--- /dev/null
+From 56a608c84ca59a5a66106fee30d80ea9622bef5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Nov 2020 13:13:45 +0000
+Subject: afs: Fix speculative status fetch going out of order wrt to
+ modifications
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit a9e5c87ca7443d09fb530fffa4d96ce1c76dbe4d ]
+
+When doing a lookup in a directory, the afs filesystem uses a bulk
+status fetch to speculatively retrieve the statuses of up to 48 other
+vnodes found in the same directory and it will then either update extant
+inodes or create new ones - effectively doing 'lookup ahead'.
+
+To avoid the possibility of deadlocking itself, however, the filesystem
+doesn't lock all of those inodes; rather just the directory inode is
+locked (by the VFS).
+
+When the operation completes, afs_inode_init_from_status() or
+afs_apply_status() is called, depending on whether the inode already
+exists, to commit the new status.
+
+A case exists, however, where the speculative status fetch operation may
+straddle a modification operation on one of those vnodes. What can then
+happen is that the speculative bulk status RPC retrieves the old status,
+and whilst that is happening, the modification happens - which returns
+an updated status, then the modification status is committed, then we
+attempt to commit the speculative status.
+
+This results in something like the following being seen in dmesg:
+
+ kAFS: vnode modified {100058:861} 8->9 YFS.InlineBulkStatus
+
+showing that for vnode 861 on volume 100058, we saw YFS.InlineBulkStatus
+say that the vnode had data version 8 when we'd already recorded version
+9 due to a local modification. This was causing the cache to be
+invalidated for that vnode when it shouldn't have been. If it happens
+on a data file, this might lead to local changes being lost.
+
+Fix this by ignoring speculative status updates if the data version
+doesn't match the expected value.
+
+Note that it is possible to get a DV regression if a volume gets
+restored from a backup - but we should get a callback break in such a
+case that should trigger a recheck anyway. It might be worth checking
+the volume creation time in the volsync info and, if a change is
+observed in that (as would happen on a restore), invalidate all caches
+associated with the volume.
+
+Fixes: 5cf9dd55a0ec ("afs: Prospectively look up extra files when doing a single lookup")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 1 +
+ fs/afs/inode.c | 8 ++++++++
+ fs/afs/internal.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 1bb5b9d7f0a2c..9068d5578a26f 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -823,6 +823,7 @@ static struct inode *afs_do_lookup(struct inode *dir, struct dentry *dentry,
+ vp->cb_break_before = afs_calc_vnode_cb_break(vnode);
+ vp->vnode = vnode;
+ vp->put_vnode = true;
++ vp->speculative = true; /* vnode not locked */
+ }
+ }
+ }
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 0fe8844b4bee2..b0d7b892090da 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -294,6 +294,13 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v
+ op->flags &= ~AFS_OPERATION_DIR_CONFLICT;
+ }
+ } else if (vp->scb.have_status) {
++ if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version &&
++ vp->speculative)
++ /* Ignore the result of a speculative bulk status fetch
++ * if it splits around a modification op, thereby
++ * appearing to regress the data version.
++ */
++ goto out;
+ afs_apply_status(op, vp);
+ if (vp->scb.have_cb)
+ afs_apply_callback(op, vp);
+@@ -305,6 +312,7 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v
+ }
+ }
+
++out:
+ write_sequnlock(&vnode->cb_lock);
+
+ if (vp->scb.have_status)
+diff --git a/fs/afs/internal.h b/fs/afs/internal.h
+index 17336cbb8419f..932f501888e73 100644
+--- a/fs/afs/internal.h
++++ b/fs/afs/internal.h
+@@ -754,6 +754,7 @@ struct afs_vnode_param {
+ bool update_ctime:1; /* Need to update the ctime */
+ bool set_size:1; /* Must update i_size */
+ bool op_unlinked:1; /* True if file was unlinked by op */
++ bool speculative:1; /* T if speculative status fetch (no vnode lock) */
+ };
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 8103c28cf214eab52511254c153a692820bed728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:13:20 -0300
+Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]
+
+The SPI chip selects are represented as:
+
+cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;
+
+, which means that they are used in GPIO function instead of native
+SPI mode.
+
+Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
+the native CSPI_SSI function.
+
+Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index a25da415cb02e..907339bc81e54 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -59,7 +59,7 @@
+ MX50_PAD_CSPI_MISO__CSPI_MISO 0x00
+ MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00
+ MX50_PAD_CSPI_SS0__GPIO4_11 0xc4
+- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4
++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84
+ >;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From c94bf8c2c5142023afb25c2520851d63ae94079f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 09:18:16 +0200
+Subject: ARM: dts: imx6q-prti6q: fix PHY address
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit e402599e5e5e0b2758d7766fd9f6d7953d4ccd85 ]
+
+Due to bug in the bootloader, the PHY has floating address and may
+randomly change on each PHY reset. To avoid it, the updated bootloader
+with the following patch[0] should be used:
+
+| ARM: protonic: disable on-die termination to fix PHY bootstrapping
+|
+| If on-die termination is enabled, the RXC pin of iMX6 will be pulled
+| high. Since we already have an 10K pull-down on board, the RXC level on
+| PHY reset will be ~800mV, which is mostly interpreted as 1. On some
+| reboots we get 0 instead and kernel can't detect the PHY properly.
+|
+| Since the default 0x020e07ac value is 0, it is sufficient to remove this
+| entry from the affected imxcfg files.
+|
+| Since we get stable 0 on pin PHYADDR[2], the PHY address is changed from
+| 4 to 0.
+
+With latest bootloader update, the PHY address will be fixed to "0".
+
+[0] https://git.pengutronix.de/cgit/barebox/commit/?id=93f7dcf631edfcda19e7757b28d66017ea274b81
+
+Fixes: 0d446a505592 ("ARM: dts: add Protonic PRTI6Q board")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-prti6q.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-prti6q.dts b/arch/arm/boot/dts/imx6q-prti6q.dts
+index de6cbaab8b499..671bb3a6665d8 100644
+--- a/arch/arm/boot/dts/imx6q-prti6q.dts
++++ b/arch/arm/boot/dts/imx6q-prti6q.dts
+@@ -213,8 +213,8 @@
+ #size-cells = <0>;
+
+ /* Microchip KSZ9031RNX PHY */
+- rgmii_phy: ethernet-phy@4 {
+- reg = <4>;
++ rgmii_phy: ethernet-phy@0 {
++ reg = <0>;
+ interrupts-extended = <&gpio1 28 IRQ_TYPE_LEVEL_LOW>;
+ reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+ reset-assert-us = <10000>;
+--
+2.27.0
+
--- /dev/null
+From 80269c2a63a6710c9cbe19e369e497043d42c951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 23:11:20 +0300
+Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
+
+From: Sergey Matyukevich <geomatsi@gmail.com>
+
+[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]
+
+Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
+KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
+modes. Adapt imx6q-udoo board phy settings : explicitly set required
+delay configuration using "rgmii-id".
+
+Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
+Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+index 828dd20cd27d2..d07d8f83456d2 100644
+--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+@@ -98,7 +98,7 @@
+ &fec {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_enet>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 11ed64b7c551b096fd90f5a26d8426d1524e70fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 20:46:17 +0100
+Subject: ARM: dts: stm32: Define VIO regulator supply on DHCOM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 1f3d7fc279b1a299bb8b1b225d80309a2062ab8a ]
+
+The VIO regulator is supplied by PMIC Buck3, describe this in the DT.
+
+Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Patrice Chotard <patrice.chotard@st.com>
+Cc: Patrick Delaunay <patrick.delaunay@st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+index a87ebc4843963..6c3920cd5419b 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+@@ -68,6 +68,7 @@
+ gpio = <&gpiog 3 GPIO_ACTIVE_LOW>;
+ regulator-always-on;
+ regulator-boot-on;
++ vin-supply = <&vdd>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From e6408b83f23ad71c597cfd43bdc0e5223fa01346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 01:25:35 +0200
+Subject: ARM: dts: stm32: Enable thermal sensor support on stm32mp15xx-dhcor
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit e5ace7f62695656ef8a66ad5a4c3edd055894876 ]
+
+Enable STM32 Digital Thermal Sensor driver for stm32mp15xx-dhcor SoMs.
+
+Fixes: 94cafe1b6482 ("ARM: dts: stm32: Add Avenger96 devicetree support based on STM32MP157A")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+index 04fbb324a541f..803eb8bc9c85c 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+@@ -21,6 +21,10 @@
+ };
+ };
+
++&dts {
++ status = "okay";
++};
++
+ &i2c4 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&i2c4_pins_a>;
+--
+2.27.0
+
--- /dev/null
+From 3013b006f9998bca7aead34799969cbb88a9854e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 21:46:17 +0100
+Subject: ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 7e5f3155dcbb4d724386b30cc232002d9b9d81f5 ]
+
+On the prototype DHCOM, the LED5 was connected to pin PG2 of the
+STM32MP15xx, however on the production SoM this was changed to pin
+PC6. Update the connection in the DT.
+
+Fixes: 81d5fc719798 ("ARM: dts: stm32: Add GPIO LEDs for STM32MP1 DHCOM PDK2")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Patrice Chotard <patrice.chotard@st.com>
+Cc: Patrick Delaunay <patrick.delaunay@st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+index 7cddeb1a545a3..13f52b79454e1 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+@@ -82,7 +82,7 @@
+
+ led-0 {
+ label = "green:led5";
+- gpios = <&gpiog 2 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpioc 6 GPIO_ACTIVE_HIGH>;
+ default-state = "off";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 76dc2697b180366d29fd2e35dae4f8110bad2a53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 21:35:38 +0200
+Subject: ARM: dts: stm32: Fix TA3-GPIO-C key on STM32MP1 DHCOM PDK2
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 52d9edbe6efc5042cf57fae6a25d07572ddf398b ]
+
+On the prototype DHCOM, the TA3-GPIO-C button was connected to pin PI11 of
+the STM32MP15xx, however on the production SoM this was changed to pin PG0
+to free up the IRQ line 11 for LAN8710i PHY IRQ. Update the connection in
+the DT. Since the IRQ line 0 is used for PMIC as well and cannot be shared
+with the button, make the button polled.
+
+Fixes: 87cabf9405cb ("ARM: dts: stm32: Add GPIO keys for STM32MP1 DHCOM PDK2")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Patrice Chotard <patrice.chotard@st.com>
+Cc: Patrick Delaunay <patrick.delaunay@st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+index e4e3c92eb30d3..7cddeb1a545a3 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+@@ -46,6 +46,16 @@
+ linux,code = <KEY_A>;
+ gpios = <&gpiof 3 GPIO_ACTIVE_LOW>;
+ };
++
++ /*
++ * The EXTi IRQ line 0 is shared with PMIC,
++ * so mark this as polled GPIO key.
++ */
++ button-2 {
++ label = "TA3-GPIO-C";
++ linux,code = <KEY_C>;
++ gpios = <&gpiog 0 GPIO_ACTIVE_LOW>;
++ };
+ };
+
+ gpio-keys {
+@@ -59,13 +69,6 @@
+ wakeup-source;
+ };
+
+- button-2 {
+- label = "TA3-GPIO-C";
+- linux,code = <KEY_C>;
+- gpios = <&gpioi 11 GPIO_ACTIVE_LOW>;
+- wakeup-source;
+- };
+-
+ button-3 {
+ label = "TA4-GPIO-D";
+ linux,code = <KEY_D>;
+--
+2.27.0
+
--- /dev/null
+From d74ca7a546b3ac40043a743bbdb75587d57199bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 20:46:52 +0100
+Subject: ARM: dts: stm32: Keep VDDA LDO1 always on on DHCOM
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit f4c7fa39415da6db1fa0bc26162ac23a0fbae8bb ]
+
+The VDDA LDO1 PMIC output supplies the analog VDDA input of the
+STM32MP1 on DHCOM, keep it always on, otherwise there could be
+leakage through the SoC.
+
+Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Patrice Chotard <patrice.chotard@st.com>
+Cc: Patrick Delaunay <patrick.delaunay@st.com>
+Cc: linux-stm32@st-md-mailman.stormreply.com
+To: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+index 6c3920cd5419b..e4804afc90e2f 100644
+--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi
+@@ -203,6 +203,7 @@
+
+ vdda: ldo1 {
+ regulator-name = "vdda";
++ regulator-always-on;
+ regulator-min-microvolt = <2900000>;
+ regulator-max-microvolt = <2900000>;
+ interrupts = <IT_CURLIM_LDO1 0>;
+--
+2.27.0
+
--- /dev/null
+From bae1b33eb909aaac01fc8957828e85d11fe7dd85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:07 +0800
+Subject: ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e76724153f5b4539802cc21b2c6131058668a1c6 ]
+
+The Ethernet PHY on the A31 Hummingbird has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: c220aec2bb79 ("ARM: dts: sun6i: Add Merrii A31 Hummingbird support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-2-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun6i-a31-hummingbird.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+index 049e6ab3cf56c..73de34ae37fdc 100644
+--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
++++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+@@ -154,7 +154,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 859f19abd7ff5a13a79af6dbb0f0816c57ec816c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:09 +0800
+Subject: ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit f94f78bd93f567c022f594589dbeecdf59931365 ]
+
+The Ethernet PHY on the Bananapi M1+ has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 04c85ecad32a ("ARM: dts: sun7i: Add dts file for Bananapi M1 Plus board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-4-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+index 32d5d45a35c03..8945dbb114a2a 100644
+--- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
++++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+@@ -130,7 +130,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_gmac_3v3>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From b37541c1676ee8ba6fd45b87c95fd714a553ae7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:08 +0800
+Subject: ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 353c3de1303fc93032164402c0eb8550ecd6f154 ]
+
+The Ethernet PHY on the Cubietruck has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 67073d97672d ("ARM: dts: sun7i: cubietruck: Enable the GMAC")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Emilio López <emilio@elopez.com.ar>
+Reviewed-by: Emilio López <emilio@elopez.com.ar>
+Link: https://lore.kernel.org/r/20201024162515.30032-3-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20-cubietruck.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
+index 8c8dee6ea461a..9109ca0919ade 100644
+--- a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
++++ b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
+@@ -151,7 +151,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 096edadadf7e81b34ca106e57d6d0fe6c5f77791 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:11 +0800
+Subject: ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 57dbe558457bf4042169bc1f334e3b53a8480a1c ]
+
+The Ethernet PHY on the Bananapi M3 and Cubietruck Plus have the RX
+and TX delays enabled on the PHY, using pull-ups on the RXDLY and
+TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 039359948a4b ("ARM: dts: sun8i: a83t: Enable Ethernet on two boards")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-6-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +-
+ arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+index 9d34eabba1213..431f70234d364 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+@@ -131,7 +131,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_sw>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ allwinner,rx-delay-ps = <700>;
+ allwinner,tx-delay-ps = <700>;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index d9be511f054f0..d8326a5c681d4 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -183,7 +183,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_dldo4>;
+ phy-handle = <&rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From cfbd4fdb01d08c074df98323890de1525d8bdfd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:10 +0800
+Subject: ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e080ab31a0aa126b0a7e4f67f2b01b371b852c88 ]
+
+The Ethernet PHY on the Orange Pi Plus 2E has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Fixes: 7a78ef92cdc5 ("ARM: sun8i: h3: Enable EMAC with external PHY on Orange Pi Plus 2E")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-5-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+index 6dbf7b2e0c13c..b6ca45d18e511 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+@@ -67,7 +67,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From c0978125f28d90d63bf0b3b19eae4f97b47589ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 09:19:49 +0100
+Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit b3eec3212e66ece33f69be0de98d54e67834e798 ]
+
+Ethernet PHY on BananaPi M2 Ultra provides RX and TX delays. Fix
+ethernet node to reflect that fact.
+
+Fixes: c36fd5a48bd2 ("ARM: dts: sun8i: r40: bananapi-m2-ultra: Enable GMAC ethernet controller")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201025081949.783443-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+index ea15073f0c79c..7db89500f399c 100644
+--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+@@ -129,7 +129,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From f25f57fc1de88f8f7e23394620323372f09d06c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:12 +0800
+Subject: ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit b1064037e8ecf09d587b7b4966eebe0c362908e5 ]
+
+The Ethernet PHY on the Cubieboard 4 and A80 Optimus have the RX
+and TX delays enabled on the PHY, using pull-ups on the RXDLY and
+TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 98048143b7f8 ("ARM: dts: sun9i: cubieboard4: Enable GMAC")
+Fixes: bc9bd03a44f9 ("ARM: dts: sun9i: a80-optimus: Enable GMAC")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-7-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 2 +-
+ arch/arm/boot/dts/sun9i-a80-optimus.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+index d3b337b043a15..484b93df20cb6 100644
+--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
++++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+@@ -129,7 +129,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_cldo1>;
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+index bbc6335e56314..5c3580d712e40 100644
+--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
++++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
+@@ -124,7 +124,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&gmac_rgmii_pins>;
+ phy-handle = <&phy1>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-supply = <®_cldo1>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 706f240de05c3658056715eda27eac1c598edb51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:13 +0800
+Subject: ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on
+ Ethernet PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3914160ffc0bf762d6d605d4b27036b7b89367ea ]
+
+The Ethernet PHY on the Bananapi M2+ has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 8c7ba536e709 ("ARM: sun8i: bananapi-m2-plus: Enable dwmac-sun8i")
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Fixes: aa8fee415f46 ("ARM: dts: sun8i: h3: Split out non-SoC-specific parts of Bananapi M2 Plus")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-8-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
+index 39263e74fbb53..8e5cb3b3fd686 100644
+--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
++++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
+@@ -126,7 +126,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 5c7c5c7877f8838b1cbc3fe5446f7676d35a3fd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 01:55:28 +0100
+Subject: ARM: dts: vf610-zii-dev-rev-b: Fix MDIO over clocking
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit f8b5a33707c9a19ec905d2826be0acd151997a09 ]
+
+The ZII devel B board has two generations of Marvell Switches. The
+mv88e6352 supports an MDIO clock of 12MHz. However the older 88e6185
+does not like 12MHz, and often fails to probe.
+
+Reduce the clock speed to 5MHz, which seems to work reliably.
+
+Cc: Chris Healy <cphealy@gmail.com>
+Fixes: b955387667ec ("ARM: dts: ZII: update MDIO speed and preamble")
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/vf610-zii-dev-rev-b.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
+index e500911ce0a59..6f1e0f0d4f0ae 100644
+--- a/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
++++ b/arch/arm/boot/dts/vf610-zii-dev-rev-b.dts
+@@ -406,6 +406,9 @@
+ };
+ };
+
++&mdio1 {
++ clock-frequency = <5000000>;
++};
+
+ &iomuxc {
+ pinctrl_gpio_e6185_eeprom_sel: pinctrl-gpio-e6185-eeprom-spi0 {
+--
+2.27.0
+
--- /dev/null
+From 043394efe2d466c65fbd9403748bf0e36354bbd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:15 +0800
+Subject: arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on
+ PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 1a9a8910b2153cd3c4f3f2f8defcb853ead3b1fd ]
+
+The Ethernet PHY on the Bananapi M64 has the RX and TX delays
+enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: e7295499903d ("arm64: allwinner: bananapi-m64: Enable dwmac-sun8i")
+Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-10-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 883f217efb812..5dd81e9239a7a 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -105,7 +105,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_dc1sw>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From e2e5784b154fe72ab3f8173fcf0acb0565ee4770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 20:58:39 +0200
+Subject: arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit d7cdff444579e6659459b2fe04340ebb27628d5e ]
+
+RX/TX delay on OrangePi Win board is set on PHY. Reflect that in
+ethernet node.
+
+Fixes: 93d6a27cfcc0 ("arm64: dts: allwinner: a64: Orange Pi Win: Add Ethernet node")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201022185839.2779245-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+index fde9c7a99b17e..cc1723a16cf75 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+@@ -120,7 +120,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_gmac_3v3>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From ca4ac98ffdd8ec08b85bda46e049b7c40fbb86e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Oct 2020 23:13:01 +0200
+Subject: arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 927f42fcc1b4f7d04a2ac5cf02f25612aa8923a4 ]
+
+According to board schematic, PHY provides both, RX and TX delays.
+However, according to "fix" Realtek provided for this board, only TX
+delay should be provided by PHY.
+Tests show that both variants work but TX only PHY delay works
+slightly better.
+
+Update ethernet node to reflect the fact that PHY provides TX delay.
+
+Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201022211301.3548422-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index b26181cf9095a..b54099b654c8a 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -13,7 +13,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-txid";
+ phy-handle = <&ext_rgmii_phy>;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 77bef90500440461668855f37cb790f82dbf14c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Oct 2020 19:24:09 +0200
+Subject: arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Péron <peron.clem@gmail.com>
+
+[ Upstream commit 97a38c1c213b162aa577299de698f39c18ba696b ]
+
+Before the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
+delay config"), the software overwrite for RX/TX delays of the RTL8211e
+were not working properly and the Beelink GS1 had both RX/TX delay of RGMII
+interface set using pull-up on the TXDLY and RXDLY pins.
+
+Now that these delays are working properly they overwrite the HW
+config and set this to 'rgmii' meaning no delay on both RX/TX.
+This makes the ethernet of this board not working anymore.
+
+Set the phy-mode to 'rgmii-id' meaning RGMII with RX/TX delays
+in the device-tree to keep the correct configuration.
+
+Fixes: 089bee8dd119 ("arm64: dts: allwinner: h6: Introduce Beelink GS1 board")
+Signed-off-by: Clément Péron <peron.clem@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201018172409.1754775-1-peron.clem@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+index 3f7ceeb1a767a..7c9dbde645b52 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+@@ -97,7 +97,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ext_rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_aldo2>;
+ status = "okay";
+--
+2.27.0
+
--- /dev/null
+From 4994fe5fcbccbd2a3fd34afd40b503692b259967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:14 +0800
+Subject: arm64: dts: allwinner: h5: libretech-all-h5-cc: Enable RGMII RX/TX
+ delay on PHY
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 2bd8570d20c88909b8be3251727a26476b02652c ]
+
+The Ethernet PHY on the Libre Computer ALL-H5-CC has the RX and TX
+delays enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.
+
+Fix the phy-mode description to correct reflect this so that the
+implementation doesn't reconfigure the delays incorrectly. This
+happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
+rx/tx delay config").
+
+Fixes: 60d0426d7603 ("arm64: dts: allwinner: h5: Add Libre Computer ALL-H5-CC H5 board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-9-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts
+index df1b9263ad0e2..6e30a564c87f6 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-libretech-all-h5-cc.dts
+@@ -36,7 +36,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ /delete-property/ allwinner,leds-active-low;
+ status = "okay";
+ };
+--
+2.27.0
+
--- /dev/null
+From 2ed9c7520005d08bebd12d224f256fe89a2927bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 20:48:58 +0200
+Subject: arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit b34bf9f6a623ddb82600a5ed5c644224122395e1 ]
+
+RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
+node.
+
+Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201023184858.3272918-1-jernej.skrabec@siol.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+index 7d7aad18f078b..8bf2db9dcbda0 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+@@ -123,7 +123,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From b116a6100d55d6e03599c05840bf6eac4f8639af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 12:58:17 +0100
+Subject: arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
+
+From: Nenad Peric <nperic@gmail.com>
+
+[ Upstream commit 107954afc5df667da438644aa4982606663f9b17 ]
+
+RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
+node.
+
+Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
+Signed-off-by: Nenad Peric <nperic@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201028115817.68113-1-nperic@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+index cb44bfa5981fd..33ab44072e6d7 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+@@ -124,7 +124,7 @@
+ pinctrl-0 = <&emac_rgmii_pins>;
+ phy-supply = <®_gmac_3v3>;
+ phy-handle = <&ext_rgmii_phy>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 7100138e27abae2e7691577a194a8ff7550c9667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Oct 2020 06:34:49 +0000
+Subject: arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 419c65f5000a6c25597ea52488528d75b287cbd0 ]
+
+Since commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"),
+the network is unusable on PineH64 model A.
+
+This is due to phy-mode incorrectly set to rgmii instead of rgmii-id.
+
+Fixes: 729e1ffcf47e ("arm64: allwinner: h6: add support for the Ethernet on Pine H64")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201019063449.33316-1-clabbe@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+index af85b2074867f..961732c52aa0e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+@@ -100,7 +100,7 @@
+ &emac {
+ pinctrl-names = "default";
+ pinctrl-0 = <&ext_rgmii_pins>;
+- phy-mode = "rgmii";
++ phy-mode = "rgmii-id";
+ phy-handle = <&ext_rgmii_phy>;
+ phy-supply = <®_gmac_3v3>;
+ allwinner,rx-delay-ps = <200>;
+--
+2.27.0
+
--- /dev/null
+From 0138e7d4df1f9f0bff6881fee210daf417dc9dec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Sep 2020 09:30:21 +0800
+Subject: arm64: dts: fsl: fix endianness issue of rcpm
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Biwen Li <biwen.li@nxp.com>
+
+[ Upstream commit d92454287ee25d78f1caac3734a1864f8a5a5275 ]
+
+Add little-endian property to RCPM node (for ls1028a,ls1088a,ls208xa),
+otherwise RCPM driver will program hardware with incorrect setting,
+causing system (such as LS1028ARDB) failed to be waked by wakeup source.
+
+Fixes: 791c88ca5713 (“arm64: dts: ls1028a: Add ftm_alarm0 DT node”)
+Fixes: f4fe3a8665495 (“arm64: dts: layerscape: add ftm_alarm0 node”)
+Signed-off-by: Biwen Li <biwen.li@nxp.com>
+Signed-off-by: Ran Wang <ran.wang_1@nxp.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 1 +
+ arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 1 +
+ arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+index 0efeb8fa773e7..651bfe1040ba3 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+@@ -1012,6 +1012,7 @@
+ compatible = "fsl,ls1028a-rcpm", "fsl,qoriq-rcpm-2.1+";
+ reg = <0x0 0x1e34040 0x0 0x1c>;
+ #fsl,rcpm-wakeup-cells = <7>;
++ little-endian;
+ };
+
+ ftm_alarm0: timer@2800000 {
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
+index 169f4742ae3b2..2ef812dd29ebc 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi
+@@ -787,6 +787,7 @@
+ compatible = "fsl,ls1088a-rcpm", "fsl,qoriq-rcpm-2.1+";
+ reg = <0x0 0x1e34040 0x0 0x18>;
+ #fsl,rcpm-wakeup-cells = <6>;
++ little-endian;
+ };
+
+ ftm_alarm0: timer@2800000 {
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+index 41102dacc2e10..141b3d23b1552 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi
+@@ -769,6 +769,7 @@
+ compatible = "fsl,ls208xa-rcpm", "fsl,qoriq-rcpm-2.1+";
+ reg = <0x0 0x1e34040 0x0 0x18>;
+ #fsl,rcpm-wakeup-cells = <6>;
++ little-endian;
+ };
+
+ ftm_alarm0: timer@2800000 {
+--
+2.27.0
+
--- /dev/null
+From e8904f8a0a987fe9700873262ba074ffd77ce4da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Oct 2020 08:02:37 -0500
+Subject: arm64: dts: imx8mm-beacon-som: Fix Choppy BT audio
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 587258edd94c305077923ec458e04c032fca83e6 ]
+
+When streaming bluetooth audio, the sound is choppy due to the
+fact that the default baud rate of the HCI interface is too slow
+to handle 16-bit stereo at 48KHz.
+
+The Bluetooth chip is capable of up to 4M baud on the serial port,
+so this patch sets the max-speed to 4000000 in order to properly
+stream audio over the Bluetooth.
+
+Fixes: 593816fa2f35 ("arm64: dts: imx: Add Beacon i.MX8m-Mini development kit")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi
+index 94911b1707ef2..09d757b3e3ce6 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi
+@@ -210,6 +210,7 @@
+ host-wakeup-gpios = <&gpio2 8 GPIO_ACTIVE_HIGH>;
+ device-wakeup-gpios = <&gpio2 7 GPIO_ACTIVE_HIGH>;
+ clocks = <&osc_32k>;
++ max-speed = <4000000>;
+ clock-names = "extclk";
+ };
+ };
+--
+2.27.0
+
--- /dev/null
+From fe91ca81eda1b1ef29ff7b8733fd72ad6e91461c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 18:06:12 +0100
+Subject: arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit d19d2152ca055baf20339cfacbf039c2cfb8d936 ]
+
+The datasheet for both the industrial and consumer variant of the
+SoC lists a typical voltage of 0.95V for the 1.6GHz CPU operating
+point.
+
+Fixes: e85c9d0faa75 (arm64: dts: imx8mm: Add cpufreq properties)
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 76f040e4be5e9..7cc2a810831ab 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -129,7 +129,7 @@
+
+ opp-1600000000 {
+ opp-hz = /bits/ 64 <1600000000>;
+- opp-microvolt = <900000>;
++ opp-microvolt = <950000>;
+ opp-supported-hw = <0xc>, <0x7>;
+ clock-latency-ns = <150000>;
+ opp-suspend;
+--
+2.27.0
+
--- /dev/null
+From 169337e339c02f668f1282577b19f98d0b285ad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 13:33:00 -0500
+Subject: arm64: dts imx8mn: Remove non-existent USB OTG2
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit cf5abb0132193767c07c83e06f91b777d22ba495 ]
+
+According to the i.MX8MN TRM, there is only one OTG port. The
+address for OTG2 is reserved on Nano.
+
+This patch removes the non-existent OTG2, usbphynop2, and the usbmisc2
+nodes.
+
+Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 30 -----------------------
+ 1 file changed, 30 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+index 9385dd7d1a2f7..b05f60503d45a 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -789,28 +789,6 @@
+ #index-cells = <1>;
+ reg = <0x32e40200 0x200>;
+ };
+-
+- usbotg2: usb@32e50000 {
+- compatible = "fsl,imx8mn-usb", "fsl,imx7d-usb";
+- reg = <0x32e50000 0x200>;
+- interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk IMX8MN_CLK_USB1_CTRL_ROOT>;
+- clock-names = "usb1_ctrl_root_clk";
+- assigned-clocks = <&clk IMX8MN_CLK_USB_BUS>,
+- <&clk IMX8MN_CLK_USB_CORE_REF>;
+- assigned-clock-parents = <&clk IMX8MN_SYS_PLL2_500M>,
+- <&clk IMX8MN_SYS_PLL1_100M>;
+- fsl,usbphy = <&usbphynop2>;
+- fsl,usbmisc = <&usbmisc2 0>;
+- status = "disabled";
+- };
+-
+- usbmisc2: usbmisc@32e50200 {
+- compatible = "fsl,imx8mn-usbmisc", "fsl,imx7d-usbmisc";
+- #index-cells = <1>;
+- reg = <0x32e50200 0x200>;
+- };
+-
+ };
+
+ dma_apbh: dma-controller@33000000 {
+@@ -875,12 +853,4 @@
+ assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
+ clock-names = "main_clk";
+ };
+-
+- usbphynop2: usbphynop2 {
+- compatible = "usb-nop-xceiv";
+- clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
+- assigned-clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
+- assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
+- clock-names = "main_clk";
+- };
+ };
+--
+2.27.0
+
--- /dev/null
+From 6e43053bea3d406b6e265a2d10a6046034e3d7c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 12:54:34 -0800
+Subject: ASOC: Intel: kbl_rt5663_rt5514_max98927: Do not try to disable
+ disabled clock
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 879ee8b6f2bae0cc4a25536f8841db1dbc969523 ]
+
+In kabylake_set_bias_level(), enabling mclk may fail if the clock has
+already been enabled by the firmware. Attempts to disable that clock
+later will fail with a warning backtrace.
+
+mclk already disabled
+WARNING: CPU: 2 PID: 108 at drivers/clk/clk.c:952 clk_core_disable+0x1b6/0x1cf
+...
+Call Trace:
+ clk_disable+0x2d/0x3a
+ kabylake_set_bias_level+0x72/0xfd [snd_soc_kbl_rt5663_rt5514_max98927]
+ snd_soc_card_set_bias_level+0x2b/0x6f
+ snd_soc_dapm_set_bias_level+0xe1/0x209
+ dapm_pre_sequence_async+0x63/0x96
+ async_run_entry_fn+0x3d/0xd1
+ process_one_work+0x2a9/0x526
+...
+
+Only disable the clock if it has been enabled.
+
+Fixes: 15747a802075 ("ASoC: eve: implement set_bias_level function for rt5514")
+Cc: Brent Lu <brent.lu@intel.com>
+Cc: Curtis Malainey <cujomalainey@chromium.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201111205434.207610-1-linux@roeck-us.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+index 922cd0176e1ff..f95546c184aae 100644
+--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c
+@@ -700,6 +700,8 @@ static int kabylake_set_bias_level(struct snd_soc_card *card,
+ switch (level) {
+ case SND_SOC_BIAS_PREPARE:
+ if (dapm->bias_level == SND_SOC_BIAS_ON) {
++ if (!__clk_is_enabled(priv->mclk))
++ return 0;
+ dev_dbg(card->dev, "Disable mclk");
+ clk_disable_unprepare(priv->mclk);
+ } else {
+--
+2.27.0
+
--- /dev/null
+From 45bdd47d54589152e68c72b2c1b6797faa94652b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:19:01 +0800
+Subject: ASoC: Intel: KMB: Fix S24_LE configuration
+
+From: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
+
+[ Upstream commit 1bd7b0fc0165694897b7d2fb39751a07b98f6bf1 ]
+
+S24_LE is 24 bit audio in 32 bit container configuration
+Fixing the configuration to match the data arrangement of
+this audio format.
+
+Fixes: c5477e966728 ("ASoC: Intel: Add KeemBay platform driver")
+
+Signed-off-by: Michael Sit Wei Hong <michael.wei.hong.sit@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20201116061905.32431-2-michael.wei.hong.sit@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/keembay/kmb_platform.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/keembay/kmb_platform.c b/sound/soc/intel/keembay/kmb_platform.c
+index 16f9fc4c663d1..49079da5c4065 100644
+--- a/sound/soc/intel/keembay/kmb_platform.c
++++ b/sound/soc/intel/keembay/kmb_platform.c
+@@ -455,9 +455,9 @@ static int kmb_dai_hw_params(struct snd_pcm_substream *substream,
+ kmb_i2s->xfer_resolution = 0x02;
+ break;
+ case SNDRV_PCM_FORMAT_S24_LE:
+- config->data_width = 24;
+- kmb_i2s->ccr = 0x08;
+- kmb_i2s->xfer_resolution = 0x04;
++ config->data_width = 32;
++ kmb_i2s->ccr = 0x14;
++ kmb_i2s->xfer_resolution = 0x05;
+ break;
+ case SNDRV_PCM_FORMAT_S32_LE:
+ config->data_width = 32;
+--
+2.27.0
+
--- /dev/null
+From 4de35e57db287539e5af71a86dffcbace52ba8ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 10:26:50 +0530
+Subject: ASoC: qcom: lpass-platform: Fix memory leak
+
+From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+
+[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ]
+
+lpass_pcm_data is not freed in error paths. Free it in
+error paths to avoid memory leak.
+
+Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
+Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
+Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/lpass-platform.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
+index e62ac7e650785..a1cabcd267b8b 100644
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -73,8 +73,10 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component,
+ else
+ dma_ch = 0;
+
+- if (dma_ch < 0)
++ if (dma_ch < 0) {
++ kfree(data);
+ return dma_ch;
++ }
+
+ drvdata->substream[dma_ch] = substream;
+
+@@ -95,6 +97,7 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component,
+ ret = snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+ if (ret < 0) {
++ kfree(data);
+ dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
+ ret);
+ return -EINVAL;
+--
+2.27.0
+
--- /dev/null
+From de66736db60beac6bdf3d3872bd9d294d94b6934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:46 -0800
+Subject: bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to
+ self
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 6fa9201a898983da731fca068bb4b5c941537588 ]
+
+If a socket redirects to itself and it is under memory pressure it is
+possible to get a socket stuck so that recv() returns EAGAIN and the
+socket can not advance for some time. This happens because when
+redirecting a skb to the same socket we received the skb on we first
+check if it is OK to enqueue the skb on the receiving socket by checking
+memory limits. But, if the skb is itself the object holding the memory
+needed to enqueue the skb we will keep retrying from kernel side
+and always fail with EAGAIN. Then userspace will get a recv() EAGAIN
+error if there are no skbs in the psock ingress queue. This will continue
+until either some skbs get kfree'd causing the memory pressure to
+reduce far enough that we can enqueue the pending packet or the
+socket is destroyed. In some cases its possible to get a socket
+stuck for a noticeable amount of time if the socket is only receiving
+skbs from sk_skb verdict programs. To reproduce I make the socket
+memory limits ridiculously low so sockets are always under memory
+pressure. More often though if under memory pressure it looks like
+a spurious EAGAIN error on user space side causing userspace to retry
+and typically enough has moved on the memory side that it works.
+
+To fix skip memory checks and skb_orphan if receiving on the same
+sock as already assigned.
+
+For SK_PASS cases this is easy, its always the same socket so we
+can just omit the orphan/set_owner pair.
+
+For backlog cases we need to check skb->sk and decide if the orphan
+and set_owner pair are needed.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556572660.73229.12566203819812939627.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 72 +++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 53 insertions(+), 19 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 4ac112cc490c5..97f4c11a2ea7a 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -399,38 +399,38 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
+
+-static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
++static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
++ struct sk_buff *skb)
+ {
+- struct sock *sk = psock->sk;
+- int copied = 0, num_sge;
+ struct sk_msg *msg;
+
+ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
+- return -EAGAIN;
++ return NULL;
++
++ if (!sk_rmem_schedule(sk, skb, skb->truesize))
++ return NULL;
+
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+- return -EAGAIN;
+- if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
+- kfree(msg);
+- return -EAGAIN;
+- }
++ return NULL;
+
+ sk_msg_init(msg);
+- num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
++ return msg;
++}
++
++static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
++ struct sk_psock *psock,
++ struct sock *sk,
++ struct sk_msg *msg)
++{
++ int num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
++ int copied;
++
+ if (unlikely(num_sge < 0)) {
+ kfree(msg);
+ return num_sge;
+ }
+
+- /* This will transition ownership of the data from the socket where
+- * the BPF program was run initiating the redirect to the socket
+- * we will eventually receive this data on. The data will be released
+- * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
+- * into user buffers.
+- */
+- skb_set_owner_r(skb, sk);
+-
+ copied = skb->len;
+ msg->sg.start = 0;
+ msg->sg.size = copied;
+@@ -442,6 +442,40 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ return copied;
+ }
+
++static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
++{
++ struct sock *sk = psock->sk;
++ struct sk_msg *msg;
++
++ msg = sk_psock_create_ingress_msg(sk, skb);
++ if (!msg)
++ return -EAGAIN;
++
++ /* This will transition ownership of the data from the socket where
++ * the BPF program was run initiating the redirect to the socket
++ * we will eventually receive this data on. The data will be released
++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
++ * into user buffers.
++ */
++ skb_set_owner_r(skb, sk);
++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
++}
++
++/* Puts an skb on the ingress queue of the socket already assigned to the
++ * skb. In this case we do not need to check memory limits or skb_set_owner_r
++ * because the skb is already accounted for here.
++ */
++static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb)
++{
++ struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
++ struct sock *sk = psock->sk;
++
++ if (unlikely(!msg))
++ return -EAGAIN;
++ sk_msg_init(msg);
++ return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
++}
++
+ static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
+ u32 off, u32 len, bool ingress)
+ {
+@@ -784,7 +818,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ * retrying later from workqueue.
+ */
+ if (skb_queue_empty(&psock->ingress_skb)) {
+- err = sk_psock_skb_ingress(psock, skb);
++ err = sk_psock_skb_ingress_self(psock, skb);
+ }
+ if (err < 0) {
+ skb_queue_tail(&psock->ingress_skb, skb);
+--
+2.27.0
+
--- /dev/null
+From ca1bbccc1141db77c29ce3d5d030bffb202c828c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:06 -0800
+Subject: bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 36cd0e696a832a00247fca522034703566ac8885 ]
+
+Fix sockmap sk_skb programs so that they observe sk_rcvbuf limits. This
+allows users to tune SO_RCVBUF and sockmap will honor them.
+
+We can refactor the if(charge) case out in later patches. But, keep this
+fix to the point.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556568657.73229.8404601585878439060.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 20 ++++++++++++++++----
+ net/ipv4/tcp_bpf.c | 3 ++-
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index 30ddca6db6c6b..f41b06e60ad90 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -170,10 +170,12 @@ static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
+ struct scatterlist *sge = sk_msg_elem(msg, i);
+ u32 len = sge->length;
+
+- if (charge)
+- sk_mem_uncharge(sk, len);
+- if (!msg->skb)
++ /* When the skb owns the memory we free it from consume_skb path. */
++ if (!msg->skb) {
++ if (charge)
++ sk_mem_uncharge(sk, len);
+ put_page(sg_page(sge));
++ }
+ memset(sge, 0, sizeof(*sge));
+ return len;
+ }
+@@ -403,6 +405,9 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ int copied = 0, num_sge;
+ struct sk_msg *msg;
+
++ if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
++ return -EAGAIN;
++
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+ return -EAGAIN;
+@@ -418,7 +423,14 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ return num_sge;
+ }
+
+- sk_mem_charge(sk, skb->len);
++ /* This will transition ownership of the data from the socket where
++ * the BPF program was run initiating the redirect to the socket
++ * we will eventually receive this data on. The data will be released
++ * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
++ * into user buffers.
++ */
++ skb_set_owner_r(skb, sk);
++
+ copied = skb->len;
+ msg->sg.start = 0;
+ msg->sg.size = copied;
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index d85ba32dc6e7a..24e1be45d4cd7 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -45,7 +45,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ if (likely(!peek)) {
+ sge->offset += copy;
+ sge->length -= copy;
+- sk_mem_uncharge(sk, copy);
++ if (!msg_rx->skb)
++ sk_mem_uncharge(sk, copy);
+ msg_rx->sg.size -= copy;
+
+ if (!sge->length) {
+--
+2.27.0
+
--- /dev/null
+From 7b99f67ff83bf7afd92ecdcec44cadc53c527e55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:27:46 -0800
+Subject: bpf, sockmap: Fix partial copy_page_to_iter so progress can still be
+ made
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit c9c89dcd872ea33327673fcb97398993a1f22736 ]
+
+If copy_page_to_iter() fails or even partially completes, but with fewer
+bytes copied than expected we currently reset sg.start and return EFAULT.
+This proves problematic if we already copied data into the user buffer
+before we return an error. Because we leave the copied data in the user
+buffer and fail to unwind the scatterlist so kernel side believes data
+has been copied and user side believes data has _not_ been received.
+
+Expected behavior should be to return number of bytes copied and then
+on the next read we need to return the error assuming its still there. This
+can happen if we have a copy length spanning multiple scatterlist elements
+and one or more complete before the error is hit.
+
+The error is rare enough though that my normal testing with server side
+programs, such as nginx, httpd, envoy, etc., I have never seen this. The
+only reliable way to reproduce that I've found is to stream movies over
+my browser for a day or so and wait for it to hang. Not very scientific,
+but with a few extra WARN_ON()s in the code the bug was obvious.
+
+When we review the errors from copy_page_to_iter() it seems we are hitting
+a page fault from copy_page_to_iter_iovec() where the code checks
+fault_in_pages_writeable(buf, copy) where buf is the user buffer. It
+also seems typical server applications don't hit this case.
+
+The other way to try and reproduce this is run the sockmap selftest tool
+test_sockmap with data verification enabled, but it doesn't reproduce the
+fault. Perhaps we can trigger this case artificially somehow from the
+test tools. I haven't sorted out a way to do that yet though.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556566659.73229.15694973114605301063.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_bpf.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
+index 7aa68f4aae6c3..d85ba32dc6e7a 100644
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -15,8 +15,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ {
+ struct iov_iter *iter = &msg->msg_iter;
+ int peek = flags & MSG_PEEK;
+- int i, ret, copied = 0;
+ struct sk_msg *msg_rx;
++ int i, copied = 0;
+
+ msg_rx = list_first_entry_or_null(&psock->ingress_msg,
+ struct sk_msg, list);
+@@ -37,11 +37,9 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ page = sg_page(sge);
+ if (copied + copy > len)
+ copy = len - copied;
+- ret = copy_page_to_iter(page, sge->offset, copy, iter);
+- if (ret != copy) {
+- msg_rx->sg.start = i;
+- return -EFAULT;
+- }
++ copy = copy_page_to_iter(page, sge->offset, copy, iter);
++ if (!copy)
++ return copied ? copied : -EFAULT;
+
+ copied += copy;
+ if (likely(!peek)) {
+@@ -56,6 +54,11 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
+ put_page(page);
+ }
+ } else {
++ /* Lets not optimize peek case if copy_page_to_iter
++ * didn't copy the entire length lets just break.
++ */
++ if (copy != sge->length)
++ return copied;
+ sk_msg_iter_var_next(i);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 1699f9d7542306045797e4c7de90cf7b7f704e81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 11:36:37 -0700
+Subject: bpf, sockmap: On receive programs try to fast track SK_PASS ingress
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 9ecbfb06a078c4911fb444203e8e41d93d22f886 ]
+
+When we receive an skb and the ingress skb verdict program returns
+SK_PASS we currently set the ingress flag and put it on the workqueue
+so it can be turned into a sk_msg and put on the sk_msg ingress queue.
+Then finally telling userspace with data_ready hook.
+
+Here we observe that if the workqueue is empty then we can try to
+convert into a sk_msg type and call data_ready directly without
+bouncing through a workqueue. Its a common pattern to have a recv
+verdict program for visibility that always returns SK_PASS. In this
+case unless there is an ENOMEM error or we overrun the socket we
+can avoid the workqueue completely only using it when we fall back
+to error cases caused by memory pressure.
+
+By doing this we eliminate another case where data may be dropped
+if errors occur on memory limits in workqueue.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/160226859704.5692.12929678876744977669.stgit@john-Precision-5820-Tower
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index aa78784292a7e..eaf9c90389517 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -764,6 +764,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ {
+ struct tcp_skb_cb *tcp;
+ struct sock *sk_other;
++ int err = -EIO;
+
+ switch (verdict) {
+ case __SK_PASS:
+@@ -775,8 +776,20 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+
+ tcp = TCP_SKB_CB(skb);
+ tcp->bpf.flags |= BPF_F_INGRESS;
+- skb_queue_tail(&psock->ingress_skb, skb);
+- schedule_work(&psock->work);
++
++ /* If the queue is empty then we can submit directly
++ * into the msg queue. If its not empty we have to
++ * queue work otherwise we may get OOO data. Otherwise,
++ * if sk_psock_skb_ingress errors will be handled by
++ * retrying later from workqueue.
++ */
++ if (skb_queue_empty(&psock->ingress_skb)) {
++ err = sk_psock_skb_ingress(psock, skb);
++ }
++ if (err < 0) {
++ skb_queue_tail(&psock->ingress_skb, skb);
++ schedule_work(&psock->work);
++ }
+ break;
+ case __SK_REDIRECT:
+ sk_psock_skb_redirect(skb);
+--
+2.27.0
+
--- /dev/null
+From 89fe6e35827c7d691523d81cefe853799000166b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 11:36:16 -0700
+Subject: bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit cfea28f890cf292d5fe90680db64b68086ef25ba ]
+
+For sk_skb case where skb_verdict program returns SK_PASS to continue to
+pass packet up the stack, the memory limits were already checked before
+enqueuing in skb_queue_tail from TCP side. So, lets remove the extra checks
+here. The theory is if the TCP stack believes we have memory to receive
+the packet then lets trust the stack and not double check the limits.
+
+In fact the accounting here can cause a drop if sk_rmem_alloc has increased
+after the stack accepted this packet, but before the duplicate check here.
+And worse if this happens because TCP stack already believes the data has
+been received there is no retransmit.
+
+Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/160226857664.5692.668205469388498375.stgit@john-Precision-5820-Tower
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index f41b06e60ad90..aa78784292a7e 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -762,6 +762,7 @@ EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
+ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ struct sk_buff *skb, int verdict)
+ {
++ struct tcp_skb_cb *tcp;
+ struct sock *sk_other;
+
+ switch (verdict) {
+@@ -771,16 +772,12 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
+ !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
+ goto out_free;
+ }
+- if (atomic_read(&sk_other->sk_rmem_alloc) <=
+- sk_other->sk_rcvbuf) {
+- struct tcp_skb_cb *tcp = TCP_SKB_CB(skb);
+
+- tcp->bpf.flags |= BPF_F_INGRESS;
+- skb_queue_tail(&psock->ingress_skb, skb);
+- schedule_work(&psock->work);
+- break;
+- }
+- goto out_free;
++ tcp = TCP_SKB_CB(skb);
++ tcp->bpf.flags |= BPF_F_INGRESS;
++ skb_queue_tail(&psock->ingress_skb, skb);
++ schedule_work(&psock->work);
++ break;
+ case __SK_REDIRECT:
+ sk_psock_skb_redirect(skb);
+ break;
+--
+2.27.0
+
--- /dev/null
+From 30e26cd192452c5c5e771d23dd8eae2e61d2a586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 14:28:26 -0800
+Subject: bpf, sockmap: Use truesize with sk_rmem_schedule()
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 70796fb751f1d34cc650e640572a174faf009cd4 ]
+
+We use skb->size with sk_rmem_scheduled() which is not correct. Instead
+use truesize to align with socket and tcp stack usage of sk_rmem_schedule.
+
+Suggested-by: Daniel Borkman <daniel@iogearbox.net>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/160556570616.73229.17003722112077507863.stgit@john-XPS-13-9370
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/skmsg.c b/net/core/skmsg.c
+index eaf9c90389517..4ac112cc490c5 100644
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -411,7 +411,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+ msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+ if (unlikely(!msg))
+ return -EAGAIN;
+- if (!sk_rmem_schedule(sk, skb, skb->len)) {
++ if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
+ kfree(msg);
+ return -EAGAIN;
+ }
+--
+2.27.0
+
--- /dev/null
+From 1f966b4a4c5f286fb0c990395f15d07d48464c2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:05 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ can_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ]
+
+In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 5c06404bdf3e7..c7106daadd0c7 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -677,16 +677,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
+- cfd->len > CAN_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CAN_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+--
+2.27.0
+
--- /dev/null
+From b6617b3cf1bf2ecb600ee3b0e079437779ccecba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 03:09:06 +0530
+Subject: can: af_can: prevent potential access of uninitialized member in
+ canfd_rcv()
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ]
+
+In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
+uninitialized cfd->len is accessed nonetheless by pr_warn_once().
+
+Fix this uninitialized variable access by checking cfd->len's validity
+condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
+condition is checked, and appropriately modify the log messages that
+are generated as well.
+In case either of the required conditions fail, the skb is freed and
+NET_RX_DROP is returned, same as before.
+
+Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
+Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
+Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/af_can.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index c7106daadd0c7..0e71e0164ab3b 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -703,16 +703,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
+ {
+ struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
+
+- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
+- cfd->len > CANFD_MAX_DLEN)) {
+- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
++ dev->type, skb->len);
++ goto free_skb;
++ }
++
++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
+ dev->type, skb->len, cfd->len);
+- kfree_skb(skb);
+- return NET_RX_DROP;
++ goto free_skb;
+ }
+
+ can_receive(skb, dev);
+ return NET_RX_SUCCESS;
++
++free_skb:
++ kfree_skb(skb);
++ return NET_RX_DROP;
+ }
+
+ /* af_can protocol functions */
+--
+2.27.0
+
--- /dev/null
+From 12d4419cece87cac2a1bb0bee9b7348a628d486f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 21:51:47 +0000
+Subject: can: dev: can_restart(): post buffer from the right context
+
+From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+
+[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]
+
+netif_rx() is meant to be called from interrupt contexts. can_restart() may be
+called by can_restart_work(), which is called from a worqueue, so it may run in
+process context. Use netif_rx_ni() instead.
+
+Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
+Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
+Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
+Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
+[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index d5e52ffc7ed25..4bc9aa6c34787 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -566,7 +566,7 @@ static void can_restart(struct net_device *dev)
+
+ cf->can_id |= CAN_ERR_RESTARTED;
+
+- netif_rx(skb);
++ netif_rx_ni(skb);
+
+ stats->rx_packets++;
+ stats->rx_bytes += cf->can_dlc;
+--
+2.27.0
+
--- /dev/null
+From 67e28c76c59301b8b3ab428fcd85a23c806a9ee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:30:00 +0800
+Subject: can: flexcan: fix failure handling of pm_runtime_get_sync()
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b7ee5bc3e1006433601a058a6a7c24c5272635f4 ]
+
+pm_runtime_get_sync() will increment pm usage at first and it will resume the
+device later. If runtime of the device has error or device is in inaccessible
+state(or other error state), resume operation will fail. If we do not call put
+operation to decrease the reference, it will result in reference leak in the
+two functions flexcan_get_berr_counter() and flexcan_open().
+
+Moreover, this device cannot enter the idle state and always stay busy or other
+non-idle state later. So we should fix it through adding
+pm_runtime_put_noidle().
+
+Fixes: ca10989632d88 ("can: flexcan: implement can Runtime PM")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201108083000.2599705-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index a330d6c56242e..20a56f389c20c 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -614,8 +614,10 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
+ int err;
+
+ err = pm_runtime_get_sync(priv->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_noidle(priv->dev);
+ return err;
++ }
+
+ err = __flexcan_get_berr_counter(dev, bec);
+
+@@ -1310,8 +1312,10 @@ static int flexcan_open(struct net_device *dev)
+ int err;
+
+ err = pm_runtime_get_sync(priv->dev);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put_noidle(priv->dev);
+ return err;
++ }
+
+ err = open_candev(dev);
+ if (err)
+--
+2.27.0
+
--- /dev/null
+From a96c73679da53d5207961e3020827d8903f96b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 16:01:48 +0100
+Subject: can: flexcan: flexcan_chip_start(): fix erroneous
+ flexcan_transceiver_enable() during bus-off recovery
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit cd9f13c59461351d7a5fd07924264fb49b287359 ]
+
+If the CAN controller goes into bus off, the do_set_mode() callback with
+CAN_MODE_START can be used to recover the controller, which then calls
+flexcan_chip_start(). If configured, this is done automatically by the
+framework or manually by the user.
+
+In flexcan_chip_start() there is an explicit call to
+flexcan_transceiver_enable(), which does a regulator_enable() on the
+transceiver regulator. This results in a net usage counter increase, as there
+is no corresponding flexcan_transceiver_disable() in the bus off code path.
+This further leads to the transceiver stuck enabled, even if the CAN interface
+is shut down.
+
+To fix this problem the
+flexcan_transceiver_enable()/flexcan_transceiver_disable() are moved out of
+flexcan_chip_start()/flexcan_chip_stop() into flexcan_open()/flexcan_close().
+
+Fixes: e955cead0311 ("CAN: Add Flexcan CAN controller driver")
+Link: https://lore.kernel.org/r/20201118150148.2664024-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 20a56f389c20c..4cbe8889f546f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -1229,14 +1229,10 @@ static int flexcan_chip_start(struct net_device *dev)
+ priv->write(reg_mecr, ®s->mecr);
+ }
+
+- err = flexcan_transceiver_enable(priv);
+- if (err)
+- goto out_chip_disable;
+-
+ /* synchronize with the can bus */
+ err = flexcan_chip_unfreeze(priv);
+ if (err)
+- goto out_transceiver_disable;
++ goto out_chip_disable;
+
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+
+@@ -1254,8 +1250,6 @@ static int flexcan_chip_start(struct net_device *dev)
+
+ return 0;
+
+- out_transceiver_disable:
+- flexcan_transceiver_disable(priv);
+ out_chip_disable:
+ flexcan_chip_disable(priv);
+ return err;
+@@ -1285,7 +1279,6 @@ static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error)
+ priv->write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
+ ®s->ctrl);
+
+- flexcan_transceiver_disable(priv);
+ priv->can.state = CAN_STATE_STOPPED;
+
+ return 0;
+@@ -1321,10 +1314,14 @@ static int flexcan_open(struct net_device *dev)
+ if (err)
+ goto out_runtime_put;
+
+- err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
++ err = flexcan_transceiver_enable(priv);
+ if (err)
+ goto out_close;
+
++ err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
++ if (err)
++ goto out_transceiver_disable;
++
+ priv->mb_size = sizeof(struct flexcan_mb) + CAN_MAX_DLEN;
+ priv->mb_count = (sizeof(priv->regs->mb[0]) / priv->mb_size) +
+ (sizeof(priv->regs->mb[1]) / priv->mb_size);
+@@ -1373,6 +1370,8 @@ static int flexcan_open(struct net_device *dev)
+ can_rx_offload_del(&priv->offload);
+ out_free_irq:
+ free_irq(dev->irq, dev);
++ out_transceiver_disable:
++ flexcan_transceiver_disable(priv);
+ out_close:
+ close_candev(dev);
+ out_runtime_put:
+@@ -1391,6 +1390,7 @@ static int flexcan_close(struct net_device *dev)
+
+ can_rx_offload_del(&priv->offload);
+ free_irq(dev->irq, dev);
++ flexcan_transceiver_disable(priv);
+
+ close_candev(dev);
+ pm_runtime_put(priv->dev);
+--
+2.27.0
+
--- /dev/null
+From be42b3494b190434636e62899abdc9fdffd84c78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 17:30:22 +0100
+Subject: can: kvaser_pciefd: Fix KCAN bittiming limits
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit 470e14c00c63752466ac44de392f584dfdddd82e ]
+
+Use correct bittiming limits for the KCAN CAN controller.
+
+Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/r/20201115163027.16851-1-jimmyassarsson@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/kvaser_pciefd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
+index 6f766918211a4..72acd1ba162d2 100644
+--- a/drivers/net/can/kvaser_pciefd.c
++++ b/drivers/net/can/kvaser_pciefd.c
+@@ -287,12 +287,12 @@ struct kvaser_pciefd_tx_packet {
+ static const struct can_bittiming_const kvaser_pciefd_bittiming_const = {
+ .name = KVASER_PCIEFD_DRV_NAME,
+ .tseg1_min = 1,
+- .tseg1_max = 255,
++ .tseg1_max = 512,
+ .tseg2_min = 1,
+ .tseg2_max = 32,
+ .sjw_max = 16,
+ .brp_min = 1,
+- .brp_max = 4096,
++ .brp_max = 8192,
+ .brp_inc = 1,
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 73eac15d4748a437b9fcfd5faef21a5ca1ff7838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 17:30:23 +0100
+Subject: can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
+
+From: Jimmy Assarsson <extja@kvaser.com>
+
+[ Upstream commit d003868d7f8579838ed58b6429af91844039b6f8 ]
+
+Use correct bittiming limits for the KCAN CAN controller.
+
+Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
+Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
+Link: https://lore.kernel.org/r/20201115163027.16851-2-jimmyassarsson@gmail.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+index 7ab87a7587545..218fadc911558 100644
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
+ .tseg2_max = 32,
+ .sjw_max = 16,
+ .brp_min = 1,
+- .brp_max = 4096,
++ .brp_max = 8192,
+ .brp_inc = 1,
+ };
+
+--
+2.27.0
+
--- /dev/null
+From d93e756335ec2f66ccec2887ea3f91d89dc232fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 12:38:29 -0600
+Subject: can: m_can: Fix freeing of can device from peripherials
+
+From: Dan Murphy <dmurphy@ti.com>
+
+[ Upstream commit 85816aba460ceebed0047381395615891df68c8f ]
+
+Fix leaking netdev device from peripherial devices. The call to allocate the
+netdev device is made from and managed by the peripherial.
+
+Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
+Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 3 ---
+ drivers/net/can/m_can/m_can_platform.c | 23 +++++++++++++++--------
+ drivers/net/can/m_can/tcan4x5x.c | 26 ++++++++++++++++++--------
+ 3 files changed, 33 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index f2c87b76e5692..645101d19989b 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1856,7 +1856,6 @@ pm_runtime_fail:
+ if (ret) {
+ if (m_can_dev->pm_clock_support)
+ pm_runtime_disable(m_can_dev->dev);
+- free_candev(m_can_dev->net);
+ }
+
+ return ret;
+@@ -1914,8 +1913,6 @@ void m_can_class_unregister(struct m_can_classdev *m_can_dev)
+ unregister_candev(m_can_dev->net);
+
+ m_can_clk_stop(m_can_dev);
+-
+- free_candev(m_can_dev->net);
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_unregister);
+
+diff --git a/drivers/net/can/m_can/m_can_platform.c b/drivers/net/can/m_can/m_can_platform.c
+index e6d0cb9ee02f0..161cb9be018c0 100644
+--- a/drivers/net/can/m_can/m_can_platform.c
++++ b/drivers/net/can/m_can/m_can_platform.c
+@@ -67,32 +67,36 @@ static int m_can_plat_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
++ if (!priv) {
++ ret = -ENOMEM;
++ goto probe_fail;
++ }
+
+ mcan_class->device_data = priv;
+
+- m_can_class_get_clocks(mcan_class);
++ ret = m_can_class_get_clocks(mcan_class);
++ if (ret)
++ goto probe_fail;
+
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "m_can");
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ irq = platform_get_irq_byname(pdev, "int0");
+ if (IS_ERR(addr) || irq < 0) {
+ ret = -EINVAL;
+- goto failed_ret;
++ goto probe_fail;
+ }
+
+ /* message ram could be shared */
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram");
+ if (!res) {
+ ret = -ENODEV;
+- goto failed_ret;
++ goto probe_fail;
+ }
+
+ mram_addr = devm_ioremap(&pdev->dev, res->start, resource_size(res));
+ if (!mram_addr) {
+ ret = -ENOMEM;
+- goto failed_ret;
++ goto probe_fail;
+ }
+
+ priv->base = addr;
+@@ -111,9 +115,10 @@ static int m_can_plat_probe(struct platform_device *pdev)
+
+ m_can_init_ram(mcan_class);
+
+- ret = m_can_class_register(mcan_class);
++ return m_can_class_register(mcan_class);
+
+-failed_ret:
++probe_fail:
++ m_can_class_free_dev(mcan_class->net);
+ return ret;
+ }
+
+@@ -134,6 +139,8 @@ static int m_can_plat_remove(struct platform_device *pdev)
+
+ m_can_class_unregister(mcan_class);
+
++ m_can_class_free_dev(mcan_class->net);
++
+ platform_set_drvdata(pdev, NULL);
+
+ return 0;
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index 4fdb7121403ab..e5d7d85e0b6d1 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -440,14 +440,18 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+ return -ENOMEM;
+
+ priv = devm_kzalloc(&spi->dev, sizeof(*priv), GFP_KERNEL);
+- if (!priv)
+- return -ENOMEM;
++ if (!priv) {
++ ret = -ENOMEM;
++ goto out_m_can_class_free_dev;
++ }
+
+ priv->power = devm_regulator_get_optional(&spi->dev, "vsup");
+- if (PTR_ERR(priv->power) == -EPROBE_DEFER)
+- return -EPROBE_DEFER;
+- else
++ if (PTR_ERR(priv->power) == -EPROBE_DEFER) {
++ ret = -EPROBE_DEFER;
++ goto out_m_can_class_free_dev;
++ } else {
+ priv->power = NULL;
++ }
+
+ mcan_class->device_data = priv;
+
+@@ -460,8 +464,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+ }
+
+ /* Sanity check */
+- if (freq < 20000000 || freq > TCAN4X5X_EXT_CLK_DEF)
+- return -ERANGE;
++ if (freq < 20000000 || freq > TCAN4X5X_EXT_CLK_DEF) {
++ ret = -ERANGE;
++ goto out_m_can_class_free_dev;
++ }
+
+ priv->reg_offset = TCAN4X5X_MCAN_OFFSET;
+ priv->mram_start = TCAN4X5X_MRAM_START;
+@@ -518,8 +524,10 @@ out_clk:
+ clk_disable_unprepare(mcan_class->cclk);
+ clk_disable_unprepare(mcan_class->hclk);
+ }
+-
++ out_m_can_class_free_dev:
++ m_can_class_free_dev(mcan_class->net);
+ dev_err(&spi->dev, "Probe failed, err=%d\n", ret);
++
+ return ret;
+ }
+
+@@ -531,6 +539,8 @@ static int tcan4x5x_can_remove(struct spi_device *spi)
+
+ tcan4x5x_power_enable(priv->power, 0);
+
++ m_can_class_free_dev(priv->mcan_dev->net);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 388044d776565260e4146cc128da8bbd239a5798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 12:38:29 -0600
+Subject: can: m_can: m_can_class_free_dev(): introduce new function
+
+From: Dan Murphy <dmurphy@ti.com>
+
+[ Upstream commit a8c22f5b0c689a29f45ef4a110d09fd391debcbc ]
+
+This patch creates a common function that peripherials can call to free the
+netdev device when failures occur.
+
+Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
+Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 6 ++++++
+ drivers/net/can/m_can/m_can.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 63887e23d89c0..f2c87b76e5692 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1812,6 +1812,12 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(m_can_class_allocate_dev);
+
++void m_can_class_free_dev(struct net_device *net)
++{
++ free_candev(net);
++}
++EXPORT_SYMBOL_GPL(m_can_class_free_dev);
++
+ int m_can_class_register(struct m_can_classdev *m_can_dev)
+ {
+ int ret;
+diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h
+index 49f42b50627a1..b2699a7c99973 100644
+--- a/drivers/net/can/m_can/m_can.h
++++ b/drivers/net/can/m_can/m_can.h
+@@ -99,6 +99,7 @@ struct m_can_classdev {
+ };
+
+ struct m_can_classdev *m_can_class_allocate_dev(struct device *dev);
++void m_can_class_free_dev(struct net_device *net);
+ int m_can_class_register(struct m_can_classdev *cdev);
+ void m_can_class_unregister(struct m_can_classdev *cdev);
+ int m_can_class_get_clocks(struct m_can_classdev *cdev);
+--
+2.27.0
+
--- /dev/null
+From a91f09d3aac3b6e6fb5e5972a04aa439c56b2088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 10:23:30 +0800
+Subject: can: m_can: m_can_handle_state_change(): fix state change
+
+From: Wu Bo <wubo.oduw@gmail.com>
+
+[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]
+
+m_can_handle_state_change() is called with the new_state as an argument.
+
+In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
+following code indicate that a CAN_STATE_ERROR_WARNING is handled.
+
+This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.
+
+Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
+Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
+Cc: Dan Murphy <dmurphy@ti.com>
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 02c5795b73936..63887e23d89c0 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -665,7 +665,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ unsigned int ecr;
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cdev->can.can_stats.error_warning++;
+ cdev->can.state = CAN_STATE_ERROR_WARNING;
+@@ -694,7 +694,7 @@ static int m_can_handle_state_change(struct net_device *dev,
+ __m_can_get_berr_counter(dev, &bec);
+
+ switch (new_state) {
+- case CAN_STATE_ERROR_ACTIVE:
++ case CAN_STATE_ERROR_WARNING:
+ /* error warning state */
+ cf->can_id |= CAN_ERR_CRTL;
+ cf->data[1] = (bec.txerr > bec.rxerr) ?
+--
+2.27.0
+
--- /dev/null
+From f197875fbe528311cd6d1ada635600d66038c00c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Aug 2020 11:24:42 +0530
+Subject: can: m_can: m_can_stop(): set device to software init mode before
+ closing
+
+From: Faiz Abbas <faiz_abbas@ti.com>
+
+[ Upstream commit a584e9bc1b7e88f24f8504886eafbe6c73d8a97c ]
+
+There might be some requests pending in the buffer when the interface close
+sequence occurs. In some devices, these pending requests might lead to the
+module not shutting down properly when m_can_clk_stop() is called.
+
+Therefore, move the device to init state before potentially powering it down.
+
+Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
+Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Link: https://lore.kernel.org/r/20200825055442.16994-1-faiz_abbas@ti.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 645101d19989b..e7264043f79a2 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -1414,6 +1414,9 @@ static void m_can_stop(struct net_device *dev)
+ /* disable all interrupts */
+ m_can_disable_all_interrupts(cdev);
+
++ /* Set init mode to disengage from the network */
++ m_can_config_endisable(cdev, true);
++
+ /* set the state as STOPPED */
+ cdev->can.state = CAN_STATE_STOPPED;
+ }
+--
+2.27.0
+
--- /dev/null
+From d8606cb3ca6a3e14a49c255c17c2e1c95b019436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Sep 2020 16:47:15 +0300
+Subject: can: m_can: process interrupt only when not runtime suspended
+
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+
+[ Upstream commit a1f634463aaf2c94dfa13001dbdea011303124cc ]
+
+Avoid processing bogus interrupt statuses when the HW is runtime suspended and
+the M_CAN_IR register read may get all bits 1's. Handler can be called if the
+interrupt request is shared with other peripherals or at the end of free_irq().
+
+Therefore check the runtime suspended status before processing.
+
+Fixes: cdf8259d6573 ("can: m_can: Add PM Support")
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20200915134715.696303-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index e7264043f79a2..f3fc37e96b087 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -956,6 +956,8 @@ static irqreturn_t m_can_isr(int irq, void *dev_id)
+ struct net_device_stats *stats = &dev->stats;
+ u32 ir;
+
++ if (pm_runtime_suspended(cdev->dev))
++ return IRQ_NONE;
+ ir = m_can_read(cdev, M_CAN_IR);
+ if (!ir)
+ return IRQ_NONE;
+--
+2.27.0
+
--- /dev/null
+From 006ea22478caf5634ad416d38f720a8b04a4c8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Aug 2019 21:16:55 +0200
+Subject: can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to
+ can_put_echo_skb()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ]
+
+The driver has to first fill the skb with data and then handle it to
+can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before
+sending the skb out via USB.
+
+Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
+Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
+Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/mcba_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
+index 21faa2ec46327..8f785c199e220 100644
+--- a/drivers/net/can/usb/mcba_usb.c
++++ b/drivers/net/can/usb/mcba_usb.c
+@@ -326,8 +326,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (!ctx)
+ return NETDEV_TX_BUSY;
+
+- can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+-
+ if (cf->can_id & CAN_EFF_FLAG) {
+ /* SIDH | SIDL | EIDH | EIDL
+ * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
+@@ -357,6 +355,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
+ if (cf->can_id & CAN_RTR_FLAG)
+ usb_msg.dlc |= MCBA_DLC_RTR_MASK;
+
++ can_put_echo_skb(skb, priv->netdev, ctx->ndx);
++
+ err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
+ if (err)
+ goto xmit_failed;
+--
+2.27.0
+
--- /dev/null
+From 060e98ffbac4b4cd3692c2dacaa36bbc87399b48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 11:24:27 +0000
+Subject: can: peak_usb: fix potential integer overflow on shift of a int
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]
+
+The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
+arithmetic and then assigned to a signed 64 bit variable. In the case where
+time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
+Avoid this by shifting using the BIT_ULL macro instead.
+
+Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index c2764799f9efb..204ccb27d6d9a 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -156,7 +156,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
+ /* case when event time (tsw) wraps */
+ if (ts < time_ref->ts_dev_1)
+- delta_ts = 1 << time_ref->adapter->ts_used_bits;
++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
+
+ /* Otherwise, sync time counter (ts_dev_2) has wrapped:
+ * handle case when event time (tsn) hasn't.
+@@ -168,7 +168,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
+ * tsn ts
+ */
+ } else if (time_ref->ts_dev_1 < ts) {
+- delta_ts = -(1 << time_ref->adapter->ts_used_bits);
++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
+ }
+
+ /* add delay between last sync and event timestamps */
+--
+2.27.0
+
--- /dev/null
+From 70ecd5af13f8b11bd65ee76c8528727dd2f4a597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 16:10:13 +0200
+Subject: can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 3fcce133f0d9a50d3a23f8e2bc950197b4e03900 ]
+
+regmap is a library function that gets selected by drivers that need it. No
+driver modules should depend on it. Instead depends on SPI and select
+REGMAP_SPI. Depending on REGMAP_SPI makes this driver only build if another
+driver already selected REGMAP_SPI, as the symbol can't be selected through the
+menu kernel configuration.
+
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: http://lore.kernel.org/r/20200413141013.506613-1-enric.balletbo@collabora.com
+Reviewed-by: Dan Murphy <dmurphy@ti.com>
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
+index d9216147ca93f..3acedb766c48c 100644
+--- a/drivers/net/can/m_can/Kconfig
++++ b/drivers/net/can/m_can/Kconfig
+@@ -16,7 +16,8 @@ config CAN_M_CAN_PLATFORM
+
+ config CAN_M_CAN_TCAN4X5X
+ depends on CAN_M_CAN
+- depends on REGMAP_SPI
++ depends on SPI
++ select REGMAP_SPI
+ tristate "TCAN4X5X M_CAN device"
+ help
+ Say Y here if you want support for Texas Instruments TCAN4x5x
+--
+2.27.0
+
--- /dev/null
+From 54c815db8ce6ef3587dd316513402288065823f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 11:30:34 +0100
+Subject: can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for
+ devm_regmap_init()
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1ff203badbbf1738027c8395d5b40b0d462b6e4d ]
+
+This patch adds the missing error checking when initializing the regmap
+interface fails.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Cc: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20201019154233.1262589-7-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/tcan4x5x.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index eacd428e07e9f..f058bd9104e99 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -487,6 +487,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
+
+ priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus,
+ &spi->dev, &tcan4x5x_regmap);
++ if (IS_ERR(priv->regmap)) {
++ ret = PTR_ERR(priv->regmap);
++ goto out_clk;
++ }
+
+ ret = tcan4x5x_power_enable(priv->power, 1);
+ if (ret)
+--
+2.27.0
+
--- /dev/null
+From f8d781721c77b1667b1fc5397e4063311d914332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Aug 2020 22:23:49 +0200
+Subject: can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit c81d0b6ca665477c761f227807010762630b089f ]
+
+Change the order in tcan4x5x_can_remove() to be the exact inverse of
+tcan4x5x_can_probe(). First m_can_class_unregister(), then power down the
+device.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Cc: Dan Murphy <dmurphy@ti.com>
+Link: http://lore.kernel.org/r/20201019154233.1262589-10-mkl@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/tcan4x5x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
+index f058bd9104e99..4fdb7121403ab 100644
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -527,10 +527,10 @@ static int tcan4x5x_can_remove(struct spi_device *spi)
+ {
+ struct tcan4x5x_priv *priv = spi_get_drvdata(spi);
+
+- tcan4x5x_power_enable(priv->power, 0);
+-
+ m_can_class_unregister(priv->mcan_dev);
+
++ tcan4x5x_power_enable(priv->power, 0);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From d531c1b512f218fc987d69a3d0c44d96dd88913e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 19:17:08 +0800
+Subject: can: ti_hecc: Fix memleak in ti_hecc_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ]
+
+In the error handling, we should goto the probe_exit_candev
+to free ndev to prevent memory leak.
+
+Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/ti_hecc.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
+index 228ecd45ca6c1..0e8b5df7e9830 100644
+--- a/drivers/net/can/ti_hecc.c
++++ b/drivers/net/can/ti_hecc.c
+@@ -887,7 +887,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->base = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->base)) {
+ dev_err(&pdev->dev, "hecc ioremap failed\n");
+- return PTR_ERR(priv->base);
++ err = PTR_ERR(priv->base);
++ goto probe_exit_candev;
+ }
+
+ /* handle hecc-ram memory */
+@@ -900,7 +901,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->hecc_ram)) {
+ dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
+- return PTR_ERR(priv->hecc_ram);
++ err = PTR_ERR(priv->hecc_ram);
++ goto probe_exit_candev;
+ }
+
+ /* handle mbx memory */
+@@ -913,13 +915,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
+ priv->mbx = devm_ioremap_resource(&pdev->dev, res);
+ if (IS_ERR(priv->mbx)) {
+ dev_err(&pdev->dev, "mbx ioremap failed\n");
+- return PTR_ERR(priv->mbx);
++ err = PTR_ERR(priv->mbx);
++ goto probe_exit_candev;
+ }
+
+ irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+ if (!irq) {
+ dev_err(&pdev->dev, "No irq resource\n");
+- goto probe_exit;
++ goto probe_exit_candev;
+ }
+
+ priv->ndev = ndev;
+@@ -983,7 +986,7 @@ probe_exit_release_clk:
+ clk_put(priv->clk);
+ probe_exit_candev:
+ free_candev(ndev);
+-probe_exit:
++
+ return err;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7b9d74ae0d63c125aec93c90ca14fe4ffc6a605f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 11:51:22 -0500
+Subject: counter/ti-eqep: Fix regmap max_register
+
+From: David Lechner <david@lechnology.com>
+
+[ Upstream commit 271b339236e1c0e6448bc1cafeaedcb529324bf0 ]
+
+The values given were the offset of the register after the last
+register instead of the actual last register in each range. Fix
+by using the correct last register of each range.
+
+Fixes: f213729f6796 ("counter: new TI eQEP driver")
+Signed-off-by: David Lechner <david@lechnology.com>
+Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Link: https://lore.kernel.org/r/20201025165122.607866-1-david@lechnology.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/counter/ti-eqep.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/counter/ti-eqep.c b/drivers/counter/ti-eqep.c
+index 1ff07faef27f3..5d6470968d2cd 100644
+--- a/drivers/counter/ti-eqep.c
++++ b/drivers/counter/ti-eqep.c
+@@ -368,7 +368,7 @@ static const struct regmap_config ti_eqep_regmap32_config = {
+ .reg_bits = 32,
+ .val_bits = 32,
+ .reg_stride = 4,
+- .max_register = 0x24,
++ .max_register = QUPRD,
+ };
+
+ static const struct regmap_config ti_eqep_regmap16_config = {
+@@ -376,7 +376,7 @@ static const struct regmap_config ti_eqep_regmap16_config = {
+ .reg_bits = 16,
+ .val_bits = 16,
+ .reg_stride = 2,
+- .max_register = 0x1e,
++ .max_register = QCPRDLAT,
+ };
+
+ static int ti_eqep_probe(struct platform_device *pdev)
+--
+2.27.0
+
--- /dev/null
+From e8a9751677cea00c55b8ebe0007c5e2e5d1097e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 13:16:31 +0300
+Subject: dmaengine: fix error codes in channel_register()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7e4be1290a38b3dd4a77cdf4565c9ffe7e620013 ]
+
+The error codes were not set on some of these error paths.
+
+Also the error handling was more confusing than it needed to be so I
+cleaned it up and shuffled it around a bit.
+
+Fixes: d2fb0a043838 ("dmaengine: break out channel registration")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20201113101631.GE168908@mwanda
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dmaengine.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index a53e71d2bbd4c..a2146d1f42da7 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -1055,16 +1055,15 @@ static int get_dma_id(struct dma_device *device)
+ static int __dma_async_device_channel_register(struct dma_device *device,
+ struct dma_chan *chan)
+ {
+- int rc = 0;
++ int rc;
+
+ chan->local = alloc_percpu(typeof(*chan->local));
+ if (!chan->local)
+- goto err_out;
++ return -ENOMEM;
+ chan->dev = kzalloc(sizeof(*chan->dev), GFP_KERNEL);
+ if (!chan->dev) {
+- free_percpu(chan->local);
+- chan->local = NULL;
+- goto err_out;
++ rc = -ENOMEM;
++ goto err_free_local;
+ }
+
+ /*
+@@ -1077,7 +1076,8 @@ static int __dma_async_device_channel_register(struct dma_device *device,
+ if (chan->chan_id < 0) {
+ pr_err("%s: unable to alloc ida for chan: %d\n",
+ __func__, chan->chan_id);
+- goto err_out;
++ rc = chan->chan_id;
++ goto err_free_dev;
+ }
+
+ chan->dev->device.class = &dma_devclass;
+@@ -1098,9 +1098,10 @@ static int __dma_async_device_channel_register(struct dma_device *device,
+ mutex_lock(&device->chan_mutex);
+ ida_free(&device->chan_ida, chan->chan_id);
+ mutex_unlock(&device->chan_mutex);
+- err_out:
+- free_percpu(chan->local);
++ err_free_dev:
+ kfree(chan->dev);
++ err_free_local:
++ free_percpu(chan->local);
+ return rc;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 27f1f22d8e125c6677fd84f8cc2c5bda878fc943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 15:23:46 -0700
+Subject: dmaengine: idxd: fix mapping of portal size
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 8326be9f1c0bb498baf134878a8deb8a952e0135 ]
+
+Portal size is 4k. Current code is mapping all 4 portals in a single chunk.
+Restrict the mapped portal size to a single portal to ensure that submission
+only goes to the intended portal address.
+
+Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/160513342642.510187.16450549281618747065.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 2 +-
+ drivers/dma/idxd/registers.h | 2 +-
+ drivers/dma/idxd/submit.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index c2beece445215..66e947627f569 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -271,7 +271,7 @@ int idxd_wq_map_portal(struct idxd_wq *wq)
+ resource_size_t start;
+
+ start = pci_resource_start(pdev, IDXD_WQ_BAR);
+- start = start + wq->id * IDXD_PORTAL_SIZE;
++ start += idxd_get_wq_portal_full_offset(wq->id, IDXD_PORTAL_LIMITED);
+
+ wq->dportal = devm_ioremap(dev, start, IDXD_PORTAL_SIZE);
+ if (!wq->dportal)
+diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h
+index aef5a902829ee..54390334c243a 100644
+--- a/drivers/dma/idxd/registers.h
++++ b/drivers/dma/idxd/registers.h
+@@ -8,7 +8,7 @@
+
+ #define IDXD_MMIO_BAR 0
+ #define IDXD_WQ_BAR 2
+-#define IDXD_PORTAL_SIZE 0x4000
++#define IDXD_PORTAL_SIZE PAGE_SIZE
+
+ /* MMIO Device BAR0 Registers */
+ #define IDXD_VER_OFFSET 0x00
+diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
+index 156a1ee233aa5..417048e3c42aa 100644
+--- a/drivers/dma/idxd/submit.c
++++ b/drivers/dma/idxd/submit.c
+@@ -74,7 +74,7 @@ int idxd_submit_desc(struct idxd_wq *wq, struct idxd_desc *desc)
+ if (idxd->state != IDXD_DEV_ENABLED)
+ return -EIO;
+
+- portal = wq->dportal + idxd_get_wq_portal_offset(IDXD_PORTAL_UNLIMITED);
++ portal = wq->dportal;
+ /*
+ * The wmb() flushes writes to coherent DMA data before possibly
+ * triggering a DMA read. The wmb() is necessary even on UP because
+--
+2.27.0
+
--- /dev/null
+From 0ef16712429320c69408e5e7de3b57774d4112df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 14:34:09 -0700
+Subject: dmaengine: idxd: fix wq config registers offset programming
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 484f910e93b48c1d8890d8330a87e34ae61f4782 ]
+
+DSA spec v1.1 [1] updated to include a stride size register for WQ
+configuration that will specify how much space is reserved for the WQ
+configuration register set. This change is expected to be in the final
+gen1 DSA hardware. Fix the driver to use WQCFG_OFFSET() for all WQ
+offset calculation and fixup WQCFG_OFFSET() to use the new calculated
+wq size.
+
+[1]: https://software.intel.com/content/www/us/en/develop/download/intel-data-streaming-accelerator-preliminary-architecture-specification.html
+
+Fixes: bfe1d56091c1 ("dmaengine: idxd: Init and probe for Intel data accelerators")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/160383444959.48058.14249265538404901781.stgit@djiang5-desk3.ch.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/device.c | 29 ++++++++++++++---------------
+ drivers/dma/idxd/idxd.h | 3 ++-
+ drivers/dma/idxd/init.c | 5 +++++
+ drivers/dma/idxd/registers.h | 23 ++++++++++++++++++++++-
+ 4 files changed, 43 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c
+index b75d699160bfa..c2beece445215 100644
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -295,7 +295,7 @@ void idxd_wq_disable_cleanup(struct idxd_wq *wq)
+ int i, wq_offset;
+
+ lockdep_assert_held(&idxd->dev_lock);
+- memset(&wq->wqcfg, 0, sizeof(wq->wqcfg));
++ memset(wq->wqcfg, 0, idxd->wqcfg_size);
+ wq->type = IDXD_WQT_NONE;
+ wq->size = 0;
+ wq->group = NULL;
+@@ -304,8 +304,8 @@ void idxd_wq_disable_cleanup(struct idxd_wq *wq)
+ clear_bit(WQ_FLAG_DEDICATED, &wq->flags);
+ memset(wq->name, 0, WQ_NAME_SIZE);
+
+- for (i = 0; i < 8; i++) {
+- wq_offset = idxd->wqcfg_offset + wq->id * 32 + i * sizeof(u32);
++ for (i = 0; i < WQCFG_STRIDES(idxd); i++) {
++ wq_offset = WQCFG_OFFSET(idxd, wq->id, i);
+ iowrite32(0, idxd->reg_base + wq_offset);
+ dev_dbg(dev, "WQ[%d][%d][%#x]: %#x\n",
+ wq->id, i, wq_offset,
+@@ -535,10 +535,10 @@ static int idxd_wq_config_write(struct idxd_wq *wq)
+ if (!wq->group)
+ return 0;
+
+- memset(&wq->wqcfg, 0, sizeof(union wqcfg));
++ memset(wq->wqcfg, 0, idxd->wqcfg_size);
+
+ /* byte 0-3 */
+- wq->wqcfg.wq_size = wq->size;
++ wq->wqcfg->wq_size = wq->size;
+
+ if (wq->size == 0) {
+ dev_warn(dev, "Incorrect work queue size: 0\n");
+@@ -546,22 +546,21 @@ static int idxd_wq_config_write(struct idxd_wq *wq)
+ }
+
+ /* bytes 4-7 */
+- wq->wqcfg.wq_thresh = wq->threshold;
++ wq->wqcfg->wq_thresh = wq->threshold;
+
+ /* byte 8-11 */
+- wq->wqcfg.priv = !!(wq->type == IDXD_WQT_KERNEL);
+- wq->wqcfg.mode = 1;
+-
+- wq->wqcfg.priority = wq->priority;
++ wq->wqcfg->priv = !!(wq->type == IDXD_WQT_KERNEL);
++ wq->wqcfg->mode = 1;
++ wq->wqcfg->priority = wq->priority;
+
+ /* bytes 12-15 */
+- wq->wqcfg.max_xfer_shift = idxd->hw.gen_cap.max_xfer_shift;
+- wq->wqcfg.max_batch_shift = idxd->hw.gen_cap.max_batch_shift;
++ wq->wqcfg->max_xfer_shift = idxd->hw.gen_cap.max_xfer_shift;
++ wq->wqcfg->max_batch_shift = idxd->hw.gen_cap.max_batch_shift;
+
+ dev_dbg(dev, "WQ %d CFGs\n", wq->id);
+- for (i = 0; i < 8; i++) {
+- wq_offset = idxd->wqcfg_offset + wq->id * 32 + i * sizeof(u32);
+- iowrite32(wq->wqcfg.bits[i], idxd->reg_base + wq_offset);
++ for (i = 0; i < WQCFG_STRIDES(idxd); i++) {
++ wq_offset = WQCFG_OFFSET(idxd, wq->id, i);
++ iowrite32(wq->wqcfg->bits[i], idxd->reg_base + wq_offset);
+ dev_dbg(dev, "WQ[%d][%d][%#x]: %#x\n",
+ wq->id, i, wq_offset,
+ ioread32(idxd->reg_base + wq_offset));
+diff --git a/drivers/dma/idxd/idxd.h b/drivers/dma/idxd/idxd.h
+index e62b4799d1896..a3e5b83c80ef7 100644
+--- a/drivers/dma/idxd/idxd.h
++++ b/drivers/dma/idxd/idxd.h
+@@ -103,7 +103,7 @@ struct idxd_wq {
+ u32 priority;
+ enum idxd_wq_state state;
+ unsigned long flags;
+- union wqcfg wqcfg;
++ union wqcfg *wqcfg;
+ u32 vec_ptr; /* interrupt steering */
+ struct dsa_hw_desc **hw_descs;
+ int num_descs;
+@@ -180,6 +180,7 @@ struct idxd_device {
+ int max_wq_size;
+ int token_limit;
+ int nr_tokens; /* non-reserved tokens */
++ unsigned int wqcfg_size;
+
+ union sw_err_reg sw_err;
+ wait_queue_head_t cmd_waitq;
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index c7c61974f20f6..4bf9ed369bb7b 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -176,6 +176,9 @@ static int idxd_setup_internals(struct idxd_device *idxd)
+ wq->idxd = idxd;
+ mutex_init(&wq->wq_lock);
+ wq->idxd_cdev.minor = -1;
++ wq->wqcfg = devm_kzalloc(dev, idxd->wqcfg_size, GFP_KERNEL);
++ if (!wq->wqcfg)
++ return -ENOMEM;
+ }
+
+ for (i = 0; i < idxd->max_engines; i++) {
+@@ -249,6 +252,8 @@ static void idxd_read_caps(struct idxd_device *idxd)
+ dev_dbg(dev, "total workqueue size: %u\n", idxd->max_wq_size);
+ idxd->max_wqs = idxd->hw.wq_cap.num_wqs;
+ dev_dbg(dev, "max workqueues: %u\n", idxd->max_wqs);
++ idxd->wqcfg_size = 1 << (idxd->hw.wq_cap.wqcfg_size + IDXD_WQCFG_MIN);
++ dev_dbg(dev, "wqcfg size: %u\n", idxd->wqcfg_size);
+
+ /* reading operation capabilities */
+ for (i = 0; i < 4; i++) {
+diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h
+index a39e7ae6b3d93..aef5a902829ee 100644
+--- a/drivers/dma/idxd/registers.h
++++ b/drivers/dma/idxd/registers.h
+@@ -43,7 +43,8 @@ union wq_cap_reg {
+ struct {
+ u64 total_wq_size:16;
+ u64 num_wqs:8;
+- u64 rsvd:24;
++ u64 wqcfg_size:4;
++ u64 rsvd:20;
+ u64 shared_mode:1;
+ u64 dedicated_mode:1;
+ u64 rsvd2:1;
+@@ -55,6 +56,7 @@ union wq_cap_reg {
+ u64 bits;
+ } __packed;
+ #define IDXD_WQCAP_OFFSET 0x20
++#define IDXD_WQCFG_MIN 5
+
+ union group_cap_reg {
+ struct {
+@@ -333,4 +335,23 @@ union wqcfg {
+ };
+ u32 bits[8];
+ } __packed;
++
++/*
++ * This macro calculates the offset into the WQCFG register
++ * idxd - struct idxd *
++ * n - wq id
++ * ofs - the index of the 32b dword for the config register
++ *
++ * The WQCFG register block is divided into groups per each wq. The n index
++ * allows us to move to the register group that's for that particular wq.
++ * Each register is 32bits. The ofs gives us the number of register to access.
++ */
++#define WQCFG_OFFSET(_idxd_dev, n, ofs) \
++({\
++ typeof(_idxd_dev) __idxd_dev = (_idxd_dev); \
++ (__idxd_dev)->wqcfg_offset + (n) * (__idxd_dev)->wqcfg_size + sizeof(u32) * (ofs); \
++})
++
++#define WQCFG_STRIDES(_idxd_dev) ((_idxd_dev)->wqcfg_size / sizeof(u32))
++
+ #endif
+--
+2.27.0
+
--- /dev/null
+From 219c75eb66fbd8ba62563d3c0a51ab383c6717ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 17:40:13 +0200
+Subject: dmaengine: ti: omap-dma: Block PM if SDMA is busy to fix audio
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 29a25b9246f7f24203d30d59424cbe22bd905dfc ]
+
+We now use cpu_pm for saving and restoring device context for deeper SoC
+idle states. But for omap3, we must also block idle if SDMA is busy.
+
+If we don't block idle when SDMA is busy, we eventually end up saving and
+restoring SDMA register state on PER domain idle while SDMA is active and
+that causes at least audio playback to fail.
+
+Fixes: 4c74ecf79227 ("dmaengine: ti: omap-dma: Add device tree match data and use it for cpu_pm")
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20201109154013.11950-1-tony@atomide.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/omap-dma.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
+index 918301e175525..3339f0952074a 100644
+--- a/drivers/dma/ti/omap-dma.c
++++ b/drivers/dma/ti/omap-dma.c
+@@ -1522,29 +1522,38 @@ static void omap_dma_free(struct omap_dmadev *od)
+ }
+ }
+
++/* Currently used by omap2 & 3 to block deeper SoC idle states */
++static bool omap_dma_busy(struct omap_dmadev *od)
++{
++ struct omap_chan *c;
++ int lch = -1;
++
++ while (1) {
++ lch = find_next_bit(od->lch_bitmap, od->lch_count, lch + 1);
++ if (lch >= od->lch_count)
++ break;
++ c = od->lch_map[lch];
++ if (!c)
++ continue;
++ if (omap_dma_chan_read(c, CCR) & CCR_ENABLE)
++ return true;
++ }
++
++ return false;
++}
++
+ /* Currently only used for omap2. For omap1, also a check for lcd_dma is needed */
+ static int omap_dma_busy_notifier(struct notifier_block *nb,
+ unsigned long cmd, void *v)
+ {
+ struct omap_dmadev *od;
+- struct omap_chan *c;
+- int lch = -1;
+
+ od = container_of(nb, struct omap_dmadev, nb);
+
+ switch (cmd) {
+ case CPU_CLUSTER_PM_ENTER:
+- while (1) {
+- lch = find_next_bit(od->lch_bitmap, od->lch_count,
+- lch + 1);
+- if (lch >= od->lch_count)
+- break;
+- c = od->lch_map[lch];
+- if (!c)
+- continue;
+- if (omap_dma_chan_read(c, CCR) & CCR_ENABLE)
+- return NOTIFY_BAD;
+- }
++ if (omap_dma_busy(od))
++ return NOTIFY_BAD;
+ break;
+ case CPU_CLUSTER_PM_ENTER_FAILED:
+ case CPU_CLUSTER_PM_EXIT:
+@@ -1595,6 +1604,8 @@ static int omap_dma_context_notifier(struct notifier_block *nb,
+
+ switch (cmd) {
+ case CPU_CLUSTER_PM_ENTER:
++ if (omap_dma_busy(od))
++ return NOTIFY_BAD;
+ omap_dma_context_save(od);
+ break;
+ case CPU_CLUSTER_PM_ENTER_FAILED:
+--
+2.27.0
+
--- /dev/null
+From f1a0dbdbe1ae942b4756126aa8ed51f899a7098f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 12:30:06 +0530
+Subject: dmaengine: xilinx_dma: Fix SG capability check for MCDMA
+
+From: Matthew Murrian <matthew.murrian@goctsi.com>
+
+[ Upstream commit 96d5d884f78306206d745d856aad322becd100c3 ]
+
+The SG capability is inherently present with Multichannel DMA operation.
+The register used to check for this capability with other DMA driver types
+is not defined for MCDMA.
+
+Fixes: 6ccd692bfb7f ("dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support")
+Signed-off-by: Matthew Murrian <matthew.murrian@goctsi.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Link: https://lore.kernel.org/r/1604473206-32573-4-git-send-email-radhey.shyam.pandey@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index f0662f6672ff9..0fc432567b857 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -2875,10 +2875,11 @@ static int xilinx_dma_chan_probe(struct xilinx_dma_device *xdev,
+ chan->stop_transfer = xilinx_dma_stop_transfer;
+ }
+
+- /* check if SG is enabled (only for AXIDMA and CDMA) */
++ /* check if SG is enabled (only for AXIDMA, AXIMCDMA, and CDMA) */
+ if (xdev->dma_config->dmatype != XDMA_TYPE_VDMA) {
+- if (dma_ctrl_read(chan, XILINX_DMA_REG_DMASR) &
+- XILINX_DMA_DMASR_SG_MASK)
++ if (xdev->dma_config->dmatype == XDMA_TYPE_AXIMCDMA ||
++ dma_ctrl_read(chan, XILINX_DMA_REG_DMASR) &
++ XILINX_DMA_DMASR_SG_MASK)
+ chan->has_sg = true;
+ dev_dbg(chan->dev, "ch %d: SG %s\n", chan->id,
+ chan->has_sg ? "enabled" : "disabled");
+--
+2.27.0
+
--- /dev/null
+From d37399298bdff962aabca35932e09379e6cb2be1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 12:30:05 +0530
+Subject: dmaengine: xilinx_dma: Fix usage of xilinx_aximcdma_tx_segment
+
+From: Matthew Murrian <matthew.murrian@goctsi.com>
+
+[ Upstream commit c8ae7932997d0cc92d016829138074c7520248e5 ]
+
+Several code sections incorrectly use struct xilinx_axidma_tx_segment
+instead of struct xilinx_aximcdma_tx_segment when operating as
+Multichannel DMA. As their structures are similar, this just works.
+
+Fixes: 6ccd692bfb7f ("dmaengine: xilinx_dma: Add Xilinx AXI MCDMA Engine driver support")
+Signed-off-by: Matthew Murrian <matthew.murrian@goctsi.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Link: https://lore.kernel.org/r/1604473206-32573-3-git-send-email-radhey.shyam.pandey@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 5429497d3560b..f0662f6672ff9 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -948,8 +948,10 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
+ {
+ struct xilinx_cdma_tx_segment *cdma_seg;
+ struct xilinx_axidma_tx_segment *axidma_seg;
++ struct xilinx_aximcdma_tx_segment *aximcdma_seg;
+ struct xilinx_cdma_desc_hw *cdma_hw;
+ struct xilinx_axidma_desc_hw *axidma_hw;
++ struct xilinx_aximcdma_desc_hw *aximcdma_hw;
+ struct list_head *entry;
+ u32 residue = 0;
+
+@@ -961,13 +963,23 @@ static u32 xilinx_dma_get_residue(struct xilinx_dma_chan *chan,
+ cdma_hw = &cdma_seg->hw;
+ residue += (cdma_hw->control - cdma_hw->status) &
+ chan->xdev->max_buffer_len;
+- } else {
++ } else if (chan->xdev->dma_config->dmatype ==
++ XDMA_TYPE_AXIDMA) {
+ axidma_seg = list_entry(entry,
+ struct xilinx_axidma_tx_segment,
+ node);
+ axidma_hw = &axidma_seg->hw;
+ residue += (axidma_hw->control - axidma_hw->status) &
+ chan->xdev->max_buffer_len;
++ } else {
++ aximcdma_seg =
++ list_entry(entry,
++ struct xilinx_aximcdma_tx_segment,
++ node);
++ aximcdma_hw = &aximcdma_seg->hw;
++ residue +=
++ (aximcdma_hw->control - aximcdma_hw->status) &
++ chan->xdev->max_buffer_len;
+ }
+ }
+
+@@ -1135,7 +1147,7 @@ static int xilinx_dma_alloc_chan_resources(struct dma_chan *dchan)
+ upper_32_bits(chan->seg_p + sizeof(*chan->seg_mv) *
+ ((i + 1) % XILINX_DMA_NUM_DESCS));
+ chan->seg_mv[i].phys = chan->seg_p +
+- sizeof(*chan->seg_v) * i;
++ sizeof(*chan->seg_mv) * i;
+ list_add_tail(&chan->seg_mv[i].node,
+ &chan->free_seg_list);
+ }
+@@ -1560,7 +1572,7 @@ static void xilinx_dma_start_transfer(struct xilinx_dma_chan *chan)
+ static void xilinx_mcdma_start_transfer(struct xilinx_dma_chan *chan)
+ {
+ struct xilinx_dma_tx_descriptor *head_desc, *tail_desc;
+- struct xilinx_axidma_tx_segment *tail_segment;
++ struct xilinx_aximcdma_tx_segment *tail_segment;
+ u32 reg;
+
+ /*
+@@ -1582,7 +1594,7 @@ static void xilinx_mcdma_start_transfer(struct xilinx_dma_chan *chan)
+ tail_desc = list_last_entry(&chan->pending_list,
+ struct xilinx_dma_tx_descriptor, node);
+ tail_segment = list_last_entry(&tail_desc->segments,
+- struct xilinx_axidma_tx_segment, node);
++ struct xilinx_aximcdma_tx_segment, node);
+
+ reg = dma_ctrl_read(chan, XILINX_MCDMA_CHAN_CR_OFFSET(chan->tdest));
+
+@@ -1864,6 +1876,7 @@ static void append_desc_queue(struct xilinx_dma_chan *chan,
+ struct xilinx_vdma_tx_segment *tail_segment;
+ struct xilinx_dma_tx_descriptor *tail_desc;
+ struct xilinx_axidma_tx_segment *axidma_tail_segment;
++ struct xilinx_aximcdma_tx_segment *aximcdma_tail_segment;
+ struct xilinx_cdma_tx_segment *cdma_tail_segment;
+
+ if (list_empty(&chan->pending_list))
+@@ -1885,11 +1898,17 @@ static void append_desc_queue(struct xilinx_dma_chan *chan,
+ struct xilinx_cdma_tx_segment,
+ node);
+ cdma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys;
+- } else {
++ } else if (chan->xdev->dma_config->dmatype == XDMA_TYPE_AXIDMA) {
+ axidma_tail_segment = list_last_entry(&tail_desc->segments,
+ struct xilinx_axidma_tx_segment,
+ node);
+ axidma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys;
++ } else {
++ aximcdma_tail_segment =
++ list_last_entry(&tail_desc->segments,
++ struct xilinx_aximcdma_tx_segment,
++ node);
++ aximcdma_tail_segment->hw.next_desc = (u32)desc->async_tx.phys;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From ff84b4ca993f16965a929401586ca16633227510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Oct 2020 19:17:47 +1100
+Subject: drm: bridge: dw-hdmi: Avoid resetting force in the detect function
+
+From: Jonathan Liu <net147@gmail.com>
+
+[ Upstream commit bc551d776b691022f49b5bb5379bd58f7c4eb76a ]
+
+It has been observed that resetting force in the detect function can
+result in the PHY being powered down in response to hot-plug detect
+being asserted, even when the HDMI connector is forced on.
+
+Enabling debug messages and adding a call to dump_stack() in
+dw_hdmi_phy_power_off() shows the following in dmesg:
+[ 160.637413] dwhdmi-rockchip ff940000.hdmi: EVENT=plugin
+[ 160.637433] dwhdmi-rockchip ff940000.hdmi: PHY powered down in 0 iterations
+
+Call trace:
+dw_hdmi_phy_power_off
+dw_hdmi_phy_disable
+dw_hdmi_update_power
+dw_hdmi_detect
+dw_hdmi_connector_detect
+drm_helper_probe_detect_ctx
+drm_helper_hpd_irq_event
+dw_hdmi_irq
+irq_thread_fn
+irq_thread
+kthread
+ret_from_fork
+
+Fixes: 381f05a7a842 ("drm: bridge/dw_hdmi: add connector mode forcing")
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201031081747.372599-1-net147@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index 748df1cacd2b7..0c79a9ba48bb6 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -2327,12 +2327,6 @@ static enum drm_connector_status dw_hdmi_detect(struct dw_hdmi *hdmi)
+ {
+ enum drm_connector_status result;
+
+- mutex_lock(&hdmi->mutex);
+- hdmi->force = DRM_FORCE_UNSPECIFIED;
+- dw_hdmi_update_power(hdmi);
+- dw_hdmi_update_phy_mask(hdmi);
+- mutex_unlock(&hdmi->mutex);
+-
+ result = hdmi->phy.ops->read_hpd(hdmi, hdmi->phy.data);
+
+ mutex_lock(&hdmi->mutex);
+--
+2.27.0
+
--- /dev/null
+From 66010159a606a4a3e6301dab6afb17c8b67a3cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 09:09:29 +0800
+Subject: drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
+
+From: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+
+[ Upstream commit 6654b57866b98230a270953dd34f67de17ab1708 ]
+
+Fix to return a negative error code from the error handling case instead
+of 0 in function sun8i_dw_hdmi_bind().
+
+Fixes: b7c7436a5ff0 ("drm/sun4i: Implement A83T HDMI driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/1605488969-5211-1-git-send-email-wangxiongfeng2@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+index d4c08043dd81d..92add2cef2e7d 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+@@ -208,6 +208,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
+ phy_node = of_parse_phandle(dev->of_node, "phys", 0);
+ if (!phy_node) {
+ dev_err(dev, "Can't found PHY phandle\n");
++ ret = -EINVAL;
+ goto err_disable_clk_tmds;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8c69b01dfc92bd40ca837c340351f5e91900662c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Oct 2020 17:28:27 +0200
+Subject: efi/arm: set HSCTLR Thumb2 bit correctly for HVC calls from HYP
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit fbc81ec5b85d43a4b22e49ec0e643fa7dec2ea40 ]
+
+Commit
+
+ db227c19e68db353 ("ARM: 8985/1: efi/decompressor: deal with HYP mode boot gracefully")
+
+updated the EFI entry code to permit firmware to invoke the EFI stub
+loader in HYP mode, with the MMU either enabled or disabled, neither
+of which is permitted by the EFI spec, but which does happen in the
+field.
+
+In the MMU on case, we remain in HYP mode as configured by the firmware,
+and rely on the fact that any HVC instruction issued in this mode will
+be dispatched via the SVC slot in the HYP vector table. However, this
+slot will point to a Thumb2 symbol if the kernel is built in Thumb2
+mode, and so we have to configure HSCTLR to ensure that the exception
+handlers are invoked in Thumb2 mode as well.
+
+Fixes: db227c19e68db353 ("ARM: 8985/1: efi/decompressor: deal with HYP mode boot gracefully")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/head.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 434a16982e344..19499d636bc88 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -1476,6 +1476,9 @@ ENTRY(efi_enter_kernel)
+ @ issued from HYP mode take us to the correct handler code. We
+ @ will disable the MMU before jumping to the kernel proper.
+ @
++ ARM( bic r1, r1, #(1 << 30) ) @ clear HSCTLR.TE
++ THUMB( orr r1, r1, #(1 << 30) ) @ set HSCTLR.TE
++ mcr p15, 4, r1, c1, c0, 0
+ adr r0, __hyp_reentry_vectors
+ mcr p15, 4, r0, c12, c0, 0 @ set HYP vector base (HVBAR)
+ isb
+--
+2.27.0
+
--- /dev/null
+From 3a5eedf54c083302ff55ae54cb4d69ec8288eedb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 11:39:19 -0500
+Subject: efi/x86: Free efi_pgd with free_pages()
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit c2fe61d8be491ff8188edaf22e838f819999146b ]
+
+Commit
+
+ d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
+
+changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in
+the error path it should be freed using free_pages() rather than
+free_page().
+
+Commit
+
+ 06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()")
+
+fixed one instance of this, but missed another.
+
+Move the freeing out-of-line to avoid code duplication and fix this bug.
+
+Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
+Link: https://lore.kernel.org/r/20201110163919.1134431-1-nivedita@alum.mit.edu
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi_64.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 6af4da1149bac..5ce50adb6fd0c 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -77,28 +77,30 @@ int __init efi_alloc_page_tables(void)
+ gfp_mask = GFP_KERNEL | __GFP_ZERO;
+ efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
+ if (!efi_pgd)
+- return -ENOMEM;
++ goto fail;
+
+ pgd = efi_pgd + pgd_index(EFI_VA_END);
+ p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END);
+- if (!p4d) {
+- free_page((unsigned long)efi_pgd);
+- return -ENOMEM;
+- }
++ if (!p4d)
++ goto free_pgd;
+
+ pud = pud_alloc(&init_mm, p4d, EFI_VA_END);
+- if (!pud) {
+- if (pgtable_l5_enabled())
+- free_page((unsigned long) pgd_page_vaddr(*pgd));
+- free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
+- return -ENOMEM;
+- }
++ if (!pud)
++ goto free_p4d;
+
+ efi_mm.pgd = efi_pgd;
+ mm_init_cpumask(&efi_mm);
+ init_new_context(NULL, &efi_mm);
+
+ return 0;
++
++free_p4d:
++ if (pgtable_l5_enabled())
++ free_page((unsigned long)pgd_page_vaddr(*pgd));
++free_pgd:
++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
++fail:
++ return -ENOMEM;
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From aa9f02869d4b43ff33f51d7e65da20cdfa028eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 22:49:31 +0900
+Subject: fail_function: Remove a redundant mutex unlock
+
+From: Luo Meng <luomeng12@huawei.com>
+
+[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ]
+
+Fix a mutex_unlock() issue where before copy_from_user() is
+not called mutex_locked.
+
+Fixes: 4b1a29a7f542 ("error-injection: Support fault injection framework")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Luo Meng <luomeng12@huawei.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/fail_function.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/fail_function.c b/kernel/fail_function.c
+index 63b349168da72..b0b1ad93fa957 100644
+--- a/kernel/fail_function.c
++++ b/kernel/fail_function.c
+@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+
+ if (copy_from_user(buf, buffer, count)) {
+ ret = -EFAULT;
+- goto out;
++ goto out_free;
+ }
+ buf[count] = '\0';
+ sym = strstrip(buf);
+@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
+ ret = count;
+ }
+ out:
+- kfree(buf);
+ mutex_unlock(&fei_lock);
++out_free:
++ kfree(buf);
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7a9ec483ca173d4baebfcd6b9e73197dc796751b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 22:20:56 +0100
+Subject: HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit b4c00e7976636f33a4f67eab436a11666c8afd60 ]
+
+Some users are pairing the Dinovo keyboards with the MX5000 or MX5500
+receivers, instead of with the Dinovo receivers. The receivers are
+mostly the same (and the air protocol obviously is compatible) but
+currently the Dinovo receivers are handled by hid-lg.c while the
+MX5x00 receivers are handled by logitech-dj.c.
+
+When using a Dinovo keyboard, with its builtin touchpad, through
+logitech-dj.c then the touchpad stops working because when asking the
+receiver for paired devices, we get only 1 paired device with
+a device_type of REPORT_TYPE_KEYBOARD. And since we don't see a paired
+mouse, we have nowhere to send mouse-events to, so we drop them.
+
+Extend the existing fix for the Dinovo Edge for this to also cover the
+Dinovo Mini keyboard and also add a mapping to logitech-hidpp for the
+Media key on the Dinovo Mini, so that that keeps working too.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
+Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 1 +
+ drivers/hid/hid-logitech-hidpp.c | 25 +++++++++++++++++++++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 1cafb65428b04..389f953c1f12c 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -875,6 +875,7 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
+ */
+ static const u16 kbd_builtin_touchpad_ids[] = {
+ 0xb309, /* Dinovo Edge */
++ 0xb30c, /* Dinovo Mini */
+ };
+
+ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index 730036650f7df..a2991622702ae 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -93,6 +93,8 @@ MODULE_PARM_DESC(disable_tap_to_click,
+ #define HIDPP_CAPABILITY_BATTERY_LEVEL_STATUS BIT(3)
+ #define HIDPP_CAPABILITY_BATTERY_VOLTAGE BIT(4)
+
++#define lg_map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
++
+ /*
+ * There are two hidpp protocols in use, the first version hidpp10 is known
+ * as register access protocol or RAP, the second version hidpp20 is known as
+@@ -2950,6 +2952,26 @@ static int g920_get_config(struct hidpp_device *hidpp,
+ return g920_ff_set_autocenter(hidpp, data);
+ }
+
++/* -------------------------------------------------------------------------- */
++/* Logitech Dinovo Mini keyboard with builtin touchpad */
++/* -------------------------------------------------------------------------- */
++#define DINOVO_MINI_PRODUCT_ID 0xb30c
++
++static int lg_dinovo_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
++ return 0;
++
++ switch (usage->hid & HID_USAGE) {
++ case 0x00d: lg_map_key_clear(KEY_MEDIA); break;
++ default:
++ return 0;
++ }
++ return 1;
++}
++
+ /* -------------------------------------------------------------------------- */
+ /* HID++1.0 devices which use HID++ reports for their wheels */
+ /* -------------------------------------------------------------------------- */
+@@ -3185,6 +3207,9 @@ static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ field->application != HID_GD_MOUSE)
+ return m560_input_mapping(hdev, hi, field, usage, bit, max);
+
++ if (hdev->product == DINOVO_MINI_PRODUCT_ID)
++ return lg_dinovo_input_mapping(hdev, hi, field, usage, bit, max);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8ef2ca5fb27caf4bdb8d3ed82bb5831a4d540a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 14:36:56 +0100
+Subject: HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin
+ trackpad
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit ee5e58418a854755201eb4952b1230d873a457d5 ]
+
+Some quad/bluetooth keyboards, such as the Dinovo Edge (Y-RAY81) have a
+builtin touchpad. In this case when asking the receiver for paired devices,
+we get only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD.
+
+This means that we do not instantiate a second dj_hiddev for the mouse
+(as we normally would) and thus there is no place for us to forward the
+mouse input reports to, causing the touchpad part of the keyboard to not
+work.
+
+There is no way for us to detect these keyboards, so this commit adds
+an array with device-ids for such keyboards and when a keyboard is on
+this list it adds STD_MOUSE to the reports_supported bitmap for the
+dj_hiddev created for the keyboard fixing the touchpad not working.
+
+Using a list of device-ids for this is not ideal, but there are only
+very few such keyboards so this should be fine. Besides the Dinovo Edge,
+other known wireless Logitech keyboards with a builtin touchpad are:
+
+* Dinovo Mini (TODO add its device-id to the list)
+* K400 (uses a unifying receiver so is not affected)
+* K600 (uses a unifying receiver so is not affected)
+
+Cc: stable@vger.kernel.org
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
+Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-dj.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 38ee25a813b9e..1cafb65428b04 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -866,11 +866,23 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
+ schedule_work(&djrcv_dev->work);
+ }
+
++/*
++ * Some quad/bluetooth keyboards have a builtin touchpad in this case we see
++ * only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. For the
++ * touchpad to work we must also forward mouse input reports to the dj_hiddev
++ * created for the keyboard (instead of forwarding them to a second paired
++ * device with a device_type of REPORT_TYPE_MOUSE as we normally would).
++ */
++static const u16 kbd_builtin_touchpad_ids[] = {
++ 0xb309, /* Dinovo Edge */
++};
++
+ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+ struct hidpp_event *hidpp_report,
+ struct dj_workitem *workitem)
+ {
+ struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
++ int i, id;
+
+ workitem->type = WORKITEM_TYPE_PAIRED;
+ workitem->device_type = hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] &
+@@ -882,6 +894,13 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
+ workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA |
+ POWER_KEYS | MEDIA_CENTER |
+ HIDPP;
++ id = (workitem->quad_id_msb << 8) | workitem->quad_id_lsb;
++ for (i = 0; i < ARRAY_SIZE(kbd_builtin_touchpad_ids); i++) {
++ if (id == kbd_builtin_touchpad_ids[i]) {
++ workitem->reports_supported |= STD_MOUSE;
++ break;
++ }
++ }
+ break;
+ case REPORT_TYPE_MOUSE:
+ workitem->reports_supported |= STD_MOUSE | HIDPP;
+--
+2.27.0
+
--- /dev/null
+From 668fe9f23c9f4f26b2f174f6beb7c89fdfd1e593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 06:56:12 -0700
+Subject: HID: logitech-hidpp: Add PID for MX Anywhere 2
+
+From: Harry Cutts <hcutts@chromium.org>
+
+[ Upstream commit b59f38dbfd5d19eb7e03d8b639f0c0d385ba8cc5 ]
+
+It seems that the PID 0x4072 was missing from the list Logitech gave me
+for this mouse, as I found one with it in the wild (with which I tested
+this patch).
+
+Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice")
+Signed-off-by: Harry Cutts <hcutts@chromium.org>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index b8b53dc95e86b..730036650f7df 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3947,6 +3947,7 @@ static const struct hid_device_id hidpp_devices[] = {
+ LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { /* Mouse Logitech MX Anywhere 2 */
+ LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
++ { LDJ_DEVICE(0x4072), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+ { LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+--
+2.27.0
+
--- /dev/null
+From f777e8428dc6cb7a4655504fa73f4dd5d76d64e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 23:02:23 +0100
+Subject: HID: mcp2221: Fix GPIO output handling
+
+From: Lars Povlsen <lars.povlsen@microchip.com>
+
+[ Upstream commit 567b8e9fed8add9e20885be38ecd73bb0e07406b ]
+
+The mcp2221 driver GPIO output handling has has several issues.
+
+* A wrong value is used for the GPIO direction.
+
+* Wrong offsets are calculated for some GPIO set value/set direction
+ operations, when offset is larger than 0.
+
+This has been fixed by introducing proper manifest constants for the
+direction encoding, and using 'offsetof' when calculating GPIO
+register offsets.
+
+The updated driver has been tested with the Sparx5 pcb134/pcb135
+board, which has the mcp2221 device with several (output) GPIO's.
+
+Fixes: 328de1c519c5c092 ("HID: mcp2221: add GPIO functionality support")
+Reviewed-by: Rishi Gupta <gupt21@gmail.com>
+Signed-off-by: Lars Povlsen <lars.povlsen@microchip.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-mcp2221.c | 48 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 39 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
+index 0d27ccb55dd93..4211b9839209b 100644
+--- a/drivers/hid/hid-mcp2221.c
++++ b/drivers/hid/hid-mcp2221.c
+@@ -49,6 +49,36 @@ enum {
+ MCP2221_ALT_F_NOT_GPIOD = 0xEF,
+ };
+
++/* MCP GPIO direction encoding */
++enum {
++ MCP2221_DIR_OUT = 0x00,
++ MCP2221_DIR_IN = 0x01,
++};
++
++#define MCP_NGPIO 4
++
++/* MCP GPIO set command layout */
++struct mcp_set_gpio {
++ u8 cmd;
++ u8 dummy;
++ struct {
++ u8 change_value;
++ u8 value;
++ u8 change_direction;
++ u8 direction;
++ } gpio[MCP_NGPIO];
++} __packed;
++
++/* MCP GPIO get command layout */
++struct mcp_get_gpio {
++ u8 cmd;
++ u8 dummy;
++ struct {
++ u8 direction;
++ u8 value;
++ } gpio[MCP_NGPIO];
++} __packed;
++
+ /*
+ * There is no way to distinguish responses. Therefore next command
+ * is sent only after response to previous has been received. Mutex
+@@ -542,7 +572,7 @@ static int mcp_gpio_get(struct gpio_chip *gc,
+
+ mcp->txbuf[0] = MCP2221_GPIO_GET;
+
+- mcp->gp_idx = (offset + 1) * 2;
++ mcp->gp_idx = offsetof(struct mcp_get_gpio, gpio[offset].value);
+
+ mutex_lock(&mcp->lock);
+ ret = mcp_send_data_req_status(mcp, mcp->txbuf, 1);
+@@ -559,7 +589,7 @@ static void mcp_gpio_set(struct gpio_chip *gc,
+ memset(mcp->txbuf, 0, 18);
+ mcp->txbuf[0] = MCP2221_GPIO_SET;
+
+- mcp->gp_idx = ((offset + 1) * 4) - 1;
++ mcp->gp_idx = offsetof(struct mcp_set_gpio, gpio[offset].value);
+
+ mcp->txbuf[mcp->gp_idx - 1] = 1;
+ mcp->txbuf[mcp->gp_idx] = !!value;
+@@ -575,7 +605,7 @@ static int mcp_gpio_dir_set(struct mcp2221 *mcp,
+ memset(mcp->txbuf, 0, 18);
+ mcp->txbuf[0] = MCP2221_GPIO_SET;
+
+- mcp->gp_idx = (offset + 1) * 5;
++ mcp->gp_idx = offsetof(struct mcp_set_gpio, gpio[offset].direction);
+
+ mcp->txbuf[mcp->gp_idx - 1] = 1;
+ mcp->txbuf[mcp->gp_idx] = val;
+@@ -590,7 +620,7 @@ static int mcp_gpio_direction_input(struct gpio_chip *gc,
+ struct mcp2221 *mcp = gpiochip_get_data(gc);
+
+ mutex_lock(&mcp->lock);
+- ret = mcp_gpio_dir_set(mcp, offset, 0);
++ ret = mcp_gpio_dir_set(mcp, offset, MCP2221_DIR_IN);
+ mutex_unlock(&mcp->lock);
+
+ return ret;
+@@ -603,7 +633,7 @@ static int mcp_gpio_direction_output(struct gpio_chip *gc,
+ struct mcp2221 *mcp = gpiochip_get_data(gc);
+
+ mutex_lock(&mcp->lock);
+- ret = mcp_gpio_dir_set(mcp, offset, 1);
++ ret = mcp_gpio_dir_set(mcp, offset, MCP2221_DIR_OUT);
+ mutex_unlock(&mcp->lock);
+
+ /* Can't configure as output, bailout early */
+@@ -623,7 +653,7 @@ static int mcp_gpio_get_direction(struct gpio_chip *gc,
+
+ mcp->txbuf[0] = MCP2221_GPIO_GET;
+
+- mcp->gp_idx = (offset + 1) * 2;
++ mcp->gp_idx = offsetof(struct mcp_get_gpio, gpio[offset].direction);
+
+ mutex_lock(&mcp->lock);
+ ret = mcp_send_data_req_status(mcp, mcp->txbuf, 1);
+@@ -632,7 +662,7 @@ static int mcp_gpio_get_direction(struct gpio_chip *gc,
+ if (ret)
+ return ret;
+
+- if (mcp->gpio_dir)
++ if (mcp->gpio_dir == MCP2221_DIR_IN)
+ return GPIO_LINE_DIRECTION_IN;
+
+ return GPIO_LINE_DIRECTION_OUT;
+@@ -758,7 +788,7 @@ static int mcp2221_raw_event(struct hid_device *hdev,
+ mcp->status = -ENOENT;
+ } else {
+ mcp->status = !!data[mcp->gp_idx];
+- mcp->gpio_dir = !!data[mcp->gp_idx + 1];
++ mcp->gpio_dir = data[mcp->gp_idx + 1];
+ }
+ break;
+ default:
+@@ -860,7 +890,7 @@ static int mcp2221_probe(struct hid_device *hdev,
+ mcp->gc->get_direction = mcp_gpio_get_direction;
+ mcp->gc->set = mcp_gpio_set;
+ mcp->gc->get = mcp_gpio_get;
+- mcp->gc->ngpio = 4;
++ mcp->gc->ngpio = MCP_NGPIO;
+ mcp->gc->base = -1;
+ mcp->gc->can_sleep = 1;
+ mcp->gc->parent = &hdev->dev;
+--
+2.27.0
+
--- /dev/null
+From 0f72d90ecb671a249a7535f5a8499aad3e0162af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 14:42:27 +0800
+Subject: IB/hfi1: Fix error return code in hfi1_init_dd()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit dabbd6abcdbeb1358a53ec28a244429320eb0e3a ]
+
+Fix to return a negative error code from the error handling case instead
+of 0, as done elsewhere in this function.
+
+Fixes: 4730f4a6c6b2 ("IB/hfi1: Activate the dummy netdev")
+Link: https://lore.kernel.org/r/1605249747-17942-1-git-send-email-zhangchangzhong@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Acked-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 7eaf995382168..c87b94ea29397 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -15245,7 +15245,8 @@ int hfi1_init_dd(struct hfi1_devdata *dd)
+ & CCE_REVISION_SW_MASK);
+
+ /* alloc netdev data */
+- if (hfi1_netdev_alloc(dd))
++ ret = hfi1_netdev_alloc(dd);
++ if (ret)
+ goto bail_cleanup;
+
+ ret = set_up_context_variables(dd);
+--
+2.27.0
+
--- /dev/null
+From 961e934c29002c6766cff2ba0499e664a68e8b81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:09 -0700
+Subject: Input: adxl34x - clean up a data type in adxl34x_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]
+
+The "revid" is used to store negative error codes so it should be an int
+type.
+
+Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/adxl34x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
+index 5fe92d4ba3f0c..4cc4e8ff42b33 100644
+--- a/drivers/input/misc/adxl34x.c
++++ b/drivers/input/misc/adxl34x.c
+@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
+ struct input_dev *input_dev;
+ const struct adxl34x_platform_data *pdata;
+ int err, range, i;
+- unsigned char revid;
++ int revid;
+
+ if (!irq) {
+ dev_err(dev, "no IRQ?\n");
+--
+2.27.0
+
--- /dev/null
+From cacf45da5059bad3faf5e47084395f0b875792f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 20:06:24 -0800
+Subject: Input: elan_i2c - fix firmware update on newer ICs
+
+From: jingle.wu <jingle.wu@emc.com.tw>
+
+[ Upstream commit ae3d6083acf60116d4f409677452399547ed2009 ]
+
+The argument to iap page type command depends on the firmware page size.
+
+Fixes: bfd9b92bc8f9 ("Input: elan_i2c - handle firmware updated on newer ICs")
+Signed-off-by: Jingle Wu <jingle.wu@emc.com.tw>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/elan_i2c.h | 2 +-
+ drivers/input/mouse/elan_i2c_core.c | 3 ++-
+ drivers/input/mouse/elan_i2c_i2c.c | 10 +++++-----
+ drivers/input/mouse/elan_i2c_smbus.c | 2 +-
+ 4 files changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h
+index c75b00c45d750..36e3cd9086716 100644
+--- a/drivers/input/mouse/elan_i2c.h
++++ b/drivers/input/mouse/elan_i2c.h
+@@ -78,7 +78,7 @@ struct elan_transport_ops {
+ int (*iap_reset)(struct i2c_client *client);
+
+ int (*prepare_fw_update)(struct i2c_client *client, u16 ic_type,
+- u8 iap_version);
++ u8 iap_version, u16 fw_page_size);
+ int (*write_fw_block)(struct i2c_client *client, u16 fw_page_size,
+ const u8 *page, u16 checksum, int idx);
+ int (*finish_fw_update)(struct i2c_client *client,
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index c599e21a84784..61ed3f5ca2199 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -497,7 +497,8 @@ static int __elan_update_firmware(struct elan_tp_data *data,
+ u16 sw_checksum = 0, fw_checksum = 0;
+
+ error = data->ops->prepare_fw_update(client, data->ic_type,
+- data->iap_version);
++ data->iap_version,
++ data->fw_page_size);
+ if (error)
+ return error;
+
+diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
+index 5a496d4ffa491..13dc097eb6c65 100644
+--- a/drivers/input/mouse/elan_i2c_i2c.c
++++ b/drivers/input/mouse/elan_i2c_i2c.c
+@@ -517,7 +517,7 @@ static int elan_i2c_set_flash_key(struct i2c_client *client)
+ return 0;
+ }
+
+-static int elan_read_write_iap_type(struct i2c_client *client)
++static int elan_read_write_iap_type(struct i2c_client *client, u16 fw_page_size)
+ {
+ int error;
+ u16 constant;
+@@ -526,7 +526,7 @@ static int elan_read_write_iap_type(struct i2c_client *client)
+
+ do {
+ error = elan_i2c_write_cmd(client, ETP_I2C_IAP_TYPE_CMD,
+- ETP_I2C_IAP_TYPE_REG);
++ fw_page_size / 2);
+ if (error) {
+ dev_err(&client->dev,
+ "cannot write iap type: %d\n", error);
+@@ -543,7 +543,7 @@ static int elan_read_write_iap_type(struct i2c_client *client)
+ constant = le16_to_cpup((__le16 *)val);
+ dev_dbg(&client->dev, "iap type reg: 0x%04x\n", constant);
+
+- if (constant == ETP_I2C_IAP_TYPE_REG)
++ if (constant == fw_page_size / 2)
+ return 0;
+
+ } while (--retry > 0);
+@@ -553,7 +553,7 @@ static int elan_read_write_iap_type(struct i2c_client *client)
+ }
+
+ static int elan_i2c_prepare_fw_update(struct i2c_client *client, u16 ic_type,
+- u8 iap_version)
++ u8 iap_version, u16 fw_page_size)
+ {
+ struct device *dev = &client->dev;
+ int error;
+@@ -594,7 +594,7 @@ static int elan_i2c_prepare_fw_update(struct i2c_client *client, u16 ic_type,
+ }
+
+ if (ic_type >= 0x0D && iap_version >= 1) {
+- error = elan_read_write_iap_type(client);
++ error = elan_read_write_iap_type(client, fw_page_size);
+ if (error)
+ return error;
+ }
+diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
+index 8ff823751f3ba..1820f1cfc1dc4 100644
+--- a/drivers/input/mouse/elan_i2c_smbus.c
++++ b/drivers/input/mouse/elan_i2c_smbus.c
+@@ -340,7 +340,7 @@ static int elan_smbus_set_flash_key(struct i2c_client *client)
+ }
+
+ static int elan_smbus_prepare_fw_update(struct i2c_client *client, u16 ic_type,
+- u8 iap_version)
++ u8 iap_version, u16 fw_page_size)
+ {
+ struct device *dev = &client->dev;
+ int len;
+--
+2.27.0
+
--- /dev/null
+From eb518f5719574c2406358a270f46352f7ef091e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 17:48:52 -0800
+Subject: Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
+
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+
+[ Upstream commit 676650d007e06fddcf3fe38238251d71bd179641 ]
+
+When TOUCHSCREEN_ADC is enabled and IIO_BUFFER is disabled, it results
+in the following Kbuild warning:
+
+WARNING: unmet direct dependencies detected for IIO_BUFFER_CB
+ Depends on [n]: IIO [=y] && IIO_BUFFER [=n]
+ Selected by [y]:
+ - TOUCHSCREEN_ADC [=y] && !UML && INPUT [=y] && INPUT_TOUCHSCREEN [=y] && IIO [=y]
+
+The reason is that TOUCHSCREEN_ADC selects IIO_BUFFER_CB without depending
+on or selecting IIO_BUFFER while IIO_BUFFER_CB depends on IIO_BUFFER. This
+can also fail building the kernel.
+
+Honor the kconfig dependency to remove unmet direct dependency warnings
+and avoid any potential build failures.
+
+Fixes: aa132ffb6b0a ("input: touchscreen: resistive-adc-touch: add generic resistive ADC touchscreen")
+Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Link: https://lore.kernel.org/r/20201102221504.541279-1-fazilyildiran@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
+index 35c867b2d9a77..e6e043388a972 100644
+--- a/drivers/input/touchscreen/Kconfig
++++ b/drivers/input/touchscreen/Kconfig
+@@ -96,6 +96,7 @@ config TOUCHSCREEN_AD7879_SPI
+ config TOUCHSCREEN_ADC
+ tristate "Generic ADC based resistive touchscreen"
+ depends on IIO
++ select IIO_BUFFER
+ select IIO_BUFFER_CB
+ help
+ Say Y here if you want to use the generic ADC
+--
+2.27.0
+
--- /dev/null
+From f2fd1a6a762f19669251ce83c3320e87bbdbf894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 15:19:08 +0800
+Subject: iommu/vt-d: Avoid panic if iommu init fails in tboot system
+
+From: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+
+[ Upstream commit 4d213e76a359e540ca786ee937da7f35faa8e5f8 ]
+
+"intel_iommu=off" command line is used to disable iommu but iommu is force
+enabled in a tboot system for security reason.
+
+However for better performance on high speed network device, a new option
+"intel_iommu=tboot_noforce" is introduced to disable the force on.
+
+By default kernel should panic if iommu init fail in tboot for security
+reason, but it's unnecessory if we use "intel_iommu=tboot_noforce,off".
+
+Fix the code setting force_on and move intel_iommu_tboot_noforce
+from tboot code to intel iommu code.
+
+Fixes: 7304e8f28bb2 ("iommu/vt-d: Correctly disable Intel IOMMU force on")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
+Tested-by: Lukasz Hawrylko <lukasz.hawrylko@linux.intel.com>
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20201110071908.3133-1-zhenzhong.duan@gmail.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tboot.c | 3 ---
+ drivers/iommu/intel/iommu.c | 5 +++--
+ include/linux/intel-iommu.h | 1 -
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
+index 992fb1415c0f1..420be871d9d45 100644
+--- a/arch/x86/kernel/tboot.c
++++ b/arch/x86/kernel/tboot.c
+@@ -514,9 +514,6 @@ int tboot_force_iommu(void)
+ if (!tboot_enabled())
+ return 0;
+
+- if (intel_iommu_tboot_noforce)
+- return 1;
+-
+ if (no_iommu || swiotlb || dmar_disabled)
+ pr_warn("Forcing Intel-IOMMU to enabled\n");
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index e58be1fe7585e..f67b7e6ddf1bc 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -179,7 +179,7 @@ static int rwbf_quirk;
+ * (used when kernel is launched w/ TXT)
+ */
+ static int force_on = 0;
+-int intel_iommu_tboot_noforce;
++static int intel_iommu_tboot_noforce;
+ static int no_platform_optin;
+
+ #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
+@@ -4846,7 +4846,8 @@ int __init intel_iommu_init(void)
+ * Intel IOMMU is required for a TXT/tboot launch or platform
+ * opt in, so enforce that.
+ */
+- force_on = tboot_force_iommu() || platform_optin_force_iommu();
++ force_on = (!intel_iommu_tboot_noforce && tboot_force_iommu()) ||
++ platform_optin_force_iommu();
+
+ if (iommu_init_mempool()) {
+ if (force_on)
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index 6a3ddaabf3f50..bdf80d7a70fb3 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -791,7 +791,6 @@ extern int iommu_calculate_agaw(struct intel_iommu *iommu);
+ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
+ extern int dmar_disabled;
+ extern int intel_iommu_enabled;
+-extern int intel_iommu_tboot_noforce;
+ extern int intel_iommu_gfx_mapped;
+ #else
+ static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
+--
+2.27.0
+
--- /dev/null
+From bcc1af5edf8bf3d8c9870c2267dc44c791545d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Aug 2020 19:12:11 +0300
+Subject: iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c7eb900f5f45eeab1ea1bed997a2a12d8b5907bc ]
+
+Static analyzer is not happy about intel_iommu_gfx_mapped declaration:
+
+.../drivers/iommu/intel/iommu.c:364:5: warning: symbol 'intel_iommu_gfx_mapped' was not declared. Should it be static?
+
+Move its declaration to Intel IOMMU header file.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20200828161212.71294-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/intel-gtt.h | 5 +----
+ include/linux/intel-iommu.h | 1 +
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/include/drm/intel-gtt.h b/include/drm/intel-gtt.h
+index 71d81923e6b06..abfefaaf897a0 100644
+--- a/include/drm/intel-gtt.h
++++ b/include/drm/intel-gtt.h
+@@ -5,6 +5,7 @@
+ #define _DRM_INTEL_GTT_H
+
+ #include <linux/agp_backend.h>
++#include <linux/intel-iommu.h>
+ #include <linux/kernel.h>
+
+ void intel_gtt_get(u64 *gtt_total,
+@@ -33,8 +34,4 @@ void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries);
+ /* flag for GFDT type */
+ #define AGP_USER_CACHED_MEMORY_GFDT (1 << 3)
+
+-#ifdef CONFIG_INTEL_IOMMU
+-extern int intel_iommu_gfx_mapped;
+-#endif
+-
+ #endif
+diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
+index b1ed2f25f7c0d..6a3ddaabf3f50 100644
+--- a/include/linux/intel-iommu.h
++++ b/include/linux/intel-iommu.h
+@@ -792,6 +792,7 @@ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
+ extern int dmar_disabled;
+ extern int intel_iommu_enabled;
+ extern int intel_iommu_tboot_noforce;
++extern int intel_iommu_gfx_mapped;
+ #else
+ static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
+ {
+--
+2.27.0
+
--- /dev/null
+From 7e414dc6c2e30a4a2aa774793cba015a3c2ce4b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 16:16:40 -0800
+Subject: ip_tunnels: Set tunnel option flag when tunnel metadata is present
+
+From: Yi-Hung Wei <yihung.wei@gmail.com>
+
+[ Upstream commit 9c2e14b48119b39446031d29d994044ae958d8fc ]
+
+Currently, we may set the tunnel option flag when the size of metadata
+is zero. For example, we set TUNNEL_GENEVE_OPT in the receive function
+no matter the geneve option is present or not. As this may result in
+issues on the tunnel flags consumers, this patch fixes the issue.
+
+Related discussion:
+* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u
+
+Fixes: 256c87c17c53 ("net: check tunnel option type in tunnel flags")
+Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
+Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 3 +--
+ include/net/ip_tunnels.h | 7 ++++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 974a244f45ba0..67c86ebfa7da2 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -225,8 +225,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ if (ip_tunnel_collect_metadata() || gs->collect_md) {
+ __be16 flags;
+
+- flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT |
+- (gnvh->oam ? TUNNEL_OAM : 0) |
++ flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) |
+ (gnvh->critical ? TUNNEL_CRIT_OPT : 0);
+
+ tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags,
+diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
+index 02ccd32542d0a..61620677b0347 100644
+--- a/include/net/ip_tunnels.h
++++ b/include/net/ip_tunnels.h
+@@ -478,9 +478,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ const void *from, int len,
+ __be16 flags)
+ {
+- memcpy(ip_tunnel_info_opts(info), from, len);
+ info->options_len = len;
+- info->key.tun_flags |= flags;
++ if (len > 0) {
++ memcpy(ip_tunnel_info_opts(info), from, len);
++ info->key.tun_flags |= flags;
++ }
+ }
+
+ static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate)
+@@ -526,7 +528,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
+ __be16 flags)
+ {
+ info->options_len = 0;
+- info->key.tun_flags |= flags;
+ }
+
+ #endif /* CONFIG_INET */
+--
+2.27.0
+
--- /dev/null
+From 4bb2dfc7ec18658462c665b7009849c8c1727767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 15:24:40 -0800
+Subject: kunit: tool: unmark test_data as binary blobs
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit c335b4f1f65012713832d988ec06512c7bda5c04 ]
+
+The tools/testing/kunit/test_data/ directory was marked as binary
+because some of the test_data files cause checkpatch warnings. Fix this
+by dropping the .gitattributes file.
+
+Fixes: afc63da64f1e ("kunit: kunit_parser: make parser more robust")
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/kunit/.gitattributes | 1 -
+ 1 file changed, 1 deletion(-)
+ delete mode 100644 tools/testing/kunit/.gitattributes
+
+diff --git a/tools/testing/kunit/.gitattributes b/tools/testing/kunit/.gitattributes
+deleted file mode 100644
+index 5b7da1fc3b8f1..0000000000000
+--- a/tools/testing/kunit/.gitattributes
++++ /dev/null
+@@ -1 +0,0 @@
+-test_data/* binary
+--
+2.27.0
+
--- /dev/null
+From 1da4ee1acefea5461f3a2ec362ac774e273a180f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 12:05:45 -0800
+Subject: lib/strncpy_from_user.c: Mask out bytes after NUL terminator.
+
+From: Daniel Xu <dxu@dxuuu.xyz>
+
+[ Upstream commit 6fa6d28051e9fcaa1570e69648ea13a353a5d218 ]
+
+do_strncpy_from_user() may copy some extra bytes after the NUL
+terminator into the destination buffer. This usually does not matter for
+normal string operations. However, when BPF programs key BPF maps with
+strings, this matters a lot.
+
+A BPF program may read strings from user memory by calling the
+bpf_probe_read_user_str() helper which eventually calls
+do_strncpy_from_user(). The program can then key a map with the
+destination buffer. BPF map keys are fixed-width and string-agnostic,
+meaning that map keys are treated as a set of bytes.
+
+The issue is when do_strncpy_from_user() overcopies bytes after the NUL
+terminator, it can result in seemingly identical strings occupying
+multiple slots in a BPF map. This behavior is subtle and totally
+unexpected by the user.
+
+This commit masks out the bytes following the NUL while preserving
+long-sized stride in the fast path.
+
+Fixes: 6ae08ae3dea2 ("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers")
+Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/21efc982b3e9f2f7b0379eed642294caaa0c27a7.1605642949.git.dxu@dxuuu.xyz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 10 ++++++++++
+ lib/strncpy_from_user.c | 19 +++++++++++++++++--
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index a8d4f253ed778..f236927ed2110 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -173,6 +173,16 @@ bpf_probe_read_user_str_common(void *dst, u32 size,
+ {
+ int ret;
+
++ /*
++ * NB: We rely on strncpy_from_user() not copying junk past the NUL
++ * terminator into `dst`.
++ *
++ * strncpy_from_user() does long-sized strides in the fast path. If the
++ * strncpy does not mask out the bytes after the NUL in `unsafe_ptr`,
++ * then there could be junk after the NUL in `dst`. If user takes `dst`
++ * and keys a hash map with it, then semantically identical strings can
++ * occupy multiple entries in the map.
++ */
+ ret = strncpy_from_user_nofault(dst, unsafe_ptr, size);
+ if (unlikely(ret < 0))
+ memset(dst, 0, size);
+diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
+index 34696a348864f..2eaed320a4db7 100644
+--- a/lib/strncpy_from_user.c
++++ b/lib/strncpy_from_user.c
+@@ -34,17 +34,32 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src,
+ goto byte_at_a_time;
+
+ while (max >= sizeof(unsigned long)) {
+- unsigned long c, data;
++ unsigned long c, data, mask;
+
+ /* Fall back to byte-at-a-time if we get a page fault */
+ unsafe_get_user(c, (unsigned long __user *)(src+res), byte_at_a_time);
+
+- *(unsigned long *)(dst+res) = c;
++ /*
++ * Note that we mask out the bytes following the NUL. This is
++ * important to do because string oblivious code may read past
++ * the NUL. For those routines, we don't want to give them
++ * potentially random bytes after the NUL in `src`.
++ *
++ * One example of such code is BPF map keys. BPF treats map keys
++ * as an opaque set of bytes. Without the post-NUL mask, any BPF
++ * maps keyed by strings returned from strncpy_from_user() may
++ * have multiple entries for semantically identical strings.
++ */
+ if (has_zero(c, &data, &constants)) {
+ data = prep_zero_mask(c, data, &constants);
+ data = create_zero_mask(data);
++ mask = zero_bytemask(data);
++ *(unsigned long *)(dst+res) = c & mask;
+ return res + find_zero(data);
+ }
++
++ *(unsigned long *)(dst+res) = c;
++
+ res += sizeof(unsigned long);
+ max -= sizeof(unsigned long);
+ }
+--
+2.27.0
+
--- /dev/null
+From 68ecced425590b8cfeeb1793aa529ca4c31c263f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 22:13:50 +0100
+Subject: libbpf: Fix VERSIONED_SYM_COUNT number parsing
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 1fd6cee127e2ddff36d648573d7566aafb0d0b77 ]
+
+We remove "other info" from "readelf -s --wide" output when
+parsing GLOBAL_SYM_COUNT variable, which was added in [1].
+But we don't do that for VERSIONED_SYM_COUNT and it's failing
+the check_abi target on powerpc Fedora 33.
+
+The extra "other info" wasn't problem for VERSIONED_SYM_COUNT
+parsing until commit [2] added awk in the pipe, which assumes
+that the last column is symbol, but it can be "other info".
+
+Adding "other info" removal for VERSIONED_SYM_COUNT the same
+way as we did for GLOBAL_SYM_COUNT parsing.
+
+[1] aa915931ac3e ("libbpf: Fix readelf output parsing for Fedora")
+[2] 746f534a4809 ("tools/libbpf: Avoid counting local symbols in ABI check")
+
+Fixes: 746f534a4809 ("tools/libbpf: Avoid counting local symbols in ABI check")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20201118211350.1493421-1-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
+index 9ae8f4ef0aac2..8bf2c406b0e05 100644
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -152,6 +152,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \
+ awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \
+ sort -u | wc -l)
+ VERSIONED_SYM_COUNT = $(shell readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \
++ sed 's/\[.*\]//' | \
+ awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \
+ grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | sort -u | wc -l)
+
+@@ -220,6 +221,7 @@ check_abi: $(OUTPUT)libbpf.so
+ awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \
+ sort -u > $(OUTPUT)libbpf_global_syms.tmp; \
+ readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \
++ sed 's/\[.*\]//' | \
+ awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \
+ grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | \
+ sort -u > $(OUTPUT)libbpf_versioned_syms.tmp; \
+--
+2.27.0
+
--- /dev/null
+From 5b21aa08eaf66be89d99850d76ab47838bc9b533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 22:17:19 -0800
+Subject: libfs: fix error cast of negative value in simple_attr_write()
+
+From: Yicong Yang <yangyicong@hisilicon.com>
+
+[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]
+
+The attr->set() receive a value of u64, but simple_strtoll() is used for
+doing the conversion. It will lead to the error cast if user inputs a
+negative value.
+
+Use kstrtoull() instead of simple_strtoll() to convert a string got from
+the user to an unsigned value. The former will return '-EINVAL' if it
+gets a negetive value, but the latter can't handle the situation
+correctly. Make 'val' unsigned long long as what kstrtoull() takes,
+this will eliminate the compile warning on no 64-bit architectures.
+
+Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
+Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/libfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/libfs.c b/fs/libfs.c
+index e0d42e977d9af..7bf691979a584 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -957,7 +957,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ size_t len, loff_t *ppos)
+ {
+ struct simple_attr *attr;
+- u64 val;
++ unsigned long long val;
+ size_t size;
+ ssize_t ret;
+
+@@ -975,7 +975,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
+ goto out;
+
+ attr->set_buf[size] = '\0';
+- val = simple_strtoll(attr->set_buf, NULL, 0);
++ ret = kstrtoull(attr->set_buf, 0, &val);
++ if (ret)
++ goto out;
+ ret = attr->set(attr->data, val);
+ if (ret == 0)
+ ret = len; /* on success, claim we got the whole input */
+--
+2.27.0
+
--- /dev/null
+From ea5572642598408cf0d7460df6c940247df7bb69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:18:56 +0800
+Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]
+
+If the clk_register fails, we should free h before
+function returns to prevent memleak.
+
+Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/alchemy/common/clock.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
+index a95a894aceaf1..f0c8303371047 100644
+--- a/arch/mips/alchemy/common/clock.c
++++ b/arch/mips/alchemy/common/clock.c
+@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ {
+ struct clk_init_data id;
+ struct clk_hw *h;
++ struct clk *clk;
+
+ h = kzalloc(sizeof(*h), GFP_KERNEL);
+ if (!h)
+@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
+ id.ops = &alchemy_clkops_cpu;
+ h->init = &id;
+
+- return clk_register(NULL, h);
++ clk = clk_register(NULL, h);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ kfree(h);
++ }
++
++ return clk;
+ }
+
+ /* AUXPLLs ************************************************************/
+--
+2.27.0
+
--- /dev/null
+From bbf94c8cabc7644f19bde069d669807f0c625139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Oct 2020 12:44:40 -0700
+Subject: MIPS: export has_transparent_hugepage() for modules
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ]
+
+MIPS should export its local version of "has_transparent_hugepage"
+so that loadable modules (dax) can use it.
+
+Fixes this build error:
+ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined!
+
+Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Cc: linux-mips@vger.kernel.org
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Dave Jiang <dave.jiang@intel.com>
+Cc: linux-nvdimm@lists.01.org
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlb-r4k.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 38e2894d5fa32..1b939abbe4caa 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -438,6 +438,7 @@ int has_transparent_hugepage(void)
+ }
+ return mask == PM_HUGE_MASK;
+ }
++EXPORT_SYMBOL(has_transparent_hugepage);
+
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+
+--
+2.27.0
+
--- /dev/null
+From 11ca803b93de36cc09c0c49fbea11ce2f497b5da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 11:35:52 +0200
+Subject: net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
+
+From: Eli Cohen <elic@nvidia.com>
+
+[ Upstream commit 5b8631c7b21ca8bc039f0bc030048973b039e0d2 ]
+
+Avoid calling mlx5_esw_modify_vport_rate() if qos is not enabled and
+avoid unnecessary syndrome messages from firmware.
+
+Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support")
+Signed-off-by: Eli Cohen <elic@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 5ad2308a2a6bd..d4ee0a9c03dbf 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1142,6 +1142,10 @@ int mlx5_esw_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num,
+ struct mlx5_vport *vport;
+
+ vport = mlx5_eswitch_get_vport(esw, vport_num);
++
++ if (!vport->qos.enabled)
++ return -EOPNOTSUPP;
++
+ MLX5_SET(scheduling_context, ctx, max_average_bw, rate_mbps);
+
+ return mlx5_modify_scheduling_element_cmd(esw->dev,
+--
+2.27.0
+
--- /dev/null
+From bec5543a7f7b47d4d4cba6d56e2b978d720c10f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:42:28 +0800
+Subject: perf lock: Correct field name "flags"
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit e24a87b54ef3e39261f1d859b7f78416349dfb14 ]
+
+The tracepoint "lock:lock_acquire" contains field "flags" but not
+"flag". Current code wrongly retrieves value from field "flag" and it
+always gets zero for the value, thus "perf lock" doesn't report the
+correct result.
+
+This patch replaces the field name "flag" with "flags", so can read out
+the correct flags for locking.
+
+Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20201104094229.17509-1-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index f0a1dbacb46c7..5cecc1ad78e1f 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -406,7 +406,7 @@ static int report_lock_acquire_event(struct evsel *evsel,
+ struct lock_seq_stat *seq;
+ const char *name = evsel__strval(evsel, sample, "name");
+ u64 tmp = evsel__intval(evsel, sample, "lockdep_addr");
+- int flag = evsel__intval(evsel, sample, "flag");
++ int flag = evsel__intval(evsel, sample, "flags");
+
+ memcpy(&addr, &tmp, sizeof(void *));
+
+--
+2.27.0
+
--- /dev/null
+From 574db974aacbf776ecdadcfef3a86c23cd3f7fda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 17:42:29 +0800
+Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero
+
+From: Leo Yan <leo.yan@linaro.org>
+
+[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]
+
+When execute command "perf lock report", it hits failure and outputs log
+as follows:
+
+ perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
+ Aborted
+
+This is an imbalance issue. The locking sequence structure
+"lock_seq_stat" contains the reader counter and it is used to check if
+the locking sequence is balance or not between acquiring and releasing.
+
+If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
+the "read_count" will be reset to zero when allocate a new structure at
+the next time; thus it causes the wrong counting for reader and finally
+results in imbalance issue.
+
+To fix this issue, if detects "read_count" is not zero (means still have
+read user in the locking sequence), goto the "end" tag to skip freeing
+structure "lock_seq_stat".
+
+Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-lock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
+index 5cecc1ad78e1f..a2f1e53f37a7a 100644
+--- a/tools/perf/builtin-lock.c
++++ b/tools/perf/builtin-lock.c
+@@ -621,7 +621,7 @@ static int report_lock_release_event(struct evsel *evsel,
+ case SEQ_STATE_READ_ACQUIRED:
+ seq->read_count--;
+ BUG_ON(seq->read_count < 0);
+- if (!seq->read_count) {
++ if (seq->read_count) {
+ ls->nr_release++;
+ goto end;
+ }
+--
+2.27.0
+
--- /dev/null
+From 140f39b7b50f14fcee9adb139c1529da59fa779e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 15:11:55 -0700
+Subject: rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit c583bcb8f5edd48c1798798e341f78afb9bf4f6f ]
+
+The try_invoke_on_locked_down_task() function requires that
+interrupts be enabled, but it is called with interrupts disabled from
+rcu_print_task_stall(), resulting in an "IRQs not enabled as expected"
+diagnostic. This commit therefore updates rcu_print_task_stall()
+to accumulate a list of the first few tasks while holding the current
+leaf rcu_node structure's ->lock, then releases that lock and only then
+uses try_invoke_on_locked_down_task() to attempt to obtain per-task
+detailed information. Of course, as soon as ->lock is released, the
+task might exit, so the get_task_struct() function is used to prevent
+the task structure from going away in the meantime.
+
+Link: https://lore.kernel.org/lkml/000000000000903d5805ab908fc4@google.com/
+Fixes: 5bef8da66a9c ("rcu: Add per-task state to RCU CPU stall warnings")
+Reported-by: syzbot+cb3b69ae80afd6535b0e@syzkaller.appspotmail.com
+Reported-by: syzbot+f04854e1c5c9e913cc27@syzkaller.appspotmail.com
+Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_stall.h | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
+index b5d3b4794db48..e3c0f6fb5806d 100644
+--- a/kernel/rcu/tree_stall.h
++++ b/kernel/rcu/tree_stall.h
+@@ -249,13 +249,16 @@ static bool check_slow_task(struct task_struct *t, void *arg)
+
+ /*
+ * Scan the current list of tasks blocked within RCU read-side critical
+- * sections, printing out the tid of each.
++ * sections, printing out the tid of each of the first few of them.
+ */
+-static int rcu_print_task_stall(struct rcu_node *rnp)
++static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
++ __releases(rnp->lock)
+ {
++ int i = 0;
+ int ndetected = 0;
+ struct rcu_stall_chk_rdr rscr;
+ struct task_struct *t;
++ struct task_struct *ts[8];
+
+ if (!rcu_preempt_blocked_readers_cgp(rnp))
+ return 0;
+@@ -264,6 +267,14 @@ static int rcu_print_task_stall(struct rcu_node *rnp)
+ t = list_entry(rnp->gp_tasks->prev,
+ struct task_struct, rcu_node_entry);
+ list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry) {
++ get_task_struct(t);
++ ts[i++] = t;
++ if (i >= ARRAY_SIZE(ts))
++ break;
++ }
++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
++ for (i--; i; i--) {
++ t = ts[i];
+ if (!try_invoke_on_locked_down_task(t, check_slow_task, &rscr))
+ pr_cont(" P%d", t->pid);
+ else
+@@ -273,6 +284,7 @@ static int rcu_print_task_stall(struct rcu_node *rnp)
+ ".q"[rscr.rs.b.need_qs],
+ ".e"[rscr.rs.b.exp_hint],
+ ".l"[rscr.on_blkd_list]);
++ put_task_struct(t);
+ ndetected++;
+ }
+ pr_cont("\n");
+@@ -293,8 +305,9 @@ static void rcu_print_detail_task_stall_rnp(struct rcu_node *rnp)
+ * Because preemptible RCU does not exist, we never have to check for
+ * tasks blocked within RCU read-side critical sections.
+ */
+-static int rcu_print_task_stall(struct rcu_node *rnp)
++static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
+ {
++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+ return 0;
+ }
+ #endif /* #else #ifdef CONFIG_PREEMPT_RCU */
+@@ -472,7 +485,6 @@ static void print_other_cpu_stall(unsigned long gp_seq, unsigned long gps)
+ pr_err("INFO: %s detected stalls on CPUs/tasks:\n", rcu_state.name);
+ rcu_for_each_leaf_node(rnp) {
+ raw_spin_lock_irqsave_rcu_node(rnp, flags);
+- ndetected += rcu_print_task_stall(rnp);
+ if (rnp->qsmask != 0) {
+ for_each_leaf_node_possible_cpu(rnp, cpu)
+ if (rnp->qsmask & leaf_node_cpu_bit(rnp, cpu)) {
+@@ -480,7 +492,7 @@ static void print_other_cpu_stall(unsigned long gp_seq, unsigned long gps)
+ ndetected++;
+ }
+ }
+- raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
++ ndetected += rcu_print_task_stall(rnp, flags); // Releases rnp->lock.
+ }
+
+ for_each_possible_cpu(cpu)
+--
+2.27.0
+
--- /dev/null
+From b5400655e58819f791d8c47f626ec5e60856e606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 11:22:02 +0800
+Subject: RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device()
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit d035c3f6cdb8e5d5a17adcbb79d7453417a6077d ]
+
+Fix missing kfree in pvrdma_register_device() when failure from
+ib_device_set_netdev().
+
+Fixes: 4b38da75e089 ("RDMA/drivers: Convert easy drivers to use ib_device_set_netdev()")
+Link: https://lore.kernel.org/r/20201111032202.17925-1-miaoqinglang@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index 780fd2dfc07eb..10e67283b9db7 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -266,7 +266,7 @@ static int pvrdma_register_device(struct pvrdma_dev *dev)
+ }
+ ret = ib_device_set_netdev(&dev->ib_dev, dev->netdev, 1);
+ if (ret)
+- return ret;
++ goto err_srq_free;
+ spin_lock_init(&dev->srq_tbl_lock);
+ rdma_set_device_sysfs_group(&dev->ib_dev, &pvrdma_attr_group);
+
+--
+2.27.0
+
--- /dev/null
+From 11728843b0b99ad09d88e34aba1366ef8f97f8a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 08:50:09 -0600
+Subject: regulator: ti-abb: Fix array out of bound read access on the first
+ transition
+
+From: Nishanth Menon <nm@ti.com>
+
+[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]
+
+At the start of driver initialization, we do not know what bias
+setting the bootloader has configured the system for and we only know
+for certain the very first time we do a transition.
+
+However, since the initial value of the comparison index is -EINVAL,
+this negative value results in an array out of bound access on the
+very first transition.
+
+Since we don't know what the setting is, we just set the bias
+configuration as there is nothing to compare against. This prevents
+the array out of bound access.
+
+NOTE: Even though we could use a more relaxed check of "< 0" the only
+valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.
+
+Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
+Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index af9abcd9c1665..16501ce0f56f4 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ return ret;
+ }
+
+- /* If data is exactly the same, then just update index, no change */
+ info = &abb->info[sel];
++ /*
++ * When Linux kernel is starting up, we are'nt sure of the
++ * Bias configuration that bootloader has configured.
++ * So, we get to know the actual setting the first time
++ * we are asked to transition.
++ */
++ if (abb->current_info_idx == -EINVAL)
++ goto just_set_abb;
++
++ /* If data is exactly the same, then just update index, no change */
+ oinfo = &abb->info[abb->current_info_idx];
+ if (!memcmp(info, oinfo, sizeof(*info))) {
+ dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
+@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
+ goto out;
+ }
+
++just_set_abb:
+ ret = ti_abb_set_opp(rdev, abb, info);
+
+ out:
+--
+2.27.0
+
--- /dev/null
+From bb3bd774f1fd524a624f004ae414d8158e3e509f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Oct 2020 00:25:06 +0800
+Subject: Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to
+ active high"
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 8d80e2f00a42ef10b54e1b2d9e97314f8fd046c0 ]
+
+This reverts commit 75ee680cbd2e4d0156b94f9fec50076361ab12f2.
+
+Turns out the activity and link LEDs on the RJ45 port are active low,
+just like on the Orange Pi PC.
+
+Revert the commit that says otherwise.
+
+Fixes: 75ee680cbd2e ("arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high")
+Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201024162515.30032-1-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+index 71fb732089397..babf4cf1b2f68 100644
+--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+@@ -53,11 +53,6 @@
+ };
+ };
+
+-&emac {
+- /* LEDs changed to active high on the plus */
+- /delete-property/ allwinner,leds-active-low;
+-};
+-
+ &mmc1 {
+ vmmc-supply = <®_vcc3v3>;
+ bus-width = <4>;
+--
+2.27.0
+
--- /dev/null
+From 72f6cf4d91ef6114cff2f30627883d0fdf4a7c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Nov 2020 16:49:08 +0800
+Subject: rfkill: Fix use-after-free in rfkill_resume()
+
+From: Claire Chang <tientzu@chromium.org>
+
+[ Upstream commit 94e2bd0b259ed39a755fdded47e6734acf1ce464 ]
+
+If a device is getting removed or reprobed during resume, use-after-free
+might happen. For example, h5_btrtl_resume() schedules a work queue for
+device reprobing, which of course requires removal first.
+
+If the removal happens in parallel with the device_resume() and wins the
+race to acquire device_lock(), removal may remove the device from the PM
+lists and all, but device_resume() is already running and will continue
+when the lock can be acquired, thus calling rfkill_resume().
+
+During this, if rfkill_set_block() is then called after the corresponding
+*_unregister() and kfree() are called, there will be an use-after-free
+in hci_rfkill_set_block():
+
+BUG: KASAN: use-after-free in hci_rfkill_set_block+0x58/0xc0 [bluetooth]
+...
+Call trace:
+ dump_backtrace+0x0/0x154
+ show_stack+0x20/0x2c
+ dump_stack+0xbc/0x12c
+ print_address_description+0x88/0x4b0
+ __kasan_report+0x144/0x168
+ kasan_report+0x10/0x18
+ check_memory_region+0x19c/0x1ac
+ __kasan_check_write+0x18/0x24
+ hci_rfkill_set_block+0x58/0xc0 [bluetooth]
+ rfkill_set_block+0x9c/0x120
+ rfkill_resume+0x34/0x70
+ dpm_run_callback+0xf0/0x1f4
+ device_resume+0x210/0x22c
+
+Fix this by checking rfkill->registered in rfkill_resume(). device_del()
+in rfkill_unregister() requires device_lock() and the whole rfkill_resume()
+is also protected by the same lock via device_resume(), we can make sure
+either the rfkill->registered is false before rfkill_resume() starts or the
+rfkill device won't be unregistered before rfkill_resume() returns.
+
+As async_resume() holds a reference to the device, at this level there can
+be no use-after-free; only in the user that doesn't expect this scenario.
+
+Fixes: 8589086f4efd ("Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Link: https://lore.kernel.org/r/20201110084908.219088-1-tientzu@chromium.org
+[edit commit message for clarity and add more info provided later]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rfkill/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index 971c73c7d34cb..97101c55763d7 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -876,6 +876,9 @@ static int rfkill_resume(struct device *dev)
+
+ rfkill->suspended = false;
+
++ if (!rfkill->registered)
++ return 0;
++
+ if (!rfkill->persistent) {
+ cur = !!(rfkill->state & RFKILL_BLOCK_SW);
+ rfkill_set_block(rfkill, cur);
+--
+2.27.0
+
--- /dev/null
+From 211799cbb4d9b4c22b12333a5189aab3f9e69267 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 19:19:32 +0100
+Subject: RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit b1e678bf290db5a76f1b6a9f7c381310e03440d6 ]
+
+dma_virt_ops requires that all pages have a kernel virtual address.
+Introduce a INFINIBAND_VIRT_DMA Kconfig symbol that depends on !HIGHMEM
+and make all three drivers depend on the new symbol.
+
+Also remove the ARCH_DMA_ADDR_T_64BIT dependency, which has been obsolete
+since commit 4965a68780c5 ("arch: define the ARCH_DMA_ADDR_T_64BIT config
+symbol in lib/Kconfig")
+
+Fixes: 551199aca1c3 ("lib/dma-virt: Add dma_virt_ops")
+Link: https://lore.kernel.org/r/20201106181941.1878556-2-hch@lst.de
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/Kconfig | 3 +++
+ drivers/infiniband/sw/rdmavt/Kconfig | 3 ++-
+ drivers/infiniband/sw/rxe/Kconfig | 2 +-
+ drivers/infiniband/sw/siw/Kconfig | 1 +
+ 4 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
+index 91b023341b779..58d1c91ffe51e 100644
+--- a/drivers/infiniband/Kconfig
++++ b/drivers/infiniband/Kconfig
+@@ -72,6 +72,9 @@ config INFINIBAND_ADDR_TRANS_CONFIGFS
+ This allows the user to config the default GID type that the CM
+ uses for each device, when initiaing new connections.
+
++config INFINIBAND_VIRT_DMA
++ def_bool !HIGHMEM
++
+ if INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
+ source "drivers/infiniband/hw/mthca/Kconfig"
+ source "drivers/infiniband/hw/qib/Kconfig"
+diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
+index 9ef5f5ce1ff6b..c8e268082952b 100644
+--- a/drivers/infiniband/sw/rdmavt/Kconfig
++++ b/drivers/infiniband/sw/rdmavt/Kconfig
+@@ -1,7 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config INFINIBAND_RDMAVT
+ tristate "RDMA verbs transport library"
+- depends on X86_64 && ARCH_DMA_ADDR_T_64BIT
++ depends on INFINIBAND_VIRT_DMA
++ depends on X86_64
+ depends on PCI
+ select DMA_VIRT_OPS
+ help
+diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
+index a0c6c7dfc1814..8810bfa680495 100644
+--- a/drivers/infiniband/sw/rxe/Kconfig
++++ b/drivers/infiniband/sw/rxe/Kconfig
+@@ -2,7 +2,7 @@
+ config RDMA_RXE
+ tristate "Software RDMA over Ethernet (RoCE) driver"
+ depends on INET && PCI && INFINIBAND
+- depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
++ depends on INFINIBAND_VIRT_DMA
+ select NET_UDP_TUNNEL
+ select CRYPTO_CRC32
+ select DMA_VIRT_OPS
+diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig
+index b622fc62f2cd6..3450ba5081df5 100644
+--- a/drivers/infiniband/sw/siw/Kconfig
++++ b/drivers/infiniband/sw/siw/Kconfig
+@@ -1,6 +1,7 @@
+ config RDMA_SIW
+ tristate "Software RDMA over TCP/IP (iWARP) driver"
+ depends on INET && INFINIBAND && LIBCRC32C
++ depends on INFINIBAND_VIRT_DMA
+ select DMA_VIRT_OPS
+ help
+ This driver implements the iWARP RDMA transport over
+--
+2.27.0
+
--- /dev/null
+From f6cdb95dde5ba6b04d7c89a121d1f041c4806baa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 11:12:01 +0000
+Subject: sched/fair: Fix overutilized update in enqueue_task_fair()
+
+From: Quentin Perret <qperret@google.com>
+
+[ Upstream commit 8e1ac4299a6e8726de42310d9c1379f188140c71 ]
+
+enqueue_task_fair() attempts to skip the overutilized update for new
+tasks as their util_avg is not accurate yet. However, the flag we check
+to do so is overwritten earlier on in the function, which makes the
+condition pretty much a nop.
+
+Fix this by saving the flag early on.
+
+Fixes: 2802bf3cd936 ("sched/fair: Add over-utilization/tipping point indicator")
+Reported-by: Rick Yiu <rickyiu@google.com>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Link: https://lkml.kernel.org/r/20201112111201.2081902-1-qperret@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 48a6d442b4443..c0c4d9ad7da8e 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5473,6 +5473,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
+ struct cfs_rq *cfs_rq;
+ struct sched_entity *se = &p->se;
+ int idle_h_nr_running = task_has_idle_policy(p);
++ int task_new = !(flags & ENQUEUE_WAKEUP);
+
+ /*
+ * The code below (indirectly) updates schedutil which looks at
+@@ -5545,7 +5546,7 @@ enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
+ * into account, but that is not straightforward to implement,
+ * and the following generally works well enough in practice.
+ */
+- if (flags & ENQUEUE_WAKEUP)
++ if (!task_new)
+ update_overutilized_status(rq);
+
+ enqueue_throttle:
+--
+2.27.0
+
--- /dev/null
+From 2788b51d1a5854d26f961fdc117054cdc2c25149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 09:08:41 +0100
+Subject: sched: Fix data-race in wakeup
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit f97bb5272d9e95d400d6c8643ebb146b3e3e7842 ]
+
+Mel reported that on some ARM64 platforms loadavg goes bananas and
+Will tracked it down to the following race:
+
+ CPU0 CPU1
+
+ schedule()
+ prev->sched_contributes_to_load = X;
+ deactivate_task(prev);
+
+ try_to_wake_up()
+ if (p->on_rq &&) // false
+ if (smp_load_acquire(&p->on_cpu) && // true
+ ttwu_queue_wakelist())
+ p->sched_remote_wakeup = Y;
+
+ smp_store_release(prev->on_cpu, 0);
+
+where both p->sched_contributes_to_load and p->sched_remote_wakeup are
+in the same word, and thus the stores X and Y race (and can clobber
+one another's data).
+
+Whereas prior to commit c6e7bd7afaeb ("sched/core: Optimize ttwu()
+spinning on p->on_cpu") the p->on_cpu handoff serialized access to
+p->sched_remote_wakeup (just as it still does with
+p->sched_contributes_to_load) that commit broke that by calling
+ttwu_queue_wakelist() with p->on_cpu != 0.
+
+However, due to
+
+ p->XXX = X ttwu()
+ schedule() if (p->on_rq && ...) // false
+ smp_mb__after_spinlock() if (smp_load_acquire(&p->on_cpu) &&
+ deactivate_task() ttwu_queue_wakelist())
+ p->on_rq = 0; p->sched_remote_wakeup = Y;
+
+We can be sure any 'current' store is complete and 'current' is
+guaranteed asleep. Therefore we can move p->sched_remote_wakeup into
+the current flags word.
+
+Note: while the observed failure was loadavg accounting gone wrong due
+to ttwu() cobbering p->sched_contributes_to_load, the reverse problem
+is also possible where schedule() clobbers p->sched_remote_wakeup,
+this could result in enqueue_entity() wrecking ->vruntime and causing
+scheduling artifacts.
+
+Fixes: c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu")
+Reported-by: Mel Gorman <mgorman@techsingularity.net>
+Debugged-by: Will Deacon <will@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20201117083016.GK3121392@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 8bf2295ebee48..12aa57de8eea0 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -770,7 +770,6 @@ struct task_struct {
+ unsigned sched_reset_on_fork:1;
+ unsigned sched_contributes_to_load:1;
+ unsigned sched_migrated:1;
+- unsigned sched_remote_wakeup:1;
+ #ifdef CONFIG_PSI
+ unsigned sched_psi_wake_requeue:1;
+ #endif
+@@ -780,6 +779,21 @@ struct task_struct {
+
+ /* Unserialized, strictly 'current' */
+
++ /*
++ * This field must not be in the scheduler word above due to wakelist
++ * queueing no longer being serialized by p->on_cpu. However:
++ *
++ * p->XXX = X; ttwu()
++ * schedule() if (p->on_rq && ..) // false
++ * smp_mb__after_spinlock(); if (smp_load_acquire(&p->on_cpu) && //true
++ * deactivate_task() ttwu_queue_wakelist())
++ * p->on_rq = 0; p->sched_remote_wakeup = Y;
++ *
++ * guarantees all stores of 'current' are visible before
++ * ->sched_remote_wakeup gets used, so it can be in this word.
++ */
++ unsigned sched_remote_wakeup:1;
++
+ /* Bit to tell LSMs we're in execve(): */
+ unsigned in_execve:1;
+ unsigned in_iowait:1;
+--
+2.27.0
+
--- /dev/null
+From 09b67eb0d38ebc9677ac048d34527fb3bfb9c7f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 13:50:42 +0200
+Subject: sched: Fix rq->nr_iowait ordering
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit ec618b84f6e15281cc3660664d34cd0dd2f2579e ]
+
+ schedule() ttwu()
+ deactivate_task(); if (p->on_rq && ...) // false
+ atomic_dec(&task_rq(p)->nr_iowait);
+ if (prev->in_iowait)
+ atomic_inc(&rq->nr_iowait);
+
+Allows nr_iowait to be decremented before it gets incremented,
+resulting in more dodgy IO-wait numbers than usual.
+
+Note that because we can now do ttwu_queue_wakelist() before
+p->on_cpu==0, we lose the natural ordering and have to further delay
+the decrement.
+
+Fixes: c6e7bd7afaeb ("sched/core: Optimize ttwu() spinning on p->on_cpu")
+Reported-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Link: https://lkml.kernel.org/r/20201117093829.GD3121429@hirez.programming.kicks-ass.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b1e0da56abcac..c4da7e17b9061 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2505,7 +2505,12 @@ ttwu_do_activate(struct rq *rq, struct task_struct *p, int wake_flags,
+ #ifdef CONFIG_SMP
+ if (wake_flags & WF_MIGRATED)
+ en_flags |= ENQUEUE_MIGRATED;
++ else
+ #endif
++ if (p->in_iowait) {
++ delayacct_blkio_end(p);
++ atomic_dec(&task_rq(p)->nr_iowait);
++ }
+
+ activate_task(rq, p, en_flags);
+ ttwu_do_wakeup(rq, p, wake_flags, rf);
+@@ -2892,11 +2897,6 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
+ if (READ_ONCE(p->on_rq) && ttwu_runnable(p, wake_flags))
+ goto unlock;
+
+- if (p->in_iowait) {
+- delayacct_blkio_end(p);
+- atomic_dec(&task_rq(p)->nr_iowait);
+- }
+-
+ #ifdef CONFIG_SMP
+ /*
+ * Ensure we load p->on_cpu _after_ p->on_rq, otherwise it would be
+@@ -2967,6 +2967,11 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
+
+ cpu = select_task_rq(p, p->wake_cpu, SD_BALANCE_WAKE, wake_flags);
+ if (task_cpu(p) != cpu) {
++ if (p->in_iowait) {
++ delayacct_blkio_end(p);
++ atomic_dec(&task_rq(p)->nr_iowait);
++ }
++
+ wake_flags |= WF_MIGRATED;
+ psi_ttwu_dequeue(p);
+ set_task_cpu(p, cpu);
+--
+2.27.0
+
--- /dev/null
+From 7dc7ac8d74260d11361c056ea4369015a05536d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 18:16:33 +0800
+Subject: selftests/bpf: Fix error return code in run_getsockopt_test()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 2acc3c1bc8e98bc66b1badec42e9ea205b4fcdaa ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 65b4414a05eb ("selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201116101633.64627-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/sockopt_multi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
+index 29188d6f5c8de..51fac975b3163 100644
+--- a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
++++ b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
+@@ -138,7 +138,8 @@ static int run_getsockopt_test(struct bpf_object *obj, int cg_parent,
+ */
+
+ buf = 0x40;
+- if (setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1) < 0) {
++ err = setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1);
++ if (err < 0) {
+ log_err("Failed to call setsockopt(IP_TOS)");
+ goto detach;
+ }
+--
+2.27.0
+
--- /dev/null
+From 22ea7f2159f173865f575b6f7aa767aab076b13b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 11:33:02 -0800
+Subject: selftests/seccomp: powerpc: Fix typo in macro variable name
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit f5098e34dd4c774c3040e417960f1637e5daade8 ]
+
+A typo sneaked into the powerpc selftest. Fix the name so it builds again.
+
+Fixes: 46138329faea ("selftests/seccomp: powerpc: Fix seccomp return value testing")
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/lkml/87y2ix2895.fsf@mpe.ellerman.id.au
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/seccomp/seccomp_bpf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 9a9eb02539fb4..6a27b12e9b3c2 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -1710,10 +1710,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
+ * and the code is stored as a positive value. \
+ */ \
+ if (_result < 0) { \
+- SYSCALL_RET(_regs) = -result; \
++ SYSCALL_RET(_regs) = -_result; \
+ (_regs).ccr |= 0x10000000; \
+ } else { \
+- SYSCALL_RET(_regs) = result; \
++ SYSCALL_RET(_regs) = _result; \
+ (_regs).ccr &= ~0x10000000; \
+ } \
+ } while (0)
+--
+2.27.0
+
--- /dev/null
+From 148689581947bc298bb7c0c23dbbfcedc258b2ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 11:54:43 -0800
+Subject: selftests/seccomp: sh: Fix register names
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 4c222f31fb1db4d590503a181a6268ced9252379 ]
+
+It looks like the seccomp selftests was never actually built for sh.
+This fixes it, though I don't have an environment to do a runtime test
+of it yet.
+
+Fixes: 0bb605c2c7f2b4b3 ("sh: Add SECCOMP_FILTER")
+Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/lkml/a36d7b48-6598-1642-e403-0c77a86f416d@physik.fu-berlin.de
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/seccomp/seccomp_bpf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index 6a27b12e9b3c2..687ca8afe0e83 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -1738,8 +1738,8 @@ TEST_F(TRACE_poke, getpid_runs_normally)
+ #define SYSCALL_RET(_regs) (_regs).a[(_regs).windowbase * 4 + 2]
+ #elif defined(__sh__)
+ # define ARCH_REGS struct pt_regs
+-# define SYSCALL_NUM(_regs) (_regs).gpr[3]
+-# define SYSCALL_RET(_regs) (_regs).gpr[0]
++# define SYSCALL_NUM(_regs) (_regs).regs[3]
++# define SYSCALL_RET(_regs) (_regs).regs[0]
+ #else
+ # error "Do not know how to find your architecture's registers and syscalls"
+ #endif
+--
+2.27.0
+
arm64-kpti-add-kryo2xx-gold-silver-cpu-cores-to-kpti.patch
arm64-cpu_errata-apply-erratum-845719-to-kryo2xx-sil.patch
usb-dwc2-avoid-leaving-the-error_debugfs-label-unuse.patch
+arm64-dts-allwinner-beelink-gs1-enable-both-rgmii-rx.patch
+arm64-dts-allwinner-pine-h64-enable-both-rgmii-rx-tx.patch
+arm64-dts-allwinner-a64-orangepi-win-fix-ethernet-no.patch
+arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch
+arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch
+arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch
+revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch
+arm-dts-sun6i-a31-hummingbird-enable-rgmii-rx-tx-del.patch
+arm-dts-sun7i-cubietruck-enable-rgmii-rx-tx-delay-on.patch
+arm-dts-sun7i-bananapi-m1-plus-enable-rgmii-rx-tx-de.patch
+arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch
+arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch
+arm-dts-sun9i-enable-both-rgmii-rx-tx-delay-on-ether.patch
+arm-dts-sunxi-bananapi-m2-plus-enable-rgmii-rx-tx-de.patch
+arm64-dts-allwinner-h5-libretech-all-h5-cc-enable-rg.patch
+arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch
+input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch
+mips-export-has_transparent_hugepage-for-modules.patch
+dmaengine-idxd-fix-wq-config-registers-offset-progra.patch
+arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch
+arm64-dts-fsl-fix-endianness-issue-of-rcpm.patch
+arm64-dts-imx8mm-beacon-som-fix-choppy-bt-audio.patch
+arm64-dts-imx8mn-remove-non-existent-usb-otg2.patch
+arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch
+arm-dts-vf610-zii-dev-rev-b-fix-mdio-over-clocking.patch
+arm-dts-imx6q-prti6q-fix-phy-address.patch
+swiotlb-using-size_max-needs-limits.h-included.patch
+tee-amdtee-fix-memory-leak-due-to-reset-of-global-sh.patch
+tee-amdtee-synchronize-access-to-shm-list.patch
+dmaengine-xilinx_dma-fix-usage-of-xilinx_aximcdma_tx.patch
+dmaengine-xilinx_dma-fix-sg-capability-check-for-mcd.patch
+arm-dts-stm32-fix-ta3-gpio-c-key-on-stm32mp1-dhcom-p.patch
+arm-dts-stm32-fix-led5-on-stm32mp1-dhcom-pdk2.patch
+arm-dts-stm32-define-vio-regulator-supply-on-dhcom.patch
+arm-dts-stm32-enable-thermal-sensor-support-on-stm32.patch
+arm-dts-stm32-keep-vdda-ldo1-always-on-on-dhcom.patch
+arm64-dts-imx8mm-fix-voltage-for-1.6ghz-cpu-operatin.patch
+arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch
+dmaengine-ti-omap-dma-block-pm-if-sdma-is-busy-to-fi.patch
+kunit-tool-unmark-test_data-as-binary-blobs.patch
+rcu-don-t-invoke-try_invoke_on_locked_down_task-with.patch
+spi-fix-client-driver-breakages-when-using-gpio-desc.patch
+input-resistive-adc-touch-fix-kconfig-dependency-on-.patch
+input-elan_i2c-fix-firmware-update-on-newer-ics.patch
+rfkill-fix-use-after-free-in-rfkill_resume.patch
+rdma-pvrdma-fix-missing-kfree-in-pvrdma_register_dev.patch
+rmda-sw-don-t-allow-drivers-using-dma_virt_ops-on-hi.patch
+perf-lock-correct-field-name-flags.patch
+perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch
+sunrpc-fix-oops-in-the-rpc_xdr_buf-event-class.patch
+drm-bridge-dw-hdmi-avoid-resetting-force-in-the-dete.patch
+tools-bpftool-add-missing-close-before-bpftool-net-a.patch
+ib-hfi1-fix-error-return-code-in-hfi1_init_dd.patch
+ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch
+can-af_can-prevent-potential-access-of-uninitialized.patch-9610
+can-dev-can_restart-post-buffer-from-the-right-conte.patch
+can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch
+can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch
+can-peak_usb-fix-potential-integer-overflow-on-shift.patch
+can-flexcan-fix-failure-handling-of-pm_runtime_get_s.patch
+can-tcan4x5x-replace-depends-on-regmap_spi-with-depe.patch
+can-tcan4x5x-tcan4x5x_can_probe-add-missing-error-ch.patch
+can-tcan4x5x-tcan4x5x_can_remove-fix-order-of-deregi.patch
+can-m_can-m_can_handle_state_change-fix-state-change.patch
+can-m_can-m_can_class_free_dev-introduce-new-functio.patch
+can-m_can-fix-freeing-of-can-device-from-peripherial.patch
+can-m_can-m_can_stop-set-device-to-software-init-mod.patch
+dmaengine-idxd-fix-mapping-of-portal-size.patch
+asoc-intel-kmb-fix-s24_le-configuration.patch
+asoc-qcom-lpass-platform-fix-memory-leak.patch
+spi-cadence-quadspi-fix-error-return-code-in-cqspi_p.patch
+selftests-bpf-fix-error-return-code-in-run_getsockop.patch
+mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch
+drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch
+net-mlx5-e-switch-fail-mlx5_esw_modify_vport_rate-if.patch
+bpf-sockmap-fix-partial-copy_page_to_iter-so-progres.patch
+bpf-sockmap-ensure-so_rcvbuf-memory-is-observed-on-i.patch
+can-kvaser_pciefd-fix-kcan-bittiming-limits.patch
+can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch
+dmaengine-fix-error-codes-in-channel_register.patch
+iommu-vt-d-move-intel_iommu_gfx_mapped-to-intel-iomm.patch
+iommu-vt-d-avoid-panic-if-iommu-init-fails-in-tboot-.patch
+can-flexcan-flexcan_chip_start-fix-erroneous-flexcan.patch
+can-m_can-process-interrupt-only-when-not-runtime-su.patch
+xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch
+xfs-strengthen-rmap-record-flags-checking.patch
+xfs-directory-scrub-should-check-the-null-bestfree-e.patch
+xfs-ensure-inobt-record-walks-always-make-forward-pr.patch
+xfs-return-corresponding-errcode-if-xfs_initialize_p.patch
+asoc-intel-kbl_rt5663_rt5514_max98927-do-not-try-to-.patch
+regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
+libbpf-fix-versioned_sym_count-number-parsing.patch
+lib-strncpy_from_user.c-mask-out-bytes-after-nul-ter.patch
+fail_function-remove-a-redundant-mutex-unlock.patch
+xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch
+selftests-seccomp-powerpc-fix-typo-in-macro-variable.patch
+selftests-seccomp-sh-fix-register-names.patch
+bpf-sockmap-skb-verdict-sk_pass-to-self-already-chec.patch
+bpf-sockmap-on-receive-programs-try-to-fast-track-sk.patch
+bpf-sockmap-use-truesize-with-sk_rmem_schedule.patch
+bpf-sockmap-avoid-returning-unneeded-eagain-when-red.patch
+efi-arm-set-hsctlr-thumb2-bit-correctly-for-hvc-call.patch
+counter-ti-eqep-fix-regmap-max_register.patch
+efi-x86-free-efi_pgd-with-free_pages.patch
+sched-fair-fix-overutilized-update-in-enqueue_task_f.patch
+sched-fix-data-race-in-wakeup.patch
+sched-fix-rq-nr_iowait-ordering.patch
+libfs-fix-error-cast-of-negative-value-in-simple_att.patch
+afs-fix-speculative-status-fetch-going-out-of-order-.patch
+hid-logitech-hidpp-add-pid-for-mx-anywhere-2.patch
+hid-mcp2221-fix-gpio-output-handling.patch
+hid-logitech-dj-handle-quad-bluetooth-keyboards-with.patch
+hid-logitech-dj-fix-dinovo-mini-when-paired-with-a-m.patch
--- /dev/null
+From 63968bb532f1e2f3a3a8ec82fdc50bc4bc069404 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 22:18:36 +0800
+Subject: spi: cadence-quadspi: Fix error return code in cqspi_probe
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit ac9978fcad3c5abc43cdd225441ce9459c36e16b ]
+
+Fix to return the error code from
+devm_reset_control_get_optional_exclusive() instaed of 0
+in cqspi_probe().
+
+Fixes: 31fb632b5d43ca ("spi: Move cadence-quadspi driver to drivers/spi/")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20201116141836.2970579-1-chengzhihao1@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index c6795c684b16a..9f8cae7a35bb6 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1263,12 +1263,14 @@ static int cqspi_probe(struct platform_device *pdev)
+ /* Obtain QSPI reset control */
+ rstc = devm_reset_control_get_optional_exclusive(dev, "qspi");
+ if (IS_ERR(rstc)) {
++ ret = PTR_ERR(rstc);
+ dev_err(dev, "Cannot get QSPI reset.\n");
+ goto probe_reset_failed;
+ }
+
+ rstc_ocp = devm_reset_control_get_optional_exclusive(dev, "qspi-ocp");
+ if (IS_ERR(rstc_ocp)) {
++ ret = PTR_ERR(rstc_ocp);
+ dev_err(dev, "Cannot get QSPI OCP reset.\n");
+ goto probe_reset_failed;
+ }
+--
+2.27.0
+
--- /dev/null
+From 6b7e10eb3b86fe03c7c7232a1bb0e8c485932756 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 10:07:06 -0500
+Subject: spi: fix client driver breakages when using GPIO descriptors
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 766c6b63aa044e84b045803b40b14754d69a2a1d ]
+
+Commit f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+introduced the optional use of GPIO descriptors for chip selects.
+
+A side-effect of this change: when a SPI bus uses GPIO descriptors,
+all its client devices have SPI_CS_HIGH set in spi->mode. This flag is
+required for the SPI bus to operate correctly.
+
+This unfortunately breaks many client drivers, which use the following
+pattern to configure their underlying SPI bus:
+
+static int client_device_probe(struct spi_device *spi)
+{
+ ...
+ spi->mode = SPI_MODE_0;
+ spi->bits_per_word = 8;
+ err = spi_setup(spi);
+ ..
+}
+
+In short, many client drivers overwrite the SPI_CS_HIGH bit in
+spi->mode, and break the underlying SPI bus driver.
+
+This is especially true for Freescale/NXP imx ecspi, where large
+numbers of spi client drivers now no longer work.
+
+Proposed fix:
+-------------
+When using gpio descriptors, depend on gpiolib to handle CS polarity.
+Existing quirks in gpiolib ensure that this is handled correctly.
+
+Existing gpiolib behaviour will force the polarity of any chip-select
+gpiod to active-high (if 'spi-active-high' devicetree prop present) or
+active-low (if 'spi-active-high' absent). Irrespective of whether
+the gpio is marked GPIO_ACTIVE_[HIGH|LOW] in the devicetree.
+
+Loose ends:
+-----------
+If this fix is applied:
+- is commit 138c9c32f090
+ ("spi: spidev: Fix CS polarity if GPIO descriptors are used")
+ still necessary / correct ?
+
+Fixes: f3186dd87669 ("spi: Optionally use GPIO descriptors for CS GPIOs")
+Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20201106150706.29089-1-TheSven73@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 23 ++++++-----------------
+ 1 file changed, 6 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 0cab239d8e7fc..7566482c052c8 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -812,18 +812,16 @@ static void spi_set_cs(struct spi_device *spi, bool enable)
+ enable = !enable;
+
+ if (spi->cs_gpiod || gpio_is_valid(spi->cs_gpio)) {
+- /*
+- * Honour the SPI_NO_CS flag and invert the enable line, as
+- * active low is default for SPI. Execution paths that handle
+- * polarity inversion in gpiolib (such as device tree) will
+- * enforce active high using the SPI_CS_HIGH resulting in a
+- * double inversion through the code above.
+- */
+ if (!(spi->mode & SPI_NO_CS)) {
+ if (spi->cs_gpiod)
++ /* polarity handled by gpiolib */
+ gpiod_set_value_cansleep(spi->cs_gpiod,
+- !enable);
++ enable1);
+ else
++ /*
++ * invert the enable line, as active low is
++ * default for SPI.
++ */
+ gpio_set_value_cansleep(spi->cs_gpio, !enable);
+ }
+ /* Some SPI masters need both GPIO CS & slave_select */
+@@ -1992,15 +1990,6 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
+ }
+ spi->chip_select = value;
+
+- /*
+- * For descriptors associated with the device, polarity inversion is
+- * handled in the gpiolib, so all gpio chip selects are "active high"
+- * in the logical sense, the gpiolib will invert the line if need be.
+- */
+- if ((ctlr->use_gpio_descriptors) && ctlr->cs_gpiods &&
+- ctlr->cs_gpiods[spi->chip_select])
+- spi->mode |= SPI_CS_HIGH;
+-
+ /* Device speed */
+ if (!of_property_read_u32(nc, "spi-max-frequency", &value))
+ spi->max_speed_hz = value;
+--
+2.27.0
+
--- /dev/null
+From 33455eb9f989c450178d0bf4000761b29aaaa5f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 15:17:32 -0500
+Subject: SUNRPC: Fix oops in the rpc_xdr_buf event class
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit c3213d260a23e263ef85ba21ac68c9e7578020b5 ]
+
+Backchannel rpc tasks don't have task->tk_client set, so it's necessary
+to check it for NULL before dereferencing.
+
+Fixes: c509f15a5801 ("SUNRPC: Split the xdr_buf event class")
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/sunrpc.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
+index ca2f27b9f919d..1652cc32aebcd 100644
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -68,7 +68,8 @@ DECLARE_EVENT_CLASS(rpc_xdr_buf_class,
+
+ TP_fast_assign(
+ __entry->task_id = task->tk_pid;
+- __entry->client_id = task->tk_client->cl_clid;
++ __entry->client_id = task->tk_client ?
++ task->tk_client->cl_clid : -1;
+ __entry->head_base = xdr->head[0].iov_base;
+ __entry->head_len = xdr->head[0].iov_len;
+ __entry->tail_base = xdr->tail[0].iov_base;
+--
+2.27.0
+
--- /dev/null
+From 3646b6ad43facac61294c24540d1f582ba2cea7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 12:43:27 +1100
+Subject: swiotlb: using SIZE_MAX needs limits.h included
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+[ Upstream commit f51778db088b2407ec177f2f4da0f6290602aa3f ]
+
+After merging the drm-misc tree, linux-next build (arm
+multi_v7_defconfig) failed like this:
+
+In file included from drivers/gpu/drm/nouveau/nouveau_ttm.c:26:
+include/linux/swiotlb.h: In function 'swiotlb_max_mapping_size':
+include/linux/swiotlb.h:99:9: error: 'SIZE_MAX' undeclared (first use in this function)
+ 99 | return SIZE_MAX;
+ | ^~~~~~~~
+include/linux/swiotlb.h:7:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'?
+ 6 | #include <linux/init.h>
+ +++ |+#include <stdint.h>
+ 7 | #include <linux/types.h>
+include/linux/swiotlb.h:99:9: note: each undeclared identifier is reported only once for each function it appears in
+ 99 | return SIZE_MAX;
+ | ^~~~~~~~
+
+Caused by commit
+
+ abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")
+
+but only exposed by commit "drm/nouveu: fix swiotlb include"
+
+Fix it by including linux/limits.h as appropriate.
+
+Fixes: abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Link: https://lore.kernel.org/r/20201102124327.2f82b2a7@canb.auug.org.au
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swiotlb.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
+index 046bb94bd4d61..fa5122c6711e6 100644
+--- a/include/linux/swiotlb.h
++++ b/include/linux/swiotlb.h
+@@ -5,6 +5,7 @@
+ #include <linux/dma-direction.h>
+ #include <linux/init.h>
+ #include <linux/types.h>
++#include <linux/limits.h>
+
+ struct device;
+ struct page;
+--
+2.27.0
+
--- /dev/null
+From 5f2b492026d16eed9a7920cefc9642767d5ecd6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 11:56:09 +0530
+Subject: tee: amdtee: fix memory leak due to reset of global shm list
+
+From: Rijo Thomas <Rijo-john.Thomas@amd.com>
+
+[ Upstream commit ff1f855804cdbbb6db7b9b6df6cab783d1a40d66 ]
+
+The driver maintains a list of shared memory buffers along with their
+mapped buffer id's in a global linked list. These buffers need to be
+unmapped after use by the user-space client.
+
+The global shared memory list is initialized to zero entries in the
+function amdtee_open(). This clearing of list entries can be a source
+for memory leak on secure side if the global linked list previously
+held some mapped buffer entries allocated from another TEE context.
+
+Fix potential memory leak issue by moving global shared memory list
+to AMD-TEE driver context data structure.
+
+Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
+Reviewed-by: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
+Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/amdtee/amdtee_private.h | 7 +++----
+ drivers/tee/amdtee/core.c | 18 +++++++++++-------
+ 2 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h
+index d7f798c3394bc..97df16a17285a 100644
+--- a/drivers/tee/amdtee/amdtee_private.h
++++ b/drivers/tee/amdtee/amdtee_private.h
+@@ -64,9 +64,12 @@ struct amdtee_session {
+ /**
+ * struct amdtee_context_data - AMD-TEE driver context data
+ * @sess_list: Keeps track of sessions opened in current TEE context
++ * @shm_list: Keeps track of buffers allocated and mapped in current TEE
++ * context
+ */
+ struct amdtee_context_data {
+ struct list_head sess_list;
++ struct list_head shm_list;
+ };
+
+ struct amdtee_driver_data {
+@@ -89,10 +92,6 @@ struct amdtee_shm_data {
+ u32 buf_id;
+ };
+
+-struct amdtee_shm_context {
+- struct list_head shmdata_list;
+-};
+-
+ #define LOWER_TWO_BYTE_MASK 0x0000FFFF
+
+ /**
+diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
+index 27b4cd77d0db6..ce61c68ec58cb 100644
+--- a/drivers/tee/amdtee/core.c
++++ b/drivers/tee/amdtee/core.c
+@@ -20,7 +20,6 @@
+
+ static struct amdtee_driver_data *drv_data;
+ static DEFINE_MUTEX(session_list_mutex);
+-static struct amdtee_shm_context shmctx;
+
+ static void amdtee_get_version(struct tee_device *teedev,
+ struct tee_ioctl_version_data *vers)
+@@ -42,7 +41,7 @@ static int amdtee_open(struct tee_context *ctx)
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&ctxdata->sess_list);
+- INIT_LIST_HEAD(&shmctx.shmdata_list);
++ INIT_LIST_HEAD(&ctxdata->shm_list);
+
+ ctx->data = ctxdata;
+ return 0;
+@@ -152,10 +151,11 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata,
+
+ u32 get_buffer_id(struct tee_shm *shm)
+ {
+- u32 buf_id = 0;
++ struct amdtee_context_data *ctxdata = shm->ctx->data;
+ struct amdtee_shm_data *shmdata;
++ u32 buf_id = 0;
+
+- list_for_each_entry(shmdata, &shmctx.shmdata_list, shm_node)
++ list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node)
+ if (shmdata->kaddr == shm->kaddr) {
+ buf_id = shmdata->buf_id;
+ break;
+@@ -333,8 +333,9 @@ int amdtee_close_session(struct tee_context *ctx, u32 session)
+
+ int amdtee_map_shmem(struct tee_shm *shm)
+ {
+- struct shmem_desc shmem;
++ struct amdtee_context_data *ctxdata;
+ struct amdtee_shm_data *shmnode;
++ struct shmem_desc shmem;
+ int rc, count;
+ u32 buf_id;
+
+@@ -362,7 +363,8 @@ int amdtee_map_shmem(struct tee_shm *shm)
+
+ shmnode->kaddr = shm->kaddr;
+ shmnode->buf_id = buf_id;
+- list_add(&shmnode->shm_node, &shmctx.shmdata_list);
++ ctxdata = shm->ctx->data;
++ list_add(&shmnode->shm_node, &ctxdata->shm_list);
+
+ pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr);
+
+@@ -371,6 +373,7 @@ int amdtee_map_shmem(struct tee_shm *shm)
+
+ void amdtee_unmap_shmem(struct tee_shm *shm)
+ {
++ struct amdtee_context_data *ctxdata;
+ struct amdtee_shm_data *shmnode;
+ u32 buf_id;
+
+@@ -381,7 +384,8 @@ void amdtee_unmap_shmem(struct tee_shm *shm)
+ /* Unmap the shared memory from TEE */
+ handle_unmap_shmem(buf_id);
+
+- list_for_each_entry(shmnode, &shmctx.shmdata_list, shm_node)
++ ctxdata = shm->ctx->data;
++ list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node)
+ if (buf_id == shmnode->buf_id) {
+ list_del(&shmnode->shm_node);
+ kfree(shmnode);
+--
+2.27.0
+
--- /dev/null
+From e8b774f799bca211256bf0f34a76e0ca7014ba6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Nov 2020 11:56:10 +0530
+Subject: tee: amdtee: synchronize access to shm list
+
+From: Rijo Thomas <Rijo-john.Thomas@amd.com>
+
+[ Upstream commit be353be27874f40837327d9a39e3ad2149ab66d3 ]
+
+Synchronize access to shm or shared memory buffer list to prevent
+race conditions due to concurrent updates to shared shm list by
+multiple threads.
+
+Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
+Reviewed-by: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
+Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/amdtee/amdtee_private.h | 1 +
+ drivers/tee/amdtee/core.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h
+index 97df16a17285a..337c8d82f74eb 100644
+--- a/drivers/tee/amdtee/amdtee_private.h
++++ b/drivers/tee/amdtee/amdtee_private.h
+@@ -70,6 +70,7 @@ struct amdtee_session {
+ struct amdtee_context_data {
+ struct list_head sess_list;
+ struct list_head shm_list;
++ struct mutex shm_mutex; /* synchronizes access to @shm_list */
+ };
+
+ struct amdtee_driver_data {
+diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
+index ce61c68ec58cb..8a6a8f30bb427 100644
+--- a/drivers/tee/amdtee/core.c
++++ b/drivers/tee/amdtee/core.c
+@@ -42,6 +42,7 @@ static int amdtee_open(struct tee_context *ctx)
+
+ INIT_LIST_HEAD(&ctxdata->sess_list);
+ INIT_LIST_HEAD(&ctxdata->shm_list);
++ mutex_init(&ctxdata->shm_mutex);
+
+ ctx->data = ctxdata;
+ return 0;
+@@ -85,6 +86,7 @@ static void amdtee_release(struct tee_context *ctx)
+ list_del(&sess->list_node);
+ release_session(sess);
+ }
++ mutex_destroy(&ctxdata->shm_mutex);
+ kfree(ctxdata);
+
+ ctx->data = NULL;
+@@ -155,11 +157,13 @@ u32 get_buffer_id(struct tee_shm *shm)
+ struct amdtee_shm_data *shmdata;
+ u32 buf_id = 0;
+
++ mutex_lock(&ctxdata->shm_mutex);
+ list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node)
+ if (shmdata->kaddr == shm->kaddr) {
+ buf_id = shmdata->buf_id;
+ break;
+ }
++ mutex_unlock(&ctxdata->shm_mutex);
+
+ return buf_id;
+ }
+@@ -364,7 +368,9 @@ int amdtee_map_shmem(struct tee_shm *shm)
+ shmnode->kaddr = shm->kaddr;
+ shmnode->buf_id = buf_id;
+ ctxdata = shm->ctx->data;
++ mutex_lock(&ctxdata->shm_mutex);
+ list_add(&shmnode->shm_node, &ctxdata->shm_list);
++ mutex_unlock(&ctxdata->shm_mutex);
+
+ pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr);
+
+@@ -385,12 +391,14 @@ void amdtee_unmap_shmem(struct tee_shm *shm)
+ handle_unmap_shmem(buf_id);
+
+ ctxdata = shm->ctx->data;
++ mutex_lock(&ctxdata->shm_mutex);
+ list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node)
+ if (buf_id == shmnode->buf_id) {
+ list_del(&shmnode->shm_node);
+ kfree(shmnode);
+ break;
+ }
++ mutex_unlock(&ctxdata->shm_mutex);
+ }
+
+ int amdtee_invoke_func(struct tee_context *ctx,
+--
+2.27.0
+
--- /dev/null
+From fd09047b911dd19a4b4a0e12a1ccc9f10b0bf9e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 19:51:52 +0800
+Subject: tools, bpftool: Add missing close before bpftool net attach exit
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 50431b45685b600fc2851a3f2b53e24643efe6d3 ]
+
+progfd is created by prog_parse_fd() in do_attach() and before the latter
+returns in case of success, the file descriptor should be closed.
+
+Fixes: 04949ccc273e ("tools: bpftool: add net attach command to attach XDP on interface")
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20201113115152.53178-1-wanghai38@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/net.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
+index 56c3a2bae3ef2..029c8188a2f90 100644
+--- a/tools/bpf/bpftool/net.c
++++ b/tools/bpf/bpftool/net.c
+@@ -313,8 +313,8 @@ static int do_attach(int argc, char **argv)
+
+ ifindex = net_parse_dev(&argc, &argv);
+ if (ifindex < 1) {
+- close(progfd);
+- return -EINVAL;
++ err = -EINVAL;
++ goto cleanup;
+ }
+
+ if (argc) {
+@@ -322,8 +322,8 @@ static int do_attach(int argc, char **argv)
+ overwrite = true;
+ } else {
+ p_err("expected 'overwrite', got: '%s'?", *argv);
+- close(progfd);
+- return -EINVAL;
++ err = -EINVAL;
++ goto cleanup;
+ }
+ }
+
+@@ -331,17 +331,17 @@ static int do_attach(int argc, char **argv)
+ if (is_prefix("xdp", attach_type_strings[attach_type]))
+ err = do_attach_detach_xdp(progfd, attach_type, ifindex,
+ overwrite);
+-
+- if (err < 0) {
++ if (err) {
+ p_err("interface %s attach failed: %s",
+ attach_type_strings[attach_type], strerror(-err));
+- return err;
++ goto cleanup;
+ }
+
+ if (json_output)
+ jsonw_null(json_wtr);
+-
+- return 0;
++cleanup:
++ close(progfd);
++ return err;
+ }
+
+ static int do_detach(int argc, char **argv)
+--
+2.27.0
+
--- /dev/null
+From cc6afaa477150d6a5dab0c6cc38bfdfa564eba51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:32:42 -0800
+Subject: xfs: directory scrub should check the null bestfree entries too
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 6b48e5b8a20f653b7d64ccf99a498f2523bff752 ]
+
+Teach the directory scrubber to check all the bestfree entries,
+including the null ones. We want to be able to detect the case where
+the entry is null but there actually /is/ a directory data block.
+
+Found by fuzzing lbests[0] = ones in xfs/391.
+
+Fixes: df481968f33b ("xfs: scrub directory freespace")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/dir.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/scrub/dir.c b/fs/xfs/scrub/dir.c
+index 7c432997edade..b045e95c2ea73 100644
+--- a/fs/xfs/scrub/dir.c
++++ b/fs/xfs/scrub/dir.c
+@@ -558,14 +558,27 @@ xchk_directory_leaf1_bestfree(
+ /* Check all the bestfree entries. */
+ for (i = 0; i < bestcount; i++, bestp++) {
+ best = be16_to_cpu(*bestp);
+- if (best == NULLDATAOFF)
+- continue;
+ error = xfs_dir3_data_read(sc->tp, sc->ip,
+- i * args->geo->fsbcount, 0, &dbp);
++ xfs_dir2_db_to_da(args->geo, i),
++ XFS_DABUF_MAP_HOLE_OK,
++ &dbp);
+ if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, lblk,
+ &error))
+ break;
+- xchk_directory_check_freesp(sc, lblk, dbp, best);
++
++ if (!dbp) {
++ if (best != NULLDATAOFF) {
++ xchk_fblock_set_corrupt(sc, XFS_DATA_FORK,
++ lblk);
++ break;
++ }
++ continue;
++ }
++
++ if (best == NULLDATAOFF)
++ xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, lblk);
++ else
++ xchk_directory_check_freesp(sc, lblk, dbp, best);
+ xfs_trans_brelse(sc->tp, dbp);
+ if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
+ break;
+--
+2.27.0
+
--- /dev/null
+From e3311a05f52d28e96ad40a54e317739f4a6b9020 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 09:59:22 -0800
+Subject: xfs: ensure inobt record walks always make forward progress
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 27c14b5daa82861220d6fa6e27b51f05f21ffaa7 ]
+
+The aim of the inode btree record iterator function is to call a
+callback on every record in the btree. To avoid having to tear down and
+recreate the inode btree cursor around every callback, it caches a
+certain number of records in a memory buffer. After each batch of
+callback invocations, we have to perform a btree lookup to find the
+next record after where we left off.
+
+However, if the keys of the inode btree are corrupt, the lookup might
+put us in the wrong part of the inode btree, causing the walk function
+to loop forever. Therefore, we add extra cursor tracking to make sure
+that we never go backwards neither when performing the lookup nor when
+jumping to the next inobt record. This also fixes an off by one error
+where upon resume the lookup should have been for the inode /after/ the
+point at which we stopped.
+
+Found by fuzzing xfs/460 with keys[2].startino = ones causing bulkstat
+and quotacheck to hang.
+
+Fixes: a211432c27ff ("xfs: create simplified inode walk function")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_iwalk.c | 27 ++++++++++++++++++++++++---
+ 1 file changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_iwalk.c b/fs/xfs/xfs_iwalk.c
+index 233dcc8784db0..2a45138831e33 100644
+--- a/fs/xfs/xfs_iwalk.c
++++ b/fs/xfs/xfs_iwalk.c
+@@ -55,6 +55,9 @@ struct xfs_iwalk_ag {
+ /* Where do we start the traversal? */
+ xfs_ino_t startino;
+
++ /* What was the last inode number we saw when iterating the inobt? */
++ xfs_ino_t lastino;
++
+ /* Array of inobt records we cache. */
+ struct xfs_inobt_rec_incore *recs;
+
+@@ -301,6 +304,9 @@ xfs_iwalk_ag_start(
+ if (XFS_IS_CORRUPT(mp, *has_more != 1))
+ return -EFSCORRUPTED;
+
++ iwag->lastino = XFS_AGINO_TO_INO(mp, agno,
++ irec->ir_startino + XFS_INODES_PER_CHUNK - 1);
++
+ /*
+ * If the LE lookup yielded an inobt record before the cursor position,
+ * skip it and see if there's another one after it.
+@@ -347,15 +353,17 @@ xfs_iwalk_run_callbacks(
+ struct xfs_mount *mp = iwag->mp;
+ struct xfs_trans *tp = iwag->tp;
+ struct xfs_inobt_rec_incore *irec;
+- xfs_agino_t restart;
++ xfs_agino_t next_agino;
+ int error;
+
++ next_agino = XFS_INO_TO_AGINO(mp, iwag->lastino) + 1;
++
+ ASSERT(iwag->nr_recs > 0);
+
+ /* Delete cursor but remember the last record we cached... */
+ xfs_iwalk_del_inobt(tp, curpp, agi_bpp, 0);
+ irec = &iwag->recs[iwag->nr_recs - 1];
+- restart = irec->ir_startino + XFS_INODES_PER_CHUNK - 1;
++ ASSERT(next_agino == irec->ir_startino + XFS_INODES_PER_CHUNK);
+
+ error = xfs_iwalk_ag_recs(iwag);
+ if (error)
+@@ -372,7 +380,7 @@ xfs_iwalk_run_callbacks(
+ if (error)
+ return error;
+
+- return xfs_inobt_lookup(*curpp, restart, XFS_LOOKUP_GE, has_more);
++ return xfs_inobt_lookup(*curpp, next_agino, XFS_LOOKUP_GE, has_more);
+ }
+
+ /* Walk all inodes in a single AG, from @iwag->startino to the end of the AG. */
+@@ -396,6 +404,7 @@ xfs_iwalk_ag(
+
+ while (!error && has_more) {
+ struct xfs_inobt_rec_incore *irec;
++ xfs_ino_t rec_fsino;
+
+ cond_resched();
+ if (xfs_pwork_want_abort(&iwag->pwork))
+@@ -407,6 +416,15 @@ xfs_iwalk_ag(
+ if (error || !has_more)
+ break;
+
++ /* Make sure that we always move forward. */
++ rec_fsino = XFS_AGINO_TO_INO(mp, agno, irec->ir_startino);
++ if (iwag->lastino != NULLFSINO &&
++ XFS_IS_CORRUPT(mp, iwag->lastino >= rec_fsino)) {
++ error = -EFSCORRUPTED;
++ goto out;
++ }
++ iwag->lastino = rec_fsino + XFS_INODES_PER_CHUNK - 1;
++
+ /* No allocated inodes in this chunk; skip it. */
+ if (iwag->skip_empty && irec->ir_freecount == irec->ir_count) {
+ error = xfs_btree_increment(cur, 0, &has_more);
+@@ -535,6 +553,7 @@ xfs_iwalk(
+ .trim_start = 1,
+ .skip_empty = 1,
+ .pwork = XFS_PWORK_SINGLE_THREADED,
++ .lastino = NULLFSINO,
+ };
+ xfs_agnumber_t agno = XFS_INO_TO_AGNO(mp, startino);
+ int error;
+@@ -623,6 +642,7 @@ xfs_iwalk_threaded(
+ iwag->data = data;
+ iwag->startino = startino;
+ iwag->sz_recs = xfs_iwalk_prefetch(inode_records);
++ iwag->lastino = NULLFSINO;
+ xfs_pwork_queue(&pctl, &iwag->pwork);
+ startino = XFS_AGINO_TO_INO(mp, agno + 1, 0);
+ if (flags & XFS_INOBT_WALK_SAME_AG)
+@@ -696,6 +716,7 @@ xfs_inobt_walk(
+ .startino = startino,
+ .sz_recs = xfs_inobt_walk_prefetch(inobt_records),
+ .pwork = XFS_PWORK_SINGLE_THREADED,
++ .lastino = NULLFSINO,
+ };
+ xfs_agnumber_t agno = XFS_INO_TO_AGNO(mp, startino);
+ int error;
+--
+2.27.0
+
--- /dev/null
+From 59d873f78dc4a0c7ca5385925843ff186c9ff579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:32:41 -0800
+Subject: xfs: fix the minrecs logic when dealing with inode root child blocks
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit e95b6c3ef1311dd7b20467d932a24b6d0fd88395 ]
+
+The comment and logic in xchk_btree_check_minrecs for dealing with
+inode-rooted btrees isn't quite correct. While the direct children of
+the inode root are allowed to have fewer records than what would
+normally be allowed for a regular ondisk btree block, this is only true
+if there is only one child block and the number of records don't fit in
+the inode root.
+
+Fixes: 08a3a692ef58 ("xfs: btree scrub should check minrecs")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/btree.c | 45 ++++++++++++++++++++++++++------------------
+ 1 file changed, 27 insertions(+), 18 deletions(-)
+
+diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
+index f52a7b8256f96..debf392e05156 100644
+--- a/fs/xfs/scrub/btree.c
++++ b/fs/xfs/scrub/btree.c
+@@ -452,32 +452,41 @@ xchk_btree_check_minrecs(
+ int level,
+ struct xfs_btree_block *block)
+ {
+- unsigned int numrecs;
+- int ok_level;
+-
+- numrecs = be16_to_cpu(block->bb_numrecs);
++ struct xfs_btree_cur *cur = bs->cur;
++ unsigned int root_level = cur->bc_nlevels - 1;
++ unsigned int numrecs = be16_to_cpu(block->bb_numrecs);
+
+ /* More records than minrecs means the block is ok. */
+- if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level))
++ if (numrecs >= cur->bc_ops->get_minrecs(cur, level))
+ return;
+
+ /*
+- * Certain btree blocks /can/ have fewer than minrecs records. Any
+- * level greater than or equal to the level of the highest dedicated
+- * btree block are allowed to violate this constraint.
+- *
+- * For a btree rooted in a block, the btree root can have fewer than
+- * minrecs records. If the btree is rooted in an inode and does not
+- * store records in the root, the direct children of the root and the
+- * root itself can have fewer than minrecs records.
++ * For btrees rooted in the inode, it's possible that the root block
++ * contents spilled into a regular ondisk block because there wasn't
++ * enough space in the inode root. The number of records in that
++ * child block might be less than the standard minrecs, but that's ok
++ * provided that there's only one direct child of the root.
+ */
+- ok_level = bs->cur->bc_nlevels - 1;
+- if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
+- ok_level--;
+- if (level >= ok_level)
++ if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) &&
++ level == cur->bc_nlevels - 2) {
++ struct xfs_btree_block *root_block;
++ struct xfs_buf *root_bp;
++ int root_maxrecs;
++
++ root_block = xfs_btree_get_block(cur, root_level, &root_bp);
++ root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level);
++ if (be16_to_cpu(root_block->bb_numrecs) != 1 ||
++ numrecs <= root_maxrecs)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ return;
++ }
+
+- xchk_btree_set_corrupt(bs->sc, bs->cur, level);
++ /*
++ * Otherwise, only the root level is allowed to have fewer than minrecs
++ * records or keyptrs.
++ */
++ if (level < root_level)
++ xchk_btree_set_corrupt(bs->sc, cur, level);
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 9fe1b5c1548414a7ef6112f5e45d2f82e2fe59fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 09:21:26 -0800
+Subject: xfs: return corresponding errcode if xfs_initialize_perag() fail
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 595189c25c28a55523354336bf24453242c81c15 ]
+
+In xfs_initialize_perag(), if kmem_zalloc(), xfs_buf_hash_init(), or
+radix_tree_preload() failed, the returned value 'error' is not set
+accordingly.
+
+Reported-as-fixing: 8b26c5825e02 ("xfs: handle ENOMEM correctly during initialisation of perag structures")
+Fixes: 9b2471797942 ("xfs: cache unlinked pointers in an rhashtable")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_mount.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
+index c8ae49a1e99c3..2a491a043ec97 100644
+--- a/fs/xfs/xfs_mount.c
++++ b/fs/xfs/xfs_mount.c
+@@ -194,20 +194,25 @@ xfs_initialize_perag(
+ }
+
+ pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL);
+- if (!pag)
++ if (!pag) {
++ error = -ENOMEM;
+ goto out_unwind_new_pags;
++ }
+ pag->pag_agno = index;
+ pag->pag_mount = mp;
+ spin_lock_init(&pag->pag_ici_lock);
+ INIT_RADIX_TREE(&pag->pag_ici_root, GFP_ATOMIC);
+- if (xfs_buf_hash_init(pag))
++
++ error = xfs_buf_hash_init(pag);
++ if (error)
+ goto out_free_pag;
+ init_waitqueue_head(&pag->pagb_wait);
+ spin_lock_init(&pag->pagb_lock);
+ pag->pagb_count = 0;
+ pag->pagb_tree = RB_ROOT;
+
+- if (radix_tree_preload(GFP_NOFS))
++ error = radix_tree_preload(GFP_NOFS);
++ if (error)
+ goto out_hash_destroy;
+
+ spin_lock(&mp->m_perag_lock);
+--
+2.27.0
+
--- /dev/null
+From 3ac3a50ac1d382b8f5b18bc3dcd54d94225ff4a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 15:17:50 -0800
+Subject: xfs: revert "xfs: fix rmap key and record comparison functions"
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ]
+
+This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f.
+
+Your maintainer committed a major braino in the rmap code by adding the
+attr fork, bmbt, and unwritten extent usage bits into rmap record key
+comparisons. While XFS uses the usage bits *in the rmap records* for
+cross-referencing metadata in xfs_scrub and xfs_repair, it only needs
+the owner and offset information to distinguish between reverse mappings
+of the same physical extent into the data fork of a file at multiple
+offsets. The other bits are not important for key comparisons for index
+lookups, and never have been.
+
+Eric Sandeen reports that this causes regressions in generic/299, so
+undo this patch before it does more damage.
+
+Reported-by: Eric Sandeen <sandeen@sandeen.net>
+Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
+index 577a66381327c..beb81c84a9375 100644
+--- a/fs/xfs/libxfs/xfs_rmap_btree.c
++++ b/fs/xfs/libxfs/xfs_rmap_btree.c
+@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp->rm_offset);
+- y = xfs_rmap_irec_offset_pack(rec);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
++ y = rec->rm_offset;
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys(
+ else if (y > x)
+ return -1;
+
+- x = be64_to_cpu(kp1->rm_offset);
+- y = be64_to_cpu(kp2->rm_offset);
++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
+ if (x > y)
+ return 1;
+ else if (y > x)
+@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(k1->rmap.rm_offset);
+- b = be64_to_cpu(k2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder(
+ return 1;
+ else if (a > b)
+ return 0;
+- a = be64_to_cpu(r1->rmap.rm_offset);
+- b = be64_to_cpu(r2->rmap.rm_offset);
++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
+ if (a <= b)
+ return 1;
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 77805f1364ef7f5e4c89c75ad06d14765d0fccc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 16:32:41 -0800
+Subject: xfs: strengthen rmap record flags checking
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 498fe261f0d6d5189f8e11d283705dd97b474b54 ]
+
+We always know the correct state of the rmap record flags (attr, bmbt,
+unwritten) so check them by direct comparison.
+
+Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree")
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/scrub/bmap.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
+index 412e2ec55e388..fed56d213a3f9 100644
+--- a/fs/xfs/scrub/bmap.c
++++ b/fs/xfs/scrub/bmap.c
+@@ -218,13 +218,13 @@ xchk_bmap_xref_rmap(
+ * which doesn't track unwritten state.
+ */
+ if (owner != XFS_RMAP_OWN_COW &&
+- irec->br_state == XFS_EXT_UNWRITTEN &&
+- !(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
++ !!(irec->br_state == XFS_EXT_UNWRITTEN) !=
++ !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+
+- if (info->whichfork == XFS_ATTR_FORK &&
+- !(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
++ if (!!(info->whichfork == XFS_ATTR_FORK) !=
++ !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
+ xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
+ irec->br_startoff);
+ if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
