->start - al->map->pgoff, false);
+ }
+
++ if (mod) {
++ void **userdatap;
++
++ dwfl_module_info(mod, &userdatap, NULL, NULL, NULL, NULL, NULL, NULL);
++ *userdatap = dso;
++ }
++
+ return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From cd481a11cc29a4f6a8c6aa47dbb2158f1a807bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 20:00:33 +0800
+Subject: perf vendor events arm64: Fix Ampere eMag event typo
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 2bf797be81fa808f05f1a7a65916619132256a27 ]
+
+The "briefdescription" for event 0x35 has a typo - fix it.
+
+Fixes: d35c595bf005 ("perf vendor events arm64: Revise core JSON events for eMAG")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Acked-by: Will Deacon <will@kernel.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
+Cc: Nakamura, Shunsuke/中村 俊介 <nakamura.shun@fujitsu.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linuxarm@openeuler.org
+Link: https://lore.kernel.org/r/1611835236-34696-2-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json b/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
+index 40010a8724b3a..ce6e7e7960579 100644
+--- a/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
++++ b/tools/perf/pmu-events/arch/arm64/ampere/emag/cache.json
+@@ -114,7 +114,7 @@
+ "PublicDescription": "Level 2 access to instruciton TLB that caused a page table walk. This event counts on any instruciton access which causes L2I_TLB_REFILL to count",
+ "EventCode": "0x35",
+ "EventName": "L2I_TLB_ACCESS",
+- "BriefDescription": "L2D TLB access"
++ "BriefDescription": "L2I TLB access"
+ },
+ {
+ "PublicDescription": "Branch target buffer misprediction",
+--
+2.27.0
+
--- /dev/null
+From 73d391321b14b736d8d0d706debeac2dfc134bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 14:04:59 +0300
+Subject: phy: cadence-torrent: Fix error code in cdns_torrent_phy_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 266df28f9ac16b0dff553d78bc3fb1c084b96b9d ]
+
+This error path should return -EINVAL, but currently it returns
+success.
+
+Fixes: d09945eacad0 ("phy: cadence-torrent: Check total lane count for all subnodes is within limit")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9s7Wxq+b6ls0q7o@mwanda
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/phy-cadence-torrent.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/cadence/phy-cadence-torrent.c b/drivers/phy/cadence/phy-cadence-torrent.c
+index f310e15d94cbc..591a15834b48f 100644
+--- a/drivers/phy/cadence/phy-cadence-torrent.c
++++ b/drivers/phy/cadence/phy-cadence-torrent.c
+@@ -2298,6 +2298,7 @@ static int cdns_torrent_phy_probe(struct platform_device *pdev)
+
+ if (total_num_lanes > MAX_NUM_LANES) {
+ dev_err(dev, "Invalid lane configuration\n");
++ ret = -EINVAL;
+ goto put_lnk_rst;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From a878f56c71ac22da232aa15653f845cfed06607c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Dec 2020 16:04:54 +0800
+Subject: phy: rockchip-emmc: emmc_phy_init() always return 0
+
+From: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+
+[ Upstream commit 39961bd6b70e5a5d7c4b5483ad8e1db6b5765c60 ]
+
+rockchip_emmc_phy_init() return variable is not set with the error value
+if clk_get() failed. 'emmcclk' is optional, thus use clk_get_optional()
+and if the return value != NULL make error processing and set the
+return code accordingly.
+
+Fixes: 52c0624a10cce phy: rockchip-emmc: Set phyctrl_frqsel based on card clock
+Signed-off-by: Chris Ruehl <chris.ruehl@gtsys.com.hk>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20201210080454.17379-1-chris.ruehl@gtsys.com.hk
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-emmc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-emmc.c b/drivers/phy/rockchip/phy-rockchip-emmc.c
+index 1e424f263e7ab..496d199852aff 100644
+--- a/drivers/phy/rockchip/phy-rockchip-emmc.c
++++ b/drivers/phy/rockchip/phy-rockchip-emmc.c
+@@ -248,15 +248,17 @@ static int rockchip_emmc_phy_init(struct phy *phy)
+ * - SDHCI driver to get the PHY
+ * - SDHCI driver to init the PHY
+ *
+- * The clock is optional, so upon any error we just set to NULL.
++ * The clock is optional, using clk_get_optional() to get the clock
++ * and do error processing if the return value != NULL
+ *
+ * NOTE: we don't do anything special for EPROBE_DEFER here. Given the
+ * above expected use case, EPROBE_DEFER isn't sensible to expect, so
+ * it's just like any other error.
+ */
+- rk_phy->emmcclk = clk_get(&phy->dev, "emmcclk");
++ rk_phy->emmcclk = clk_get_optional(&phy->dev, "emmcclk");
+ if (IS_ERR(rk_phy->emmcclk)) {
+- dev_dbg(&phy->dev, "Error getting emmcclk: %d\n", ret);
++ ret = PTR_ERR(rk_phy->emmcclk);
++ dev_err(&phy->dev, "Error getting emmcclk: %d\n", ret);
+ rk_phy->emmcclk = NULL;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From fe78605b29c99b3dd9912086ee3588a036d383f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jan 2021 14:17:53 +0100
+Subject: phy: USB_LGM_PHY should depend on X86
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6b46e60a6943d629d69924be3169d8f214624ab2 ]
+
+The Intel Lightning Mountain (LGM) USB3 USB is only present on Intel
+Lightning Mountain SoCs. Hence add a dependency on X86, to prevent
+asking the user about this driver when configuring a kernel without
+Intel Lightning Mountain platform support.
+
+Fixes: 1cce8f73a561c944 ("phy: Add USB3 PHY support for Intel LGM SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210129131753.2656306-1-geert+renesas@glider.be
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
+index 00dabe5fab8a0..68d9c2f6a5caf 100644
+--- a/drivers/phy/Kconfig
++++ b/drivers/phy/Kconfig
+@@ -52,6 +52,7 @@ config PHY_XGENE
+ config USB_LGM_PHY
+ tristate "INTEL Lightning Mountain USB PHY Driver"
+ depends on USB_SUPPORT
++ depends on X86 || COMPILE_TEST
+ select USB_PHY
+ select REGULATOR
+ select REGULATOR_FIXED_VOLTAGE
+--
+2.27.0
+
--- /dev/null
+From 2e0cd06e1878b1a81aca313932c90573cba39672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 22:03:55 +0000
+Subject: platform/chrome: cros_ec_proto: Add LID and BATTERY to default mask
+
+From: Evan Benn <evanbenn@chromium.org>
+
+[ Upstream commit 852405d8efcbca0e02f14592fb1d1dcd0d3fb508 ]
+
+After 'platform/chrome: cros_ec_proto: Use EC_HOST_EVENT_MASK not BIT'
+some of the flags are not quite correct.
+LID_CLOSED is used to suspend the device, so it makes sense to ignore that.
+BATTERY events are also frequent and causing spurious wakes on elm/hana
+mt8173 devices.
+
+Fixes: c214e564acb2 ("platform/chrome: cros_ec_proto: ignore unnecessary wakeups on old ECs")
+Signed-off-by: Evan Benn <evanbenn@chromium.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20201209220306.2.I3291bf83e4884c206b097ede34780e014fa3e265@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_proto.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index 3ad60190e11c6..aa7f7aa772971 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -526,9 +526,11 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev)
+ * power), not wake up.
+ */
+ ec_dev->host_event_wake_mask = U32_MAX &
+- ~(EC_HOST_EVENT_MASK(EC_HOST_EVENT_AC_DISCONNECTED) |
++ ~(EC_HOST_EVENT_MASK(EC_HOST_EVENT_LID_CLOSED) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_AC_DISCONNECTED) |
+ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_LOW) |
+ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_CRITICAL) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY) |
+ EC_HOST_EVENT_MASK(EC_HOST_EVENT_PD_MCU) |
+ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_STATUS));
+ /*
+--
+2.27.0
+
--- /dev/null
+From eeda4085bb28280ed9de7d7060139b732b7b4802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 22:03:54 +0000
+Subject: platform/chrome: cros_ec_proto: Use EC_HOST_EVENT_MASK not BIT
+
+From: Evan Benn <evanbenn@chromium.org>
+
+[ Upstream commit 0944ea07baa748741563c8842122010fa9017d16 ]
+
+The host_event_code enum is 1-based, use EC_HOST_EVENT_MASK not BIT to
+generate the intended mask. This patch changes the behaviour of the
+mask, a following patch will restore the intended behaviour:
+'Add LID and BATTERY to default mask'
+
+Fixes: c214e564acb2 ("platform/chrome: cros_ec_proto: ignore unnecessary wakeups on old ECs")
+Signed-off-by: Evan Benn <evanbenn@chromium.org>
+Reviewed-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20201209220306.1.I6133572c0ab3c6b95426f804bac2d3833e24acb1@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_proto.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index 7c92a6e22d75d..3ad60190e11c6 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -526,11 +526,11 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev)
+ * power), not wake up.
+ */
+ ec_dev->host_event_wake_mask = U32_MAX &
+- ~(BIT(EC_HOST_EVENT_AC_DISCONNECTED) |
+- BIT(EC_HOST_EVENT_BATTERY_LOW) |
+- BIT(EC_HOST_EVENT_BATTERY_CRITICAL) |
+- BIT(EC_HOST_EVENT_PD_MCU) |
+- BIT(EC_HOST_EVENT_BATTERY_STATUS));
++ ~(EC_HOST_EVENT_MASK(EC_HOST_EVENT_AC_DISCONNECTED) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_LOW) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_CRITICAL) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_PD_MCU) |
++ EC_HOST_EVENT_MASK(EC_HOST_EVENT_BATTERY_STATUS));
+ /*
+ * Old ECs may not support this command. Complain about all
+ * other errors.
+--
+2.27.0
+
--- /dev/null
+From c54a956b56488875af5d8428b1549f3de6cea32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 12:55:06 -0800
+Subject: platform/x86: intel_pmt: Make INTEL_PMT_CLASS non-user-selectable
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit 35d8a973fe4d38afee944db636c3d2b1df3741a7 ]
+
+Fix error in Kconfig that exposed INTEL_PMT_CLASS as a user selectable
+option. It is already selected by INTEL_PMT_TELEMETRY and
+INTEL_PMT_CRASHLOG which are user selectable.
+
+Fixes: e2729113ce66 ("platform/x86: Intel PMT class driver")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20210126205508.30907-1-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 91e6176cdfbdf..af75c3342c061 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -1369,7 +1369,7 @@ config INTEL_PMC_CORE
+ - MPHY/PLL gating status (Sunrisepoint PCH only)
+
+ config INTEL_PMT_CLASS
+- tristate "Intel Platform Monitoring Technology (PMT) Class driver"
++ tristate
+ help
+ The Intel Platform Monitoring Technology (PMT) class driver provides
+ the basic sysfs interface and file hierarchy uses by PMT devices.
+--
+2.27.0
+
--- /dev/null
+From 8cfe59fe8cf081a9b3d93b6ba14d6ad2b8607daf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 12:55:08 -0800
+Subject: platform/x86: intel_pmt_crashlog: Add dependency on MFD_INTEL_PMT
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit fdd3feb37e36bec2ad75d76f8ac4d0273c5c0a91 ]
+
+All devices that expose Intel Platform Monitoring Technology (PMT)
+crashlog are currently owned by the intel_pmt MFD driver. Therefore make
+the crashlog driver depend on the MFD driver for build.
+
+Fixes: 5ef9998c96b0 ("platform/x86: Intel PMT Crashlog capability driver")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20210126205508.30907-3-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 9948c5f4928d4..ac4125ec06603 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -1394,6 +1394,7 @@ config INTEL_PMT_TELEMETRY
+
+ config INTEL_PMT_CRASHLOG
+ tristate "Intel Platform Monitoring Technology (PMT) Crashlog driver"
++ depends on MFD_INTEL_PMT
+ select INTEL_PMT_CLASS
+ help
+ The Intel Platform Monitoring Technology (PMT) crashlog driver provides
+--
+2.27.0
+
--- /dev/null
+From 225e46adf5781202bd712ea50c0a661f9db6a308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 12:55:07 -0800
+Subject: platform/x86: intel_pmt_telemetry: Add dependency on MFD_INTEL_PMT
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit f3f6da5014dea3cc005b36948abe3664b5d1f7d3 ]
+
+All devices that expose Intel Platform Monitoring Technology (PMT)
+telemetry are currently owned by the intel_pmt MFD driver. Therefore make
+the telemetry driver depend on the MFD driver for build.
+
+Fixes: 68fe8e6e2c4b ("platform/x86: Intel PMT Telemetry capability driver")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Link: https://lore.kernel.org/r/20210126205508.30907-2-david.e.box@linux.intel.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index af75c3342c061..9948c5f4928d4 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -1382,6 +1382,7 @@ config INTEL_PMT_CLASS
+
+ config INTEL_PMT_TELEMETRY
+ tristate "Intel Platform Monitoring Technology (PMT) Telemetry driver"
++ depends on MFD_INTEL_PMT
+ select INTEL_PMT_CLASS
+ help
+ The Intel Platform Monitory Technology (PMT) Telemetry driver provides
+--
+2.27.0
+
--- /dev/null
+From e2c70b10b4393276b4043abeb04d6ff62878ab11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 14:57:31 +0200
+Subject: power: reset: at91-sama5d2_shdwc: fix wkupdbc mask
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 95aa21a3f1183260db1b0395e03df5bebc5ed641 ]
+
+According to datasheet WKUPDBC mask is b/w bits 26..24.
+
+Fixes: f80cb48843987 ("power: reset: at91-shdwc: add new shutdown controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/reset/at91-sama5d2_shdwc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/reset/at91-sama5d2_shdwc.c b/drivers/power/reset/at91-sama5d2_shdwc.c
+index 2fe3a627cb535..d9cf91e5b06d0 100644
+--- a/drivers/power/reset/at91-sama5d2_shdwc.c
++++ b/drivers/power/reset/at91-sama5d2_shdwc.c
+@@ -37,7 +37,7 @@
+
+ #define AT91_SHDW_MR 0x04 /* Shut Down Mode Register */
+ #define AT91_SHDW_WKUPDBC_SHIFT 24
+-#define AT91_SHDW_WKUPDBC_MASK GENMASK(31, 16)
++#define AT91_SHDW_WKUPDBC_MASK GENMASK(26, 24)
+ #define AT91_SHDW_WKUPDBC(x) (((x) << AT91_SHDW_WKUPDBC_SHIFT) \
+ & AT91_SHDW_WKUPDBC_MASK)
+
+--
+2.27.0
+
--- /dev/null
+From eea3f1fd4387c9f0b5415c37a0585a7160ba2f64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 09:24:21 -0600
+Subject: power: supply: axp20x_usb_power: Init work before enabling IRQs
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit b5e8642ed95ff6ecc20cc6038fe831affa9d098c ]
+
+The IRQ handler calls mod_delayed_work() on power->vbus_detect. However,
+that work item is not initialized until after the IRQs are enabled. If
+an IRQ is already pending when the driver is probed, the driver calls
+mod_delayed_work() on an uninitialized work item, which causes an oops.
+
+Fixes: bcfb7ae3f50b ("power: supply: axp20x_usb_power: Only poll while offline")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp20x_usb_power.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/axp20x_usb_power.c b/drivers/power/supply/axp20x_usb_power.c
+index 70b28b699a80c..8933ae26c3d69 100644
+--- a/drivers/power/supply/axp20x_usb_power.c
++++ b/drivers/power/supply/axp20x_usb_power.c
+@@ -593,6 +593,7 @@ static int axp20x_usb_power_probe(struct platform_device *pdev)
+ power->axp20x_id = axp_data->axp20x_id;
+ power->regmap = axp20x->regmap;
+ power->num_irqs = axp_data->num_irq_names;
++ INIT_DELAYED_WORK(&power->vbus_detect, axp20x_usb_power_poll_vbus);
+
+ if (power->axp20x_id == AXP202_ID) {
+ /* Enable vbus valid checking */
+@@ -645,7 +646,6 @@ static int axp20x_usb_power_probe(struct platform_device *pdev)
+ }
+ }
+
+- INIT_DELAYED_WORK(&power->vbus_detect, axp20x_usb_power_poll_vbus);
+ if (axp20x_usb_vbus_needs_polling(power))
+ queue_delayed_work(system_power_efficient_wq, &power->vbus_detect, 0);
+
+--
+2.27.0
+
--- /dev/null
+From a7b5851d7099d181a1e1c46211dc7d0aa7be2778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 12:19:11 +0200
+Subject: power: supply: cpcap: Add missing IRQF_ONESHOT to fix regression
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e62333e26be649bfc3c167b9f2bbca38b92332c5 ]
+
+Commit 25d76fed7ffe ("phy: cpcap-usb: Use IRQF_ONESHOT") started causing
+errors loading phy-cpcap-usb driver:
+
+cpcap_battery cpcap_battery.0: failed to register power supply
+genirq: Flags mismatch irq 211. 00002080 (se0conn) vs. 00000080 (se0conn)
+cpcap-usb-phy cpcap-usb-phy.0: could not get irq se0conn: -16
+
+Let's fix this by adding the missing IRQF_ONESHOT to also cpcap-battery
+and cpcap-charger drivers.
+
+Fixes: 25d76fed7ffe ("phy: cpcap-usb: Use IRQF_ONESHOT")
+Reported-by: Merlijn Wajer <merlijn@wizzup.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-battery.c | 2 +-
+ drivers/power/supply/cpcap-charger.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index 295611b3b15e9..7a974b5bd9dd1 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -666,7 +666,7 @@ static int cpcap_battery_init_irq(struct platform_device *pdev,
+
+ error = devm_request_threaded_irq(ddata->dev, irq, NULL,
+ cpcap_battery_irq_thread,
+- IRQF_SHARED,
++ IRQF_SHARED | IRQF_ONESHOT,
+ name, ddata);
+ if (error) {
+ dev_err(ddata->dev, "could not get irq %s: %i\n",
+diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c
+index c0d452e3dc8b0..804ac7f84c301 100644
+--- a/drivers/power/supply/cpcap-charger.c
++++ b/drivers/power/supply/cpcap-charger.c
+@@ -708,7 +708,7 @@ static int cpcap_usb_init_irq(struct platform_device *pdev,
+
+ error = devm_request_threaded_irq(ddata->dev, irq, NULL,
+ cpcap_charger_irq_thread,
+- IRQF_SHARED,
++ IRQF_SHARED | IRQF_ONESHOT,
+ name, ddata);
+ if (error) {
+ dev_err(ddata->dev, "could not get irq %s: %i\n",
+--
+2.27.0
+
--- /dev/null
+From 94f81256e2d5d4e17e229c10095116dc9d5f25a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 21:53:50 +0200
+Subject: power: supply: cpcap-battery: Fix missing power_supply_put()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 97456a24acb41b74ab6910f40fb8f09b206fd3b5 ]
+
+Fix missing power_supply_put().
+
+Cc: Arthur Demchenkov <spinal.by@gmail.com>
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Fixes: 8b0134cc14b9 ("power: supply: cpcap-battery: Fix handling of lowered charger voltage")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-battery.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index 7a974b5bd9dd1..cebc5c8fda1b5 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -561,17 +561,21 @@ static int cpcap_battery_update_charger(struct cpcap_battery_ddata *ddata,
+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE,
+ &prop);
+ if (error)
+- return error;
++ goto out_put;
+
+ /* Allow charger const voltage lower than battery const voltage */
+ if (const_charge_voltage > prop.intval)
+- return 0;
++ goto out_put;
+
+ val.intval = const_charge_voltage;
+
+- return power_supply_set_property(charger,
++ error = power_supply_set_property(charger,
+ POWER_SUPPLY_PROP_CONSTANT_CHARGE_VOLTAGE,
+ &val);
++out_put:
++ power_supply_put(charger);
++
++ return error;
+ }
+
+ static int cpcap_battery_set_property(struct power_supply *psy,
+--
+2.27.0
+
--- /dev/null
+From 7411de8a7633524af159042561d3c96cecaf4b86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Jan 2021 21:53:49 +0200
+Subject: power: supply: cpcap-charger: Fix missing power_supply_put()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4bff91bb3231882b530af794c92ac3a5fe199481 ]
+
+Fix missing power_supply_put().
+
+Cc: Arthur Demchenkov <spinal.by@gmail.com>
+Cc: Carl Philipp Klemm <philipp@uvos.xyz>
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Fixes: 5688ea049233 ("power: supply: cpcap-charger: Allow changing constant charge voltage")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-charger.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c
+index 804ac7f84c301..2c5f2246c6eaa 100644
+--- a/drivers/power/supply/cpcap-charger.c
++++ b/drivers/power/supply/cpcap-charger.c
+@@ -302,6 +302,7 @@ cpcap_charger_get_bat_const_charge_voltage(struct cpcap_charger_ddata *ddata)
+ if (!error)
+ voltage = prop.intval;
+ }
++ power_supply_put(battery);
+
+ return voltage;
+ }
+--
+2.27.0
+
--- /dev/null
+From 6fd1a1ed06d7f0a1ea1b5c91a965b9d063c5a7e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:15:24 +0000
+Subject: power: supply: cpcap-charger: Fix power_supply_put on null battery
+ pointer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 39196cfe10dd2b46ee28b44abbc0db4f4cb7822f ]
+
+Currently if the pointer battery is null there is a null pointer
+dereference on the call to power_supply_put. Fix this by only
+performing the put if battery is not null.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 4bff91bb3231 ("power: supply: cpcap-charger: Fix missing power_supply_put()")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-charger.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c
+index 2c5f2246c6eaa..22fff01425d63 100644
+--- a/drivers/power/supply/cpcap-charger.c
++++ b/drivers/power/supply/cpcap-charger.c
+@@ -301,8 +301,9 @@ cpcap_charger_get_bat_const_charge_voltage(struct cpcap_charger_ddata *ddata)
+ &prop);
+ if (!error)
+ voltage = prop.intval;
++
++ power_supply_put(battery);
+ }
+- power_supply_put(battery);
+
+ return voltage;
+ }
+--
+2.27.0
+
--- /dev/null
+From 90d867db6536e4ffc9804fa7bbc6b5411d83c09d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Jan 2021 13:13:10 -0800
+Subject: power: supply: fix sbs-charger build, needs REGMAP_I2C
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a4bdea2004b28f47ab48ea99172eda8628f6fb44 ]
+
+CHARGER_SBS should select REGMAP_I2C since it uses API(s) that are
+provided by that Kconfig symbol.
+
+Fixes these errors:
+
+../drivers/power/supply/sbs-charger.c:149:21: error: variable ‘sbs_regmap’ has initializer but incomplete type
+ static const struct regmap_config sbs_regmap = {
+../drivers/power/supply/sbs-charger.c:150:3: error: ‘const struct regmap_config’ has no member named ‘reg_bits’
+ .reg_bits = 8,
+../drivers/power/supply/sbs-charger.c:155:23: error: ‘REGMAP_ENDIAN_LITTLE’ undeclared here (not in a function)
+ .val_format_endian = REGMAP_ENDIAN_LITTLE, /* since based on SMBus */
+../drivers/power/supply/sbs-charger.c: In function ‘sbs_probe’:
+../drivers/power/supply/sbs-charger.c:183:17: error: implicit declaration of function ‘devm_regmap_init_i2c’; did you mean ‘devm_request_irq’? [-Werror=implicit-function-declaration]
+ chip->regmap = devm_regmap_init_i2c(client, &sbs_regmap);
+../drivers/power/supply/sbs-charger.c: At top level:
+../drivers/power/supply/sbs-charger.c:149:35: error: storage size of ‘sbs_regmap’ isn’t known
+ static const struct regmap_config sbs_regmap = {
+
+Fixes: feb583e37f8a ("power: supply: add sbs-charger driver")
+Reported-by: Martin Mokrejs <mmokrejs@fold.natur.cuni.cz>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Martin Mokrejs <mmokrejs@fold.natur.cuni.cz>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig
+index eec646c568b7b..1699b9269a78e 100644
+--- a/drivers/power/supply/Kconfig
++++ b/drivers/power/supply/Kconfig
+@@ -229,6 +229,7 @@ config BATTERY_SBS
+ config CHARGER_SBS
+ tristate "SBS Compliant charger"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ Say Y to include support for SBS compliant battery chargers.
+
+--
+2.27.0
+
--- /dev/null
+From 548f6a46fc85415a4347c9a3fa33fd97de388697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 22:17:34 +0300
+Subject: power: supply: smb347-charger: Fix interrupt usage if interrupt is
+ unavailable
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 6996312642d2dad3070c3d276c7621f35e721f30 ]
+
+The IRQ=0 could be a valid interrupt number in kernel because interrupt
+numbers are virtual in a modern kernel. Hence fix the interrupt usage in
+a case if interrupt is unavailable by not overriding the interrupt number
+which is used by the driver.
+
+Note that currently Nexus 7 is the only know device which uses SMB347
+kernel diver and it has a properly working interrupt, hence this patch
+doesn't fix any real problems, it's a minor cleanup/improvement.
+
+Fixes: 99298de5df92 ("power: supply: smb347-charger: Replace mutex with IRQ disable/enable")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/smb347-charger.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c
+index d3bf35ed12cee..8cfbd8d6b4786 100644
+--- a/drivers/power/supply/smb347-charger.c
++++ b/drivers/power/supply/smb347-charger.c
+@@ -137,6 +137,7 @@
+ * @mains_online: is AC/DC input connected
+ * @usb_online: is USB input connected
+ * @charging_enabled: is charging enabled
++ * @irq_unsupported: is interrupt unsupported by SMB hardware
+ * @max_charge_current: maximum current (in uA) the battery can be charged
+ * @max_charge_voltage: maximum voltage (in uV) the battery can be charged
+ * @pre_charge_current: current (in uA) to use in pre-charging phase
+@@ -193,6 +194,7 @@ struct smb347_charger {
+ bool mains_online;
+ bool usb_online;
+ bool charging_enabled;
++ bool irq_unsupported;
+
+ unsigned int max_charge_current;
+ unsigned int max_charge_voltage;
+@@ -862,6 +864,9 @@ static int smb347_irq_set(struct smb347_charger *smb, bool enable)
+ {
+ int ret;
+
++ if (smb->irq_unsupported)
++ return 0;
++
+ ret = smb347_set_writable(smb, true);
+ if (ret < 0)
+ return ret;
+@@ -923,8 +928,6 @@ static int smb347_irq_init(struct smb347_charger *smb,
+ ret = regmap_update_bits(smb->regmap, CFG_STAT,
+ CFG_STAT_ACTIVE_HIGH | CFG_STAT_DISABLED,
+ CFG_STAT_DISABLED);
+- if (ret < 0)
+- client->irq = 0;
+
+ smb347_set_writable(smb, false);
+
+@@ -1345,6 +1348,7 @@ static int smb347_probe(struct i2c_client *client,
+ if (ret < 0) {
+ dev_warn(dev, "failed to initialize IRQ: %d\n", ret);
+ dev_warn(dev, "disabling IRQ support\n");
++ smb->irq_unsupported = true;
+ } else {
+ smb347_irq_enable(smb);
+ }
+@@ -1357,8 +1361,8 @@ static int smb347_remove(struct i2c_client *client)
+ {
+ struct smb347_charger *smb = i2c_get_clientdata(client);
+
+- if (client->irq)
+- smb347_irq_disable(smb);
++ smb347_irq_disable(smb);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From e93b83ad9644f6391c35af9c1cc74f99f783836e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 07:49:13 +0000
+Subject: powerpc/47x: Disable 256k page size
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 910a0cb6d259736a0c86e795d4c2f42af8d0d775 ]
+
+PPC47x_TLBE_SIZE isn't defined for 256k pages, leading to a build
+break if 256k pages is selected.
+
+So change the kconfig so that 256k pages can't be selected for 47x.
+
+Fixes: e7f75ad01d59 ("powerpc/47x: Base ppc476 support")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+[mpe: Expand change log to mention build break]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/2fed79b1154c872194f98bac4422c23918325e61.1611128938.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 107bb4319e0e0..a685e42d39932 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -772,7 +772,7 @@ config PPC_64K_PAGES
+
+ config PPC_256K_PAGES
+ bool "256k page size"
+- depends on 44x && !STDBINUTILS
++ depends on 44x && !STDBINUTILS && !PPC_47x
+ help
+ Make the page size 256k.
+
+--
+2.27.0
+
--- /dev/null
+From 297e4f9bbc5a7c000f858cb5e57a1aa62b0afc17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 08:56:13 +0000
+Subject: powerpc/8xx: Fix software emulation interrupt
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 903178d0ce6bb30ef80a3604ab9ee2b57869fbc9 ]
+
+For unimplemented instructions or unimplemented SPRs, the 8xx triggers
+a "Software Emulation Exception" (0x1000). That interrupt doesn't set
+reason bits in SRR1 as the "Program Check Exception" does.
+
+Go through emulation_assist_interrupt() to set REASON_ILLEGAL.
+
+Fixes: fbbcc3bb139e ("powerpc/8xx: Remove SoftwareEmulation()")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ad782af87a222efc79cfb06079b0fd23d4224eaf.1612515180.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_8xx.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 52702f3db6df6..9eb63cf6ac38e 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -165,7 +165,7 @@ SystemCall:
+ /* On the MPC8xx, this is a software emulation interrupt. It occurs
+ * for all unimplemented and illegal instructions.
+ */
+- EXCEPTION(0x1000, SoftEmu, program_check_exception, EXC_XFER_STD)
++ EXCEPTION(0x1000, SoftEmu, emulation_assist_interrupt, EXC_XFER_STD)
+
+ . = 0x1100
+ /*
+--
+2.27.0
+
--- /dev/null
+From e72c6aaeda4a3c9836070aa942548bd449081bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 14:28:38 +0100
+Subject: powerpc: Fix build error in paravirt.h
+
+From: Michal Suchanek <msuchanek@suse.de>
+
+[ Upstream commit 9899a56f1eca964cd0de21008a9fa1523a571231 ]
+
+./arch/powerpc/include/asm/paravirt.h:83:44: error: implicit declaration
+of function 'smp_processor_id'; did you mean 'raw_smp_processor_id'?
+
+smp_processor_id is defined in linux/smp.h but it is not included.
+
+The build error happens only when the patch is applied to 5.3 kernel but
+it only works by chance in mainline.
+
+Fixes: ca3f969dcb11 ("powerpc/paravirt: Use is_kvm_guest() in vcpu_is_preempted()")
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210120132838.15589-1-msuchanek@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/paravirt.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/include/asm/paravirt.h b/arch/powerpc/include/asm/paravirt.h
+index edc08f04aef77..5d1726bb28e79 100644
+--- a/arch/powerpc/include/asm/paravirt.h
++++ b/arch/powerpc/include/asm/paravirt.h
+@@ -10,6 +10,7 @@
+ #endif
+
+ #ifdef CONFIG_PPC_SPLPAR
++#include <linux/smp.h>
+ #include <asm/kvm_guest.h>
+ #include <asm/cputhreads.h>
+
+--
+2.27.0
+
--- /dev/null
+From 311b2f0a833387b0302c98cd600f79de8c935ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Feb 2021 20:15:41 +1100
+Subject: powerpc/kuap: Restore AMR after replaying soft interrupts
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 60a707d0c99aff4eadb7fd334c5fd21df386723e ]
+
+Since de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace
+Access Protection"), user access helpers call user_{read|write}_access_{begin|end}
+when user space access is allowed.
+
+Commit 890274c2dc4c ("powerpc/64s: Implement KUAP for Radix MMU") made
+the mentioned helpers program a AMR special register to allow such
+access for a short period of time, most of the time AMR is expected to
+block user memory access by the kernel.
+
+Since the code accesses the user space memory, unsafe_get_user() calls
+might_fault() which calls arch_local_irq_restore() if either
+CONFIG_PROVE_LOCKING or CONFIG_DEBUG_ATOMIC_SLEEP is enabled.
+arch_local_irq_restore() then attempts to replay pending soft
+interrupts as KUAP regions have hardware interrupts enabled.
+
+If a pending interrupt happens to do user access (performance
+interrupts do that), it enables access for a short period of time so
+after returning from the replay, the user access state remains blocked
+and if a user page fault happens - "Bug: Read fault blocked by AMR!"
+appears and SIGSEGV is sent.
+
+An example trace:
+ Bug: Read fault blocked by AMR!
+ WARNING: CPU: 0 PID: 1603 at /home/aik/p/kernel/arch/powerpc/include/asm/book3s/64/kup-radix.h:145
+ CPU: 0 PID: 1603 Comm: amr Not tainted 5.10.0-rc6_v5.10-rc6_a+fstn1 #24
+ NIP: c00000000009ece8 LR: c00000000009ece4 CTR: 0000000000000000
+ REGS: c00000000dc63560 TRAP: 0700 Not tainted (5.10.0-rc6_v5.10-rc6_a+fstn1)
+ MSR: 8000000000021033 <SF,ME,IR,DR,RI,LE> CR: 28002888 XER: 20040000
+ CFAR: c0000000001fa928 IRQMASK: 1
+ GPR00: c00000000009ece4 c00000000dc637f0 c000000002397600 000000000000001f
+ GPR04: c0000000020eb318 0000000000000000 c00000000dc63494 0000000000000027
+ GPR08: c00000007fe4de68 c00000000dfe9180 0000000000000000 0000000000000001
+ GPR12: 0000000000002000 c0000000030a0000 0000000000000000 0000000000000000
+ GPR16: 0000000000000000 0000000000000000 0000000000000000 bfffffffffffffff
+ GPR20: 0000000000000000 c0000000134a4020 c0000000019c2218 0000000000000fe0
+ GPR24: 0000000000000000 0000000000000000 c00000000d106200 0000000040000000
+ GPR28: 0000000000000000 0000000000000300 c00000000dc63910 c000000001946730
+ NIP __do_page_fault+0xb38/0xde0
+ LR __do_page_fault+0xb34/0xde0
+ Call Trace:
+ __do_page_fault+0xb34/0xde0 (unreliable)
+ handle_page_fault+0x10/0x2c
+ --- interrupt: 300 at strncpy_from_user+0x290/0x440
+ LR = strncpy_from_user+0x284/0x440
+ strncpy_from_user+0x2f0/0x440 (unreliable)
+ getname_flags+0x88/0x2c0
+ do_sys_openat2+0x2d4/0x5f0
+ do_sys_open+0xcc/0x140
+ system_call_exception+0x160/0x240
+ system_call_common+0xf0/0x27c
+
+To fix it save/restore the AMR when replaying interrupts, and also
+add a check if AMR was not blocked prior to replaying interrupts.
+
+Originally found by syzkaller.
+
+Fixes: 890274c2dc4c ("powerpc/64s: Implement KUAP for Radix MMU")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Use normal commit citation format and add full oops log to
+ change log, move kuap_check_amr() into the restore routine to
+ avoid warnings about unreconciled IRQ state]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210202091541.36499-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/irq.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index cc7a6271b6b4e..e8a548447dd68 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -269,6 +269,31 @@ again:
+ }
+ }
+
++#if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_PPC_KUAP)
++static inline void replay_soft_interrupts_irqrestore(void)
++{
++ unsigned long kuap_state = get_kuap();
++
++ /*
++ * Check if anything calls local_irq_enable/restore() when KUAP is
++ * disabled (user access enabled). We handle that case here by saving
++ * and re-locking AMR but we shouldn't get here in the first place,
++ * hence the warning.
++ */
++ kuap_check_amr();
++
++ if (kuap_state != AMR_KUAP_BLOCKED)
++ set_kuap(AMR_KUAP_BLOCKED);
++
++ replay_soft_interrupts();
++
++ if (kuap_state != AMR_KUAP_BLOCKED)
++ set_kuap(kuap_state);
++}
++#else
++#define replay_soft_interrupts_irqrestore() replay_soft_interrupts()
++#endif
++
+ notrace void arch_local_irq_restore(unsigned long mask)
+ {
+ unsigned char irq_happened;
+@@ -332,7 +357,7 @@ notrace void arch_local_irq_restore(unsigned long mask)
+ irq_soft_mask_set(IRQS_ALL_DISABLED);
+ trace_hardirqs_off();
+
+- replay_soft_interrupts();
++ replay_soft_interrupts_irqrestore();
+ local_paca->irq_happened = 0;
+
+ trace_hardirqs_on();
+--
+2.27.0
+
--- /dev/null
+From 9093c2d61737c720b8f7f4ceb0aee15774d8c068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 06:36:52 +0000
+Subject: powerpc/kvm: Force selection of CONFIG_PPC_FPU
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 27f699579b64dbf27caf31e5c0eac567ec0aa8b8 ]
+
+book3s/32 kvm is designed with the assumption that
+an FPU is always present.
+
+Force selection of FPU support in the kernel when
+build KVM.
+
+Fixes: 7d68c8916950 ("powerpc/32s: Allow deselecting CONFIG_PPC_FPU on mpc832x")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/74461a99fa1466f361532ca794ca0753be3d9f86.1611038044.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
+index 549591d9aaa2c..e45644657d49d 100644
+--- a/arch/powerpc/kvm/Kconfig
++++ b/arch/powerpc/kvm/Kconfig
+@@ -54,6 +54,7 @@ config KVM_BOOK3S_32
+ select KVM
+ select KVM_BOOK3S_32_HANDLER
+ select KVM_BOOK3S_PR_POSSIBLE
++ select PPC_FPU
+ help
+ Support running unmodified book3s_32 guest kernels
+ in virtual machines on book3s_32 host processors.
+--
+2.27.0
+
--- /dev/null
+From e801d7cfd2a3bc01220bc021450cd4a8130ac905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 20:59:00 -0600
+Subject: powerpc/pseries/dlpar: handle ibm, configure-connector delay status
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 768d70e19ba525debd571b36e6d0ab19956c63d7 ]
+
+dlpar_configure_connector() has two problems in its handling of
+ibm,configure-connector's return status:
+
+1. When the status is -2 (busy, call again), we call
+ ibm,configure-connector again immediately without checking whether
+ to schedule, which can result in monopolizing the CPU.
+2. Extended delay status (9900..9905) goes completely unhandled,
+ causing the configuration to unnecessarily terminate.
+
+Fix both of these issues by using rtas_busy_delay().
+
+Fixes: ab519a011caa ("powerpc/pseries: Kernel DLPAR Infrastructure")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210107025900.410369-1-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 16e86ba8aa209..f6b7749d6ada7 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -127,7 +127,6 @@ void dlpar_free_cc_nodes(struct device_node *dn)
+ #define NEXT_PROPERTY 3
+ #define PREV_PARENT 4
+ #define MORE_MEMORY 5
+-#define CALL_AGAIN -2
+ #define ERR_CFG_USE -9003
+
+ struct device_node *dlpar_configure_connector(__be32 drc_index,
+@@ -168,6 +167,9 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+
+ spin_unlock(&rtas_data_buf_lock);
+
++ if (rtas_busy_delay(rc))
++ continue;
++
+ switch (rc) {
+ case COMPLETE:
+ break;
+@@ -216,9 +218,6 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ last_dn = last_dn->parent;
+ break;
+
+- case CALL_AGAIN:
+- break;
+-
+ case MORE_MEMORY:
+ case ERR_CFG_USE:
+ default:
+--
+2.27.0
+
--- /dev/null
+From 15349491b3899a9e88f08eada4fe880af9aef586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 18:36:22 +0530
+Subject: powerpc/sstep: Check instruction validity against ISA version before
+ emulation
+
+From: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+
+[ Upstream commit 8813ff49607eab3caaf40fe8929b0ce7dc68e85f ]
+
+We currently unconditionally try to emulate newer instructions on older
+Power versions that could cause issues. Gate it.
+
+Fixes: 350779a29f11 ("powerpc: Handle most loads and stores in instruction emulation code")
+Signed-off-by: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/161157995977.64773.13794501093457185080.stgit@thinktux.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 78 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 62 insertions(+), 16 deletions(-)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index ede093e962347..5e725ed24d772 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1306,9 +1306,11 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ if ((word & 0xfe2) == 2)
+ op->type = SYSCALL;
+ else if (IS_ENABLED(CONFIG_PPC_BOOK3S_64) &&
+- (word & 0xfe3) == 1)
++ (word & 0xfe3) == 1) { /* scv */
+ op->type = SYSCALL_VECTORED_0;
+- else
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
++ } else
+ op->type = UNKNOWN;
+ return 0;
+ #endif
+@@ -1412,7 +1414,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #ifdef __powerpc64__
+ case 1:
+ if (!cpu_has_feature(CPU_FTR_ARCH_31))
+- return -1;
++ goto unknown_opcode;
+
+ prefix_r = GET_PREFIX_R(word);
+ ra = GET_PREFIX_RA(suffix);
+@@ -1446,7 +1448,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #ifdef __powerpc64__
+ case 4:
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+
+ switch (word & 0x3f) {
+ case 48: /* maddhd */
+@@ -1532,6 +1534,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ case 19:
+ if (((word >> 1) & 0x1f) == 2) {
+ /* addpcis */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ imm = (short) (word & 0xffc1); /* d0 + d2 fields */
+ imm |= (word >> 15) & 0x3e; /* d1 field */
+ op->val = regs->nip + (imm << 16) + 4;
+@@ -1844,7 +1848,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #ifdef __powerpc64__
+ case 265: /* modud */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ op->val = regs->gpr[ra] % regs->gpr[rb];
+ goto compute_done;
+ #endif
+@@ -1854,7 +1858,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ case 267: /* moduw */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ op->val = (unsigned int) regs->gpr[ra] %
+ (unsigned int) regs->gpr[rb];
+ goto compute_done;
+@@ -1891,7 +1895,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #endif
+ case 755: /* darn */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ switch (ra & 0x3) {
+ case 0:
+ /* 32-bit conditioned */
+@@ -1913,14 +1917,14 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #ifdef __powerpc64__
+ case 777: /* modsd */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ op->val = (long int) regs->gpr[ra] %
+ (long int) regs->gpr[rb];
+ goto compute_done;
+ #endif
+ case 779: /* modsw */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ op->val = (int) regs->gpr[ra] %
+ (int) regs->gpr[rb];
+ goto compute_done;
+@@ -1997,14 +2001,14 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #endif
+ case 538: /* cnttzw */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ val = (unsigned int) regs->gpr[rd];
+ op->val = (val ? __builtin_ctz(val) : 32);
+ goto logical_done;
+ #ifdef __powerpc64__
+ case 570: /* cnttzd */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ val = regs->gpr[rd];
+ op->val = (val ? __builtin_ctzl(val) : 64);
+ goto logical_done;
+@@ -2114,7 +2118,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ case 890: /* extswsli with sh_5 = 0 */
+ case 891: /* extswsli with sh_5 = 1 */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- return -1;
++ goto unknown_opcode;
+ op->type = COMPUTE + SETREG;
+ sh = rb | ((word & 2) << 4);
+ val = (signed int) regs->gpr[rd];
+@@ -2441,6 +2445,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 268: /* lxvx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 16);
+ op->element_size = 16;
+@@ -2450,6 +2456,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ case 269: /* lxvl */
+ case 301: { /* lxvll */
+ int nb;
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->ea = ra ? regs->gpr[ra] : 0;
+ nb = regs->gpr[rb] & 0xff;
+@@ -2470,13 +2478,15 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ case 333: /* lxvpx */
+ if (!cpu_has_feature(CPU_FTR_ARCH_31))
+- return -1;
++ goto unknown_opcode;
+ op->reg = VSX_REGISTER_XTP(rd);
+ op->type = MKOP(LOAD_VSX, 0, 32);
+ op->element_size = 32;
+ break;
+
+ case 364: /* lxvwsx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 4);
+ op->element_size = 4;
+@@ -2484,6 +2494,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 396: /* stxvx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(STORE_VSX, 0, 16);
+ op->element_size = 16;
+@@ -2493,6 +2505,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ case 397: /* stxvl */
+ case 429: { /* stxvll */
+ int nb;
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->ea = ra ? regs->gpr[ra] : 0;
+ nb = regs->gpr[rb] & 0xff;
+@@ -2506,7 +2520,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ }
+ case 461: /* stxvpx */
+ if (!cpu_has_feature(CPU_FTR_ARCH_31))
+- return -1;
++ goto unknown_opcode;
+ op->reg = VSX_REGISTER_XTP(rd);
+ op->type = MKOP(STORE_VSX, 0, 32);
+ op->element_size = 32;
+@@ -2544,6 +2558,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 781: /* lxsibzx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 1);
+ op->element_size = 8;
+@@ -2551,6 +2567,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 812: /* lxvh8x */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 16);
+ op->element_size = 2;
+@@ -2558,6 +2576,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 813: /* lxsihzx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 2);
+ op->element_size = 8;
+@@ -2571,6 +2591,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 876: /* lxvb16x */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(LOAD_VSX, 0, 16);
+ op->element_size = 1;
+@@ -2584,6 +2606,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 909: /* stxsibx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(STORE_VSX, 0, 1);
+ op->element_size = 8;
+@@ -2591,6 +2615,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 940: /* stxvh8x */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(STORE_VSX, 0, 16);
+ op->element_size = 2;
+@@ -2598,6 +2624,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 941: /* stxsihx */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(STORE_VSX, 0, 2);
+ op->element_size = 8;
+@@ -2611,6 +2639,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 1004: /* stxvb16x */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd | ((word & 1) << 5);
+ op->type = MKOP(STORE_VSX, 0, 16);
+ op->element_size = 1;
+@@ -2719,12 +2749,16 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ op->type = MKOP(LOAD_FP, 0, 16);
+ break;
+ case 2: /* lxsd */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd + 32;
+ op->type = MKOP(LOAD_VSX, 0, 8);
+ op->element_size = 8;
+ op->vsx_flags = VSX_CHECK_VEC;
+ break;
+ case 3: /* lxssp */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->reg = rd + 32;
+ op->type = MKOP(LOAD_VSX, 0, 4);
+ op->element_size = 8;
+@@ -2754,7 +2788,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ #ifdef CONFIG_VSX
+ case 6:
+ if (!cpu_has_feature(CPU_FTR_ARCH_31))
+- return -1;
++ goto unknown_opcode;
+ op->ea = dqform_ea(word, regs);
+ op->reg = VSX_REGISTER_XTP(rd);
+ op->element_size = 32;
+@@ -2777,6 +2811,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 1: /* lxv */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->ea = dqform_ea(word, regs);
+ if (word & 8)
+ op->reg = rd + 32;
+@@ -2787,6 +2823,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ case 2: /* stxsd with LSB of DS field = 0 */
+ case 6: /* stxsd with LSB of DS field = 1 */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->ea = dsform_ea(word, regs);
+ op->reg = rd + 32;
+ op->type = MKOP(STORE_VSX, 0, 8);
+@@ -2796,6 +2834,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ case 3: /* stxssp with LSB of DS field = 0 */
+ case 7: /* stxssp with LSB of DS field = 1 */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->ea = dsform_ea(word, regs);
+ op->reg = rd + 32;
+ op->type = MKOP(STORE_VSX, 0, 4);
+@@ -2804,6 +2844,8 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+
+ case 5: /* stxv */
++ if (!cpu_has_feature(CPU_FTR_ARCH_300))
++ goto unknown_opcode;
+ op->ea = dqform_ea(word, regs);
+ if (word & 8)
+ op->reg = rd + 32;
+@@ -2833,7 +2875,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ break;
+ case 1: /* Prefixed instructions */
+ if (!cpu_has_feature(CPU_FTR_ARCH_31))
+- return -1;
++ goto unknown_opcode;
+
+ prefix_r = GET_PREFIX_R(word);
+ ra = GET_PREFIX_RA(suffix);
+@@ -2982,6 +3024,10 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ return 0;
+
++ unknown_opcode:
++ op->type = UNKNOWN;
++ return 0;
++
+ logical_done:
+ if (word & 1)
+ set_cr0(regs, op);
+--
+2.27.0
+
--- /dev/null
+From 376da3f90d9e97a676dde327c79746cbd46258c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 13:37:44 +0530
+Subject: powerpc/sstep: Fix darn emulation
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit 22b89ba178dd0a66a26699ead014a3e73ff8e044 ]
+
+Commit 8813ff49607e ("powerpc/sstep: Check instruction validity
+against ISA version before emulation") introduced a proper way to skip
+unknown instructions. This makes sure that the same is used for the
+darn instruction when the range selection bits have a reserved value.
+
+Fixes: a23987ef267a ("powerpc: sstep: Add support for darn instruction")
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210204080744.135785-2-sandipan@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 25cfa9c622c58..bb5c20d4ca91c 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1918,7 +1918,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ goto compute_done;
+ }
+
+- return -1;
++ goto unknown_opcode;
+ #ifdef __powerpc64__
+ case 777: /* modsd */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+--
+2.27.0
+
--- /dev/null
+From 800836c7530a1b8e33fb7a95bc977d1670d0448e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 18:36:43 +0530
+Subject: powerpc/sstep: Fix incorrect return from analyze_instr()
+
+From: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+
+[ Upstream commit 718aae916fa6619c57c348beaedd675835cf1aa1 ]
+
+We currently just percolate the return value from analyze_instr()
+to the caller of emulate_step(), especially if it is a -1.
+
+For one particular case (opcode = 4) for instructions that aren't
+currently emulated, we are returning 'should not be single-stepped'
+while we should have returned 0 which says 'did not emulate, may
+have to single-step'.
+
+Fixes: 930d6288a26787 ("powerpc: sstep: Add support for maddhd, maddhdu, maddld instructions")
+Signed-off-by: Ananth N Mavinakayanahalli <ananth@linux.ibm.com>
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Tested-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Reviewed-by: Sandipan Das <sandipan@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/161157999039.64773.14950289716779364766.stgit@thinktux.local
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 5e725ed24d772..33935869e4976 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1447,6 +1447,11 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ #ifdef __powerpc64__
+ case 4:
++ /*
++ * There are very many instructions with this primary opcode
++ * introduced in the ISA as early as v2.03. However, the ones
++ * we currently emulate were all introduced with ISA 3.0
++ */
+ if (!cpu_has_feature(CPU_FTR_ARCH_300))
+ goto unknown_opcode;
+
+@@ -1474,7 +1479,7 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+ * There are other instructions from ISA 3.0 with the same
+ * primary opcode which do not have emulation support yet.
+ */
+- return -1;
++ goto unknown_opcode;
+ #endif
+
+ case 7: /* mulli */
+--
+2.27.0
+
--- /dev/null
+From 26c4d64b43e7223f0d18f9b8e1ab38f52168815d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Feb 2021 13:37:43 +0530
+Subject: powerpc/sstep: Fix load-store and update emulation
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+[ Upstream commit bbda4b6c7d7c7f79da71f95c92a5d76be22c3efd ]
+
+The Power ISA says that the fixed-point load and update instructions
+must neither use R0 for the base address (RA) nor have the
+destination (RT) and the base address (RA) as the same register.
+Similarly, for fixed-point stores and floating-point loads and stores,
+the instruction is invalid when R0 is used as the base address (RA).
+
+This is applicable to the following instructions.
+ * Load Byte and Zero with Update (lbzu)
+ * Load Byte and Zero with Update Indexed (lbzux)
+ * Load Halfword and Zero with Update (lhzu)
+ * Load Halfword and Zero with Update Indexed (lhzux)
+ * Load Halfword Algebraic with Update (lhau)
+ * Load Halfword Algebraic with Update Indexed (lhaux)
+ * Load Word and Zero with Update (lwzu)
+ * Load Word and Zero with Update Indexed (lwzux)
+ * Load Word Algebraic with Update Indexed (lwaux)
+ * Load Doubleword with Update (ldu)
+ * Load Doubleword with Update Indexed (ldux)
+ * Load Floating Single with Update (lfsu)
+ * Load Floating Single with Update Indexed (lfsux)
+ * Load Floating Double with Update (lfdu)
+ * Load Floating Double with Update Indexed (lfdux)
+ * Store Byte with Update (stbu)
+ * Store Byte with Update Indexed (stbux)
+ * Store Halfword with Update (sthu)
+ * Store Halfword with Update Indexed (sthux)
+ * Store Word with Update (stwu)
+ * Store Word with Update Indexed (stwux)
+ * Store Doubleword with Update (stdu)
+ * Store Doubleword with Update Indexed (stdux)
+ * Store Floating Single with Update (stfsu)
+ * Store Floating Single with Update Indexed (stfsux)
+ * Store Floating Double with Update (stfdu)
+ * Store Floating Double with Update Indexed (stfdux)
+
+E.g. the following behaviour is observed for an invalid load and
+update instruction having RA = RT.
+
+While a userspace program having an instruction word like 0xe9ce0001,
+i.e. ldu r14, 0(r14), runs without getting receiving a SIGILL on a
+Power system (observed on P8 and P9), the outcome of executing that
+instruction word varies and its behaviour can be considered to be
+undefined.
+
+Attaching an uprobe at that instruction's address results in emulation
+which currently performs the load as well as writes the effective
+address back to the base register. This might not match the outcome
+from hardware.
+
+To remove any inconsistencies, this adds additional checks for the
+aforementioned instructions to make sure that the emulation
+infrastructure treats them as unknown. The kernel can then fallback to
+executing such instructions on hardware.
+
+Fixes: 0016a4cf5582 ("powerpc: Emulate most Book I instructions in emulate_step()")
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210204080744.135785-1-sandipan@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/sstep.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 33935869e4976..25cfa9c622c58 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -3019,6 +3019,20 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
+
+ }
+
++ if (OP_IS_LOAD_STORE(op->type) && (op->type & UPDATE)) {
++ switch (GETTYPE(op->type)) {
++ case LOAD:
++ if (ra == rd)
++ goto unknown_opcode;
++ fallthrough;
++ case STORE:
++ case LOAD_FP:
++ case STORE_FP:
++ if (ra == 0)
++ goto unknown_opcode;
++ }
++ }
++
+ #ifdef CONFIG_VSX
+ if ((GETTYPE(op->type) == LOAD_VSX ||
+ GETTYPE(op->type) == STORE_VSX) &&
+--
+2.27.0
+
--- /dev/null
+From ae96e163cd15c7a547dc10d105634ef7816bd244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 14:51:19 +0800
+Subject: powerpc/time: Enable sched clock for irqtime
+
+From: Pingfan Liu <kernelfans@gmail.com>
+
+[ Upstream commit b709e32ef570b8b91dfbcb63cffac4324c87799f ]
+
+When CONFIG_IRQ_TIME_ACCOUNTING and CONFIG_VIRT_CPU_ACCOUNTING_GEN, powerpc
+does not enable "sched_clock_irqtime" and can not utilize irq time
+accounting.
+
+Like x86, powerpc does not use the sched_clock_register() interface. So it
+needs an dedicated call to enable_sched_clock_irqtime() to enable irq time
+accounting.
+
+Fixes: 518470fe962e ("powerpc: Add HAVE_IRQ_TIME_ACCOUNTING")
+Signed-off-by: Pingfan Liu <kernelfans@gmail.com>
+[mpe: Add fixes tag]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1603349479-26185-1-git-send-email-kernelfans@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/time.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index 67feb35244606..83633a24ce788 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -53,6 +53,7 @@
+ #include <linux/of_clk.h>
+ #include <linux/suspend.h>
+ #include <linux/sched/cputime.h>
++#include <linux/sched/clock.h>
+ #include <linux/processor.h>
+ #include <asm/trace.h>
+
+@@ -1030,6 +1031,7 @@ void __init time_init(void)
+ tick_setup_hrtimer_broadcast();
+
+ of_clk_init(NULL);
++ enable_sched_clock_irqtime();
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 7ecba7cf3e1735508c1ea5ea5846488ec868c11b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 16:57:40 +1100
+Subject: powerpc/uaccess: Avoid might_fault() when user access is enabled
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 7d506ca97b665b95e698a53697dad99fae813c1a ]
+
+The amount of code executed with enabled user space access (unlocked
+KUAP) should be minimal. However with CONFIG_PROVE_LOCKING or
+CONFIG_DEBUG_ATOMIC_SLEEP enabled, might_fault() calls into various
+parts of the kernel, and may even end up replaying interrupts which in
+turn may access user space and forget to restore the KUAP state.
+
+The problem places are:
+ 1. strncpy_from_user (and similar) which unlock KUAP and call
+ unsafe_get_user -> __get_user_allowed -> __get_user_nocheck()
+ with do_allow=false to skip KUAP as the caller took care of it.
+ 2. __unsafe_put_user_goto() which is called with unlocked KUAP.
+
+eg:
+ WARNING: CPU: 30 PID: 1 at arch/powerpc/include/asm/book3s/64/kup.h:324 arch_local_irq_restore+0x160/0x190
+ NIP arch_local_irq_restore+0x160/0x190
+ LR lock_is_held_type+0x140/0x200
+ Call Trace:
+ 0xc00000007f392ff8 (unreliable)
+ ___might_sleep+0x180/0x320
+ __might_fault+0x50/0xe0
+ filldir64+0x2d0/0x5d0
+ call_filldir+0xc8/0x180
+ ext4_readdir+0x948/0xb40
+ iterate_dir+0x1ec/0x240
+ sys_getdents64+0x80/0x290
+ system_call_exception+0x160/0x280
+ system_call_common+0xf0/0x27c
+
+Change __get_user_nocheck() to look at `do_allow` to decide whether to
+skip might_fault(). Since strncpy_from_user/etc call might_fault()
+anyway before unlocking KUAP, there should be no visible change.
+
+Drop might_fault() in __unsafe_put_user_goto() as it is only called
+from unsafe_put_user(), which already has KUAP unlocked.
+
+Since keeping might_fault() is still desirable for debugging, add
+calls to it in user_[read|write]_access_begin(). That also allows us
+to drop the is_kernel_addr() test, because there should be no code
+using user_[read|write]_access_begin() in order to access a kernel
+address.
+
+Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+[mpe: Combine with related patch from myself, merge change logs]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210204121612.32721-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/uaccess.h | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
+index 501c9a79038c0..f53bfefb4a577 100644
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -216,8 +216,6 @@ do { \
+ #define __put_user_nocheck_goto(x, ptr, size, label) \
+ do { \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
+- if (!is_kernel_addr((unsigned long)__pu_addr)) \
+- might_fault(); \
+ __chk_user_ptr(ptr); \
+ __put_user_size_goto((x), __pu_addr, (size), label); \
+ } while (0)
+@@ -313,7 +311,7 @@ do { \
+ __typeof__(size) __gu_size = (size); \
+ \
+ __chk_user_ptr(__gu_addr); \
+- if (!is_kernel_addr((unsigned long)__gu_addr)) \
++ if (do_allow && !is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+ barrier_nospec(); \
+ if (do_allow) \
+@@ -508,6 +506,9 @@ static __must_check inline bool user_access_begin(const void __user *ptr, size_t
+ {
+ if (unlikely(!access_ok(ptr, len)))
+ return false;
++
++ might_fault();
++
+ allow_read_write_user((void __user *)ptr, ptr, len);
+ return true;
+ }
+@@ -521,6 +522,9 @@ user_read_access_begin(const void __user *ptr, size_t len)
+ {
+ if (unlikely(!access_ok(ptr, len)))
+ return false;
++
++ might_fault();
++
+ allow_read_from_user(ptr, len);
+ return true;
+ }
+@@ -532,6 +536,9 @@ user_write_access_begin(const void __user *ptr, size_t len)
+ {
+ if (unlikely(!access_ok(ptr, len)))
+ return false;
++
++ might_fault();
++
+ allow_write_to_user((void __user *)ptr, len);
+ return true;
+ }
+--
+2.27.0
+
--- /dev/null
+From fb62a6c9df6a3b2a1de2c3e9b2037610fb95cdeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 18:37:52 +0106
+Subject: printk: avoid prb_first_valid_seq() where possible
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 13791c80b0cdf54d92fc54221cdf490683b109de ]
+
+If message sizes average larger than expected (more than 32
+characters), the data_ring will wrap before the desc_ring. Once the
+data_ring wraps, it will start invalidating descriptors. These
+invalid descriptors hang around until they are eventually recycled
+when the desc_ring wraps. Readers do not care about invalid
+descriptors, but they still need to iterate past them. If the
+average message size is much larger than 32 characters, then there
+will be many invalid descriptors preceding the valid descriptors.
+
+The function prb_first_valid_seq() always begins at the oldest
+descriptor and searches for the first valid descriptor. This can
+be rather expensive for the above scenario. And, in fact, because
+of its heavy usage in /dev/kmsg, there have been reports of long
+delays and even RCU stalls.
+
+For code that does not need to search from the oldest record,
+replace prb_first_valid_seq() usage with prb_read_valid_*()
+functions, which provide a start sequence number to search from.
+
+Fixes: 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Reported-by: J. Avila <elavila@google.com>
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20210211173152.1629-1-john.ogness@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 5a95c688621fa..575a34b88936f 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -735,9 +735,9 @@ static ssize_t devkmsg_read(struct file *file, char __user *buf,
+ logbuf_lock_irq();
+ }
+
+- if (user->seq < prb_first_valid_seq(prb)) {
++ if (r->info->seq != user->seq) {
+ /* our last seen message is gone, return error and reset */
+- user->seq = prb_first_valid_seq(prb);
++ user->seq = r->info->seq;
+ ret = -EPIPE;
+ logbuf_unlock_irq();
+ goto out;
+@@ -812,6 +812,7 @@ static loff_t devkmsg_llseek(struct file *file, loff_t offset, int whence)
+ static __poll_t devkmsg_poll(struct file *file, poll_table *wait)
+ {
+ struct devkmsg_user *user = file->private_data;
++ struct printk_info info;
+ __poll_t ret = 0;
+
+ if (!user)
+@@ -820,9 +821,9 @@ static __poll_t devkmsg_poll(struct file *file, poll_table *wait)
+ poll_wait(file, &log_wait, wait);
+
+ logbuf_lock_irq();
+- if (prb_read_valid(prb, user->seq, NULL)) {
++ if (prb_read_valid_info(prb, user->seq, &info, NULL)) {
+ /* return error when data has vanished underneath us */
+- if (user->seq < prb_first_valid_seq(prb))
++ if (info.seq != user->seq)
+ ret = EPOLLIN|EPOLLRDNORM|EPOLLERR|EPOLLPRI;
+ else
+ ret = EPOLLIN|EPOLLRDNORM;
+@@ -1559,6 +1560,7 @@ static void syslog_clear(void)
+
+ int do_syslog(int type, char __user *buf, int len, int source)
+ {
++ struct printk_info info;
+ bool clear = false;
+ static int saved_console_loglevel = LOGLEVEL_DEFAULT;
+ int error;
+@@ -1629,9 +1631,14 @@ int do_syslog(int type, char __user *buf, int len, int source)
+ /* Number of chars in the log buffer */
+ case SYSLOG_ACTION_SIZE_UNREAD:
+ logbuf_lock_irq();
+- if (syslog_seq < prb_first_valid_seq(prb)) {
++ if (!prb_read_valid_info(prb, syslog_seq, &info, NULL)) {
++ /* No unread messages. */
++ logbuf_unlock_irq();
++ return 0;
++ }
++ if (info.seq != syslog_seq) {
+ /* messages are gone, move to first one */
+- syslog_seq = prb_first_valid_seq(prb);
++ syslog_seq = info.seq;
+ syslog_partial = 0;
+ }
+ if (source == SYSLOG_FROM_PROC) {
+@@ -1643,7 +1650,6 @@ int do_syslog(int type, char __user *buf, int len, int source)
+ error = prb_next_seq(prb) - syslog_seq;
+ } else {
+ bool time = syslog_partial ? syslog_time : printk_time;
+- struct printk_info info;
+ unsigned int line_count;
+ u64 seq;
+
+@@ -3429,9 +3435,11 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
+ goto out;
+
+ logbuf_lock_irqsave(flags);
+- if (dumper->cur_seq < prb_first_valid_seq(prb)) {
+- /* messages are gone, move to first available one */
+- dumper->cur_seq = prb_first_valid_seq(prb);
++ if (prb_read_valid_info(prb, dumper->cur_seq, &info, NULL)) {
++ if (info.seq != dumper->cur_seq) {
++ /* messages are gone, move to first available one */
++ dumper->cur_seq = info.seq;
++ }
+ }
+
+ /* last entry */
+--
+2.27.0
+
--- /dev/null
+From f0b6742cee54097003e23e28df53f415e9340fe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 17:20:49 -0800
+Subject: proc: use kvzalloc for our kernel buffer
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 4508943794efdd94171549c0bd52810e2f4ad9fe ]
+
+Since
+
+ sysctl: pass kernel pointers to ->proc_handler
+
+we have been pre-allocating a buffer to copy the data from the proc
+handlers into, and then copying that to userspace. The problem is this
+just blindly kzalloc()'s the buffer size passed in from the read, which in
+the case of our 'cat' binary was 64kib. Order-4 allocations are not
+awesome, and since we can potentially allocate up to our maximum order, so
+use kvzalloc for these buffers.
+
+[willy@infradead.org: changelog tweaks]
+
+Link: https://lkml.kernel.org/r/6345270a2c1160b89dd5e6715461f388176899d1.1612972413.git.josef@toxicpanda.com
+Fixes: 32927393dc1c ("sysctl: pass kernel pointers to ->proc_handler")
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+CC: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/proc/proc_sysctl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
+index d2018f70d1fae..070d2df8ab9cf 100644
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -571,7 +571,7 @@ static ssize_t proc_sys_call_handler(struct kiocb *iocb, struct iov_iter *iter,
+ error = -ENOMEM;
+ if (count >= KMALLOC_MAX_SIZE)
+ goto out;
+- kbuf = kzalloc(count + 1, GFP_KERNEL);
++ kbuf = kvzalloc(count + 1, GFP_KERNEL);
+ if (!kbuf)
+ goto out;
+
+@@ -600,7 +600,7 @@ static ssize_t proc_sys_call_handler(struct kiocb *iocb, struct iov_iter *iter,
+
+ error = count;
+ out_free_buf:
+- kfree(kbuf);
++ kvfree(kbuf);
+ out:
+ sysctl_head_finish(head);
+
+--
+2.27.0
+
--- /dev/null
+From ff0acafa79eda7cd09e93d9bdd980bf656dd8ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 08:32:39 +0100
+Subject: pwm: iqs620a: Fix overflow and optimize calculations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 72d6b2459dbd539c1369149e501fdc3dc8ddef16 ]
+
+If state->duty_cycle is 0x100000000000000, the previous calculation of
+duty_scale overflows and yields a duty cycle ratio of 0% instead of
+100%. Fix this by clamping the requested duty cycle to the maximal
+possible duty cycle first. This way it is possible to use a native
+integer division instead of a (depending on the architecture) more
+expensive 64bit division.
+
+With this change in place duty_scale cannot be bigger than 256 which
+allows to simplify the calculation of duty_val.
+
+Fixes: 6f0841a8197b ("pwm: Add support for Azoteq IQS620A PWM generator")
+Tested-by: Jeff LaBundy <jeff@labundy.com>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-iqs620a.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-iqs620a.c b/drivers/pwm/pwm-iqs620a.c
+index 5ede8255926ef..14b18fb4f5274 100644
+--- a/drivers/pwm/pwm-iqs620a.c
++++ b/drivers/pwm/pwm-iqs620a.c
+@@ -46,7 +46,8 @@ static int iqs620_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ {
+ struct iqs620_pwm_private *iqs620_pwm;
+ struct iqs62x_core *iqs62x;
+- u64 duty_scale;
++ unsigned int duty_cycle;
++ unsigned int duty_scale;
+ int ret;
+
+ if (state->polarity != PWM_POLARITY_NORMAL)
+@@ -70,7 +71,8 @@ static int iqs620_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ * For lower duty cycles (e.g. 0), the PWM output is simply disabled to
+ * allow an external pull-down resistor to hold the GPIO3/LTX pin low.
+ */
+- duty_scale = div_u64(state->duty_cycle * 256, IQS620_PWM_PERIOD_NS);
++ duty_cycle = min_t(u64, state->duty_cycle, IQS620_PWM_PERIOD_NS);
++ duty_scale = duty_cycle * 256 / IQS620_PWM_PERIOD_NS;
+
+ mutex_lock(&iqs620_pwm->lock);
+
+@@ -82,7 +84,7 @@ static int iqs620_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ }
+
+ if (duty_scale) {
+- u8 duty_val = min_t(u64, duty_scale - 1, 0xff);
++ u8 duty_val = duty_scale - 1;
+
+ ret = regmap_write(iqs62x->regmap, IQS620_PWM_DUTY_CYCLE,
+ duty_val);
+--
+2.27.0
+
--- /dev/null
+From 232dffdf37ea3c72995bc471055016295c716844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 11:12:08 -0500
+Subject: pwm: rockchip: Eliminate potential race condition when probing
+
+From: Simon South <simon@simonsouth.net>
+
+[ Upstream commit d21ba5d6217bd5a6a696678385906ed1994b380b ]
+
+Commit 48cf973cae33 ("pwm: rockchip: Avoid glitches on already running
+PWMs") introduced a potential race condition in rockchip_pwm_probe(): A
+consumer could enable an inactive PWM, or disable a running one, between
+rockchip_pwm_probe() registering the device via pwmchip_add() and checking
+whether it is enabled (to determine whether it was started by a
+bootloader). This could result in a device's PWM clock being either enabled
+once more than necessary, potentially causing it to continue running when
+no longer needed, or disabled once more than necessary, producing a warning
+from the kernel.
+
+Eliminate these possibilities by modifying rockchip_pwm_probe() so it
+checks whether a device is enabled before registering it rather than after.
+
+Fixes: 48cf973cae33 ("pwm: rockchip: Avoid glitches on already running PWMs")
+Reported-by: Trent Piepho <tpiepho@gmail.com>
+Signed-off-by: Simon South <simon@simonsouth.net>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-rockchip.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index 90f969f9f5e2b..f3a5641f6bca5 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -288,6 +288,7 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ const struct of_device_id *id;
+ struct rockchip_pwm_chip *pc;
+ u32 enable_conf, ctrl;
++ bool enabled;
+ int ret, count;
+
+ id = of_match_device(rockchip_pwm_dt_ids, &pdev->dev);
+@@ -349,6 +350,10 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ pc->chip.of_pwm_n_cells = 3;
+ }
+
++ enable_conf = pc->data->enable_conf;
++ ctrl = readl_relaxed(pc->base + pc->data->regs.ctrl);
++ enabled = (ctrl & enable_conf) == enable_conf;
++
+ ret = pwmchip_add(&pc->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+@@ -356,9 +361,7 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ }
+
+ /* Keep the PWM clk enabled if the PWM appears to be up and running. */
+- enable_conf = pc->data->enable_conf;
+- ctrl = readl_relaxed(pc->base + pc->data->regs.ctrl);
+- if ((ctrl & enable_conf) != enable_conf)
++ if (!enabled)
+ clk_disable(pc->clk);
+
+ clk_disable(pc->pclk);
+--
+2.27.0
+
--- /dev/null
+From 035d05740349a74a13400807a7060d6ec96ca0c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 11:12:05 -0500
+Subject: pwm: rockchip: Enable APB clock during register access while probing
+
+From: Simon South <simon@simonsouth.net>
+
+[ Upstream commit d9b657a5cdbd960de35dee7e06473caf44a9016f ]
+
+Commit 457f74abbed0 ("pwm: rockchip: Keep enabled PWMs running while
+probing") modified rockchip_pwm_probe() to access a PWM device's registers
+directly to check whether or not the device is enabled, but did not also
+change the function so it first enables the device's APB clock to be
+certain the device can respond. This risks hanging the kernel on systems
+with PWM devices that use more than a single clock.
+
+Avoid this by enabling the device's APB clock before accessing its
+registers (and disabling the clock when register access is complete).
+
+Fixes: 457f74abbed0 ("pwm: rockchip: Keep enabled PWMs running while probing")
+Reported-by: Thierry Reding <thierry.reding@gmail.com>
+Suggested-by: Trent Piepho <tpiepho@gmail.com>
+Signed-off-by: Simon South <simon@simonsouth.net>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-rockchip.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index 389a5e1404128..e6929bc739684 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -330,9 +330,9 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = clk_prepare(pc->pclk);
++ ret = clk_prepare_enable(pc->pclk);
+ if (ret) {
+- dev_err(&pdev->dev, "Can't prepare APB clk: %d\n", ret);
++ dev_err(&pdev->dev, "Can't prepare enable APB clk: %d\n", ret);
+ goto err_clk;
+ }
+
+@@ -362,10 +362,12 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+ if ((ctrl & enable_conf) != enable_conf)
+ clk_disable(pc->clk);
+
++ clk_disable(pc->pclk);
++
+ return 0;
+
+ err_pclk:
+- clk_unprepare(pc->pclk);
++ clk_disable_unprepare(pc->pclk);
+ err_clk:
+ clk_disable_unprepare(pc->clk);
+
+--
+2.27.0
+
--- /dev/null
+From 7a32c774e0763499ea99523f7c064f25f8f04288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 11:12:06 -0500
+Subject: pwm: rockchip: rockchip_pwm_probe(): Remove superfluous
+ clk_unprepare()
+
+From: Simon South <simon@simonsouth.net>
+
+[ Upstream commit d5d8d675865ccddfe4da26c85f22c55cec663bf2 ]
+
+If rockchip_pwm_probe() fails to register a PWM device it calls
+clk_unprepare() for the device's PWM clock, without having first disabled
+the clock and before jumping to an error handler that also unprepares
+it. This is likely to produce warnings from the kernel about the clock
+being unprepared when it is still enabled, and then being unprepared when
+it has already been unprepared.
+
+Prevent these warnings by removing this unnecessary call to
+clk_unprepare().
+
+Fixes: 48cf973cae33 ("pwm: rockchip: Avoid glitches on already running PWMs")
+Signed-off-by: Simon South <simon@simonsouth.net>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-rockchip.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index e6929bc739684..90f969f9f5e2b 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -351,7 +351,6 @@ static int rockchip_pwm_probe(struct platform_device *pdev)
+
+ ret = pwmchip_add(&pc->chip);
+ if (ret < 0) {
+- clk_unprepare(pc->clk);
+ dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+ goto err_pclk;
+ }
+--
+2.27.0
+
--- /dev/null
+From c03e4fab9e40b89bfb33ccf3a782afa9a2294def Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Dec 2020 12:09:53 +0100
+Subject: quota: Fix memory leak when handling corrupted quota file
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit a4db1072e1a3bd7a8d9c356e1902b13ac5deb8ef ]
+
+When checking corrupted quota file we can bail out and leak allocated
+info structure. Properly free info structure on error return.
+
+Reported-by: syzbot+77779c9b52ab78154b08@syzkaller.appspotmail.com
+Fixes: 11c514a99bb9 ("quota: Sanity-check quota file headers on load")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/quota_v2.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
+index c21106557a37e..b1467f3921c28 100644
+--- a/fs/quota/quota_v2.c
++++ b/fs/quota/quota_v2.c
+@@ -164,19 +164,24 @@ static int v2_read_file_info(struct super_block *sb, int type)
+ quota_error(sb, "Number of blocks too big for quota file size (%llu > %llu).",
+ (loff_t)qinfo->dqi_blocks << qinfo->dqi_blocksize_bits,
+ i_size_read(sb_dqopt(sb)->files[type]));
+- goto out;
++ goto out_free;
+ }
+ if (qinfo->dqi_free_blk >= qinfo->dqi_blocks) {
+ quota_error(sb, "Free block number too big (%u >= %u).",
+ qinfo->dqi_free_blk, qinfo->dqi_blocks);
+- goto out;
++ goto out_free;
+ }
+ if (qinfo->dqi_free_entry >= qinfo->dqi_blocks) {
+ quota_error(sb, "Block with free entry too big (%u >= %u).",
+ qinfo->dqi_free_entry, qinfo->dqi_blocks);
+- goto out;
++ goto out_free;
+ }
+ ret = 0;
++out_free:
++ if (ret) {
++ kfree(info->dqi_priv);
++ info->dqi_priv = NULL;
++ }
+ out:
+ up_read(&dqopt->dqio_sem);
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 5abfa6297aa8cf2c60f0c6f74daf85d17f3aa84d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Feb 2021 16:05:19 +0100
+Subject: r8169: fix jumbo packet handling on RTL8168e
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 6cf739131a15e4177e58a1b4f2bede9d5da78552 ]
+
+Josef reported [0] that using jumbo packets fails on RTL8168e.
+Aligning the values for register MaxTxPacketSize with the
+vendor driver fixes the problem.
+
+[0] https://bugzilla.kernel.org/show_bug.cgi?id=211827
+
+Fixes: d58d46b5d851 ("r8169: jumbo fixes.")
+Reported-by: Josef Oškera <joskera@redhat.com>
+Tested-by: Josef Oškera <joskera@redhat.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/b15ddef7-0d50-4320-18f4-6a3f86fbfd3e@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 0d78408b4e269..470ff6b3ebef1 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2315,14 +2315,14 @@ static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp)
+
+ static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+ {
+- RTL_W8(tp, MaxTxPacketSize, 0x3f);
++ RTL_W8(tp, MaxTxPacketSize, 0x24);
+ RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+ RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01);
+ }
+
+ static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp)
+ {
+- RTL_W8(tp, MaxTxPacketSize, 0x0c);
++ RTL_W8(tp, MaxTxPacketSize, 0x3f);
+ RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+ RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01);
+ }
+--
+2.27.0
+
--- /dev/null
+From 03da1e4650ccd9a6a90b74d7eaa4ddde9fb049ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:39:25 +0800
+Subject: RDMA/hns: Add mapped page count checking for MTR
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit 9ea9a53ea93be1cc66729ceb920f0d07285d6bfd ]
+
+Add the mapped page count checking flow to avoid invalid page size when
+creating MTR.
+
+Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing")
+Link: https://lore.kernel.org/r/1612517974-31867-4-git-send-email-liweihang@huawei.com
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.c | 9 ++--
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 56 ++++++++++++++----------
+ 2 files changed, 40 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
+index edc9d6b98d954..cfd2e1b60c7f0 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
+@@ -1075,9 +1075,8 @@ static struct roce_hem_item *hem_list_alloc_item(struct hns_roce_dev *hr_dev,
+ return NULL;
+
+ if (exist_bt) {
+- hem->addr = dma_alloc_coherent(hr_dev->dev,
+- count * BA_BYTE_LEN,
+- &hem->dma_addr, GFP_KERNEL);
++ hem->addr = dma_alloc_coherent(hr_dev->dev, count * BA_BYTE_LEN,
++ &hem->dma_addr, GFP_KERNEL);
+ if (!hem->addr) {
+ kfree(hem);
+ return NULL;
+@@ -1336,6 +1335,10 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev,
+ if (ba_num < 1)
+ return -ENOMEM;
+
++ if (ba_num > unit)
++ return -ENOBUFS;
++
++ ba_num = min_t(int, ba_num, unit);
+ INIT_LIST_HEAD(&temp_root);
+ offset = r->offset;
+ /* indicate to last region */
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 1bcffd93ff3e3..1e0465f05b7da 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -631,30 +631,26 @@ int hns_roce_dealloc_mw(struct ib_mw *ibmw)
+ }
+
+ static int mtr_map_region(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+- dma_addr_t *pages, struct hns_roce_buf_region *region)
++ struct hns_roce_buf_region *region, dma_addr_t *pages,
++ int max_count)
+ {
++ int count, npage;
++ int offset, end;
+ __le64 *mtts;
+- int offset;
+- int count;
+- int npage;
+ u64 addr;
+- int end;
+ int i;
+
+- /* if hopnum is 0, buffer cannot store BAs, so skip write mtt */
+- if (!region->hopnum)
+- return 0;
+-
+ offset = region->offset;
+ end = offset + region->count;
+ npage = 0;
+- while (offset < end) {
++ while (offset < end && npage < max_count) {
++ count = 0;
+ mtts = hns_roce_hem_list_find_mtt(hr_dev, &mtr->hem_list,
+ offset, &count, NULL);
+ if (!mtts)
+ return -ENOBUFS;
+
+- for (i = 0; i < count; i++) {
++ for (i = 0; i < count && npage < max_count; i++) {
+ if (hr_dev->hw_rev == HNS_ROCE_HW_VER1)
+ addr = to_hr_hw_page_addr(pages[npage]);
+ else
+@@ -666,7 +662,7 @@ static int mtr_map_region(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+ offset += count;
+ }
+
+- return 0;
++ return npage;
+ }
+
+ static inline bool mtr_has_mtt(struct hns_roce_buf_attr *attr)
+@@ -833,8 +829,8 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+ {
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+ struct hns_roce_buf_region *r;
+- unsigned int i;
+- int err;
++ unsigned int i, mapped_cnt;
++ int ret;
+
+ /*
+ * Only use the first page address as root ba when hopnum is 0, this
+@@ -845,26 +841,42 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+ return 0;
+ }
+
+- for (i = 0; i < mtr->hem_cfg.region_count; i++) {
++ for (i = 0, mapped_cnt = 0; i < mtr->hem_cfg.region_count &&
++ mapped_cnt < page_cnt; i++) {
+ r = &mtr->hem_cfg.region[i];
++ /* if hopnum is 0, no need to map pages in this region */
++ if (!r->hopnum) {
++ mapped_cnt += r->count;
++ continue;
++ }
++
+ if (r->offset + r->count > page_cnt) {
+- err = -EINVAL;
++ ret = -EINVAL;
+ ibdev_err(ibdev,
+ "failed to check mtr%u end %u + %u, max %u.\n",
+ i, r->offset, r->count, page_cnt);
+- return err;
++ return ret;
+ }
+
+- err = mtr_map_region(hr_dev, mtr, &pages[r->offset], r);
+- if (err) {
++ ret = mtr_map_region(hr_dev, mtr, r, &pages[r->offset],
++ page_cnt - mapped_cnt);
++ if (ret < 0) {
+ ibdev_err(ibdev,
+ "failed to map mtr%u offset %u, ret = %d.\n",
+- i, r->offset, err);
+- return err;
++ i, r->offset, ret);
++ return ret;
+ }
++ mapped_cnt += ret;
++ ret = 0;
+ }
+
+- return 0;
++ if (mapped_cnt < page_cnt) {
++ ret = -ENOBUFS;
++ ibdev_err(ibdev, "failed to map mtr pages count: %u < %u.\n",
++ mapped_cnt, page_cnt);
++ }
++
++ return ret;
+ }
+
+ int hns_roce_mtr_find(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
+--
+2.27.0
+
--- /dev/null
+From 90bfae60dfd674649dc72e8135739ae6dc1f287d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:57:59 +0800
+Subject: RDMA/hns: Allocate one more recv SGE for HIP08
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit 9dd052474a2645b2a6171d19ad17b05b180d446d ]
+
+The RQ/SRQ of HIP08 needs one special sge to stop receive reliably. So the
+driver needs to allocate at least one SGE when creating RQ/SRQ and ensure
+that at least one SGE is filled with the special value during post_recv.
+
+Besides, the kernel driver should only do this for kernel ULP. For
+userspace ULP, the userspace driver will allocate the reserved SGE in
+buffer, and the kernel driver just needs to pin the corresponding size of
+memory based on the userspace driver's requirements.
+
+Link: https://lore.kernel.org/r/1611997090-48820-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 4 +++
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 28 ++++++++++-----
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 +-
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 37 +++++++++++++++----
+ drivers/infiniband/hw/hns/hns_roce_srq.c | 40 +++++++++++++++++++--
+ 5 files changed, 93 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index ad8253245a85f..dd3e3886ab96d 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -65,6 +65,8 @@
+ #define HNS_ROCE_CQE_WCMD_EMPTY_BIT 0x2
+ #define HNS_ROCE_MIN_CQE_CNT 16
+
++#define HNS_ROCE_RESERVED_SGE 1
++
+ #define HNS_ROCE_MAX_IRQ_NUM 128
+
+ #define HNS_ROCE_SGE_IN_WQE 2
+@@ -393,6 +395,7 @@ struct hns_roce_wq {
+ spinlock_t lock;
+ u32 wqe_cnt; /* WQE num */
+ u32 max_gs;
++ u32 rsv_sge;
+ int offset;
+ int wqe_shift; /* WQE size */
+ u32 head;
+@@ -496,6 +499,7 @@ struct hns_roce_srq {
+ unsigned long srqn;
+ u32 wqe_cnt;
+ int max_gs;
++ u32 rsv_sge;
+ int wqe_shift;
+ void __iomem *db_reg_l;
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 833e1f259936f..4d1e4bddf8327 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -741,6 +741,7 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp,
+ unsigned long flags;
+ void *wqe = NULL;
+ u32 wqe_idx;
++ u32 max_sge;
+ int nreq;
+ int ret;
+ int i;
+@@ -754,6 +755,7 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp,
+ goto out;
+ }
+
++ max_sge = hr_qp->rq.max_gs - hr_qp->rq.rsv_sge;
+ for (nreq = 0; wr; ++nreq, wr = wr->next) {
+ if (unlikely(hns_roce_wq_overflow(&hr_qp->rq, nreq,
+ hr_qp->ibqp.recv_cq))) {
+@@ -764,9 +766,9 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp,
+
+ wqe_idx = (hr_qp->rq.head + nreq) & (hr_qp->rq.wqe_cnt - 1);
+
+- if (unlikely(wr->num_sge > hr_qp->rq.max_gs)) {
++ if (unlikely(wr->num_sge > max_sge)) {
+ ibdev_err(ibdev, "num_sge = %d >= max_sge = %u.\n",
+- wr->num_sge, hr_qp->rq.max_gs);
++ wr->num_sge, max_sge);
+ ret = -EINVAL;
+ *bad_wr = wr;
+ goto out;
+@@ -781,9 +783,10 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp,
+ dseg++;
+ }
+
+- if (wr->num_sge < hr_qp->rq.max_gs) {
++ if (hr_qp->rq.rsv_sge) {
+ dseg->lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
+ dseg->addr = 0;
++ dseg->len = cpu_to_le32(HNS_ROCE_INVALID_SGE_LENGTH);
+ }
+
+ /* rq support inline data */
+@@ -879,6 +882,7 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ __le32 *srq_idx;
+ int ret = 0;
+ int wqe_idx;
++ u32 max_sge;
+ void *wqe;
+ int nreq;
+ int i;
+@@ -886,9 +890,13 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ spin_lock_irqsave(&srq->lock, flags);
+
+ ind = srq->head & (srq->wqe_cnt - 1);
++ max_sge = srq->max_gs - srq->rsv_sge;
+
+ for (nreq = 0; wr; ++nreq, wr = wr->next) {
+- if (unlikely(wr->num_sge >= srq->max_gs)) {
++ if (unlikely(wr->num_sge > max_sge)) {
++ ibdev_err(&hr_dev->ib_dev,
++ "srq: num_sge = %d, max_sge = %u.\n",
++ wr->num_sge, max_sge);
+ ret = -EINVAL;
+ *bad_wr = wr;
+ break;
+@@ -916,9 +924,9 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ dseg[i].addr = cpu_to_le64(wr->sg_list[i].addr);
+ }
+
+- if (wr->num_sge < srq->max_gs) {
+- dseg[i].len = 0;
+- dseg[i].lkey = cpu_to_le32(0x100);
++ if (srq->rsv_sge) {
++ dseg[i].len = cpu_to_le32(HNS_ROCE_INVALID_SGE_LENGTH);
++ dseg[i].lkey = cpu_to_le32(HNS_ROCE_INVALID_LKEY);
+ dseg[i].addr = 0;
+ }
+
+@@ -1999,10 +2007,12 @@ static int hns_roce_query_pf_caps(struct hns_roce_dev *hr_dev)
+ caps->max_sq_sg = le16_to_cpu(resp_a->max_sq_sg);
+ caps->max_sq_inline = le16_to_cpu(resp_a->max_sq_inline);
+ caps->max_rq_sg = le16_to_cpu(resp_a->max_rq_sg);
++ caps->max_rq_sg = roundup_pow_of_two(caps->max_rq_sg);
+ caps->max_extend_sg = le32_to_cpu(resp_a->max_extend_sg);
+ caps->num_qpc_timer = le16_to_cpu(resp_a->num_qpc_timer);
+ caps->num_cqc_timer = le16_to_cpu(resp_a->num_cqc_timer);
+ caps->max_srq_sges = le16_to_cpu(resp_a->max_srq_sges);
++ caps->max_srq_sges = roundup_pow_of_two(caps->max_srq_sges);
+ caps->num_aeq_vectors = resp_a->num_aeq_vectors;
+ caps->num_other_vectors = resp_a->num_other_vectors;
+ caps->max_sq_desc_sz = resp_a->max_sq_desc_sz;
+@@ -5083,7 +5093,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
+ done:
+ qp_attr->cur_qp_state = qp_attr->qp_state;
+ qp_attr->cap.max_recv_wr = hr_qp->rq.wqe_cnt;
+- qp_attr->cap.max_recv_sge = hr_qp->rq.max_gs;
++ qp_attr->cap.max_recv_sge = hr_qp->rq.max_gs - hr_qp->rq.rsv_sge;
+
+ if (!ibqp->uobject) {
+ qp_attr->cap.max_send_wr = hr_qp->sq.wqe_cnt;
+@@ -5395,7 +5405,7 @@ static int hns_roce_v2_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr)
+
+ attr->srq_limit = limit_wl;
+ attr->max_wr = srq->wqe_cnt - 1;
+- attr->max_sge = srq->max_gs;
++ attr->max_sge = srq->max_gs - srq->rsv_sge;
+
+ out:
+ hns_roce_free_cmd_mailbox(hr_dev, mailbox);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+index bdaccf86460dd..09d88d97a7ff9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -96,7 +96,8 @@
+ #define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ PAGE_SIZE
+ #define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFFF000
+ #define HNS_ROCE_V2_MAX_INNER_MTPT_NUM 2
+-#define HNS_ROCE_INVALID_LKEY 0x100
++#define HNS_ROCE_INVALID_LKEY 0x0
++#define HNS_ROCE_INVALID_SGE_LENGTH 0x80000000
+ #define HNS_ROCE_CMQ_TX_TIMEOUT 30000
+ #define HNS_ROCE_V2_UC_RC_SGE_NUM_IN_WQE 2
+ #define HNS_ROCE_V2_RSV_QPS 8
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 1116371adf74f..8695c96e66964 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -413,9 +413,32 @@ static void free_qpn(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+ mutex_unlock(&hr_dev->qp_table.bank_mutex);
+ }
+
++static u32 proc_rq_sge(struct hns_roce_dev *dev, struct hns_roce_qp *hr_qp,
++ bool user)
++{
++ u32 max_sge = dev->caps.max_rq_sg;
++
++ if (dev->pci_dev->revision >= PCI_REVISION_ID_HIP09)
++ return max_sge;
++
++ /* Reserve SGEs only for HIP08 in kernel; The userspace driver will
++ * calculate number of max_sge with reserved SGEs when allocating wqe
++ * buf, so there is no need to do this again in kernel. But the number
++ * may exceed the capacity of SGEs recorded in the firmware, so the
++ * kernel driver should just adapt the value accordingly.
++ */
++ if (user)
++ max_sge = roundup_pow_of_two(max_sge + 1);
++ else
++ hr_qp->rq.rsv_sge = 1;
++
++ return max_sge;
++}
++
+ static int set_rq_size(struct hns_roce_dev *hr_dev, struct ib_qp_cap *cap,
+- struct hns_roce_qp *hr_qp, int has_rq)
++ struct hns_roce_qp *hr_qp, int has_rq, bool user)
+ {
++ u32 max_sge = proc_rq_sge(hr_dev, hr_qp, user);
+ u32 cnt;
+
+ /* If srq exist, set zero for relative number of rq */
+@@ -431,8 +454,9 @@ static int set_rq_size(struct hns_roce_dev *hr_dev, struct ib_qp_cap *cap,
+
+ /* Check the validity of QP support capacity */
+ if (!cap->max_recv_wr || cap->max_recv_wr > hr_dev->caps.max_wqes ||
+- cap->max_recv_sge > hr_dev->caps.max_rq_sg) {
+- ibdev_err(&hr_dev->ib_dev, "RQ config error, depth=%u, sge=%d\n",
++ cap->max_recv_sge > max_sge) {
++ ibdev_err(&hr_dev->ib_dev,
++ "RQ config error, depth = %u, sge = %u\n",
+ cap->max_recv_wr, cap->max_recv_sge);
+ return -EINVAL;
+ }
+@@ -444,7 +468,8 @@ static int set_rq_size(struct hns_roce_dev *hr_dev, struct ib_qp_cap *cap,
+ return -EINVAL;
+ }
+
+- hr_qp->rq.max_gs = roundup_pow_of_two(max(1U, cap->max_recv_sge));
++ hr_qp->rq.max_gs = roundup_pow_of_two(max(1U, cap->max_recv_sge) +
++ hr_qp->rq.rsv_sge);
+
+ if (hr_dev->caps.max_rq_sg <= HNS_ROCE_SGE_IN_WQE)
+ hr_qp->rq.wqe_shift = ilog2(hr_dev->caps.max_rq_desc_sz);
+@@ -459,7 +484,7 @@ static int set_rq_size(struct hns_roce_dev *hr_dev, struct ib_qp_cap *cap,
+ hr_qp->rq_inl_buf.wqe_cnt = 0;
+
+ cap->max_recv_wr = cnt;
+- cap->max_recv_sge = hr_qp->rq.max_gs;
++ cap->max_recv_sge = hr_qp->rq.max_gs - hr_qp->rq.rsv_sge;
+
+ return 0;
+ }
+@@ -919,7 +944,7 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
+ hr_qp->sq_signal_bits = IB_SIGNAL_REQ_WR;
+
+ ret = set_rq_size(hr_dev, &init_attr->cap, hr_qp,
+- hns_roce_qp_has_rq(init_attr));
++ hns_roce_qp_has_rq(init_attr), !!udata);
+ if (ret) {
+ ibdev_err(ibdev, "failed to set user RQ size, ret = %d.\n",
+ ret);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index c4ae57e4173a1..8e20085b8920a 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -3,6 +3,7 @@
+ * Copyright (c) 2018 Hisilicon Limited.
+ */
+
++#include <linux/pci.h>
+ #include <rdma/ib_umem.h>
+ #include "hns_roce_device.h"
+ #include "hns_roce_cmd.h"
+@@ -279,6 +280,28 @@ static void free_srq_wrid(struct hns_roce_srq *srq)
+ srq->wrid = NULL;
+ }
+
++static u32 proc_srq_sge(struct hns_roce_dev *dev, struct hns_roce_srq *hr_srq,
++ bool user)
++{
++ u32 max_sge = dev->caps.max_srq_sges;
++
++ if (dev->pci_dev->revision >= PCI_REVISION_ID_HIP09)
++ return max_sge;
++
++ /* Reserve SGEs only for HIP08 in kernel; The userspace driver will
++ * calculate number of max_sge with reserved SGEs when allocating wqe
++ * buf, so there is no need to do this again in kernel. But the number
++ * may exceed the capacity of SGEs recorded in the firmware, so the
++ * kernel driver should just adapt the value accordingly.
++ */
++ if (user)
++ max_sge = roundup_pow_of_two(max_sge + 1);
++ else
++ hr_srq->rsv_sge = 1;
++
++ return max_sge;
++}
++
+ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ struct ib_srq_init_attr *init_attr,
+ struct ib_udata *udata)
+@@ -288,6 +311,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ struct hns_roce_srq *srq = to_hr_srq(ib_srq);
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+ struct hns_roce_ib_create_srq ucmd = {};
++ u32 max_sge;
+ int ret;
+ u32 cqn;
+
+@@ -295,16 +319,24 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ init_attr->srq_type != IB_SRQT_XRC)
+ return -EOPNOTSUPP;
+
+- /* Check the actual SRQ wqe and SRQ sge num */
++ max_sge = proc_srq_sge(hr_dev, srq, !!udata);
++
+ if (init_attr->attr.max_wr >= hr_dev->caps.max_srq_wrs ||
+- init_attr->attr.max_sge > hr_dev->caps.max_srq_sges)
++ init_attr->attr.max_sge > max_sge) {
++ ibdev_err(&hr_dev->ib_dev,
++ "SRQ config error, depth = %u, sge = %d\n",
++ init_attr->attr.max_wr, init_attr->attr.max_sge);
+ return -EINVAL;
++ }
+
+ mutex_init(&srq->mutex);
+ spin_lock_init(&srq->lock);
+
+ srq->wqe_cnt = roundup_pow_of_two(init_attr->attr.max_wr + 1);
+- srq->max_gs = init_attr->attr.max_sge;
++ srq->max_gs =
++ roundup_pow_of_two(init_attr->attr.max_sge + srq->rsv_sge);
++ init_attr->attr.max_wr = srq->wqe_cnt;
++ init_attr->attr.max_sge = srq->max_gs;
+
+ if (udata) {
+ ret = ib_copy_from_udata(&ucmd, udata,
+@@ -351,6 +383,8 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+
+ srq->event = hns_roce_ib_srq_event;
+ resp.srqn = srq->srqn;
++ srq->max_gs = init_attr->attr.max_sge;
++ init_attr->attr.max_sge = srq->max_gs - srq->rsv_sge;
+
+ if (udata) {
+ ret = ib_copy_to_udata(udata, &resp,
+--
+2.27.0
+
--- /dev/null
+From c65767294c5d8001e307a73679560e3d77437611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:39:23 +0800
+Subject: RDMA/hns: Avoid filling sgid index when modifying QP to RTR
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit 773f841ab1aeb0134e3872eb3545592732db8218 ]
+
+ULP usually set IB(V)_QP_AV when trying to modify QP to RTR if they want
+to record sgid index into QPC. For UD QPs, it is useless because it will
+be included in WQE. For RC QPs, it will be filled in
+hns_roce_set_path(). So sgid index shouldn't be filled by default. Then
+hns_get_gid_index() is moved to hns_roce_hw_v1.c because it is only called
+in it.
+
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Link: https://lore.kernel.org/r/1612517974-31867-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 16 ++++++++++++++++
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 -----------
+ drivers/infiniband/hw/hns/hns_roce_main.c | 16 ----------------
+ 3 files changed, 16 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+index f68585ff8e8a5..c2539a8d91116 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
+@@ -43,6 +43,22 @@
+ #include "hns_roce_hem.h"
+ #include "hns_roce_hw_v1.h"
+
++/**
++ * hns_get_gid_index - Get gid index.
++ * @hr_dev: pointer to structure hns_roce_dev.
++ * @port: port, value range: 0 ~ MAX
++ * @gid_index: gid_index, value range: 0 ~ MAX
++ * Description:
++ * N ports shared gids, allocation method as follow:
++ * GID[0][0], GID[1][0],.....GID[N - 1][0],
++ * GID[0][0], GID[1][0],.....GID[N - 1][0],
++ * And so on
++ */
++u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index)
++{
++ return gid_index * hr_dev->caps.num_ports + port;
++}
++
+ static void set_data_seg(struct hns_roce_wqe_data_seg *dseg, struct ib_sge *sg)
+ {
+ dseg->lkey = cpu_to_le32(sg->lkey);
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index a909993552e7f..b8f6d5f706ddc 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4254,7 +4254,6 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
+ struct hns_roce_v2_qp_context *context,
+ struct hns_roce_v2_qp_context *qpc_mask)
+ {
+- const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr);
+ struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
+ struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+@@ -4262,7 +4261,6 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
+ dma_addr_t irrl_ba;
+ enum ib_mtu mtu;
+ u8 lp_pktn_ini;
+- u8 port_num;
+ u64 *mtts;
+ u8 *dmac;
+ u8 *smac;
+@@ -4343,15 +4341,6 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
+ V2_QPC_BYTE_56_DQPN_M, V2_QPC_BYTE_56_DQPN_S, 0);
+ }
+
+- /* Configure GID index */
+- port_num = rdma_ah_get_port_num(&attr->ah_attr);
+- roce_set_field(context->byte_20_smac_sgid_idx,
+- V2_QPC_BYTE_20_SGID_IDX_M, V2_QPC_BYTE_20_SGID_IDX_S,
+- hns_get_gid_index(hr_dev, port_num - 1,
+- grh->sgid_index));
+- roce_set_field(qpc_mask->byte_20_smac_sgid_idx,
+- V2_QPC_BYTE_20_SGID_IDX_M, V2_QPC_BYTE_20_SGID_IDX_S, 0);
+-
+ memcpy(&(context->dmac), dmac, sizeof(u32));
+ roce_set_field(context->byte_52_udpspn_dmac, V2_QPC_BYTE_52_DMAC_M,
+ V2_QPC_BYTE_52_DMAC_S, *((u16 *)(&dmac[4])));
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index 60822e666f351..baadb12b13752 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -42,22 +42,6 @@
+ #include "hns_roce_device.h"
+ #include "hns_roce_hem.h"
+
+-/**
+- * hns_get_gid_index - Get gid index.
+- * @hr_dev: pointer to structure hns_roce_dev.
+- * @port: port, value range: 0 ~ MAX
+- * @gid_index: gid_index, value range: 0 ~ MAX
+- * Description:
+- * N ports shared gids, allocation method as follow:
+- * GID[0][0], GID[1][0],.....GID[N - 1][0],
+- * GID[0][0], GID[1][0],.....GID[N - 1][0],
+- * And so on
+- */
+-u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index)
+-{
+- return gid_index * hr_dev->caps.num_ports + port;
+-}
+-
+ static int hns_roce_set_mac(struct hns_roce_dev *hr_dev, u8 port, u8 *addr)
+ {
+ u8 phy_port;
+--
+2.27.0
+
--- /dev/null
+From b1bac9e97160949f03e616692bb04d1bfc2ca330 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:58:00 +0800
+Subject: RDMA/hns: Bugfix for checking whether the srq is full when post wr
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit 1620f09b96ec14c1ff1ff64ee0aeabc027c653d5 ]
+
+If a user posts WR by wr_list, the head pointer of idx_queue won't be
+updated until all wqes are filled, so the judgment of whether head equals
+to tail will get a wrong result. Fix above issue and move the head and
+tail pointer from the srq structure into the idx_queue structure. After
+idx_queue is filled with wqe idx, the head pointer of it will increase.
+
+Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
+Link: https://lore.kernel.org/r/1611997090-48820-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++--
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 19 ++++++++++++++-----
+ drivers/infiniband/hw/hns/hns_roce_srq.c | 5 +++--
+ 3 files changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index dd3e3886ab96d..2e42e25957938 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -492,6 +492,8 @@ struct hns_roce_idx_que {
+ struct hns_roce_mtr mtr;
+ int entry_shift;
+ unsigned long *bitmap;
++ u32 head;
++ u32 tail;
+ };
+
+ struct hns_roce_srq {
+@@ -511,8 +513,6 @@ struct hns_roce_srq {
+ u64 *wrid;
+ struct hns_roce_idx_que idx_que;
+ spinlock_t lock;
+- u16 head;
+- u16 tail;
+ struct mutex mutex;
+ void (*event)(struct hns_roce_srq *srq, enum hns_roce_event event);
+ };
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 4d1e4bddf8327..c05e418b6e538 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -849,11 +849,20 @@ static void hns_roce_free_srq_wqe(struct hns_roce_srq *srq, int wqe_index)
+ spin_lock(&srq->lock);
+
+ bitmap_clear(srq->idx_que.bitmap, wqe_index, 1);
+- srq->tail++;
++ srq->idx_que.tail++;
+
+ spin_unlock(&srq->lock);
+ }
+
++int hns_roce_srqwq_overflow(struct hns_roce_srq *srq, int nreq)
++{
++ struct hns_roce_idx_que *idx_que = &srq->idx_que;
++ unsigned int cur;
++
++ cur = idx_que->head - idx_que->tail;
++ return cur + nreq >= srq->wqe_cnt - 1;
++}
++
+ static int find_empty_entry(struct hns_roce_idx_que *idx_que,
+ unsigned long size)
+ {
+@@ -889,7 +898,7 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+
+ spin_lock_irqsave(&srq->lock, flags);
+
+- ind = srq->head & (srq->wqe_cnt - 1);
++ ind = srq->idx_que.head & (srq->wqe_cnt - 1);
+ max_sge = srq->max_gs - srq->rsv_sge;
+
+ for (nreq = 0; wr; ++nreq, wr = wr->next) {
+@@ -902,7 +911,7 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ break;
+ }
+
+- if (unlikely(srq->head == srq->tail)) {
++ if (unlikely(hns_roce_srqwq_overflow(srq, nreq))) {
+ ret = -ENOMEM;
+ *bad_wr = wr;
+ break;
+@@ -938,7 +947,7 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ }
+
+ if (likely(nreq)) {
+- srq->head += nreq;
++ srq->idx_que.head += nreq;
+
+ /*
+ * Make sure that descriptors are written before
+@@ -950,7 +959,7 @@ static int hns_roce_v2_post_srq_recv(struct ib_srq *ibsrq,
+ cpu_to_le32(HNS_ROCE_V2_SRQ_DB << V2_DB_BYTE_4_CMD_S |
+ (srq->srqn & V2_DB_BYTE_4_TAG_M));
+ srq_db.parameter =
+- cpu_to_le32(srq->head & V2_DB_PARAMETER_IDX_M);
++ cpu_to_le32(srq->idx_que.head & V2_DB_PARAMETER_IDX_M);
+
+ hns_roce_write64(hr_dev, (__le32 *)&srq_db, srq->db_reg_l);
+ }
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 8e20085b8920a..9f60a0a745e11 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -247,6 +247,9 @@ static int alloc_srq_idx(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
+ }
+ }
+
++ idx_que->head = 0;
++ idx_que->tail = 0;
++
+ return 0;
+ err_idx_mtr:
+ hns_roce_mtr_destroy(hr_dev, &idx_que->mtr);
+@@ -265,8 +268,6 @@ static void free_srq_idx(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)
+
+ static int alloc_srq_wrid(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq)
+ {
+- srq->head = 0;
+- srq->tail = srq->wqe_cnt - 1;
+ srq->wrid = kvmalloc_array(srq->wqe_cnt, sizeof(u64), GFP_KERNEL);
+ if (!srq->wrid)
+ return -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From d5ab6577e3d34ede73c2b679ec1cca9075622714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:39:26 +0800
+Subject: RDMA/hns: Disable RQ inline by default
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 7373de9adb19aebed2781d3fdde576533d626d7a ]
+
+This feature should only be enabled by querying capability from firmware.
+
+Fixes: ba6bb7e97421 ("RDMA/hns: Add interfaces to get pf capabilities from firmware")
+Link: https://lore.kernel.org/r/1612517974-31867-5-git-send-email-liweihang@huawei.com
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index b8f6d5f706ddc..43ed927860569 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1883,7 +1883,6 @@ static void set_default_caps(struct hns_roce_dev *hr_dev)
+
+ caps->flags = HNS_ROCE_CAP_FLAG_REREG_MR |
+ HNS_ROCE_CAP_FLAG_ROCE_V1_V2 |
+- HNS_ROCE_CAP_FLAG_RQ_INLINE |
+ HNS_ROCE_CAP_FLAG_RECORD_DB |
+ HNS_ROCE_CAP_FLAG_SQ_RECORD_DB;
+
+--
+2.27.0
+
--- /dev/null
+From e5055237663e73ed69f63350d0351ee73a563367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 17:39:24 +0800
+Subject: RDMA/hns: Fix type of sq_signal_bits
+
+From: Weihang Li <liweihang@huawei.com>
+
+[ Upstream commit ea4092f3b56b236d08890ea589506ebd76248c53 ]
+
+This bit should be in type of enum ib_sig_type, or there will be a sparse
+warning.
+
+Fixes: bfe860351e31 ("RDMA/hns: Fix cast from or to restricted __le32 for driver")
+Link: https://lore.kernel.org/r/1612517974-31867-3-git-send-email-liweihang@huawei.com
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 9ac6d760aa5b3..54abe615b502a 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -652,7 +652,7 @@ struct hns_roce_qp {
+ struct hns_roce_db sdb;
+ unsigned long en_flags;
+ u32 doorbell_qpn;
+- u32 sq_signal_bits;
++ enum ib_sig_type sq_signal_bits;
+ struct hns_roce_wq sq;
+
+ struct hns_roce_mtr mtr;
+--
+2.27.0
+
--- /dev/null
+From a7591a1c875086f11cd91333fa33492eacf8da82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:58:02 +0800
+Subject: RDMA/hns: Fixed wrong judgments in the goto branch
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit bb74fe7e81c8b2b65c6a351a247fdb9a969cbaec ]
+
+When an error occurs, the qp_table must be cleared, regardless of whether
+the SRQ feature is enabled.
+
+Fixes: 5c1f167af112 ("RDMA/hns: Init SRQ table for hip08")
+Link: https://lore.kernel.org/r/1611997090-48820-5-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
+index d9179bae4989d..60822e666f351 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -772,8 +772,7 @@ static int hns_roce_setup_hca(struct hns_roce_dev *hr_dev)
+ return 0;
+
+ err_qp_table_free:
+- if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_SRQ)
+- hns_roce_cleanup_qp_table(hr_dev);
++ hns_roce_cleanup_qp_table(hr_dev);
+
+ err_cq_table_free:
+ hns_roce_cleanup_cq_table(hr_dev);
+--
+2.27.0
+
--- /dev/null
+From e5c5e9e584859ae7d4fbab19ac48ee1fed197679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Feb 2021 16:55:40 +0800
+Subject: RDMA/hns: Fixes missing error code of CMDQ
+
+From: Lang Cheng <chenglang@huawei.com>
+
+[ Upstream commit 8f86e2eadac968200a6ab1d7074fc0f5cbc1e075 ]
+
+When posting a multi-descriptors command, the error code of previous
+failed descriptors may be rewrote to 0 by a later successful descriptor.
+
+Fixes: a04ff739f2a9 ("RDMA/hns: Add command queue support for hip08 RoCE driver")
+Link: https://lore.kernel.org/r/1612688143-28226-3-git-send-email-liweihang@huawei.com
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 43ed927860569..0f76e193317e6 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1264,7 +1264,7 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev,
+ u32 timeout = 0;
+ int handle = 0;
+ u16 desc_ret;
+- int ret = 0;
++ int ret;
+ int ntc;
+
+ spin_lock_bh(&csq->lock);
+@@ -1309,15 +1309,14 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev,
+ if (hns_roce_cmq_csq_done(hr_dev)) {
+ complete = true;
+ handle = 0;
++ ret = 0;
+ while (handle < num) {
+ /* get the result of hardware write back */
+ desc_to_use = &csq->desc[ntc];
+ desc[handle] = *desc_to_use;
+ dev_dbg(hr_dev->dev, "Get cmq desc:\n");
+ desc_ret = le16_to_cpu(desc[handle].retval);
+- if (desc_ret == CMD_EXEC_SUCCESS)
+- ret = 0;
+- else
++ if (unlikely(desc_ret != CMD_EXEC_SUCCESS))
+ ret = -EIO;
+ priv->cmq.last_status = desc_ret;
+ ntc++;
+--
+2.27.0
+
--- /dev/null
+From 1487e318615c5249d3bae88161f553a29f27bc50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:58:01 +0800
+Subject: RDMA/hns: Force srq_limit to 0 when creating SRQ
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit b5df9b7a2f965b7903850d8f89846ffe0080b84b ]
+
+According to the IB Specification, srq_limit shouldn't be configured
+during SRQ creation. If a user set srq_limit at this time, the driver
+should forced it to zero, or the result of creating SRQ will conflict with
+the result of querying SRQ.
+
+Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
+Link: https://lore.kernel.org/r/1611997090-48820-4-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_srq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index 9f60a0a745e11..ecc42c59e3cfc 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -338,6 +338,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ roundup_pow_of_two(init_attr->attr.max_sge + srq->rsv_sge);
+ init_attr->attr.max_wr = srq->wqe_cnt;
+ init_attr->attr.max_sge = srq->max_gs;
++ init_attr->attr.srq_limit = 0;
+
+ if (udata) {
+ ret = ib_copy_from_udata(&ucmd, udata,
+--
+2.27.0
+
--- /dev/null
+From f01e4d923499312191775491afe605bf0d63d7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 16:58:03 +0800
+Subject: RDMA/hns: Remove the reserved WQE of SRQ
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit 6ee00fbf733d7e17ca935e5636adfce605b10659 ]
+
+Each SRQs contain an reserved WQE, it is inappropriate and should be
+removed.
+
+Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
+Link: https://lore.kernel.org/r/1611997090-48820-6-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 1 +
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++---
+ drivers/infiniband/hw/hns/hns_roce_srq.c | 6 ++++--
+ 3 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index 2e42e25957938..9ac6d760aa5b3 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -54,6 +54,7 @@
+ /* Hardware specification only for v1 engine */
+ #define HNS_ROCE_MIN_CQE_NUM 0x40
+ #define HNS_ROCE_MIN_WQE_NUM 0x20
++#define HNS_ROCE_MIN_SRQ_WQE_NUM 1
+
+ /* Hardware specification only for v1 engine */
+ #define HNS_ROCE_MAX_INNER_MTPT_NUM 0x7
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index c05e418b6e538..a909993552e7f 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -860,7 +860,7 @@ int hns_roce_srqwq_overflow(struct hns_roce_srq *srq, int nreq)
+ unsigned int cur;
+
+ cur = idx_que->head - idx_que->tail;
+- return cur + nreq >= srq->wqe_cnt - 1;
++ return cur + nreq >= srq->wqe_cnt;
+ }
+
+ static int find_empty_entry(struct hns_roce_idx_que *idx_que,
+@@ -5350,7 +5350,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq,
+ return -EINVAL;
+
+ if (srq_attr_mask & IB_SRQ_LIMIT) {
+- if (srq_attr->srq_limit >= srq->wqe_cnt)
++ if (srq_attr->srq_limit > srq->wqe_cnt)
+ return -EINVAL;
+
+ mailbox = hns_roce_alloc_cmd_mailbox(hr_dev);
+@@ -5413,7 +5413,7 @@ static int hns_roce_v2_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr)
+ SRQC_BYTE_8_SRQ_LIMIT_WL_S);
+
+ attr->srq_limit = limit_wl;
+- attr->max_wr = srq->wqe_cnt - 1;
++ attr->max_wr = srq->wqe_cnt;
+ attr->max_sge = srq->max_gs - srq->rsv_sge;
+
+ out:
+diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
+index ecc42c59e3cfc..51de9305bb4de 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -322,7 +322,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+
+ max_sge = proc_srq_sge(hr_dev, srq, !!udata);
+
+- if (init_attr->attr.max_wr >= hr_dev->caps.max_srq_wrs ||
++ if (init_attr->attr.max_wr > hr_dev->caps.max_srq_wrs ||
+ init_attr->attr.max_sge > max_sge) {
+ ibdev_err(&hr_dev->ib_dev,
+ "SRQ config error, depth = %u, sge = %d\n",
+@@ -333,7 +333,9 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
+ mutex_init(&srq->mutex);
+ spin_lock_init(&srq->lock);
+
+- srq->wqe_cnt = roundup_pow_of_two(init_attr->attr.max_wr + 1);
++ init_attr->attr.max_wr = max_t(u32, init_attr->attr.max_wr,
++ HNS_ROCE_MIN_SRQ_WQE_NUM);
++ srq->wqe_cnt = roundup_pow_of_two(init_attr->attr.max_wr);
+ srq->max_gs =
+ roundup_pow_of_two(init_attr->attr.max_sge + srq->rsv_sge);
+ init_attr->attr.max_wr = srq->wqe_cnt;
+--
+2.27.0
+
--- /dev/null
+From 1f9ddfbaddd3b15cf86d4866c23bebae95782373 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:07:09 +0200
+Subject: RDMA/mlx5: Allow creating all QPs even when non RDMA profile is used
+
+From: Mark Bloch <mbloch@nvidia.com>
+
+[ Upstream commit 2614488d1f3cd5989375042286b11424208e20c8 ]
+
+The cited commit disallowed creating any QP which isn't raw ethernet, reg
+umr or the special UD qp for testing WC, this proved too strict.
+
+While modify can't be done (no GIDS/GID table for example) just creating a
+QP is okay.
+
+This patch partially reverts the bellow mentioned commit and places the
+restriction at the modify QP stage and not at the creation. DEVX commands
+should be used to manipulate such QPs.
+
+Fixes: 42caf9cb5937 ("RDMA/mlx5: Allow only raw Ethernet QPs when RoCE isn't enabled")
+Link: https://lore.kernel.org/r/20210125120709.836718-1-leon@kernel.org
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 0cb7cc642d87d..bab40ad527dae 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2432,9 +2432,6 @@ static int check_qp_type(struct mlx5_ib_dev *dev, struct ib_qp_init_attr *attr,
+ case MLX5_IB_QPT_HW_GSI:
+ case IB_QPT_DRIVER:
+ case IB_QPT_GSI:
+- if (dev->profile == &raw_eth_profile)
+- goto out;
+- fallthrough;
+ case IB_QPT_RAW_PACKET:
+ case IB_QPT_UD:
+ case MLX5_IB_QPT_REG_UMR:
+@@ -2629,10 +2626,6 @@ static int process_create_flags(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
+ int create_flags = attr->create_flags;
+ bool cond;
+
+- if (qp->type == IB_QPT_UD && dev->profile == &raw_eth_profile)
+- if (create_flags & ~MLX5_IB_QP_CREATE_WC_TEST)
+- return -EINVAL;
+-
+ if (qp_type == MLX5_IB_QPT_DCT)
+ return (create_flags) ? -EINVAL : 0;
+
+@@ -4211,6 +4204,23 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return 0;
+ }
+
++static bool mlx5_ib_modify_qp_allowed(struct mlx5_ib_dev *dev,
++ struct mlx5_ib_qp *qp,
++ enum ib_qp_type qp_type)
++{
++ if (dev->profile != &raw_eth_profile)
++ return true;
++
++ if (qp_type == IB_QPT_RAW_PACKET || qp_type == MLX5_IB_QPT_REG_UMR)
++ return true;
++
++ /* Internal QP used for wc testing, with NOPs in wq */
++ if (qp->flags & MLX5_IB_QP_CREATE_WC_TEST)
++ return true;
++
++ return false;
++}
++
+ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int attr_mask, struct ib_udata *udata)
+ {
+@@ -4223,6 +4233,9 @@ int mlx5_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ int err = -EINVAL;
+ int port;
+
++ if (!mlx5_ib_modify_qp_allowed(dev, qp, ibqp->qp_type))
++ return -EOPNOTSUPP;
++
+ if (attr_mask & ~(IB_QP_ATTR_STANDARD_BITS | IB_QP_RATE_LIMIT))
+ return -EOPNOTSUPP;
+
+--
+2.27.0
+
--- /dev/null
+From 8a2c76b0fe9caf6d719b6ed93d1ef6f163911471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 15:01:19 +0200
+Subject: RDMA/mlx5: Use the correct obj_id upon DEVX TIR creation
+
+From: Yishai Hadas <yishaih@nvidia.com>
+
+[ Upstream commit 8798e4ad0abe0ba1221928a46561981c510be0c6 ]
+
+Use the correct obj_id upon DEVX TIR creation by strictly taking the tirn
+24 bits and not the general obj_id which is 32 bits.
+
+Fixes: 7efce3691d33 ("IB/mlx5: Add obj create and destroy functionality")
+Link: https://lore.kernel.org/r/20201230130121.180350-2-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
+index 819c142857d65..ff8e17d7f7ca8 100644
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -1064,7 +1064,9 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din,
+ MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_RQT);
+ break;
+ case MLX5_CMD_OP_CREATE_TIR:
+- MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++ *obj_id = MLX5_GET(create_tir_out, out, tirn);
++ MLX5_SET(destroy_tir_in, din, opcode, MLX5_CMD_OP_DESTROY_TIR);
++ MLX5_SET(destroy_tir_in, din, tirn, *obj_id);
+ break;
+ case MLX5_CMD_OP_CREATE_TIS:
+ MLX5_SET(general_obj_in_cmd_hdr, din, opcode, MLX5_CMD_OP_DESTROY_TIS);
+--
+2.27.0
+
--- /dev/null
+From 151cce02402899376a2b8538ac342a13f3a2eccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:03 +0100
+Subject: RDMA/rtrs: Call kobject_put in the failure path
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit 424774c9f3fa100ef7d9cfb9ee211e2ba1cd5119 ]
+
+Per the comment of kobject_init_and_add, we need to free the memory
+by call kobject_put.
+
+Fixes: 215378b838df ("RDMA/rtrs: client: sysfs interface functions")
+Fixes: 91b11610af8d ("RDMA/rtrs: server: sysfs interface functions")
+Link: https://lore.kernel.org/r/20201217141915.56989-8-jinpu.wang@cloud.ionos.com
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 2 ++
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 3 ++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+index ba00f0de14caa..ad77659800cd2 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+@@ -408,6 +408,7 @@ int rtrs_clt_create_sess_files(struct rtrs_clt_sess *sess)
+ "%s", str);
+ if (err) {
+ pr_err("kobject_init_and_add: %d\n", err);
++ kobject_put(&sess->kobj);
+ return err;
+ }
+ err = sysfs_create_group(&sess->kobj, &rtrs_clt_sess_attr_group);
+@@ -419,6 +420,7 @@ int rtrs_clt_create_sess_files(struct rtrs_clt_sess *sess)
+ &sess->kobj, "stats");
+ if (err) {
+ pr_err("kobject_init_and_add: %d\n", err);
++ kobject_put(&sess->stats->kobj_stats);
+ goto remove_group;
+ }
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index cca3a0acbabc5..0a3886629cae8 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -236,6 +236,7 @@ static int rtrs_srv_create_stats_files(struct rtrs_srv_sess *sess)
+ &sess->kobj, "stats");
+ if (err) {
+ rtrs_err(s, "kobject_init_and_add(): %d\n", err);
++ kobject_put(&sess->stats->kobj_stats);
+ return err;
+ }
+ err = sysfs_create_group(&sess->stats->kobj_stats,
+@@ -292,8 +293,8 @@ remove_group:
+ sysfs_remove_group(&sess->kobj, &rtrs_srv_sess_attr_group);
+ put_kobj:
+ kobject_del(&sess->kobj);
+- kobject_put(&sess->kobj);
+ destroy_root:
++ kobject_put(&sess->kobj);
+ rtrs_srv_destroy_once_sysfs_root_folders(sess);
+
+ return err;
+--
+2.27.0
+
--- /dev/null
+From 2ed19589678e22cf64a001118940c8940bc4550e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:10 +0100
+Subject: RDMA/rtrs-clt: Refactor the failure cases in alloc_clt
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit eab098246625e91c1cbd6e8f75b09e4c9c28a9fc ]
+
+Make all failure cases go to the common path to avoid duplicate code.
+And some issued existed before.
+
+1. clt need to be freed to avoid memory leak.
+
+2. return ERR_PTR(-ENOMEM) if kobject_create_and_add fails, because
+ rtrs_clt_open checks the return value of by call "IS_ERR(clt)".
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-15-jinpu.wang@cloud.ionos.com
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index b3fb5fb93815f..172bf7f221ff0 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -2570,11 +2570,8 @@ static struct rtrs_clt *alloc_clt(const char *sessname, size_t paths_num,
+ clt->dev.class = rtrs_clt_dev_class;
+ clt->dev.release = rtrs_clt_dev_release;
+ err = dev_set_name(&clt->dev, "%s", sessname);
+- if (err) {
+- free_percpu(clt->pcpu_path);
+- kfree(clt);
+- return ERR_PTR(err);
+- }
++ if (err)
++ goto err;
+ /*
+ * Suppress user space notification until
+ * sysfs files are created
+@@ -2582,29 +2579,31 @@ static struct rtrs_clt *alloc_clt(const char *sessname, size_t paths_num,
+ dev_set_uevent_suppress(&clt->dev, true);
+ err = device_register(&clt->dev);
+ if (err) {
+- free_percpu(clt->pcpu_path);
+ put_device(&clt->dev);
+- return ERR_PTR(err);
++ goto err;
+ }
+
+ clt->kobj_paths = kobject_create_and_add("paths", &clt->dev.kobj);
+ if (!clt->kobj_paths) {
+- free_percpu(clt->pcpu_path);
+- device_unregister(&clt->dev);
+- return NULL;
++ err = -ENOMEM;
++ goto err_dev;
+ }
+ err = rtrs_clt_create_sysfs_root_files(clt);
+ if (err) {
+- free_percpu(clt->pcpu_path);
+ kobject_del(clt->kobj_paths);
+ kobject_put(clt->kobj_paths);
+- device_unregister(&clt->dev);
+- return ERR_PTR(err);
++ goto err_dev;
+ }
+ dev_set_uevent_suppress(&clt->dev, false);
+ kobject_uevent(&clt->dev.kobj, KOBJ_ADD);
+
+ return clt;
++err_dev:
++ device_unregister(&clt->dev);
++err:
++ free_percpu(clt->pcpu_path);
++ kfree(clt);
++ return ERR_PTR(err);
+ }
+
+ static void wait_for_inflight_permits(struct rtrs_clt *clt)
+--
+2.27.0
+
--- /dev/null
+From 10b7d76c0efdaf9c0fffe71e19ff24010607962f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:01 +0100
+Subject: RDMA/rtrs-clt: Set mininum limit when create QP
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit f47e4e3e71724f625958b0059f6c8ac5d44d27ef ]
+
+Currently rtrs when create_qp use a coarse numbers (bigger in general),
+which leads to hardware create more resources which only waste memory
+with no benefits.
+
+- SERVICE con,
+For max_send_wr/max_recv_wr, it's 2 times SERVICE_CON_QUEUE_DEPTH + 2
+
+- IO con
+For max_send_wr/max_recv_wr, it's sess->queue_depth * 3 + 1
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-6-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 719254fc83a1c..b3fb5fb93815f 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1511,7 +1511,7 @@ static void destroy_con(struct rtrs_clt_con *con)
+ static int create_con_cq_qp(struct rtrs_clt_con *con)
+ {
+ struct rtrs_clt_sess *sess = to_clt_sess(con->c.sess);
+- u32 wr_queue_size;
++ u32 max_send_wr, max_recv_wr, cq_size;
+ int err, cq_vector;
+ struct rtrs_msg_rkey_rsp *rsp;
+
+@@ -1523,7 +1523,8 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
+ * + 2 for drain and heartbeat
+ * in case qp gets into error state
+ */
+- wr_queue_size = SERVICE_CON_QUEUE_DEPTH * 3 + 2;
++ max_send_wr = SERVICE_CON_QUEUE_DEPTH * 2 + 2;
++ max_recv_wr = SERVICE_CON_QUEUE_DEPTH * 2 + 2;
+ /* We must be the first here */
+ if (WARN_ON(sess->s.dev))
+ return -EINVAL;
+@@ -1555,25 +1556,29 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
+
+ /* Shared between connections */
+ sess->s.dev_ref++;
+- wr_queue_size =
++ max_send_wr =
+ min_t(int, sess->s.dev->ib_dev->attrs.max_qp_wr,
+ /* QD * (REQ + RSP + FR REGS or INVS) + drain */
+ sess->queue_depth * 3 + 1);
++ max_recv_wr =
++ min_t(int, sess->s.dev->ib_dev->attrs.max_qp_wr,
++ sess->queue_depth * 3 + 1);
+ }
+ /* alloc iu to recv new rkey reply when server reports flags set */
+ if (sess->flags == RTRS_MSG_NEW_RKEY_F || con->c.cid == 0) {
+- con->rsp_ius = rtrs_iu_alloc(wr_queue_size, sizeof(*rsp),
++ con->rsp_ius = rtrs_iu_alloc(max_recv_wr, sizeof(*rsp),
+ GFP_KERNEL, sess->s.dev->ib_dev,
+ DMA_FROM_DEVICE,
+ rtrs_clt_rdma_done);
+ if (!con->rsp_ius)
+ return -ENOMEM;
+- con->queue_size = wr_queue_size;
++ con->queue_size = max_recv_wr;
+ }
++ cq_size = max_send_wr + max_recv_wr;
+ cq_vector = con->cpu % sess->s.dev->ib_dev->num_comp_vectors;
+ err = rtrs_cq_qp_create(&sess->s, &con->c, sess->max_send_sge,
+- cq_vector, wr_queue_size, wr_queue_size,
+- wr_queue_size, IB_POLL_SOFTIRQ);
++ cq_vector, cq_size, max_send_wr,
++ max_recv_wr, IB_POLL_SOFTIRQ);
+ /*
+ * In case of error we do not bother to clean previous allocations,
+ * since destroy_con_cq_qp() must be called.
+--
+2.27.0
+
--- /dev/null
+From 0c94b33405183de2f5dbf9867d3a9d0165a179f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:18:57 +0100
+Subject: RDMA/rtrs: Extend ibtrs_cq_qp_create
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 7490fd1fe836ba3c7eda7a4b1cfd9e44389ffda5 ]
+
+rtrs does not have same limit for both max_send_wr and max_recv_wr,
+To allow client and server set different values, export in a separate
+parameter for rtrs_cq_qp_create.
+
+Also fix the type accordingly, u32 should be used instead of u16.
+
+Fixes: c0894b3ea69d ("RDMA/rtrs: core: lib functions shared between client and server modules")
+Link: https://lore.kernel.org/r/20201217141915.56989-2-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 ++--
+ drivers/infiniband/ulp/rtrs/rtrs-pri.h | 5 +++--
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++--
+ drivers/infiniband/ulp/rtrs/rtrs.c | 14 ++++++++------
+ 4 files changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 67f86c405a265..719254fc83a1c 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -1511,7 +1511,7 @@ static void destroy_con(struct rtrs_clt_con *con)
+ static int create_con_cq_qp(struct rtrs_clt_con *con)
+ {
+ struct rtrs_clt_sess *sess = to_clt_sess(con->c.sess);
+- u16 wr_queue_size;
++ u32 wr_queue_size;
+ int err, cq_vector;
+ struct rtrs_msg_rkey_rsp *rsp;
+
+@@ -1573,7 +1573,7 @@ static int create_con_cq_qp(struct rtrs_clt_con *con)
+ cq_vector = con->cpu % sess->s.dev->ib_dev->num_comp_vectors;
+ err = rtrs_cq_qp_create(&sess->s, &con->c, sess->max_send_sge,
+ cq_vector, wr_queue_size, wr_queue_size,
+- IB_POLL_SOFTIRQ);
++ wr_queue_size, IB_POLL_SOFTIRQ);
+ /*
+ * In case of error we do not bother to clean previous allocations,
+ * since destroy_con_cq_qp() must be called.
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+index 3f2918671dbed..d5621e6fad1b1 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+@@ -303,8 +303,9 @@ int rtrs_post_rdma_write_imm_empty(struct rtrs_con *con, struct ib_cqe *cqe,
+ struct ib_send_wr *head);
+
+ int rtrs_cq_qp_create(struct rtrs_sess *rtrs_sess, struct rtrs_con *con,
+- u32 max_send_sge, int cq_vector, u16 cq_size,
+- u16 wr_queue_size, enum ib_poll_context poll_ctx);
++ u32 max_send_sge, int cq_vector, int cq_size,
++ u32 max_send_wr, u32 max_recv_wr,
++ enum ib_poll_context poll_ctx);
+ void rtrs_cq_qp_destroy(struct rtrs_con *con);
+
+ void rtrs_init_hb(struct rtrs_sess *sess, struct ib_cqe *cqe,
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index c42fd470c4eb4..ed4628f032bb6 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1586,7 +1586,7 @@ static int create_con(struct rtrs_srv_sess *sess,
+ struct rtrs_sess *s = &sess->s;
+ struct rtrs_srv_con *con;
+
+- u16 cq_size, wr_queue_size;
++ u32 cq_size, wr_queue_size;
+ int err, cq_vector;
+
+ con = kzalloc(sizeof(*con), GFP_KERNEL);
+@@ -1630,7 +1630,8 @@ static int create_con(struct rtrs_srv_sess *sess,
+
+ /* TODO: SOFTIRQ can be faster, but be careful with softirq context */
+ err = rtrs_cq_qp_create(&sess->s, &con->c, 1, cq_vector, cq_size,
+- wr_queue_size, IB_POLL_WORKQUEUE);
++ wr_queue_size, wr_queue_size,
++ IB_POLL_WORKQUEUE);
+ if (err) {
+ rtrs_err(s, "rtrs_cq_qp_create(), err: %d\n", err);
+ goto free_con;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c
+index 2e3a849e0a77c..df52427f17106 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs.c
+@@ -231,14 +231,14 @@ static int create_cq(struct rtrs_con *con, int cq_vector, u16 cq_size,
+ }
+
+ static int create_qp(struct rtrs_con *con, struct ib_pd *pd,
+- u16 wr_queue_size, u32 max_sge)
++ u32 max_send_wr, u32 max_recv_wr, u32 max_sge)
+ {
+ struct ib_qp_init_attr init_attr = {NULL};
+ struct rdma_cm_id *cm_id = con->cm_id;
+ int ret;
+
+- init_attr.cap.max_send_wr = wr_queue_size;
+- init_attr.cap.max_recv_wr = wr_queue_size;
++ init_attr.cap.max_send_wr = max_send_wr;
++ init_attr.cap.max_recv_wr = max_recv_wr;
+ init_attr.cap.max_recv_sge = 1;
+ init_attr.event_handler = qp_event_handler;
+ init_attr.qp_context = con;
+@@ -260,8 +260,9 @@ static int create_qp(struct rtrs_con *con, struct ib_pd *pd,
+ }
+
+ int rtrs_cq_qp_create(struct rtrs_sess *sess, struct rtrs_con *con,
+- u32 max_send_sge, int cq_vector, u16 cq_size,
+- u16 wr_queue_size, enum ib_poll_context poll_ctx)
++ u32 max_send_sge, int cq_vector, int cq_size,
++ u32 max_send_wr, u32 max_recv_wr,
++ enum ib_poll_context poll_ctx)
+ {
+ int err;
+
+@@ -269,7 +270,8 @@ int rtrs_cq_qp_create(struct rtrs_sess *sess, struct rtrs_con *con,
+ if (err)
+ return err;
+
+- err = create_qp(con, sess->dev->ib_pd, wr_queue_size, max_send_sge);
++ err = create_qp(con, sess->dev->ib_pd, max_send_wr, max_recv_wr,
++ max_send_sge);
+ if (err) {
+ ib_free_cq(con->cq);
+ con->cq = NULL;
+--
+2.27.0
+
--- /dev/null
+From fdc5649e8079b272ca373b2273fa948d8f92cd6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:15 +0100
+Subject: RDMA/rtrs: Fix KASAN: stack-out-of-bounds bug
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 7fbc3c373eefc291ff96d48496106c106b7f81c6 ]
+
+When KASAN is enabled, we notice warning below:
+[ 483.436975] ==================================================================
+[ 483.437234] BUG: KASAN: stack-out-of-bounds in _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.437430] Read of size 4 at addr ffff88a195fd7d30 by task kworker/1:3/6954
+
+[ 483.437731] CPU: 1 PID: 6954 Comm: kworker/1:3 Kdump: loaded Tainted: G O 5.4.82-pserver #5.4.82-1+feature+linux+5.4.y+dbg+20201210.1532+987e7a6~deb10
+[ 483.437976] Hardware name: Supermicro Super Server/X11DDW-L, BIOS 3.3 02/21/2020
+[ 483.438168] Workqueue: rtrs_server_wq hb_work [rtrs_core]
+[ 483.438323] Call Trace:
+[ 483.438486] dump_stack+0x96/0xe0
+[ 483.438646] ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.438802] print_address_description.constprop.6+0x1b/0x220
+[ 483.438966] ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.439133] ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.439285] __kasan_report.cold.9+0x1a/0x32
+[ 483.439444] ? _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.439597] kasan_report+0x10/0x20
+[ 483.439752] _mlx5_ib_post_send+0x188a/0x2560 [mlx5_ib]
+[ 483.439910] ? update_sd_lb_stats+0xfb1/0xfc0
+[ 483.440073] ? set_reg_wr+0x520/0x520 [mlx5_ib]
+[ 483.440222] ? update_group_capacity+0x340/0x340
+[ 483.440377] ? find_busiest_group+0x314/0x870
+[ 483.440526] ? update_sd_lb_stats+0xfc0/0xfc0
+[ 483.440683] ? __bitmap_and+0x6f/0x100
+[ 483.440832] ? __lock_acquire+0xa2/0x2150
+[ 483.440979] ? __lock_acquire+0xa2/0x2150
+[ 483.441128] ? __lock_acquire+0xa2/0x2150
+[ 483.441279] ? debug_lockdep_rcu_enabled+0x23/0x60
+[ 483.441430] ? lock_downgrade+0x390/0x390
+[ 483.441582] ? __lock_acquire+0xa2/0x2150
+[ 483.441729] ? __lock_acquire+0xa2/0x2150
+[ 483.441876] ? newidle_balance+0x425/0x8f0
+[ 483.442024] ? __lock_acquire+0xa2/0x2150
+[ 483.442172] ? debug_lockdep_rcu_enabled+0x23/0x60
+[ 483.442330] hb_work+0x15d/0x1d0 [rtrs_core]
+[ 483.442479] ? schedule_hb+0x50/0x50 [rtrs_core]
+[ 483.442627] ? lock_downgrade+0x390/0x390
+[ 483.442781] ? process_one_work+0x40d/0xa50
+[ 483.442931] process_one_work+0x4ee/0xa50
+[ 483.443082] ? pwq_dec_nr_in_flight+0x110/0x110
+[ 483.443231] ? do_raw_spin_lock+0x119/0x1d0
+[ 483.443383] worker_thread+0x65/0x5c0
+[ 483.443532] ? process_one_work+0xa50/0xa50
+[ 483.451839] kthread+0x1e2/0x200
+[ 483.451983] ? kthread_create_on_node+0xc0/0xc0
+[ 483.452139] ret_from_fork+0x3a/0x50
+
+The problem is we use wrong type when send wr, hw driver expect the type
+of IB_WR_RDMA_WRITE_WITH_IMM wr should be ib_rdma_wr, and doing
+container_of to access member. The fix is simple use ib_rdma_wr instread
+of ib_send_wr.
+
+Fixes: c0894b3ea69d ("RDMA/rtrs: core: lib functions shared between client and server modules")
+Link: https://lore.kernel.org/r/20201217141915.56989-20-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c
+index df52427f17106..da4ff764dd3f0 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs.c
+@@ -182,16 +182,16 @@ int rtrs_post_rdma_write_imm_empty(struct rtrs_con *con, struct ib_cqe *cqe,
+ u32 imm_data, enum ib_send_flags flags,
+ struct ib_send_wr *head)
+ {
+- struct ib_send_wr wr;
++ struct ib_rdma_wr wr;
+
+- wr = (struct ib_send_wr) {
+- .wr_cqe = cqe,
+- .send_flags = flags,
+- .opcode = IB_WR_RDMA_WRITE_WITH_IMM,
+- .ex.imm_data = cpu_to_be32(imm_data),
++ wr = (struct ib_rdma_wr) {
++ .wr.wr_cqe = cqe,
++ .wr.send_flags = flags,
++ .wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM,
++ .wr.ex.imm_data = cpu_to_be32(imm_data),
+ };
+
+- return rtrs_post_send(con->qp, head, &wr);
++ return rtrs_post_send(con->qp, head, &wr.wr);
+ }
+ EXPORT_SYMBOL_GPL(rtrs_post_rdma_write_imm_empty);
+
+--
+2.27.0
+
--- /dev/null
+From a23aa9cf492630ce300022ae264becb8d7077d6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 14:45:23 +0100
+Subject: RDMA/rtrs: Only allow addition of path to an already established
+ session
+
+From: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+
+[ Upstream commit 03e9b33a0fd677f554b03352646c13459bf60458 ]
+
+While adding a path from the client side to an already established
+session, it was possible to provide the destination IP to a different
+server. This is dangerous.
+
+This commit adds an extra member to the rtrs_msg_conn_req structure, named
+first_conn; which is supposed to notify if the connection request is the
+first for that session or not.
+
+On the server side, if a session does not exist but the first_conn
+received inside the rtrs_msg_conn_req structure is 1, the connection
+request is failed. This signifies that the connection request is for an
+already existing session, and since the server did not find one, it is an
+wrong connection request.
+
+Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20210212134525.103456-3-jinpu.wang@cloud.ionos.com
+Signed-off-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Reviewed-by: Lutz Pogrell <lutz.pogrell@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt.c | 7 +++++++
+ drivers/infiniband/ulp/rtrs/rtrs-clt.h | 1 +
+ drivers/infiniband/ulp/rtrs/rtrs-pri.h | 4 +++-
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 21 +++++++++++++++------
+ 4 files changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+index 172bf7f221ff0..785cd1cf2a402 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+@@ -31,6 +31,8 @@
+ */
+ #define RTRS_RECONNECT_SEED 8
+
++#define FIRST_CONN 0x01
++
+ MODULE_DESCRIPTION("RDMA Transport Client");
+ MODULE_LICENSE("GPL");
+
+@@ -1662,6 +1664,7 @@ static int rtrs_rdma_route_resolved(struct rtrs_clt_con *con)
+ .cid_num = cpu_to_le16(sess->s.con_num),
+ .recon_cnt = cpu_to_le16(sess->s.recon_cnt),
+ };
++ msg.first_conn = sess->for_new_clt ? FIRST_CONN : 0;
+ uuid_copy(&msg.sess_uuid, &sess->s.uuid);
+ uuid_copy(&msg.paths_uuid, &clt->paths_uuid);
+
+@@ -1747,6 +1750,8 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con,
+ scnprintf(sess->hca_name, sizeof(sess->hca_name),
+ sess->s.dev->ib_dev->name);
+ sess->s.src_addr = con->c.cm_id->route.addr.src_addr;
++ /* set for_new_clt, to allow future reconnect on any path */
++ sess->for_new_clt = 1;
+ }
+
+ return 0;
+@@ -2676,6 +2681,8 @@ struct rtrs_clt *rtrs_clt_open(struct rtrs_clt_ops *ops,
+ err = PTR_ERR(sess);
+ goto close_all_sess;
+ }
++ if (!i)
++ sess->for_new_clt = 1;
+ list_add_tail_rcu(&sess->s.entry, &clt->paths_list);
+
+ err = init_sess(sess);
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.h b/drivers/infiniband/ulp/rtrs/rtrs-clt.h
+index b8dbd701b3cb2..7c9e155027969 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.h
+@@ -143,6 +143,7 @@ struct rtrs_clt_sess {
+ int max_send_sge;
+ u32 flags;
+ struct kobject kobj;
++ u8 for_new_clt;
+ struct rtrs_clt_stats *stats;
+ /* cache hca_port and hca_name to display in sysfs */
+ u8 hca_port;
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-pri.h b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+index d5621e6fad1b1..8caad0a2322bf 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-pri.h
++++ b/drivers/infiniband/ulp/rtrs/rtrs-pri.h
+@@ -188,7 +188,9 @@ struct rtrs_msg_conn_req {
+ __le16 recon_cnt;
+ uuid_t sess_uuid;
+ uuid_t paths_uuid;
+- u8 reserved[12];
++ u8 first_conn : 1;
++ u8 reserved_bits : 7;
++ u8 reserved[11];
+ };
+
+ /**
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 1150d50b5d1e4..b6cb09972de55 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1334,7 +1334,8 @@ static void free_srv(struct rtrs_srv *srv)
+ }
+
+ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+- const uuid_t *paths_uuid)
++ const uuid_t *paths_uuid,
++ bool first_conn)
+ {
+ struct rtrs_srv *srv;
+ int i;
+@@ -1347,12 +1348,20 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+ return srv;
+ }
+ }
++ /*
++ * If this request is not the first connection request from the
++ * client for this session then fail and return error.
++ */
++ if (!first_conn) {
++ mutex_unlock(&ctx->srv_mutex);
++ return ERR_PTR(-ENXIO);
++ }
+
+ /* need to allocate a new srv */
+ srv = kzalloc(sizeof(*srv), GFP_KERNEL);
+ if (!srv) {
+ mutex_unlock(&ctx->srv_mutex);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ INIT_LIST_HEAD(&srv->paths_list);
+@@ -1387,7 +1396,7 @@ err_free_chunks:
+
+ err_free_srv:
+ kfree(srv);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+ static void put_srv(struct rtrs_srv *srv)
+@@ -1788,13 +1797,13 @@ static int rtrs_rdma_connect(struct rdma_cm_id *cm_id,
+ goto reject_w_econnreset;
+ }
+ recon_cnt = le16_to_cpu(msg->recon_cnt);
+- srv = get_or_create_srv(ctx, &msg->paths_uuid);
++ srv = get_or_create_srv(ctx, &msg->paths_uuid, msg->first_conn);
+ /*
+ * "refcount == 0" happens if a previous thread calls get_or_create_srv
+ * allocate srv, but chunks of srv are not allocated yet.
+ */
+- if (!srv || refcount_read(&srv->refcount) == 0) {
+- err = -ENOMEM;
++ if (IS_ERR(srv) || refcount_read(&srv->refcount) == 0) {
++ err = PTR_ERR(srv);
+ goto reject_w_err;
+ }
+ mutex_lock(&srv->paths_mutex);
+--
+2.27.0
+
--- /dev/null
+From 01f8a251dc84468534e8c0db8714c3d3ebd04ee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Feb 2021 15:38:07 +0100
+Subject: RDMA/rtrs-srv: Do not pass a valid pointer to PTR_ERR()
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit ed408529679737a9a7ad816c8de5d59ba104bb11 ]
+
+smatch gives the warning:
+
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c:1805 rtrs_rdma_connect() warn: passing zero to 'PTR_ERR'
+
+Which is trying to say smatch has shown that srv is not an error pointer
+and thus cannot be passed to PTR_ERR.
+
+The solution is to move the list_add() down after full initilization of
+rtrs_srv. To avoid holding the srv_mutex too long, only hold it during the
+list operation as suggested by Leon.
+
+Fixes: 03e9b33a0fd6 ("RDMA/rtrs: Only allow addition of path to an already established session")
+Link: https://lore.kernel.org/r/20210216143807.65923-1-jinpu.wang@cloud.ionos.com
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 20 +++++++-------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 77ec87f1a660b..3850d2a938f8e 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1348,21 +1348,18 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+ return srv;
+ }
+ }
++ mutex_unlock(&ctx->srv_mutex);
+ /*
+ * If this request is not the first connection request from the
+ * client for this session then fail and return error.
+ */
+- if (!first_conn) {
+- mutex_unlock(&ctx->srv_mutex);
++ if (!first_conn)
+ return ERR_PTR(-ENXIO);
+- }
+
+ /* need to allocate a new srv */
+ srv = kzalloc(sizeof(*srv), GFP_KERNEL);
+- if (!srv) {
+- mutex_unlock(&ctx->srv_mutex);
++ if (!srv)
+ return ERR_PTR(-ENOMEM);
+- }
+
+ INIT_LIST_HEAD(&srv->paths_list);
+ mutex_init(&srv->paths_mutex);
+@@ -1372,8 +1369,6 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+ srv->ctx = ctx;
+ device_initialize(&srv->dev);
+ srv->dev.release = rtrs_srv_dev_release;
+- list_add(&srv->ctx_list, &ctx->srv_list);
+- mutex_unlock(&ctx->srv_mutex);
+
+ srv->chunks = kcalloc(srv->queue_depth, sizeof(*srv->chunks),
+ GFP_KERNEL);
+@@ -1386,6 +1381,9 @@ static struct rtrs_srv *get_or_create_srv(struct rtrs_srv_ctx *ctx,
+ goto err_free_chunks;
+ }
+ refcount_set(&srv->refcount, 1);
++ mutex_lock(&ctx->srv_mutex);
++ list_add(&srv->ctx_list, &ctx->srv_list);
++ mutex_unlock(&ctx->srv_mutex);
+
+ return srv;
+
+@@ -1800,11 +1798,7 @@ static int rtrs_rdma_connect(struct rdma_cm_id *cm_id,
+ }
+ recon_cnt = le16_to_cpu(msg->recon_cnt);
+ srv = get_or_create_srv(ctx, &msg->paths_uuid, msg->first_conn);
+- /*
+- * "refcount == 0" happens if a previous thread calls get_or_create_srv
+- * allocate srv, but chunks of srv are not allocated yet.
+- */
+- if (IS_ERR(srv) || refcount_read(&srv->refcount) == 0) {
++ if (IS_ERR(srv)) {
+ err = PTR_ERR(srv);
+ goto reject_w_err;
+ }
+--
+2.27.0
+
--- /dev/null
+From cdd3071e4e22cd91243704fc38ebfbf1be2761e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 14:45:24 +0100
+Subject: RDMA/rtrs-srv: fix memory leak by missing kobject free
+
+From: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+
+[ Upstream commit f7452a7e96c120d73100387d5f87de9fce7133cb ]
+
+kmemleak reported an error as below:
+
+ unreferenced object 0xffff8880674b7640 (size 64):
+ comm "kworker/4:1H", pid 113, jiffies 4296403507 (age 507.840s)
+ hex dump (first 32 bytes):
+ 69 70 3a 31 39 32 2e 31 36 38 2e 31 32 32 2e 31 ip:192.168.122.1
+ 31 30 40 69 70 3a 31 39 32 2e 31 36 38 2e 31 32 10@ip:192.168.12
+ backtrace:
+ [<0000000054413611>] kstrdup+0x2e/0x60
+ [<0000000078e3120a>] kobject_set_name_vargs+0x2f/0xb0
+ [<00000000ca2be3ee>] kobject_init_and_add+0xb0/0x120
+ [<0000000062ba5e78>] rtrs_srv_create_sess_files+0x14c/0x314 [rtrs_server]
+ [<00000000b45b7217>] rtrs_srv_info_req_done+0x5b1/0x800 [rtrs_server]
+ [<000000008fc5aa8f>] __ib_process_cq+0x94/0x100 [ib_core]
+ [<00000000a9599cb4>] ib_cq_poll_work+0x32/0xc0 [ib_core]
+ [<00000000cfc376be>] process_one_work+0x4bc/0x980
+ [<0000000016e5c96a>] worker_thread+0x78/0x5c0
+ [<00000000c20b8be0>] kthread+0x191/0x1e0
+ [<000000006c9c0003>] ret_from_fork+0x3a/0x50
+
+It is caused by the not-freed kobject of rtrs_srv_sess. The kobject
+embedded in rtrs_srv_sess has ref-counter 2 after calling
+process_info_req(). Therefore it must call kobject_put twice. Currently
+it calls kobject_put only once at rtrs_srv_destroy_sess_files because
+kobject_del removes the state_in_sysfs flag and then kobject_put in
+free_sess() is not called.
+
+This patch moves kobject_del() into free_sess() so that the kobject of
+rtrs_srv_sess can be freed. And also this patch adds the missing call of
+sysfs_remove_group() to clean-up the sysfs directory.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20210212134525.103456-4-jinpu.wang@cloud.ionos.com
+Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 +-
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index 0a3886629cae8..94e3f3290500a 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -305,7 +305,7 @@ void rtrs_srv_destroy_sess_files(struct rtrs_srv_sess *sess)
+ if (sess->kobj.state_in_sysfs) {
+ kobject_del(&sess->stats->kobj_stats);
+ kobject_put(&sess->stats->kobj_stats);
+- kobject_del(&sess->kobj);
++ sysfs_remove_group(&sess->kobj, &rtrs_srv_sess_attr_group);
+ kobject_put(&sess->kobj);
+
+ rtrs_srv_destroy_once_sysfs_root_folders(sess);
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index b6cb09972de55..77ec87f1a660b 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1476,10 +1476,12 @@ static bool __is_path_w_addr_exists(struct rtrs_srv *srv,
+
+ static void free_sess(struct rtrs_srv_sess *sess)
+ {
+- if (sess->kobj.state_in_sysfs)
++ if (sess->kobj.state_in_sysfs) {
++ kobject_del(&sess->kobj);
+ kobject_put(&sess->kobj);
+- else
++ } else {
+ kfree(sess);
++ }
+ }
+
+ static void rtrs_srv_close_work(struct work_struct *work)
+--
+2.27.0
+
--- /dev/null
+From 6cc56455694c3c87e8c62d09f66e60ca9ed7cf1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:09 +0100
+Subject: RDMA/rtrs-srv: Fix missing wr_cqe
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 8537f2de6519945890a2b0f3739b23f32b5c0a89 ]
+
+We had a few places wr_cqe is not set, which could lead to NULL pointer
+deref or GPF in error case.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-14-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Md Haris Iqbal <haris.iqbal@cloud.ionos.com>
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 92a216ddd9fd3..f59731c5a96a3 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -267,6 +267,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ WARN_ON_ONCE(rkey != wr->rkey);
+
+ wr->wr.opcode = IB_WR_RDMA_WRITE;
++ wr->wr.wr_cqe = &io_comp_cqe;
+ wr->wr.ex.imm_data = 0;
+ wr->wr.send_flags = 0;
+
+@@ -294,6 +295,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ inv_wr.sg_list = NULL;
+ inv_wr.num_sge = 0;
+ inv_wr.opcode = IB_WR_SEND_WITH_INV;
++ inv_wr.wr_cqe = &io_comp_cqe;
+ inv_wr.send_flags = 0;
+ inv_wr.ex.invalidate_rkey = rkey;
+ }
+@@ -304,6 +306,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+
+ srv_mr = &sess->mrs[id->msg_id];
+ rwr.wr.opcode = IB_WR_REG_MR;
++ rwr.wr.wr_cqe = &local_reg_cqe;
+ rwr.wr.num_sge = 0;
+ rwr.mr = srv_mr->mr;
+ rwr.wr.send_flags = 0;
+@@ -379,6 +382,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+
+ if (need_inval) {
+ if (likely(sg_cnt)) {
++ inv_wr.wr_cqe = &io_comp_cqe;
+ inv_wr.sg_list = NULL;
+ inv_wr.num_sge = 0;
+ inv_wr.opcode = IB_WR_SEND_WITH_INV;
+@@ -421,6 +425,7 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ srv_mr = &sess->mrs[id->msg_id];
+ rwr.wr.next = &imm_wr;
+ rwr.wr.opcode = IB_WR_REG_MR;
++ rwr.wr.wr_cqe = &local_reg_cqe;
+ rwr.wr.num_sge = 0;
+ rwr.wr.send_flags = 0;
+ rwr.mr = srv_mr->mr;
+--
+2.27.0
+
--- /dev/null
+From f8044fa1ee4e0c28a35751d458c985c1ed154568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 14:45:22 +0100
+Subject: RDMA/rtrs-srv: Fix stack-out-of-bounds
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit e6daa8f61d8def10f0619fe51b4c794f69598e4f ]
+
+ BUG: KASAN: stack-out-of-bounds in _mlx4_ib_post_send+0x1bd2/0x2770 [mlx4_ib]
+ Read of size 4 at addr ffff8880d5a7f980 by task kworker/0:1H/565
+
+ CPU: 0 PID: 565 Comm: kworker/0:1H Tainted: G O 5.4.84-storage #5.4.84-1+feature+linux+5.4.y+dbg+20201216.1319+b6b887b~deb10
+ Hardware name: Supermicro H8QG6/H8QG6, BIOS 3.00 09/04/2012
+ Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
+ Call Trace:
+ dump_stack+0x96/0xe0
+ print_address_description.constprop.4+0x1f/0x300
+ ? irq_work_claim+0x2e/0x50
+ __kasan_report.cold.8+0x78/0x92
+ ? _mlx4_ib_post_send+0x1bd2/0x2770 [mlx4_ib]
+ kasan_report+0x10/0x20
+ _mlx4_ib_post_send+0x1bd2/0x2770 [mlx4_ib]
+ ? check_chain_key+0x1d7/0x2e0
+ ? _mlx4_ib_post_recv+0x630/0x630 [mlx4_ib]
+ ? lockdep_hardirqs_on+0x1a8/0x290
+ ? stack_depot_save+0x218/0x56e
+ ? do_profile_hits.isra.6.cold.13+0x1d/0x1d
+ ? check_chain_key+0x1d7/0x2e0
+ ? save_stack+0x4d/0x80
+ ? save_stack+0x19/0x80
+ ? __kasan_slab_free+0x125/0x170
+ ? kfree+0xe7/0x3b0
+ rdma_write_sg+0x5b0/0x950 [rtrs_server]
+
+The problem is when we send imm_wr, the type should be ib_rdma_wr, so hw
+driver like mlx4 can do rdma_wr(wr), so fix it by use the ib_rdma_wr as
+type for imm_wr.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20210212134525.103456-2-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 64 +++++++++++++-------------
+ 1 file changed, 33 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index d017ede304b76..1150d50b5d1e4 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -222,7 +222,8 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ dma_addr_t dma_addr = sess->dma_addr[id->msg_id];
+ struct rtrs_srv_mr *srv_mr;
+ struct rtrs_srv *srv = sess->srv;
+- struct ib_send_wr inv_wr, imm_wr;
++ struct ib_send_wr inv_wr;
++ struct ib_rdma_wr imm_wr;
+ struct ib_rdma_wr *wr = NULL;
+ enum ib_send_flags flags;
+ size_t sg_cnt;
+@@ -274,15 +275,15 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ if (need_inval && always_invalidate) {
+ wr->wr.next = &rwr.wr;
+ rwr.wr.next = &inv_wr;
+- inv_wr.next = &imm_wr;
++ inv_wr.next = &imm_wr.wr;
+ } else if (always_invalidate) {
+ wr->wr.next = &rwr.wr;
+- rwr.wr.next = &imm_wr;
++ rwr.wr.next = &imm_wr.wr;
+ } else if (need_inval) {
+ wr->wr.next = &inv_wr;
+- inv_wr.next = &imm_wr;
++ inv_wr.next = &imm_wr.wr;
+ } else {
+- wr->wr.next = &imm_wr;
++ wr->wr.next = &imm_wr.wr;
+ }
+ /*
+ * From time to time we have to post signaled sends,
+@@ -300,7 +301,7 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ inv_wr.ex.invalidate_rkey = rkey;
+ }
+
+- imm_wr.next = NULL;
++ imm_wr.wr.next = NULL;
+ if (always_invalidate) {
+ struct rtrs_msg_rkey_rsp *msg;
+
+@@ -321,22 +322,22 @@ static int rdma_write_sg(struct rtrs_srv_op *id)
+ list.addr = srv_mr->iu->dma_addr;
+ list.length = sizeof(*msg);
+ list.lkey = sess->s.dev->ib_pd->local_dma_lkey;
+- imm_wr.sg_list = &list;
+- imm_wr.num_sge = 1;
+- imm_wr.opcode = IB_WR_SEND_WITH_IMM;
++ imm_wr.wr.sg_list = &list;
++ imm_wr.wr.num_sge = 1;
++ imm_wr.wr.opcode = IB_WR_SEND_WITH_IMM;
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev,
+ srv_mr->iu->dma_addr,
+ srv_mr->iu->size, DMA_TO_DEVICE);
+ } else {
+- imm_wr.sg_list = NULL;
+- imm_wr.num_sge = 0;
+- imm_wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM;
++ imm_wr.wr.sg_list = NULL;
++ imm_wr.wr.num_sge = 0;
++ imm_wr.wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM;
+ }
+- imm_wr.send_flags = flags;
+- imm_wr.ex.imm_data = cpu_to_be32(rtrs_to_io_rsp_imm(id->msg_id,
++ imm_wr.wr.send_flags = flags;
++ imm_wr.wr.ex.imm_data = cpu_to_be32(rtrs_to_io_rsp_imm(id->msg_id,
+ 0, need_inval));
+
+- imm_wr.wr_cqe = &io_comp_cqe;
++ imm_wr.wr.wr_cqe = &io_comp_cqe;
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev, dma_addr,
+ offset, DMA_BIDIRECTIONAL);
+
+@@ -363,7 +364,8 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ {
+ struct rtrs_sess *s = con->c.sess;
+ struct rtrs_srv_sess *sess = to_srv_sess(s);
+- struct ib_send_wr inv_wr, imm_wr, *wr = NULL;
++ struct ib_send_wr inv_wr, *wr = NULL;
++ struct ib_rdma_wr imm_wr;
+ struct ib_reg_wr rwr;
+ struct rtrs_srv *srv = sess->srv;
+ struct rtrs_srv_mr *srv_mr;
+@@ -400,15 +402,15 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ if (need_inval && always_invalidate) {
+ wr = &inv_wr;
+ inv_wr.next = &rwr.wr;
+- rwr.wr.next = &imm_wr;
++ rwr.wr.next = &imm_wr.wr;
+ } else if (always_invalidate) {
+ wr = &rwr.wr;
+- rwr.wr.next = &imm_wr;
++ rwr.wr.next = &imm_wr.wr;
+ } else if (need_inval) {
+ wr = &inv_wr;
+- inv_wr.next = &imm_wr;
++ inv_wr.next = &imm_wr.wr;
+ } else {
+- wr = &imm_wr;
++ wr = &imm_wr.wr;
+ }
+ /*
+ * From time to time we have to post signalled sends,
+@@ -417,13 +419,13 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ flags = (atomic_inc_return(&con->wr_cnt) % srv->queue_depth) ?
+ 0 : IB_SEND_SIGNALED;
+ imm = rtrs_to_io_rsp_imm(id->msg_id, errno, need_inval);
+- imm_wr.next = NULL;
++ imm_wr.wr.next = NULL;
+ if (always_invalidate) {
+ struct ib_sge list;
+ struct rtrs_msg_rkey_rsp *msg;
+
+ srv_mr = &sess->mrs[id->msg_id];
+- rwr.wr.next = &imm_wr;
++ rwr.wr.next = &imm_wr.wr;
+ rwr.wr.opcode = IB_WR_REG_MR;
+ rwr.wr.wr_cqe = &local_reg_cqe;
+ rwr.wr.num_sge = 0;
+@@ -440,21 +442,21 @@ static int send_io_resp_imm(struct rtrs_srv_con *con, struct rtrs_srv_op *id,
+ list.addr = srv_mr->iu->dma_addr;
+ list.length = sizeof(*msg);
+ list.lkey = sess->s.dev->ib_pd->local_dma_lkey;
+- imm_wr.sg_list = &list;
+- imm_wr.num_sge = 1;
+- imm_wr.opcode = IB_WR_SEND_WITH_IMM;
++ imm_wr.wr.sg_list = &list;
++ imm_wr.wr.num_sge = 1;
++ imm_wr.wr.opcode = IB_WR_SEND_WITH_IMM;
+ ib_dma_sync_single_for_device(sess->s.dev->ib_dev,
+ srv_mr->iu->dma_addr,
+ srv_mr->iu->size, DMA_TO_DEVICE);
+ } else {
+- imm_wr.sg_list = NULL;
+- imm_wr.num_sge = 0;
+- imm_wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM;
++ imm_wr.wr.sg_list = NULL;
++ imm_wr.wr.num_sge = 0;
++ imm_wr.wr.opcode = IB_WR_RDMA_WRITE_WITH_IMM;
+ }
+- imm_wr.send_flags = flags;
+- imm_wr.wr_cqe = &io_comp_cqe;
++ imm_wr.wr.send_flags = flags;
++ imm_wr.wr.wr_cqe = &io_comp_cqe;
+
+- imm_wr.ex.imm_data = cpu_to_be32(imm);
++ imm_wr.wr.ex.imm_data = cpu_to_be32(imm);
+
+ err = ib_post_send(id->con->c.qp, wr, NULL);
+ if (unlikely(err))
+--
+2.27.0
+
--- /dev/null
+From 48c205d360e444c1348c5424a73d3bd1322b6a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:14 +0100
+Subject: RDMA/rtrs-srv: Init wr_cnt as 1
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 6f5d1b3016d650f351e65c645a5eee5394547dd0 ]
+
+Fix up wr_avail accounting. if wr_cnt is 0, then we do SIGNAL for first
+wr, in completion we add queue_depth back, which is not right in the
+sense of tracking for available wr.
+
+So fix it by init wr_cnt to 1.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-19-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index f59731c5a96a3..d017ede304b76 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1604,7 +1604,7 @@ static int create_con(struct rtrs_srv_sess *sess,
+ con->c.cm_id = cm_id;
+ con->c.sess = &sess->s;
+ con->c.cid = cid;
+- atomic_set(&con->wr_cnt, 0);
++ atomic_set(&con->wr_cnt, 1);
+
+ if (con->c.cid == 0) {
+ /*
+--
+2.27.0
+
--- /dev/null
+From 81df4852765303974c1557526a8b998f1d154a2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:02 +0100
+Subject: RDMA/rtrs-srv: Jump to dereg_mr label if allocate iu fails
+
+From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+
+[ Upstream commit f77c4839ee8f4612dcb6601602329096030bd813 ]
+
+The rtrs_iu_free is called in rtrs_iu_alloc if memory is limited, so we
+don't need to free the same iu again.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-7-jinpu.wang@cloud.ionos.com
+Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
+Reviewed-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index 341661f42add0..92a216ddd9fd3 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -651,7 +651,7 @@ static int map_cont_bufs(struct rtrs_srv_sess *sess)
+ if (!srv_mr->iu) {
+ err = -ENOMEM;
+ rtrs_err(ss, "rtrs_iu_alloc(), err: %d\n", err);
+- goto free_iu;
++ goto dereg_mr;
+ }
+ }
+ /* Eventually dma addr for each chunk can be cached */
+@@ -667,7 +667,6 @@ err:
+ srv_mr = &sess->mrs[mri];
+ sgt = &srv_mr->sgt;
+ mr = srv_mr->mr;
+-free_iu:
+ rtrs_iu_free(srv_mr->iu, sess->s.dev->ib_dev, 1);
+ dereg_mr:
+ ib_dereg_mr(mr);
+--
+2.27.0
+
--- /dev/null
+From 0136112582b485b997aa1a90f9cef28a4c7e2c43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:18:59 +0100
+Subject: RDMA/rtrs-srv: Release lock before call into close_sess
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit 99f0c3807973359bba8f37d9198eea59fe38c32a ]
+
+In this error case, we don't need hold mutex to call close_sess.
+
+Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality")
+Link: https://lore.kernel.org/r/20201217141915.56989-4-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Tested-by: Lutz Pogrell <lutz.pogrell@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+index ed4628f032bb6..341661f42add0 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c
+@@ -1863,8 +1863,8 @@ reject_w_econnreset:
+ return rtrs_rdma_do_reject(cm_id, -ECONNRESET);
+
+ close_and_return_err:
+- close_sess(sess);
+ mutex_unlock(&srv->paths_mutex);
++ close_sess(sess);
+
+ return err;
+ }
+--
+2.27.0
+
--- /dev/null
+From 1575041d334843837f4619e9f4117dbee2d6682c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 14:45:25 +0100
+Subject: RDMA/rtrs-srv-sysfs: fix missing put_device
+
+From: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+
+[ Upstream commit e2853c49477d104c01d3c7944e1fb5074eb11d9f ]
+
+put_device() decreases the ref-count and then the device will be
+cleaned-up, while at is also add missing put_device in
+rtrs_srv_create_once_sysfs_root_folders
+
+This patch solves a kmemleak error as below:
+
+ unreferenced object 0xffff88809a7a0710 (size 8):
+ comm "kworker/4:1H", pid 113, jiffies 4295833049 (age 6212.380s)
+ hex dump (first 8 bytes):
+ 62 6c 61 00 6b 6b 6b a5 bla.kkk.
+ backtrace:
+ [<0000000054413611>] kstrdup+0x2e/0x60
+ [<0000000078e3120a>] kobject_set_name_vargs+0x2f/0xb0
+ [<00000000f1a17a6b>] dev_set_name+0xab/0xe0
+ [<00000000d5502e32>] rtrs_srv_create_sess_files+0x2fb/0x314 [rtrs_server]
+ [<00000000ed11a1ef>] rtrs_srv_info_req_done+0x631/0x800 [rtrs_server]
+ [<000000008fc5aa8f>] __ib_process_cq+0x94/0x100 [ib_core]
+ [<00000000a9599cb4>] ib_cq_poll_work+0x32/0xc0 [ib_core]
+ [<00000000cfc376be>] process_one_work+0x4bc/0x980
+ [<0000000016e5c96a>] worker_thread+0x78/0x5c0
+ [<00000000c20b8be0>] kthread+0x191/0x1e0
+ [<000000006c9c0003>] ret_from_fork+0x3a/0x50
+
+Fixes: baa5b28b7a47 ("RDMA/rtrs-srv: Replace device_register with device_initialize and device_add")
+Link: https://lore.kernel.org/r/20210212134525.103456-5-jinpu.wang@cloud.ionos.com
+Signed-off-by: Gioh Kim <gi-oh.kim@cloud.ionos.com>
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index 94e3f3290500a..126a96e75c621 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -183,6 +183,7 @@ static int rtrs_srv_create_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ err = -ENOMEM;
+ pr_err("kobject_create_and_add(): %d\n", err);
+ device_del(&srv->dev);
++ put_device(&srv->dev);
+ goto unlock;
+ }
+ dev_set_uevent_suppress(&srv->dev, false);
+@@ -208,6 +209,7 @@ rtrs_srv_destroy_once_sysfs_root_folders(struct rtrs_srv_sess *sess)
+ kobject_put(srv->kobj_paths);
+ mutex_unlock(&srv->paths_mutex);
+ device_del(&srv->dev);
++ put_device(&srv->dev);
+ } else {
+ mutex_unlock(&srv->paths_mutex);
+ }
+--
+2.27.0
+
--- /dev/null
+From d7c0267169a58a2b14f8ef48707b7527f3f2b02e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 15:19:00 +0100
+Subject: RDMA/rtrs-srv: Use sysfs_remove_file_self for disconnect
+
+From: Jack Wang <jinpu.wang@cloud.ionos.com>
+
+[ Upstream commit f991fdac813f1598a9bb17b602ce04812ba9148c ]
+
+Remove self first to avoid deadlock, we don't want to
+use close_work to remove sess sysfs.
+
+Fixes: 91b11610af8d ("RDMA/rtrs: server: sysfs interface functions")
+Link: https://lore.kernel.org/r/20201217141915.56989-5-jinpu.wang@cloud.ionos.com
+Signed-off-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Tested-by: Lutz Pogrell <lutz.pogrell@cloud.ionos.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+index d2edff3b8f0df..cca3a0acbabc5 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+@@ -51,6 +51,8 @@ static ssize_t rtrs_srv_disconnect_store(struct kobject *kobj,
+ sockaddr_to_str((struct sockaddr *)&sess->s.dst_addr, str, sizeof(str));
+
+ rtrs_info(s, "disconnect for path %s requested\n", str);
++ /* first remove sysfs itself to avoid deadlock */
++ sysfs_remove_file_self(&sess->kobj, &attr->attr);
+ close_sess(sess);
+
+ return count;
+--
+2.27.0
+
--- /dev/null
+From 2515ff5899fe317cc608eab764741fbd75a0a048 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 12:23:02 -0600
+Subject: RDMA/rxe: Correct skb on loopback path
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 5120bf0a5fc15dec210a0fe0f39e4a256bb6e349 ]
+
+rxe_net.c sends packets at the IP layer with skb->data pointing at the IP
+header but receives packets from a UDP tunnel with skb->data pointing at
+the UDP header. On the loopback path this was not correctly accounted
+for. This patch corrects for this by using sbk_pull() to strip the IP
+header from the skb on received packets.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20210128182301.16859-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_net.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 943914c2a50c7..bce44502ab0ed 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -414,6 +414,11 @@ int rxe_send(struct rxe_pkt_info *pkt, struct sk_buff *skb)
+
+ void rxe_loopback(struct sk_buff *skb)
+ {
++ if (skb->protocol == htons(ETH_P_IP))
++ skb_pull(skb, sizeof(struct iphdr));
++ else
++ skb_pull(skb, sizeof(struct ipv6hdr));
++
+ rxe_rcv(skb);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From bcb5145bc9960596a1f40569218e90ed714fd803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jan 2021 11:47:53 -0600
+Subject: RDMA/rxe: Fix coding error in rxe_rcv_mcast_pkt
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 8fc1b7027fc162738d5a85c82410e501a371a404 ]
+
+rxe_rcv_mcast_pkt() in rxe_recv.c can leak SKBs in error path code. The
+loop over the QPs attached to a multicast group creates new cloned SKBs
+for all but the last QP in the list and passes the SKB and its clones to
+rxe_rcv_pkt() for further processing. Any QPs that do not pass some checks
+are skipped. If the last QP in the list fails the tests the SKB is
+leaked. This patch checks if the SKB for the last QP was used and if not
+frees it. Also removes a redundant loop invariant assignment.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Fixes: 71abf20b28ff ("RDMA/rxe: Handle skb_clone() failure in rxe_recv.c")
+Link: https://lore.kernel.org/r/20210128174752.16128-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index db0ee5c3962e4..cb69a125e2806 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -257,7 +257,6 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+
+ list_for_each_entry(mce, &mcg->qp_list, qp_list) {
+ qp = mce->qp;
+- pkt = SKB_TO_PKT(skb);
+
+ /* validate qp for incoming packet */
+ err = check_type_state(rxe, pkt, qp);
+@@ -269,12 +268,18 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+ continue;
+
+ /* for all but the last qp create a new clone of the
+- * skb and pass to the qp.
++ * skb and pass to the qp. If an error occurs in the
++ * checks for the last qp in the list we need to
++ * free the skb since it hasn't been passed on to
++ * rxe_rcv_pkt() which would free it later.
+ */
+- if (mce->qp_list.next != &mcg->qp_list)
++ if (mce->qp_list.next != &mcg->qp_list) {
+ per_qp_skb = skb_clone(skb, GFP_ATOMIC);
+- else
++ } else {
+ per_qp_skb = skb;
++ /* show we have consumed the skb */
++ skb = NULL;
++ }
+
+ if (unlikely(!per_qp_skb))
+ continue;
+@@ -289,9 +294,8 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
+
+ rxe_drop_ref(mcg); /* drop ref from rxe_pool_get_key. */
+
+- return;
+-
+ err1:
++ /* free skb if not consumed */
+ kfree_skb(skb);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 0029fdf723a99b6abaafd14355d0575cf10f88ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 15:45:01 -0600
+Subject: RDMA/rxe: Fix coding error in rxe_recv.c
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit 7d9ae80e31df57dd3253e1ec514f0000aa588a81 ]
+
+check_type_state() in rxe_recv.c is written as if the type bits in the
+packet opcode were a bit mask which is not correct. This patch corrects
+this code to compare all 3 type bits to the required type.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20210127214500.3707-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_recv.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index c9984a28eecc7..db0ee5c3962e4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -9,21 +9,26 @@
+ #include "rxe.h"
+ #include "rxe_loc.h"
+
++/* check that QP matches packet opcode type and is in a valid state */
+ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ struct rxe_qp *qp)
+ {
++ unsigned int pkt_type;
++
+ if (unlikely(!qp->valid))
+ goto err1;
+
++ pkt_type = pkt->opcode & 0xe0;
++
+ switch (qp_type(qp)) {
+ case IB_QPT_RC:
+- if (unlikely((pkt->opcode & IB_OPCODE_RC) != 0)) {
++ if (unlikely(pkt_type != IB_OPCODE_RC)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+ break;
+ case IB_QPT_UC:
+- if (unlikely(!(pkt->opcode & IB_OPCODE_UC))) {
++ if (unlikely(pkt_type != IB_OPCODE_UC)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+@@ -31,7 +36,7 @@ static int check_type_state(struct rxe_dev *rxe, struct rxe_pkt_info *pkt,
+ case IB_QPT_UD:
+ case IB_QPT_SMI:
+ case IB_QPT_GSI:
+- if (unlikely(!(pkt->opcode & IB_OPCODE_UD))) {
++ if (unlikely(pkt_type != IB_OPCODE_UD)) {
+ pr_warn_ratelimited("bad qp type\n");
+ goto err1;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4d0b3cd4a2dfdf5d26acba91e9597a62ea284351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 13:29:22 +0200
+Subject: RDMA/siw: Fix calculation of tx_valid_cpus size
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 429fa9698957d1a910535ce5e33aedf5adfdabc1 ]
+
+The size of tx_valid_cpus was calculated under the assumption that the
+numa nodes identifiers are continuous, which is not the case in all archs
+as this could lead to the following panic when trying to access an invalid
+tx_valid_cpus index, avoid the following panic by using nr_node_ids
+instead of num_online_nodes() to allocate the tx_valid_cpus size.
+
+ Kernel attempted to read user page (8) - exploit attempt? (uid: 0)
+ BUG: Kernel NULL pointer dereference on read at 0x00000008
+ Faulting instruction address: 0xc0080000081b4a90
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
+ Modules linked in: siw(+) rfkill rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm sunrpc ib_umad rdma_cm ib_cm iw_cm i40iw ib_uverbs ib_core i40e ses enclosure scsi_transport_sas ipmi_powernv ibmpowernv at24 ofpart ipmi_devintf regmap_i2c ipmi_msghandler powernv_flash uio_pdrv_genirq uio mtd opal_prd zram ip_tables xfs libcrc32c sd_mod t10_pi ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm_ttm_helper ttm drm vmx_crypto aacraid drm_panel_orientation_quirks dm_mod
+ CPU: 40 PID: 3279 Comm: modprobe Tainted: G W X --------- --- 5.11.0-0.rc4.129.eln108.ppc64le #2
+ NIP: c0080000081b4a90 LR: c0080000081b4a2c CTR: c0000000007ce1c0
+ REGS: c000000027fa77b0 TRAP: 0300 Tainted: G W X --------- --- (5.11.0-0.rc4.129.eln108.ppc64le)
+ MSR: 9000000002009033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE> CR: 44224882 XER: 00000000
+ CFAR: c0000000007ce200 DAR: 0000000000000008 DSISR: 40000000 IRQMASK: 0
+ GPR00: c0080000081b4a2c c000000027fa7a50 c0080000081c3900 0000000000000040
+ GPR04: c000000002023080 c000000012e1c300 000020072ad70000 0000000000000001
+ GPR08: c000000001726068 0000000000000008 0000000000000008 c0080000081b5758
+ GPR12: c0000000007ce1c0 c0000007fffc3000 00000001590b1e40 0000000000000000
+ GPR16: 0000000000000000 0000000000000001 000000011ad68fc8 00007fffcc09c5c8
+ GPR20: 0000000000000008 0000000000000000 00000001590b2850 00000001590b1d30
+ GPR24: 0000000000043d68 000000011ad67a80 000000011ad67a80 0000000000100000
+ GPR28: c000000012e1c300 c0000000020271c8 0000000000000001 c0080000081bf608
+ NIP [c0080000081b4a90] siw_init_cpulist+0x194/0x214 [siw]
+ LR [c0080000081b4a2c] siw_init_cpulist+0x130/0x214 [siw]
+ Call Trace:
+ [c000000027fa7a50] [c0080000081b4a2c] siw_init_cpulist+0x130/0x214 [siw] (unreliable)
+ [c000000027fa7a90] [c0080000081b4e68] siw_init_module+0x40/0x2a0 [siw]
+ [c000000027fa7b30] [c0000000000124f4] do_one_initcall+0x84/0x2e0
+ [c000000027fa7c00] [c000000000267ffc] do_init_module+0x7c/0x350
+ [c000000027fa7c90] [c00000000026a180] __do_sys_init_module+0x210/0x250
+ [c000000027fa7db0] [c0000000000387e4] system_call_exception+0x134/0x230
+ [c000000027fa7e10] [c00000000000d660] system_call_common+0xf0/0x27c
+ Instruction dump:
+ 40810044 3d420000 e8bf0000 e88a82d0 3d420000 e90a82c8 792a1f24 7cc4302a
+ 7d2642aa 79291f24 7d25482a 7d295214 <7d4048a8> 7d4a3b78 7d4049ad 40c2fff4
+
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Link: https://lore.kernel.org/r/20210201112922.141085-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index ee95cf29179d2..41c46dfaebf66 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -135,7 +135,7 @@ static struct {
+
+ static int siw_init_cpulist(void)
+ {
+- int i, num_nodes = num_possible_nodes();
++ int i, num_nodes = nr_node_ids;
+
+ memset(siw_tx_thread, 0, sizeof(siw_tx_thread));
+
+--
+2.27.0
+
--- /dev/null
+From f7d11f7fef236321bf4bf23a08faad4a7b3eb317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 13:58:45 +0100
+Subject: RDMA/siw: Fix handling of zero-sized Read and Receive Queues.
+
+From: Bernard Metzler <bmt@zurich.ibm.com>
+
+[ Upstream commit 661f385961f06f36da24cf408d461f988d0c39ad ]
+
+During connection setup, the application may choose to zero-size inbound
+and outbound READ queues, as well as the Receive queue. This patch fixes
+handling of zero-sized queues, but not prevents it.
+
+Kamal Heib says in an initial error report:
+
+ When running the blktests over siw the following shift-out-of-bounds is
+ reported, this is happening because the passed IRD or ORD from the ulp
+ could be zero which will lead to unexpected behavior when calling
+ roundup_pow_of_two(), fix that by blocking zero values of ORD or IRD.
+
+ UBSAN: shift-out-of-bounds in ./include/linux/log2.h:57:13
+ shift exponent 64 is too large for 64-bit type 'long unsigned int'
+ CPU: 20 PID: 3957 Comm: kworker/u64:13 Tainted: G S 5.10.0-rc6 #2
+ Hardware name: Dell Inc. PowerEdge R630/02C2CP, BIOS 2.1.5 04/11/2016
+ Workqueue: iw_cm_wq cm_work_handler [iw_cm]
+ Call Trace:
+ dump_stack+0x99/0xcb
+ ubsan_epilogue+0x5/0x40
+ __ubsan_handle_shift_out_of_bounds.cold.11+0xb4/0xf3
+ ? down_write+0x183/0x3d0
+ siw_qp_modify.cold.8+0x2d/0x32 [siw]
+ ? __local_bh_enable_ip+0xa5/0xf0
+ siw_accept+0x906/0x1b60 [siw]
+ ? xa_load+0x147/0x1f0
+ ? siw_connect+0x17a0/0x17a0 [siw]
+ ? lock_downgrade+0x700/0x700
+ ? siw_get_base_qp+0x1c2/0x340 [siw]
+ ? _raw_spin_unlock_irqrestore+0x39/0x40
+ iw_cm_accept+0x1f4/0x430 [iw_cm]
+ rdma_accept+0x3fa/0xb10 [rdma_cm]
+ ? check_flush_dependency+0x410/0x410
+ ? cma_rep_recv+0x570/0x570 [rdma_cm]
+ nvmet_rdma_queue_connect+0x1a62/0x2680 [nvmet_rdma]
+ ? nvmet_rdma_alloc_cmds+0xce0/0xce0 [nvmet_rdma]
+ ? lock_release+0x56e/0xcc0
+ ? lock_downgrade+0x700/0x700
+ ? lock_downgrade+0x700/0x700
+ ? __xa_alloc_cyclic+0xef/0x350
+ ? __xa_alloc+0x2d0/0x2d0
+ ? rdma_restrack_add+0xbe/0x2c0 [ib_core]
+ ? __ww_mutex_die+0x190/0x190
+ cma_cm_event_handler+0xf2/0x500 [rdma_cm]
+ iw_conn_req_handler+0x910/0xcb0 [rdma_cm]
+ ? _raw_spin_unlock_irqrestore+0x39/0x40
+ ? trace_hardirqs_on+0x1c/0x150
+ ? cma_ib_handler+0x8a0/0x8a0 [rdma_cm]
+ ? __kasan_kmalloc.constprop.7+0xc1/0xd0
+ cm_work_handler+0x121c/0x17a0 [iw_cm]
+ ? iw_cm_reject+0x190/0x190 [iw_cm]
+ ? trace_hardirqs_on+0x1c/0x150
+ process_one_work+0x8fb/0x16c0
+ ? pwq_dec_nr_in_flight+0x320/0x320
+ worker_thread+0x87/0xb40
+ ? __kthread_parkme+0xd1/0x1a0
+ ? process_one_work+0x16c0/0x16c0
+ kthread+0x35f/0x430
+ ? kthread_mod_delayed_work+0x180/0x180
+ ret_from_fork+0x22/0x30
+
+Fixes: a531975279f3 ("rdma/siw: main include file")
+Fixes: f29dd55b0236 ("rdma/siw: queue pair methods")
+Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
+Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
+Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
+Link: https://lore.kernel.org/r/20210108125845.1803-1-bmt@zurich.ibm.com
+Reported-by: Kamal Heib <kamalheib1@gmail.com>
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw.h | 2 +-
+ drivers/infiniband/sw/siw/siw_qp.c | 271 ++++++++++++++------------
+ drivers/infiniband/sw/siw/siw_qp_rx.c | 26 ++-
+ drivers/infiniband/sw/siw/siw_qp_tx.c | 4 +-
+ drivers/infiniband/sw/siw/siw_verbs.c | 20 +-
+ 5 files changed, 177 insertions(+), 146 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
+index adda789962196..368959ae9a8cc 100644
+--- a/drivers/infiniband/sw/siw/siw.h
++++ b/drivers/infiniband/sw/siw/siw.h
+@@ -653,7 +653,7 @@ static inline struct siw_sqe *orq_get_free(struct siw_qp *qp)
+ {
+ struct siw_sqe *orq_e = orq_get_tail(qp);
+
+- if (orq_e && READ_ONCE(orq_e->flags) == 0)
++ if (READ_ONCE(orq_e->flags) == 0)
+ return orq_e;
+
+ return NULL;
+diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
+index 875d36d4b1c61..ddb2e66f9f133 100644
+--- a/drivers/infiniband/sw/siw/siw_qp.c
++++ b/drivers/infiniband/sw/siw/siw_qp.c
+@@ -199,26 +199,26 @@ void siw_qp_llp_write_space(struct sock *sk)
+
+ static int siw_qp_readq_init(struct siw_qp *qp, int irq_size, int orq_size)
+ {
+- irq_size = roundup_pow_of_two(irq_size);
+- orq_size = roundup_pow_of_two(orq_size);
+-
+- qp->attrs.irq_size = irq_size;
+- qp->attrs.orq_size = orq_size;
+-
+- qp->irq = vzalloc(irq_size * sizeof(struct siw_sqe));
+- if (!qp->irq) {
+- siw_dbg_qp(qp, "irq malloc for %d failed\n", irq_size);
+- qp->attrs.irq_size = 0;
+- return -ENOMEM;
++ if (irq_size) {
++ irq_size = roundup_pow_of_two(irq_size);
++ qp->irq = vzalloc(irq_size * sizeof(struct siw_sqe));
++ if (!qp->irq) {
++ qp->attrs.irq_size = 0;
++ return -ENOMEM;
++ }
+ }
+- qp->orq = vzalloc(orq_size * sizeof(struct siw_sqe));
+- if (!qp->orq) {
+- siw_dbg_qp(qp, "orq malloc for %d failed\n", orq_size);
+- qp->attrs.orq_size = 0;
+- qp->attrs.irq_size = 0;
+- vfree(qp->irq);
+- return -ENOMEM;
++ if (orq_size) {
++ orq_size = roundup_pow_of_two(orq_size);
++ qp->orq = vzalloc(orq_size * sizeof(struct siw_sqe));
++ if (!qp->orq) {
++ qp->attrs.orq_size = 0;
++ qp->attrs.irq_size = 0;
++ vfree(qp->irq);
++ return -ENOMEM;
++ }
+ }
++ qp->attrs.irq_size = irq_size;
++ qp->attrs.orq_size = orq_size;
+ siw_dbg_qp(qp, "ORD %d, IRD %d\n", orq_size, irq_size);
+ return 0;
+ }
+@@ -288,13 +288,14 @@ int siw_qp_mpa_rts(struct siw_qp *qp, enum mpa_v2_ctrl ctrl)
+ if (ctrl & MPA_V2_RDMA_WRITE_RTR)
+ wqe->sqe.opcode = SIW_OP_WRITE;
+ else if (ctrl & MPA_V2_RDMA_READ_RTR) {
+- struct siw_sqe *rreq;
++ struct siw_sqe *rreq = NULL;
+
+ wqe->sqe.opcode = SIW_OP_READ;
+
+ spin_lock(&qp->orq_lock);
+
+- rreq = orq_get_free(qp);
++ if (qp->attrs.orq_size)
++ rreq = orq_get_free(qp);
+ if (rreq) {
+ siw_read_to_orq(rreq, &wqe->sqe);
+ qp->orq_put++;
+@@ -877,135 +878,88 @@ void siw_read_to_orq(struct siw_sqe *rreq, struct siw_sqe *sqe)
+ rreq->num_sge = 1;
+ }
+
+-/*
+- * Must be called with SQ locked.
+- * To avoid complete SQ starvation by constant inbound READ requests,
+- * the active IRQ will not be served after qp->irq_burst, if the
+- * SQ has pending work.
+- */
+-int siw_activate_tx(struct siw_qp *qp)
++static int siw_activate_tx_from_sq(struct siw_qp *qp)
+ {
+- struct siw_sqe *irqe, *sqe;
++ struct siw_sqe *sqe;
+ struct siw_wqe *wqe = tx_wqe(qp);
+ int rv = 1;
+
+- irqe = &qp->irq[qp->irq_get % qp->attrs.irq_size];
+-
+- if (irqe->flags & SIW_WQE_VALID) {
+- sqe = sq_get_next(qp);
+-
+- /*
+- * Avoid local WQE processing starvation in case
+- * of constant inbound READ request stream
+- */
+- if (sqe && ++qp->irq_burst >= SIW_IRQ_MAXBURST_SQ_ACTIVE) {
+- qp->irq_burst = 0;
+- goto skip_irq;
+- }
+- memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
+- wqe->wr_status = SIW_WR_QUEUED;
+-
+- /* start READ RESPONSE */
+- wqe->sqe.opcode = SIW_OP_READ_RESPONSE;
+- wqe->sqe.flags = 0;
+- if (irqe->num_sge) {
+- wqe->sqe.num_sge = 1;
+- wqe->sqe.sge[0].length = irqe->sge[0].length;
+- wqe->sqe.sge[0].laddr = irqe->sge[0].laddr;
+- wqe->sqe.sge[0].lkey = irqe->sge[0].lkey;
+- } else {
+- wqe->sqe.num_sge = 0;
+- }
+-
+- /* Retain original RREQ's message sequence number for
+- * potential error reporting cases.
+- */
+- wqe->sqe.sge[1].length = irqe->sge[1].length;
+-
+- wqe->sqe.rkey = irqe->rkey;
+- wqe->sqe.raddr = irqe->raddr;
++ sqe = sq_get_next(qp);
++ if (!sqe)
++ return 0;
+
+- wqe->processed = 0;
+- qp->irq_get++;
++ memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
++ wqe->wr_status = SIW_WR_QUEUED;
+
+- /* mark current IRQ entry free */
+- smp_store_mb(irqe->flags, 0);
++ /* First copy SQE to kernel private memory */
++ memcpy(&wqe->sqe, sqe, sizeof(*sqe));
+
++ if (wqe->sqe.opcode >= SIW_NUM_OPCODES) {
++ rv = -EINVAL;
+ goto out;
+ }
+- sqe = sq_get_next(qp);
+- if (sqe) {
+-skip_irq:
+- memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
+- wqe->wr_status = SIW_WR_QUEUED;
+-
+- /* First copy SQE to kernel private memory */
+- memcpy(&wqe->sqe, sqe, sizeof(*sqe));
+-
+- if (wqe->sqe.opcode >= SIW_NUM_OPCODES) {
++ if (wqe->sqe.flags & SIW_WQE_INLINE) {
++ if (wqe->sqe.opcode != SIW_OP_SEND &&
++ wqe->sqe.opcode != SIW_OP_WRITE) {
+ rv = -EINVAL;
+ goto out;
+ }
+- if (wqe->sqe.flags & SIW_WQE_INLINE) {
+- if (wqe->sqe.opcode != SIW_OP_SEND &&
+- wqe->sqe.opcode != SIW_OP_WRITE) {
+- rv = -EINVAL;
+- goto out;
+- }
+- if (wqe->sqe.sge[0].length > SIW_MAX_INLINE) {
+- rv = -EINVAL;
+- goto out;
+- }
+- wqe->sqe.sge[0].laddr = (uintptr_t)&wqe->sqe.sge[1];
+- wqe->sqe.sge[0].lkey = 0;
+- wqe->sqe.num_sge = 1;
++ if (wqe->sqe.sge[0].length > SIW_MAX_INLINE) {
++ rv = -EINVAL;
++ goto out;
+ }
+- if (wqe->sqe.flags & SIW_WQE_READ_FENCE) {
+- /* A READ cannot be fenced */
+- if (unlikely(wqe->sqe.opcode == SIW_OP_READ ||
+- wqe->sqe.opcode ==
+- SIW_OP_READ_LOCAL_INV)) {
+- siw_dbg_qp(qp, "cannot fence read\n");
+- rv = -EINVAL;
+- goto out;
+- }
+- spin_lock(&qp->orq_lock);
++ wqe->sqe.sge[0].laddr = (uintptr_t)&wqe->sqe.sge[1];
++ wqe->sqe.sge[0].lkey = 0;
++ wqe->sqe.num_sge = 1;
++ }
++ if (wqe->sqe.flags & SIW_WQE_READ_FENCE) {
++ /* A READ cannot be fenced */
++ if (unlikely(wqe->sqe.opcode == SIW_OP_READ ||
++ wqe->sqe.opcode ==
++ SIW_OP_READ_LOCAL_INV)) {
++ siw_dbg_qp(qp, "cannot fence read\n");
++ rv = -EINVAL;
++ goto out;
++ }
++ spin_lock(&qp->orq_lock);
+
+- if (!siw_orq_empty(qp)) {
+- qp->tx_ctx.orq_fence = 1;
+- rv = 0;
+- }
+- spin_unlock(&qp->orq_lock);
++ if (qp->attrs.orq_size && !siw_orq_empty(qp)) {
++ qp->tx_ctx.orq_fence = 1;
++ rv = 0;
++ }
++ spin_unlock(&qp->orq_lock);
+
+- } else if (wqe->sqe.opcode == SIW_OP_READ ||
+- wqe->sqe.opcode == SIW_OP_READ_LOCAL_INV) {
+- struct siw_sqe *rreq;
++ } else if (wqe->sqe.opcode == SIW_OP_READ ||
++ wqe->sqe.opcode == SIW_OP_READ_LOCAL_INV) {
++ struct siw_sqe *rreq;
+
+- wqe->sqe.num_sge = 1;
++ if (unlikely(!qp->attrs.orq_size)) {
++ /* We negotiated not to send READ req's */
++ rv = -EINVAL;
++ goto out;
++ }
++ wqe->sqe.num_sge = 1;
+
+- spin_lock(&qp->orq_lock);
++ spin_lock(&qp->orq_lock);
+
+- rreq = orq_get_free(qp);
+- if (rreq) {
+- /*
+- * Make an immediate copy in ORQ to be ready
+- * to process loopback READ reply
+- */
+- siw_read_to_orq(rreq, &wqe->sqe);
+- qp->orq_put++;
+- } else {
+- qp->tx_ctx.orq_fence = 1;
+- rv = 0;
+- }
+- spin_unlock(&qp->orq_lock);
++ rreq = orq_get_free(qp);
++ if (rreq) {
++ /*
++ * Make an immediate copy in ORQ to be ready
++ * to process loopback READ reply
++ */
++ siw_read_to_orq(rreq, &wqe->sqe);
++ qp->orq_put++;
++ } else {
++ qp->tx_ctx.orq_fence = 1;
++ rv = 0;
+ }
+-
+- /* Clear SQE, can be re-used by application */
+- smp_store_mb(sqe->flags, 0);
+- qp->sq_get++;
+- } else {
+- rv = 0;
++ spin_unlock(&qp->orq_lock);
+ }
++
++ /* Clear SQE, can be re-used by application */
++ smp_store_mb(sqe->flags, 0);
++ qp->sq_get++;
+ out:
+ if (unlikely(rv < 0)) {
+ siw_dbg_qp(qp, "error %d\n", rv);
+@@ -1014,6 +968,65 @@ out:
+ return rv;
+ }
+
++/*
++ * Must be called with SQ locked.
++ * To avoid complete SQ starvation by constant inbound READ requests,
++ * the active IRQ will not be served after qp->irq_burst, if the
++ * SQ has pending work.
++ */
++int siw_activate_tx(struct siw_qp *qp)
++{
++ struct siw_sqe *irqe;
++ struct siw_wqe *wqe = tx_wqe(qp);
++
++ if (!qp->attrs.irq_size)
++ return siw_activate_tx_from_sq(qp);
++
++ irqe = &qp->irq[qp->irq_get % qp->attrs.irq_size];
++
++ if (!(irqe->flags & SIW_WQE_VALID))
++ return siw_activate_tx_from_sq(qp);
++
++ /*
++ * Avoid local WQE processing starvation in case
++ * of constant inbound READ request stream
++ */
++ if (sq_get_next(qp) && ++qp->irq_burst >= SIW_IRQ_MAXBURST_SQ_ACTIVE) {
++ qp->irq_burst = 0;
++ return siw_activate_tx_from_sq(qp);
++ }
++ memset(wqe->mem, 0, sizeof(*wqe->mem) * SIW_MAX_SGE);
++ wqe->wr_status = SIW_WR_QUEUED;
++
++ /* start READ RESPONSE */
++ wqe->sqe.opcode = SIW_OP_READ_RESPONSE;
++ wqe->sqe.flags = 0;
++ if (irqe->num_sge) {
++ wqe->sqe.num_sge = 1;
++ wqe->sqe.sge[0].length = irqe->sge[0].length;
++ wqe->sqe.sge[0].laddr = irqe->sge[0].laddr;
++ wqe->sqe.sge[0].lkey = irqe->sge[0].lkey;
++ } else {
++ wqe->sqe.num_sge = 0;
++ }
++
++ /* Retain original RREQ's message sequence number for
++ * potential error reporting cases.
++ */
++ wqe->sqe.sge[1].length = irqe->sge[1].length;
++
++ wqe->sqe.rkey = irqe->rkey;
++ wqe->sqe.raddr = irqe->raddr;
++
++ wqe->processed = 0;
++ qp->irq_get++;
++
++ /* mark current IRQ entry free */
++ smp_store_mb(irqe->flags, 0);
++
++ return 1;
++}
++
+ /*
+ * Check if current CQ state qualifies for calling CQ completion
+ * handler. Must be called with CQ lock held.
+diff --git a/drivers/infiniband/sw/siw/siw_qp_rx.c b/drivers/infiniband/sw/siw/siw_qp_rx.c
+index 4bd1f1f84057b..60116f20653c7 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
+@@ -680,6 +680,10 @@ static int siw_init_rresp(struct siw_qp *qp, struct siw_rx_stream *srx)
+ }
+ spin_lock_irqsave(&qp->sq_lock, flags);
+
++ if (unlikely(!qp->attrs.irq_size)) {
++ run_sq = 0;
++ goto error_irq;
++ }
+ if (tx_work->wr_status == SIW_WR_IDLE) {
+ /*
+ * immediately schedule READ response w/o
+@@ -712,8 +716,9 @@ static int siw_init_rresp(struct siw_qp *qp, struct siw_rx_stream *srx)
+ /* RRESP now valid as current TX wqe or placed into IRQ */
+ smp_store_mb(resp->flags, SIW_WQE_VALID);
+ } else {
+- pr_warn("siw: [QP %u]: irq %d exceeded %d\n", qp_id(qp),
+- qp->irq_put % qp->attrs.irq_size, qp->attrs.irq_size);
++error_irq:
++ pr_warn("siw: [QP %u]: IRQ exceeded or null, size %d\n",
++ qp_id(qp), qp->attrs.irq_size);
+
+ siw_init_terminate(qp, TERM_ERROR_LAYER_RDMAP,
+ RDMAP_ETYPE_REMOTE_OPERATION,
+@@ -740,6 +745,9 @@ static int siw_orqe_start_rx(struct siw_qp *qp)
+ struct siw_sqe *orqe;
+ struct siw_wqe *wqe = NULL;
+
++ if (unlikely(!qp->attrs.orq_size))
++ return -EPROTO;
++
+ /* make sure ORQ indices are current */
+ smp_mb();
+
+@@ -796,8 +804,8 @@ int siw_proc_rresp(struct siw_qp *qp)
+ */
+ rv = siw_orqe_start_rx(qp);
+ if (rv) {
+- pr_warn("siw: [QP %u]: ORQ empty at idx %d\n",
+- qp_id(qp), qp->orq_get % qp->attrs.orq_size);
++ pr_warn("siw: [QP %u]: ORQ empty, size %d\n",
++ qp_id(qp), qp->attrs.orq_size);
+ goto error_term;
+ }
+ rv = siw_rresp_check_ntoh(srx, frx);
+@@ -1290,11 +1298,13 @@ static int siw_rdmap_complete(struct siw_qp *qp, int error)
+ wc_status);
+ siw_wqe_put_mem(wqe, SIW_OP_READ);
+
+- if (!error)
++ if (!error) {
+ rv = siw_check_tx_fence(qp);
+- else
+- /* Disable current ORQ eleement */
+- WRITE_ONCE(orq_get_current(qp)->flags, 0);
++ } else {
++ /* Disable current ORQ element */
++ if (qp->attrs.orq_size)
++ WRITE_ONCE(orq_get_current(qp)->flags, 0);
++ }
+ break;
+
+ case RDMAP_RDMA_READ_REQ:
+diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
+index d19d8325588b5..7989c4043db4e 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
+@@ -1107,8 +1107,8 @@ next_wqe:
+ /*
+ * RREQ may have already been completed by inbound RRESP!
+ */
+- if (tx_type == SIW_OP_READ ||
+- tx_type == SIW_OP_READ_LOCAL_INV) {
++ if ((tx_type == SIW_OP_READ ||
++ tx_type == SIW_OP_READ_LOCAL_INV) && qp->attrs.orq_size) {
+ /* Cleanup pending entry in ORQ */
+ qp->orq_put--;
+ qp->orq[qp->orq_put % qp->attrs.orq_size].flags = 0;
+diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
+index 68fd053fc7748..e389d44e5591d 100644
+--- a/drivers/infiniband/sw/siw/siw_verbs.c
++++ b/drivers/infiniband/sw/siw/siw_verbs.c
+@@ -365,13 +365,23 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ if (rv)
+ goto err_out;
+
++ num_sqe = attrs->cap.max_send_wr;
++ num_rqe = attrs->cap.max_recv_wr;
++
+ /* All queue indices are derived from modulo operations
+ * on a free running 'get' (consumer) and 'put' (producer)
+ * unsigned counter. Having queue sizes at power of two
+ * avoids handling counter wrap around.
+ */
+- num_sqe = roundup_pow_of_two(attrs->cap.max_send_wr);
+- num_rqe = roundup_pow_of_two(attrs->cap.max_recv_wr);
++ if (num_sqe)
++ num_sqe = roundup_pow_of_two(num_sqe);
++ else {
++ /* Zero sized SQ is not supported */
++ rv = -EINVAL;
++ goto err_out;
++ }
++ if (num_rqe)
++ num_rqe = roundup_pow_of_two(num_rqe);
+
+ if (udata)
+ qp->sendq = vmalloc_user(num_sqe * sizeof(struct siw_sqe));
+@@ -379,7 +389,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ qp->sendq = vzalloc(num_sqe * sizeof(struct siw_sqe));
+
+ if (qp->sendq == NULL) {
+- siw_dbg(base_dev, "SQ size %d alloc failed\n", num_sqe);
+ rv = -ENOMEM;
+ goto err_out_xa;
+ }
+@@ -413,7 +422,6 @@ struct ib_qp *siw_create_qp(struct ib_pd *pd,
+ qp->recvq = vzalloc(num_rqe * sizeof(struct siw_rqe));
+
+ if (qp->recvq == NULL) {
+- siw_dbg(base_dev, "RQ size %d alloc failed\n", num_rqe);
+ rv = -ENOMEM;
+ goto err_out_xa;
+ }
+@@ -966,9 +974,9 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr,
+ unsigned long flags;
+ int rv = 0;
+
+- if (qp->srq) {
++ if (qp->srq || qp->attrs.rq_size == 0) {
+ *bad_wr = wr;
+- return -EOPNOTSUPP; /* what else from errno.h? */
++ return -EINVAL;
+ }
+ if (!rdma_is_kernel_res(&qp->base_qp.res)) {
+ siw_dbg_qp(qp, "no kernel post_recv for user mapped rq\n");
+--
+2.27.0
+
--- /dev/null
+From 6cfc38e602604c1154e66f7287f0bb0112123ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 11:05:17 +0200
+Subject: RDMA/ucma: Fix use-after-free bug in ucma_create_uevent
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Avihai Horon <avihaih@nvidia.com>
+
+[ Upstream commit fe454dc31e84f8c14cb8942fcb61666c9f40745b ]
+
+ucma_process_join() allocates struct ucma_multicast mc and frees it if an
+error occurs during its run. Specifically, if an error occurs in
+copy_to_user(), a use-after-free might happen in the following scenario:
+
+1. mc struct is allocated.
+2. rdma_join_multicast() is called and succeeds. During its run,
+ cma_iboe_join_multicast() enqueues a work that will later use the
+ aforementioned mc struct.
+3. copy_to_user() is called and fails.
+4. mc struct is deallocated.
+5. The work that was enqueued by cma_iboe_join_multicast() is run and
+ calls ucma_create_uevent() which tries to access mc struct (which is
+ freed by now).
+
+Fix this bug by cancelling the work enqueued by cma_iboe_join_multicast().
+Since cma_work_handler() frees struct cma_work, we don't use it in
+cma_iboe_join_multicast() so we can safely cancel the work later.
+
+The following syzkaller report revealed it:
+
+ BUG: KASAN: use-after-free in ucma_create_uevent+0x2dd/0x;3f0 drivers/infiniband/core/ucma.c:272
+ Read of size 8 at addr ffff88810b3ad110 by task kworker/u8:1/108
+
+ CPU: 1 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Workqueue: rdma_cm cma_work_handler
+ Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xbe/0xf9 lib/dump_stack.c:118
+ print_address_description.constprop.0+0x3e/0×60 mm/kasan/report.c:385
+ __kasan_report mm/kasan/report.c:545 [inline]
+ kasan_report.cold+0x1f/0×37 mm/kasan/report.c:562
+ ucma_create_uevent+0x2dd/0×3f0 drivers/infiniband/core/ucma.c:272
+ ucma_event_handler+0xb7/0×3c0 drivers/infiniband/core/ucma.c:349
+ cma_cm_event_handler+0x5d/0×1c0 drivers/infiniband/core/cma.c:1977
+ cma_work_handler+0xfa/0×190 drivers/infiniband/core/cma.c:2718
+ process_one_work+0x54c/0×930 kernel/workqueue.c:2272
+ worker_thread+0x82/0×830 kernel/workqueue.c:2418
+ kthread+0x1ca/0×220 kernel/kthread.c:292
+ ret_from_fork+0x1f/0×30 arch/x86/entry/entry_64.S:296
+
+ Allocated by task 359:
+ kasan_save_stack+0x1b/0×40 mm/kasan/common.c:48
+ kasan_set_track mm/kasan/common.c:56 [inline]
+ __kasan_kmalloc mm/kasan/common.c:461 [inline]
+ __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:434
+ kmalloc include/linux/slab.h:552 [inline]
+ kzalloc include/linux/slab.h:664 [inline]
+ ucma_process_join+0x16e/0×3f0 drivers/infiniband/core/ucma.c:1453
+ ucma_join_multicast+0xda/0×140 drivers/infiniband/core/ucma.c:1538
+ ucma_write+0x1f7/0×280 drivers/infiniband/core/ucma.c:1724
+ vfs_write fs/read_write.c:603 [inline]
+ vfs_write+0x191/0×4c0 fs/read_write.c:585
+ ksys_write+0x1a1/0×1e0 fs/read_write.c:658
+ do_syscall_64+0x2d/0×40 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+ Freed by task 359:
+ kasan_save_stack+0x1b/0×40 mm/kasan/common.c:48
+ kasan_set_track+0x1c/0×30 mm/kasan/common.c:56
+ kasan_set_free_info+0x1b/0×30 mm/kasan/generic.c:355
+ __kasan_slab_free+0x112/0×160 mm/kasan/common.c:422
+ slab_free_hook mm/slub.c:1544 [inline]
+ slab_free_freelist_hook mm/slub.c:1577 [inline]
+ slab_free mm/slub.c:3142 [inline]
+ kfree+0xb3/0×3e0 mm/slub.c:4124
+ ucma_process_join+0x22d/0×3f0 drivers/infiniband/core/ucma.c:1497
+ ucma_join_multicast+0xda/0×140 drivers/infiniband/core/ucma.c:1538
+ ucma_write+0x1f7/0×280 drivers/infiniband/core/ucma.c:1724
+ vfs_write fs/read_write.c:603 [inline]
+ vfs_write+0x191/0×4c0 fs/read_write.c:585
+ ksys_write+0x1a1/0×1e0 fs/read_write.c:658
+ do_syscall_64+0x2d/0×40 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ The buggy address belongs to the object at ffff88810b3ad100
+ which belongs to the cache kmalloc-192 of size 192
+ The buggy address is located 16 bytes inside of
+ 192-byte region [ffff88810b3ad100, ffff88810b3ad1c0)
+
+Fixes: b5de0c60cc30 ("RDMA/cma: Fix use after free race in roce multicast join")
+Link: https://lore.kernel.org/r/20210211090517.1278415-1-leon@kernel.org
+Reported-by: Amit Matityahu <mitm@nvidia.com>
+Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 70 ++++++++++++++++++++---------------
+ 1 file changed, 41 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index c51b84b2d2f37..e3638f80e1d52 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -352,7 +352,13 @@ struct ib_device *cma_get_ib_dev(struct cma_device *cma_dev)
+
+ struct cma_multicast {
+ struct rdma_id_private *id_priv;
+- struct ib_sa_multicast *sa_mc;
++ union {
++ struct ib_sa_multicast *sa_mc;
++ struct {
++ struct work_struct work;
++ struct rdma_cm_event event;
++ } iboe_join;
++ };
+ struct list_head list;
+ void *context;
+ struct sockaddr_storage addr;
+@@ -1823,6 +1829,8 @@ static void destroy_mc(struct rdma_id_private *id_priv,
+ cma_igmp_send(ndev, &mgid, false);
+ dev_put(ndev);
+ }
++
++ cancel_work_sync(&mc->iboe_join.work);
+ }
+ kfree(mc);
+ }
+@@ -2683,6 +2691,28 @@ static int cma_query_ib_route(struct rdma_id_private *id_priv,
+ return (id_priv->query_id < 0) ? id_priv->query_id : 0;
+ }
+
++static void cma_iboe_join_work_handler(struct work_struct *work)
++{
++ struct cma_multicast *mc =
++ container_of(work, struct cma_multicast, iboe_join.work);
++ struct rdma_cm_event *event = &mc->iboe_join.event;
++ struct rdma_id_private *id_priv = mc->id_priv;
++ int ret;
++
++ mutex_lock(&id_priv->handler_mutex);
++ if (READ_ONCE(id_priv->state) == RDMA_CM_DESTROYING ||
++ READ_ONCE(id_priv->state) == RDMA_CM_DEVICE_REMOVAL)
++ goto out_unlock;
++
++ ret = cma_cm_event_handler(id_priv, event);
++ WARN_ON(ret);
++
++out_unlock:
++ mutex_unlock(&id_priv->handler_mutex);
++ if (event->event == RDMA_CM_EVENT_MULTICAST_JOIN)
++ rdma_destroy_ah_attr(&event->param.ud.ah_attr);
++}
++
+ static void cma_work_handler(struct work_struct *_work)
+ {
+ struct cma_work *work = container_of(_work, struct cma_work, work);
+@@ -4478,10 +4508,7 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast)
+ cma_make_mc_event(status, id_priv, multicast, &event, mc);
+ ret = cma_cm_event_handler(id_priv, &event);
+ rdma_destroy_ah_attr(&event.param.ud.ah_attr);
+- if (ret) {
+- destroy_id_handler_unlock(id_priv);
+- return 0;
+- }
++ WARN_ON(ret);
+
+ out:
+ mutex_unlock(&id_priv->handler_mutex);
+@@ -4604,7 +4631,6 @@ static void cma_iboe_set_mgid(struct sockaddr *addr, union ib_gid *mgid,
+ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
+ struct cma_multicast *mc)
+ {
+- struct cma_work *work;
+ struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr;
+ int err = 0;
+ struct sockaddr *addr = (struct sockaddr *)&mc->addr;
+@@ -4618,10 +4644,6 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
+ if (cma_zero_addr(addr))
+ return -EINVAL;
+
+- work = kzalloc(sizeof *work, GFP_KERNEL);
+- if (!work)
+- return -ENOMEM;
+-
+ gid_type = id_priv->cma_dev->default_gid_type[id_priv->id.port_num -
+ rdma_start_port(id_priv->cma_dev->device)];
+ cma_iboe_set_mgid(addr, &ib.rec.mgid, gid_type);
+@@ -4632,10 +4654,9 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
+
+ if (dev_addr->bound_dev_if)
+ ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if);
+- if (!ndev) {
+- err = -ENODEV;
+- goto err_free;
+- }
++ if (!ndev)
++ return -ENODEV;
++
+ ib.rec.rate = iboe_get_rate(ndev);
+ ib.rec.hop_limit = 1;
+ ib.rec.mtu = iboe_get_mtu(ndev->mtu);
+@@ -4653,24 +4674,15 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,
+ err = -ENOTSUPP;
+ }
+ dev_put(ndev);
+- if (err || !ib.rec.mtu) {
+- if (!err)
+- err = -EINVAL;
+- goto err_free;
+- }
++ if (err || !ib.rec.mtu)
++ return err ?: -EINVAL;
++
+ rdma_ip2gid((struct sockaddr *)&id_priv->id.route.addr.src_addr,
+ &ib.rec.port_gid);
+- work->id = id_priv;
+- INIT_WORK(&work->work, cma_work_handler);
+- cma_make_mc_event(0, id_priv, &ib, &work->event, mc);
+- /* Balances with cma_id_put() in cma_work_handler */
+- cma_id_get(id_priv);
+- queue_work(cma_wq, &work->work);
++ INIT_WORK(&mc->iboe_join.work, cma_iboe_join_work_handler);
++ cma_make_mc_event(0, id_priv, &ib, &mc->iboe_join.event, mc);
++ queue_work(cma_wq, &mc->iboe_join.work);
+ return 0;
+-
+-err_free:
+- kfree(work);
+- return err;
+ }
+
+ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr,
+--
+2.27.0
+
--- /dev/null
+From 0efaa7abbbae19b6b6d353ff6f3c5614e87c0aac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:30 +0800
+Subject: regmap: sdw: use _no_pm functions in regmap_read/write
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit d288a5712ef961e16d588bbdb2d846e00b5ef154 ]
+
+sdw_update_slave_status will be invoked when a codec is attached,
+and the codec driver will initialize the codec with regmap functions
+while the codec device is pm_runtime suspended.
+
+regmap routines currently rely on regular SoundWire IO functions,
+which will call pm_runtime_get_sync()/put_autosuspend.
+
+This causes a deadlock where the resume routine waits for an
+initialization complete signal that while the initialization complete
+can only be reached when the resume completes.
+
+The only solution if we allow regmap functions to be used in resume
+operations as well as during codec initialization is to use _no_pm
+routines. The duty of making sure the bus is operational needs to be
+handled above the regmap level.
+
+Fixes: 7c22ce6e21840 ('regmap: Add SoundWire bus support')
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20210122070634.12825-6-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap-sdw.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/regmap/regmap-sdw.c b/drivers/base/regmap/regmap-sdw.c
+index c83be26434e76..966de8a136d90 100644
+--- a/drivers/base/regmap/regmap-sdw.c
++++ b/drivers/base/regmap/regmap-sdw.c
+@@ -13,7 +13,7 @@ static int regmap_sdw_write(void *context, unsigned int reg, unsigned int val)
+ struct device *dev = context;
+ struct sdw_slave *slave = dev_to_sdw_dev(dev);
+
+- return sdw_write(slave, reg, val);
++ return sdw_write_no_pm(slave, reg, val);
+ }
+
+ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+@@ -22,7 +22,7 @@ static int regmap_sdw_read(void *context, unsigned int reg, unsigned int *val)
+ struct sdw_slave *slave = dev_to_sdw_dev(dev);
+ int read;
+
+- read = sdw_read(slave, reg);
++ read = sdw_read_no_pm(slave, reg);
+ if (read < 0)
+ return read;
+
+--
+2.27.0
+
--- /dev/null
+From 915dc5644dc6e102dabd8735c41c3cc8e54dcb23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 04:33:13 -0800
+Subject: regulator: axp20x: Fix reference cout leak
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e78bf6be7edaacb39778f3a89416caddfc6c6d70 ]
+
+Decrements the reference count of device node and its child node.
+
+Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/20210120123313.107640-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/axp20x-regulator.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index 90cb8445f7216..d260c442b788d 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -1070,7 +1070,7 @@ static int axp20x_set_dcdc_freq(struct platform_device *pdev, u32 dcdcfreq)
+ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ {
+ struct device_node *np, *regulators;
+- int ret;
++ int ret = 0;
+ u32 dcdcfreq = 0;
+
+ np = of_node_get(pdev->dev.parent->of_node);
+@@ -1085,13 +1085,12 @@ static int axp20x_regulator_parse_dt(struct platform_device *pdev)
+ ret = axp20x_set_dcdc_freq(pdev, dcdcfreq);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "Error setting dcdc frequency: %d\n", ret);
+- return ret;
+ }
+-
+ of_node_put(regulators);
+ }
+
+- return 0;
++ of_node_put(np);
++ return ret;
+ }
+
+ static int axp20x_set_dcdc_workmode(struct regulator_dev *rdev, int id, u32 workmode)
+--
+2.27.0
+
--- /dev/null
+From f6484fa89d102e8b62c2db46344f5034dd28f752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 10:00:23 +0200
+Subject: regulator: bd718x7, bd71828, Fix dvs voltage levels
+
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+
+[ Upstream commit c294554111a835598b557db789d9ad2379b512a2 ]
+
+The ROHM BD718x7 and BD71828 drivers support setting HW state
+specific voltages from device-tree. This is used also by various
+in-tree DTS files.
+
+These drivers do incorrectly try to compose bit-map using enum
+values. By a chance this works for first two valid levels having
+values 1 and 2 - but setting values for the rest of the levels
+do indicate capability of setting values for first levels as
+well. Luckily the regulators which support setting values for
+SUSPEND/LPSR do usually also support setting values for RUN
+and IDLE too - thus this has not been such a fatal issue.
+
+Fix this by defining the old enum values as bits and fixing the
+parsing code. This allows keeping existing IC specific drivers
+intact and only slightly changing the rohm-regulator.c
+
+Fixes: 21b72156ede8b ("regulator: bd718x7: Split driver to common and bd718x7 specific parts")
+Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20210212080023.GA880728@localhost.localdomain
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rohm-regulator.c | 9 ++++++---
+ include/linux/mfd/rohm-generic.h | 14 ++++++--------
+ 2 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/regulator/rohm-regulator.c b/drivers/regulator/rohm-regulator.c
+index 399002383b28b..5c558b153d55e 100644
+--- a/drivers/regulator/rohm-regulator.c
++++ b/drivers/regulator/rohm-regulator.c
+@@ -52,9 +52,12 @@ int rohm_regulator_set_dvs_levels(const struct rohm_dvs_config *dvs,
+ char *prop;
+ unsigned int reg, mask, omask, oreg = desc->enable_reg;
+
+- for (i = 0; i < ROHM_DVS_LEVEL_MAX && !ret; i++) {
+- if (dvs->level_map & (1 << i)) {
+- switch (i + 1) {
++ for (i = 0; i < ROHM_DVS_LEVEL_VALID_AMOUNT && !ret; i++) {
++ int bit;
++
++ bit = BIT(i);
++ if (dvs->level_map & bit) {
++ switch (bit) {
+ case ROHM_DVS_LEVEL_RUN:
+ prop = "rohm,dvs-run-voltage";
+ reg = dvs->run_reg;
+diff --git a/include/linux/mfd/rohm-generic.h b/include/linux/mfd/rohm-generic.h
+index 4283b5b33e040..2b85b9deb03ae 100644
+--- a/include/linux/mfd/rohm-generic.h
++++ b/include/linux/mfd/rohm-generic.h
+@@ -20,14 +20,12 @@ struct rohm_regmap_dev {
+ struct regmap *regmap;
+ };
+
+-enum {
+- ROHM_DVS_LEVEL_UNKNOWN,
+- ROHM_DVS_LEVEL_RUN,
+- ROHM_DVS_LEVEL_IDLE,
+- ROHM_DVS_LEVEL_SUSPEND,
+- ROHM_DVS_LEVEL_LPSR,
+- ROHM_DVS_LEVEL_MAX = ROHM_DVS_LEVEL_LPSR,
+-};
++#define ROHM_DVS_LEVEL_RUN BIT(0)
++#define ROHM_DVS_LEVEL_IDLE BIT(1)
++#define ROHM_DVS_LEVEL_SUSPEND BIT(2)
++#define ROHM_DVS_LEVEL_LPSR BIT(3)
++#define ROHM_DVS_LEVEL_VALID_AMOUNT 4
++#define ROHM_DVS_LEVEL_UNKNOWN 0
+
+ /**
+ * struct rohm_dvs_config - dynamic voltage scaling register descriptions
+--
+2.27.0
+
--- /dev/null
+From ce25a6db6fc3fd68671dc7db408bd5c2c3befd22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 19:32:50 +0100
+Subject: regulator: core: Avoid debugfs: Directory ... already present! error
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit dbe954d8f1635f949a1d9a5d6e6fb749ae022b47 ]
+
+Sometimes regulator_get() gets called twice for the same supply on the
+same device. This may happen e.g. when a framework / library is used
+which uses the regulator; and the driver itself also needs to enable
+the regulator in some cases where the framework will not enable it.
+
+Commit ff268b56ce8c ("regulator: core: Don't spew backtraces on
+duplicate sysfs") already takes care of the backtrace which would
+trigger when creating a duplicate consumer symlink under
+/sys/class/regulator/regulator.%d in this scenario.
+
+Commit c33d442328f5 ("debugfs: make error message a bit more verbose")
+causes a new error to get logged in this scenario:
+
+[ 26.938425] debugfs: Directory 'wm5102-codec-MICVDD' with parent 'spi-WM510204:00-MICVDD' already present!
+
+There is no _nowarn variant of debugfs_create_dir(), but we can detect
+and avoid this problem by checking the return value of the earlier
+sysfs_create_link_nowarn() call.
+
+Add a check for the earlier sysfs_create_link_nowarn() failing with
+-EEXIST and skip the debugfs_create_dir() call in that case, avoiding
+this error getting logged.
+
+Fixes: c33d442328f5 ("debugfs: make error message a bit more verbose")
+Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20210122183250.370571-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 67a768fe5b2a3..2e6c6af9d1c3a 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1617,7 +1617,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ const char *supply_name)
+ {
+ struct regulator *regulator;
+- int err;
++ int err = 0;
+
+ if (dev) {
+ char buf[REG_STR_SIZE];
+@@ -1663,8 +1663,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ }
+ }
+
+- regulator->debugfs = debugfs_create_dir(supply_name,
+- rdev->debugfs);
++ if (err != -EEXIST)
++ regulator->debugfs = debugfs_create_dir(supply_name, rdev->debugfs);
+ if (!regulator->debugfs) {
+ rdev_dbg(rdev, "Failed to create debugfs directory\n");
+ } else {
+--
+2.27.0
+
--- /dev/null
+From 262ce2ad7cfee78a7c974db08729ade2a9eb06a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 22:49:35 -0500
+Subject: regulator: qcom-rpmh: fix pm8009 ldo7
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 20ccc362c3d20da734af896e075b74222589f2c0 ]
+
+Use the correct name to avoid ldo7 commands being sent to ldo6's address.
+
+Fixes: 06369bcc15a1 ("regulator: qcom-rpmh: Add support for SM8150")
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20210211034935.5622-1-jonathan@marek.ca
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index 98320e1d8bf66..37a2abbe85c72 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -937,7 +937,7 @@ static const struct rpmh_vreg_init_data pm8009_vreg_data[] = {
+ RPMH_VREG("ldo4", "ldo%s4", &pmic5_nldo, "vdd-l4"),
+ RPMH_VREG("ldo5", "ldo%s5", &pmic5_pldo, "vdd-l5-l6"),
+ RPMH_VREG("ldo6", "ldo%s6", &pmic5_pldo, "vdd-l5-l6"),
+- RPMH_VREG("ldo7", "ldo%s6", &pmic5_pldo_lv, "vdd-l7"),
++ RPMH_VREG("ldo7", "ldo%s7", &pmic5_pldo_lv, "vdd-l7"),
+ {},
+ };
+
+--
+2.27.0
+
--- /dev/null
+From f9ac31fac3dbf11aeb6729b96abce6a91e692eff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Dec 2020 15:23:47 +0300
+Subject: regulator: qcom-rpmh-regulator: add pm8009-1 chip revision
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 951384cabc5dfb09251d440dbc26058eba86f97e ]
+
+PM8009 has special revision (P=1), which is to be used for sm8250
+platform. The major difference is the S2 regulator which supplies 0.95 V
+instead of 2.848V. Declare regulators data to be used for this chip
+revision. The datasheet calls the chip just pm8009-1, so use the same
+name.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: 06369bcc15a1 ("regulator: qcom-rpmh: Add support for SM8150")
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20201231122348.637917-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/qcom-rpmh-regulator.c | 26 +++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c
+index c395a8dda6f7c..98320e1d8bf66 100644
+--- a/drivers/regulator/qcom-rpmh-regulator.c
++++ b/drivers/regulator/qcom-rpmh-regulator.c
+@@ -732,6 +732,15 @@ static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = {
+ .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
+ };
+
++static const struct rpmh_vreg_hw_data pmic5_hfsmps515_1 = {
++ .regulator_type = VRM,
++ .ops = &rpmh_regulator_vrm_ops,
++ .voltage_range = REGULATOR_LINEAR_RANGE(900000, 0, 4, 16000),
++ .n_voltages = 5,
++ .pmic_mode_map = pmic_mode_map_pmic5_smps,
++ .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode,
++};
++
+ static const struct rpmh_vreg_hw_data pmic5_bob = {
+ .regulator_type = VRM,
+ .ops = &rpmh_regulator_vrm_bypass_ops,
+@@ -932,6 +941,19 @@ static const struct rpmh_vreg_init_data pm8009_vreg_data[] = {
+ {},
+ };
+
++static const struct rpmh_vreg_init_data pm8009_1_vreg_data[] = {
++ RPMH_VREG("smps1", "smp%s1", &pmic5_hfsmps510, "vdd-s1"),
++ RPMH_VREG("smps2", "smp%s2", &pmic5_hfsmps515_1, "vdd-s2"),
++ RPMH_VREG("ldo1", "ldo%s1", &pmic5_nldo, "vdd-l1"),
++ RPMH_VREG("ldo2", "ldo%s2", &pmic5_nldo, "vdd-l2"),
++ RPMH_VREG("ldo3", "ldo%s3", &pmic5_nldo, "vdd-l3"),
++ RPMH_VREG("ldo4", "ldo%s4", &pmic5_nldo, "vdd-l4"),
++ RPMH_VREG("ldo5", "ldo%s5", &pmic5_pldo, "vdd-l5-l6"),
++ RPMH_VREG("ldo6", "ldo%s6", &pmic5_pldo, "vdd-l5-l6"),
++ RPMH_VREG("ldo7", "ldo%s6", &pmic5_pldo_lv, "vdd-l7"),
++ {},
++};
++
+ static const struct rpmh_vreg_init_data pm6150_vreg_data[] = {
+ RPMH_VREG("smps1", "smp%s1", &pmic5_ftsmps510, "vdd-s1"),
+ RPMH_VREG("smps2", "smp%s2", &pmic5_ftsmps510, "vdd-s2"),
+@@ -1057,6 +1079,10 @@ static const struct of_device_id __maybe_unused rpmh_regulator_match_table[] = {
+ .compatible = "qcom,pm8009-rpmh-regulators",
+ .data = pm8009_vreg_data,
+ },
++ {
++ .compatible = "qcom,pm8009-1-rpmh-regulators",
++ .data = pm8009_1_vreg_data,
++ },
+ {
+ .compatible = "qcom,pm8150-rpmh-regulators",
+ .data = pm8150_vreg_data,
+--
+2.27.0
+
--- /dev/null
+From 8c8f78a5802624e353fee49df9ab9644d631d479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:59:14 +0100
+Subject: regulator: s5m8767: Drop regulators OF node reference
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit a5872bd3398d0ff2ce4c77794bc7837899c69024 ]
+
+The device node reference obtained with of_get_child_by_name() should be
+dropped on error paths.
+
+Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20210121155914.48034-1-krzk@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/s5m8767.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 48dd95b3ff45a..7c111bbdc2afa 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -544,14 +544,18 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+ rdata = devm_kcalloc(&pdev->dev,
+ pdata->num_regulators, sizeof(*rdata),
+ GFP_KERNEL);
+- if (!rdata)
++ if (!rdata) {
++ of_node_put(regulators_np);
+ return -ENOMEM;
++ }
+
+ rmode = devm_kcalloc(&pdev->dev,
+ pdata->num_regulators, sizeof(*rmode),
+ GFP_KERNEL);
+- if (!rmode)
++ if (!rmode) {
++ of_node_put(regulators_np);
+ return -ENOMEM;
++ }
+
+ pdata->regulators = rdata;
+ pdata->opmode = rmode;
+--
+2.27.0
+
--- /dev/null
+From a692c3f146fb43c197fcdd61f02a60a5ef7c6774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 19:27:56 -0800
+Subject: regulator: s5m8767: Fix reference count leak
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit dea6dd2ba63f8c8532addb8f32daf7b89a368a42 ]
+
+Call of_node_put() to drop references of regulators_np and reg_np before
+returning error code.
+
+Fixes: 9ae5cc75ceaa ("regulator: s5m8767: Pass descriptor instead of GPIO number")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20210121032756.49501-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/s5m8767.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
+index 3fa472127e9a1..48dd95b3ff45a 100644
+--- a/drivers/regulator/s5m8767.c
++++ b/drivers/regulator/s5m8767.c
+@@ -573,10 +573,13 @@ static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+ "s5m8767,pmic-ext-control",
+ GPIOD_OUT_HIGH | GPIOD_FLAGS_BIT_NONEXCLUSIVE,
+ "s5m8767");
+- if (PTR_ERR(rdata->ext_control_gpiod) == -ENOENT)
++ if (PTR_ERR(rdata->ext_control_gpiod) == -ENOENT) {
+ rdata->ext_control_gpiod = NULL;
+- else if (IS_ERR(rdata->ext_control_gpiod))
++ } else if (IS_ERR(rdata->ext_control_gpiod)) {
++ of_node_put(reg_np);
++ of_node_put(regulators_np);
+ return PTR_ERR(rdata->ext_control_gpiod);
++ }
+
+ rdata->id = i;
+ rdata->initdata = of_get_regulator_init_data(
+--
+2.27.0
+
--- /dev/null
+From b6d3955ee5e2f212783002b822e7aace48402d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 16:20:46 +0800
+Subject: remoteproc/mediatek: acknowledge watchdog IRQ after handled
+
+From: Tzung-Bi Shih <tzungbi@google.com>
+
+[ Upstream commit 8c545f52dce44368fff524e13116e696e005c074 ]
+
+Acknowledges watchdog IRQ after handled or kernel keeps receiving the
+interrupt.
+
+Fixes: fd0b6c1ff85a ("remoteproc/mediatek: Add support for mt8192 SCP")
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Link: https://lore.kernel.org/r/20210127082046.3735157-1-tzungbi@google.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/mtk_common.h | 1 +
+ drivers/remoteproc/mtk_scp.c | 20 +++++++++++---------
+ 2 files changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/remoteproc/mtk_common.h b/drivers/remoteproc/mtk_common.h
+index 988edb4977c31..bcab38511bf31 100644
+--- a/drivers/remoteproc/mtk_common.h
++++ b/drivers/remoteproc/mtk_common.h
+@@ -47,6 +47,7 @@
+
+ #define MT8192_CORE0_SW_RSTN_CLR 0x10000
+ #define MT8192_CORE0_SW_RSTN_SET 0x10004
++#define MT8192_CORE0_WDT_IRQ 0x10030
+ #define MT8192_CORE0_WDT_CFG 0x10034
+
+ #define SCP_FW_VER_LEN 32
+diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
+index e0c2356903616..eba825b46696e 100644
+--- a/drivers/remoteproc/mtk_scp.c
++++ b/drivers/remoteproc/mtk_scp.c
+@@ -197,17 +197,19 @@ static void mt8192_scp_irq_handler(struct mtk_scp *scp)
+
+ scp_to_host = readl(scp->reg_base + MT8192_SCP2APMCU_IPC_SET);
+
+- if (scp_to_host & MT8192_SCP_IPC_INT_BIT)
++ if (scp_to_host & MT8192_SCP_IPC_INT_BIT) {
+ scp_ipi_handler(scp);
+- else
+- scp_wdt_handler(scp, scp_to_host);
+
+- /*
+- * SCP won't send another interrupt until we clear
+- * MT8192_SCP2APMCU_IPC.
+- */
+- writel(MT8192_SCP_IPC_INT_BIT,
+- scp->reg_base + MT8192_SCP2APMCU_IPC_CLR);
++ /*
++ * SCP won't send another interrupt until we clear
++ * MT8192_SCP2APMCU_IPC.
++ */
++ writel(MT8192_SCP_IPC_INT_BIT,
++ scp->reg_base + MT8192_SCP2APMCU_IPC_CLR);
++ } else {
++ scp_wdt_handler(scp, scp_to_host);
++ writel(1, scp->reg_base + MT8192_CORE0_WDT_IRQ);
++ }
+ }
+
+ static irqreturn_t scp_irq_handler(int irq, void *priv)
+--
+2.27.0
+
--- /dev/null
+From c0601b7bac5eaae35169981e48f04316c498c23e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Dec 2020 15:59:11 +0100
+Subject: rtc: rx6110: fix build against modular I2C
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit def8550f543e6c9101f3e1a03160b2aab8c02e8a ]
+
+With CONFIG_I2C=m, the #ifdef section is disabled, as shown
+by this warning:
+
+drivers/rtc/rtc-rx6110.c:314:12: error: unused function 'rx6110_probe' [-Werror,-Wunused-function]
+
+Change the driver to use IS_ENABLED() instead, which works
+for both module and built-in subsystems.
+
+Fixes: afa819c2c6bf ("rtc: rx6110: add i2c support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201230145938.3254459-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-rx6110.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-rx6110.c b/drivers/rtc/rtc-rx6110.c
+index a7b671a210223..79161d4c6ce4d 100644
+--- a/drivers/rtc/rtc-rx6110.c
++++ b/drivers/rtc/rtc-rx6110.c
+@@ -331,7 +331,7 @@ static int rx6110_probe(struct rx6110_data *rx6110, struct device *dev)
+ return 0;
+ }
+
+-#ifdef CONFIG_SPI_MASTER
++#if IS_ENABLED(CONFIG_SPI_MASTER)
+ static struct regmap_config regmap_spi_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+@@ -411,7 +411,7 @@ static void rx6110_spi_unregister(void)
+ }
+ #endif /* CONFIG_SPI_MASTER */
+
+-#ifdef CONFIG_I2C
++#if IS_ENABLED(CONFIG_I2C)
+ static struct regmap_config regmap_i2c_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+--
+2.27.0
+
--- /dev/null
+From 23b9426462e428b4ad9f86e31cbe2c0c109f3941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 11:22:17 +0100
+Subject: rtc: s5m: select REGMAP_I2C
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit 1f0cbda3b452b520c5f3794f8f0e410e8bc7386a ]
+
+The rtc-s5m uses the I2C regmap but doesn't select it in Kconfig so
+depending on the configuration the build may fail. Fix it.
+
+Fixes: 959df7778bbd ("rtc: Enable compile testing for Maxim and Samsung drivers")
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210114102219.23682-2-brgl@bgdev.pl
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 6123f9f4fbc90..e4bef40831c75 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -692,6 +692,7 @@ config RTC_DRV_S5M
+ tristate "Samsung S2M/S5M series"
+ depends on MFD_SEC_CORE || COMPILE_TEST
+ select REGMAP_IRQ
++ select REGMAP_I2C
+ help
+ If you say yes here you will get support for the
+ RTC of Samsung S2MPS14 and S5M PMIC series.
+--
+2.27.0
+
--- /dev/null
+From 3f3edc2692afd61d5ad05c955d654c9d64b96718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 19:51:47 -0800
+Subject: rtc: zynqmp: depend on HAS_IOMEM
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit ddd0521549a975e6148732d6ca6b89ffa862c0e5 ]
+
+The Xilinx zynqmp RTC driver makes use of IOMEM functions like
+devm_platform_ioremap_resource(), which are only available if
+CONFIG_HAS_IOMEM is defined.
+
+This causes the driver not to be enable under make ARCH=um allyesconfig,
+even though it won't build.
+
+By adding a dependency on HAS_IOMEM, the driver will not be enabled on
+architectures which don't support it.
+
+Fixes: 09ef18bcd5ac ("rtc: use devm_platform_ioremap_resource() to simplify code")
+Signed-off-by: David Gow <davidgow@google.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210127035146.1523286-1-davidgow@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index e4bef40831c75..4e2b3a175607b 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1301,7 +1301,7 @@ config RTC_DRV_OPAL
+
+ config RTC_DRV_ZYNQMP
+ tristate "Xilinx Zynq Ultrascale+ MPSoC RTC"
+- depends on OF
++ depends on OF && HAS_IOMEM
+ help
+ If you say yes here you get support for the RTC controller found on
+ Xilinx Zynq Ultrascale+ MPSoC.
+--
+2.27.0
+
--- /dev/null
+From edf6d58ad06ff68ce504fc0e028ae412cf6d08d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:03:08 +0100
+Subject: s390/zcrypt: return EIO when msg retry limit reached
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit d39fae45c97c67b1b4da04773f2bb5a2f29088c4 ]
+
+When a msg is retried because the lower ap layer returns -EAGAIN
+there is a retry limit (currently 10). When this limit is reached
+the last return code from the lower layer is returned, causing
+the userspace to get -1 on the ioctl with errno EAGAIN.
+
+This EAGAIN is misleading here. After 10 retry attempts the
+userspace should receive a clear failure indication like EINVAL
+or EIO or ENODEV. However, the reason why these retries all
+fail is unclear. On an invalid message EINVAL would be returned
+by the lower layer, and if devices go away or are not available
+an ENODEV is seen. So this patch now reworks the retry loops
+to return EIO to userspace when the retry limit is reached.
+
+Fixes: 91ffc519c199 ("s390/zcrypt: introduce msg tracking in zcrypt functions")
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_api.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
+index 10206e4498d07..52eaf51c9bb64 100644
+--- a/drivers/s390/crypto/zcrypt_api.c
++++ b/drivers/s390/crypto/zcrypt_api.c
+@@ -1438,6 +1438,8 @@ static int icarsamodexpo_ioctl(struct ap_perms *perms, unsigned long arg)
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc) {
+ ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSAMODEXPO rc=%d\n", rc);
+ return rc;
+@@ -1481,6 +1483,8 @@ static int icarsacrt_ioctl(struct ap_perms *perms, unsigned long arg)
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc) {
+ ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSACRT rc=%d\n", rc);
+ return rc;
+@@ -1524,6 +1528,8 @@ static int zsecsendcprb_ioctl(struct ap_perms *perms, unsigned long arg)
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc)
+ ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDCPRB rc=%d status=0x%x\n",
+ rc, xcRB.status);
+@@ -1568,6 +1574,8 @@ static int zsendep11cprb_ioctl(struct ap_perms *perms, unsigned long arg)
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc)
+ ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDEP11CPRB rc=%d\n", rc);
+ if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
+@@ -1744,6 +1752,8 @@ static long trans_modexpo32(struct ap_perms *perms, struct file *filp,
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc)
+ return rc;
+ return put_user(mex64.outputdatalength,
+@@ -1795,6 +1805,8 @@ static long trans_modexpo_crt32(struct ap_perms *perms, struct file *filp,
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ if (rc)
+ return rc;
+ return put_user(crt64.outputdatalength,
+@@ -1865,6 +1877,8 @@ static long trans_xcRB32(struct ap_perms *perms, struct file *filp,
+ if (rc == -EAGAIN)
+ tr.again_counter++;
+ } while (rc == -EAGAIN && tr.again_counter < TRACK_AGAIN_MAX);
++ if (rc == -EAGAIN && tr.again_counter >= TRACK_AGAIN_MAX)
++ rc = -EIO;
+ xcRB32.reply_control_blk_length = xcRB64.reply_control_blk_length;
+ xcRB32.reply_data_length = xcRB64.reply_data_length;
+ xcRB32.status = xcRB64.status;
+--
+2.27.0
+
--- /dev/null
+From 2d298c028e45104e77d507b2bf61800e3d5616d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 12:07:55 +0000
+Subject: sched/eas: Don't update misfit status if the task is pinned
+
+From: Qais Yousef <qais.yousef@arm.com>
+
+[ Upstream commit 0ae78eec8aa64e645866e75005162603a77a0f49 ]
+
+If the task is pinned to a cpu, setting the misfit status means that
+we'll unnecessarily continuously attempt to migrate the task but fail.
+
+This continuous failure will cause the balance_interval to increase to
+a high value, and eventually cause unnecessary significant delays in
+balancing the system when real imbalance happens.
+
+Caught while testing uclamp where rt-app calibration loop was pinned to
+cpu 0, shortly after which we spawn another task with high util_clamp
+value. The task was failing to migrate after over 40ms of runtime due to
+balance_interval unnecessary expanded to a very high value from the
+calibration loop.
+
+Not done here, but it could be useful to extend the check for pinning to
+verify that the affinity of the task has a cpu that fits. We could end
+up in a similar situation otherwise.
+
+Fixes: 3b1baa6496e6 ("sched/fair: Add 'group_misfit_task' load-balance type")
+Signed-off-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Quentin Perret <qperret@google.com>
+Acked-by: Valentin Schneider <valentin.schneider@arm.com>
+Link: https://lkml.kernel.org/r/20210119120755.2425264-1-qais.yousef@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 6918adaf74150..bbc78794224ac 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4060,7 +4060,7 @@ static inline void update_misfit_status(struct task_struct *p, struct rq *rq)
+ if (!static_branch_unlikely(&sched_asym_cpucapacity))
+ return;
+
+- if (!p) {
++ if (!p || p->nr_cpus_allowed == 1) {
+ rq->misfit_task_load = 0;
+ return;
+ }
+--
+2.27.0
+
--- /dev/null
+From a3fa963356a5fdb5c7dca5fe20b758a013ec2917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Dec 2020 17:27:52 +0800
+Subject: sched/fair: Avoid stale CPU util_est value for schedutil in task
+ dequeue
+
+From: Xuewen Yan <xuewen.yan@unisoc.com>
+
+[ Upstream commit 8c1f560c1ea3f19e22ba356f62680d9d449c9ec2 ]
+
+CPU (root cfs_rq) estimated utilization (util_est) is currently used in
+dequeue_task_fair() to drive frequency selection before it is updated.
+
+with:
+
+CPU_util : rq->cfs.avg.util_avg
+CPU_util_est : rq->cfs.avg.util_est
+CPU_utilization : max(CPU_util, CPU_util_est)
+task_util : p->se.avg.util_avg
+task_util_est : p->se.avg.util_est
+
+dequeue_task_fair():
+
+ /* (1) CPU_util and task_util update + inform schedutil about
+ CPU_utilization changes */
+ for_each_sched_entity() /* 2 loops */
+ (dequeue_entity() ->) update_load_avg() -> cfs_rq_util_change()
+ -> cpufreq_update_util() ->...-> sugov_update_[shared\|single]
+ -> sugov_get_util() -> cpu_util_cfs()
+
+ /* (2) CPU_util_est and task_util_est update */
+ util_est_dequeue()
+
+cpu_util_cfs() uses CPU_utilization which could lead to a false (too
+high) utilization value for schedutil in task ramp-down or ramp-up
+scenarios during task dequeue.
+
+To mitigate the issue split the util_est update (2) into:
+
+ (A) CPU_util_est update in util_est_dequeue()
+ (B) task_util_est update in util_est_update()
+
+Place (A) before (1) and keep (B) where (2) is. The latter is necessary
+since (B) relies on task_util update in (1).
+
+Fixes: 7f65ea42eb00 ("sched/fair: Add util_est on top of PELT")
+Signed-off-by: Xuewen Yan <xuewen.yan@unisoc.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Link: https://lkml.kernel.org/r/1608283672-18240-1-git-send-email-xuewen.yan94@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++---------------
+ 1 file changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 04a3ce20da671..6918adaf74150 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3943,6 +3943,22 @@ static inline void util_est_enqueue(struct cfs_rq *cfs_rq,
+ trace_sched_util_est_cfs_tp(cfs_rq);
+ }
+
++static inline void util_est_dequeue(struct cfs_rq *cfs_rq,
++ struct task_struct *p)
++{
++ unsigned int enqueued;
++
++ if (!sched_feat(UTIL_EST))
++ return;
++
++ /* Update root cfs_rq's estimated utilization */
++ enqueued = cfs_rq->avg.util_est.enqueued;
++ enqueued -= min_t(unsigned int, enqueued, _task_util_est(p));
++ WRITE_ONCE(cfs_rq->avg.util_est.enqueued, enqueued);
++
++ trace_sched_util_est_cfs_tp(cfs_rq);
++}
++
+ /*
+ * Check if a (signed) value is within a specified (unsigned) margin,
+ * based on the observation that:
+@@ -3956,23 +3972,16 @@ static inline bool within_margin(int value, int margin)
+ return ((unsigned int)(value + margin - 1) < (2 * margin - 1));
+ }
+
+-static void
+-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
++static inline void util_est_update(struct cfs_rq *cfs_rq,
++ struct task_struct *p,
++ bool task_sleep)
+ {
+ long last_ewma_diff;
+ struct util_est ue;
+- int cpu;
+
+ if (!sched_feat(UTIL_EST))
+ return;
+
+- /* Update root cfs_rq's estimated utilization */
+- ue.enqueued = cfs_rq->avg.util_est.enqueued;
+- ue.enqueued -= min_t(unsigned int, ue.enqueued, _task_util_est(p));
+- WRITE_ONCE(cfs_rq->avg.util_est.enqueued, ue.enqueued);
+-
+- trace_sched_util_est_cfs_tp(cfs_rq);
+-
+ /*
+ * Skip update of task's estimated utilization when the task has not
+ * yet completed an activation, e.g. being migrated.
+@@ -4012,8 +4021,7 @@ util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p, bool task_sleep)
+ * To avoid overestimation of actual task utilization, skip updates if
+ * we cannot grant there is idle time in this CPU.
+ */
+- cpu = cpu_of(rq_of(cfs_rq));
+- if (task_util(p) > capacity_orig_of(cpu))
++ if (task_util(p) > capacity_orig_of(cpu_of(rq_of(cfs_rq))))
+ return;
+
+ /*
+@@ -4096,8 +4104,11 @@ static inline void
+ util_est_enqueue(struct cfs_rq *cfs_rq, struct task_struct *p) {}
+
+ static inline void
+-util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p,
+- bool task_sleep) {}
++util_est_dequeue(struct cfs_rq *cfs_rq, struct task_struct *p) {}
++
++static inline void
++util_est_update(struct cfs_rq *cfs_rq, struct task_struct *p,
++ bool task_sleep) {}
+ static inline void update_misfit_status(struct task_struct *p, struct rq *rq) {}
+
+ #endif /* CONFIG_SMP */
+@@ -5609,6 +5620,8 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
+ int idle_h_nr_running = task_has_idle_policy(p);
+ bool was_sched_idle = sched_idle_rq(rq);
+
++ util_est_dequeue(&rq->cfs, p);
++
+ for_each_sched_entity(se) {
+ cfs_rq = cfs_rq_of(se);
+ dequeue_entity(cfs_rq, se, flags);
+@@ -5659,7 +5672,7 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
+ rq->next_balance = jiffies;
+
+ dequeue_throttle:
+- util_est_dequeue(&rq->cfs, p, task_sleep);
++ util_est_update(&rq->cfs, p, task_sleep);
+ hrtick_update(rq);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 71f693705a52ac50c006cd4e4b524ad40dc7858c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Feb 2021 11:24:28 -0800
+Subject: scsi: bnx2fc: Fix Kconfig warning & CNIC build errors
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit eefb816acb0162e94a85a857f3a55148f671d5a5 ]
+
+CNIC depends on MMU, but since 'select' does not follow any dependency
+chains, SCSI_BNX2X_FCOE also needs to depend on MMU, so that erroneous
+configs are not generated, which cause build errors in cnic.
+
+WARNING: unmet direct dependencies detected for CNIC
+ Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && MMU [=n]
+ Selected by [y]:
+ - SCSI_BNX2X_FCOE [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && (IPV6 [=n] || IPV6 [=n]=n) && LIBFC [=y] && LIBFCOE [=y]
+
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L154':
+cnic.c:(.text+0x1094): undefined reference to `uio_event_notify'
+riscv64-linux-ld: cnic.c:(.text+0x10bc): undefined reference to `uio_event_notify'
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L1442':
+cnic.c:(.text+0x96a8): undefined reference to `__uio_register_device'
+riscv64-linux-ld: drivers/net/ethernet/broadcom/cnic.o: in function `.L0 ':
+cnic.c:(.text.unlikely+0x68): undefined reference to `uio_unregister_device'
+
+Link: https://lore.kernel.org/r/20210213192428.22537-1-rdunlap@infradead.org
+Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver")
+Cc: Saurav Kashyap <skashyap@marvell.com>
+Cc: Javed Hasan <jhasan@marvell.com>
+Cc: GR-QLogic-Storage-Upstream@marvell.com
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: linux-scsi@vger.kernel.org
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2fc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig
+index 3cf7e08df8093..ecdc0f0f4f4e6 100644
+--- a/drivers/scsi/bnx2fc/Kconfig
++++ b/drivers/scsi/bnx2fc/Kconfig
+@@ -5,6 +5,7 @@ config SCSI_BNX2X_FCOE
+ depends on (IPV6 || IPV6=n)
+ depends on LIBFC
+ depends on LIBFCOE
++ depends on MMU
+ select NETDEVICES
+ select ETHERNET
+ select NET_VENDOR_BROADCOM
+--
+2.27.0
+
--- /dev/null
+From e95cab61d42a4754418a9e7107d76e266271f7b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:43 +0100
+Subject: scsi: isci: Pass gfp_t flags in isci_port_bc_change_received()
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit 71dca5539fcf977aead0c9ea1962e70e78484b8e ]
+
+Use the new libsas event notifiers API, which requires callers to
+explicitly pass the gfp_t memory allocation flags.
+
+libsas sas_notify_port_event() is called from
+isci_port_bc_change_received(). Below is the context analysis for all of
+its call chains:
+
+host.c: sci_controller_error_handler(): atomic, irq handler (*)
+OR host.c: sci_controller_completion_handler(), atomic, tasklet (*)
+ -> sci_controller_process_completions()
+ -> sci_controller_event_completion()
+ -> phy.c: sci_phy_event_handler()
+ -> port.c: sci_port_broadcast_change_received()
+ -> isci_port_bc_change_received()
+
+host.c: isci_host_init() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_initialize(), atomic (*)
+ -> port_config.c: sci_port_configuration_agent_initialize()
+ -> sci_mpc_agent_validate_phy_configuration()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_set_phy()
+ -> phy.c: sci_phy_set_port()
+ -> port.c: sci_port_broadcast_change_received()
+ -> isci_port_bc_change_received()
+
+port_config.c: apc_agent_timeout(), atomic, timer callback (*)
+ -> sci_apc_agent_configure_ports()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_set_phy()
+ -> phy.c: sci_phy_set_port()
+ -> port.c: sci_port_broadcast_change_received()
+ -> isci_port_bc_change_received()
+
+phy.c: enter SCI state: *SCI_PHY_STOPPED* # Cont. from [1]
+ -> sci_phy_stopped_state_enter()
+ -> host.c: sci_controller_link_down()
+ -> ->link_down_handler()
+ == port_config.c: sci_apc_agent_link_down()
+ -> port.c: sci_port_remove_phy()
+ -> sci_port_clear_phy()
+ -> phy.c: sci_phy_set_port()
+ -> port.c: sci_port_broadcast_change_received()
+ -> isci_port_bc_change_received()
+
+phy.c: enter SCI state: *SCI_PHY_STARTING* # Cont. from [2]
+ -> sci_phy_starting_state_enter()
+ -> host.c: sci_controller_link_down()
+ -> ->link_down_handler()
+ == port_config.c: sci_apc_agent_link_down()
+ -> port.c: sci_port_remove_phy()
+ -> sci_port_clear_phy()
+ -> phy.c: sci_phy_set_port()
+ -> port.c: sci_port_broadcast_change_received()
+ -> isci_port_bc_change_received()
+
+[1] Call chains for entering state: *SCI_PHY_STOPPED*
+-----------------------------------------------------
+
+host.c: isci_host_init() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_initialize(), atomic (*)
+ -> phy.c: sci_phy_initialize()
+ -> phy.c: sci_phy_link_layer_initialization()
+ -> phy.c: sci_change_state(SCI_PHY_STOPPED)
+
+init.c: PCI ->remove() || PM_OPS ->suspend, process context (+)
+ -> host.c: isci_host_deinit()
+ -> sci_controller_stop_phys()
+ -> phy.c: sci_phy_stop()
+ -> sci_change_state(SCI_PHY_STOPPED)
+
+phy.c: isci_phy_control()
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_phy_stop(), atomic (*)
+ -> sci_change_state(SCI_PHY_STOPPED)
+
+[2] Call chains for entering state: *SCI_PHY_STARTING*
+------------------------------------------------------
+
+phy.c: phy_sata_timeout(), atimer, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_change_state(SCI_PHY_STARTING)
+
+host.c: phy_startup_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+host.c: isci_host_start() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_start(), atomic (*)
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+phy.c: Enter SCI state *SCI_PHY_SUB_FINAL* # Cont. from [2A]
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_phy_starting_final_substate_enter()
+ -> sci_change_state(SCI_PHY_READY)
+ -> Enter SCI state: *SCI_PHY_READY*
+ -> sci_phy_ready_state_enter()
+ -> host.c: sci_controller_link_up()
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+phy.c: sci_phy_event_handler(), atomic, discussed earlier (*)
+ -> sci_change_state(SCI_PHY_STARTING), 11 instances
+
+port.c: isci_port_perform_hard_reset()
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> port.c: sci_port_hard_reset(), atomic (*)
+ -> phy.c: sci_phy_reset()
+ -> sci_change_state(SCI_PHY_RESETTING)
+ -> enter SCI PHY state: *SCI_PHY_RESETTING*
+ -> sci_phy_resetting_state_enter()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+[2A] Call chains for entering SCI state: *SCI_PHY_SUB_FINAL*
+------------------------------------------------------------
+
+host.c: power_control_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> phy.c: sci_phy_consume_power_handler()
+ -> phy.c: sci_change_state(SCI_PHY_SUB_FINAL)
+
+host.c: sci_controller_error_handler(): atomic, irq handler (*)
+OR host.c: sci_controller_completion_handler(), atomic, tasklet (*)
+ -> sci_controller_process_completions()
+ -> sci_controller_unsolicited_frame()
+ -> phy.c: sci_phy_frame_handler()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SAS_POWER)
+ -> sci_phy_starting_await_sas_power_substate_enter()
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_controller_event_completion()
+ -> phy.c: sci_phy_event_handler()
+ -> sci_phy_start_sata_link_training()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SATA_POWER)
+ -> sci_phy_starting_await_sata_power_substate_enter
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+
+As can be seen from the "(*)" markers above, almost all the call-chains are
+atomic. The only exception, marked with "(+)", is a PCI ->remove() and
+PM_OPS ->suspend() cold path. Thus, pass GFP_ATOMIC to the libsas port
+event notifier.
+
+Note, the now-replaced libsas APIs used in_interrupt() to implicitly decide
+which memory allocation type to use. This was only partially correct, as
+it fails to choose the correct GFP flags when just preemption or interrupts
+are disabled. Such buggy code paths are marked with "(@)" in the call
+chains above.
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-8-a.darwish@linutronix.de
+Fixes: 1c393b970e0f ("scsi: libsas: Use dynamic alloced work to avoid sas event lost")
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
+index 10136ae466e20..e50c3b0deeb30 100644
+--- a/drivers/scsi/isci/port.c
++++ b/drivers/scsi/isci/port.c
+@@ -164,7 +164,8 @@ static void isci_port_bc_change_received(struct isci_host *ihost,
+ "%s: isci_phy = %p, sas_phy = %p\n",
+ __func__, iphy, &iphy->sas_phy);
+
+- sas_notify_port_event(&iphy->sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event_gfp(&iphy->sas_phy,
++ PORTE_BROADCAST_RCVD, GFP_ATOMIC);
+ sci_port_bcn_enable(iport);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 5f017f993d640a5efa26fed4613d18ff3ccc16b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:41 +0100
+Subject: scsi: isci: Pass gfp_t flags in isci_port_link_down()
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit 885ab3b8926fdf9cdd7163dfad99deb9b0662b39 ]
+
+Use the new libsas event notifiers API, which requires callers to
+explicitly pass the gfp_t memory allocation flags.
+
+sas_notify_phy_event() is exclusively called by isci_port_link_down().
+Below is the context analysis for all of its call chains:
+
+port.c: port_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> port_state_machine_change(..., SCI_PORT_FAILED)
+ -> enter SCI port state: *SCI_PORT_FAILED*
+ -> sci_port_failed_state_enter()
+ -> isci_port_hard_reset_complete()
+ -> isci_port_link_down()
+
+port.c: isci_port_perform_hard_reset()
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> port.c: sci_port_hard_reset(), atomic (*)
+ -> phy.c: sci_phy_reset()
+ -> sci_change_state(SCI_PHY_RESETTING)
+ -> enter SCI PHY state: *SCI_PHY_RESETTING*
+ -> sci_phy_resetting_state_enter()
+ -> port.c: sci_port_deactivate_phy()
+ -> isci_port_link_down()
+
+port.c: enter SCI port state: *SCI_PORT_READY* # Cont. from [1]
+ -> sci_port_ready_state_enter()
+ -> isci_port_hard_reset_complete()
+ -> isci_port_link_down()
+
+phy.c: enter SCI state: *SCI_PHY_STOPPED* # Cont. from [2]
+ -> sci_phy_stopped_state_enter()
+ -> host.c: sci_controller_link_down()
+ -> ->link_down_handler()
+ == port_config.c: sci_apc_agent_link_down()
+ -> port.c: sci_port_remove_phy()
+ -> sci_port_deactivate_phy()
+ -> isci_port_link_down()
+ == port_config.c: sci_mpc_agent_link_down()
+ -> port.c: sci_port_link_down()
+ -> sci_port_deactivate_phy()
+ -> isci_port_link_down()
+
+phy.c: enter SCI state: *SCI_PHY_STARTING* # Cont. from [3]
+ -> sci_phy_starting_state_enter()
+ -> host.c: sci_controller_link_down()
+ -> ->link_down_handler()
+ == port_config.c: sci_apc_agent_link_down()
+ -> port.c: sci_port_remove_phy()
+ -> isci_port_link_down()
+ == port_config.c: sci_mpc_agent_link_down()
+ -> port.c: sci_port_link_down()
+ -> sci_port_deactivate_phy()
+ -> isci_port_link_down()
+
+[1] Call chains for 'enter SCI port state: *SCI_PORT_READY*'
+------------------------------------------------------------
+
+host.c: isci_host_init() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_initialize(), atomic (*)
+ -> port_config.c: sci_port_configuration_agent_initialize()
+ -> sci_mpc_agent_validate_phy_configuration()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+
+host.c: isci_host_start() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> host.c: sci_controller_start(), atomic (*)
+ -> host.c: sci_port_start()
+ -> port.c: port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+
+port_config.c: apc_agent_timeout(), atomic, timer callback (*)
+ -> sci_apc_agent_configure_ports()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+
+port_config.c: mpc_agent_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> ->link_up_handler()
+ == port.c: sci_apc_agent_link_up()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+ == port.c: sci_mpc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+
+phy.c: enter SCI state: SCI_PHY_SUB_FINAL # Cont. from [1A]
+ -> sci_phy_starting_final_substate_enter()
+ -> sci_change_state(SCI_PHY_READY)
+ -> enter SCI state: *SCI_PHY_READY*
+ -> sci_phy_ready_state_enter()
+ -> host.c: sci_controller_link_up()
+ -> port_agent.link_up_handler()
+ == port_config.c: sci_apc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+ == port_config.c: sci_mpc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> sci_port_general_link_up_handler()
+ -> port_state_machine_change(, SCI_PORT_READY)
+ -> enter port state *SCI_PORT_READY*
+
+[1A] Call chains for entering SCI state: *SCI_PHY_SUB_FINAL*
+------------------------------------------------------------
+
+host.c: power_control_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> phy.c: sci_phy_consume_power_handler()
+ -> phy.c: sci_change_state(SCI_PHY_SUB_FINAL)
+
+host.c: sci_controller_error_handler(): atomic, irq handler (*)
+OR host.c: sci_controller_completion_handler(), atomic, tasklet (*)
+ -> sci_controller_process_completions()
+ -> sci_controller_unsolicited_frame()
+ -> phy.c: sci_phy_frame_handler()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SAS_POWER)
+ -> sci_phy_starting_await_sas_power_substate_enter()
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_controller_event_completion()
+ -> phy.c: sci_phy_event_handler()
+ -> sci_phy_start_sata_link_training()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SATA_POWER)
+ -> sci_phy_starting_await_sata_power_substate_enter
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+
+[2] Call chains for entering state: *SCI_PHY_STOPPED*
+-----------------------------------------------------
+
+host.c: isci_host_init() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_initialize(), atomic (*)
+ -> phy.c: sci_phy_initialize()
+ -> phy.c: sci_phy_link_layer_initialization()
+ -> phy.c: sci_change_state(SCI_PHY_STOPPED)
+
+init.c: PCI ->remove() || PM_OPS ->suspend, process context (+)
+ -> host.c: isci_host_deinit()
+ -> sci_controller_stop_phys()
+ -> phy.c: sci_phy_stop()
+ -> sci_change_state(SCI_PHY_STOPPED)
+
+phy.c: isci_phy_control()
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_phy_stop(), atomic (*)
+ -> sci_change_state(SCI_PHY_STOPPED)
+
+[3] Call chains for entering state: *SCI_PHY_STARTING*
+------------------------------------------------------
+
+phy.c: phy_sata_timeout(), atimer, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_change_state(SCI_PHY_STARTING)
+
+host.c: phy_startup_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+host.c: isci_host_start() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_start(), atomic (*)
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+phy.c: Enter SCI state *SCI_PHY_SUB_FINAL*, atomic, check above (*)
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_phy_starting_final_substate_enter()
+ -> sci_change_state(SCI_PHY_READY)
+ -> Enter SCI state: *SCI_PHY_READY*
+ -> sci_phy_ready_state_enter()
+ -> host.c: sci_controller_link_up()
+ -> sci_controller_start_next_phy()
+ -> sci_phy_start()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+phy.c: sci_phy_event_handler(), atomic, discussed earlier (*)
+ -> sci_change_state(SCI_PHY_STARTING), 11 instances
+
+phy.c: enter SCI state: *SCI_PHY_RESETTING*, atomic, discussed (*)
+ -> sci_phy_resetting_state_enter()
+ -> sci_change_state(SCI_PHY_STARTING)
+
+As can be seen from the "(*)" markers above, almost all the call-chains are
+atomic. The only exception, marked with "(+)", is a PCI ->remove() and
+PM_OPS ->suspend() cold path. Thus, pass GFP_ATOMIC to the libsas phy event
+notifier.
+
+Note, The now-replaced libsas APIs used in_interrupt() to implicitly decide
+which memory allocation type to use. This was only partially correct, as
+it fails to choose the correct GFP flags when just preemption or interrupts
+are disabled. Such buggy code paths are marked with "(@)" in the call
+chains above.
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-6-a.darwish@linutronix.de
+Fixes: 1c393b970e0f ("scsi: libsas: Use dynamic alloced work to avoid sas event lost")
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/port.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
+index 8d93497380674..a3c58718c2600 100644
+--- a/drivers/scsi/isci/port.c
++++ b/drivers/scsi/isci/port.c
+@@ -269,8 +269,8 @@ static void isci_port_link_down(struct isci_host *isci_host,
+ * isci_port_deformed and isci_dev_gone functions.
+ */
+ sas_phy_disconnected(&isci_phy->sas_phy);
+- sas_notify_phy_event(&isci_phy->sas_phy,
+- PHYE_LOSS_OF_SIGNAL);
++ sas_notify_phy_event_gfp(&isci_phy->sas_phy,
++ PHYE_LOSS_OF_SIGNAL, GFP_ATOMIC);
+
+ dev_dbg(&isci_host->pdev->dev,
+ "%s: isci_port = %p - Done\n", __func__, isci_port);
+--
+2.27.0
+
--- /dev/null
+From 43b8e9754699cf17ec8507dde89301b178ebd375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:42 +0100
+Subject: scsi: isci: Pass gfp_t flags in isci_port_link_up()
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit 5ce7902902adb8d154d67ba494f06daa29360ef0 ]
+
+Use the new libsas event notifiers API, which requires callers to
+explicitly pass the gfp_t memory allocation flags.
+
+libsas sas_notify_port_event() is called from isci_port_link_up(). Below
+is the context analysis for all of its call chains:
+
+host.c: isci_host_init() (@)
+spin_lock_irq(isci_host::scic_lock)
+ -> sci_controller_initialize(), atomic (*)
+ -> port_config.c: sci_port_configuration_agent_initialize()
+ -> sci_mpc_agent_validate_phy_configuration()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_general_link_up_handler()
+ -> sci_port_activate_phy()
+ -> isci_port_link_up()
+
+port_config.c: apc_agent_timeout(), atomic, timer callback (*)
+ -> sci_apc_agent_configure_ports()
+ -> port.c: sci_port_add_phy()
+ -> sci_port_general_link_up_handler()
+ -> sci_port_activate_phy()
+ -> isci_port_link_up()
+
+phy.c: enter SCI state: *SCI_PHY_SUB_FINAL* # Cont. from [1]
+ -> phy.c: sci_phy_starting_final_substate_enter()
+ -> phy.c: sci_change_state(SCI_PHY_READY)
+ -> enter SCI state: *SCI_PHY_READY*
+ -> phy.c: sci_phy_ready_state_enter()
+ -> host.c: sci_controller_link_up()
+ -> .link_up_handler()
+ == port_config.c: sci_apc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> (continue at [A])
+ == port_config.c: sci_mpc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> (continue at [A])
+
+port_config.c: mpc_agent_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> ->link_up_handler()
+ == port_config.c: sci_apc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> (continue at [A])
+ == port_config.c: sci_mpc_agent_link_up()
+ -> port.c: sci_port_link_up()
+ -> (continue at [A])
+
+[A] port.c: sci_port_link_up()
+ -> sci_port_activate_phy()
+ -> isci_port_link_up()
+ -> sci_port_general_link_up_handler()
+ -> sci_port_activate_phy()
+ -> isci_port_link_up()
+
+[1] Call chains for entering SCI state: *SCI_PHY_SUB_FINAL*
+-----------------------------------------------------------
+
+host.c: power_control_timeout(), atomic, timer callback (*)
+spin_lock_irqsave(isci_host::scic_lock, )
+ -> phy.c: sci_phy_consume_power_handler()
+ -> phy.c: sci_change_state(SCI_PHY_SUB_FINAL)
+
+host.c: sci_controller_error_handler(): atomic, irq handler (*)
+OR host.c: sci_controller_completion_handler(), atomic, tasklet (*)
+ -> sci_controller_process_completions()
+ -> sci_controller_unsolicited_frame()
+ -> phy.c: sci_phy_frame_handler()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SAS_POWER)
+ -> sci_phy_starting_await_sas_power_substate_enter()
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+ -> sci_controller_event_completion()
+ -> phy.c: sci_phy_event_handler()
+ -> sci_phy_start_sata_link_training()
+ -> sci_change_state(SCI_PHY_SUB_AWAIT_SATA_POWER)
+ -> sci_phy_starting_await_sata_power_substate_enter
+ -> host.c: sci_controller_power_control_queue_insert()
+ -> phy.c: sci_phy_consume_power_handler()
+ -> sci_change_state(SCI_PHY_SUB_FINAL)
+
+As can be seen from the "(*)" markers above, all the call-chains are
+atomic. Pass GFP_ATOMIC to libsas port event notifier.
+
+Note, the now-replaced libsas APIs used in_interrupt() to implicitly decide
+which memory allocation type to use. This was only partially correct, as
+it fails to choose the correct GFP flags when just preemption or interrupts
+are disabled. Such buggy code paths are marked with "(@)" in the call
+chains above.
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-7-a.darwish@linutronix.de
+Fixes: 1c393b970e0f ("scsi: libsas: Use dynamic alloced work to avoid sas event lost")
+Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/isci/port.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
+index a3c58718c2600..10136ae466e20 100644
+--- a/drivers/scsi/isci/port.c
++++ b/drivers/scsi/isci/port.c
+@@ -223,7 +223,8 @@ static void isci_port_link_up(struct isci_host *isci_host,
+ /* Notify libsas that we have an address frame, if indeed
+ * we've found an SSP, SMP, or STP target */
+ if (success)
+- sas_notify_port_event(&iphy->sas_phy, PORTE_BYTES_DMAED);
++ sas_notify_port_event_gfp(&iphy->sas_phy,
++ PORTE_BYTES_DMAED, GFP_ATOMIC);
+ }
+
+
+--
+2.27.0
+
--- /dev/null
+From eb45ea36be730c7f29f8aaf1b19bec62c0277fcf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:39 +0100
+Subject: scsi: libsas: Introduce a _gfp() variant of event notifiers
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit c2d0f1a65ab9fbabebb463bf36f50ea8f4633386 ]
+
+sas_alloc_event() uses in_interrupt() to decide which allocation should be
+used.
+
+The usage of in_interrupt() in drivers is phased out and Linus clearly
+requested that code which changes behaviour depending on context should
+either be separated or the context be conveyed in an argument passed by the
+caller, which usually knows the context.
+
+The in_interrupt() check is also only partially correct, because it fails
+to choose the correct code path when just preemption or interrupts are
+disabled. For example, as in the following call chain:
+
+ mvsas/mv_sas.c: mvs_work_queue() [process context]
+ spin_lock_irqsave(mvs_info::lock, )
+ -> libsas/sas_event.c: sas_notify_phy_event()
+ -> sas_alloc_event()
+ -> in_interrupt() = false
+ -> invalid GFP_KERNEL allocation
+ -> libsas/sas_event.c: sas_notify_port_event()
+ -> sas_alloc_event()
+ -> in_interrupt() = false
+ -> invalid GFP_KERNEL allocation
+
+Introduce sas_alloc_event_gfp(), sas_notify_port_event_gfp(), and
+sas_notify_phy_event_gfp(), which all behave like the non _gfp() variants
+but use a caller-passed GFP mask for allocations.
+
+For bisectability, all callers will be modified first to pass GFP context,
+then the non _gfp() libsas API variants will be modified to take a gfp_t by
+default.
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-4-a.darwish@linutronix.de
+Fixes: 1c393b970e0f ("scsi: libsas: Use dynamic alloced work to avoid sas event lost")
+Cc: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/scsi/libsas.rst | 2 +
+ drivers/scsi/libsas/sas_event.c | 65 ++++++++++++++++++++++++------
+ drivers/scsi/libsas/sas_init.c | 21 +++++++---
+ drivers/scsi/libsas/sas_internal.h | 4 ++
+ include/scsi/libsas.h | 4 ++
+ 5 files changed, 79 insertions(+), 17 deletions(-)
+
+diff --git a/Documentation/scsi/libsas.rst b/Documentation/scsi/libsas.rst
+index 210df1aba1409..de422253b0ab7 100644
+--- a/Documentation/scsi/libsas.rst
++++ b/Documentation/scsi/libsas.rst
+@@ -192,6 +192,8 @@ The event interface::
+ void (*notify_ha_event)(struct sas_ha_struct *, enum ha_event);
+ void sas_notify_port_event(struct sas_phy *, enum port_event);
+ void sas_notify_phy_event(struct sas_phy *, enum phy_event);
++ void sas_notify_port_event_gfp(struct sas_phy *, enum port_event, gfp_t);
++ void sas_notify_phy_event_gfp(struct sas_phy *, enum phy_event, gfp_t);
+
+ The port notification::
+
+diff --git a/drivers/scsi/libsas/sas_event.c b/drivers/scsi/libsas/sas_event.c
+index 112a1b76f63b1..ba266a17250ae 100644
+--- a/drivers/scsi/libsas/sas_event.c
++++ b/drivers/scsi/libsas/sas_event.c
+@@ -131,18 +131,15 @@ static void sas_phy_event_worker(struct work_struct *work)
+ sas_free_event(ev);
+ }
+
+-int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
++static int __sas_notify_port_event(struct asd_sas_phy *phy,
++ enum port_event event,
++ struct asd_sas_event *ev)
+ {
+- struct asd_sas_event *ev;
+ struct sas_ha_struct *ha = phy->ha;
+ int ret;
+
+ BUG_ON(event >= PORT_NUM_EVENTS);
+
+- ev = sas_alloc_event(phy);
+- if (!ev)
+- return -ENOMEM;
+-
+ INIT_SAS_EVENT(ev, sas_port_event_worker, phy, event);
+
+ ret = sas_queue_event(event, &ev->work, ha);
+@@ -151,20 +148,41 @@ int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(sas_notify_port_event);
+
+-int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event)
++int sas_notify_port_event_gfp(struct asd_sas_phy *phy, enum port_event event,
++ gfp_t gfp_flags)
+ {
+ struct asd_sas_event *ev;
+- struct sas_ha_struct *ha = phy->ha;
+- int ret;
+
+- BUG_ON(event >= PHY_NUM_EVENTS);
++ ev = sas_alloc_event_gfp(phy, gfp_flags);
++ if (!ev)
++ return -ENOMEM;
++
++ return __sas_notify_port_event(phy, event, ev);
++}
++EXPORT_SYMBOL_GPL(sas_notify_port_event_gfp);
++
++int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
++{
++ struct asd_sas_event *ev;
+
+ ev = sas_alloc_event(phy);
+ if (!ev)
+ return -ENOMEM;
+
++ return __sas_notify_port_event(phy, event, ev);
++}
++EXPORT_SYMBOL_GPL(sas_notify_port_event);
++
++static inline int __sas_notify_phy_event(struct asd_sas_phy *phy,
++ enum phy_event event,
++ struct asd_sas_event *ev)
++{
++ struct sas_ha_struct *ha = phy->ha;
++ int ret;
++
++ BUG_ON(event >= PHY_NUM_EVENTS);
++
+ INIT_SAS_EVENT(ev, sas_phy_event_worker, phy, event);
+
+ ret = sas_queue_event(event, &ev->work, ha);
+@@ -173,5 +191,28 @@ int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event)
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(sas_notify_phy_event);
+
++int sas_notify_phy_event_gfp(struct asd_sas_phy *phy, enum phy_event event,
++ gfp_t gfp_flags)
++{
++ struct asd_sas_event *ev;
++
++ ev = sas_alloc_event_gfp(phy, gfp_flags);
++ if (!ev)
++ return -ENOMEM;
++
++ return __sas_notify_phy_event(phy, event, ev);
++}
++EXPORT_SYMBOL_GPL(sas_notify_phy_event_gfp);
++
++int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event)
++{
++ struct asd_sas_event *ev;
++
++ ev = sas_alloc_event(phy);
++ if (!ev)
++ return -ENOMEM;
++
++ return __sas_notify_phy_event(phy, event, ev);
++}
++EXPORT_SYMBOL_GPL(sas_notify_phy_event);
+diff --git a/drivers/scsi/libsas/sas_init.c b/drivers/scsi/libsas/sas_init.c
+index 6dc2505d36af7..f8ae1f0f17d36 100644
+--- a/drivers/scsi/libsas/sas_init.c
++++ b/drivers/scsi/libsas/sas_init.c
+@@ -584,16 +584,15 @@ sas_domain_attach_transport(struct sas_domain_function_template *dft)
+ }
+ EXPORT_SYMBOL_GPL(sas_domain_attach_transport);
+
+-
+-struct asd_sas_event *sas_alloc_event(struct asd_sas_phy *phy)
++static struct asd_sas_event *__sas_alloc_event(struct asd_sas_phy *phy,
++ gfp_t gfp_flags)
+ {
+ struct asd_sas_event *event;
+- gfp_t flags = in_interrupt() ? GFP_ATOMIC : GFP_KERNEL;
+ struct sas_ha_struct *sas_ha = phy->ha;
+ struct sas_internal *i =
+ to_sas_internal(sas_ha->core.shost->transportt);
+
+- event = kmem_cache_zalloc(sas_event_cache, flags);
++ event = kmem_cache_zalloc(sas_event_cache, gfp_flags);
+ if (!event)
+ return NULL;
+
+@@ -604,7 +603,8 @@ struct asd_sas_event *sas_alloc_event(struct asd_sas_phy *phy)
+ if (cmpxchg(&phy->in_shutdown, 0, 1) == 0) {
+ pr_notice("The phy%d bursting events, shut it down.\n",
+ phy->id);
+- sas_notify_phy_event(phy, PHYE_SHUTDOWN);
++ sas_notify_phy_event_gfp(phy, PHYE_SHUTDOWN,
++ gfp_flags);
+ }
+ } else {
+ /* Do not support PHY control, stop allocating events */
+@@ -618,6 +618,17 @@ struct asd_sas_event *sas_alloc_event(struct asd_sas_phy *phy)
+ return event;
+ }
+
++struct asd_sas_event *sas_alloc_event(struct asd_sas_phy *phy)
++{
++ return __sas_alloc_event(phy, in_interrupt() ? GFP_ATOMIC : GFP_KERNEL);
++}
++
++struct asd_sas_event *sas_alloc_event_gfp(struct asd_sas_phy *phy,
++ gfp_t gfp_flags)
++{
++ return __sas_alloc_event(phy, gfp_flags);
++}
++
+ void sas_free_event(struct asd_sas_event *event)
+ {
+ struct asd_sas_phy *phy = event->phy;
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 53ea32ed17a75..52e09c3e2b50d 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -49,6 +49,8 @@ int sas_register_phys(struct sas_ha_struct *sas_ha);
+ void sas_unregister_phys(struct sas_ha_struct *sas_ha);
+
+ struct asd_sas_event *sas_alloc_event(struct asd_sas_phy *phy);
++struct asd_sas_event *sas_alloc_event_gfp(struct asd_sas_phy *phy,
++ gfp_t gfp_flags);
+ void sas_free_event(struct asd_sas_event *event);
+
+ int sas_register_ports(struct sas_ha_struct *sas_ha);
+@@ -77,6 +79,8 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ int sas_smp_get_phy_events(struct sas_phy *phy);
+
+ int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event);
++int sas_notify_phy_event_gfp(struct asd_sas_phy *phy, enum phy_event event,
++ gfp_t flags);
+ void sas_device_set_phy(struct domain_device *dev, struct sas_port *port);
+ struct domain_device *sas_find_dev_by_rphy(struct sas_rphy *rphy);
+ struct domain_device *sas_ex_to_ata(struct domain_device *ex_dev, int phy_id);
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 3387149502e9a..e6a43163ab5b7 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -704,5 +704,9 @@ int sas_request_addr(struct Scsi_Host *shost, u8 *addr);
+
+ int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event);
+ int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event);
++int sas_notify_port_event_gfp(struct asd_sas_phy *phy, enum port_event event,
++ gfp_t gfp_flags);
++int sas_notify_phy_event_gfp(struct asd_sas_phy *phy, enum phy_event event,
++ gfp_t gfp_flags);
+
+ #endif /* _SASLIB_H_ */
+--
+2.27.0
+
--- /dev/null
+From 3c4df182ab28ea4fa28865afacec568a4f51f3ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:38 +0100
+Subject: scsi: libsas: Remove notifier indirection
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 121181f3f839c29d8dd9fdc3cc9babbdc74227f8 ]
+
+LLDDs report events to libsas with .notify_port_event and .notify_phy_event
+callbacks.
+
+These callbacks are fixed and so there is no reason why the functions
+cannot be called directly, so do that.
+
+This neatens the code slightly, makes it more obvious, and reduces function
+pointer usage, which is generally a good thing. Downside is that there are
+2x more symbol exports.
+
+[a.darwish@linutronix.de: Remove the now unused "sas_ha" local variables]
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-3-a.darwish@linutronix.de
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/scsi/libsas.rst | 9 ++----
+ drivers/scsi/aic94xx/aic94xx_scb.c | 20 ++++++-------
+ drivers/scsi/hisi_sas/hisi_sas_main.c | 12 +++-----
+ drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 3 +-
+ drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 3 +-
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +-
+ drivers/scsi/isci/port.c | 7 ++---
+ drivers/scsi/libsas/sas_event.c | 13 +++------
+ drivers/scsi/libsas/sas_init.c | 6 ----
+ drivers/scsi/libsas/sas_internal.h | 1 -
+ drivers/scsi/mvsas/mv_sas.c | 14 ++++-----
+ drivers/scsi/pm8001/pm8001_hwi.c | 40 ++++++++++++--------------
+ drivers/scsi/pm8001/pm8001_sas.c | 7 ++---
+ drivers/scsi/pm8001/pm80xx_hwi.c | 35 ++++++++++------------
+ include/scsi/libsas.h | 7 ++---
+ 15 files changed, 70 insertions(+), 110 deletions(-)
+
+diff --git a/Documentation/scsi/libsas.rst b/Documentation/scsi/libsas.rst
+index f9b77c7879dbb..210df1aba1409 100644
+--- a/Documentation/scsi/libsas.rst
++++ b/Documentation/scsi/libsas.rst
+@@ -189,12 +189,9 @@ num_phys
+ The event interface::
+
+ /* LLDD calls these to notify the class of an event. */
+- void (*notify_port_event)(struct sas_phy *, enum port_event);
+- void (*notify_phy_event)(struct sas_phy *, enum phy_event);
+-
+-When sas_register_ha() returns, those are set and can be
+-called by the LLDD to notify the SAS layer of such events
+-the SAS layer.
++ void (*notify_ha_event)(struct sas_ha_struct *, enum ha_event);
++ void sas_notify_port_event(struct sas_phy *, enum port_event);
++ void sas_notify_phy_event(struct sas_phy *, enum phy_event);
+
+ The port notification::
+
+diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
+index 13677973da5cf..770546177ca46 100644
+--- a/drivers/scsi/aic94xx/aic94xx_scb.c
++++ b/drivers/scsi/aic94xx/aic94xx_scb.c
+@@ -68,7 +68,6 @@ static void asd_phy_event_tasklet(struct asd_ascb *ascb,
+ struct done_list_struct *dl)
+ {
+ struct asd_ha_struct *asd_ha = ascb->ha;
+- struct sas_ha_struct *sas_ha = &asd_ha->sas_ha;
+ int phy_id = dl->status_block[0] & DL_PHY_MASK;
+ struct asd_phy *phy = &asd_ha->phys[phy_id];
+
+@@ -81,7 +80,7 @@ static void asd_phy_event_tasklet(struct asd_ascb *ascb,
+ ASD_DPRINTK("phy%d: device unplugged\n", phy_id);
+ asd_turn_led(asd_ha, phy_id, 0);
+ sas_phy_disconnected(&phy->sas_phy);
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
+ break;
+ case CURRENT_OOB_DONE:
+ /* hot plugged device */
+@@ -89,12 +88,12 @@ static void asd_phy_event_tasklet(struct asd_ascb *ascb,
+ get_lrate_mode(phy, oob_mode);
+ ASD_DPRINTK("phy%d device plugged: lrate:0x%x, proto:0x%x\n",
+ phy_id, phy->sas_phy.linkrate, phy->sas_phy.iproto);
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+ break;
+ case CURRENT_SPINUP_HOLD:
+ /* hot plug SATA, no COMWAKE sent */
+ asd_turn_led(asd_ha, phy_id, 1);
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
+ break;
+ case CURRENT_GTO_TIMEOUT:
+ case CURRENT_OOB_ERROR:
+@@ -102,7 +101,7 @@ static void asd_phy_event_tasklet(struct asd_ascb *ascb,
+ dl->status_block[1]);
+ asd_turn_led(asd_ha, phy_id, 0);
+ sas_phy_disconnected(&phy->sas_phy);
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
+ break;
+ }
+ }
+@@ -222,7 +221,6 @@ static void asd_bytes_dmaed_tasklet(struct asd_ascb *ascb,
+ int edb_el = edb_id + ascb->edb_index;
+ struct asd_dma_tok *edb = ascb->ha->seq.edb_arr[edb_el];
+ struct asd_phy *phy = &ascb->ha->phys[phy_id];
+- struct sas_ha_struct *sas_ha = phy->sas_phy.ha;
+ u16 size = ((dl->status_block[3] & 7) << 8) | dl->status_block[2];
+
+ size = min(size, (u16) sizeof(phy->frame_rcvd));
+@@ -234,7 +232,7 @@ static void asd_bytes_dmaed_tasklet(struct asd_ascb *ascb,
+ spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
+ asd_dump_frame_rcvd(phy, dl);
+ asd_form_port(ascb->ha, phy);
+- sas_ha->notify_port_event(&phy->sas_phy, PORTE_BYTES_DMAED);
++ sas_notify_port_event(&phy->sas_phy, PORTE_BYTES_DMAED);
+ }
+
+ static void asd_link_reset_err_tasklet(struct asd_ascb *ascb,
+@@ -270,7 +268,7 @@ static void asd_link_reset_err_tasklet(struct asd_ascb *ascb,
+ asd_turn_led(asd_ha, phy_id, 0);
+ sas_phy_disconnected(sas_phy);
+ asd_deform_port(asd_ha, phy);
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+
+ if (retries_left == 0) {
+ int num = 1;
+@@ -315,7 +313,7 @@ static void asd_primitive_rcvd_tasklet(struct asd_ascb *ascb,
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = ffs(cont);
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy,PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+
+ case LmUNKNOWNP:
+@@ -336,7 +334,7 @@ static void asd_primitive_rcvd_tasklet(struct asd_ascb *ascb,
+ /* The sequencer disables all phys on that port.
+ * We have to re-enable the phys ourselves. */
+ asd_deform_port(asd_ha, phy);
+- sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
++ sas_notify_port_event(sas_phy, PORTE_HARD_RESET);
+ break;
+
+ default:
+@@ -567,7 +565,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
+ /* the device is gone */
+ sas_phy_disconnected(sas_phy);
+ asd_deform_port(asd_ha, phy);
+- sas_ha->notify_port_event(sas_phy, PORTE_TIMER_EVENT);
++ sas_notify_port_event(sas_phy, PORTE_TIMER_EVENT);
+ break;
+ default:
+ ASD_DPRINTK("%s: phy%d: unknown event:0x%x\n", __func__,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index cf0bfac920a81..76f8fc3fad599 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -616,7 +616,6 @@ static void hisi_sas_bytes_dmaed(struct hisi_hba *hisi_hba, int phy_no)
+ {
+ struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sas_ha;
+
+ if (!phy->phy_attached)
+ return;
+@@ -627,8 +626,7 @@ static void hisi_sas_bytes_dmaed(struct hisi_hba *hisi_hba, int phy_no)
+ return;
+ }
+
+- sas_ha = &hisi_hba->sha;
+- sas_ha->notify_phy_event(sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(sas_phy, PHYE_OOB_DONE);
+
+ if (sas_phy->phy) {
+ struct sas_phy *sphy = sas_phy->phy;
+@@ -656,7 +654,7 @@ static void hisi_sas_bytes_dmaed(struct hisi_hba *hisi_hba, int phy_no)
+ }
+
+ sas_phy->frame_rcvd_size = phy->frame_rcvd_size;
+- sas_ha->notify_port_event(sas_phy, PORTE_BYTES_DMAED);
++ sas_notify_port_event(sas_phy, PORTE_BYTES_DMAED);
+ }
+
+ static struct hisi_sas_device *hisi_sas_alloc_dev(struct domain_device *device)
+@@ -1411,7 +1409,6 @@ static void hisi_sas_refresh_port_id(struct hisi_hba *hisi_hba)
+
+ static void hisi_sas_rescan_topology(struct hisi_hba *hisi_hba, u32 state)
+ {
+- struct sas_ha_struct *sas_ha = &hisi_hba->sha;
+ struct asd_sas_port *_sas_port = NULL;
+ int phy_no;
+
+@@ -1432,7 +1429,7 @@ static void hisi_sas_rescan_topology(struct hisi_hba *hisi_hba, u32 state)
+ _sas_port = sas_port;
+
+ if (dev_is_expander(dev->dev_type))
+- sas_ha->notify_port_event(sas_phy,
++ sas_notify_port_event(sas_phy,
+ PORTE_BROADCAST_RCVD);
+ }
+ } else {
+@@ -2194,7 +2191,6 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
+ {
+ struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sas_ha = &hisi_hba->sha;
+ struct device *dev = hisi_hba->dev;
+
+ if (rdy) {
+@@ -2210,7 +2206,7 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
+ return;
+ }
+ /* Phy down and not ready */
+- sas_ha->notify_phy_event(sas_phy, PHYE_LOSS_OF_SIGNAL);
++ sas_notify_phy_event(sas_phy, PHYE_LOSS_OF_SIGNAL);
+ sas_phy_disconnected(sas_phy);
+
+ if (port) {
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 45e866cb9164d..22eecc89d41bd 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -1408,7 +1408,6 @@ static irqreturn_t int_bcast_v1_hw(int irq, void *p)
+ struct hisi_sas_phy *phy = p;
+ struct hisi_hba *hisi_hba = phy->hisi_hba;
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sha = &hisi_hba->sha;
+ struct device *dev = hisi_hba->dev;
+ int phy_no = sas_phy->id;
+ u32 irq_value;
+@@ -1424,7 +1423,7 @@ static irqreturn_t int_bcast_v1_hw(int irq, void *p)
+ }
+
+ if (!test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+- sha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+
+ end:
+ hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT2,
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 9adfdefef9cad..10ba0680da04b 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -2818,14 +2818,13 @@ static void phy_bcast_v2_hw(int phy_no, struct hisi_hba *hisi_hba)
+ {
+ struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sas_ha = &hisi_hba->sha;
+ u32 bcast_status;
+
+ hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1);
+ bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS);
+ if ((bcast_status & RX_BCAST_CHG_MSK) &&
+ !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
+ CHL_INT0_SL_RX_BCST_ACK_MSK);
+ hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 0);
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 7c12804b4e1d1..9d9dcc11a866b 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1600,14 +1600,13 @@ static irqreturn_t phy_bcast_v3_hw(int phy_no, struct hisi_hba *hisi_hba)
+ {
+ struct hisi_sas_phy *phy = &hisi_hba->phy[phy_no];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sas_ha = &hisi_hba->sha;
+ u32 bcast_status;
+
+ hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1);
+ bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS);
+ if ((bcast_status & RX_BCAST_CHG_MSK) &&
+ !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
+ CHL_INT0_SL_RX_BCST_ACK_MSK);
+ hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 0);
+diff --git a/drivers/scsi/isci/port.c b/drivers/scsi/isci/port.c
+index 1df45f028ea75..8d93497380674 100644
+--- a/drivers/scsi/isci/port.c
++++ b/drivers/scsi/isci/port.c
+@@ -164,7 +164,7 @@ static void isci_port_bc_change_received(struct isci_host *ihost,
+ "%s: isci_phy = %p, sas_phy = %p\n",
+ __func__, iphy, &iphy->sas_phy);
+
+- ihost->sas_ha.notify_port_event(&iphy->sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(&iphy->sas_phy, PORTE_BROADCAST_RCVD);
+ sci_port_bcn_enable(iport);
+ }
+
+@@ -223,8 +223,7 @@ static void isci_port_link_up(struct isci_host *isci_host,
+ /* Notify libsas that we have an address frame, if indeed
+ * we've found an SSP, SMP, or STP target */
+ if (success)
+- isci_host->sas_ha.notify_port_event(&iphy->sas_phy,
+- PORTE_BYTES_DMAED);
++ sas_notify_port_event(&iphy->sas_phy, PORTE_BYTES_DMAED);
+ }
+
+
+@@ -270,7 +269,7 @@ static void isci_port_link_down(struct isci_host *isci_host,
+ * isci_port_deformed and isci_dev_gone functions.
+ */
+ sas_phy_disconnected(&isci_phy->sas_phy);
+- isci_host->sas_ha.notify_phy_event(&isci_phy->sas_phy,
++ sas_notify_phy_event(&isci_phy->sas_phy,
+ PHYE_LOSS_OF_SIGNAL);
+
+ dev_dbg(&isci_host->pdev->dev,
+diff --git a/drivers/scsi/libsas/sas_event.c b/drivers/scsi/libsas/sas_event.c
+index a1852f6c042b9..112a1b76f63b1 100644
+--- a/drivers/scsi/libsas/sas_event.c
++++ b/drivers/scsi/libsas/sas_event.c
+@@ -109,7 +109,7 @@ void sas_enable_revalidation(struct sas_ha_struct *ha)
+
+ sas_phy = container_of(port->phy_list.next, struct asd_sas_phy,
+ port_phy_el);
+- ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ }
+ mutex_unlock(&ha->disco_mutex);
+ }
+@@ -131,7 +131,7 @@ static void sas_phy_event_worker(struct work_struct *work)
+ sas_free_event(ev);
+ }
+
+-static int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
++int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
+ {
+ struct asd_sas_event *ev;
+ struct sas_ha_struct *ha = phy->ha;
+@@ -151,6 +151,7 @@ static int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event)
+
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(sas_notify_port_event);
+
+ int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event)
+ {
+@@ -172,11 +173,5 @@ int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event)
+
+ return ret;
+ }
++EXPORT_SYMBOL_GPL(sas_notify_phy_event);
+
+-int sas_init_events(struct sas_ha_struct *sas_ha)
+-{
+- sas_ha->notify_port_event = sas_notify_port_event;
+- sas_ha->notify_phy_event = sas_notify_phy_event;
+-
+- return 0;
+-}
+diff --git a/drivers/scsi/libsas/sas_init.c b/drivers/scsi/libsas/sas_init.c
+index 21c43b18d5d5b..6dc2505d36af7 100644
+--- a/drivers/scsi/libsas/sas_init.c
++++ b/drivers/scsi/libsas/sas_init.c
+@@ -123,12 +123,6 @@ int sas_register_ha(struct sas_ha_struct *sas_ha)
+ goto Undo_phys;
+ }
+
+- error = sas_init_events(sas_ha);
+- if (error) {
+- pr_notice("couldn't start event thread:%d\n", error);
+- goto Undo_ports;
+- }
+-
+ error = -ENOMEM;
+ snprintf(name, sizeof(name), "%s_event_q", dev_name(sas_ha->dev));
+ sas_ha->event_q = create_singlethread_workqueue(name);
+diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
+index 1f1d01901978c..53ea32ed17a75 100644
+--- a/drivers/scsi/libsas/sas_internal.h
++++ b/drivers/scsi/libsas/sas_internal.h
+@@ -54,7 +54,6 @@ void sas_free_event(struct asd_sas_event *event);
+ int sas_register_ports(struct sas_ha_struct *sas_ha);
+ void sas_unregister_ports(struct sas_ha_struct *sas_ha);
+
+-int sas_init_events(struct sas_ha_struct *sas_ha);
+ void sas_disable_revalidation(struct sas_ha_struct *ha);
+ void sas_enable_revalidation(struct sas_ha_struct *ha);
+ void __sas_drain_work(struct sas_ha_struct *ha);
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index a920eced92ecc..e5e3e95f78b0c 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -220,7 +220,7 @@ static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+ {
+ struct mvs_phy *phy = &mvi->phy[i];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+- struct sas_ha_struct *sas_ha;
++
+ if (!phy->phy_attached)
+ return;
+
+@@ -229,8 +229,7 @@ static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+ return;
+ }
+
+- sas_ha = mvi->sas;
+- sas_ha->notify_phy_event(sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(sas_phy, PHYE_OOB_DONE);
+
+ if (sas_phy->phy) {
+ struct sas_phy *sphy = sas_phy->phy;
+@@ -262,8 +261,7 @@ static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+
+ sas_phy->frame_rcvd_size = phy->frame_rcvd_size;
+
+- mvi->sas->notify_port_event(sas_phy,
+- PORTE_BYTES_DMAED);
++ sas_notify_port_event(sas_phy, PORTE_BYTES_DMAED);
+ }
+
+ void mvs_scan_start(struct Scsi_Host *shost)
+@@ -1880,7 +1878,6 @@ static void mvs_work_queue(struct work_struct *work)
+ struct mvs_info *mvi = mwq->mvi;
+ unsigned long flags;
+ u32 phy_no = (unsigned long) mwq->data;
+- struct sas_ha_struct *sas_ha = mvi->sas;
+ struct mvs_phy *phy = &mvi->phy[phy_no];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+
+@@ -1895,7 +1892,7 @@ static void mvs_work_queue(struct work_struct *work)
+ if (!(tmp & PHY_READY_MASK)) {
+ sas_phy_disconnected(sas_phy);
+ mvs_phy_disconnected(phy);
+- sas_ha->notify_phy_event(sas_phy,
++ sas_notify_phy_event(sas_phy,
+ PHYE_LOSS_OF_SIGNAL);
+ mv_dprintk("phy%d Removed Device\n", phy_no);
+ } else {
+@@ -1908,8 +1905,7 @@ static void mvs_work_queue(struct work_struct *work)
+ }
+ } else if (mwq->handler & EXP_BRCT_CHG) {
+ phy->phy_event &= ~EXP_BRCT_CHG;
+- sas_ha->notify_port_event(sas_phy,
+- PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ mv_dprintk("phy%d Got Broadcast Change\n", phy_no);
+ }
+ list_del(&mwq->entry);
+diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
+index c8d4d87c54737..dd15246d5b037 100644
+--- a/drivers/scsi/pm8001/pm8001_hwi.c
++++ b/drivers/scsi/pm8001/pm8001_hwi.c
+@@ -3179,7 +3179,7 @@ void pm8001_bytes_dmaed(struct pm8001_hba_info *pm8001_ha, int i)
+ pm8001_dbg(pm8001_ha, MSG, "phy %d byte dmaded.\n", i);
+
+ sas_phy->frame_rcvd_size = phy->frame_rcvd_size;
+- pm8001_ha->sas->notify_port_event(sas_phy, PORTE_BYTES_DMAED);
++ sas_notify_port_event(sas_phy, PORTE_BYTES_DMAED);
+ }
+
+ /* Get the link rate speed */
+@@ -3293,7 +3293,6 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ u32 npip_portstate = le32_to_cpu(pPayload->npip_portstate);
+ u8 portstate = (u8)(npip_portstate & 0x0000000F);
+ struct pm8001_port *port = &pm8001_ha->port[port_id];
+- struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+ unsigned long flags;
+ u8 deviceType = pPayload->sas_identify.dev_type;
+@@ -3337,7 +3336,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ else if (phy->identify.device_type != SAS_PHY_UNUSED)
+ phy->identify.target_port_protocols = SAS_PROTOCOL_SMP;
+ phy->sas_phy.oob_mode = SAS_OOB_MODE;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+ spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+ memcpy(phy->frame_rcvd, &pPayload->sas_identify,
+ sizeof(struct sas_identify_frame)-4);
+@@ -3369,7 +3368,6 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ u32 npip_portstate = le32_to_cpu(pPayload->npip_portstate);
+ u8 portstate = (u8)(npip_portstate & 0x0000000F);
+ struct pm8001_port *port = &pm8001_ha->port[port_id];
+- struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+ unsigned long flags;
+ pm8001_dbg(pm8001_ha, DEVIO, "HW_EVENT_SATA_PHY_UP port id = %d, phy id = %d\n",
+@@ -3381,7 +3379,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ phy->phy_type |= PORT_TYPE_SATA;
+ phy->phy_attached = 1;
+ phy->sas_phy.oob_mode = SATA_OOB_MODE;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+ spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+ memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
+ sizeof(struct dev_to_host_fis));
+@@ -3728,11 +3726,11 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ break;
+ case HW_EVENT_SATA_SPINUP_HOLD:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_SATA_SPINUP_HOLD\n");
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
+ break;
+ case HW_EVENT_PHY_DOWN:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PHY_DOWN\n");
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
+ phy->phy_attached = 0;
+ phy->phy_state = 0;
+ hw_event_phy_down(pm8001_ha, piomb);
+@@ -3741,7 +3739,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PORT_INVALID\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ /* the broadcast change primitive received, tell the LIBSAS this event
+ to revalidate the sas domain*/
+@@ -3752,20 +3750,20 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_CHANGE;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_PHY_ERROR:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PHY_ERROR\n");
+ sas_phy_disconnected(&phy->sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
+ break;
+ case HW_EVENT_BROADCAST_EXP:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_BROADCAST_EXP\n");
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_EXP;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_LINK_ERR_INVALID_DWORD:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3774,7 +3772,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ HW_EVENT_LINK_ERR_INVALID_DWORD, port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_LINK_ERR_DISPARITY_ERROR:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3784,7 +3782,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_LINK_ERR_CODE_VIOLATION:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3794,7 +3792,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_LINK_ERR_LOSS_OF_DWORD_SYNCH:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3804,7 +3802,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_MALFUNCTION:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_MALFUNCTION\n");
+@@ -3814,7 +3812,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_SES;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_INBOUND_CRC_ERROR:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_INBOUND_CRC_ERROR\n");
+@@ -3824,13 +3822,13 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ break;
+ case HW_EVENT_HARD_RESET_RECEIVED:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_HARD_RESET_RECEIVED\n");
+- sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
++ sas_notify_port_event(sas_phy, PORTE_HARD_RESET);
+ break;
+ case HW_EVENT_ID_FRAME_TIMEOUT:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_ID_FRAME_TIMEOUT\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_LINK_ERR_PHY_RESET_FAILED:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3840,20 +3838,20 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void* piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_PORT_RESET_TIMER_TMO:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PORT_RESET_TIMER_TMO\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_PORT_RECOVERY_TIMER_TMO:
+ pm8001_dbg(pm8001_ha, MSG,
+ "HW_EVENT_PORT_RECOVERY_TIMER_TMO\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_PORT_RECOVER:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PORT_RECOVER\n");
+diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
+index d1e9dba2ef193..e21c6cfff4cbd 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.c
++++ b/drivers/scsi/pm8001/pm8001_sas.c
+@@ -158,7 +158,6 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+ int rc = 0, phy_id = sas_phy->id;
+ struct pm8001_hba_info *pm8001_ha = NULL;
+ struct sas_phy_linkrates *rates;
+- struct sas_ha_struct *sas_ha;
+ struct pm8001_phy *phy;
+ DECLARE_COMPLETION_ONSTACK(completion);
+ unsigned long flags;
+@@ -207,18 +206,16 @@ int pm8001_phy_control(struct asd_sas_phy *sas_phy, enum phy_func func,
+ if (pm8001_ha->chip_id != chip_8001) {
+ if (pm8001_ha->phy[phy_id].phy_state ==
+ PHY_STATE_LINK_UP_SPCV) {
+- sas_ha = pm8001_ha->sas;
+ sas_phy_disconnected(&phy->sas_phy);
+- sas_ha->notify_phy_event(&phy->sas_phy,
++ sas_notify_phy_event(&phy->sas_phy,
+ PHYE_LOSS_OF_SIGNAL);
+ phy->phy_attached = 0;
+ }
+ } else {
+ if (pm8001_ha->phy[phy_id].phy_state ==
+ PHY_STATE_LINK_UP_SPC) {
+- sas_ha = pm8001_ha->sas;
+ sas_phy_disconnected(&phy->sas_phy);
+- sas_ha->notify_phy_event(&phy->sas_phy,
++ sas_notify_phy_event(&phy->sas_phy,
+ PHYE_LOSS_OF_SIGNAL);
+ phy->phy_attached = 0;
+ }
+diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
+index 6772b0924dac8..f617177b7bb33 100644
+--- a/drivers/scsi/pm8001/pm80xx_hwi.c
++++ b/drivers/scsi/pm8001/pm80xx_hwi.c
+@@ -3243,7 +3243,6 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ u8 portstate = (u8)(phyid_npip_portstate & 0x0000000F);
+
+ struct pm8001_port *port = &pm8001_ha->port[port_id];
+- struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+ unsigned long flags;
+ u8 deviceType = pPayload->sas_identify.dev_type;
+@@ -3288,7 +3287,7 @@ hw_event_sas_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ else if (phy->identify.device_type != SAS_PHY_UNUSED)
+ phy->identify.target_port_protocols = SAS_PROTOCOL_SMP;
+ phy->sas_phy.oob_mode = SAS_OOB_MODE;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+ spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+ memcpy(phy->frame_rcvd, &pPayload->sas_identify,
+ sizeof(struct sas_identify_frame)-4);
+@@ -3322,7 +3321,6 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ u8 portstate = (u8)(phyid_npip_portstate & 0x0000000F);
+
+ struct pm8001_port *port = &pm8001_ha->port[port_id];
+- struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+ struct pm8001_phy *phy = &pm8001_ha->phy[phy_id];
+ unsigned long flags;
+ pm8001_dbg(pm8001_ha, DEVIO,
+@@ -3336,7 +3334,7 @@ hw_event_sata_phy_up(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ phy->phy_type |= PORT_TYPE_SATA;
+ phy->phy_attached = 1;
+ phy->sas_phy.oob_mode = SATA_OOB_MODE;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_DONE);
+ spin_lock_irqsave(&phy->sas_phy.frame_rcvd_lock, flags);
+ memcpy(phy->frame_rcvd, ((u8 *)&pPayload->sata_fis - 4),
+ sizeof(struct dev_to_host_fis));
+@@ -3418,11 +3416,8 @@ hw_event_phy_down(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ break;
+
+ }
+- if (port_sata && (portstate != PORT_IN_RESET)) {
+- struct sas_ha_struct *sas_ha = pm8001_ha->sas;
+-
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
+- }
++ if (port_sata && (portstate != PORT_IN_RESET))
++ sas_notify_phy_event(&phy->sas_phy, PHYE_LOSS_OF_SIGNAL);
+ }
+
+ static int mpi_phy_start_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
+@@ -3520,7 +3515,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ break;
+ case HW_EVENT_SATA_SPINUP_HOLD:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_SATA_SPINUP_HOLD\n");
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_SPINUP_HOLD);
+ break;
+ case HW_EVENT_PHY_DOWN:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PHY_DOWN\n");
+@@ -3536,7 +3531,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PORT_INVALID\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ /* the broadcast change primitive received, tell the LIBSAS this event
+ to revalidate the sas domain*/
+@@ -3547,20 +3542,20 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_CHANGE;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_PHY_ERROR:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PHY_ERROR\n");
+ sas_phy_disconnected(&phy->sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
++ sas_notify_phy_event(&phy->sas_phy, PHYE_OOB_ERROR);
+ break;
+ case HW_EVENT_BROADCAST_EXP:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_BROADCAST_EXP\n");
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_EXP;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_LINK_ERR_INVALID_DWORD:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3597,7 +3592,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ spin_lock_irqsave(&sas_phy->sas_prim_lock, flags);
+ sas_phy->sas_prim = HW_EVENT_BROADCAST_SES;
+ spin_unlock_irqrestore(&sas_phy->sas_prim_lock, flags);
+- sas_ha->notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
+ break;
+ case HW_EVENT_INBOUND_CRC_ERROR:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_INBOUND_CRC_ERROR\n");
+@@ -3607,13 +3602,13 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ break;
+ case HW_EVENT_HARD_RESET_RECEIVED:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_HARD_RESET_RECEIVED\n");
+- sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
++ sas_notify_port_event(sas_phy, PORTE_HARD_RESET);
+ break;
+ case HW_EVENT_ID_FRAME_TIMEOUT:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_ID_FRAME_TIMEOUT\n");
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_LINK_ERR_PHY_RESET_FAILED:
+ pm8001_dbg(pm8001_ha, MSG,
+@@ -3623,7 +3618,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ break;
+ case HW_EVENT_PORT_RESET_TIMER_TMO:
+ pm8001_dbg(pm8001_ha, MSG, "HW_EVENT_PORT_RESET_TIMER_TMO\n");
+@@ -3631,7 +3626,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ port_id, phy_id, 0, 0);
+ sas_phy_disconnected(sas_phy);
+ phy->phy_attached = 0;
+- sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
++ sas_notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
+ if (pm8001_ha->phy[phy_id].reset_completion) {
+ pm8001_ha->phy[phy_id].port_reset_status =
+ PORT_RESET_TMO;
+@@ -3648,7 +3643,7 @@ static int mpi_hw_event(struct pm8001_hba_info *pm8001_ha, void *piomb)
+ for (i = 0; i < pm8001_ha->chip->n_phy; i++) {
+ if (port->wide_port_phymap & (1 << i)) {
+ phy = &pm8001_ha->phy[i];
+- sas_ha->notify_phy_event(&phy->sas_phy,
++ sas_notify_phy_event(&phy->sas_phy,
+ PHYE_LOSS_OF_SIGNAL);
+ port->wide_port_phymap &= ~(1 << i);
+ }
+diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
+index 4e2d61e8fb1ed..3387149502e9a 100644
+--- a/include/scsi/libsas.h
++++ b/include/scsi/libsas.h
+@@ -391,10 +391,6 @@ struct sas_ha_struct {
+ int strict_wide_ports; /* both sas_addr and attached_sas_addr must match
+ * their siblings when forming wide ports */
+
+- /* LLDD calls these to notify the class of an event. */
+- int (*notify_port_event)(struct asd_sas_phy *, enum port_event);
+- int (*notify_phy_event)(struct asd_sas_phy *, enum phy_event);
+-
+ void *lldd_ha; /* not touched by sas class code */
+
+ struct list_head eh_done_q; /* complete via scsi_eh_flush_done_q */
+@@ -706,4 +702,7 @@ struct sas_phy *sas_get_local_phy(struct domain_device *dev);
+
+ int sas_request_addr(struct Scsi_Host *shost, u8 *addr);
+
++int sas_notify_port_event(struct asd_sas_phy *phy, enum port_event event);
++int sas_notify_phy_event(struct asd_sas_phy *phy, enum phy_event event);
++
+ #endif /* _SASLIB_H_ */
+--
+2.27.0
+
--- /dev/null
+From ac87cba626600fa85e99da83b9672330a5c8b2ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 11:44:34 +0300
+Subject: scsi: lpfc: Fix ancient double free
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0be310979e5e1272d4c5b557642df4da4ce7eba4 ]
+
+The "pmb" pointer is freed at the start of the function and then freed
+again in the error handling code.
+
+Link: https://lore.kernel.org/r/YA6E8rO51hE56SVw@mwanda
+Fixes: 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of SLI-3")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 2b6b5fc671feb..e5ace4a4f432a 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -1145,13 +1145,14 @@ lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ struct lpfc_vport *vport = pmb->vport;
+ LPFC_MBOXQ_t *sparam_mb;
+ struct lpfc_dmabuf *sparam_mp;
++ u16 status = pmb->u.mb.mbxStatus;
+ int rc;
+
+- if (pmb->u.mb.mbxStatus)
+- goto out;
+-
+ mempool_free(pmb, phba->mbox_mem_pool);
+
++ if (status)
++ goto out;
++
+ /* don't perform discovery for SLI4 loopback diagnostic test */
+ if ((phba->sli_rev == LPFC_SLI_REV4) &&
+ !(phba->hba_flag & HBA_FCOE_MODE) &&
+@@ -1214,12 +1215,10 @@ lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+
+ out:
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
+- "0306 CONFIG_LINK mbxStatus error x%x "
+- "HBA state x%x\n",
+- pmb->u.mb.mbxStatus, vport->port_state);
+-sparam_out:
+- mempool_free(pmb, phba->mbox_mem_pool);
++ "0306 CONFIG_LINK mbxStatus error x%x HBA state x%x\n",
++ status, vport->port_state);
+
++sparam_out:
+ lpfc_linkdown(phba);
+
+ lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
+--
+2.27.0
+
--- /dev/null
+From cd6cb18aed3a6711d0bd5810c9000a1752d9b8ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 11:09:40 +0100
+Subject: scsi: mvsas: Pass gfp_t flags to libsas event notifiers
+
+From: Ahmed S. Darwish <a.darwish@linutronix.de>
+
+[ Upstream commit feb18e900f0048001ff375dca639eaa327ab3c1b ]
+
+mvsas calls the non _gfp version of the libsas event notifiers API, leading
+to the buggy call chains below:
+
+ mvsas/mv_sas.c: mvs_work_queue() [process context]
+ spin_lock_irqsave(mvs_info::lock, )
+ -> libsas/sas_event.c: sas_notify_phy_event()
+ -> sas_alloc_event()
+ -> in_interrupt() = false
+ -> invalid GFP_KERNEL allocation
+ -> libsas/sas_event.c: sas_notify_port_event()
+ -> sas_alloc_event()
+ -> in_interrupt() = false
+ -> invalid GFP_KERNEL allocation
+
+Use the new event notifiers API instead, which requires callers to
+explicitly pass the gfp_t memory allocation flags.
+
+Below are context analysis for the modified functions:
+
+=> mvs_bytes_dmaed():
+
+Since it is invoked from both process and atomic contexts, let its callers
+pass the gfp_t flags. Call chains:
+
+ scsi_scan.c: do_scsi_scan_host() [has msleep()]
+ -> shost->hostt->scan_start()
+ -> [mvsas/mv_init.c: Scsi_Host::scsi_host_template .scan_start = mvs_scan_start()]
+ -> mvsas/mv_sas.c: mvs_scan_start()
+ -> mvs_bytes_dmaed(..., GFP_KERNEL)
+
+ mvsas/mv_sas.c: mvs_work_queue()
+ spin_lock_irqsave(mvs_info::lock,)
+ -> mvs_bytes_dmaed(..., GFP_ATOMIC)
+
+ mvsas/mv_64xx.c: mvs_64xx_isr() || mvsas/mv_94xx.c: mvs_94xx_isr()
+ -> mvsas/mv_chips.h: mvs_int_full()
+ -> mvsas/mv_sas.c: mvs_int_port()
+ -> mvs_bytes_dmaed(..., GFP_ATOMIC);
+
+=> mvs_work_queue():
+
+Invoked from process context, but it calls all the libsas event notifier
+APIs under a spin_lock_irqsave(). Pass GFP_ATOMIC.
+
+Link: https://lore.kernel.org/r/20210118100955.1761652-5-a.darwish@linutronix.de
+Fixes: 1c393b970e0f ("scsi: libsas: Use dynamic alloced work to avoid sas event lost")
+Cc: Jason Yan <yanaijie@huawei.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Ahmed S. Darwish <a.darwish@linutronix.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mvsas/mv_sas.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index e5e3e95f78b0c..484e01428da28 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -216,7 +216,7 @@ void mvs_set_sas_addr(struct mvs_info *mvi, int port_id, u32 off_lo,
+ MVS_CHIP_DISP->write_port_cfg_data(mvi, port_id, hi);
+ }
+
+-static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
++static void mvs_bytes_dmaed(struct mvs_info *mvi, int i, gfp_t gfp_flags)
+ {
+ struct mvs_phy *phy = &mvi->phy[i];
+ struct asd_sas_phy *sas_phy = &phy->sas_phy;
+@@ -229,7 +229,7 @@ static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+ return;
+ }
+
+- sas_notify_phy_event(sas_phy, PHYE_OOB_DONE);
++ sas_notify_phy_event_gfp(sas_phy, PHYE_OOB_DONE, gfp_flags);
+
+ if (sas_phy->phy) {
+ struct sas_phy *sphy = sas_phy->phy;
+@@ -261,7 +261,7 @@ static void mvs_bytes_dmaed(struct mvs_info *mvi, int i)
+
+ sas_phy->frame_rcvd_size = phy->frame_rcvd_size;
+
+- sas_notify_port_event(sas_phy, PORTE_BYTES_DMAED);
++ sas_notify_port_event_gfp(sas_phy, PORTE_BYTES_DMAED, gfp_flags);
+ }
+
+ void mvs_scan_start(struct Scsi_Host *shost)
+@@ -277,7 +277,7 @@ void mvs_scan_start(struct Scsi_Host *shost)
+ for (j = 0; j < core_nr; j++) {
+ mvi = ((struct mvs_prv_info *)sha->lldd_ha)->mvi[j];
+ for (i = 0; i < mvi->chip->n_phy; ++i)
+- mvs_bytes_dmaed(mvi, i);
++ mvs_bytes_dmaed(mvi, i, GFP_KERNEL);
+ }
+ mvs_prv->scan_finished = 1;
+ }
+@@ -1892,20 +1892,21 @@ static void mvs_work_queue(struct work_struct *work)
+ if (!(tmp & PHY_READY_MASK)) {
+ sas_phy_disconnected(sas_phy);
+ mvs_phy_disconnected(phy);
+- sas_notify_phy_event(sas_phy,
+- PHYE_LOSS_OF_SIGNAL);
++ sas_notify_phy_event_gfp(sas_phy,
++ PHYE_LOSS_OF_SIGNAL, GFP_ATOMIC);
+ mv_dprintk("phy%d Removed Device\n", phy_no);
+ } else {
+ MVS_CHIP_DISP->detect_porttype(mvi, phy_no);
+ mvs_update_phyinfo(mvi, phy_no, 1);
+- mvs_bytes_dmaed(mvi, phy_no);
++ mvs_bytes_dmaed(mvi, phy_no, GFP_ATOMIC);
+ mvs_port_notify_formed(sas_phy, 0);
+ mv_dprintk("phy%d Attached Device\n", phy_no);
+ }
+ }
+ } else if (mwq->handler & EXP_BRCT_CHG) {
+ phy->phy_event &= ~EXP_BRCT_CHG;
+- sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD);
++ sas_notify_port_event_gfp(sas_phy,
++ PORTE_BROADCAST_RCVD, GFP_ATOMIC);
+ mv_dprintk("phy%d Got Broadcast Change\n", phy_no);
+ }
+ list_del(&mwq->entry);
+@@ -2022,7 +2023,7 @@ void mvs_int_port(struct mvs_info *mvi, int phy_no, u32 events)
+ mdelay(10);
+ }
+
+- mvs_bytes_dmaed(mvi, phy_no);
++ mvs_bytes_dmaed(mvi, phy_no, GFP_ATOMIC);
+ /* whether driver is going to handle hot plug */
+ if (phy->phy_event & PHY_PLUG_OUT) {
+ mvs_port_notify_formed(&phy->sas_phy, 0);
+--
+2.27.0
+
--- /dev/null
+From b63e258605c176b811911aa49f9dc6840a167284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Feb 2021 22:52:45 +0900
+Subject: scsi: sd: sd_zbc: Don't pass GFP_NOIO to kvcalloc
+
+From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+
+[ Upstream commit 9acced3f58ad24407c1f9ebf53a8892c1e24cdb5 ]
+
+Dan reported we're passing in GFP_NOIO to kvmalloc() which will then
+fallback to doing kmalloc() instead of an optional vmalloc() if the size
+exceeds kmalloc()s limits. This will break with drives that have zone
+numbers exceeding PAGE_SIZE/sizeof(u32).
+
+Instead of passing in GFP_NOIO, enter an implicit GFP_NOIO allocation
+scope.
+
+Link: https://lore.kernel.org/r/YCuvSfKw4qEQBr/t@mwanda
+Link: https://lore.kernel.org/r/5a6345e2989fd06c049ac4e4627f6acb492c15b8.1613569821.git.johannes.thumshirn@wdc.com
+Fixes: 5795eb443060: ("scsi: sd_zbc: emulate ZONE_APPEND commands")
+Cc: Damien Le Moal <Damien.LeMoal@wdc.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sd_zbc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
+index cf07b7f935790..87a7274e4632b 100644
+--- a/drivers/scsi/sd_zbc.c
++++ b/drivers/scsi/sd_zbc.c
+@@ -688,6 +688,7 @@ int sd_zbc_revalidate_zones(struct scsi_disk *sdkp)
+ unsigned int nr_zones = sdkp->rev_nr_zones;
+ u32 max_append;
+ int ret = 0;
++ unsigned int flags;
+
+ /*
+ * For all zoned disks, initialize zone append emulation data if not
+@@ -720,16 +721,19 @@ int sd_zbc_revalidate_zones(struct scsi_disk *sdkp)
+ disk->queue->nr_zones == nr_zones)
+ goto unlock;
+
++ flags = memalloc_noio_save();
+ sdkp->zone_blocks = zone_blocks;
+ sdkp->nr_zones = nr_zones;
+- sdkp->rev_wp_offset = kvcalloc(nr_zones, sizeof(u32), GFP_NOIO);
++ sdkp->rev_wp_offset = kvcalloc(nr_zones, sizeof(u32), GFP_KERNEL);
+ if (!sdkp->rev_wp_offset) {
+ ret = -ENOMEM;
++ memalloc_noio_restore(flags);
+ goto unlock;
+ }
+
+ ret = blk_revalidate_disk_zones(disk, sd_zbc_revalidate_zones_cb);
+
++ memalloc_noio_restore(flags);
+ kvfree(sdkp->rev_wp_offset);
+ sdkp->rev_wp_offset = NULL;
+
+--
+2.27.0
+
--- /dev/null
+From 6ed3c0573ed03c66494713fd6a9db5f35cd25963 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 19:13:27 -0800
+Subject: scsi: ufs: Fix a possible NULL pointer issue
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit fb7afe24ba1b7e27483be7d2ac3ed002e67eecd5 ]
+
+During system resume/suspend, hba could be NULL. In this case, do not touch
+eh_sem.
+
+Fixes: 88a92d6ae4fe ("scsi: ufs: Serialize eh_work with system PM events and async scan")
+Link: https://lore.kernel.org/r/1610594010-7254-2-git-send-email-cang@codeaurora.org
+Acked-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index fb32d122f2e38..728168cd18f55 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -94,6 +94,8 @@
+ 16, 4, buf, __len, false); \
+ } while (0)
+
++static bool early_suspend;
++
+ int ufshcd_dump_regs(struct ufs_hba *hba, size_t offset, size_t len,
+ const char *prefix)
+ {
+@@ -8939,8 +8941,14 @@ int ufshcd_system_suspend(struct ufs_hba *hba)
+ int ret = 0;
+ ktime_t start = ktime_get();
+
++ if (!hba) {
++ early_suspend = true;
++ return 0;
++ }
++
+ down(&hba->eh_sem);
+- if (!hba || !hba->is_powered)
++
++ if (!hba->is_powered)
+ return 0;
+
+ if ((ufs_get_pm_lvl_to_dev_pwr_mode(hba->spm_lvl) ==
+@@ -8989,9 +8997,12 @@ int ufshcd_system_resume(struct ufs_hba *hba)
+ int ret = 0;
+ ktime_t start = ktime_get();
+
+- if (!hba) {
+- up(&hba->eh_sem);
++ if (!hba)
+ return -EINVAL;
++
++ if (unlikely(early_suspend)) {
++ early_suspend = false;
++ down(&hba->eh_sem);
+ }
+
+ if (!hba->is_powered || pm_runtime_suspended(hba->dev))
+--
+2.27.0
+
--- /dev/null
+From aa3581dc11314ebc2323213cc55e7e99855d146b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 09:20:29 +0100
+Subject: selftests/bpf: Convert test_xdp_redirect.sh to bash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 732fa32330667a80ce4985ca81b6e9d6b2ad2072 ]
+
+The test_xdp_redirect.sh script uses a bash feature, '&>'. On systems,
+e.g. Debian, where '/bin/sh' is dash, this will not work as
+expected. Use bash in the shebang to get the expected behavior.
+
+Further, using 'set -e' means that the error of a command cannot be
+captured without the command being executed with '&&' or '||'. Let us
+restructure the ping-commands, and use them as an if-expression, so
+that we can capture the return value.
+
+v4: Added missing Fixes:, and removed local variables. (Andrii)
+v3: Reintroduced /bin/bash, and kept 'set -e'. (Andrii)
+v2: Kept /bin/sh and removed bashisms. (Randy)
+
+Fixes: 996139e801fd ("selftests: bpf: add a test for XDP redirect")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210211082029.1687666-1-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_xdp_redirect.sh | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_xdp_redirect.sh b/tools/testing/selftests/bpf/test_xdp_redirect.sh
+index dd80f0c84afb4..c033850886f44 100755
+--- a/tools/testing/selftests/bpf/test_xdp_redirect.sh
++++ b/tools/testing/selftests/bpf/test_xdp_redirect.sh
+@@ -1,4 +1,4 @@
+-#!/bin/sh
++#!/bin/bash
+ # Create 2 namespaces with two veth peers, and
+ # forward packets in-between using generic XDP
+ #
+@@ -57,12 +57,8 @@ test_xdp_redirect()
+ ip link set dev veth1 $xdpmode obj test_xdp_redirect.o sec redirect_to_222 &> /dev/null
+ ip link set dev veth2 $xdpmode obj test_xdp_redirect.o sec redirect_to_111 &> /dev/null
+
+- ip netns exec ns1 ping -c 1 10.1.1.22 &> /dev/null
+- local ret1=$?
+- ip netns exec ns2 ping -c 1 10.1.1.11 &> /dev/null
+- local ret2=$?
+-
+- if [ $ret1 -eq 0 -a $ret2 -eq 0 ]; then
++ if ip netns exec ns1 ping -c 1 10.1.1.22 &> /dev/null &&
++ ip netns exec ns2 ping -c 1 10.1.1.11 &> /dev/null; then
+ echo "selftests: test_xdp_redirect $xdpmode [PASS]";
+ else
+ ret=1
+--
+2.27.0
+
--- /dev/null
+From e49bb18ec562bb4b79c9f5275c67050bd63a7fb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 22:50:18 -0800
+Subject: selftests/bpf: Don't exit on failed bpf_testmod unload
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 86ce322d21eb032ed8fdd294d0fb095d2debb430 ]
+
+Fix bug in handling bpf_testmod unloading that will cause test_progs exiting
+prematurely if bpf_testmod unloading failed. This is especially problematic
+when running a subset of test_progs that doesn't require root permissions and
+doesn't rely on bpf_testmod, yet will fail immediately due to exit(1) in
+unload_bpf_testmod().
+
+Fixes: 9f7fa225894c ("selftests/bpf: Add bpf_testmod kernel module for testing")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210126065019.1268027-1-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_progs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 213628ee721c1..6396932b97e29 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -390,7 +390,7 @@ static void unload_bpf_testmod(void)
+ return;
+ }
+ fprintf(env.stderr, "Failed to unload bpf_testmod.ko from kernel: %d\n", -errno);
+- exit(1);
++ return;
+ }
+ if (env.verbosity > VERBOSE_NONE)
+ fprintf(stdout, "Successfully unloaded bpf_testmod.ko.\n");
+--
+2.27.0
+
--- /dev/null
+From 1d7be5ad5d81511acff73272dc86ad263bec6338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jan 2021 23:55:17 -0800
+Subject: selftests/bpf: Sync RCU before unloading bpf_testmod
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 635599bace259a2c42741c3ea61bfa7be6f15556 ]
+
+If some of the subtests use module BTFs through ksyms, they will cause
+bpf_prog to take a refcount on bpf_testmod module, which will prevent it from
+successfully unloading. Module's refcnt is decremented when bpf_prog is freed,
+which generally happens in RCU callback. So we need to trigger
+syncronize_rcu() in the kernel, which can be achieved nicely with
+membarrier(MEMBARRIER_CMD_SHARED) or membarrier(MEMBARRIER_CMD_GLOBAL) syscall.
+So do that in kernel_sync_rcu() and make it available to other test inside the
+test_progs. This synchronize_rcu() is called before attempting to unload
+bpf_testmod.
+
+Fixes: 9f7fa225894c ("selftests/bpf: Add bpf_testmod kernel module for testing")
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Yonghong Song <yhs@fb.com>
+Acked-by: Hao Luo <haoluo@google.com>
+Link: https://lore.kernel.org/bpf/20210112075520.4103414-5-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/btf_map_in_map.c | 33 -------------------
+ tools/testing/selftests/bpf/test_progs.c | 11 +++++++
+ tools/testing/selftests/bpf/test_progs.h | 1 +
+ 3 files changed, 12 insertions(+), 33 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
+index 76ebe4c250f11..eb90a6b8850d2 100644
+--- a/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
++++ b/tools/testing/selftests/bpf/prog_tests/btf_map_in_map.c
+@@ -20,39 +20,6 @@ static __u32 bpf_map_id(struct bpf_map *map)
+ return info.id;
+ }
+
+-/*
+- * Trigger synchronize_rcu() in kernel.
+- *
+- * ARRAY_OF_MAPS/HASH_OF_MAPS lookup/update operations trigger synchronize_rcu()
+- * if looking up an existing non-NULL element or updating the map with a valid
+- * inner map FD. Use this fact to trigger synchronize_rcu(): create map-in-map,
+- * create a trivial ARRAY map, update map-in-map with ARRAY inner map. Then
+- * cleanup. At the end, at least one synchronize_rcu() would be called.
+- */
+-static int kern_sync_rcu(void)
+-{
+- int inner_map_fd, outer_map_fd, err, zero = 0;
+-
+- inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, 4, 4, 1, 0);
+- if (CHECK(inner_map_fd < 0, "inner_map_create", "failed %d\n", -errno))
+- return -1;
+-
+- outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
+- sizeof(int), inner_map_fd, 1, 0);
+- if (CHECK(outer_map_fd < 0, "outer_map_create", "failed %d\n", -errno)) {
+- close(inner_map_fd);
+- return -1;
+- }
+-
+- err = bpf_map_update_elem(outer_map_fd, &zero, &inner_map_fd, 0);
+- if (err)
+- err = -errno;
+- CHECK(err, "outer_map_update", "failed %d\n", err);
+- close(inner_map_fd);
+- close(outer_map_fd);
+- return err;
+-}
+-
+ static void test_lookup_update(void)
+ {
+ int map1_fd, map2_fd, map3_fd, map4_fd, map5_fd, map1_id, map2_id;
+diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
+index 7d077d48cadd0..213628ee721c1 100644
+--- a/tools/testing/selftests/bpf/test_progs.c
++++ b/tools/testing/selftests/bpf/test_progs.c
+@@ -11,6 +11,7 @@
+ #include <signal.h>
+ #include <string.h>
+ #include <execinfo.h> /* backtrace */
++#include <linux/membarrier.h>
+
+ #define EXIT_NO_TEST 2
+ #define EXIT_ERR_SETUP_INFRA 3
+@@ -370,8 +371,18 @@ static int delete_module(const char *name, int flags)
+ return syscall(__NR_delete_module, name, flags);
+ }
+
++/*
++ * Trigger synchronize_rcu() in kernel.
++ */
++int kern_sync_rcu(void)
++{
++ return syscall(__NR_membarrier, MEMBARRIER_CMD_SHARED, 0, 0);
++}
++
+ static void unload_bpf_testmod(void)
+ {
++ if (kern_sync_rcu())
++ fprintf(env.stderr, "Failed to trigger kernel-side RCU sync!\n");
+ if (delete_module("bpf_testmod", 0)) {
+ if (errno == ENOENT) {
+ if (env.verbosity > VERBOSE_NONE)
+diff --git a/tools/testing/selftests/bpf/test_progs.h b/tools/testing/selftests/bpf/test_progs.h
+index 115953243f623..e49e2fdde9425 100644
+--- a/tools/testing/selftests/bpf/test_progs.h
++++ b/tools/testing/selftests/bpf/test_progs.h
+@@ -219,6 +219,7 @@ int bpf_find_map(const char *test, struct bpf_object *obj, const char *name);
+ int compare_map_keys(int map1_fd, int map2_fd);
+ int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len);
+ int extract_build_id(char *build_id, size_t size);
++int kern_sync_rcu(void);
+
+ #ifdef __x86_64__
+ #define SYS_NANOSLEEP_KPROBE_NAME "__x64_sys_nanosleep"
+--
+2.27.0
+
--- /dev/null
+From c38859ba5f7a0a120d77a318c9f36b6bf41451b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 13:48:15 -0600
+Subject: selftests/ftrace: Update synthetic event syntax errors
+
+From: Tom Zanussi <zanussi@kernel.org>
+
+[ Upstream commit b5734e997e1117afb479ffda500e36fa91aea3e8 ]
+
+Some of the synthetic event errors and positions have changed in the
+code - update those and add several more tests.
+
+Also add a runtime check to ensure that the kernel supports dynamic
+strings in synthetic events, which these tests require.
+
+Link: https://lkml.kernel.org/r/51402656433455baead34f068c6e9466b64df9c0.1612208610.git.zanussi@kernel.org
+
+Fixes: 81ff92a93d95 (selftests/ftrace: Add test case for synthetic event syntax errors)
+Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../trigger-synthetic_event_syntax_errors.tc | 35 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic_event_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic_event_syntax_errors.tc
+index ada594fe16cb3..955e3ceea44b5 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic_event_syntax_errors.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic_event_syntax_errors.tc
+@@ -1,19 +1,38 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+ # description: event trigger - test synthetic_events syntax parser errors
+-# requires: synthetic_events error_log
++# requires: synthetic_events error_log "char name[]' >> synthetic_events":README
+
+ check_error() { # command-with-error-pos-by-^
+ ftrace_errlog_check 'synthetic_events' "$1" 'synthetic_events'
+ }
+
++check_dyn_error() { # command-with-error-pos-by-^
++ ftrace_errlog_check 'synthetic_events' "$1" 'dynamic_events'
++}
++
+ check_error 'myevent ^chr arg' # INVALID_TYPE
+-check_error 'myevent ^char str[];; int v' # INVALID_TYPE
+-check_error 'myevent char ^str]; int v' # INVALID_NAME
+-check_error 'myevent char ^str;[]' # INVALID_NAME
+-check_error 'myevent ^char str[; int v' # INVALID_TYPE
+-check_error '^mye;vent char str[]' # BAD_NAME
+-check_error 'myevent char str[]; ^int' # INVALID_FIELD
+-check_error '^myevent' # INCOMPLETE_CMD
++check_error 'myevent ^unsigned arg' # INCOMPLETE_TYPE
++
++check_error 'myevent char ^str]; int v' # BAD_NAME
++check_error '^mye-vent char str[]' # BAD_NAME
++check_error 'myevent char ^st-r[]' # BAD_NAME
++
++check_error 'myevent char str;^[]' # INVALID_FIELD
++check_error 'myevent char str; ^int' # INVALID_FIELD
++
++check_error 'myevent char ^str[; int v' # INVALID_ARRAY_SPEC
++check_error 'myevent char ^str[kdjdk]' # INVALID_ARRAY_SPEC
++check_error 'myevent char ^str[257]' # INVALID_ARRAY_SPEC
++
++check_error '^mye;vent char str[]' # INVALID_CMD
++check_error '^myevent ; char str[]' # INVALID_CMD
++check_error '^myevent; char str[]' # INVALID_CMD
++check_error '^myevent ;char str[]' # INVALID_CMD
++check_error '^; char str[]' # INVALID_CMD
++check_error '^;myevent char str[]' # INVALID_CMD
++check_error '^myevent' # INVALID_CMD
++
++check_dyn_error '^s:junk/myevent char str[' # INVALID_DYN_CMD
+
+ exit 0
+--
+2.27.0
+
--- /dev/null
+From c753e31a6074d648bbe7c258227a8e9a47899826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 15:20:28 -0800
+Subject: selftests: mptcp: fix ACKRX debug message
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+[ Upstream commit f384221a381751508f390b36d0e51bd5a7beb627 ]
+
+Info from received MPCapable SYN were printed instead of the ones from
+received MPCapable 3rd ACK.
+
+Fixes: fed61c4b584c ("selftests: mptcp: make 2nd net namespace use tcp syn cookies unconditionally")
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+index 2cfd87d94db89..e927df83efb91 100755
+--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+@@ -493,7 +493,7 @@ do_transfer()
+ echo "${listener_ns} SYNRX: ${cl_proto} -> ${srv_proto}: expect ${expect_synrx}, got ${stat_synrx_now_l}"
+ fi
+ if [ $expect_ackrx -ne $stat_ackrx_now_l ] ;then
+- echo "${listener_ns} ACKRX: ${cl_proto} -> ${srv_proto}: expect ${expect_synrx}, got ${stat_synrx_now_l}"
++ echo "${listener_ns} ACKRX: ${cl_proto} -> ${srv_proto}: expect ${expect_ackrx}, got ${stat_ackrx_now_l} "
+ fi
+
+ if [ $retc -eq 0 ] && [ $rets -eq 0 ];then
+--
+2.27.0
+
--- /dev/null
+From c2fcb2c007ae2878a074fc23810a3e48ac64e647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Dec 2020 12:34:59 +0800
+Subject: selftests/powerpc: Make the test check in eeh-basic.sh posix
+ compliant
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+[ Upstream commit 3db380570af7052620ace20c29e244938610ca71 ]
+
+The == operand is a bash extension, thus this will fail on Ubuntu
+with:
+ ./eeh-basic.sh: 89: test: 2: unexpected operator
+
+As the /bin/sh on Ubuntu is pointed to DASH.
+
+Use -eq to fix this posix compatibility issue.
+
+Fixes: 996f9e0f93f162 ("selftests/powerpc: Fix eeh-basic.sh exit codes")
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Reviewed-by: Frederic Barrat <fbarrat@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201228043459.14281-1-po-hsu.lin@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/eeh/eeh-basic.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
+index 0d783e1065c86..64779f073e177 100755
+--- a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
++++ b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh
+@@ -86,5 +86,5 @@ echo "$failed devices failed to recover ($dev_count tested)"
+ lspci | diff -u $pre_lspci -
+ rm -f $pre_lspci
+
+-test "$failed" == 0
++test "$failed" -eq 0
+ exit $?
+--
+2.27.0
+
--- /dev/null
+From cca89c154c2d9d37052401c8581ad0422ff38cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jan 2021 17:21:56 +0100
+Subject: serial: stm32: fix DMA initialization error handling
+
+From: Erwan Le Ray <erwan.leray@foss.st.com>
+
+[ Upstream commit e7997f7ff7f8154d477f6f976698d868a2ac3934 ]
+
+DMA initialization error handling is not properly implemented in the
+driver.
+Fix DMA initialization error handling by:
+- moving TX DMA descriptor request error handling in a new dedicated
+fallback_err label
+- adding error handling to TX DMA descriptor submission
+- adding error handling to RX DMA descriptor submission
+
+This patch depends on '24832ca3ee85 ("tty: serial: stm32-usart: Remove set
+but unused 'cookie' variables")' which unfortunately doesn't include a
+"Fixes" tag.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@foss.st.com>
+Link: https://lore.kernel.org/r/20210106162203.28854-2-erwan.leray@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index f4de32d3f2afe..6248304a001f4 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -383,17 +383,18 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
+ DMA_MEM_TO_DEV,
+ DMA_PREP_INTERRUPT);
+
+- if (!desc) {
+- for (i = count; i > 0; i--)
+- stm32_transmit_chars_pio(port);
+- return;
+- }
++ if (!desc)
++ goto fallback_err;
+
+ desc->callback = stm32_tx_dma_complete;
+ desc->callback_param = port;
+
+ /* Push current DMA TX transaction in the pending queue */
+- dmaengine_submit(desc);
++ if (dma_submit_error(dmaengine_submit(desc))) {
++ /* dma no yet started, safe to free resources */
++ dmaengine_terminate_async(stm32port->tx_ch);
++ goto fallback_err;
++ }
+
+ /* Issue pending DMA TX requests */
+ dma_async_issue_pending(stm32port->tx_ch);
+@@ -402,6 +403,11 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
+
+ xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
+ port->icount.tx += count;
++ return;
++
++fallback_err:
++ for (i = count; i > 0; i--)
++ stm32_transmit_chars_pio(port);
+ }
+
+ static void stm32_transmit_chars(struct uart_port *port)
+@@ -1130,7 +1136,11 @@ static int stm32_of_dma_rx_probe(struct stm32_port *stm32port,
+ desc->callback_param = NULL;
+
+ /* Push current DMA transaction in the pending queue */
+- dmaengine_submit(desc);
++ ret = dma_submit_error(dmaengine_submit(desc));
++ if (ret) {
++ dmaengine_terminate_sync(stm32port->rx_ch);
++ goto config_err;
++ }
+
+ /* Issue pending DMA requests */
+ dma_async_issue_pending(stm32port->rx_ch);
+--
+2.27.0
+
alsa-pcm-assure-sync-with-the-pending-stop-operation-at-suspend.patch
alsa-pcm-don-t-call-sync_stop-if-it-hasn-t-been-stopped.patch
drm-i915-gt-one-more-flush-for-baytrail-clear-residuals.patch
+ath10k-fix-error-handling-in-case-of-ce-pipe-init-fa.patch
+bluetooth-btqcomsmd-fix-a-resource-leak-in-error-han.patch
+bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
+bluetooth-fix-initializing-response-id-after-clearin.patch
+arm64-dts-renesas-beacon-kit-fix-choppy-bluetooth-au.patch
+arm64-dts-renesas-beacon-fix-audio-1.8v-pin-enable.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-18809
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-22522
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-30617
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-24783
+arm-dts-exynos-correct-pmic-interrupt-trigger-level-.patch-27844
+arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch
+arm64-dts-exynos-correct-pmic-interrupt-trigger-leve.patch-19801
+memory-mtk-smi-fix-pm-usage-counter-unbalance-in-mtk.patch
+bluetooth-hci_qca-fix-memleak-in-qca_controller_memd.patch
+staging-vchiq-fix-bulk-userdata-handling.patch
+staging-vchiq-fix-bulk-transfers-on-64-bit-builds.patch
+arm64-dts-qcom-msm8916-samsung-a5u-fix-iris-compatib.patch
+net-stmmac-dwmac-meson8b-fix-enabling-the-timing-adj.patch
+bpf-add-bpf_patch_call_args-prototype-to-include-lin.patch
+bpf-avoid-warning-when-re-casting-__bpf_call_base-in.patch
+firmware-arm_scmi-fix-call-site-of-scmi_notification.patch
+arm64-dts-allwinner-a64-properly-connect-usb-phy-to-.patch
+arm64-dts-allwinner-h6-properly-connect-usb-phy-to-p.patch
+arm64-dts-allwinner-drop-non-removable-from-sopine-l.patch
+arm64-dts-allwinner-h6-allow-up-to-150-mhz-mmc-bus-f.patch
+arm64-dts-allwinner-a64-limit-mmc2-bus-frequency-to-.patch
+arm64-dts-qcom-msm8916-samsung-a2015-fix-sensors.patch
+cpufreq-brcmstb-avs-cpufreq-free-resources-in-error-.patch
+cpufreq-brcmstb-avs-cpufreq-fix-resource-leaks-in-re.patch
+arm64-dts-rockchip-rk3328-add-clock_in_out-property-.patch
+acpica-fix-exception-code-class-checks.patch
+usb-gadget-u_audio-free-requests-only-after-callback.patch
+arm64-dts-qcom-sdm845-db845c-fix-reset-pin-of-ov8856.patch
+soc-qcom-socinfo-fix-an-off-by-one-in-qcom_show_pmic.patch
+soc-ti-pm33xx-fix-some-resource-leak-in-the-error-ha.patch
+staging-media-atomisp-fix-size_t-format-specifier-in.patch
+bluetooth-drop-hci-device-reference-before-return.patch
+bluetooth-put-hci-device-if-inquiry-procedure-interr.patch
+memory-ti-aemif-drop-child-node-when-jumping-out-loo.patch
+arm-dts-configure-missing-thermal-interrupt-for-4430.patch
+usb-dwc2-do-not-update-data-length-if-it-is-0-on-inb.patch
+usb-dwc2-abort-transaction-after-errors-with-unknown.patch
+usb-dwc2-make-trimming-xfer-length-a-debug-message.patch
+staging-rtl8723bs-wifi_regd.c-fix-incorrect-number-o.patch
+x86-msr-filter-msr-writes-through-x86_ioc_wrmsr_regs.patch
+arm64-dts-renesas-beacon-fix-eeprom-compatible-value.patch
+can-mcp251xfd-mcp251xfd_probe-fix-errata-reference.patch
+arm-dts-armada388-helios4-assign-pinctrl-to-leds.patch
+arm-dts-armada388-helios4-assign-pinctrl-to-each-fan.patch
+arm64-dts-armada-3720-turris-mox-rename-u-boot-mtd-p.patch
+opp-correct-debug-message-in-_opp_add_static_v2.patch
+bluetooth-btusb-fix-memory-leak-in-btusb_mtk_wmt_rec.patch
+soc-qcom-ocmem-don-t-return-null-in-of_get_ocmem.patch
+arm64-dts-msm8916-fix-reserved-and-rfsa-nodes-unit-a.patch
+arm64-dts-meson-fix-broken-wifi-node-for-khadas-vim3.patch
+iwlwifi-mvm-set-enabled-in-the-ppag-command-properly.patch
+arm-s3c-fix-fiq-for-clang-ias.patch
+optee-simplify-i2c-access.patch
+staging-wfx-fix-possible-panic-with-re-queued-frames.patch
+arm-at91-use-proper-asm-syntax-in-pm_suspend.patch
+ath10k-fix-suspicious-rcu-usage-warning-in-ath10k_wm.patch
+ath10k-fix-lockdep-assertion-warning-in-ath10k_sta_s.patch
+ath11k-fix-a-locking-bug-in-ath11k_mac_op_start.patch
+soc-aspeed-snoop-add-clock-control-logic.patch
+iwlwifi-mvm-fix-the-type-we-use-in-the-ppag-table-va.patch
+iwlwifi-mvm-store-ppag-enabled-disabled-flag-properl.patch
+iwlwifi-mvm-send-stored-ppag-command-instead-of-loca.patch
+iwlwifi-mvm-assign-sar-table-revision-to-the-command.patch
+iwlwifi-mvm-don-t-check-if-csa-event-is-running-befo.patch
+bpf_lru_list-read-double-checked-variable-once-witho.patch
+iwlwifi-pnvm-set-the-pnvm-again-if-it-was-already-lo.patch
+iwlwifi-pnvm-increment-the-pointer-before-checking-t.patch
+ath9k-fix-data-bus-crash-when-setting-nf_override-vi.patch
+selftests-bpf-convert-test_xdp_redirect.sh-to-bash.patch
+ibmvnic-set-to-closed-state-even-on-error.patch
+bnxt_en-reverse-order-of-tx-disable-and-carrier-off.patch
+bnxt_en-fix-devlink-info-s-stored-fw.psid-version-fo.patch
+xen-netback-fix-spurious-event-detection-for-common-.patch
+dpaa2-eth-fix-memory-leak-in-xdp_redirect.patch
+net-phy-consider-that-suspend2ram-may-cut-off-phy-po.patch
+net-mlx5e-enable-xdp-for-connect-x-ipsec-capable-dev.patch
+net-mlx5e-don-t-change-interrupt-moderation-params-w.patch
+net-mlx5e-change-interrupt-moderation-channel-params.patch
+net-mlx5-fix-health-error-state-handling.patch
+net-mlx5e-replace-synchronize_rcu-with-synchronize_n.patch
+net-mlx5e-ktls-use-refcounts-to-free-ktls-rx-priv-co.patch
+net-mlx5-disable-devlink-reload-for-multi-port-slave.patch
+net-mlx5-disallow-roce-on-multi-port-slave-device.patch
+net-mlx5-disallow-roce-on-lag-device.patch
+net-mlx5-disable-devlink-reload-for-lag-devices.patch
+net-mlx5e-ct-manage-the-lifetime-of-the-ct-entry-obj.patch
+net-mlx5e-check-tunnel-offload-is-required-before-se.patch
+mac80211-fix-potential-overflow-when-multiplying-to-.patch
+libbpf-ignore-non-function-pointer-member-in-struct_.patch
+bpf-fix-an-unitialized-value-in-bpf_iter.patch
+bpf-devmap-use-gfp_kernel-for-xdp-bulk-queue-allocat.patch
+bpf-fix-bpf_fib_lookup-helper-mtu-check-for-skb-ctx.patch
+selftests-mptcp-fix-ackrx-debug-message.patch
+tcp-fix-so_rcvlowat-related-hangs-under-mem-pressure.patch
+net-axienet-handle-deferred-probe-on-clock-properly.patch
+cxgb4-chtls-cxgbit-keeping-the-max-ofld-immediate-da.patch
+b43-n-phy-fix-the-update-of-coef-for-the-phy-revisio.patch
+bpf-clear-subreg_def-for-global-function-return-valu.patch
+ibmvnic-add-memory-barrier-to-protect-long-term-buff.patch
+ibmvnic-skip-send_request_unmap-for-timeout-reset.patch
+ibmvnic-serialize-access-to-work-queue-on-remove.patch
+net-dsa-felix-perform-teardown-in-reverse-order-of-s.patch
+net-dsa-felix-don-t-deinitialize-unused-ports.patch
+net-phy-mscc-adding-lcpll-reset-to-vsc8514.patch
+net-amd-xgbe-reset-the-phy-rx-data-path-when-mailbox.patch
+net-amd-xgbe-fix-netdev-watchdog-transmit-queue-time.patch
+net-amd-xgbe-reset-link-when-the-link-never-comes-ba.patch
+net-amd-xgbe-fix-network-fluctuations-when-using-1g-.patch
+net-mvneta-remove-per-cpu-queue-mapping-for-armada-3.patch
+net-enetc-fix-destroyed-phylink-dereference-during-u.patch
+bluetooth-remove-hci_req_le_suspend_config.patch
+arm64-dts-broadcom-bcm4908-use-proper-nand-binding.patch
+bluetooth-hci_qca-wait-for-ssr-completion-during-sus.patch
+serial-stm32-fix-dma-initialization-error-handling.patch
+bpf-declare-__bpf_free_used_maps-unconditionally.patch
+selftests-bpf-sync-rcu-before-unloading-bpf_testmod.patch
+arm64-dts-qcom-sm8250-correct-sdhc_2-xo-clk.patch
+arm64-dts-qcom-qrb5165-rb5-fix-usd-pins-drive-streng.patch
+tty-convert-tty_ldisc_ops-read-function-to-take-a-ke.patch
+tty-implement-read_iter.patch
+x86-sgx-fix-the-return-type-of-sgx_init.patch
+selftests-bpf-don-t-exit-on-failed-bpf_testmod-unloa.patch
+arm64-dts-mt8183-rename-rdma-fifo-size.patch
+arm64-dts-mt8183-refine-gamma-compatible-name.patch
+arm64-dts-mt8183-add-missing-power-domain-for-pwm0-n.patch
+net-sfp-add-workaround-for-realtek-rtl8672-and-rtl96.patch
+arm-tegra-ouya-fix-emmc-on-specific-bootloaders.patch
+arm64-dts-mt8183-fix-gce-include-path.patch
+bluetooth-hci_qca-check-for-ssr-triggered-flag-while.patch
+bluetooth-hci_qca-fixed-issue-during-suspend.patch
+soc-aspeed-socinfo-add-new-systems.patch
+net-mlx5e-e-switch-fix-rate-calculation-for-overflow.patch
+net-mlx5e-enable-striding-rq-for-connect-x-ipsec-cap.patch
+net-mlx5e-fix-cq-params-of-icosq-and-async-icosq.patch
+ibmvnic-change-ibmvnic_max_ind_descs-to-16.patch
+net-ipa-initialize-all-resources.patch
+net-phy-mscc-improved-serdes-calibration-applied-to-.patch
+net-phy-mscc-coma-mode-disabled-for-vsc8514.patch
+fbdev-aty-sparc64-requires-fb_aty_ct.patch
+drm-gma500-fix-error-return-code-in-psb_driver_load.patch
+drm-document-that-user-space-should-force-probe-conn.patch
+gma500-clean-up-error-handling-in-init.patch
+drm-fb-helper-add-missed-unlocks-in-setcmap_legacy.patch
+drm-panel-s6e63m0-fix-init-sequence-again.patch
+drm-panel-mantix-tweak-init-sequence.patch
+drm-vc4-hdmi-take-into-account-the-clock-doubling-fl.patch
+drm-panel-s6e63m0-support-max-brightness.patch
+crypto-sun4i-ss-linearize-buffers-content-must-be-ke.patch
+crypto-sun4i-ss-fix-kmap-usage.patch
+crypto-arm64-aes-ce-really-hide-slower-algos-when-fa.patch
+hwrng-ingenic-fix-a-resource-leak-in-an-error-handli.patch
+media-allegro-fix-use-after-free-on-error.patch
+asoc-fsl_aud2htx-select-snd_soc_imx_pcm_dma.patch
+kcsan-rewrite-kcsan_prandom_u32_max-without-prandom_.patch
+drm-rcar-du-fix-pm-reference-leak-in-rcar_cmm_enable.patch
+drm-rcar-du-fix-crash-when-using-lvds1-clock-for-crt.patch
+drm-rcar-du-fix-the-return-check-of-of_parse_phandle.patch
+drm-rcar-du-fix-leak-of-cmm-platform-device-referenc.patch
+drm-amdgpu-fix-macro-name-_amdgpu_trace_h_-in-prepro.patch
+mips-c-r4k-fix-section-mismatch-for-loongson2_sc_ini.patch
+mips-lantiq-explicitly-compare-ltq_ebu_pcc_istat-aga.patch
+drm-virtio-make-sure-context-is-created-in-gem-open.patch
+drm-fourcc-fix-amlogic-format-modifier-masks.patch
+media-ipu3-cio2-build-only-for-x86.patch
+media-i2c-ov5670-fix-pixel_rate-minimum-value.patch
+media-imx-unregister-csc-scaler-only-if-registered.patch
+media-imx-fix-csc-scaler-unregister.patch
+media-mtk-vcodec-fix-error-return-code-in-vdec_vp9_d.patch
+media-camss-fix-signedness-bug-in-video_enum_fmt.patch
+media-camss-missing-error-code-in-msm_video_register.patch
+media-vsp1-fix-an-error-handling-path-in-the-probe-f.patch
+media-em28xx-fix-use-after-free-in-em28xx_alloc_urbs.patch
+media-media-pci-fix-memleak-in-empress_init.patch
+media-tm6000-fix-memleak-in-tm6000_start_stream.patch
+media-aspeed-fix-error-return-code-in-aspeed_video_s.patch
+asoc-cs42l56-fix-up-error-handling-in-probe.patch
+asoc-qcom-qdsp6-move-frontend-aifs-to-q6asm-dai.patch
+evm-fix-memleak-in-init_desc.patch
+crypto-qat-replace-crypto_aes-with-crypto_lib_aes-in.patch
+crypto-bcm-rename-struct-device_private-to-bcm_devic.patch
+sched-fair-avoid-stale-cpu-util_est-value-for-schedu.patch
+drm-sun4i-tcon-fix-inverted-dclk-polarity.patch
+media-imx7-csi-fix-regression-for-parallel-cameras-o.patch
+media-imx7-csi-fix-pad-link-validation.patch
+media-ti-vpe-cal-fix-write-to-unallocated-memory.patch
+mips-properly-stop-.eh_frame-generation.patch
+mips-compare-__sync_loongson3_war-against-0.patch
+drm-tegra-fix-reference-leak-when-pm_runtime_get_syn.patch
+drm-amdgpu-toggle-on-df-cstate-after-finishing-xgmi-.patch
+bsg-free-the-request-before-return-error-code.patch
+macintosh-adb-iop-use-big-endian-autopoll-mask.patch
+drm-amd-display-fix-10-12-bpc-setup-in-dce-output-bi.patch
+drm-amd-display-fix-hdmi-deep-color-output-for-dce-6.patch
+media-software_node-fix-refcounts-in-software_node_g.patch
+media-lmedm04-fix-misuse-of-comma.patch
+media-vidtv-psi-fix-missing-crc-for-pmt.patch
+media-atomisp-fix-a-buffer-overflow-in-debug-code.patch
+media-qm1d1c0042-fix-error-return-code-in-qm1d1c0042.patch
+media-cx25821-fix-a-bug-when-reallocating-some-dma-m.patch
+media-mtk-vcodec-fix-argument-used-when-debug-is-def.patch
+mtd-phram-use-div_u64_rem-to-stop-overwrite-len-in-p.patch
+media-pxa_camera-declare-variable-when-debug-is-defi.patch
+media-uvcvideo-accept-invalid-bformatindex-and-bfram.patch
+media-i2c-kconfig-select-fwnode-for-ov772x-sensor.patch
+asoc-max98373-fixes-a-typo-in-max98373_feedback_get.patch
+sched-eas-don-t-update-misfit-status-if-the-task-is-.patch
+f2fs-fix-null-page-reference-in-redirty_blocks.patch
+f2fs-compress-fix-potential-deadlock.patch
+asoc-qcom-lpass-cpu-remove-bit-clock-state-check.patch
+asoc-sof-intel-hda-cancel-d0i3-work-during-runtime-s.patch
+perf-arm-cmn-fix-pmu-instance-naming.patch
+perf-arm-cmn-move-irqs-when-migrating-context.patch
+mtd-parser-imagetag-fix-error-codes-in-bcm963xx_pars.patch
+crypto-talitos-work-around-sec6-errata-aes-ctr-mode-.patch
+crypto-talitos-fix-ctr-aes-on-sec1.patch
+drm-nouveau-bail-out-of-nouveau_channel_new-if-chann.patch
+irqchip-ls-extirq-add-irqchip_skip_set_wake-to-the-i.patch
+mm-proc-invalidate-tlb-after-clearing-soft-dirty-pag.patch
+ata-ahci_brcm-add-back-regulators-management.patch
+asoc-cpcap-fix-microphone-timeslot-mask.patch
+asoc-codecs-add-missing-max_register-in-regmap-confi.patch
+mtd-parsers-afs-fix-freeing-the-part-name-memory-in-.patch
+mtd-rawnand-intel-fix-an-error-handling-path-in-ebu_.patch
+f2fs-fix-to-avoid-inconsistent-quota-data.patch
+drm-amdgpu-prevent-shift-wrapping-in-amdgpu_read_mas.patch
+f2fs-fix-a-wrong-condition-in-__submit_bio.patch
+asoc-qcom-fix-typo-error-in-hdmi-regmap-config-callb.patch
+kvm-nsvm-don-t-strip-host-s-c-bit-from-guest-s-cr3-w.patch
+drm-mediatek-check-if-fb-is-null.patch
+drm-mediatek-fix-aal-size-config.patch
+drivers-hv-vmbus-avoid-use-after-free-in-vmbus_onoff.patch
+asoc-intel-sof_sdw-add-missing-tgl_hdmi-quirk-for-de.patch
+asoc-intel-sof_sdw-add-missing-tgl_hdmi-quirk-for-de.patch-19323
+asoc-intel-sof_sdw-add-missing-tgl_hdmi-quirk-for-de.patch-13427
+locking-lockdep-avoid-unmatched-unlock.patch
+asoc-qcom-lpass-fix-i2s-ctl-register-bit-map.patch
+asoc-rt5682-fix-panic-in-rt5682_jack_detect_handler-.patch
+asoc-sof-debug-fix-a-potential-issue-on-string-buffe.patch
+btrfs-clarify-error-returns-values-in-__load_free_sp.patch
+btrfs-fix-double-accounting-of-ordered-extent-for-su.patch
+mips-relocatable-provide-kaslr_offset-to-get-the-ker.patch
+kvm-x86-restore-all-64-bits-of-dr6-and-dr7-during-rs.patch
+s390-zcrypt-return-eio-when-msg-retry-limit-reached.patch
+drm-vc4-hdmi-move-hdmi-reset-to-bind.patch
+drm-vc4-hdmi-fix-register-offset-with-longer-cec-mes.patch
+drm-vc4-hdmi-fix-up-cec-registers.patch
+drm-vc4-hdmi-restore-cec-physical-address-on-reconne.patch
+drm-vc4-hdmi-compute-the-cec-clock-divider-from-the-.patch
+drm-vc4-hdmi-update-the-cec-clock-divider-on-hsm-rat.patch
+drm-lima-fix-reference-leak-in-lima_pm_busy.patch
+drm-virtio-fix-an-error-code-in-virtio_gpu_init.patch
+drm-dp_mst-don-t-cache-edids-for-physical-ports.patch
+hwrng-timeriomem-fix-cooldown-period-calculation.patch
+crypto-ecdh_helper-ensure-len-secret.len-in-decode_k.patch
+io_uring-fix-possible-deadlock-in-io_uring_poll.patch
+nvmet-tcp-fix-receive-data-digest-calculation-for-mu.patch
+nvmet-tcp-fix-potential-race-of-tcp-socket-closing-a.patch
+nvme-multipath-set-nr_zones-for-zoned-namespaces.patch
+nvmet-remove-extra-variable-in-identify-ns.patch
+nvmet-set-status-to-0-in-case-for-invalid-nsid.patch
+asoc-sof-sof-pci-dev-add-missing-up-extreme-quirk.patch
+ima-free-ima-measurement-buffer-on-error.patch
+ima-free-ima-measurement-buffer-after-kexec-syscall.patch
+asoc-simple-card-utils-fix-device-module-clock.patch
+fs-jfs-fix-potential-integer-overflow-on-shift-of-a-.patch
+jffs2-fix-use-after-free-in-jffs2_sum_write_data.patch
+ubifs-fix-memleak-in-ubifs_init_authentication.patch
+ubifs-replay-fix-high-stack-usage-again.patch
+ubifs-fix-error-return-code-in-alloc_wbufs.patch
+irqchip-imx-imx_intmux-should-not-default-to-y-uncon.patch
+smp-process-pending-softirqs-in-flush_smp_call_funct.patch
+drm-amdgpu-display-remove-hdcp_srm-sysfs-on-device-r.patch
+input-da7280-fix-missing-error-test.patch
+input-da7280-protect-of-match-table-with-config_of.patch
+input-imx_keypad-add-dependency-on-has_iomem.patch
+capabilities-don-t-allow-writing-ambiguous-v3-file-c.patch
+hsi-fix-pm-usage-counter-unbalance-in-ssi_hw_init.patch
+power-supply-cpcap-add-missing-irqf_oneshot-to-fix-r.patch
+clk-meson-clk-pll-fix-initializing-the-old-rate-fall.patch
+clk-meson-clk-pll-make-ret-a-signed-integer.patch
+clk-meson-clk-pll-propagate-the-error-from-meson_clk.patch
+selftests-powerpc-make-the-test-check-in-eeh-basic.s.patch
+regulator-qcom-rpmh-regulator-add-pm8009-1-chip-revi.patch
+arm64-dts-qcom-qrb5165-rb5-fix-pm8009-regulators.patch
+quota-fix-memory-leak-when-handling-corrupted-quota-.patch
+i2c-iproc-handle-only-slave-interrupts-which-are-ena.patch
+i2c-iproc-update-slave-isr-mask-isr_mask_slave.patch
+i2c-iproc-handle-master-read-request.patch
+spi-cadence-quadspi-abort-read-if-dummy-cycles-requi.patch
+clk-sunxi-ng-h6-fix-cec-clock.patch
+clk-renesas-r8a779a0-remove-non-existent-s2-clock.patch
+clk-renesas-r8a779a0-fix-parent-of-cbfusa-clock.patch
+hid-core-detect-and-skip-invalid-inputs-to-snto32.patch
+rdma-siw-fix-handling-of-zero-sized-read-and-receive.patch
+dmaengine-fsldma-fix-a-resource-leak-in-the-remove-f.patch
+dmaengine-fsldma-fix-a-resource-leak-in-an-error-han.patch
+dmaengine-owl-dma-fix-a-resource-leak-in-the-remove-.patch
+rtc-rx6110-fix-build-against-modular-i2c.patch
+dmaengine-qcom-always-inline-gpi_update_reg.patch
+dmaengine-ti-k3-udma-set-rflow-count-for-bcdma-split.patch
+dmaengine-hsu-disable-spurious-interrupt.patch
+mfd-bd9571mwv-use-devm_mfd_add_devices.patch
+power-supply-cpcap-charger-fix-missing-power_supply_.patch
+power-supply-cpcap-battery-fix-missing-power_supply_.patch
+scsi-ufs-fix-a-possible-null-pointer-issue.patch
+power-supply-cpcap-charger-fix-power_supply_put-on-n.patch
+fdt-properly-handle-no-map-field-in-the-memory-regio.patch
+of-fdt-make-sure-no-map-does-not-remove-already-rese.patch
+rdma-rtrs-extend-ibtrs_cq_qp_create.patch
+rdma-rtrs-srv-release-lock-before-call-into-close_se.patch
+rdma-rtrs-srv-use-sysfs_remove_file_self-for-disconn.patch
+rdma-rtrs-clt-set-mininum-limit-when-create-qp.patch
+rdma-rtrs-srv-jump-to-dereg_mr-label-if-allocate-iu-.patch
+rdma-rtrs-call-kobject_put-in-the-failure-path.patch
+rdma-rtrs-srv-fix-missing-wr_cqe.patch
+rdma-rtrs-clt-refactor-the-failure-cases-in-alloc_cl.patch
+rdma-rtrs-srv-init-wr_cnt-as-1.patch
+rdma-rtrs-fix-kasan-stack-out-of-bounds-bug.patch
+power-reset-at91-sama5d2_shdwc-fix-wkupdbc-mask.patch
+rtc-s5m-select-regmap_i2c.patch
+dmaengine-idxd-set-dma-channel-to-be-private.patch
+power-supply-fix-sbs-charger-build-needs-regmap_i2c.patch
+clocksource-drivers-ixp4xx-select-timer_of-when-need.patch
+clocksource-drivers-mxs_timer-add-missing-semicolon-.patch
+module-harden-elf-info-handling.patch
+spi-imx-don-t-print-error-on-eprobedefer.patch
+rdma-mlx5-use-the-correct-obj_id-upon-devx-tir-creat.patch
+ib-mlx5-add-mutex-destroy-call-to-cap_mask_mutex-mut.patch
+clk-sunxi-ng-h6-fix-clock-divider-range-on-some-cloc.patch
+platform-chrome-cros_ec_proto-use-ec_host_event_mask.patch
+platform-chrome-cros_ec_proto-add-lid-and-battery-to.patch
+regulator-axp20x-fix-reference-cout-leak.patch
+watch_queue-drop-references-to-dev-watch_queue.patch
+certs-fix-blacklist-flag-type-confusion.patch
+regulator-s5m8767-fix-reference-count-leak.patch
+spi-atmel-put-allocated-master-before-return.patch
+regulator-s5m8767-drop-regulators-of-node-reference.patch
+scsi-libsas-remove-notifier-indirection.patch
+scsi-libsas-introduce-a-_gfp-variant-of-event-notifi.patch
+scsi-mvsas-pass-gfp_t-flags-to-libsas-event-notifier.patch
+scsi-isci-pass-gfp_t-flags-in-isci_port_link_down.patch
+scsi-isci-pass-gfp_t-flags-in-isci_port_link_up.patch
+scsi-isci-pass-gfp_t-flags-in-isci_port_bc_change_re.patch
+power-supply-axp20x_usb_power-init-work-before-enabl.patch
+power-supply-smb347-charger-fix-interrupt-usage-if-i.patch
+regulator-core-avoid-debugfs-directory-.-already-pre.patch
+isofs-release-buffer-head-before-return.patch
+watchdog-intel-mid_wdt-postpone-irq-handler-registra.patch
+auxdisplay-ht16k33-fix-refresh-rate-handling.patch
+auxdisplay-fix-duplicate-charlcd-config-symbol.patch
+objtool-fix-error-handling-for-std-cld-warnings.patch
+objtool-fix-retpoline-detection-in-asm-code.patch
+objtool-fix-.cold-section-suffix-check-for-newer-ver.patch
+scsi-lpfc-fix-ancient-double-free.patch
+iommu-switch-gather-end-to-the-inclusive-end.patch
+tools-testing-scatterlist-fix-overflow-of-max-segmen.patch
+rdma-mlx5-allow-creating-all-qps-even-when-non-rdma-.patch
+ib-umad-return-eio-in-case-of-when-device-disassocia.patch
+ib-umad-return-epollerr-in-case-of-when-device-disas.patch
+kvm-ppc-make-the-vmx-instruction-emulation-routines-.patch
+powerpc-kvm-force-selection-of-config_ppc_fpu.patch
+powerpc-47x-disable-256k-page-size.patch
+powerpc-sstep-check-instruction-validity-against-isa.patch
+powerpc-sstep-fix-incorrect-return-from-analyze_inst.patch
+powerpc-time-enable-sched-clock-for-irqtime.patch
+powerpc-fix-build-error-in-paravirt.h.patch
+mmc-owl-mmc-fix-a-resource-leak-in-an-error-handling.patch
+mmc-sdhci-sprd-fix-some-resource-leaks-in-the-remove.patch
+mmc-usdhi6rol0-fix-a-resource-leak-in-the-error-hand.patch
+mmc-renesas_sdhi_internal_dmac-fix-dma-buffer-alignm.patch
+arm-9046-1-decompressor-do-not-clear-sctlr.ntlsmd-fo.patch
+i2c-qcom-geni-store-dma-mapping-data-in-geni_i2c_dev.patch
+i2c-i2c-qcom-geni-add-shutdown-callback-for-i2c.patch
+i3c-master-mipi-i3c-hci-specify-has_iomem-dependency.patch
+amba-fix-resource-leak-for-drivers-without-.remove.patch
+iommu-move-iotlb_sync_map-out-from-__iommu_map.patch
+iommu-properly-pass-gfp_t-in-_iommu_map-to-avoid-ato.patch
+ib-mlx5-return-appropriate-error-code-instead-of-eno.patch
+ib-cm-avoid-a-loop-when-device-has-255-ports.patch
+tracepoint-do-not-fail-unregistering-a-probe-due-to-.patch
+rtc-zynqmp-depend-on-has_iomem.patch
+platform-x86-intel_pmt-make-intel_pmt_class-non-user.patch
+platform-x86-intel_pmt_telemetry-add-dependency-on-m.patch
+platform-x86-intel_pmt_crashlog-add-dependency-on-mf.patch
+perf-tools-fix-dso-filtering-when-not-finding-a-map-.patch
+perf-vendor-events-arm64-fix-ampere-emag-event-typo.patch
+rdma-rxe-fix-coding-error-in-rxe_recv.c.patch
+rdma-rxe-fix-coding-error-in-rxe_rcv_mcast_pkt.patch
+rdma-rxe-correct-skb-on-loopback-path.patch
+spi-stm32-properly-handle-0-byte-transfer.patch
+mfd-altera-sysmgr-fix-physical-address-storing-more.patch
+mfd-wm831x-auxadc-prevent-use-after-free-in-wm831x_a.patch
+powerpc-pseries-dlpar-handle-ibm-configure-connector.patch
+powerpc-8xx-fix-software-emulation-interrupt.patch
+powerpc-sstep-fix-load-store-and-update-emulation.patch
+powerpc-sstep-fix-darn-emulation.patch
+clk-qcom-gfm-mux-fix-clk-mask.patch
+clk-qcom-gcc-sc7180-mark-the-mm-xo-clocks-to-be-alwa.patch
+clk-qcom-gcc-msm8998-fix-alpha-pll-type-for-all-gpll.patch
+kunit-tool-fix-unit-test-cleanup-handling.patch
+kselftests-dmabuf-heaps-fix-makefile-s-inclusion-of-.patch
+rdma-hns-allocate-one-more-recv-sge-for-hip08.patch
+rdma-hns-bugfix-for-checking-whether-the-srq-is-full.patch
+rdma-hns-force-srq_limit-to-0-when-creating-srq.patch
+rdma-hns-fixed-wrong-judgments-in-the-goto-branch.patch
+rdma-hns-remove-the-reserved-wqe-of-srq.patch
+rdma-siw-fix-calculation-of-tx_valid_cpus-size.patch
+rdma-hns-avoid-filling-sgid-index-when-modifying-qp-.patch
+rdma-hns-fix-type-of-sq_signal_bits.patch
+rdma-hns-add-mapped-page-count-checking-for-mtr.patch
+rdma-hns-disable-rq-inline-by-default.patch
+clk-divider-fix-initialization-with-parent_hw.patch
+spi-pxa2xx-fix-the-controller-numbering-for-wildcat-.patch
+powerpc-uaccess-avoid-might_fault-when-user-access-i.patch
+powerpc-kuap-restore-amr-after-replaying-soft-interr.patch
+regulator-qcom-rpmh-fix-pm8009-ldo7.patch
+clk-aspeed-fix-apll-calculate-formula-from-ast2600-a.patch
+selftests-ftrace-update-synthetic-event-syntax-error.patch
+perf-symbols-use-long-for-iterator-for-bfd-symbols.patch
+regulator-bd718x7-bd71828-fix-dvs-voltage-levels.patch
+spi-dw-avoid-stack-content-exposure.patch
+spi-skip-zero-length-transfers-in-spi_transfer_one_m.patch
+printk-avoid-prb_first_valid_seq-where-possible.patch
+perf-symbols-fix-return-value-when-loading-pe-dso.patch
+nfsd-register-pernet-ops-last-unregister-first.patch
+svcrdma-hold-private-mutex-while-invoking-rdma_accep.patch
+ceph-fix-flush_snap-logic-after-putting-caps.patch
+rdma-hns-fixes-missing-error-code-of-cmdq.patch
+rdma-ucma-fix-use-after-free-bug-in-ucma_create_ueve.patch
+rdma-rtrs-srv-fix-stack-out-of-bounds.patch
+rdma-rtrs-only-allow-addition-of-path-to-an-already-.patch
+rdma-rtrs-srv-fix-memory-leak-by-missing-kobject-fre.patch
+rdma-rtrs-srv-sysfs-fix-missing-put_device.patch
+rdma-rtrs-srv-do-not-pass-a-valid-pointer-to-ptr_err.patch
+input-sur40-fix-an-error-code-in-sur40_probe.patch
+perf-record-fix-continue-profiling-after-draining-th.patch
+perf-unwind-set-userdata-for-all-__report_module-pat.patch
+perf-intel-pt-fix-missing-cyc-processing-in-psb.patch
+perf-intel-pt-fix-premature-ipc.patch
+perf-intel-pt-fix-ipc-with-cyc-threshold.patch
+perf-test-fix-unaligned-access-in-sample-parsing-tes.patch
+input-elo-fix-an-error-code-in-elo_connect.patch
+sparc64-only-select-compat_binfmt_elf-if-binfmt_elf-.patch
+sparc-fix-led.c-driver-when-proc_fs-is-not-enabled.patch
+input-zinitix-fix-return-type-of-zinitix_init_touch.patch
+input-st1232-add-idle-state-as-ready-condition.patch
+arm-9065-1-oabi-compat-fix-build-when-epoll-is-not-e.patch
+input-st1232-fix-normal-vs.-idle-state-handling.patch
+misc-eeprom_93xx46-fix-module-alias-to-enable-module.patch
+phy-rockchip-emmc-emmc_phy_init-always-return-0.patch
+phy-cadence-torrent-fix-error-code-in-cdns_torrent_p.patch
+misc-eeprom_93xx46-add-module-alias-to-avoid-breakin.patch
+pci-rcar-always-allocate-msi-addresses-in-32bit-spac.patch
+soundwire-debugfs-use-controller-id-instead-of-link_.patch
+soundwire-cadence-fix-ack-nak-handling.patch
+pwm-rockchip-enable-apb-clock-during-register-access.patch
+pwm-rockchip-rockchip_pwm_probe-remove-superfluous-c.patch
+pwm-rockchip-eliminate-potential-race-condition-when.patch
+pci-xilinx-cpm-fix-reference-count-leak-on-error-pat.patch
+vmci-use-set_page_dirty_lock-when-unregistering-gues.patch
+pci-align-checking-of-syscall-user-config-accessors.patch
+mei-hbm-call-mei_set_devstate-on-hbm-stop-response.patch
+drm-msm-fix-msm_info_get_iova-with-carveout.patch
+drm-msm-add-proper-checks-for-gpu-llcc-support.patch
+drm-msm-dsi-correct-io_start-for-msm8994-20nm-phy.patch
+drm-msm-mdp5-fix-wait-for-commit-for-cmd-panels.patch
+drm-msm-fix-race-of-gpu-init-vs-timestamp-power-mana.patch
+drm-msm-fix-races-managing-the-oob-state-for-timesta.patch
+drm-msm-kms-make-a-lock_class_key-for-each-crtc-mute.patch
+drm-msm-dp-trigger-unplug-event-in-msm_dp_display_di.patch
+vfio-iommu_type1-populate-full-dirty-when-detach-non.patch
+vfio-iommu_type1-fix-some-sanity-checks-in-detach-gr.patch
+vfio-pci-zdev-fix-possible-segmentation-fault-issue.patch
+ext4-fix-potential-htree-index-checksum-corruption.patch
+phy-usb_lgm_phy-should-depend-on-x86.patch
+coresight-etm4x-skip-accessing-trcpdcr-in-save-resto.patch
+nvmem-core-fix-a-resource-leak-on-error-in-nvmem_add.patch
+nvmem-core-skip-child-nodes-not-matching-binding.patch
+drm-msm-fix-legacy-relocs-path.patch
+soundwire-bus-use-sdw_update_no_pm-when-initializing.patch
+soundwire-bus-use-sdw_write_no_pm-when-setting-the-b.patch
+soundwire-export-sdw_write-read_no_pm-functions.patch
+soundwire-bus-fix-confusion-on-device-used-by-pm_run.patch
+drm-msm-dp-add-a-missing-semi-colon.patch
+misc-fastrpc-fix-incorrect-usage-of-dma_map_sgtable.patch
+remoteproc-mediatek-acknowledge-watchdog-irq-after-h.patch
+mhi-fix-double-dma-free.patch
+regmap-sdw-use-_no_pm-functions-in-regmap_read-write.patch
+ext-ext4_kunit_tests-should-depend-on-ext4_fs-instea.patch
+mailbox-sprd-correct-definition-of-sprd_outbox_fifo_.patch
+device-dax-fix-default-return-code-of-range_parse.patch
+pci-pci-bridge-emul-fix-array-overruns-improve-safet.patch
+pci-cadence-fix-dma-range-mapping-early-return-error.patch
+i40e-fix-flow-for-ipv6-next-header-extension-header.patch
+i40e-add-zero-initialization-of-aq-command-structure.patch
+i40e-fix-overwriting-flow-control-settings-during-dr.patch
+i40e-fix-addition-of-rx-filters-after-enabling-fw-ll.patch
+i40e-fix-vfs-not-created.patch
+take-mmap-lock-in-cacheflush-syscall.patch
+nios2-fixed-broken-sys_clone-syscall.patch
+i40e-fix-add-tc-filter-for-ipv6.patch
+i40e-fix-endianness-conversions.patch
+octeontx2-af-fix-an-off-by-one-in-rvu_dbg_qsize_writ.patch
+pwm-iqs620a-fix-overflow-and-optimize-calculations.patch
+ice-report-correct-max-number-of-tcs.patch
+ice-account-for-port-vlan-in-vf-max-packet-size-calc.patch
+ice-fix-state-bits-on-lldp-mode-switch.patch
+ice-update-the-number-of-available-rss-queues.patch
+dpaa_eth-fix-the-access-method-for-the-dpaa_napi_por.patch
+net-stmmac-fix-cbs-idleslope-and-sendslope-calculati.patch
+net-mlx4_core-add-missed-mlx4_free_cmd_mailbox.patch
+pci-rockchip-make-ep-gpios-dt-property-optional.patch
+vxlan-move-debug-check-after-netdev-unregister.patch
+wireguard-device-do-not-generate-icmp-for-non-ip-pac.patch
+wireguard-kconfig-use-arm-chacha-even-with-no-neon.patch
+ocfs2-fix-a-use-after-free-on-error.patch
+mm-memcontrol-fix-nr_anon_thps-accounting-in-charge-.patch
+mm-memcontrol-fix-slub-memory-accounting.patch
+mm-memory.c-fix-potential-pte_unmap_unlock-pte-error.patch
+mm-hugetlb-fix-potential-double-free-in-hugetlb_regi.patch
+mm-hugetlb-suppress-wrong-warning-info-when-alloc-gi.patch
+mm-compaction-fix-misbehaviors-of-fast_find_migrateb.patch
+net-phy-micrel-set-soft_reset-callback-to-genphy_sof.patch
+r8169-fix-jumbo-packet-handling-on-rtl8168e.patch
+nfsv4-fixes-for-nfs4_bitmask_adjust.patch
+kvm-svm-intercept-invpcid-when-it-s-disabled-to-inje.patch
+kvm-x86-mmu-expand-collapsible-spte-zap-for-tdp-mmu-.patch
+cifs-fix-inconsistent-is_err-and-ptr_err.patch
+arm64-add-missing-isb-after-invalidating-tlb-in-__pr.patch
+i2c-brcmstb-fix-brcmstd_send_i2c_cmd-condition.patch
+i2c-exynos5-preserve-high-speed-master-code.patch
+mm-thp-shmem-make-khugepaged-obey-tmpfs-mount-flags.patch
+mm-fix-memory_failure-handling-of-dax-namespace-meta.patch
+mm-rmap-fix-potential-pte_unmap-on-an-not-mapped-pte.patch
+proc-use-kvzalloc-for-our-kernel-buffer.patch
+csky-fix-a-size-determination-in-gpr_get.patch
+scsi-bnx2fc-fix-kconfig-warning-cnic-build-errors.patch
+scsi-sd-sd_zbc-don-t-pass-gfp_noio-to-kvcalloc.patch
+block-reopen-the-device-in-blkdev_reread_part.patch
+block-fix-logging-on-capacity-change.patch
+ide-falconide-fix-module-unload.patch
--- /dev/null
+From 8e44294bbf5435e26831ceb52843313bf4c04394 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Jan 2021 21:10:25 +0100
+Subject: smp: Process pending softirqs in flush_smp_call_function_from_idle()
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit f9d34595ae4feed38856b88769e2ba5af22d2548 ]
+
+send_call_function_single_ipi() may wake an idle CPU without sending an
+IPI. The woken up CPU will process the SMP-functions in
+flush_smp_call_function_from_idle(). Any raised softirq from within the
+SMP-function call will not be processed.
+Should the CPU have no tasks assigned, then it will go back to idle with
+pending softirqs and the NOHZ will rightfully complain.
+
+Process pending softirqs on return from flush_smp_call_function_queue().
+
+Fixes: b2a02fc43a1f4 ("smp: Optimize send_call_function_single_ipi()")
+Reported-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20210123201027.3262800-2-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/smp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/smp.c b/kernel/smp.c
+index 1b6070bf97bb0..aeb0adfa06063 100644
+--- a/kernel/smp.c
++++ b/kernel/smp.c
+@@ -14,6 +14,7 @@
+ #include <linux/export.h>
+ #include <linux/percpu.h>
+ #include <linux/init.h>
++#include <linux/interrupt.h>
+ #include <linux/gfp.h>
+ #include <linux/smp.h>
+ #include <linux/cpu.h>
+@@ -449,6 +450,9 @@ void flush_smp_call_function_from_idle(void)
+
+ local_irq_save(flags);
+ flush_smp_call_function_queue(true);
++ if (local_softirq_pending())
++ do_softirq();
++
+ local_irq_restore(flags);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From ef34a07fa306829ffeef162092a6f6e2b4d2e62d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 17:17:47 +0800
+Subject: soc: aspeed: snoop: Add clock control logic
+
+From: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+
+[ Upstream commit 3f94cf15583be554df7aaa651b8ff8e1b68fbe51 ]
+
+If LPC SNOOP driver is registered ahead of lpc-ctrl module, LPC
+SNOOP block will be enabled without heart beating of LCLK until
+lpc-ctrl enables the LCLK. This issue causes improper handling on
+host interrupts when the host sends interrupt in that time frame.
+Then kernel eventually forcibly disables the interrupt with
+dumping stack and printing a 'nobody cared this irq' message out.
+
+To prevent this issue, all LPC sub-nodes should enable LCLK
+individually so this patch adds clock control logic into the LPC
+SNOOP driver.
+
+Fixes: 3772e5da4454 ("drivers/misc: Aspeed LPC snoop output using misc chardev")
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@intel.com>
+Signed-off-by: Vernon Mauery <vernon.mauery@linux.intel.com>
+Signed-off-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
+Link: https://lore.kernel.org/r/20201208091748.1920-1-wangzhiqiang.bj@bytedance.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-lpc-snoop.c | 30 ++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-lpc-snoop.c b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+index 682ba0eb4eba1..20acac6342eff 100644
+--- a/drivers/soc/aspeed/aspeed-lpc-snoop.c
++++ b/drivers/soc/aspeed/aspeed-lpc-snoop.c
+@@ -11,6 +11,7 @@
+ */
+
+ #include <linux/bitops.h>
++#include <linux/clk.h>
+ #include <linux/interrupt.h>
+ #include <linux/fs.h>
+ #include <linux/kfifo.h>
+@@ -67,6 +68,7 @@ struct aspeed_lpc_snoop_channel {
+ struct aspeed_lpc_snoop {
+ struct regmap *regmap;
+ int irq;
++ struct clk *clk;
+ struct aspeed_lpc_snoop_channel chan[NUM_SNOOP_CHANNELS];
+ };
+
+@@ -282,22 +284,42 @@ static int aspeed_lpc_snoop_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
++ lpc_snoop->clk = devm_clk_get(dev, NULL);
++ if (IS_ERR(lpc_snoop->clk)) {
++ rc = PTR_ERR(lpc_snoop->clk);
++ if (rc != -EPROBE_DEFER)
++ dev_err(dev, "couldn't get clock\n");
++ return rc;
++ }
++ rc = clk_prepare_enable(lpc_snoop->clk);
++ if (rc) {
++ dev_err(dev, "couldn't enable clock\n");
++ return rc;
++ }
++
+ rc = aspeed_lpc_snoop_config_irq(lpc_snoop, pdev);
+ if (rc)
+- return rc;
++ goto err;
+
+ rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 0, port);
+ if (rc)
+- return rc;
++ goto err;
+
+ /* Configuration of 2nd snoop channel port is optional */
+ if (of_property_read_u32_index(dev->of_node, "snoop-ports",
+ 1, &port) == 0) {
+ rc = aspeed_lpc_enable_snoop(lpc_snoop, dev, 1, port);
+- if (rc)
++ if (rc) {
+ aspeed_lpc_disable_snoop(lpc_snoop, 0);
++ goto err;
++ }
+ }
+
++ return 0;
++
++err:
++ clk_disable_unprepare(lpc_snoop->clk);
++
+ return rc;
+ }
+
+@@ -309,6 +331,8 @@ static int aspeed_lpc_snoop_remove(struct platform_device *pdev)
+ aspeed_lpc_disable_snoop(lpc_snoop, 0);
+ aspeed_lpc_disable_snoop(lpc_snoop, 1);
+
++ clk_disable_unprepare(lpc_snoop->clk);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 4dcae42fe15ccb8288f04661db74911ac1c53dbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Feb 2021 22:16:51 +1030
+Subject: soc: aspeed: socinfo: Add new systems
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit d0e72be77e7995923fac73f27cf7a75d3d1a4dec ]
+
+Aspeed's u-boot sdk has been updated with the SoC IDs for the AST2605
+variant, as well as A2 and A3 variants of the 2600 family.
+
+>From u-boot's arch/arm/mach-aspeed/ast2600/scu_info.c:
+
+ SOC_ID("AST2600-A0", 0x0500030305000303),
+ SOC_ID("AST2600-A1", 0x0501030305010303),
+ SOC_ID("AST2620-A1", 0x0501020305010203),
+ SOC_ID("AST2600-A2", 0x0502030305010303),
+ SOC_ID("AST2620-A2", 0x0502020305010203),
+ SOC_ID("AST2605-A2", 0x0502010305010103),
+ SOC_ID("AST2600-A3", 0x0503030305030303),
+ SOC_ID("AST2620-A3", 0x0503020305030203),
+ SOC_ID("AST2605-A3", 0x0503010305030103),
+
+Fixes: e0218dca5787 ("soc: aspeed: Add soc info driver")
+Link: https://lore.kernel.org/r/20210210114651.334324-1-joel@jms.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/aspeed/aspeed-socinfo.c | 33 ++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/soc/aspeed/aspeed-socinfo.c b/drivers/soc/aspeed/aspeed-socinfo.c
+index 773930e0cb100..e3215f826d17a 100644
+--- a/drivers/soc/aspeed/aspeed-socinfo.c
++++ b/drivers/soc/aspeed/aspeed-socinfo.c
+@@ -25,6 +25,7 @@ static struct {
+ /* AST2600 */
+ { "AST2600", 0x05000303 },
+ { "AST2620", 0x05010203 },
++ { "AST2605", 0x05030103 },
+ };
+
+ static const char *siliconid_to_name(u32 siliconid)
+@@ -43,14 +44,30 @@ static const char *siliconid_to_name(u32 siliconid)
+ static const char *siliconid_to_rev(u32 siliconid)
+ {
+ unsigned int rev = (siliconid >> 16) & 0xff;
+-
+- switch (rev) {
+- case 0:
+- return "A0";
+- case 1:
+- return "A1";
+- case 3:
+- return "A2";
++ unsigned int gen = (siliconid >> 24) & 0xff;
++
++ if (gen < 0x5) {
++ /* AST2500 and below */
++ switch (rev) {
++ case 0:
++ return "A0";
++ case 1:
++ return "A1";
++ case 3:
++ return "A2";
++ }
++ } else {
++ /* AST2600 */
++ switch (rev) {
++ case 0:
++ return "A0";
++ case 1:
++ return "A1";
++ case 2:
++ return "A2";
++ case 3:
++ return "A3";
++ }
+ }
+
+ return "??";
+--
+2.27.0
+
--- /dev/null
+From ec8eee5b1585d05be49c0185c9c70a61ef797f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Jan 2021 15:23:49 +0100
+Subject: soc: qcom: ocmem: don't return NULL in of_get_ocmem
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit 01f937ffc4686837d6c43dea80c6ade6cbd2940a ]
+
+If ocmem probe fails for whatever reason, of_get_ocmem returned NULL.
+Without this, users must check for both NULL and IS_ERR on the returned
+pointer - which didn't happen in drivers/gpu/drm/msm/adreno/adreno_gpu.c
+leading to a NULL pointer dereference.
+
+Reviewed-by: Brian Masney <masneyb@onstation.org>
+Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Link: https://lore.kernel.org/r/20210130142349.53335-1-luca@z3ntu.xyz
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/ocmem.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c
+index 7f9e9944d1eae..f1875dc31ae2c 100644
+--- a/drivers/soc/qcom/ocmem.c
++++ b/drivers/soc/qcom/ocmem.c
+@@ -189,6 +189,7 @@ struct ocmem *of_get_ocmem(struct device *dev)
+ {
+ struct platform_device *pdev;
+ struct device_node *devnode;
++ struct ocmem *ocmem;
+
+ devnode = of_parse_phandle(dev->of_node, "sram", 0);
+ if (!devnode || !devnode->parent) {
+@@ -202,7 +203,12 @@ struct ocmem *of_get_ocmem(struct device *dev)
+ return ERR_PTR(-EPROBE_DEFER);
+ }
+
+- return platform_get_drvdata(pdev);
++ ocmem = platform_get_drvdata(pdev);
++ if (!ocmem) {
++ dev_err(dev, "Cannot get ocmem\n");
++ return ERR_PTR(-ENODEV);
++ }
++ return ocmem;
+ }
+ EXPORT_SYMBOL(of_get_ocmem);
+
+--
+2.27.0
+
--- /dev/null
+From 2aaca96027b1105c024108b1aade91fcf32ad31f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 12:57:55 +0300
+Subject: soc: qcom: socinfo: Fix an off by one in qcom_show_pmic_model()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5fb33d8960dc7abdabc6fe599a30c2c99b082ef6 ]
+
+These need to be < ARRAY_SIZE() instead of <= ARRAY_SIZE() to prevent
+accessing one element beyond the end of the array.
+
+Acked-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Fixes: e9247e2ce577 ("soc: qcom: socinfo: fix printing of pmic_model")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/YAf+o85Z9lgkq3Nw@mwanda
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/socinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
+index d21530d24253e..6daa3c5771d16 100644
+--- a/drivers/soc/qcom/socinfo.c
++++ b/drivers/soc/qcom/socinfo.c
+@@ -286,7 +286,7 @@ static int qcom_show_pmic_model(struct seq_file *seq, void *p)
+ if (model < 0)
+ return -EINVAL;
+
+- if (model <= ARRAY_SIZE(pmic_models) && pmic_models[model])
++ if (model < ARRAY_SIZE(pmic_models) && pmic_models[model])
+ seq_printf(seq, "%s\n", pmic_models[model]);
+ else
+ seq_printf(seq, "unknown (%d)\n", model);
+--
+2.27.0
+
--- /dev/null
+From d45d673c9cd529b649016ee3e43151b287d4fc8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jan 2021 20:51:36 -0800
+Subject: soc: ti: pm33xx: Fix some resource leak in the error handling paths
+ of the probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 17ad4662595ea0c4fd7496b664523ef632e63349 ]
+
+'am33xx_pm_rtc_setup()' allocates some resources that must be freed on the
+error. Commit 2152fbbd47c0 ("soc: ti: pm33xx: Simplify RTC usage to prepare
+to drop platform data") has introduced the use of these resources but has
+only updated the remove function.
+
+Fix the error handling path of the probe function now.
+
+Fixes: 2152fbbd47c0 ("soc: ti: pm33xx: Simplify RTC usage to prepare to drop platform data")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/pm33xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/pm33xx.c b/drivers/soc/ti/pm33xx.c
+index 64f3e31055401..7bab4bbaf02dc 100644
+--- a/drivers/soc/ti/pm33xx.c
++++ b/drivers/soc/ti/pm33xx.c
+@@ -535,7 +535,7 @@ static int am33xx_pm_probe(struct platform_device *pdev)
+
+ ret = am33xx_push_sram_idle();
+ if (ret)
+- goto err_free_sram;
++ goto err_unsetup_rtc;
+
+ am33xx_pm_set_ipc_ops();
+
+@@ -575,6 +575,9 @@ err_pm_runtime_put:
+ err_pm_runtime_disable:
+ pm_runtime_disable(dev);
+ wkup_m3_ipc_put(m3_ipc);
++err_unsetup_rtc:
++ iounmap(rtc_base_virt);
++ clk_put(rtc_fck);
+ err_free_sram:
+ am33xx_pm_free_sram();
+ pm33xx_dev = NULL;
+--
+2.27.0
+
--- /dev/null
+From ef8c175ab4b799817f4751fcbdc28877ab3af2c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:33 +0800
+Subject: soundwire: bus: fix confusion on device used by pm_runtime
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 973794e85610d9a716a897baa9007ff56e192826 ]
+
+Intel stress-tests routinely report IO timeouts and invalid power
+management transitions. Upon further analysis, we seem to be using the
+wrong devices in pm_runtime calls.
+
+Before reading and writing registers, we first need to make sure the
+Slave is fully resumed. The existing code attempts to do such that,
+however because of a confusion dating from 2017 and copy/paste, we
+end-up resuming the parent only instead of resuming the codec device.
+
+This can lead to accesses to the Slave registers while the bus is
+still being configured and the Slave not enumerated, and as a result
+IO errors occur.
+
+This is a classic problem, similar confusions happened for HDaudio
+between bus and codec device, leading to power management issues.
+
+Fix by using the relevant device for all uses of pm_runtime functions.
+
+Fixes: 60ee9be255712 ('soundwire: bus: add PM/no-PM versions of read/write functions')
+Fixes: aa79293517b39 ('soundwire: bus: fix io error when processing alert event')
+Fixes: 9d715fa005ebc ('soundwire: Add IO transfer')
+Reported-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210122070634.12825-9-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 483d5a389c92a..662b3b0302467 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -513,16 +513,16 @@ int sdw_nread(struct sdw_slave *slave, u32 addr, size_t count, u8 *val)
+ {
+ int ret;
+
+- ret = pm_runtime_get_sync(slave->bus->dev);
++ ret = pm_runtime_get_sync(&slave->dev);
+ if (ret < 0 && ret != -EACCES) {
+- pm_runtime_put_noidle(slave->bus->dev);
++ pm_runtime_put_noidle(&slave->dev);
+ return ret;
+ }
+
+ ret = sdw_nread_no_pm(slave, addr, count, val);
+
+- pm_runtime_mark_last_busy(slave->bus->dev);
+- pm_runtime_put(slave->bus->dev);
++ pm_runtime_mark_last_busy(&slave->dev);
++ pm_runtime_put(&slave->dev);
+
+ return ret;
+ }
+@@ -539,16 +539,16 @@ int sdw_nwrite(struct sdw_slave *slave, u32 addr, size_t count, u8 *val)
+ {
+ int ret;
+
+- ret = pm_runtime_get_sync(slave->bus->dev);
++ ret = pm_runtime_get_sync(&slave->dev);
+ if (ret < 0 && ret != -EACCES) {
+- pm_runtime_put_noidle(slave->bus->dev);
++ pm_runtime_put_noidle(&slave->dev);
+ return ret;
+ }
+
+ ret = sdw_nwrite_no_pm(slave, addr, count, val);
+
+- pm_runtime_mark_last_busy(slave->bus->dev);
+- pm_runtime_put(slave->bus->dev);
++ pm_runtime_mark_last_busy(&slave->dev);
++ pm_runtime_put(&slave->dev);
+
+ return ret;
+ }
+@@ -1453,7 +1453,7 @@ static int sdw_handle_slave_alerts(struct sdw_slave *slave)
+ ret = pm_runtime_get_sync(&slave->dev);
+ if (ret < 0 && ret != -EACCES) {
+ dev_err(&slave->dev, "Failed to resume device: %d\n", ret);
+- pm_runtime_put_noidle(slave->bus->dev);
++ pm_runtime_put_noidle(&slave->dev);
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 28aa36dccf74ee877581db71408098e438bb560a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:26 +0800
+Subject: soundwire: bus: use sdw_update_no_pm when initializing a device
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit b04c975e654cfdea6d691cd403b5a81cce7e593d ]
+
+When a Slave device is resumed, it may resume the bus and restart the
+enumeration. During that process, we absolutely don't want to call
+regular read/write routines which will wait for the resume to
+complete, otherwise a deadlock occurs.
+
+Fixes: 60ee9be25571 ('soundwire: bus: add PM/no-PM versions of read/write functions')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210122070634.12825-2-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index d1e8c3a54976b..60c42508c6c6b 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -489,6 +489,18 @@ sdw_read_no_pm(struct sdw_slave *slave, u32 addr)
+ return buf;
+ }
+
++static int sdw_update_no_pm(struct sdw_slave *slave, u32 addr, u8 mask, u8 val)
++{
++ int tmp;
++
++ tmp = sdw_read_no_pm(slave, addr);
++ if (tmp < 0)
++ return tmp;
++
++ tmp = (tmp & ~mask) | val;
++ return sdw_write_no_pm(slave, addr, tmp);
++}
++
+ /**
+ * sdw_nread() - Read "n" contiguous SDW Slave registers
+ * @slave: SDW Slave
+@@ -1256,7 +1268,7 @@ static int sdw_initialize_slave(struct sdw_slave *slave)
+ val = slave->prop.scp_int1_mask;
+
+ /* Enable SCP interrupts */
+- ret = sdw_update(slave, SDW_SCP_INTMASK1, val, val);
++ ret = sdw_update_no_pm(slave, SDW_SCP_INTMASK1, val, val);
+ if (ret < 0) {
+ dev_err(slave->bus->dev,
+ "SDW_SCP_INTMASK1 write failed:%d\n", ret);
+@@ -1271,7 +1283,7 @@ static int sdw_initialize_slave(struct sdw_slave *slave)
+ val = prop->dp0_prop->imp_def_interrupts;
+ val |= SDW_DP0_INT_PORT_READY | SDW_DP0_INT_BRA_FAILURE;
+
+- ret = sdw_update(slave, SDW_DP0_INTMASK, val, val);
++ ret = sdw_update_no_pm(slave, SDW_DP0_INTMASK, val, val);
+ if (ret < 0)
+ dev_err(slave->bus->dev,
+ "SDW_DP0_INTMASK read failed:%d\n", ret);
+--
+2.27.0
+
--- /dev/null
+From f1b3c600b7c2dfe531c079fa0918ec3a0ed3e125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:27 +0800
+Subject: soundwire: bus: use sdw_write_no_pm when setting the bus scale
+ registers
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 299e9780b9196bcb15b26dfdccd3244eb072d560 ]
+
+When a Slave device is resumed, it may resume the bus and restart the
+enumeration. During that process, we absolutely don't want to call
+regular read/write routines which will wait for the resume to
+complete, otherwise a deadlock occurs.
+
+This patch fixes the same problem as the previous one, but is split to
+make the life of linux-stable maintainers less painful.
+
+Fixes: 29d158f90690 ('soundwire: bus: initialize bus clock base and scale registers')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210122070634.12825-3-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index 60c42508c6c6b..b1830032b0522 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -1222,7 +1222,7 @@ static int sdw_slave_set_frequency(struct sdw_slave *slave)
+ }
+ scale_index++;
+
+- ret = sdw_write(slave, SDW_SCP_BUS_CLOCK_BASE, base);
++ ret = sdw_write_no_pm(slave, SDW_SCP_BUS_CLOCK_BASE, base);
+ if (ret < 0) {
+ dev_err(&slave->dev,
+ "SDW_SCP_BUS_CLOCK_BASE write failed:%d\n", ret);
+@@ -1230,13 +1230,13 @@ static int sdw_slave_set_frequency(struct sdw_slave *slave)
+ }
+
+ /* initialize scale for both banks */
+- ret = sdw_write(slave, SDW_SCP_BUSCLOCK_SCALE_B0, scale_index);
++ ret = sdw_write_no_pm(slave, SDW_SCP_BUSCLOCK_SCALE_B0, scale_index);
+ if (ret < 0) {
+ dev_err(&slave->dev,
+ "SDW_SCP_BUSCLOCK_SCALE_B0 write failed:%d\n", ret);
+ return ret;
+ }
+- ret = sdw_write(slave, SDW_SCP_BUSCLOCK_SCALE_B1, scale_index);
++ ret = sdw_write_no_pm(slave, SDW_SCP_BUSCLOCK_SCALE_B1, scale_index);
+ if (ret < 0)
+ dev_err(&slave->dev,
+ "SDW_SCP_BUSCLOCK_SCALE_B1 write failed:%d\n", ret);
+--
+2.27.0
+
--- /dev/null
+From e30d1a8f3ccf9a619bf970b45ec060b5370fb490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 13:37:37 +0800
+Subject: soundwire: cadence: fix ACK/NAK handling
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit db9d9f944f95e7f3aa60ac00cbd502415152c421 ]
+
+The existing code reports a NAK only when ACK=0
+This is not aligned with the SoundWire 1.x specifications.
+
+Table 32 in the SoundWire 1.2 specification shows that a Device shall
+not set NAK=1 if ACK=1. But Table 33 shows the Combined Response
+may very well be NAK=1/ACK=1, e.g. if another Device than the one
+addressed reports a parity error.
+
+NAK=1 signals a 'Command_Aborted', regardless of the ACK bit value.
+
+Move the tests for NAK so that the NAK=1/ACK=1 combination is properly
+detected according to the specification.
+
+Fixes: 956baa1992f9a ('soundwire: cdns: Add sdw_master_ops and IO transfer support')
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115053738.22630-5-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/cadence_master.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soundwire/cadence_master.c b/drivers/soundwire/cadence_master.c
+index 9fa55164354a2..580660599f461 100644
+--- a/drivers/soundwire/cadence_master.c
++++ b/drivers/soundwire/cadence_master.c
+@@ -484,10 +484,10 @@ cdns_fill_msg_resp(struct sdw_cdns *cdns,
+ if (!(cdns->response_buf[i] & CDNS_MCP_RESP_ACK)) {
+ no_ack = 1;
+ dev_dbg_ratelimited(cdns->dev, "Msg Ack not received\n");
+- if (cdns->response_buf[i] & CDNS_MCP_RESP_NACK) {
+- nack = 1;
+- dev_err_ratelimited(cdns->dev, "Msg NACK received\n");
+- }
++ }
++ if (cdns->response_buf[i] & CDNS_MCP_RESP_NACK) {
++ nack = 1;
++ dev_err_ratelimited(cdns->dev, "Msg NACK received\n");
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From eeb2e7e71fde89978f8fb0c1e38322dae2c6cf91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 16:25:59 +0000
+Subject: soundwire: debugfs: use controller id instead of link_id
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 6d5e7af1f6f5924de5dd1ebe97675c2363100878 ]
+
+link_id can be zero and if we have multiple controller instances
+in a system like Qualcomm debugfs will end-up with duplicate namespace
+resulting in incorrect debugfs entries.
+
+Using id should give a unique debugfs directory entry and should fix below
+warning too.
+"debugfs: Directory 'master-0' with parent 'soundwire' already present!"
+
+Fixes: bf03473d5bcc ("soundwire: add debugfs support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210115162559.20869-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c
+index b6cad0d59b7b9..5f9efa42bb25b 100644
+--- a/drivers/soundwire/debugfs.c
++++ b/drivers/soundwire/debugfs.c
+@@ -19,7 +19,7 @@ void sdw_bus_debugfs_init(struct sdw_bus *bus)
+ return;
+
+ /* create the debugfs master-N */
+- snprintf(name, sizeof(name), "master-%d", bus->link_id);
++ snprintf(name, sizeof(name), "master-%d", bus->id);
+ bus->debugfs = debugfs_create_dir(name, sdw_debugfs_root);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From d0285622bd45f710de017d0bcd6061a207adf2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 15:06:29 +0800
+Subject: soundwire: export sdw_write/read_no_pm functions
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 167790abb90fa073d8341ee0e408ccad3d2109cd ]
+
+sdw_write_no_pm and sdw_read_no_pm are useful when we want to do IO
+without touching PM.
+
+Fixes: 0231453bc08f ('soundwire: bus: add clock stop helpers')
+Fixes: 60ee9be25571 ('soundwire: bus: add PM/no-PM versions of read/write functions')
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20210122070634.12825-5-yung-chuan.liao@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/bus.c | 7 ++++---
+ include/linux/soundwire/sdw.h | 2 ++
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
+index b1830032b0522..483d5a389c92a 100644
+--- a/drivers/soundwire/bus.c
++++ b/drivers/soundwire/bus.c
+@@ -405,10 +405,11 @@ sdw_nwrite_no_pm(struct sdw_slave *slave, u32 addr, size_t count, u8 *val)
+ return sdw_transfer(slave->bus, &msg);
+ }
+
+-static int sdw_write_no_pm(struct sdw_slave *slave, u32 addr, u8 value)
++int sdw_write_no_pm(struct sdw_slave *slave, u32 addr, u8 value)
+ {
+ return sdw_nwrite_no_pm(slave, addr, 1, &value);
+ }
++EXPORT_SYMBOL(sdw_write_no_pm);
+
+ static int
+ sdw_bread_no_pm(struct sdw_bus *bus, u16 dev_num, u32 addr)
+@@ -476,8 +477,7 @@ int sdw_bwrite_no_pm_unlocked(struct sdw_bus *bus, u16 dev_num, u32 addr, u8 val
+ }
+ EXPORT_SYMBOL(sdw_bwrite_no_pm_unlocked);
+
+-static int
+-sdw_read_no_pm(struct sdw_slave *slave, u32 addr)
++int sdw_read_no_pm(struct sdw_slave *slave, u32 addr)
+ {
+ u8 buf;
+ int ret;
+@@ -488,6 +488,7 @@ sdw_read_no_pm(struct sdw_slave *slave, u32 addr)
+ else
+ return buf;
+ }
++EXPORT_SYMBOL(sdw_read_no_pm);
+
+ static int sdw_update_no_pm(struct sdw_slave *slave, u32 addr, u8 mask, u8 val)
+ {
+diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h
+index f0b01b728640d..d08039d65825e 100644
+--- a/include/linux/soundwire/sdw.h
++++ b/include/linux/soundwire/sdw.h
+@@ -1005,6 +1005,8 @@ int sdw_bus_exit_clk_stop(struct sdw_bus *bus);
+
+ int sdw_read(struct sdw_slave *slave, u32 addr);
+ int sdw_write(struct sdw_slave *slave, u32 addr, u8 value);
++int sdw_write_no_pm(struct sdw_slave *slave, u32 addr, u8 value);
++int sdw_read_no_pm(struct sdw_slave *slave, u32 addr);
+ int sdw_nread(struct sdw_slave *slave, u32 addr, size_t count, u8 *val);
+ int sdw_nwrite(struct sdw_slave *slave, u32 addr, size_t count, u8 *val);
+
+--
+2.27.0
+
--- /dev/null
+From 730f4cfd7bd67b050ad40b9f37e416203eeb5adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 16:48:00 -0800
+Subject: sparc: fix led.c driver when PROC_FS is not enabled
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit b3554aa2470b5db1222c31e08ec9c29ab33eabc7 ]
+
+Fix Sparc build when CONFIG_PROC_FS is not enabled.
+
+Fixes this build error:
+arch/sparc/kernel/led.c:107:30: error: 'led_proc_ops' defined but not used [-Werror=unused-const-variable=]
+ 107 | static const struct proc_ops led_proc_ops = {
+ | ^~~~~~~~~~~~
+ cc1: all warnings being treated as errors
+
+Fixes: 97a32539b956 ("proc: convert everything to "struct proc_ops"")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Lars Kotthoff <metalhead@metalhead.ws>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: sparclinux@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/led.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/sparc/kernel/led.c b/arch/sparc/kernel/led.c
+index bd48575172c32..3a66e62eb2a0e 100644
+--- a/arch/sparc/kernel/led.c
++++ b/arch/sparc/kernel/led.c
+@@ -50,6 +50,7 @@ static void led_blink(struct timer_list *unused)
+ add_timer(&led_blink_timer);
+ }
+
++#ifdef CONFIG_PROC_FS
+ static int led_proc_show(struct seq_file *m, void *v)
+ {
+ if (get_auxio() & AUXIO_LED)
+@@ -111,6 +112,7 @@ static const struct proc_ops led_proc_ops = {
+ .proc_release = single_release,
+ .proc_write = led_proc_write,
+ };
++#endif
+
+ static struct proc_dir_entry *led;
+
+--
+2.27.0
+
--- /dev/null
+From ad7dc6f04d17c98ffb459c5f29d2237b689841a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 16:40:11 -0800
+Subject: sparc64: only select COMPAT_BINFMT_ELF if BINFMT_ELF is set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 80bddf5c93a99e11fc9faf7e4b575d01cecd45d3 ]
+
+Currently COMPAT on SPARC64 selects COMPAT_BINFMT_ELF unconditionally,
+even when BINFMT_ELF is not enabled. This causes a kconfig warning.
+
+Instead, just select COMPAT_BINFMT_ELF if BINFMT_ELF is enabled.
+This builds cleanly with no kconfig warnings.
+
+WARNING: unmet direct dependencies detected for COMPAT_BINFMT_ELF
+ Depends on [n]: COMPAT [=y] && BINFMT_ELF [=n]
+ Selected by [y]:
+ - COMPAT [=y] && SPARC64 [=y]
+
+Fixes: 26b4c912185a ("sparc,sparc64: unify Kconfig files")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: sparclinux@vger.kernel.org
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index c9c34dc52b7d8..639dde28124a2 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -494,7 +494,7 @@ config COMPAT
+ bool
+ depends on SPARC64
+ default y
+- select COMPAT_BINFMT_ELF
++ select COMPAT_BINFMT_ELF if BINFMT_ELF
+ select HAVE_UID16
+ select ARCH_WANT_OLD_COMPAT_IPC
+ select COMPAT_OLD_SIGACTION
+--
+2.27.0
+
--- /dev/null
+From 0ae43568c7dc98de09735c703dfa0dd41942f7cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 21:00:25 -0800
+Subject: spi: atmel: Put allocated master before return
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 21ea2743f015dbacec1831bdc8afc848db9c2b8c ]
+
+The allocated master is not released. Goto error handling label rather
+than directly return.
+
+Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Fixes: 5e9af37e46bc ("spi: atmel: introduce probe deferring")
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20210120050025.25426-1-bianpan2016@163.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-atmel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 948396b382d73..f429436082afa 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1590,7 +1590,7 @@ static int atmel_spi_probe(struct platform_device *pdev)
+ if (ret == 0) {
+ as->use_dma = true;
+ } else if (ret == -EPROBE_DEFER) {
+- return ret;
++ goto out_unmap_regs;
+ }
+ } else if (as->caps.has_pdc_support) {
+ as->use_pdc = true;
+--
+2.27.0
+
--- /dev/null
+From 3c38fb570f2cf3c145c71fa2000e2aa2497e6276 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Dec 2020 00:14:20 +0530
+Subject: spi: cadence-quadspi: Abort read if dummy cycles required are too
+ many
+
+From: Pratyush Yadav <p.yadav@ti.com>
+
+[ Upstream commit ceeda328edeeeeac7579e9dbf0610785a3b83d39 ]
+
+The controller can only support up to 31 dummy cycles. If the command
+requires more it falls back to using 31. This command is likely to fail
+because the correct number of cycles are not waited upon. Rather than
+silently issuing an incorrect command, fail loudly so the caller can get
+a chance to find out the command can't be supported by the controller.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Pratyush Yadav <p.yadav@ti.com>
+Link: https://lore.kernel.org/r/20201222184425.7028-3-p.yadav@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index ba7d40c2922f7..826b01f346246 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -461,7 +461,7 @@ static int cqspi_read_setup(struct cqspi_flash_pdata *f_pdata,
+ /* Setup dummy clock cycles */
+ dummy_clk = op->dummy.nbytes * 8;
+ if (dummy_clk > CQSPI_DUMMY_CLKS_MAX)
+- dummy_clk = CQSPI_DUMMY_CLKS_MAX;
++ return -EOPNOTSUPP;
+
+ if (dummy_clk)
+ reg |= (dummy_clk & CQSPI_REG_RD_INSTR_DUMMY_MASK)
+--
+2.27.0
+
--- /dev/null
+From 207287a2ee4415d74bfdc74a0112b33f89b0daa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 12:37:14 -0800
+Subject: spi: dw: Avoid stack content exposure
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 386f771aad15dd535f2368b4adc9958c0160edd4 ]
+
+Since "data" is u32, &data is a "u32 *" type, which means pointer math
+will move in u32-sized steps. This was meant to be a byte offset, so
+cast &data to "char *" to aim the copy into the correct location.
+
+Seen with -Warray-bounds (and found by Coverity):
+
+In file included from ./include/linux/string.h:269,
+ from ./arch/powerpc/include/asm/paca.h:15,
+ from ./arch/powerpc/include/asm/current.h:13,
+ from ./include/linux/mutex.h:14,
+ from ./include/linux/notifier.h:14,
+ from ./include/linux/clk.h:14,
+ from drivers/spi/spi-dw-bt1.c:12:
+In function 'memcpy',
+ inlined from 'dw_spi_bt1_dirmap_copy_from_map' at drivers/spi/spi-dw-bt1.c:87:3:
+./include/linux/fortify-string.h:20:29: warning: '__builtin_memcpy' offset 4 is out of the bounds [0, 4] of object 'data' with type 'u32' {aka 'unsigned int'} [-Warray-bounds]
+ 20 | #define __underlying_memcpy __builtin_memcpy
+ | ^
+./include/linux/fortify-string.h:191:9: note: in expansion of macro '__underlying_memcpy'
+ 191 | return __underlying_memcpy(p, q, size);
+ | ^~~~~~~~~~~~~~~~~~~
+drivers/spi/spi-dw-bt1.c: In function 'dw_spi_bt1_dirmap_copy_from_map':
+drivers/spi/spi-dw-bt1.c:77:6: note: 'data' declared here
+ 77 | u32 data;
+ | ^~~~
+
+Addresses-Coverity: CID 1497771 Out-of-bounds access
+Fixes: abf00907538e ("spi: dw: Add Baikal-T1 SPI Controller glue driver")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Link: https://lore.kernel.org/r/20210211203714.1929862-1-keescook@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-dw-bt1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-dw-bt1.c b/drivers/spi/spi-dw-bt1.c
+index 4aa8596fb1f2b..5be6b7b80c21b 100644
+--- a/drivers/spi/spi-dw-bt1.c
++++ b/drivers/spi/spi-dw-bt1.c
+@@ -84,7 +84,7 @@ static void dw_spi_bt1_dirmap_copy_from_map(void *to, void __iomem *from, size_t
+ if (shift) {
+ chunk = min_t(size_t, 4 - shift, len);
+ data = readl_relaxed(from - shift);
+- memcpy(to, &data + shift, chunk);
++ memcpy(to, (char *)&data + shift, chunk);
+ from += chunk;
+ to += chunk;
+ len -= chunk;
+--
+2.27.0
+
--- /dev/null
+From 03e11bf71dfcf82cbe4821d1c44b87f3d3f722e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 17:31:10 +0100
+Subject: spi: imx: Don't print error on -EPROBEDEFER
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guido Günther <agx@sigxcpu.org>
+
+[ Upstream commit 8346633f2c87713a1852d802305e03555e9a9fce ]
+
+This avoids
+
+[ 0.962538] spi_imx 30820000.spi: bitbang start failed with -517
+
+durig driver probe.
+
+Fixes: 8197f489f4c4 ("spi: imx: Fix failure path leak on GPIO request error correctly")
+Signed-off-by: Guido Günther <agx@sigxcpu.org>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Link: https://lore.kernel.org/r/0f51ab42e7c7a3452f2f8652794d81584303ea0d.1610987414.git.agx@sigxcpu.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 73ca821763d69..5dc4ea4b4450e 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1685,7 +1685,7 @@ static int spi_imx_probe(struct platform_device *pdev)
+ master->dev.of_node = pdev->dev.of_node;
+ ret = spi_bitbang_start(&spi_imx->bitbang);
+ if (ret) {
+- dev_err(&pdev->dev, "bitbang start failed with %d\n", ret);
++ dev_err_probe(&pdev->dev, ret, "bitbang start failed\n");
+ goto out_bitbang_start;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From e45f62c5182cda2e9f785ad11becfd1cb9ba7fd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 18:38:15 +0200
+Subject: spi: pxa2xx: Fix the controller numbering for Wildcat Point
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 54c5d3bfb0cfb7b31259765524567871dee11615 ]
+
+Wildcat Point has two SPI controllers and added one is actually second one.
+Fix the numbering by adding the description of the first one.
+
+Fixes: caba248db286 ("spi: spi-pxa2xx-pci: Add ID and driver type for WildcatPoint PCH")
+Cc: Leif Liddy <leif.liddy@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210208163816.22147-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx-pci.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
+index f236e3034cf85..aafac128bb5f1 100644
+--- a/drivers/spi/spi-pxa2xx-pci.c
++++ b/drivers/spi/spi-pxa2xx-pci.c
+@@ -21,7 +21,8 @@ enum {
+ PORT_BSW1,
+ PORT_BSW2,
+ PORT_CE4100,
+- PORT_LPT,
++ PORT_LPT0,
++ PORT_LPT1,
+ };
+
+ struct pxa_spi_info {
+@@ -57,8 +58,10 @@ static struct dw_dma_slave bsw1_rx_param = { .src_id = 7 };
+ static struct dw_dma_slave bsw2_tx_param = { .dst_id = 8 };
+ static struct dw_dma_slave bsw2_rx_param = { .src_id = 9 };
+
+-static struct dw_dma_slave lpt_tx_param = { .dst_id = 0 };
+-static struct dw_dma_slave lpt_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt1_tx_param = { .dst_id = 0 };
++static struct dw_dma_slave lpt1_rx_param = { .src_id = 1 };
++static struct dw_dma_slave lpt0_tx_param = { .dst_id = 2 };
++static struct dw_dma_slave lpt0_rx_param = { .src_id = 3 };
+
+ static bool lpss_dma_filter(struct dma_chan *chan, void *param)
+ {
+@@ -185,12 +188,19 @@ static struct pxa_spi_info spi_info_configs[] = {
+ .num_chipselect = 1,
+ .max_clk_rate = 50000000,
+ },
+- [PORT_LPT] = {
++ [PORT_LPT0] = {
+ .type = LPSS_LPT_SSP,
+ .port_id = 0,
+ .setup = lpss_spi_setup,
+- .tx_param = &lpt_tx_param,
+- .rx_param = &lpt_rx_param,
++ .tx_param = &lpt0_tx_param,
++ .rx_param = &lpt0_rx_param,
++ },
++ [PORT_LPT1] = {
++ .type = LPSS_LPT_SSP,
++ .port_id = 1,
++ .setup = lpss_spi_setup,
++ .tx_param = &lpt1_tx_param,
++ .rx_param = &lpt1_rx_param,
+ },
+ };
+
+@@ -285,8 +295,9 @@ static const struct pci_device_id pxa2xx_spi_pci_devices[] = {
+ { PCI_VDEVICE(INTEL, 0x2290), PORT_BSW1 },
+ { PCI_VDEVICE(INTEL, 0x22ac), PORT_BSW2 },
+ { PCI_VDEVICE(INTEL, 0x2e6a), PORT_CE4100 },
+- { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT },
+- { },
++ { PCI_VDEVICE(INTEL, 0x9ce5), PORT_LPT0 },
++ { PCI_VDEVICE(INTEL, 0x9ce6), PORT_LPT1 },
++ { }
+ };
+ MODULE_DEVICE_TABLE(pci, pxa2xx_spi_pci_devices);
+
+--
+2.27.0
+
--- /dev/null
+From 09a79c83558ecbbc524439d70de3d7fe668f17b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 19:08:20 +0100
+Subject: spi: Skip zero-length transfers in spi_transfer_one_message()
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit b306320322c9cfaa465bc2c7367acf6072b1ac0e ]
+
+With the introduction of 26751de25d25 ("spi: bcm2835: Micro-optimise
+FIFO loops") it has become apparent that some users might initiate
+zero-length SPI transfers. A fact the micro-optimization omitted, and
+which turned out to cause crashes[1].
+
+Instead of changing the micro-optimization itself, use a bigger hammer
+and skip zero-length transfers altogether for drivers using the default
+transfer_one_message() implementation.
+
+Reported-by: Phil Elwell <phil@raspberrypi.com>
+Fixes: 26751de25d25 ("spi: bcm2835: Micro-optimise FIFO loops")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[1] https://github.com/raspberrypi/linux/issues/4100
+Link: https://lore.kernel.org/r/20210211180820.25757-1-nsaenzjulienne@suse.de
+
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 720ab34784c1d..ccca3a7409fac 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1267,7 +1267,7 @@ static int spi_transfer_one_message(struct spi_controller *ctlr,
+ ptp_read_system_prets(xfer->ptp_sts);
+ }
+
+- if (xfer->tx_buf || xfer->rx_buf) {
++ if ((xfer->tx_buf || xfer->rx_buf) && xfer->len) {
+ reinit_completion(&ctlr->xfer_completion);
+
+ fallback_pio:
+--
+2.27.0
+
--- /dev/null
+From ae5fafd7811bca57add7f6c407cd255e2d1f2ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Feb 2021 19:59:25 +0100
+Subject: spi: stm32: properly handle 0 byte transfer
+
+From: Alain Volmat <alain.volmat@foss.st.com>
+
+[ Upstream commit 2269f5a8b1a7b38651d62676b98182828f29d11a ]
+
+On 0 byte transfer request, return straight from the
+xfer function after finalizing the transfer.
+
+Fixes: dcbe0d84dfa5 ("spi: add driver for STM32 SPI controller")
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://lore.kernel.org/r/1612551572-495-2-git-send-email-alain.volmat@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
+index 6017209c6d2f7..6eeb39669a866 100644
+--- a/drivers/spi/spi-stm32.c
++++ b/drivers/spi/spi-stm32.c
+@@ -1677,6 +1677,10 @@ static int stm32_spi_transfer_one(struct spi_master *master,
+ struct stm32_spi *spi = spi_master_get_devdata(master);
+ int ret;
+
++ /* Don't do anything on 0 bytes transfers */
++ if (transfer->len == 0)
++ return 0;
++
+ spi->tx_buf = transfer->tx_buf;
+ spi->rx_buf = transfer->rx_buf;
+ spi->tx_len = spi->tx_buf ? transfer->len : 0;
+--
+2.27.0
+
--- /dev/null
+From 9c6f7265834a57fe94a9c5ca786a115a2e67af14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 19:11:50 +0100
+Subject: staging: media: atomisp: Fix size_t format specifier in hmm_alloc()
+ debug statemenet
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Borislav Petkov <bp@suse.de>
+
+[ Upstream commit bfe21ef195a9f2785747e698dfd19f75554e2d91 ]
+
+Fix this build warning on 32-bit:
+
+ drivers/staging/media/atomisp/pci/hmm/hmm.c: In function ‘hmm_alloc’:
+ drivers/staging/media/atomisp/pci/hmm/hmm.c:272:3: warning: format ‘%ld’ \
+ expects argument of type ‘long int’, but argument 6 has type ‘size_t {aka unsigned int}’ [-Wformat=]
+ "%s: pages: 0x%08x (%ld bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
+ ^
+
+Fixes: 03884c93560c ("media: atomisp: add debug for hmm alloc")
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lore.kernel.org/r/20201126181150.10576-1-bp@alien8.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/pci/hmm/hmm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm.c b/drivers/staging/media/atomisp/pci/hmm/hmm.c
+index e0eaff0f8a228..6a5ee46070898 100644
+--- a/drivers/staging/media/atomisp/pci/hmm/hmm.c
++++ b/drivers/staging/media/atomisp/pci/hmm/hmm.c
+@@ -269,7 +269,7 @@ ia_css_ptr hmm_alloc(size_t bytes, enum hmm_bo_type type,
+ hmm_set(bo->start, 0, bytes);
+
+ dev_dbg(atomisp_dev,
+- "%s: pages: 0x%08x (%ld bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
++ "%s: pages: 0x%08x (%zu bytes), type: %d from highmem %d, user ptr %p, cached %d\n",
+ __func__, bo->start, bytes, type, from_highmem, userptr, cached);
+
+ return bo->start;
+--
+2.27.0
+
--- /dev/null
+From 68c637b4eac89b964443fdafd42959bc2f681c88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jan 2021 22:14:01 +0800
+Subject: staging: rtl8723bs: wifi_regd.c: Fix incorrect number of regulatory
+ rules
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 61834c967a929f6b4b7fcb91f43fa225cc29aa19 ]
+
+The custom regulatory ruleset in the rtl8723bs driver lists an incorrect
+number of rules: one too many. This results in an out-of-bounds access,
+as detected by KASAN. This was possible thanks to the newly added support
+for KASAN on ARMv7.
+
+Fix this by filling in the correct number of rules given.
+
+KASAN report:
+
+==================================================================
+BUG: KASAN: global-out-of-bounds in cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211]
+Read of size 4 at addr bf20c254 by task ip/971
+
+CPU: 2 PID: 971 Comm: ip Tainted: G C 5.11.0-rc2-00020-gf7fe528a7ebe #1
+Hardware name: Allwinner sun8i Family
+[<c0113338>] (unwind_backtrace) from [<c010e8a4>] (show_stack+0x10/0x14)
+[<c010e8a4>] (show_stack) from [<c0e0f868>] (dump_stack+0x9c/0xb4)
+[<c0e0f868>] (dump_stack) from [<c0388284>] (print_address_description.constprop.2+0x1dc/0x2dc)
+[<c0388284>] (print_address_description.constprop.2) from [<c03885cc>] (kasan_report+0x1a8/0x1c4)
+[<c03885cc>] (kasan_report) from [<bf00a354>] (cfg80211_does_bw_fit_range+0x14/0x4c [cfg80211])
+[<bf00a354>] (cfg80211_does_bw_fit_range [cfg80211]) from [<bf00b41c>] (freq_reg_info_regd.part.6+0x108/0x124 [>
+[<bf00b41c>] (freq_reg_info_regd.part.6 [cfg80211]) from [<bf00df00>] (handle_channel_custom.constprop.12+0x48/>
+[<bf00df00>] (handle_channel_custom.constprop.12 [cfg80211]) from [<bf00e150>] (wiphy_apply_custom_regulatory+0>
+[<bf00e150>] (wiphy_apply_custom_regulatory [cfg80211]) from [<bf1fb9e8>] (rtw_regd_init+0x60/0x70 [r8723bs])
+[<bf1fb9e8>] (rtw_regd_init [r8723bs]) from [<bf1ee5a8>] (rtw_cfg80211_init_wiphy+0x164/0x1e8 [r8723bs])
+[<bf1ee5a8>] (rtw_cfg80211_init_wiphy [r8723bs]) from [<bf1f8d50>] (_netdev_open+0xe4/0x28c [r8723bs])
+[<bf1f8d50>] (_netdev_open [r8723bs]) from [<bf1f8f58>] (netdev_open+0x60/0x88 [r8723bs])
+[<bf1f8f58>] (netdev_open [r8723bs]) from [<c0bb3730>] (__dev_open+0x178/0x220)
+[<c0bb3730>] (__dev_open) from [<c0bb3cdc>] (__dev_change_flags+0x258/0x2c4)
+[<c0bb3cdc>] (__dev_change_flags) from [<c0bb3d88>] (dev_change_flags+0x40/0x80)
+[<c0bb3d88>] (dev_change_flags) from [<c0bc86fc>] (do_setlink+0x538/0x1160)
+[<c0bc86fc>] (do_setlink) from [<c0bcf9e8>] (__rtnl_newlink+0x65c/0xad8)
+[<c0bcf9e8>] (__rtnl_newlink) from [<c0bcfeb0>] (rtnl_newlink+0x4c/0x6c)
+[<c0bcfeb0>] (rtnl_newlink) from [<c0bc67c8>] (rtnetlink_rcv_msg+0x1f8/0x454)
+[<c0bc67c8>] (rtnetlink_rcv_msg) from [<c0c330e4>] (netlink_rcv_skb+0xc4/0x1e0)
+[<c0c330e4>] (netlink_rcv_skb) from [<c0c32478>] (netlink_unicast+0x2c8/0x3c4)
+[<c0c32478>] (netlink_unicast) from [<c0c32894>] (netlink_sendmsg+0x320/0x5f0)
+[<c0c32894>] (netlink_sendmsg) from [<c0b75eb0>] (____sys_sendmsg+0x320/0x3e0)
+[<c0b75eb0>] (____sys_sendmsg) from [<c0b78394>] (___sys_sendmsg+0xe8/0x12c)
+[<c0b78394>] (___sys_sendmsg) from [<c0b78a50>] (__sys_sendmsg+0xc0/0x120)
+[<c0b78a50>] (__sys_sendmsg) from [<c0100060>] (ret_fast_syscall+0x0/0x58)
+Exception stack(0xc5693fa8 to 0xc5693ff0)
+3fa0: 00000074 c7a39800 00000003 b6cee648 00000000 00000000
+3fc0: 00000074 c7a39800 00000001 00000128 78d18349 00000000 b6ceeda0 004f7cb0
+3fe0: 00000128 b6cee5e8 aeca151f aec1d746
+
+The buggy address belongs to the variable:
+ rtw_drv_halt+0xf908/0x6b4 [r8723bs]
+
+Memory state around the buggy address:
+ bf20c100: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
+ bf20c180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>bf20c200: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
+ ^
+ bf20c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ bf20c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+==================================================================
+
+Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20210108141401.31741-1-wens@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8723bs/os_dep/wifi_regd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+index 2833fc6901e6e..3f04b7a954ba0 100644
+--- a/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
++++ b/drivers/staging/rtl8723bs/os_dep/wifi_regd.c
+@@ -34,7 +34,7 @@
+ NL80211_RRF_PASSIVE_SCAN)
+
+ static const struct ieee80211_regdomain rtw_regdom_rd = {
+- .n_reg_rules = 3,
++ .n_reg_rules = 2,
+ .alpha2 = "99",
+ .reg_rules = {
+ RTW_2GHZ_CH01_11,
+--
+2.27.0
+
--- /dev/null
+From 664924181d5b46127fe0e697fb78735a3b9b8751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 16:20:29 +0000
+Subject: staging: vchiq: Fix bulk transfers on 64-bit builds
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 88753cc19f087abe0d39644b844e67a59cfb5a3d ]
+
+The recent change to the bulk transfer compat function missed the fact
+the relevant ioctl command is VCHIQ_IOC_QUEUE_BULK_TRANSMIT32, not
+VCHIQ_IOC_QUEUE_BULK_TRANSMIT, as any attempt to send a bulk block
+to the VPU would have shown.
+
+Fixes: a4367cd2b231 ("staging: vchiq: convert compat bulk transfer")
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Link: https://lore.kernel.org/r/20210105162030.1415213-3-phil@raspberrypi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index 2a8883673ba11..2ca5805b2fce0 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -1717,7 +1717,7 @@ vchiq_compat_ioctl_queue_bulk(struct file *file,
+ {
+ struct vchiq_queue_bulk_transfer32 args32;
+ struct vchiq_queue_bulk_transfer args;
+- enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT) ?
++ enum vchiq_bulk_dir dir = (cmd == VCHIQ_IOC_QUEUE_BULK_TRANSMIT32) ?
+ VCHIQ_BULK_TRANSMIT : VCHIQ_BULK_RECEIVE;
+
+ if (copy_from_user(&args32, argp, sizeof(args32)))
+--
+2.27.0
+
--- /dev/null
+From 98aaa96d59f063f87192213309cd88f62f1a9c42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 16:20:28 +0000
+Subject: staging: vchiq: Fix bulk userdata handling
+
+From: Phil Elwell <phil@raspberrypi.com>
+
+[ Upstream commit 96ae327678eceabf455b11a88ba14ad540d4b046 ]
+
+The addition of the local 'userdata' pointer to
+vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
+WAITING modes are used, in which case the value provided by the
+caller is not returned to them as expected, but instead it is replaced
+with a NULL. This lack of a suitable context may cause the application
+to crash or otherwise malfunction.
+
+Fixes: 4184da4f316a ("staging: vchiq: fix __user annotations")
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Link: https://lore.kernel.org/r/20210105162030.1415213-2-phil@raspberrypi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+index f500a70438056..2a8883673ba11 100644
+--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
+@@ -958,7 +958,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
+ struct vchiq_service *service;
+ struct bulk_waiter_node *waiter = NULL;
+ bool found = false;
+- void *userdata = NULL;
++ void *userdata;
+ int status = 0;
+ int ret;
+
+@@ -997,6 +997,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
+ "found bulk_waiter %pK for pid %d", waiter,
+ current->pid);
+ userdata = &waiter->bulk_waiter;
++ } else {
++ userdata = args->userdata;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 2bbf4dab44c30daca2f9db971bb71ec4ce0a8492 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 14:52:54 +0100
+Subject: staging: wfx: fix possible panic with re-queued frames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Pouiller <jerome.pouiller@silabs.com>
+
+[ Upstream commit 26df933d9b83ea668304dc4ec641d52ea1fc4091 ]
+
+When the firmware rejects a frame (because station become asleep or
+disconnected), the frame is re-queued in mac80211. However, the
+re-queued frame was 8 bytes longer than the original one (the size of
+the ICV for the encryption). So, when mac80211 try to send this frame
+again, it is a little bigger than expected.
+If the frame is re-queued secveral time it end with a skb_over_panic
+because the skb buffer is not large enough.
+
+Note it only happens when device acts as an AP and encryption is
+enabled.
+
+This patch more or less reverts the commit 049fde130419 ("staging: wfx:
+drop useless field from struct wfx_tx_priv").
+
+Fixes: 049fde130419 ("staging: wfx: drop useless field from struct wfx_tx_priv")
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Link: https://lore.kernel.org/r/20210208135254.399964-1-Jerome.Pouiller@silabs.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/wfx/data_tx.c | 10 +++++++++-
+ drivers/staging/wfx/data_tx.h | 1 +
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/wfx/data_tx.c b/drivers/staging/wfx/data_tx.c
+index 36b36ef39d053..77fb104efdec1 100644
+--- a/drivers/staging/wfx/data_tx.c
++++ b/drivers/staging/wfx/data_tx.c
+@@ -331,6 +331,7 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta,
+ {
+ struct hif_msg *hif_msg;
+ struct hif_req_tx *req;
++ struct wfx_tx_priv *tx_priv;
+ struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+ struct ieee80211_key_conf *hw_key = tx_info->control.hw_key;
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+@@ -344,11 +345,14 @@ static int wfx_tx_inner(struct wfx_vif *wvif, struct ieee80211_sta *sta,
+
+ // From now tx_info->control is unusable
+ memset(tx_info->rate_driver_data, 0, sizeof(struct wfx_tx_priv));
++ // Fill tx_priv
++ tx_priv = (struct wfx_tx_priv *)tx_info->rate_driver_data;
++ tx_priv->icv_size = wfx_tx_get_icv_len(hw_key);
+
+ // Fill hif_msg
+ WARN(skb_headroom(skb) < wmsg_len, "not enough space in skb");
+ WARN(offset & 1, "attempt to transmit an unaligned frame");
+- skb_put(skb, wfx_tx_get_icv_len(hw_key));
++ skb_put(skb, tx_priv->icv_size);
+ skb_push(skb, wmsg_len);
+ memset(skb->data, 0, wmsg_len);
+ hif_msg = (struct hif_msg *)skb->data;
+@@ -484,6 +488,7 @@ static void wfx_tx_fill_rates(struct wfx_dev *wdev,
+
+ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
+ {
++ const struct wfx_tx_priv *tx_priv;
+ struct ieee80211_tx_info *tx_info;
+ struct wfx_vif *wvif;
+ struct sk_buff *skb;
+@@ -495,6 +500,7 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
+ return;
+ }
+ tx_info = IEEE80211_SKB_CB(skb);
++ tx_priv = wfx_skb_tx_priv(skb);
+ wvif = wdev_to_wvif(wdev, ((struct hif_msg *)skb->data)->interface);
+ WARN_ON(!wvif);
+ if (!wvif)
+@@ -503,6 +509,8 @@ void wfx_tx_confirm_cb(struct wfx_dev *wdev, const struct hif_cnf_tx *arg)
+ // Note that wfx_pending_get_pkt_us_delay() get data from tx_info
+ _trace_tx_stats(arg, skb, wfx_pending_get_pkt_us_delay(wdev, skb));
+ wfx_tx_fill_rates(wdev, tx_info, arg);
++ skb_trim(skb, skb->len - tx_priv->icv_size);
++
+ // From now, you can touch to tx_info->status, but do not touch to
+ // tx_priv anymore
+ // FIXME: use ieee80211_tx_info_clear_status()
+diff --git a/drivers/staging/wfx/data_tx.h b/drivers/staging/wfx/data_tx.h
+index 46c9fff7a870e..401363d6b563a 100644
+--- a/drivers/staging/wfx/data_tx.h
++++ b/drivers/staging/wfx/data_tx.h
+@@ -35,6 +35,7 @@ struct tx_policy_cache {
+
+ struct wfx_tx_priv {
+ ktime_t xmit_timestamp;
++ unsigned char icv_size;
+ };
+
+ void wfx_tx_policy_init(struct wfx_vif *wvif);
+--
+2.27.0
+
--- /dev/null
+From b5bc7278d13367d37e8200a5faa183fc53837e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Feb 2021 10:48:57 -0500
+Subject: svcrdma: Hold private mutex while invoking rdma_accept()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 0ac24c320c4d89a9de6ec802591398b8675c7b3c ]
+
+RDMA core mutex locking was restructured by commit d114c6feedfe
+("RDMA/cma: Add missing locking to rdma_accept()") [Aug 2020]. When
+lock debugging is enabled, the RPC/RDMA server trips over the new
+lockdep assertion in rdma_accept() because it doesn't call
+rdma_accept() from its CM event handler.
+
+As a temporary fix, have svc_rdma_accept() take the handler_mutex
+explicitly. In the meantime, let's consider how to restructure the
+RPC/RDMA transport to invoke rdma_accept() from the proper context.
+
+Calls to svc_rdma_accept() are serialized with calls to
+svc_rdma_free() by the generic RPC server layer.
+
+Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/linux-rdma/20210209154014.GO4247@nvidia.com/
+Fixes: d114c6feedfe ("RDMA/cma: Add missing locking to rdma_accept()")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtrdma/svc_rdma_transport.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+index afba4e9d5425d..c895f80df659c 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -475,9 +475,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
+ if (!svc_rdma_post_recvs(newxprt))
+ goto errout;
+
+- /* Swap out the handler */
+- newxprt->sc_cm_id->event_handler = svc_rdma_cma_handler;
+-
+ /* Construct RDMA-CM private message */
+ pmsg.cp_magic = rpcrdma_cmp_magic;
+ pmsg.cp_version = RPCRDMA_CMP_VERSION;
+@@ -498,7 +495,10 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
+ }
+ conn_param.private_data = &pmsg;
+ conn_param.private_data_len = sizeof(pmsg);
++ rdma_lock_handler(newxprt->sc_cm_id);
++ newxprt->sc_cm_id->event_handler = svc_rdma_cma_handler;
+ ret = rdma_accept(newxprt->sc_cm_id, &conn_param);
++ rdma_unlock_handler(newxprt->sc_cm_id);
+ if (ret) {
+ trace_svcrdma_accept_err(newxprt, ret);
+ goto errout;
+--
+2.27.0
+
--- /dev/null
+From 290341d95b75ef3a62c3a4e52cc06d2643d140ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Feb 2021 14:59:35 +0800
+Subject: Take mmap lock in cacheflush syscall
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit c26958cb5a0d9053d1358258827638773f3d36ed ]
+
+We need to take the mmap lock around find_vma() and subsequent use of the
+VMA. Otherwise, we can race with concurrent operations like munmap(), which
+can lead to use-after-free accesses to freed VMAs.
+
+Fixes: 1000197d8013 ("nios2: System calls handling")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/sys_nios2.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/arch/nios2/kernel/sys_nios2.c b/arch/nios2/kernel/sys_nios2.c
+index cd390ec4f88bf..b1ca856999521 100644
+--- a/arch/nios2/kernel/sys_nios2.c
++++ b/arch/nios2/kernel/sys_nios2.c
+@@ -22,6 +22,7 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
+ unsigned int op)
+ {
+ struct vm_area_struct *vma;
++ struct mm_struct *mm = current->mm;
+
+ if (len == 0)
+ return 0;
+@@ -34,16 +35,22 @@ asmlinkage int sys_cacheflush(unsigned long addr, unsigned long len,
+ if (addr + len < addr)
+ return -EFAULT;
+
++ if (mmap_read_lock_killable(mm))
++ return -EINTR;
++
+ /*
+ * Verify that the specified address region actually belongs
+ * to this process.
+ */
+- vma = find_vma(current->mm, addr);
+- if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end)
++ vma = find_vma(mm, addr);
++ if (vma == NULL || addr < vma->vm_start || addr + len > vma->vm_end) {
++ mmap_read_unlock(mm);
+ return -EFAULT;
++ }
+
+ flush_cache_range(vma, addr, addr + len);
+
++ mmap_read_unlock(mm);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From f1a13199f674efdf8f9886c0900c925cf722d9c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Feb 2021 15:22:13 -0800
+Subject: tcp: fix SO_RCVLOWAT related hangs under mem pressure
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit f969dc5a885736842c3511ecdea240fbb02d25d9 ]
+
+While commit 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
+fixed an issue vs too small sk_rcvbuf for given sk_rcvlowat constraint,
+it missed to address issue caused by memory pressure.
+
+1) If we are under memory pressure and socket receive queue is empty.
+First incoming packet is allowed to be queued, after commit
+76dfa6082032 ("tcp: allow one skb to be received per socket under memory pressure")
+
+But we do not send EPOLLIN yet, in case tcp_data_ready() sees sk_rcvlowat
+is bigger than skb length.
+
+2) Then, when next packet comes, it is dropped, and we directly
+call sk->sk_data_ready().
+
+3) If application is using poll(), tcp_poll() will then use
+tcp_stream_is_readable() and decide the socket receive queue is
+not yet filled, so nothing will happen.
+
+Even when sender retransmits packets, phases 2) & 3) repeat
+and flow is effectively frozen, until memory pressure is off.
+
+Fix is to consider tcp_under_memory_pressure() to take care
+of global memory pressure or memcg pressure.
+
+Fixes: 24adbc1676af ("tcp: fix SO_RCVLOWAT hangs with fat skbs")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Arjun Roy <arjunroy@google.com>
+Suggested-by: Wei Wang <weiwan@google.com>
+Reviewed-by: Wei Wang <weiwan@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 25bbada379c46..244208f6f6c2a 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1431,8 +1431,13 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied);
+ */
+ static inline bool tcp_rmem_pressure(const struct sock *sk)
+ {
+- int rcvbuf = READ_ONCE(sk->sk_rcvbuf);
+- int threshold = rcvbuf - (rcvbuf >> 3);
++ int rcvbuf, threshold;
++
++ if (tcp_under_memory_pressure(sk))
++ return true;
++
++ rcvbuf = READ_ONCE(sk->sk_rcvbuf);
++ threshold = rcvbuf - (rcvbuf >> 3);
+
+ return atomic_read(&sk->sk_rmem_alloc) > threshold;
+ }
+--
+2.27.0
+
--- /dev/null
+From c894c23021595cc9c2f996bd6f24b807f2ecbdff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 14:05:27 +0200
+Subject: tools/testing/scatterlist: Fix overflow of max segment size
+
+From: Maor Gottlieb <maorg@nvidia.com>
+
+[ Upstream commit 96667052149da3855c4361925324b690c687152f ]
+
+Because SCATTERLIST_MAX_SEGMENT was removed and replaced with UINT_MAX,
+the test overflows the max_sgement variable. Remove this case.
+
+Fixes: 7a60c2dd0f57 ("drm: Remove SCATTERLIST_MAX_SEGMENT")
+Link: https://lore.kernel.org/r/20210125120527.836363-1-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/scatterlist/main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/testing/scatterlist/main.c b/tools/testing/scatterlist/main.c
+index 71c960dcd8a42..652254754b4cb 100644
+--- a/tools/testing/scatterlist/main.c
++++ b/tools/testing/scatterlist/main.c
+@@ -55,7 +55,6 @@ int main(void)
+ struct test *test, tests[] = {
+ { -EINVAL, 1, pfn(0), NULL, PAGE_SIZE, 0, 1 },
+ { 0, 1, pfn(0), NULL, PAGE_SIZE, PAGE_SIZE + 1, 1 },
+- { 0, 1, pfn(0), NULL, PAGE_SIZE, sgmax + 1, 1 },
+ { 0, 1, pfn(0), NULL, PAGE_SIZE, sgmax, 1 },
+ { 0, 1, pfn(0), NULL, 1, sgmax, 1 },
+ { 0, 2, pfn(0, 1), NULL, 2 * PAGE_SIZE, sgmax, 1 },
+--
+2.27.0
+
--- /dev/null
+From be8cc00c1c6c12a41bf07b4601741916cf0db1d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:34:05 -0500
+Subject: tracepoint: Do not fail unregistering a probe due to memory failure
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit befe6d946551d65cddbd32b9cb0170b0249fd5ed ]
+
+The list of tracepoint callbacks is managed by an array that is protected
+by RCU. To update this array, a new array is allocated, the updates are
+copied over to the new array, and then the list of functions for the
+tracepoint is switched over to the new array. After a completion of an RCU
+grace period, the old array is freed.
+
+This process happens for both adding a callback as well as removing one.
+But on removing a callback, if the new array fails to be allocated, the
+callback is not removed, and may be used after it is freed by the clients
+of the tracepoint.
+
+There's really no reason to fail if the allocation for a new array fails
+when removing a function. Instead, the function can simply be replaced by a
+stub function that could be cleaned up on the next modification of the
+array. That is, instead of calling the function registered to the
+tracepoint, it would call a stub function in its place.
+
+Link: https://lore.kernel.org/r/20201115055256.65625-1-mmullins@mmlx.us
+Link: https://lore.kernel.org/r/20201116175107.02db396d@gandalf.local.home
+Link: https://lore.kernel.org/r/20201117211836.54acaef2@oasis.local.home
+Link: https://lkml.kernel.org/r/20201118093405.7a6d2290@gandalf.local.home
+
+[ Note, this version does use undefined compiler behavior (assuming that
+ a stub function with no parameters or return, can be called by a location
+ that thinks it has parameters but still no return value. Static calls
+ do the same thing, so this trick is not without precedent.
+
+ There's another solution that uses RCU tricks and is more complex, but
+ can be an alternative if this solution becomes an issue.
+
+ Link: https://lore.kernel.org/lkml/20210127170721.58bce7cc@gandalf.local.home/
+]
+
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Cc: KP Singh <kpsingh@chromium.org>
+Cc: netdev <netdev@vger.kernel.org>
+Cc: bpf <bpf@vger.kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Florian Weimer <fw@deneb.enyo.de>
+Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints")
+Reported-by: syzbot+83aa762ef23b6f0d1991@syzkaller.appspotmail.com
+Reported-by: syzbot+d29e58bb557324e55e5e@syzkaller.appspotmail.com
+Reported-by: Matt Mullins <mmullins@mmlx.us>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Tested-by: Matt Mullins <mmullins@mmlx.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/tracepoint.c | 80 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index 7261fa0f5e3cc..e8f20ae29c18f 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -53,6 +53,12 @@ struct tp_probes {
+ struct tracepoint_func probes[];
+ };
+
++/* Called in removal of a func but failed to allocate a new tp_funcs */
++static void tp_stub_func(void)
++{
++ return;
++}
++
+ static inline void *allocate_probes(int count)
+ {
+ struct tp_probes *p = kmalloc(struct_size(p, probes, count),
+@@ -131,6 +137,7 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ {
+ struct tracepoint_func *old, *new;
+ int nr_probes = 0;
++ int stub_funcs = 0;
+ int pos = -1;
+
+ if (WARN_ON(!tp_func->func))
+@@ -147,14 +154,34 @@ func_add(struct tracepoint_func **funcs, struct tracepoint_func *tp_func,
+ if (old[nr_probes].func == tp_func->func &&
+ old[nr_probes].data == tp_func->data)
+ return ERR_PTR(-EEXIST);
++ if (old[nr_probes].func == tp_stub_func)
++ stub_funcs++;
+ }
+ }
+- /* + 2 : one for new probe, one for NULL func */
+- new = allocate_probes(nr_probes + 2);
++ /* + 2 : one for new probe, one for NULL func - stub functions */
++ new = allocate_probes(nr_probes + 2 - stub_funcs);
+ if (new == NULL)
+ return ERR_PTR(-ENOMEM);
+ if (old) {
+- if (pos < 0) {
++ if (stub_funcs) {
++ /* Need to copy one at a time to remove stubs */
++ int probes = 0;
++
++ pos = -1;
++ for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
++ if (old[nr_probes].func == tp_stub_func)
++ continue;
++ if (pos < 0 && old[nr_probes].prio < prio)
++ pos = probes++;
++ new[probes++] = old[nr_probes];
++ }
++ nr_probes = probes;
++ if (pos < 0)
++ pos = probes;
++ else
++ nr_probes--; /* Account for insertion */
++
++ } else if (pos < 0) {
+ pos = nr_probes;
+ memcpy(new, old, nr_probes * sizeof(struct tracepoint_func));
+ } else {
+@@ -188,8 +215,9 @@ static void *func_remove(struct tracepoint_func **funcs,
+ /* (N -> M), (N > 1, M >= 0) probes */
+ if (tp_func->func) {
+ for (nr_probes = 0; old[nr_probes].func; nr_probes++) {
+- if (old[nr_probes].func == tp_func->func &&
+- old[nr_probes].data == tp_func->data)
++ if ((old[nr_probes].func == tp_func->func &&
++ old[nr_probes].data == tp_func->data) ||
++ old[nr_probes].func == tp_stub_func)
+ nr_del++;
+ }
+ }
+@@ -208,14 +236,32 @@ static void *func_remove(struct tracepoint_func **funcs,
+ /* N -> M, (N > 1, M > 0) */
+ /* + 1 for NULL */
+ new = allocate_probes(nr_probes - nr_del + 1);
+- if (new == NULL)
+- return ERR_PTR(-ENOMEM);
+- for (i = 0; old[i].func; i++)
+- if (old[i].func != tp_func->func
+- || old[i].data != tp_func->data)
+- new[j++] = old[i];
+- new[nr_probes - nr_del].func = NULL;
+- *funcs = new;
++ if (new) {
++ for (i = 0; old[i].func; i++)
++ if ((old[i].func != tp_func->func
++ || old[i].data != tp_func->data)
++ && old[i].func != tp_stub_func)
++ new[j++] = old[i];
++ new[nr_probes - nr_del].func = NULL;
++ *funcs = new;
++ } else {
++ /*
++ * Failed to allocate, replace the old function
++ * with calls to tp_stub_func.
++ */
++ for (i = 0; old[i].func; i++)
++ if (old[i].func == tp_func->func &&
++ old[i].data == tp_func->data) {
++ old[i].func = tp_stub_func;
++ /* Set the prio to the next event. */
++ if (old[i + 1].func)
++ old[i].prio =
++ old[i + 1].prio;
++ else
++ old[i].prio = -1;
++ }
++ *funcs = old;
++ }
+ }
+ debug_print_probes(*funcs);
+ return old;
+@@ -295,10 +341,12 @@ static int tracepoint_remove_func(struct tracepoint *tp,
+ tp_funcs = rcu_dereference_protected(tp->funcs,
+ lockdep_is_held(&tracepoints_mutex));
+ old = func_remove(&tp_funcs, func);
+- if (IS_ERR(old)) {
+- WARN_ON_ONCE(PTR_ERR(old) != -ENOMEM);
++ if (WARN_ON_ONCE(IS_ERR(old)))
+ return PTR_ERR(old);
+- }
++
++ if (tp_funcs == old)
++ /* Failed allocating new tp_funcs, replaced func with stub */
++ return 0;
+
+ if (!tp_funcs) {
+ /* Removed last function */
+--
+2.27.0
+
--- /dev/null
+From dacc7c351b8fc1827360ee3a5af6e576955b899e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:31:30 -0800
+Subject: tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 3b830a9c34d5897be07176ce4e6f2d75e2c8cfd7 ]
+
+The tty line discipline .read() function was passed the final user
+pointer destination as an argument, which doesn't match the 'write()'
+function, and makes it very inconvenient to do a splice method for
+ttys.
+
+This is a conversion to use a kernel buffer instead.
+
+NOTE! It does this by passing the tty line discipline ->read() function
+an additional "cookie" to fill in, and an offset into the cookie data.
+
+The line discipline can fill in the cookie data with its own private
+information, and then the reader will repeat the read until either the
+cookie is cleared or it runs out of data.
+
+The only real user of this is N_HDLC, which can use this to handle big
+packets, even if the kernel buffer is smaller than the whole packet.
+
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_ldisc.c | 34 +++++++--------
+ drivers/input/serio/serport.c | 4 +-
+ drivers/net/ppp/ppp_async.c | 3 +-
+ drivers/net/ppp/ppp_synctty.c | 3 +-
+ drivers/tty/n_gsm.c | 3 +-
+ drivers/tty/n_hdlc.c | 60 +++++++++++++++++--------
+ drivers/tty/n_null.c | 3 +-
+ drivers/tty/n_r3964.c | 10 ++---
+ drivers/tty/n_tracerouter.c | 4 +-
+ drivers/tty/n_tracesink.c | 4 +-
+ drivers/tty/n_tty.c | 82 +++++++++++++++--------------------
+ drivers/tty/tty_io.c | 64 +++++++++++++++++++++++++--
+ include/linux/tty_ldisc.h | 3 +-
+ net/nfc/nci/uart.c | 3 +-
+ 14 files changed, 178 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index 8be4d807d1370..637c5b8c2aa1a 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -801,7 +801,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
+ * We don't provide read/write/poll interface for user space.
+ */
+ static ssize_t hci_uart_tty_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr)
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ return 0;
+ }
+@@ -818,29 +819,28 @@ static __poll_t hci_uart_tty_poll(struct tty_struct *tty,
+ return 0;
+ }
+
++static struct tty_ldisc_ops hci_uart_ldisc = {
++ .owner = THIS_MODULE,
++ .magic = TTY_LDISC_MAGIC,
++ .name = "n_hci",
++ .open = hci_uart_tty_open,
++ .close = hci_uart_tty_close,
++ .read = hci_uart_tty_read,
++ .write = hci_uart_tty_write,
++ .ioctl = hci_uart_tty_ioctl,
++ .compat_ioctl = hci_uart_tty_ioctl,
++ .poll = hci_uart_tty_poll,
++ .receive_buf = hci_uart_tty_receive,
++ .write_wakeup = hci_uart_tty_wakeup,
++};
++
+ static int __init hci_uart_init(void)
+ {
+- static struct tty_ldisc_ops hci_uart_ldisc;
+ int err;
+
+ BT_INFO("HCI UART driver ver %s", VERSION);
+
+ /* Register the tty discipline */
+-
+- memset(&hci_uart_ldisc, 0, sizeof(hci_uart_ldisc));
+- hci_uart_ldisc.magic = TTY_LDISC_MAGIC;
+- hci_uart_ldisc.name = "n_hci";
+- hci_uart_ldisc.open = hci_uart_tty_open;
+- hci_uart_ldisc.close = hci_uart_tty_close;
+- hci_uart_ldisc.read = hci_uart_tty_read;
+- hci_uart_ldisc.write = hci_uart_tty_write;
+- hci_uart_ldisc.ioctl = hci_uart_tty_ioctl;
+- hci_uart_ldisc.compat_ioctl = hci_uart_tty_ioctl;
+- hci_uart_ldisc.poll = hci_uart_tty_poll;
+- hci_uart_ldisc.receive_buf = hci_uart_tty_receive;
+- hci_uart_ldisc.write_wakeup = hci_uart_tty_wakeup;
+- hci_uart_ldisc.owner = THIS_MODULE;
+-
+ err = tty_register_ldisc(N_HCI, &hci_uart_ldisc);
+ if (err) {
+ BT_ERR("HCI line discipline registration failed. (%d)", err);
+diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
+index 8ac970a423de6..33e9d9bfd036f 100644
+--- a/drivers/input/serio/serport.c
++++ b/drivers/input/serio/serport.c
+@@ -156,7 +156,9 @@ out:
+ * returning 0 characters.
+ */
+
+-static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, unsigned char __user * buf, size_t nr)
++static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file,
++ unsigned char *kbuf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ struct serport *serport = (struct serport*) tty->disc_data;
+ struct serio *serio;
+diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
+index 29a0917a81e60..f14a9d190de91 100644
+--- a/drivers/net/ppp/ppp_async.c
++++ b/drivers/net/ppp/ppp_async.c
+@@ -259,7 +259,8 @@ static int ppp_asynctty_hangup(struct tty_struct *tty)
+ */
+ static ssize_t
+ ppp_asynctty_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t count)
++ unsigned char *buf, size_t count,
++ void **cookie, unsigned long offset)
+ {
+ return -EAGAIN;
+ }
+diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
+index 0f338752c38b9..f774b7e52da44 100644
+--- a/drivers/net/ppp/ppp_synctty.c
++++ b/drivers/net/ppp/ppp_synctty.c
+@@ -257,7 +257,8 @@ static int ppp_sync_hangup(struct tty_struct *tty)
+ */
+ static ssize_t
+ ppp_sync_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t count)
++ unsigned char *buf, size_t count,
++ void **cookie, unsigned long offset)
+ {
+ return -EAGAIN;
+ }
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index c676fa89ee0b6..51dafc06f5414 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -2559,7 +2559,8 @@ static void gsmld_write_wakeup(struct tty_struct *tty)
+ */
+
+ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr)
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index 12557ee1edb68..1363e659dc1db 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -416,13 +416,19 @@ static void n_hdlc_tty_receive(struct tty_struct *tty, const __u8 *data,
+ * Returns the number of bytes returned or error code.
+ */
+ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+- __u8 __user *buf, size_t nr)
++ __u8 *kbuf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ struct n_hdlc *n_hdlc = tty->disc_data;
+ int ret = 0;
+ struct n_hdlc_buf *rbuf;
+ DECLARE_WAITQUEUE(wait, current);
+
++ /* Is this a repeated call for an rbuf we already found earlier? */
++ rbuf = *cookie;
++ if (rbuf)
++ goto have_rbuf;
++
+ add_wait_queue(&tty->read_wait, &wait);
+
+ for (;;) {
+@@ -436,25 +442,8 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ set_current_state(TASK_INTERRUPTIBLE);
+
+ rbuf = n_hdlc_buf_get(&n_hdlc->rx_buf_list);
+- if (rbuf) {
+- if (rbuf->count > nr) {
+- /* too large for caller's buffer */
+- ret = -EOVERFLOW;
+- } else {
+- __set_current_state(TASK_RUNNING);
+- if (copy_to_user(buf, rbuf->buf, rbuf->count))
+- ret = -EFAULT;
+- else
+- ret = rbuf->count;
+- }
+-
+- if (n_hdlc->rx_free_buf_list.count >
+- DEFAULT_RX_BUF_COUNT)
+- kfree(rbuf);
+- else
+- n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
++ if (rbuf)
+ break;
+- }
+
+ /* no data */
+ if (tty_io_nonblock(tty, file)) {
+@@ -473,6 +462,39 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ remove_wait_queue(&tty->read_wait, &wait);
+ __set_current_state(TASK_RUNNING);
+
++ if (!rbuf)
++ return ret;
++ *cookie = rbuf;
++
++have_rbuf:
++ /* Have we used it up entirely? */
++ if (offset >= rbuf->count)
++ goto done_with_rbuf;
++
++ /* More data to go, but can't copy any more? EOVERFLOW */
++ ret = -EOVERFLOW;
++ if (!nr)
++ goto done_with_rbuf;
++
++ /* Copy as much data as possible */
++ ret = rbuf->count - offset;
++ if (ret > nr)
++ ret = nr;
++ memcpy(kbuf, rbuf->buf+offset, ret);
++ offset += ret;
++
++ /* If we still have data left, we leave the rbuf in the cookie */
++ if (offset < rbuf->count)
++ return ret;
++
++done_with_rbuf:
++ *cookie = NULL;
++
++ if (n_hdlc->rx_free_buf_list.count > DEFAULT_RX_BUF_COUNT)
++ kfree(rbuf);
++ else
++ n_hdlc_buf_put(&n_hdlc->rx_free_buf_list, rbuf);
++
+ return ret;
+
+ } /* end of n_hdlc_tty_read() */
+diff --git a/drivers/tty/n_null.c b/drivers/tty/n_null.c
+index 96feabae47407..ce03ae78f5c6a 100644
+--- a/drivers/tty/n_null.c
++++ b/drivers/tty/n_null.c
+@@ -20,7 +20,8 @@ static void n_null_close(struct tty_struct *tty)
+ }
+
+ static ssize_t n_null_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user * buf, size_t nr)
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ return -EOPNOTSUPP;
+ }
+diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
+index 934dd2fb2ec80..3161f0a535e37 100644
+--- a/drivers/tty/n_r3964.c
++++ b/drivers/tty/n_r3964.c
+@@ -129,7 +129,7 @@ static void remove_client_block(struct r3964_info *pInfo,
+ static int r3964_open(struct tty_struct *tty);
+ static void r3964_close(struct tty_struct *tty);
+ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user * buf, size_t nr);
++ void *cookie, unsigned char *buf, size_t nr);
+ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
+ const unsigned char *buf, size_t nr);
+ static int r3964_ioctl(struct tty_struct *tty, struct file *file,
+@@ -1058,7 +1058,8 @@ static void r3964_close(struct tty_struct *tty)
+ }
+
+ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user * buf, size_t nr)
++ unsigned char *kbuf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ struct r3964_info *pInfo = tty->disc_data;
+ struct r3964_client_info *pClient;
+@@ -1109,10 +1110,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+ kfree(pMsg);
+ TRACE_M("r3964_read - msg kfree %p", pMsg);
+
+- if (copy_to_user(buf, &theMsg, ret)) {
+- ret = -EFAULT;
+- goto unlock;
+- }
++ memcpy(kbuf, &theMsg, ret);
+
+ TRACE_PS("read - return %d", ret);
+ goto unlock;
+diff --git a/drivers/tty/n_tracerouter.c b/drivers/tty/n_tracerouter.c
+index 4479af4d2fa5c..3490ed51b1a3c 100644
+--- a/drivers/tty/n_tracerouter.c
++++ b/drivers/tty/n_tracerouter.c
+@@ -118,7 +118,9 @@ static void n_tracerouter_close(struct tty_struct *tty)
+ * -EINVAL
+ */
+ static ssize_t n_tracerouter_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr) {
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
++{
+ return -EINVAL;
+ }
+
+diff --git a/drivers/tty/n_tracesink.c b/drivers/tty/n_tracesink.c
+index d96ba82cc3569..1d9931041fd8b 100644
+--- a/drivers/tty/n_tracesink.c
++++ b/drivers/tty/n_tracesink.c
+@@ -115,7 +115,9 @@ static void n_tracesink_close(struct tty_struct *tty)
+ * -EINVAL
+ */
+ static ssize_t n_tracesink_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr) {
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
++{
+ return -EINVAL;
+ }
+
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 219e85756171b..0bd32ae8a269d 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -164,29 +164,24 @@ static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
+ memset(buffer, 0x00, size);
+ }
+
+-static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
+- size_t tail, size_t n)
++static void tty_copy(struct tty_struct *tty, void *to, size_t tail, size_t n)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+ size_t size = N_TTY_BUF_SIZE - tail;
+ void *from = read_buf_addr(ldata, tail);
+- int uncopied;
+
+ if (n > size) {
+ tty_audit_add_data(tty, from, size);
+- uncopied = copy_to_user(to, from, size);
+- zero_buffer(tty, from, size - uncopied);
+- if (uncopied)
+- return uncopied;
++ memcpy(to, from, size);
++ zero_buffer(tty, from, size);
+ to += size;
+ n -= size;
+ from = ldata->read_buf;
+ }
+
+ tty_audit_add_data(tty, from, n);
+- uncopied = copy_to_user(to, from, n);
+- zero_buffer(tty, from, n - uncopied);
+- return uncopied;
++ memcpy(to, from, n);
++ zero_buffer(tty, from, n);
+ }
+
+ /**
+@@ -1944,15 +1939,16 @@ static inline int input_available_p(struct tty_struct *tty, int poll)
+ /**
+ * copy_from_read_buf - copy read data directly
+ * @tty: terminal device
+- * @b: user data
++ * @kbp: data
+ * @nr: size of data
+ *
+ * Helper function to speed up n_tty_read. It is only called when
+- * ICANON is off; it copies characters straight from the tty queue to
+- * user space directly. It can be profitably called twice; once to
+- * drain the space from the tail pointer to the (physical) end of the
+- * buffer, and once to drain the space from the (physical) beginning of
+- * the buffer to head pointer.
++ * ICANON is off; it copies characters straight from the tty queue.
++ *
++ * It can be profitably called twice; once to drain the space from
++ * the tail pointer to the (physical) end of the buffer, and once
++ * to drain the space from the (physical) beginning of the buffer
++ * to head pointer.
+ *
+ * Called under the ldata->atomic_read_lock sem
+ *
+@@ -1962,7 +1958,7 @@ static inline int input_available_p(struct tty_struct *tty, int poll)
+ */
+
+ static int copy_from_read_buf(struct tty_struct *tty,
+- unsigned char __user **b,
++ unsigned char **kbp,
+ size_t *nr)
+
+ {
+@@ -1978,8 +1974,7 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ n = min(*nr, n);
+ if (n) {
+ unsigned char *from = read_buf_addr(ldata, tail);
+- retval = copy_to_user(*b, from, n);
+- n -= retval;
++ memcpy(*kbp, from, n);
+ is_eof = n == 1 && *from == EOF_CHAR(tty);
+ tty_audit_add_data(tty, from, n);
+ zero_buffer(tty, from, n);
+@@ -1988,7 +1983,7 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
+ (head == ldata->read_tail))
+ n = 0;
+- *b += n;
++ *kbp += n;
+ *nr -= n;
+ }
+ return retval;
+@@ -1997,12 +1992,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ /**
+ * canon_copy_from_read_buf - copy read data in canonical mode
+ * @tty: terminal device
+- * @b: user data
++ * @kbp: data
+ * @nr: size of data
+ *
+ * Helper function for n_tty_read. It is only called when ICANON is on;
+ * it copies one line of input up to and including the line-delimiting
+- * character into the user-space buffer.
++ * character into the result buffer.
+ *
+ * NB: When termios is changed from non-canonical to canonical mode and
+ * the read buffer contains data, n_tty_set_termios() simulates an EOF
+@@ -2018,14 +2013,14 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ */
+
+ static int canon_copy_from_read_buf(struct tty_struct *tty,
+- unsigned char __user **b,
++ unsigned char **kbp,
+ size_t *nr)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+ size_t n, size, more, c;
+ size_t eol;
+ size_t tail;
+- int ret, found = 0;
++ int found = 0;
+
+ /* N.B. avoid overrun if nr == 0 */
+ if (!*nr)
+@@ -2061,10 +2056,8 @@ static int canon_copy_from_read_buf(struct tty_struct *tty,
+ n_tty_trace("%s: eol:%zu found:%d n:%zu c:%zu tail:%zu more:%zu\n",
+ __func__, eol, found, n, c, tail, more);
+
+- ret = tty_copy_to_user(tty, *b, tail, n);
+- if (ret)
+- return -EFAULT;
+- *b += n;
++ tty_copy(tty, *kbp, tail, n);
++ *kbp += n;
+ *nr -= n;
+
+ if (found)
+@@ -2129,10 +2122,11 @@ static int job_control(struct tty_struct *tty, struct file *file)
+ */
+
+ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr)
++ unsigned char *kbuf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+- unsigned char __user *b = buf;
++ unsigned char *kb = kbuf;
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ int c;
+ int minimum, time;
+@@ -2178,17 +2172,13 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ /* First test for status change. */
+ if (packet && tty->link->ctrl_status) {
+ unsigned char cs;
+- if (b != buf)
++ if (kb != kbuf)
+ break;
+ spin_lock_irq(&tty->link->ctrl_lock);
+ cs = tty->link->ctrl_status;
+ tty->link->ctrl_status = 0;
+ spin_unlock_irq(&tty->link->ctrl_lock);
+- if (put_user(cs, b)) {
+- retval = -EFAULT;
+- break;
+- }
+- b++;
++ *kb++ = cs;
+ nr--;
+ break;
+ }
+@@ -2231,24 +2221,20 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ }
+
+ if (ldata->icanon && !L_EXTPROC(tty)) {
+- retval = canon_copy_from_read_buf(tty, &b, &nr);
++ retval = canon_copy_from_read_buf(tty, &kb, &nr);
+ if (retval)
+ break;
+ } else {
+ int uncopied;
+
+ /* Deal with packet mode. */
+- if (packet && b == buf) {
+- if (put_user(TIOCPKT_DATA, b)) {
+- retval = -EFAULT;
+- break;
+- }
+- b++;
++ if (packet && kb == kbuf) {
++ *kb++ = TIOCPKT_DATA;
+ nr--;
+ }
+
+- uncopied = copy_from_read_buf(tty, &b, &nr);
+- uncopied += copy_from_read_buf(tty, &b, &nr);
++ uncopied = copy_from_read_buf(tty, &kb, &nr);
++ uncopied += copy_from_read_buf(tty, &kb, &nr);
+ if (uncopied) {
+ retval = -EFAULT;
+ break;
+@@ -2257,7 +2243,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+
+ n_tty_check_unthrottle(tty);
+
+- if (b - buf >= minimum)
++ if (kb - kbuf >= minimum)
+ break;
+ if (time)
+ timeout = time;
+@@ -2269,8 +2255,8 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ remove_wait_queue(&tty->read_wait, &wait);
+ mutex_unlock(&ldata->atomic_read_lock);
+
+- if (b - buf)
+- retval = b - buf;
++ if (kb - kbuf)
++ retval = kb - kbuf;
+
+ return retval;
+ }
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 082da38762fc7..0c11c65d27431 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -829,6 +829,65 @@ static void tty_update_time(struct timespec64 *time)
+ time->tv_sec = sec;
+ }
+
++/*
++ * Iterate on the ldisc ->read() function until we've gotten all
++ * the data the ldisc has for us.
++ *
++ * The "cookie" is something that the ldisc read function can fill
++ * in to let us know that there is more data to be had.
++ *
++ * We promise to continue to call the ldisc until it stops returning
++ * data or clears the cookie. The cookie may be something that the
++ * ldisc maintains state for and needs to free.
++ */
++static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct file *file,
++ char __user *buf, size_t count)
++{
++ int retval = 0;
++ void *cookie = NULL;
++ unsigned long offset = 0;
++ char kernel_buf[64];
++
++ do {
++ int size, uncopied;
++
++ size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
++ size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
++ if (!size)
++ break;
++
++ /*
++ * A ldisc read error return will override any previously copied
++ * data (eg -EOVERFLOW from HDLC)
++ */
++ if (size < 0) {
++ memzero_explicit(kernel_buf, sizeof(kernel_buf));
++ return size;
++ }
++
++ uncopied = copy_to_user(buf+offset, kernel_buf, size);
++ size -= uncopied;
++ offset += size;
++ count -= size;
++
++ /*
++ * If the user copy failed, we still need to do another ->read()
++ * call if we had a cookie to let the ldisc clear up.
++ *
++ * But make sure size is zeroed.
++ */
++ if (unlikely(uncopied)) {
++ count = 0;
++ retval = -EFAULT;
++ }
++ } while (cookie);
++
++ /* We always clear tty buffer in case they contained passwords */
++ memzero_explicit(kernel_buf, sizeof(kernel_buf));
++ return offset ? offset : retval;
++}
++
++
+ /**
+ * tty_read - read method for tty device files
+ * @file: pointer to tty file
+@@ -862,10 +921,9 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ ld = tty_ldisc_ref_wait(tty);
+ if (!ld)
+ return hung_up_tty_read(file, buf, count, ppos);
++ i = -EIO;
+ if (ld->ops->read)
+- i = ld->ops->read(tty, file, buf, count);
+- else
+- i = -EIO;
++ i = iterate_tty_read(ld, tty, file, buf, count);
+ tty_ldisc_deref(ld);
+
+ if (i > 0)
+diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
+index b1e6043e99175..572a079761165 100644
+--- a/include/linux/tty_ldisc.h
++++ b/include/linux/tty_ldisc.h
+@@ -185,7 +185,8 @@ struct tty_ldisc_ops {
+ void (*close)(struct tty_struct *);
+ void (*flush_buffer)(struct tty_struct *tty);
+ ssize_t (*read)(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr);
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset);
+ ssize_t (*write)(struct tty_struct *tty, struct file *file,
+ const unsigned char *buf, size_t nr);
+ int (*ioctl)(struct tty_struct *tty, struct file *file,
+diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c
+index 11b554ce07ffc..1204c438e87dc 100644
+--- a/net/nfc/nci/uart.c
++++ b/net/nfc/nci/uart.c
+@@ -292,7 +292,8 @@ static int nci_uart_tty_ioctl(struct tty_struct *tty, struct file *file,
+
+ /* We don't provide read/write/poll interface for user space. */
+ static ssize_t nci_uart_tty_read(struct tty_struct *tty, struct file *file,
+- unsigned char __user *buf, size_t nr)
++ unsigned char *buf, size_t nr,
++ void **cookie, unsigned long offset)
+ {
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From e930b0ae88793fd61679f7a5d24779e05efc1d9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jan 2021 10:49:19 -0800
+Subject: tty: implement read_iter
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit dd78b0c483e33225e0e0782b0ed887129b00f956 ]
+
+Now that the ldisc read() function takes kernel pointers, it's fairly
+straightforward to make the tty file operations use .read_iter() instead
+of .read().
+
+That automatically gives us vread() and friends, and also makes it
+possible to do .splice_read() on ttys again.
+
+Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops")
+Reported-by: Oliver Giles <ohw.giles@gmail.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/tty_io.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 0c11c65d27431..623738d8e32c8 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -142,7 +142,7 @@ LIST_HEAD(tty_drivers); /* linked list of tty drivers */
+ /* Mutex to protect creating and releasing a tty */
+ DEFINE_MUTEX(tty_mutex);
+
+-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
++static ssize_t tty_read(struct kiocb *, struct iov_iter *);
+ static ssize_t tty_write(struct kiocb *, struct iov_iter *);
+ static __poll_t tty_poll(struct file *, poll_table *);
+ static int tty_open(struct inode *, struct file *);
+@@ -473,8 +473,9 @@ static void tty_show_fdinfo(struct seq_file *m, struct file *file)
+
+ static const struct file_operations tty_fops = {
+ .llseek = no_llseek,
+- .read = tty_read,
++ .read_iter = tty_read,
+ .write_iter = tty_write,
++ .splice_read = generic_file_splice_read,
+ .splice_write = iter_file_splice_write,
+ .poll = tty_poll,
+ .unlocked_ioctl = tty_ioctl,
+@@ -487,8 +488,9 @@ static const struct file_operations tty_fops = {
+
+ static const struct file_operations console_fops = {
+ .llseek = no_llseek,
+- .read = tty_read,
++ .read_iter = tty_read,
+ .write_iter = redirected_tty_write,
++ .splice_read = generic_file_splice_read,
+ .splice_write = iter_file_splice_write,
+ .poll = tty_poll,
+ .unlocked_ioctl = tty_ioctl,
+@@ -840,16 +842,17 @@ static void tty_update_time(struct timespec64 *time)
+ * data or clears the cookie. The cookie may be something that the
+ * ldisc maintains state for and needs to free.
+ */
+-static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct file *file,
+- char __user *buf, size_t count)
++static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty,
++ struct file *file, struct iov_iter *to)
+ {
+ int retval = 0;
+ void *cookie = NULL;
+ unsigned long offset = 0;
+ char kernel_buf[64];
++ size_t count = iov_iter_count(to);
+
+ do {
+- int size, uncopied;
++ int size, copied;
+
+ size = count > sizeof(kernel_buf) ? sizeof(kernel_buf) : count;
+ size = ld->ops->read(tty, file, kernel_buf, size, &cookie, offset);
+@@ -865,10 +868,9 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
+ return size;
+ }
+
+- uncopied = copy_to_user(buf+offset, kernel_buf, size);
+- size -= uncopied;
+- offset += size;
+- count -= size;
++ copied = copy_to_iter(kernel_buf, size, to);
++ offset += copied;
++ count -= copied;
+
+ /*
+ * If the user copy failed, we still need to do another ->read()
+@@ -876,7 +878,7 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
+ *
+ * But make sure size is zeroed.
+ */
+- if (unlikely(uncopied)) {
++ if (unlikely(copied != size)) {
+ count = 0;
+ retval = -EFAULT;
+ }
+@@ -903,10 +905,10 @@ static int iterate_tty_read(struct tty_ldisc *ld, struct tty_struct *tty, struct
+ * read calls may be outstanding in parallel.
+ */
+
+-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+- loff_t *ppos)
++static ssize_t tty_read(struct kiocb *iocb, struct iov_iter *to)
+ {
+ int i;
++ struct file *file = iocb->ki_filp;
+ struct inode *inode = file_inode(file);
+ struct tty_struct *tty = file_tty(file);
+ struct tty_ldisc *ld;
+@@ -919,11 +921,9 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ /* We want to wait for the line discipline to sort out in this
+ situation */
+ ld = tty_ldisc_ref_wait(tty);
+- if (!ld)
+- return hung_up_tty_read(file, buf, count, ppos);
+ i = -EIO;
+- if (ld->ops->read)
+- i = iterate_tty_read(ld, tty, file, buf, count);
++ if (ld && ld->ops->read)
++ i = iterate_tty_read(ld, tty, file, to);
+ tty_ldisc_deref(ld);
+
+ if (i > 0)
+@@ -2945,7 +2945,7 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+
+ static int this_tty(const void *t, struct file *file, unsigned fd)
+ {
+- if (likely(file->f_op->read != tty_read))
++ if (likely(file->f_op->read_iter != tty_read))
+ return 0;
+ return file_tty(file) != t ? 0 : fd + 1;
+ }
+--
+2.27.0
+
--- /dev/null
+From c01e00f8febeca9e46296f7f4e7ab4269b0f5047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 16:23:43 +0800
+Subject: ubifs: Fix error return code in alloc_wbufs()
+
+From: Wang ShaoBo <bobo.shaobowang@huawei.com>
+
+[ Upstream commit 42119dbe571eb419dae99b81dd20fa42f47464e1 ]
+
+Fix to return PTR_ERR() error code from the error handling case instead
+fo 0 in function alloc_wbufs(), as done elsewhere in this function.
+
+Fixes: 6a98bc4614de ("ubifs: Add authentication nodes to journal")
+Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
+Reviewed-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/super.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index 138b9426c6c18..ddb2ca636c93d 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -838,8 +838,10 @@ static int alloc_wbufs(struct ubifs_info *c)
+ c->jheads[i].wbuf.jhead = i;
+ c->jheads[i].grouped = 1;
+ c->jheads[i].log_hash = ubifs_hash_get_desc(c);
+- if (IS_ERR(c->jheads[i].log_hash))
++ if (IS_ERR(c->jheads[i].log_hash)) {
++ err = PTR_ERR(c->jheads[i].log_hash);
+ goto out;
++ }
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From de46e9a9006ba5fd00b789ebfbf98736264d672d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jan 2021 14:03:40 +0800
+Subject: ubifs: Fix memleak in ubifs_init_authentication
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 11b8ab3836454a2600e396f34731e491b661f9d5 ]
+
+When crypto_shash_digestsize() fails, c->hmac_tfm
+has not been freed before returning, which leads
+to memleak.
+
+Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/auth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
+index 51a7c8c2c3f0a..e564d5ff87816 100644
+--- a/fs/ubifs/auth.c
++++ b/fs/ubifs/auth.c
+@@ -327,7 +327,7 @@ int ubifs_init_authentication(struct ubifs_info *c)
+ ubifs_err(c, "hmac %s is bigger than maximum allowed hmac size (%d > %d)",
+ hmac_name, c->hmac_desc_len, UBIFS_HMAC_ARR_SZ);
+ err = -EINVAL;
+- goto out_free_hash;
++ goto out_free_hmac;
+ }
+
+ err = crypto_shash_setkey(c->hmac_tfm, ukp->data, ukp->datalen);
+--
+2.27.0
+
--- /dev/null
+From 15965808bf67508baa34c84ca2fea73028c07d2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jan 2021 22:30:11 +0100
+Subject: ubifs: replay: Fix high stack usage, again
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 410b6de702ef84fea6e7abcb6620ef8bfc112fae ]
+
+An earlier commit moved out some functions to not be inlined by gcc, but
+after some other rework to remove one of those, clang started inlining
+the other one and ran into the same problem as gcc did before:
+
+fs/ubifs/replay.c:1174:5: error: stack frame size of 1152 bytes in function 'ubifs_replay_journal' [-Werror,-Wframe-larger-than=]
+
+Mark the function as noinline_for_stack to ensure it doesn't happen
+again.
+
+Fixes: f80df3851246 ("ubifs: use crypto_shash_tfm_digest()")
+Fixes: eb66eff6636d ("ubifs: replay: Fix high stack usage")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/replay.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
+index 79801c9a5b874..0f8a6a16421b4 100644
+--- a/fs/ubifs/replay.c
++++ b/fs/ubifs/replay.c
+@@ -559,7 +559,9 @@ static int is_last_bud(struct ubifs_info *c, struct ubifs_bud *bud)
+ }
+
+ /* authenticate_sleb_hash is split out for stack usage */
+-static int authenticate_sleb_hash(struct ubifs_info *c, struct shash_desc *log_hash, u8 *hash)
++static int noinline_for_stack
++authenticate_sleb_hash(struct ubifs_info *c,
++ struct shash_desc *log_hash, u8 *hash)
+ {
+ SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm);
+
+--
+2.27.0
+
--- /dev/null
+From e96a412afa6f09c98ba7bf620430329d49ec5d2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:50 +0100
+Subject: usb: dwc2: Abort transaction after errors with unknown reason
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit f74b68c61cbc4b2245022fcce038509333d63f6f ]
+
+In some situations, the following error messages are reported.
+
+dwc2 ff540000.usb: dwc2_hc_chhltd_intr_dma: Channel 1 - ChHltd set, but reason is unknown
+dwc2 ff540000.usb: hcint 0x00000002, intsts 0x04000021
+
+This is sometimes followed by:
+
+dwc2 ff540000.usb: dwc2_update_urb_state_abn(): trimming xfer length
+
+and then:
+
+WARNING: CPU: 0 PID: 0 at kernel/v4.19/drivers/usb/dwc2/hcd.c:2913
+ dwc2_assign_and_init_hc+0x98c/0x990
+
+The warning suggests that an odd buffer address is to be used for DMA.
+
+After an error is observed, the receive buffer may be full
+(urb->actual_length >= urb->length). However, the urb is still left in
+the queue unless three errors were observed in a row. When it is queued
+again, the dwc2 hcd code translates this into a 1-block transfer.
+If urb->actual_length (ie the total expected receive length) is not
+DMA-aligned, the buffer pointer programmed into the chip will be
+unaligned. This results in the observed warning.
+
+To solve the problem, abort input transactions after an error with
+unknown cause if the entire packet was already received. This may be
+a bit drastic, but we don't really know why the transfer was aborted
+even though the entire packet was received. Aborting the transfer in
+this situation is less risky than accepting a potentially corrupted
+packet.
+
+With this patch in place, the 'ChHltd set' and 'trimming xfer length'
+messages are still observed, but there are no more transfer attempts
+with odd buffer addresses.
+
+Fixes: 151d0cbdbe860 ("usb: dwc2: make the scheduler handle excessive NAKs better")
+Cc: Boris ARZUR <boris@konbu.org>
+Cc: Douglas Anderson <dianders@chromium.org>
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-3-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index a052d39b4375e..12819e019e13c 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -1977,6 +1977,18 @@ error:
+ qtd->error_count++;
+ dwc2_update_urb_state_abn(hsotg, chan, chnum, qtd->urb,
+ qtd, DWC2_HC_XFER_XACT_ERR);
++ /*
++ * We can get here after a completed transaction
++ * (urb->actual_length >= urb->length) which was not reported
++ * as completed. If that is the case, and we do not abort
++ * the transfer, a transfer of size 0 will be enqueued
++ * subsequently. If urb->actual_length is not DMA-aligned,
++ * the buffer will then point to an unaligned address, and
++ * the resulting behavior is undefined. Bail out in that
++ * situation.
++ */
++ if (qtd->urb->actual_length >= qtd->urb->length)
++ qtd->error_count = 3;
+ dwc2_hcd_save_data_toggle(hsotg, chan, chnum, qtd);
+ dwc2_halt_channel(hsotg, chan, qtd, DWC2_HC_XFER_XACT_ERR);
+ }
+--
+2.27.0
+
--- /dev/null
+From 7555c8b4eb9de3d22c4c0bf7c9a01c51cf6d7f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:49 +0100
+Subject: usb: dwc2: Do not update data length if it is 0 on inbound transfers
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 415fa1c7305dedbb345e2cc8ac91769bc1c83f1a ]
+
+The DWC2 documentation states that transfers with zero data length should
+set the number of packets to 1 and the transfer length to 0. This is not
+currently the case for inbound transfers: the transfer length is set to
+the maximum packet length. This can have adverse effects if the chip
+actually does transfer data as it is programmed to do. Follow chip
+documentation and keep the transfer length set to 0 in that situation.
+
+Fixes: 56f5b1cff22a1 ("staging: Core files for the DWC2 driver")
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-2-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index e9ac215b96633..fc3269f5faf19 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -1313,19 +1313,20 @@ static void dwc2_hc_start_transfer(struct dwc2_hsotg *hsotg,
+ if (num_packets > max_hc_pkt_count) {
+ num_packets = max_hc_pkt_count;
+ chan->xfer_len = num_packets * chan->max_packet;
++ } else if (chan->ep_is_in) {
++ /*
++ * Always program an integral # of max packets
++ * for IN transfers.
++ * Note: This assumes that the input buffer is
++ * aligned and sized accordingly.
++ */
++ chan->xfer_len = num_packets * chan->max_packet;
+ }
+ } else {
+ /* Need 1 packet for transfer length of 0 */
+ num_packets = 1;
+ }
+
+- if (chan->ep_is_in)
+- /*
+- * Always program an integral # of max packets for IN
+- * transfers
+- */
+- chan->xfer_len = num_packets * chan->max_packet;
+-
+ if (chan->ep_type == USB_ENDPOINT_XFER_INT ||
+ chan->ep_type == USB_ENDPOINT_XFER_ISOC)
+ /*
+--
+2.27.0
+
--- /dev/null
+From c89be172196057ad5e67317003c26c60f6b250a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 12:20:51 +0100
+Subject: usb: dwc2: Make "trimming xfer length" a debug message
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 1a9e38cabd80356ffb98c2c88fec528ea9644fd5 ]
+
+With some USB network adapters, such as DM96xx, the following message
+is seen for each maximum size receive packet.
+
+dwc2 ff540000.usb: dwc2_update_urb_state(): trimming xfer length
+
+This happens because the packet size requested by the driver is 1522
+bytes, wMaxPacketSize is 64, the dwc2 driver configures the chip to
+receive 24*64 = 1536 bytes, and the chip does indeed send more than
+1522 bytes of data. Since the event does not indicate an error condition,
+the message is just noise. Demote it to debug level.
+
+Fixes: 7359d482eb4d3 ("staging: HCD files for the DWC2 driver")
+Tested-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Link: https://lore.kernel.org/r/20210113112052.17063-4-nsaenzjulienne@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/hcd_intr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
+index 12819e019e13c..d5f4ec1b73b15 100644
+--- a/drivers/usb/dwc2/hcd_intr.c
++++ b/drivers/usb/dwc2/hcd_intr.c
+@@ -500,7 +500,7 @@ static int dwc2_update_urb_state(struct dwc2_hsotg *hsotg,
+ &short_read);
+
+ if (urb->actual_length + xfer_length > urb->length) {
+- dev_warn(hsotg->dev, "%s(): trimming xfer length\n", __func__);
++ dev_dbg(hsotg->dev, "%s(): trimming xfer length\n", __func__);
+ xfer_length = urb->length - urb->actual_length;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c891aae237ba1d46f8dacbd1dcf274b0844cf9c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 09:46:39 +0100
+Subject: usb: gadget: u_audio: Free requests only after callback
+
+From: Jack Pham <jackp@codeaurora.org>
+
+[ Upstream commit 7de8681be2cde9f6953d3be1fa6ce05f9fe6e637 ]
+
+As per the kernel doc for usb_ep_dequeue(), it states that "this
+routine is asynchronous, that is, it may return before the completion
+routine runs". And indeed since v5.0 the dwc3 gadget driver updated
+its behavior to place dequeued requests on to a cancelled list to be
+given back later after the endpoint is stopped.
+
+The free_ep() was incorrectly assuming that a request was ready to
+be freed after calling dequeue which results in a use-after-free
+in dwc3 when it traverses its cancelled list. Fix this by moving
+the usb_ep_free_request() call to the callback itself in case the
+ep is disabled.
+
+Fixes: eb9fecb9e69b0 ("usb: gadget: f_uac2: split out audio core")
+Reported-and-tested-by: Ferry Toth <fntoth@gmail.com>
+Reviewed-and-tested-by: Peter Chen <peter.chen@nxp.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20210118084642.322510-2-jbrunet@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_audio.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
+index e6d32c5367812..908e49dafd620 100644
+--- a/drivers/usb/gadget/function/u_audio.c
++++ b/drivers/usb/gadget/function/u_audio.c
+@@ -89,7 +89,12 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
+ struct snd_uac_chip *uac = prm->uac;
+
+ /* i/f shutting down */
+- if (!prm->ep_enabled || req->status == -ESHUTDOWN)
++ if (!prm->ep_enabled) {
++ usb_ep_free_request(ep, req);
++ return;
++ }
++
++ if (req->status == -ESHUTDOWN)
+ return;
+
+ /*
+@@ -336,8 +341,14 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep)
+
+ for (i = 0; i < params->req_number; i++) {
+ if (prm->ureq[i].req) {
+- usb_ep_dequeue(ep, prm->ureq[i].req);
+- usb_ep_free_request(ep, prm->ureq[i].req);
++ if (usb_ep_dequeue(ep, prm->ureq[i].req))
++ usb_ep_free_request(ep, prm->ureq[i].req);
++ /*
++ * If usb_ep_dequeue() cannot successfully dequeue the
++ * request, the request will be freed by the completion
++ * callback.
++ */
++
+ prm->ureq[i].req = NULL;
+ }
+ }
+--
+2.27.0
+
--- /dev/null
+From fed96b6c02b2196c8a647443a8cd47d6ffe2a91c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 17:26:35 +0800
+Subject: vfio/iommu_type1: Fix some sanity checks in detach group
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit 4a19f37a3dd3f29997735e61b25ddad24b8abe73 ]
+
+vfio_sanity_check_pfn_list() is used to check whether pfn_list and
+notifier are empty when remove the external domain, so it makes a
+wrong assumption that only external domain will use the pinning
+interface.
+
+Now we apply the pfn_list check when a vfio_dma is removed and apply
+the notifier check when all domains are removed.
+
+Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices")
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 31 ++++++++-----------------------
+ 1 file changed, 8 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 161725395f2fb..78bd28873945a 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -957,6 +957,7 @@ static long vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma,
+
+ static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
+ {
++ WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list));
+ vfio_unmap_unpin(iommu, dma, true);
+ vfio_unlink_dma(iommu, dma);
+ put_task_struct(dma->task);
+@@ -2250,23 +2251,6 @@ static void vfio_iommu_unmap_unpin_reaccount(struct vfio_iommu *iommu)
+ }
+ }
+
+-static void vfio_sanity_check_pfn_list(struct vfio_iommu *iommu)
+-{
+- struct rb_node *n;
+-
+- n = rb_first(&iommu->dma_list);
+- for (; n; n = rb_next(n)) {
+- struct vfio_dma *dma;
+-
+- dma = rb_entry(n, struct vfio_dma, node);
+-
+- if (WARN_ON(!RB_EMPTY_ROOT(&dma->pfn_list)))
+- break;
+- }
+- /* mdev vendor driver must unregister notifier */
+- WARN_ON(iommu->notifier.head);
+-}
+-
+ /*
+ * Called when a domain is removed in detach. It is possible that
+ * the removed domain decided the iova aperture window. Modify the
+@@ -2366,10 +2350,10 @@ static void vfio_iommu_type1_detach_group(void *iommu_data,
+ kfree(group);
+
+ if (list_empty(&iommu->external_domain->group_list)) {
+- vfio_sanity_check_pfn_list(iommu);
+-
+- if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu))
++ if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu)) {
++ WARN_ON(iommu->notifier.head);
+ vfio_iommu_unmap_unpin_all(iommu);
++ }
+
+ kfree(iommu->external_domain);
+ iommu->external_domain = NULL;
+@@ -2403,10 +2387,12 @@ static void vfio_iommu_type1_detach_group(void *iommu_data,
+ */
+ if (list_empty(&domain->group_list)) {
+ if (list_is_singular(&iommu->domain_list)) {
+- if (!iommu->external_domain)
++ if (!iommu->external_domain) {
++ WARN_ON(iommu->notifier.head);
+ vfio_iommu_unmap_unpin_all(iommu);
+- else
++ } else {
+ vfio_iommu_unmap_unpin_reaccount(iommu);
++ }
+ }
+ iommu_domain_free(domain->domain);
+ list_del(&domain->next);
+@@ -2490,7 +2476,6 @@ static void vfio_iommu_type1_release(void *iommu_data)
+
+ if (iommu->external_domain) {
+ vfio_release_domain(iommu->external_domain, true);
+- vfio_sanity_check_pfn_list(iommu);
+ kfree(iommu->external_domain);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 71a6ef9add0fe60e0bb7b30a0c6767c476b18468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jan 2021 17:26:34 +0800
+Subject: vfio/iommu_type1: Populate full dirty when detach non-pinned group
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit d0a78f91761fcd837da1e7a4b0f8368873adc646 ]
+
+If a group with non-pinned-page dirty scope is detached with dirty
+logging enabled, we should fully populate the dirty bitmaps at the
+time it's removed since we don't know the extent of its previous DMA,
+nor will the group be present to trigger the full bitmap when the user
+retrieves the dirty bitmap.
+
+Fixes: d6a4c185660c ("vfio iommu: Implementation of ioctl for dirty pages tracking")
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_type1.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index 0b4dedaa91289..161725395f2fb 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -236,6 +236,18 @@ static void vfio_dma_populate_bitmap(struct vfio_dma *dma, size_t pgsize)
+ }
+ }
+
++static void vfio_iommu_populate_bitmap_full(struct vfio_iommu *iommu)
++{
++ struct rb_node *n;
++ unsigned long pgshift = __ffs(iommu->pgsize_bitmap);
++
++ for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) {
++ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node);
++
++ bitmap_set(dma->bitmap, 0, dma->size >> pgshift);
++ }
++}
++
+ static int vfio_dma_bitmap_alloc_all(struct vfio_iommu *iommu, size_t pgsize)
+ {
+ struct rb_node *n;
+@@ -2415,8 +2427,11 @@ detach_group_done:
+ * Removal of a group without dirty tracking may allow the iommu scope
+ * to be promoted.
+ */
+- if (update_dirty_scope)
++ if (update_dirty_scope) {
+ update_pinned_page_dirty_scope(iommu);
++ if (iommu->dirty_page_tracking)
++ vfio_iommu_populate_bitmap_full(iommu);
++ }
+ mutex_unlock(&iommu->lock);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From d90c32707dccb0185fef9fbcb1c76b381e1ea110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Feb 2021 16:28:25 +0000
+Subject: vfio-pci/zdev: fix possible segmentation fault issue
+
+From: Max Gurtovoy <mgurtovoy@nvidia.com>
+
+[ Upstream commit 7e31d6dc2c78b2a0ba0039ca97ca98a581e8db82 ]
+
+In case allocation fails, we must behave correctly and exit with error.
+
+Fixes: e6b817d4b821 ("vfio-pci/zdev: Add zPCI capabilities to VFIO_DEVICE_GET_INFO")
+Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_zdev.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/vfio/pci/vfio_pci_zdev.c b/drivers/vfio/pci/vfio_pci_zdev.c
+index 2296856340311..1bb7edac56899 100644
+--- a/drivers/vfio/pci/vfio_pci_zdev.c
++++ b/drivers/vfio/pci/vfio_pci_zdev.c
+@@ -74,6 +74,8 @@ static int zpci_util_cap(struct zpci_dev *zdev, struct vfio_pci_device *vdev,
+ int ret;
+
+ cap = kmalloc(cap_size, GFP_KERNEL);
++ if (!cap)
++ return -ENOMEM;
+
+ cap->header.id = VFIO_DEVICE_INFO_CAP_ZPCI_UTIL;
+ cap->header.version = 1;
+@@ -98,6 +100,8 @@ static int zpci_pfip_cap(struct zpci_dev *zdev, struct vfio_pci_device *vdev,
+ int ret;
+
+ cap = kmalloc(cap_size, GFP_KERNEL);
++ if (!cap)
++ return -ENOMEM;
+
+ cap->header.id = VFIO_DEVICE_INFO_CAP_ZPCI_PFIP;
+ cap->header.version = 1;
+--
+2.27.0
+
--- /dev/null
+From a3bee5ffcfcafdf78d75b1c90dd1a794752dd171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jan 2021 08:32:40 -0800
+Subject: VMCI: Use set_page_dirty_lock() when unregistering guest memory
+
+From: Jorgen Hansen <jhansen@vmware.com>
+
+[ Upstream commit 5a16c535409f8dcb7568e20737309e3027ae3e49 ]
+
+When the VMCI host support releases guest memory in the case where
+the VM was killed, the pinned guest pages aren't locked. Use
+set_page_dirty_lock() instead of set_page_dirty().
+
+Testing done: Killed VM while having an active VMCI based vSocket
+connection and observed warning from ext4. With this fix, no
+warning was observed. Ran various vSocket tests without issues.
+
+Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Jorgen Hansen <jhansen@vmware.com>
+Link: https://lore.kernel.org/r/1611160360-30299-1-git-send-email-jhansen@vmware.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index c49065887e8f5..df6b19c4c49b5 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -630,7 +630,7 @@ static void qp_release_pages(struct page **pages,
+
+ for (i = 0; i < num_pages; i++) {
+ if (dirty)
+- set_page_dirty(pages[i]);
++ set_page_dirty_lock(pages[i]);
+
+ put_page(pages[i]);
+ pages[i] = NULL;
+--
+2.27.0
+
--- /dev/null
+From 0f10cf763b123d3d42c4a72513e038a9e5776268 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Feb 2021 15:45:52 +0000
+Subject: vxlan: move debug check after netdev unregister
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 92584ddf550ae72d492858c19d1f9025e07a9350 ]
+
+The debug check must be done after unregister_netdevice_many() call --
+the hlist_del_rcu() for this is done inside .ndo_stop.
+
+This is the same with commit 0fda7600c2e1 ("geneve: move debug check after
+netdev unregister")
+
+Test commands:
+ ip netns del A
+ ip netns add A
+ ip netns add B
+
+ ip netns exec B ip link add vxlan0 type vxlan vni 100 local 10.0.0.1 \
+ remote 10.0.0.2 dstport 4789 srcport 4789 4789
+ ip netns exec B ip link set vxlan0 netns A
+ ip netns exec A ip link set vxlan0 up
+ ip netns del B
+
+Splat looks like:
+[ 73.176249][ T7] ------------[ cut here ]------------
+[ 73.178662][ T7] WARNING: CPU: 4 PID: 7 at drivers/net/vxlan.c:4743 vxlan_exit_batch_net+0x52e/0x720 [vxlan]
+[ 73.182597][ T7] Modules linked in: vxlan openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 mlx5_core nfp mlxfw ixgbevf tls sch_fq_codel nf_tables nfnetlink ip_tables x_tables unix
+[ 73.190113][ T7] CPU: 4 PID: 7 Comm: kworker/u16:0 Not tainted 5.11.0-rc7+ #838
+[ 73.193037][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 73.196986][ T7] Workqueue: netns cleanup_net
+[ 73.198946][ T7] RIP: 0010:vxlan_exit_batch_net+0x52e/0x720 [vxlan]
+[ 73.201509][ T7] Code: 00 01 00 00 0f 84 39 fd ff ff 48 89 ca 48 c1 ea 03 80 3c 1a 00 0f 85 a6 00 00 00 89 c2 48 83 c2 02 49 8b 14 d4 48 85 d2 74 ce <0f> 0b eb ca e8 b9 51 db dd 84 c0 0f 85 4a fe ff ff 48 c7 c2 80 bc
+[ 73.208813][ T7] RSP: 0018:ffff888100907c10 EFLAGS: 00010286
+[ 73.211027][ T7] RAX: 000000000000003c RBX: dffffc0000000000 RCX: ffff88800ec411f0
+[ 73.213702][ T7] RDX: ffff88800a278000 RSI: ffff88800fc78c70 RDI: ffff88800fc78070
+[ 73.216169][ T7] RBP: ffff88800b5cbdc0 R08: fffffbfff424de61 R09: fffffbfff424de61
+[ 73.218463][ T7] R10: ffffffffa126f307 R11: fffffbfff424de60 R12: ffff88800ec41000
+[ 73.220794][ T7] R13: ffff888100907d08 R14: ffff888100907c50 R15: ffff88800fc78c40
+[ 73.223337][ T7] FS: 0000000000000000(0000) GS:ffff888114800000(0000) knlGS:0000000000000000
+[ 73.225814][ T7] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 73.227616][ T7] CR2: 0000562b5cb4f4d0 CR3: 0000000105fbe001 CR4: 00000000003706e0
+[ 73.229700][ T7] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 73.231820][ T7] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 73.233844][ T7] Call Trace:
+[ 73.234698][ T7] ? vxlan_err_lookup+0x3c0/0x3c0 [vxlan]
+[ 73.235962][ T7] ? ops_exit_list.isra.11+0x93/0x140
+[ 73.237134][ T7] cleanup_net+0x45e/0x8a0
+[ ... ]
+
+Fixes: 57b61127ab7d ("vxlan: speedup vxlan tunnels dismantle")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Link: https://lore.kernel.org/r/20210221154552.11749-1-ap420073@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index a8ad710629e69..0842371eca3d6 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -4725,7 +4725,6 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ struct vxlan_dev *vxlan, *next;
+ struct net_device *dev, *aux;
+- unsigned int h;
+
+ for_each_netdev_safe(net, dev, aux)
+ if (dev->rtnl_link_ops == &vxlan_link_ops)
+@@ -4739,14 +4738,13 @@ static void vxlan_destroy_tunnels(struct net *net, struct list_head *head)
+ unregister_netdevice_queue(vxlan->dev, head);
+ }
+
+- for (h = 0; h < PORT_HASH_SIZE; ++h)
+- WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
+ }
+
+ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+ {
+ struct net *net;
+ LIST_HEAD(list);
++ unsigned int h;
+
+ rtnl_lock();
+ list_for_each_entry(net, net_list, exit_list) {
+@@ -4759,6 +4757,13 @@ static void __net_exit vxlan_exit_batch_net(struct list_head *net_list)
+
+ unregister_netdevice_many(&list);
+ rtnl_unlock();
++
++ list_for_each_entry(net, net_list, exit_list) {
++ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
++
++ for (h = 0; h < PORT_HASH_SIZE; ++h)
++ WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
++ }
+ }
+
+ static struct pernet_operations vxlan_net_ops = {
+--
+2.27.0
+
--- /dev/null
+From 3f9e8201c95cd61a0cc4b6fee150a465f00f5f74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 15:28:02 -0500
+Subject: watch_queue: Drop references to /dev/watch_queue
+
+From: Gabriel Krisman Bertazi <krisman@collabora.com>
+
+[ Upstream commit 8fe62e0c0e2efa5437f3ee81b65d69e70a45ecd2 ]
+
+The merged API doesn't use a watch_queue device, but instead relies on
+pipes, so let the documentation reflect that.
+
+Fixes: f7e47677e39a ("watch_queue: Add a key/keyring notification facility")
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Ben Boeckel <mathstuf@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/security/keys/core.rst | 4 ++--
+ samples/Kconfig | 2 +-
+ samples/watch_queue/watch_test.c | 2 +-
+ security/keys/Kconfig | 8 ++++----
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/Documentation/security/keys/core.rst b/Documentation/security/keys/core.rst
+index aa0081685ee11..b3ed5c581034c 100644
+--- a/Documentation/security/keys/core.rst
++++ b/Documentation/security/keys/core.rst
+@@ -1040,8 +1040,8 @@ The keyctl syscall functions are:
+
+ "key" is the ID of the key to be watched.
+
+- "queue_fd" is a file descriptor referring to an open "/dev/watch_queue"
+- which manages the buffer into which notifications will be delivered.
++ "queue_fd" is a file descriptor referring to an open pipe which
++ manages the buffer into which notifications will be delivered.
+
+ "filter" is either NULL to remove a watch or a filter specification to
+ indicate what events are required from the key.
+diff --git a/samples/Kconfig b/samples/Kconfig
+index 0ed6e4d71d87b..e76cdfc50e257 100644
+--- a/samples/Kconfig
++++ b/samples/Kconfig
+@@ -210,7 +210,7 @@ config SAMPLE_WATCHDOG
+ depends on CC_CAN_LINK
+
+ config SAMPLE_WATCH_QUEUE
+- bool "Build example /dev/watch_queue notification consumer"
++ bool "Build example watch_queue notification API consumer"
+ depends on CC_CAN_LINK && HEADERS_INSTALL
+ help
+ Build example userspace program to use the new mount_notify(),
+diff --git a/samples/watch_queue/watch_test.c b/samples/watch_queue/watch_test.c
+index 46e618a897fef..8c6cb57d5cfc5 100644
+--- a/samples/watch_queue/watch_test.c
++++ b/samples/watch_queue/watch_test.c
+@@ -1,5 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0
+-/* Use /dev/watch_queue to watch for notifications.
++/* Use watch_queue API to watch for notifications.
+ *
+ * Copyright (C) 2020 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+diff --git a/security/keys/Kconfig b/security/keys/Kconfig
+index 83bc23409164a..c161642a84841 100644
+--- a/security/keys/Kconfig
++++ b/security/keys/Kconfig
+@@ -119,7 +119,7 @@ config KEY_NOTIFICATIONS
+ bool "Provide key/keyring change notifications"
+ depends on KEYS && WATCH_QUEUE
+ help
+- This option provides support for getting change notifications on keys
+- and keyrings on which the caller has View permission. This makes use
+- of the /dev/watch_queue misc device to handle the notification
+- buffer and provides KEYCTL_WATCH_KEY to enable/disable watches.
++ This option provides support for getting change notifications
++ on keys and keyrings on which the caller has View permission.
++ This makes use of pipes to handle the notification buffer and
++ provides KEYCTL_WATCH_KEY to enable/disable watches.
+--
+2.27.0
+
--- /dev/null
+From 8785f06d9663df7f5b904fa22348ae1a751617b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 19:33:02 +0300
+Subject: watchdog: intel-mid_wdt: Postpone IRQ handler registration till SCU
+ is ready
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f285c9532b5bd3de7e37a6203318437cab79bd9a ]
+
+When SCU is not ready and CONFIG_DEBUG_SHIRQ=y we got deferred probe followed
+by fired test IRQ which immediately makes kernel panic. Fix this by delaying
+IRQ handler registration till SCU is ready.
+
+Fixes: 80ae679b8f86 ("watchdog: intel-mid_wdt: Convert to use new SCU IPC API")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/intel-mid_wdt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/watchdog/intel-mid_wdt.c b/drivers/watchdog/intel-mid_wdt.c
+index 1ae03b64ef8bf..9b2173f765c8c 100644
+--- a/drivers/watchdog/intel-mid_wdt.c
++++ b/drivers/watchdog/intel-mid_wdt.c
+@@ -154,6 +154,10 @@ static int mid_wdt_probe(struct platform_device *pdev)
+ watchdog_set_nowayout(wdt_dev, WATCHDOG_NOWAYOUT);
+ watchdog_set_drvdata(wdt_dev, mid);
+
++ mid->scu = devm_intel_scu_ipc_dev_get(dev);
++ if (!mid->scu)
++ return -EPROBE_DEFER;
++
+ ret = devm_request_irq(dev, pdata->irq, mid_wdt_irq,
+ IRQF_SHARED | IRQF_NO_SUSPEND, "watchdog",
+ wdt_dev);
+@@ -162,10 +166,6 @@ static int mid_wdt_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- mid->scu = devm_intel_scu_ipc_dev_get(dev);
+- if (!mid->scu)
+- return -EPROBE_DEFER;
+-
+ /*
+ * The firmware followed by U-Boot leaves the watchdog running
+ * with the default threshold which may vary. When we get here
+--
+2.27.0
+
--- /dev/null
+From e8859d2db88a4545b2ab7cc4b5048e1be17ddd8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 17:25:47 +0100
+Subject: wireguard: device: do not generate ICMP for non-IP packets
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit 99fff5264e7ab06f45b0ad60243475be0a8d0559 ]
+
+If skb->protocol doesn't match the actual skb->data header, it's
+probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
+expecting to reply to a valid IP packet. So this commit has that early
+mismatch case jump to a later error label.
+
+Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireguard/device.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
+index a3ed49cd95c31..82ce757c852ee 100644
+--- a/drivers/net/wireguard/device.c
++++ b/drivers/net/wireguard/device.c
+@@ -138,7 +138,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
+ else if (skb->protocol == htons(ETH_P_IPV6))
+ net_dbg_ratelimited("%s: No peer has allowed IPs matching %pI6\n",
+ dev->name, &ipv6_hdr(skb)->daddr);
+- goto err;
++ goto err_icmp;
+ }
+
+ family = READ_ONCE(peer->endpoint.addr.sa_family);
+@@ -201,12 +201,13 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
+
+ err_peer:
+ wg_peer_put(peer);
+-err:
+- ++dev->stats.tx_errors;
++err_icmp:
+ if (skb->protocol == htons(ETH_P_IP))
+ icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+ else if (skb->protocol == htons(ETH_P_IPV6))
+ icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
++err:
++ ++dev->stats.tx_errors;
+ kfree_skb(skb);
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From e35af1cc14f48325e0330b24d21d54f959f28792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Feb 2021 17:25:49 +0100
+Subject: wireguard: kconfig: use arm chacha even with no neon
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit bce2473927af8de12ad131a743f55d69d358c0b9 ]
+
+The condition here was incorrect: a non-neon fallback implementation is
+available on arm32 when NEON is not supported.
+
+Reported-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 260f9f46668b8..63339d29be905 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -87,7 +87,7 @@ config WIREGUARD
+ select CRYPTO_CURVE25519_X86 if X86 && 64BIT
+ select ARM_CRYPTO if ARM
+ select ARM64_CRYPTO if ARM64
+- select CRYPTO_CHACHA20_NEON if (ARM || ARM64) && KERNEL_MODE_NEON
++ select CRYPTO_CHACHA20_NEON if ARM || (ARM64 && KERNEL_MODE_NEON)
+ select CRYPTO_POLY1305_NEON if ARM64 && KERNEL_MODE_NEON
+ select CRYPTO_POLY1305_ARM if ARM
+ select CRYPTO_CURVE25519_NEON if ARM && KERNEL_MODE_NEON
+--
+2.27.0
+
--- /dev/null
+From cdf78a28ab46b60deb5adf81c7792d7814b73f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jan 2021 21:24:56 +0900
+Subject: x86/MSR: Filter MSR writes through X86_IOC_WRMSR_REGS ioctl too
+
+From: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+
+[ Upstream commit 02a16aa13574c8526beadfc9ae8cc9b66315fa2d ]
+
+Commit
+
+ a7e1f67ed29f ("x86/msr: Filter MSR writes")
+
+introduced a module parameter to disable writing to the MSR device file
+and tainted the kernel upon writing. As MSR registers can be written by
+the X86_IOC_WRMSR_REGS ioctl too, the same filtering and tainting should
+be applied to the ioctl as well.
+
+ [ bp: Massage commit message and space out statements. ]
+
+Fixes: a7e1f67ed29f ("x86/msr: Filter MSR writes")
+Signed-off-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20210127122456.13939-1-misono.tomohiro@jp.fujitsu.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/msr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
+index 8a67d1fa8dc58..ed8ac6bcbafb2 100644
+--- a/arch/x86/kernel/msr.c
++++ b/arch/x86/kernel/msr.c
+@@ -182,6 +182,13 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
+ err = security_locked_down(LOCKDOWN_MSR);
+ if (err)
+ break;
++
++ err = filter_write(regs[1]);
++ if (err)
++ return err;
++
++ add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
++
+ err = wrmsr_safe_regs_on_cpu(cpu, regs);
+ if (err)
+ break;
+--
+2.27.0
+
--- /dev/null
+From d6b67942c2ed3d843692930bd3ef12c4d9de0d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jan 2021 15:23:11 -0800
+Subject: x86/sgx: Fix the return type of sgx_init()
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit 31bf92881714fe9962d43d097b5114a9b4ad0a12 ]
+
+device_initcall() expects a function of type initcall_t, which returns
+an integer. Change the signature of sgx_init() to match.
+
+Fixes: e7e0545299d8c ("x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections")
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Link: https://lkml.kernel.org/r/20210113232311.277302-1-samitolvanen@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/sgx/main.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/sgx/main.c b/arch/x86/kernel/cpu/sgx/main.c
+index c519fc5f69480..8df81a3ed9457 100644
+--- a/arch/x86/kernel/cpu/sgx/main.c
++++ b/arch/x86/kernel/cpu/sgx/main.c
+@@ -700,25 +700,27 @@ static bool __init sgx_page_cache_init(void)
+ return true;
+ }
+
+-static void __init sgx_init(void)
++static int __init sgx_init(void)
+ {
+ int ret;
+ int i;
+
+ if (!cpu_feature_enabled(X86_FEATURE_SGX))
+- return;
++ return -ENODEV;
+
+ if (!sgx_page_cache_init())
+- return;
++ return -ENOMEM;
+
+- if (!sgx_page_reclaimer_init())
++ if (!sgx_page_reclaimer_init()) {
++ ret = -ENOMEM;
+ goto err_page_cache;
++ }
+
+ ret = sgx_drv_init();
+ if (ret)
+ goto err_kthread;
+
+- return;
++ return 0;
+
+ err_kthread:
+ kthread_stop(ksgxd_tsk);
+@@ -728,6 +730,8 @@ err_page_cache:
+ vfree(sgx_epc_sections[i].pages);
+ memunmap(sgx_epc_sections[i].virt_addr);
+ }
++
++ return ret;
+ }
+
+ device_initcall(sgx_init);
+--
+2.27.0
+
--- /dev/null
+From e9bd0f9f39801cf34c77f480f47ae5610fd5220e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Feb 2021 11:16:12 +0100
+Subject: xen/netback: fix spurious event detection for common event case
+
+From: Juergen Gross <jgross@suse.com>
+
+[ Upstream commit a3daf3d39132b405781be8d9ede0c449b244b64e ]
+
+In case of a common event for rx and tx queue the event should be
+regarded to be spurious if no rx and no tx requests are pending.
+
+Unfortunately the condition for testing that is wrong causing to
+decide a event being spurious if no rx OR no tx requests are
+pending.
+
+Fix that plus using local variables for rx/tx pending indicators in
+order to split function calls and if condition.
+
+Fixes: 23025393dbeb3b ("xen/netback: use lateeoi irq binding")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Reviewed-by: Paul Durrant <paul@xen.org>
+Reviewed-by: Wei Liu <wl@xen.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/xen-netback/interface.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index acb786d8b1d8f..e02a4fbb74de5 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -162,13 +162,15 @@ irqreturn_t xenvif_interrupt(int irq, void *dev_id)
+ {
+ struct xenvif_queue *queue = dev_id;
+ int old;
++ bool has_rx, has_tx;
+
+ old = atomic_fetch_or(NETBK_COMMON_EOI, &queue->eoi_pending);
+ WARN(old, "Interrupt while EOI pending\n");
+
+- /* Use bitwise or as we need to call both functions. */
+- if ((!xenvif_handle_tx_interrupt(queue) |
+- !xenvif_handle_rx_interrupt(queue))) {
++ has_tx = xenvif_handle_tx_interrupt(queue);
++ has_rx = xenvif_handle_rx_interrupt(queue);
++
++ if (!has_rx && !has_tx) {
+ atomic_andnot(NETBK_COMMON_EOI, &queue->eoi_pending);
+ xen_irq_lateeoi(irq, XEN_EOI_FLAG_SPURIOUS);
+ }
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
