--- /dev/null
+From 7980dff398f86a618f502378fa27cf7e77449afa Mon Sep 17 00:00:00 2001
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+Date: Tue, 14 Jan 2020 17:09:24 +0100
+Subject: ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+commit 7980dff398f86a618f502378fa27cf7e77449afa upstream.
+
+Add a missing property to GMAC node so that multicast filtering works
+correctly.
+
+Fixes: 556cc1c5f528 ("ARC: [axs101] Add support for AXS101 SDP (software development platform)")
+Acked-by: Alexey Brodkin <abrodkin@synopsys.com>
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/boot/dts/axs10x_mb.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arc/boot/dts/axs10x_mb.dtsi
++++ b/arch/arc/boot/dts/axs10x_mb.dtsi
+@@ -78,6 +78,7 @@
+ interrupt-names = "macirq";
+ phy-mode = "rgmii";
+ snps,pbl = < 32 >;
++ snps,multicast-filter-bins = <256>;
+ clocks = <&apbclk>;
+ clock-names = "stmmaceth";
+ max-speed = <100>;
--- /dev/null
+From 01053dadb79d63b65f7b353e68b4b6ccf4effedb Mon Sep 17 00:00:00 2001
+From: Tero Kristo <t-kristo@ti.com>
+Date: Wed, 11 Dec 2019 08:07:18 -0600
+Subject: ARM: dts: am43xx: add support for clkout1 clock
+
+From: Tero Kristo <t-kristo@ti.com>
+
+commit 01053dadb79d63b65f7b353e68b4b6ccf4effedb upstream.
+
+clkout1 clock node and its generation tree was missing. Add this based
+on the data on TRM and PRCM functional spec.
+
+commit 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes") effectively
+reverted this commit 8010f13a40d3 ("ARM: dts: am43xx: add support for
+clkout1 clock") which is needed for the ov2659 camera sensor clock
+definition hence it is being re-applied here.
+
+Note that because of the current dts node name dependency for mapping to
+clock domain, we must still use "clkout1-*ck" naming instead of generic
+"clock@" naming for the node. And because of this, it's probably best to
+apply the dts node addition together along with the other clock changes.
+
+Fixes: 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes")
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Tested-by: Benoit Parrot <bparrot@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Benoit Parrot <bparrot@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/am43xx-clocks.dtsi | 54 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+--- a/arch/arm/boot/dts/am43xx-clocks.dtsi
++++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
+@@ -704,6 +704,60 @@
+ ti,bit-shift = <8>;
+ reg = <0x2a48>;
+ };
++
++ clkout1_osc_div_ck: clkout1-osc-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&sys_clkin_ck>;
++ ti,bit-shift = <20>;
++ ti,max-div = <4>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_mux_ck: clkout1-src2-mux-ck {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&clk_rc32k_ck>, <&sysclk_div>, <&dpll_ddr_m2_ck>,
++ <&dpll_per_m2_ck>, <&dpll_disp_m2_ck>,
++ <&dpll_mpu_m2_ck>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_pre_div_ck: clkout1-src2-pre-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&clkout1_src2_mux_ck>;
++ ti,bit-shift = <4>;
++ ti,max-div = <8>;
++ reg = <0x4100>;
++ };
++
++ clkout1_src2_post_div_ck: clkout1-src2-post-div-ck {
++ #clock-cells = <0>;
++ compatible = "ti,divider-clock";
++ clocks = <&clkout1_src2_pre_div_ck>;
++ ti,bit-shift = <8>;
++ ti,max-div = <32>;
++ ti,index-power-of-two;
++ reg = <0x4100>;
++ };
++
++ clkout1_mux_ck: clkout1-mux-ck {
++ #clock-cells = <0>;
++ compatible = "ti,mux-clock";
++ clocks = <&clkout1_osc_div_ck>, <&clk_rc32k_ck>,
++ <&clkout1_src2_post_div_ck>, <&dpll_extdev_m2_ck>;
++ ti,bit-shift = <16>;
++ reg = <0x4100>;
++ };
++
++ clkout1_ck: clkout1-ck {
++ #clock-cells = <0>;
++ compatible = "ti,gate-clock";
++ clocks = <&clkout1_mux_ck>;
++ ti,bit-shift = <23>;
++ reg = <0x4100>;
++ };
+ };
+
+ &prcm {
--- /dev/null
+From 9d39d86cd4af2b17b970d63307daad71f563d207 Mon Sep 17 00:00:00 2001
+From: Ingo van Lil <inguin@gmx.de>
+Date: Tue, 3 Dec 2019 15:21:47 +0100
+Subject: ARM: dts: at91: Reenable UART TX pull-ups
+
+From: Ingo van Lil <inguin@gmx.de>
+
+commit 9d39d86cd4af2b17b970d63307daad71f563d207 upstream.
+
+Pull-ups for SAM9 UART/USART TX lines were disabled in a previous
+commit. However, several chips in the SAM9 family require pull-ups to
+prevent the TX lines from falling (and causing an endless break
+condition) when the transceiver is disabled.
+
+From the SAM9G20 datasheet, 32.5.1: "To prevent the TXD line from
+falling when the USART is disabled, the use of an internal pull up
+is mandatory.". This commit reenables the pull-ups for all chips having
+that sentence in their datasheets.
+
+Fixes: 5e04822f7db5 ("ARM: dts: at91: fixes uart pinctrl, set pullup on rx, clear pullup on tx")
+Signed-off-by: Ingo van Lil <inguin@gmx.de>
+Cc: Peter Rosin <peda@axentia.se>
+Link: https://lore.kernel.org/r/20191203142147.875227-1-inguin@gmx.de
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91sam9260.dtsi | 12 ++++++------
+ arch/arm/boot/dts/at91sam9261.dtsi | 6 +++---
+ arch/arm/boot/dts/at91sam9263.dtsi | 6 +++---
+ arch/arm/boot/dts/at91sam9g45.dtsi | 8 ++++----
+ arch/arm/boot/dts/at91sam9rl.dtsi | 8 ++++----
+ 5 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -187,7 +187,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 5 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -221,7 +221,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -239,7 +239,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -257,7 +257,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 10 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 10 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 11 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -275,7 +275,7 @@
+ uart0 {
+ pinctrl_uart0: uart0-0 {
+ atmel,pins =
+- <AT91_PIOA 31 AT91_PERIPH_B AT91_PINCTRL_NONE
++ <AT91_PIOA 31 AT91_PERIPH_B AT91_PINCTRL_PULL_UP
+ AT91_PIOA 30 AT91_PERIPH_B AT91_PINCTRL_PULL_UP>;
+ };
+ };
+@@ -283,7 +283,7 @@
+ uart1 {
+ pinctrl_uart1: uart1-0 {
+ atmel,pins =
+- <AT91_PIOB 12 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+ };
+--- a/arch/arm/boot/dts/at91sam9261.dtsi
++++ b/arch/arm/boot/dts/at91sam9261.dtsi
+@@ -329,7 +329,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOC 8 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -347,7 +347,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOC 12 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -365,7 +365,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOC 14 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOC 14 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOC 15 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+--- a/arch/arm/boot/dts/at91sam9263.dtsi
++++ b/arch/arm/boot/dts/at91sam9263.dtsi
+@@ -183,7 +183,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOA 26 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOA 26 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOA 27 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -201,7 +201,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOD 0 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOD 0 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOD 1 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -219,7 +219,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOD 2 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOD 2 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOD 3 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+--- a/arch/arm/boot/dts/at91sam9g45.dtsi
++++ b/arch/arm/boot/dts/at91sam9g45.dtsi
+@@ -556,7 +556,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOB 19 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 19 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 18 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -574,7 +574,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 4 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 5 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -592,7 +592,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -610,7 +610,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_NONE
++ <AT91_PIOB 8 AT91_PERIPH_A AT91_PINCTRL_PULL_UP
+ AT91_PIOB 9 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+--- a/arch/arm/boot/dts/at91sam9rl.dtsi
++++ b/arch/arm/boot/dts/at91sam9rl.dtsi
+@@ -682,7 +682,7 @@
+ usart0 {
+ pinctrl_usart0: usart0-0 {
+ atmel,pins =
+- <AT91_PIOA 6 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 6 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 7 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -721,7 +721,7 @@
+ usart1 {
+ pinctrl_usart1: usart1-0 {
+ atmel,pins =
+- <AT91_PIOA 11 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 11 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 12 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -744,7 +744,7 @@
+ usart2 {
+ pinctrl_usart2: usart2-0 {
+ atmel,pins =
+- <AT91_PIOA 13 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOA 13 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOA 14 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
+@@ -767,7 +767,7 @@
+ usart3 {
+ pinctrl_usart3: usart3-0 {
+ atmel,pins =
+- <AT91_PIOB 0 AT91_PERIPH_A AT91_PINCTRL_NONE>,
++ <AT91_PIOB 0 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>,
+ <AT91_PIOB 1 AT91_PERIPH_A AT91_PINCTRL_PULL_UP>;
+ };
+
--- /dev/null
+From a7e0f3fc01df4b1b7077df777c37feae8c9e8b6d Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Fri, 10 Jan 2020 18:20:07 +0100
+Subject: ARM: dts: at91: sama5d3: define clock rate range for tcb1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+commit a7e0f3fc01df4b1b7077df777c37feae8c9e8b6d upstream.
+
+The clock rate range for the TCB1 clock is missing. define it in the device
+tree.
+
+Reported-by: Karl Rudbæk Olsen <karl@micro-technic.com>
+Fixes: d2e8190b7916 ("ARM: at91/dt: define sama5d3 clocks")
+Link: https://lore.kernel.org/r/20200110172007.1253659-2-alexandre.belloni@bootlin.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/sama5d3_tcb1.dtsi
++++ b/arch/arm/boot/dts/sama5d3_tcb1.dtsi
+@@ -22,6 +22,7 @@
+ tcb1_clk: tcb1_clk {
+ #clock-cells = <0>;
+ reg = <27>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+ };
+ };
--- /dev/null
+From ee0aa926ddb0bd8ba59e33e3803b3b5804e3f5da Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Date: Fri, 10 Jan 2020 18:20:06 +0100
+Subject: ARM: dts: at91: sama5d3: fix maximum peripheral clock rates
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+commit ee0aa926ddb0bd8ba59e33e3803b3b5804e3f5da upstream.
+
+Currently the maximum rate for peripheral clock is calculated based on a
+typical 133MHz MCK. The maximum frequency is defined in the datasheet as a
+ratio to MCK. Some sama5d3 platforms are using a 166MHz MCK. Update the
+device trees to match the maximum rate based on 166MHz.
+
+Reported-by: Karl Rudbæk Olsen <karl@micro-technic.com>
+Fixes: d2e8190b7916 ("ARM: at91/dt: define sama5d3 clocks")
+Link: https://lore.kernel.org/r/20200110172007.1253659-1-alexandre.belloni@bootlin.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sama5d3.dtsi | 28 ++++++++++++++--------------
+ arch/arm/boot/dts/sama5d3_can.dtsi | 4 ++--
+ arch/arm/boot/dts/sama5d3_uart.dtsi | 4 ++--
+ 3 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/arch/arm/boot/dts/sama5d3.dtsi
++++ b/arch/arm/boot/dts/sama5d3.dtsi
+@@ -1188,49 +1188,49 @@
+ usart0_clk: usart0_clk {
+ #clock-cells = <0>;
+ reg = <12>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart1_clk: usart1_clk {
+ #clock-cells = <0>;
+ reg = <13>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart2_clk: usart2_clk {
+ #clock-cells = <0>;
+ reg = <14>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ usart3_clk: usart3_clk {
+ #clock-cells = <0>;
+ reg = <15>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ uart0_clk: uart0_clk {
+ #clock-cells = <0>;
+ reg = <16>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ twi0_clk: twi0_clk {
+ reg = <18>;
+ #clock-cells = <0>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ twi1_clk: twi1_clk {
+ #clock-cells = <0>;
+ reg = <19>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ twi2_clk: twi2_clk {
+ #clock-cells = <0>;
+ reg = <20>;
+- atmel,clk-output-range = <0 16625000>;
++ atmel,clk-output-range = <0 41500000>;
+ };
+
+ mci0_clk: mci0_clk {
+@@ -1246,19 +1246,19 @@
+ spi0_clk: spi0_clk {
+ #clock-cells = <0>;
+ reg = <24>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ spi1_clk: spi1_clk {
+ #clock-cells = <0>;
+ reg = <25>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ tcb0_clk: tcb0_clk {
+ #clock-cells = <0>;
+ reg = <26>;
+- atmel,clk-output-range = <0 133000000>;
++ atmel,clk-output-range = <0 166000000>;
+ };
+
+ pwm_clk: pwm_clk {
+@@ -1269,7 +1269,7 @@
+ adc_clk: adc_clk {
+ #clock-cells = <0>;
+ reg = <29>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ dma0_clk: dma0_clk {
+@@ -1300,13 +1300,13 @@
+ ssc0_clk: ssc0_clk {
+ #clock-cells = <0>;
+ reg = <38>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ ssc1_clk: ssc1_clk {
+ #clock-cells = <0>;
+ reg = <39>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ sha_clk: sha_clk {
+--- a/arch/arm/boot/dts/sama5d3_can.dtsi
++++ b/arch/arm/boot/dts/sama5d3_can.dtsi
+@@ -36,13 +36,13 @@
+ can0_clk: can0_clk {
+ #clock-cells = <0>;
+ reg = <40>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ can1_clk: can1_clk {
+ #clock-cells = <0>;
+ reg = <41>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+ };
+ };
+--- a/arch/arm/boot/dts/sama5d3_uart.dtsi
++++ b/arch/arm/boot/dts/sama5d3_uart.dtsi
+@@ -41,13 +41,13 @@
+ uart0_clk: uart0_clk {
+ #clock-cells = <0>;
+ reg = <16>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+
+ uart1_clk: uart1_clk {
+ #clock-cells = <0>;
+ reg = <17>;
+- atmel,clk-output-range = <0 66000000>;
++ atmel,clk-output-range = <0 83000000>;
+ };
+ };
+ };
--- /dev/null
+From fe634a7a9a57fb736e39fb71aa9adc6448a90f94 Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Wed, 25 Dec 2019 02:06:06 +0100
+Subject: ARM: dts: meson8: use the actual frequency for the GPU's 182.1MHz OPP
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+commit fe634a7a9a57fb736e39fb71aa9adc6448a90f94 upstream.
+
+The clock setup on Meson8 cannot achieve a Mali frequency of exactly
+182.15MHz. The vendor driver uses "FCLK_DIV7 / 2" for this frequency,
+which translates to 2550MHz / 7 / 2 = 182142857Hz.
+Update the GPU operating point to that specific frequency to not confuse
+myself when comparing the frequency from the .dts with the actual clock
+rate on the system.
+
+Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/meson8.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -129,8 +129,8 @@
+ gpu_opp_table: gpu-opp-table {
+ compatible = "operating-points-v2";
+
+- opp-182150000 {
+- opp-hz = /bits/ 64 <182150000>;
++ opp-182142857 {
++ opp-hz = /bits/ 64 <182142857>;
+ opp-microvolt = <1150000>;
+ };
+ opp-318750000 {
--- /dev/null
+From c3dd3315ab58b2cfa1916df55b0d0f9fbd94266f Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Wed, 25 Dec 2019 02:06:07 +0100
+Subject: ARM: dts: meson8b: use the actual frequency for the GPU's 364MHz OPP
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+commit c3dd3315ab58b2cfa1916df55b0d0f9fbd94266f upstream.
+
+The clock setup on Meson8 cannot achieve a Mali frequency of exactly
+182.15MHz. The vendor driver uses "FCLK_DIV7 / 1" for this frequency,
+which translates to 2550MHz / 7 / 1 = 364285714Hz.
+Update the GPU operating point to that specific frequency to not confuse
+myself when comparing the frequency from the .dts with the actual clock
+rate on the system.
+
+Fixes: c3ea80b6138cae ("ARM: dts: meson8b: add the Mali-450 MP2 GPU")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/meson8b.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/meson8b.dtsi
++++ b/arch/arm/boot/dts/meson8b.dtsi
+@@ -125,8 +125,8 @@
+ opp-hz = /bits/ 64 <255000000>;
+ opp-microvolt = <1100000>;
+ };
+- opp-364300000 {
+- opp-hz = /bits/ 64 <364300000>;
++ opp-364285714 {
++ opp-hz = /bits/ 64 <364285714>;
+ opp-microvolt = <1100000>;
+ };
+ opp-425000000 {
--- /dev/null
+From 62bba54d99407aedfe9b0a02e72e23c06e2b0116 Mon Sep 17 00:00:00 2001
+From: Baruch Siach <baruch@tkos.co.il>
+Date: Thu, 19 Dec 2019 12:28:45 +0200
+Subject: arm64: dts: marvell: clearfog-gt-8k: fix switch cpu port node
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+commit 62bba54d99407aedfe9b0a02e72e23c06e2b0116 upstream.
+
+Explicitly set the switch cpu (upstream) port phy-mode and managed
+properties. This fixes the Marvell 88E6141 switch serdes configuration
+with the recently enabled phylink layer.
+
+Fixes: a6120833272c ("arm64: dts: add support for SolidRun Clearfog GT 8K")
+Reported-by: Denis Odintsov <d.odintsov@traviangames.com>
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
++++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts
+@@ -408,6 +408,8 @@
+ reg = <5>;
+ label = "cpu";
+ ethernet = <&cp1_eth2>;
++ phy-mode = "2500base-x";
++ managed = "in-band-status";
+ };
+ };
+
--- /dev/null
+From 05caa5bf9cab9983dd7a50428c46b7e617ba20d6 Mon Sep 17 00:00:00 2001
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Date: Wed, 6 Nov 2019 20:59:48 -0800
+Subject: arm64: dts: qcom: msm8998: Fix tcsr syscon size
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+commit 05caa5bf9cab9983dd7a50428c46b7e617ba20d6 upstream.
+
+The tcsr syscon region is really 0x40000 in size. We need access to the
+full region so that we can access the axi resets when managing the
+modem subsystem.
+
+Fixes: c7833949564e ("arm64: dts: qcom: msm8998: Add smem related nodes")
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Link: https://lore.kernel.org/r/20191107045948.4341-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -987,7 +987,7 @@
+
+ tcsr_mutex_regs: syscon@1f40000 {
+ compatible = "syscon";
+- reg = <0x01f40000 0x20000>;
++ reg = <0x01f40000 0x40000>;
+ };
+
+ tlmm: pinctrl@3400000 {
--- /dev/null
+From c9ec155b5962233aff3df65210bd6a4788dee21c Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Mon, 18 Nov 2019 17:18:23 -0800
+Subject: arm64: dts: qcom: msm8998-mtp: Add alias for blsp1_uart3
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit c9ec155b5962233aff3df65210bd6a4788dee21c upstream.
+
+The msm_serial driver has a predefined set of uart ports defined, which
+is allocated either by reading aliases or if no match is found a simple
+counter, starting at index 0. But there's no logic in place to prevent
+these two allocation mechanism from colliding. As a result either none
+or all of the active msm_serial instances must be listed as aliases.
+
+Define blsp1_uart3 as "serial1" to mitigate this problem.
+
+Fixes: 4cffb9f2c700 ("arm64: dts: qcom: msm8998-mtp: Enable bluetooth")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Link: https://lore.kernel.org/r/20191119011823.379100-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi
+@@ -9,6 +9,7 @@
+ / {
+ aliases {
+ serial0 = &blsp2_uart1;
++ serial1 = &blsp1_uart3;
+ };
+
+ chosen {
--- /dev/null
+From bf2b74ce9b33a2edd6ba1930ce60a71830790910 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Mon, 16 Dec 2019 11:08:22 +0900
+Subject: arm64: dts: renesas: r8a77990: ebisu: Remove clkout-lr-synchronous from sound
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+commit bf2b74ce9b33a2edd6ba1930ce60a71830790910 upstream.
+
+rcar_sound doesn't support clkout-lr-synchronous in upstream.
+It was supported under out-of-tree rcar_sound.
+upstream rcar_sound is supporting
+ - clkout-lr-synchronous
+ + clkout-lr-asynchronous
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87mubt3tux.wl-kuninori.morimoto.gx@renesas.com
+Fixes: 56629fcba94c698d ("arm64: dts: renesas: ebisu: Enable Audio")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts
+@@ -636,7 +636,6 @@
+ /* audio_clkout0/1/2/3 */
+ #clock-cells = <1>;
+ clock-frequency = <12288000 11289600>;
+- clkout-lr-synchronous;
+
+ status = "okay";
+
--- /dev/null
+From 1eebac0240580b531954b02c05068051df41142a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sat, 16 Nov 2019 11:06:56 +0000
+Subject: arm64: dts: uDPU: fix broken ethernet
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 1eebac0240580b531954b02c05068051df41142a upstream.
+
+The uDPU uses both ethernet controllers, which ties up COMPHY 0 for
+eth1 and COMPHY 1 for eth0, with no USB3 comphy. The addition of
+COMPHY support made the kernel override the setup by the boot loader
+breaking this platform by assuming that COMPHY 0 was always used for
+USB3. Delete the USB3 COMPHY definition at platform level, and add
+phy specifications for the ethernet channels.
+
+Fixes: bd3d25b07342 ("arm64: dts: marvell: armada-37xx: link USB hosts with their PHYs")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts
+@@ -143,6 +143,7 @@
+ phy-mode = "sgmii";
+ status = "okay";
+ managed = "in-band-status";
++ phys = <&comphy1 0>;
+ sfp = <&sfp_eth0>;
+ };
+
+@@ -150,11 +151,14 @@
+ phy-mode = "sgmii";
+ status = "okay";
+ managed = "in-band-status";
++ phys = <&comphy0 1>;
+ sfp = <&sfp_eth1>;
+ };
+
+ &usb3 {
+ status = "okay";
++ phys = <&usb2_utmi_otg_phy>;
++ phy-names = "usb2-utmi-otg-phy";
+ };
+
+ &uart0 {
--- /dev/null
+From 88d6f130e5632bbf419a2e184ec7adcbe241260b Mon Sep 17 00:00:00 2001
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Fri, 7 Feb 2020 00:18:10 -0800
+Subject: bpf: Improve bucket_log calculation logic
+
+From: Martin KaFai Lau <kafai@fb.com>
+
+commit 88d6f130e5632bbf419a2e184ec7adcbe241260b upstream.
+
+It was reported that the max_t, ilog2, and roundup_pow_of_two macros have
+exponential effects on the number of states in the sparse checker.
+
+This patch breaks them up by calculating the "nbuckets" first so that the
+"bucket_log" only needs to take ilog2().
+
+In addition, Linus mentioned:
+
+ Patch looks good, but I'd like to point out that it's not just sparse.
+
+ You can see it with a simple
+
+ make net/core/bpf_sk_storage.i
+ grep 'smap->bucket_log = ' net/core/bpf_sk_storage.i | wc
+
+ and see the end result:
+
+ 1 365071 2686974
+
+ That's one line (the assignment line) that is 2,686,974 characters in
+ length.
+
+ Now, sparse does happen to react particularly badly to that (I didn't
+ look to why, but I suspect it's just that evaluating all the types
+ that don't actually ever end up getting used ends up being much more
+ expensive than it should be), but I bet it's not good for gcc either.
+
+Fixes: 6ac99e8f23d4 ("bpf: Introduce bpf sk local storage")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Link: https://lore.kernel.org/bpf/20200207081810.3918919-1-kafai@fb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/bpf_sk_storage.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/core/bpf_sk_storage.c
++++ b/net/core/bpf_sk_storage.c
+@@ -643,9 +643,10 @@ static struct bpf_map *bpf_sk_storage_ma
+ return ERR_PTR(-ENOMEM);
+ bpf_map_init_from_attr(&smap->map, attr);
+
++ nbuckets = roundup_pow_of_two(num_possible_cpus());
+ /* Use at least 2 buckets, select_bucket() is undefined behavior with 1 bucket */
+- smap->bucket_log = max_t(u32, 1, ilog2(roundup_pow_of_two(num_possible_cpus())));
+- nbuckets = 1U << smap->bucket_log;
++ nbuckets = max_t(u32, 2, nbuckets);
++ smap->bucket_log = ilog2(nbuckets);
+ cost = sizeof(*smap->buckets) * nbuckets + sizeof(*smap);
+
+ ret = bpf_map_charge_init(&smap->map.memory, cost);
--- /dev/null
+From 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 Mon Sep 17 00:00:00 2001
+From: Jakub Sitnicki <jakub@cloudflare.com>
+Date: Thu, 6 Feb 2020 12:16:51 +0100
+Subject: bpf, sockhash: Synchronize_rcu before free'ing map
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+commit 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 upstream.
+
+We need to have a synchronize_rcu before free'ing the sockhash because any
+outstanding psock references will have a pointer to the map and when they
+use it, this could trigger a use after free.
+
+This is a sister fix for sockhash, following commit 2bb90e5cc90e ("bpf:
+sockmap, synchronize_rcu before free'ing map") which addressed sockmap,
+which comes from a manual audit.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200206111652.694507-3-jakub@cloudflare.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/sock_map.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -250,6 +250,7 @@ static void sock_map_free(struct bpf_map
+ }
+ raw_spin_unlock_bh(&stab->lock);
+
++ /* wait for psock readers accessing its map link */
+ synchronize_rcu();
+
+ bpf_map_area_free(stab->sks);
+@@ -873,6 +874,9 @@ static void sock_hash_free(struct bpf_ma
+ raw_spin_unlock_bh(&bucket->lock);
+ }
+
++ /* wait for psock readers accessing its map link */
++ synchronize_rcu();
++
+ bpf_map_area_free(htab->buckets);
+ kfree(htab);
+ }
--- /dev/null
+From 85b8ac01a421791d66c3a458a7f83cfd173fe3fa Mon Sep 17 00:00:00 2001
+From: Lorenz Bauer <lmb@cloudflare.com>
+Date: Fri, 7 Feb 2020 10:37:12 +0000
+Subject: bpf, sockmap: Check update requirements after locking
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+commit 85b8ac01a421791d66c3a458a7f83cfd173fe3fa upstream.
+
+It's currently possible to insert sockets in unexpected states into
+a sockmap, due to a TOCTTOU when updating the map from a syscall.
+sock_map_update_elem checks that sk->sk_state == TCP_ESTABLISHED,
+locks the socket and then calls sock_map_update_common. At this
+point, the socket may have transitioned into another state, and
+the earlier assumptions don't hold anymore. Crucially, it's
+conceivable (though very unlikely) that a socket has become unhashed.
+This breaks the sockmap's assumption that it will get a callback
+via sk->sk_prot->unhash.
+
+Fix this by checking the (fixed) sk_type and sk_protocol without the
+lock, followed by a locked check of sk_state.
+
+Unfortunately it's not possible to push the check down into
+sock_(map|hash)_update_common, since BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB
+run before the socket has transitioned from TCP_SYN_RECV into
+TCP_ESTABLISHED.
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/20200207103713.28175-1-lmb@cloudflare.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/sock_map.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -417,14 +417,16 @@ static int sock_map_update_elem(struct b
+ ret = -EINVAL;
+ goto out;
+ }
+- if (!sock_map_sk_is_suitable(sk) ||
+- sk->sk_state != TCP_ESTABLISHED) {
++ if (!sock_map_sk_is_suitable(sk)) {
+ ret = -EOPNOTSUPP;
+ goto out;
+ }
+
+ sock_map_sk_acquire(sk);
+- ret = sock_map_update_common(map, idx, sk, flags);
++ if (sk->sk_state != TCP_ESTABLISHED)
++ ret = -EOPNOTSUPP;
++ else
++ ret = sock_map_update_common(map, idx, sk, flags);
+ sock_map_sk_release(sk);
+ out:
+ fput(sock->file);
+@@ -740,14 +742,16 @@ static int sock_hash_update_elem(struct
+ ret = -EINVAL;
+ goto out;
+ }
+- if (!sock_map_sk_is_suitable(sk) ||
+- sk->sk_state != TCP_ESTABLISHED) {
++ if (!sock_map_sk_is_suitable(sk)) {
+ ret = -EOPNOTSUPP;
+ goto out;
+ }
+
+ sock_map_sk_acquire(sk);
+- ret = sock_hash_update_common(map, key, sk, flags);
++ if (sk->sk_state != TCP_ESTABLISHED)
++ ret = -EOPNOTSUPP;
++ else
++ ret = sock_hash_update_common(map, key, sk, flags);
+ sock_map_sk_release(sk);
+ out:
+ fput(sock->file);
--- /dev/null
+From db6a5018b6e008c1d69c6628cdaa9541b8e70940 Mon Sep 17 00:00:00 2001
+From: Jakub Sitnicki <jakub@cloudflare.com>
+Date: Thu, 6 Feb 2020 12:16:50 +0100
+Subject: bpf, sockmap: Don't sleep while holding RCU lock on tear-down
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+commit db6a5018b6e008c1d69c6628cdaa9541b8e70940 upstream.
+
+rcu_read_lock is needed to protect access to psock inside sock_map_unref
+when tearing down the map. However, we can't afford to sleep in lock_sock
+while in RCU read-side critical section. Grab the RCU lock only after we
+have locked the socket.
+
+This fixes RCU warnings triggerable on a VM with 1 vCPU when free'ing a
+sockmap/sockhash that contains at least one socket:
+
+| =============================
+| WARNING: suspicious RCU usage
+| 5.5.0-04005-g8fc91b972b73 #450 Not tainted
+| -----------------------------
+| include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section!
+|
+| other info that might help us debug this:
+|
+|
+| rcu_scheduler_active = 2, debug_locks = 1
+| 4 locks held by kworker/0:1/62:
+| #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0
+| #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0
+| #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_map_free+0x5/0x170
+| #3: ffff8881368c5df8 (&stab->lock){+...}, at: sock_map_free+0x64/0x170
+|
+| stack backtrace:
+| CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73 #450
+| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+| Workqueue: events bpf_map_free_deferred
+| Call Trace:
+| dump_stack+0x71/0xa0
+| ___might_sleep+0x105/0x190
+| lock_sock_nested+0x28/0x90
+| sock_map_free+0x95/0x170
+| bpf_map_free_deferred+0x58/0x80
+| process_one_work+0x260/0x5e0
+| worker_thread+0x4d/0x3e0
+| kthread+0x108/0x140
+| ? process_one_work+0x5e0/0x5e0
+| ? kthread_park+0x90/0x90
+| ret_from_fork+0x3a/0x50
+
+| =============================
+| WARNING: suspicious RCU usage
+| 5.5.0-04005-g8fc91b972b73-dirty #452 Not tainted
+| -----------------------------
+| include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section!
+|
+| other info that might help us debug this:
+|
+|
+| rcu_scheduler_active = 2, debug_locks = 1
+| 4 locks held by kworker/0:1/62:
+| #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0
+| #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0
+| #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_hash_free+0x5/0x1d0
+| #3: ffff888139966e00 (&htab->buckets[i].lock){+...}, at: sock_hash_free+0x92/0x1d0
+|
+| stack backtrace:
+| CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73-dirty #452
+| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+| Workqueue: events bpf_map_free_deferred
+| Call Trace:
+| dump_stack+0x71/0xa0
+| ___might_sleep+0x105/0x190
+| lock_sock_nested+0x28/0x90
+| sock_hash_free+0xec/0x1d0
+| bpf_map_free_deferred+0x58/0x80
+| process_one_work+0x260/0x5e0
+| worker_thread+0x4d/0x3e0
+| kthread+0x108/0x140
+| ? process_one_work+0x5e0/0x5e0
+| ? kthread_park+0x90/0x90
+| ret_from_fork+0x3a/0x50
+
+Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200206111652.694507-2-jakub@cloudflare.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/sock_map.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -234,7 +234,6 @@ static void sock_map_free(struct bpf_map
+ int i;
+
+ synchronize_rcu();
+- rcu_read_lock();
+ raw_spin_lock_bh(&stab->lock);
+ for (i = 0; i < stab->map.max_entries; i++) {
+ struct sock **psk = &stab->sks[i];
+@@ -243,12 +242,13 @@ static void sock_map_free(struct bpf_map
+ sk = xchg(psk, NULL);
+ if (sk) {
+ lock_sock(sk);
++ rcu_read_lock();
+ sock_map_unref(sk, psk);
++ rcu_read_unlock();
+ release_sock(sk);
+ }
+ }
+ raw_spin_unlock_bh(&stab->lock);
+- rcu_read_unlock();
+
+ synchronize_rcu();
+
+@@ -859,19 +859,19 @@ static void sock_hash_free(struct bpf_ma
+ int i;
+
+ synchronize_rcu();
+- rcu_read_lock();
+ for (i = 0; i < htab->buckets_num; i++) {
+ bucket = sock_hash_select_bucket(htab, i);
+ raw_spin_lock_bh(&bucket->lock);
+ hlist_for_each_entry_safe(elem, node, &bucket->head, node) {
+ hlist_del_rcu(&elem->node);
+ lock_sock(elem->sk);
++ rcu_read_lock();
+ sock_map_unref(elem->sk, elem);
++ rcu_read_unlock();
+ release_sock(elem->sk);
+ }
+ raw_spin_unlock_bh(&bucket->lock);
+ }
+- rcu_read_unlock();
+
+ bpf_map_area_free(htab->buckets);
+ kfree(htab);
--- /dev/null
+From d95f1e8b462c4372ac409886070bb8719d8a4d3a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
+Date: Thu, 6 Feb 2020 11:29:06 +0100
+Subject: bpftool: Don't crash on missing xlated program instructions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+commit d95f1e8b462c4372ac409886070bb8719d8a4d3a upstream.
+
+Turns out the xlated program instructions can also be missing if
+kptr_restrict sysctl is set. This means that the previous fix to check the
+jited_prog_insns pointer was insufficient; add another check of the
+xlated_prog_insns pointer as well.
+
+Fixes: 5b79bcdf0362 ("bpftool: Don't crash on missing jited insns or ksyms")
+Fixes: cae73f233923 ("bpftool: use bpf_program__get_prog_info_linear() in prog.c:do_dump()")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20200206102906.112551-1-toke@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/bpf/bpftool/prog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -500,7 +500,7 @@ static int do_dump(int argc, char **argv
+ buf = (unsigned char *)(info->jited_prog_insns);
+ member_len = info->jited_prog_len;
+ } else { /* DUMP_XLATED */
+- if (info->xlated_prog_len == 0) {
++ if (info->xlated_prog_len == 0 || !info->xlated_prog_insns) {
+ p_err("error retrieving insn dump: kernel.kptr_restrict set?");
+ goto err_free;
+ }
--- /dev/null
+From 72d052e28d1d2363f9107be63ef3a3afdea6143c Mon Sep 17 00:00:00 2001
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+Date: Fri, 10 Jan 2020 09:30:42 +0800
+Subject: MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+commit 72d052e28d1d2363f9107be63ef3a3afdea6143c upstream.
+
+If kzalloc fails, it should return -ENOMEM, otherwise may trigger a NULL
+pointer dereference.
+
+Fixes: 3adeb2566b9b ("MIPS: Loongson: Improve LEFI firmware interface")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/loongson64/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/mips/loongson64/platform.c
++++ b/arch/mips/loongson64/platform.c
+@@ -27,6 +27,9 @@ static int __init loongson3_platform_ini
+ continue;
+
+ pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
++ if (!pdev)
++ return -ENOMEM;
++
+ pdev->name = loongson_sysconf.sensors[i].name;
+ pdev->id = loongson_sysconf.sensors[i].id;
+ pdev->dev.platform_data = &loongson_sysconf.sensors[i];
--- /dev/null
+From d08f3010f4a32eec3c8aa771f03a1b342a1472fa Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 7 Feb 2020 11:29:51 +0100
+Subject: mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+commit d08f3010f4a32eec3c8aa771f03a1b342a1472fa upstream.
+
+Fix u8 cast reading max_nss from MT_TOP_STRAP_STA register in
+mt7615_eeprom_parse_hw_cap routine
+
+Fixes: acf5457fd99db ("mt76: mt7615: read {tx,rx} mask from eeprom")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+@@ -92,8 +92,9 @@ static int mt7615_check_eeprom(struct mt
+
+ static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev *dev)
+ {
+- u8 val, *eeprom = dev->mt76.eeprom.data;
++ u8 *eeprom = dev->mt76.eeprom.data;
+ u8 tx_mask, rx_mask, max_nss;
++ u32 val;
+
+ val = FIELD_GET(MT_EE_NIC_WIFI_CONF_BAND_SEL,
+ eeprom[MT_EE_WIFI_CONF]);
--- /dev/null
+From 6ab63366e1ec4ec1900f253aa64727b4b5f4ee73 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sat, 1 Feb 2020 16:43:04 +0000
+Subject: netdevsim: disable devlink reload when resources are being used
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 6ab63366e1ec4ec1900f253aa64727b4b5f4ee73 upstream.
+
+devlink reload destroys resources and allocates resources again.
+So, when devices and ports resources are being used, devlink reload
+function should not be executed. In order to avoid this race, a new
+lock is added and new_port() and del_port() call devlink_reload_disable()
+and devlink_reload_enable().
+
+Thread0 Thread1
+{new/del}_port() {new/del}_port()
+devlink_reload_disable()
+ devlink_reload_disable()
+devlink_reload_enable()
+ //here
+ devlink_reload_enable()
+
+Before Thread1's devlink_reload_enable(), the devlink is already allowed
+to execute reload because Thread0 allows it. devlink reload disable/enable
+variable type is bool. So the above case would exist.
+So, disable/enable should be executed atomically.
+In order to do that, a new lock is used.
+
+Test commands:
+ modprobe netdevsim
+ echo 1 > /sys/bus/netdevsim/new_device
+ while :
+ do
+ echo 1 > /sys/devices/netdevsim1/new_port &
+ echo 1 > /sys/devices/netdevsim1/del_port &
+ devlink dev reload netdevsim/netdevsim1 &
+ done
+
+Splat looks like:
+[ 23.342145][ T932] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock))
+[ 23.342159][ T932] WARNING: CPU: 0 PID: 932 at kernel/locking/mutex-debug.c:103 mutex_destroy+0xc7/0xf0
+[ 23.344182][ T932] Modules linked in: netdevsim openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_dx
+[ 23.346485][ T932] CPU: 0 PID: 932 Comm: devlink Not tainted 5.5.0+ #322
+[ 23.347696][ T932] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 23.348893][ T932] RIP: 0010:mutex_destroy+0xc7/0xf0
+[ 23.349505][ T932] Code: e0 07 83 c0 03 38 d0 7c 04 84 d2 75 2e 8b 05 00 ac b0 02 85 c0 75 8b 48 c7 c6 00 5e 07 96 40
+[ 23.351887][ T932] RSP: 0018:ffff88806208f810 EFLAGS: 00010286
+[ 23.353963][ T932] RAX: dffffc0000000008 RBX: ffff888067f6f2c0 RCX: ffffffff942c4bd4
+[ 23.355222][ T932] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff96dac5b4
+[ 23.356169][ T932] RBP: ffff888067f6f000 R08: fffffbfff2d235a5 R09: fffffbfff2d235a5
+[ 23.357160][ T932] R10: 0000000000000001 R11: fffffbfff2d235a4 R12: ffff888067f6f208
+[ 23.358288][ T932] R13: ffff88806208fa70 R14: ffff888067f6f000 R15: ffff888069ce3800
+[ 23.359307][ T932] FS: 00007fe2a3876740(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000
+[ 23.360473][ T932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 23.361319][ T932] CR2: 00005561357aa000 CR3: 000000005227a006 CR4: 00000000000606f0
+[ 23.362323][ T932] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 23.363417][ T932] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 23.364414][ T932] Call Trace:
+[ 23.364828][ T932] nsim_dev_reload_destroy+0x77/0xb0 [netdevsim]
+[ 23.365655][ T932] nsim_dev_reload_down+0x84/0xb0 [netdevsim]
+[ 23.366433][ T932] devlink_reload+0xb1/0x350
+[ 23.367010][ T932] genl_rcv_msg+0x580/0xe90
+
+[ ...]
+
+[ 23.531729][ T1305] kernel BUG at lib/list_debug.c:53!
+[ 23.532523][ T1305] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
+[ 23.533467][ T1305] CPU: 2 PID: 1305 Comm: bash Tainted: G W 5.5.0+ #322
+[ 23.534962][ T1305] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 23.536503][ T1305] RIP: 0010:__list_del_entry_valid+0xe6/0x150
+[ 23.538346][ T1305] Code: 89 ea 48 c7 c7 00 73 1e 96 e8 df f7 4c ff 0f 0b 48 c7 c7 60 73 1e 96 e8 d1 f7 4c ff 0f 0b 44
+[ 23.541068][ T1305] RSP: 0018:ffff888047c27b58 EFLAGS: 00010282
+[ 23.542001][ T1305] RAX: 0000000000000054 RBX: ffff888067f6f318 RCX: 0000000000000000
+[ 23.543051][ T1305] RDX: 0000000000000054 RSI: 0000000000000008 RDI: ffffed1008f84f61
+[ 23.544072][ T1305] RBP: ffff88804aa0fca0 R08: ffffed100d940539 R09: ffffed100d940539
+[ 23.545085][ T1305] R10: 0000000000000001 R11: ffffed100d940538 R12: ffff888047c27cb0
+[ 23.546422][ T1305] R13: ffff88806208b840 R14: ffffffff981976c0 R15: ffff888067f6f2c0
+[ 23.547406][ T1305] FS: 00007f76c0431740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
+[ 23.548527][ T1305] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 23.549389][ T1305] CR2: 00007f5048f1a2f8 CR3: 000000004b310006 CR4: 00000000000606e0
+[ 23.550636][ T1305] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 23.551578][ T1305] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 23.552597][ T1305] Call Trace:
+[ 23.553004][ T1305] mutex_remove_waiter+0x101/0x520
+[ 23.553646][ T1305] __mutex_lock+0xac7/0x14b0
+[ 23.554218][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim]
+[ 23.554908][ T1305] ? mutex_lock_io_nested+0x1380/0x1380
+[ 23.555570][ T1305] ? _parse_integer+0xf0/0xf0
+[ 23.556043][ T1305] ? kstrtouint+0x86/0x110
+[ 23.556504][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim]
+[ 23.557133][ T1305] nsim_dev_port_del+0x4e/0x140 [netdevsim]
+[ 23.558024][ T1305] del_port_store+0xcc/0xf0 [netdevsim]
+[ ... ]
+
+Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netdevsim/bus.c | 19 +++++++++++++++++++
+ drivers/net/netdevsim/netdevsim.h | 2 ++
+ 2 files changed, 21 insertions(+)
+
+--- a/drivers/net/netdevsim/bus.c
++++ b/drivers/net/netdevsim/bus.c
+@@ -97,6 +97,8 @@ new_port_store(struct device *dev, struc
+ const char *buf, size_t count)
+ {
+ struct nsim_bus_dev *nsim_bus_dev = to_nsim_bus_dev(dev);
++ struct nsim_dev *nsim_dev = dev_get_drvdata(dev);
++ struct devlink *devlink;
+ unsigned int port_index;
+ int ret;
+
+@@ -106,7 +108,14 @@ new_port_store(struct device *dev, struc
+ ret = kstrtouint(buf, 0, &port_index);
+ if (ret)
+ return ret;
++
++ devlink = priv_to_devlink(nsim_dev);
++
++ mutex_lock(&nsim_bus_dev->nsim_bus_reload_lock);
++ devlink_reload_disable(devlink);
+ ret = nsim_dev_port_add(nsim_bus_dev, port_index);
++ devlink_reload_enable(devlink);
++ mutex_unlock(&nsim_bus_dev->nsim_bus_reload_lock);
+ return ret ? ret : count;
+ }
+
+@@ -117,6 +126,8 @@ del_port_store(struct device *dev, struc
+ const char *buf, size_t count)
+ {
+ struct nsim_bus_dev *nsim_bus_dev = to_nsim_bus_dev(dev);
++ struct nsim_dev *nsim_dev = dev_get_drvdata(dev);
++ struct devlink *devlink;
+ unsigned int port_index;
+ int ret;
+
+@@ -126,7 +137,14 @@ del_port_store(struct device *dev, struc
+ ret = kstrtouint(buf, 0, &port_index);
+ if (ret)
+ return ret;
++
++ devlink = priv_to_devlink(nsim_dev);
++
++ mutex_lock(&nsim_bus_dev->nsim_bus_reload_lock);
++ devlink_reload_disable(devlink);
+ ret = nsim_dev_port_del(nsim_bus_dev, port_index);
++ devlink_reload_enable(devlink);
++ mutex_unlock(&nsim_bus_dev->nsim_bus_reload_lock);
+ return ret ? ret : count;
+ }
+
+@@ -311,6 +329,7 @@ nsim_bus_dev_new(unsigned int id, unsign
+ nsim_bus_dev->dev.type = &nsim_bus_dev_type;
+ nsim_bus_dev->port_count = port_count;
+ nsim_bus_dev->initial_net = current->nsproxy->net_ns;
++ mutex_init(&nsim_bus_dev->nsim_bus_reload_lock);
+ /* Disallow using nsim_bus_dev */
+ smp_store_release(&nsim_bus_dev->init, false);
+
+--- a/drivers/net/netdevsim/netdevsim.h
++++ b/drivers/net/netdevsim/netdevsim.h
+@@ -240,6 +240,8 @@ struct nsim_bus_dev {
+ */
+ unsigned int num_vfs;
+ struct nsim_vf_config *vfconfigs;
++ /* Lock for devlink->reload_enabled in netdevsim module */
++ struct mutex nsim_bus_reload_lock;
+ bool init;
+ };
+
--- /dev/null
+From 8526ad9646b17c59b6d430d8baa8f152a14fe177 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sat, 1 Feb 2020 16:43:13 +0000
+Subject: netdevsim: fix panic in nsim_dev_take_snapshot_write()
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 8526ad9646b17c59b6d430d8baa8f152a14fe177 upstream.
+
+nsim_dev_take_snapshot_write() uses nsim_dev and nsim_dev->dummy_region.
+So, during this function, these data shouldn't be removed.
+But there is no protecting stuff in this function.
+
+There are two similar cases.
+1. reload case
+reload could be called during nsim_dev_take_snapshot_write().
+When reload is being executed, nsim_dev_reload_down() is called and it
+calls nsim_dev_reload_destroy(). nsim_dev_reload_destroy() calls
+devlink_region_destroy() to destroy nsim_dev->dummy_region.
+So, during nsim_dev_take_snapshot_write(), nsim_dev->dummy_region()
+would be removed.
+At this point, snapshot_write() would access freed pointer.
+In order to fix this case, take_snapshot file will be removed before
+devlink_region_destroy().
+The take_snapshot file will be re-created by ->reload_up().
+
+2. del_device_store case
+del_device_store() also could call nsim_dev_reload_destroy()
+during nsim_dev_take_snapshot_write(). If so, panic would occur.
+This problem is actually the same problem with the first case.
+So, this problem will be fixed by the first case's solution.
+
+Test commands:
+ modprobe netdevsim
+ while :
+ do
+ echo 1 > /sys/bus/netdevsim/new_device &
+ echo 1 > /sys/bus/netdevsim/del_device &
+ devlink dev reload netdevsim/netdevsim1 &
+ echo 1 > /sys/kernel/debug/netdevsim/netdevsim1/take_snapshot &
+ done
+
+Splat looks like:
+[ 45.564513][ T975] general protection fault, probably for non-canonical address 0xdffffc000000003a: 0000 [#1] SMP DEI
+[ 45.566131][ T975] KASAN: null-ptr-deref in range [0x00000000000001d0-0x00000000000001d7]
+[ 45.566135][ T975] CPU: 1 PID: 975 Comm: bash Not tainted 5.5.0+ #322
+[ 45.569020][ T975] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 45.569026][ T975] RIP: 0010:__mutex_lock+0x10a/0x14b0
+[ 45.570518][ T975] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f
+[ 45.570522][ T975] RSP: 0018:ffff888046ccfbf0 EFLAGS: 00010206
+[ 45.572305][ T975] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 45.572308][ T975] RDX: 000000000000003a RSI: ffffffffac926440 RDI: 00000000000001d0
+[ 45.576843][ T975] RBP: ffff888046ccfd70 R08: ffffffffab610645 R09: 0000000000000000
+[ 45.576847][ T975] R10: ffff888046ccfd90 R11: ffffed100d6360ad R12: 0000000000000000
+[ 45.578471][ T975] R13: dffffc0000000000 R14: ffffffffae1976c0 R15: 0000000000000168
+[ 45.578475][ T975] FS: 00007f614d6e7740(0000) GS:ffff88806c400000(0000) knlGS:0000000000000000
+[ 45.581492][ T975] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 45.582942][ T975] CR2: 00005618677d1cf0 CR3: 000000005fb9c002 CR4: 00000000000606e0
+[ 45.584543][ T975] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 45.586633][ T975] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 45.589889][ T975] Call Trace:
+[ 45.591445][ T975] ? devlink_region_snapshot_create+0x55/0x4a0
+[ 45.601250][ T975] ? mutex_lock_io_nested+0x1380/0x1380
+[ 45.602817][ T975] ? mutex_lock_io_nested+0x1380/0x1380
+[ 45.603875][ T975] ? mark_held_locks+0xa5/0xe0
+[ 45.604769][ T975] ? _raw_spin_unlock_irqrestore+0x2d/0x50
+[ 45.606147][ T975] ? __mutex_unlock_slowpath+0xd0/0x670
+[ 45.607723][ T975] ? crng_backtrack_protect+0x80/0x80
+[ 45.613530][ T975] ? wait_for_completion+0x390/0x390
+[ 45.615152][ T975] ? devlink_region_snapshot_create+0x55/0x4a0
+[ 45.616834][ T975] devlink_region_snapshot_create+0x55/0x4a0
+[ ... ]
+
+Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netdevsim/dev.c | 13 +++++++++++--
+ drivers/net/netdevsim/netdevsim.h | 1 +
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/netdevsim/dev.c
++++ b/drivers/net/netdevsim/dev.c
+@@ -88,8 +88,11 @@ static int nsim_dev_debugfs_init(struct
+ &nsim_dev->max_macs);
+ debugfs_create_bool("test1", 0600, nsim_dev->ddir,
+ &nsim_dev->test1);
+- debugfs_create_file("take_snapshot", 0200, nsim_dev->ddir, nsim_dev,
+- &nsim_dev_take_snapshot_fops);
++ nsim_dev->take_snapshot = debugfs_create_file("take_snapshot",
++ 0200,
++ nsim_dev->ddir,
++ nsim_dev,
++ &nsim_dev_take_snapshot_fops);
+ debugfs_create_bool("dont_allow_reload", 0600, nsim_dev->ddir,
+ &nsim_dev->dont_allow_reload);
+ debugfs_create_bool("fail_reload", 0600, nsim_dev->ddir,
+@@ -740,6 +743,11 @@ static int nsim_dev_reload_create(struct
+ if (err)
+ goto err_health_exit;
+
++ nsim_dev->take_snapshot = debugfs_create_file("take_snapshot",
++ 0200,
++ nsim_dev->ddir,
++ nsim_dev,
++ &nsim_dev_take_snapshot_fops);
+ return 0;
+
+ err_health_exit:
+@@ -853,6 +861,7 @@ static void nsim_dev_reload_destroy(stru
+
+ if (devlink_is_reload_failed(devlink))
+ return;
++ debugfs_remove(nsim_dev->take_snapshot);
+ nsim_dev_port_del_all(nsim_dev);
+ nsim_dev_health_exit(nsim_dev);
+ nsim_dev_traps_exit(devlink);
+--- a/drivers/net/netdevsim/netdevsim.h
++++ b/drivers/net/netdevsim/netdevsim.h
+@@ -160,6 +160,7 @@ struct nsim_dev {
+ struct nsim_trap_data *trap_data;
+ struct dentry *ddir;
+ struct dentry *ports_ddir;
++ struct dentry *take_snapshot;
+ struct bpf_offload_dev *bpf_dev;
+ bool bpf_bind_accept;
+ u32 bpf_bind_verifier_delay;
--- /dev/null
+From f5cd21605ecd249e5fc715411df22cc1bc877b32 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sat, 1 Feb 2020 16:42:54 +0000
+Subject: netdevsim: fix using uninitialized resources
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit f5cd21605ecd249e5fc715411df22cc1bc877b32 upstream.
+
+When module is being initialized, __init() calls bus_register() and
+driver_register().
+These functions internally create various resources and sysfs files.
+The sysfs files are used for basic operations(add/del device).
+/sys/bus/netdevsim/new_device
+/sys/bus/netdevsim/del_device
+
+These sysfs files use netdevsim resources, they are mostly allocated
+and initialized in ->probe() function, which is nsim_dev_probe().
+But, sysfs files could be executed before ->probe() is finished.
+So, accessing uninitialized data would occur.
+
+Another problem is very similar.
+/sys/bus/netdevsim/new_device internally creates sysfs files.
+/sys/devices/netdevsim<id>/new_port
+/sys/devices/netdevsim<id>/del_port
+
+These sysfs files also use netdevsim resources, they are mostly allocated
+and initialized in creating device routine, which is nsim_bus_dev_new().
+But they also could be executed before nsim_bus_dev_new() is finished.
+So, accessing uninitialized data would occur.
+
+To fix these problems, this patch adds flags, which means whether the
+operation is finished or not.
+The flag variable 'nsim_bus_enable' means whether netdevsim bus was
+initialized or not.
+This is protected by nsim_bus_dev_list_lock.
+The flag variable 'nsim_bus_dev->init' means whether nsim_bus_dev was
+initialized or not.
+This could be used in {new/del}_port_store() with no lock.
+
+Test commands:
+ #SHELL1
+ modprobe netdevsim
+ while :
+ do
+ echo "1 1" > /sys/bus/netdevsim/new_device
+ echo "1 1" > /sys/bus/netdevsim/del_device
+ done
+
+ #SHELL2
+ while :
+ do
+ echo 1 > /sys/devices/netdevsim1/new_port
+ echo 1 > /sys/devices/netdevsim1/del_port
+ done
+
+Splat looks like:
+[ 47.508954][ T1008] general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 I
+[ 47.510793][ T1008] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+[ 47.511963][ T1008] CPU: 2 PID: 1008 Comm: bash Not tainted 5.5.0+ #322
+[ 47.512823][ T1008] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 47.514041][ T1008] RIP: 0010:__mutex_lock+0x10a/0x14b0
+[ 47.514699][ T1008] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f
+[ 47.517163][ T1008] RSP: 0018:ffff888059b4fbb0 EFLAGS: 00010206
+[ 47.517802][ T1008] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 47.518941][ T1008] RDX: 0000000000000021 RSI: ffffffff85926440 RDI: 0000000000000108
+[ 47.519732][ T1008] RBP: ffff888059b4fd30 R08: ffffffffc073fad0 R09: 0000000000000000
+[ 47.520729][ T1008] R10: ffff888059b4fd50 R11: ffff88804bb38040 R12: 0000000000000000
+[ 47.521702][ T1008] R13: dffffc0000000000 R14: ffffffff871976c0 R15: 00000000000000a0
+[ 47.522760][ T1008] FS: 00007fd4be05a740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
+[ 47.523877][ T1008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 47.524627][ T1008] CR2: 0000561c82b69cf0 CR3: 0000000065dd6004 CR4: 00000000000606e0
+[ 47.527662][ T1008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 47.528604][ T1008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 47.529531][ T1008] Call Trace:
+[ 47.529874][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim]
+[ 47.530470][ T1008] ? mutex_lock_io_nested+0x1380/0x1380
+[ 47.531018][ T1008] ? _kstrtoull+0x76/0x160
+[ 47.531449][ T1008] ? _parse_integer+0xf0/0xf0
+[ 47.531874][ T1008] ? kernfs_fop_write+0x1cf/0x410
+[ 47.532330][ T1008] ? sysfs_file_ops+0x160/0x160
+[ 47.532773][ T1008] ? kstrtouint+0x86/0x110
+[ 47.533168][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim]
+[ 47.533721][ T1008] nsim_dev_port_add+0x50/0x150 [netdevsim]
+[ 47.534336][ T1008] ? sysfs_file_ops+0x160/0x160
+[ 47.534858][ T1008] new_port_store+0x99/0xb0 [netdevsim]
+[ 47.535439][ T1008] ? del_port_store+0xb0/0xb0 [netdevsim]
+[ 47.536035][ T1008] ? sysfs_file_ops+0x112/0x160
+[ 47.536544][ T1008] ? sysfs_kf_write+0x3b/0x180
+[ 47.537029][ T1008] kernfs_fop_write+0x276/0x410
+[ 47.537548][ T1008] ? __sb_start_write+0x215/0x2e0
+[ 47.538110][ T1008] vfs_write+0x197/0x4a0
+[ ... ]
+
+Fixes: f9d9db47d3ba ("netdevsim: add bus attributes to add new and delete devices")
+Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netdevsim/bus.c | 43 +++++++++++++++++++++++++++++++++++---
+ drivers/net/netdevsim/netdevsim.h | 1
+ 2 files changed, 41 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/netdevsim/bus.c
++++ b/drivers/net/netdevsim/bus.c
+@@ -17,6 +17,7 @@
+ static DEFINE_IDA(nsim_bus_dev_ids);
+ static LIST_HEAD(nsim_bus_dev_list);
+ static DEFINE_MUTEX(nsim_bus_dev_list_lock);
++static bool nsim_bus_enable;
+
+ static struct nsim_bus_dev *to_nsim_bus_dev(struct device *dev)
+ {
+@@ -99,6 +100,9 @@ new_port_store(struct device *dev, struc
+ unsigned int port_index;
+ int ret;
+
++ /* Prevent to use nsim_bus_dev before initialization. */
++ if (!smp_load_acquire(&nsim_bus_dev->init))
++ return -EBUSY;
+ ret = kstrtouint(buf, 0, &port_index);
+ if (ret)
+ return ret;
+@@ -116,6 +120,9 @@ del_port_store(struct device *dev, struc
+ unsigned int port_index;
+ int ret;
+
++ /* Prevent to use nsim_bus_dev before initialization. */
++ if (!smp_load_acquire(&nsim_bus_dev->init))
++ return -EBUSY;
+ ret = kstrtouint(buf, 0, &port_index);
+ if (ret)
+ return ret;
+@@ -179,15 +186,30 @@ new_device_store(struct bus_type *bus, c
+ pr_err("Format for adding new device is \"id port_count\" (uint uint).\n");
+ return -EINVAL;
+ }
+- nsim_bus_dev = nsim_bus_dev_new(id, port_count);
+- if (IS_ERR(nsim_bus_dev))
+- return PTR_ERR(nsim_bus_dev);
+
+ mutex_lock(&nsim_bus_dev_list_lock);
++ /* Prevent to use resource before initialization. */
++ if (!smp_load_acquire(&nsim_bus_enable)) {
++ err = -EBUSY;
++ goto err;
++ }
++
++ nsim_bus_dev = nsim_bus_dev_new(id, port_count);
++ if (IS_ERR(nsim_bus_dev)) {
++ err = PTR_ERR(nsim_bus_dev);
++ goto err;
++ }
++
++ /* Allow using nsim_bus_dev */
++ smp_store_release(&nsim_bus_dev->init, true);
++
+ list_add_tail(&nsim_bus_dev->list, &nsim_bus_dev_list);
+ mutex_unlock(&nsim_bus_dev_list_lock);
+
+ return count;
++err:
++ mutex_unlock(&nsim_bus_dev_list_lock);
++ return err;
+ }
+ static BUS_ATTR_WO(new_device);
+
+@@ -215,6 +237,11 @@ del_device_store(struct bus_type *bus, c
+
+ err = -ENOENT;
+ mutex_lock(&nsim_bus_dev_list_lock);
++ /* Prevent to use resource before initialization. */
++ if (!smp_load_acquire(&nsim_bus_enable)) {
++ mutex_unlock(&nsim_bus_dev_list_lock);
++ return -EBUSY;
++ }
+ list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) {
+ if (nsim_bus_dev->dev.id != id)
+ continue;
+@@ -284,6 +311,8 @@ nsim_bus_dev_new(unsigned int id, unsign
+ nsim_bus_dev->dev.type = &nsim_bus_dev_type;
+ nsim_bus_dev->port_count = port_count;
+ nsim_bus_dev->initial_net = current->nsproxy->net_ns;
++ /* Disallow using nsim_bus_dev */
++ smp_store_release(&nsim_bus_dev->init, false);
+
+ err = device_register(&nsim_bus_dev->dev);
+ if (err)
+@@ -299,6 +328,8 @@ err_nsim_bus_dev_free:
+
+ static void nsim_bus_dev_del(struct nsim_bus_dev *nsim_bus_dev)
+ {
++ /* Disallow using nsim_bus_dev */
++ smp_store_release(&nsim_bus_dev->init, false);
+ device_unregister(&nsim_bus_dev->dev);
+ ida_free(&nsim_bus_dev_ids, nsim_bus_dev->dev.id);
+ kfree(nsim_bus_dev);
+@@ -320,6 +351,8 @@ int nsim_bus_init(void)
+ err = driver_register(&nsim_driver);
+ if (err)
+ goto err_bus_unregister;
++ /* Allow using resources */
++ smp_store_release(&nsim_bus_enable, true);
+ return 0;
+
+ err_bus_unregister:
+@@ -331,12 +364,16 @@ void nsim_bus_exit(void)
+ {
+ struct nsim_bus_dev *nsim_bus_dev, *tmp;
+
++ /* Disallow using resources */
++ smp_store_release(&nsim_bus_enable, false);
++
+ mutex_lock(&nsim_bus_dev_list_lock);
+ list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) {
+ list_del(&nsim_bus_dev->list);
+ nsim_bus_dev_del(nsim_bus_dev);
+ }
+ mutex_unlock(&nsim_bus_dev_list_lock);
++
+ driver_unregister(&nsim_driver);
+ bus_unregister(&nsim_bus);
+ }
+--- a/drivers/net/netdevsim/netdevsim.h
++++ b/drivers/net/netdevsim/netdevsim.h
+@@ -240,6 +240,7 @@ struct nsim_bus_dev {
+ */
+ unsigned int num_vfs;
+ struct nsim_vf_config *vfconfigs;
++ bool init;
+ };
+
+ int nsim_bus_init(void);
--- /dev/null
+From 83cf4213bafc4e3c747f0a25ad22cfbf55af7e84 Mon Sep 17 00:00:00 2001
+From: Taehee Yoo <ap420073@gmail.com>
+Date: Sat, 1 Feb 2020 16:43:39 +0000
+Subject: netdevsim: use __GFP_NOWARN to avoid memalloc warning
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+commit 83cf4213bafc4e3c747f0a25ad22cfbf55af7e84 upstream.
+
+vfnum buffer size and binary_len buffer size is received by user-space.
+So, this buffer size could be too large. If so, kmalloc will internally
+print a warning message.
+This warning message is actually not necessary for the netdevsim module.
+So, this patch adds __GFP_NOWARN.
+
+Test commands:
+ modprobe netdevsim
+ echo 1 > /sys/bus/netdevsim/new_device
+ echo 1000000000 > /sys/devices/netdevsim1/sriov_numvfs
+
+Splat looks like:
+[ 357.847266][ T1000] WARNING: CPU: 0 PID: 1000 at mm/page_alloc.c:4738 __alloc_pages_nodemask+0x2f3/0x740
+[ 357.850273][ T1000] Modules linked in: netdevsim veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrx
+[ 357.852989][ T1000] CPU: 0 PID: 1000 Comm: bash Tainted: G B 5.5.0-rc5+ #270
+[ 357.854334][ T1000] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
+[ 357.855703][ T1000] RIP: 0010:__alloc_pages_nodemask+0x2f3/0x740
+[ 357.856669][ T1000] Code: 64 fe ff ff 65 48 8b 04 25 c0 0f 02 00 48 05 f0 12 00 00 41 be 01 00 00 00 49 89 47 0
+[ 357.860272][ T1000] RSP: 0018:ffff8880b7f47bd8 EFLAGS: 00010246
+[ 357.861009][ T1000] RAX: ffffed1016fe8f80 RBX: 1ffff11016fe8fae RCX: 0000000000000000
+[ 357.861843][ T1000] RDX: 0000000000000000 RSI: 0000000000000017 RDI: 0000000000000000
+[ 357.862661][ T1000] RBP: 0000000000040dc0 R08: 1ffff11016fe8f67 R09: dffffc0000000000
+[ 357.863509][ T1000] R10: ffff8880b7f47d68 R11: fffffbfff2798180 R12: 1ffff11016fe8f80
+[ 357.864355][ T1000] R13: 0000000000000017 R14: 0000000000000017 R15: ffff8880c2038d68
+[ 357.865178][ T1000] FS: 00007fd9a5b8c740(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000
+[ 357.866248][ T1000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 357.867531][ T1000] CR2: 000055ce01ba8100 CR3: 00000000b7dbe005 CR4: 00000000000606f0
+[ 357.868972][ T1000] Call Trace:
+[ 357.869423][ T1000] ? lock_contended+0xcd0/0xcd0
+[ 357.870001][ T1000] ? __alloc_pages_slowpath+0x21d0/0x21d0
+[ 357.870673][ T1000] ? _kstrtoull+0x76/0x160
+[ 357.871148][ T1000] ? alloc_pages_current+0xc1/0x1a0
+[ 357.871704][ T1000] kmalloc_order+0x22/0x80
+[ 357.872184][ T1000] kmalloc_order_trace+0x1d/0x140
+[ 357.872733][ T1000] __kmalloc+0x302/0x3a0
+[ 357.873204][ T1000] nsim_bus_dev_numvfs_store+0x1ab/0x260 [netdevsim]
+[ 357.873919][ T1000] ? kernfs_get_active+0x12c/0x180
+[ 357.874459][ T1000] ? new_device_store+0x450/0x450 [netdevsim]
+[ 357.875111][ T1000] ? kernfs_get_parent+0x70/0x70
+[ 357.875632][ T1000] ? sysfs_file_ops+0x160/0x160
+[ 357.876152][ T1000] kernfs_fop_write+0x276/0x410
+[ 357.876680][ T1000] ? __sb_start_write+0x1ba/0x2e0
+[ 357.877225][ T1000] vfs_write+0x197/0x4a0
+[ 357.877671][ T1000] ksys_write+0x141/0x1d0
+[ ... ]
+
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Fixes: 79579220566c ("netdevsim: add SR-IOV functionality")
+Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netdevsim/bus.c | 2 +-
+ drivers/net/netdevsim/health.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/netdevsim/bus.c
++++ b/drivers/net/netdevsim/bus.c
+@@ -29,7 +29,7 @@ static int nsim_bus_dev_vfs_enable(struc
+ {
+ nsim_bus_dev->vfconfigs = kcalloc(num_vfs,
+ sizeof(struct nsim_vf_config),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!nsim_bus_dev->vfconfigs)
+ return -ENOMEM;
+ nsim_bus_dev->num_vfs = num_vfs;
+--- a/drivers/net/netdevsim/health.c
++++ b/drivers/net/netdevsim/health.c
+@@ -82,7 +82,7 @@ static int nsim_dev_dummy_fmsg_put(struc
+ if (err)
+ return err;
+
+- binary = kmalloc(binary_len, GFP_KERNEL);
++ binary = kmalloc(binary_len, GFP_KERNEL | __GFP_NOWARN);
+ if (!binary)
+ return -ENOMEM;
+ get_random_bytes(binary, binary_len);
--- /dev/null
+From 5e0c94d3aeeecc68c573033f08d9678fecf253bd Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Wed, 22 Jan 2020 19:05:20 +0300
+Subject: platform/x86: intel_mid_powerbtn: Take a copy of ddata
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 5e0c94d3aeeecc68c573033f08d9678fecf253bd upstream.
+
+The driver gets driver_data from memory that is marked as const (which
+is probably put to read-only memory) and it then modifies it. This
+likely causes some sort of fault to happen.
+
+Fix this by taking a copy of the structure.
+
+Fixes: c94a8ff14de3 ("platform/x86: intel_mid_powerbtn: make mid_pb_ddata const")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/intel_mid_powerbtn.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/intel_mid_powerbtn.c
++++ b/drivers/platform/x86/intel_mid_powerbtn.c
+@@ -146,9 +146,10 @@ static int mid_pb_probe(struct platform_
+
+ input_set_capability(input, EV_KEY, KEY_POWER);
+
+- ddata = (struct mid_pb_ddata *)id->driver_data;
++ ddata = devm_kmemdup(&pdev->dev, (void *)id->driver_data,
++ sizeof(*ddata), GFP_KERNEL);
+ if (!ddata)
+- return -ENODATA;
++ return -ENOMEM;
+
+ ddata->dev = &pdev->dev;
+ ddata->irq = irq;
--- /dev/null
+From 5649607a8d0b0e019a4db14aab3de1e16c3a2b4f Mon Sep 17 00:00:00 2001
+From: Vaibhav Jain <vaibhav@linux.ibm.com>
+Date: Wed, 22 Jan 2020 21:21:40 +0530
+Subject: powerpc/papr_scm: Fix leaking 'bus_desc.provider_name' in some paths
+
+From: Vaibhav Jain <vaibhav@linux.ibm.com>
+
+commit 5649607a8d0b0e019a4db14aab3de1e16c3a2b4f upstream.
+
+String 'bus_desc.provider_name' allocated inside
+papr_scm_nvdimm_init() will leaks in case call to
+nvdimm_bus_register() fails or when papr_scm_remove() is called.
+
+This minor patch ensures that 'bus_desc.provider_name' is freed in
+error path for nvdimm_bus_register() as well as in papr_scm_remove().
+
+Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions")
+Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200122155140.120429-1-vaibhav@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/papr_scm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/platforms/pseries/papr_scm.c
++++ b/arch/powerpc/platforms/pseries/papr_scm.c
+@@ -322,6 +322,7 @@ static int papr_scm_nvdimm_init(struct p
+ p->bus = nvdimm_bus_register(NULL, &p->bus_desc);
+ if (!p->bus) {
+ dev_err(dev, "Error creating nvdimm bus %pOF\n", p->dn);
++ kfree(p->bus_desc.provider_name);
+ return -ENXIO;
+ }
+
+@@ -477,6 +478,7 @@ static int papr_scm_remove(struct platfo
+
+ nvdimm_bus_unregister(p->bus);
+ drc_pmem_unbind(p);
++ kfree(p->bus_desc.provider_name);
+ kfree(p);
+
+ return 0;
--- /dev/null
+From 7559d3d295f3365ea7ac0c0274c05e633fe4f594 Mon Sep 17 00:00:00 2001
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Mon, 16 Dec 2019 15:19:22 +1100
+Subject: powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+commit 7559d3d295f3365ea7ac0c0274c05e633fe4f594 upstream.
+
+By default a pseries guest supports a H_PUT_TCE hypercall which maps
+a single IOMMU page in a DMA window. Additionally the hypervisor may
+support H_PUT_TCE_INDIRECT/H_STUFF_TCE which update multiple TCEs at once;
+this is advertised via the device tree /rtas/ibm,hypertas-functions
+property which Linux converts to FW_FEATURE_MULTITCE.
+
+FW_FEATURE_MULTITCE is checked when dma_iommu_ops is used; however
+the code managing the huge DMA window (DDW) ignores it and calls
+H_PUT_TCE_INDIRECT even if it is explicitly disabled via
+the "multitce=off" kernel command line parameter.
+
+This adds FW_FEATURE_MULTITCE checking to the DDW code path.
+
+This changes tce_build_pSeriesLP to take liobn and page size as
+the huge window does not have iommu_table descriptor which usually
+the place to store these numbers.
+
+Fixes: 4e8b0cf46b25 ("powerpc/pseries: Add support for dynamic dma windows")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Tested-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191216041924.42318-3-aik@ozlabs.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/iommu.c | 43 ++++++++++++++++++++++-----------
+ 1 file changed, 29 insertions(+), 14 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -132,10 +132,10 @@ static unsigned long tce_get_pseries(str
+ return be64_to_cpu(*tcep);
+ }
+
+-static void tce_free_pSeriesLP(struct iommu_table*, long, long);
++static void tce_free_pSeriesLP(unsigned long liobn, long, long);
+ static void tce_freemulti_pSeriesLP(struct iommu_table*, long, long);
+
+-static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum,
++static int tce_build_pSeriesLP(unsigned long liobn, long tcenum, long tceshift,
+ long npages, unsigned long uaddr,
+ enum dma_data_direction direction,
+ unsigned long attrs)
+@@ -146,25 +146,25 @@ static int tce_build_pSeriesLP(struct io
+ int ret = 0;
+ long tcenum_start = tcenum, npages_start = npages;
+
+- rpn = __pa(uaddr) >> TCE_SHIFT;
++ rpn = __pa(uaddr) >> tceshift;
+ proto_tce = TCE_PCI_READ;
+ if (direction != DMA_TO_DEVICE)
+ proto_tce |= TCE_PCI_WRITE;
+
+ while (npages--) {
+- tce = proto_tce | (rpn & TCE_RPN_MASK) << TCE_RPN_SHIFT;
+- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, tce);
++ tce = proto_tce | (rpn & TCE_RPN_MASK) << tceshift;
++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << tceshift, tce);
+
+ if (unlikely(rc == H_NOT_ENOUGH_RESOURCES)) {
+ ret = (int)rc;
+- tce_free_pSeriesLP(tbl, tcenum_start,
++ tce_free_pSeriesLP(liobn, tcenum_start,
+ (npages_start - (npages + 1)));
+ break;
+ }
+
+ if (rc && printk_ratelimit()) {
+ printk("tce_build_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc);
+- printk("\tindex = 0x%llx\n", (u64)tbl->it_index);
++ printk("\tindex = 0x%llx\n", (u64)liobn);
+ printk("\ttcenum = 0x%llx\n", (u64)tcenum);
+ printk("\ttce val = 0x%llx\n", tce );
+ dump_stack();
+@@ -193,7 +193,8 @@ static int tce_buildmulti_pSeriesLP(stru
+ unsigned long flags;
+
+ if ((npages == 1) || !firmware_has_feature(FW_FEATURE_MULTITCE)) {
+- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
++ return tce_build_pSeriesLP(tbl->it_index, tcenum,
++ tbl->it_page_shift, npages, uaddr,
+ direction, attrs);
+ }
+
+@@ -209,8 +210,9 @@ static int tce_buildmulti_pSeriesLP(stru
+ /* If allocation fails, fall back to the loop implementation */
+ if (!tcep) {
+ local_irq_restore(flags);
+- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
+- direction, attrs);
++ return tce_build_pSeriesLP(tbl->it_index, tcenum,
++ tbl->it_page_shift,
++ npages, uaddr, direction, attrs);
+ }
+ __this_cpu_write(tce_page, tcep);
+ }
+@@ -261,16 +263,16 @@ static int tce_buildmulti_pSeriesLP(stru
+ return ret;
+ }
+
+-static void tce_free_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages)
++static void tce_free_pSeriesLP(unsigned long liobn, long tcenum, long npages)
+ {
+ u64 rc;
+
+ while (npages--) {
+- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, 0);
++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << 12, 0);
+
+ if (rc && printk_ratelimit()) {
+ printk("tce_free_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc);
+- printk("\tindex = 0x%llx\n", (u64)tbl->it_index);
++ printk("\tindex = 0x%llx\n", (u64)liobn);
+ printk("\ttcenum = 0x%llx\n", (u64)tcenum);
+ dump_stack();
+ }
+@@ -285,7 +287,7 @@ static void tce_freemulti_pSeriesLP(stru
+ u64 rc;
+
+ if (!firmware_has_feature(FW_FEATURE_MULTITCE))
+- return tce_free_pSeriesLP(tbl, tcenum, npages);
++ return tce_free_pSeriesLP(tbl->it_index, tcenum, npages);
+
+ rc = plpar_tce_stuff((u64)tbl->it_index, (u64)tcenum << 12, 0, npages);
+
+@@ -400,6 +402,19 @@ static int tce_setrange_multi_pSeriesLP(
+ u64 rc = 0;
+ long l, limit;
+
++ if (!firmware_has_feature(FW_FEATURE_MULTITCE)) {
++ unsigned long tceshift = be32_to_cpu(maprange->tce_shift);
++ unsigned long dmastart = (start_pfn << PAGE_SHIFT) +
++ be64_to_cpu(maprange->dma_base);
++ unsigned long tcenum = dmastart >> tceshift;
++ unsigned long npages = num_pfn << PAGE_SHIFT >> tceshift;
++ void *uaddr = __va(start_pfn << PAGE_SHIFT);
++
++ return tce_build_pSeriesLP(be32_to_cpu(maprange->liobn),
++ tcenum, tceshift, npages, (unsigned long) uaddr,
++ DMA_BIDIRECTIONAL, 0);
++ }
++
+ local_irq_disable(); /* to protect tcep and the page behind it */
+ tcep = __this_cpu_read(tce_page);
+
--- /dev/null
+From aff8c8242bc638ba57247ae1ec5f272ac3ed3b92 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Mon, 20 Jan 2020 14:10:02 -0800
+Subject: powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning
+
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+
+commit aff8c8242bc638ba57247ae1ec5f272ac3ed3b92 upstream.
+
+Commit e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to
+iommu_table") missed an iommu_table allocation in the pseries vio code.
+The iommu_table is allocated with kzalloc and as a result the associated
+kref gets a value of zero. This has the side effect that during a DLPAR
+remove of the associated virtual IOA the iommu_tce_table_put() triggers
+a use-after-free underflow warning.
+
+Call Trace:
+[c0000002879e39f0] [c00000000071ecb4] refcount_warn_saturate+0x184/0x190
+(unreliable)
+[c0000002879e3a50] [c0000000000500ac] iommu_tce_table_put+0x9c/0xb0
+[c0000002879e3a70] [c0000000000f54e4] vio_dev_release+0x34/0x70
+[c0000002879e3aa0] [c00000000087cfa4] device_release+0x54/0xf0
+[c0000002879e3b10] [c000000000d64c84] kobject_cleanup+0xa4/0x240
+[c0000002879e3b90] [c00000000087d358] put_device+0x28/0x40
+[c0000002879e3bb0] [c0000000007a328c] dlpar_remove_slot+0x15c/0x250
+[c0000002879e3c50] [c0000000007a348c] remove_slot_store+0xac/0xf0
+[c0000002879e3cd0] [c000000000d64220] kobj_attr_store+0x30/0x60
+[c0000002879e3cf0] [c0000000004ff13c] sysfs_kf_write+0x6c/0xa0
+[c0000002879e3d10] [c0000000004fde4c] kernfs_fop_write+0x18c/0x260
+[c0000002879e3d60] [c000000000410f3c] __vfs_write+0x3c/0x70
+[c0000002879e3d80] [c000000000415408] vfs_write+0xc8/0x250
+[c0000002879e3dd0] [c0000000004157dc] ksys_write+0x7c/0x120
+[c0000002879e3e20] [c00000000000b278] system_call+0x5c/0x68
+
+Further, since the refcount was always zero the iommu_tce_table_put()
+fails to call the iommu_table release function resulting in a leak.
+
+Fix this issue be initilizing the iommu_table kref immediately after
+allocation.
+
+Fixes: e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to iommu_table")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1579558202-26052-1-git-send-email-tyreld@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/vio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/platforms/pseries/vio.c
++++ b/arch/powerpc/platforms/pseries/vio.c
+@@ -1176,6 +1176,8 @@ static struct iommu_table *vio_build_iom
+ if (tbl == NULL)
+ return NULL;
+
++ kref_init(&tbl->it_kref);
++
+ of_parse_dma_window(dev->dev.of_node, dma_window,
+ &tbl->it_index, &offset, &size);
+
--- /dev/null
+From e26ad936dd89d79f66c2b567f700e0c2a7103070 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Tue, 14 Jan 2020 08:13:08 +0000
+Subject: powerpc/ptdump: Fix W+X verification call in mark_rodata_ro()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit e26ad936dd89d79f66c2b567f700e0c2a7103070 upstream.
+
+ptdump_check_wx() also have to be called when pages are mapped
+by blocks.
+
+Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/37517da8310f4457f28921a4edb88fb21d27b62a.1578989531.git.christophe.leroy@c-s.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/pgtable_32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/mm/pgtable_32.c
++++ b/arch/powerpc/mm/pgtable_32.c
+@@ -218,6 +218,7 @@ void mark_rodata_ro(void)
+
+ if (v_block_mapped((unsigned long)_sinittext)) {
+ mmu_mark_rodata_ro();
++ ptdump_check_wx();
+ return;
+ }
+
--- /dev/null
+From f509247b08f2dcf7754d9ed85ad69a7972aa132b Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Tue, 14 Jan 2020 08:13:10 +0000
+Subject: powerpc/ptdump: Only enable PPC_CHECK_WX with STRICT_KERNEL_RWX
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit f509247b08f2dcf7754d9ed85ad69a7972aa132b upstream.
+
+ptdump_check_wx() is called from mark_rodata_ro() which only exists
+when CONFIG_STRICT_KERNEL_RWX is selected.
+
+Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/922d4939c735c6b52b4137838bcc066fffd4fc33.1578989545.git.christophe.leroy@c-s.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/Kconfig.debug
++++ b/arch/powerpc/Kconfig.debug
+@@ -371,7 +371,7 @@ config PPC_PTDUMP
+
+ config PPC_DEBUG_WX
+ bool "Warn on W+X mappings at boot"
+- depends on PPC_PTDUMP
++ depends on PPC_PTDUMP && STRICT_KERNEL_RWX
+ help
+ Generate a warning if any W+X mappings are found at boot.
+
--- /dev/null
+From d862b44133b7a1d7de25288e09eabf4df415e971 Mon Sep 17 00:00:00 2001
+From: Ram Pai <linuxram@us.ibm.com>
+Date: Mon, 16 Dec 2019 15:19:21 +1100
+Subject: Revert "powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests"
+
+From: Ram Pai <linuxram@us.ibm.com>
+
+commit d862b44133b7a1d7de25288e09eabf4df415e971 upstream.
+
+This reverts commit edea902c1c1efb855f77e041f9daf1abe7a9768a.
+
+At the time the change allowed direct DMA ops for secure VMs; however
+since then we switched on using SWIOTLB backed with IOMMU (direct mapping)
+and to make this work, we need dma_iommu_ops which handles all cases
+including TCE mapping I/O pages in the presence of an IOMMU.
+
+Fixes: edea902c1c1e ("powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests")
+Signed-off-by: Ram Pai <linuxram@us.ibm.com>
+[aik: added "revert" and "fixes:"]
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Tested-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191216041924.42318-2-aik@ozlabs.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/pseries/iommu.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/arch/powerpc/platforms/pseries/iommu.c
++++ b/arch/powerpc/platforms/pseries/iommu.c
+@@ -36,7 +36,6 @@
+ #include <asm/udbg.h>
+ #include <asm/mmzone.h>
+ #include <asm/plpar_wrappers.h>
+-#include <asm/svm.h>
+
+ #include "pseries.h"
+
+@@ -1320,15 +1319,7 @@ void iommu_init_early_pSeries(void)
+ of_reconfig_notifier_register(&iommu_reconfig_nb);
+ register_memory_notifier(&iommu_mem_nb);
+
+- /*
+- * Secure guest memory is inacessible to devices so regular DMA isn't
+- * possible.
+- *
+- * In that case keep devices' dma_map_ops as NULL so that the generic
+- * DMA code path will use SWIOTLB to bounce buffers for DMA.
+- */
+- if (!is_secure_guest())
+- set_pci_dma_ops(&dma_iommu_ops);
++ set_pci_dma_ops(&dma_iommu_ops);
+ }
+
+ static int __init disable_multitce(char *str)
--- /dev/null
+From b6da197a2e9670df6f07e6698629e9ce95ab614e Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 23 Jan 2020 15:14:35 +0200
+Subject: rtc: cmos: Stop using shared IRQ
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit b6da197a2e9670df6f07e6698629e9ce95ab614e upstream.
+
+As reported by Guilherme G. Piccoli:
+
+---8<---8<---8<---
+
+The rtc-cmos interrupt setting was changed in the commit 079062b28fb4
+("rtc: cmos: prevent kernel warning on IRQ flags mismatch") in order
+to allow shared interrupts; according to that commit's description,
+some machine got kernel warnings due to the interrupt line being shared
+between rtc-cmos and other hardware, and rtc-cmos didn't allow IRQ sharing
+that time.
+
+After the aforementioned commit though it was observed a huge increase
+in lost HPET interrupts in some systems, observed through the following
+kernel message:
+
+[...] hpet1: lost 35 rtc interrupts
+
+After investigation, it was narrowed down to the shared interrupts
+usage when having the kernel option "irqpoll" enabled. In this case,
+all IRQ handlers are called for non-timer interrupts, if such handlers
+are setup in shared IRQ lines. The rtc-cmos IRQ handler could be set to
+hpet_rtc_interrupt(), which will produce the kernel "lost interrupts"
+message after doing work - lots of readl/writel to HPET registers, which
+are known to be slow.
+
+Although "irqpoll" is not a default kernel option, it's used in some contexts,
+one being the kdump kernel (which is an already "impaired" kernel usually
+running with 1 CPU available), so the performance burden could be considerable.
+Also, the same issue would happen (in a shorter extent though) when using
+"irqfixup" kernel option.
+
+In a quick experiment, a virtual machine with uptime of 2 minutes produced
+>300 calls to hpet_rtc_interrupt() when "irqpoll" was set, whereas without
+sharing interrupts this number reduced to 1 interrupt. Machines with more
+hardware than a VM should generate even more unnecessary HPET interrupts
+in this scenario.
+
+---8<---8<---8<---
+
+After looking into the rtc-cmos driver history and DSDT table from
+the Microsoft Surface 3, we may notice that Hans de Goede submitted
+a correct fix (see dependency below). Thus, we simply revert
+the culprit commit.
+
+Fixes: 079062b28fb4 ("rtc: cmos: prevent kernel warning on IRQ flags mismatch")
+Depends-on: a1e23a42f1bd ("rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs")
+Reported-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20200123131437.28157-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-cmos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -850,7 +850,7 @@ cmos_do_probe(struct device *dev, struct
+ rtc_cmos_int_handler = cmos_interrupt;
+
+ retval = request_irq(rtc_irq, rtc_cmos_int_handler,
+- IRQF_SHARED, dev_name(&cmos_rtc.rtc->dev),
++ 0, dev_name(&cmos_rtc.rtc->dev),
+ cmos_rtc.rtc);
+ if (retval < 0) {
+ dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
--- /dev/null
+From f236a2a2ebabad0848ad0995af7ad1dc7029e895 Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Thu, 12 Dec 2019 16:31:10 +0100
+Subject: rtc: hym8563: Return -EINVAL if the time is known to be invalid
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+commit f236a2a2ebabad0848ad0995af7ad1dc7029e895 upstream.
+
+The current code returns -EPERM when the voltage loss bit is set.
+Since the bit indicates that the time value is not valid, return
+-EINVAL instead, which is the appropriate error code for this
+situation.
+
+Fixes: dcaf03849352 ("rtc: add hym8563 rtc-driver")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Link: https://lore.kernel.org/r/20191212153111.966923-1-paul.kocialkowski@bootlin.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-hym8563.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-hym8563.c
++++ b/drivers/rtc/rtc-hym8563.c
+@@ -97,7 +97,7 @@ static int hym8563_rtc_read_time(struct
+
+ if (!hym8563->valid) {
+ dev_warn(&client->dev, "no valid clock/calendar values available\n");
+- return -EPERM;
++ return -EINVAL;
+ }
+
+ ret = i2c_smbus_read_i2c_block_data(client, HYM8563_SEC, 7, buf);
--- /dev/null
+From 34719de919af07682861cb0fa2bcf64da33ecf44 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Sun, 12 Jan 2020 18:13:49 +0100
+Subject: rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 34719de919af07682861cb0fa2bcf64da33ecf44 upstream.
+
+Merely enabling I2C and RTC selects REGMAP_I2C and REGMAP_SPI, even when
+no driver needs it. While the former can be moduler, the latter cannot,
+and thus becomes built-in.
+
+Fix this by moving the select statements for REGMAP_I2C and REGMAP_SPI
+from the RTC_I2C_AND_SPI helper to the individual drivers that depend on
+it.
+
+Note that the comment for RTC_I2C_AND_SPI refers to SND_SOC_I2C_AND_SPI
+for more information, but the latter does not select REGMAP_{I2C,SPI}
+itself, and defers that to the individual drivers, too.
+
+Fixes: 080481f54ef62121 ("rtc: merge ds3232 and ds3234")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20200112171349.22268-1-geert@linux-m68k.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/Kconfig | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -848,14 +848,14 @@ config RTC_I2C_AND_SPI
+ default m if I2C=m
+ default y if I2C=y
+ default y if SPI_MASTER=y
+- select REGMAP_I2C if I2C
+- select REGMAP_SPI if SPI_MASTER
+
+ comment "SPI and I2C RTC drivers"
+
+ config RTC_DRV_DS3232
+ tristate "Dallas/Maxim DS3232/DS3234"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ help
+ If you say yes here you get support for Dallas Semiconductor
+ DS3232 and DS3234 real-time clock chips. If an interrupt is associated
+@@ -875,6 +875,8 @@ config RTC_DRV_DS3232_HWMON
+ config RTC_DRV_PCF2127
+ tristate "NXP PCF2127"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ select WATCHDOG_CORE if WATCHDOG
+ help
+ If you say yes here you get support for the NXP PCF2127/29 RTC
+@@ -891,6 +893,8 @@ config RTC_DRV_PCF2127
+ config RTC_DRV_RV3029C2
+ tristate "Micro Crystal RV3029/3049"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ help
+ If you say yes here you get support for the Micro Crystal
+ RV3029 and RV3049 RTC chips.
--- /dev/null
+From 751438bc0f10f75633144acd6ff145f7260706d5 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 13 Nov 2019 02:17:20 +0000
+Subject: rtc: mt6397: drop free_irq of devm_ allocated irq
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 751438bc0f10f75633144acd6ff145f7260706d5 upstream.
+
+The devm_request_threaded_irq function allocates irq that is
+released when a driver detaches. Thus, there is no reason to
+explicitly call free_irq in probe function.
+
+Fixes: 851b87148aa2 ("rtc: mt6397: improvements of rtc driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20191113021720.9527-1-weiyongjun1@huawei.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-mt6397.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/rtc/rtc-mt6397.c
++++ b/drivers/rtc/rtc-mt6397.c
+@@ -297,15 +297,7 @@ static int mtk_rtc_probe(struct platform
+
+ rtc->rtc_dev->ops = &mtk_rtc_ops;
+
+- ret = rtc_register_device(rtc->rtc_dev);
+- if (ret)
+- goto out_free_irq;
+-
+- return 0;
+-
+-out_free_irq:
+- free_irq(rtc->irq, rtc);
+- return ret;
++ return rtc_register_device(rtc->rtc_dev);
+ }
+
+ #ifdef CONFIG_PM_SLEEP
--- /dev/null
+From 5d3919a953c3c96c02fc7a337f8376cde43ae31f Mon Sep 17 00:00:00 2001
+From: Jakub Sitnicki <jakub@cloudflare.com>
+Date: Thu, 6 Feb 2020 12:16:52 +0100
+Subject: selftests/bpf: Test freeing sockmap/sockhash with a socket in it
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+commit 5d3919a953c3c96c02fc7a337f8376cde43ae31f upstream.
+
+Commit 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear
+down") introduced sleeping issues inside RCU critical sections and while
+holding a spinlock on sockmap/sockhash tear-down. There has to be at least
+one socket in the map for the problem to surface.
+
+This adds a test that triggers the warnings for broken locking rules. Not a
+fix per se, but rather tooling to verify the accompanying fixes. Run on a
+VM with 1 vCPU to reproduce the warnings.
+
+Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200206111652.694507-4-jakub@cloudflare.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | 74 +++++++++++++++++
+ 1 file changed, 74 insertions(+)
+
+--- /dev/null
++++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c
+@@ -0,0 +1,74 @@
++// SPDX-License-Identifier: GPL-2.0
++// Copyright (c) 2020 Cloudflare
++
++#include "test_progs.h"
++
++static int connected_socket_v4(void)
++{
++ struct sockaddr_in addr = {
++ .sin_family = AF_INET,
++ .sin_port = htons(80),
++ .sin_addr = { inet_addr("127.0.0.1") },
++ };
++ socklen_t len = sizeof(addr);
++ int s, repair, err;
++
++ s = socket(AF_INET, SOCK_STREAM, 0);
++ if (CHECK_FAIL(s == -1))
++ goto error;
++
++ repair = TCP_REPAIR_ON;
++ err = setsockopt(s, SOL_TCP, TCP_REPAIR, &repair, sizeof(repair));
++ if (CHECK_FAIL(err))
++ goto error;
++
++ err = connect(s, (struct sockaddr *)&addr, len);
++ if (CHECK_FAIL(err))
++ goto error;
++
++ repair = TCP_REPAIR_OFF_NO_WP;
++ err = setsockopt(s, SOL_TCP, TCP_REPAIR, &repair, sizeof(repair));
++ if (CHECK_FAIL(err))
++ goto error;
++
++ return s;
++error:
++ perror(__func__);
++ close(s);
++ return -1;
++}
++
++/* Create a map, populate it with one socket, and free the map. */
++static void test_sockmap_create_update_free(enum bpf_map_type map_type)
++{
++ const int zero = 0;
++ int s, map, err;
++
++ s = connected_socket_v4();
++ if (CHECK_FAIL(s == -1))
++ return;
++
++ map = bpf_create_map(map_type, sizeof(int), sizeof(int), 1, 0);
++ if (CHECK_FAIL(map == -1)) {
++ perror("bpf_create_map");
++ goto out;
++ }
++
++ err = bpf_map_update_elem(map, &zero, &s, BPF_NOEXIST);
++ if (CHECK_FAIL(err)) {
++ perror("bpf_map_update");
++ goto out;
++ }
++
++out:
++ close(map);
++ close(s);
++}
++
++void test_sockmap_basic(void)
++{
++ if (test__start_subtest("sockmap create_update_free"))
++ test_sockmap_create_update_free(BPF_MAP_TYPE_SOCKMAP);
++ if (test__start_subtest("sockhash create_update_free"))
++ test_sockmap_create_update_free(BPF_MAP_TYPE_SOCKHASH);
++}
nfsv4-try-lease-recovery-on-nfs4err_expired.patch
nfsv4.0-nfs4_do_fsinfo-should-not-do-implicit-lease-renewals.patch
x86-boot-handle-malformed-srat-tables-during-early-a.patch
+bpftool-don-t-crash-on-missing-xlated-program-instructions.patch
+bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch
+bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
+selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch
+bpf-improve-bucket_log-calculation-logic.patch
+bpf-sockmap-check-update-requirements-after-locking.patch
+mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch
+netdevsim-fix-using-uninitialized-resources.patch
+netdevsim-disable-devlink-reload-when-resources-are-being-used.patch
+netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch
+netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch
+rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch
+rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch
+rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch
+rtc-cmos-stop-using-shared-irq.patch
+watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch
+mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch
+arc-add-missing-multicast-filter-number-to-gmac-node.patch
+platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch
+arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch
+arm64-dts-udpu-fix-broken-ethernet.patch
+arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch
+arm-dts-at91-reenable-uart-tx-pull-ups.patch
+arm-dts-am43xx-add-support-for-clkout1-clock.patch
+arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch
+arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch
+arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch
+arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch
+arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch
+arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch
+tools-power-acpi-fix-compilation-error.patch
+soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch
+revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch
+powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch
+powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch
+powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch
+powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch
+powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch
--- /dev/null
+From 5d0d4d42bed0090d3139e7c5ca1587d76d48add6 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 14 Feb 2019 09:36:33 -0800
+Subject: soc: qcom: rpmhpd: Set 'active_only' for active only power domains
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit 5d0d4d42bed0090d3139e7c5ca1587d76d48add6 upstream.
+
+The 'active_only' attribute was accidentally never set to true for any
+power domains meaning that all the code handling this attribute was
+dead.
+
+NOTE that the RPM power domain code (as opposed to the RPMh one) gets
+this right.
+
+Acked-by: Rajendra Nayak <rnayak@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20190214173633.211000-1-dianders@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/qcom/rpmhpd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/soc/qcom/rpmhpd.c
++++ b/drivers/soc/qcom/rpmhpd.c
+@@ -93,6 +93,7 @@ static struct rpmhpd sdm845_mx = {
+
+ static struct rpmhpd sdm845_mx_ao = {
+ .pd = { .name = "mx_ao", },
++ .active_only = true,
+ .peer = &sdm845_mx,
+ .res_name = "mx.lvl",
+ };
+@@ -107,6 +108,7 @@ static struct rpmhpd sdm845_cx = {
+
+ static struct rpmhpd sdm845_cx_ao = {
+ .pd = { .name = "cx_ao", },
++ .active_only = true,
+ .peer = &sdm845_cx,
+ .parent = &sdm845_mx_ao.pd,
+ .res_name = "cx.lvl",
--- /dev/null
+From 1985f8c7f9a42a651a9750d6fcadc74336d182df Mon Sep 17 00:00:00 2001
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Date: Sat, 14 Dec 2019 00:27:12 +0800
+Subject: tools/power/acpi: fix compilation error
+
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+
+commit 1985f8c7f9a42a651a9750d6fcadc74336d182df upstream.
+
+If we compile tools/acpi target in the top source directory, we'd get a
+compilation error showing as bellow:
+
+ # make tools/acpi
+ DESCEND power/acpi
+ DESCEND tools/acpidbg
+ CC tools/acpidbg/acpidbg.o
+ Assembler messages:
+ Fatal error: can't create /home/lzy/kernel-upstream/power/acpi/\
+ tools/acpidbg/acpidbg.o: No such file or directory
+ ../../Makefile.rules:26: recipe for target '/home/lzy/kernel-upstream/\
+ power/acpi/tools/acpidbg/acpidbg.o' failed
+ make[3]: *** [/home/lzy/kernel-upstream//power/acpi/tools/acpidbg/\
+ acpidbg.o] Error 1
+ Makefile:19: recipe for target 'acpidbg' failed
+ make[2]: *** [acpidbg] Error 2
+ Makefile:54: recipe for target 'acpi' failed
+ make[1]: *** [acpi] Error 2
+ Makefile:1607: recipe for target 'tools/acpi' failed
+ make: *** [tools/acpi] Error 2
+
+Fixes: d5a4b1a540b8 ("tools/power/acpi: Remove direct kernel source include reference")
+Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/power/acpi/Makefile.config | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/power/acpi/Makefile.config
++++ b/tools/power/acpi/Makefile.config
+@@ -15,7 +15,7 @@ include $(srctree)/../../scripts/Makefil
+
+ OUTPUT=$(srctree)/
+ ifeq ("$(origin O)", "command line")
+- OUTPUT := $(O)/power/acpi/
++ OUTPUT := $(O)/tools/power/acpi/
+ endif
+ #$(info Determined 'OUTPUT' to be $(OUTPUT))
+
--- /dev/null
+From e0b4f4e0cf7fa9d62628d4249c765ec18dffd143 Mon Sep 17 00:00:00 2001
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Date: Fri, 13 Dec 2019 12:19:34 +0530
+Subject: watchdog: qcom: Use platform_get_irq_optional() for bark irq
+
+From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+
+commit e0b4f4e0cf7fa9d62628d4249c765ec18dffd143 upstream.
+
+platform_get_irq() prints an error message when the interrupt
+is not available. So on platforms where bark interrupt is
+not specified, following error message is observed on SDM845.
+
+[ 2.975888] qcom_wdt 17980000.watchdog: IRQ index 0 not found
+
+This is also seen on SC7180, SM8150 SoCs as well.
+Fix this by using platform_get_irq_optional() instead.
+
+Fixes: 36375491a4395654 ("watchdog: qcom: support pre-timeout when the bark irq is available")
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20191213064934.4112-1-saiprakash.ranjan@codeaurora.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/qcom-wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/qcom-wdt.c
++++ b/drivers/watchdog/qcom-wdt.c
+@@ -246,7 +246,7 @@ static int qcom_wdt_probe(struct platfor
+ }
+
+ /* check if there is pretimeout support */
+- irq = platform_get_irq(pdev, 0);
++ irq = platform_get_irq_optional(pdev, 0);
+ if (irq > 0) {
+ ret = devm_request_irq(dev, irq, qcom_wdt_isr,
+ IRQF_TRIGGER_RISING,
projects / thirdparty / kernel / stable-queue.git / commitdiff
