--- /dev/null
+From 84502762f77204a7c5a8691827c4479902ceef0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 13:14:40 +0100
+Subject: 6lowpan: iphc: Fix an off-by-one check of array index
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ]
+
+The bounds check of id is off-by-one and the comparison should
+be >= rather >. Currently the WARN_ON_ONCE check does not stop
+the out of range indexing of &ldev->ctx.table[id] so also add
+a return path if the bounds are out of range.
+
+Addresses-Coverity: ("Illegal address computation").
+Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/6lowpan/debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c
+index 1c140af06d52..600b9563bfc5 100644
+--- a/net/6lowpan/debugfs.c
++++ b/net/6lowpan/debugfs.c
+@@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev,
+ struct dentry *root;
+ char buf[32];
+
+- WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE);
++ if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE))
++ return;
+
+ sprintf(buf, "%d", id);
+
+--
+2.30.2
+
--- /dev/null
+From e0d92233b7c74970cc0e89d87fef4673a3dd087b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 18:28:24 -0400
+Subject: amdgpu/pm: add extra info to SMU msg pre-check failed message
+
+From: Darren Powell <darren.powell@amd.com>
+
+[ Upstream commit 1e4a53de01c68d4ec9800b9a0f6efe9f26184a77 ]
+
+Insert the value of the response to error message emitted when the
+SMU msg pre-check failes
+
+Signed-off-by: Darren Powell <darren.powell@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+index dc7d2e71aa6f..5d1743f3321e 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+@@ -104,8 +104,8 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
+
+ ret = smu_cmn_wait_for_response(smu);
+ if (ret != 0x1) {
+- dev_err(adev->dev, "Msg issuing pre-check failed and "
+- "SMU may be not in the right state!\n");
++ dev_err(adev->dev, "Msg issuing pre-check failed(0x%x) and "
++ "SMU may be not in the right state!\n", ret);
+ if (ret != -ETIME)
+ ret = -EIO;
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From a2acd3cb281eb206f824ec3a1bf9f2069efac89b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 14:27:23 +0800
+Subject: ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
+
+From: Dylan Hung <dylan_hung@aspeedtech.com>
+
+[ Upstream commit 8c295b7f3d01359ff4336fcb6e406e6ed37957d6 ]
+
+The HVI3C shall be a group of I3C function, not an independent function.
+Correct the function name from "HVI3C" to "I3C".
+
+Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes")
+Link: https://lore.kernel.org/r/20201029062723.20798-1-dylan_hung@aspeedtech.com
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+index 7028e21bdd98..910eacc8ad3b 100644
+--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
++++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+@@ -208,12 +208,12 @@
+ };
+
+ pinctrl_hvi3c3_default: hvi3c3_default {
+- function = "HVI3C3";
++ function = "I3C3";
+ groups = "HVI3C3";
+ };
+
+ pinctrl_hvi3c4_default: hvi3c4_default {
+- function = "HVI3C4";
++ function = "I3C4";
+ groups = "HVI3C4";
+ };
+
+--
+2.30.2
+
--- /dev/null
+From d3709d07d0015a652abb2e08937eb8b17bd4cb97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Jul 2021 23:40:23 +0200
+Subject: ARM: dts: meson8: Use a higher default GPU clock frequency
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 44cf630bcb8c5ec78125805c9447dd5766792224 ]
+
+We are seeing "imprecise external abort (0x1406)" errors during boot
+(which then cause the whole board to hang) on Meson8 (but not Meson8m2).
+These are observed while trying to access the GPU's registers when the
+MALI clock is running at it's default setting of 24MHz. The 3.10 vendor
+kernel uses 318.75MHz as "default" GPU frequency. Using that makes the
+"imprecise external aborts" go away.
+Add the assigned-clocks and assigned-clock-rates properties to also bump
+the MALI clock to 318.75MHz before accessing any of it's registers.
+
+Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU")
+Reported-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20210711214023.2163565-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
+index 157a950a55d3..686c7b7c79d5 100644
+--- a/arch/arm/boot/dts/meson8.dtsi
++++ b/arch/arm/boot/dts/meson8.dtsi
+@@ -304,8 +304,13 @@
+ "pp2", "ppmmu2", "pp4", "ppmmu4",
+ "pp5", "ppmmu5", "pp6", "ppmmu6";
+ resets = <&reset RESET_MALI>;
++
+ clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>;
+ clock-names = "bus", "core";
++
++ assigned-clocks = <&clkc CLKID_MALI>;
++ assigned-clock-rates = <318750000>;
++
+ operating-points-v2 = <&gpu_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+--
+2.30.2
+
--- /dev/null
+From 749fc0e3b0f7f5e99886224475b2b6af83efa125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 11:23:55 +0000
+Subject: ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit 72ccc373b064ae3ac0c5b5f2306069b60ca118df ]
+
+After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs.
+Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
+instead of dummy regulator.
+
+[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
+[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
+[ 7.117184] VCCK: supplied by regulator-dummy
+[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
+[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
+[ 7.118498] VDDEE: will resolve supply early: pwm
+[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
+[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
+[ 7.118553] VDDEE: supplied by regulator-dummy
+[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT
+
+Fixes: 087a1d8b4e4c ("ARM: dts: meson8b: ec100: add the VDDEE regulator")
+Fixes: 3e7db1c1b7a3 ("ARM: dts: meson8b: ec100: improve the description of the regulators")
+
+Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20210705112358.3554-4-linux.amoon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b-ec100.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts
+index 8e48ccc6b634..7e8ddc6f1252 100644
+--- a/arch/arm/boot/dts/meson8b-ec100.dts
++++ b/arch/arm/boot/dts/meson8b-ec100.dts
+@@ -148,7 +148,7 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
+- vin-supply = <&vcc_5v>;
++ pwm-supply = <&vcc_5v>;
+
+ pwms = <&pwm_cd 0 1148 0>;
+ pwm-dutycycle-range = <100 0>;
+@@ -232,7 +232,7 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
+- vin-supply = <&vcc_5v>;
++ pwm-supply = <&vcc_5v>;
+
+ pwms = <&pwm_cd 1 1148 0>;
+ pwm-dutycycle-range = <100 0>;
+--
+2.30.2
+
--- /dev/null
+From 12de8a9e2081756522ca6aa536b982bda7604e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 11:23:54 +0000
+Subject: ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit 632062e540becbbcb067523ec8bcadb1239d9578 ]
+
+After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs.
+Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
+instead of dummy regulator.
+Add missing pwm-supply for regulator-vcck regulator node.
+
+[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
+[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
+[ 7.117184] VCCK: supplied by regulator-dummy
+[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
+[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
+[ 7.118498] VDDEE: will resolve supply early: pwm
+[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
+[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
+[ 7.118553] VDDEE: supplied by regulator-dummy
+[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT
+
+Fixes: dee51cd0d2e8 ("ARM: dts: meson8b: mxq: add the VDDEE regulator")
+Fixes: d94f60e3dfa0 ("ARM: dts: meson8b: mxq: improve support for the TRONFY MXQ S805")
+
+Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20210705112358.3554-3-linux.amoon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b-mxq.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/meson8b-mxq.dts b/arch/arm/boot/dts/meson8b-mxq.dts
+index f3937d55472d..7adedd3258c3 100644
+--- a/arch/arm/boot/dts/meson8b-mxq.dts
++++ b/arch/arm/boot/dts/meson8b-mxq.dts
+@@ -34,6 +34,8 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
++ pwm-supply = <&vcc_5v>;
++
+ pwms = <&pwm_cd 0 1148 0>;
+ pwm-dutycycle-range = <100 0>;
+
+@@ -79,7 +81,7 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
+- vin-supply = <&vcc_5v>;
++ pwm-supply = <&vcc_5v>;
+
+ pwms = <&pwm_cd 1 1148 0>;
+ pwm-dutycycle-range = <100 0>;
+--
+2.30.2
+
--- /dev/null
+From c1de9f37f3067274b3d175f5ad81551091293658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 11:23:53 +0000
+Subject: ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit 876228e9f935f19c7afc7ba394d17e2ec9143b65 ]
+
+After enabling CONFIG_REGULATOR_DEBUG=y we observe below debug logs.
+Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
+instead of dummy regulator.
+
+[ 7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
+[ 7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
+[ 7.117184] VCCK: supplied by regulator-dummy
+[ 7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
+[ 7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
+[ 7.118498] VDDEE: will resolve supply early: pwm
+[ 7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
+[ 7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
+[ 7.118553] VDDEE: supplied by regulator-dummy
+[ 7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT
+
+Fixes: 524d96083b66 ("ARM: dts: meson8b: odroidc1: add the CPU voltage regulator")
+Fixes: 8bdf38be712d ("ARM: dts: meson8b: odroidc1: add the VDDEE regulator")
+
+Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+[narmstrong: fixed typo in commit s/observer/observe/]
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lore.kernel.org/r/20210705112358.3554-2-linux.amoon@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/meson8b-odroidc1.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
+index c440ef94e082..04356bc639fa 100644
+--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
+@@ -131,7 +131,7 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
+- vin-supply = <&p5v0>;
++ pwm-supply = <&p5v0>;
+
+ pwms = <&pwm_cd 0 12218 0>;
+ pwm-dutycycle-range = <91 0>;
+@@ -163,7 +163,7 @@
+ regulator-min-microvolt = <860000>;
+ regulator-max-microvolt = <1140000>;
+
+- vin-supply = <&p5v0>;
++ pwm-supply = <&p5v0>;
+
+ pwms = <&pwm_cd 1 12218 0>;
+ pwm-dutycycle-range = <91 0>;
+--
+2.30.2
+
--- /dev/null
+From 22f6e80fc1e9b6795171fe32b42485e69969707d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 09:21:10 +0200
+Subject: arm64: dts: exynos: correct GIC CPU interfaces address range on
+ Exynos7
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+
+[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ]
+
+The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by
+ARM).
+
+Reported-by: Sam Protsenko <semen.protsenko@linaro.org>
+Reported-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
+Link: https://lore.kernel.org/r/20210805072110.4730-1-krzysztof.kozlowski@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 10244e59d56d..56a0bb7eb0e6 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -102,7 +102,7 @@
+ #address-cells = <0>;
+ interrupt-controller;
+ reg = <0x11001000 0x1000>,
+- <0x11002000 0x1000>,
++ <0x11002000 0x2000>,
+ <0x11004000 0x2000>,
+ <0x11006000 0x2000>;
+ };
+--
+2.30.2
+
--- /dev/null
+From 76289df1508d3461d5e035c015b5da84aa994793 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jun 2021 23:55:46 +0200
+Subject: arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 514ef1e62d6521c2199d192b1c71b79d2aa21d5a ]
+
+Current PCIe MEM space of size 16 MB is not enough for some combination
+of PCIe cards (e.g. NVMe disk together with ath11k wifi card). ARM Trusted
+Firmware for Armada 3700 platform already assigns 128 MB for PCIe window,
+so extend PCIe MEM space to the end of 128 MB PCIe window which allows to
+allocate more PCIe BARs for more PCIe cards.
+
+Without this change some combination of PCIe cards cannot be used and
+kernel show error messages in dmesg during initialization:
+
+ pci 0000:00:00.0: BAR 8: no space for [mem size 0x01800000]
+ pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x01800000]
+ pci 0000:00:00.0: BAR 6: assigned [mem 0xe8000000-0xe80007ff pref]
+ pci 0000:01:00.0: BAR 8: no space for [mem size 0x01800000]
+ pci 0000:01:00.0: BAR 8: failed to assign [mem size 0x01800000]
+ pci 0000:02:03.0: BAR 8: no space for [mem size 0x01000000]
+ pci 0000:02:03.0: BAR 8: failed to assign [mem size 0x01000000]
+ pci 0000:02:07.0: BAR 8: no space for [mem size 0x00100000]
+ pci 0000:02:07.0: BAR 8: failed to assign [mem size 0x00100000]
+ pci 0000:03:00.0: BAR 0: no space for [mem size 0x01000000 64bit]
+ pci 0000:03:00.0: BAR 0: failed to assign [mem size 0x01000000 64bit]
+
+Due to bugs in U-Boot port for Turris Mox, the second range in Turris Mox
+kernel DTS file for PCIe must start at 16 MB offset. Otherwise U-Boot
+crashes during loading of kernel DTB file. This bug is present only in
+U-Boot code for Turris Mox and therefore other Armada 3700 devices are not
+affected by this bug. Bug is fixed in U-Boot version 2021.07.
+
+To not break booting new kernels on existing versions of U-Boot on Turris
+Mox, use first 16 MB range for IO and second range with rest of PCIe window
+for MEM.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 76f6386b25cc ("arm64: dts: marvell: Add Aardvark PCIe support for Armada 3700")
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/marvell/armada-3720-turris-mox.dts | 17 +++++++++++++++++
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 11 +++++++++--
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+index a05b1ab2dd12..04da07ae4420 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+@@ -135,6 +135,23 @@
+ pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>;
+ status = "okay";
+ reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>;
++ /*
++ * U-Boot port for Turris Mox has a bug which always expects that "ranges" DT property
++ * contains exactly 2 ranges with 3 (child) address cells, 2 (parent) address cells and
++ * 2 size cells and also expects that the second range starts at 16 MB offset. If these
++ * conditions are not met then U-Boot crashes during loading kernel DTB file. PCIe address
++ * space is 128 MB long, so the best split between MEM and IO is to use fixed 16 MB window
++ * for IO and the rest 112 MB (64+32+16) for MEM, despite that maximal IO size is just 64 kB.
++ * This bug is not present in U-Boot ports for other Armada 3700 devices and is fixed in
++ * U-Boot version 2021.07. See relevant U-Boot commits (the last one contains fix):
++ * https://source.denx.de/u-boot/u-boot/-/commit/cb2ddb291ee6fcbddd6d8f4ff49089dfe580f5d7
++ * https://source.denx.de/u-boot/u-boot/-/commit/c64ac3b3185aeb3846297ad7391fc6df8ecd73bf
++ * https://source.denx.de/u-boot/u-boot/-/commit/4a82fca8e330157081fc132a591ebd99ba02ee33
++ */
++ #address-cells = <3>;
++ #size-cells = <2>;
++ ranges = <0x81000000 0 0xe8000000 0 0xe8000000 0 0x01000000 /* Port 0 IO */
++ 0x82000000 0 0xe9000000 0 0xe9000000 0 0x07000000>; /* Port 0 MEM */
+
+ /* enabled by U-Boot if PCIe module is present */
+ status = "disabled";
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index 5db81a416cd6..9acc5d2b5a00 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -489,8 +489,15 @@
+ #interrupt-cells = <1>;
+ msi-parent = <&pcie0>;
+ msi-controller;
+- ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x1000000 /* Port 0 MEM */
+- 0x81000000 0 0xe9000000 0 0xe9000000 0 0x10000>; /* Port 0 IO*/
++ /*
++ * The 128 MiB address range [0xe8000000-0xf0000000] is
++ * dedicated for PCIe and can be assigned to 8 windows
++ * with size a power of two. Use one 64 KiB window for
++ * IO at the end and the remaining seven windows
++ * (totaling 127 MiB) for MEM.
++ */
++ ranges = <0x82000000 0 0xe8000000 0 0xe8000000 0 0x07f00000 /* Port 0 MEM */
++ 0x81000000 0 0xefff0000 0 0xefff0000 0 0x00010000>; /* Port 0 IO */
+ interrupt-map-mask = <0 0 0 7>;
+ interrupt-map = <0 0 0 1 &pcie_intc 0>,
+ <0 0 0 2 &pcie_intc 1>,
+--
+2.30.2
+
--- /dev/null
+From de27e9659f105d8a6433a0aff6b0cbfe78f46df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Jul 2021 17:08:10 +0800
+Subject: arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms
+
+From: Judy Hsiao <judyhsiao@chromium.org>
+
+[ Upstream commit a8c7f3100e708d5f55692f0607ca80c5dcd21ce8 ]
+
+Set audu wakeup delay to 80 ms for fixing pop noise during capture begin.
+
+Fixes: ba5f9b5d7ff3 ("arm64: dts: qcom: sc7180: Add wakeup delay for adau codec")
+Signed-off-by: Judy Hsiao <judyhsiao@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210708090810.174767-1-judyhsiao@chromium.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
+index 3eb8550da1fc..3fa1ad1d0f02 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
+@@ -23,7 +23,7 @@ ap_h1_spi: &spi0 {};
+ adau7002: audio-codec-1 {
+ compatible = "adi,adau7002";
+ IOVDD-supply = <&pp1800_l15a>;
+- wakeup-delay-ms = <15>;
++ wakeup-delay-ms = <80>;
+ #sound-dai-cells = <0>;
+ };
+ };
+--
+2.30.2
+
--- /dev/null
+From 33a6792681725bd57b5d2ff9170693cd9a945d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 00:07:01 +0100
+Subject: arm64: dts: qcom: sm8250: fix usb2 qmp phy node
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 63fa4322469648ae1023bb92a8b0d6a2f4bdaf2c ]
+
+Use 'lanes' as SuperSpeed lanes device node instead of just 'lane' to
+fix issues with TypeC support.
+
+Fixes: 46a6f297d7dd ("arm64: dts: qcom: sm8250: Add USB and PHY device nodes")
+Cc: robh+dt@kernel.org
+Cc: devicetree@vger.kernel.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20210706230702.299047-2-bryan.odonoghue@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 09b552396557..1316bea3eab5 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -2123,7 +2123,7 @@
+ <&gcc GCC_USB3_PHY_SEC_BCR>;
+ reset-names = "phy", "common";
+
+- usb_2_ssphy: lane@88eb200 {
++ usb_2_ssphy: lanes@88eb200 {
+ reg = <0 0x088eb200 0 0x200>,
+ <0 0x088eb400 0 0x200>,
+ <0 0x088eb800 0 0x800>;
+--
+2.30.2
+
--- /dev/null
+From 78a3cef258b56a24920807a008a06cce1a3c4101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 19:06:32 +0100
+Subject: arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit c96ca5604a889a142d6b60889cc6da48498806e9 ]
+
+Hihope boards use Realtek PHY. From the very beginning it use only
+tx delays. However the phy driver commit bbc4d71d63549bcd003
+("net: phy: realtek: fix rtl8211e rx/tx delay config") introduced
+NFS mount failure. Now it needs rx delay inaddition to tx delay
+for NFS mount to work. This patch fixes NFS mount failure issue
+by adding MAC internal rx delay.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Fixes: bbc4d71d63549bcd ("net: phy: realtek: fix rtl8211e rx/tx delay config")
+Link: https://lore.kernel.org/r/20210721180632.15080-1-biju.das.jz@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+index 202c4fc88bd5..dde3a07bc417 100644
+--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
++++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+@@ -20,6 +20,7 @@
+ pinctrl-names = "default";
+ phy-handle = <&phy0>;
+ tx-internal-delay-ps = <2000>;
++ rx-internal-delay-ps = <1800>;
+ status = "okay";
+
+ phy0: ethernet-phy@0 {
+--
+2.30.2
+
--- /dev/null
+From 2af3b384985afb5426b0158d54dd39943aaa87d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 12:15:50 +0200
+Subject: arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w
+ properties
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 4ec82a7bb3db8c6005e715c63224c32d458917a2 ]
+
+The "max-clock" and "min-vrefresh" properties fail to validate with
+commit cfe34bb7a770c5d8 ("dt-bindings: drm: bridge: adi,adv7511.txt:
+convert to yaml"). Drop them, as they are parts of an out-of-tree
+workaround that is not needed upstream.
+
+Fixes: bcf3003438ea4645 ("arm64: dts: renesas: r8a77995: draak: Enable HDMI display output")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Link: https://lore.kernel.org/r/975b6686bc423421b147d367fe7fb9a0db99c5af.1625134398.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+index 6783c3ad0856..57784341f39d 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+@@ -277,10 +277,6 @@
+ interrupt-parent = <&gpio1>;
+ interrupts = <28 IRQ_TYPE_LEVEL_LOW>;
+
+- /* Depends on LVDS */
+- max-clock = <135000000>;
+- min-vrefresh = <50>;
+-
+ adi,input-depth = <8>;
+ adi,input-colorspace = "rgb";
+ adi,input-clock = "1x";
+--
+2.30.2
+
--- /dev/null
+From 739c28f119dc9c1ab6f3ed3bd482413f87ef628b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 14:03:34 +0800
+Subject: ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 2fbbcffea5b6adbfe90ffc842a6b3eb2d7e381ed ]
+
+The devm_clk_get() may return -EPROBE_DEFER, then clocks
+will be assigned to NULL wrongly. As the clocks are
+optional so we can use devm_clk_get_optional() instead of
+devm_clk_get().
+
+Fixes: b73d9e6225e8 ("ASoC: fsl_rpmsg: Add CPU DAI driver for audio base on rpmsg")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1629266614-6942-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl_rpmsg.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl_rpmsg.c b/sound/soc/fsl/fsl_rpmsg.c
+index ea5c973e2e84..d60f4dac6c1b 100644
+--- a/sound/soc/fsl/fsl_rpmsg.c
++++ b/sound/soc/fsl/fsl_rpmsg.c
+@@ -165,25 +165,25 @@ static int fsl_rpmsg_probe(struct platform_device *pdev)
+ }
+
+ /* Get the optional clocks */
+- rpmsg->ipg = devm_clk_get(&pdev->dev, "ipg");
++ rpmsg->ipg = devm_clk_get_optional(&pdev->dev, "ipg");
+ if (IS_ERR(rpmsg->ipg))
+- rpmsg->ipg = NULL;
++ return PTR_ERR(rpmsg->ipg);
+
+- rpmsg->mclk = devm_clk_get(&pdev->dev, "mclk");
++ rpmsg->mclk = devm_clk_get_optional(&pdev->dev, "mclk");
+ if (IS_ERR(rpmsg->mclk))
+- rpmsg->mclk = NULL;
++ return PTR_ERR(rpmsg->mclk);
+
+- rpmsg->dma = devm_clk_get(&pdev->dev, "dma");
++ rpmsg->dma = devm_clk_get_optional(&pdev->dev, "dma");
+ if (IS_ERR(rpmsg->dma))
+- rpmsg->dma = NULL;
++ return PTR_ERR(rpmsg->dma);
+
+- rpmsg->pll8k = devm_clk_get(&pdev->dev, "pll8k");
++ rpmsg->pll8k = devm_clk_get_optional(&pdev->dev, "pll8k");
+ if (IS_ERR(rpmsg->pll8k))
+- rpmsg->pll8k = NULL;
++ return PTR_ERR(rpmsg->pll8k);
+
+- rpmsg->pll11k = devm_clk_get(&pdev->dev, "pll11k");
++ rpmsg->pll11k = devm_clk_get_optional(&pdev->dev, "pll11k");
+ if (IS_ERR(rpmsg->pll11k))
+- rpmsg->pll11k = NULL;
++ return PTR_ERR(rpmsg->pll11k);
+
+ platform_set_drvdata(pdev, rpmsg);
+ pm_runtime_enable(&pdev->dev);
+--
+2.30.2
+
--- /dev/null
+From dbf7ee6f8c9f29cf026ecefb1af075c2de4fb0ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 14:35:39 -0700
+Subject: ASoC: Intel: Fix platform ID matching
+
+From: Curtis Malainey <cujomalainey@chromium.org>
+
+[ Upstream commit f4eeaed04e861b95f1f2c911263f2fcaa959c078 ]
+
+Sparse warnings triggered truncating the IDs of some platform device
+tables. Unfortunately some of the IDs in the match tables were missed
+which breaks audio. The KBL change has been verified to fix audio, the
+CML change was not tested as it was found through grepping the broken
+changes and found to match the same situation in anticipation that it
+should also be fixed.
+
+Fixes: 94efd726b947 ("ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters")
+Fixes: 24e46fb811e9 ("ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters")
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Tested-by: Matt Davis <mattedavis@google.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210809213544.1682444-1-cujomalainey@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 +-
+ sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-cml-match.c b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
+index 7f6ef8229969..4d7a181fb8e6 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-cml-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
+@@ -75,7 +75,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_machines[] = {
+ },
+ {
+ .id = "DLGS7219",
+- .drv_name = "cml_da7219_max98357a",
++ .drv_name = "cml_da7219_mx98357a",
+ .machine_quirk = snd_soc_acpi_codec_list,
+ .quirk_data = &max98390_spk_codecs,
+ .sof_fw_filename = "sof-cml.ri",
+diff --git a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
+index ba5ff468c265..741bf2f9e081 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
+@@ -87,7 +87,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_kbl_machines[] = {
+ },
+ {
+ .id = "DLGS7219",
+- .drv_name = "kbl_da7219_max98357a",
++ .drv_name = "kbl_da7219_mx98357a",
+ .fw_filename = "intel/dsp_fw_kbl.bin",
+ .machine_quirk = snd_soc_acpi_codec_list,
+ .quirk_data = &kbl_7219_98357_codecs,
+--
+2.30.2
+
--- /dev/null
+From 985ba932dc9665eee10e762d82cc86e60f60a7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 09:57:32 +0200
+Subject: ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 6d41bbf2fd3615c56dbf2b67f6cbf9e83d14a2e2 ]
+
+Contrary to what is said in board's file, topology targeting
+kbl_da7219_max98373 expects format 16b, not 24/32b. Partially revert
+changes added in 'ASoC: Intel: Boards: Add Maxim98373 support' to bring
+old behavior back, aligning with topology expectations.
+
+Fixes: 716d53cc7837 ("ASoC: Intel: Boards: Add Maxim98373 support")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Link: https://lore.kernel.org/r/20210818075742.1515155-2-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +++-----------------
+ 1 file changed, 7 insertions(+), 48 deletions(-)
+
+diff --git a/sound/soc/intel/boards/kbl_da7219_max98927.c b/sound/soc/intel/boards/kbl_da7219_max98927.c
+index 4b7b4a044f81..255f8df09d84 100644
+--- a/sound/soc/intel/boards/kbl_da7219_max98927.c
++++ b/sound/soc/intel/boards/kbl_da7219_max98927.c
+@@ -199,7 +199,7 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream,
+ }
+ if (!strcmp(codec_dai->component->name, MAX98373_DEV0_NAME)) {
+ ret = snd_soc_dai_set_tdm_slot(codec_dai,
+- 0x03, 3, 8, 24);
++ 0x30, 3, 8, 16);
+ if (ret < 0) {
+ dev_err(runtime->dev,
+ "DEV0 TDM slot err:%d\n", ret);
+@@ -208,10 +208,10 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream,
+ }
+ if (!strcmp(codec_dai->component->name, MAX98373_DEV1_NAME)) {
+ ret = snd_soc_dai_set_tdm_slot(codec_dai,
+- 0x0C, 3, 8, 24);
++ 0xC0, 3, 8, 16);
+ if (ret < 0) {
+ dev_err(runtime->dev,
+- "DEV0 TDM slot err:%d\n", ret);
++ "DEV1 TDM slot err:%d\n", ret);
+ return ret;
+ }
+ }
+@@ -311,24 +311,6 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
+ * The above 2 loops are mutually exclusive based on the stream direction,
+ * thus rtd_dpcm variable will never be overwritten
+ */
+- /*
+- * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE,
+- * where as kblda7219m98927 & kblmax98927 supports S16_LE by default.
+- * Skipping the port wise FE and BE configuration for kblda7219m98373 &
+- * kblmax98373 as the topology (FE & BE) supports S24_LE only.
+- */
+-
+- if (!strcmp(rtd->card->name, "kblda7219m98373") ||
+- !strcmp(rtd->card->name, "kblmax98373")) {
+- /* The ADSP will convert the FE rate to 48k, stereo */
+- rate->min = rate->max = 48000;
+- chan->min = chan->max = DUAL_CHANNEL;
+-
+- /* set SSP to 24 bit */
+- snd_mask_none(fmt);
+- snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE);
+- return 0;
+- }
+
+ /*
+ * The ADSP will convert the FE rate to 48k, stereo, 24 bit
+@@ -479,31 +461,20 @@ static struct snd_pcm_hw_constraint_list constraints_channels_quad = {
+ static int kbl_fe_startup(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+- struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream);
+
+ /*
+ * On this platform for PCM device we support,
+ * 48Khz
+ * stereo
++ * 16 bit audio
+ */
+
+ runtime->hw.channels_max = DUAL_CHANNEL;
+ snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ &constraints_channels);
+- /*
+- * Setup S24_LE (32 bit container and 24 bit valid data) for
+- * kblda7219m98373 & kblmax98373. For kblda7219m98927 &
+- * kblmax98927 keeping it as 16/16 due to topology FW dependency.
+- */
+- if (!strcmp(soc_rt->card->name, "kblda7219m98373") ||
+- !strcmp(soc_rt->card->name, "kblmax98373")) {
+- runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE;
+- snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24);
+-
+- } else {
+- runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+- snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
+- }
++
++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
+
+ snd_pcm_hw_constraint_list(runtime, 0,
+ SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+@@ -536,23 +507,11 @@ static int kabylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
+ static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime = substream->runtime;
+- struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream);
+
+ runtime->hw.channels_min = runtime->hw.channels_max = QUAD_CHANNEL;
+ snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ &constraints_channels_quad);
+
+- /*
+- * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE.
+- * The DMIC also configured for S24_LE. Forcing the DMIC format to
+- * S24_LE due to the topology FW dependency.
+- */
+- if (!strcmp(soc_rt->card->name, "kblda7219m98373") ||
+- !strcmp(soc_rt->card->name, "kblmax98373")) {
+- runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE;
+- snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24);
+- }
+-
+ return snd_pcm_hw_constraint_list(substream->runtime, 0,
+ SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+ }
+--
+2.30.2
+
--- /dev/null
+From 5618bfb8f72f802ae5a04b8bbfc77152b0d5e6d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 09:57:35 +0200
+Subject: ASoC: Intel: Skylake: Fix module resource and format selection
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit e8b374b649afe756c2470e0e6668022e90bf8518 ]
+
+Module configuration may differ between its instances depending on
+resources required and input and output audio format. Available
+parameters to select from are stored in module resource and interface
+(format) lists. These come from topology, together with description of
+each of pipe's modules.
+
+Ignoring index value provided by topology and relying always on 0th
+entry leads to unexpected module behavior due to under/overbudged
+resources assigned or impropper format selection. Fix by taking entry at
+index specified by topology.
+
+Fixes: f6fa56e22559 ("ASoC: Intel: Skylake: Parse and update module config structure")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Link: https://lore.kernel.org/r/20210818075742.1515155-5-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-topology.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index 45b1521e6189..09037d555ec4 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -113,7 +113,7 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w,
+
+ static void skl_dump_mconfig(struct skl_dev *skl, struct skl_module_cfg *mcfg)
+ {
+- struct skl_module_iface *iface = &mcfg->module->formats[0];
++ struct skl_module_iface *iface = &mcfg->module->formats[mcfg->fmt_idx];
+
+ dev_dbg(skl->dev, "Dumping config\n");
+ dev_dbg(skl->dev, "Input Format:\n");
+@@ -195,8 +195,8 @@ static void skl_tplg_update_params_fixup(struct skl_module_cfg *m_cfg,
+ struct skl_module_fmt *in_fmt, *out_fmt;
+
+ /* Fixups will be applied to pin 0 only */
+- in_fmt = &m_cfg->module->formats[0].inputs[0].fmt;
+- out_fmt = &m_cfg->module->formats[0].outputs[0].fmt;
++ in_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].inputs[0].fmt;
++ out_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].outputs[0].fmt;
+
+ if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) {
+ if (is_fe) {
+@@ -239,9 +239,9 @@ static void skl_tplg_update_buffer_size(struct skl_dev *skl,
+ /* Since fixups is applied to pin 0 only, ibs, obs needs
+ * change for pin 0 only
+ */
+- res = &mcfg->module->resources[0];
+- in_fmt = &mcfg->module->formats[0].inputs[0].fmt;
+- out_fmt = &mcfg->module->formats[0].outputs[0].fmt;
++ res = &mcfg->module->resources[mcfg->res_idx];
++ in_fmt = &mcfg->module->formats[mcfg->fmt_idx].inputs[0].fmt;
++ out_fmt = &mcfg->module->formats[mcfg->fmt_idx].outputs[0].fmt;
+
+ if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT)
+ multiplier = 5;
+@@ -1631,11 +1631,12 @@ int skl_tplg_update_pipe_params(struct device *dev,
+ struct skl_module_cfg *mconfig,
+ struct skl_pipe_params *params)
+ {
+- struct skl_module_res *res = &mconfig->module->resources[0];
++ struct skl_module_res *res;
+ struct skl_dev *skl = get_skl_ctx(dev);
+ struct skl_module_fmt *format = NULL;
+ u8 cfg_idx = mconfig->pipe->cur_config_idx;
+
++ res = &mconfig->module->resources[mconfig->res_idx];
+ skl_tplg_fill_dma_id(mconfig, params);
+ mconfig->fmt_idx = mconfig->mod_cfg[cfg_idx].fmt_idx;
+ mconfig->res_idx = mconfig->mod_cfg[cfg_idx].res_idx;
+@@ -1644,9 +1645,9 @@ int skl_tplg_update_pipe_params(struct device *dev,
+ return 0;
+
+ if (params->stream == SNDRV_PCM_STREAM_PLAYBACK)
+- format = &mconfig->module->formats[0].inputs[0].fmt;
++ format = &mconfig->module->formats[mconfig->fmt_idx].inputs[0].fmt;
+ else
+- format = &mconfig->module->formats[0].outputs[0].fmt;
++ format = &mconfig->module->formats[mconfig->fmt_idx].outputs[0].fmt;
+
+ /* set the hw_params */
+ format->s_freq = params->s_freq;
+--
+2.30.2
+
--- /dev/null
+From 6dd2b4b242dbd3a44edcd1e259c7bf2924bdfe7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 09:57:33 +0200
+Subject: ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 126b3422adc80f29d2129db7f61e0113a8a526c6 ]
+
+Advancing pointer initially fixed issue for some users but caused
+regression for others. Leave data as it to make it easier for end users
+to adjust their topology files if needed.
+
+Fixes: a8cd7066f042 ("ASoC: Intel: Skylake: Strip T and L from TLV IPCs")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Tested-by: Lukasz Majczak <lma@semihalf.com>
+Link: https://lore.kernel.org/r/20210818075742.1515155-3-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/skylake/skl-topology.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index c0fdab39e7c2..45b1521e6189 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -1463,12 +1463,6 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol,
+ struct skl_dev *skl = get_skl_ctx(w->dapm->dev);
+
+ if (ac->params) {
+- /*
+- * Widget data is expected to be stripped of T and L
+- */
+- size -= 2 * sizeof(unsigned int);
+- data += 2;
+-
+ if (size > ac->max)
+ return -EINVAL;
+ ac->size = size;
+--
+2.30.2
+
--- /dev/null
+From dd2c668076af167697b7c55144aa29e09b7b665f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 22:11:04 +0800
+Subject: ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in
+ mt8183_afe_pcm_dev_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 19f479c37f76e926a6c0bec974a4d09826e32fc6 ]
+
+Add missing pm_runtime_disable() when probe error out. It could
+avoid pm_runtime implementation complains when removing and probing
+again the driver.
+
+Fixes:a94aec035a122 ("ASoC: mediatek: mt8183: add platform driver")
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210618141104.105047-3-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 ++++++++++++++--------
+ 1 file changed, 27 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+index c4a598cbbdaa..14e77df06b01 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
++++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+@@ -1119,25 +1119,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->regmap = syscon_node_to_regmap(dev->parent->of_node);
+ if (IS_ERR(afe->regmap)) {
+ dev_err(dev, "could not get regmap from parent\n");
+- return PTR_ERR(afe->regmap);
++ ret = PTR_ERR(afe->regmap);
++ goto err_pm_disable;
+ }
+ ret = regmap_attach_dev(dev, afe->regmap, &mt8183_afe_regmap_config);
+ if (ret) {
+ dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ rstc = devm_reset_control_get(dev, "audiosys");
+ if (IS_ERR(rstc)) {
+ ret = PTR_ERR(rstc);
+ dev_err(dev, "could not get audiosys reset:%d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ ret = reset_control_reset(rstc);
+ if (ret) {
+ dev_err(dev, "failed to trigger audio reset:%d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* enable clock for regcache get default value from hw */
+@@ -1147,7 +1148,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config);
+ if (ret) {
+ dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ pm_runtime_put_sync(&pdev->dev);
+@@ -1160,8 +1161,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->memif_size = MT8183_MEMIF_NUM;
+ afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif),
+ GFP_KERNEL);
+- if (!afe->memif)
+- return -ENOMEM;
++ if (!afe->memif) {
++ ret = -ENOMEM;
++ goto err_pm_disable;
++ }
+
+ for (i = 0; i < afe->memif_size; i++) {
+ afe->memif[i].data = &memif_data[i];
+@@ -1178,22 +1181,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->irqs_size = MT8183_IRQ_NUM;
+ afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs),
+ GFP_KERNEL);
+- if (!afe->irqs)
+- return -ENOMEM;
++ if (!afe->irqs) {
++ ret = -ENOMEM;
++ goto err_pm_disable;
++ }
+
+ for (i = 0; i < afe->irqs_size; i++)
+ afe->irqs[i].irq_data = &irq_data[i];
+
+ /* request irq */
+ irq_id = platform_get_irq(pdev, 0);
+- if (irq_id < 0)
+- return irq_id;
++ if (irq_id < 0) {
++ ret = irq_id;
++ goto err_pm_disable;
++ }
+
+ ret = devm_request_irq(dev, irq_id, mt8183_afe_irq_handler,
+ IRQF_TRIGGER_NONE, "asys-isr", (void *)afe);
+ if (ret) {
+ dev_err(dev, "could not request_irq for asys-isr\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* init sub_dais */
+@@ -1204,7 +1211,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_warn(afe->dev, "dai register i %d fail, ret %d\n",
+ i, ret);
+- return ret;
++ goto err_pm_disable;
+ }
+ }
+
+@@ -1213,7 +1220,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_warn(afe->dev, "mtk_afe_combine_sub_dai fail, ret %d\n",
+ ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ afe->mtk_afe_hardware = &mt8183_afe_hardware;
+@@ -1229,7 +1236,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ NULL, 0);
+ if (ret) {
+ dev_warn(dev, "err_platform\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ ret = devm_snd_soc_register_component(afe->dev,
+@@ -1238,10 +1245,14 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->num_dai_drivers);
+ if (ret) {
+ dev_warn(dev, "err_dai_component\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ return ret;
++
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
++ return ret;
+ }
+
+ static int mt8183_afe_pcm_dev_remove(struct platform_device *pdev)
+--
+2.30.2
+
--- /dev/null
+From b285307df9a61f4604ec331010541049faae6e6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jun 2021 22:11:03 +0800
+Subject: ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in
+ mt8192_afe_pcm_dev_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 2af2f861edd21c1456ef7dbec52122ce1b581568 ]
+
+Add missing pm_runtime_disable() when probe error out. It could
+avoid pm_runtime implementation complains when removing and probing
+again the driver.
+
+Fixes:125ab5d588b0b ("ASoC: mediatek: mt8192: add platform driver")
+
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20210618141104.105047-2-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 ++++++++++++++--------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+index 7a1724f5ff4c..31c280339c50 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
++++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+@@ -2229,12 +2229,13 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->regmap = syscon_node_to_regmap(dev->parent->of_node);
+ if (IS_ERR(afe->regmap)) {
+ dev_err(dev, "could not get regmap from parent\n");
+- return PTR_ERR(afe->regmap);
++ ret = PTR_ERR(afe->regmap);
++ goto err_pm_disable;
+ }
+ ret = regmap_attach_dev(dev, afe->regmap, &mt8192_afe_regmap_config);
+ if (ret) {
+ dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* enable clock for regcache get default value from hw */
+@@ -2244,7 +2245,7 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
+ ret = regmap_reinit_cache(afe->regmap, &mt8192_afe_regmap_config);
+ if (ret) {
+ dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ pm_runtime_put_sync(&pdev->dev);
+@@ -2257,8 +2258,10 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->memif_size = MT8192_MEMIF_NUM;
+ afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif),
+ GFP_KERNEL);
+- if (!afe->memif)
+- return -ENOMEM;
++ if (!afe->memif) {
++ ret = -ENOMEM;
++ goto err_pm_disable;
++ }
+
+ for (i = 0; i < afe->memif_size; i++) {
+ afe->memif[i].data = &memif_data[i];
+@@ -2272,22 +2275,26 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
+ afe->irqs_size = MT8192_IRQ_NUM;
+ afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs),
+ GFP_KERNEL);
+- if (!afe->irqs)
+- return -ENOMEM;
++ if (!afe->irqs) {
++ ret = -ENOMEM;
++ goto err_pm_disable;
++ }
+
+ for (i = 0; i < afe->irqs_size; i++)
+ afe->irqs[i].irq_data = &irq_data[i];
+
+ /* request irq */
+ irq_id = platform_get_irq(pdev, 0);
+- if (irq_id < 0)
+- return irq_id;
++ if (irq_id < 0) {
++ ret = irq_id;
++ goto err_pm_disable;
++ }
+
+ ret = devm_request_irq(dev, irq_id, mt8192_afe_irq_handler,
+ IRQF_TRIGGER_NONE, "asys-isr", (void *)afe);
+ if (ret) {
+ dev_err(dev, "could not request_irq for Afe_ISR_Handle\n");
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* init sub_dais */
+--
+2.30.2
+
--- /dev/null
+From ec762c38aa3acc9a4bd4d27a9c1f5df76f98fcf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 00:51:51 -0700
+Subject: ASoC: rt5682: Implement remove callback
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 87b42abae99d3d851aec64cd4d0f7def8113950e ]
+
+Let's implement a remove callback for this driver that's similar to the
+shutdown hook, but also disables the regulators before they're put by
+devm code.
+
+Cc: Jairaj Arava <jairaj.arava@intel.com>
+Cc: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@intel.com>
+Cc: Shuming Fan <shumingf@realtek.com>
+Cc: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210508075151.1626903-2-swboyd@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682-i2c.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c
+index cd964e023d96..4a56a52adab5 100644
+--- a/sound/soc/codecs/rt5682-i2c.c
++++ b/sound/soc/codecs/rt5682-i2c.c
+@@ -280,6 +280,16 @@ static void rt5682_i2c_shutdown(struct i2c_client *client)
+ rt5682_reset(rt5682);
+ }
+
++static int rt5682_i2c_remove(struct i2c_client *client)
++{
++ struct rt5682_priv *rt5682 = i2c_get_clientdata(client);
++
++ rt5682_i2c_shutdown(client);
++ regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies);
++
++ return 0;
++}
++
+ static const struct of_device_id rt5682_of_match[] = {
+ {.compatible = "realtek,rt5682i"},
+ {},
+@@ -306,6 +316,7 @@ static struct i2c_driver rt5682_i2c_driver = {
+ .probe_type = PROBE_PREFER_ASYNCHRONOUS,
+ },
+ .probe = rt5682_i2c_probe,
++ .remove = rt5682_i2c_remove,
+ .shutdown = rt5682_i2c_shutdown,
+ .id_table = rt5682_i2c_id,
+ };
+--
+2.30.2
+
--- /dev/null
+From ee5e3da2cf83186cbb08c518d5c7fea84eededb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 08:17:56 -0700
+Subject: ASoC: rt5682: Properly turn off regulators if wrong device ID
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 772d44526e203c062171786e514373f129616278 ]
+
+When I booted up on a board that had a slightly different codec
+stuffed on it, I got this message at bootup:
+
+ rt5682 9-001a: Device with ID register 6749 is not rt5682
+
+That's normal/expected, but what wasn't normal was the splat that I
+got after:
+
+ WARNING: CPU: 7 PID: 176 at drivers/regulator/core.c:2151 _regulator_put+0x150/0x158
+ pc : _regulator_put+0x150/0x158
+ ...
+ Call trace:
+ _regulator_put+0x150/0x158
+ regulator_bulk_free+0x48/0x70
+ devm_regulator_bulk_release+0x20/0x2c
+ release_nodes+0x1cc/0x244
+ devres_release_all+0x44/0x60
+ really_probe+0x17c/0x378
+ ...
+
+This is because the error paths don't turn off the regulator. Let's
+fix that.
+
+Fixes: 0ddce71c21f0 ("ASoC: rt5682: add rt5682 codec driver")
+Fixes: 87b42abae99d ("ASoC: rt5682: Implement remove callback")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20210811081751.v2.1.I4a1d9aa5d99e05aeee15c2768db600158d76cab8@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682-i2c.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c
+index 4a56a52adab5..e559b965a0a6 100644
+--- a/sound/soc/codecs/rt5682-i2c.c
++++ b/sound/soc/codecs/rt5682-i2c.c
+@@ -117,6 +117,13 @@ static struct snd_soc_dai_driver rt5682_dai[] = {
+ },
+ };
+
++static void rt5682_i2c_disable_regulators(void *data)
++{
++ struct rt5682_priv *rt5682 = data;
++
++ regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies);
++}
++
+ static int rt5682_i2c_probe(struct i2c_client *i2c,
+ const struct i2c_device_id *id)
+ {
+@@ -157,6 +164,11 @@ static int rt5682_i2c_probe(struct i2c_client *i2c,
+ return ret;
+ }
+
++ ret = devm_add_action_or_reset(&i2c->dev, rt5682_i2c_disable_regulators,
++ rt5682);
++ if (ret)
++ return ret;
++
+ ret = regulator_bulk_enable(ARRAY_SIZE(rt5682->supplies),
+ rt5682->supplies);
+ if (ret) {
+@@ -285,7 +297,6 @@ static int rt5682_i2c_remove(struct i2c_client *client)
+ struct rt5682_priv *rt5682 = i2c_get_clientdata(client);
+
+ rt5682_i2c_shutdown(client);
+- regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 485815c98af1979c0a19a3562faf61769770e967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 07:25:28 +0200
+Subject: ASoC: wcd9335: Disable irq on slave ports in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d3efd26af2e044ff2b48d38bb871630282d77e60 ]
+
+The probe calls 'wcd9335_setup_irqs()' to enable interrupts on all slave
+ports.
+This must be undone in the remove function.
+
+Add a 'wcd9335_teardown_irqs()' function that undoes 'wcd9335_setup_irqs()'
+function, and call it from the remove function.
+
+Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Message-Id: <8f761244d79bd4c098af8a482be9121d3a486d1b.1629091028.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd9335.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
+index 47fe68edea3a..d885ced34f60 100644
+--- a/sound/soc/codecs/wcd9335.c
++++ b/sound/soc/codecs/wcd9335.c
+@@ -4076,6 +4076,16 @@ static int wcd9335_setup_irqs(struct wcd9335_codec *wcd)
+ return ret;
+ }
+
++static void wcd9335_teardown_irqs(struct wcd9335_codec *wcd)
++{
++ int i;
++
++ /* disable interrupts on all slave ports */
++ for (i = 0; i < WCD9335_SLIM_NUM_PORT_REG; i++)
++ regmap_write(wcd->if_regmap, WCD9335_SLIM_PGD_PORT_INT_EN0 + i,
++ 0x00);
++}
++
+ static void wcd9335_cdc_sido_ccl_enable(struct wcd9335_codec *wcd,
+ bool ccl_flag)
+ {
+@@ -4878,6 +4888,7 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)
+ struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev);
+
+ wcd_clsh_ctrl_free(wcd->clsh_ctrl);
++ wcd9335_teardown_irqs(wcd);
+ }
+
+ static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
+--
+2.30.2
+
--- /dev/null
+From 4a9a13e24fd43e39ab60b041e04819ce788b910d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 07:25:10 +0200
+Subject: ASoC: wcd9335: Fix a double irq free in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 7a6a723e98aa45f393e6add18f7309dfffa1b0e2 ]
+
+There is no point in calling 'free_irq()' explicitly for
+'WCD9335_IRQ_SLIMBUS' in the remove function.
+
+The irqs are requested in 'wcd9335_setup_irqs()' using a resource managed
+function (i.e. 'devm_request_threaded_irq()').
+'wcd9335_setup_irqs()' requests all what is defined in the 'wcd9335_irqs'
+structure.
+This structure has only one entry for 'WCD9335_IRQ_SLIMBUS'.
+
+So 'devm_request...irq()' + explicit 'free_irq()' would lead to a double
+free.
+
+Remove the unneeded 'free_irq()' from the remove function.
+
+Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Message-Id: <0614d63bc00edd7e81dd367504128f3d84f72efa.1629091028.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd9335.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
+index 86c92e03ea5d..933f59e4e56f 100644
+--- a/sound/soc/codecs/wcd9335.c
++++ b/sound/soc/codecs/wcd9335.c
+@@ -4869,7 +4869,6 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)
+ struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev);
+
+ wcd_clsh_ctrl_free(wcd->clsh_ctrl);
+- free_irq(regmap_irq_get_virq(wcd->irq_data, WCD9335_IRQ_SLIMBUS), wcd);
+ }
+
+ static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
+--
+2.30.2
+
--- /dev/null
+From 52cec431f4549249bdee61017399e09af7d99bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 07:25:20 +0200
+Subject: ASoC: wcd9335: Fix a memory leak in the error handling path of the
+ probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit fc6fc81caa63900cef9ebb8b2e365c3ed5a9effb ]
+
+If 'wcd9335_setup_irqs()' fails, me must release the memory allocated in
+'wcd_clsh_ctrl_alloc()', as already done in the remove function.
+
+Add an error handling path and the missing 'wcd_clsh_ctrl_free()' call.
+
+Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Message-Id: <6dc12372f09fabb70bf05941dbe6a1382dc93e43.1629091028.git.christophe.jaillet@wanadoo.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wcd9335.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
+index 933f59e4e56f..47fe68edea3a 100644
+--- a/sound/soc/codecs/wcd9335.c
++++ b/sound/soc/codecs/wcd9335.c
+@@ -4844,6 +4844,7 @@ static void wcd9335_codec_init(struct snd_soc_component *component)
+ static int wcd9335_codec_probe(struct snd_soc_component *component)
+ {
+ struct wcd9335_codec *wcd = dev_get_drvdata(component->dev);
++ int ret;
+ int i;
+
+ snd_soc_component_init_regmap(component, wcd->regmap);
+@@ -4861,7 +4862,15 @@ static int wcd9335_codec_probe(struct snd_soc_component *component)
+ for (i = 0; i < NUM_CODEC_DAIS; i++)
+ INIT_LIST_HEAD(&wcd->dai[i].slim_ch_list);
+
+- return wcd9335_setup_irqs(wcd);
++ ret = wcd9335_setup_irqs(wcd);
++ if (ret)
++ goto free_clsh_ctrl;
++
++ return 0;
++
++free_clsh_ctrl:
++ wcd_clsh_ctrl_free(wcd->clsh_ctrl);
++ return ret;
+ }
+
+ static void wcd9335_codec_remove(struct snd_soc_component *comp)
+--
+2.30.2
+
--- /dev/null
+From 4bd8c0df34ebd35e50b079e872e80769d300d8d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 14:34:38 +0300
+Subject: ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe ]
+
+This error path is unlikely because of it checked for NULL and
+returned -ENOMEM earlier in the function. But it should return
+an error code here as well if we ever do hit it because of a
+race condition or something.
+
+Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210813113438.GB30697@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index b137e7f34397..bd1ef6334997 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -2504,8 +2504,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
+ goto free_data_skb;
+
+ for (index = 0; index < num_pri_streams; index++) {
+- if (WARN_ON(!data_sync_bufs[index].skb))
++ if (WARN_ON(!data_sync_bufs[index].skb)) {
++ ret = -ENOMEM;
+ goto free_data_skb;
++ }
+
+ ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev,
+ data_sync_bufs[index].
+--
+2.30.2
+
--- /dev/null
+From be37c8ee593e10602746f3e0fa7a11fe13013d74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 04:52:25 -0700
+Subject: atlantic: Fix driver resume flow.
+
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+
+[ Upstream commit 57f780f1c43362b86fd23d20bd940e2468237716 ]
+
+Driver crashes when restoring from the Hibernate. In the resume flow,
+driver need to clean up the older nic/vec objects and re-initialize them.
+
+Fixes: 8aaa112a57c1d ("net: atlantic: refactoring pm logic")
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+index 59253846e885..f26d03735619 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+@@ -417,6 +417,9 @@ static int atl_resume_common(struct device *dev, bool deep)
+ pci_restore_state(pdev);
+
+ if (deep) {
++ /* Reinitialize Nic/Vecs objects */
++ aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol);
++
+ ret = aq_nic_init(nic);
+ if (ret)
+ goto err_exit;
+--
+2.30.2
+
--- /dev/null
+From fe2ed0de2d22ad106c0dab64e5da86f21ee43622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 08:40:26 +0200
+Subject: bcache: add proper error unwinding in bcache_device_init
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ]
+
+Except for the IDA none of the allocations in bcache_device_init is
+unwound on error, fix that.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Coly Li <colyli@suse.de>
+Link: https://lore.kernel.org/r/20210809064028.1198327-7-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index bea8c4429ae8..a407e3be0f17 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -935,20 +935,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
+ n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long);
+ d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL);
+ if (!d->full_dirty_stripes)
+- return -ENOMEM;
++ goto out_free_stripe_sectors_dirty;
+
+ idx = ida_simple_get(&bcache_device_idx, 0,
+ BCACHE_DEVICE_IDX_MAX, GFP_KERNEL);
+ if (idx < 0)
+- return idx;
++ goto out_free_full_dirty_stripes;
+
+ if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio),
+ BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER))
+- goto err;
++ goto out_ida_remove;
+
+ d->disk = alloc_disk(BCACHE_MINORS);
+ if (!d->disk)
+- goto err;
++ goto out_bioset_exit;
+
+ set_capacity(d->disk, sectors);
+ snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx);
+@@ -994,8 +994,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
+
+ return 0;
+
+-err:
++out_bioset_exit:
++ bioset_exit(&d->bio_split);
++out_ida_remove:
+ ida_simple_remove(&bcache_device_idx, idx);
++out_free_full_dirty_stripes:
++ kvfree(d->full_dirty_stripes);
++out_free_stripe_sectors_dirty:
++ kvfree(d->stripe_sectors_dirty);
+ return -ENOMEM;
+
+ }
+--
+2.30.2
+
--- /dev/null
+From bdf7a6ddf15821f134465a13cf8122081c5a9f98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 10:52:31 +0800
+Subject: bcma: Fix memory leak for internally-handled cores
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]
+
+kmemleak reported that dev_name() of internally-handled cores were leaked
+on driver unbinding. Let's use device_initialize() to take refcounts for
+them and put_device() to properly free the related stuff.
+
+While looking at it, there's another potential issue for those which should
+be *registered* into driver core. If device_register() failed, we put
+device once and freed bcma_device structures. In bcma_unregister_cores(),
+they're treated as unregistered and we hit both UAF and double-free. That
+smells not good and has also been fixed now.
+
+Fixes: ab54bc8460b5 ("bcma: fill core details for every device")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bcma/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
+index 6535614a7dc1..1df2b5801c3b 100644
+--- a/drivers/bcma/main.c
++++ b/drivers/bcma/main.c
+@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);
+
+ void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
++ device_initialize(&core->dev);
+ core->dev.release = bcma_release_core_dev;
+ core->dev.bus = &bcma_bus_type;
+ dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
+@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
+ {
+ int err;
+
+- err = device_register(&core->dev);
++ err = device_add(&core->dev);
+ if (err) {
+ bcma_err(bus, "Could not register dev for core 0x%03X\n",
+ core->id.id);
+- put_device(&core->dev);
+ return;
+ }
+ core->dev_registered = true;
+@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)
+ /* Now noone uses internally-handled cores, we can free them */
+ list_for_each_entry_safe(core, tmp, &bus->cores, list) {
+ list_del(&core->list);
+- kfree(core);
++ put_device(&core->dev);
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 79e2f18010734e1b8e0f2fef55d778389543d8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Aug 2021 22:59:18 -0700
+Subject: blk-crypto: fix check for too-large dun_bytes
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit cc40b7225151f611ef837f6403cfaeadc7af214a ]
+
+dun_bytes needs to be less than or equal to the IV size of the
+encryption mode, not just less than or equal to BLK_CRYPTO_MAX_IV_SIZE.
+
+Currently this doesn't matter since blk_crypto_init_key() is never
+actually passed invalid values, but we might as well fix this.
+
+Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20210825055918.51975-1-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-crypto.c b/block/blk-crypto.c
+index c5bdaafffa29..103c2e2d50d6 100644
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -332,7 +332,7 @@ int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key,
+ if (mode->keysize == 0)
+ return -EINVAL;
+
+- if (dun_bytes == 0 || dun_bytes > BLK_CRYPTO_MAX_IV_SIZE)
++ if (dun_bytes == 0 || dun_bytes > mode->ivsize)
+ return -EINVAL;
+
+ if (!is_power_of_2(data_unit_size))
+--
+2.30.2
+
--- /dev/null
+From 39af0d657b8509bcc7f11d39896e5987ce9b7533 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 11:51:56 +0800
+Subject: blk-throtl: optimize IOPS throttle for large IO scenarios
+
+From: Chunguang Xu <brookxu@tencent.com>
+
+[ Upstream commit 4f1e9630afe6332de7286820fedd019f19eac057 ]
+
+After patch 54efd50 (block: make generic_make_request handle
+arbitrarily sized bios), the IO through io-throttle may be larger,
+and these IOs may be further split into more small IOs. However,
+IOPS throttle does not seem to be aware of this change, which
+makes the calculation of IOPS of large IOs incomplete, resulting
+in disk-side IOPS that does not meet expectations. Maybe we should
+fix this problem.
+
+We can reproduce it by set max_sectors_kb of disk to 128, set
+blkio.write_iops_throttle to 100, run a dd instance inside blkio
+and use iostat to watch IOPS:
+
+dd if=/dev/zero of=/dev/sdb bs=1M count=1000 oflag=direct
+
+As a result, without this change the average IOPS is 1995, with
+this change the IOPS is 98.
+
+Signed-off-by: Chunguang Xu <brookxu@tencent.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/65869aaad05475797d63b4c3fed4f529febe3c26.1627876014.git.brookxu@tencent.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 2 ++
+ block/blk-throttle.c | 32 ++++++++++++++++++++++++++++++++
+ block/blk.h | 2 ++
+ 3 files changed, 36 insertions(+)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index bcdff1879c34..410ea45027c9 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -348,6 +348,8 @@ void __blk_queue_split(struct bio **bio, unsigned int *nr_segs)
+ trace_block_split(split, (*bio)->bi_iter.bi_sector);
+ submit_bio_noacct(*bio);
+ *bio = split;
++
++ blk_throtl_charge_bio_split(*bio);
+ }
+ }
+
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index b1b22d863bdf..55c49015e533 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -178,6 +178,9 @@ struct throtl_grp {
+ unsigned int bad_bio_cnt; /* bios exceeding latency threshold */
+ unsigned long bio_cnt_reset_time;
+
++ atomic_t io_split_cnt[2];
++ atomic_t last_io_split_cnt[2];
++
+ struct blkg_rwstat stat_bytes;
+ struct blkg_rwstat stat_ios;
+ };
+@@ -777,6 +780,8 @@ static inline void throtl_start_new_slice_with_credit(struct throtl_grp *tg,
+ tg->bytes_disp[rw] = 0;
+ tg->io_disp[rw] = 0;
+
++ atomic_set(&tg->io_split_cnt[rw], 0);
++
+ /*
+ * Previous slice has expired. We must have trimmed it after last
+ * bio dispatch. That means since start of last slice, we never used
+@@ -799,6 +804,9 @@ static inline void throtl_start_new_slice(struct throtl_grp *tg, bool rw)
+ tg->io_disp[rw] = 0;
+ tg->slice_start[rw] = jiffies;
+ tg->slice_end[rw] = jiffies + tg->td->throtl_slice;
++
++ atomic_set(&tg->io_split_cnt[rw], 0);
++
+ throtl_log(&tg->service_queue,
+ "[%c] new slice start=%lu end=%lu jiffies=%lu",
+ rw == READ ? 'R' : 'W', tg->slice_start[rw],
+@@ -1031,6 +1039,9 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio,
+ jiffies + tg->td->throtl_slice);
+ }
+
++ if (iops_limit != UINT_MAX)
++ tg->io_disp[rw] += atomic_xchg(&tg->io_split_cnt[rw], 0);
++
+ if (tg_with_in_bps_limit(tg, bio, bps_limit, &bps_wait) &&
+ tg_with_in_iops_limit(tg, bio, iops_limit, &iops_wait)) {
+ if (wait)
+@@ -2052,12 +2063,14 @@ static void throtl_downgrade_check(struct throtl_grp *tg)
+ }
+
+ if (tg->iops[READ][LIMIT_LOW]) {
++ tg->last_io_disp[READ] += atomic_xchg(&tg->last_io_split_cnt[READ], 0);
+ iops = tg->last_io_disp[READ] * HZ / elapsed_time;
+ if (iops >= tg->iops[READ][LIMIT_LOW])
+ tg->last_low_overflow_time[READ] = now;
+ }
+
+ if (tg->iops[WRITE][LIMIT_LOW]) {
++ tg->last_io_disp[WRITE] += atomic_xchg(&tg->last_io_split_cnt[WRITE], 0);
+ iops = tg->last_io_disp[WRITE] * HZ / elapsed_time;
+ if (iops >= tg->iops[WRITE][LIMIT_LOW])
+ tg->last_low_overflow_time[WRITE] = now;
+@@ -2176,6 +2189,25 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td)
+ }
+ #endif
+
++void blk_throtl_charge_bio_split(struct bio *bio)
++{
++ struct blkcg_gq *blkg = bio->bi_blkg;
++ struct throtl_grp *parent = blkg_to_tg(blkg);
++ struct throtl_service_queue *parent_sq;
++ bool rw = bio_data_dir(bio);
++
++ do {
++ if (!parent->has_rules[rw])
++ break;
++
++ atomic_inc(&parent->io_split_cnt[rw]);
++ atomic_inc(&parent->last_io_split_cnt[rw]);
++
++ parent_sq = parent->service_queue.parent_sq;
++ parent = sq_to_tg(parent_sq);
++ } while (parent);
++}
++
+ bool blk_throtl_bio(struct bio *bio)
+ {
+ struct request_queue *q = bio->bi_bdev->bd_disk->queue;
+diff --git a/block/blk.h b/block/blk.h
+index 54d48987c21b..40b00d18bdb2 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -290,11 +290,13 @@ int create_task_io_context(struct task_struct *task, gfp_t gfp_mask, int node);
+ extern int blk_throtl_init(struct request_queue *q);
+ extern void blk_throtl_exit(struct request_queue *q);
+ extern void blk_throtl_register_queue(struct request_queue *q);
++extern void blk_throtl_charge_bio_split(struct bio *bio);
+ bool blk_throtl_bio(struct bio *bio);
+ #else /* CONFIG_BLK_DEV_THROTTLING */
+ static inline int blk_throtl_init(struct request_queue *q) { return 0; }
+ static inline void blk_throtl_exit(struct request_queue *q) { }
+ static inline void blk_throtl_register_queue(struct request_queue *q) { }
++static inline void blk_throtl_charge_bio_split(struct bio *bio) { }
+ static inline bool blk_throtl_bio(struct bio *bio) { return false; }
+ #endif /* CONFIG_BLK_DEV_THROTTLING */
+ #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
+--
+2.30.2
+
--- /dev/null
+From ebb53a7645b2909f9b30de609bf801ae25434e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 12:15:01 +0300
+Subject: block: nbd: add sanity check for first_minor
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ]
+
+Syzbot hit WARNING in internal_create_group(). The problem was in
+too big disk->first_minor.
+
+disk->first_minor is initialized by value, which comes from userspace
+and there wasn't any sanity checks about value correctness. It can cause
+duplicate creation of sysfs files/links, because disk->first_minor will
+be passed to MKDEV() which causes truncation to byte. Since maximum
+minor value is 0xff, let's check if first_minor is correct minor number.
+
+NOTE: the root case of the reported warning was in wrong error handling
+in register_disk(), but we can avoid passing knowingly wrong values to
+sysfs API, because sysfs error messages can confuse users. For example:
+user passed 1048576 as index, but sysfs complains about duplicate
+creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0.
+Log and reproducer for above example can be found on syzkaller bug
+report page.
+
+Link: https://syzkaller.appspot.com/bug?id=03c2ae9146416edf811958d5fd7acfab75b143d1
+Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
+Reported-by: syzbot+9937dc42271cd87d4b98@syzkaller.appspotmail.com
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 7384058c24d0..4acf5c6cb80d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1717,7 +1717,17 @@ static int nbd_dev_add(int index)
+ refcount_set(&nbd->refs, 1);
+ INIT_LIST_HEAD(&nbd->list);
+ disk->major = NBD_MAJOR;
++
++ /* Too big first_minor can cause duplicate creation of
++ * sysfs files/links, since first_minor will be truncated to
++ * byte in __device_add_disk().
++ */
+ disk->first_minor = index << part_shift;
++ if (disk->first_minor > 0xff) {
++ err = -EINVAL;
++ goto out_free_idr;
++ }
++
+ disk->fops = &nbd_fops;
+ disk->private_data = nbd;
+ sprintf(disk->disk_name, "nbd%d", index);
+--
+2.30.2
+
--- /dev/null
+From 1ed8a9dee8be13bccb589d531812688a70ca9430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 11:42:26 +0800
+Subject: block: return ELEVATOR_DISCARD_MERGE if possible
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 866663b7b52d2da267b28e12eed89ee781b8fed1 ]
+
+When merging one bio to request, if they are discard IO and the queue
+supports multi-range discard, we need to return ELEVATOR_DISCARD_MERGE
+because both block core and related drivers(nvme, virtio-blk) doesn't
+handle mixed discard io merge(traditional IO merge together with
+discard merge) well.
+
+Fix the issue by returning ELEVATOR_DISCARD_MERGE in this situation,
+so both blk-mq and drivers just need to handle multi-range discard.
+
+Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Fixes: 2705dfb20947 ("block: fix discard request merge")
+Link: https://lore.kernel.org/r/20210729034226.1591070-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 3 +++
+ block/blk-merge.c | 16 ----------------
+ block/elevator.c | 3 +++
+ block/mq-deadline.c | 2 ++
+ include/linux/blkdev.h | 16 ++++++++++++++++
+ 5 files changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index eccbe2aed7c3..4df33cc08eee 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2333,6 +2333,9 @@ static int bfq_request_merge(struct request_queue *q, struct request **req,
+ __rq = bfq_find_rq_fmerge(bfqd, bio, q);
+ if (__rq && elv_bio_merge_ok(__rq, bio)) {
+ *req = __rq;
++
++ if (blk_discard_mergable(__rq))
++ return ELEVATOR_DISCARD_MERGE;
+ return ELEVATOR_FRONT_MERGE;
+ }
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 410ea45027c9..526953525e35 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -707,22 +707,6 @@ static void blk_account_io_merge_request(struct request *req)
+ }
+ }
+
+-/*
+- * Two cases of handling DISCARD merge:
+- * If max_discard_segments > 1, the driver takes every bio
+- * as a range and send them to controller together. The ranges
+- * needn't to be contiguous.
+- * Otherwise, the bios/requests will be handled as same as
+- * others which should be contiguous.
+- */
+-static inline bool blk_discard_mergable(struct request *req)
+-{
+- if (req_op(req) == REQ_OP_DISCARD &&
+- queue_max_discard_segments(req->q) > 1)
+- return true;
+- return false;
+-}
+-
+ static enum elv_merge blk_try_req_merge(struct request *req,
+ struct request *next)
+ {
+diff --git a/block/elevator.c b/block/elevator.c
+index 440699c28119..73e0591acfd4 100644
+--- a/block/elevator.c
++++ b/block/elevator.c
+@@ -336,6 +336,9 @@ enum elv_merge elv_merge(struct request_queue *q, struct request **req,
+ __rq = elv_rqhash_find(q, bio->bi_iter.bi_sector);
+ if (__rq && elv_bio_merge_ok(__rq, bio)) {
+ *req = __rq;
++
++ if (blk_discard_mergable(__rq))
++ return ELEVATOR_DISCARD_MERGE;
+ return ELEVATOR_BACK_MERGE;
+ }
+
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index 8eea2cbf2bf4..8dca7255d04c 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -454,6 +454,8 @@ static int dd_request_merge(struct request_queue *q, struct request **rq,
+
+ if (elv_bio_merge_ok(__rq, bio)) {
+ *rq = __rq;
++ if (blk_discard_mergable(__rq))
++ return ELEVATOR_DISCARD_MERGE;
+ return ELEVATOR_FRONT_MERGE;
+ }
+ }
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index f69c75bd6d27..9bfb2f65534b 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1531,6 +1531,22 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector
+ return offset << SECTOR_SHIFT;
+ }
+
++/*
++ * Two cases of handling DISCARD merge:
++ * If max_discard_segments > 1, the driver takes every bio
++ * as a range and send them to controller together. The ranges
++ * needn't to be contiguous.
++ * Otherwise, the bios/requests will be handled as same as
++ * others which should be contiguous.
++ */
++static inline bool blk_discard_mergable(struct request *req)
++{
++ if (req_op(req) == REQ_OP_DISCARD &&
++ queue_max_discard_segments(req->q) > 1)
++ return true;
++ return false;
++}
++
+ static inline int bdev_discard_alignment(struct block_device *bdev)
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
+--
+2.30.2
+
--- /dev/null
+From 00ef7c57f894f4d4fdcacb2530600a1532b57cc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 18:15:21 +0300
+Subject: Bluetooth: add timeout sanity check to hci_inquiry
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit f41a4b2b5eb7872109723dab8ae1603bdd9d9ec1 ]
+
+Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
+unreasonable huge inquiry timeout passed from userspace.
+Fix it by adding sanity check for timeout value to hci_inquiry().
+
+Since hci_inquiry() is the only user of hci_req_sync() with user
+controlled timeout value, it makes sense to check timeout value in
+hci_inquiry() and don't touch hci_req_sync().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 7154af1fad81..bf1bb08b94aa 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1343,6 +1343,12 @@ int hci_inquiry(void __user *arg)
+ goto done;
+ }
+
++ /* Restrict maximum inquiry length to 60 seconds */
++ if (ir.length > 60) {
++ err = -EINVAL;
++ goto done;
++ }
++
+ hci_dev_lock(hdev);
+ if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
+ inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
+--
+2.30.2
+
--- /dev/null
+From 21d3eb7d2c9e43c1ae44aff314ca5dfcd72b22f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 21:46:25 +0800
+Subject: Bluetooth: btusb: Fix a unspported condition to set available debug
+ features
+
+From: Jun Miao <jun.miao@windriver.com>
+
+[ Upstream commit 20a831f04f1526f2c3442efd3dece8630216b5d2 ]
+
+When reading the support debug features failed, there are not available
+features init. Continue to set the debug features is illogical, we should
+skip btintel_set_debug_features(), even if check it by "if (!features)".
+
+Fixes: c453b10c2b28 ("Bluetooth: btusb: Configure Intel debug feature based on available support")
+Signed-off-by: Jun Miao <jun.miao@windriver.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 9122f9cc97cb..ae0cf5e71584 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2912,10 +2912,11 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
+ /* Read the Intel supported features and if new exception formats
+ * supported, need to load the additional DDC config to enable.
+ */
+- btintel_read_debug_features(hdev, &features);
+-
+- /* Set DDC mask for available debug features */
+- btintel_set_debug_features(hdev, &features);
++ err = btintel_read_debug_features(hdev, &features);
++ if (!err) {
++ /* Set DDC mask for available debug features */
++ btintel_set_debug_features(hdev, &features);
++ }
+
+ /* Read the Intel version information after loading the FW */
+ err = btintel_read_version(hdev, &ver);
+@@ -3008,10 +3009,11 @@ static int btusb_setup_intel_newgen(struct hci_dev *hdev)
+ /* Read the Intel supported features and if new exception formats
+ * supported, need to load the additional DDC config to enable.
+ */
+- btintel_read_debug_features(hdev, &features);
+-
+- /* Set DDC mask for available debug features */
+- btintel_set_debug_features(hdev, &features);
++ err = btintel_read_debug_features(hdev, &features);
++ if (!err) {
++ /* Set DDC mask for available debug features */
++ btintel_set_debug_features(hdev, &features);
++ }
+
+ /* Read the Intel version information after loading the FW */
+ err = btintel_read_version_tlv(hdev, &version);
+--
+2.30.2
+
--- /dev/null
+From e0944a096e3d4be107601bff3679ba4bf5a0d946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:14:10 +0800
+Subject: Bluetooth: fix repeated calls to sco_sock_kill
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ]
+
+In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed
+socket"), a check was added to sco_sock_kill to skip killing a socket
+if the SOCK_DEAD flag was set.
+
+This was done after a trace for a use-after-free bug showed that the
+same sock pointer was being killed twice.
+
+Unfortunately, this check prevents sco_sock_kill from running on any
+socket. sco_sock_kill kills a socket only if it's zapped and orphaned,
+however sock_orphan announces that the socket is dead before detaching
+it. i.e., orphaned sockets have the SOCK_DEAD flag set.
+
+To fix this, we remove the check for SOCK_DEAD, and avoid repeated
+calls to sco_sock_kill by removing incorrect calls in:
+
+1. sco_sock_timeout. The socket should not be killed on timeout as
+further processing is expected to be done. For example,
+sco_sock_connect sets the timer then waits for the socket to be
+connected or for an error to be returned.
+
+2. sco_conn_del. This function should clean up resources for the
+connection, but the socket itself should be cleaned up in
+sco_sock_release.
+
+3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen
+and sco_sock_release are followed by sco_sock_kill. Hence the
+duplicated call should be removed.
+
+Fixes: 4e1a720d0312 ("Bluetooth: avoid killing an already killed socket")
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index a7b4555f312f..9769a7ceb689 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -85,7 +85,6 @@ static void sco_sock_timeout(struct timer_list *t)
+ sk->sk_state_change(sk);
+ bh_unlock_sock(sk);
+
+- sco_sock_kill(sk);
+ sock_put(sk);
+ }
+
+@@ -177,7 +176,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
+ sco_sock_clear_timer(sk);
+ sco_chan_del(sk, err);
+ bh_unlock_sock(sk);
+- sco_sock_kill(sk);
+ sock_put(sk);
+ }
+
+@@ -394,8 +392,7 @@ static void sco_sock_cleanup_listen(struct sock *parent)
+ */
+ static void sco_sock_kill(struct sock *sk)
+ {
+- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
+- sock_flag(sk, SOCK_DEAD))
++ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+ return;
+
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+@@ -447,7 +444,6 @@ static void sco_sock_close(struct sock *sk)
+ lock_sock(sk);
+ __sco_sock_close(sk);
+ release_sock(sk);
+- sco_sock_kill(sk);
+ }
+
+ static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg,
+--
+2.30.2
+
--- /dev/null
+From 496912f783803fea688ed7cfda68f4838e82fd6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 16:09:51 +0100
+Subject: Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer
+ overflow
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]
+
+An earlier commit replaced using batostr to using %pMR sprintf for the
+construction of session->name. Static analysis detected that this new
+method can use a total of 21 characters (including the trailing '\0')
+so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
+buffer overflows.
+
+Addresses-Coverity: ("Out-of-bounds write")
+Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/cmtp/cmtp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
+index c32638dddbf9..f6b9dc4e408f 100644
+--- a/net/bluetooth/cmtp/cmtp.h
++++ b/net/bluetooth/cmtp/cmtp.h
+@@ -26,7 +26,7 @@
+ #include <linux/types.h>
+ #include <net/bluetooth/bluetooth.h>
+
+-#define BTNAMSIZ 18
++#define BTNAMSIZ 21
+
+ /* CMTP ioctl defines */
+ #define CMTPCONNADD _IOW('C', 200, int)
+--
+2.30.2
+
--- /dev/null
+From bd9eece266a936b2907afc68b6c5066c21dfdf9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 13:22:36 -0700
+Subject: Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
+
+From: Tedd Ho-Jeong An <tedd.an@intel.com>
+
+[ Upstream commit a25fca4d3c18766b6f7a3c95fa8faec23ef464c5 ]
+
+This patch fixes the MGMT add_advertising command repsones with the
+wrong opcode when it is trying to return the not supported error.
+
+Fixes: cbbdfa6f33198 ("Bluetooth: Enable controller RPA resolution using Experimental feature")
+Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 470eaabb021f..6a9826164fd7 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -7725,7 +7725,7 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev,
+ * advertising.
+ */
+ if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
+- return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+ MGMT_STATUS_NOT_SUPPORTED);
+
+ if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
+--
+2.30.2
+
--- /dev/null
+From a3362f9a5d6de9324b56c17a653de2299496d01d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 12:53:15 +0800
+Subject: Bluetooth: Move shutdown callback before flushing tx and rx queue
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit 0ea53674d07fb6db2dd7a7ec2fdc85a12eb246c2 ]
+
+Commit 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues
+are flushed or cancelled") introduced a regression that makes mtkbtsdio
+driver stops working:
+[ 36.593956] Bluetooth: hci0: Firmware already downloaded
+[ 46.814613] Bluetooth: hci0: Execution of wmt command timed out
+[ 46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110)
+
+The shutdown callback depends on the result of hdev->rx_work, so we
+should call it before flushing rx_work:
+-> btmtksdio_shutdown()
+ -> mtk_hci_wmt_sync()
+ -> __hci_cmd_send()
+ -> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared
+
+-> btmtksdio_recv_event()
+ -> hci_recv_frame()
+ -> queue_work(hdev->workqueue, &hdev->rx_work)
+ -> clears BTMTKSDIO_TX_WAIT_VND_EVT
+
+So move the shutdown callback before flushing TX/RX queue to resolve the
+issue.
+
+Reported-and-tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Fixes: 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled")
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index ee59d1c7f1f6..7154af1fad81 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1734,6 +1734,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
+ hci_request_cancel_all(hdev);
+ hci_req_sync_lock(hdev);
+
++ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
++ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
++ test_bit(HCI_UP, &hdev->flags)) {
++ /* Execute vendor specific shutdown routine */
++ if (hdev->shutdown)
++ hdev->shutdown(hdev);
++ }
++
+ if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+ cancel_delayed_work_sync(&hdev->cmd_timer);
+ hci_req_sync_unlock(hdev);
+--
+2.30.2
+
--- /dev/null
+From 48ddd64cac47236522ed71d3949254774b228fa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 18:00:09 +0300
+Subject: Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ]
+
+Smatch complains that some of these struct members are not initialized
+leading to a stack information disclosure:
+
+ net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
+ check that 'cp.retrans_effort' doesn't leak information
+
+This seems like a valid warning. I've added a default case to fix
+this issue.
+
+Fixes: 2f69a82acf6f ("Bluetooth: Use voice setting in deferred SCO connection request")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 3bd41563f118..a7b4555f312f 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -773,6 +773,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
+ cp.max_latency = cpu_to_le16(0xffff);
+ cp.retrans_effort = 0xff;
+ break;
++ default:
++ /* use CVSD settings as fallback */
++ cp.max_latency = cpu_to_le16(0xffff);
++ cp.retrans_effort = 0xff;
++ break;
+ }
+
+ hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
+--
+2.30.2
+
--- /dev/null
+From 0398d22b96fd7b25228f39add8255693cb81aeb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 21:43:17 +0900
+Subject: bpf: Fix a typo of reuseport map in bpf.h.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
+
+[ Upstream commit f170acda7ffaf0473d06e1e17c12cd9fd63904f5 ]
+
+Fix s/BPF_MAP_TYPE_REUSEPORT_ARRAY/BPF_MAP_TYPE_REUSEPORT_SOCKARRAY/ typo
+in bpf.h.
+
+Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20210714124317.67526-1-kuniyu@amazon.co.jp
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h | 2 +-
+ tools/include/uapi/linux/bpf.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index ec6d85a81744..353f06cf210e 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -3222,7 +3222,7 @@ union bpf_attr {
+ * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags)
+ * Description
+ * Select a **SO_REUSEPORT** socket from a
+- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*.
++ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*.
+ * It checks the selected socket is matching the incoming
+ * request in the socket buffer.
+ * Return
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index ec6d85a81744..353f06cf210e 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -3222,7 +3222,7 @@ union bpf_attr {
+ * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags)
+ * Description
+ * Select a **SO_REUSEPORT** socket from a
+- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*.
++ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*.
+ * It checks the selected socket is matching the incoming
+ * request in the socket buffer.
+ * Return
+--
+2.30.2
+
--- /dev/null
+From 0a056ae268ef17520c513ab566ffd321ebf530bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 09:39:35 -0700
+Subject: bpf: Fix possible out of bound write in narrow load handling
+
+From: Andrey Ignatov <rdna@fb.com>
+
+[ Upstream commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 ]
+
+Fix a verifier bug found by smatch static checker in [0].
+
+This problem has never been seen in prod to my best knowledge. Fixing it
+still seems to be a good idea since it's hard to say for sure whether
+it's possible or not to have a scenario where a combination of
+convert_ctx_access() and a narrow load would lead to an out of bound
+write.
+
+When narrow load is handled, one or two new instructions are added to
+insn_buf array, but before it was only checked that
+
+ cnt >= ARRAY_SIZE(insn_buf)
+
+And it's safe to add a new instruction to insn_buf[cnt++] only once. The
+second try will lead to out of bound write. And this is what can happen
+if `shift` is set.
+
+Fix it by making sure that if the BPF_RSH instruction has to be added in
+addition to BPF_AND then there is enough space for two more instructions
+in insn_buf.
+
+The full report [0] is below:
+
+kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array
+kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array
+
+kernel/bpf/verifier.c
+ 12282
+ 12283 insn->off = off & ~(size_default - 1);
+ 12284 insn->code = BPF_LDX | BPF_MEM | size_code;
+ 12285 }
+ 12286
+ 12287 target_size = 0;
+ 12288 cnt = convert_ctx_access(type, insn, insn_buf, env->prog,
+ 12289 &target_size);
+ 12290 if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) ||
+ ^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Bounds check.
+
+ 12291 (ctx_field_size && !target_size)) {
+ 12292 verbose(env, "bpf verifier is misconfigured\n");
+ 12293 return -EINVAL;
+ 12294 }
+ 12295
+ 12296 if (is_narrower_load && size < target_size) {
+ 12297 u8 shift = bpf_ctx_narrow_access_offset(
+ 12298 off, size, size_default) * 8;
+ 12299 if (ctx_field_size <= 4) {
+ 12300 if (shift)
+ 12301 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
+ ^^^^^
+increment beyond end of array
+
+ 12302 insn->dst_reg,
+ 12303 shift);
+--> 12304 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
+ ^^^^^
+out of bounds write
+
+ 12305 (1 << size * 8) - 1);
+ 12306 } else {
+ 12307 if (shift)
+ 12308 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
+ 12309 insn->dst_reg,
+ 12310 shift);
+ 12311 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
+ ^^^^^^^^^^^^^^^
+Same.
+
+ 12312 (1ULL << size * 8) - 1);
+ 12313 }
+ 12314 }
+ 12315
+ 12316 new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
+ 12317 if (!new_prog)
+ 12318 return -ENOMEM;
+ 12319
+ 12320 delta += cnt - 1;
+ 12321
+ 12322 /* keep walking new program and skip insns we just inserted */
+ 12323 env->prog = new_prog;
+ 12324 insn = new_prog->insnsi + i + delta;
+ 12325 }
+ 12326
+ 12327 return 0;
+ 12328 }
+
+[0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/
+
+v1->v2:
+- clarify that problem was only seen by static checker but not in prod;
+
+Fixes: 46f53a65d2de ("bpf: Allow narrow loads with offset > 0")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210820163935.1902398-1-rdna@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index c07126558bb7..d810f9e0ed9d 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -11982,6 +11982,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ if (is_narrower_load && size < target_size) {
+ u8 shift = bpf_ctx_narrow_access_offset(
+ off, size, size_default) * 8;
++ if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) {
++ verbose(env, "bpf verifier narrow ctx load misconfigured\n");
++ return -EINVAL;
++ }
+ if (ctx_field_size <= 4) {
+ if (shift)
+ insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
+--
+2.30.2
+
--- /dev/null
+From 52aa24048678c9cfa3a42f3b14f9dca1775b76c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 10:18:15 +0000
+Subject: bpf: Fix potential memleak and UAF in the verifier.
+
+From: He Fengqing <hefengqing@huawei.com>
+
+[ Upstream commit 75f0fc7b48ad45a2e5736bcf8de26c8872fe8695 ]
+
+In bpf_patch_insn_data(), we first use the bpf_patch_insn_single() to
+insert new instructions, then use adjust_insn_aux_data() to adjust
+insn_aux_data. If the old env->prog have no enough room for new inserted
+instructions, we use bpf_prog_realloc to construct new_prog and free the
+old env->prog.
+
+There have two errors here. First, if adjust_insn_aux_data() return
+ENOMEM, we should free the new_prog. Second, if adjust_insn_aux_data()
+return ENOMEM, bpf_patch_insn_data() will return NULL, and env->prog has
+been freed in bpf_prog_realloc, but we will use it in bpf_check().
+
+So in this patch, we make the adjust_insn_aux_data() never fails. In
+bpf_patch_insn_data(), we first pre-malloc memory for the new
+insn_aux_data, then call bpf_patch_insn_single() to insert new
+instructions, at last call adjust_insn_aux_data() to adjust
+insn_aux_data.
+
+Fixes: 8041902dae52 ("bpf: adjust insn_aux_data when patching insns")
+Signed-off-by: He Fengqing <hefengqing@huawei.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/bpf/20210714101815.164322-1-hefengqing@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 6b58fd978b70..c07126558bb7 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -11383,10 +11383,11 @@ static void convert_pseudo_ld_imm64(struct bpf_verifier_env *env)
+ * insni[off, off + cnt). Adjust corresponding insn_aux_data by copying
+ * [0, off) and [off, end) to new locations, so the patched range stays zero
+ */
+-static int adjust_insn_aux_data(struct bpf_verifier_env *env,
+- struct bpf_prog *new_prog, u32 off, u32 cnt)
++static void adjust_insn_aux_data(struct bpf_verifier_env *env,
++ struct bpf_insn_aux_data *new_data,
++ struct bpf_prog *new_prog, u32 off, u32 cnt)
+ {
+- struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data;
++ struct bpf_insn_aux_data *old_data = env->insn_aux_data;
+ struct bpf_insn *insn = new_prog->insnsi;
+ u32 old_seen = old_data[off].seen;
+ u32 prog_len;
+@@ -11399,12 +11400,9 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env,
+ old_data[off].zext_dst = insn_has_def32(env, insn + off + cnt - 1);
+
+ if (cnt == 1)
+- return 0;
++ return;
+ prog_len = new_prog->len;
+- new_data = vzalloc(array_size(prog_len,
+- sizeof(struct bpf_insn_aux_data)));
+- if (!new_data)
+- return -ENOMEM;
++
+ memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
+ memcpy(new_data + off + cnt - 1, old_data + off,
+ sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1));
+@@ -11415,7 +11413,6 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env,
+ }
+ env->insn_aux_data = new_data;
+ vfree(old_data);
+- return 0;
+ }
+
+ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len)
+@@ -11450,6 +11447,14 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
+ const struct bpf_insn *patch, u32 len)
+ {
+ struct bpf_prog *new_prog;
++ struct bpf_insn_aux_data *new_data = NULL;
++
++ if (len > 1) {
++ new_data = vzalloc(array_size(env->prog->len + len - 1,
++ sizeof(struct bpf_insn_aux_data)));
++ if (!new_data)
++ return NULL;
++ }
+
+ new_prog = bpf_patch_insn_single(env->prog, off, patch, len);
+ if (IS_ERR(new_prog)) {
+@@ -11457,10 +11462,10 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
+ verbose(env,
+ "insn %d cannot be patched due to 16-bit range\n",
+ env->insn_aux_data[off].orig_idx);
++ vfree(new_data);
+ return NULL;
+ }
+- if (adjust_insn_aux_data(env, new_prog, off, len))
+- return NULL;
++ adjust_insn_aux_data(env, new_data, new_prog, off, len);
+ adjust_subprog_starts(env, off, len);
+ adjust_poke_descs(new_prog, off, len);
+ return new_prog;
+--
+2.30.2
+
--- /dev/null
+From 514937e81addaea95b3dba2146b5398792fb3a9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jul 2021 17:56:32 -0700
+Subject: bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's
+ optstring
+
+From: Matthew Cover <werekraken@gmail.com>
+
+[ Upstream commit 34ad6d9d8c27293e1895b448af7d6cf5d351ad8d ]
+
+Commit ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program
+on cpumap") added the following option, but missed adding it to optstring:
+
+ - mprog-disable: disable loading XDP program on cpumap entries
+
+Fix it and add the missing option character.
+
+Fixes: ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program on cpumap")
+Signed-off-by: Matthew Cover <matthew.cover@stackpath.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20210731005632.13228-1-matthew.cover@stackpath.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/xdp_redirect_cpu_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c
+index 576411612523..c7d7d3586730 100644
+--- a/samples/bpf/xdp_redirect_cpu_user.c
++++ b/samples/bpf/xdp_redirect_cpu_user.c
+@@ -831,7 +831,7 @@ int main(int argc, char **argv)
+ memset(cpu, 0, n_cpus * sizeof(int));
+
+ /* Parse commands line args */
+- while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:",
++ while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:n",
+ long_options, &longindex)) != -1) {
+ switch (opt) {
+ case 'd':
+--
+2.30.2
+
--- /dev/null
+From d22846497780ed7f8970b7413f5ec5b21fb66031 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 11:48:32 -0700
+Subject: bpf, selftests: Fix test_maps now that sockmap supports UDP
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit c39aa21599748f3845a47645f482d94099b11460 ]
+
+UDP socket support was added recently so testing UDP insert failure is no
+longer correct and causes test_maps failure. The fix is easy though, we
+simply need to test that UDP is correctly added instead of blocked.
+
+Fixes: 122e6c79efe1c ("sock_map: Update sock type checks for UDP")
+Reported-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210720184832.452430-1-john.fastabend@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_maps.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 51adc42b2b40..aa38dc4a5e85 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -747,8 +747,8 @@ static void test_sockmap(unsigned int tasks, void *data)
+ udp = socket(AF_INET, SOCK_DGRAM, 0);
+ i = 0;
+ err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
+- if (!err) {
+- printf("Failed socket SOCK_DGRAM allowed '%i:%i'\n",
++ if (err) {
++ printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
+ i, udp);
+ goto out_sockmap;
+ }
+--
+2.30.2
+
--- /dev/null
+From 42f2b0f303d558cb891bc03b26c6e2e67b8c3e4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 08:35:22 +0200
+Subject: brcmfmac: pcie: fix oops on failure to resume and reprobe
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit d745ca4f2c4ae9f1bd8cf7d8ac6e22d739bffd19 ]
+
+When resuming from suspend, brcmf_pcie_pm_leave_D3 will first attempt a
+hot resume and then fall back to removing the PCI device and then
+reprobing. If this probe fails, the kernel will oops, because brcmf_err,
+which is called to report the failure will dereference the stale bus
+pointer. Open code and use the default bus-less brcmf_err to avoid this.
+
+Fixes: 8602e62441ab ("brcmfmac: pass bus to the __brcmf_err() in pcie.c")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210817063521.22450-1-a.fatoum@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+index 143a705b5cb3..4800e19bdcc3 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2075,7 +2075,7 @@ cleanup:
+
+ err = brcmf_pcie_probe(pdev, NULL);
+ if (err)
+- brcmf_err(bus, "probe after resume failed, err=%d\n", err);
++ __brcmf_err(NULL, __func__, "probe after resume failed, err=%d\n", err);
+
+ return err;
+ }
+--
+2.30.2
+
--- /dev/null
+From 0cf1ca1bf6a4ccd7cd0261e9f31df647798eab59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 17:34:20 -0400
+Subject: certs: Trigger creation of RSA module signing key if it's not an RSA
+ key
+
+From: Stefan Berger <stefanb@linux.ibm.com>
+
+[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ]
+
+Address a kbuild issue where a developer created an ECDSA key for signing
+kernel modules and then builds an older version of the kernel, when bi-
+secting the kernel for example, that does not support ECDSA keys.
+
+If openssl is installed, trigger the creation of an RSA module signing
+key if it is not an RSA key.
+
+Fixes: cfc411e7fff3 ("Move certificate handling to its own directory")
+Cc: David Howells <dhowells@redhat.com>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ certs/Makefile | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/certs/Makefile b/certs/Makefile
+index 359239a0ee9e..f9344e52ecda 100644
+--- a/certs/Makefile
++++ b/certs/Makefile
+@@ -57,11 +57,19 @@ endif
+ redirect_openssl = 2>&1
+ quiet_redirect_openssl = 2>&1
+ silent_redirect_openssl = 2>/dev/null
++openssl_available = $(shell openssl help 2>/dev/null && echo yes)
+
+ # We do it this way rather than having a boolean option for enabling an
+ # external private key, because 'make randconfig' might enable such a
+ # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
+ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
++
++ifeq ($(openssl_available),yes)
++X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
++
++$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
++endif
++
+ $(obj)/signing_key.pem: $(obj)/x509.genkey
+ @$(kecho) "###"
+ @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
+--
+2.30.2
+
--- /dev/null
+From f3ec3ab6ad2dbfb55a25f600fecacd6967631c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 10:18:27 -0400
+Subject: cgroup/cpuset: Fix a partition bug with hotplug
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 15d428e6fe77fffc3f4fff923336036f5496ef17 ]
+
+In cpuset_hotplug_workfn(), the detection of whether the cpu list
+has been changed is done by comparing the effective cpus of the top
+cpuset with the cpu_active_mask. However, in the rare case that just
+all the CPUs in the subparts_cpus are offlined, the detection fails
+and the partition states are not updated correctly. Fix it by forcing
+the cpus_updated flag to true in this particular case.
+
+Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index adb5190c4429..592e9e37542f 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -3168,6 +3168,13 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
+ cpus_updated = !cpumask_equal(top_cpuset.effective_cpus, &new_cpus);
+ mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems);
+
++ /*
++ * In the rare case that hotplug removes all the cpus in subparts_cpus,
++ * we assumed that cpus are updated.
++ */
++ if (!cpus_updated && top_cpuset.nr_subparts_cpus)
++ cpus_updated = true;
++
+ /* synchronize cpus_allowed to cpu_active_mask */
+ if (cpus_updated) {
+ spin_lock_irq(&callback_lock);
+--
+2.30.2
+
--- /dev/null
+From b7a79d57ef8c8a1eb759452a4b2af933cad821f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 10:18:28 -0400
+Subject: cgroup/cpuset: Fix violation of cpuset locking rule
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 6ba34d3c73674e46d9e126e4f0cee79e5ef2481c ]
+
+The cpuset fields that manage partition root state do not strictly
+follow the cpuset locking rule that update to cpuset has to be done
+with both the callback_lock and cpuset_mutex held. This is now fixed
+by making sure that the locking rule is upheld.
+
+Fixes: 3881b86128d0 ("cpuset: Add an error state to cpuset.sched.partition")
+Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition")
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 58 +++++++++++++++++++++++++-----------------
+ 1 file changed, 35 insertions(+), 23 deletions(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 28a784bf64b1..13b5be6df4da 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1148,6 +1148,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ struct cpuset *parent = parent_cs(cpuset);
+ int adding; /* Moving cpus from effective_cpus to subparts_cpus */
+ int deleting; /* Moving cpus from subparts_cpus to effective_cpus */
++ int new_prs;
+ bool part_error = false; /* Partition error? */
+
+ percpu_rwsem_assert_held(&cpuset_rwsem);
+@@ -1183,6 +1184,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ * A cpumask update cannot make parent's effective_cpus become empty.
+ */
+ adding = deleting = false;
++ new_prs = cpuset->partition_root_state;
+ if (cmd == partcmd_enable) {
+ cpumask_copy(tmp->addmask, cpuset->cpus_allowed);
+ adding = true;
+@@ -1247,11 +1249,11 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ switch (cpuset->partition_root_state) {
+ case PRS_ENABLED:
+ if (part_error)
+- cpuset->partition_root_state = PRS_ERROR;
++ new_prs = PRS_ERROR;
+ break;
+ case PRS_ERROR:
+ if (!part_error)
+- cpuset->partition_root_state = PRS_ENABLED;
++ new_prs = PRS_ENABLED;
+ break;
+ }
+ /*
+@@ -1260,10 +1262,10 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ part_error = (prev_prs == PRS_ERROR);
+ }
+
+- if (!part_error && (cpuset->partition_root_state == PRS_ERROR))
++ if (!part_error && (new_prs == PRS_ERROR))
+ return 0; /* Nothing need to be done */
+
+- if (cpuset->partition_root_state == PRS_ERROR) {
++ if (new_prs == PRS_ERROR) {
+ /*
+ * Remove all its cpus from parent's subparts_cpus.
+ */
+@@ -1272,7 +1274,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ parent->subparts_cpus);
+ }
+
+- if (!adding && !deleting)
++ if (!adding && !deleting && (new_prs == cpuset->partition_root_state))
+ return 0;
+
+ /*
+@@ -1299,6 +1301,9 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ }
+
+ parent->nr_subparts_cpus = cpumask_weight(parent->subparts_cpus);
++
++ if (cpuset->partition_root_state != new_prs)
++ cpuset->partition_root_state = new_prs;
+ spin_unlock_irq(&callback_lock);
+
+ return cmd == partcmd_update;
+@@ -1321,6 +1326,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ struct cpuset *cp;
+ struct cgroup_subsys_state *pos_css;
+ bool need_rebuild_sched_domains = false;
++ int new_prs;
+
+ rcu_read_lock();
+ cpuset_for_each_descendant_pre(cp, pos_css, cs) {
+@@ -1360,7 +1366,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ * update_tasks_cpumask() again for tasks in the parent
+ * cpuset if the parent's subparts_cpus changes.
+ */
+- if ((cp != cs) && cp->partition_root_state) {
++ new_prs = cp->partition_root_state;
++ if ((cp != cs) && new_prs) {
+ switch (parent->partition_root_state) {
+ case PRS_DISABLED:
+ /*
+@@ -1370,7 +1377,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ */
+ WARN_ON_ONCE(cp->partition_root_state
+ != PRS_ERROR);
+- cp->partition_root_state = PRS_DISABLED;
++ new_prs = PRS_DISABLED;
+
+ /*
+ * clear_bit() is an atomic operation and
+@@ -1391,11 +1398,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ /*
+ * When parent is invalid, it has to be too.
+ */
+- cp->partition_root_state = PRS_ERROR;
+- if (cp->nr_subparts_cpus) {
+- cp->nr_subparts_cpus = 0;
+- cpumask_clear(cp->subparts_cpus);
+- }
++ new_prs = PRS_ERROR;
+ break;
+ }
+ }
+@@ -1407,8 +1410,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ spin_lock_irq(&callback_lock);
+
+ cpumask_copy(cp->effective_cpus, tmp->new_cpus);
+- if (cp->nr_subparts_cpus &&
+- (cp->partition_root_state != PRS_ENABLED)) {
++ if (cp->nr_subparts_cpus && (new_prs != PRS_ENABLED)) {
+ cp->nr_subparts_cpus = 0;
+ cpumask_clear(cp->subparts_cpus);
+ } else if (cp->nr_subparts_cpus) {
+@@ -1435,6 +1437,10 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ = cpumask_weight(cp->subparts_cpus);
+ }
+ }
++
++ if (new_prs != cp->partition_root_state)
++ cp->partition_root_state = new_prs;
++
+ spin_unlock_irq(&callback_lock);
+
+ WARN_ON(!is_in_v2_mode() &&
+@@ -1944,25 +1950,25 @@ out:
+ */
+ static int update_prstate(struct cpuset *cs, int new_prs)
+ {
+- int err;
++ int err, old_prs = cs->partition_root_state;
+ struct cpuset *parent = parent_cs(cs);
+ struct tmpmasks tmpmask;
+
+- if (new_prs == cs->partition_root_state)
++ if (old_prs == new_prs)
+ return 0;
+
+ /*
+ * Cannot force a partial or invalid partition root to a full
+ * partition root.
+ */
+- if (new_prs && (cs->partition_root_state < 0))
++ if (new_prs && (old_prs == PRS_ERROR))
+ return -EINVAL;
+
+ if (alloc_cpumasks(NULL, &tmpmask))
+ return -ENOMEM;
+
+ err = -EINVAL;
+- if (!cs->partition_root_state) {
++ if (!old_prs) {
+ /*
+ * Turning on partition root requires setting the
+ * CS_CPU_EXCLUSIVE bit implicitly as well and cpus_allowed
+@@ -1981,14 +1987,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+ goto out;
+ }
+- cs->partition_root_state = PRS_ENABLED;
+ } else {
+ /*
+ * Turning off partition root will clear the
+ * CS_CPU_EXCLUSIVE bit.
+ */
+- if (cs->partition_root_state == PRS_ERROR) {
+- cs->partition_root_state = PRS_DISABLED;
++ if (old_prs == PRS_ERROR) {
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+ err = 0;
+ goto out;
+@@ -1999,8 +2003,6 @@ static int update_prstate(struct cpuset *cs, int new_prs)
+ if (err)
+ goto out;
+
+- cs->partition_root_state = PRS_DISABLED;
+-
+ /* Turning off CS_CPU_EXCLUSIVE will not return error */
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+ }
+@@ -2017,6 +2019,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)
+
+ rebuild_sched_domains_locked();
+ out:
++ if (!err) {
++ spin_lock_irq(&callback_lock);
++ cs->partition_root_state = new_prs;
++ spin_unlock_irq(&callback_lock);
++ }
++
+ free_cpumasks(NULL, &tmpmask);
+ return err;
+ }
+@@ -3080,8 +3088,10 @@ retry:
+ if (is_partition_root(cs) && (cpumask_empty(&new_cpus) ||
+ (parent->partition_root_state == PRS_ERROR))) {
+ if (cs->nr_subparts_cpus) {
++ spin_lock_irq(&callback_lock);
+ cs->nr_subparts_cpus = 0;
+ cpumask_clear(cs->subparts_cpus);
++ spin_unlock_irq(&callback_lock);
+ compute_effective_cpumask(&new_cpus, cs, parent);
+ }
+
+@@ -3095,7 +3105,9 @@ retry:
+ cpumask_empty(&new_cpus)) {
+ update_parent_subparts_cpumask(cs, partcmd_disable,
+ NULL, tmp);
++ spin_lock_irq(&callback_lock);
+ cs->partition_root_state = PRS_ERROR;
++ spin_unlock_irq(&callback_lock);
+ }
+ cpuset_force_rebuild();
+ }
+--
+2.30.2
+
--- /dev/null
+From ead072f22d2b758bfd2129933d63336f0b3a089e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jul 2021 10:18:26 -0400
+Subject: cgroup/cpuset: Miscellaneous code cleanup
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit 0f3adb8a1e5f36e792598c1d77a2cfac9c90a4f9 ]
+
+Use more descriptive variable names for update_prstate(), remove
+unnecessary code and fix some typos. There is no functional change.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cpuset.c | 40 +++++++++++++++++++---------------------
+ 1 file changed, 19 insertions(+), 21 deletions(-)
+
+diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
+index 592e9e37542f..28a784bf64b1 100644
+--- a/kernel/cgroup/cpuset.c
++++ b/kernel/cgroup/cpuset.c
+@@ -1114,7 +1114,7 @@ enum subparts_cmd {
+ * cpus_allowed can be granted or an error code will be returned.
+ *
+ * For partcmd_disable, the cpuset is being transofrmed from a partition
+- * root back to a non-partition root. any CPUs in cpus_allowed that are in
++ * root back to a non-partition root. Any CPUs in cpus_allowed that are in
+ * parent's subparts_cpus will be taken away from that cpumask and put back
+ * into parent's effective_cpus. 0 should always be returned.
+ *
+@@ -1225,7 +1225,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
+ /*
+ * partcmd_update w/o newmask:
+ *
+- * addmask = cpus_allowed & parent->effectiveb_cpus
++ * addmask = cpus_allowed & parent->effective_cpus
+ *
+ * Note that parent's subparts_cpus may have been
+ * pre-shrunk in case there is a change in the cpu list.
+@@ -1365,12 +1365,12 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
+ case PRS_DISABLED:
+ /*
+ * If parent is not a partition root or an
+- * invalid partition root, clear the state
+- * state and the CS_CPU_EXCLUSIVE flag.
++ * invalid partition root, clear its state
++ * and its CS_CPU_EXCLUSIVE flag.
+ */
+ WARN_ON_ONCE(cp->partition_root_state
+ != PRS_ERROR);
+- cp->partition_root_state = 0;
++ cp->partition_root_state = PRS_DISABLED;
+
+ /*
+ * clear_bit() is an atomic operation and
+@@ -1937,30 +1937,28 @@ out:
+
+ /*
+ * update_prstate - update partititon_root_state
+- * cs: the cpuset to update
+- * val: 0 - disabled, 1 - enabled
++ * cs: the cpuset to update
++ * new_prs: new partition root state
+ *
+ * Call with cpuset_mutex held.
+ */
+-static int update_prstate(struct cpuset *cs, int val)
++static int update_prstate(struct cpuset *cs, int new_prs)
+ {
+ int err;
+ struct cpuset *parent = parent_cs(cs);
+- struct tmpmasks tmp;
++ struct tmpmasks tmpmask;
+
+- if ((val != 0) && (val != 1))
+- return -EINVAL;
+- if (val == cs->partition_root_state)
++ if (new_prs == cs->partition_root_state)
+ return 0;
+
+ /*
+ * Cannot force a partial or invalid partition root to a full
+ * partition root.
+ */
+- if (val && cs->partition_root_state)
++ if (new_prs && (cs->partition_root_state < 0))
+ return -EINVAL;
+
+- if (alloc_cpumasks(NULL, &tmp))
++ if (alloc_cpumasks(NULL, &tmpmask))
+ return -ENOMEM;
+
+ err = -EINVAL;
+@@ -1978,7 +1976,7 @@ static int update_prstate(struct cpuset *cs, int val)
+ goto out;
+
+ err = update_parent_subparts_cpumask(cs, partcmd_enable,
+- NULL, &tmp);
++ NULL, &tmpmask);
+ if (err) {
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+ goto out;
+@@ -1990,18 +1988,18 @@ static int update_prstate(struct cpuset *cs, int val)
+ * CS_CPU_EXCLUSIVE bit.
+ */
+ if (cs->partition_root_state == PRS_ERROR) {
+- cs->partition_root_state = 0;
++ cs->partition_root_state = PRS_DISABLED;
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+ err = 0;
+ goto out;
+ }
+
+ err = update_parent_subparts_cpumask(cs, partcmd_disable,
+- NULL, &tmp);
++ NULL, &tmpmask);
+ if (err)
+ goto out;
+
+- cs->partition_root_state = 0;
++ cs->partition_root_state = PRS_DISABLED;
+
+ /* Turning off CS_CPU_EXCLUSIVE will not return error */
+ update_flag(CS_CPU_EXCLUSIVE, cs, 0);
+@@ -2015,11 +2013,11 @@ static int update_prstate(struct cpuset *cs, int val)
+ update_tasks_cpumask(parent);
+
+ if (parent->child_ecpus_count)
+- update_sibling_cpumasks(parent, cs, &tmp);
++ update_sibling_cpumasks(parent, cs, &tmpmask);
+
+ rebuild_sched_domains_locked();
+ out:
+- free_cpumasks(NULL, &tmp);
++ free_cpumasks(NULL, &tmpmask);
+ return err;
+ }
+
+@@ -3060,7 +3058,7 @@ retry:
+ goto retry;
+ }
+
+- parent = parent_cs(cs);
++ parent = parent_cs(cs);
+ compute_effective_cpumask(&new_cpus, cs, parent);
+ nodes_and(new_mems, cs->mems_allowed, parent->effective_mems);
+
+--
+2.30.2
+
--- /dev/null
+From e05b648d3df1e46ab4b95bdb80cae8e384723036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 12:27:09 +0200
+Subject: CIFS: Fix a potencially linear read overflow
+
+From: Len Baker <len.baker@gmx.com>
+
+[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]
+
+strlcpy() reads the entire source buffer first. This read may exceed the
+destination size limit. This is both inefficient and can lead to linear
+read overflows if a source string is not NUL-terminated.
+
+Also, the strnlen() call does not avoid the read overflow in the strlcpy
+function when a not NUL-terminated string is passed.
+
+So, replace this block by a call to kstrndup() that avoids this type of
+overflow and does the same.
+
+Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
+Signed-off-by: Len Baker <len.baker@gmx.com>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_unicode.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index 9bd03a231032..171ad8b42107 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
+ if (!dst)
+ return NULL;
+ cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
+- NO_MAP_UNI_RSVD);
++ NO_MAP_UNI_RSVD);
+ } else {
+- len = strnlen(src, maxlen);
+- len++;
+- dst = kmalloc(len, GFP_KERNEL);
+- if (!dst)
+- return NULL;
+- strlcpy(dst, src, len);
++ dst = kstrndup(src, maxlen, GFP_KERNEL);
+ }
+
+ return dst;
+--
+2.30.2
+
--- /dev/null
+From db0925d4eee92e594c9e8ed0d03a10b6d09ad2c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 12:54:04 +0200
+Subject: clk: staging: correct reference to config IOMEM to config HAS_IOMEM
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit cbfa6f33e3a685c329d78e06b0cf1dcb23c9d849 ]
+
+Commit 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx
+Clocking Wizard driver") introduces a dependency on the non-existing config
+IOMEM, which basically makes it impossible to include this driver into any
+build. Fortunately, ./scripts/checkkconfigsymbols.py warns:
+
+IOMEM
+Referencing files: drivers/staging/clocking-wizard/Kconfig
+
+The config for IOMEM support is called HAS_IOMEM. Correct this reference to
+the intended config.
+
+Fixes: 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx Clocking Wizard driver")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Link: https://lore.kernel.org/r/20210817105404.13146-1-lukas.bulwahn@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/clocking-wizard/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/clocking-wizard/Kconfig b/drivers/staging/clocking-wizard/Kconfig
+index 69cf51445f08..2324b5d73788 100644
+--- a/drivers/staging/clocking-wizard/Kconfig
++++ b/drivers/staging/clocking-wizard/Kconfig
+@@ -5,6 +5,6 @@
+
+ config COMMON_CLK_XLNX_CLKWZRD
+ tristate "Xilinx Clocking Wizard"
+- depends on COMMON_CLK && OF && IOMEM
++ depends on COMMON_CLK && OF && HAS_IOMEM
+ help
+ Support for the Xilinx Clocking Wizard IP core clock generator.
+--
+2.30.2
+
--- /dev/null
+From e11df3f52341a52b239487ac1a2b0c7377704876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Apr 2021 14:34:43 +0200
+Subject: clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ
+ for clock source channel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Phong Hoang <phong.hoang.wz@renesas.com>
+
+[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ]
+
+If CMT instance has at least two channels, one channel will be used
+as a clock source and another one used as a clock event device.
+In that case, IRQ is not requested for clock source channel so
+sh_cmt_clock_event_program_verify() might work incorrectly.
+Besides, when a channel is only used for clock source, don't need to
+re-set the next match_value since it should be maximum timeout as
+it still is.
+
+On the other hand, due to no IRQ, total_cycles is not counted up
+when reaches compare match time (timer counter resets to zero),
+so sh_cmt_clocksource_read() returns unexpected value.
+Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants
+will also lead to wrong delta calculation. Hence, this mask should
+correspond to timer counter width, and above function just returns
+the raw value of timer counter register.
+
+Fixes: bfa76bb12f23 ("clocksource: sh_cmt: Request IRQ for clock event device only")
+Fixes: 37e7742c55ba ("clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines")
+Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20210422123443.73334-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
+index d7ed99f0001f..dd0956ad969c 100644
+--- a/drivers/clocksource/sh_cmt.c
++++ b/drivers/clocksource/sh_cmt.c
+@@ -579,7 +579,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag)
+ ch->flags |= flag;
+
+ /* setup timeout if no clockevent */
+- if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT)))
++ if (ch->cmt->num_channels == 1 &&
++ flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT)))
+ __sh_cmt_set_next(ch, ch->max_match_value);
+ out:
+ raw_spin_unlock_irqrestore(&ch->lock, flags);
+@@ -621,20 +622,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
+ static u64 sh_cmt_clocksource_read(struct clocksource *cs)
+ {
+ struct sh_cmt_channel *ch = cs_to_sh_cmt(cs);
+- unsigned long flags;
+ u32 has_wrapped;
+- u64 value;
+- u32 raw;
+
+- raw_spin_lock_irqsave(&ch->lock, flags);
+- value = ch->total_cycles;
+- raw = sh_cmt_get_counter(ch, &has_wrapped);
++ if (ch->cmt->num_channels == 1) {
++ unsigned long flags;
++ u64 value;
++ u32 raw;
+
+- if (unlikely(has_wrapped))
+- raw += ch->match_value + 1;
+- raw_spin_unlock_irqrestore(&ch->lock, flags);
++ raw_spin_lock_irqsave(&ch->lock, flags);
++ value = ch->total_cycles;
++ raw = sh_cmt_get_counter(ch, &has_wrapped);
++
++ if (unlikely(has_wrapped))
++ raw += ch->match_value + 1;
++ raw_spin_unlock_irqrestore(&ch->lock, flags);
++
++ return value + raw;
++ }
+
+- return value + raw;
++ return sh_cmt_get_counter(ch, &has_wrapped);
+ }
+
+ static int sh_cmt_clocksource_enable(struct clocksource *cs)
+@@ -697,7 +703,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch,
+ cs->disable = sh_cmt_clocksource_disable;
+ cs->suspend = sh_cmt_clocksource_suspend;
+ cs->resume = sh_cmt_clocksource_resume;
+- cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8);
++ cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width);
+ cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
+
+ dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
+--
+2.30.2
+
--- /dev/null
+From cec8f92a2ef3da2271dd22c3c381dad317152642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 21:06:11 +0900
+Subject: counter: 104-quad-8: Return error when invalid mode during
+ ceiling_write
+
+From: William Breathitt Gray <vilhelm.gray@gmail.com>
+
+[ Upstream commit 728246e8f7269ecd35a2c6e6795323e6d8f48db7 ]
+
+The 104-QUAD-8 only has two count modes where a ceiling value makes
+sense: Range Limit and Modulo-N. Outside of these two modes, setting a
+ceiling value is an invalid operation -- so let's report it as such by
+returning -EINVAL.
+
+Fixes: fc069262261c ("counter: 104-quad-8: Add lock guards - generic interface")
+Acked-by: Syed Nayyar Waris <syednwaris@gmail.com>
+Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Link: https://lore.kernel.org/r/a2147f022829b66839a1db5530a7fada47856847.1627990337.git.vilhelm.gray@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/counter/104-quad-8.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
+index 9691f8612be8..8de776f3b142 100644
+--- a/drivers/counter/104-quad-8.c
++++ b/drivers/counter/104-quad-8.c
+@@ -715,12 +715,13 @@ static ssize_t quad8_count_ceiling_write(struct counter_device *counter,
+ case 1:
+ case 3:
+ quad8_preset_register_set(priv, count->id, ceiling);
+- break;
++ mutex_unlock(&priv->lock);
++ return len;
+ }
+
+ mutex_unlock(&priv->lock);
+
+- return len;
++ return -EINVAL;
+ }
+
+ static ssize_t quad8_count_preset_enable_read(struct counter_device *counter,
+--
+2.30.2
+
--- /dev/null
+From 5eaa5762ac66ed0746402b16e085240e8b387b87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 10:39:05 +0200
+Subject: crypto: ecc - handle unaligned input buffer in ecc_swap_digits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mian Yousaf Kaukab <ykaukab@suse.de>
+
+[ Upstream commit 0469dede0eeeefe12a9a2fd76078f4a266513457 ]
+
+ecdsa_set_pub_key() makes an u64 pointer at 1 byte offset of the key.
+This results in an unaligned u64 pointer. This pointer is passed to
+ecc_swap_digits() which assumes natural alignment.
+
+This causes a kernel crash on an armv7 platform:
+[ 0.409022] Unhandled fault: alignment exception (0x001) at 0xc2a0a6a9
+...
+[ 0.416982] PC is at ecdsa_set_pub_key+0xdc/0x120
+...
+[ 0.491492] Backtrace:
+[ 0.492059] [<c07c266c>] (ecdsa_set_pub_key) from [<c07c75d4>] (test_akcipher_one+0xf4/0x6c0)
+
+Handle unaligned input buffer in ecc_swap_digits() by replacing
+be64_to_cpu() to get_unaligned_be64(). Change type of in pointer to
+void to reflect it doesn’t necessarily need to be aligned.
+
+Fixes: 4e6602916bc6 ("crypto: ecdsa - Add support for ECDSA signature verification")
+Reported-by: Guillaume Gardet <guillaume.gardet@arm.com>
+Suggested-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mian Yousaf Kaukab <ykaukab@suse.de>
+Tested-by: Stefan Berger <stefanb@linux.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecc.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/ecc.h b/crypto/ecc.h
+index a006132646a4..1350e8eb6ac2 100644
+--- a/crypto/ecc.h
++++ b/crypto/ecc.h
+@@ -27,6 +27,7 @@
+ #define _CRYPTO_ECC_H
+
+ #include <crypto/ecc_curve.h>
++#include <asm/unaligned.h>
+
+ /* One digit is u64 qword. */
+ #define ECC_CURVE_NIST_P192_DIGITS 3
+@@ -46,13 +47,13 @@
+ * @out: Output array
+ * @ndigits: Number of digits to copy
+ */
+-static inline void ecc_swap_digits(const u64 *in, u64 *out, unsigned int ndigits)
++static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigits)
+ {
+ const __be64 *src = (__force __be64 *)in;
+ int i;
+
+ for (i = 0; i < ndigits; i++)
+- out[i] = be64_to_cpu(src[ndigits - 1 - i]);
++ out[i] = get_unaligned_be64(&src[ndigits - 1 - i]);
+ }
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From cbd3823c78dcaa1c59f402546f1dc45b2106c2b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 15:41:01 +0800
+Subject: crypto: hisilicon/sec - fix the abnormal exiting process
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit 90367a027a22c3a9ca8b8bac15df34d9e859fc11 ]
+
+Because the algs registration process has added a judgment.
+So need to add the judgment for the abnormal exiting process.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 6f0062d4408c..e682e2a77b70 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -921,7 +921,8 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ return 0;
+
+ err_alg_unregister:
+- hisi_qm_alg_unregister(qm, &sec_devices);
++ if (qm->qp_num >= ctx_q_num)
++ hisi_qm_alg_unregister(qm, &sec_devices);
+ err_qm_stop:
+ sec_debugfs_exit(qm);
+ hisi_qm_stop(qm, QM_NORMAL);
+--
+2.30.2
+
--- /dev/null
+From e2fe629c62f11168d55fc03815d0c616e4ba8c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 15:41:02 +0800
+Subject: crypto: hisilicon/sec - modify the hardware endian configuration
+
+From: Kai Ye <yekai13@huawei.com>
+
+[ Upstream commit a52626106d6f7edf3d106c065e13a0313cfeb82f ]
+
+When the endian configuration of the hardware is abnormal, it will
+cause the SEC engine is faulty that reports empty message. And it
+will affect the normal function of the hardware. Currently the soft
+configuration method can't restore the faulty device. The endian
+needs to be configured according to the system properties. So fix it.
+
+Signed-off-by: Kai Ye <yekai13@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h | 5 ----
+ drivers/crypto/hisilicon/sec2/sec_main.c | 31 +++++++-----------------
+ 2 files changed, 9 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index dfdce2f21e65..1aeb53f28edd 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -140,11 +140,6 @@ struct sec_ctx {
+ struct device *dev;
+ };
+
+-enum sec_endian {
+- SEC_LE = 0,
+- SEC_32BE,
+- SEC_64BE
+-};
+
+ enum sec_debug_file_index {
+ SEC_CLEAR_ENABLE,
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index e682e2a77b70..0305e656b477 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -304,31 +304,20 @@ static const struct pci_device_id sec_dev_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(pci, sec_dev_ids);
+
+-static u8 sec_get_endian(struct hisi_qm *qm)
++static void sec_set_endian(struct hisi_qm *qm)
+ {
+ u32 reg;
+
+- /*
+- * As for VF, it is a wrong way to get endian setting by
+- * reading a register of the engine
+- */
+- if (qm->pdev->is_virtfn) {
+- dev_err_ratelimited(&qm->pdev->dev,
+- "cannot access a register in VF!\n");
+- return SEC_LE;
+- }
+ reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG);
+- /* BD little endian mode */
+- if (!(reg & BIT(0)))
+- return SEC_LE;
++ reg &= ~(BIT(1) | BIT(0));
++ if (!IS_ENABLED(CONFIG_64BIT))
++ reg |= BIT(1);
+
+- /* BD 32-bits big endian mode */
+- else if (!(reg & BIT(1)))
+- return SEC_32BE;
+
+- /* BD 64-bits big endian mode */
+- else
+- return SEC_64BE;
++ if (!IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN))
++ reg |= BIT(0);
++
++ writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+ }
+
+ static int sec_engine_init(struct hisi_qm *qm)
+@@ -382,9 +371,7 @@ static int sec_engine_init(struct hisi_qm *qm)
+ qm->io_base + SEC_BD_ERR_CHK_EN_REG3);
+
+ /* config endian */
+- reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG);
+- reg |= sec_get_endian(qm);
+- writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
++ sec_set_endian(qm);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 18393cab7130f0d2d6236f217aa8cb5da390077d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 14:56:37 -0400
+Subject: crypto: mxs-dcp - Check for DMA mapping errors
+
+From: Sean Anderson <sean.anderson@seco.com>
+
+[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ]
+
+After calling dma_map_single(), we must also call dma_mapping_error().
+This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG:
+
+[ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c
+[ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single]
+
+Signed-off-by: Sean Anderson <sean.anderson@seco.com>
+Reviewed-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++---------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
+index d6a7784d2988..f397cc5bf102 100644
+--- a/drivers/crypto/mxs-dcp.c
++++ b/drivers/crypto/mxs-dcp.c
+@@ -170,15 +170,19 @@ static struct dcp *global_sdcp;
+
+ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
+ {
++ int dma_err;
+ struct dcp *sdcp = global_sdcp;
+ const int chan = actx->chan;
+ uint32_t stat;
+ unsigned long ret;
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+-
+ dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc),
+ DMA_TO_DEVICE);
+
++ dma_err = dma_mapping_error(sdcp->dev, desc_phys);
++ if (dma_err)
++ return dma_err;
++
+ reinit_completion(&sdcp->completion[chan]);
+
+ /* Clear status register. */
+@@ -216,18 +220,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
+ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ struct skcipher_request *req, int init)
+ {
++ dma_addr_t key_phys, src_phys, dst_phys;
+ struct dcp *sdcp = global_sdcp;
+ struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
+ struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req);
+ int ret;
+
+- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
+- 2 * AES_KEYSIZE_128,
+- DMA_TO_DEVICE);
+- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
+- DCP_BUF_SZ, DMA_TO_DEVICE);
+- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+- DCP_BUF_SZ, DMA_FROM_DEVICE);
++ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
++ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, key_phys);
++ if (ret)
++ return ret;
++
++ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
++ DCP_BUF_SZ, DMA_TO_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, src_phys);
++ if (ret)
++ goto err_src;
++
++ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
++ DCP_BUF_SZ, DMA_FROM_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, dst_phys);
++ if (ret)
++ goto err_dst;
+
+ if (actx->fill % AES_BLOCK_SIZE) {
+ dev_err(sdcp->dev, "Invalid block size!\n");
+@@ -265,10 +280,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
+ ret = mxs_dcp_start_dma(actx);
+
+ aes_done_run:
++ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
++err_dst:
++ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
++err_src:
+ dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
+ DMA_TO_DEVICE);
+- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
+
+ return ret;
+ }
+@@ -557,6 +574,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf,
+ DCP_BUF_SZ, DMA_TO_DEVICE);
+
++ ret = dma_mapping_error(sdcp->dev, buf_phys);
++ if (ret)
++ return ret;
++
+ /* Fill in the DMA descriptor. */
+ desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
+ MXS_DCP_CONTROL0_INTERRUPT |
+@@ -589,6 +610,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
+ if (rctx->fini) {
+ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
+ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
++ ret = dma_mapping_error(sdcp->dev, digest_phys);
++ if (ret)
++ goto done_run;
++
+ desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
+ desc->payload = digest_phys;
+ }
+--
+2.30.2
+
--- /dev/null
+From 471c2a6f3953fbaa8ebb7c131f5e3b3cbe9b1fd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 02:06:09 +0200
+Subject: crypto: omap - Fix inconsistent locking of device lists
+
+From: Ben Hutchings <ben.hutchings@mind.be>
+
+[ Upstream commit fe4d55773b879c785ae61da9b1c2160f0110f67e ]
+
+lockdep complains that in omap-aes, the list_lock is taken both with
+softirqs enabled at probe time, and also in softirq context, which
+could lead to a deadlock:
+
+ ================================
+ WARNING: inconsistent lock state
+ 5.14.0-rc1-00035-gc836005b01c5-dirty #69 Not tainted
+ --------------------------------
+ inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
+ ksoftirqd/0/7 [HC0[0]:SC1[3]:HE1:SE0] takes:
+ bf00e014 (list_lock){+.?.}-{2:2}, at: omap_aes_find_dev+0x18/0x54 [omap_aes_driver]
+ {SOFTIRQ-ON-W} state was registered at:
+ _raw_spin_lock+0x40/0x50
+ omap_aes_probe+0x1d4/0x664 [omap_aes_driver]
+ platform_probe+0x58/0xb8
+ really_probe+0xbc/0x314
+ __driver_probe_device+0x80/0xe4
+ driver_probe_device+0x30/0xc8
+ __driver_attach+0x70/0xf4
+ bus_for_each_dev+0x70/0xb4
+ bus_add_driver+0xf0/0x1d4
+ driver_register+0x74/0x108
+ do_one_initcall+0x84/0x2e4
+ do_init_module+0x5c/0x240
+ load_module+0x221c/0x2584
+ sys_finit_module+0xb0/0xec
+ ret_fast_syscall+0x0/0x2c
+ 0xbed90b30
+ irq event stamp: 111800
+ hardirqs last enabled at (111800): [<c02a21e4>] __kmalloc+0x484/0x5ec
+ hardirqs last disabled at (111799): [<c02a21f0>] __kmalloc+0x490/0x5ec
+ softirqs last enabled at (111776): [<c01015f0>] __do_softirq+0x2b8/0x4d0
+ softirqs last disabled at (111781): [<c0135948>] run_ksoftirqd+0x34/0x50
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(list_lock);
+ <Interrupt>
+ lock(list_lock);
+
+ *** DEADLOCK ***
+
+ 2 locks held by ksoftirqd/0/7:
+ #0: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0x6c/0x260
+ #1: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x2c/0xdc
+
+ stack backtrace:
+ CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 5.14.0-rc1-00035-gc836005b01c5-dirty #69
+ Hardware name: Generic AM43 (Flattened Device Tree)
+ [<c010e6e0>] (unwind_backtrace) from [<c010b9d0>] (show_stack+0x10/0x14)
+ [<c010b9d0>] (show_stack) from [<c017c640>] (mark_lock.part.17+0x5bc/0xd04)
+ [<c017c640>] (mark_lock.part.17) from [<c017d9e4>] (__lock_acquire+0x960/0x2fa4)
+ [<c017d9e4>] (__lock_acquire) from [<c0180980>] (lock_acquire+0x10c/0x358)
+ [<c0180980>] (lock_acquire) from [<c093d324>] (_raw_spin_lock_bh+0x44/0x58)
+ [<c093d324>] (_raw_spin_lock_bh) from [<bf00b258>] (omap_aes_find_dev+0x18/0x54 [omap_aes_driver])
+ [<bf00b258>] (omap_aes_find_dev [omap_aes_driver]) from [<bf00b328>] (omap_aes_crypt+0x94/0xd4 [omap_aes_driver])
+ [<bf00b328>] (omap_aes_crypt [omap_aes_driver]) from [<c08ac6d0>] (esp_input+0x1b0/0x2c8)
+ [<c08ac6d0>] (esp_input) from [<c08c9e90>] (xfrm_input+0x410/0x1290)
+ [<c08c9e90>] (xfrm_input) from [<c08b6374>] (xfrm4_esp_rcv+0x54/0x11c)
+ [<c08b6374>] (xfrm4_esp_rcv) from [<c0838840>] (ip_protocol_deliver_rcu+0x48/0x3bc)
+ [<c0838840>] (ip_protocol_deliver_rcu) from [<c0838c50>] (ip_local_deliver_finish+0x9c/0xdc)
+ [<c0838c50>] (ip_local_deliver_finish) from [<c0838dd8>] (ip_local_deliver+0x148/0x1b0)
+ [<c0838dd8>] (ip_local_deliver) from [<c0838f5c>] (ip_rcv+0x11c/0x180)
+ [<c0838f5c>] (ip_rcv) from [<c077e3a4>] (__netif_receive_skb_one_core+0x54/0x74)
+ [<c077e3a4>] (__netif_receive_skb_one_core) from [<c077e588>] (netif_receive_skb+0xa8/0x260)
+ [<c077e588>] (netif_receive_skb) from [<c068d6d4>] (cpsw_rx_handler+0x224/0x2fc)
+ [<c068d6d4>] (cpsw_rx_handler) from [<c0688ccc>] (__cpdma_chan_process+0xf4/0x188)
+ [<c0688ccc>] (__cpdma_chan_process) from [<c068a0c0>] (cpdma_chan_process+0x3c/0x5c)
+ [<c068a0c0>] (cpdma_chan_process) from [<c0690e14>] (cpsw_rx_mq_poll+0x44/0x98)
+ [<c0690e14>] (cpsw_rx_mq_poll) from [<c0780810>] (__napi_poll+0x28/0x268)
+ [<c0780810>] (__napi_poll) from [<c0780c64>] (net_rx_action+0xcc/0x204)
+ [<c0780c64>] (net_rx_action) from [<c0101478>] (__do_softirq+0x140/0x4d0)
+ [<c0101478>] (__do_softirq) from [<c0135948>] (run_ksoftirqd+0x34/0x50)
+ [<c0135948>] (run_ksoftirqd) from [<c01583b8>] (smpboot_thread_fn+0xf4/0x1d8)
+ [<c01583b8>] (smpboot_thread_fn) from [<c01546dc>] (kthread+0x14c/0x174)
+ [<c01546dc>] (kthread) from [<c010013c>] (ret_from_fork+0x14/0x38)
+ ...
+
+The omap-des and omap-sham drivers appear to have a similar issue.
+
+Fix this by using spin_{,un}lock_bh() around device list access in all
+the probe and remove functions.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@mind.be>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/omap-aes.c | 8 ++++----
+ drivers/crypto/omap-des.c | 8 ++++----
+ drivers/crypto/omap-sham.c | 12 ++++++------
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
+index 0dd4c6b157de..9b968ac4ee7b 100644
+--- a/drivers/crypto/omap-aes.c
++++ b/drivers/crypto/omap-aes.c
+@@ -1175,9 +1175,9 @@ static int omap_aes_probe(struct platform_device *pdev)
+ spin_lock_init(&dd->lock);
+
+ INIT_LIST_HEAD(&dd->list);
+- spin_lock(&list_lock);
++ spin_lock_bh(&list_lock);
+ list_add_tail(&dd->list, &dev_list);
+- spin_unlock(&list_lock);
++ spin_unlock_bh(&list_lock);
+
+ /* Initialize crypto engine */
+ dd->engine = crypto_engine_alloc_init(dev, 1);
+@@ -1264,9 +1264,9 @@ static int omap_aes_remove(struct platform_device *pdev)
+ if (!dd)
+ return -ENODEV;
+
+- spin_lock(&list_lock);
++ spin_lock_bh(&list_lock);
+ list_del(&dd->list);
+- spin_unlock(&list_lock);
++ spin_unlock_bh(&list_lock);
+
+ for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
+ for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
+diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
+index c9d38bcfd1c7..7fdf38e07adf 100644
+--- a/drivers/crypto/omap-des.c
++++ b/drivers/crypto/omap-des.c
+@@ -1035,9 +1035,9 @@ static int omap_des_probe(struct platform_device *pdev)
+
+
+ INIT_LIST_HEAD(&dd->list);
+- spin_lock(&list_lock);
++ spin_lock_bh(&list_lock);
+ list_add_tail(&dd->list, &dev_list);
+- spin_unlock(&list_lock);
++ spin_unlock_bh(&list_lock);
+
+ /* Initialize des crypto engine */
+ dd->engine = crypto_engine_alloc_init(dev, 1);
+@@ -1096,9 +1096,9 @@ static int omap_des_remove(struct platform_device *pdev)
+ if (!dd)
+ return -ENODEV;
+
+- spin_lock(&list_lock);
++ spin_lock_bh(&list_lock);
+ list_del(&dd->list);
+- spin_unlock(&list_lock);
++ spin_unlock_bh(&list_lock);
+
+ for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
+ for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index a47ac60a4ee1..63beea7cdba5 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -2144,9 +2144,9 @@ static int omap_sham_probe(struct platform_device *pdev)
+ (rev & dd->pdata->major_mask) >> dd->pdata->major_shift,
+ (rev & dd->pdata->minor_mask) >> dd->pdata->minor_shift);
+
+- spin_lock(&sham.lock);
++ spin_lock_bh(&sham.lock);
+ list_add_tail(&dd->list, &sham.dev_list);
+- spin_unlock(&sham.lock);
++ spin_unlock_bh(&sham.lock);
+
+ dd->engine = crypto_engine_alloc_init(dev, 1);
+ if (!dd->engine) {
+@@ -2194,9 +2194,9 @@ err_algs:
+ err_engine_start:
+ crypto_engine_exit(dd->engine);
+ err_engine:
+- spin_lock(&sham.lock);
++ spin_lock_bh(&sham.lock);
+ list_del(&dd->list);
+- spin_unlock(&sham.lock);
++ spin_unlock_bh(&sham.lock);
+ err_pm:
+ pm_runtime_disable(dev);
+ if (!dd->polling_mode)
+@@ -2215,9 +2215,9 @@ static int omap_sham_remove(struct platform_device *pdev)
+ dd = platform_get_drvdata(pdev);
+ if (!dd)
+ return -ENODEV;
+- spin_lock(&sham.lock);
++ spin_lock_bh(&sham.lock);
+ list_del(&dd->list);
+- spin_unlock(&sham.lock);
++ spin_unlock_bh(&sham.lock);
+ for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
+ for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
+ crypto_unregister_ahash(
+--
+2.30.2
+
--- /dev/null
+From 06194e75111dc0631452ecd9aed341f0ee69b179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 13:23:34 +0300
+Subject: crypto: omap-sham - clear dma flags only after
+ omap_sham_update_dma_stop()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ]
+
+We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is
+done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the
+end of omap_sham_update_dma_stop().
+
+The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not
+need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be
+applied as clean-up.
+
+Cc: Lokesh Vutla <lokeshvutla@ti.com>
+Cc: Tero Kristo <kristo@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/omap-sham.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index dd53ad9987b0..a47ac60a4ee1 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -1736,7 +1736,7 @@ static void omap_sham_done_task(unsigned long data)
+ if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags))
+ goto finish;
+ } else if (test_bit(FLAGS_DMA_READY, &dd->flags)) {
+- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
++ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
+ omap_sham_update_dma_stop(dd);
+ if (dd->err) {
+ err = dd->err;
+--
+2.30.2
+
--- /dev/null
+From 8d31caadb5044ff463a507d726324921b7df15f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:28 +0100
+Subject: crypto: qat - do not export adf_iov_putmsg()
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ]
+
+The function adf_iov_putmsg() is only used inside the intel_qat module
+therefore should not be exported.
+Remove EXPORT_SYMBOL for the function adf_iov_putmsg().
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+index 663638bb5c97..efa4bffb4f60 100644
+--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+@@ -186,7 +186,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(adf_iov_putmsg);
+
+ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
+ {
+--
+2.30.2
+
--- /dev/null
+From 111c7594cf2d5818d8b2f7df82b2eeea65d7bdeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:13 +0100
+Subject: crypto: qat - do not ignore errors from enable_vf2pf_comms()
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ]
+
+The function adf_dev_init() ignores the error code reported by
+enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible
+with the pf, then the load of the VF driver progresses.
+This patch changes adf_dev_init() so that the error code from
+enable_vf2pf_comms() is returned to the caller.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_init.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
+index 744c40351428..02864985dbb0 100644
+--- a/drivers/crypto/qat/qat_common/adf_init.c
++++ b/drivers/crypto/qat/qat_common/adf_init.c
+@@ -61,6 +61,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
+ struct service_hndl *service;
+ struct list_head *list_itr;
+ struct adf_hw_device_data *hw_data = accel_dev->hw_device;
++ int ret;
+
+ if (!hw_data) {
+ dev_err(&GET_DEV(accel_dev),
+@@ -127,9 +128,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
+ }
+
+ hw_data->enable_error_correction(accel_dev);
+- hw_data->enable_vf2pf_comms(accel_dev);
++ ret = hw_data->enable_vf2pf_comms(accel_dev);
+
+- return 0;
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(adf_dev_init);
+
+--
+2.30.2
+
--- /dev/null
+From 74311be9186e1784d14b1aca478e019a08bdf40e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:22 +0100
+Subject: crypto: qat - fix naming for init/shutdown VF to PF notifications
+
+From: Marco Chiappero <marco.chiappero@intel.com>
+
+[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ]
+
+At start and shutdown, VFs notify the PF about their state. These
+notifications are carried out through a message exchange using the PFVF
+protocol.
+
+Function names lead to believe they do perform init or shutdown logic.
+This is to fix the naming to better reflect their purpose.
+
+Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
+Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 ++--
+ drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 ++--
+ drivers/crypto/qat/qat_common/adf_common_drv.h | 8 ++++----
+ drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 ++++++------
+ .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 ++--
+ 5 files changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+index 15f6b9bdfb22..ddf42fb32625 100644
+--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
++++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+@@ -81,10 +81,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+index d231583428c9..7e202ef92523 100644
+--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
++++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+@@ -81,10 +81,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
+index c61476553728..dd4a811b7e89 100644
+--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
++++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
+@@ -198,8 +198,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
+ void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
+ void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
+
+-int adf_vf2pf_init(struct adf_accel_dev *accel_dev);
+-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev);
++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
+ int adf_init_pf_wq(void);
+ void adf_exit_pf_wq(void);
+ int adf_init_vf_wq(void);
+@@ -222,12 +222,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev)
+ {
+ }
+
+-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
++static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
+ {
+ return 0;
+ }
+
+-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
++static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
+ {
+ }
+
+diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+index e85bd62d134a..3e25fac051b2 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+@@ -5,14 +5,14 @@
+ #include "adf_pf2vf_msg.h"
+
+ /**
+- * adf_vf2pf_init() - send init msg to PF
++ * adf_vf2pf_notify_init() - send init msg to PF
+ * @accel_dev: Pointer to acceleration VF device.
+ *
+ * Function sends an init message from the VF to a PF
+ *
+ * Return: 0 on success, error code otherwise.
+ */
+-int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
++int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
+ {
+ u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
+ (ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT));
+@@ -25,17 +25,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+ set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(adf_vf2pf_init);
++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init);
+
+ /**
+- * adf_vf2pf_shutdown() - send shutdown msg to PF
++ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF
+ * @accel_dev: Pointer to acceleration VF device.
+ *
+ * Function sends a shutdown message from the VF to a PF
+ *
+ * Return: void
+ */
+-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
++void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
+ {
+ u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
+ (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT));
+@@ -45,4 +45,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+ dev_err(&GET_DEV(accel_dev),
+ "Failed to send Shutdown event to PF\n");
+ }
+-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown);
++EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
+diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+index f14fb82ed6df..744734caaf7b 100644
+--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
++++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+@@ -81,10 +81,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data)
+ hw_data->enable_error_correction = adf_vf_void_noop;
+ hw_data->init_admin_comms = adf_vf_int_noop;
+ hw_data->exit_admin_comms = adf_vf_void_noop;
+- hw_data->send_admin_init = adf_vf2pf_init;
++ hw_data->send_admin_init = adf_vf2pf_notify_init;
+ hw_data->init_arb = adf_vf_int_noop;
+ hw_data->exit_arb = adf_vf_void_noop;
+- hw_data->disable_iov = adf_vf2pf_shutdown;
++ hw_data->disable_iov = adf_vf2pf_notify_shutdown;
+ hw_data->get_accel_mask = get_accel_mask;
+ hw_data->get_ae_mask = get_ae_mask;
+ hw_data->get_num_accels = get_num_accels;
+--
+2.30.2
+
--- /dev/null
+From 1a7f2d49aa66dbefa63143d6675972f656c71ed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:19 +0100
+Subject: crypto: qat - fix reuse of completion variable
+
+From: Marco Chiappero <marco.chiappero@intel.com>
+
+[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ]
+
+Use reinit_completion() to set to a clean state a completion variable,
+used to coordinate the VF to PF request-response flow, before every
+new VF request.
+
+Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
+Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+index a1b77bd7a894..663638bb5c97 100644
+--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
++++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+@@ -316,6 +316,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
+ msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT;
+ BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255);
+
++ reinit_completion(&accel_dev->vf.iov_msg_completion);
++
+ /* Send request from VF to PF */
+ ret = adf_iov_putmsg(accel_dev, msg, 0);
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From beed1c717184043bf9dfe71d1a399d0a85bc3ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:14 +0100
+Subject: crypto: qat - handle both source of interrupt in VF ISR
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ]
+
+The top half of the VF drivers handled only a source at the time.
+If an interrupt for PF2VF and bundle occurred at the same time, the ISR
+scheduled only the bottom half for PF2VF.
+This patch fixes the VF top half so that if both sources of interrupt
+trigger at the same time, both bottom halves are scheduled.
+
+This patch is based on earlier work done by Conor McLoughlin.
+
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+index 888388acb6bd..3e4f64d248f9 100644
+--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
+@@ -160,6 +160,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+ struct adf_bar *pmisc =
+ &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
+ void __iomem *pmisc_bar_addr = pmisc->virt_addr;
++ bool handled = false;
+ u32 v_int;
+
+ /* Read VF INT source CSR to determine the source of VF interrupt */
+@@ -172,7 +173,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+
+ /* Schedule tasklet to handle interrupt BH */
+ tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet);
+- return IRQ_HANDLED;
++ handled = true;
+ }
+
+ /* Check bundle interrupt */
+@@ -184,10 +185,10 @@ static irqreturn_t adf_isr(int irq, void *privdata)
+ csr_ops->write_csr_int_flag_and_col(bank->csr_addr,
+ bank->bank_number, 0);
+ tasklet_hi_schedule(&bank->resp_handler);
+- return IRQ_HANDLED;
++ handled = true;
+ }
+
+- return IRQ_NONE;
++ return handled ? IRQ_HANDLED : IRQ_NONE;
+ }
+
+ static int adf_request_msi_irq(struct adf_accel_dev *accel_dev)
+--
+2.30.2
+
--- /dev/null
+From 3598293b77540064eb963183aac2eaae3d8274b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 21:21:10 +0100
+Subject: crypto: qat - use proper type for vf_mask
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]
+
+Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.
+
+This is to fix the following warning reported by KASAN the first time
+adf_msix_isr_ae() gets called.
+
+ [ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
+ [ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
+ [ 692.092076] Call Trace:
+ [ 692.092089] <IRQ>
+ [ 692.092101] dump_stack+0x9c/0xcf
+ [ 692.092132] print_address_description.constprop.0+0x18/0x130
+ [ 692.092164] ? find_first_bit+0x28/0x50
+ [ 692.092185] kasan_report.cold+0x7f/0x111
+ [ 692.092213] ? static_obj+0x10/0x80
+ [ 692.092234] ? find_first_bit+0x28/0x50
+ [ 692.092262] find_first_bit+0x28/0x50
+ [ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat]
+
+Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
+index e3ad5587be49..daab02011717 100644
+--- a/drivers/crypto/qat/qat_common/adf_isr.c
++++ b/drivers/crypto/qat/qat_common/adf_isr.c
+@@ -15,6 +15,8 @@
+ #include "adf_transport_access_macros.h"
+ #include "adf_transport_internal.h"
+
++#define ADF_MAX_NUM_VFS 32
++
+ static int adf_enable_msix(struct adf_accel_dev *accel_dev)
+ {
+ struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
+@@ -72,7 +74,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
+ struct adf_bar *pmisc =
+ &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
+ void __iomem *pmisc_bar_addr = pmisc->virt_addr;
+- u32 vf_mask;
++ unsigned long vf_mask;
+
+ /* Get the interrupt sources triggered by VFs */
+ vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
+@@ -93,8 +95,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
+ * unless the VF is malicious and is attempting to
+ * flood the host OS with VF2PF interrupts.
+ */
+- for_each_set_bit(i, (const unsigned long *)&vf_mask,
+- (sizeof(vf_mask) * BITS_PER_BYTE)) {
++ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) {
+ vf_info = accel_dev->pf.vf_info + i;
+
+ if (!__ratelimit(&vf_info->vf2pf_ratelimit)) {
+--
+2.30.2
+
--- /dev/null
+From c8817f770ae30e60eeff506fd730180004c40284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 14:44:33 +0200
+Subject: crypto: rmd320 - remove rmd320 in Makefile
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit ff1469a21df5a2e981dd2f78e96e412fecb3ba59 ]
+
+Commit 93f64202926f ("crypto: rmd320 - remove RIPE-MD 320 hash algorithm")
+removes the Kconfig and code, but misses to adjust the Makefile.
+
+Hence, ./scripts/checkkconfigsymbols.py warns:
+
+CRYPTO_RMD320
+Referencing files: crypto/Makefile
+
+Remove the missing piece of this code removal.
+
+Fixes: 93f64202926f ("crypto: rmd320 - remove RIPE-MD 320 hash algorithm")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 10526d4559b8..c633f15a0481 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -74,7 +74,6 @@ obj-$(CONFIG_CRYPTO_NULL2) += crypto_null.o
+ obj-$(CONFIG_CRYPTO_MD4) += md4.o
+ obj-$(CONFIG_CRYPTO_MD5) += md5.o
+ obj-$(CONFIG_CRYPTO_RMD160) += rmd160.o
+-obj-$(CONFIG_CRYPTO_RMD320) += rmd320.o
+ obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o
+ obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o
+ obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o
+--
+2.30.2
+
--- /dev/null
+From 9271e021526313265fe307d3bd496ca6f2225ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 15:55:06 +0800
+Subject: crypto: tcrypt - Fix missing return value check
+
+From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+
+[ Upstream commit 7b3d52683b3a47c0ba1dfd6b5994a3a795b06972 ]
+
+There are several places where the return value check of crypto_aead_setkey
+and crypto_aead_setauthsize were lost. It is necessary to add these checks.
+
+At the same time, move the crypto_aead_setauthsize() call out of the loop,
+and only need to call it once after load transform.
+
+Fixee: 53f52d7aecb4 ("crypto: tcrypt - Added speed tests for AEAD crypto alogrithms in tcrypt test suite")
+Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
+Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tcrypt.c | 29 +++++++++++++++++++----------
+ 1 file changed, 19 insertions(+), 10 deletions(-)
+
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index 6b7c158dc508..f9c00875bc0e 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -290,6 +290,11 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs,
+ }
+
+ ret = crypto_aead_setauthsize(tfm, authsize);
++ if (ret) {
++ pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo,
++ ret);
++ goto out_free_tfm;
++ }
+
+ for (i = 0; i < num_mb; ++i)
+ if (testmgr_alloc_buf(data[i].xbuf)) {
+@@ -315,7 +320,7 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs,
+ for (i = 0; i < num_mb; ++i) {
+ data[i].req = aead_request_alloc(tfm, GFP_KERNEL);
+ if (!data[i].req) {
+- pr_err("alg: skcipher: Failed to allocate request for %s\n",
++ pr_err("alg: aead: Failed to allocate request for %s\n",
+ algo);
+ while (i--)
+ aead_request_free(data[i].req);
+@@ -567,13 +572,19 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
+ sgout = &sg[9];
+
+ tfm = crypto_alloc_aead(algo, 0, 0);
+-
+ if (IS_ERR(tfm)) {
+ pr_err("alg: aead: Failed to load transform for %s: %ld\n", algo,
+ PTR_ERR(tfm));
+ goto out_notfm;
+ }
+
++ ret = crypto_aead_setauthsize(tfm, authsize);
++ if (ret) {
++ pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo,
++ ret);
++ goto out_noreq;
++ }
++
+ crypto_init_wait(&wait);
+ printk(KERN_INFO "\ntesting speed of %s (%s) %s\n", algo,
+ get_driver_name(crypto_aead, tfm), e);
+@@ -611,8 +622,13 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
+ break;
+ }
+ }
++
+ ret = crypto_aead_setkey(tfm, key, *keysize);
+- ret = crypto_aead_setauthsize(tfm, authsize);
++ if (ret) {
++ pr_err("setkey() failed flags=%x: %d\n",
++ crypto_aead_get_flags(tfm), ret);
++ goto out;
++ }
+
+ iv_len = crypto_aead_ivsize(tfm);
+ if (iv_len)
+@@ -622,15 +638,8 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
+ printk(KERN_INFO "test %u (%d bit key, %d byte blocks): ",
+ i, *keysize * 8, bs);
+
+-
+ memset(tvmem[0], 0xff, PAGE_SIZE);
+
+- if (ret) {
+- pr_err("setkey() failed flags=%x\n",
+- crypto_aead_get_flags(tfm));
+- goto out;
+- }
+-
+ sg_init_aead(sg, xbuf, bs + (enc ? 0 : authsize),
+ assoc, aad_size);
+
+--
+2.30.2
+
--- /dev/null
+From 70597e466a5f78484e9dcd67e4899cad80f9d2a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 18:54:03 +0200
+Subject: crypto: x86/aes-ni - add missing error checks in XTS code
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 821720b9f34ec54106ebf012a712ba73bbcf47c2 ]
+
+The updated XTS code fails to check the return code of skcipher_walk_virt,
+which may lead to skcipher_walk_abort() or skcipher_walk_done() being called
+while the walk argument is in an inconsistent state.
+
+So check the return value after each such call, and bail on errors.
+
+Fixes: 2481104fe98d ("crypto: x86/aes-ni-xts - rewrite and drop indirections via glue helper")
+Reported-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: syzbot <syzbot+5d1bad8042a8f0e8117a@syzkaller.appspotmail.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/crypto/aesni-intel_glue.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index 2144e54a6c89..388643ca2177 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -849,6 +849,8 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)
+ return -EINVAL;
+
+ err = skcipher_walk_virt(&walk, req, false);
++ if (err)
++ return err;
+
+ if (unlikely(tail > 0 && walk.nbytes < walk.total)) {
+ int blocks = DIV_ROUND_UP(req->cryptlen, AES_BLOCK_SIZE) - 2;
+@@ -862,7 +864,10 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)
+ skcipher_request_set_crypt(&subreq, req->src, req->dst,
+ blocks * AES_BLOCK_SIZE, req->iv);
+ req = &subreq;
++
+ err = skcipher_walk_virt(&walk, req, false);
++ if (err)
++ return err;
+ } else {
+ tail = 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 185efa54f45d844c0b3158e10df3b7bf1c64a3f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 18:24:44 +0200
+Subject: debugfs: Return error during {full/open}_proxy_open() on rmmod
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sven Eckelmann <sven@narfation.org>
+
+[ Upstream commit 112cedc8e600b668688eb809bf11817adec58ddc ]
+
+If a kernel module gets unloaded then it printed report about a leak before
+commit 275678e7a9be ("debugfs: Check module state before warning in
+{full/open}_proxy_open()"). An additional check was added in this commit to
+avoid this printing. But it was forgotten that the function must return an
+error in this case because it was not actually opened.
+
+As result, the systems started to crash or to hang when a module was
+unloaded while something was trying to open a file.
+
+Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()")
+Cc: Taehee Yoo <ap420073@gmail.com>
+Reported-by: Mário Lopes <ml@simonwunderlich.de>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Link: https://lore.kernel.org/r/20210802162444.7848-1-sven@narfation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/debugfs/file.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
+index ba7c01cd9a5d..36f2dbe6061f 100644
+--- a/fs/debugfs/file.c
++++ b/fs/debugfs/file.c
+@@ -179,8 +179,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
+ if (!fops_get(real_fops)) {
+ #ifdef CONFIG_MODULES
+ if (real_fops->owner &&
+- real_fops->owner->state == MODULE_STATE_GOING)
++ real_fops->owner->state == MODULE_STATE_GOING) {
++ r = -ENXIO;
+ goto out;
++ }
+ #endif
+
+ /* Huh? Module did not clean up after itself at exit? */
+@@ -314,8 +316,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp)
+ if (!fops_get(real_fops)) {
+ #ifdef CONFIG_MODULES
+ if (real_fops->owner &&
+- real_fops->owner->state == MODULE_STATE_GOING)
++ real_fops->owner->state == MODULE_STATE_GOING) {
++ r = -ENXIO;
+ goto out;
++ }
+ #endif
+
+ /* Huh? Module did not cleanup after itself at exit? */
+--
+2.30.2
+
--- /dev/null
+From 5887f173c029adc3973a3d6350075bf869d79c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 20:19:24 +0300
+Subject: devlink: Break parameter notification sequence to be before/after
+ unload/load driver
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 05a7f4a8dff19999ca8a83a35ff4782689de7bfc ]
+
+The change of namespaces during devlink reload calls to driver unload
+before it accesses devlink parameters. The commands below causes to
+use-after-free bug when trying to get flow steering mode.
+
+ * ip netns add n1
+ * devlink dev reload pci/0000:00:09.0 netns n1
+
+ ==================================================================
+ BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
+ Read of size 4 at addr ffff888009d04308 by task devlink/275
+
+ CPU: 6 PID: 275 Comm: devlink Not tainted 5.12.0-rc2+ #2853
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x93/0xc2
+ print_address_description.constprop.0+0x18/0x140
+ ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
+ ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
+ kasan_report.cold+0x7c/0xd8
+ ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
+ mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
+ devlink_nl_param_fill+0x1c8/0xe80
+ ? __free_pages_ok+0x37a/0x8a0
+ ? devlink_flash_update_timeout_notify+0xd0/0xd0
+ ? lock_acquire+0x1a9/0x6d0
+ ? fs_reclaim_acquire+0xb7/0x160
+ ? lock_is_held_type+0x98/0x110
+ ? 0xffffffff81000000
+ ? lock_release+0x1f9/0x6c0
+ ? fs_reclaim_release+0xa1/0xf0
+ ? lock_downgrade+0x6d0/0x6d0
+ ? lock_is_held_type+0x98/0x110
+ ? lock_is_held_type+0x98/0x110
+ ? memset+0x20/0x40
+ ? __build_skb_around+0x1f8/0x2b0
+ devlink_param_notify+0x6d/0x180
+ devlink_reload+0x1c3/0x520
+ ? devlink_remote_reload_actions_performed+0x30/0x30
+ ? mutex_trylock+0x24b/0x2d0
+ ? devlink_nl_cmd_reload+0x62b/0x1070
+ devlink_nl_cmd_reload+0x66d/0x1070
+ ? devlink_reload+0x520/0x520
+ ? devlink_get_from_attrs+0x1bc/0x260
+ ? devlink_nl_pre_doit+0x64/0x4d0
+ genl_family_rcv_msg_doit+0x1e9/0x2f0
+ ? mutex_lock_io_nested+0x1130/0x1130
+ ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
+ ? security_capable+0x51/0x90
+ genl_rcv_msg+0x27f/0x4a0
+ ? genl_get_cmd+0x3c0/0x3c0
+ ? lock_acquire+0x1a9/0x6d0
+ ? devlink_reload+0x520/0x520
+ ? lock_release+0x6c0/0x6c0
+ netlink_rcv_skb+0x11d/0x340
+ ? genl_get_cmd+0x3c0/0x3c0
+ ? netlink_ack+0x9f0/0x9f0
+ ? lock_release+0x1f9/0x6c0
+ genl_rcv+0x24/0x40
+ netlink_unicast+0x433/0x700
+ ? netlink_attachskb+0x730/0x730
+ ? _copy_from_iter_full+0x178/0x650
+ ? __alloc_skb+0x113/0x2b0
+ netlink_sendmsg+0x6f1/0xbd0
+ ? netlink_unicast+0x700/0x700
+ ? lock_is_held_type+0x98/0x110
+ ? netlink_unicast+0x700/0x700
+ sock_sendmsg+0xb0/0xe0
+ __sys_sendto+0x193/0x240
+ ? __x64_sys_getpeername+0xb0/0xb0
+ ? do_sys_openat2+0x10b/0x370
+ ? __up_read+0x1a1/0x7b0
+ ? do_user_addr_fault+0x219/0xdc0
+ ? __x64_sys_openat+0x120/0x1d0
+ ? __x64_sys_open+0x1a0/0x1a0
+ __x64_sys_sendto+0xdd/0x1b0
+ ? syscall_enter_from_user_mode+0x1d/0x50
+ do_syscall_64+0x2d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+ RIP: 0033:0x7fc69d0af14a
+ Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
+ RSP: 002b:00007ffc1d8292f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
+ RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc69d0af14a
+ RDX: 0000000000000038 RSI: 0000555f57c56440 RDI: 0000000000000003
+ RBP: 0000555f57c56410 R08: 00007fc69d17b200 R09: 000000000000000c
+ R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
+ R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+
+ Allocated by task 146:
+ kasan_save_stack+0x1b/0x40
+ __kasan_kmalloc+0x99/0xc0
+ mlx5_init_fs+0xf0/0x1c50 [mlx5_core]
+ mlx5_load+0xd2/0x180 [mlx5_core]
+ mlx5_init_one+0x2f6/0x450 [mlx5_core]
+ probe_one+0x47d/0x6e0 [mlx5_core]
+ pci_device_probe+0x2a0/0x4a0
+ really_probe+0x20a/0xc90
+ driver_probe_device+0xd8/0x380
+ device_driver_attach+0x1df/0x250
+ __driver_attach+0xff/0x240
+ bus_for_each_dev+0x11e/0x1a0
+ bus_add_driver+0x309/0x570
+ driver_register+0x1ee/0x380
+ 0xffffffffa06b8062
+ do_one_initcall+0xd5/0x410
+ do_init_module+0x1c8/0x760
+ load_module+0x6d8b/0x9650
+ __do_sys_finit_module+0x118/0x1b0
+ do_syscall_64+0x2d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ Freed by task 275:
+ kasan_save_stack+0x1b/0x40
+ kasan_set_track+0x1c/0x30
+ kasan_set_free_info+0x20/0x30
+ __kasan_slab_free+0x102/0x140
+ slab_free_freelist_hook+0x74/0x1b0
+ kfree+0xd7/0x2a0
+ mlx5_unload+0x16/0xb0 [mlx5_core]
+ mlx5_unload_one+0xae/0x120 [mlx5_core]
+ mlx5_devlink_reload_down+0x1bc/0x380 [mlx5_core]
+ devlink_reload+0x141/0x520
+ devlink_nl_cmd_reload+0x66d/0x1070
+ genl_family_rcv_msg_doit+0x1e9/0x2f0
+ genl_rcv_msg+0x27f/0x4a0
+ netlink_rcv_skb+0x11d/0x340
+ genl_rcv+0x24/0x40
+ netlink_unicast+0x433/0x700
+ netlink_sendmsg+0x6f1/0xbd0
+ sock_sendmsg+0xb0/0xe0
+ __sys_sendto+0x193/0x240
+ __x64_sys_sendto+0xdd/0x1b0
+ do_syscall_64+0x2d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+ The buggy address belongs to the object at ffff888009d04300
+ which belongs to the cache kmalloc-128 of size 128
+ The buggy address is located 8 bytes inside of
+ 128-byte region [ffff888009d04300, ffff888009d04380)
+ The buggy address belongs to the page:
+ page:0000000086a64ecc refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888009d04000 pfn:0x9d04
+ head:0000000086a64ecc order:1 compound_mapcount:0
+ flags: 0x4000000000010200(slab|head)
+ raw: 4000000000010200 ffffea0000203980 0000000200000002 ffff8880050428c0
+ raw: ffff888009d04000 000000008020001d 00000001ffffffff 0000000000000000
+ page dumped because: kasan: bad access detected
+
+ Memory state around the buggy address:
+ ffff888009d04200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff888009d04280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ >ffff888009d04300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff888009d04380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff888009d04400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ==================================================================
+
+The right solution to devlink reload is to notify about deletion of
+parameters, unload driver, change net namespaces, load driver and notify
+about addition of parameters.
+
+Fixes: 070c63f20f6c ("net: devlink: allow to change namespaces during reload")
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/devlink.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index 051432ea4f69..170e44f5e7df 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -3283,10 +3283,12 @@ static void devlink_param_notify(struct devlink *devlink,
+ struct devlink_param_item *param_item,
+ enum devlink_command cmd);
+
+-static void devlink_reload_netns_change(struct devlink *devlink,
+- struct net *dest_net)
++static void devlink_ns_change_notify(struct devlink *devlink,
++ struct net *dest_net, struct net *curr_net,
++ bool new)
+ {
+ struct devlink_param_item *param_item;
++ enum devlink_command cmd;
+
+ /* Userspace needs to be notified about devlink objects
+ * removed from original and entering new network namespace.
+@@ -3294,17 +3296,18 @@ static void devlink_reload_netns_change(struct devlink *devlink,
+ * reload process so the notifications are generated separatelly.
+ */
+
+- list_for_each_entry(param_item, &devlink->param_list, list)
+- devlink_param_notify(devlink, 0, param_item,
+- DEVLINK_CMD_PARAM_DEL);
+- devlink_notify(devlink, DEVLINK_CMD_DEL);
++ if (!dest_net || net_eq(dest_net, curr_net))
++ return;
+
+- __devlink_net_set(devlink, dest_net);
++ if (new)
++ devlink_notify(devlink, DEVLINK_CMD_NEW);
+
+- devlink_notify(devlink, DEVLINK_CMD_NEW);
++ cmd = new ? DEVLINK_CMD_PARAM_NEW : DEVLINK_CMD_PARAM_DEL;
+ list_for_each_entry(param_item, &devlink->param_list, list)
+- devlink_param_notify(devlink, 0, param_item,
+- DEVLINK_CMD_PARAM_NEW);
++ devlink_param_notify(devlink, 0, param_item, cmd);
++
++ if (!new)
++ devlink_notify(devlink, DEVLINK_CMD_DEL);
+ }
+
+ static bool devlink_reload_supported(const struct devlink_ops *ops)
+@@ -3384,6 +3387,7 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net,
+ u32 *actions_performed, struct netlink_ext_ack *extack)
+ {
+ u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE];
++ struct net *curr_net;
+ int err;
+
+ if (!devlink->reload_enabled)
+@@ -3391,18 +3395,22 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net,
+
+ memcpy(remote_reload_stats, devlink->stats.remote_reload_stats,
+ sizeof(remote_reload_stats));
++
++ curr_net = devlink_net(devlink);
++ devlink_ns_change_notify(devlink, dest_net, curr_net, false);
+ err = devlink->ops->reload_down(devlink, !!dest_net, action, limit, extack);
+ if (err)
+ return err;
+
+- if (dest_net && !net_eq(dest_net, devlink_net(devlink)))
+- devlink_reload_netns_change(devlink, dest_net);
++ if (dest_net && !net_eq(dest_net, curr_net))
++ __devlink_net_set(devlink, dest_net);
+
+ err = devlink->ops->reload_up(devlink, action, limit, actions_performed, extack);
+ devlink_reload_failed_set(devlink, !!err);
+ if (err)
+ return err;
+
++ devlink_ns_change_notify(devlink, dest_net, curr_net, true);
+ WARN_ON(!(*actions_performed & BIT(action)));
+ /* Catch driver on updating the remote action within devlink reload */
+ WARN_ON(memcmp(remote_reload_stats, devlink->stats.remote_reload_stats,
+--
+2.30.2
+
--- /dev/null
+From 8f22372e26b713d73c49857a6cb4d2cf2f44b7a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Aug 2021 12:57:30 +0300
+Subject: devlink: Clear whole devlink_flash_notify struct
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit ed43fbac717882165a2a4bd64f7b1f56f7467bb7 ]
+
+The { 0 } doesn't clear all fields in the struct, but tells to the
+compiler to set all fields to zero and doesn't touch any sub-fields
+if they exists.
+
+The {} is an empty initialiser that instructs to fully initialize whole
+struct including sub-fields, which is error-prone for future
+devlink_flash_notify extensions.
+
+Fixes: 6700acc5f1fe ("devlink: collect flash notify params into a struct")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/devlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index 170e44f5e7df..5d01bebffaca 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -3607,7 +3607,7 @@ out_free_msg:
+
+ static void devlink_flash_update_begin_notify(struct devlink *devlink)
+ {
+- struct devlink_flash_notify params = { 0 };
++ struct devlink_flash_notify params = {};
+
+ __devlink_flash_update_notify(devlink,
+ DEVLINK_CMD_FLASH_UPDATE,
+@@ -3616,7 +3616,7 @@ static void devlink_flash_update_begin_notify(struct devlink *devlink)
+
+ static void devlink_flash_update_end_notify(struct devlink *devlink)
+ {
+- struct devlink_flash_notify params = { 0 };
++ struct devlink_flash_notify params = {};
+
+ __devlink_flash_update_notify(devlink,
+ DEVLINK_CMD_FLASH_UPDATE_END,
+--
+2.30.2
+
--- /dev/null
+From 12ef02a43c0d992ece7990a85429b7b3748e2cc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 15:43:01 +0800
+Subject: driver core: Fix error return code in really_probe()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit f04948dea236b000da09c466a7ec931ecd8d7867 ]
+
+In the case of error handling, the error code returned by the subfunction
+should be propagated instead of 0.
+
+Fixes: 1901fb2604fb ("Driver core: fix "driver" symlink timing")
+Fixes: 23b6904442d0 ("driver core: add dev_groups to all drivers")
+Fixes: 8fd456ec0cf0 ("driver core: Add state_synced sysfs file for devices that support it")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210707074301.2722-1-thunder.leizhen@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 592b3955abe2..a421da0c9c01 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -560,7 +560,8 @@ re_probe:
+ goto probe_failed;
+ }
+
+- if (driver_sysfs_add(dev)) {
++ ret = driver_sysfs_add(dev);
++ if (ret) {
+ pr_err("%s: driver_sysfs_add(%s) failed\n",
+ __func__, dev_name(dev));
+ goto probe_failed;
+@@ -582,15 +583,18 @@ re_probe:
+ goto probe_failed;
+ }
+
+- if (device_add_groups(dev, drv->dev_groups)) {
++ ret = device_add_groups(dev, drv->dev_groups);
++ if (ret) {
+ dev_err(dev, "device_add_groups() failed\n");
+ goto dev_groups_failed;
+ }
+
+- if (dev_has_sync_state(dev) &&
+- device_create_file(dev, &dev_attr_state_synced)) {
+- dev_err(dev, "state_synced sysfs add failed\n");
+- goto dev_sysfs_state_synced_failed;
++ if (dev_has_sync_state(dev)) {
++ ret = device_create_file(dev, &dev_attr_state_synced);
++ if (ret) {
++ dev_err(dev, "state_synced sysfs add failed\n");
++ goto dev_sysfs_state_synced_failed;
++ }
+ }
+
+ if (test_remove) {
+--
+2.30.2
+
--- /dev/null
+From b45af5731a3f2df89137242d3ebf377c7f9649b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 01:22:15 +0800
+Subject: drm/amdgpu/acp: Make PM domain really work
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit aff890288de2d818e4f83ec40c9315e2d735df07 ]
+
+Devices created by mfd_add_hotplug_devices() don't really increase the
+index of its name, so get_mfd_cell_dev() cannot find any device, hence a
+NULL dev is passed to pm_genpd_add_device():
+[ 56.974926] (NULL device *): amdgpu: device acp_audio_dma.0.auto added to pm domain
+[ 56.974933] (NULL device *): amdgpu: Failed to add dev to genpd
+[ 56.974941] [drm:amdgpu_device_ip_init [amdgpu]] *ERROR* hw_init of IP block <acp_ip> failed -22
+[ 56.975810] amdgpu 0000:00:01.0: amdgpu: amdgpu_device_ip_init failed
+[ 56.975839] amdgpu 0000:00:01.0: amdgpu: Fatal error during GPU init
+[ 56.977136] ------------[ cut here ]------------
+[ 56.977143] kernel BUG at mm/slub.c:4206!
+[ 56.977158] invalid opcode: 0000 [#1] SMP NOPTI
+[ 56.977167] CPU: 1 PID: 1648 Comm: modprobe Not tainted 5.12.0-051200rc8-generic #202104182230
+[ 56.977175] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./FM2A68M-HD+, BIOS P5.20 02/13/2019
+[ 56.977180] RIP: 0010:kfree+0x3bf/0x410
+[ 56.977195] Code: 89 e7 48 d3 e2 f7 da e8 5f 0d 02 00 80 e7 02 75 3e 44 89 ee 4c 89 e7 e8 ef 5f fd ff e9 fa fe ff ff 49 8b 44 24 08 a8 01 75 b7 <0f> 0b 4c 8b 4d b0 48 8b 4d a8 48 89 da 4c 89 e6 41 b8 01 00 00 00
+[ 56.977202] RSP: 0018:ffffa48640ff79f0 EFLAGS: 00010246
+[ 56.977210] RAX: 0000000000000000 RBX: ffff9286127d5608 RCX: 0000000000000000
+[ 56.977215] RDX: 0000000000000000 RSI: ffffffffc099d0fb RDI: ffff9286127d5608
+[ 56.977220] RBP: ffffa48640ff7a48 R08: 0000000000000001 R09: 0000000000000001
+[ 56.977224] R10: 0000000000000000 R11: ffff9286087d8458 R12: fffff3ae0449f540
+[ 56.977229] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100
+[ 56.977234] FS: 00007f9de5929540(0000) GS:ffff928612e80000(0000) knlGS:0000000000000000
+[ 56.977240] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 56.977245] CR2: 00007f697dd97160 CR3: 00000001110f0000 CR4: 00000000001506e0
+[ 56.977251] Call Trace:
+[ 56.977261] amdgpu_dm_encoder_destroy+0x1b/0x30 [amdgpu]
+[ 56.978056] drm_mode_config_cleanup+0x4f/0x2e0 [drm]
+[ 56.978147] ? kfree+0x3dd/0x410
+[ 56.978157] ? drm_managed_release+0xc8/0x100 [drm]
+[ 56.978232] drm_mode_config_init_release+0xe/0x10 [drm]
+[ 56.978311] drm_managed_release+0x9d/0x100 [drm]
+[ 56.978388] devm_drm_dev_init_release+0x4d/0x70 [drm]
+[ 56.978450] devm_action_release+0x15/0x20
+[ 56.978459] release_nodes+0x77/0xc0
+[ 56.978469] devres_release_all+0x3f/0x50
+[ 56.978477] really_probe+0x245/0x460
+[ 56.978485] driver_probe_device+0xe9/0x160
+[ 56.978492] device_driver_attach+0xab/0xb0
+[ 56.978499] __driver_attach+0x8f/0x150
+[ 56.978506] ? device_driver_attach+0xb0/0xb0
+[ 56.978513] bus_for_each_dev+0x7e/0xc0
+[ 56.978521] driver_attach+0x1e/0x20
+[ 56.978528] bus_add_driver+0x135/0x1f0
+[ 56.978534] driver_register+0x91/0xf0
+[ 56.978540] __pci_register_driver+0x54/0x60
+[ 56.978549] amdgpu_init+0x77/0x1000 [amdgpu]
+[ 56.979246] ? 0xffffffffc0dbc000
+[ 56.979254] do_one_initcall+0x48/0x1d0
+[ 56.979265] ? kmem_cache_alloc_trace+0x120/0x230
+[ 56.979274] ? do_init_module+0x28/0x280
+[ 56.979282] do_init_module+0x62/0x280
+[ 56.979288] load_module+0x71c/0x7a0
+[ 56.979296] __do_sys_finit_module+0xc2/0x120
+[ 56.979305] __x64_sys_finit_module+0x1a/0x20
+[ 56.979311] do_syscall_64+0x38/0x90
+[ 56.979319] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 56.979328] RIP: 0033:0x7f9de54f989d
+[ 56.979335] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48
+[ 56.979342] RSP: 002b:00007ffe3c395a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+[ 56.979350] RAX: ffffffffffffffda RBX: 0000560df3ef4330 RCX: 00007f9de54f989d
+[ 56.979355] RDX: 0000000000000000 RSI: 0000560df3a07358 RDI: 000000000000000f
+[ 56.979360] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000
+[ 56.979365] R10: 000000000000000f R11: 0000000000000246 R12: 0000560df3a07358
+[ 56.979369] R13: 0000000000000000 R14: 0000560df3ef4460 R15: 0000560df3ef4330
+[ 56.979377] Modules linked in: amdgpu(+) iommu_v2 gpu_sched drm_ttm_helper ttm drm_kms_helper cec rc_core i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt nft_counter xt_tcpudp ipt_REJECT nf_reject_ipv4 xt_conntrack iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables libcrc32c nfnetlink ip6_tables iptable_filter bpfilter input_leds binfmt_misc edac_mce_amd kvm_amd ccp kvm snd_hda_codec_realtek snd_hda_codec_generic crct10dif_pclmul snd_hda_codec_hdmi ledtrig_audio ghash_clmulni_intel aesni_intel snd_hda_intel snd_intel_dspcfg snd_seq_midi crypto_simd snd_intel_sdw_acpi cryptd snd_hda_codec snd_seq_midi_event snd_rawmidi snd_hda_core snd_hwdep snd_seq fam15h_power k10temp snd_pcm snd_seq_device snd_timer snd mac_hid soundcore sch_fq_codel nct6775 hwmon_vid drm ip_tables x_tables autofs4 dm_mirror dm_region_hash dm_log hid_generic usbhid hid uas usb_storage r8169 crc32_pclmul realtek ahci xhci_pci i2c_piix4
+[ 56.979521] xhci_pci_renesas libahci video
+[ 56.979541] ---[ end trace cb8f6a346f18da7b ]---
+
+Instead of finding MFD hotplugged device by its name, simply iterate
+over the child devices to avoid the issue.
+
+Squash in unused variable removal (Alex)
+
+BugLink: https://bugs.launchpad.net/bugs/1920674
+Fixes: 25030321ba28 ("drm/amd: add pm domain for ACP IP sub blocks")
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 ++++++++++++-------------
+ 1 file changed, 26 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+index b8655ff73a65..cc9c9f8b23b2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -160,17 +160,28 @@ static int acp_poweron(struct generic_pm_domain *genpd)
+ return 0;
+ }
+
+-static struct device *get_mfd_cell_dev(const char *device_name, int r)
++static int acp_genpd_add_device(struct device *dev, void *data)
+ {
+- char auto_dev_name[25];
+- struct device *dev;
++ struct generic_pm_domain *gpd = data;
++ int ret;
+
+- snprintf(auto_dev_name, sizeof(auto_dev_name),
+- "%s.%d.auto", device_name, r);
+- dev = bus_find_device_by_name(&platform_bus_type, NULL, auto_dev_name);
+- dev_info(dev, "device %s added to pm domain\n", auto_dev_name);
++ ret = pm_genpd_add_device(gpd, dev);
++ if (ret)
++ dev_err(dev, "Failed to add dev to genpd %d\n", ret);
+
+- return dev;
++ return ret;
++}
++
++static int acp_genpd_remove_device(struct device *dev, void *data)
++{
++ int ret;
++
++ ret = pm_genpd_remove_device(dev);
++ if (ret)
++ dev_err(dev, "Failed to remove dev from genpd %d\n", ret);
++
++ /* Continue to remove */
++ return 0;
+ }
+
+ /**
+@@ -181,11 +192,10 @@ static struct device *get_mfd_cell_dev(const char *device_name, int r)
+ */
+ static int acp_hw_init(void *handle)
+ {
+- int r, i;
++ int r;
+ uint64_t acp_base;
+ u32 val = 0;
+ u32 count = 0;
+- struct device *dev;
+ struct i2s_platform_data *i2s_pdata = NULL;
+
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+@@ -341,15 +351,10 @@ static int acp_hw_init(void *handle)
+ if (r)
+ goto failure;
+
+- for (i = 0; i < ACP_DEVS ; i++) {
+- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
+- r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev);
+- if (r) {
+- dev_err(dev, "Failed to add dev to genpd\n");
+- goto failure;
+- }
+- }
+-
++ r = device_for_each_child(adev->acp.parent, &adev->acp.acp_genpd->gpd,
++ acp_genpd_add_device);
++ if (r)
++ goto failure;
+
+ /* Assert Soft reset of ACP */
+ val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET);
+@@ -410,10 +415,8 @@ failure:
+ */
+ static int acp_hw_fini(void *handle)
+ {
+- int i, ret;
+ u32 val = 0;
+ u32 count = 0;
+- struct device *dev;
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+ /* return early if no ACP */
+@@ -458,13 +461,8 @@ static int acp_hw_fini(void *handle)
+ udelay(100);
+ }
+
+- for (i = 0; i < ACP_DEVS ; i++) {
+- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
+- ret = pm_genpd_remove_device(dev);
+- /* If removal fails, dont giveup and try rest */
+- if (ret)
+- dev_err(dev, "remove dev from genpd failed\n");
+- }
++ device_for_each_child(adev->acp.parent, NULL,
++ acp_genpd_remove_device);
+
+ mfd_remove_devices(adev->acp.parent);
+ kfree(adev->acp.acp_res);
+--
+2.30.2
+
--- /dev/null
+From affd7be8cfa28b1727e3babcbd06c6080bf3312b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 13:09:59 +0530
+Subject: drm/gma500: Fix end of loop tests for list_for_each_entry
+
+From: Harshvardhan Jha <harshvardhan.jha@oracle.com>
+
+[ Upstream commit ea9a897b8affa0f7b4c90182b785dded74e434aa ]
+
+The list_for_each_entry() iterator, "connector" in this code, can never be
+NULL. If we exit the loop without finding the correct connector then
+"connector" points invalid memory that is an offset from the list head.
+This will eventually lead to memory corruption and presumably a kernel
+crash.
+
+Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
+Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210709073959.11443-1-harshvardhan.jha@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+index 432bdcc57ac9..a1332878857b 100644
+--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
++++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
+@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
+ continue;
+ }
+
+- if (!connector) {
++ if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
+ DRM_ERROR("Couldn't find connector when setting mode");
+ gma_power_end(dev);
+ return;
+--
+2.30.2
+
--- /dev/null
+From 2859e36aafd0686420400115cf8f7e248ec7abd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:44:53 -0700
+Subject: drm/msm/dp: replug event is converted into an unplug followed by an
+ plug events
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit 7e10bf427850f2d7133fd091999abd5fc1755cdb ]
+
+Remove special handling of replug interrupt and instead treat replug event
+as a sequential unplug followed by a plugin event. This is needed to meet
+the requirements of DP Link Layer CTS test case 4.2.1.3.
+
+Changes in V2:
+-- add fixes statement
+
+Changes in V3:
+-- delete EV_HPD_REPLUG_INT
+
+Fixes: f21c8a276c2d ("drm/msm/dp: handle irq_hpd with sink_count = 0 correctly")
+
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/1628196295-7382-5-git-send-email-khsieh@codeaurora.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index e6706a88d804..2b1e127390e4 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -55,7 +55,6 @@ enum {
+ EV_HPD_INIT_SETUP,
+ EV_HPD_PLUG_INT,
+ EV_IRQ_HPD_INT,
+- EV_HPD_REPLUG_INT,
+ EV_HPD_UNPLUG_INT,
+ EV_USER_NOTIFICATION,
+ EV_CONNECT_PENDING_TIMEOUT,
+@@ -1119,9 +1118,6 @@ static int hpd_event_thread(void *data)
+ case EV_IRQ_HPD_INT:
+ dp_irq_hpd_handle(dp_priv, todo->data);
+ break;
+- case EV_HPD_REPLUG_INT:
+- /* do nothing */
+- break;
+ case EV_USER_NOTIFICATION:
+ dp_display_send_hpd_notification(dp_priv,
+ todo->data);
+@@ -1165,10 +1161,8 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)
+
+ if (hpd_isr_status & 0x0F) {
+ /* hpd related interrupts */
+- if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK ||
+- hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
++ if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK)
+ dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
+- }
+
+ if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) {
+ /* stop sentinel connect pending checking */
+@@ -1176,8 +1170,10 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)
+ dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0);
+ }
+
+- if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK)
+- dp_add_event(dp, EV_HPD_REPLUG_INT, 0, 0);
++ if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
++ dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
++ dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3);
++ }
+
+ if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK)
+ dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+--
+2.30.2
+
--- /dev/null
+From 2742080bd0f050d77cf255affdba84dce6fec5f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 08:51:01 -0700
+Subject: drm/msm/dp: update is_connected status base on sink count at
+ dp_pm_resume()
+
+From: Kuogee Hsieh <khsieh@codeaurora.org>
+
+[ Upstream commit e8a767e04dbc7b201cb17ab99dca723a3488b6d4 ]
+
+Currently at dp_pm_resume() is_connected state is decided base on hpd connection
+status only. This will put is_connected in wrongly "true" state at the scenario
+that dongle attached to DUT but without hmdi cable connecting to it. Fix this
+problem by adding read sink count from dongle and decided is_connected state base
+on both sink count and hpd connection status.
+
+Changes in v2:
+-- remove dp_get_sink_count() cand call drm_dp_read_sink_count()
+
+Changes in v3:
+-- delete status local variable from dp_pm_resume()
+
+Changes in v4:
+-- delete un necessary comment at dp_pm_resume()
+
+Fixes: d9aa6571b28ba ("drm/msm/dp: check sink_count before update is_connected status")
+Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
+Link: https://lore.kernel.org/r/1628092261-32346-1-git-send-email-khsieh@codeaurora.org
+Tested-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dp/dp_display.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
+index cdec0a367a2c..e6706a88d804 100644
+--- a/drivers/gpu/drm/msm/dp/dp_display.c
++++ b/drivers/gpu/drm/msm/dp/dp_display.c
+@@ -1286,7 +1286,7 @@ static int dp_pm_resume(struct device *dev)
+ struct platform_device *pdev = to_platform_device(dev);
+ struct msm_dp *dp_display = platform_get_drvdata(pdev);
+ struct dp_display_private *dp;
+- u32 status;
++ int sink_count = 0;
+
+ dp = container_of(dp_display, struct dp_display_private, dp_display);
+
+@@ -1300,14 +1300,25 @@ static int dp_pm_resume(struct device *dev)
+
+ dp_catalog_ctrl_hpd_config(dp->catalog);
+
+- status = dp_catalog_link_is_connected(dp->catalog);
++ /*
++ * set sink to normal operation mode -- D0
++ * before dpcd read
++ */
++ dp_link_psm_config(dp->link, &dp->panel->link_info, false);
++
++ if (dp_catalog_link_is_connected(dp->catalog)) {
++ sink_count = drm_dp_read_sink_count(dp->aux);
++ if (sink_count < 0)
++ sink_count = 0;
++ }
+
++ dp->link->sink_count = sink_count;
+ /*
+ * can not declared display is connected unless
+ * HDMI cable is plugged in and sink_count of
+ * dongle become 1
+ */
+- if (status && dp->link->sink_count)
++ if (dp->link->sink_count)
+ dp->dp_display.is_connected = true;
+ else
+ dp->dp_display.is_connected = false;
+--
+2.30.2
+
--- /dev/null
+From 69d9867f5af14d8ffde976d06d205ce0c5b06fb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 02:05:19 +0300
+Subject: drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary
+ LMs
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ]
+
+dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs
+instead of mixers actually used for the CTL. Change it to clear
+necessary data, using provided mixer ids.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20210704230519.4081467-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+index 2d4645e01ebf..e01135b7a404 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+@@ -345,10 +345,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)
+ int i;
+
+ for (i = 0; i < ctx->mixer_count; i++) {
+- DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0);
+- DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0);
++ enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id;
++
++ DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0);
++ DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0);
+ }
+
+ DPU_REG_WRITE(c, CTL_FETCH_PIPE_ACTIVE, 0);
+--
+2.30.2
+
--- /dev/null
+From 86866248a0778a0730d1c61b583384c9130479d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 11:15:13 +0200
+Subject: drm/msm/dsi: Fix some reference counted resource leaks
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6977cc89c87506ff17e6c05f0e37f46752256e82 ]
+
+'of_find_device_by_node()' takes a reference that must be released when
+not needed anymore.
+This is expected to be done in 'dsi_destroy()'.
+
+However, there are 2 issues in 'dsi_get_phy()'.
+
+First, if 'of_find_device_by_node()' succeeds but 'platform_get_drvdata()'
+returns NULL, 'msm_dsi->phy_dev' will still be NULL, and the reference
+won't be released in 'dsi_destroy()'.
+
+Secondly, as 'of_find_device_by_node()' already takes a reference, there is
+no need for an additional 'get_device()'.
+
+Move the assignment to 'msm_dsi->phy_dev' a few lines above and remove the
+unneeded 'get_device()' to solve both issues.
+
+Fixes: ec31abf6684e ("drm/msm/dsi: Separate PHY to another platform device")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/f15bc57648a00e7c99f943903468a04639d50596.1628241097.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
+index 627048851d99..7e364b9c9f9e 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi.c
++++ b/drivers/gpu/drm/msm/dsi/dsi.c
+@@ -26,8 +26,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
+ }
+
+ phy_pdev = of_find_device_by_node(phy_node);
+- if (phy_pdev)
++ if (phy_pdev) {
+ msm_dsi->phy = platform_get_drvdata(phy_pdev);
++ msm_dsi->phy_dev = &phy_pdev->dev;
++ }
+
+ of_node_put(phy_node);
+
+@@ -36,8 +38,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
+ return -EPROBE_DEFER;
+ }
+
+- msm_dsi->phy_dev = get_device(&phy_pdev->dev);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 41c6f8fcfa4b803211a740fbe392c3de6d047a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 01:16:41 +0200
+Subject: drm/msm/mdp4: move HW revision detection to earlier phase
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 4af4fc92939dc811ef291c0673946555aa4fb71f ]
+
+Fixes if condition, which never worked inside mdp4_kms_init, since
+HW detection has been done later in mdp4_hw_init.
+
+Fixes: eb2b47bb9a03 ("drm/msm/mdp4: only use lut_clk on mdp4.2+")
+
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Link: https://lore.kernel.org/r/20210705231641.315804-2-david@ixit.cz
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 45 ++++++++++++------------
+ 1 file changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+index 3a7a01d801aa..0712752742f4 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+@@ -19,23 +19,12 @@ static int mdp4_hw_init(struct msm_kms *kms)
+ {
+ struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+ struct drm_device *dev = mdp4_kms->dev;
+- u32 major, minor, dmap_cfg, vg_cfg;
++ u32 dmap_cfg, vg_cfg;
+ unsigned long clk;
+ int ret = 0;
+
+ pm_runtime_get_sync(dev->dev);
+
+- read_mdp_hw_revision(mdp4_kms, &major, &minor);
+-
+- if (major != 4) {
+- DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
+- major, minor);
+- ret = -ENXIO;
+- goto out;
+- }
+-
+- mdp4_kms->rev = minor;
+-
+ if (mdp4_kms->rev > 1) {
+ mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER0, 0x0707ffff);
+ mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER1, 0x03073f3f);
+@@ -81,7 +70,6 @@ static int mdp4_hw_init(struct msm_kms *kms)
+ if (mdp4_kms->rev > 1)
+ mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1);
+
+-out:
+ pm_runtime_put_sync(dev->dev);
+
+ return ret;
+@@ -428,6 +416,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
+ struct msm_kms *kms = NULL;
+ struct msm_gem_address_space *aspace;
+ int irq, ret;
++ u32 major, minor;
+
+ mdp4_kms = kzalloc(sizeof(*mdp4_kms), GFP_KERNEL);
+ if (!mdp4_kms) {
+@@ -488,15 +477,6 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
+ if (IS_ERR(mdp4_kms->pclk))
+ mdp4_kms->pclk = NULL;
+
+- if (mdp4_kms->rev >= 2) {
+- mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk");
+- if (IS_ERR(mdp4_kms->lut_clk)) {
+- DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n");
+- ret = PTR_ERR(mdp4_kms->lut_clk);
+- goto fail;
+- }
+- }
+-
+ mdp4_kms->axi_clk = devm_clk_get(&pdev->dev, "bus_clk");
+ if (IS_ERR(mdp4_kms->axi_clk)) {
+ DRM_DEV_ERROR(dev->dev, "failed to get axi_clk\n");
+@@ -505,8 +485,27 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
+ }
+
+ clk_set_rate(mdp4_kms->clk, config->max_clk);
+- if (mdp4_kms->lut_clk)
++
++ read_mdp_hw_revision(mdp4_kms, &major, &minor);
++
++ if (major != 4) {
++ DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
++ major, minor);
++ ret = -ENXIO;
++ goto fail;
++ }
++
++ mdp4_kms->rev = minor;
++
++ if (mdp4_kms->rev >= 2) {
++ mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk");
++ if (IS_ERR(mdp4_kms->lut_clk)) {
++ DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n");
++ ret = PTR_ERR(mdp4_kms->lut_clk);
++ goto fail;
++ }
+ clk_set_rate(mdp4_kms->lut_clk, config->max_clk);
++ }
+
+ pm_runtime_enable(dev->dev);
+ mdp4_kms->rpm_enabled = true;
+--
+2.30.2
+
--- /dev/null
+From bd45b99d7b970a18d7d917767ef7d777bd82513f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 01:16:40 +0200
+Subject: drm/msm/mdp4: refactor HW revision detection into
+ read_mdp_hw_revision
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit 4d319afe666b0fc9a9855ba9bdf9ae3710ecf431 ]
+
+Inspired by MDP5 code.
+Also use DRM_DEV_INFO for MDP version as MDP5 does.
+
+Cosmetic change: uint32_t -> u32 - checkpatch suggestion.
+
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Link: https://lore.kernel.org/r/20210705231641.315804-1-david@ixit.cz
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 27 ++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+index 4a5b518288b0..3a7a01d801aa 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+@@ -19,20 +19,13 @@ static int mdp4_hw_init(struct msm_kms *kms)
+ {
+ struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
+ struct drm_device *dev = mdp4_kms->dev;
+- uint32_t version, major, minor, dmap_cfg, vg_cfg;
++ u32 major, minor, dmap_cfg, vg_cfg;
+ unsigned long clk;
+ int ret = 0;
+
+ pm_runtime_get_sync(dev->dev);
+
+- mdp4_enable(mdp4_kms);
+- version = mdp4_read(mdp4_kms, REG_MDP4_VERSION);
+- mdp4_disable(mdp4_kms);
+-
+- major = FIELD(version, MDP4_VERSION_MAJOR);
+- minor = FIELD(version, MDP4_VERSION_MINOR);
+-
+- DBG("found MDP4 version v%d.%d", major, minor);
++ read_mdp_hw_revision(mdp4_kms, &major, &minor);
+
+ if (major != 4) {
+ DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
+@@ -411,6 +404,22 @@ fail:
+ return ret;
+ }
+
++static void read_mdp_hw_revision(struct mdp4_kms *mdp4_kms,
++ u32 *major, u32 *minor)
++{
++ struct drm_device *dev = mdp4_kms->dev;
++ u32 version;
++
++ mdp4_enable(mdp4_kms);
++ version = mdp4_read(mdp4_kms, REG_MDP4_VERSION);
++ mdp4_disable(mdp4_kms);
++
++ *major = FIELD(version, MDP4_VERSION_MAJOR);
++ *minor = FIELD(version, MDP4_VERSION_MINOR);
++
++ DRM_DEV_INFO(dev->dev, "MDP4 version v%d.%d", *major, *minor);
++}
++
+ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev->dev);
+--
+2.30.2
+
--- /dev/null
+From 3bd69581878fb62aff0aef4ece042f1273129aed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 00:49:46 +0200
+Subject: drm: mxsfb: Clear FIFO_CLEAR bit
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 5e23c98178eb1a2cdb7c4fee9a39baf8cabf282d ]
+
+Make sure the FIFO_CLEAR bit is latched in when configuring the
+controller, so that the FIFO is really cleared. And then clear
+the FIFO_CLEAR bit, since it is not self-clearing.
+
+Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Daniel Abrecht <public@danielabrecht.ch>
+Cc: Emil Velikov <emil.l.velikov@gmail.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
+Tested-by: Jagan Teki <jagan@amarulasolutions.com> # i.Core MX8MM
+Acked-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210620224946.189524-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/mxsfb_kms.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+index 5bcc06c1ac0b..54f905ac75c0 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+@@ -243,6 +243,9 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
+
+ /* Clear the FIFOs */
+ writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
++ readl(mxsfb->base + LCDC_CTRL1);
++ writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_CLR);
++ readl(mxsfb->base + LCDC_CTRL1);
+
+ if (mxsfb->devdata->has_overlay)
+ writel(0, mxsfb->base + LCDC_AS_CTRL);
+--
+2.30.2
+
--- /dev/null
+From e702e9c0ca8ec70c09d18fcea424bdc50a61af93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 00:47:01 +0200
+Subject: drm: mxsfb: Enable recovery on underflow
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 0c9856e4edcdcac22d65618e8ceff9eb41447880 ]
+
+There is some sort of corner case behavior of the controller,
+which could rarely be triggered at least on i.MX6SX connected
+to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS
+bridged 1920x1080 panel (and likely on other setups too), where
+the image on the panel shifts to the right and wraps around.
+This happens either when the controller is enabled on boot or
+even later during run time. The condition does not correct
+itself automatically, i.e. the display image remains shifted.
+
+It seems this problem is known and is due to sporadic underflows
+of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow
+IRQs, neither of the IRQs trigger and neither IRQ status bit is
+asserted when this condition occurs.
+
+All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW
+bit, which is described in the reference manual since i.MX23 as
+"
+ Set this bit to enable the LCDIF block to recover in the next
+ field/frame if there was an underflow in the current field/frame.
+"
+Enable this bit to mitigate the sporadic underflows.
+
+Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Daniel Abrecht <public@danielabrecht.ch>
+Cc: Emil Velikov <emil.l.velikov@gmail.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210620224701.189289-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/mxsfb_kms.c | 29 +++++++++++++++++++++++++++++
+ drivers/gpu/drm/mxsfb/mxsfb_regs.h | 1 +
+ 2 files changed, 30 insertions(+)
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+index 300e7bab0f43..01e0f525360f 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+@@ -115,6 +115,35 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
+ reg |= VDCTRL4_SYNC_SIGNALS_ON;
+ writel(reg, mxsfb->base + LCDC_VDCTRL4);
+
++ /*
++ * Enable recovery on underflow.
++ *
++ * There is some sort of corner case behavior of the controller,
++ * which could rarely be triggered at least on i.MX6SX connected
++ * to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS
++ * bridged 1920x1080 panel (and likely on other setups too), where
++ * the image on the panel shifts to the right and wraps around.
++ * This happens either when the controller is enabled on boot or
++ * even later during run time. The condition does not correct
++ * itself automatically, i.e. the display image remains shifted.
++ *
++ * It seems this problem is known and is due to sporadic underflows
++ * of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow
++ * IRQs, neither of the IRQs trigger and neither IRQ status bit is
++ * asserted when this condition occurs.
++ *
++ * All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW
++ * bit, which is described in the reference manual since i.MX23 as
++ * "
++ * Set this bit to enable the LCDIF block to recover in the next
++ * field/frame if there was an underflow in the current field/frame.
++ * "
++ * Enable this bit to mitigate the sporadic underflows.
++ */
++ reg = readl(mxsfb->base + LCDC_CTRL1);
++ reg |= CTRL1_RECOVER_ON_UNDERFLOW;
++ writel(reg, mxsfb->base + LCDC_CTRL1);
++
+ writel(CTRL_RUN, mxsfb->base + LCDC_CTRL + REG_SET);
+ }
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+index 55d28a27f912..df90e960f495 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
++++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+@@ -54,6 +54,7 @@
+ #define CTRL_DF24 BIT(1)
+ #define CTRL_RUN BIT(0)
+
++#define CTRL1_RECOVER_ON_UNDERFLOW BIT(24)
+ #define CTRL1_FIFO_CLEAR BIT(21)
+ #define CTRL1_SET_BYTE_PACKAGING(x) (((x) & 0xf) << 16)
+ #define CTRL1_GET_BYTE_PACKAGING(x) (((x) >> 16) & 0xf)
+--
+2.30.2
+
--- /dev/null
+From 887ef82617ab886b1ba74017b28a8404fb2062f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 00:47:59 +0200
+Subject: drm: mxsfb: Increase number of outstanding requests on V4 and newer
+ HW
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 9891cb54445bc65bf156bda416b6215048c7f617 ]
+
+In case the DRAM is under high load, the MXSFB FIFO might underflow
+and that causes visible artifacts. This could be triggered on i.MX8MM
+using e.g. "$ memtester 128M" on a device with 1920x1080 panel. The
+first "Stuck Address" test of the memtester will completely corrupt
+the image on the panel and leave the MXSFB FIFO in odd state.
+
+To avoid this underflow, increase number of outstanding requests to
+DRAM from 2 to 16, which is the maximum. This mitigates the issue
+and it can no longer be triggered.
+
+Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Daniel Abrecht <public@danielabrecht.ch>
+Cc: Emil Velikov <emil.l.velikov@gmail.com>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210620224759.189351-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mxsfb/mxsfb_drv.c | 3 +++
+ drivers/gpu/drm/mxsfb/mxsfb_drv.h | 1 +
+ drivers/gpu/drm/mxsfb/mxsfb_kms.c | 8 ++++++++
+ drivers/gpu/drm/mxsfb/mxsfb_regs.h | 8 ++++++++
+ 4 files changed, 20 insertions(+)
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+index 6da93551e2e5..c277d3f61a5e 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+@@ -51,6 +51,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
+ .hs_wdth_mask = 0xff,
+ .hs_wdth_shift = 24,
+ .has_overlay = false,
++ .has_ctrl2 = false,
+ },
+ [MXSFB_V4] = {
+ .transfer_count = LCDC_V4_TRANSFER_COUNT,
+@@ -59,6 +60,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
+ .hs_wdth_mask = 0x3fff,
+ .hs_wdth_shift = 18,
+ .has_overlay = false,
++ .has_ctrl2 = true,
+ },
+ [MXSFB_V6] = {
+ .transfer_count = LCDC_V4_TRANSFER_COUNT,
+@@ -67,6 +69,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
+ .hs_wdth_mask = 0x3fff,
+ .hs_wdth_shift = 18,
+ .has_overlay = true,
++ .has_ctrl2 = true,
+ },
+ };
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.h b/drivers/gpu/drm/mxsfb/mxsfb_drv.h
+index 399d23e91ed1..7c720e226fdf 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.h
++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.h
+@@ -22,6 +22,7 @@ struct mxsfb_devdata {
+ unsigned int hs_wdth_mask;
+ unsigned int hs_wdth_shift;
+ bool has_overlay;
++ bool has_ctrl2;
+ };
+
+ struct mxsfb_drm_private {
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+index 01e0f525360f..5bcc06c1ac0b 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
++++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+@@ -107,6 +107,14 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
+ clk_prepare_enable(mxsfb->clk_disp_axi);
+ clk_prepare_enable(mxsfb->clk);
+
++ /* Increase number of outstanding requests on all supported IPs */
++ if (mxsfb->devdata->has_ctrl2) {
++ reg = readl(mxsfb->base + LCDC_V4_CTRL2);
++ reg &= ~CTRL2_SET_OUTSTANDING_REQS_MASK;
++ reg |= CTRL2_SET_OUTSTANDING_REQS_16;
++ writel(reg, mxsfb->base + LCDC_V4_CTRL2);
++ }
++
+ /* If it was disabled, re-enable the mode again */
+ writel(CTRL_DOTCLK_MODE, mxsfb->base + LCDC_CTRL + REG_SET);
+
+diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+index df90e960f495..694fea13e893 100644
+--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
++++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+@@ -15,6 +15,7 @@
+ #define LCDC_CTRL 0x00
+ #define LCDC_CTRL1 0x10
+ #define LCDC_V3_TRANSFER_COUNT 0x20
++#define LCDC_V4_CTRL2 0x20
+ #define LCDC_V4_TRANSFER_COUNT 0x30
+ #define LCDC_V4_CUR_BUF 0x40
+ #define LCDC_V4_NEXT_BUF 0x50
+@@ -61,6 +62,13 @@
+ #define CTRL1_CUR_FRAME_DONE_IRQ_EN BIT(13)
+ #define CTRL1_CUR_FRAME_DONE_IRQ BIT(9)
+
++#define CTRL2_SET_OUTSTANDING_REQS_1 0
++#define CTRL2_SET_OUTSTANDING_REQS_2 (0x1 << 21)
++#define CTRL2_SET_OUTSTANDING_REQS_4 (0x2 << 21)
++#define CTRL2_SET_OUTSTANDING_REQS_8 (0x3 << 21)
++#define CTRL2_SET_OUTSTANDING_REQS_16 (0x4 << 21)
++#define CTRL2_SET_OUTSTANDING_REQS_MASK (0x7 << 21)
++
+ #define TRANSFER_COUNT_SET_VCOUNT(x) (((x) & 0xffff) << 16)
+ #define TRANSFER_COUNT_GET_VCOUNT(x) (((x) >> 16) & 0xffff)
+ #define TRANSFER_COUNT_SET_HCOUNT(x) ((x) & 0xffff)
+--
+2.30.2
+
--- /dev/null
+From 5e80e99cdfe96182b39972deba5d0d35adbf6e60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 15:33:00 +0100
+Subject: drm/of: free the iterator object on failure
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit 6f9223a56fabc840836b49de27dc7b27642c6a32 ]
+
+When bailing out due to the sanity check the iterator value needs to be
+freed because the early return prevents for_each_child_of_node() from
+doing the dereference itself.
+
+Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210714143300.20632-1-steven.price@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_of.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
+index 197c57477344..997b8827fed2 100644
+--- a/drivers/gpu/drm/drm_of.c
++++ b/drivers/gpu/drm/drm_of.c
+@@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type(
+ * configurations by passing the endpoints explicitly to
+ * drm_of_lvds_get_dual_link_pixel_order().
+ */
+- if (!current_pt || pixels_type != current_pt)
++ if (!current_pt || pixels_type != current_pt) {
++ of_node_put(endpoint);
+ return -EINVAL;
++ }
+ }
+
+ return pixels_type;
+--
+2.30.2
+
--- /dev/null
+From 761ab3c6efef0d59d299ebbe0b30cb64a63d57a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 22:07:17 +0200
+Subject: drm/of: free the right object
+
+From: Julia Lawall <Julia.Lawall@inria.fr>
+
+[ Upstream commit b557a5f8da5798d27370ed6b73e673aae33efd55 ]
+
+There is no need to free a NULL value. Instead, free the object
+that is leaking due to the iterator.
+
+The semantic patch that finds this problem is as follows:
+
+// <smpl>
+@@
+expression x,e;
+identifier f;
+@@
+ x = f(...);
+ if (x == NULL) {
+ ... when any
+ when != x = e
+* of_node_put(x);
+ ...
+ }
+// </smpl>
+
+Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
+Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210709200717.3676376-1-Julia.Lawall@inria.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_of.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
+index ca04c34e8251..197c57477344 100644
+--- a/drivers/gpu/drm/drm_of.c
++++ b/drivers/gpu/drm/drm_of.c
+@@ -315,7 +315,7 @@ static int drm_of_lvds_get_remote_pixels_type(
+
+ remote_port = of_graph_get_remote_port(endpoint);
+ if (!remote_port) {
+- of_node_put(remote_port);
++ of_node_put(endpoint);
+ return -EPIPE;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From dd202e78b65cc568f8dcd3937da8f6e58bc7d7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jun 2021 14:38:56 +0000
+Subject: drm/panfrost: Fix missing clk_disable_unprepare() on error in
+ panfrost_clk_init()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit f42498705965bd4b026953c1892c686d8b1138e4 ]
+
+Fix the missing clk_disable_unprepare() before return
+from panfrost_clk_init() in the error handling case.
+
+Fixes: b681af0bc1cc ("drm: panfrost: add optional bus_clock")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210608143856.4154766-1-weiyongjun1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_device.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_device.c b/drivers/gpu/drm/panfrost/panfrost_device.c
+index fbcf5edbe367..9275cd0b2793 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_device.c
++++ b/drivers/gpu/drm/panfrost/panfrost_device.c
+@@ -54,7 +54,8 @@ static int panfrost_clk_init(struct panfrost_device *pfdev)
+ if (IS_ERR(pfdev->bus_clock)) {
+ dev_err(pfdev->dev, "get bus_clock failed %ld\n",
+ PTR_ERR(pfdev->bus_clock));
+- return PTR_ERR(pfdev->bus_clock);
++ err = PTR_ERR(pfdev->bus_clock);
++ goto disable_clock;
+ }
+
+ if (pfdev->bus_clock) {
+--
+2.30.2
+
--- /dev/null
+From 8a03073b5c6bb2a261e2c20278a312a58424d8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 02:09:53 +0200
+Subject: drm: rcar-du: Don't put reference to drm_device in rcar_du_remove()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit c29b6b0b126e9ee69a5d6339475e831a149295bd ]
+
+The reference to the drm_device that was acquired by
+devm_drm_dev_alloc() is released automatically by the devres
+infrastructure. It must not be released manually, as that causes a
+reference underflow..
+
+Fixes: ea6aae151887 ("drm: rcar-du: Embed drm_device in rcar_du_device")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+index bfbff90588cb..c22551c2facb 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+@@ -556,8 +556,6 @@ static int rcar_du_remove(struct platform_device *pdev)
+
+ drm_kms_helper_poll_fini(ddev);
+
+- drm_dev_put(ddev);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0a5265586fff092ed5654f3c833a2c2de3d40b55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 10:57:00 -0700
+Subject: EDAC/i10nm: Fix NVDIMM detection
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 2294a7299f5e51667b841f63c6d69474491753fb ]
+
+MCDDRCFG is a per-channel register and uses bit{0,1} to indicate
+the NVDIMM presence on DIMM slot{0,1}. Current i10nm_edac driver
+wrongly uses MCDDRCFG as per-DIMM register and fails to detect
+the NVDIMM.
+
+Fix it by reading MCDDRCFG as per-channel register and using its
+bit{0,1} to check whether the NVDIMM is populated on DIMM slot{0,1}.
+
+Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors")
+Reported-by: Fan Du <fan.du@intel.com>
+Tested-by: Wen Jin <wen.jin@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/r/20210818175701.1611513-2-tony.luck@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/i10nm_base.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
+index 37b4e875420e..1cea5d8fa434 100644
+--- a/drivers/edac/i10nm_base.c
++++ b/drivers/edac/i10nm_base.c
+@@ -26,8 +26,8 @@
+ pci_read_config_dword((d)->uracu, 0xd8 + (i) * 4, &(reg))
+ #define I10NM_GET_DIMMMTR(m, i, j) \
+ readl((m)->mbase + 0x2080c + (i) * (m)->chan_mmio_sz + (j) * 4)
+-#define I10NM_GET_MCDDRTCFG(m, i, j) \
+- readl((m)->mbase + 0x20970 + (i) * (m)->chan_mmio_sz + (j) * 4)
++#define I10NM_GET_MCDDRTCFG(m, i) \
++ readl((m)->mbase + 0x20970 + (i) * (m)->chan_mmio_sz)
+ #define I10NM_GET_MCMTR(m, i) \
+ readl((m)->mbase + 0x20ef8 + (i) * (m)->chan_mmio_sz)
+ #define I10NM_GET_AMAP(m, i) \
+@@ -185,10 +185,10 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
+
+ ndimms = 0;
+ amap = I10NM_GET_AMAP(imc, i);
++ mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i);
+ for (j = 0; j < I10NM_NUM_DIMMS; j++) {
+ dimm = edac_get_dimm(mci, i, j, 0);
+ mtr = I10NM_GET_DIMMMTR(imc, i, j);
+- mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i, j);
+ edac_dbg(1, "dimmmtr 0x%x mcddrtcfg 0x%x (mc%d ch%d dimm%d)\n",
+ mtr, mcddrtcfg, imc->mc, i, j);
+
+--
+2.30.2
+
--- /dev/null
+From 1250fb8ffa2b5d7bec248e8e9ce3dffcbe6e6b34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jun 2021 12:27:40 -0500
+Subject: EDAC/mce_amd: Do not load edac_mce_amd module on guests
+
+From: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
+
+[ Upstream commit 767f4b620edadac579c9b8b6660761d4285fa6f9 ]
+
+Hypervisors likely do not expose the SMCA feature to the guest and
+loading this module leads to false warnings. This module should not be
+loaded in guests to begin with, but people tend to do so, especially
+when testing kernels in VMs. And then they complain about those false
+warnings.
+
+Do the practical thing and do not load this module when running as a
+guest to avoid all that complaining.
+
+ [ bp: Rewrite commit message. ]
+
+Suggested-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Tested-by: Kim Phillips <kim.phillips@amd.com>
+Link: https://lkml.kernel.org/r/20210628172740.245689-1-Smita.KoralahalliChannabasappa@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/mce_amd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
+index 5dd905a3f30c..1a1629166aa3 100644
+--- a/drivers/edac/mce_amd.c
++++ b/drivers/edac/mce_amd.c
+@@ -1176,6 +1176,9 @@ static int __init mce_amd_init(void)
+ c->x86_vendor != X86_VENDOR_HYGON)
+ return -ENODEV;
+
++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
++ return -ENODEV;
++
+ if (boot_cpu_has(X86_FEATURE_SMCA)) {
+ xec_mask = 0x3f;
+ goto out;
+--
+2.30.2
+
--- /dev/null
+From 3a69a26e42f887ee45314e7dfcbbc25fda5f6fc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 17:18:31 +0800
+Subject: fcntl: fix potential deadlock for &fasync_struct.fa_lock
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
+
+There is an existing lock hierarchy of
+&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
+from the following call chain:
+
+ input_inject_event():
+ spin_lock_irqsave(&dev->event_lock,...);
+ input_handle_event():
+ input_pass_values():
+ input_to_handler():
+ evdev_events():
+ evdev_pass_values():
+ spin_lock(&client->buffer_lock);
+ __pass_event():
+ kill_fasync():
+ kill_fasync_rcu():
+ read_lock(&fa->fa_lock);
+ send_sigio():
+ read_lock_irqsave(&fown->lock,...);
+
+&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
+while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
+hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
+an exported symbol, it may not necessarily be called with interrupts
+disabled.
+
+As kill_fasync_rcu may be called with interrupts disabled (for
+example, in the call chain above), we replace calls to
+read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
+with read_lock_irqsave/read_unlock_irqrestore.
+
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fcntl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index cf9e81dfa615..887db4918a89 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -1004,13 +1004,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
+ {
+ while (fa) {
+ struct fown_struct *fown;
++ unsigned long flags;
+
+ if (fa->magic != FASYNC_MAGIC) {
+ printk(KERN_ERR "kill_fasync: bad magic number in "
+ "fasync_struct!\n");
+ return;
+ }
+- read_lock(&fa->fa_lock);
++ read_lock_irqsave(&fa->fa_lock, flags);
+ if (fa->fa_file) {
+ fown = &fa->fa_file->f_owner;
+ /* Don't send SIGURG to processes which have not set a
+@@ -1019,7 +1020,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
+ if (!(sig == SIGURG && fown->signum == 0))
+ send_sigio(fown, fa->fa_fd, band);
+ }
+- read_unlock(&fa->fa_lock);
++ read_unlock_irqrestore(&fa->fa_lock, flags);
+ fa = rcu_dereference(fa->fa_next);
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 9c9abb48f47a79235e54cd3bd021d0ebb993fa3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 17:18:30 +0800
+Subject: fcntl: fix potential deadlocks for &fown_struct.lock
+
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+
+[ Upstream commit f671a691e299f58835d4660d642582bf0e8f6fda ]
+
+Syzbot reports a potential deadlock in do_fcntl:
+
+========================================================
+WARNING: possible irq lock inversion dependency detected
+5.12.0-syzkaller #0 Not tainted
+--------------------------------------------------------
+syz-executor132/8391 just changed the state of lock:
+ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: f_getown_ex fs/fcntl.c:211 [inline]
+ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: do_fcntl+0x8b4/0x1200 fs/fcntl.c:395
+but this lock was taken by another, HARDIRQ-safe lock in the past:
+ (&dev->event_lock){-...}-{2:2}
+
+and interrupts could create inverse lock ordering between them.
+
+other info that might help us debug this:
+Chain exists of:
+ &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
+
+ Possible interrupt unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&f->f_owner.lock);
+ local_irq_disable();
+ lock(&dev->event_lock);
+ lock(&new->fa_lock);
+ <Interrupt>
+ lock(&dev->event_lock);
+
+ *** DEADLOCK ***
+
+This happens because there is a lock hierarchy of
+&dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
+from the following call chain:
+
+ input_inject_event():
+ spin_lock_irqsave(&dev->event_lock,...);
+ input_handle_event():
+ input_pass_values():
+ input_to_handler():
+ evdev_events():
+ evdev_pass_values():
+ spin_lock(&client->buffer_lock);
+ __pass_event():
+ kill_fasync():
+ kill_fasync_rcu():
+ read_lock(&fa->fa_lock);
+ send_sigio():
+ read_lock_irqsave(&fown->lock,...);
+
+However, since &dev->event_lock is HARDIRQ-safe, interrupts have to be
+disabled while grabbing &f->f_owner.lock, otherwise we invert the lock
+hierarchy.
+
+Hence, we replace calls to read_lock/read_unlock on &f->f_owner.lock,
+with read_lock_irq/read_unlock_irq.
+
+Reported-and-tested-by: syzbot+e6d5398a02c516ce5e70@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fcntl.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index dfc72f15be7f..cf9e81dfa615 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -150,7 +150,8 @@ void f_delown(struct file *filp)
+ pid_t f_getown(struct file *filp)
+ {
+ pid_t pid = 0;
+- read_lock(&filp->f_owner.lock);
++
++ read_lock_irq(&filp->f_owner.lock);
+ rcu_read_lock();
+ if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
+ pid = pid_vnr(filp->f_owner.pid);
+@@ -158,7 +159,7 @@ pid_t f_getown(struct file *filp)
+ pid = -pid;
+ }
+ rcu_read_unlock();
+- read_unlock(&filp->f_owner.lock);
++ read_unlock_irq(&filp->f_owner.lock);
+ return pid;
+ }
+
+@@ -208,7 +209,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
+ struct f_owner_ex owner = {};
+ int ret = 0;
+
+- read_lock(&filp->f_owner.lock);
++ read_lock_irq(&filp->f_owner.lock);
+ rcu_read_lock();
+ if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
+ owner.pid = pid_vnr(filp->f_owner.pid);
+@@ -231,7 +232,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
+ ret = -EINVAL;
+ break;
+ }
+- read_unlock(&filp->f_owner.lock);
++ read_unlock_irq(&filp->f_owner.lock);
+
+ if (!ret) {
+ ret = copy_to_user(owner_p, &owner, sizeof(owner));
+@@ -249,10 +250,10 @@ static int f_getowner_uids(struct file *filp, unsigned long arg)
+ uid_t src[2];
+ int err;
+
+- read_lock(&filp->f_owner.lock);
++ read_lock_irq(&filp->f_owner.lock);
+ src[0] = from_kuid(user_ns, filp->f_owner.uid);
+ src[1] = from_kuid(user_ns, filp->f_owner.euid);
+- read_unlock(&filp->f_owner.lock);
++ read_unlock_irq(&filp->f_owner.lock);
+
+ err = put_user(src[0], &dst[0]);
+ err |= put_user(src[1], &dst[1]);
+--
+2.30.2
+
--- /dev/null
+From d9462adbc2fcfb50f2cde3c1cf169dddc7611026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 14:45:31 +0800
+Subject: firmware: fix theoretical UAF race with firmware cache and resume
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 3ecc8cb7c092b2f50e21d2aaaae35b8221ee7214 ]
+
+This race was discovered when I carefully analyzed the code to locate
+another firmware-related UAF issue. It can be triggered only when the
+firmware load operation is executed during suspend. This possibility is
+almost impossible because there are few firmware load and suspend actions
+in the actual environment.
+
+ CPU0 CPU1
+__device_uncache_fw_images(): assign_fw():
+ fw_cache_piggyback_on_request()
+ <----- P0
+ spin_lock(&fwc->name_lock);
+ ...
+ list_del(&fce->list);
+ spin_unlock(&fwc->name_lock);
+
+ uncache_firmware(fce->name);
+ <----- P1
+ kref_get(&fw_priv->ref);
+
+If CPU1 is interrupted at position P0, the new 'fce' has been added to the
+list fwc->fw_names by the fw_cache_piggyback_on_request(). In this case,
+CPU0 executes __device_uncache_fw_images() and will be able to see it when
+it traverses list fwc->fw_names. Before CPU1 executes kref_get() at P1, if
+CPU0 further executes uncache_firmware(), the count of fw_priv->ref may
+decrease to 0, causing fw_priv to be released in advance.
+
+Move kref_get() to the lock protection range of fwc->name_lock to fix it.
+
+Fixes: ac39b3ea73aa ("firmware loader: let caching firmware piggyback on loading firmware")
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Link: https://lore.kernel.org/r/20210719064531.3733-2-thunder.leizhen@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/firmware_loader/main.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
+index 68c549d71230..bdbedc6660a8 100644
+--- a/drivers/base/firmware_loader/main.c
++++ b/drivers/base/firmware_loader/main.c
+@@ -165,7 +165,7 @@ static inline int fw_state_wait(struct fw_priv *fw_priv)
+ return __fw_state_wait_common(fw_priv, MAX_SCHEDULE_TIMEOUT);
+ }
+
+-static int fw_cache_piggyback_on_request(const char *name);
++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv);
+
+ static struct fw_priv *__allocate_fw_priv(const char *fw_name,
+ struct firmware_cache *fwc,
+@@ -707,10 +707,8 @@ int assign_fw(struct firmware *fw, struct device *device)
+ * on request firmware.
+ */
+ if (!(fw_priv->opt_flags & FW_OPT_NOCACHE) &&
+- fw_priv->fwc->state == FW_LOADER_START_CACHE) {
+- if (fw_cache_piggyback_on_request(fw_priv->fw_name))
+- kref_get(&fw_priv->ref);
+- }
++ fw_priv->fwc->state == FW_LOADER_START_CACHE)
++ fw_cache_piggyback_on_request(fw_priv);
+
+ /* pass the pages buffer to driver at the last minute */
+ fw_set_page_data(fw_priv, fw);
+@@ -1259,11 +1257,11 @@ static int __fw_entry_found(const char *name)
+ return 0;
+ }
+
+-static int fw_cache_piggyback_on_request(const char *name)
++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv)
+ {
+- struct firmware_cache *fwc = &fw_cache;
++ const char *name = fw_priv->fw_name;
++ struct firmware_cache *fwc = fw_priv->fwc;
+ struct fw_cache_entry *fce;
+- int ret = 0;
+
+ spin_lock(&fwc->name_lock);
+ if (__fw_entry_found(name))
+@@ -1271,13 +1269,12 @@ static int fw_cache_piggyback_on_request(const char *name)
+
+ fce = alloc_fw_cache_entry(name);
+ if (fce) {
+- ret = 1;
+ list_add(&fce->list, &fwc->fw_names);
++ kref_get(&fw_priv->ref);
+ pr_debug("%s: fw: %s\n", __func__, name);
+ }
+ found:
+ spin_unlock(&fwc->name_lock);
+- return ret;
+ }
+
+ static void free_fw_cache_entry(struct fw_cache_entry *fce)
+@@ -1508,9 +1505,8 @@ static inline void unregister_fw_pm_ops(void)
+ unregister_pm_notifier(&fw_cache.pm_notify);
+ }
+ #else
+-static int fw_cache_piggyback_on_request(const char *name)
++static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv)
+ {
+- return 0;
+ }
+ static inline int register_fw_pm_ops(void)
+ {
+--
+2.30.2
+
--- /dev/null
+From 8ed8ec34849348ee522cf1a493292328f1c5dd29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 08:46:11 +0200
+Subject: firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 09cbd1df7d2615c19e40facbe31fdcb5f1ebfa96 ]
+
+The reference taken by 'of_find_device_by_node()' must be released when
+not needed anymore.
+
+Add the corresponding 'put_device()' in the normal and error handling
+paths.
+
+Fixes: 4e3d60656a72 ("ARM: bcm2835: Add the Raspberry Pi firmware driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/5e17e5409b934cd08bf6f9279c73be5c1cb11cce.1628232242.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/raspberrypi.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index 250e01680742..4b8978b254f9 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -329,12 +329,18 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+
+ fw = platform_get_drvdata(pdev);
+ if (!fw)
+- return NULL;
++ goto err_put_device;
+
+ if (!kref_get_unless_zero(&fw->consumers))
+- return NULL;
++ goto err_put_device;
++
++ put_device(&pdev->dev);
+
+ return fw;
++
++err_put_device:
++ put_device(&pdev->dev);
++ return NULL;
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_get);
+
+--
+2.30.2
+
--- /dev/null
+From 09d0a204402b0a9053f531774f7525f1c9803952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 17:33:32 +0800
+Subject: genirq/timings: Fix error return code in irq_timings_test_irqs()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 290fdc4b7ef14e33d0e30058042b0e9bfd02b89b ]
+
+Return a negative error code from the error handling case instead of 0, as
+done elsewhere in this function.
+
+Fixes: f52da98d900e ("genirq/timings: Add selftest for irqs circular buffer")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20210811093333.2376-1-thunder.leizhen@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/timings.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c
+index 4d2a702d7aa9..c43e2ac2f8de 100644
+--- a/kernel/irq/timings.c
++++ b/kernel/irq/timings.c
+@@ -799,12 +799,14 @@ static int __init irq_timings_test_irqs(struct timings_intervals *ti)
+
+ __irq_timings_store(irq, irqs, ti->intervals[i]);
+ if (irqs->circ_timings[i & IRQ_TIMINGS_MASK] != index) {
++ ret = -EBADSLT;
+ pr_err("Failed to store in the circular buffer\n");
+ goto out;
+ }
+ }
+
+ if (irqs->count != ti->count) {
++ ret = -ERANGE;
+ pr_err("Count differs\n");
+ goto out;
+ }
+--
+2.30.2
+
--- /dev/null
+From 7c08bc2bca58b37fa0b91cd647c313030ca54c3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 17:24:30 +0100
+Subject: gfs2: Fix memory leak of object lsi on error return path
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a6579cbfd7216b071008db13360c322a6b21400b ]
+
+In the case where IS_ERR(lsi->si_sc_inode) is true the error exit path
+to free_local does not kfree the allocated object lsi leading to a memory
+leak. Fix this by kfree'ing lst before taking the error exit path.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: 97fd734ba17e ("gfs2: lookup local statfs inodes prior to journal recovery")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/ops_fstype.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 5f4504dd0875..bd3b3be1a473 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -677,6 +677,7 @@ static int init_statfs(struct gfs2_sbd *sdp)
+ error = PTR_ERR(lsi->si_sc_inode);
+ fs_err(sdp, "can't find local \"sc\" file#%u: %d\n",
+ jd->jd_jid, error);
++ kfree(lsi);
+ goto free_local;
+ }
+ lsi->si_jid = jd->jd_jid;
+--
+2.30.2
+
--- /dev/null
+From c37fda96e5479b08abac0ec3e9ed11b164396f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 07:42:33 -0500
+Subject: gfs2: init system threads before freeze lock
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit a28dc123fa66ba7f3eca7cffc4b01d96bfd35c27 ]
+
+Patch 96b1454f2e ("gfs2: move freeze glock outside the make_fs_rw and _ro
+functions") changed the gfs2 mount sequence so that it holds the freeze
+lock before calling gfs2_make_fs_rw. Before this patch, gfs2_make_fs_rw
+called init_threads to initialize the quotad and logd threads. That is a
+problem if the system needs to withdraw due to IO errors early in the
+mount sequence, for example, while initializing the system statfs inode:
+
+1. An IO error causes the statfs glock to not sync properly after
+ recovery, and leaves items on the ail list.
+2. The leftover items on the ail list causes its do_xmote call to fail,
+ which makes it want to withdraw. But since the glock code cannot
+ withdraw (because the withdraw sequence uses glocks) it relies upon
+ the logd daemon to initiate the withdraw.
+3. The withdraw can never be performed by the logd daemon because all
+ this takes place before the logd daemon is started.
+
+This patch moves function init_threads from super.c to ops_fstype.c
+and it changes gfs2_fill_super to start its threads before holding the
+freeze lock, and if there's an error, stop its threads after releasing
+it. This allows the logd to run unblocked by the freeze lock. Thus,
+the logd daemon can perform its withdraw sequence properly.
+
+Fixes: 96b1454f2e8e ("gfs2: move freeze glock outside the make_fs_rw and _ro functions")
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/ops_fstype.c | 42 ++++++++++++++++++++++++++++++
+ fs/gfs2/super.c | 61 +++++---------------------------------------
+ 2 files changed, 48 insertions(+), 55 deletions(-)
+
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index bd3b3be1a473..ca76e3b8792c 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1089,6 +1089,34 @@ void gfs2_online_uevent(struct gfs2_sbd *sdp)
+ kobject_uevent_env(&sdp->sd_kobj, KOBJ_ONLINE, envp);
+ }
+
++static int init_threads(struct gfs2_sbd *sdp)
++{
++ struct task_struct *p;
++ int error = 0;
++
++ p = kthread_run(gfs2_logd, sdp, "gfs2_logd");
++ if (IS_ERR(p)) {
++ error = PTR_ERR(p);
++ fs_err(sdp, "can't start logd thread: %d\n", error);
++ return error;
++ }
++ sdp->sd_logd_process = p;
++
++ p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad");
++ if (IS_ERR(p)) {
++ error = PTR_ERR(p);
++ fs_err(sdp, "can't start quotad thread: %d\n", error);
++ goto fail;
++ }
++ sdp->sd_quotad_process = p;
++ return 0;
++
++fail:
++ kthread_stop(sdp->sd_logd_process);
++ sdp->sd_logd_process = NULL;
++ return error;
++}
++
+ /**
+ * gfs2_fill_super - Read in superblock
+ * @sb: The VFS superblock
+@@ -1217,6 +1245,14 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
+ goto fail_per_node;
+ }
+
++ if (!sb_rdonly(sb)) {
++ error = init_threads(sdp);
++ if (error) {
++ gfs2_withdraw_delayed(sdp);
++ goto fail_per_node;
++ }
++ }
++
+ error = gfs2_freeze_lock(sdp, &freeze_gh, 0);
+ if (error)
+ goto fail_per_node;
+@@ -1226,6 +1262,12 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
+
+ gfs2_freeze_unlock(&freeze_gh);
+ if (error) {
++ if (sdp->sd_quotad_process)
++ kthread_stop(sdp->sd_quotad_process);
++ sdp->sd_quotad_process = NULL;
++ if (sdp->sd_logd_process)
++ kthread_stop(sdp->sd_logd_process);
++ sdp->sd_logd_process = NULL;
+ fs_err(sdp, "can't make FS RW: %d\n", error);
+ goto fail_per_node;
+ }
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 4d4ceb0b6903..2bdbba5ea8d7 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -119,34 +119,6 @@ int gfs2_jdesc_check(struct gfs2_jdesc *jd)
+ return 0;
+ }
+
+-static int init_threads(struct gfs2_sbd *sdp)
+-{
+- struct task_struct *p;
+- int error = 0;
+-
+- p = kthread_run(gfs2_logd, sdp, "gfs2_logd");
+- if (IS_ERR(p)) {
+- error = PTR_ERR(p);
+- fs_err(sdp, "can't start logd thread: %d\n", error);
+- return error;
+- }
+- sdp->sd_logd_process = p;
+-
+- p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad");
+- if (IS_ERR(p)) {
+- error = PTR_ERR(p);
+- fs_err(sdp, "can't start quotad thread: %d\n", error);
+- goto fail;
+- }
+- sdp->sd_quotad_process = p;
+- return 0;
+-
+-fail:
+- kthread_stop(sdp->sd_logd_process);
+- sdp->sd_logd_process = NULL;
+- return error;
+-}
+-
+ /**
+ * gfs2_make_fs_rw - Turn a Read-Only FS into a Read-Write one
+ * @sdp: the filesystem
+@@ -161,26 +133,17 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
+ struct gfs2_log_header_host head;
+ int error;
+
+- error = init_threads(sdp);
+- if (error) {
+- gfs2_withdraw_delayed(sdp);
+- return error;
+- }
+-
+ j_gl->gl_ops->go_inval(j_gl, DIO_METADATA);
+- if (gfs2_withdrawn(sdp)) {
+- error = -EIO;
+- goto fail;
+- }
++ if (gfs2_withdrawn(sdp))
++ return -EIO;
+
+ error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
+ if (error || gfs2_withdrawn(sdp))
+- goto fail;
++ return error;
+
+ if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) {
+ gfs2_consist(sdp);
+- error = -EIO;
+- goto fail;
++ return -EIO;
+ }
+
+ /* Initialize some head of the log stuff */
+@@ -188,20 +151,8 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
+ gfs2_log_pointers_init(sdp, head.lh_blkno);
+
+ error = gfs2_quota_init(sdp);
+- if (error || gfs2_withdrawn(sdp))
+- goto fail;
+-
+- set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
+-
+- return 0;
+-
+-fail:
+- if (sdp->sd_quotad_process)
+- kthread_stop(sdp->sd_quotad_process);
+- sdp->sd_quotad_process = NULL;
+- if (sdp->sd_logd_process)
+- kthread_stop(sdp->sd_logd_process);
+- sdp->sd_logd_process = NULL;
++ if (!error && !gfs2_withdrawn(sdp))
++ set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
+ return error;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 7976e9f081e49a792b27cd08d0cd9aebbae33ca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Jul 2021 15:34:59 +0800
+Subject: gve: fix the wrong AdminQ buffer overflow check
+
+From: Haiyue Wang <haiyue.wang@intel.com>
+
+[ Upstream commit 63a9192b8fa1ea55efeba1f18fad52bb24d9bf12 ]
+
+The 'tail' pointer is also free-running count, so it needs to be masked
+as 'adminq_prod_cnt' does, to become an index value of AdminQ buffer.
+
+Fixes: 5cdad90de62c ("gve: Batch AQ commands for creating and destroying queues.")
+Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>
+Reviewed-by: Catherine Sullivan <csully@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/google/gve/gve_adminq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c
+index 53864f200599..b175f2b2f5bc 100644
+--- a/drivers/net/ethernet/google/gve/gve_adminq.c
++++ b/drivers/net/ethernet/google/gve/gve_adminq.c
+@@ -233,7 +233,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
+ tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
+
+ // Check if next command will overflow the buffer.
+- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
++ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
++ (tail & priv->adminq_mask)) {
+ int err;
+
+ // Flush existing commands to make room.
+@@ -243,7 +244,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
+
+ // Retry.
+ tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
+- if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
++ if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
++ (tail & priv->adminq_mask)) {
+ // This should never happen. We just flushed the
+ // command queue so there should be enough space.
+ return -ENOMEM;
+--
+2.30.2
+
--- /dev/null
+From 354d308cc93df8fa598403ec0c03dee61cedd190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 15:39:46 +0200
+Subject: hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ]
+
+If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then
+the timer has to be canceled first and then added back. If the timer is the
+first expiring timer then on removal the clockevent device is reprogrammed
+to the next expiring timer to avoid that the pending expiry fires needlessly.
+
+If the new expiry time ends up to be the first expiry again then the clock
+event device has to reprogrammed again.
+
+Avoid this by checking whether the timer is the first to expire and in that
+case, keep the timer on the current CPU and delay the reprogramming up to
+the point where the timer has been enqueued again.
+
+Reported-by: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20210713135157.873137732@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 53 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 4a66725b1d4a..ba2e0d0a0e5a 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1030,12 +1030,13 @@ static void __remove_hrtimer(struct hrtimer *timer,
+ * remove hrtimer, called with base lock held
+ */
+ static inline int
+-remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
++remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
++ bool restart, bool keep_local)
+ {
+ u8 state = timer->state;
+
+ if (state & HRTIMER_STATE_ENQUEUED) {
+- int reprogram;
++ bool reprogram;
+
+ /*
+ * Remove the timer and force reprogramming when high
+@@ -1048,8 +1049,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest
+ debug_deactivate(timer);
+ reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+
++ /*
++ * If the timer is not restarted then reprogramming is
++ * required if the timer is local. If it is local and about
++ * to be restarted, avoid programming it twice (on removal
++ * and a moment later when it's requeued).
++ */
+ if (!restart)
+ state = HRTIMER_STATE_INACTIVE;
++ else
++ reprogram &= !keep_local;
+
+ __remove_hrtimer(timer, base, state, reprogram);
+ return 1;
+@@ -1103,9 +1112,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ struct hrtimer_clock_base *base)
+ {
+ struct hrtimer_clock_base *new_base;
++ bool force_local, first;
+
+- /* Remove an active timer from the queue: */
+- remove_hrtimer(timer, base, true);
++ /*
++ * If the timer is on the local cpu base and is the first expiring
++ * timer then this might end up reprogramming the hardware twice
++ * (on removal and on enqueue). To avoid that by prevent the
++ * reprogram on removal, keep the timer local to the current CPU
++ * and enforce reprogramming after it is queued no matter whether
++ * it is the new first expiring timer again or not.
++ */
++ force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
++ force_local &= base->cpu_base->next_timer == timer;
++
++ /*
++ * Remove an active timer from the queue. In case it is not queued
++ * on the current CPU, make sure that remove_hrtimer() updates the
++ * remote data correctly.
++ *
++ * If it's on the current CPU and the first expiring timer, then
++ * skip reprogramming, keep the timer local and enforce
++ * reprogramming later if it was the first expiring timer. This
++ * avoids programming the underlying clock event twice (once at
++ * removal and once after enqueue).
++ */
++ remove_hrtimer(timer, base, true, force_local);
+
+ if (mode & HRTIMER_MODE_REL)
+ tim = ktime_add_safe(tim, base->get_time());
+@@ -1115,9 +1146,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+
+ /* Switch the timer base, if necessary: */
+- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
++ if (!force_local) {
++ new_base = switch_hrtimer_base(timer, base,
++ mode & HRTIMER_MODE_PINNED);
++ } else {
++ new_base = base;
++ }
++
++ first = enqueue_hrtimer(timer, new_base, mode);
++ if (!force_local)
++ return first;
+
+- return enqueue_hrtimer(timer, new_base, mode);
++ /*
++ * Timer was forced to stay on the current CPU to avoid
++ * reprogramming on removal and enqueue. Force reprogram the
++ * hardware by evaluating the new first expiring timer.
++ */
++ hrtimer_force_reprogram(new_base->cpu_base, 1);
++ return 0;
+ }
+
+ /**
+@@ -1183,7 +1229,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer)
+ base = lock_hrtimer_base(timer, &flags);
+
+ if (!hrtimer_callback_running(timer))
+- ret = remove_hrtimer(timer, base, false);
++ ret = remove_hrtimer(timer, base, false, false);
+
+ unlock_hrtimer_base(timer, &flags);
+
+--
+2.30.2
+
--- /dev/null
+From 78c181fa84b6e1ec75e70b7e687e069dc9387122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 15:39:48 +0200
+Subject: hrtimer: Ensure timerfd notification for HIGHRES=n
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 8c3b5e6ec0fee18bc2ce38d1dfe913413205f908 ]
+
+If high resolution timers are disabled the timerfd notification about a
+clock was set event is not happening for all cases which use
+clock_was_set_delayed() because that's a NOP for HIGHRES=n, which is wrong.
+
+Make clock_was_set_delayed() unconditially available to fix that.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20210713135158.196661266@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/hrtimer.h | 5 -----
+ kernel/time/hrtimer.c | 32 ++++++++++++++++----------------
+ kernel/time/tick-internal.h | 3 +++
+ 3 files changed, 19 insertions(+), 21 deletions(-)
+
+diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
+index bb5e7b0a4274..77295af72426 100644
+--- a/include/linux/hrtimer.h
++++ b/include/linux/hrtimer.h
+@@ -318,16 +318,12 @@ struct clock_event_device;
+
+ extern void hrtimer_interrupt(struct clock_event_device *dev);
+
+-extern void clock_was_set_delayed(void);
+-
+ extern unsigned int hrtimer_resolution;
+
+ #else
+
+ #define hrtimer_resolution (unsigned int)LOW_RES_NSEC
+
+-static inline void clock_was_set_delayed(void) { }
+-
+ #endif
+
+ static inline ktime_t
+@@ -351,7 +347,6 @@ hrtimer_expires_remaining_adjusted(const struct hrtimer *timer)
+ timer->base->get_time());
+ }
+
+-extern void clock_was_set(void);
+ #ifdef CONFIG_TIMERFD
+ extern void timerfd_clock_was_set(void);
+ #else
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index ba2e0d0a0e5a..5af758473488 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -758,22 +758,6 @@ static void hrtimer_switch_to_hres(void)
+ retrigger_next_event(NULL);
+ }
+
+-static void clock_was_set_work(struct work_struct *work)
+-{
+- clock_was_set();
+-}
+-
+-static DECLARE_WORK(hrtimer_work, clock_was_set_work);
+-
+-/*
+- * Called from timekeeping and resume code to reprogram the hrtimer
+- * interrupt device on all cpus.
+- */
+-void clock_was_set_delayed(void)
+-{
+- schedule_work(&hrtimer_work);
+-}
+-
+ #else
+
+ static inline int hrtimer_is_hres_enabled(void) { return 0; }
+@@ -891,6 +875,22 @@ void clock_was_set(void)
+ timerfd_clock_was_set();
+ }
+
++static void clock_was_set_work(struct work_struct *work)
++{
++ clock_was_set();
++}
++
++static DECLARE_WORK(hrtimer_work, clock_was_set_work);
++
++/*
++ * Called from timekeeping and resume code to reprogram the hrtimer
++ * interrupt device on all cpus and to notify timerfd.
++ */
++void clock_was_set_delayed(void)
++{
++ schedule_work(&hrtimer_work);
++}
++
+ /*
+ * During resume we might have to reprogram the high resolution timer
+ * interrupt on all online CPUs. However, all other CPUs will be
+diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
+index 7a981c9e87a4..e61c1244e7d4 100644
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -164,3 +164,6 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
+
+ extern u64 get_next_timer_interrupt(unsigned long basej, u64 basem);
+ void timer_clear_idle(void);
++
++void clock_was_set(void);
++void clock_was_set_delayed(void);
+--
+2.30.2
+
--- /dev/null
+From 074812a24f15960a261928d0cc92c809dd00a2c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 13:39:59 +1200
+Subject: hwmon: (pmbus/bpa-rs600) Don't use rated limits as warn limits
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 7a8c68c57fd09541377f6971f25efdeb9a926c37 ]
+
+In the initial implementation a number of PMBUS_x_WARN_LIMITs were
+mapped to MFR fields. This was incorrect as these MFR limits reflect the
+rated limit as opposed to a limit which will generate warning. Instead
+return -ENXIO like we were already doing for other WARN_LIMITs.
+
+Subsequently these rated limits have been exposed generically as new
+fields in the sysfs ABI so the values are still available.
+
+Fixes: 15b2703e5e02 ("hwmon: (pmbus) Add driver for BluTek BPA-RS600")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20210812014000.26293-2-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/bpa-rs600.c | 25 -------------------------
+ 1 file changed, 25 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/bpa-rs600.c b/drivers/hwmon/pmbus/bpa-rs600.c
+index 2be69fedfa36..be76efe67d83 100644
+--- a/drivers/hwmon/pmbus/bpa-rs600.c
++++ b/drivers/hwmon/pmbus/bpa-rs600.c
+@@ -12,15 +12,6 @@
+ #include <linux/pmbus.h>
+ #include "pmbus.h"
+
+-#define BPARS600_MFR_VIN_MIN 0xa0
+-#define BPARS600_MFR_VIN_MAX 0xa1
+-#define BPARS600_MFR_IIN_MAX 0xa2
+-#define BPARS600_MFR_PIN_MAX 0xa3
+-#define BPARS600_MFR_VOUT_MIN 0xa4
+-#define BPARS600_MFR_VOUT_MAX 0xa5
+-#define BPARS600_MFR_IOUT_MAX 0xa6
+-#define BPARS600_MFR_POUT_MAX 0xa7
+-
+ static int bpa_rs600_read_byte_data(struct i2c_client *client, int page, int reg)
+ {
+ int ret;
+@@ -81,29 +72,13 @@ static int bpa_rs600_read_word_data(struct i2c_client *client, int page, int pha
+
+ switch (reg) {
+ case PMBUS_VIN_UV_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MIN);
+- break;
+ case PMBUS_VIN_OV_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MAX);
+- break;
+ case PMBUS_VOUT_UV_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MIN);
+- break;
+ case PMBUS_VOUT_OV_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MAX);
+- break;
+ case PMBUS_IIN_OC_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IIN_MAX);
+- break;
+ case PMBUS_IOUT_OC_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IOUT_MAX);
+- break;
+ case PMBUS_PIN_OP_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_PIN_MAX);
+- break;
+ case PMBUS_POUT_OP_WARN_LIMIT:
+- ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_POUT_MAX);
+- break;
+ case PMBUS_VIN_UV_FAULT_LIMIT:
+ case PMBUS_VIN_OV_FAULT_LIMIT:
+ case PMBUS_VOUT_UV_FAULT_LIMIT:
+--
+2.30.2
+
--- /dev/null
+From abb33355e73e82282306175047e8c643c8a925b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 10:48:11 +0200
+Subject: hwmon: remove amd_energy driver in Makefile
+
+From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+
+[ Upstream commit b3a7ab2d4376726178909e27b6956c012277ac4e ]
+
+Commit 9049572fb145 ("hwmon: Remove amd_energy driver") removes the driver,
+but misses to adjust the Makefile.
+
+Hence, ./scripts/checkkconfigsymbols.py warns:
+
+SENSORS_AMD_ENERGY
+Referencing files: drivers/hwmon/Makefile
+
+Remove the missing piece of this driver removal.
+
+Fixes: 9049572fb145 ("hwmon: Remove amd_energy driver")
+Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Link: https://lore.kernel.org/r/20210817084811.10673-1-lukas.bulwahn@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/Makefile | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
+index 59e78bc212cf..ae66c8ce4eef 100644
+--- a/drivers/hwmon/Makefile
++++ b/drivers/hwmon/Makefile
+@@ -45,7 +45,6 @@ obj-$(CONFIG_SENSORS_ADT7462) += adt7462.o
+ obj-$(CONFIG_SENSORS_ADT7470) += adt7470.o
+ obj-$(CONFIG_SENSORS_ADT7475) += adt7475.o
+ obj-$(CONFIG_SENSORS_AHT10) += aht10.o
+-obj-$(CONFIG_SENSORS_AMD_ENERGY) += amd_energy.o
+ obj-$(CONFIG_SENSORS_APPLESMC) += applesmc.o
+ obj-$(CONFIG_SENSORS_ARM_SCMI) += scmi-hwmon.o
+ obj-$(CONFIG_SENSORS_ARM_SCPI) += scpi-hwmon.o
+--
+2.30.2
+
--- /dev/null
+From bc74c09028b6cc4e1e66392d3ecccab4b93800fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 May 2021 22:13:45 +0300
+Subject: i2c: highlander: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit f16a3bb69aa6baabf8f0aca982c8cf21e2a4f6bc ]
+
+The driver is written as if platform_get_irq() returns 0 on errors (while
+actually it returns a negative error code), blithely passing these error
+codes to request_irq() (which takes *unsigned* IRQ #) -- which fails with
+-EINVAL. Add the necessary error check to the pre-existing *if* statement
+forcing the driver into the polling mode...
+
+Fixes: 4ad48e6ab18c ("i2c: Renesas Highlander FPGA SMBus support")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-highlander.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c
+index 803dad70e2a7..a2add128d084 100644
+--- a/drivers/i2c/busses/i2c-highlander.c
++++ b/drivers/i2c/busses/i2c-highlander.c
+@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, dev);
+
+ dev->irq = platform_get_irq(pdev, 0);
+- if (iic_force_poll)
++ if (dev->irq < 0 || iic_force_poll)
+ dev->irq = 0;
+
+ if (dev->irq) {
+--
+2.30.2
+
--- /dev/null
+From db4c2c9055998cb5aafbe4b49611c3bec39df10b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 17:35:54 +0300
+Subject: i2c: hix5hd2: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit f9b459c2ba5edfe247e86b45ad5dea8da542f3ea ]
+
+Iff platform_get_irq() returns 0, the driver's probe() method will return 0
+early (as if the method's call was successful). Let's consider IRQ0 valid
+for simplicity -- devm_request_irq() can always override that decision...
+
+Fixes: 15ef27756b23 ("i2c: hix5hd2: add i2c controller driver")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-hix5hd2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c
+index aa00ba8bcb70..61ae58f57047 100644
+--- a/drivers/i2c/busses/i2c-hix5hd2.c
++++ b/drivers/i2c/busses/i2c-hix5hd2.c
+@@ -413,7 +413,7 @@ static int hix5hd2_i2c_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->regs);
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0)
++ if (irq < 0)
+ return irq;
+
+ priv->clk = devm_clk_get(&pdev->dev, NULL);
+--
+2.30.2
+
--- /dev/null
+From ae561d1d1445a9b23f93df3ae6434623837e0e45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 23:35:09 +0300
+Subject: i2c: iop3xx: fix deferred probing
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit a1299505162ad00def3573260c2c68b9c8e8d697 ]
+
+When adding the code to handle platform_get_irq*() errors in the commit
+489447380a29 ("handle errors returned by platform_get_irq*()"), the
+actual error code was enforced to be -ENXIO in the driver for some
+strange reason. This didn't matter much until the deferred probing was
+introduced -- which requires an actual error code to be propagated
+upstream from the failure site.
+
+While fixing this, also stop overriding the errors from request_irq() to
+-EIO (done since the pre-git era).
+
+Fixes: 489447380a29 ("[PATCH] handle errors returned by platform_get_irq*()")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-iop3xx.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
+index cfecaf18ccbb..4a6ff54d87fe 100644
+--- a/drivers/i2c/busses/i2c-iop3xx.c
++++ b/drivers/i2c/busses/i2c-iop3xx.c
+@@ -469,16 +469,14 @@ iop3xx_i2c_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq < 0) {
+- ret = -ENXIO;
++ ret = irq;
+ goto unmap;
+ }
+ ret = request_irq(irq, iop3xx_i2c_irq_handler, 0,
+ pdev->name, adapter_data);
+
+- if (ret) {
+- ret = -EIO;
++ if (ret)
+ goto unmap;
+- }
+
+ memcpy(new_adapter->name, pdev->name, strlen(pdev->name));
+ new_adapter->owner = THIS_MODULE;
+--
+2.30.2
+
--- /dev/null
+From 42ab3d2ae6d490057e04e67c69d9902d9e627175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 17:38:45 +0300
+Subject: i2c: mt65xx: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 58fb7c643d346e2364404554f531cfa6a1a3917c ]
+
+Iff platform_get_irq() returns 0, the driver's probe() method will return 0
+early (as if the method's call was successful). Let's consider IRQ0 valid
+for simplicity -- devm_request_irq() can always override that decision...
+
+Fixes: ce38815d39ea ("I2C: mediatek: Add driver for MediaTek I2C controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Reviewed-by: Qii Wang <qii.wang@mediatek.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mt65xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
+index 4e9fb6b44436..d90d80d046bd 100644
+--- a/drivers/i2c/busses/i2c-mt65xx.c
++++ b/drivers/i2c/busses/i2c-mt65xx.c
+@@ -1211,7 +1211,7 @@ static int mtk_i2c_probe(struct platform_device *pdev)
+ return PTR_ERR(i2c->pdmabase);
+
+ irq = platform_get_irq(pdev, 0);
+- if (irq <= 0)
++ if (irq < 0)
+ return irq;
+
+ init_completion(&i2c->msg_complete);
+--
+2.30.2
+
--- /dev/null
+From a01507c76ada9d74850267723c0c5080281990c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 17:45:25 +0300
+Subject: i2c: s3c2410: fix IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit d6840a5e370b7ea4fde16ce2caf431bcc87f9a75 ]
+
+Iff platform_get_irq() returns 0, the driver's probe() method will return 0
+early (as if the method's call was successful). Let's consider IRQ0 valid
+for simplicity -- devm_request_irq() can always override that decision...
+
+Fixes: e0d1ec97853f ("i2c-s3c2410: Change IRQ to be plain integer.")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-s3c2410.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index 4d82761e1585..b49a1b170bb2 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1137,7 +1137,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
+ */
+ if (!(i2c->quirks & QUIRK_POLL)) {
+ i2c->irq = ret = platform_get_irq(pdev, 0);
+- if (ret <= 0) {
++ if (ret < 0) {
+ dev_err(&pdev->dev, "cannot find IRQ\n");
+ clk_unprepare(i2c->clk);
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From 02d23e8ad623bb41d95bdb66269021f8689264b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 23:39:11 +0300
+Subject: i2c: synquacer: fix deferred probing
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 8d744da241b81f4211f4813b0d3c1981326fa9ca ]
+
+The driver overrides the error codes returned by platform_get_irq() to
+-ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe
+permanently instead of the deferred probing. Switch to propagating the
+error codes upstream.
+
+Fixes: 0d676a6c4390 ("i2c: add support for Socionext SynQuacer I2C controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
+Acked-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-synquacer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index 31be1811d5e6..e4026c5416b1 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -578,7 +578,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
+
+ i2c->irq = platform_get_irq(pdev, 0);
+ if (i2c->irq < 0)
+- return -ENODEV;
++ return i2c->irq;
+
+ ret = devm_request_irq(&pdev->dev, i2c->irq, synquacer_i2c_isr,
+ 0, dev_name(&pdev->dev), i2c);
+--
+2.30.2
+
--- /dev/null
+From 3eeb65cf2bef3e9a95b4226121b570c559d3f5f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Jul 2021 17:47:54 +0300
+Subject: i2c: xlp9xx: fix main IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 661e8a88e8317eb9ffe69c69d6cb4876370fe7e2 ]
+
+Iff platform_get_irq() returns 0 for the main IRQ, the driver's probe()
+method will return 0 early (as if the method's call was successful).
+Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always
+override that decision...
+
+Fixes: 2bbd681ba2b ("i2c: xlp9xx: Driver for Netlogic XLP9XX/5XX I2C controller")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Reviewed-by: George Cherian <george.cherian@marvell.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xlp9xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c
+index f2241cedf5d3..6d24dc385522 100644
+--- a/drivers/i2c/busses/i2c-xlp9xx.c
++++ b/drivers/i2c/busses/i2c-xlp9xx.c
+@@ -517,7 +517,7 @@ static int xlp9xx_i2c_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->base);
+
+ priv->irq = platform_get_irq(pdev, 0);
+- if (priv->irq <= 0)
++ if (priv->irq < 0)
+ return priv->irq;
+ /* SMBAlert irq */
+ priv->alert_data.irq = platform_get_irq(pdev, 1);
+--
+2.30.2
+
--- /dev/null
+From d3353d0d83e1b2e50eb9c29460bd4595e0b0a338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Mar 2021 10:34:30 +0100
+Subject: i40e: improve locking of mac_filter_hash
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 8b4b06919fd66caf49fdf4fe59f9d6312cf7956d ]
+
+i40e_config_vf_promiscuous_mode() calls
+i40e_getnum_vf_vsi_vlan_filters() without acquiring the
+mac_filter_hash_lock spinlock.
+
+This is unsafe because mac_filter_hash may get altered in another thread
+while i40e_getnum_vf_vsi_vlan_filters() traverses the hashes.
+
+Simply adding the spinlock in i40e_getnum_vf_vsi_vlan_filters() is not
+possible as it already gets called in i40e_get_vlan_list_sync() with the
+spinlock held. Therefore adding a wrapper that acquires the spinlock and
+call the correct function where appropriate.
+
+Fixes: 37d318d7805f ("i40e: Remove scheduling while atomic possibility")
+Fix-suggested-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 ++++++++++++++++---
+ 1 file changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index eff0a30790dd..472f56b360b8 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -1160,12 +1160,12 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf)
+ }
+
+ /**
+- * i40e_getnum_vf_vsi_vlan_filters
++ * __i40e_getnum_vf_vsi_vlan_filters
+ * @vsi: pointer to the vsi
+ *
+ * called to get the number of VLANs offloaded on this VF
+ **/
+-static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
++static int __i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
+ {
+ struct i40e_mac_filter *f;
+ u16 num_vlans = 0, bkt;
+@@ -1178,6 +1178,23 @@ static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
+ return num_vlans;
+ }
+
++/**
++ * i40e_getnum_vf_vsi_vlan_filters
++ * @vsi: pointer to the vsi
++ *
++ * wrapper for __i40e_getnum_vf_vsi_vlan_filters() with spinlock held
++ **/
++static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
++{
++ int num_vlans;
++
++ spin_lock_bh(&vsi->mac_filter_hash_lock);
++ num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi);
++ spin_unlock_bh(&vsi->mac_filter_hash_lock);
++
++ return num_vlans;
++}
++
+ /**
+ * i40e_get_vlan_list_sync
+ * @vsi: pointer to the VSI
+@@ -1195,7 +1212,7 @@ static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, u16 *num_vlans,
+ int bkt;
+
+ spin_lock_bh(&vsi->mac_filter_hash_lock);
+- *num_vlans = i40e_getnum_vf_vsi_vlan_filters(vsi);
++ *num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi);
+ *vlan_list = kcalloc(*num_vlans, sizeof(**vlan_list), GFP_ATOMIC);
+ if (!(*vlan_list))
+ goto err;
+--
+2.30.2
+
--- /dev/null
+From f2a32bd161bfdb1d28af7cadedf56c3ae9e13f98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Aug 2021 12:27:53 -0700
+Subject: ice: Only lock to update netdev dev_addr
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit b357d9717be7f95fde2c6c4650b186a995b71e59 ]
+
+commit 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync
+list") introduced calls to netif_addr_lock_bh() and
+netif_addr_unlock_bh() in the driver's ndo_set_mac() callback. This is
+fine since the driver is updated the netdev's dev_addr, but since this
+is a spinlock, the driver cannot sleep when the lock is held.
+Unfortunately the functions to add/delete MAC filters depend on a mutex.
+This was causing a trace with the lock debug kernel config options
+enabled when changing the mac address via iproute.
+
+[ 203.273059] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281
+[ 203.273065] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6698, name: ip
+[ 203.273068] Preemption disabled at:
+[ 203.273068] [<ffffffffc04aaeab>] ice_set_mac_address+0x8b/0x1c0 [ice]
+[ 203.273097] CPU: 31 PID: 6698 Comm: ip Tainted: G S W I 5.14.0-rc4 #2
+[ 203.273100] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020
+[ 203.273102] Call Trace:
+[ 203.273107] dump_stack_lvl+0x33/0x42
+[ 203.273113] ? ice_set_mac_address+0x8b/0x1c0 [ice]
+[ 203.273124] ___might_sleep.cold.150+0xda/0xea
+[ 203.273131] mutex_lock+0x1c/0x40
+[ 203.273136] ice_remove_mac+0xe3/0x180 [ice]
+[ 203.273155] ? ice_fltr_add_mac_list+0x20/0x20 [ice]
+[ 203.273175] ice_fltr_prepare_mac+0x43/0xa0 [ice]
+[ 203.273194] ice_set_mac_address+0xab/0x1c0 [ice]
+[ 203.273206] dev_set_mac_address+0xb8/0x120
+[ 203.273210] dev_set_mac_address_user+0x2c/0x50
+[ 203.273212] do_setlink+0x1dd/0x10e0
+[ 203.273217] ? __nla_validate_parse+0x12d/0x1a0
+[ 203.273221] __rtnl_newlink+0x530/0x910
+[ 203.273224] ? __kmalloc_node_track_caller+0x17f/0x380
+[ 203.273230] ? preempt_count_add+0x68/0xa0
+[ 203.273236] ? _raw_spin_lock_irqsave+0x1f/0x30
+[ 203.273241] ? kmem_cache_alloc_trace+0x4d/0x440
+[ 203.273244] rtnl_newlink+0x43/0x60
+[ 203.273245] rtnetlink_rcv_msg+0x13a/0x380
+[ 203.273248] ? rtnl_calcit.isra.40+0x130/0x130
+[ 203.273250] netlink_rcv_skb+0x4e/0x100
+[ 203.273256] netlink_unicast+0x1a2/0x280
+[ 203.273258] netlink_sendmsg+0x242/0x490
+[ 203.273260] sock_sendmsg+0x58/0x60
+[ 203.273263] ____sys_sendmsg+0x1ef/0x260
+[ 203.273265] ? copy_msghdr_from_user+0x5c/0x90
+[ 203.273268] ? ____sys_recvmsg+0xe6/0x170
+[ 203.273270] ___sys_sendmsg+0x7c/0xc0
+[ 203.273272] ? copy_msghdr_from_user+0x5c/0x90
+[ 203.273274] ? ___sys_recvmsg+0x89/0xc0
+[ 203.273276] ? __netlink_sendskb+0x50/0x50
+[ 203.273278] ? mod_objcg_state+0xee/0x310
+[ 203.273282] ? __dentry_kill+0x114/0x170
+[ 203.273286] ? get_max_files+0x10/0x10
+[ 203.273288] __sys_sendmsg+0x57/0xa0
+[ 203.273290] do_syscall_64+0x37/0x80
+[ 203.273295] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 203.273296] RIP: 0033:0x7f8edf96e278
+[ 203.273298] Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 63 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
+[ 203.273300] RSP: 002b:00007ffcb8bdac08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 203.273303] RAX: ffffffffffffffda RBX: 000000006115e0ae RCX: 00007f8edf96e278
+[ 203.273304] RDX: 0000000000000000 RSI: 00007ffcb8bdac70 RDI: 0000000000000003
+[ 203.273305] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007ffcb8bda5b0
+[ 203.273306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
+[ 203.273306] R13: 0000555e10092020 R14: 0000000000000000 R15: 0000000000000005
+
+Fix this by only locking when changing the netdev->dev_addr. Also, make
+sure to restore the old netdev->dev_addr on any failures.
+
+Fixes: 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list")
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index a7f2f5c490e3..e16d20b77a3f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -4911,6 +4911,7 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
+ struct ice_hw *hw = &pf->hw;
+ struct sockaddr *addr = pi;
+ enum ice_status status;
++ u8 old_mac[ETH_ALEN];
+ u8 flags = 0;
+ int err = 0;
+ u8 *mac;
+@@ -4933,8 +4934,13 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
+ }
+
+ netif_addr_lock_bh(netdev);
++ ether_addr_copy(old_mac, netdev->dev_addr);
++ /* change the netdev's MAC address */
++ memcpy(netdev->dev_addr, mac, netdev->addr_len);
++ netif_addr_unlock_bh(netdev);
++
+ /* Clean up old MAC filter. Not an error if old filter doesn't exist */
+- status = ice_fltr_remove_mac(vsi, netdev->dev_addr, ICE_FWD_TO_VSI);
++ status = ice_fltr_remove_mac(vsi, old_mac, ICE_FWD_TO_VSI);
+ if (status && status != ICE_ERR_DOES_NOT_EXIST) {
+ err = -EADDRNOTAVAIL;
+ goto err_update_filters;
+@@ -4957,13 +4963,12 @@ err_update_filters:
+ if (err) {
+ netdev_err(netdev, "can't set MAC %pM. filter update failed\n",
+ mac);
++ netif_addr_lock_bh(netdev);
++ ether_addr_copy(netdev->dev_addr, old_mac);
+ netif_addr_unlock_bh(netdev);
+ return err;
+ }
+
+- /* change the netdev's MAC address */
+- memcpy(netdev->dev_addr, mac, netdev->addr_len);
+- netif_addr_unlock_bh(netdev);
+ netdev_dbg(vsi->netdev, "updated MAC address to %pM\n",
+ netdev->dev_addr);
+
+--
+2.30.2
+
--- /dev/null
+From 4a3410639a5a3173f9220c68d317b8d751a7fc10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 08:37:25 -0600
+Subject: io-wq: remove GFP_ATOMIC allocation off schedule out path
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit d3e9f732c415cf22faa33d6f195e291ad82dc92e ]
+
+Daniel reports that the v5.14-rc4-rt4 kernel throws a BUG when running
+stress-ng:
+
+| [ 90.202543] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35
+| [ 90.202549] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2047, name: iou-wrk-2041
+| [ 90.202555] CPU: 5 PID: 2047 Comm: iou-wrk-2041 Tainted: G W 5.14.0-rc4-rt4+ #89
+| [ 90.202559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
+| [ 90.202561] Call Trace:
+| [ 90.202577] dump_stack_lvl+0x34/0x44
+| [ 90.202584] ___might_sleep.cold+0x87/0x94
+| [ 90.202588] rt_spin_lock+0x19/0x70
+| [ 90.202593] ___slab_alloc+0xcb/0x7d0
+| [ 90.202598] ? newidle_balance.constprop.0+0xf5/0x3b0
+| [ 90.202603] ? dequeue_entity+0xc3/0x290
+| [ 90.202605] ? io_wqe_dec_running.isra.0+0x98/0xe0
+| [ 90.202610] ? pick_next_task_fair+0xb9/0x330
+| [ 90.202612] ? __schedule+0x670/0x1410
+| [ 90.202615] ? io_wqe_dec_running.isra.0+0x98/0xe0
+| [ 90.202618] kmem_cache_alloc_trace+0x79/0x1f0
+| [ 90.202621] io_wqe_dec_running.isra.0+0x98/0xe0
+| [ 90.202625] io_wq_worker_sleeping+0x37/0x50
+| [ 90.202628] schedule+0x30/0xd0
+| [ 90.202630] schedule_timeout+0x8f/0x1a0
+| [ 90.202634] ? __bpf_trace_tick_stop+0x10/0x10
+| [ 90.202637] io_wqe_worker+0xfd/0x320
+| [ 90.202641] ? finish_task_switch.isra.0+0xd3/0x290
+| [ 90.202644] ? io_worker_handle_work+0x670/0x670
+| [ 90.202646] ? io_worker_handle_work+0x670/0x670
+| [ 90.202649] ret_from_fork+0x22/0x30
+
+which is due to the RT kernel not liking a GFP_ATOMIC allocation inside
+a raw spinlock. Besides that not working on RT, doing any kind of
+allocation from inside schedule() is kind of nasty and should be avoided
+if at all possible.
+
+This particular path happens when an io-wq worker goes to sleep, and we
+need a new worker to handle pending work. We currently allocate a small
+data item to hold the information we need to create a new worker, but we
+can instead include this data in the io_worker struct itself and just
+protect it with a single bit lock. We only really need one per worker
+anyway, as we will have run pending work between to sleep cycles.
+
+https://lore.kernel.org/lkml/20210804082418.fbibprcwtzyt5qax@beryllium.lan/
+Reported-by: Daniel Wagner <dwagner@suse.de>
+Tested-by: Daniel Wagner <dwagner@suse.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io-wq.c | 72 ++++++++++++++++++++++++++++++------------------------
+ 1 file changed, 40 insertions(+), 32 deletions(-)
+
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index 91b0d1fb90eb..87705ae951fd 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -53,6 +53,10 @@ struct io_worker {
+
+ struct completion ref_done;
+
++ unsigned long create_state;
++ struct callback_head create_work;
++ int create_index;
++
+ struct rcu_head rcu;
+ };
+
+@@ -273,24 +277,18 @@ static void io_wqe_inc_running(struct io_worker *worker)
+ atomic_inc(&acct->nr_running);
+ }
+
+-struct create_worker_data {
+- struct callback_head work;
+- struct io_wqe *wqe;
+- int index;
+-};
+-
+ static void create_worker_cb(struct callback_head *cb)
+ {
+- struct create_worker_data *cwd;
++ struct io_worker *worker;
+ struct io_wq *wq;
+ struct io_wqe *wqe;
+ struct io_wqe_acct *acct;
+ bool do_create = false, first = false;
+
+- cwd = container_of(cb, struct create_worker_data, work);
+- wqe = cwd->wqe;
++ worker = container_of(cb, struct io_worker, create_work);
++ wqe = worker->wqe;
+ wq = wqe->wq;
+- acct = &wqe->acct[cwd->index];
++ acct = &wqe->acct[worker->create_index];
+ raw_spin_lock_irq(&wqe->lock);
+ if (acct->nr_workers < acct->max_workers) {
+ if (!acct->nr_workers)
+@@ -300,33 +298,42 @@ static void create_worker_cb(struct callback_head *cb)
+ }
+ raw_spin_unlock_irq(&wqe->lock);
+ if (do_create) {
+- create_io_worker(wq, wqe, cwd->index, first);
++ create_io_worker(wq, wqe, worker->create_index, first);
+ } else {
+ atomic_dec(&acct->nr_running);
+ io_worker_ref_put(wq);
+ }
+- kfree(cwd);
++ clear_bit_unlock(0, &worker->create_state);
++ io_worker_release(worker);
+ }
+
+-static void io_queue_worker_create(struct io_wqe *wqe, struct io_wqe_acct *acct)
++static void io_queue_worker_create(struct io_wqe *wqe, struct io_worker *worker,
++ struct io_wqe_acct *acct)
+ {
+- struct create_worker_data *cwd;
+ struct io_wq *wq = wqe->wq;
+
+ /* raced with exit, just ignore create call */
+ if (test_bit(IO_WQ_BIT_EXIT, &wq->state))
+ goto fail;
++ if (!io_worker_get(worker))
++ goto fail;
++ /*
++ * create_state manages ownership of create_work/index. We should
++ * only need one entry per worker, as the worker going to sleep
++ * will trigger the condition, and waking will clear it once it
++ * runs the task_work.
++ */
++ if (test_bit(0, &worker->create_state) ||
++ test_and_set_bit_lock(0, &worker->create_state))
++ goto fail_release;
+
+- cwd = kmalloc(sizeof(*cwd), GFP_ATOMIC);
+- if (cwd) {
+- init_task_work(&cwd->work, create_worker_cb);
+- cwd->wqe = wqe;
+- cwd->index = acct->index;
+- if (!task_work_add(wq->task, &cwd->work, TWA_SIGNAL))
+- return;
+-
+- kfree(cwd);
+- }
++ init_task_work(&worker->create_work, create_worker_cb);
++ worker->create_index = acct->index;
++ if (!task_work_add(wq->task, &worker->create_work, TWA_SIGNAL))
++ return;
++ clear_bit_unlock(0, &worker->create_state);
++fail_release:
++ io_worker_release(worker);
+ fail:
+ atomic_dec(&acct->nr_running);
+ io_worker_ref_put(wq);
+@@ -344,7 +351,7 @@ static void io_wqe_dec_running(struct io_worker *worker)
+ if (atomic_dec_and_test(&acct->nr_running) && io_wqe_run_queue(wqe)) {
+ atomic_inc(&acct->nr_running);
+ atomic_inc(&wqe->wq->worker_refs);
+- io_queue_worker_create(wqe, acct);
++ io_queue_worker_create(wqe, worker, acct);
+ }
+ }
+
+@@ -1010,12 +1017,12 @@ err_wq:
+
+ static bool io_task_work_match(struct callback_head *cb, void *data)
+ {
+- struct create_worker_data *cwd;
++ struct io_worker *worker;
+
+ if (cb->func != create_worker_cb)
+ return false;
+- cwd = container_of(cb, struct create_worker_data, work);
+- return cwd->wqe->wq == data;
++ worker = container_of(cb, struct io_worker, create_work);
++ return worker->wqe->wq == data;
+ }
+
+ void io_wq_exit_start(struct io_wq *wq)
+@@ -1032,12 +1039,13 @@ static void io_wq_exit_workers(struct io_wq *wq)
+ return;
+
+ while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) {
+- struct create_worker_data *cwd;
++ struct io_worker *worker;
+
+- cwd = container_of(cb, struct create_worker_data, work);
+- atomic_dec(&cwd->wqe->acct[cwd->index].nr_running);
++ worker = container_of(cb, struct io_worker, create_work);
++ atomic_dec(&worker->wqe->acct[worker->create_index].nr_running);
+ io_worker_ref_put(wq);
+- kfree(cwd);
++ clear_bit_unlock(0, &worker->create_state);
++ io_worker_release(worker);
+ }
+
+ rcu_read_lock();
+--
+2.30.2
+
--- /dev/null
+From d80b67f5773c9042c9dc245d28f1f51685bab929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jun 2021 18:14:00 +0100
+Subject: io_uring: refactor io_submit_flush_completions()
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+[ Upstream commit 2a2758f26df519fab011f49d53440382dda8e1a5 ]
+
+struct io_comp_state is always contained in struct io_ring_ctx, don't
+pass them into io_submit_flush_completions() separately, it makes the
+interface cleaner and simplifies it for the compiler.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/44d6ca57003a82484338e95197024dbd65a1b376.1623949695.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/io_uring.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index f6ddc7182943..788ba4f3730f 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -1060,8 +1060,7 @@ static void __io_queue_sqe(struct io_kiocb *req);
+ static void io_rsrc_put_work(struct work_struct *work);
+
+ static void io_req_task_queue(struct io_kiocb *req);
+-static void io_submit_flush_completions(struct io_comp_state *cs,
+- struct io_ring_ctx *ctx);
++static void io_submit_flush_completions(struct io_ring_ctx *ctx);
+ static bool io_poll_remove_waitqs(struct io_kiocb *req);
+ static int io_req_prep_async(struct io_kiocb *req);
+
+@@ -1901,7 +1900,7 @@ static void ctx_flush_and_put(struct io_ring_ctx *ctx)
+ return;
+ if (ctx->submit_state.comp.nr) {
+ mutex_lock(&ctx->uring_lock);
+- io_submit_flush_completions(&ctx->submit_state.comp, ctx);
++ io_submit_flush_completions(ctx);
+ mutex_unlock(&ctx->uring_lock);
+ }
+ percpu_ref_put(&ctx->refs);
+@@ -2147,9 +2146,9 @@ static void io_req_free_batch(struct req_batch *rb, struct io_kiocb *req,
+ list_add(&req->compl.list, &state->comp.free_list);
+ }
+
+-static void io_submit_flush_completions(struct io_comp_state *cs,
+- struct io_ring_ctx *ctx)
++static void io_submit_flush_completions(struct io_ring_ctx *ctx)
+ {
++ struct io_comp_state *cs = &ctx->submit_state.comp;
+ int i, nr = cs->nr;
+ struct io_kiocb *req;
+ struct req_batch rb;
+@@ -6462,7 +6461,7 @@ static void __io_queue_sqe(struct io_kiocb *req)
+
+ cs->reqs[cs->nr++] = req;
+ if (cs->nr == ARRAY_SIZE(cs->reqs))
+- io_submit_flush_completions(cs, ctx);
++ io_submit_flush_completions(ctx);
+ } else {
+ io_put_req(req);
+ }
+@@ -6676,7 +6675,7 @@ static void io_submit_state_end(struct io_submit_state *state,
+ if (state->link.head)
+ io_queue_sqe(state->link.head);
+ if (state->comp.nr)
+- io_submit_flush_completions(&state->comp, ctx);
++ io_submit_flush_completions(ctx);
+ if (state->plug_started)
+ blk_finish_plug(&state->plug);
+ io_state_file_put(state);
+--
+2.30.2
+
--- /dev/null
+From 6575594419212bd23bce456248e18c130bf92899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 15:39:44 +0300
+Subject: ionic: cleanly release devlink instance
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit c2255ff47768c94a0ebc3968f007928bb47ea43b ]
+
+The failure to register devlink will leave the system with dangled
+devlink resource, which is not cleaned if devlink_port_register() fails.
+
+In order to remove access to ".registered" field of struct devlink_port,
+require both devlink_register and devlink_port_register to success and
+check it through device pointer.
+
+Fixes: fbfb8031533c ("ionic: Add hardware init and device commands")
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Acked-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/pensando/ionic/ionic_devlink.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
+index b41301a5b0df..cd520e4c5522 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
+@@ -91,20 +91,20 @@ int ionic_devlink_register(struct ionic *ionic)
+ attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL;
+ devlink_port_attrs_set(&ionic->dl_port, &attrs);
+ err = devlink_port_register(dl, &ionic->dl_port, 0);
+- if (err)
++ if (err) {
+ dev_err(ionic->dev, "devlink_port_register failed: %d\n", err);
+- else
+- devlink_port_type_eth_set(&ionic->dl_port,
+- ionic->lif->netdev);
++ devlink_unregister(dl);
++ return err;
++ }
+
+- return err;
++ devlink_port_type_eth_set(&ionic->dl_port, ionic->lif->netdev);
++ return 0;
+ }
+
+ void ionic_devlink_unregister(struct ionic *ionic)
+ {
+ struct devlink *dl = priv_to_devlink(ionic);
+
+- if (ionic->dl_port.registered)
+- devlink_port_unregister(&ionic->dl_port);
++ devlink_port_unregister(&ionic->dl_port);
+ devlink_unregister(dl);
+ }
+--
+2.30.2
+
--- /dev/null
+From 5fb68dfe5c290e97822ae95a54c4294893df5c8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 19:02:10 -0700
+Subject: ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 92548b0ee220e000d81c27ac9a80e0ede895a881 ]
+
+The UDP length field should be in network order.
+This removes the following sparse error:
+
+net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types)
+net/ipv4/route.c:3173:27: expected restricted __be16 [usertype] len
+net/ipv4/route.c:3173:27: got unsigned long
+
+Fixes: 404eb77ea766 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Roopa Prabhu <roopa@nvidia.com>
+Cc: David Ahern <dsahern@kernel.org>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 70eba1c33fa4..f495fad73be9 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -3061,7 +3061,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
+ udph = skb_put_zero(skb, sizeof(struct udphdr));
+ udph->source = sport;
+ udph->dest = dport;
+- udph->len = sizeof(struct udphdr);
++ udph->len = htons(sizeof(struct udphdr));
+ udph->check = 0;
+ break;
+ }
+--
+2.30.2
+
--- /dev/null
+From 38a3ac12ee29736df491c570e3a84562e9b73cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Aug 2021 15:16:15 -0700
+Subject: ipv4: make exception cache less predictible
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ]
+
+Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
+fnhe_hashfun()"), an attacker can still use brute force to learn
+some secrets from a victim linux host.
+
+One way to defeat these attacks is to make the max depth of the hash
+table bucket a random value.
+
+Before this patch, each bucket of the hash table used to store exceptions
+could contain 6 items under attack.
+
+After the patch, each bucket would contains a random number of items,
+between 6 and 10. The attacker can no longer infer secrets.
+
+This is slightly increasing memory size used by the hash table,
+by 50% in average, we do not expect this to be a problem.
+
+This patch is more complex than the prior one (IPv6 equivalent),
+because IPv4 was reusing the oldest entry.
+Since we need to be able to evict more than one entry per
+update_or_create_fnhe() call, I had to replace
+fnhe_oldest() with fnhe_remove_oldest().
+
+Also note that we will queue extra kfree_rcu() calls under stress,
+which hopefully wont be a too big issue.
+
+Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Keyu Man <kman001@ucr.edu>
+Cc: Willy Tarreau <w@1wt.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Tested-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/route.c | 46 ++++++++++++++++++++++++++++++----------------
+ 1 file changed, 30 insertions(+), 16 deletions(-)
+
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d8811e1fbd6c..70eba1c33fa4 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -586,18 +586,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
+ }
+ }
+
+-static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
++static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
+ {
+- struct fib_nh_exception *fnhe, *oldest;
++ struct fib_nh_exception __rcu **fnhe_p, **oldest_p;
++ struct fib_nh_exception *fnhe, *oldest = NULL;
+
+- oldest = rcu_dereference(hash->chain);
+- for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
+- fnhe = rcu_dereference(fnhe->fnhe_next)) {
+- if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
++ for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) {
++ fnhe = rcu_dereference_protected(*fnhe_p,
++ lockdep_is_held(&fnhe_lock));
++ if (!fnhe)
++ break;
++ if (!oldest ||
++ time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) {
+ oldest = fnhe;
++ oldest_p = fnhe_p;
++ }
+ }
+ fnhe_flush_routes(oldest);
+- return oldest;
++ *oldest_p = oldest->fnhe_next;
++ kfree_rcu(oldest, rcu);
+ }
+
+ static u32 fnhe_hashfun(__be32 daddr)
+@@ -676,16 +683,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,
+ if (rt)
+ fill_route_from_fnhe(rt, fnhe);
+ } else {
+- if (depth > FNHE_RECLAIM_DEPTH)
+- fnhe = fnhe_oldest(hash);
+- else {
+- fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
+- if (!fnhe)
+- goto out_unlock;
+-
+- fnhe->fnhe_next = hash->chain;
+- rcu_assign_pointer(hash->chain, fnhe);
++ /* Randomize max depth to avoid some side channels attacks. */
++ int max_depth = FNHE_RECLAIM_DEPTH +
++ prandom_u32_max(FNHE_RECLAIM_DEPTH);
++
++ while (depth > max_depth) {
++ fnhe_remove_oldest(hash);
++ depth--;
+ }
++
++ fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
++ if (!fnhe)
++ goto out_unlock;
++
++ fnhe->fnhe_next = hash->chain;
++
+ fnhe->fnhe_genid = genid;
+ fnhe->fnhe_daddr = daddr;
+ fnhe->fnhe_gw = gw;
+@@ -693,6 +705,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,
+ fnhe->fnhe_mtu_locked = lock;
+ fnhe->fnhe_expires = max(1UL, expires);
+
++ rcu_assign_pointer(hash->chain, fnhe);
++
+ /* Exception created; mark the cached routes for the nexthop
+ * stale, so anyone caching it rechecks if this exception
+ * applies to them.
+--
+2.30.2
+
--- /dev/null
+From 5b833bcae15c8251fce90d089da64a3311db5341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Aug 2021 15:16:14 -0700
+Subject: ipv6: make exception cache less predictible
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a00df2caffed3883c341d5685f830434312e4a43 ]
+
+Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"),
+an attacker can still use brute force to learn some secrets from a victim
+linux host.
+
+One way to defeat these attacks is to make the max depth of the hash
+table bucket a random value.
+
+Before this patch, each bucket of the hash table used to store exceptions
+could contain 6 items under attack.
+
+After the patch, each bucket would contains a random number of items,
+between 6 and 10. The attacker can no longer infer secrets.
+
+This is slightly increasing memory size used by the hash table,
+we do not expect this to be a problem.
+
+Following patch is dealing with the same issue in IPv4.
+
+Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Keyu Man <kman001@ucr.edu>
+Cc: Wei Wang <weiwan@google.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/route.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 67c74469503a..cd99de5b6882 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,
+ struct in6_addr *src_key = NULL;
+ struct rt6_exception *rt6_ex;
+ struct fib6_nh *nh = res->nh;
++ int max_depth;
+ int err = 0;
+
+ spin_lock_bh(&rt6_exception_lock);
+@@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt,
+ bucket->depth++;
+ net->ipv6.rt6_stats->fib_rt_cache++;
+
+- if (bucket->depth > FIB6_MAX_DEPTH)
++ /* Randomize max depth to avoid some side channels attacks. */
++ max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH);
++ while (bucket->depth > max_depth)
+ rt6_exception_remove_oldest(bucket);
+
+ out:
+--
+2.30.2
+
--- /dev/null
+From 9971e219f1ff10f97dbb0bb26806489b7942c208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 12:09:42 +0200
+Subject: irqchip/apple-aic: Fix irq_disable from within irq handlers
+
+From: Sven Peter <sven@svenpeter.dev>
+
+[ Upstream commit 60a1cd10b222e004f860d14651e80089c77e8e6b ]
+
+When disable_irq_nosync for an interrupt is called from within its
+interrupt handler, this interrupt is only marked as disabled with the
+intention to mask it when it triggers again.
+The AIC hardware however automatically masks the interrupt when it is read.
+aic_irq_eoi then unmasks it again if it's not disabled *and* not masked.
+This results in a state mismatch between the hardware state and the
+state kept in irq_data: The hardware interrupt is masked but
+IRQD_IRQ_MASKED is not set. Any further calls to unmask_irq will directly
+return and the interrupt can never be enabled again.
+
+Fix this by keeping the hardware and irq_data state in sync by unmasking in
+aic_irq_eoi if and only if the irq_data state also assumes the interrupt to
+be unmasked.
+
+Fixes: 76cde2639411 ("irqchip/apple-aic: Add support for the Apple Interrupt Controller")
+Signed-off-by: Sven Peter <sven@svenpeter.dev>
+Acked-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210812100942.17206-1-sven@svenpeter.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-apple-aic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c
+index c179e27062fd..151aab408fa6 100644
+--- a/drivers/irqchip/irq-apple-aic.c
++++ b/drivers/irqchip/irq-apple-aic.c
+@@ -225,7 +225,7 @@ static void aic_irq_eoi(struct irq_data *d)
+ * Reading the interrupt reason automatically acknowledges and masks
+ * the IRQ, so we just unmask it here if needed.
+ */
+- if (!irqd_irq_disabled(d) && !irqd_irq_masked(d))
++ if (!irqd_irq_masked(d))
+ aic_irq_unmask(d);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1cd2ddd1453200b1a2108b4f59df7707fcbef525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 01:15:05 +0800
+Subject: irqchip/gic-v3: Fix priority comparison when non-secure priorities
+ are used
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 8d474deaba2c4dd33a5e2f5be82e6798ffa6b8a5 ]
+
+When non-secure priorities are used, compared to the raw priority set,
+the value read back from RPR is also right-shifted by one and the
+highest bit set.
+
+Add a macro to do the modifications to the raw priority when doing the
+comparison against the RPR value. This corrects the pseudo-NMI behavior
+when non-secure priorities in the GIC are used. Tested on 5.10 with
+the "IPI as pseudo-NMI" series [1] applied on MT8195.
+
+[1] https://lore.kernel.org/linux-arm-kernel/1604317487-14543-1-git-send-email-sumit.garg@linaro.org/
+
+Fixes: 336780590990 ("irqchip/gic-v3: Support pseudo-NMIs when SCR_EL3.FIQ == 0")
+Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+[maz: Added comment contributed by Alex]
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210811171505.1502090-1-wenst@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 66d623f91678..20a2d606b4c9 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -100,6 +100,27 @@ EXPORT_SYMBOL(gic_pmr_sync);
+ DEFINE_STATIC_KEY_FALSE(gic_nonsecure_priorities);
+ EXPORT_SYMBOL(gic_nonsecure_priorities);
+
++/*
++ * When the Non-secure world has access to group 0 interrupts (as a
++ * consequence of SCR_EL3.FIQ == 0), reading the ICC_RPR_EL1 register will
++ * return the Distributor's view of the interrupt priority.
++ *
++ * When GIC security is enabled (GICD_CTLR.DS == 0), the interrupt priority
++ * written by software is moved to the Non-secure range by the Distributor.
++ *
++ * If both are true (which is when gic_nonsecure_priorities gets enabled),
++ * we need to shift down the priority programmed by software to match it
++ * against the value returned by ICC_RPR_EL1.
++ */
++#define GICD_INT_RPR_PRI(priority) \
++ ({ \
++ u32 __priority = (priority); \
++ if (static_branch_unlikely(&gic_nonsecure_priorities)) \
++ __priority = 0x80 | (__priority >> 1); \
++ \
++ __priority; \
++ })
++
+ /* ppi_nmi_refs[n] == number of cpus having ppi[n + 16] set as NMI */
+ static refcount_t *ppi_nmi_refs;
+
+@@ -687,7 +708,7 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
+ return;
+
+ if (gic_supports_nmi() &&
+- unlikely(gic_read_rpr() == GICD_INT_NMI_PRI)) {
++ unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI))) {
+ gic_handle_nmi(irqnr, regs);
+ return;
+ }
+--
+2.30.2
+
--- /dev/null
+From 53a79f1cd0732af0699223b63c9d91a1c64ae08f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 21:22:16 +0800
+Subject: irqchip/loongson-pch-pic: Improve edge triggered interrupt support
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit e5dec38ac5d05d17a7110c8045aa101015281e4d ]
+
+Edge-triggered mode and level-triggered mode need different handlers,
+and edge-triggered mode need a specific ack operation. So improve it.
+
+Fixes: ef8c01eb64ca6719da449dab0 ("irqchip: Add Loongson PCH PIC controller")
+Signed-off-by: Chen Zhu <zhuchen@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210805132216.3539007-1-chenhuacai@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-loongson-pch-pic.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-loongson-pch-pic.c b/drivers/irqchip/irq-loongson-pch-pic.c
+index f790ca6d78aa..a4eb8a2181c7 100644
+--- a/drivers/irqchip/irq-loongson-pch-pic.c
++++ b/drivers/irqchip/irq-loongson-pch-pic.c
+@@ -92,18 +92,22 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)
+ case IRQ_TYPE_EDGE_RISING:
+ pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq);
+ pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq);
++ irq_set_handler_locked(d, handle_edge_irq);
+ break;
+ case IRQ_TYPE_EDGE_FALLING:
+ pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq);
+ pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq);
++ irq_set_handler_locked(d, handle_edge_irq);
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq);
+ pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq);
++ irq_set_handler_locked(d, handle_level_irq);
+ break;
+ case IRQ_TYPE_LEVEL_LOW:
+ pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq);
+ pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq);
++ irq_set_handler_locked(d, handle_level_irq);
+ break;
+ default:
+ ret = -EINVAL;
+@@ -113,11 +117,24 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)
+ return ret;
+ }
+
++static void pch_pic_ack_irq(struct irq_data *d)
++{
++ unsigned int reg;
++ struct pch_pic *priv = irq_data_get_irq_chip_data(d);
++
++ reg = readl(priv->base + PCH_PIC_EDGE + PIC_REG_IDX(d->hwirq) * 4);
++ if (reg & BIT(PIC_REG_BIT(d->hwirq))) {
++ writel(BIT(PIC_REG_BIT(d->hwirq)),
++ priv->base + PCH_PIC_CLR + PIC_REG_IDX(d->hwirq) * 4);
++ }
++ irq_chip_ack_parent(d);
++}
++
+ static struct irq_chip pch_pic_irq_chip = {
+ .name = "PCH PIC",
+ .irq_mask = pch_pic_mask_irq,
+ .irq_unmask = pch_pic_unmask_irq,
+- .irq_ack = irq_chip_ack_parent,
++ .irq_ack = pch_pic_ack_irq,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ .irq_set_type = pch_pic_set_type,
+ };
+--
+2.30.2
+
--- /dev/null
+From 012cca4d818f593d02f3f872d0b58a8b16515722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 18:24:37 +0200
+Subject: isofs: joliet: Fix iocharset=utf8 mount option
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ]
+
+Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset,
+it is required to use utf8 mount option.
+
+Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount
+option.
+
+If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So
+simplify code around, remove s_utf8 field as to distinguish between UTF-8
+and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL
+or not.
+
+Link: https://lore.kernel.org/r/20210808162453.1653-5-pali@kernel.org
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/isofs/inode.c | 27 +++++++++++++--------------
+ fs/isofs/isofs.h | 1 -
+ fs/isofs/joliet.c | 4 +---
+ 3 files changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index 21edc423b79f..678e2c51b855 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -155,7 +155,6 @@ struct iso9660_options{
+ unsigned int overriderockperm:1;
+ unsigned int uid_set:1;
+ unsigned int gid_set:1;
+- unsigned int utf8:1;
+ unsigned char map;
+ unsigned char check;
+ unsigned int blocksize;
+@@ -356,7 +355,6 @@ static int parse_options(char *options, struct iso9660_options *popt)
+ popt->gid = GLOBAL_ROOT_GID;
+ popt->uid = GLOBAL_ROOT_UID;
+ popt->iocharset = NULL;
+- popt->utf8 = 0;
+ popt->overriderockperm = 0;
+ popt->session=-1;
+ popt->sbsector=-1;
+@@ -389,10 +387,13 @@ static int parse_options(char *options, struct iso9660_options *popt)
+ case Opt_cruft:
+ popt->cruft = 1;
+ break;
++#ifdef CONFIG_JOLIET
+ case Opt_utf8:
+- popt->utf8 = 1;
++ kfree(popt->iocharset);
++ popt->iocharset = kstrdup("utf8", GFP_KERNEL);
++ if (!popt->iocharset)
++ return 0;
+ break;
+-#ifdef CONFIG_JOLIET
+ case Opt_iocharset:
+ kfree(popt->iocharset);
+ popt->iocharset = match_strdup(&args[0]);
+@@ -495,7 +496,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
+ if (sbi->s_nocompress) seq_puts(m, ",nocompress");
+ if (sbi->s_overriderockperm) seq_puts(m, ",overriderockperm");
+ if (sbi->s_showassoc) seq_puts(m, ",showassoc");
+- if (sbi->s_utf8) seq_puts(m, ",utf8");
+
+ if (sbi->s_check) seq_printf(m, ",check=%c", sbi->s_check);
+ if (sbi->s_mapping) seq_printf(m, ",map=%c", sbi->s_mapping);
+@@ -518,9 +518,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
+ seq_printf(m, ",fmode=%o", sbi->s_fmode);
+
+ #ifdef CONFIG_JOLIET
+- if (sbi->s_nls_iocharset &&
+- strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
++ if (sbi->s_nls_iocharset)
+ seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
++ else
++ seq_puts(m, ",iocharset=utf8");
+ #endif
+ return 0;
+ }
+@@ -863,14 +864,13 @@ root_found:
+ sbi->s_nls_iocharset = NULL;
+
+ #ifdef CONFIG_JOLIET
+- if (joliet_level && opt.utf8 == 0) {
++ if (joliet_level) {
+ char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT;
+- sbi->s_nls_iocharset = load_nls(p);
+- if (! sbi->s_nls_iocharset) {
+- /* Fail only if explicit charset specified */
+- if (opt.iocharset)
++ if (strcmp(p, "utf8") != 0) {
++ sbi->s_nls_iocharset = opt.iocharset ?
++ load_nls(opt.iocharset) : load_nls_default();
++ if (!sbi->s_nls_iocharset)
+ goto out_freesbi;
+- sbi->s_nls_iocharset = load_nls_default();
+ }
+ }
+ #endif
+@@ -886,7 +886,6 @@ root_found:
+ sbi->s_gid = opt.gid;
+ sbi->s_uid_set = opt.uid_set;
+ sbi->s_gid_set = opt.gid_set;
+- sbi->s_utf8 = opt.utf8;
+ sbi->s_nocompress = opt.nocompress;
+ sbi->s_overriderockperm = opt.overriderockperm;
+ /*
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 055ec6c586f7..dcdc191ed183 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -44,7 +44,6 @@ struct isofs_sb_info {
+ unsigned char s_session;
+ unsigned int s_high_sierra:1;
+ unsigned int s_rock:2;
+- unsigned int s_utf8:1;
+ unsigned int s_cruft:1; /* Broken disks with high byte of length
+ * containing junk */
+ unsigned int s_nocompress:1;
+diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c
+index be8b6a9d0b92..c0f04a1e7f69 100644
+--- a/fs/isofs/joliet.c
++++ b/fs/isofs/joliet.c
+@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)
+ int
+ get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode)
+ {
+- unsigned char utf8;
+ struct nls_table *nls;
+ unsigned char len = 0;
+
+- utf8 = ISOFS_SB(inode->i_sb)->s_utf8;
+ nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset;
+
+- if (utf8) {
++ if (!nls) {
+ len = utf16s_to_utf8s((const wchar_t *) de->name,
+ de->name_len[0] >> 1, UTF16_BIG_ENDIAN,
+ outname, PAGE_SIZE);
+--
+2.30.2
+
--- /dev/null
+From 889b74b365ab35b8c1f59aaab1c7fa72e628ca92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 14:21:53 +0300
+Subject: iwlwifi: skip first element in the WTAS ACPI table
+
+From: Abhishek Naik <abhishek.naik@intel.com>
+
+[ Upstream commit 19426d54302e199b3fd2d575f926a13af66be2b9 ]
+
+By mistake we were considering the first element of the WTAS wifi
+package as part of the data we want to rid, but that element is the wifi
+package signature (always 0x07), so it should be skipped.
+
+Change the code to read the data starting from element 1 instead.
+
+Signed-off-by: Abhishek Naik <abhishek.naik@intel.com>
+Fixes: 28dd7ccdc56f ("iwlwifi: acpi: read TAS table from ACPI and send it to the FW")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20210805141826.ff8148197b15.I70636c04e37b2b57a5df3ce611511f62203d27a7@changeid
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+index e31bba836c6f..dfa4047f97a0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+@@ -243,7 +243,7 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
+ goto out_free;
+ }
+
+- enabled = !!wifi_pkg->package.elements[0].integer.value;
++ enabled = !!wifi_pkg->package.elements[1].integer.value;
+
+ if (!enabled) {
+ *block_list_size = -1;
+@@ -252,15 +252,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
+ goto out_free;
+ }
+
+- if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER ||
+- wifi_pkg->package.elements[1].integer.value >
++ if (wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER ||
++ wifi_pkg->package.elements[2].integer.value >
+ APCI_WTAS_BLACK_LIST_MAX) {
+ IWL_DEBUG_RADIO(fwrt, "TAS invalid array size %llu\n",
+ wifi_pkg->package.elements[1].integer.value);
+ ret = -EINVAL;
+ goto out_free;
+ }
+- *block_list_size = wifi_pkg->package.elements[1].integer.value;
++ *block_list_size = wifi_pkg->package.elements[2].integer.value;
+
+ IWL_DEBUG_RADIO(fwrt, "TAS array size %d\n", *block_list_size);
+ if (*block_list_size > APCI_WTAS_BLACK_LIST_MAX) {
+@@ -273,15 +273,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
+ for (i = 0; i < *block_list_size; i++) {
+ u32 country;
+
+- if (wifi_pkg->package.elements[2 + i].type !=
++ if (wifi_pkg->package.elements[3 + i].type !=
+ ACPI_TYPE_INTEGER) {
+ IWL_DEBUG_RADIO(fwrt,
+- "TAS invalid array elem %d\n", 2 + i);
++ "TAS invalid array elem %d\n", 3 + i);
+ ret = -EINVAL;
+ goto out_free;
+ }
+
+- country = wifi_pkg->package.elements[2 + i].integer.value;
++ country = wifi_pkg->package.elements[3 + i].integer.value;
+ block_list_array[i] = cpu_to_le32(country);
+ IWL_DEBUG_RADIO(fwrt, "TAS block list country %d\n", country);
+ }
+--
+2.30.2
+
--- /dev/null
+From a0628d16972cd6366ad836f15dde83ff9e40f054 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Jun 2021 19:09:03 +0800
+Subject: leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit e642197562cd9781453f835e1406cfe0feeb917e ]
+
+The error code is missing in this code scenario, add the error code
+'-EINVAL' to the return value 'ret'.
+
+Eliminate the follow smatch warning:
+
+drivers/leds/leds-is31fl32xx.c:388 is31fl32xx_parse_dt() warn: missing
+error code 'ret'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Fixes: 9d7cffaf99f5 ("leds: Add driver for the ISSI IS31FL32xx family of LED controllers")
+Acked-by: David Rivshin <drivshin@allworx.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-is31fl32xx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/leds-is31fl32xx.c b/drivers/leds/leds-is31fl32xx.c
+index 2180255ad339..899ed94b6687 100644
+--- a/drivers/leds/leds-is31fl32xx.c
++++ b/drivers/leds/leds-is31fl32xx.c
+@@ -385,6 +385,7 @@ static int is31fl32xx_parse_dt(struct device *dev,
+ dev_err(dev,
+ "Node %pOF 'reg' conflicts with another LED\n",
+ child);
++ ret = -EINVAL;
+ goto err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From baa05a3587e02c21acdd53488f55245595908bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 May 2021 14:19:27 +0300
+Subject: leds: lgm-sso: Don't spam logs when probe is deferred
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+[ Upstream commit 1ed4d05e0a0b23ba15e0affcff4008dd537ae3ee ]
+
+When requesting GPIO line the probe can be deferred.
+In such case don't spam logs with an error message.
+This can be achieved by switching to dev_err_probe().
+
+Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
+Cc: Amireddy Mallikarjuna reddy <mallikarjunax.reddy@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/blink/leds-lgm-sso.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
+index 2dd285052c6a..6c0ffcaa6b5c 100644
+--- a/drivers/leds/blink/leds-lgm-sso.c
++++ b/drivers/leds/blink/leds-lgm-sso.c
+@@ -643,7 +643,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+ fwnode_child,
+ GPIOD_ASIS, NULL);
+ if (IS_ERR(led->gpiod)) {
+- dev_err(dev, "led: get gpio fail!\n");
++ dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
+ goto __dt_err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d70cc4138952c7aa73c7d384317ad2902c3da8ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 14:26:19 +0300
+Subject: leds: lgm-sso: Propagate error codes from callee to caller
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 9cbc861095375793a69858f91f3ac4e817f320f0 ]
+
+The one of the latest change to the driver reveals the problem that
+the error codes from callee aren't propagated to the caller of
+__sso_led_dt_parse(). Fix this accordingly.
+
+Fixes: 9999908ca1ab ("leds: lgm-sso: Put fwnode in any case during ->probe()")
+Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/blink/leds-lgm-sso.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
+index 6c0ffcaa6b5c..24736f29d363 100644
+--- a/drivers/leds/blink/leds-lgm-sso.c
++++ b/drivers/leds/blink/leds-lgm-sso.c
+@@ -643,7 +643,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+ fwnode_child,
+ GPIOD_ASIS, NULL);
+ if (IS_ERR(led->gpiod)) {
+- dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
++ ret = dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
+ goto __dt_err;
+ }
+
+@@ -663,8 +663,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+ desc->panic_indicator = 1;
+
+ ret = fwnode_property_read_u32(fwnode_child, "reg", &prop);
+- if (ret != 0 || prop >= SSO_LED_MAX_NUM) {
++ if (ret)
++ goto __dt_err;
++ if (prop >= SSO_LED_MAX_NUM) {
+ dev_err(dev, "invalid LED pin:%u\n", prop);
++ ret = -EINVAL;
+ goto __dt_err;
+ }
+ desc->pin = prop;
+@@ -700,7 +703,8 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+ desc->brightness = LED_FULL;
+ }
+
+- if (sso_create_led(priv, led, fwnode_child))
++ ret = sso_create_led(priv, led, fwnode_child);
++ if (ret)
+ goto __dt_err;
+ }
+
+@@ -714,7 +718,7 @@ __dt_err:
+ sso_led_shutdown(led);
+ }
+
+- return -EINVAL;
++ return ret;
+ }
+
+ static int sso_led_dt_parse(struct sso_led_priv *priv)
+--
+2.30.2
+
--- /dev/null
+From 85ec4d914e70bc58ba8e28b2414d9d56389a1f7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 May 2021 14:19:26 +0300
+Subject: leds: lgm-sso: Put fwnode in any case during ->probe()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+[ Upstream commit 9999908ca1abee7aa518a4f6a3739517c137acbf ]
+
+fwnode_get_next_child_node() bumps a reference counting of a returned variable.
+We have to balance it whenever we return to the caller.
+
+All the same in fwnode_for_each_child_node() case.
+
+Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
+Cc: Amireddy Mallikarjuna reddy <mallikarjunax.reddy@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/blink/leds-lgm-sso.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
+index 7d5f0bf2817a..2dd285052c6a 100644
+--- a/drivers/leds/blink/leds-lgm-sso.c
++++ b/drivers/leds/blink/leds-lgm-sso.c
+@@ -630,8 +630,10 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+
+ fwnode_for_each_child_node(fw_ssoled, fwnode_child) {
+ led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
+- if (!led)
+- return -ENOMEM;
++ if (!led) {
++ ret = -ENOMEM;
++ goto __dt_err;
++ }
+
+ INIT_LIST_HEAD(&led->list);
+ led->priv = priv;
+@@ -701,11 +703,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
+ if (sso_create_led(priv, led, fwnode_child))
+ goto __dt_err;
+ }
+- fwnode_handle_put(fw_ssoled);
+
+ return 0;
++
+ __dt_err:
+- fwnode_handle_put(fw_ssoled);
++ fwnode_handle_put(fwnode_child);
+ /* unregister leds */
+ list_for_each(p, &priv->led_list) {
+ led = list_entry(p, struct sso_led, list);
+@@ -730,6 +732,7 @@ static int sso_led_dt_parse(struct sso_led_priv *priv)
+ fw_ssoled = fwnode_get_named_child_node(fwnode, "ssoled");
+ if (fw_ssoled) {
+ ret = __sso_led_dt_parse(priv, fw_ssoled);
++ fwnode_handle_put(fw_ssoled);
+ if (ret)
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From c8ca7b6e0d8fdfde006f02521eb84f5ba9131ac8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 May 2021 14:19:33 +0300
+Subject: leds: lt3593: Put fwnode in any case during ->probe()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+[ Upstream commit 7e1baaaa2407a642ea19b58e214fab9a69cda1d7 ]
+
+device_get_next_child_node() bumps a reference counting of a returned variable.
+We have to balance it whenever we return to the caller.
+
+Fixes: 8cd7d6daba93 ("leds: lt3593: Add device tree probing glue")
+Cc: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-lt3593.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c
+index 68e06434ac08..7dab08773a34 100644
+--- a/drivers/leds/leds-lt3593.c
++++ b/drivers/leds/leds-lt3593.c
+@@ -99,10 +99,9 @@ static int lt3593_led_probe(struct platform_device *pdev)
+ init_data.default_label = ":";
+
+ ret = devm_led_classdev_register_ext(dev, &led_data->cdev, &init_data);
+- if (ret < 0) {
+- fwnode_handle_put(child);
++ fwnode_handle_put(child);
++ if (ret < 0)
+ return ret;
+- }
+
+ platform_set_drvdata(pdev, led_data);
+
+--
+2.30.2
+
--- /dev/null
+From 0a32430ba83bac123275896e8faa542646f0d5d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 May 2021 14:19:34 +0300
+Subject: leds: rt8515: Put fwnode in any case during ->probe()
+
+From: Andy Shevchenko <andy.shevchenko@gmail.com>
+
+[ Upstream commit 8aa41952ef245449df79100e1942b5e6288b098a ]
+
+fwnode_get_next_available_child_node() bumps a reference counting of
+a returned variable. We have to balance it whenever we return to
+the caller.
+
+Fixes: e1c6edcbea13 ("leds: rt8515: Add Richtek RT8515 LED driver")
+Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-rt8515.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/leds/flash/leds-rt8515.c b/drivers/leds/flash/leds-rt8515.c
+index 590bfa180d10..44904fdee3cc 100644
+--- a/drivers/leds/flash/leds-rt8515.c
++++ b/drivers/leds/flash/leds-rt8515.c
+@@ -343,8 +343,9 @@ static int rt8515_probe(struct platform_device *pdev)
+
+ ret = devm_led_classdev_flash_register_ext(dev, fled, &init_data);
+ if (ret) {
+- dev_err(dev, "can't register LED %s\n", led->name);
++ fwnode_handle_put(child);
+ mutex_destroy(&rt->lock);
++ dev_err(dev, "can't register LED %s\n", led->name);
+ return ret;
+ }
+
+@@ -362,6 +363,7 @@ static int rt8515_probe(struct platform_device *pdev)
+ */
+ }
+
++ fwnode_handle_put(child);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 40fe6da24068a203f1a0485fa4cbcc4e0cfda3d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Feb 2021 12:52:08 +0100
+Subject: leds: trigger: audio: Add an activate callback to ensure the initial
+ brightness is set
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 64f67b5240db79eceb0bd57dae8e591fd3103ba0 ]
+
+Some 2-in-1s with a detachable (USB) keyboard(dock) have mute-LEDs in
+the speaker- and/or mic-mute keys on the keyboard.
+
+Examples of this are the Lenovo Thinkpad10 tablet (with its USB kbd-dock)
+and the HP x2 10 series.
+
+The detachable nature of these keyboards means that the keyboard and
+thus the mute LEDs may show up after the user (or userspace restoring
+old mixer settings) has muted the speaker and/or mic.
+
+Current LED-class devices with a default_trigger of "audio-mute" or
+"audio-micmute" initialize the brightness member of led_classdev with
+ledtrig_audio_get() before registering the LED.
+
+This makes the software state after attaching the keyboard match the
+actual audio mute state, e.g. cat /sys/class/leds/foo/brightness will
+show the right value.
+
+But before this commit nothing was actually calling the led_classdev's
+brightness_set[_blocking] callback so the value returned by
+ledtrig_audio_get() was never actually being sent to the hw, leading
+to the mute LEDs staying in their default power-on state, after
+attaching the keyboard, even if ledtrig_audio_get() returned a different
+state.
+
+This could be fixed by having the individual LED drivers call
+brightness_set[_blocking] themselves after registering the LED,
+but this really is something which should be done by a led-trigger
+activate callback.
+
+Add an activate callback for this, fixing the issue of the
+mute LEDs being out of sync after (re)attaching the keyboard.
+
+Cc: Takashi Iwai <tiwai@suse.de>
+Fixes: faa2541f5b1a ("leds: trigger: Introduce audio mute LED trigger")
+Reviewed-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/trigger/ledtrig-audio.c | 37 ++++++++++++++++++++++------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/leds/trigger/ledtrig-audio.c b/drivers/leds/trigger/ledtrig-audio.c
+index f76621e88482..c6b437e6369b 100644
+--- a/drivers/leds/trigger/ledtrig-audio.c
++++ b/drivers/leds/trigger/ledtrig-audio.c
+@@ -6,10 +6,33 @@
+ #include <linux/kernel.h>
+ #include <linux/leds.h>
+ #include <linux/module.h>
++#include "../leds.h"
+
+-static struct led_trigger *ledtrig_audio[NUM_AUDIO_LEDS];
+ static enum led_brightness audio_state[NUM_AUDIO_LEDS];
+
++static int ledtrig_audio_mute_activate(struct led_classdev *led_cdev)
++{
++ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MUTE]);
++ return 0;
++}
++
++static int ledtrig_audio_micmute_activate(struct led_classdev *led_cdev)
++{
++ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MICMUTE]);
++ return 0;
++}
++
++static struct led_trigger ledtrig_audio[NUM_AUDIO_LEDS] = {
++ [LED_AUDIO_MUTE] = {
++ .name = "audio-mute",
++ .activate = ledtrig_audio_mute_activate,
++ },
++ [LED_AUDIO_MICMUTE] = {
++ .name = "audio-micmute",
++ .activate = ledtrig_audio_micmute_activate,
++ },
++};
++
+ enum led_brightness ledtrig_audio_get(enum led_audio type)
+ {
+ return audio_state[type];
+@@ -19,24 +42,22 @@ EXPORT_SYMBOL_GPL(ledtrig_audio_get);
+ void ledtrig_audio_set(enum led_audio type, enum led_brightness state)
+ {
+ audio_state[type] = state;
+- led_trigger_event(ledtrig_audio[type], state);
++ led_trigger_event(&ledtrig_audio[type], state);
+ }
+ EXPORT_SYMBOL_GPL(ledtrig_audio_set);
+
+ static int __init ledtrig_audio_init(void)
+ {
+- led_trigger_register_simple("audio-mute",
+- &ledtrig_audio[LED_AUDIO_MUTE]);
+- led_trigger_register_simple("audio-micmute",
+- &ledtrig_audio[LED_AUDIO_MICMUTE]);
++ led_trigger_register(&ledtrig_audio[LED_AUDIO_MUTE]);
++ led_trigger_register(&ledtrig_audio[LED_AUDIO_MICMUTE]);
+ return 0;
+ }
+ module_init(ledtrig_audio_init);
+
+ static void __exit ledtrig_audio_exit(void)
+ {
+- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MUTE]);
+- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MICMUTE]);
++ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MUTE]);
++ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MICMUTE]);
+ }
+ module_exit(ledtrig_audio_exit);
+
+--
+2.30.2
+
--- /dev/null
+From af734a4aa723c98d5697d4e998bcf9c0044e41fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 16:53:32 +0800
+Subject: lib/mpi: use kcalloc in mpi_resize
+
+From: Hongbo Li <herberthbli@tencent.com>
+
+[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ]
+
+We should set the additional space to 0 in mpi_resize().
+So use kcalloc() instead of kmalloc_array().
+
+In lib/mpi/ec.c:
+/****************
+ * Resize the array of A to NLIMBS. the additional space is cleared
+ * (set to 0) [done by m_realloc()]
+ */
+int mpi_resize(MPI a, unsigned nlimbs)
+
+Like the comment of kernel's mpi_resize() said, the additional space
+need to be set to 0, but when a->d is not NULL, it does not set.
+
+The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt
+is _gcry_mpi_resize() which set the additional space to 0.
+
+This bug may cause mpi api which use mpi_resize() get wrong result
+under the condition of using the additional space without initiation.
+If this condition is not met, the bug would not be triggered.
+Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well,
+so the bug is not triggered in these cases.
+
+add_points_edwards() use the additional space directly, so it will
+get a wrong result.
+
+Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
+Signed-off-by: Hongbo Li <herberthbli@tencent.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/mpi/mpiutil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
+index 3c63710c20c6..e6c4b3180ab1 100644
+--- a/lib/mpi/mpiutil.c
++++ b/lib/mpi/mpiutil.c
+@@ -148,7 +148,7 @@ int mpi_resize(MPI a, unsigned nlimbs)
+ return 0; /* no need to do it */
+
+ if (a->d) {
+- p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
++ p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
+ if (!p)
+ return -ENOMEM;
+ memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
+--
+2.30.2
+
--- /dev/null
+From 17588d58505ee7e183c27761df21e441eeaf3e88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 10:44:47 +0900
+Subject: libata: fix ata_host_start()
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ]
+
+The loop on entry of ata_host_start() may not initialize host->ops to a
+non NULL value. The test on the host_stop field of host->ops must then
+be preceded by a check that host->ops is not NULL.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Link: https://lore.kernel.org/r/20210816014456.2191776-3-damien.lemoal@wdc.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 61c762961ca8..44f434acfce0 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5573,7 +5573,7 @@ int ata_host_start(struct ata_host *host)
+ have_stop = 1;
+ }
+
+- if (host->ops->host_stop)
++ if (host->ops && host->ops->host_stop)
+ have_stop = 1;
+
+ if (have_stop) {
+--
+2.30.2
+
--- /dev/null
+From 1fdc54d61ea711da6f6060b91f0b59eac6866a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 19:38:37 +0200
+Subject: libbpf: Fix removal of inner map in bpf_object__create_map
+
+From: Martynas Pumputis <m@lambda.lt>
+
+[ Upstream commit a21ab4c59e09c2a9994a6e393b7484e3b3f78a99 ]
+
+If creating an outer map of a BTF-defined map-in-map fails (via
+bpf_object__create_map()), then the previously created its inner map
+won't be destroyed.
+
+Fix this by ensuring that the destroy routines are not bypassed in the
+case of a failure.
+
+Fixes: 646f02ffdd49c ("libbpf: Add BTF-defined map-in-map support")
+Reported-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Martynas Pumputis <m@lambda.lt>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20210719173838.423148-2-m@lambda.lt
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 2af2d0e4a231..f6ebda75b030 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -4409,6 +4409,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map)
+ {
+ struct bpf_create_map_attr create_attr;
+ struct bpf_map_def *def = &map->def;
++ int err = 0;
+
+ memset(&create_attr, 0, sizeof(create_attr));
+
+@@ -4451,8 +4452,6 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map)
+
+ if (bpf_map_type__is_map_in_map(def->type)) {
+ if (map->inner_map) {
+- int err;
+-
+ err = bpf_object__create_map(obj, map->inner_map);
+ if (err) {
+ pr_warn("map '%s': failed to create inner map: %d\n",
+@@ -4469,8 +4468,8 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map)
+ if (map->fd < 0 && (create_attr.btf_key_type_id ||
+ create_attr.btf_value_type_id)) {
+ char *cp, errmsg[STRERR_BUFSIZE];
+- int err = -errno;
+
++ err = -errno;
+ cp = libbpf_strerror_r(err, errmsg, sizeof(errmsg));
+ pr_warn("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n",
+ map->name, cp, err);
+@@ -4482,15 +4481,14 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map)
+ map->fd = bpf_create_map_xattr(&create_attr);
+ }
+
+- if (map->fd < 0)
+- return -errno;
++ err = map->fd < 0 ? -errno : 0;
+
+ if (bpf_map_type__is_map_in_map(def->type) && map->inner_map) {
+ bpf_map__destroy(map->inner_map);
+ zfree(&map->inner_map);
+ }
+
+- return 0;
++ return err;
+ }
+
+ static int init_map_slots(struct bpf_map *map)
+--
+2.30.2
+
--- /dev/null
+From b0015223cc71b7d37232e1c94a0308b439d40677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 20:42:38 +0800
+Subject: libbpf: Fix the possible memory leak on error
+
+From: Shuyi Cheng <chengshuyi@linux.alibaba.com>
+
+[ Upstream commit 18353c87e0e0440d4c7c746ed740738bbc1b538e ]
+
+If the strdup() fails then we need to call bpf_object__close(obj) to
+avoid a resource leak.
+
+Fixes: 166750bc1dd2 ("libbpf: Support libbpf-provided extern variables")
+Signed-off-by: Shuyi Cheng <chengshuyi@linux.alibaba.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/1626180159-112996-3-git-send-email-chengshuyi@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index c41d9b2b59ac..2af2d0e4a231 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -7365,8 +7365,10 @@ __bpf_object__open(const char *path, const void *obj_buf, size_t obj_buf_sz,
+ kconfig = OPTS_GET(opts, kconfig, NULL);
+ if (kconfig) {
+ obj->kconfig = strdup(kconfig);
+- if (!obj->kconfig)
+- return ERR_PTR(-ENOMEM);
++ if (!obj->kconfig) {
++ err = -ENOMEM;
++ goto out;
++ }
+ }
+
+ err = bpf_object__elf_init(obj);
+--
+2.30.2
+
--- /dev/null
+From 4987f382b143b67f2aca21c5f33e054e25637e43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 00:06:00 -0700
+Subject: libbpf: Re-build libbpf.so when libbpf.map changes
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 61c7aa5020e98ac2fdcf07d07eec1baf2e9f0a08 ]
+
+Ensure libbpf.so is re-built whenever libbpf.map is modified. Without this,
+changes to libbpf.map are not detected and versioned symbols mismatch error
+will be reported until `make clean && make` is used, which is a suboptimal
+developer experience.
+
+Fixes: 306b267cb3c4 ("libbpf: Verify versioned symbols")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210815070609.987780-8-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
+index e43e1896cb4b..0d9d8ed6512b 100644
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -4,8 +4,9 @@
+ RM ?= rm
+ srctree = $(abs_srctree)
+
++VERSION_SCRIPT := libbpf.map
+ LIBBPF_VERSION := $(shell \
+- grep -oE '^LIBBPF_([0-9.]+)' libbpf.map | \
++ grep -oE '^LIBBPF_([0-9.]+)' $(VERSION_SCRIPT) | \
+ sort -rV | head -n1 | cut -d'_' -f2)
+ LIBBPF_MAJOR_VERSION := $(firstword $(subst ., ,$(LIBBPF_VERSION)))
+
+@@ -110,7 +111,6 @@ SHARED_OBJDIR := $(OUTPUT)sharedobjs/
+ STATIC_OBJDIR := $(OUTPUT)staticobjs/
+ BPF_IN_SHARED := $(SHARED_OBJDIR)libbpf-in.o
+ BPF_IN_STATIC := $(STATIC_OBJDIR)libbpf-in.o
+-VERSION_SCRIPT := libbpf.map
+ BPF_HELPER_DEFS := $(OUTPUT)bpf_helper_defs.h
+
+ LIB_TARGET := $(addprefix $(OUTPUT),$(LIB_TARGET))
+@@ -163,10 +163,10 @@ $(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h
+
+ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
+
+-$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED)
++$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) $(VERSION_SCRIPT)
+ $(QUIET_LINK)$(CC) $(LDFLAGS) \
+ --shared -Wl,-soname,libbpf.so.$(LIBBPF_MAJOR_VERSION) \
+- -Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -lz -o $@
++ -Wl,--version-script=$(VERSION_SCRIPT) $< -lelf -lz -o $@
+ @ln -sf $(@F) $(OUTPUT)libbpf.so
+ @ln -sf $(@F) $(OUTPUT)libbpf.so.$(LIBBPF_MAJOR_VERSION)
+
+@@ -181,7 +181,7 @@ $(OUTPUT)libbpf.pc:
+
+ check: check_abi
+
+-check_abi: $(OUTPUT)libbpf.so
++check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT)
+ @if [ "$(GLOBAL_SYM_COUNT)" != "$(VERSIONED_SYM_COUNT)" ]; then \
+ echo "Warning: Num of global symbols in $(BPF_IN_SHARED)" \
+ "($(GLOBAL_SYM_COUNT)) does NOT match with num of" \
+--
+2.30.2
+
--- /dev/null
+From de9dd3564231aceb358d55a63f30ec656a90f274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 19:29:39 -0700
+Subject: lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit d1f278da6b11585f05b2755adfc8851cbf14a1ec ]
+
+When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some
+compilers (i.e., at least gcc 8.4.0) decided to compile this
+inline. This is a problem for lkdtm.ko, which inserted a kprobe
+on this function for the SCSI_DISPATCH_CMD crashpoint.
+
+Move this crashpoint one function up the call chain to
+scsi_queue_rq. Though this is also a static function, it should never be
+inlined because it is assigned as a structure entry. Therefore,
+kprobe_register should always be able to find it.
+
+Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c")
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Link: https://lore.kernel.org/r/20210819022940.561875-2-kevmitch@arista.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/fault-injection/provoke-crashes.rst | 2 +-
+ drivers/misc/lkdtm/core.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
+index a20ba5d93932..18de17354206 100644
+--- a/Documentation/fault-injection/provoke-crashes.rst
++++ b/Documentation/fault-injection/provoke-crashes.rst
+@@ -29,7 +29,7 @@ recur_count
+ cpoint_name
+ Where in the kernel to trigger the action. It can be
+ one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
+- FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
++ FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
+ IDE_CORE_CP, or DIRECT
+
+ cpoint_type
+diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
+index cd833011f285..4757e29b42c0 100644
+--- a/drivers/misc/lkdtm/core.c
++++ b/drivers/misc/lkdtm/core.c
+@@ -81,7 +81,7 @@ static struct crashpoint crashpoints[] = {
+ CRASHPOINT("FS_DEVRW", "ll_rw_block"),
+ CRASHPOINT("MEM_SWAPOUT", "shrink_inactive_list"),
+ CRASHPOINT("TIMERADD", "hrtimer_start"),
+- CRASHPOINT("SCSI_DISPATCH_CMD", "scsi_dispatch_cmd"),
++ CRASHPOINT("SCSI_QUEUE_RQ", "scsi_queue_rq"),
+ CRASHPOINT("IDE_CORE_CP", "generic_ide_ioctl"),
+ #endif
+ };
+--
+2.30.2
+
--- /dev/null
+From f83c982259af45586e3660507285baa620099e2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 09:33:28 -0400
+Subject: lockd: Fix invalid lockowner cast after vfs_test_lock
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit cd2d644ddba183ec7b451b7c20d5c7cc06fcf0d7 ]
+
+After calling vfs_test_lock() the pointer to a conflicting lock can be
+returned, and that lock is not guarunteed to be owned by nlm. In that
+case, we cannot cast it to struct nlm_lockowner. Instead return the pid
+of that conflicting lock.
+
+Fixes: 646d73e91b42 ("lockd: Show pid of lockd for remote locks")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/svclock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index 61d3cc2283dc..498cb70c2c0d 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -634,7 +634,7 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file,
+ conflock->caller = "somehost"; /* FIXME */
+ conflock->len = strlen(conflock->caller);
+ conflock->oh.len = 0; /* don't return OH info */
+- conflock->svid = ((struct nlm_lockowner *)lock->fl.fl_owner)->pid;
++ conflock->svid = lock->fl.fl_pid;
+ conflock->fl.fl_type = lock->fl.fl_type;
+ conflock->fl.fl_start = lock->fl.fl_start;
+ conflock->fl.fl_end = lock->fl.fl_end;
+--
+2.30.2
+
--- /dev/null
+From e5fd95ce9057e09fd0642e045f8bf96db54b5259 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Aug 2021 23:27:37 +0200
+Subject: locking/local_lock: Add missing owner initialization
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit d8bbd97ad0b99a9394f2cd8410b884c48e218cf0 ]
+
+If CONFIG_DEBUG_LOCK_ALLOC=y is enabled then local_lock_t has an 'owner'
+member which is checked for consistency, but nothing initialized it to
+zero explicitly.
+
+The static initializer does so implicit, and the run time allocated per CPU
+storage is usually zero initialized as well, but relying on that is not
+really good practice.
+
+Fixes: 91710728d172 ("locking: Introduce local_lock()")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20210815211301.969975279@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/local_lock_internal.h | 42 ++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 19 deletions(-)
+
+diff --git a/include/linux/local_lock_internal.h b/include/linux/local_lock_internal.h
+index ded90b097e6e..3f02b818625e 100644
+--- a/include/linux/local_lock_internal.h
++++ b/include/linux/local_lock_internal.h
+@@ -14,29 +14,14 @@ typedef struct {
+ } local_lock_t;
+
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define LL_DEP_MAP_INIT(lockname) \
++# define LOCAL_LOCK_DEBUG_INIT(lockname) \
+ .dep_map = { \
+ .name = #lockname, \
+ .wait_type_inner = LD_WAIT_CONFIG, \
+- .lock_type = LD_LOCK_PERCPU, \
+- }
+-#else
+-# define LL_DEP_MAP_INIT(lockname)
+-#endif
+-
+-#define INIT_LOCAL_LOCK(lockname) { LL_DEP_MAP_INIT(lockname) }
+-
+-#define __local_lock_init(lock) \
+-do { \
+- static struct lock_class_key __key; \
+- \
+- debug_check_no_locks_freed((void *)lock, sizeof(*lock));\
+- lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, 0, \
+- LD_WAIT_CONFIG, LD_WAIT_INV, \
+- LD_LOCK_PERCPU); \
+-} while (0)
++ .lock_type = LD_LOCK_PERCPU, \
++ }, \
++ .owner = NULL,
+
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+ static inline void local_lock_acquire(local_lock_t *l)
+ {
+ lock_map_acquire(&l->dep_map);
+@@ -51,11 +36,30 @@ static inline void local_lock_release(local_lock_t *l)
+ lock_map_release(&l->dep_map);
+ }
+
++static inline void local_lock_debug_init(local_lock_t *l)
++{
++ l->owner = NULL;
++}
+ #else /* CONFIG_DEBUG_LOCK_ALLOC */
++# define LOCAL_LOCK_DEBUG_INIT(lockname)
+ static inline void local_lock_acquire(local_lock_t *l) { }
+ static inline void local_lock_release(local_lock_t *l) { }
++static inline void local_lock_debug_init(local_lock_t *l) { }
+ #endif /* !CONFIG_DEBUG_LOCK_ALLOC */
+
++#define INIT_LOCAL_LOCK(lockname) { LOCAL_LOCK_DEBUG_INIT(lockname) }
++
++#define __local_lock_init(lock) \
++do { \
++ static struct lock_class_key __key; \
++ \
++ debug_check_no_locks_freed((void *)lock, sizeof(*lock));\
++ lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, \
++ 0, LD_WAIT_CONFIG, LD_WAIT_INV, \
++ LD_LOCK_PERCPU); \
++ local_lock_debug_init(lock); \
++} while (0)
++
+ #define __local_lock(lock) \
+ do { \
+ preempt_disable(); \
+--
+2.30.2
+
--- /dev/null
+From 7e6e3495e5ae39dd3b5e6ffc523809faf979d629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jun 2021 17:35:18 +0200
+Subject: locking/mutex: Fix HANDOFF condition
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
+
+Yanfei reported that setting HANDOFF should not depend on recomputing
+@first, only on @first state. Which would then give:
+
+ if (ww_ctx || !first)
+ first = __mutex_waiter_is_first(lock, &waiter);
+ if (first)
+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+
+But because 'ww_ctx || !first' is basically 'always' and the test for
+first is relatively cheap, omit that first branch entirely.
+
+Reported-by: Yanfei Xu <yanfei.xu@windriver.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Yanfei Xu <yanfei.xu@windriver.com>
+Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/mutex.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
+index 013e1b08a1bf..a03d3d3ff886 100644
+--- a/kernel/locking/mutex.c
++++ b/kernel/locking/mutex.c
+@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
+ {
+ struct mutex_waiter waiter;
+- bool first = false;
+ struct ww_mutex *ww;
+ int ret;
+
+@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+
+ set_current_state(state);
+ for (;;) {
++ bool first;
++
+ /*
+ * Once we hold wait_lock, we're serialized against
+ * mutex_unlock() handing the lock off to us, do a trylock
+@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,
+ spin_unlock(&lock->wait_lock);
+ schedule_preempt_disabled();
+
+- /*
+- * ww_mutex needs to always recheck its position since its waiter
+- * list is not FIFO ordered.
+- */
+- if (ww_ctx || !first) {
+- first = __mutex_waiter_is_first(lock, &waiter);
+- if (first)
+- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+- }
++ first = __mutex_waiter_is_first(lock, &waiter);
++ if (first)
++ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
+
+ set_current_state(state);
+ /*
+--
+2.30.2
+
--- /dev/null
+From 1dd1c03ae6a1edee3afcf636fac5f27cae431b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 15:27:03 +0300
+Subject: m68k: coldfire: return success for clk_enable(NULL)
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f6a4f0b424df957d84fa7b9f2d02981234ff5828 ]
+
+The clk_enable is supposed work when CONFIG_HAVE_CLK is false, but it
+returns -EINVAL. That means some drivers fail during probe.
+
+[ 1.680000] flexcan: probe of flexcan.0 failed with error -22
+
+Fixes: c1fb1bf64bb6 ("m68k: let clk_enable() return immediately if clk is NULL")
+Fixes: bea8bcb12da0 ("m68knommu: Add support for the Coldfire m5441x.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/coldfire/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/m68k/coldfire/clk.c b/arch/m68k/coldfire/clk.c
+index 076a9caa9557..c895a189c5ae 100644
+--- a/arch/m68k/coldfire/clk.c
++++ b/arch/m68k/coldfire/clk.c
+@@ -92,7 +92,7 @@ int clk_enable(struct clk *clk)
+ unsigned long flags;
+
+ if (!clk)
+- return -EINVAL;
++ return 0;
+
+ spin_lock_irqsave(&clk_lock, flags);
+ if ((clk->enabled++ == 0) && clk->clk_ops)
+--
+2.30.2
+
--- /dev/null
+From f641c2aad2629acb57b5d287a94a606817ee20e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 23:47:27 +0300
+Subject: m68k: emu: Fix invalid free in nfeth_cleanup()
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ]
+
+In the for loop all nfeth_dev array members should be freed, not only
+the first one. Freeing only the first array member can cause
+double-free bugs and memory leaks.
+
+Fixes: 9cd7b148312f ("m68k/atari: ARAnyM - Add support for network access")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/20210705204727.10743-1-paskripkin@gmail.com
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/emu/nfeth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c
+index d2875e32abfc..79e55421cfb1 100644
+--- a/arch/m68k/emu/nfeth.c
++++ b/arch/m68k/emu/nfeth.c
+@@ -254,8 +254,8 @@ static void __exit nfeth_cleanup(void)
+
+ for (i = 0; i < MAX_UNIT; i++) {
+ if (nfeth_dev[i]) {
+- unregister_netdev(nfeth_dev[0]);
+- free_netdev(nfeth_dev[0]);
++ unregister_netdev(nfeth_dev[i]);
++ free_netdev(nfeth_dev[i]);
+ }
+ }
+ free_irq(nfEtherIRQ, nfeth_interrupt);
+--
+2.30.2
+
--- /dev/null
+From 5d0e545823309711087962be3c2b1b38eaeebaae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 12:44:13 +0200
+Subject: m68k: Fix invalid RMW_INSNS on CPUs that lack CAS
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 2189e928b62e91d8efbc9826ae7c0968f0d55790 ]
+
+When enabling CONFIG_RMW_INSNS in e.g. a Coldfire build:
+
+ {standard input}:3068: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `casl %d4,%d0,(%a6)' ignored
+
+Fix this by (a) adding a new config symbol to track if support for any
+CPU that lacks the CAS instruction is enabled, and (b) making
+CONFIG_RMW_INSNS depend on the new symbol not being set.
+
+Fixes: 0e152d80507b75c0 ("m68k: reorganize Kconfig options to improve mmu/non-mmu selections")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210725104413.318932-1-geert@linux-m68k.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/Kconfig.cpu | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
+index f4d23977d2a5..1127d64b6c1d 100644
+--- a/arch/m68k/Kconfig.cpu
++++ b/arch/m68k/Kconfig.cpu
+@@ -26,6 +26,7 @@ config COLDFIRE
+ bool "Coldfire CPU family support"
+ select ARCH_HAVE_CUSTOM_GPIO_H
+ select CPU_HAS_NO_BITFIELDS
++ select CPU_HAS_NO_CAS
+ select CPU_HAS_NO_MULDIV64
+ select GENERIC_CSUM
+ select GPIOLIB
+@@ -39,6 +40,7 @@ config M68000
+ bool
+ depends on !MMU
+ select CPU_HAS_NO_BITFIELDS
++ select CPU_HAS_NO_CAS
+ select CPU_HAS_NO_MULDIV64
+ select CPU_HAS_NO_UNALIGNED
+ select GENERIC_CSUM
+@@ -54,6 +56,7 @@ config M68000
+ config MCPU32
+ bool
+ select CPU_HAS_NO_BITFIELDS
++ select CPU_HAS_NO_CAS
+ select CPU_HAS_NO_UNALIGNED
+ select CPU_NO_EFFICIENT_FFS
+ help
+@@ -383,7 +386,7 @@ config ADVANCED
+
+ config RMW_INSNS
+ bool "Use read-modify-write instructions"
+- depends on ADVANCED
++ depends on ADVANCED && !CPU_HAS_NO_CAS
+ help
+ This allows to use certain instructions that work with indivisible
+ read-modify-write bus cycles. While this is faster than the
+@@ -459,6 +462,9 @@ config NODES_SHIFT
+ config CPU_HAS_NO_BITFIELDS
+ bool
+
++config CPU_HAS_NO_CAS
++ bool
++
+ config CPU_HAS_NO_MULDIV64
+ bool
+
+--
+2.30.2
+
--- /dev/null
+From 406fa30cd0dfe0c6b10ce4b5b40c56c464e7f179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 16:51:28 +0800
+Subject: mac80211: Fix insufficient headroom issue for AMSDU
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit f50d2ff8f016b79a2ff4acd5943a1eda40c545d4 ]
+
+ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom,
+the original reserved headroom might be eaten. Add the necessary
+extra_tx_headroom.
+
+Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://lore.kernel.org/r/20210816085128.10931-2-pkshih@realtek.com
+[fix indentation]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 2651498d05e8..e61c320974ba 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3210,7 +3210,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
+ if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
+ return true;
+
+- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
++ if (!ieee80211_amsdu_realloc_pad(local, skb,
++ sizeof(*amsdu_hdr) +
++ local->hw.extra_tx_headroom))
+ return false;
+
+ data = skb_push(skb, sizeof(*amsdu_hdr));
+--
+2.30.2
+
--- /dev/null
+From 530fa3fbe77b1e7cfbe5f14bd3b046683707c604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 07:38:56 +0200
+Subject: media: atomisp: fix the uninitialized use and rename "retvalue"
+
+From: Yizhuo <yzhai003@ucr.edu>
+
+[ Upstream commit c275e5d349b0d2b1143607d28b9c7c14a8a0a9b4 ]
+
+Inside function mt9m114_detect(), variable "retvalue" could
+be uninitialized if mt9m114_read_reg() returns error, however, it
+is used in the later if statement, which is potentially unsafe.
+
+The local variable "retvalue" is renamed to "model" to avoid
+confusion.
+
+Link: https://lore.kernel.org/linux-media/20210625053858.3862-1-yzhai003@ucr.edu
+Fixes: ad85094 (media / atomisp: fix the uninitialized use of model ID)
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
+index f5de81132177..77293579a134 100644
+--- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
++++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
+@@ -1533,16 +1533,19 @@ static struct v4l2_ctrl_config mt9m114_controls[] = {
+ static int mt9m114_detect(struct mt9m114_device *dev, struct i2c_client *client)
+ {
+ struct i2c_adapter *adapter = client->adapter;
+- u32 retvalue;
++ u32 model;
++ int ret;
+
+ if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
+ dev_err(&client->dev, "%s: i2c error", __func__);
+ return -ENODEV;
+ }
+- mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue);
+- dev->real_model_id = retvalue;
++ ret = mt9m114_read_reg(client, MISENSOR_16BIT, MT9M114_PID, &model);
++ if (ret)
++ return ret;
++ dev->real_model_id = model;
+
+- if (retvalue != MT9M114_MOD_ID) {
++ if (model != MT9M114_MOD_ID) {
+ dev_err(&client->dev, "%s: failed: client->addr = %x\n",
+ __func__, client->addr);
+ return -ENODEV;
+--
+2.30.2
+
--- /dev/null
+From 69601c883baf69843dd20d82927a9d1427e101bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Jul 2021 16:57:08 +0200
+Subject: media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 44693d74f5653f82cd7ca0fe730eed0f6b83306a ]
+
+The frame memory control register value is currently determined
+before userspace selects the final capture format and never corrected.
+Update ctx->frame_mem_ctrl in __coda_start_decoding() to fix decoding
+into YUV420 or YVU420 capture buffers.
+
+Reported-by: Andrej Picej <andrej.picej@norik.com>
+Fixes: 497e6b8559a6 ("media: coda: add sequence initialization work")
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-bit.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
+index 2f42808c43a4..c484c008ab02 100644
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -2053,17 +2053,25 @@ static int __coda_start_decoding(struct coda_ctx *ctx)
+ u32 src_fourcc, dst_fourcc;
+ int ret;
+
++ q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
++ q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
++ src_fourcc = q_data_src->fourcc;
++ dst_fourcc = q_data_dst->fourcc;
++
+ if (!ctx->initialized) {
+ ret = __coda_decoder_seq_init(ctx);
+ if (ret < 0)
+ return ret;
++ } else {
++ ctx->frame_mem_ctrl &= ~(CODA_FRAME_CHROMA_INTERLEAVE | (0x3 << 9) |
++ CODA9_FRAME_TILED2LINEAR);
++ if (dst_fourcc == V4L2_PIX_FMT_NV12 || dst_fourcc == V4L2_PIX_FMT_YUYV)
++ ctx->frame_mem_ctrl |= CODA_FRAME_CHROMA_INTERLEAVE;
++ if (ctx->tiled_map_type == GDI_TILED_FRAME_MB_RASTER_MAP)
++ ctx->frame_mem_ctrl |= (0x3 << 9) |
++ ((ctx->use_vdoa) ? 0 : CODA9_FRAME_TILED2LINEAR);
+ }
+
+- q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
+- q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
+- src_fourcc = q_data_src->fourcc;
+- dst_fourcc = q_data_dst->fourcc;
+-
+ coda_write(dev, ctx->parabuf.paddr, CODA_REG_BIT_PARA_BUF_ADDR);
+
+ ret = coda_alloc_framebuffers(ctx, q_data_dst, src_fourcc);
+--
+2.30.2
+
--- /dev/null
+From 292f1e55c050a84e1d597803580c11bd142e05f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jun 2021 21:54:31 +0200
+Subject: media: cxd2880-spi: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit dcb0145821017e929a733e2271c85c6f82b9c9f8 ]
+
+If an error occurs after a successful 'regulator_enable()' call,
+'regulator_disable()' must be called.
+
+Fix the error handling path of the probe accordingly.
+
+Fixes: cb496cd472af ("media: cxd2880-spi: Add optional vcc regulator")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/spi/cxd2880-spi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
+index 931ec0727cd3..a280e4bd80c2 100644
+--- a/drivers/media/spi/cxd2880-spi.c
++++ b/drivers/media/spi/cxd2880-spi.c
+@@ -524,13 +524,13 @@ cxd2880_spi_probe(struct spi_device *spi)
+ if (IS_ERR(dvb_spi->vcc_supply)) {
+ if (PTR_ERR(dvb_spi->vcc_supply) == -EPROBE_DEFER) {
+ ret = -EPROBE_DEFER;
+- goto fail_adapter;
++ goto fail_regulator;
+ }
+ dvb_spi->vcc_supply = NULL;
+ } else {
+ ret = regulator_enable(dvb_spi->vcc_supply);
+ if (ret)
+- goto fail_adapter;
++ goto fail_regulator;
+ }
+
+ dvb_spi->spi = spi;
+@@ -618,6 +618,9 @@ fail_frontend:
+ fail_attach:
+ dvb_unregister_adapter(&dvb_spi->adapter);
+ fail_adapter:
++ if (!dvb_spi->vcc_supply)
++ regulator_disable(dvb_spi->vcc_supply);
++fail_regulator:
+ kfree(dvb_spi);
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From bf971f810df94869a41fc662a7dc227c6796943f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jun 2021 07:07:28 +0200
+Subject: media: dvb-usb: Fix error handling in dvb_usb_i2c_init
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 131ae388b88e3daf4cb0721ed4b4cb8bfc201465 ]
+
+In dvb_usb_i2c_init, if i2c_add_adapter fails, it only prints an error
+message, and then continues to set DVB_USB_STATE_I2C. This affects the
+logic of dvb_usb_i2c_exit, which leads to that, the deletion of i2c_adap
+even if the i2c_add_adapter fails.
+
+Fix this by returning at the failure of i2c_add_adapter and then move
+dvb_usb_i2c_exit out of the error handling code of dvb_usb_i2c_init.
+
+Fixes: 13a79f14ab28 ("media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/dvb-usb-i2c.c | 9 +++++++--
+ drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +-
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
+index 2e07106f4680..bc4b2abdde1a 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
+@@ -17,7 +17,8 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)
+
+ if (d->props.i2c_algo == NULL) {
+ err("no i2c algorithm specified");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err;
+ }
+
+ strscpy(d->i2c_adap.name, d->desc->name, sizeof(d->i2c_adap.name));
+@@ -27,11 +28,15 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)
+
+ i2c_set_adapdata(&d->i2c_adap, d);
+
+- if ((ret = i2c_add_adapter(&d->i2c_adap)) < 0)
++ ret = i2c_add_adapter(&d->i2c_adap);
++ if (ret < 0) {
+ err("could not add i2c adapter");
++ goto err;
++ }
+
+ d->state |= DVB_USB_STATE_I2C;
+
++err:
+ return ret;
+ }
+
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+index 28e1fd64dd3c..61439c8f33ca 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
+@@ -194,8 +194,8 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums)
+
+ err_adapter_init:
+ dvb_usb_adapter_exit(d);
+-err_i2c_init:
+ dvb_usb_i2c_exit(d);
++err_i2c_init:
+ if (d->priv && d->props.priv_destroy)
+ d->props.priv_destroy(d);
+ err_priv_init:
+--
+2.30.2
+
--- /dev/null
+From 8dc511f77b0395421e23a6f0319dd079a42ff905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 07:33:27 +0200
+Subject: media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]
+
+If dibusb_read_eeprom_byte fails, the mac address is not initialized.
+And nova_t_read_mac_address does not handle this failure, which leads to
+the uninit-value in dvb_usb_adapter_dvb_init.
+
+Fix this by handling the failure of dibusb_read_eeprom_byte.
+
+Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
+Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
+index e7b290552b66..9c0eb0d40822 100644
+--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
++++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
+@@ -130,7 +130,7 @@ ret:
+
+ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
+ {
+- int i;
++ int i, ret;
+ u8 b;
+
+ mac[0] = 0x00;
+@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
+
+ /* this is a complete guess, but works for my box */
+ for (i = 136; i < 139; i++) {
+- dibusb_read_eeprom_byte(d,i, &b);
++ ret = dibusb_read_eeprom_byte(d, i, &b);
++ if (ret)
++ return ret;
+
+ mac[5 - (i - 136)] = b;
+ }
+--
+2.30.2
+
--- /dev/null
+From 8a5251af88ecf86d775c4c2f17ffe674ea6a97f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jun 2021 07:59:04 +0200
+Subject: media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ]
+
+If vp702x_usb_in_op fails, the mac address is not initialized.
+And vp702x_read_mac_addr does not handle this failure, which leads to
+the uninit-value in dvb_usb_adapter_dvb_init.
+
+Fix this by handling the failure of vp702x_usb_in_op.
+
+Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c
+index bf54747e2e01..a1d9e4801a2b 100644
+--- a/drivers/media/usb/dvb-usb/vp702x.c
++++ b/drivers/media/usb/dvb-usb/vp702x.c
+@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
+ static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6])
+ {
+ u8 i, *buf;
++ int ret;
+ struct vp702x_device_state *st = d->priv;
+
+ mutex_lock(&st->buf_mutex);
+ buf = st->buf;
+- for (i = 6; i < 12; i++)
+- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1);
++ for (i = 6; i < 12; i++) {
++ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1,
++ &buf[i - 6], 1);
++ if (ret < 0)
++ goto err;
++ }
+
+ memcpy(mac, buf, 6);
++err:
+ mutex_unlock(&st->buf_mutex);
+- return 0;
++ return ret;
+ }
+
+ static int vp702x_frontend_attach(struct dvb_usb_adapter *adap)
+--
+2.30.2
+
--- /dev/null
+From 75176390ed814ab522d28c14b5af9f90587564a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 11:34:09 +0200
+Subject: media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ]
+
+If em28xx_ir_init fails, it would decrease the refcount of dev. However,
+in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease
+the refcount of dev. This will lead to a refcount bug.
+
+Fix this bug by removing the kref_put in the error handling code
+of em28xx_ir_init.
+
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
+Modules linked in:
+CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3
+Workqueue: usb_hub_wq hub_event
+RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
+Call Trace:
+ kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69
+ em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150
+ usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
+ __device_release_driver drivers/base/dd.c:1201 [inline]
+ device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232
+ bus_remove_device+0x108/0x160 drivers/base/bus.c:529
+ device_del+0x1fe/0x510 drivers/base/core.c:3540
+ usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
+ usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221
+ hub_port_connect drivers/usb/core/hub.c:5151 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
+ port_event drivers/usb/core/hub.c:5586 [inline]
+ hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668
+ process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
+ process_scheduled_works kernel/workqueue.c:2338 [inline]
+ worker_thread+0x333/0x5b0 kernel/workqueue.c:2424
+ kthread+0x188/0x1d0 kernel/kthread.c:319
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
+
+Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct")
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-input.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
+index 59529cbf9cd0..0b6d77c3bec8 100644
+--- a/drivers/media/usb/em28xx/em28xx-input.c
++++ b/drivers/media/usb/em28xx/em28xx-input.c
+@@ -842,7 +842,6 @@ error:
+ kfree(ir);
+ ref_put:
+ em28xx_shutdown_buttons(dev);
+- kref_put(&dev->ref, em28xx_free_device);
+ return err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 492b846286f66831b0b83a34abe47aecd6878161 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Jun 2021 21:45:02 +0200
+Subject: media: go7007: fix memory leak in go7007_usb_probe
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 47d94dad8e64b2fc1d8f66ce7acf714f9462c60f ]
+
+In commit 137641287eb4 ("go7007: add sanity checking for endpoints")
+endpoint sanity check was introduced, but if check fails it simply
+returns with leaked pointers.
+
+Cutted log from my local syzbot instance:
+
+BUG: memory leak
+unreferenced object 0xffff8880209f0000 (size 8192):
+ comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
+ hex dump (first 32 bytes):
+ 30 b0 27 22 80 88 ff ff 75 73 62 2d 64 75 6d 6d 0.'"....usb-dumm
+ 79 5f 68 63 64 2e 33 2d 31 00 00 00 00 00 00 00 y_hcd.3-1.......
+ backtrace:
+ [<ffffffff860ca856>] kmalloc include/linux/slab.h:556 [inline]
+ [<ffffffff860ca856>] kzalloc include/linux/slab.h:686 [inline]
+ [<ffffffff860ca856>] go7007_alloc+0x46/0xb40 drivers/media/usb/go7007/go7007-driver.c:696
+ [<ffffffff860de74e>] go7007_usb_probe+0x13e/0x2200 drivers/media/usb/go7007/go7007-usb.c:1114
+ [<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
+ [<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576
+
+BUG: memory leak
+unreferenced object 0xffff88801e2f2800 (size 512):
+ comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
+ hex dump (first 32 bytes):
+ 00 87 40 8a ff ff ff ff 00 00 00 00 00 00 00 00 ..@.............
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<ffffffff860de794>] kmalloc include/linux/slab.h:556 [inline]
+ [<ffffffff860de794>] kzalloc include/linux/slab.h:686 [inline]
+ [<ffffffff860de794>] go7007_usb_probe+0x184/0x2200 drivers/media/usb/go7007/go7007-usb.c:1118
+ [<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
+ [<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576
+
+Fixes: 137641287eb4 ("go7007: add sanity checking for endpoints")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index dbf0455d5d50..eeb85981e02b 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1134,7 +1134,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
+
+ ep = usb->usbdev->ep_in[4];
+ if (!ep)
+- return -ENODEV;
++ goto allocfail;
+
+ /* Allocate the URB and buffer for receiving incoming interrupts */
+ usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
+--
+2.30.2
+
--- /dev/null
+From d9488bd5e40471aeb1cc2bc53c9fa95b253482af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Jun 2021 21:45:42 +0200
+Subject: media: go7007: remove redundant initialization
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ]
+
+In go7007_alloc() kzalloc() is used for struct go7007
+allocation. It means that there is no need in zeroing
+any members, because kzalloc will take care of it.
+
+Removing these reduntant initialization steps increases
+execution speed a lot:
+
+ Before:
+ + 86.802 us | go7007_alloc();
+ After:
+ + 29.595 us | go7007_alloc();
+
+Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver")
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------
+ 1 file changed, 26 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
+index f1767be9d868..6650eab913d8 100644
+--- a/drivers/media/usb/go7007/go7007-driver.c
++++ b/drivers/media/usb/go7007/go7007-driver.c
+@@ -691,49 +691,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board,
+ struct device *dev)
+ {
+ struct go7007 *go;
+- int i;
+
+ go = kzalloc(sizeof(struct go7007), GFP_KERNEL);
+ if (go == NULL)
+ return NULL;
+ go->dev = dev;
+ go->board_info = board;
+- go->board_id = 0;
+ go->tuner_type = -1;
+- go->channel_number = 0;
+- go->name[0] = 0;
+ mutex_init(&go->hw_lock);
+ init_waitqueue_head(&go->frame_waitq);
+ spin_lock_init(&go->spinlock);
+ go->status = STATUS_INIT;
+- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter));
+- go->i2c_adapter_online = 0;
+- go->interrupt_available = 0;
+ init_waitqueue_head(&go->interrupt_waitq);
+- go->input = 0;
+ go7007_update_board(go);
+- go->encoder_h_halve = 0;
+- go->encoder_v_halve = 0;
+- go->encoder_subsample = 0;
+ go->format = V4L2_PIX_FMT_MJPEG;
+ go->bitrate = 1500000;
+ go->fps_scale = 1;
+- go->pali = 0;
+ go->aspect_ratio = GO7007_RATIO_1_1;
+- go->gop_size = 0;
+- go->ipb = 0;
+- go->closed_gop = 0;
+- go->repeat_seqhead = 0;
+- go->seq_header_enable = 0;
+- go->gop_header_enable = 0;
+- go->dvd_mode = 0;
+- go->interlace_coding = 0;
+- for (i = 0; i < 4; ++i)
+- go->modet[i].enable = 0;
+- for (i = 0; i < 1624; ++i)
+- go->modet_map[i] = 0;
+- go->audio_deliver = NULL;
+- go->audio_enabled = 0;
+
+ return go;
+ }
+--
+2.30.2
+
--- /dev/null
+From 82fc541417cedfd0a02f645f104dff41a6eeb133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Apr 2021 16:37:33 +0200
+Subject: media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 0368e7d2cd84a90d0518753fac33795e13df553f ]
+
+Add the missing unlock before return from function
+isp_subdev_notifier_complete() in the init error
+handling case.
+
+Fixes: ba689d933361 ("media: omap3isp: Acquire graph mutex for graph traversal")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap3isp/isp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 53025c8c7531..20f59c59ff8a 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -2037,8 +2037,10 @@ static int isp_subdev_notifier_complete(struct v4l2_async_notifier *async)
+ mutex_lock(&isp->media_dev.graph_mutex);
+
+ ret = media_entity_enum_init(&isp->crashed, &isp->media_dev);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&isp->media_dev.graph_mutex);
+ return ret;
++ }
+
+ list_for_each_entry(sd, &v4l2_dev->subdevs, list) {
+ if (sd->notifier != &isp->notifier)
+--
+2.30.2
+
--- /dev/null
+From f7b470f11730886dffd9a3a3c42b59d3d032ea75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jul 2021 11:24:10 +0200
+Subject: media: rockchip/rga: fix error handling in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit e58430e1d4fd01b74475d2fbe2e25b5817b729a9 ]
+
+There are a few bugs in this code. 1) No checks for whether
+dma_alloc_attrs() or __get_free_pages() failed. 2) If
+video_register_device() fails it doesn't clean up the dma attrs or the
+free pages. 3) The video_device_release() function frees "vfd" which
+leads to a use after free on the next line. The call to
+video_unregister_device() is not required so I have just removed that.
+
+Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
+Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga.c | 27 ++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
+index bf3fd71ec3af..6759091b15e0 100644
+--- a/drivers/media/platform/rockchip/rga/rga.c
++++ b/drivers/media/platform/rockchip/rga/rga.c
+@@ -863,12 +863,12 @@ static int rga_probe(struct platform_device *pdev)
+ if (IS_ERR(rga->m2m_dev)) {
+ v4l2_err(&rga->v4l2_dev, "Failed to init mem2mem device\n");
+ ret = PTR_ERR(rga->m2m_dev);
+- goto unreg_video_dev;
++ goto rel_vdev;
+ }
+
+ ret = pm_runtime_resume_and_get(rga->dev);
+ if (ret < 0)
+- goto unreg_video_dev;
++ goto rel_vdev;
+
+ rga->version.major = (rga_read(rga, RGA_VERSION_INFO) >> 24) & 0xFF;
+ rga->version.minor = (rga_read(rga, RGA_VERSION_INFO) >> 20) & 0x0F;
+@@ -882,11 +882,23 @@ static int rga_probe(struct platform_device *pdev)
+ rga->cmdbuf_virt = dma_alloc_attrs(rga->dev, RGA_CMDBUF_SIZE,
+ &rga->cmdbuf_phy, GFP_KERNEL,
+ DMA_ATTR_WRITE_COMBINE);
++ if (!rga->cmdbuf_virt) {
++ ret = -ENOMEM;
++ goto rel_vdev;
++ }
+
+ rga->src_mmu_pages =
+ (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3);
++ if (!rga->src_mmu_pages) {
++ ret = -ENOMEM;
++ goto free_dma;
++ }
+ rga->dst_mmu_pages =
+ (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3);
++ if (rga->dst_mmu_pages) {
++ ret = -ENOMEM;
++ goto free_src_pages;
++ }
+
+ def_frame.stride = (def_frame.width * def_frame.fmt->depth) >> 3;
+ def_frame.size = def_frame.stride * def_frame.height;
+@@ -894,7 +906,7 @@ static int rga_probe(struct platform_device *pdev)
+ ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
+ if (ret) {
+ v4l2_err(&rga->v4l2_dev, "Failed to register video device\n");
+- goto rel_vdev;
++ goto free_dst_pages;
+ }
+
+ v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n",
+@@ -902,10 +914,15 @@ static int rga_probe(struct platform_device *pdev)
+
+ return 0;
+
++free_dst_pages:
++ free_pages((unsigned long)rga->dst_mmu_pages, 3);
++free_src_pages:
++ free_pages((unsigned long)rga->src_mmu_pages, 3);
++free_dma:
++ dma_free_attrs(rga->dev, RGA_CMDBUF_SIZE, rga->cmdbuf_virt,
++ rga->cmdbuf_phy, DMA_ATTR_WRITE_COMBINE);
+ rel_vdev:
+ video_device_release(vfd);
+-unreg_video_dev:
+- video_unregister_device(rga->vfd);
+ unreg_v4l2_dev:
+ v4l2_device_unregister(&rga->v4l2_dev);
+ err_put_clk:
+--
+2.30.2
+
--- /dev/null
+From 909eed59374ac306f65740f33cbd638db7677f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 17:19:20 +0200
+Subject: media: rockchip/rga: use pm_runtime_resume_and_get()
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 0314339a0a49f4a128b61e5e1a0af1df6e64a186 ]
+
+Commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+added pm_runtime_resume_and_get() in order to automatically handle
+dev->power.usage_count decrement on errors.
+
+Use the new API, in order to cleanup the error check logic.
+
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rga/rga-buf.c | 3 +--
+ drivers/media/platform/rockchip/rga/rga.c | 4 +++-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c
+index bf9a75b75083..81508ed5abf3 100644
+--- a/drivers/media/platform/rockchip/rga/rga-buf.c
++++ b/drivers/media/platform/rockchip/rga/rga-buf.c
+@@ -79,9 +79,8 @@ static int rga_buf_start_streaming(struct vb2_queue *q, unsigned int count)
+ struct rockchip_rga *rga = ctx->rga;
+ int ret;
+
+- ret = pm_runtime_get_sync(rga->dev);
++ ret = pm_runtime_resume_and_get(rga->dev);
+ if (ret < 0) {
+- pm_runtime_put_noidle(rga->dev);
+ rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED);
+ return ret;
+ }
+diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
+index 9d122429706e..bf3fd71ec3af 100644
+--- a/drivers/media/platform/rockchip/rga/rga.c
++++ b/drivers/media/platform/rockchip/rga/rga.c
+@@ -866,7 +866,9 @@ static int rga_probe(struct platform_device *pdev)
+ goto unreg_video_dev;
+ }
+
+- pm_runtime_get_sync(rga->dev);
++ ret = pm_runtime_resume_and_get(rga->dev);
++ if (ret < 0)
++ goto unreg_video_dev;
+
+ rga->version.major = (rga_read(rga, RGA_VERSION_INFO) >> 24) & 0xFF;
+ rga->version.minor = (rga_read(rga, RGA_VERSION_INFO) >> 20) & 0x0F;
+--
+2.30.2
+
--- /dev/null
+From a51ab959d0153695220feeb087965809b56b6c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jun 2021 07:13:55 +0200
+Subject: media: TDA1997x: enable EDID support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Hałasa <khalasa@piap.pl>
+
+[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ]
+
+Without this patch, the TDA19971 chip's EDID is inactive.
+EDID never worked with this driver, it was all tested with HDMI signal
+sources which don't need EDID support.
+
+Signed-off-by: Krzysztof Halasa <khalasa@piap.pl>
+Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tda1997x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
+index 89bb7e6dc7a4..9554c8348c02 100644
+--- a/drivers/media/i2c/tda1997x.c
++++ b/drivers/media/i2c/tda1997x.c
+@@ -2233,6 +2233,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)
+ /* get initial HDMI status */
+ state->hdmi_status = io_read(sd, REG_HDMI_FLAGS);
+
++ io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN);
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 443a1d16e914c1bc8e52425e834196932d13b042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jul 2021 18:21:22 +0200
+Subject: media: venus: helper: do not set constrained parameters for UBWC
+
+From: Mansur Alisha Shaik <mansur@codeaurora.org>
+
+[ Upstream commit 1ac61faf6ebbce59fccbb53d7faf25576e9897ab ]
+
+Plane constraints firmware interface is to override the default
+alignment for a given color format. By default venus hardware has
+alignments as 128x32, but NV12 was defined differently to meet
+various usecases. Compressed NV12 has always been aligned as 128x32,
+hence not needed to override the default alignment.
+
+Fixes: bc28936bbba9 ("media: venus: helpers, hfi, vdec: Set actual plane constraints to FW")
+Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/helpers.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
+index b813d6dba481..3a0871f0bea6 100644
+--- a/drivers/media/platform/qcom/venus/helpers.c
++++ b/drivers/media/platform/qcom/venus/helpers.c
+@@ -1138,6 +1138,9 @@ int venus_helper_set_format_constraints(struct venus_inst *inst)
+ if (!IS_V6(inst->core))
+ return 0;
+
++ if (inst->opb_fmt == HFI_COLOR_FORMAT_NV12_UBWC)
++ return 0;
++
+ pconstraint.buffer_type = HFI_BUFFER_OUTPUT2;
+ pconstraint.num_planes = 2;
+ pconstraint.plane_format[0].stride_multiples = 128;
+--
+2.30.2
+
--- /dev/null
+From dc521373202b3d71d769fa2aa3c382315d252c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 09:45:17 +0200
+Subject: media: venus: hfi: fix return value check in
+ sys_get_prop_image_version()
+
+From: Zhen Lei <thunder.leizhen@huawei.com>
+
+[ Upstream commit 331e06bbde5856059b7a6bb183f12878ed4decb1 ]
+
+In case of error, the function qcom_smem_get() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check
+should be replaced with IS_ERR().
+
+Fixes: d566e78dd6af ("media: venus : hfi: add venus image info into smem")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c
+index a2d436d407b2..e8776ac45b02 100644
+--- a/drivers/media/platform/qcom/venus/hfi_msgs.c
++++ b/drivers/media/platform/qcom/venus/hfi_msgs.c
+@@ -261,7 +261,7 @@ sys_get_prop_image_version(struct device *dev,
+
+ smem_tbl_ptr = qcom_smem_get(QCOM_SMEM_HOST_ANY,
+ SMEM_IMG_VER_TBL, &smem_blk_sz);
+- if (smem_tbl_ptr && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ)
++ if (!IS_ERR(smem_tbl_ptr) && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ)
+ memcpy(smem_tbl_ptr + SMEM_IMG_OFFSET_VENUS,
+ img_ver, VER_STR_SZ);
+ }
+--
+2.30.2
+
--- /dev/null
+From 7f43804d24e7567bd9a4c57889c58137a83c92a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 14:30:25 +0200
+Subject: media: venus: venc: Fix potential null pointer dereference on pointer
+ fmt
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 09ea9719a423fc675d40dd05407165e161ea0c48 ]
+
+Currently the call to find_format can potentially return a NULL to
+fmt and the nullpointer is later dereferenced on the assignment of
+pixmp->num_planes = fmt->num_planes. Fix this by adding a NULL pointer
+check and returning NULL for the failure case.
+
+Addresses-Coverity: ("Dereference null return")
+
+Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/venc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
+index 4a7291f934b6..2c443c1afd3a 100644
+--- a/drivers/media/platform/qcom/venus/venc.c
++++ b/drivers/media/platform/qcom/venus/venc.c
+@@ -183,6 +183,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)
+ else
+ return NULL;
+ fmt = find_format(inst, pixmp->pixelformat, f->type);
++ if (!fmt)
++ return NULL;
+ }
+
+ pixmp->width = clamp(pixmp->width, frame_width_min(inst),
+--
+2.30.2
+
--- /dev/null
+From 25966bbbcd4597188583263969ad236d60f3bdc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 12:47:52 -0700
+Subject: mm/swap: consider max pages in iomap_swapfile_add_extent
+
+From: Xu Yu <xuyu@linux.alibaba.com>
+
+[ Upstream commit 36ca7943ac18aebf8aad4c50829eb2ea5ec847df ]
+
+When the max pages (last_page in the swap header + 1) is smaller than
+the total pages (inode size) of the swapfile, iomap_swapfile_activate
+overwrites sis->max with total pages.
+
+However, frontswap_map is a swap page state bitmap allocated using the
+initial sis->max page count read from the swap header. If swapfile
+activation increases sis->max, it's possible for the frontswap code to
+walk off the end of the bitmap, thereby corrupting kernel memory.
+
+[djwong: modify the description a bit; the original paragraph reads:
+
+"However, frontswap_map is allocated using max pages. When test and clear
+the sis offset, which is larger than max pages, of frontswap_map in
+__frontswap_invalidate_page(), neighbors of frontswap_map may be
+overwritten, i.e., slab is polluted."
+
+Note also that this bug resulted in a behavioral change: activating a
+swap file that was formatted and later extended results in all pages
+being activated, not the number of pages recorded in the swap header.]
+
+This fixes the issue by considering the limitation of max pages of swap
+info in iomap_swapfile_add_extent().
+
+To reproduce the case, compile kernel with slub RED ZONE, then run test:
+$ sudo stress-ng -a 1 -x softlockup,resources -t 72h --metrics --times \
+ --verify -v -Y /root/tmpdir/stress-ng/stress-statistic-12.yaml \
+ --log-file /root/tmpdir/stress-ng/stress-logfile-12.txt \
+ --temp-path /root/tmpdir/stress-ng/
+
+We'll get the error log as below:
+
+[ 1151.015141] =============================================================================
+[ 1151.016489] BUG kmalloc-16 (Not tainted): Right Redzone overwritten
+[ 1151.017486] -----------------------------------------------------------------------------
+[ 1151.017486]
+[ 1151.018997] Disabling lock debugging due to kernel taint
+[ 1151.019873] INFO: 0x0000000084e43932-0x0000000098d17cae @offset=7392. First byte 0x0 instead of 0xcc
+[ 1151.021303] INFO: Allocated in __do_sys_swapon+0xcf6/0x1170 age=43417 cpu=9 pid=3816
+[ 1151.022538] __slab_alloc+0xe/0x20
+[ 1151.023069] __kmalloc_node+0xfd/0x4b0
+[ 1151.023704] __do_sys_swapon+0xcf6/0x1170
+[ 1151.024346] do_syscall_64+0x33/0x40
+[ 1151.024925] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1151.025749] INFO: Freed in put_cred_rcu+0xa1/0xc0 age=43424 cpu=3 pid=2041
+[ 1151.026889] kfree+0x276/0x2b0
+[ 1151.027405] put_cred_rcu+0xa1/0xc0
+[ 1151.027949] rcu_do_batch+0x17d/0x410
+[ 1151.028566] rcu_core+0x14e/0x2b0
+[ 1151.029084] __do_softirq+0x101/0x29e
+[ 1151.029645] asm_call_irq_on_stack+0x12/0x20
+[ 1151.030381] do_softirq_own_stack+0x37/0x40
+[ 1151.031037] do_softirq.part.15+0x2b/0x30
+[ 1151.031710] __local_bh_enable_ip+0x4b/0x50
+[ 1151.032412] copy_fpstate_to_sigframe+0x111/0x360
+[ 1151.033197] __setup_rt_frame+0xce/0x480
+[ 1151.033809] arch_do_signal+0x1a3/0x250
+[ 1151.034463] exit_to_user_mode_prepare+0xcf/0x110
+[ 1151.035242] syscall_exit_to_user_mode+0x27/0x190
+[ 1151.035970] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1151.036795] INFO: Slab 0x000000003b9de4dc objects=44 used=9 fp=0x00000000539e349e flags=0xfffffc0010201
+[ 1151.038323] INFO: Object 0x000000004855ba01 @offset=7376 fp=0x0000000000000000
+[ 1151.038323]
+[ 1151.039683] Redzone 000000008d0afd3d: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
+[ 1151.041180] Object 000000004855ba01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+[ 1151.042714] Redzone 0000000084e43932: 00 00 00 c0 cc cc cc cc ........
+[ 1151.044120] Padding 000000000864c042: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
+[ 1151.045615] CPU: 5 PID: 3816 Comm: stress-ng Tainted: G B 5.10.50+ #7
+[ 1151.046846] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 1151.048633] Call Trace:
+[ 1151.049072] dump_stack+0x57/0x6a
+[ 1151.049585] check_bytes_and_report+0xed/0x110
+[ 1151.050320] check_object+0x1eb/0x290
+[ 1151.050924] ? __x64_sys_swapoff+0x39a/0x540
+[ 1151.051646] free_debug_processing+0x151/0x350
+[ 1151.052333] __slab_free+0x21a/0x3a0
+[ 1151.052938] ? _cond_resched+0x2d/0x40
+[ 1151.053529] ? __vunmap+0x1de/0x220
+[ 1151.054139] ? __x64_sys_swapoff+0x39a/0x540
+[ 1151.054796] ? kfree+0x276/0x2b0
+[ 1151.055307] kfree+0x276/0x2b0
+[ 1151.055832] __x64_sys_swapoff+0x39a/0x540
+[ 1151.056466] do_syscall_64+0x33/0x40
+[ 1151.057084] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1151.057866] RIP: 0033:0x150340b0ffb7
+[ 1151.058481] Code: Unable to access opcode bytes at RIP 0x150340b0ff8d.
+[ 1151.059537] RSP: 002b:00007fff7f4ee238 EFLAGS: 00000246 ORIG_RAX: 00000000000000a8
+[ 1151.060768] RAX: ffffffffffffffda RBX: 00007fff7f4ee66c RCX: 0000150340b0ffb7
+[ 1151.061904] RDX: 000000000000000a RSI: 0000000000018094 RDI: 00007fff7f4ee860
+[ 1151.063033] RBP: 00007fff7f4ef980 R08: 0000000000000000 R09: 0000150340a672bd
+[ 1151.064135] R10: 00007fff7f4edca0 R11: 0000000000000246 R12: 0000000000018094
+[ 1151.065253] R13: 0000000000000005 R14: 000000000160d930 R15: 00007fff7f4ee66c
+[ 1151.066413] FIX kmalloc-16: Restoring 0x0000000084e43932-0x0000000098d17cae=0xcc
+[ 1151.066413]
+[ 1151.067890] FIX kmalloc-16: Object at 0x000000004855ba01 not freed
+
+Fixes: 67482129cdab ("iomap: add a swapfile activation function")
+Fixes: a45c0eccc564 ("iomap: move the swapfile code into a separate file")
+Signed-off-by: Gang Deng <gavin.dg@linux.alibaba.com>
+Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap/swapfile.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/iomap/swapfile.c b/fs/iomap/swapfile.c
+index 6250ca6a1f85..4ecf4e1f68ef 100644
+--- a/fs/iomap/swapfile.c
++++ b/fs/iomap/swapfile.c
+@@ -31,11 +31,16 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi)
+ {
+ struct iomap *iomap = &isi->iomap;
+ unsigned long nr_pages;
++ unsigned long max_pages;
+ uint64_t first_ppage;
+ uint64_t first_ppage_reported;
+ uint64_t next_ppage;
+ int error;
+
++ if (unlikely(isi->nr_pages >= isi->sis->max))
++ return 0;
++ max_pages = isi->sis->max - isi->nr_pages;
++
+ /*
+ * Round the start up and the end down so that the physical
+ * extent aligns to a page boundary.
+@@ -48,6 +53,7 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi)
+ if (first_ppage >= next_ppage)
+ return 0;
+ nr_pages = next_ppage - first_ppage;
++ nr_pages = min(nr_pages, max_pages);
+
+ /*
+ * Calculate how much swap space we're adding; the first page contains
+--
+2.30.2
+
--- /dev/null
+From c0716ec5aee2b083096fa220ba22fc386c227782 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:16:43 +0300
+Subject: mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit c3ff0189d3bc9c03845fe37472c140f0fefd0c79 ]
+
+Depending on the DMA driver being used, the struct dma_slave_config may
+need to be initialized to zero for the unused data.
+
+For example, we have three DMA drivers using src_port_window_size and
+dst_port_window_size. If these are left uninitialized, it can cause DMA
+failures.
+
+For dw_mmc, this is probably not currently an issue but is still good to
+fix though.
+
+Fixes: 3fc7eaef44db ("mmc: dw_mmc: Add external dma interface support")
+Cc: Shawn Lin <shawn.lin@rock-chips.com>
+Cc: Jaehoon Chung <jh80.chung@samsung.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210810081644.19353-2-tony@atomide.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/dw_mmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index c3229d8c7041..33cb70aa02aa 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -782,6 +782,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,
+ int ret = 0;
+
+ /* Set external dma config: burst size, burst width */
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.dst_addr = host->phy_regs + fifo_offset;
+ cfg.src_addr = cfg.dst_addr;
+ cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+--
+2.30.2
+
--- /dev/null
+From 16e18c1521e3f89276b3afbaf223a582db36c15e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:16:44 +0300
+Subject: mmc: moxart: Fix issue with uninitialized dma_slave_config
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit ee5165354d498e5bceb0b386e480ac84c5f8c28c ]
+
+Depending on the DMA driver being used, the struct dma_slave_config may
+need to be initialized to zero for the unused data.
+
+For example, we have three DMA drivers using src_port_window_size and
+dst_port_window_size. If these are left uninitialized, it can cause DMA
+failures.
+
+For moxart, this is probably not currently an issue but is still good to
+fix though.
+
+Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver")
+Cc: Jonas Jensen <jonas.jensen@gmail.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210810081644.19353-3-tony@atomide.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/moxart-mmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
+index bde298887579..6c9d38132f74 100644
+--- a/drivers/mmc/host/moxart-mmc.c
++++ b/drivers/mmc/host/moxart-mmc.c
+@@ -628,6 +628,7 @@ static int moxart_probe(struct platform_device *pdev)
+ host->dma_chan_tx, host->dma_chan_rx);
+ host->have_dma = true;
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+
+--
+2.30.2
+
--- /dev/null
+From e9fc011724ef9da90c94d87334312aa6dca58f90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:16:42 +0300
+Subject: mmc: sdhci: Fix issue with uninitialized dma_slave_config
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 522654d534d315d540710124c57b49ca22ac5f72 ]
+
+Depending on the DMA driver being used, the struct dma_slave_config may
+need to be initialized to zero for the unused data.
+
+For example, we have three DMA drivers using src_port_window_size and
+dst_port_window_size. If these are left uninitialized, it can cause DMA
+failures at least if external TI SDMA is ever configured for sdhci.
+
+For other external DMA cases, this is probably not currently an issue but
+is still good to fix though.
+
+Fixes: 18e762e3b7a7 ("mmc: sdhci: add support for using external DMA devices")
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Chunyan Zhang <zhang.chunyan@linaro.org>
+Cc: Faiz Abbas <faiz_abbas@ti.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Link: https://lore.kernel.org/r/20210810081644.19353-1-tony@atomide.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 6b39126fbf06..a1df6d4e9e86 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1222,6 +1222,7 @@ static int sdhci_external_dma_setup(struct sdhci_host *host,
+ if (!host->mapbase)
+ return -EINVAL;
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr = host->mapbase + SDHCI_BUFFER;
+ cfg.dst_addr = host->mapbase + SDHCI_BUFFER;
+ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+--
+2.30.2
+
--- /dev/null
+From 405ab1300a2678c3ec226efdd498a059f607487f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 10:12:12 +0800
+Subject: nbd: add the check to prevent overflow in __nbd_ioctl()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ]
+
+If user specify a large enough value of NBD blocks option, it may trigger
+signed integer overflow which may lead to nbd->config->bytesize becomes a
+large or small value, zero in particular.
+
+UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31
+signed integer overflow:
+1024 * 4611686155866341414 cannot be represented in type 'long long int'
+[...]
+Call trace:
+[...]
+ handle_overflow+0x188/0x1dc lib/ubsan.c:192
+ __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213
+ nbd_size_set drivers/block/nbd.c:325 [inline]
+ __nbd_ioctl drivers/block/nbd.c:1342 [inline]
+ nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395
+ __blkdev_driver_ioctl block/ioctl.c:311 [inline]
+[...]
+
+Although it is not a big deal, still silence the UBSAN by limit
+the input value.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Link: https://lore.kernel.org/r/20210804021212.990223-1-libaokun1@huawei.com
+[axboe: dropped unlikely()]
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 1061894a55df..7384058c24d0 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1369,6 +1369,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ unsigned int cmd, unsigned long arg)
+ {
+ struct nbd_config *config = nbd->config;
++ loff_t bytesize;
+
+ switch (cmd) {
+ case NBD_DISCONNECT:
+@@ -1383,8 +1384,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ case NBD_SET_SIZE:
+ return nbd_set_size(nbd, arg, config->blksize);
+ case NBD_SET_SIZE_BLOCKS:
+- return nbd_set_size(nbd, arg * config->blksize,
+- config->blksize);
++ if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
++ return -EINVAL;
++ return nbd_set_size(nbd, bytesize, config->blksize);
+ case NBD_SET_TIMEOUT:
+ nbd_set_cmd_timeout(nbd, arg);
+ return 0;
+--
+2.30.2
+
--- /dev/null
+From 726e7a5f6eba6d0bb86934d07405d08aa0bc54e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 19:35:30 +0300
+Subject: net: cipso: fix warnings in netlbl_cipsov4_add_std
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 ]
+
+Syzbot reported warning in netlbl_cipsov4_add(). The
+problem was in too big doi_def->map.std->lvl.local_size
+passed to kcalloc(). Since this value comes from userpace there is
+no need to warn if value is not correct.
+
+The same problem may occur with other kcalloc() calls in
+this function, so, I've added __GFP_NOWARN flag to all
+kcalloc() calls there.
+
+Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
+Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlabel/netlabel_cipso_v4.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
+index 4f50a64315cf..50f40943c815 100644
+--- a/net/netlabel/netlabel_cipso_v4.c
++++ b/net/netlabel/netlabel_cipso_v4.c
+@@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ }
+ doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->lvl.local == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+ }
+ doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->lvl.cipso == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+@@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ doi_def->map.std->cat.local = kcalloc(
+ doi_def->map.std->cat.local_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->cat.local == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+@@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
+ doi_def->map.std->cat.cipso = kcalloc(
+ doi_def->map.std->cat.cipso_size,
+ sizeof(u32),
+- GFP_KERNEL);
++ GFP_KERNEL | __GFP_NOWARN);
+ if (doi_def->map.std->cat.cipso == NULL) {
+ ret_val = -ENOMEM;
+ goto add_std_failure;
+--
+2.30.2
+
--- /dev/null
+From cf04e71cf76384c75919b679091bbc89bdb1c01b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 03:20:08 +0300
+Subject: net: dsa: don't disable multicast flooding to the CPU even without an
+ IGMP querier
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit c73c57081b3d59aa99093fbedced32ea02620cd3 ]
+
+Commit 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER
+attribute") added an option for users to turn off multicast flooding
+towards the CPU if they turn off the IGMP querier on a bridge which
+already has enslaved ports (echo 0 > /sys/class/net/br0/bridge/multicast_router).
+
+And commit a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags")
+simply papered over that issue, because it moved the decision to flood
+the CPU with multicast (or not) from the DSA core down to individual drivers,
+instead of taking a more radical position then.
+
+The truth is that disabling multicast flooding to the CPU is simply
+something we are not prepared to do now, if at all. Some reasons:
+
+- ICMP6 neighbor solicitation messages are unregistered multicast
+ packets as far as the bridge is concerned. So if we stop flooding
+ multicast, the outside world cannot ping the bridge device's IPv6
+ link-local address.
+
+- There might be foreign interfaces bridged with our DSA switch ports
+ (sending a packet towards the host does not necessarily equal
+ termination, but maybe software forwarding). So if there is no one
+ interested in that multicast traffic in the local network stack, that
+ doesn't mean nobody is.
+
+- PTP over L4 (IPv4, IPv6) is multicast, but is unregistered as far as
+ the bridge is concerned. This should reach the CPU port.
+
+- The switch driver might not do FDB partitioning. And since we don't
+ even bother to do more fine-grained flood disabling (such as "disable
+ flooding _from_port_N_ towards the CPU port" as opposed to "disable
+ flooding _from_any_port_ towards the CPU port"), this breaks standalone
+ ports, or even multiple bridges where one has an IGMP querier and one
+ doesn't.
+
+Reverting the logic makes all of the above work.
+
+Fixes: a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags")
+Fixes: 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER attribute")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 10 ----------
+ drivers/net/dsa/b53/b53_priv.h | 2 --
+ drivers/net/dsa/bcm_sf2.c | 1 -
+ drivers/net/dsa/mv88e6xxx/chip.c | 18 ------------------
+ include/net/dsa.h | 2 --
+ net/dsa/dsa_priv.h | 2 --
+ net/dsa/port.c | 11 -----------
+ net/dsa/slave.c | 6 ------
+ 8 files changed, 52 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 3ca6b394dd5f..54b273d85861 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1993,15 +1993,6 @@ int b53_br_flags(struct dsa_switch *ds, int port,
+ }
+ EXPORT_SYMBOL(b53_br_flags);
+
+-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
+- struct netlink_ext_ack *extack)
+-{
+- b53_port_set_mcast_flood(ds->priv, port, mrouter);
+-
+- return 0;
+-}
+-EXPORT_SYMBOL(b53_set_mrouter);
+-
+ static bool b53_possible_cpu_port(struct dsa_switch *ds, int port)
+ {
+ /* Broadcom switches will accept enabling Broadcom tags on the
+@@ -2245,7 +2236,6 @@ static const struct dsa_switch_ops b53_switch_ops = {
+ .port_bridge_leave = b53_br_leave,
+ .port_pre_bridge_flags = b53_br_flags_pre,
+ .port_bridge_flags = b53_br_flags,
+- .port_set_mrouter = b53_set_mrouter,
+ .port_stp_state_set = b53_br_set_stp_state,
+ .port_fast_age = b53_br_fast_age,
+ .port_vlan_filtering = b53_vlan_filtering,
+diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
+index 82700a5714c1..9bf8319342b0 100644
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -328,8 +328,6 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port,
+ int b53_br_flags(struct dsa_switch *ds, int port,
+ struct switchdev_brport_flags flags,
+ struct netlink_ext_ack *extack);
+-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
+- struct netlink_ext_ack *extack);
+ int b53_setup_devlink_resources(struct dsa_switch *ds);
+ void b53_port_event(struct dsa_switch *ds, int port);
+ void b53_phylink_validate(struct dsa_switch *ds, int port,
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 3b018fcf4412..6ce9ec1283e0 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -1199,7 +1199,6 @@ static const struct dsa_switch_ops bcm_sf2_ops = {
+ .port_pre_bridge_flags = b53_br_flags_pre,
+ .port_bridge_flags = b53_br_flags,
+ .port_stp_state_set = b53_br_set_stp_state,
+- .port_set_mrouter = b53_set_mrouter,
+ .port_fast_age = b53_br_fast_age,
+ .port_vlan_filtering = b53_vlan_filtering,
+ .port_vlan_add = b53_vlan_add,
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 272b0535d946..111a6d5985da 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -5781,23 +5781,6 @@ out:
+ return err;
+ }
+
+-static int mv88e6xxx_port_set_mrouter(struct dsa_switch *ds, int port,
+- bool mrouter,
+- struct netlink_ext_ack *extack)
+-{
+- struct mv88e6xxx_chip *chip = ds->priv;
+- int err;
+-
+- if (!chip->info->ops->port_set_mcast_flood)
+- return -EOPNOTSUPP;
+-
+- mv88e6xxx_reg_lock(chip);
+- err = chip->info->ops->port_set_mcast_flood(chip, port, mrouter);
+- mv88e6xxx_reg_unlock(chip);
+-
+- return err;
+-}
+-
+ static bool mv88e6xxx_lag_can_offload(struct dsa_switch *ds,
+ struct net_device *lag,
+ struct netdev_lag_upper_info *info)
+@@ -6099,7 +6082,6 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
+ .port_bridge_leave = mv88e6xxx_port_bridge_leave,
+ .port_pre_bridge_flags = mv88e6xxx_port_pre_bridge_flags,
+ .port_bridge_flags = mv88e6xxx_port_bridge_flags,
+- .port_set_mrouter = mv88e6xxx_port_set_mrouter,
+ .port_stp_state_set = mv88e6xxx_port_stp_state_set,
+ .port_fast_age = mv88e6xxx_port_fast_age,
+ .port_vlan_filtering = mv88e6xxx_port_vlan_filtering,
+diff --git a/include/net/dsa.h b/include/net/dsa.h
+index e1a2610a0e06..f91317d2df9d 100644
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -643,8 +643,6 @@ struct dsa_switch_ops {
+ int (*port_bridge_flags)(struct dsa_switch *ds, int port,
+ struct switchdev_brport_flags flags,
+ struct netlink_ext_ack *extack);
+- int (*port_set_mrouter)(struct dsa_switch *ds, int port, bool mrouter,
+- struct netlink_ext_ack *extack);
+
+ /*
+ * VLAN support
+diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
+index 92282de54230..1bf602f30ce4 100644
+--- a/net/dsa/dsa_priv.h
++++ b/net/dsa/dsa_priv.h
+@@ -211,8 +211,6 @@ int dsa_port_pre_bridge_flags(const struct dsa_port *dp,
+ int dsa_port_bridge_flags(const struct dsa_port *dp,
+ struct switchdev_brport_flags flags,
+ struct netlink_ext_ack *extack);
+-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter,
+- struct netlink_ext_ack *extack);
+ int dsa_port_vlan_add(struct dsa_port *dp,
+ const struct switchdev_obj_port_vlan *vlan,
+ struct netlink_ext_ack *extack);
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index fad55372e461..c3ffbd41331a 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -545,17 +545,6 @@ int dsa_port_bridge_flags(const struct dsa_port *dp,
+ return ds->ops->port_bridge_flags(ds, dp->index, flags, extack);
+ }
+
+-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter,
+- struct netlink_ext_ack *extack)
+-{
+- struct dsa_switch *ds = dp->ds;
+-
+- if (!ds->ops->port_set_mrouter)
+- return -EOPNOTSUPP;
+-
+- return ds->ops->port_set_mrouter(ds, dp->index, mrouter, extack);
+-}
+-
+ int dsa_port_mtu_change(struct dsa_port *dp, int new_mtu,
+ bool propagate_upstream)
+ {
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index d4756b920108..5882159137ea 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -311,12 +311,6 @@ static int dsa_slave_port_attr_set(struct net_device *dev,
+
+ ret = dsa_port_bridge_flags(dp, attr->u.brport_flags, extack);
+ break;
+- case SWITCHDEV_ATTR_ID_BRIDGE_MROUTER:
+- if (!dsa_port_offloads_bridge(dp, attr->orig_dev))
+- return -EOPNOTSUPP;
+-
+- ret = dsa_port_mrouter(dp->cpu_dp, attr->u.mrouter, extack);
+- break;
+ default:
+ ret = -EOPNOTSUPP;
+ break;
+--
+2.30.2
+
--- /dev/null
+From faf9e75a6047d3a33dd143060ce53271c748c427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 03:20:07 +0300
+Subject: net: dsa: mt7530: remove the .port_set_mrouter implementation
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit cbbf09b5771e6e9da268bc0d2fb6e428afa787bc ]
+
+DSA's idea of optimizing out multicast flooding to the CPU port leaves
+quite a few holes open, so it should be reverted.
+
+The mt7530 driver is the only new driver which added a .port_set_mrouter
+implementation after the reorg from commit a8b659e7ff75 ("net: dsa: act
+as passthrough for bridge port flags"), so it needs to be reverted
+separately so that the other revert commit can go a bit further down the
+git history.
+
+Fixes: 5a30833b9a16 ("net: dsa: mt7530: support MDB and bridge flag operations")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mt7530.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
+index 2b01efad1a51..647f8e5c16da 100644
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -1172,18 +1172,6 @@ mt7530_port_bridge_flags(struct dsa_switch *ds, int port,
+ return 0;
+ }
+
+-static int
+-mt7530_port_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
+- struct netlink_ext_ack *extack)
+-{
+- struct mt7530_priv *priv = ds->priv;
+-
+- mt7530_rmw(priv, MT7530_MFC, UNM_FFP(BIT(port)),
+- mrouter ? UNM_FFP(BIT(port)) : 0);
+-
+- return 0;
+-}
+-
+ static int
+ mt7530_port_bridge_join(struct dsa_switch *ds, int port,
+ struct net_device *bridge)
+@@ -2847,7 +2835,6 @@ static const struct dsa_switch_ops mt7530_switch_ops = {
+ .port_stp_state_set = mt7530_stp_state_set,
+ .port_pre_bridge_flags = mt7530_port_pre_bridge_flags,
+ .port_bridge_flags = mt7530_port_bridge_flags,
+- .port_set_mrouter = mt7530_port_set_mrouter,
+ .port_bridge_join = mt7530_port_bridge_join,
+ .port_bridge_leave = mt7530_port_bridge_leave,
+ .port_fdb_add = mt7530_port_fdb_add,
+--
+2.30.2
+
--- /dev/null
+From 46ccaee58031fe6d51aa56e25a56a6a38e6c8ed5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 03:20:06 +0300
+Subject: net: dsa: stop syncing the bridge mcast_router attribute at join time
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 7df4e7449489d82cee6813dccbb4ae4f3f26ef7b ]
+
+Qingfang points out that when a bridge with the default settings is
+created and a port joins it:
+
+ip link add br0 type bridge
+ip link set swp0 master br0
+
+DSA calls br_multicast_router() on the bridge to see if the br0 device
+is a multicast router port, and if it is, it enables multicast flooding
+to the CPU port, otherwise it disables it.
+
+If we look through the multicast_router_show() sysfs or at the
+IFLA_BR_MCAST_ROUTER netlink attribute, we see that the default mrouter
+attribute for the bridge device is "1" (MDB_RTR_TYPE_TEMP_QUERY).
+
+However, br_multicast_router() will return "0" (MDB_RTR_TYPE_DISABLED),
+because an mrouter port in the MDB_RTR_TYPE_TEMP_QUERY state may not be
+actually _active_ until it receives an actual IGMP query. So, the
+br_multicast_router() function should really have been called
+br_multicast_router_active() perhaps.
+
+When/if an IGMP query is received, the bridge device will transition via
+br_multicast_mark_router() into the active state until the
+ip4_mc_router_timer expires after an multicast_querier_interval.
+
+Of course, this does not happen if the bridge is created with an
+mcast_router attribute of "2" (MDB_RTR_TYPE_PERM).
+
+The point is that in lack of any IGMP query messages, and in the default
+bridge configuration, unregistered multicast packets will not be able to
+reach the CPU port through flooding, and this breaks many use cases
+(most obviously, IPv6 ND, with its ICMP6 neighbor solicitation multicast
+messages).
+
+Leave the multicast flooding setting towards the CPU port down to a driver
+level decision.
+
+Fixes: 010e269f91be ("net: dsa: sync up switchdev objects and port attributes when joining the bridge")
+Reported-by: DENG Qingfang <dqfext@gmail.com>
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/port.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/net/dsa/port.c b/net/dsa/port.c
+index 6379d66a6bb3..fad55372e461 100644
+--- a/net/dsa/port.c
++++ b/net/dsa/port.c
+@@ -186,10 +186,6 @@ static int dsa_port_switchdev_sync(struct dsa_port *dp,
+ if (err && err != -EOPNOTSUPP)
+ return err;
+
+- err = dsa_port_mrouter(dp->cpu_dp, br_multicast_router(br), extack);
+- if (err && err != -EOPNOTSUPP)
+- return err;
+-
+ err = dsa_port_ageing_time(dp, br_get_ageing_time(br));
+ if (err && err != -EOPNOTSUPP)
+ return err;
+@@ -235,12 +231,6 @@ static void dsa_port_switchdev_unsync(struct dsa_port *dp)
+
+ /* VLAN filtering is handled by dsa_switch_bridge_leave */
+
+- /* Some drivers treat the notification for having a local multicast
+- * router by allowing multicast to be flooded to the CPU, so we should
+- * allow this in standalone mode too.
+- */
+- dsa_port_mrouter(dp->cpu_dp, true, NULL);
+-
+ /* Ageing time may be global to the switch chip, so don't change it
+ * here because we have no good reason (or value) to change it to.
+ */
+--
+2.30.2
+
--- /dev/null
+From 5061752ed2447c75d18b249531f34b1e1e8e4bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 14:30:39 +0300
+Subject: net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd
+ group
+
+From: Maor Dickman <maord@nvidia.com>
+
+[ Upstream commit ca6891f9b27db7764bba0798202b0a21d0dc909c ]
+
+When indirect forward group is created, flow is added with vhca id but
+without setting vhca id valid flag which violates the PRM.
+
+Fix by setting the missing flag, vhca id valid.
+
+Fixes: 34ca65352ddf ("net/mlx5: E-Switch, Indirect table infrastructure")
+Signed-off-by: Maor Dickman <maord@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
+index 3da7becc1069..425c91814b34 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
+@@ -364,6 +364,7 @@ static int mlx5_create_indir_fwd_group(struct mlx5_eswitch *esw,
+ dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
+ dest.vport.num = e->vport;
+ dest.vport.vhca_id = MLX5_CAP_GEN(esw->dev, vhca_id);
++ dest.vport.flags = MLX5_FLOW_DEST_VPORT_VHCA_ID;
+ e->fwd_rule = mlx5_add_flow_rules(e->ft, spec, &flow_act, &dest, 1);
+ if (IS_ERR(e->fwd_rule)) {
+ mlx5_destroy_flow_group(e->fwd_grp);
+--
+2.30.2
+
--- /dev/null
+From ab3a7f24144fec05a00e4b1db341bf28af82e086 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 17:58:16 +0800
+Subject: net/mlx5: Fix missing return value in
+ mlx5_devlink_eswitch_inline_mode_set()
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit bcd68c04c7692416206414dc8971730aa140eba7 ]
+
+The return value is missing in this code scenario, add the return value
+'0' to the return value 'err'.
+
+Eliminate the follow smatch warning:
+
+drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c:3083
+mlx5_devlink_eswitch_inline_mode_set() warn: missing error code 'err'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Fixes: 8e0aa4bc959c ("net/mlx5: E-switch, Protect eswitch mode changes")
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index d0e4daa55a4a..c6d3348d759e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -3074,8 +3074,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode,
+
+ switch (MLX5_CAP_ETH(dev, wqe_inline_mode)) {
+ case MLX5_CAP_INLINE_MODE_NOT_REQUIRED:
+- if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE)
++ if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE) {
++ err = 0;
+ goto out;
++ }
++
+ fallthrough;
+ case MLX5_CAP_INLINE_MODE_L2:
+ NL_SET_ERR_MSG_MOD(extack, "Inline mode can't be set");
+--
+2.30.2
+
--- /dev/null
+From 76ba2cba3814b9ad026c717b59b9c06bfd9b5cf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 16:24:21 +0300
+Subject: net/mlx5: Fix unpublish devlink parameters
+
+From: Parav Pandit <parav@nvidia.com>
+
+[ Upstream commit 6f35723864b42ec9e9bb95a503449633395c4975 ]
+
+Cleanup routine missed to unpublish the parameters. Add it.
+
+Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter")
+Signed-off-by: Parav Pandit <parav@nvidia.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+index 44c458443428..4794173f8fdb 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+@@ -664,6 +664,7 @@ params_reg_err:
+ void mlx5_devlink_unregister(struct devlink *devlink)
+ {
+ mlx5_devlink_traps_unregister(devlink);
++ devlink_params_unpublish(devlink);
+ devlink_params_unregister(devlink, mlx5_devlink_params,
+ ARRAY_SIZE(mlx5_devlink_params));
+ devlink_unregister(devlink);
+--
+2.30.2
+
--- /dev/null
+From 275e9befe51259d1256137ab5cea05679614f8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 15:05:11 +0300
+Subject: net/mlx5: Remove all auxiliary devices at the unregister event
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 8e7e2e8ed0e251138926838b7933f8eb6dd56b12 ]
+
+The call to mlx5_unregister_device() means that mlx5_core driver is
+removed. In such scenario, we need to disregard all other flags like
+attach/detach and forcibly remove all auxiliary devices.
+
+Fixes: a5ae8fc9058e ("net/mlx5e: Don't create devices during unload flow")
+Tested-and-Reported-by: Yicong Yang <yangyicong@hisilicon.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+index def2156e50ee..20bb37266254 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -397,7 +397,7 @@ int mlx5_register_device(struct mlx5_core_dev *dev)
+ void mlx5_unregister_device(struct mlx5_core_dev *dev)
+ {
+ mutex_lock(&mlx5_intf_mutex);
+- dev->priv.flags |= MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV;
++ dev->priv.flags = MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV;
+ mlx5_rescan_drivers_locked(dev);
+ mutex_unlock(&mlx5_intf_mutex);
+ }
+--
+2.30.2
+
--- /dev/null
+From a3e3f8c84736ebe70e7ca77075c8e0e4855f5ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 20:34:48 +0300
+Subject: net/mlx5e: Block LRO if firmware asks for tunneled LRO
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit 26ab7b384525ccfa678c518577f7f0d841209c8b ]
+
+This commit does a cleanup in LRO configuration.
+
+LRO is a parameter of an RQ, but its state is changed by modifying a TIR
+related to the RQ.
+
+The current status: LRO for tunneled packets is not supported in the
+driver, inner TIRs may enable LRO on creation, but LRO status of inner
+TIRs isn't changed in mlx5e_modify_tirs_lro(). This is inconsistent, but
+as long as the firmware doesn't declare support for tunneled LRO, it
+works, because the same RQs are shared between the inner and outer TIRs.
+
+This commit does two fixes:
+
+1. If the firmware has the tunneled LRO capability, LRO is blocked
+altogether, because it's not possible to block it for inner TIRs only,
+when the same RQs are shared between inner and outer TIRs, and the
+driver won't be able to handle tunneled LRO traffic.
+
+2. mlx5e_modify_tirs_lro() is patched to modify LRO state for all TIRs,
+including inner ones, because all TIRs related to an RQ should agree on
+their LRO state.
+
+Fixes: 7b3722fa9ef6 ("net/mlx5e: Support RSS for GRE tunneled packets")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++++++
+ include/linux/mlx5/mlx5_ifc.h | 3 ++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 779a4abead01..b0424c36cf7f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -2563,6 +2563,14 @@ static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
+ err = mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in);
+ if (err)
+ goto free_in;
++
++ /* Verify inner tirs resources allocated */
++ if (!priv->inner_indir_tir[0].tirn)
++ continue;
++
++ err = mlx5_core_modify_tir(mdev, priv->inner_indir_tir[tt].tirn, in);
++ if (err)
++ goto free_in;
+ }
+
+ for (ix = 0; ix < priv->max_nch; ix++) {
+@@ -4806,7 +4814,14 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
+ netdev->hw_enc_features |= NETIF_F_HW_VLAN_CTAG_TX;
+ netdev->hw_enc_features |= NETIF_F_HW_VLAN_CTAG_RX;
+
++ /* Tunneled LRO is not supported in the driver, and the same RQs are
++ * shared between inner and outer TIRs, so the driver can't disable LRO
++ * for inner TIRs while having it enabled for outer TIRs. Due to this,
++ * block LRO altogether if the firmware declares tunneled LRO support.
++ */
+ if (!!MLX5_CAP_ETH(mdev, lro_cap) &&
++ !MLX5_CAP_ETH(mdev, tunnel_lro_vxlan) &&
++ !MLX5_CAP_ETH(mdev, tunnel_lro_gre) &&
+ mlx5e_check_fragmented_striding_rq_cap(mdev))
+ netdev->vlan_features |= NETIF_F_LRO;
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index eb86e80e4643..857529a5568d 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -918,7 +918,8 @@ struct mlx5_ifc_per_protocol_networking_offload_caps_bits {
+ u8 scatter_fcs[0x1];
+ u8 enhanced_multi_pkt_send_wqe[0x1];
+ u8 tunnel_lso_const_out_ip_id[0x1];
+- u8 reserved_at_1c[0x2];
++ u8 tunnel_lro_gre[0x1];
++ u8 tunnel_lro_vxlan[0x1];
+ u8 tunnel_stateless_gre[0x1];
+ u8 tunnel_stateless_vxlan[0x1];
+
+--
+2.30.2
+
--- /dev/null
+From c4bbffb1c38392ae48699d9cfb95388e95165e27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 10:14:58 +0300
+Subject: net/mlx5e: Fix possible use-after-free deleting fdb rule
+
+From: Roi Dayan <roid@nvidia.com>
+
+[ Upstream commit 9a5f9cc794e17cf6ed2a5bb215d2e8b6832db444 ]
+
+After neigh-update-add failure we are still with a slow path rule but
+the driver always assume the rule is an fdb rule.
+Fix neigh-update-del by checking slow path tc flag on the flow.
+Also fix neigh-update-add for when neigh-update-del fails the same.
+
+Fixes: 5dbe906ff1d5 ("net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available")
+Signed-off-by: Roi Dayan <roid@nvidia.com>
+Reviewed-by: Paul Blakey <paulb@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+index 490131e06efb..aa4dc7d624f8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+@@ -143,7 +143,7 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
+ mlx5e_rep_queue_neigh_stats_work(priv);
+
+ list_for_each_entry(flow, flow_list, tmp_list) {
+- if (!mlx5e_is_offloaded_flow(flow))
++ if (!mlx5e_is_offloaded_flow(flow) || !flow_flag_test(flow, SLOW))
+ continue;
+ attr = flow->attr;
+ esw_attr = attr->esw_attr;
+@@ -184,7 +184,7 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
+ int err;
+
+ list_for_each_entry(flow, flow_list, tmp_list) {
+- if (!mlx5e_is_offloaded_flow(flow))
++ if (!mlx5e_is_offloaded_flow(flow) || flow_flag_test(flow, SLOW))
+ continue;
+ attr = flow->attr;
+ esw_attr = attr->esw_attr;
+--
+2.30.2
+
--- /dev/null
+From d8046800969854961e00ed2ba8551b347762e29c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 17:20:04 +0300
+Subject: net/mlx5e: Prohibit inner indir TIRs in IPoIB
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit 9c43f3865c2a03be104f1c1d5e9129c2a2bdba88 ]
+
+TIR's rx_hash_field_selector_inner can be enabled only when
+tunneled_offload_en = 1. tunneled_offload_en is filled according to the
+tunneled_offload_en field in struct mlx5e_params, which is false in the
+IPoIB profile. On the other hand, the IPoIB profile passes inner_ttc =
+true to mlx5e_create_indirect_tirs, which potentially allows the latter
+function to attempt to create inner indirect TIRs without having
+tunneled_offload_en set.
+
+This commit prohibits this behavior by passing inner_ttc = false to
+mlx5e_create_indirect_tirs. The latter function won't attempt to create
+inner indirect TIRs.
+
+As inner indirect TIRs are not created in the IPoIB profile (this commit
+blocks it explicitly, and even before they would have failed to be
+created), the call to mlx5e_create_inner_ttc_table in
+mlx5i_create_flow_steering is a no-op and can be removed.
+
+Fixes: 46dc933cee82 ("net/mlx5e: Provide explicit directive if to create inner indirect tirs")
+Fixes: 458821c72bd0 ("net/mlx5e: IPoIB, Add inner TTC table to IPoIB flow steering")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en/fs.h | 6 ------
+ .../net/ethernet/mellanox/mlx5/core/en_fs.c | 10 +++++-----
+ .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 18 ++----------------
+ 3 files changed, 7 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+index 1d5ce07b83f4..43b092f5565a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+@@ -248,18 +248,12 @@ struct ttc_params {
+
+ void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, struct ttc_params *ttc_params);
+ void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params);
+-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params);
+
+ int mlx5e_create_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
+ struct mlx5e_ttc_table *ttc);
+ void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv,
+ struct mlx5e_ttc_table *ttc);
+
+-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
+- struct mlx5e_ttc_table *ttc);
+-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
+- struct mlx5e_ttc_table *ttc);
+-
+ void mlx5e_destroy_flow_table(struct mlx5e_flow_table *ft);
+ int mlx5e_ttc_fwd_dest(struct mlx5e_priv *priv, enum mlx5e_traffic_types type,
+ struct mlx5_flow_destination *new_dest);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 0b75fab41ae8..6464ac3f294e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -1324,7 +1324,7 @@ void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv,
+ ttc_params->inner_ttc = &priv->fs.inner_ttc;
+ }
+
+-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params)
++static void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params)
+ {
+ struct mlx5_flow_table_attr *ft_attr = &ttc_params->ft_attr;
+
+@@ -1343,8 +1343,8 @@ void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params)
+ ft_attr->prio = MLX5E_NIC_PRIO;
+ }
+
+-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
+- struct mlx5e_ttc_table *ttc)
++static int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
++ struct mlx5e_ttc_table *ttc)
+ {
+ struct mlx5e_flow_table *ft = &ttc->ft;
+ int err;
+@@ -1374,8 +1374,8 @@ err:
+ return err;
+ }
+
+-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
+- struct mlx5e_ttc_table *ttc)
++static void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
++ struct mlx5e_ttc_table *ttc)
+ {
+ if (!mlx5e_tunnel_inner_ft_supported(priv->mdev))
+ return;
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+index 7d7ed025db0d..620d638e1e8f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+@@ -331,17 +331,6 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
+ }
+
+ mlx5e_set_ttc_basic_params(priv, &ttc_params);
+- mlx5e_set_inner_ttc_ft_params(&ttc_params);
+- for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++)
+- ttc_params.indir_tirn[tt] = priv->inner_indir_tir[tt].tirn;
+-
+- err = mlx5e_create_inner_ttc_table(priv, &ttc_params, &priv->fs.inner_ttc);
+- if (err) {
+- netdev_err(priv->netdev, "Failed to create inner ttc table, err=%d\n",
+- err);
+- goto err_destroy_arfs_tables;
+- }
+-
+ mlx5e_set_ttc_ft_params(&ttc_params);
+ for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++)
+ ttc_params.indir_tirn[tt] = priv->indir_tir[tt].tirn;
+@@ -350,13 +339,11 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
+ if (err) {
+ netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
+ err);
+- goto err_destroy_inner_ttc_table;
++ goto err_destroy_arfs_tables;
+ }
+
+ return 0;
+
+-err_destroy_inner_ttc_table:
+- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc);
+ err_destroy_arfs_tables:
+ mlx5e_arfs_destroy_tables(priv);
+
+@@ -366,7 +353,6 @@ err_destroy_arfs_tables:
+ static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv)
+ {
+ mlx5e_destroy_ttc_table(priv, &priv->fs.ttc);
+- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc);
+ mlx5e_arfs_destroy_tables(priv);
+ }
+
+@@ -392,7 +378,7 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv)
+ if (err)
+ goto err_destroy_indirect_rqts;
+
+- err = mlx5e_create_indirect_tirs(priv, true);
++ err = mlx5e_create_indirect_tirs(priv, false);
+ if (err)
+ goto err_destroy_direct_rqts;
+
+--
+2.30.2
+
--- /dev/null
+From 1e9398412d68d3f3aa2e4d6b5c4e27862cc9df43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jun 2021 13:37:36 +0300
+Subject: net/mlx5e: Use correct eswitch for stack devices with lag
+
+From: Dmytro Linkin <dlinkin@nvidia.com>
+
+[ Upstream commit f9d196bd632b8b79261ec3366c30ec3923ea9a02 ]
+
+If link aggregation is used within stack devices driver rejects encap
+rules if PF of the VF tunnel device is down. This happens because route
+resolved for other PF and its eswitch instance is used to determine
+correct vport.
+To fix that use devcom feature to retrieve other eswitch instance if
+failed to find vport for the 1st eswitch and LAG is active.
+
+Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading")
+Signed-off-by: Dmytro Linkin <dlinkin@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_tc.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 47bd20ad8108..ced6ff0bc916 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -1310,6 +1310,7 @@ bool mlx5e_tc_is_vf_tunnel(struct net_device *out_dev, struct net_device *route_
+ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *route_dev, u16 *vport)
+ {
+ struct mlx5e_priv *out_priv, *route_priv;
++ struct mlx5_devcom *devcom = NULL;
+ struct mlx5_core_dev *route_mdev;
+ struct mlx5_eswitch *esw;
+ u16 vhca_id;
+@@ -1321,7 +1322,24 @@ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *ro
+ route_mdev = route_priv->mdev;
+
+ vhca_id = MLX5_CAP_GEN(route_mdev, vhca_id);
++ if (mlx5_lag_is_active(out_priv->mdev)) {
++ /* In lag case we may get devices from different eswitch instances.
++ * If we failed to get vport num, it means, mostly, that we on the wrong
++ * eswitch.
++ */
++ err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport);
++ if (err != -ENOENT)
++ return err;
++
++ devcom = out_priv->mdev->priv.devcom;
++ esw = mlx5_devcom_get_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS);
++ if (!esw)
++ return -ENODEV;
++ }
++
+ err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport);
++ if (devcom)
++ mlx5_devcom_release_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS);
+ return err;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 3845bc318a049bbb0a6eb9d4c4953671a2d95734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Aug 2021 15:25:41 +0200
+Subject: net: phy: marvell10g: fix broken PHY interrupts for anyone after us
+ in the driver probe list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 0d55649d2ad7296acfda9127e1d05518d025734a ]
+
+Enabling interrupts via device tree for the internal PHYs on the
+mv88e6390 DSA switch does not work. The driver insists to use poll mode.
+
+Stage one debugging shows that the fwnode_mdiobus_phy_device_register
+function calls fwnode_irq_get properly, and phy->irq is set to a valid
+interrupt line initially.
+
+But it is then cleared.
+
+Stage two debugging shows that it is cleared here:
+
+phy_probe:
+
+ /* Disable the interrupt if the PHY doesn't support it
+ * but the interrupt is still a valid one
+ */
+ if (!phy_drv_supports_irq(phydrv) && phy_interrupt_is_valid(phydev))
+ phydev->irq = PHY_POLL;
+
+Okay, so does the "Marvell 88E6390 Family" PHY driver not have the
+.config_intr and .handle_interrupt function pointers? Yes it does.
+
+Stage three debugging shows that the PHY device does not attempt a probe
+against the "Marvell 88E6390 Family" driver, but against the "mv88x3310"
+driver.
+
+Okay, so why does the "mv88x3310" driver match on a mv88x6390 internal
+PHY? The PHY IDs (MARVELL_PHY_ID_88E6390_FAMILY vs
+MARVELL_PHY_ID_88X3310) are way different.
+
+Stage four debugging has us looking through:
+
+phy_device_register
+-> device_add
+ -> bus_probe_device
+ -> device_initial_probe
+ -> __device_attach
+ -> bus_for_each_drv
+ -> driver_match_device
+ -> drv->bus->match
+ -> phy_bus_match
+
+Okay, so as we said, the MII_PHYSID1 of mv88e6390 does not match the
+mv88x3310 driver's PHY mask & ID, so why would phy_bus_match return...
+
+Ahh, phy_bus_match calls a shortcircuit method,
+phydrv->match_phy_device, and does not even bother to compare the PHY ID
+if that is implemented.
+
+So of course, we go inside the marvell10g.c driver and sure enough, it
+implements .match_phy_device and does not bother to check the PHY ID.
+
+What's interesting though is that at the end of the device_add() from
+phy_device_register(), the driver for the internal PHYs _is_ the proper
+"Marvell 88E6390 Family". This is because "mv88x3310" ends up failing to
+probe after all, and __device_attach_driver(), to quote:
+
+ /*
+ * Ignore errors returned by ->probe so that the next driver can try
+ * its luck.
+ */
+
+The next (and only other) driver that matches is the 6390 driver. For
+this one, phy_probe doesn't fail, and everything expects to work as
+normal, EXCEPT phydev->irq has already been cleared by the previous
+unsuccessful probe of a driver which did not implement PHY interrupts,
+and therefore cleared that IRQ.
+
+Okay, so it is not just Marvell 6390 that has PHY interrupts broken.
+Stuff like Atheros, Aquantia, Broadcom, Qualcomm work because they are
+lexicographically before Marvell, and stuff like NXP, Realtek, Vitesse
+are broken.
+
+This goes to show how fragile it is to reset phydev->irq = PHY_POLL from
+the actual beginning of phy_probe itself. That seems like an actual bug
+of its own too, since phy_probe has side effects which are not restored
+on probe failure, but the line of thought probably was, the same driver
+will attempt probe again, so it doesn't matter. Well, looks like it
+does.
+
+Maybe it would make more sense to move the phydev->irq clearing after
+the actual device_add() in phy_device_register() completes, and the
+bound driver is the actual final one.
+
+(also, a bit frightening that drivers are permitted to bypass the MDIO
+bus matching in such a trivial way and perform PHY reads and writes from
+the .match_phy_device method, on devices that do not even belong to
+them. In the general case it might not be guaranteed that the MDIO
+accesses one driver needs to make to figure out whether to match on a
+device is safe for all other PHY devices)
+
+Fixes: a5de4be0aaaa ("net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Tested-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20210827132541.28953-1-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell10g.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c
+index 53a433442803..f4d758f8a1ee 100644
+--- a/drivers/net/phy/marvell10g.c
++++ b/drivers/net/phy/marvell10g.c
+@@ -987,11 +987,19 @@ static int mv3310_get_number_of_ports(struct phy_device *phydev)
+
+ static int mv3310_match_phy_device(struct phy_device *phydev)
+ {
++ if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] &
++ MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310)
++ return 0;
++
+ return mv3310_get_number_of_ports(phydev) == 1;
+ }
+
+ static int mv3340_match_phy_device(struct phy_device *phydev)
+ {
++ if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] &
++ MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310)
++ return 0;
++
+ return mv3310_get_number_of_ports(phydev) == 4;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From e26a0f6d48e003d4475c94d95fa15b40086db974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 11:37:17 +0300
+Subject: net: qrtr: make checks in qrtr_endpoint_post() stricter
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit aaa8e4922c887ff47ad66ef918193682bccc1905 ]
+
+These checks are still not strict enough. The main problem is that if
+"cb->type == QRTR_TYPE_NEW_SERVER" is true then "len - hdrlen" is
+guaranteed to be 4 but we need to be at least 16 bytes. In fact, we
+can reject everything smaller than sizeof(*pkt) which is 20 bytes.
+
+Also I don't like the ALIGN(size, 4). It's better to just insist that
+data is needs to be aligned at the start.
+
+Fixes: 0baa99ee353c ("net: qrtr: Allow non-immediate node routing")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/qrtr/qrtr.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
+index 52b7f6490d24..2e732ea2b82f 100644
+--- a/net/qrtr/qrtr.c
++++ b/net/qrtr/qrtr.c
+@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+ goto err;
+ }
+
+- if (!size || len != ALIGN(size, 4) + hdrlen)
++ if (!size || size & 3 || len != size + hdrlen)
+ goto err;
+
+ if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&
+@@ -506,8 +506,12 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
+
+ if (cb->type == QRTR_TYPE_NEW_SERVER) {
+ /* Remote node endpoint can bridge other distant nodes */
+- const struct qrtr_ctrl_pkt *pkt = data + hdrlen;
++ const struct qrtr_ctrl_pkt *pkt;
+
++ if (size < sizeof(*pkt))
++ goto err;
++
++ pkt = data + hdrlen;
+ qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 5664a6354c44ed9471f8f8b1cb45317f6ff748ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Aug 2021 16:23:15 +0200
+Subject: net: qualcomm: fix QCA7000 checksum handling
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 429205da6c834447a57279af128bdd56ccd5225e ]
+
+Based on tests the QCA7000 doesn't support checksum offloading. So assume
+ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum
+handling. This fixes data transfer issues in noisy environments.
+
+Reported-by: Michael Heimpold <michael.heimpold@in-tech.com>
+Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 2 +-
+ drivers/net/ethernet/qualcomm/qca_uart.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index ab9b02574a15..38018f024823 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -434,7 +434,7 @@ qcaspi_receive(struct qcaspi *qca)
+ skb_put(qca->rx_skb, retcode);
+ qca->rx_skb->protocol = eth_type_trans(
+ qca->rx_skb, qca->rx_skb->dev);
+- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
++ skb_checksum_none_assert(qca->rx_skb);
+ netif_rx_ni(qca->rx_skb);
+ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+ net_dev->mtu + VLAN_ETH_HLEN);
+diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c
+index bcdeca7b3366..ce3f7ce31adc 100644
+--- a/drivers/net/ethernet/qualcomm/qca_uart.c
++++ b/drivers/net/ethernet/qualcomm/qca_uart.c
+@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data,
+ skb_put(qca->rx_skb, retcode);
+ qca->rx_skb->protocol = eth_type_trans(
+ qca->rx_skb, qca->rx_skb->dev);
+- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
++ skb_checksum_none_assert(qca->rx_skb);
+ netif_rx_ni(qca->rx_skb);
+ qca->rx_skb = netdev_alloc_skb_ip_align(netdev,
+ netdev->mtu +
+--
+2.30.2
+
--- /dev/null
+From cf21bc3063a9b697e88877cbe734c8910e714a47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Aug 2021 23:58:01 +0800
+Subject: net: sched: Fix qdisc_rate_table refcount leak when get tcf_block
+ failed
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit c66070125837900163b81a03063ddd657a7e9bfb ]
+
+The reference counting issue happens in one exception handling path of
+cbq_change_class(). When failing to get tcf_block, the function forgets
+to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
+causing a refcount leak.
+
+Fix this issue by jumping to "failure" label when get tcf_block failed.
+
+Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Link: https://lore.kernel.org/r/1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_cbq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index b79a7e27bb31..38a3a8394bbd 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1614,7 +1614,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
+ err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
+ if (err) {
+ kfree(cl);
+- return err;
++ goto failure;
+ }
+
+ if (tca[TCA_RATE]) {
+--
+2.30.2
+
--- /dev/null
+From 3f9deebe969ad2c1ff07421e71d1b1f124a77f1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 14:15:58 +0800
+Subject: net: stmmac: fix INTR TBU status affecting irq count statistic
+
+From: Voon Weifeng <weifeng.voon@intel.com>
+
+[ Upstream commit 1975df880b959e30f28d66148a12d77b458abd76 ]
+
+DMA channel status "Transmit buffer unavailable(TBU)" bit is not
+considered as a successful dma tx. Hence, it should not affect
+all the irq count statistic.
+
+Fixes: 1103d3a5531c ("net: stmmac: dwmac4: Also use TBU interrupt to clean TX path")
+Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
+Signed-off-by: Vijayakannan Ayyathurai <vijayakannan.ayyathurai@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+index e63270267578..f83db62938dd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+@@ -172,11 +172,12 @@ int dwmac4_dma_interrupt(void __iomem *ioaddr,
+ x->rx_normal_irq_n++;
+ ret |= handle_rx;
+ }
+- if (likely(intr_status & (DMA_CHAN_STATUS_TI |
+- DMA_CHAN_STATUS_TBU))) {
++ if (likely(intr_status & DMA_CHAN_STATUS_TI)) {
+ x->tx_normal_irq_n++;
+ ret |= handle_tx;
+ }
++ if (unlikely(intr_status & DMA_CHAN_STATUS_TBU))
++ ret |= handle_tx;
+ if (unlikely(intr_status & DMA_CHAN_STATUS_ERI))
+ x->rx_early_irq++;
+
+--
+2.30.2
+
--- /dev/null
+From e4d8aaf3dc437cbf9b0e0842d80ee397e8a1e645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 01:55:31 +0300
+Subject: net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop()
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 47bfc4d128dedd9e828e33b70b87b591a6d59edf ]
+
+On TI K3 am64x platform the issue with RX IRQ is observed - it's become
+disabled forever after .ndo_stop(). The K3 CPSW driver manipulates RX IRQ
+by using standard Linux enable_irq()/disable_irq_nosync() API as there is
+no IRQ enable/disable options in CPSW HW itself, as result during
+.ndo_stop() following sequence happens
+
+ phy_stop()
+ teardown TX/RX channels
+ wait for TX tdown complete
+ napi_disable(TX)
+ clean up TX channels
+
+ (a)
+
+ napi_disable(RX)
+
+At point (a) it's not possible to predict if RX IRQ was triggered or not.
+if RX IRQ was triggered then it also not possible to definitely say if RX
+NAPI was run or only scheduled and immediately canceled by
+napi_disable(RX). Actually the last case causes RX IRQ to be permanently
+disabled.
+
+Another observed issue is that RX IRQ enable counter become unbalanced if
+(gro_flush_timeout =! 0) while (napi_defer_hard_irqs == 0):
+
+Unbalanced enable for IRQ 44
+WARNING: CPU: 0 PID: 10 at ../kernel/irq/manage.c:776 __enable_irq+0x38/0x80
+__enable_irq+0x38/0x80
+enable_irq+0x54/0xb0
+am65_cpsw_nuss_rx_poll+0x2f4/0x368
+__napi_poll+0x34/0x1b8
+net_rx_action+0xe4/0x220
+_stext+0x11c/0x284
+run_ksoftirqd+0x4c/0x60
+
+To avoid above issues introduce flag indicating if RX was actually disabled
+before enabling it in am65_cpsw_nuss_rx_poll() and restore RX IRQ state in
+.ndo_open()
+
+Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 13 +++++++++++--
+ drivers/net/ethernet/ti/am65-cpsw-nuss.h | 2 ++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index fb58fc470773..e967cd1ade36 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -518,6 +518,10 @@ static int am65_cpsw_nuss_common_open(struct am65_cpsw_common *common,
+ }
+
+ napi_enable(&common->napi_rx);
++ if (common->rx_irq_disabled) {
++ common->rx_irq_disabled = false;
++ enable_irq(common->rx_chns.irq);
++ }
+
+ dev_dbg(common->dev, "cpsw_nuss started\n");
+ return 0;
+@@ -871,8 +875,12 @@ static int am65_cpsw_nuss_rx_poll(struct napi_struct *napi_rx, int budget)
+
+ dev_dbg(common->dev, "%s num_rx:%d %d\n", __func__, num_rx, budget);
+
+- if (num_rx < budget && napi_complete_done(napi_rx, num_rx))
+- enable_irq(common->rx_chns.irq);
++ if (num_rx < budget && napi_complete_done(napi_rx, num_rx)) {
++ if (common->rx_irq_disabled) {
++ common->rx_irq_disabled = false;
++ enable_irq(common->rx_chns.irq);
++ }
++ }
+
+ return num_rx;
+ }
+@@ -1090,6 +1098,7 @@ static irqreturn_t am65_cpsw_nuss_rx_irq(int irq, void *dev_id)
+ {
+ struct am65_cpsw_common *common = dev_id;
+
++ common->rx_irq_disabled = true;
+ disable_irq_nosync(irq);
+ napi_schedule(&common->napi_rx);
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.h b/drivers/net/ethernet/ti/am65-cpsw-nuss.h
+index 5d93e346f05e..048ed10143c1 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h
+@@ -126,6 +126,8 @@ struct am65_cpsw_common {
+ struct am65_cpsw_rx_chn rx_chns;
+ struct napi_struct napi_rx;
+
++ bool rx_irq_disabled;
++
+ u32 nuss_ver;
+ u32 cpsw_ver;
+ unsigned long bus_freq;
+--
+2.30.2
+
--- /dev/null
+From 5d9ed916b2da815491a1126b1b139b3007c94d15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 10:33:45 +0300
+Subject: net: ti: am65-cpsw-nuss: fix wrong devlink release order
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit acf34954efd17d4f65c7bb3e614381e6afc33222 ]
+
+The commit that introduced devlink support released devlink resources in
+wrong order, that made an unwind flow to be asymmetrical. In addition,
+the am65-cpsw-nuss used internal to devlink core field - registered.
+
+In order to fix the unwind flow and remove such access to the
+registered field, rewrite the code to call devlink_port_unregister only
+on registered ports.
+
+Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/am65-cpsw-nuss.c | 34 ++++++++++++------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+index 67a08cbba859..fb58fc470773 100644
+--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+@@ -2388,21 +2388,6 @@ static const struct devlink_param am65_cpsw_devlink_params[] = {
+ am65_cpsw_dl_switch_mode_set, NULL),
+ };
+
+-static void am65_cpsw_unregister_devlink_ports(struct am65_cpsw_common *common)
+-{
+- struct devlink_port *dl_port;
+- struct am65_cpsw_port *port;
+- int i;
+-
+- for (i = 1; i <= common->port_num; i++) {
+- port = am65_common_get_port(common, i);
+- dl_port = &port->devlink_port;
+-
+- if (dl_port->registered)
+- devlink_port_unregister(dl_port);
+- }
+-}
+-
+ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common)
+ {
+ struct devlink_port_attrs attrs = {};
+@@ -2464,7 +2449,12 @@ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common)
+ return ret;
+
+ dl_port_unreg:
+- am65_cpsw_unregister_devlink_ports(common);
++ for (i = i - 1; i >= 1; i--) {
++ port = am65_common_get_port(common, i);
++ dl_port = &port->devlink_port;
++
++ devlink_port_unregister(dl_port);
++ }
+ dl_unreg:
+ devlink_unregister(common->devlink);
+ dl_free:
+@@ -2475,6 +2465,17 @@ dl_free:
+
+ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common)
+ {
++ struct devlink_port *dl_port;
++ struct am65_cpsw_port *port;
++ int i;
++
++ for (i = 1; i <= common->port_num; i++) {
++ port = am65_common_get_port(common, i);
++ dl_port = &port->devlink_port;
++
++ devlink_port_unregister(dl_port);
++ }
++
+ if (!AM65_CPSW_IS_CPSW2G(common) &&
+ IS_ENABLED(CONFIG_TI_K3_AM65_CPSW_SWITCHDEV)) {
+ devlink_params_unpublish(common->devlink);
+@@ -2482,7 +2483,6 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common)
+ ARRAY_SIZE(am65_cpsw_devlink_params));
+ }
+
+- am65_cpsw_unregister_devlink_ports(common);
+ devlink_unregister(common->devlink);
+ devlink_free(common->devlink);
+ }
+--
+2.30.2
+
--- /dev/null
+From b5d37b9b27f4cf78f6ee71a07526be4a6d3c262d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 16:41:43 -0400
+Subject: nfsd4: Fix forced-expiry locking
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit f7104cc1a9159cd0d3e8526cb638ae0301de4b61 ]
+
+This should use the network-namespace-wide client_lock, not the
+per-client cl_lock.
+
+You shouldn't see any bugs unless you're actually using the
+forced-expiry interface introduced by 89c905beccbb.
+
+Fixes: 89c905beccbb "nfsd: allow forced expiration of NFSv4 clients"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 90e81f6491ff..ab81e8ae3265 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -2665,9 +2665,9 @@ static void force_expire_client(struct nfs4_client *clp)
+ struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
+ bool already_expired;
+
+- spin_lock(&clp->cl_lock);
++ spin_lock(&nn->client_lock);
+ clp->cl_time = 0;
+- spin_unlock(&clp->cl_lock);
++ spin_unlock(&nn->client_lock);
+
+ wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0);
+ spin_lock(&nn->client_lock);
+--
+2.30.2
+
--- /dev/null
+From ab59ff48817d4ddd9cf14a683b3254a92a0e4a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Jul 2021 17:41:20 +0800
+Subject: nvme-rdma: don't update queue count when failing to set io queues
+
+From: Ruozhu Li <liruozhu@huawei.com>
+
+[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ]
+
+We update ctrl->queue_count and schedule another reconnect when io queue
+count is zero.But we will never try to create any io queue in next reco-
+nnection, because ctrl->queue_count already set to zero.We will end up
+having an admin-only session in Live state, which is exactly what we try
+to avoid in the original patch.
+Update ctrl->queue_count after queue_count zero checking to fix it.
+
+Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 4697a94c0945..f80682f7df54 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -736,13 +736,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
+ if (ret)
+ return ret;
+
+- ctrl->ctrl.queue_count = nr_io_queues + 1;
+- if (ctrl->ctrl.queue_count < 2) {
++ if (nr_io_queues == 0) {
+ dev_err(ctrl->ctrl.device,
+ "unable to set any I/O queues\n");
+ return -ENOMEM;
+ }
+
++ ctrl->ctrl.queue_count = nr_io_queues + 1;
+ dev_info(ctrl->ctrl.device,
+ "creating %d I/O queues.\n", nr_io_queues);
+
+--
+2.30.2
+
--- /dev/null
+From a1e59fd0a3e6313a8a98651dd218e440d372c56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Aug 2021 11:50:23 +0800
+Subject: nvme-tcp: don't update queue count when failing to set io queues
+
+From: Ruozhu Li <liruozhu@huawei.com>
+
+[ Upstream commit 664227fde63844d69e9ec9e90a8a7801e6ff072d ]
+
+We update ctrl->queue_count and schedule another reconnect when io queue
+count is zero.But we will never try to create any io queue in next reco-
+nnection, because ctrl->queue_count already set to zero.We will end up
+having an admin-only session in Live state, which is exactly what we try
+to avoid in the original patch.
+Update ctrl->queue_count after queue_count zero checking to fix it.
+
+Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 79a463090dd3..ab1ea5b0888e 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1755,13 +1755,13 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl)
+ if (ret)
+ return ret;
+
+- ctrl->queue_count = nr_io_queues + 1;
+- if (ctrl->queue_count < 2) {
++ if (nr_io_queues == 0) {
+ dev_err(ctrl->device,
+ "unable to set any I/O queues\n");
+ return -ENOMEM;
+ }
+
++ ctrl->queue_count = nr_io_queues + 1;
+ dev_info(ctrl->device,
+ "creating %d I/O queues.\n", nr_io_queues);
+
+--
+2.30.2
+
--- /dev/null
+From f722ce939a9985d0f3c9770f2033f0e4d9ad17d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 09:20:14 +0300
+Subject: nvmet: pass back cntlid on successful completion
+
+From: Amit Engel <amit.engel@dell.com>
+
+[ Upstream commit e804d5abe2d74cfe23f5f83be580d1cdc9307111 ]
+
+According to the NVMe specification, the response dword 0 value of the
+Connect command is based on status code: return cntlid for successful
+compeltion return IPO and IATTR for connect invalid parameters. Fix
+a missing error information for a zero sized queue, and return the
+cntlid also for I/O queue Connect commands.
+
+Signed-off-by: Amit Engel <amit.engel@dell.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fabrics-cmd.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
+index 7d0f3523fdab..8ef564c3b32c 100644
+--- a/drivers/nvme/target/fabrics-cmd.c
++++ b/drivers/nvme/target/fabrics-cmd.c
+@@ -120,6 +120,7 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
+ if (!sqsize) {
+ pr_warn("queue size zero!\n");
+ req->error_loc = offsetof(struct nvmf_connect_command, sqsize);
++ req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize);
+ ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
+ goto err;
+ }
+@@ -260,11 +261,11 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
+ }
+
+ status = nvmet_install_queue(ctrl, req);
+- if (status) {
+- /* pass back cntlid that had the issue of installing queue */
+- req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid);
++ if (status)
+ goto out_ctrl_put;
+- }
++
++ /* pass back cntlid for successful completion */
++ req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid);
+
+ pr_debug("adding queue %d to ctrl %d.\n", qid, ctrl->cntlid);
+
+--
+2.30.2
+
--- /dev/null
+From 99ce20e0c3eff7f1fb1bd3de6fcf46ee1eaefebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 17:32:19 +0530
+Subject: octeontx2-af: cn10k: Fix SDP base channel number
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 477b53f3f95ba5341b4320f8b7a92cedc5a67650 ]
+
+As per hardware the base channel number configured
+for programmable channels of a block must be multiple
+of number of channels of that block. This condition
+is not met for SDP base channel currently. Hence this
+patch ensures all the base channel numbers of all
+blocks are multiple of number of channels present in
+the blocks. Also instead of hardcoding SDP number
+of channels the same is read from the NIX_AF_CONST1
+register.
+
+Fixes: 242da439214b ("octeontx2-af: cn10k: Add support for programmable")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/marvell/octeontx2/af/common.h | 2 --
+ .../ethernet/marvell/octeontx2/af/rvu_cn10k.c | 31 +++++++++++++------
+ 2 files changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+index e66109367487..c1e11cb68d26 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h
+@@ -195,8 +195,6 @@ enum nix_scheduler {
+ #define NIX_CHAN_LBK_CHX(a, b) (0 + 0x100 * (a) + (b))
+ #define NIX_CHAN_SDP_CH_START (0x700ull)
+
+-#define SDP_CHANNELS 256
+-
+ /* NIX LSO format indices.
+ * As of now TSO is the only one using, so statically assigning indices.
+ */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+index 7d9e71c6965f..7a2157709dde 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+@@ -12,9 +12,10 @@
+
+ int rvu_set_channels_base(struct rvu *rvu)
+ {
++ u16 nr_lbk_chans, nr_sdp_chans, nr_cgx_chans, nr_cpt_chans;
++ u16 sdp_chan_base, cgx_chan_base, cpt_chan_base;
+ struct rvu_hwinfo *hw = rvu->hw;
+- u16 cpt_chan_base;
+- u64 nix_const;
++ u64 nix_const, nix_const1;
+ int blkaddr;
+
+ blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, 0);
+@@ -22,6 +23,7 @@ int rvu_set_channels_base(struct rvu *rvu)
+ return blkaddr;
+
+ nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST);
++ nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
+
+ hw->cgx = (nix_const >> 12) & 0xFULL;
+ hw->lmac_per_cgx = (nix_const >> 8) & 0xFULL;
+@@ -44,14 +46,24 @@ int rvu_set_channels_base(struct rvu *rvu)
+ * channels such that all channel numbers are contiguous
+ * leaving no holes. This way the new CPT channels can be
+ * accomodated. The order of channel numbers assigned is
+- * LBK, SDP, CGX and CPT.
++ * LBK, SDP, CGX and CPT. Also the base channel number
++ * of a block must be multiple of number of channels
++ * of the block.
+ */
+- hw->sdp_chan_base = hw->lbk_chan_base + hw->lbk_links *
+- ((nix_const >> 16) & 0xFFULL);
+- hw->cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * SDP_CHANNELS;
++ nr_lbk_chans = (nix_const >> 16) & 0xFFULL;
++ nr_sdp_chans = nix_const1 & 0xFFFULL;
++ nr_cgx_chans = nix_const & 0xFFULL;
++ nr_cpt_chans = (nix_const >> 32) & 0xFFFULL;
+
+- cpt_chan_base = hw->cgx_chan_base + hw->cgx_links *
+- (nix_const & 0xFFULL);
++ sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * nr_lbk_chans;
++ /* Round up base channel to multiple of number of channels */
++ hw->sdp_chan_base = ALIGN(sdp_chan_base, nr_sdp_chans);
++
++ cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * nr_sdp_chans;
++ hw->cgx_chan_base = ALIGN(cgx_chan_base, nr_cgx_chans);
++
++ cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * nr_cgx_chans;
++ hw->cpt_chan_base = ALIGN(cpt_chan_base, nr_cpt_chans);
+
+ /* Out of 4096 channels start CPT from 2048 so
+ * that MSB for CPT channels is always set
+@@ -155,6 +167,7 @@ err_put:
+
+ static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr)
+ {
++ u64 nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
+ u64 nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST);
+ u16 cgx_chans, lbk_chans, sdp_chans, cpt_chans;
+ struct rvu_hwinfo *hw = rvu->hw;
+@@ -164,7 +177,7 @@ static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr)
+
+ cgx_chans = nix_const & 0xFFULL;
+ lbk_chans = (nix_const >> 16) & 0xFFULL;
+- sdp_chans = SDP_CHANNELS;
++ sdp_chans = nix_const1 & 0xFFFULL;
+ cpt_chans = (nix_const >> 32) & 0xFFFULL;
+
+ start = hw->cgx_chan_base;
+--
+2.30.2
+
--- /dev/null
+From a5934a335c5070a816b157747e6f271f729ff6ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 23:30:43 +0530
+Subject: octeontx2-af: Fix loop in free and unmap counter
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 6537e96d743b89294b397b4865c6c061abae31b0 ]
+
+When the given counter does not belong to the entry
+then code ends up in infinite loop because the loop
+cursor, entry is not getting updated further. This
+patch fixes that by updating entry for every iteration.
+
+Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 0bc4529691ec..53ee1785c931 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -2567,10 +2567,11 @@ int rvu_mbox_handler_npc_mcam_unmap_counter(struct rvu *rvu,
+ index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry);
+ if (index >= mcam->bmap_entries)
+ break;
++ entry = index + 1;
++
+ if (mcam->entry2cntr_map[index] != req->cntr)
+ continue;
+
+- entry = index + 1;
+ npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr,
+ index, req->cntr);
+ }
+--
+2.30.2
+
--- /dev/null
+From 3fb3ca9e5e48729c2fead2ebebefab4110ff5169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 23:30:44 +0530
+Subject: octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit f2e4568ec95166605c77577953b2787c7f909978 ]
+
+In npc_update_vf_flow_entry function the loop cursor
+'index' is being changed inside the loop causing
+the loop to spin forever. This in turn hogs the kworker
+thread forever and no other mbox message is processed
+by AF driver after that. Fix this by using
+another variable in the loop.
+
+Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 53ee1785c931..c1a3f70063b5 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -823,7 +823,7 @@ void rvu_npc_enable_bcast_entry(struct rvu *rvu, u16 pcifunc, bool enable)
+ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
+ int blkaddr, u16 pcifunc, u64 rx_action)
+ {
+- int actindex, index, bank;
++ int actindex, index, bank, entry;
+ bool enable;
+
+ if (!(pcifunc & RVU_PFVF_FUNC_MASK))
+@@ -834,7 +834,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
+ if (mcam->entry2target_pffunc[index] == pcifunc) {
+ bank = npc_get_bank(mcam, index);
+ actindex = index;
+- index &= (mcam->banksize - 1);
++ entry = index & (mcam->banksize - 1);
+
+ /* read vf flow entry enable status */
+ enable = is_mcam_entry_enabled(rvu, mcam, blkaddr,
+@@ -844,7 +844,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
+ false);
+ /* update 'action' */
+ rvu_write64(rvu, blkaddr,
+- NPC_AF_MCAMEX_BANKX_ACTION(index, bank),
++ NPC_AF_MCAMEX_BANKX_ACTION(entry, bank),
+ rx_action);
+ if (enable)
+ npc_enable_mcam_entry(rvu, mcam, blkaddr,
+--
+2.30.2
+
--- /dev/null
+From bdf7e70beb43160849a4c932e7722d132cedbd6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 23:30:45 +0530
+Subject: octeontx2-af: Fix static code analyzer reported issues
+
+From: Subbaraya Sundeep <sbhatta@marvell.com>
+
+[ Upstream commit 698a82ebfb4b2f2014baf31b7324b328a2a6366e ]
+
+This patch fixes the static code analyzer reported issues
+in rvu_npc.c. The reported errors are different sizes of
+operands in bitops and returning uninitialized values.
+
+Fixes: 651cd2652339 ("octeontx2-af: MCAM entry installation support")
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index c1a3f70063b5..4427abbc3aad 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -23,7 +23,7 @@
+ #define RSVD_MCAM_ENTRIES_PER_NIXLF 1 /* Ucast for LFs */
+
+ #define NPC_PARSE_RESULT_DMAC_OFFSET 8
+-#define NPC_HW_TSTAMP_OFFSET 8
++#define NPC_HW_TSTAMP_OFFSET 8ULL
+ #define NPC_KEX_CHAN_MASK 0xFFFULL
+ #define NPC_KEX_PF_FUNC_MASK 0xFFFFULL
+
+@@ -1751,7 +1751,7 @@ static void npc_unmap_mcam_entry_and_cntr(struct rvu *rvu,
+ int blkaddr, u16 entry, u16 cntr)
+ {
+ u16 index = entry & (mcam->banksize - 1);
+- u16 bank = npc_get_bank(mcam, entry);
++ u32 bank = npc_get_bank(mcam, entry);
+
+ /* Remove mapping and reduce counter's refcnt */
+ mcam->entry2cntr_map[entry] = NPC_MCAM_INVALID_MAP;
+@@ -2365,8 +2365,8 @@ int rvu_mbox_handler_npc_mcam_shift_entry(struct rvu *rvu,
+ struct npc_mcam *mcam = &rvu->hw->mcam;
+ u16 pcifunc = req->hdr.pcifunc;
+ u16 old_entry, new_entry;
++ int blkaddr, rc = 0;
+ u16 index, cntr;
+- int blkaddr, rc;
+
+ blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NPC, 0);
+ if (blkaddr < 0)
+--
+2.30.2
+
--- /dev/null
+From d169cbaf71e149beb6bb75fe36dc2bce469e9c8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Aug 2021 23:30:46 +0530
+Subject: octeontx2-af: Set proper errorcode for IPv4 checksum errors
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+[ Upstream commit 1e4428b6dba9b683dc2ec0a56ed7879de3200cce ]
+
+With current config, for packets with IPv4 checksum errors,
+errorcode is being set to UNKNOWN. Hence added a separate
+errorcodes for outer and inner IPv4 checksum and changed
+NPC configuration accordingly.
+
+Also turn on L2 multicast address check in NPC protocol check block.
+
+Fixes: 6b3321bacc5a ("octeontx2-af: Enable packet length and csum validation")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+index 4427abbc3aad..d413078fc043 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+@@ -1619,14 +1619,15 @@ int rvu_npc_init(struct rvu *rvu)
+
+ /* Enable below for Rx pkts.
+ * - Outer IPv4 header checksum validation.
+- * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2M].
++ * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2B].
++ * - Detect outer L2 multicast address and set NPC_RESULT_S[L2M].
+ * - Inner IPv4 header checksum validation.
+ * - Set non zero checksum error code value
+ */
+ rvu_write64(rvu, blkaddr, NPC_AF_PCK_CFG,
+ rvu_read64(rvu, blkaddr, NPC_AF_PCK_CFG) |
+- BIT_ULL(32) | BIT_ULL(24) | BIT_ULL(6) |
+- BIT_ULL(2) | BIT_ULL(1));
++ ((u64)NPC_EC_OIP4_CSUM << 32) | (NPC_EC_IIP4_CSUM << 24) |
++ BIT_ULL(7) | BIT_ULL(6) | BIT_ULL(2) | BIT_ULL(1));
+
+ rvu_npc_setup_interfaces(rvu, blkaddr);
+
+--
+2.30.2
+
--- /dev/null
+From 146d691bfd6994c9d14bc849d948347110dedfc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 14:34:47 +0800
+Subject: octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5e8243e66b4d80eeaf9ed8cb0235ff133630a014 ]
+
+If otx2_mbox_get_rsp() fails, otx2_set_flowkey_cfg() need return an
+error code.
+
+Fixes: e7938365459f ("octeontx2-pf: Fix algorithm index in MCAM rules with RSS action")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index 25f84ad50dba..e0d1af9e7770 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -286,8 +286,10 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
+
+ rsp = (struct nix_rss_flowkey_cfg_rsp *)
+ otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+- if (IS_ERR(rsp))
++ if (IS_ERR(rsp)) {
++ err = PTR_ERR(rsp);
+ goto fail;
++ }
+
+ pfvf->hw.flowkey_alg_idx = rsp->alg_idx;
+ fail:
+--
+2.30.2
+
--- /dev/null
+From 161707938017547eace7e9aea868f45a4b1bca89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 17:32:25 +0530
+Subject: octeontx2-pf: Don't install VLAN offload rule if netdev is down
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+[ Upstream commit 05209e3570e452cdaa644e8398a8875b6a91051d ]
+
+Whenever user changes interface MAC address both default DMAC based
+MCAM rule and VLAN offload (for strip) rules are updated with new
+MAC address. To update or install VLAN offload rule PF driver needs
+interface's receive channel info, which is retrieved from admin
+function at the time of NIXLF initialization.
+
+If user changes MAC address before interface is UP, VLAN offload rule
+installation will fail and throw error as receive channel is not valid.
+To avoid this, skip VLAN offload rule installation if netdev is not UP.
+This rule will anyway be reinslatted as part of open() call.
+
+Fixes: fd9d7859db6c ("octeontx2-pf: Implement ingress/egress VLAN offload")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index 16ba457197a2..871404f3b8d3 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -208,7 +208,8 @@ int otx2_set_mac_address(struct net_device *netdev, void *p)
+ if (!otx2_hw_set_mac_addr(pfvf, addr->sa_data)) {
+ memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
+ /* update dmac field in vlan offload rule */
+- if (pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT)
++ if (netif_running(netdev) &&
++ pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT)
+ otx2_install_rxvlan_offload_flow(pfvf);
+ } else {
+ return -EPERM;
+--
+2.30.2
+
--- /dev/null
+From 9908464a76e448820074fafa4ad93192cf8d1d35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 17:32:26 +0530
+Subject: octeontx2-pf: Fix algorithm index in MCAM rules with RSS action
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+[ Upstream commit e7938365459f3a6d4edf212f435c4ad635621450 ]
+
+Otherthan setting action as RSS in NPC MCAM entry, RSS flowkey
+algorithm index also needs to be set. Otherwise whatever algorithm
+is defined at flowkey index '0' will be considered by HW and pkt
+flows will be distributed as such.
+
+Fix this by saving the flowkey index sent by admin function while
+initializing RSS and then use it when framing MCAM rules.
+
+Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/marvell/octeontx2/nic/otx2_common.c | 11 +++++++++++
+ .../net/ethernet/marvell/octeontx2/nic/otx2_common.h | 3 +++
+ .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 1 +
+ 3 files changed, 15 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+index 871404f3b8d3..25f84ad50dba 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+@@ -266,6 +266,7 @@ unlock:
+ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
+ {
+ struct otx2_rss_info *rss = &pfvf->hw.rss_info;
++ struct nix_rss_flowkey_cfg_rsp *rsp;
+ struct nix_rss_flowkey_cfg *req;
+ int err;
+
+@@ -280,6 +281,16 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
+ req->group = DEFAULT_RSS_CONTEXT_GROUP;
+
+ err = otx2_sync_mbox_msg(&pfvf->mbox);
++ if (err)
++ goto fail;
++
++ rsp = (struct nix_rss_flowkey_cfg_rsp *)
++ otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
++ if (IS_ERR(rsp))
++ goto fail;
++
++ pfvf->hw.flowkey_alg_idx = rsp->alg_idx;
++fail:
+ mutex_unlock(&pfvf->mbox.lock);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+index 45730d0d92f2..c652c27cd345 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+@@ -195,6 +195,9 @@ struct otx2_hw {
+ u8 lso_udpv4_idx;
+ u8 lso_udpv6_idx;
+
++ /* RSS */
++ u8 flowkey_alg_idx;
++
+ /* MSI-X */
+ u8 cint_cnt; /* CQ interrupt count */
+ u16 npa_msixoff; /* Offset of NPA vectors */
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+index 0b4fa92ba821..81265dbf91e2 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+@@ -682,6 +682,7 @@ static int otx2_add_flow_msg(struct otx2_nic *pfvf, struct otx2_flow *flow)
+ if (flow->flow_spec.flow_type & FLOW_RSS) {
+ req->op = NIX_RX_ACTIONOP_RSS;
+ req->index = flow->rss_ctx_id;
++ req->flow_key_alg = pfvf->hw.flowkey_alg_idx;
+ } else {
+ req->op = NIX_RX_ACTIONOP_UCAST;
+ req->index = ethtool_get_flow_spec_ring(ring_cookie);
+--
+2.30.2
+
--- /dev/null
+From 1cfe68e796c68e45a7ed95528bb0feb2c26699ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 17:32:22 +0530
+Subject: octeontx2-pf: send correct vlan priority mask to npc_install_flow_req
+
+From: Naveen Mamindlapalli <naveenm@marvell.com>
+
+[ Upstream commit 10df5a13ac6785b409ad749c4b10d4b220cc7e71 ]
+
+This patch corrects the erroneous vlan priority mask field that was
+send to npc_install_flow_req.
+
+Fixes: 1d4d9e42c240 ("octeontx2-pf: Add tc flower hardware offload on ingress traffic")
+Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+index 51157b283f6f..463d2368c118 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+@@ -385,8 +385,8 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic,
+ match.key->vlan_priority << 13;
+
+ vlan_tci_mask = match.mask->vlan_id |
+- match.key->vlan_dei << 12 |
+- match.key->vlan_priority << 13;
++ match.mask->vlan_dei << 12 |
++ match.mask->vlan_priority << 13;
+
+ flow_spec->vlan_tci = htons(vlan_tci);
+ flow_mask->vlan_tci = htons(vlan_tci_mask);
+--
+2.30.2
+
--- /dev/null
+From 81e472b651cc7e88476d87d0391cc190e1f17943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 17:54:28 +0200
+Subject: PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ]
+
+It is inconsistent to return PCI_D0 from pci_target_state() instead
+of the original target state if 'wakeup' is true and the device
+cannot signal PME from D0.
+
+This only happens when the device cannot signal PME from the original
+target state and any shallower power states (including D0) and that
+case is effectively equivalent to the one in which PME singaling is
+not supported at all. Since the original target state is returned in
+the latter case, make the function do that in the former one too.
+
+Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
+Fixes: 666ff6f83e1d ("PCI/PM: Avoid using device_may_wakeup() for runtime PM")
+Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
+Reported-by: Koba Ko <koba.ko@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 8d4ebe095d0c..75cab0142373 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2599,16 +2599,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)
+ if (dev->current_state == PCI_D3cold)
+ target_state = PCI_D3cold;
+
+- if (wakeup) {
++ if (wakeup && dev->pme_support) {
++ pci_power_t state = target_state;
++
+ /*
+ * Find the deepest state from which the device can generate
+ * PME#.
+ */
+- if (dev->pme_support) {
+- while (target_state
+- && !(dev->pme_support & (1 << target_state)))
+- target_state--;
+- }
++ while (state && !(dev->pme_support & (1 << state)))
++ state--;
++
++ if (state)
++ return state;
++ else if (dev->pme_support & 1)
++ return PCI_D0;
+ }
+
+ return target_state;
+--
+2.30.2
+
--- /dev/null
+From 857b42aaceece3741bd0bc99c1a5e068af51be3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 16:49:10 +0200
+Subject: PCI: PM: Enable PME if it can be signaled from D3cold
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ]
+
+PME signaling is only enabled by __pci_enable_wake() if the target
+device can signal PME from the given target power state (to avoid
+pointless reconfiguration of the device), but if the hierarchy above
+the device goes into D3cold, the device itself will end up in D3cold
+too, so if it can signal PME from D3cold, it should be enabled to
+do so in __pci_enable_wake().
+
+[Note that if the device does not end up in D3cold and it cannot
+ signal PME from the original target power state, it will not signal
+ PME, so in that case the behavior does not change.]
+
+Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
+Fixes: 5bcc2fb4e815 ("PCI PM: Simplify PCI wake-up code")
+Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
+Reported-by: Koba Ko <koba.ko@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 75cab0142373..a9d0530b7846 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2495,7 +2495,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable
+ if (enable) {
+ int error;
+
+- if (pci_pme_capable(dev, state))
++ /*
++ * Enable PME signaling if the device can signal PME from
++ * D3cold regardless of whether or not it can signal PME from
++ * the current target state, because that will allow it to
++ * signal PME when the hierarchy above it goes into D3cold and
++ * the device itself ends up in D3cold as a result of that.
++ */
++ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold))
+ pci_pme_active(dev, true);
+ else
+ ret = 1;
+--
+2.30.2
+
--- /dev/null
+From e9498db495466bd4c114ae42c265658df9b0de76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 21:14:31 +0100
+Subject: PM: cpu: Make notifier chain use a raw_spinlock_t
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit b2f6662ac08d0e7c25574ce53623c71bdae9dd78 ]
+
+Invoking atomic_notifier_chain_notify() requires acquiring a spinlock_t,
+which can block under CONFIG_PREEMPT_RT. Notifications for members of the
+cpu_pm notification chain will be issued by the idle task, which can never
+block.
+
+Making *all* atomic_notifiers use a raw_spinlock is too big of a hammer, as
+only notifications issued by the idle task are problematic.
+
+Special-case cpu_pm_notifier_chain by kludging a raw_notifier and
+raw_spinlock_t together, matching the atomic_notifier behavior with a
+raw_spinlock_t.
+
+Fixes: 70d932985757 ("notifier: Fix broken error handling pattern")
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cpu_pm.c | 50 +++++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 38 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
+index f7e1d0eccdbc..246efc74e3f3 100644
+--- a/kernel/cpu_pm.c
++++ b/kernel/cpu_pm.c
+@@ -13,19 +13,32 @@
+ #include <linux/spinlock.h>
+ #include <linux/syscore_ops.h>
+
+-static ATOMIC_NOTIFIER_HEAD(cpu_pm_notifier_chain);
++/*
++ * atomic_notifiers use a spinlock_t, which can block under PREEMPT_RT.
++ * Notifications for cpu_pm will be issued by the idle task itself, which can
++ * never block, IOW it requires using a raw_spinlock_t.
++ */
++static struct {
++ struct raw_notifier_head chain;
++ raw_spinlock_t lock;
++} cpu_pm_notifier = {
++ .chain = RAW_NOTIFIER_INIT(cpu_pm_notifier.chain),
++ .lock = __RAW_SPIN_LOCK_UNLOCKED(cpu_pm_notifier.lock),
++};
+
+ static int cpu_pm_notify(enum cpu_pm_event event)
+ {
+ int ret;
+
+ /*
+- * atomic_notifier_call_chain has a RCU read critical section, which
+- * could be disfunctional in cpu idle. Copy RCU_NONIDLE code to let
+- * RCU know this.
++ * This introduces a RCU read critical section, which could be
++ * disfunctional in cpu idle. Copy RCU_NONIDLE code to let RCU know
++ * this.
+ */
+ rcu_irq_enter_irqson();
+- ret = atomic_notifier_call_chain(&cpu_pm_notifier_chain, event, NULL);
++ rcu_read_lock();
++ ret = raw_notifier_call_chain(&cpu_pm_notifier.chain, event, NULL);
++ rcu_read_unlock();
+ rcu_irq_exit_irqson();
+
+ return notifier_to_errno(ret);
+@@ -33,10 +46,13 @@ static int cpu_pm_notify(enum cpu_pm_event event)
+
+ static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event event_down)
+ {
++ unsigned long flags;
+ int ret;
+
+ rcu_irq_enter_irqson();
+- ret = atomic_notifier_call_chain_robust(&cpu_pm_notifier_chain, event_up, event_down, NULL);
++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
++ ret = raw_notifier_call_chain_robust(&cpu_pm_notifier.chain, event_up, event_down, NULL);
++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+ rcu_irq_exit_irqson();
+
+ return notifier_to_errno(ret);
+@@ -49,12 +65,17 @@ static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event ev
+ * Add a driver to a list of drivers that are notified about
+ * CPU and CPU cluster low power entry and exit.
+ *
+- * This function may sleep, and has the same return conditions as
+- * raw_notifier_chain_register.
++ * This function has the same return conditions as raw_notifier_chain_register.
+ */
+ int cpu_pm_register_notifier(struct notifier_block *nb)
+ {
+- return atomic_notifier_chain_register(&cpu_pm_notifier_chain, nb);
++ unsigned long flags;
++ int ret;
++
++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
++ ret = raw_notifier_chain_register(&cpu_pm_notifier.chain, nb);
++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
+
+@@ -64,12 +85,17 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
+ *
+ * Remove a driver from the CPU PM notifier list.
+ *
+- * This function may sleep, and has the same return conditions as
+- * raw_notifier_chain_unregister.
++ * This function has the same return conditions as raw_notifier_chain_unregister.
+ */
+ int cpu_pm_unregister_notifier(struct notifier_block *nb)
+ {
+- return atomic_notifier_chain_unregister(&cpu_pm_notifier_chain, nb);
++ unsigned long flags;
++ int ret;
++
++ raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
++ ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb);
++ raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
++ return ret;
+ }
+ EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
+
+--
+2.30.2
+
--- /dev/null
+From 45874f08f83a3400d5d2c4962c3d10bd13035b8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 11:27:43 +0100
+Subject: PM: EM: Increase energy calculation precision
+
+From: Lukasz Luba <lukasz.luba@arm.com>
+
+[ Upstream commit 7fcc17d0cb12938d2b3507973a6f93fc9ed2c7a1 ]
+
+The Energy Model (EM) provides useful information about device power in
+each performance state to other subsystems like: Energy Aware Scheduler
+(EAS). The energy calculation in EAS does arithmetic operation based on
+the EM em_cpu_energy(). Current implementation of that function uses
+em_perf_state::cost as a pre-computed cost coefficient equal to:
+cost = power * max_frequency / frequency.
+The 'power' is expressed in milli-Watts (or in abstract scale).
+
+There are corner cases when the EAS energy calculation for two Performance
+Domains (PDs) return the same value. The EAS compares these values to
+choose smaller one. It might happen that this values are equal due to
+rounding error. In such scenario, we need better resolution, e.g. 1000
+times better. To provide this possibility increase the resolution in the
+em_perf_state::cost for 64-bit architectures. The cost of increasing
+resolution on 32-bit is pretty high (64-bit division) and is not justified
+since there are no new 32bit big.LITTLE EAS systems expected which would
+benefit from this higher resolution.
+
+This patch allows to avoid the rounding to milli-Watt errors, which might
+occur in EAS energy estimation for each PD. The rounding error is common
+for small tasks which have small utilization value.
+
+There are two places in the code where it makes a difference:
+1. In the find_energy_efficient_cpu() where we are searching for
+best_delta. We might suffer there when two PDs return the same result,
+like in the example below.
+
+Scenario:
+Low utilized system e.g. ~200 sum_util for PD0 and ~220 for PD1. There
+are quite a few small tasks ~10-15 util. These tasks would suffer for
+the rounding error. These utilization values are typical when running games
+on Android. One of our partners has reported 5..10mA less battery drain
+when running with increased resolution.
+
+Some details:
+We have two PDs: PD0 (big) and PD1 (little)
+Let's compare w/o patch set ('old') and w/ patch set ('new')
+We are comparing energy w/ task and w/o task placed in the PDs
+
+a) 'old' w/o patch set, PD0
+task_util = 13
+cost = 480
+sum_util_w/o_task = 215
+sum_util_w_task = 228
+scale_cpu = 1024
+energy_w/o_task = 480 * 215 / 1024 = 100.78 => 100
+energy_w_task = 480 * 228 / 1024 = 106.87 => 106
+energy_diff = 106 - 100 = 6
+(this is equal to 'old' PD1's energy_diff in 'c)')
+
+b) 'new' w/ patch set, PD0
+task_util = 13
+cost = 480 * 1000 = 480000
+sum_util_w/o_task = 215
+sum_util_w_task = 228
+energy_w/o_task = 480000 * 215 / 1024 = 100781
+energy_w_task = 480000 * 228 / 1024 = 106875
+energy_diff = 106875 - 100781 = 6094
+(this is not equal to 'new' PD1's energy_diff in 'd)')
+
+c) 'old' w/o patch set, PD1
+task_util = 13
+cost = 160
+sum_util_w/o_task = 283
+sum_util_w_task = 293
+scale_cpu = 355
+energy_w/o_task = 160 * 283 / 355 = 127.55 => 127
+energy_w_task = 160 * 296 / 355 = 133.41 => 133
+energy_diff = 133 - 127 = 6
+(this is equal to 'old' PD0's energy_diff in 'a)')
+
+d) 'new' w/ patch set, PD1
+task_util = 13
+cost = 160 * 1000 = 160000
+sum_util_w/o_task = 283
+sum_util_w_task = 293
+scale_cpu = 355
+energy_w/o_task = 160000 * 283 / 355 = 127549
+energy_w_task = 160000 * 296 / 355 = 133408
+energy_diff = 133408 - 127549 = 5859
+(this is not equal to 'new' PD0's energy_diff in 'b)')
+
+2. Difference in the 6% energy margin filter at the end of
+find_energy_efficient_cpu(). With this patch the margin comparison also
+has better resolution, so it's possible to have better task placement
+thanks to that.
+
+Fixes: 27871f7a8a341ef ("PM: Introduce an Energy Model management framework")
+Reported-by: CCJ Yeh <CCj.Yeh@mediatek.com>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/energy_model.h | 16 ++++++++++++++++
+ kernel/power/energy_model.c | 4 +++-
+ 2 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h
+index 757fc60658fa..d1e9823d99c8 100644
+--- a/include/linux/energy_model.h
++++ b/include/linux/energy_model.h
+@@ -53,6 +53,22 @@ struct em_perf_domain {
+ #ifdef CONFIG_ENERGY_MODEL
+ #define EM_MAX_POWER 0xFFFF
+
++/*
++ * Increase resolution of energy estimation calculations for 64-bit
++ * architectures. The extra resolution improves decision made by EAS for the
++ * task placement when two Performance Domains might provide similar energy
++ * estimation values (w/o better resolution the values could be equal).
++ *
++ * We increase resolution only if we have enough bits to allow this increased
++ * resolution (i.e. 64-bit). The costs for increasing resolution when 32-bit
++ * are pretty high and the returns do not justify the increased costs.
++ */
++#ifdef CONFIG_64BIT
++#define em_scale_power(p) ((p) * 1000)
++#else
++#define em_scale_power(p) (p)
++#endif
++
+ struct em_data_callback {
+ /**
+ * active_power() - Provide power at the next performance state of
+diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
+index 0f4530b3a8cd..a332ccd829e2 100644
+--- a/kernel/power/energy_model.c
++++ b/kernel/power/energy_model.c
+@@ -170,7 +170,9 @@ static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd,
+ /* Compute the cost of each performance state. */
+ fmax = (u64) table[nr_states - 1].frequency;
+ for (i = 0; i < nr_states; i++) {
+- table[i].cost = div64_u64(fmax * table[i].power,
++ unsigned long power_res = em_scale_power(table[i].power);
++
++ table[i].cost = div64_u64(fmax * power_res,
+ table[i].frequency);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a08e1e37c9f5b724bdcca33c7d0acfc15238789e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Jul 2021 14:55:10 +0200
+Subject: posix-cpu-timers: Force next expiration recalc after itimer reset
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit 406dd42bd1ba0c01babf9cde169bb319e52f6147 ]
+
+When an itimer deactivates a previously armed expiration, it simply doesn't
+do anything. As a result the process wide cputime counter keeps running and
+the tick dependency stays set until it reaches the old ghost expiration
+value.
+
+This can be reproduced with the following snippet:
+
+ void trigger_process_counter(void)
+ {
+ struct itimerval n = {};
+
+ n.it_value.tv_sec = 100;
+ setitimer(ITIMER_VIRTUAL, &n, NULL);
+ n.it_value.tv_sec = 0;
+ setitimer(ITIMER_VIRTUAL, &n, NULL);
+ }
+
+Fix this with resetting the relevant base expiration. This is similar to
+disarming a timer.
+
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20210726125513.271824-4-frederic@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/posix-cpu-timers.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
+index aa52fc85dbcb..a9f8d25220b1 100644
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -1346,8 +1346,6 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid,
+ }
+ }
+
+- if (!*newval)
+- return;
+ *newval += now;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From a6b1ef31cec0469ce1fa9b31b1748818a68cd76e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Aug 2021 15:30:59 +0200
+Subject: power: supply: axp288_fuel_gauge: Report register-address on readb /
+ writeb errors
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ]
+
+When fuel_gauge_reg_readb()/_writeb() fails, report which register we
+were trying to read / write when the error happened.
+
+Also reword the message a bit:
+- Drop the axp288 prefix, dev_err() already prints this
+- Switch from telegram / abbreviated style to a normal sentence, aligning
+ the message with those from fuel_gauge_read_*bit_word()
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp288_fuel_gauge.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
+index 37af0e216bc3..225adaffaa28 100644
+--- a/drivers/power/supply/axp288_fuel_gauge.c
++++ b/drivers/power/supply/axp288_fuel_gauge.c
+@@ -149,7 +149,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg)
+ }
+
+ if (ret < 0) {
+- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret);
++ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret);
+ return ret;
+ }
+
+@@ -163,7 +163,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val)
+ ret = regmap_write(info->regmap, reg, (unsigned int)val);
+
+ if (ret < 0)
+- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret);
++ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret);
+
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 624bfc21922936767cf233033fe136a86e83a6b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 23:05:16 +0100
+Subject: power: supply: cw2015: use dev_err_probe to allow deferred probe
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit ad1abe476995d97bfe7546ea91bb4f3dcdfbf3ab ]
+
+Deal with deferred probe using dev_err_probe so the error is handled
+and avoid logging lots probe defer information like the following:
+
+[ 9.125121] cw2015 4-0062: Failed to register power supply
+[ 9.211131] cw2015 4-0062: Failed to register power supply
+
+Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cw2015_battery.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
+index d110597746b0..091868e9e9e8 100644
+--- a/drivers/power/supply/cw2015_battery.c
++++ b/drivers/power/supply/cw2015_battery.c
+@@ -679,7 +679,9 @@ static int cw_bat_probe(struct i2c_client *client)
+ &cw2015_bat_desc,
+ &psy_cfg);
+ if (IS_ERR(cw_bat->rk_bat)) {
+- dev_err(cw_bat->dev, "Failed to register power supply\n");
++ /* try again if this happens */
++ dev_err_probe(&client->dev, PTR_ERR(cw_bat->rk_bat),
++ "Failed to register power supply\n");
+ return PTR_ERR(cw_bat->rk_bat);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1f8647090bbbf37abe4d365e213d55ed6e63cec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 18:50:14 +0200
+Subject: power: supply: max17042_battery: fix typo in MAx17042_TOFF
+
+From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+
+[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ]
+
+Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/max17042_battery.c | 2 +-
+ include/linux/power/max17042_battery.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
+index ce2041b30a06..215e77d3b6d9 100644
+--- a/drivers/power/supply/max17042_battery.c
++++ b/drivers/power/supply/max17042_battery.c
+@@ -748,7 +748,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)
+ struct max17042_config_data *config = chip->pdata->config_data;
+
+ max17042_override_por(map, MAX17042_TGAIN, config->tgain);
+- max17042_override_por(map, MAx17042_TOFF, config->toff);
++ max17042_override_por(map, MAX17042_TOFF, config->toff);
+ max17042_override_por(map, MAX17042_CGAIN, config->cgain);
+ max17042_override_por(map, MAX17042_COFF, config->coff);
+
+diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h
+index d55c746ac56e..e00ad1cfb1f1 100644
+--- a/include/linux/power/max17042_battery.h
++++ b/include/linux/power/max17042_battery.h
+@@ -69,7 +69,7 @@ enum max17042_register {
+ MAX17042_RelaxCFG = 0x2A,
+ MAX17042_MiscCFG = 0x2B,
+ MAX17042_TGAIN = 0x2C,
+- MAx17042_TOFF = 0x2D,
++ MAX17042_TOFF = 0x2D,
+ MAX17042_CGAIN = 0x2E,
+ MAX17042_COFF = 0x2F,
+
+--
+2.30.2
+
--- /dev/null
+From 0a27666b9cf12c8ea2803ee0feab90b28e28ac0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Jul 2021 20:38:38 +0300
+Subject: power: supply: smb347-charger: Add missing pin control activation
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit efe2175478d5237949e33c84d9a722fc084b218c ]
+
+Pin control needs to be activated by setting the enable bit, otherwise
+hardware rejects all pin changes. Previously this stayed unnoticed on
+Nexus 7 because pin control was enabled by default after rebooting from
+downstream kernel, which uses driver that enables the bit and charger
+registers are non-volatile until power supply (battery) is disconnected.
+Configure the pin control enable bit. This fixes the potentially
+never-enabled charging on devices that use pin control.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/smb347-charger.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c
+index 3376f42d46c3..25d239f2330e 100644
+--- a/drivers/power/supply/smb347-charger.c
++++ b/drivers/power/supply/smb347-charger.c
+@@ -56,6 +56,7 @@
+ #define CFG_PIN_EN_CTRL_ACTIVE_LOW 0x60
+ #define CFG_PIN_EN_APSD_IRQ BIT(1)
+ #define CFG_PIN_EN_CHARGER_ERROR BIT(2)
++#define CFG_PIN_EN_CTRL BIT(4)
+ #define CFG_THERM 0x07
+ #define CFG_THERM_SOFT_HOT_COMPENSATION_MASK 0x03
+ #define CFG_THERM_SOFT_HOT_COMPENSATION_SHIFT 0
+@@ -725,6 +726,15 @@ static int smb347_hw_init(struct smb347_charger *smb)
+ if (ret < 0)
+ goto fail;
+
++ /* Activate pin control, making it writable. */
++ switch (smb->enable_control) {
++ case SMB3XX_CHG_ENABLE_PIN_ACTIVE_LOW:
++ case SMB3XX_CHG_ENABLE_PIN_ACTIVE_HIGH:
++ ret = regmap_set_bits(smb->regmap, CFG_PIN, CFG_PIN_EN_CTRL);
++ if (ret < 0)
++ goto fail;
++ }
++
+ /*
+ * Make the charging functionality controllable by a write to the
+ * command register unless pin control is specified in the platform
+--
+2.30.2
+
--- /dev/null
+From 8fdedf9e44a2594a6407c8d7b7656d60464bcc56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 May 2021 17:50:10 +0800
+Subject: rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
+
+From: Yanfei Xu <yanfei.xu@windriver.com>
+
+[ Upstream commit dc87740c8a6806bd2162bfb441770e4e53be5601 ]
+
+If rcu_print_task_stall() is invoked on an rcu_node structure that does
+not contain any tasks blocking the current grace period, it takes an
+early exit that fails to release that rcu_node structure's lock. This
+results in a self-deadlock, which is detected by lockdep.
+
+To reproduce this bug:
+
+tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 3 --trust-make --configs "TREE03" --kconfig "CONFIG_PROVE_LOCKING=y" --bootargs "rcutorture.stall_cpu=30 rcutorture.stall_cpu_block=1 rcutorture.fwd_progress=0 rcutorture.test_boost=0"
+
+This will also result in other complaints, including RCU's scheduler
+hook complaining about blocking rather than preemption and an rcutorture
+writer stall.
+
+Only a partial RCU CPU stall warning message will be printed because of
+the self-deadlock.
+
+This commit therefore releases the lock on the rcu_print_task_stall()
+function's early exit path.
+
+Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled")
+Tested-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_stall.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
+index f1e011d4a899..c615fd153cb2 100644
+--- a/kernel/rcu/tree_stall.h
++++ b/kernel/rcu/tree_stall.h
+@@ -269,8 +269,10 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
+ struct task_struct *ts[8];
+
+ lockdep_assert_irqs_disabled();
+- if (!rcu_preempt_blocked_readers_cgp(rnp))
++ if (!rcu_preempt_blocked_readers_cgp(rnp)) {
++ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+ return 0;
++ }
+ pr_err("\tTasks blocked on level-%d rcu_node (CPUs %d-%d):",
+ rnp->level, rnp->grplo, rnp->grphi);
+ t = list_entry(rnp->gp_tasks->prev,
+--
+2.30.2
+
--- /dev/null
+From 8108bddbb7e3a1917fbb11699010809409c2a858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 May 2021 00:45:11 +0800
+Subject: rcu: Fix to include first blocked task in stall warning
+
+From: Yanfei Xu <yanfei.xu@windriver.com>
+
+[ Upstream commit e6a901a44f76878ed1653626c9ff4cfc5a3f58f8 ]
+
+The for loop in rcu_print_task_stall() always omits ts[0], which points
+to the first task blocking the stalled grace period. This in turn fails
+to count this first task, which means that ndetected will be equal to
+zero when all CPUs have passed through their quiescent states and only
+one task is blocking the stalled grace period. This zero value for
+ndetected will in turn result in an incorrect "All QSes seen" message:
+
+rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
+rcu: Tasks blocked on level-1 rcu_node (CPUs 12-23):
+ (detected by 15, t=6504 jiffies, g=164777, q=9011209)
+rcu: All QSes seen, last rcu_preempt kthread activity 1 (4295252379-4295252378), jiffies_till_next_fqs=1, root ->qsmask 0x2
+BUG: sleeping function called from invalid context at include/linux/uaccess.h:156
+in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 70613, name: msgstress04
+INFO: lockdep is turned off.
+Preemption disabled at:
+[<ffff8000104031a4>] create_object.isra.0+0x204/0x4b0
+CPU: 15 PID: 70613 Comm: msgstress04 Kdump: loaded Not tainted
+5.12.2-yoctodev-standard #1
+Hardware name: Marvell OcteonTX CN96XX board (DT)
+Call trace:
+ dump_backtrace+0x0/0x2cc
+ show_stack+0x24/0x30
+ dump_stack+0x110/0x188
+ ___might_sleep+0x214/0x2d0
+ __might_sleep+0x7c/0xe0
+
+This commit therefore fixes the loop to include ts[0].
+
+Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled")
+Tested-by: Qais Yousef <qais.yousef@arm.com>
+Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_stall.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
+index 4aaa4a12e95f..f1e011d4a899 100644
+--- a/kernel/rcu/tree_stall.h
++++ b/kernel/rcu/tree_stall.h
+@@ -282,8 +282,8 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
+ break;
+ }
+ raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
+- for (i--; i; i--) {
+- t = ts[i];
++ while (i) {
++ t = ts[--i];
+ if (!try_invoke_on_locked_down_task(t, check_slow_task, &rscr))
+ pr_cont(" P%d", t->pid);
+ else
+--
+2.30.2
+
--- /dev/null
+From 91569f27567adab40775e4dc28dcac04fd049f12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 May 2021 00:56:23 +0900
+Subject: rcu/tree: Handle VM stoppage in stall detection
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit ccfc9dd6914feaa9a81f10f9cce56eb0f7712264 ]
+
+The soft watchdog timer function checks if a virtual machine
+was suspended and hence what looks like a lockup in fact
+is a false positive.
+
+This is what kvm_check_and_clear_guest_paused() does: it
+tests guest PVCLOCK_GUEST_STOPPED (which is set by the host)
+and if it's set then we need to touch all watchdogs and bail
+out.
+
+Watchdog timer function runs from IRQ, so PVCLOCK_GUEST_STOPPED
+check works fine.
+
+There is, however, one more watchdog that runs from IRQ, so
+watchdog timer fn races with it, and that watchdog is not aware
+of PVCLOCK_GUEST_STOPPED - RCU stall detector.
+
+apic_timer_interrupt()
+ smp_apic_timer_interrupt()
+ hrtimer_interrupt()
+ __hrtimer_run_queues()
+ tick_sched_timer()
+ tick_sched_handle()
+ update_process_times()
+ rcu_sched_clock_irq()
+
+This triggers RCU stalls on our devices during VM resume.
+
+If tick_sched_handle()->rcu_sched_clock_irq() runs on a VCPU
+before watchdog_timer_fn()->kvm_check_and_clear_guest_paused()
+then there is nothing on this VCPU that touches watchdogs and
+RCU reads stale gp stall timestamp and new jiffies value, which
+makes it think that RCU has stalled.
+
+Make RCU stall watchdog aware of PVCLOCK_GUEST_STOPPED and
+don't report RCU stalls when we resume the VM.
+
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_stall.h | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
+index 59b95cc5cbdf..4aaa4a12e95f 100644
+--- a/kernel/rcu/tree_stall.h
++++ b/kernel/rcu/tree_stall.h
+@@ -7,6 +7,8 @@
+ * Author: Paul E. McKenney <paulmck@linux.ibm.com>
+ */
+
++#include <linux/kvm_para.h>
++
+ //////////////////////////////////////////////////////////////////////////////
+ //
+ // Controlling CPU stall warnings, including delay calculation.
+@@ -695,6 +697,14 @@ static void check_cpu_stall(struct rcu_data *rdp)
+ (READ_ONCE(rnp->qsmask) & rdp->grpmask) &&
+ cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) {
+
++ /*
++ * If a virtual machine is stopped by the host it can look to
++ * the watchdog like an RCU stall. Check to see if the host
++ * stopped the vm.
++ */
++ if (kvm_check_and_clear_guest_paused())
++ return;
++
+ /* We haven't checked in, so go dump stack. */
+ print_cpu_stall(gps);
+ if (READ_ONCE(rcu_cpu_stall_ftrace_dump))
+@@ -704,6 +714,14 @@ static void check_cpu_stall(struct rcu_data *rdp)
+ ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) &&
+ cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) {
+
++ /*
++ * If a virtual machine is stopped by the host it can look to
++ * the watchdog like an RCU stall. Check to see if the host
++ * stopped the vm.
++ */
++ if (kvm_check_and_clear_guest_paused())
++ return;
++
+ /* They had a few time units to dump stack, so complain. */
+ print_other_cpu_stall(gs2, gps);
+ if (READ_ONCE(rcu_cpu_stall_ftrace_dump))
+--
+2.30.2
+
--- /dev/null
+From 405e636f62268e1a33e9ee47e395c24940d7c33f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 23:26:30 +0900
+Subject: regmap: fix the offset of register error log
+
+From: Jeongtae Park <jeongtae.park@gmail.com>
+
+[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ]
+
+This patch fixes the offset of register error log
+by using regmap_get_offset().
+
+Signed-off-by: Jeongtae Park <jeongtae.park@gmail.com>
+Link: https://lore.kernel.org/r/20210701142630.44936-1-jeongtae.park@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 297e95be25b3..cf1dca0cde2c 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1652,7 +1652,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
+ if (ret) {
+ dev_err(map->dev,
+ "Error in caching of register: %x ret: %d\n",
+- reg + i, ret);
++ reg + regmap_get_offset(map, i), ret);
+ return ret;
+ }
+ }
+--
+2.30.2
+
--- /dev/null
+From 1c3f8dcfc9693d1118c1727105dbf6e096a4e67d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Jul 2021 23:12:11 +0300
+Subject: regulator: tps65910: Silence deferred probe error
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit e301df76472cc929fa62d923bc3892931f7ad71d ]
+
+The TPS65910 regulator now gets a deferred probe until supply regulator is
+registered. Silence noisy error message about the deferred probe.
+
+Reported-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
+Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20210705201211.16082-1-digetx@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 1d5b0a1b86f7..06cbe60c990f 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1211,12 +1211,10 @@ static int tps65910_probe(struct platform_device *pdev)
+
+ rdev = devm_regulator_register(&pdev->dev, &pmic->desc[i],
+ &config);
+- if (IS_ERR(rdev)) {
+- dev_err(tps65910->dev,
+- "failed to register %s regulator\n",
+- pdev->name);
+- return PTR_ERR(rdev);
+- }
++ if (IS_ERR(rdev))
++ return dev_err_probe(tps65910->dev, PTR_ERR(rdev),
++ "failed to register %s regulator\n",
++ pdev->name);
+
+ /* Save regulator for cleanup */
+ pmic->rdev[i] = rdev;
+--
+2.30.2
+
--- /dev/null
+From 7a4cd9ed5e8d540976d61d03d967709189b644ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 11:37:04 +0800
+Subject: regulator: vctrl: Avoid lockdep warning in enable/disable ops
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 21e39809fd7c4b8ff3662f23e0168e87594c8ca8 ]
+
+vctrl_enable() and vctrl_disable() call regulator_enable() and
+regulator_disable(), respectively. However, vctrl_* are regulator ops
+and should not be calling the locked regulator APIs. Doing so results in
+a lockdep warning.
+
+Instead of exporting more internal regulator ops, model the ctrl supply
+as an actual supply to vctrl-regulator. At probe time this driver still
+needs to use the consumer API to fetch its constraints, but otherwise
+lets the regulator core handle the upstream supply for it.
+
+The enable/disable/is_enabled ops are not removed, but now only track
+state internally. This preserves the original behavior with the ops
+being available, but one could argue that the original behavior was
+already incorrect: the internal state would not match the upstream
+supply if that supply had another consumer that enabled the supply,
+while vctrl-regulator was not enabled.
+
+The lockdep warning is as follows:
+
+ WARNING: possible circular locking dependency detected
+ 5.14.0-rc6 #2 Not tainted
+ ------------------------------------------------------
+ swapper/0/1 is trying to acquire lock:
+ ffffffc011306d00 (regulator_list_mutex){+.+.}-{3:3}, at:
+ regulator_lock_dependent (arch/arm64/include/asm/current.h:19
+ include/linux/ww_mutex.h:111
+ drivers/regulator/core.c:329)
+
+ but task is already holding lock:
+ ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
+ regulator_lock_recursive (drivers/regulator/core.c:156
+ drivers/regulator/core.c:263)
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 (regulator_ww_class_mutex){+.+.}-{3:3}:
+ __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
+ include/asm-generic/atomic-long.h:29
+ kernel/locking/mutex.c:103
+ kernel/locking/mutex.c:144
+ kernel/locking/mutex.c:963)
+ ww_mutex_lock (kernel/locking/mutex.c:1199)
+ regulator_lock_recursive (drivers/regulator/core.c:156
+ drivers/regulator/core.c:263)
+ regulator_lock_dependent (drivers/regulator/core.c:343)
+ regulator_enable (drivers/regulator/core.c:2808)
+ set_machine_constraints (drivers/regulator/core.c:1536)
+ regulator_register (drivers/regulator/core.c:5486)
+ devm_regulator_register (drivers/regulator/devres.c:196)
+ reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
+ platform_probe (drivers/base/platform.c:1427)
+ [...]
+
+ -> #1 (regulator_ww_class_acquire){+.+.}-{0:0}:
+ regulator_lock_dependent (include/linux/ww_mutex.h:129
+ drivers/regulator/core.c:329)
+ regulator_enable (drivers/regulator/core.c:2808)
+ set_machine_constraints (drivers/regulator/core.c:1536)
+ regulator_register (drivers/regulator/core.c:5486)
+ devm_regulator_register (drivers/regulator/devres.c:196)
+ reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
+ [...]
+
+ -> #0 (regulator_list_mutex){+.+.}-{3:3}:
+ __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
+ kernel/locking/lockdep.c:3174 (discriminator 4)
+ kernel/locking/lockdep.c:3789 (discriminator 4)
+ kernel/locking/lockdep.c:5015 (discriminator 4))
+ lock_acquire (arch/arm64/include/asm/percpu.h:39
+ kernel/locking/lockdep.c:438
+ kernel/locking/lockdep.c:5627)
+ __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
+ include/asm-generic/atomic-long.h:29
+ kernel/locking/mutex.c:103
+ kernel/locking/mutex.c:144
+ kernel/locking/mutex.c:963)
+ mutex_lock_nested (kernel/locking/mutex.c:1125)
+ regulator_lock_dependent (arch/arm64/include/asm/current.h:19
+ include/linux/ww_mutex.h:111
+ drivers/regulator/core.c:329)
+ regulator_enable (drivers/regulator/core.c:2808)
+ vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
+ _regulator_do_enable (drivers/regulator/core.c:2617)
+ _regulator_enable (drivers/regulator/core.c:2764)
+ regulator_enable (drivers/regulator/core.c:308
+ drivers/regulator/core.c:2809)
+ _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
+ dev_pm_opp_set_rate (drivers/opp/core.c:1164)
+ set_target (drivers/cpufreq/cpufreq-dt.c:62)
+ __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
+ drivers/cpufreq/cpufreq.c:2271)
+ cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
+ cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
+ subsys_interface_register (drivers/base/bus.c:?)
+ cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
+ dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
+ [...]
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ regulator_list_mutex --> regulator_ww_class_acquire --> regulator_ww_class_mutex
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(regulator_ww_class_mutex);
+ lock(regulator_ww_class_acquire);
+ lock(regulator_ww_class_mutex);
+ lock(regulator_list_mutex);
+
+ *** DEADLOCK ***
+
+ 6 locks held by swapper/0/1:
+ #0: ffffff8002d32188 (&dev->mutex){....}-{3:3}, at:
+ __device_driver_lock (drivers/base/dd.c:1030)
+ #1: ffffffc0111a0520 (cpu_hotplug_lock){++++}-{0:0}, at:
+ cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2792 (discriminator 2))
+ #2: ffffff8002a8d918 (subsys mutex#9){+.+.}-{3:3}, at:
+ subsys_interface_register (drivers/base/bus.c:1033)
+ #3: ffffff800341bb90 (&policy->rwsem){+.+.}-{3:3}, at:
+ cpufreq_online (include/linux/bitmap.h:285
+ include/linux/cpumask.h:405
+ drivers/cpufreq/cpufreq.c:1399)
+ #4: ffffffc011f0b7b8 (regulator_ww_class_acquire){+.+.}-{0:0}, at:
+ regulator_enable (drivers/regulator/core.c:2808)
+ #5: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
+ regulator_lock_recursive (drivers/regulator/core.c:156
+ drivers/regulator/core.c:263)
+
+ stack backtrace:
+ CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6 #2 7c8f8996d021ed0f65271e6aeebf7999de74a9fa
+ Hardware name: Google Scarlet (DT)
+ Call trace:
+ dump_backtrace (arch/arm64/kernel/stacktrace.c:161)
+ show_stack (arch/arm64/kernel/stacktrace.c:218)
+ dump_stack_lvl (lib/dump_stack.c:106 (discriminator 2))
+ dump_stack (lib/dump_stack.c:113)
+ print_circular_bug (kernel/locking/lockdep.c:?)
+ check_noncircular (kernel/locking/lockdep.c:?)
+ __lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
+ kernel/locking/lockdep.c:3174 (discriminator 4)
+ kernel/locking/lockdep.c:3789 (discriminator 4)
+ kernel/locking/lockdep.c:5015 (discriminator 4))
+ lock_acquire (arch/arm64/include/asm/percpu.h:39
+ kernel/locking/lockdep.c:438
+ kernel/locking/lockdep.c:5627)
+ __mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
+ include/asm-generic/atomic-long.h:29
+ kernel/locking/mutex.c:103
+ kernel/locking/mutex.c:144
+ kernel/locking/mutex.c:963)
+ mutex_lock_nested (kernel/locking/mutex.c:1125)
+ regulator_lock_dependent (arch/arm64/include/asm/current.h:19
+ include/linux/ww_mutex.h:111
+ drivers/regulator/core.c:329)
+ regulator_enable (drivers/regulator/core.c:2808)
+ vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
+ _regulator_do_enable (drivers/regulator/core.c:2617)
+ _regulator_enable (drivers/regulator/core.c:2764)
+ regulator_enable (drivers/regulator/core.c:308
+ drivers/regulator/core.c:2809)
+ _set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
+ dev_pm_opp_set_rate (drivers/opp/core.c:1164)
+ set_target (drivers/cpufreq/cpufreq-dt.c:62)
+ __cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
+ drivers/cpufreq/cpufreq.c:2271)
+ cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
+ cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
+ subsys_interface_register (drivers/base/bus.c:?)
+ cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
+ dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
+ [...]
+
+Reported-by: Brian Norris <briannorris@chromium.org>
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20210825033704.3307263-3-wenst@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/vctrl-regulator.c | 72 +++++++++++++++++------------
+ 1 file changed, 42 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
+index 93d33201ffe0..d2a37978fc3a 100644
+--- a/drivers/regulator/vctrl-regulator.c
++++ b/drivers/regulator/vctrl-regulator.c
+@@ -37,7 +37,6 @@ struct vctrl_voltage_table {
+ struct vctrl_data {
+ struct regulator_dev *rdev;
+ struct regulator_desc desc;
+- struct regulator *ctrl_reg;
+ bool enabled;
+ unsigned int min_slew_down_rate;
+ unsigned int ovp_threshold;
+@@ -82,7 +81,12 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV)
+ static int vctrl_get_voltage(struct regulator_dev *rdev)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
++ int ctrl_uV;
++
++ if (!rdev->supply)
++ return -EPROBE_DEFER;
++
++ ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev);
+
+ return vctrl_calc_output_voltage(vctrl, ctrl_uV);
+ }
+@@ -92,14 +96,19 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ unsigned int *selector)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- struct regulator *ctrl_reg = vctrl->ctrl_reg;
+- int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev);
+- int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
++ int orig_ctrl_uV;
++ int uV;
+ int ret;
+
++ if (!rdev->supply)
++ return -EPROBE_DEFER;
++
++ orig_ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev);
++ uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
++
+ if (req_min_uV >= uV || !vctrl->ovp_threshold)
+ /* voltage rising or no OVP */
+- return regulator_set_voltage_rdev(ctrl_reg->rdev,
++ return regulator_set_voltage_rdev(rdev->supply->rdev,
+ vctrl_calc_ctrl_voltage(vctrl, req_min_uV),
+ vctrl_calc_ctrl_voltage(vctrl, req_max_uV),
+ PM_SUSPEND_ON);
+@@ -117,7 +126,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ next_uV = max_t(int, req_min_uV, uV - max_drop_uV);
+ next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV);
+
+- ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++ ret = regulator_set_voltage_rdev(rdev->supply->rdev,
+ next_ctrl_uV,
+ next_ctrl_uV,
+ PM_SUSPEND_ON);
+@@ -134,7 +143,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+
+ err:
+ /* Try to go back to original voltage */
+- regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV,
++ regulator_set_voltage_rdev(rdev->supply->rdev, orig_ctrl_uV, orig_ctrl_uV,
+ PM_SUSPEND_ON);
+
+ return ret;
+@@ -151,16 +160,18 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ unsigned int selector)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- struct regulator *ctrl_reg = vctrl->ctrl_reg;
+ unsigned int orig_sel = vctrl->sel;
+ int ret;
+
++ if (!rdev->supply)
++ return -EPROBE_DEFER;
++
+ if (selector >= rdev->desc->n_voltages)
+ return -EINVAL;
+
+ if (selector >= vctrl->sel || !vctrl->ovp_threshold) {
+ /* voltage rising or no OVP */
+- ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++ ret = regulator_set_voltage_rdev(rdev->supply->rdev,
+ vctrl->vtable[selector].ctrl,
+ vctrl->vtable[selector].ctrl,
+ PM_SUSPEND_ON);
+@@ -179,7 +190,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ else
+ next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel;
+
+- ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++ ret = regulator_set_voltage_rdev(rdev->supply->rdev,
+ vctrl->vtable[next_sel].ctrl,
+ vctrl->vtable[next_sel].ctrl,
+ PM_SUSPEND_ON);
+@@ -202,7 +213,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ err:
+ if (vctrl->sel != orig_sel) {
+ /* Try to go back to original voltage */
+- if (!regulator_set_voltage_rdev(ctrl_reg->rdev,
++ if (!regulator_set_voltage_rdev(rdev->supply->rdev,
+ vctrl->vtable[orig_sel].ctrl,
+ vctrl->vtable[orig_sel].ctrl,
+ PM_SUSPEND_ON))
+@@ -234,10 +245,6 @@ static int vctrl_parse_dt(struct platform_device *pdev,
+ u32 pval;
+ u32 vrange_ctrl[2];
+
+- vctrl->ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl");
+- if (IS_ERR(vctrl->ctrl_reg))
+- return PTR_ERR(vctrl->ctrl_reg);
+-
+ ret = of_property_read_u32(np, "ovp-threshold-percent", &pval);
+ if (!ret) {
+ vctrl->ovp_threshold = pval;
+@@ -315,11 +322,11 @@ static int vctrl_cmp_ctrl_uV(const void *a, const void *b)
+ return at->ctrl - bt->ctrl;
+ }
+
+-static int vctrl_init_vtable(struct platform_device *pdev)
++static int vctrl_init_vtable(struct platform_device *pdev,
++ struct regulator *ctrl_reg)
+ {
+ struct vctrl_data *vctrl = platform_get_drvdata(pdev);
+ struct regulator_desc *rdesc = &vctrl->desc;
+- struct regulator *ctrl_reg = vctrl->ctrl_reg;
+ struct vctrl_voltage_range *vrange_ctrl = &vctrl->vrange.ctrl;
+ int n_voltages;
+ int ctrl_uV;
+@@ -395,23 +402,19 @@ static int vctrl_init_vtable(struct platform_device *pdev)
+ static int vctrl_enable(struct regulator_dev *rdev)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- int ret = regulator_enable(vctrl->ctrl_reg);
+
+- if (!ret)
+- vctrl->enabled = true;
++ vctrl->enabled = true;
+
+- return ret;
++ return 0;
+ }
+
+ static int vctrl_disable(struct regulator_dev *rdev)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- int ret = regulator_disable(vctrl->ctrl_reg);
+
+- if (!ret)
+- vctrl->enabled = false;
++ vctrl->enabled = false;
+
+- return ret;
++ return 0;
+ }
+
+ static int vctrl_is_enabled(struct regulator_dev *rdev)
+@@ -447,6 +450,7 @@ static int vctrl_probe(struct platform_device *pdev)
+ struct regulator_desc *rdesc;
+ struct regulator_config cfg = { };
+ struct vctrl_voltage_range *vrange_ctrl;
++ struct regulator *ctrl_reg;
+ int ctrl_uV;
+ int ret;
+
+@@ -461,15 +465,20 @@ static int vctrl_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
++ ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl");
++ if (IS_ERR(ctrl_reg))
++ return PTR_ERR(ctrl_reg);
++
+ vrange_ctrl = &vctrl->vrange.ctrl;
+
+ rdesc = &vctrl->desc;
+ rdesc->name = "vctrl";
+ rdesc->type = REGULATOR_VOLTAGE;
+ rdesc->owner = THIS_MODULE;
++ rdesc->supply_name = "ctrl";
+
+- if ((regulator_get_linear_step(vctrl->ctrl_reg) == 1) ||
+- (regulator_count_voltages(vctrl->ctrl_reg) == -EINVAL)) {
++ if ((regulator_get_linear_step(ctrl_reg) == 1) ||
++ (regulator_count_voltages(ctrl_reg) == -EINVAL)) {
+ rdesc->continuous_voltage_range = true;
+ rdesc->ops = &vctrl_ops_cont;
+ } else {
+@@ -486,12 +495,12 @@ static int vctrl_probe(struct platform_device *pdev)
+ cfg.init_data = init_data;
+
+ if (!rdesc->continuous_voltage_range) {
+- ret = vctrl_init_vtable(pdev);
++ ret = vctrl_init_vtable(pdev, ctrl_reg);
+ if (ret)
+ return ret;
+
+ /* Use locked consumer API when not in regulator framework */
+- ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
++ ctrl_uV = regulator_get_voltage(ctrl_reg);
+ if (ctrl_uV < 0) {
+ dev_err(&pdev->dev, "failed to get control voltage\n");
+ return ctrl_uV;
+@@ -514,6 +523,9 @@ static int vctrl_probe(struct platform_device *pdev)
+ }
+ }
+
++ /* Drop ctrl-supply here in favor of regulator core managed supply */
++ devm_regulator_put(ctrl_reg);
++
+ vctrl->rdev = devm_regulator_register(&pdev->dev, rdesc, &cfg);
+ if (IS_ERR(vctrl->rdev)) {
+ ret = PTR_ERR(vctrl->rdev);
+--
+2.30.2
+
--- /dev/null
+From d94d9fa747f8f2c5f203c6e606e66bffd53d1c5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 11:37:03 +0800
+Subject: regulator: vctrl: Use locked regulator_get_voltage in probe path
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 98e47570ba985f2310586c80409238200fa3170f ]
+
+In commit e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting
+and setting the voltage"), all calls to get/set the voltage of the
+control regulator were switched to unlocked versions to avoid deadlocks.
+However, the call in the probe path is done without regulator locks
+held. In this case the locked version should be used.
+
+Switch back to the locked regulator_get_voltage() in the probe path to
+avoid any mishaps.
+
+Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20210825033704.3307263-2-wenst@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/vctrl-regulator.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
+index cbadb1c99679..93d33201ffe0 100644
+--- a/drivers/regulator/vctrl-regulator.c
++++ b/drivers/regulator/vctrl-regulator.c
+@@ -490,7 +490,8 @@ static int vctrl_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
++ /* Use locked consumer API when not in regulator framework */
++ ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
+ if (ctrl_uV < 0) {
+ dev_err(&pdev->dev, "failed to get control voltage\n");
+ return ctrl_uV;
+--
+2.30.2
+
--- /dev/null
+From 9e5b18d876534100837d13412c6e1558490a2eca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 21:39:47 +0300
+Subject: rsi: fix an error code in rsi_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9adcdf6758d7c4c9bdaf22d78eb9fcae260ed113 ]
+
+Return -ENODEV instead of success for unsupported devices.
+
+Fixes: 54fdb318c111 ("rsi: add new device model for 9116")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210816183947.GA2119@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 3fbe2a3c1455..416976f09888 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -816,6 +816,7 @@ static int rsi_probe(struct usb_interface *pfunction,
+ } else {
+ rsi_dbg(ERR_ZONE, "%s: Unsupported RSI device id 0x%x\n",
+ __func__, id->idProduct);
++ status = -ENODEV;
+ goto err1;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 11aba246b0e07b92ea4573950baac106f0014a53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 13:37:46 +0300
+Subject: rsi: fix error code in rsi_load_9116_firmware()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d0f8430332a16c7baa80ce2886339182c5d85f37 ]
+
+This code returns success if the kmemdup() fails, but obviously it
+should return -ENOMEM instead.
+
+Fixes: e5a1ecc97e5f ("rsi: add firmware loading for 9116 device")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20210805103746.GA26417@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index 99b21a2c8386..f4a26f16f00f 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter)
+ }
+
+ ta_firmware = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
+- if (!ta_firmware)
++ if (!ta_firmware) {
++ status = -ENOMEM;
+ goto fail_release_fw;
++ }
+ fw_p = ta_firmware;
+ instructions_sz = fw_entry->size;
+ rsi_dbg(INFO_ZONE, "FW Length = %d bytes\n", instructions_sz);
+--
+2.30.2
+
--- /dev/null
+From 72238af516d6a18c5e6d349cf15987761b26655b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 10:55:02 +0200
+Subject: s390/ap: fix state machine hang after failure to enable irq
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit cabebb697c98fb1f05cc950a747a9b6ec61a5b01 ]
+
+If for any reason the interrupt enable for an ap queue fails the
+state machine run for the queue returned wrong return codes to the
+caller. So the caller assumed interrupt support for this queue in
+enabled and thus did not re-establish the high resolution timer used
+for polling. In the end this let to a hang for the user space process
+waiting "forever" for the reply.
+
+This patch reworks these return codes to return correct indications
+for the caller to re-establish the timer when a queue runs without
+interrupt support.
+
+Please note that this is fixing a wrong behavior after a first
+failure (enable interrupt support for the queue) failed. However,
+looks like this occasionally happens on KVM systems.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_bus.c | 25 ++++++++-----------------
+ drivers/s390/crypto/ap_bus.h | 10 ++--------
+ drivers/s390/crypto/ap_queue.c | 20 +++++++++++---------
+ 3 files changed, 21 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index 2758d05a802d..179ceb01e040 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -121,22 +121,13 @@ static struct bus_type ap_bus_type;
+ /* Adapter interrupt definitions */
+ static void ap_interrupt_handler(struct airq_struct *airq, bool floating);
+
+-static int ap_airq_flag;
++static bool ap_irq_flag;
+
+ static struct airq_struct ap_airq = {
+ .handler = ap_interrupt_handler,
+ .isc = AP_ISC,
+ };
+
+-/**
+- * ap_using_interrupts() - Returns non-zero if interrupt support is
+- * available.
+- */
+-static inline int ap_using_interrupts(void)
+-{
+- return ap_airq_flag;
+-}
+-
+ /**
+ * ap_airq_ptr() - Get the address of the adapter interrupt indicator
+ *
+@@ -146,7 +137,7 @@ static inline int ap_using_interrupts(void)
+ */
+ void *ap_airq_ptr(void)
+ {
+- if (ap_using_interrupts())
++ if (ap_irq_flag)
+ return ap_airq.lsi_ptr;
+ return NULL;
+ }
+@@ -376,7 +367,7 @@ void ap_wait(enum ap_sm_wait wait)
+ switch (wait) {
+ case AP_SM_WAIT_AGAIN:
+ case AP_SM_WAIT_INTERRUPT:
+- if (ap_using_interrupts())
++ if (ap_irq_flag)
+ break;
+ if (ap_poll_kthread) {
+ wake_up(&ap_poll_wait);
+@@ -451,7 +442,7 @@ static void ap_tasklet_fn(unsigned long dummy)
+ * be received. Doing it in the beginning of the tasklet is therefor
+ * important that no requests on any AP get lost.
+ */
+- if (ap_using_interrupts())
++ if (ap_irq_flag)
+ xchg(ap_airq.lsi_ptr, 0);
+
+ spin_lock_bh(&ap_queues_lock);
+@@ -521,7 +512,7 @@ static int ap_poll_thread_start(void)
+ {
+ int rc;
+
+- if (ap_using_interrupts() || ap_poll_kthread)
++ if (ap_irq_flag || ap_poll_kthread)
+ return 0;
+ mutex_lock(&ap_poll_thread_mutex);
+ ap_poll_kthread = kthread_run(ap_poll_thread, NULL, "appoll");
+@@ -1119,7 +1110,7 @@ static BUS_ATTR_RO(ap_adapter_mask);
+ static ssize_t ap_interrupts_show(struct bus_type *bus, char *buf)
+ {
+ return scnprintf(buf, PAGE_SIZE, "%d\n",
+- ap_using_interrupts() ? 1 : 0);
++ ap_irq_flag ? 1 : 0);
+ }
+
+ static BUS_ATTR_RO(ap_interrupts);
+@@ -1832,7 +1823,7 @@ static int __init ap_module_init(void)
+ /* enable interrupts if available */
+ if (ap_interrupts_available()) {
+ rc = register_adapter_interrupt(&ap_airq);
+- ap_airq_flag = (rc == 0);
++ ap_irq_flag = (rc == 0);
+ }
+
+ /* Create /sys/bus/ap. */
+@@ -1876,7 +1867,7 @@ out_work:
+ out_bus:
+ bus_unregister(&ap_bus_type);
+ out:
+- if (ap_using_interrupts())
++ if (ap_irq_flag)
+ unregister_adapter_interrupt(&ap_airq);
+ kfree(ap_qci_info);
+ return rc;
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 472efd3a755c..2940bc8aa43d 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -77,12 +77,6 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
+ #define AP_FUNC_EP11 5
+ #define AP_FUNC_APXA 6
+
+-/*
+- * AP interrupt states
+- */
+-#define AP_INTR_DISABLED 0 /* AP interrupt disabled */
+-#define AP_INTR_ENABLED 1 /* AP interrupt enabled */
+-
+ /*
+ * AP queue state machine states
+ */
+@@ -109,7 +103,7 @@ enum ap_sm_event {
+ * AP queue state wait behaviour
+ */
+ enum ap_sm_wait {
+- AP_SM_WAIT_AGAIN, /* retry immediately */
++ AP_SM_WAIT_AGAIN = 0, /* retry immediately */
+ AP_SM_WAIT_TIMEOUT, /* wait for timeout */
+ AP_SM_WAIT_INTERRUPT, /* wait for thin interrupt (if available) */
+ AP_SM_WAIT_NONE, /* no wait */
+@@ -182,7 +176,7 @@ struct ap_queue {
+ enum ap_dev_state dev_state; /* queue device state */
+ bool config; /* configured state */
+ ap_qid_t qid; /* AP queue id. */
+- int interrupt; /* indicate if interrupts are enabled */
++ bool interrupt; /* indicate if interrupts are enabled */
+ int queue_count; /* # messages currently on AP queue. */
+ int pendingq_count; /* # requests on pendingq list. */
+ int requestq_count; /* # requests on requestq list. */
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 337353c9655e..639f8d25679c 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -19,7 +19,7 @@
+ static void __ap_flush_queue(struct ap_queue *aq);
+
+ /**
+- * ap_queue_enable_interruption(): Enable interruption on an AP queue.
++ * ap_queue_enable_irq(): Enable interrupt support on this AP queue.
+ * @qid: The AP queue number
+ * @ind: the notification indicator byte
+ *
+@@ -27,7 +27,7 @@ static void __ap_flush_queue(struct ap_queue *aq);
+ * value it waits a while and tests the AP queue if interrupts
+ * have been switched on using ap_test_queue().
+ */
+-static int ap_queue_enable_interruption(struct ap_queue *aq, void *ind)
++static int ap_queue_enable_irq(struct ap_queue *aq, void *ind)
+ {
+ struct ap_queue_status status;
+ struct ap_qirq_ctrl qirqctrl = { 0 };
+@@ -198,7 +198,8 @@ static enum ap_sm_wait ap_sm_read(struct ap_queue *aq)
+ return AP_SM_WAIT_NONE;
+ case AP_RESPONSE_NO_PENDING_REPLY:
+ if (aq->queue_count > 0)
+- return AP_SM_WAIT_INTERRUPT;
++ return aq->interrupt ?
++ AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT;
+ aq->sm_state = AP_SM_STATE_IDLE;
+ return AP_SM_WAIT_NONE;
+ default:
+@@ -252,7 +253,8 @@ static enum ap_sm_wait ap_sm_write(struct ap_queue *aq)
+ fallthrough;
+ case AP_RESPONSE_Q_FULL:
+ aq->sm_state = AP_SM_STATE_QUEUE_FULL;
+- return AP_SM_WAIT_INTERRUPT;
++ return aq->interrupt ?
++ AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT;
+ case AP_RESPONSE_RESET_IN_PROGRESS:
+ aq->sm_state = AP_SM_STATE_RESET_WAIT;
+ return AP_SM_WAIT_TIMEOUT;
+@@ -302,7 +304,7 @@ static enum ap_sm_wait ap_sm_reset(struct ap_queue *aq)
+ case AP_RESPONSE_NORMAL:
+ case AP_RESPONSE_RESET_IN_PROGRESS:
+ aq->sm_state = AP_SM_STATE_RESET_WAIT;
+- aq->interrupt = AP_INTR_DISABLED;
++ aq->interrupt = false;
+ return AP_SM_WAIT_TIMEOUT;
+ default:
+ aq->dev_state = AP_DEV_STATE_ERROR;
+@@ -335,7 +337,7 @@ static enum ap_sm_wait ap_sm_reset_wait(struct ap_queue *aq)
+ switch (status.response_code) {
+ case AP_RESPONSE_NORMAL:
+ lsi_ptr = ap_airq_ptr();
+- if (lsi_ptr && ap_queue_enable_interruption(aq, lsi_ptr) == 0)
++ if (lsi_ptr && ap_queue_enable_irq(aq, lsi_ptr) == 0)
+ aq->sm_state = AP_SM_STATE_SETIRQ_WAIT;
+ else
+ aq->sm_state = (aq->queue_count > 0) ?
+@@ -376,7 +378,7 @@ static enum ap_sm_wait ap_sm_setirq_wait(struct ap_queue *aq)
+
+ if (status.irq_enabled == 1) {
+ /* Irqs are now enabled */
+- aq->interrupt = AP_INTR_ENABLED;
++ aq->interrupt = true;
+ aq->sm_state = (aq->queue_count > 0) ?
+ AP_SM_STATE_WORKING : AP_SM_STATE_IDLE;
+ }
+@@ -566,7 +568,7 @@ static ssize_t interrupt_show(struct device *dev,
+ spin_lock_bh(&aq->lock);
+ if (aq->sm_state == AP_SM_STATE_SETIRQ_WAIT)
+ rc = scnprintf(buf, PAGE_SIZE, "Enable Interrupt pending.\n");
+- else if (aq->interrupt == AP_INTR_ENABLED)
++ else if (aq->interrupt)
+ rc = scnprintf(buf, PAGE_SIZE, "Interrupts enabled.\n");
+ else
+ rc = scnprintf(buf, PAGE_SIZE, "Interrupts disabled.\n");
+@@ -747,7 +749,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
+ aq->ap_dev.device.type = &ap_queue_type;
+ aq->ap_dev.device_type = device_type;
+ aq->qid = qid;
+- aq->interrupt = AP_INTR_DISABLED;
++ aq->interrupt = false;
+ spin_lock_init(&aq->lock);
+ INIT_LIST_HEAD(&aq->pendingq);
+ INIT_LIST_HEAD(&aq->requestq);
+--
+2.30.2
+
--- /dev/null
+From 5c0f10d68f3cd722f55d2b974530addadc444ae7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Apr 2021 10:52:38 +0200
+Subject: s390/cio: add dev_busid sysfs entry for each subchannel
+
+From: Vineeth Vijayan <vneethv@linux.ibm.com>
+
+[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ]
+
+Introduce dev_busid, which exports the device-id associated with the
+io-subchannel (and message-subchannel). The dev_busid indicates that of
+the device which may be physically installed on the corrosponding
+subchannel. The dev_busid value "none" indicates that the subchannel
+is not valid, there is no I/O device currently associated with the
+subchannel.
+
+The dev_busid information would be helpful to write device-specific
+udev-rules associated with the subchannel. The dev_busid interface would
+be available even when the sch is not bound to any driver or if there is
+no operational device connected on it. Hence this attribute can be used to
+write udev-rules which are specific to the device associated with the
+subchannel.
+
+Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/css.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
+index a974943c27da..9fcdb8d81eee 100644
+--- a/drivers/s390/cio/css.c
++++ b/drivers/s390/cio/css.c
+@@ -430,9 +430,26 @@ static ssize_t pimpampom_show(struct device *dev,
+ }
+ static DEVICE_ATTR_RO(pimpampom);
+
++static ssize_t dev_busid_show(struct device *dev,
++ struct device_attribute *attr,
++ char *buf)
++{
++ struct subchannel *sch = to_subchannel(dev);
++ struct pmcw *pmcw = &sch->schib.pmcw;
++
++ if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
++ pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
++ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
++ pmcw->dev);
++ else
++ return sysfs_emit(buf, "none\n");
++}
++static DEVICE_ATTR_RO(dev_busid);
++
+ static struct attribute *io_subchannel_type_attrs[] = {
+ &dev_attr_chpids.attr,
+ &dev_attr_pimpampom.attr,
++ &dev_attr_dev_busid.attr,
+ NULL,
+ };
+ ATTRIBUTE_GROUPS(io_subchannel_type);
+--
+2.30.2
+
--- /dev/null
+From bc273956f1e934692a07d6b4c82e0f237837a2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 15:05:03 +0200
+Subject: s390/debug: fix debug area life cycle
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 9372a82892c2caa6bccab9a4081166fa769699f8 ]
+
+Currently allocation and registration of s390dbf debug areas are tied
+together. As a result, a debug area cannot be unregistered and
+re-registered while any process has an associated debugfs file open.
+
+Fix this by splitting alloc/release from register/unregister.
+
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/debug.c | 102 +++++++++++++++++++++------------------
+ 1 file changed, 56 insertions(+), 46 deletions(-)
+
+diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
+index 7d3649dbaa8c..a142671c449b 100644
+--- a/arch/s390/kernel/debug.c
++++ b/arch/s390/kernel/debug.c
+@@ -314,24 +314,6 @@ static debug_info_t *debug_info_create(const char *name, int pages_per_area,
+ goto out;
+
+ rc->mode = mode & ~S_IFMT;
+-
+- /* create root directory */
+- rc->debugfs_root_entry = debugfs_create_dir(rc->name,
+- debug_debugfs_root_entry);
+-
+- /* append new element to linked list */
+- if (!debug_area_first) {
+- /* first element in list */
+- debug_area_first = rc;
+- rc->prev = NULL;
+- } else {
+- /* append element to end of list */
+- debug_area_last->next = rc;
+- rc->prev = debug_area_last;
+- }
+- debug_area_last = rc;
+- rc->next = NULL;
+-
+ refcount_set(&rc->ref_count, 1);
+ out:
+ return rc;
+@@ -391,27 +373,10 @@ static void debug_info_get(debug_info_t *db_info)
+ */
+ static void debug_info_put(debug_info_t *db_info)
+ {
+- int i;
+-
+ if (!db_info)
+ return;
+- if (refcount_dec_and_test(&db_info->ref_count)) {
+- for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
+- if (!db_info->views[i])
+- continue;
+- debugfs_remove(db_info->debugfs_entries[i]);
+- }
+- debugfs_remove(db_info->debugfs_root_entry);
+- if (db_info == debug_area_first)
+- debug_area_first = db_info->next;
+- if (db_info == debug_area_last)
+- debug_area_last = db_info->prev;
+- if (db_info->prev)
+- db_info->prev->next = db_info->next;
+- if (db_info->next)
+- db_info->next->prev = db_info->prev;
++ if (refcount_dec_and_test(&db_info->ref_count))
+ debug_info_free(db_info);
+- }
+ }
+
+ /*
+@@ -635,6 +600,31 @@ static int debug_close(struct inode *inode, struct file *file)
+ return 0; /* success */
+ }
+
++/* Create debugfs entries and add to internal list. */
++static void _debug_register(debug_info_t *id)
++{
++ /* create root directory */
++ id->debugfs_root_entry = debugfs_create_dir(id->name,
++ debug_debugfs_root_entry);
++
++ /* append new element to linked list */
++ if (!debug_area_first) {
++ /* first element in list */
++ debug_area_first = id;
++ id->prev = NULL;
++ } else {
++ /* append element to end of list */
++ debug_area_last->next = id;
++ id->prev = debug_area_last;
++ }
++ debug_area_last = id;
++ id->next = NULL;
++
++ debug_register_view(id, &debug_level_view);
++ debug_register_view(id, &debug_flush_view);
++ debug_register_view(id, &debug_pages_view);
++}
++
+ /**
+ * debug_register_mode() - creates and initializes debug area.
+ *
+@@ -664,19 +654,16 @@ debug_info_t *debug_register_mode(const char *name, int pages_per_area,
+ if ((uid != 0) || (gid != 0))
+ pr_warn("Root becomes the owner of all s390dbf files in sysfs\n");
+ BUG_ON(!initialized);
+- mutex_lock(&debug_mutex);
+
+ /* create new debug_info */
+ rc = debug_info_create(name, pages_per_area, nr_areas, buf_size, mode);
+- if (!rc)
+- goto out;
+- debug_register_view(rc, &debug_level_view);
+- debug_register_view(rc, &debug_flush_view);
+- debug_register_view(rc, &debug_pages_view);
+-out:
+- if (!rc)
++ if (rc) {
++ mutex_lock(&debug_mutex);
++ _debug_register(rc);
++ mutex_unlock(&debug_mutex);
++ } else {
+ pr_err("Registering debug feature %s failed\n", name);
+- mutex_unlock(&debug_mutex);
++ }
+ return rc;
+ }
+ EXPORT_SYMBOL(debug_register_mode);
+@@ -705,6 +692,27 @@ debug_info_t *debug_register(const char *name, int pages_per_area,
+ }
+ EXPORT_SYMBOL(debug_register);
+
++/* Remove debugfs entries and remove from internal list. */
++static void _debug_unregister(debug_info_t *id)
++{
++ int i;
++
++ for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
++ if (!id->views[i])
++ continue;
++ debugfs_remove(id->debugfs_entries[i]);
++ }
++ debugfs_remove(id->debugfs_root_entry);
++ if (id == debug_area_first)
++ debug_area_first = id->next;
++ if (id == debug_area_last)
++ debug_area_last = id->prev;
++ if (id->prev)
++ id->prev->next = id->next;
++ if (id->next)
++ id->next->prev = id->prev;
++}
++
+ /**
+ * debug_unregister() - give back debug area.
+ *
+@@ -718,8 +726,10 @@ void debug_unregister(debug_info_t *id)
+ if (!id)
+ return;
+ mutex_lock(&debug_mutex);
+- debug_info_put(id);
++ _debug_unregister(id);
+ mutex_unlock(&debug_mutex);
++
++ debug_info_put(id);
+ }
+ EXPORT_SYMBOL(debug_unregister);
+
+--
+2.30.2
+
--- /dev/null
+From 2427ed232b73d853ef145cdf990dac99b9ff3e76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 15:05:02 +0200
+Subject: s390/debug: keep debug data on resize
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+[ Upstream commit 1204777867e8486a88dbb4793fe256b31ea05eeb ]
+
+Any previously recorded s390dbf debug data is reset when a debug area
+is resized using the 'pages' sysfs attribute. This can make
+live-debugging unnecessarily complex.
+
+Fix this by copying existing debug data to the newly allocated debug
+area when resizing.
+
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/debug.c | 74 ++++++++++++++++++++++++++++------------
+ 1 file changed, 53 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
+index bb958d32bd81..7d3649dbaa8c 100644
+--- a/arch/s390/kernel/debug.c
++++ b/arch/s390/kernel/debug.c
+@@ -24,6 +24,7 @@
+ #include <linux/export.h>
+ #include <linux/init.h>
+ #include <linux/fs.h>
++#include <linux/minmax.h>
+ #include <linux/debugfs.h>
+
+ #include <asm/debug.h>
+@@ -92,6 +93,8 @@ static int debug_hex_ascii_format_fn(debug_info_t *id, struct debug_view *view,
+ char *out_buf, const char *in_buf);
+ static int debug_sprintf_format_fn(debug_info_t *id, struct debug_view *view,
+ char *out_buf, debug_sprintf_entry_t *curr_event);
++static void debug_areas_swap(debug_info_t *a, debug_info_t *b);
++static void debug_events_append(debug_info_t *dest, debug_info_t *src);
+
+ /* globals */
+
+@@ -726,35 +729,28 @@ EXPORT_SYMBOL(debug_unregister);
+ */
+ static int debug_set_size(debug_info_t *id, int nr_areas, int pages_per_area)
+ {
+- debug_entry_t ***new_areas;
++ debug_info_t *new_id;
+ unsigned long flags;
+- int rc = 0;
+
+ if (!id || (nr_areas <= 0) || (pages_per_area < 0))
+ return -EINVAL;
+- if (pages_per_area > 0) {
+- new_areas = debug_areas_alloc(pages_per_area, nr_areas);
+- if (!new_areas) {
+- pr_info("Allocating memory for %i pages failed\n",
+- pages_per_area);
+- rc = -ENOMEM;
+- goto out;
+- }
+- } else {
+- new_areas = NULL;
++
++ new_id = debug_info_alloc("", pages_per_area, nr_areas, id->buf_size,
++ id->level, ALL_AREAS);
++ if (!new_id) {
++ pr_info("Allocating memory for %i pages failed\n",
++ pages_per_area);
++ return -ENOMEM;
+ }
++
+ spin_lock_irqsave(&id->lock, flags);
+- debug_areas_free(id);
+- id->areas = new_areas;
+- id->nr_areas = nr_areas;
+- id->pages_per_area = pages_per_area;
+- id->active_area = 0;
+- memset(id->active_entries, 0, sizeof(int)*id->nr_areas);
+- memset(id->active_pages, 0, sizeof(int)*id->nr_areas);
++ debug_events_append(new_id, id);
++ debug_areas_swap(new_id, id);
++ debug_info_free(new_id);
+ spin_unlock_irqrestore(&id->lock, flags);
+ pr_info("%s: set new size (%i pages)\n", id->name, pages_per_area);
+-out:
+- return rc;
++
++ return 0;
+ }
+
+ /**
+@@ -821,6 +817,42 @@ static inline debug_entry_t *get_active_entry(debug_info_t *id)
+ id->active_entries[id->active_area]);
+ }
+
++/* Swap debug areas of a and b. */
++static void debug_areas_swap(debug_info_t *a, debug_info_t *b)
++{
++ swap(a->nr_areas, b->nr_areas);
++ swap(a->pages_per_area, b->pages_per_area);
++ swap(a->areas, b->areas);
++ swap(a->active_area, b->active_area);
++ swap(a->active_pages, b->active_pages);
++ swap(a->active_entries, b->active_entries);
++}
++
++/* Append all debug events in active area from source to destination log. */
++static void debug_events_append(debug_info_t *dest, debug_info_t *src)
++{
++ debug_entry_t *from, *to, *last;
++
++ if (!src->areas || !dest->areas)
++ return;
++
++ /* Loop over all entries in src, starting with oldest. */
++ from = get_active_entry(src);
++ last = from;
++ do {
++ if (from->clock != 0LL) {
++ to = get_active_entry(dest);
++ memset(to, 0, dest->entry_size);
++ memcpy(to, from, min(src->entry_size,
++ dest->entry_size));
++ proceed_active_entry(dest);
++ }
++
++ proceed_active_entry(src);
++ from = get_active_entry(src);
++ } while (from != last);
++}
++
+ /*
+ * debug_finish_entry:
+ * - set timestamp, caller address, cpu number etc.
+--
+2.30.2
+
--- /dev/null
+From 935da9b67a16cd032cee9f77549fab943d75e15e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 12:55:08 +0200
+Subject: s390/kasan: fix large PMD pages address alignment check
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit ddd63c85ef67ea9ea7282ad35eafb6568047126e ]
+
+It is currently possible to initialize a large PMD page when
+the address is not aligned on page boundary.
+
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/kasan_init.c | 41 +++++++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c
+index db4d303aaaa9..d7fcfe97d168 100644
+--- a/arch/s390/mm/kasan_init.c
++++ b/arch/s390/mm/kasan_init.c
+@@ -108,6 +108,9 @@ static void __init kasan_early_pgtable_populate(unsigned long address,
+ sgt_prot &= ~_SEGMENT_ENTRY_NOEXEC;
+ }
+
++ /*
++ * The first 1MB of 1:1 mapping is mapped with 4KB pages
++ */
+ while (address < end) {
+ pg_dir = pgd_offset_k(address);
+ if (pgd_none(*pg_dir)) {
+@@ -158,30 +161,26 @@ static void __init kasan_early_pgtable_populate(unsigned long address,
+
+ pm_dir = pmd_offset(pu_dir, address);
+ if (pmd_none(*pm_dir)) {
+- if (mode == POPULATE_ZERO_SHADOW &&
+- IS_ALIGNED(address, PMD_SIZE) &&
++ if (IS_ALIGNED(address, PMD_SIZE) &&
+ end - address >= PMD_SIZE) {
+- pmd_populate(&init_mm, pm_dir,
+- kasan_early_shadow_pte);
+- address = (address + PMD_SIZE) & PMD_MASK;
+- continue;
+- }
+- /* the first megabyte of 1:1 is mapped with 4k pages */
+- if (has_edat && address && end - address >= PMD_SIZE &&
+- mode != POPULATE_ZERO_SHADOW) {
+- void *page;
+-
+- if (mode == POPULATE_ONE2ONE) {
+- page = (void *)address;
+- } else {
+- page = kasan_early_alloc_segment();
+- memset(page, 0, _SEGMENT_SIZE);
++ if (mode == POPULATE_ZERO_SHADOW) {
++ pmd_populate(&init_mm, pm_dir, kasan_early_shadow_pte);
++ address = (address + PMD_SIZE) & PMD_MASK;
++ continue;
++ } else if (has_edat && address) {
++ void *page;
++
++ if (mode == POPULATE_ONE2ONE) {
++ page = (void *)address;
++ } else {
++ page = kasan_early_alloc_segment();
++ memset(page, 0, _SEGMENT_SIZE);
++ }
++ pmd_val(*pm_dir) = __pa(page) | sgt_prot;
++ address = (address + PMD_SIZE) & PMD_MASK;
++ continue;
+ }
+- pmd_val(*pm_dir) = __pa(page) | sgt_prot;
+- address = (address + PMD_SIZE) & PMD_MASK;
+- continue;
+ }
+-
+ pt_dir = kasan_early_pte_alloc();
+ pmd_populate(&init_mm, pm_dir, pt_dir);
+ } else if (pmd_large(*pm_dir)) {
+--
+2.30.2
+
--- /dev/null
+From 0d1a9f1cf5197524dfc9be4b6c4b2d88b4933f0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Jul 2021 19:58:54 +0200
+Subject: s390/pci: fix misleading rc in clp_set_pci_fn()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit f7addcdd527a6dddfebe20c358b87bdb95624612 ]
+
+Currently clp_set_pci_fn() always returns 0 as long as the CLP request
+itself succeeds even if the operation itself returns a response code
+other than CLP_RC_OK or CLP_RC_SETPCIFN_ALRDY. This is highly misleading
+because calling code assumes that a zero rc means that the operation was
+successful.
+
+Fix this by returning the response code or cc on failure with the
+exception of the special handling for CLP_RC_SETPCIFN_ALRDY. Also let's
+not assume that the returned function handle for CLP_RC_SETPCIFN_ALRDY
+is 0, we don't need it anyway.
+
+Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci.c | 7 ++++---
+ arch/s390/pci/pci_clp.c | 33 ++++++++++++++++-----------------
+ 2 files changed, 20 insertions(+), 20 deletions(-)
+
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index 8fcb7ecb7225..77cd965cffef 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -661,9 +661,10 @@ int zpci_enable_device(struct zpci_dev *zdev)
+ {
+ int rc;
+
+- rc = clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES);
+- if (rc)
++ if (clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES)) {
++ rc = -EIO;
+ goto out;
++ }
+
+ rc = zpci_dma_init_device(zdev);
+ if (rc)
+@@ -684,7 +685,7 @@ int zpci_disable_device(struct zpci_dev *zdev)
+ * The zPCI function may already be disabled by the platform, this is
+ * detected in clp_disable_fh() which becomes a no-op.
+ */
+- return clp_disable_fh(zdev);
++ return clp_disable_fh(zdev) ? -EIO : 0;
+ }
+
+ /**
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index d3331596ddbe..0a0e8b8293be 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -213,15 +213,19 @@ out:
+ }
+
+ static int clp_refresh_fh(u32 fid);
+-/*
+- * Enable/Disable a given PCI function and update its function handle if
+- * necessary
++/**
++ * clp_set_pci_fn() - Execute a command on a PCI function
++ * @zdev: Function that will be affected
++ * @nr_dma_as: DMA address space number
++ * @command: The command code to execute
++ *
++ * Returns: 0 on success, < 0 for Linux errors (e.g. -ENOMEM), and
++ * > 0 for non-success platform responses
+ */
+ static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
+ {
+ struct clp_req_rsp_set_pci *rrb;
+ int rc, retries = 100;
+- u32 fid = zdev->fid;
+
+ rrb = clp_alloc_block(GFP_KERNEL);
+ if (!rrb)
+@@ -245,17 +249,16 @@ static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
+ }
+ } while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY);
+
+- if (rc || rrb->response.hdr.rsp != CLP_RC_OK) {
+- zpci_err("Set PCI FN:\n");
+- zpci_err_clp(rrb->response.hdr.rsp, rc);
+- }
+-
+ if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) {
+ zdev->fh = rrb->response.fh;
+- } else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY &&
+- rrb->response.fh == 0) {
++ } else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY) {
+ /* Function is already in desired state - update handle */
+- rc = clp_refresh_fh(fid);
++ rc = clp_refresh_fh(zdev->fid);
++ } else {
++ zpci_err("Set PCI FN:\n");
++ zpci_err_clp(rrb->response.hdr.rsp, rc);
++ if (!rc)
++ rc = rrb->response.hdr.rsp;
+ }
+ clp_free_block(rrb);
+ return rc;
+@@ -301,17 +304,13 @@ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as)
+
+ rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
+ zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, zdev->fh, rc);
+- if (rc)
+- goto out;
+-
+- if (zpci_use_mio(zdev)) {
++ if (!rc && zpci_use_mio(zdev)) {
+ rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_MIO);
+ zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n",
+ zdev->fid, zdev->fh, rc);
+ if (rc)
+ clp_disable_fh(zdev);
+ }
+-out:
+ return rc;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 57895094d52e5fcfcbdfa58d6bb3ace6e729ed88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Aug 2021 12:02:00 +0200
+Subject: s390/zcrypt: fix wrong offset index for APKA master key valid state
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 8617bb74006252cb2286008afe7d6575a6425857 ]
+
+Tests showed a mismatch between what the CCA tool reports about
+the APKA master key state and what's displayed by the zcrypt dd
+in sysfs. After some investigation, we found out that the
+documentation which was the source for the zcrypt dd implementation
+lacks the listing of 3 fields. So this patch now moves the
+evaluation of the APKA master key state to the correct offset.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/zcrypt_ccamisc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
+index d68c0ed5e0dd..f5d0212fb4fe 100644
+--- a/drivers/s390/crypto/zcrypt_ccamisc.c
++++ b/drivers/s390/crypto/zcrypt_ccamisc.c
+@@ -1724,10 +1724,10 @@ static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci)
+ rlen = vlen = PAGE_SIZE/2;
+ rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
+ rarray, &rlen, varray, &vlen);
+- if (rc == 0 && rlen >= 10*8 && vlen >= 240) {
+- ci->new_apka_mk_state = (char) rarray[7*8];
+- ci->cur_apka_mk_state = (char) rarray[8*8];
+- ci->old_apka_mk_state = (char) rarray[9*8];
++ if (rc == 0 && rlen >= 13*8 && vlen >= 240) {
++ ci->new_apka_mk_state = (char) rarray[10*8];
++ ci->cur_apka_mk_state = (char) rarray[11*8];
++ ci->old_apka_mk_state = (char) rarray[12*8];
+ if (ci->old_apka_mk_state == '2')
+ memcpy(&ci->old_apka_mkvp, varray + 208, 8);
+ if (ci->cur_apka_mk_state == '2')
+--
+2.30.2
+
--- /dev/null
+From 8ed1322dc36267b0e10de46fde6df656318eef63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 00:08:13 +0900
+Subject: samples: pktgen: add missing IPv6 option to pktgen scripts
+
+From: Juhee Kang <claudiajkang@gmail.com>
+
+[ Upstream commit 0f0c4f1b72e090b23131700bb155944cc28b2a7b ]
+
+Currently, "sample04" and "sample05" are not working properly when
+running with an IPv6 option("-6"). The commit 0f06a6787e05 ("samples:
+Add an IPv6 "-6" option to the pktgen scripts") has omitted the addition
+of this option at "sample04" and "sample05".
+
+In order to support IPv6 option, this commit adds logic related to IPv6
+option.
+
+Fixes: 0f06a6787e05 ("samples: Add an IPv6 "-6" option to the pktgen scripts")
+
+Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/pktgen/pktgen_sample04_many_flows.sh | 12 +++++++-----
+ samples/pktgen/pktgen_sample05_flow_per_thread.sh | 12 +++++++-----
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/samples/pktgen/pktgen_sample04_many_flows.sh b/samples/pktgen/pktgen_sample04_many_flows.sh
+index ddce876635aa..507c1143eb96 100755
+--- a/samples/pktgen/pktgen_sample04_many_flows.sh
++++ b/samples/pktgen/pktgen_sample04_many_flows.sh
+@@ -13,13 +13,15 @@ root_check_run_with_sudo "$@"
+ # Parameter parsing via include
+ source ${basedir}/parameters.sh
+ # Set some default params, if they didn't get set
+-[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42"
++if [ -z "$DEST_IP" ]; then
++ [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1"
++fi
+ [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff"
+ [ -z "$CLONE_SKB" ] && CLONE_SKB="0"
+ [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely
+ if [ -n "$DEST_IP" ]; then
+- validate_addr $DEST_IP
+- read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP)
++ validate_addr${IP6} $DEST_IP
++ read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP)
+ fi
+ if [ -n "$DST_PORT" ]; then
+ read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
+@@ -62,8 +64,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
+
+ # Single destination
+ pg_set $dev "dst_mac $DST_MAC"
+- pg_set $dev "dst_min $DST_MIN"
+- pg_set $dev "dst_max $DST_MAX"
++ pg_set $dev "dst${IP6}_min $DST_MIN"
++ pg_set $dev "dst${IP6}_max $DST_MAX"
+
+ if [ -n "$DST_PORT" ]; then
+ # Single destination port or random port range
+diff --git a/samples/pktgen/pktgen_sample05_flow_per_thread.sh b/samples/pktgen/pktgen_sample05_flow_per_thread.sh
+index 4a65fe2fcee9..160143ebcdd0 100755
+--- a/samples/pktgen/pktgen_sample05_flow_per_thread.sh
++++ b/samples/pktgen/pktgen_sample05_flow_per_thread.sh
+@@ -17,14 +17,16 @@ root_check_run_with_sudo "$@"
+ # Parameter parsing via include
+ source ${basedir}/parameters.sh
+ # Set some default params, if they didn't get set
+-[ -z "$DEST_IP" ] && DEST_IP="198.18.0.42"
++if [ -z "$DEST_IP" ]; then
++ [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1"
++fi
+ [ -z "$DST_MAC" ] && DST_MAC="90:e2:ba:ff:ff:ff"
+ [ -z "$CLONE_SKB" ] && CLONE_SKB="0"
+ [ -z "$BURST" ] && BURST=32
+ [ -z "$COUNT" ] && COUNT="0" # Zero means indefinitely
+ if [ -n "$DEST_IP" ]; then
+- validate_addr $DEST_IP
+- read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP)
++ validate_addr${IP6} $DEST_IP
++ read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP)
+ fi
+ if [ -n "$DST_PORT" ]; then
+ read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
+@@ -52,8 +54,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
+
+ # Single destination
+ pg_set $dev "dst_mac $DST_MAC"
+- pg_set $dev "dst_min $DST_MIN"
+- pg_set $dev "dst_max $DST_MAX"
++ pg_set $dev "dst${IP6}_min $DST_MIN"
++ pg_set $dev "dst${IP6}_max $DST_MAX"
+
+ if [ -n "$DST_PORT" ]; then
+ # Single destination port or random port range
+--
+2.30.2
+
--- /dev/null
+From 3d49b2dfafdfb168a3f6bd64db9a676c0ed0cbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 14:54:25 +0300
+Subject: sch_htb: Fix inconsistency when leaf qdisc creation fails
+
+From: Maxim Mikityanskiy <maximmi@nvidia.com>
+
+[ Upstream commit ca49bfd90a9dde175d2929dc1544b54841e33804 ]
+
+In HTB offload mode, qdiscs of leaf classes are grafted to netdev
+queues. sch_htb expects the dev_queue field of these qdiscs to point to
+the corresponding queues. However, qdisc creation may fail, and in that
+case noop_qdisc is used instead. Its dev_queue doesn't point to the
+right queue, so sch_htb can lose track of used netdev queues, which will
+cause internal inconsistencies.
+
+This commit fixes this bug by keeping track of the netdev queue inside
+struct htb_class. All reads of cl->leaf.q->dev_queue are replaced by the
+new field, the two values are synced on writes, and WARNs are added to
+assert equality of the two values.
+
+The driver API has changed: when TC_HTB_LEAF_DEL needs to move a queue,
+the driver used to pass the old and new queue IDs to sch_htb. Now that
+there is a new field (offload_queue) in struct htb_class that needs to
+be updated on this operation, the driver will pass the old class ID to
+sch_htb instead (it already knows the new class ID).
+
+Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
+Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20210826115425.1744053-1-maximmi@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/en/qos.c | 15 ++-
+ .../net/ethernet/mellanox/mlx5/core/en/qos.h | 4 +-
+ .../net/ethernet/mellanox/mlx5/core/en_main.c | 3 +-
+ include/net/pkt_cls.h | 3 +-
+ net/sched/sch_htb.c | 97 ++++++++++++-------
+ 5 files changed, 72 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+index 5efe3278b0f6..1fd8baf19829 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+@@ -733,8 +733,8 @@ static void mlx5e_reset_qdisc(struct net_device *dev, u16 qid)
+ spin_unlock_bh(qdisc_lock(qdisc));
+ }
+
+-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
+- u16 *new_qid, struct netlink_ext_ack *extack)
++int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid,
++ struct netlink_ext_ack *extack)
+ {
+ struct mlx5e_qos_node *node;
+ struct netdev_queue *txq;
+@@ -742,11 +742,9 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
+ bool opened;
+ int err;
+
+- qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", classid);
+-
+- *old_qid = *new_qid = 0;
++ qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", *classid);
+
+- node = mlx5e_sw_node_find(priv, classid);
++ node = mlx5e_sw_node_find(priv, *classid);
+ if (!node)
+ return -ENOENT;
+
+@@ -764,7 +762,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
+ err = mlx5_qos_destroy_node(priv->mdev, node->hw_id);
+ if (err) /* Not fatal. */
+ qos_warn(priv->mdev, "Failed to destroy leaf node %u (class %04x), err = %d\n",
+- node->hw_id, classid, err);
++ node->hw_id, *classid, err);
+
+ mlx5e_sw_node_delete(priv, node);
+
+@@ -826,8 +824,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
+ if (opened)
+ mlx5e_reactivate_qos_sq(priv, moved_qid, txq);
+
+- *old_qid = mlx5e_qid_from_qos(&priv->channels, moved_qid);
+- *new_qid = mlx5e_qid_from_qos(&priv->channels, qid);
++ *classid = node->classid;
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
+index 5af7991fcd19..757682b7c0e0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
+@@ -34,8 +34,8 @@ int mlx5e_htb_leaf_alloc_queue(struct mlx5e_priv *priv, u16 classid,
+ struct netlink_ext_ack *extack);
+ int mlx5e_htb_leaf_to_inner(struct mlx5e_priv *priv, u16 classid, u16 child_classid,
+ u64 rate, u64 ceil, struct netlink_ext_ack *extack);
+-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
+- u16 *new_qid, struct netlink_ext_ack *extack);
++int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid,
++ struct netlink_ext_ack *extack);
+ int mlx5e_htb_leaf_del_last(struct mlx5e_priv *priv, u16 classid, bool force,
+ struct netlink_ext_ack *extack);
+ int mlx5e_htb_node_modify(struct mlx5e_priv *priv, u16 classid, u64 rate, u64 ceil,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index b0424c36cf7f..814ff51db1a5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3447,8 +3447,7 @@ static int mlx5e_setup_tc_htb(struct mlx5e_priv *priv, struct tc_htb_qopt_offloa
+ return mlx5e_htb_leaf_to_inner(priv, htb->parent_classid, htb->classid,
+ htb->rate, htb->ceil, htb->extack);
+ case TC_HTB_LEAF_DEL:
+- return mlx5e_htb_leaf_del(priv, htb->classid, &htb->moved_qid, &htb->qid,
+- htb->extack);
++ return mlx5e_htb_leaf_del(priv, &htb->classid, htb->extack);
+ case TC_HTB_LEAF_DEL_LAST:
+ case TC_HTB_LEAF_DEL_LAST_FORCE:
+ return mlx5e_htb_leaf_del_last(priv, htb->classid,
+diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
+index ec7823921bd2..b420f905f4f6 100644
+--- a/include/net/pkt_cls.h
++++ b/include/net/pkt_cls.h
+@@ -820,10 +820,9 @@ enum tc_htb_command {
+ struct tc_htb_qopt_offload {
+ struct netlink_ext_ack *extack;
+ enum tc_htb_command command;
+- u16 classid;
+ u32 parent_classid;
++ u16 classid;
+ u16 qid;
+- u16 moved_qid;
+ u64 rate;
+ u64 ceil;
+ };
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index 8827987ba903..11bc6bf35f84 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -125,6 +125,7 @@ struct htb_class {
+ struct htb_class_leaf {
+ int deficit[TC_HTB_MAXDEPTH];
+ struct Qdisc *q;
++ struct netdev_queue *offload_queue;
+ } leaf;
+ struct htb_class_inner {
+ struct htb_prio clprio[TC_HTB_NUMPRIO];
+@@ -1376,24 +1377,47 @@ htb_graft_helper(struct netdev_queue *dev_queue, struct Qdisc *new_q)
+ return old_q;
+ }
+
+-static void htb_offload_move_qdisc(struct Qdisc *sch, u16 qid_old, u16 qid_new)
++static struct netdev_queue *htb_offload_get_queue(struct htb_class *cl)
++{
++ struct netdev_queue *queue;
++
++ queue = cl->leaf.offload_queue;
++ if (!(cl->leaf.q->flags & TCQ_F_BUILTIN))
++ WARN_ON(cl->leaf.q->dev_queue != queue);
++
++ return queue;
++}
++
++static void htb_offload_move_qdisc(struct Qdisc *sch, struct htb_class *cl_old,
++ struct htb_class *cl_new, bool destroying)
+ {
+ struct netdev_queue *queue_old, *queue_new;
+ struct net_device *dev = qdisc_dev(sch);
+- struct Qdisc *qdisc;
+
+- queue_old = netdev_get_tx_queue(dev, qid_old);
+- queue_new = netdev_get_tx_queue(dev, qid_new);
++ queue_old = htb_offload_get_queue(cl_old);
++ queue_new = htb_offload_get_queue(cl_new);
+
+- if (dev->flags & IFF_UP)
+- dev_deactivate(dev);
+- qdisc = dev_graft_qdisc(queue_old, NULL);
+- qdisc->dev_queue = queue_new;
+- qdisc = dev_graft_qdisc(queue_new, qdisc);
+- if (dev->flags & IFF_UP)
+- dev_activate(dev);
++ if (!destroying) {
++ struct Qdisc *qdisc;
+
+- WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN));
++ if (dev->flags & IFF_UP)
++ dev_deactivate(dev);
++ qdisc = dev_graft_qdisc(queue_old, NULL);
++ WARN_ON(qdisc != cl_old->leaf.q);
++ }
++
++ if (!(cl_old->leaf.q->flags & TCQ_F_BUILTIN))
++ cl_old->leaf.q->dev_queue = queue_new;
++ cl_old->leaf.offload_queue = queue_new;
++
++ if (!destroying) {
++ struct Qdisc *qdisc;
++
++ qdisc = dev_graft_qdisc(queue_new, cl_old->leaf.q);
++ if (dev->flags & IFF_UP)
++ dev_activate(dev);
++ WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN));
++ }
+ }
+
+ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+@@ -1407,10 +1431,8 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
+ if (cl->level)
+ return -EINVAL;
+
+- if (q->offload) {
+- dev_queue = new->dev_queue;
+- WARN_ON(dev_queue != cl->leaf.q->dev_queue);
+- }
++ if (q->offload)
++ dev_queue = htb_offload_get_queue(cl);
+
+ if (!new) {
+ new = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
+@@ -1479,6 +1501,8 @@ static void htb_parent_to_leaf(struct Qdisc *sch, struct htb_class *cl,
+ parent->ctokens = parent->cbuffer;
+ parent->t_c = ktime_get_ns();
+ parent->cmode = HTB_CAN_SEND;
++ if (q->offload)
++ parent->leaf.offload_queue = cl->leaf.offload_queue;
+ }
+
+ static void htb_parent_to_leaf_offload(struct Qdisc *sch,
+@@ -1499,6 +1523,7 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
+ struct netlink_ext_ack *extack)
+ {
+ struct tc_htb_qopt_offload offload_opt;
++ struct netdev_queue *dev_queue;
+ struct Qdisc *q = cl->leaf.q;
+ struct Qdisc *old = NULL;
+ int err;
+@@ -1507,16 +1532,15 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
+ return -EINVAL;
+
+ WARN_ON(!q);
+- if (!destroying) {
+- /* On destroy of HTB, two cases are possible:
+- * 1. q is a normal qdisc, but q->dev_queue has noop qdisc.
+- * 2. q is a noop qdisc (for nodes that were inner),
+- * q->dev_queue is noop_netdev_queue.
++ dev_queue = htb_offload_get_queue(cl);
++ old = htb_graft_helper(dev_queue, NULL);
++ if (destroying)
++ /* Before HTB is destroyed, the kernel grafts noop_qdisc to
++ * all queues.
+ */
+- old = htb_graft_helper(q->dev_queue, NULL);
+- WARN_ON(!old);
++ WARN_ON(!(old->flags & TCQ_F_BUILTIN));
++ else
+ WARN_ON(old != q);
+- }
+
+ if (cl->parent) {
+ cl->parent->bstats_bias.bytes += q->bstats.bytes;
+@@ -1535,18 +1559,17 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
+ if (!err || destroying)
+ qdisc_put(old);
+ else
+- htb_graft_helper(q->dev_queue, old);
++ htb_graft_helper(dev_queue, old);
+
+ if (last_child)
+ return err;
+
+- if (!err && offload_opt.moved_qid != 0) {
+- if (destroying)
+- q->dev_queue = netdev_get_tx_queue(qdisc_dev(sch),
+- offload_opt.qid);
+- else
+- htb_offload_move_qdisc(sch, offload_opt.moved_qid,
+- offload_opt.qid);
++ if (!err && offload_opt.classid != TC_H_MIN(cl->common.classid)) {
++ u32 classid = TC_H_MAJ(sch->handle) |
++ TC_H_MIN(offload_opt.classid);
++ struct htb_class *moved_cl = htb_find(classid, sch);
++
++ htb_offload_move_qdisc(sch, moved_cl, cl, destroying);
+ }
+
+ return err;
+@@ -1669,9 +1692,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg,
+ }
+
+ if (last_child) {
+- struct netdev_queue *dev_queue;
++ struct netdev_queue *dev_queue = sch->dev_queue;
++
++ if (q->offload)
++ dev_queue = htb_offload_get_queue(cl);
+
+- dev_queue = q->offload ? cl->leaf.q->dev_queue : sch->dev_queue;
+ new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
+ cl->parent->common.classid,
+ NULL);
+@@ -1843,7 +1868,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
+ }
+ dev_queue = netdev_get_tx_queue(dev, offload_opt.qid);
+ } else { /* First child. */
+- dev_queue = parent->leaf.q->dev_queue;
++ dev_queue = htb_offload_get_queue(parent);
+ old_q = htb_graft_helper(dev_queue, NULL);
+ WARN_ON(old_q != parent->leaf.q);
+ offload_opt = (struct tc_htb_qopt_offload) {
+@@ -1900,6 +1925,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
+
+ /* leaf (we) needs elementary qdisc */
+ cl->leaf.q = new_q ? new_q : &noop_qdisc;
++ if (q->offload)
++ cl->leaf.offload_queue = dev_queue;
+
+ cl->parent = parent;
+
+--
+2.30.2
+
--- /dev/null
+From 5095dd90b91a1d84597d0e3b6022c3d762bc209f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 15:59:25 +0200
+Subject: sched/deadline: Fix missing clock update in migrate_task_rq_dl()
+
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+
+[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ]
+
+A missing clock update is causing the following warning:
+
+rq->clock_update_flags < RQCF_ACT_SKIP
+WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453
+sub_running_bw.isra.0+0x190/0x1a0
+...
+CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1
+Hardware name: WIWYNN Mt.Jade Server System
+B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP:
+1.06.20210526) 2021/05/26
+...
+Call trace:
+ sub_running_bw.isra.0+0x190/0x1a0
+ migrate_task_rq_dl+0xf8/0x1e0
+ set_task_cpu+0xa8/0x1f0
+ try_to_wake_up+0x150/0x3d4
+ wake_up_q+0x64/0xc0
+ __up_write+0xd0/0x1c0
+ up_write+0x4c/0x2b0
+ cppc_set_perf+0x120/0x2d0
+ cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq]
+ __cpufreq_driver_target+0x74/0x140
+ sugov_work+0x64/0x80
+ kthread_worker_fn+0xe0/0x230
+ kthread+0x138/0x140
+ ret_from_fork+0x10/0x18
+
+The task causing this is the `cppc_fie` DL task introduced by
+commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency
+invariance").
+
+With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on
+slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm
+Server):
+
+DL task `curr=sugov:112` lets `p=cppc_fie` migrate and since the latter
+is in `non_contending` state, migrate_task_rq_dl() calls
+
+ sub_running_bw()->__sub_running_bw()->cpufreq_update_util()->
+ rq_clock()->assert_clock_updated()
+
+on p.
+
+Fix this by updating the clock for a non_contending task in
+migrate_task_rq_dl() before calling sub_running_bw().
+
+Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
+Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@kernel.org>
+Acked-by: Juri Lelli <juri.lelli@redhat.com>
+Link: https://lore.kernel.org/r/20210804135925.3734605-1-dietmar.eggemann@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 7ddb1202794f..fa29a69e14c9 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -1733,6 +1733,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused
+ */
+ raw_spin_lock(&rq->lock);
+ if (p->dl.dl_non_contending) {
++ update_rq_clock(rq);
+ sub_running_bw(&p->dl, &rq->dl);
+ p->dl.dl_non_contending = 0;
+ /*
+--
+2.30.2
+
--- /dev/null
+From ee2b66edf0731ab60ef8372f0d5fa0f8b0ec518d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Jul 2021 11:11:01 +0100
+Subject: sched/deadline: Fix reset_on_fork reporting of DL tasks
+
+From: Quentin Perret <qperret@google.com>
+
+[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ]
+
+It is possible for sched_getattr() to incorrectly report the state of
+the reset_on_fork flag when called on a deadline task.
+
+Indeed, if the flag was set on a deadline task using sched_setattr()
+with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then
+p->sched_reset_on_fork will be set, but __setscheduler() will bail out
+early, which means that the dl_se->flags will not get updated by
+__setscheduler_params()->__setparam_dl(). Consequently, if
+sched_getattr() is then called on the task, __getparam_dl() will
+override kattr.sched_flags with the now out-of-date copy in dl_se->flags
+and report the stale value to userspace.
+
+To fix this, make sure to only copy the flags that are relevant to
+sched_deadline to and from the dl_se->flags field.
+
+Signed-off-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20210727101103.2729607-2-qperret@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 7 ++++---
+ kernel/sched/sched.h | 2 ++
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 2f9964b467e0..7ddb1202794f 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2729,7 +2729,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
+ dl_se->dl_runtime = attr->sched_runtime;
+ dl_se->dl_deadline = attr->sched_deadline;
+ dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
+- dl_se->flags = attr->sched_flags;
++ dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS;
+ dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
+ dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime);
+ }
+@@ -2742,7 +2742,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr)
+ attr->sched_runtime = dl_se->dl_runtime;
+ attr->sched_deadline = dl_se->dl_deadline;
+ attr->sched_period = dl_se->dl_period;
+- attr->sched_flags = dl_se->flags;
++ attr->sched_flags &= ~SCHED_DL_FLAGS;
++ attr->sched_flags |= dl_se->flags;
+ }
+
+ /*
+@@ -2839,7 +2840,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)
+ if (dl_se->dl_runtime != attr->sched_runtime ||
+ dl_se->dl_deadline != attr->sched_deadline ||
+ dl_se->dl_period != attr->sched_period ||
+- dl_se->flags != attr->sched_flags)
++ dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS))
+ return true;
+
+ return false;
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index f2bc99ca01e5..9aa157c20722 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -227,6 +227,8 @@ static inline void update_avg(u64 *avg, u64 sample)
+ */
+ #define SCHED_FLAG_SUGOV 0x10000000
+
++#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV)
++
+ static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se)
+ {
+ #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
+--
+2.30.2
+
--- /dev/null
+From 59ba0834202099515f67ce344de92dcba631cf93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 14:07:25 +0100
+Subject: sched/debug: Don't update sched_domain debug directories before
+ sched_debug_init()
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 459b09b5a3254008b63382bf41a9b36d0b590f57 ]
+
+Since CPU capacity asymmetry can stem purely from maximum frequency
+differences (e.g. Pixel 1), a rebuild of the scheduler topology can be
+issued upon loading cpufreq, see:
+
+ arch_topology.c::init_cpu_capacity_callback()
+
+Turns out that if this rebuild happens *before* sched_debug_init() is
+run (which is a late initcall), we end up messing up the sched_domain debug
+directory: passing a NULL parent to debugfs_create_dir() ends up creating
+the directory at the debugfs root, which in this case creates
+/sys/kernel/debug/domains (instead of /sys/kernel/debug/sched/domains).
+
+This currently doesn't happen on asymmetric systems which use cpufreq-scpi
+or cpufreq-dt drivers, as those are loaded via
+deferred_probe_initcall() (it is also a late initcall, but appears to be
+ordered *after* sched_debug_init()).
+
+Ionela has been working on detecting maximum frequency asymmetry via ACPI,
+and that actually happens via a *device* initcall, thus before
+sched_debug_init(), and causes the aforementionned debugfs mayhem.
+
+One option would be to punt sched_debug_init() down to
+fs_initcall_sync(). Preventing update_sched_domain_debugfs() from running
+before sched_debug_init() appears to be the safer option.
+
+Fixes: 3b87f136f8fc ("sched,debug: Convert sysctl sched_domains to debugfs")
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: http://lore.kernel.org/r/20210514095339.12979-1-ionela.voinescu@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index c5aacbd492a1..f8c94bebd17d 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -388,6 +388,13 @@ void update_sched_domain_debugfs(void)
+ {
+ int cpu, i;
+
++ /*
++ * This can unfortunately be invoked before sched_debug_init() creates
++ * the debug directory. Don't touch sd_sysctl_cpus until then.
++ */
++ if (!debugfs_sched)
++ return;
++
+ if (!cpumask_available(sd_sysctl_cpus)) {
+ if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL))
+ return;
+--
+2.30.2
+
--- /dev/null
+From 91cbc1f41d967c1382f6bcd0ede69768aea6f211 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 11:21:53 +0100
+Subject: sched: Fix UCLAMP_FLAG_IDLE setting
+
+From: Quentin Perret <qperret@google.com>
+
+[ Upstream commit ca4984a7dd863f3e1c0df775ae3e744bff24c303 ]
+
+The UCLAMP_FLAG_IDLE flag is set on a runqueue when dequeueing the last
+uclamp active task (that is, when buckets.tasks reaches 0 for all
+buckets) to maintain the last uclamp.max and prevent blocked util from
+suddenly becoming visible.
+
+However, there is an asymmetry in how the flag is set and cleared which
+can lead to having the flag set whilst there are active tasks on the rq.
+Specifically, the flag is cleared in the uclamp_rq_inc() path, which is
+called at enqueue time, but set in uclamp_rq_dec_id() which is called
+both when dequeueing a task _and_ in the update_uclamp_active() path. As
+a result, when both uclamp_rq_{dec,ind}_id() are called from
+update_uclamp_active(), the flag ends up being set but not cleared,
+hence leaving the runqueue in a broken state.
+
+Fix this by clearing the flag in update_uclamp_active() as well.
+
+Fixes: e496187da710 ("sched/uclamp: Enforce last task's UCLAMP_MAX")
+Reported-by: Rick Yiu <rickyiu@google.com>
+Signed-off-by: Quentin Perret <qperret@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Qais Yousef <qais.yousef@arm.com>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Link: https://lore.kernel.org/r/20210805102154.590709-2-qperret@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 15b4d2fb6be3..1e9672d609f7 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1281,6 +1281,23 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p)
+ uclamp_rq_dec_id(rq, p, clamp_id);
+ }
+
++static inline void uclamp_rq_reinc_id(struct rq *rq, struct task_struct *p,
++ enum uclamp_id clamp_id)
++{
++ if (!p->uclamp[clamp_id].active)
++ return;
++
++ uclamp_rq_dec_id(rq, p, clamp_id);
++ uclamp_rq_inc_id(rq, p, clamp_id);
++
++ /*
++ * Make sure to clear the idle flag if we've transiently reached 0
++ * active tasks on rq.
++ */
++ if (clamp_id == UCLAMP_MAX && (rq->uclamp_flags & UCLAMP_FLAG_IDLE))
++ rq->uclamp_flags &= ~UCLAMP_FLAG_IDLE;
++}
++
+ static inline void
+ uclamp_update_active(struct task_struct *p)
+ {
+@@ -1304,12 +1321,8 @@ uclamp_update_active(struct task_struct *p)
+ * affecting a valid clamp bucket, the next time it's enqueued,
+ * it will already see the updated clamp bucket value.
+ */
+- for_each_clamp_id(clamp_id) {
+- if (p->uclamp[clamp_id].active) {
+- uclamp_rq_dec_id(rq, p, clamp_id);
+- uclamp_rq_inc_id(rq, p, clamp_id);
+- }
+- }
++ for_each_clamp_id(clamp_id)
++ uclamp_rq_reinc_id(rq, p, clamp_id);
+
+ task_rq_unlock(rq, p, &rf);
+ }
+--
+2.30.2
+
--- /dev/null
+From f52135a4de3a020b987d6483065b4443aa7dadac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Jul 2021 09:39:46 +0300
+Subject: sched/numa: Fix is_core_idle()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mika Penttilä <mika.penttila@gmail.com>
+
+[ Upstream commit 1c6829cfd3d5124b125e6df41158665aea413b35 ]
+
+Use the loop variable instead of the function argument to test the
+other SMT siblings for idle.
+
+Fixes: ff7db0bf24db ("sched/numa: Prefer using an idle CPU as a migration target instead of comparing tasks")
+Signed-off-by: Mika Penttilä <mika.penttila@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Acked-by: Pankaj Gupta <pankaj.gupta@ionos.com>
+Link: https://lkml.kernel.org/r/20210722063946.28951-1-mika.penttila@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index f60ef0b4ec33..3889fee98d11 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1529,7 +1529,7 @@ static inline bool is_core_idle(int cpu)
+ if (cpu == sibling)
+ continue;
+
+- if (!idle_cpu(cpu))
++ if (!idle_cpu(sibling))
+ return false;
+ }
+ #endif
+--
+2.30.2
+
--- /dev/null
+From 7ba3f7d8ebf5ed22d31253bcaf7196c05f5534ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 13:13:33 +0530
+Subject: sched/topology: Skip updating masks for non-online nodes
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit 0083242c93759dde353a963a90cb351c5c283379 ]
+
+The scheduler currently expects NUMA node distances to be stable from
+init onwards, and as a consequence builds the related data structures
+once-and-for-all at init (see sched_init_numa()).
+
+Unfortunately, on some architectures node distance is unreliable for
+offline nodes and may very well change upon onlining.
+
+Skip over offline nodes during sched_init_numa(). Track nodes that have
+been onlined at least once, and trigger a build of a node's NUMA masks
+when it is first onlined post-init.
+
+Reported-by: Geetika Moolchandani <Geetika.Moolchandani1@ibm.com>
+Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20210818074333.48645-1-srikar@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/topology.c | 65 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 55a0a243e871..41f778f3db05 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1372,6 +1372,8 @@ int sched_max_numa_distance;
+ static int *sched_domains_numa_distance;
+ static struct cpumask ***sched_domains_numa_masks;
+ int __read_mostly node_reclaim_distance = RECLAIM_DISTANCE;
++
++static unsigned long __read_mostly *sched_numa_onlined_nodes;
+ #endif
+
+ /*
+@@ -1719,6 +1721,16 @@ void sched_init_numa(void)
+ sched_domains_numa_masks[i][j] = mask;
+
+ for_each_node(k) {
++ /*
++ * Distance information can be unreliable for
++ * offline nodes, defer building the node
++ * masks to its bringup.
++ * This relies on all unique distance values
++ * still being visible at init time.
++ */
++ if (!node_online(j))
++ continue;
++
+ if (sched_debug() && (node_distance(j, k) != node_distance(k, j)))
+ sched_numa_warn("Node-distance not symmetric");
+
+@@ -1772,6 +1784,53 @@ void sched_init_numa(void)
+ sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1];
+
+ init_numa_topology_type();
++
++ sched_numa_onlined_nodes = bitmap_alloc(nr_node_ids, GFP_KERNEL);
++ if (!sched_numa_onlined_nodes)
++ return;
++
++ bitmap_zero(sched_numa_onlined_nodes, nr_node_ids);
++ for_each_online_node(i)
++ bitmap_set(sched_numa_onlined_nodes, i, 1);
++}
++
++static void __sched_domains_numa_masks_set(unsigned int node)
++{
++ int i, j;
++
++ /*
++ * NUMA masks are not built for offline nodes in sched_init_numa().
++ * Thus, when a CPU of a never-onlined-before node gets plugged in,
++ * adding that new CPU to the right NUMA masks is not sufficient: the
++ * masks of that CPU's node must also be updated.
++ */
++ if (test_bit(node, sched_numa_onlined_nodes))
++ return;
++
++ bitmap_set(sched_numa_onlined_nodes, node, 1);
++
++ for (i = 0; i < sched_domains_numa_levels; i++) {
++ for (j = 0; j < nr_node_ids; j++) {
++ if (!node_online(j) || node == j)
++ continue;
++
++ if (node_distance(j, node) > sched_domains_numa_distance[i])
++ continue;
++
++ /* Add remote nodes in our masks */
++ cpumask_or(sched_domains_numa_masks[i][node],
++ sched_domains_numa_masks[i][node],
++ sched_domains_numa_masks[0][j]);
++ }
++ }
++
++ /*
++ * A new node has been brought up, potentially changing the topology
++ * classification.
++ *
++ * Note that this is racy vs any use of sched_numa_topology_type :/
++ */
++ init_numa_topology_type();
+ }
+
+ void sched_domains_numa_masks_set(unsigned int cpu)
+@@ -1779,8 +1838,14 @@ void sched_domains_numa_masks_set(unsigned int cpu)
+ int node = cpu_to_node(cpu);
+ int i, j;
+
++ __sched_domains_numa_masks_set(node);
++
+ for (i = 0; i < sched_domains_numa_levels; i++) {
+ for (j = 0; j < nr_node_ids; j++) {
++ if (!node_online(j))
++ continue;
++
++ /* Set ourselves in the remote node's masks */
+ if (node_distance(j, node) <= sched_domains_numa_distance[i])
+ cpumask_set_cpu(cpu, sched_domains_numa_masks[i][j]);
+ }
+--
+2.30.2
+
--- /dev/null
+From 162215fb5dc25d2f818804cae26324fd016de957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 18:40:36 +0200
+Subject: selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP
+
+From: Jose Blanquicet <josebl@microsoft.com>
+
+[ Upstream commit 277b134057036df8c657079ca92c3e5e7d10aeaf ]
+
+Currently, this test is incorrectly printing the destination port in
+place of the destination IP.
+
+Fixes: 2767c97765cb ("selftests/bpf: Implement sample tcp/tcp6 bpf_iter programs")
+Signed-off-by: Jose Blanquicet <josebl@microsoft.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210805164044.527903-1-josebl@microsoft.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
+index 54380c5e1069..aa96b604b2b3 100644
+--- a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
++++ b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
+@@ -122,7 +122,7 @@ static int dump_tcp_sock(struct seq_file *seq, struct tcp_sock *tp,
+ }
+
+ BPF_SEQ_PRINTF(seq, "%4d: %08X:%04X %08X:%04X ",
+- seq_num, src, srcp, destp, destp);
++ seq_num, src, srcp, dest, destp);
+ BPF_SEQ_PRINTF(seq, "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d ",
+ state,
+ tp->write_seq - tp->snd_una, rx_queue,
+--
+2.30.2
+
--- /dev/null
+From 3168e6bb3346f3f211329d60f40f5beb1cc66ab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 00:48:14 +0200
+Subject: selftests/bpf: Fix test_core_autosize on big-endian machines
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit d164dd9a5c08c16a883b3de97d13948c7be7fa4d ]
+
+The "probed" part of test_core_autosize copies an integer using
+bpf_core_read() into an integer of a potentially different size.
+On big-endian machines a destination offset is required for this to
+produce a sensible result.
+
+Fixes: 888d83b961f6 ("selftests/bpf: Validate libbpf's auto-sizing of LD/ST/STX instructions")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210812224814.187460-1-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_core_autosize.c | 20 ++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_core_autosize.c b/tools/testing/selftests/bpf/progs/test_core_autosize.c
+index 44f5aa2e8956..9a7829c5e4a7 100644
+--- a/tools/testing/selftests/bpf/progs/test_core_autosize.c
++++ b/tools/testing/selftests/bpf/progs/test_core_autosize.c
+@@ -125,6 +125,16 @@ int handle_downsize(void *ctx)
+ return 0;
+ }
+
++#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
++#define bpf_core_read_int bpf_core_read
++#else
++#define bpf_core_read_int(dst, sz, src) ({ \
++ /* Prevent "subtraction from stack pointer prohibited" */ \
++ volatile long __off = sizeof(*dst) - (sz); \
++ bpf_core_read((char *)(dst) + __off, sz, src); \
++})
++#endif
++
+ SEC("raw_tp/sys_enter")
+ int handle_probed(void *ctx)
+ {
+@@ -132,23 +142,23 @@ int handle_probed(void *ctx)
+ __u64 tmp;
+
+ tmp = 0;
+- bpf_core_read(&tmp, bpf_core_field_size(in->ptr), &in->ptr);
++ bpf_core_read_int(&tmp, bpf_core_field_size(in->ptr), &in->ptr);
+ ptr_probed = tmp;
+
+ tmp = 0;
+- bpf_core_read(&tmp, bpf_core_field_size(in->val1), &in->val1);
++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val1), &in->val1);
+ val1_probed = tmp;
+
+ tmp = 0;
+- bpf_core_read(&tmp, bpf_core_field_size(in->val2), &in->val2);
++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val2), &in->val2);
+ val2_probed = tmp;
+
+ tmp = 0;
+- bpf_core_read(&tmp, bpf_core_field_size(in->val3), &in->val3);
++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val3), &in->val3);
+ val3_probed = tmp;
+
+ tmp = 0;
+- bpf_core_read(&tmp, bpf_core_field_size(in->val4), &in->val4);
++ bpf_core_read_int(&tmp, bpf_core_field_size(in->val4), &in->val4);
+ val4_probed = tmp;
+
+ return 0;
+--
+2.30.2
+
--- /dev/null
+locking-mutex-fix-handoff-condition.patch
+regmap-fix-the-offset-of-register-error-log.patch
+regulator-tps65910-silence-deferred-probe-error.patch
+crypto-mxs-dcp-check-for-dma-mapping-errors.patch
+sched-deadline-fix-reset_on_fork-reporting-of-dl-tas.patch
+power-supply-axp288_fuel_gauge-report-register-addre.patch
+crypto-omap-sham-clear-dma-flags-only-after-omap_sha.patch
+sched-deadline-fix-missing-clock-update-in-migrate_t.patch
+rcu-tree-handle-vm-stoppage-in-stall-detection.patch
+edac-mce_amd-do-not-load-edac_mce_amd-module-on-gues.patch
+posix-cpu-timers-force-next-expiration-recalc-after-.patch
+hrtimer-avoid-double-reprogramming-in-__hrtimer_star.patch
+hrtimer-ensure-timerfd-notification-for-highres-n.patch
+udf-check-lvid-earlier.patch
+udf-fix-iocharset-utf8-mount-option.patch
+isofs-joliet-fix-iocharset-utf8-mount-option.patch
+bcache-add-proper-error-unwinding-in-bcache_device_i.patch
+nbd-add-the-check-to-prevent-overflow-in-__nbd_ioctl.patch
+blk-throtl-optimize-iops-throttle-for-large-io-scena.patch
+nvme-tcp-don-t-update-queue-count-when-failing-to-se.patch
+nvme-rdma-don-t-update-queue-count-when-failing-to-s.patch
+nvmet-pass-back-cntlid-on-successful-completion.patch
+power-supply-smb347-charger-add-missing-pin-control-.patch
+power-supply-max17042_battery-fix-typo-in-max17042_t.patch
+s390-cio-add-dev_busid-sysfs-entry-for-each-subchann.patch
+s390-zcrypt-fix-wrong-offset-index-for-apka-master-k.patch
+libata-fix-ata_host_start.patch
+sched-topology-skip-updating-masks-for-non-online-no.patch
+crypto-omap-fix-inconsistent-locking-of-device-lists.patch
+crypto-qat-do-not-ignore-errors-from-enable_vf2pf_co.patch
+crypto-qat-handle-both-source-of-interrupt-in-vf-isr.patch
+crypto-qat-fix-reuse-of-completion-variable.patch
+crypto-qat-fix-naming-for-init-shutdown-vf-to-pf-not.patch
+crypto-qat-do-not-export-adf_iov_putmsg.patch
+crypto-hisilicon-sec-fix-the-abnormal-exiting-proces.patch
+crypto-hisilicon-sec-modify-the-hardware-endian-conf.patch
+crypto-tcrypt-fix-missing-return-value-check.patch
+fcntl-fix-potential-deadlocks-for-fown_struct.lock.patch
+fcntl-fix-potential-deadlock-for-fasync_struct.fa_lo.patch
+udf_get_extendedattr-had-no-boundary-checks.patch
+io-wq-remove-gfp_atomic-allocation-off-schedule-out-.patch
+s390-kasan-fix-large-pmd-pages-address-alignment-che.patch
+s390-pci-fix-misleading-rc-in-clp_set_pci_fn.patch
+s390-debug-keep-debug-data-on-resize.patch
+s390-debug-fix-debug-area-life-cycle.patch
+s390-ap-fix-state-machine-hang-after-failure-to-enab.patch
+sched-debug-don-t-update-sched_domain-debug-director.patch
+power-supply-cw2015-use-dev_err_probe-to-allow-defer.patch
+m68k-emu-fix-invalid-free-in-nfeth_cleanup.patch
+crypto-x86-aes-ni-add-missing-error-checks-in-xts-co.patch
+crypto-ecc-handle-unaligned-input-buffer-in-ecc_swap.patch
+sched-numa-fix-is_core_idle.patch
+sched-fix-uclamp_flag_idle-setting.patch
+rcu-fix-to-include-first-blocked-task-in-stall-warni.patch
+rcu-fix-stall-warning-deadlock-due-to-non-release-of.patch
+m68k-fix-invalid-rmw_insns-on-cpus-that-lack-cas.patch
+block-return-elevator_discard_merge-if-possible.patch
+spi-spi-fsl-dspi-fix-issue-with-uninitialized-dma_sl.patch
+spi-spi-pic32-fix-issue-with-uninitialized-dma_slave.patch
+genirq-timings-fix-error-return-code-in-irq_timings_.patch
+irqchip-loongson-pch-pic-improve-edge-triggered-inte.patch
+lib-mpi-use-kcalloc-in-mpi_resize.patch
+clocksource-drivers-sh_cmt-fix-wrong-setting-if-don-.patch
+block-nbd-add-sanity-check-for-first_minor.patch
+spi-coldfire-qspi-use-clk_disable_unprepare-in-the-r.patch
+irqchip-apple-aic-fix-irq_disable-from-within-irq-ha.patch
+irqchip-gic-v3-fix-priority-comparison-when-non-secu.patch
+crypto-qat-use-proper-type-for-vf_mask.patch
+certs-trigger-creation-of-rsa-module-signing-key-if-.patch
+tpm-ibmvtpm-avoid-error-message-when-process-gets-si.patch
+io_uring-refactor-io_submit_flush_completions.patch
+x86-mce-defer-processing-of-early-errors.patch
+spi-davinci-invoke-chipselect-callback.patch
+blk-crypto-fix-check-for-too-large-dun_bytes.patch
+regulator-vctrl-use-locked-regulator_get_voltage-in-.patch
+regulator-vctrl-avoid-lockdep-warning-in-enable-disa.patch
+spi-sprd-fix-the-wrong-wdg_load_val.patch
+spi-spi-zynq-qspi-use-wait_for_completion_timeout-to.patch
+crypto-rmd320-remove-rmd320-in-makefile.patch
+edac-i10nm-fix-nvdimm-detection.patch
+drm-panfrost-fix-missing-clk_disable_unprepare-on-er.patch
+drm-gma500-fix-end-of-loop-tests-for-list_for_each_e.patch
+asoc-mediatek-mt8192-fix-unbalanced-pm_runtime_enabl.patch
+asoc-mediatek-mt8183-fix-unbalanced-pm_runtime_enabl.patch
+media-tda1997x-enable-edid-support.patch
+leds-is31fl32xx-fix-missing-error-code-in-is31fl32xx.patch
+soc-rockchip-rockchip_grf-should-not-default-to-y-un.patch
+media-cxd2880-spi-fix-an-error-handling-path.patch
+drm-of-free-the-right-object.patch
+bpf-fix-a-typo-of-reuseport-map-in-bpf.h.patch
+bpf-fix-potential-memleak-and-uaf-in-the-verifier.patch
+drm-of-free-the-iterator-object-on-failure.patch
+gve-fix-the-wrong-adminq-buffer-overflow-check.patch
+libbpf-fix-the-possible-memory-leak-on-error.patch
+arm-dts-aspeed-g6-fix-hvi3c-function-group-in-pinctr.patch
+arm64-dts-renesas-r8a77995-draak-remove-bogus-adv751.patch
+i40e-improve-locking-of-mac_filter_hash.patch
+arm64-dts-qcom-sc7180-set-adau-wakeup-delay-to-80-ms.patch
+soc-qcom-rpmhpd-use-corner-in-power_off.patch
+libbpf-fix-removal-of-inner-map-in-bpf_object__creat.patch
+gfs2-fix-memory-leak-of-object-lsi-on-error-return-p.patch
+arm64-dts-qcom-sm8250-fix-usb2-qmp-phy-node.patch
+bpf-selftests-fix-test_maps-now-that-sockmap-support.patch
+firmware-fix-theoretical-uaf-race-with-firmware-cach.patch
+driver-core-fix-error-return-code-in-really_probe.patch
+ionic-cleanly-release-devlink-instance.patch
+media-dvb-usb-fix-uninit-value-in-dvb_usb_adapter_dv.patch
+media-dvb-usb-fix-uninit-value-in-vp702x_read_mac_ad.patch
+media-dvb-usb-fix-error-handling-in-dvb_usb_i2c_init.patch
+media-go7007-fix-memory-leak-in-go7007_usb_probe.patch
+media-go7007-remove-redundant-initialization.patch
+media-rockchip-rga-use-pm_runtime_resume_and_get.patch
+media-rockchip-rga-fix-error-handling-in-probe.patch
+media-coda-fix-frame_mem_ctrl-for-yuv420-and-yvu420-.patch
+media-atomisp-fix-the-uninitialized-use-and-rename-r.patch
+bluetooth-sco-prevent-information-leak-in-sco_conn_d.patch
+bluetooth-btusb-fix-a-unspported-condition-to-set-av.patch
+6lowpan-iphc-fix-an-off-by-one-check-of-array-index.patch
+drm-amdgpu-acp-make-pm-domain-really-work.patch
+tcp-seq_file-avoid-skipping-sk-during-tcp_seek_last_.patch
+arm-dts-meson8-use-a-higher-default-gpu-clock-freque.patch
+arm-dts-meson8b-odroidc1-fix-the-pwm-regulator-suppl.patch
+arm-dts-meson8b-mxq-fix-the-pwm-regulator-supply-pro.patch
+arm-dts-meson8b-ec100-fix-the-pwm-regulator-supply-p.patch
+net-mlx5e-prohibit-inner-indir-tirs-in-ipoib.patch
+net-mlx5e-block-lro-if-firmware-asks-for-tunneled-lr.patch
+cgroup-cpuset-fix-a-partition-bug-with-hotplug.patch
+drm-mxsfb-enable-recovery-on-underflow.patch
+drm-mxsfb-increase-number-of-outstanding-requests-on.patch
+drm-mxsfb-clear-fifo_clear-bit.patch
+net-cipso-fix-warnings-in-netlbl_cipsov4_add_std.patch
+net-ti-am65-cpsw-nuss-fix-wrong-devlink-release-orde.patch
+drm-rcar-du-don-t-put-reference-to-drm_device-in-rca.patch
+bluetooth-mgmt-fix-wrong-opcode-in-the-response-for-.patch
+tools-free-btf-objects-at-various-locations.patch
+arm64-dts-renesas-hihope-rzg2-ex-add-etheravb-intern.patch
+devlink-break-parameter-notification-sequence-to-be-.patch
+net-mlx5-fix-missing-return-value-in-mlx5_devlink_es.patch
+i2c-highlander-add-irq-check.patch
+leds-lgm-sso-put-fwnode-in-any-case-during-probe.patch
+leds-lgm-sso-don-t-spam-logs-when-probe-is-deferred.patch
+leds-lt3593-put-fwnode-in-any-case-during-probe.patch
+leds-rt8515-put-fwnode-in-any-case-during-probe.patch
+leds-trigger-audio-add-an-activate-callback-to-ensur.patch
+media-em28xx-input-fix-refcount-bug-in-em28xx_usb_di.patch
+media-omap3isp-fix-missing-unlock-in-isp_subdev_noti.patch
+media-venus-hfi-fix-return-value-check-in-sys_get_pr.patch
+media-venus-venc-fix-potential-null-pointer-derefere.patch
+media-venus-helper-do-not-set-constrained-parameters.patch
+soc-mmsys-mediatek-add-mask-to-mmsys-routes.patch
+pci-pm-avoid-forcing-pci_d0-for-wakeup-reasons-incon.patch
+pci-pm-enable-pme-if-it-can-be-signaled-from-d3cold.patch
+bpf-samples-add-missing-mprog-disable-to-xdp_redirec.patch
+soc-qcom-smsm-fix-missed-interrupts-if-state-changes.patch
+debugfs-return-error-during-full-open-_proxy_open-on.patch
+bluetooth-increase-btnamsiz-to-21-chars-to-fix-poten.patch
+net-ti-am65-cpsw-nuss-fix-rx-irq-state-after-.ndo_st.patch
+net-dsa-stop-syncing-the-bridge-mcast_router-attribu.patch
+net-dsa-mt7530-remove-the-.port_set_mrouter-implemen.patch
+net-dsa-don-t-disable-multicast-flooding-to-the-cpu-.patch
+pm-em-increase-energy-calculation-precision.patch
+selftests-bpf-fix-bpf-iter-tcp4-test-to-print-correc.patch
+leds-lgm-sso-propagate-error-codes-from-callee-to-ca.patch
+drm-msm-mdp4-refactor-hw-revision-detection-into-rea.patch
+drm-msm-mdp4-move-hw-revision-detection-to-earlier-p.patch
+drm-msm-dp-update-is_connected-status-base-on-sink-c.patch
+drm-msm-dpu-make-dpu_hw_ctl_clear_all_blendstages-cl.patch
+arm64-dts-exynos-correct-gic-cpu-interfaces-address-.patch
+counter-104-quad-8-return-error-when-invalid-mode-du.patch
+cgroup-cpuset-miscellaneous-code-cleanup.patch
+cgroup-cpuset-fix-violation-of-cpuset-locking-rule.patch
+asoc-intel-fix-platform-id-matching.patch
+bluetooth-fix-repeated-calls-to-sco_sock_kill.patch
+drm-msm-dsi-fix-some-reference-counted-resource-leak.patch
+drm-msm-dp-replug-event-is-converted-into-an-unplug-.patch
+net-mlx5-fix-unpublish-devlink-parameters.patch
+asoc-rt5682-implement-remove-callback.patch
+asoc-rt5682-properly-turn-off-regulators-if-wrong-de.patch
+usb-dwc3-meson-g12a-add-irq-check.patch
+usb-dwc3-qcom-add-irq-check.patch
+usb-gadget-udc-at91-add-irq-check.patch
+usb-gadget-udc-s3c2410-add-irq-check.patch
+usb-misc-brcmstb-usb-pinmap-add-irq-check.patch
+usb-phy-fsl-usb-add-irq-check.patch
+usb-phy-twl6030-add-irq-checks.patch
+usb-gadget-udc-renesas_usb3-fix-soc_device_match-abu.patch
+selftests-bpf-fix-test_core_autosize-on-big-endian-m.patch
+devlink-clear-whole-devlink_flash_notify-struct.patch
+samples-pktgen-add-missing-ipv6-option-to-pktgen-scr.patch
+net-stmmac-fix-intr-tbu-status-affecting-irq-count-s.patch
+bluetooth-move-shutdown-callback-before-flushing-tx-.patch
+pm-cpu-make-notifier-chain-use-a-raw_spinlock_t.patch
+usb-host-ohci-tmio-add-irq-check.patch
+usb-phy-tahvo-add-irq-check.patch
+libbpf-re-build-libbpf.so-when-libbpf.map-changes.patch
+mac80211-fix-insufficient-headroom-issue-for-amsdu.patch
+locking-local_lock-add-missing-owner-initialization.patch
+lockd-fix-invalid-lockowner-cast-after-vfs_test_lock.patch
+sunrpc-fix-a-null-pointer-deref-in-trace_svc_stats_l.patch
+nfsd4-fix-forced-expiry-locking.patch
+arm64-dts-marvell-armada-37xx-extend-pcie-mem-space.patch
+clk-staging-correct-reference-to-config-iomem-to-con.patch
+i2c-synquacer-fix-deferred-probing.patch
+hwmon-pmbus-bpa-rs600-don-t-use-rated-limits-as-warn.patch
+hwmon-remove-amd_energy-driver-in-makefile.patch
+asoc-fsl_rpmsg-check-eprobe_defer-for-getting-clocks.patch
+firmware-raspberrypi-fix-a-leak-in-rpi_firmware_get.patch
+usb-gadget-mv_u3d-request_irq-after-initializing-udc.patch
+mm-swap-consider-max-pages-in-iomap_swapfile_add_ext.patch
+lkdtm-replace-scsi_dispatch_cmd-with-scsi_queue_rq.patch
+bluetooth-add-timeout-sanity-check-to-hci_inquiry.patch
+i2c-iop3xx-fix-deferred-probing.patch
+i2c-s3c2410-fix-irq-check.patch
+i2c-hix5hd2-fix-irq-check.patch
+gfs2-init-system-threads-before-freeze-lock.patch
+rsi-fix-error-code-in-rsi_load_9116_firmware.patch
+rsi-fix-an-error-code-in-rsi_probe.patch
+octeontx2-af-cn10k-fix-sdp-base-channel-number.patch
+octeontx2-pf-send-correct-vlan-priority-mask-to-npc_.patch
+octeontx2-pf-don-t-install-vlan-offload-rule-if-netd.patch
+octeontx2-pf-fix-algorithm-index-in-mcam-rules-with-.patch
+m68k-coldfire-return-success-for-clk_enable-null.patch
+asoc-intel-kbl_da7219_max98927-fix-format-selection-.patch
+asoc-intel-skylake-leave-data-as-is-when-invoking-tl.patch
+asoc-intel-skylake-fix-module-resource-and-format-se.patch
+mmc-sdhci-fix-issue-with-uninitialized-dma_slave_con.patch
+mmc-dw_mmc-fix-issue-with-uninitialized-dma_slave_co.patch
+mmc-moxart-fix-issue-with-uninitialized-dma_slave_co.patch
+bpf-fix-possible-out-of-bound-write-in-narrow-load-h.patch
+cifs-fix-a-potencially-linear-read-overflow.patch
+i2c-mt65xx-fix-irq-check.patch
+i2c-xlp9xx-fix-main-irq-check.patch
+octeontx2-pf-cn10k-fix-error-return-code-in-otx2_set.patch
+usb-ehci-orion-handle-errors-of-clk_prepare_enable-i.patch
+usb-bdc-fix-an-error-handling-path-in-bdc_probe-when.patch
+usb-bdc-fix-a-resource-leak-in-the-error-handling-pa.patch
+tty-serial-fsl_lpuart-fix-the-wrong-mapbase-value.patch
+asoc-wcd9335-fix-a-double-irq-free-in-the-remove-fun.patch
+asoc-wcd9335-fix-a-memory-leak-in-the-error-handling.patch
+asoc-wcd9335-disable-irq-on-slave-ports-in-the-remov.patch
+iwlwifi-skip-first-element-in-the-wtas-acpi-table.patch
+net-mlx5-remove-all-auxiliary-devices-at-the-unregis.patch
+net-mlx5e-fix-possible-use-after-free-deleting-fdb-r.patch
+net-mlx5-e-switch-set-vhca-id-valid-flag-when-creati.patch
+net-mlx5e-use-correct-eswitch-for-stack-devices-with.patch
+ice-only-lock-to-update-netdev-dev_addr.patch
+net-phy-marvell10g-fix-broken-phy-interrupts-for-any.patch
+ath6kl-wmi-fix-an-error-code-in-ath6kl_wmi_sync_poin.patch
+atlantic-fix-driver-resume-flow.patch
+bcma-fix-memory-leak-for-internally-handled-cores.patch
+brcmfmac-pcie-fix-oops-on-failure-to-resume-and-repr.patch
+ipv6-make-exception-cache-less-predictible.patch
+ipv4-make-exception-cache-less-predictible.patch
+net-qrtr-make-checks-in-qrtr_endpoint_post-stricter.patch
+sch_htb-fix-inconsistency-when-leaf-qdisc-creation-f.patch
+net-sched-fix-qdisc_rate_table-refcount-leak-when-ge.patch
+net-qualcomm-fix-qca7000-checksum-handling.patch
+octeontx2-af-fix-loop-in-free-and-unmap-counter.patch
+octeontx2-af-fix-mailbox-errors-in-nix_rss_flowkey_c.patch
+octeontx2-af-fix-static-code-analyzer-reported-issue.patch
+octeontx2-af-set-proper-errorcode-for-ipv4-checksum-.patch
+ipv4-fix-endianness-issue-in-inet_rtm_getroute_build.patch
+amdgpu-pm-add-extra-info-to-smu-msg-pre-check-failed.patch
--- /dev/null
+From da22c87cb01432c50b9e94fe3c3805fbf4189a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 09:05:49 +0200
+Subject: soc: mmsys: mediatek: add mask to mmsys routes
+
+From: CK Hu <ck.hu@mediatek.com>
+
+[ Upstream commit 7bdcead7a75e3eab5e711c2da78c2a0360e7f2a4 ]
+
+SOUT has many bits and need to be cleared before set new value.
+Write only could do the clear, but for MOUT, it clears bits that
+should not be cleared. So use a mask to reset only the needed bits.
+
+this fixes HDMI issues on MT7623/BPI-R2 since 5.13
+
+Fixes: 440147639ac7 ("soc: mediatek: mmsys: Use an array for setting the routing registers")
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Link: https://lore.kernel.org/r/20210729070549.5514-1-linux@fw-web.de
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mt8183-mmsys.h | 21 +++--
+ drivers/soc/mediatek/mtk-mmsys.c | 7 +-
+ drivers/soc/mediatek/mtk-mmsys.h | 133 +++++++++++++++++++---------
+ 3 files changed, 112 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/soc/mediatek/mt8183-mmsys.h b/drivers/soc/mediatek/mt8183-mmsys.h
+index 579dfc8dc8fc..9dee485807c9 100644
+--- a/drivers/soc/mediatek/mt8183-mmsys.h
++++ b/drivers/soc/mediatek/mt8183-mmsys.h
+@@ -28,25 +28,32 @@
+ static const struct mtk_mmsys_routes mmsys_mt8183_routing_table[] = {
+ {
+ DDP_COMPONENT_OVL0, DDP_COMPONENT_OVL_2L0,
+- MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L
++ MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L,
++ MT8183_OVL0_MOUT_EN_OVL0_2L
+ }, {
+ DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0,
+- MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0
++ MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0,
++ MT8183_OVL0_2L_MOUT_EN_DISP_PATH0
+ }, {
+ DDP_COMPONENT_OVL_2L1, DDP_COMPONENT_RDMA1,
+- MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1
++ MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1,
++ MT8183_OVL1_2L_MOUT_EN_RDMA1
+ }, {
+ DDP_COMPONENT_DITHER, DDP_COMPONENT_DSI0,
+- MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0
++ MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0,
++ MT8183_DITHER0_MOUT_IN_DSI0
+ }, {
+ DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0,
+- MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L
++ MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L,
++ MT8183_DISP_PATH0_SEL_IN_OVL0_2L
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
+- MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1
++ MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1,
++ MT8183_DPI0_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_COLOR0,
+- MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0
++ MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0,
++ MT8183_RDMA0_SOUT_COLOR0
+ }
+ };
+
+diff --git a/drivers/soc/mediatek/mtk-mmsys.c b/drivers/soc/mediatek/mtk-mmsys.c
+index 080660ef11bf..0f949896fd06 100644
+--- a/drivers/soc/mediatek/mtk-mmsys.c
++++ b/drivers/soc/mediatek/mtk-mmsys.c
+@@ -68,7 +68,9 @@ void mtk_mmsys_ddp_connect(struct device *dev,
+
+ for (i = 0; i < mmsys->data->num_routes; i++)
+ if (cur == routes[i].from_comp && next == routes[i].to_comp) {
+- reg = readl_relaxed(mmsys->regs + routes[i].addr) | routes[i].val;
++ reg = readl_relaxed(mmsys->regs + routes[i].addr);
++ reg &= ~routes[i].mask;
++ reg |= routes[i].val;
+ writel_relaxed(reg, mmsys->regs + routes[i].addr);
+ }
+ }
+@@ -85,7 +87,8 @@ void mtk_mmsys_ddp_disconnect(struct device *dev,
+
+ for (i = 0; i < mmsys->data->num_routes; i++)
+ if (cur == routes[i].from_comp && next == routes[i].to_comp) {
+- reg = readl_relaxed(mmsys->regs + routes[i].addr) & ~routes[i].val;
++ reg = readl_relaxed(mmsys->regs + routes[i].addr);
++ reg &= ~routes[i].mask;
+ writel_relaxed(reg, mmsys->regs + routes[i].addr);
+ }
+ }
+diff --git a/drivers/soc/mediatek/mtk-mmsys.h b/drivers/soc/mediatek/mtk-mmsys.h
+index a760a34e6eca..5f3e2bf0c40b 100644
+--- a/drivers/soc/mediatek/mtk-mmsys.h
++++ b/drivers/soc/mediatek/mtk-mmsys.h
+@@ -35,41 +35,54 @@
+ #define RDMA0_SOUT_DSI1 0x1
+ #define RDMA0_SOUT_DSI2 0x4
+ #define RDMA0_SOUT_DSI3 0x5
++#define RDMA0_SOUT_MASK 0x7
+ #define RDMA1_SOUT_DPI0 0x2
+ #define RDMA1_SOUT_DPI1 0x3
+ #define RDMA1_SOUT_DSI1 0x1
+ #define RDMA1_SOUT_DSI2 0x4
+ #define RDMA1_SOUT_DSI3 0x5
++#define RDMA1_SOUT_MASK 0x7
+ #define RDMA2_SOUT_DPI0 0x2
+ #define RDMA2_SOUT_DPI1 0x3
+ #define RDMA2_SOUT_DSI1 0x1
+ #define RDMA2_SOUT_DSI2 0x4
+ #define RDMA2_SOUT_DSI3 0x5
++#define RDMA2_SOUT_MASK 0x7
+ #define DPI0_SEL_IN_RDMA1 0x1
+ #define DPI0_SEL_IN_RDMA2 0x3
++#define DPI0_SEL_IN_MASK 0x3
+ #define DPI1_SEL_IN_RDMA1 (0x1 << 8)
+ #define DPI1_SEL_IN_RDMA2 (0x3 << 8)
++#define DPI1_SEL_IN_MASK (0x3 << 8)
+ #define DSI0_SEL_IN_RDMA1 0x1
+ #define DSI0_SEL_IN_RDMA2 0x4
++#define DSI0_SEL_IN_MASK 0x7
+ #define DSI1_SEL_IN_RDMA1 0x1
+ #define DSI1_SEL_IN_RDMA2 0x4
++#define DSI1_SEL_IN_MASK 0x7
+ #define DSI2_SEL_IN_RDMA1 (0x1 << 16)
+ #define DSI2_SEL_IN_RDMA2 (0x4 << 16)
++#define DSI2_SEL_IN_MASK (0x7 << 16)
+ #define DSI3_SEL_IN_RDMA1 (0x1 << 16)
+ #define DSI3_SEL_IN_RDMA2 (0x4 << 16)
++#define DSI3_SEL_IN_MASK (0x7 << 16)
+ #define COLOR1_SEL_IN_OVL1 0x1
+
+ #define OVL_MOUT_EN_RDMA 0x1
+ #define BLS_TO_DSI_RDMA1_TO_DPI1 0x8
+ #define BLS_TO_DPI_RDMA1_TO_DSI 0x2
++#define BLS_RDMA1_DSI_DPI_MASK 0xf
+ #define DSI_SEL_IN_BLS 0x0
+ #define DPI_SEL_IN_BLS 0x0
++#define DPI_SEL_IN_MASK 0x1
+ #define DSI_SEL_IN_RDMA 0x1
++#define DSI_SEL_IN_MASK 0x1
+
+ struct mtk_mmsys_routes {
+ u32 from_comp;
+ u32 to_comp;
+ u32 addr;
++ u32 mask;
+ u32 val;
+ };
+
+@@ -91,124 +104,164 @@ struct mtk_mmsys_driver_data {
+ static const struct mtk_mmsys_routes mmsys_default_routing_table[] = {
+ {
+ DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0,
+- DISP_REG_CONFIG_OUT_SEL, BLS_TO_DSI_RDMA1_TO_DPI1
++ DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK,
++ BLS_TO_DSI_RDMA1_TO_DPI1
+ }, {
+ DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0,
+- DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_BLS
++ DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK,
++ DSI_SEL_IN_BLS
+ }, {
+ DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_OUT_SEL, BLS_TO_DPI_RDMA1_TO_DSI
++ DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK,
++ BLS_TO_DPI_RDMA1_TO_DSI
+ }, {
+ DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_RDMA
++ DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK,
++ DSI_SEL_IN_RDMA
+ }, {
+ DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_BLS
++ DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_MASK,
++ DPI_SEL_IN_BLS
+ }, {
+ DDP_COMPONENT_GAMMA, DDP_COMPONENT_RDMA1,
+- DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1
++ DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1,
++ GAMMA_MOUT_EN_RDMA1
+ }, {
+ DDP_COMPONENT_OD0, DDP_COMPONENT_RDMA0,
+- DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0
++ DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0,
++ OD_MOUT_EN_RDMA0
+ }, {
+ DDP_COMPONENT_OD1, DDP_COMPONENT_RDMA1,
+- DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1
++ DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1,
++ OD1_MOUT_EN_RDMA1
+ }, {
+ DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0,
+- DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0
++ DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0,
++ OVL0_MOUT_EN_COLOR0
+ }, {
+ DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0,
+- DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0
++ DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0,
++ COLOR0_SEL_IN_OVL0
+ }, {
+ DDP_COMPONENT_OVL0, DDP_COMPONENT_RDMA0,
+- DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA
++ DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA,
++ OVL_MOUT_EN_RDMA
+ }, {
+ DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1,
+- DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1
++ DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1,
++ OVL1_MOUT_EN_COLOR1
+ }, {
+ DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1,
+- DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1
++ DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1,
++ COLOR1_SEL_IN_OVL1
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI0
++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
++ RDMA0_SOUT_DPI0
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI1,
+- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI1
++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
++ RDMA0_SOUT_DPI1
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI1,
+- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI1
++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
++ RDMA0_SOUT_DSI1
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI2,
+- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI2
++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
++ RDMA0_SOUT_DSI2
+ }, {
+ DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI3,
+- DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI3
++ DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
++ RDMA0_SOUT_DSI3
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI0
++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
++ RDMA1_SOUT_DPI0
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK,
++ DPI0_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1,
+- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI1
++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
++ RDMA1_SOUT_DPI1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1,
+- DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK,
++ DPI1_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI0,
+- DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK,
++ DSI0_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1,
+- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI1
++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
++ RDMA1_SOUT_DSI1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1,
+- DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK,
++ DSI1_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2,
+- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI2
++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
++ RDMA1_SOUT_DSI2
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2,
+- DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK,
++ DSI2_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3,
+- DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI3
++ DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
++ RDMA1_SOUT_DSI3
+ }, {
+ DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3,
+- DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA1
++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK,
++ DSI3_SEL_IN_RDMA1
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI0
++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
++ RDMA2_SOUT_DPI0
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0,
+- DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK,
++ DPI0_SEL_IN_RDMA2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1,
+- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI1
++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
++ RDMA2_SOUT_DPI1
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1,
+- DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK,
++ DPI1_SEL_IN_RDMA2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI0,
+- DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK,
++ DSI0_SEL_IN_RDMA2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1,
+- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI1
++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
++ RDMA2_SOUT_DSI1
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1,
+- DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK,
++ DSI1_SEL_IN_RDMA2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2,
+- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI2
++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
++ RDMA2_SOUT_DSI2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2,
+- DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK,
++ DSI2_SEL_IN_RDMA2
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3,
+- DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI3
++ DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
++ RDMA2_SOUT_DSI3
+ }, {
+ DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3,
+- DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA2
++ DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK,
++ DSI3_SEL_IN_RDMA2
+ }
+ };
+
+--
+2.30.2
+
--- /dev/null
+From cb7bf89eb9f02589a157bdba3e1b2abe3f9e18b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jul 2021 17:54:15 -0700
+Subject: soc: qcom: rpmhpd: Use corner in power_off
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit d43b3a989bc8c06fd4bbb69a7500d180db2d68e8 ]
+
+rpmhpd_aggregate_corner() takes a corner as parameter, but in
+rpmhpd_power_off() the code requests the level of the first corner
+instead.
+
+In all (known) current cases the first corner has level 0, so this
+change should be a nop, but in case that there's a power domain with a
+non-zero lowest level this makes sure that rpmhpd_power_off() actually
+requests the lowest level - which is the closest to "power off" we can
+get.
+
+While touching the code, also skip the unnecessary zero-initialization
+of "ret".
+
+Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver")
+Reviewed-by: Rajendra Nayak <rnayak@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
+Tested-by: Sibi Sankar <sibis@codeaurora.org>
+Link: https://lore.kernel.org/r/20210703005416.2668319-2-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmhpd.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c
+index bb21c4f1c0c4..90d2e5817371 100644
+--- a/drivers/soc/qcom/rpmhpd.c
++++ b/drivers/soc/qcom/rpmhpd.c
+@@ -382,12 +382,11 @@ static int rpmhpd_power_on(struct generic_pm_domain *domain)
+ static int rpmhpd_power_off(struct generic_pm_domain *domain)
+ {
+ struct rpmhpd *pd = domain_to_rpmhpd(domain);
+- int ret = 0;
++ int ret;
+
+ mutex_lock(&rpmhpd_lock);
+
+- ret = rpmhpd_aggregate_corner(pd, pd->level[0]);
+-
++ ret = rpmhpd_aggregate_corner(pd, 0);
+ if (!ret)
+ pd->enabled = false;
+
+--
+2.30.2
+
--- /dev/null
+From 7d8069949543e07f5f42ce5fea000609593c604a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jul 2021 15:57:03 +0200
+Subject: soc: qcom: smsm: Fix missed interrupts if state changes while masked
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ]
+
+The SMSM driver detects interrupt edges by tracking the last state
+it has seen (and has triggered the interrupt handler for). This works
+fine, but only if the interrupt does not change state while masked.
+
+For example, if an interrupt is unmasked while the state is HIGH,
+the stored last_value for that interrupt might still be LOW. Then,
+when the remote processor triggers smsm_intr() we assume that nothing
+has changed, even though the state might have changed from HIGH to LOW.
+
+Attempt to fix this by checking the current remote state before
+unmasking an IRQ. Use atomic operations to avoid the interrupt handler
+from interfering with the unmask function.
+
+This fixes modem crashes in some edge cases with the BAM-DMUX driver.
+Specifically, the BAM-DMUX interrupt handler is not called for the
+HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded
+(and therefore unmasks the interrupt) after the modem was already started:
+
+qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188:
+ Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK
+
+Fixes: c97c4090ff72 ("soc: qcom: smsm: Add driver for Qualcomm SMSM")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Link: https://lore.kernel.org/r/20210712135703.324748-2-stephan@gerhold.net
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/smsm.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
+index 1d3d5e3ec2b0..6e9a9cd28b17 100644
+--- a/drivers/soc/qcom/smsm.c
++++ b/drivers/soc/qcom/smsm.c
+@@ -109,7 +109,7 @@ struct smsm_entry {
+ DECLARE_BITMAP(irq_enabled, 32);
+ DECLARE_BITMAP(irq_rising, 32);
+ DECLARE_BITMAP(irq_falling, 32);
+- u32 last_value;
++ unsigned long last_value;
+
+ u32 *remote_state;
+ u32 *subscription;
+@@ -204,8 +204,7 @@ static irqreturn_t smsm_intr(int irq, void *data)
+ u32 val;
+
+ val = readl(entry->remote_state);
+- changed = val ^ entry->last_value;
+- entry->last_value = val;
++ changed = val ^ xchg(&entry->last_value, val);
+
+ for_each_set_bit(i, entry->irq_enabled, 32) {
+ if (!(changed & BIT(i)))
+@@ -264,6 +263,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)
+ struct qcom_smsm *smsm = entry->smsm;
+ u32 val;
+
++ /* Make sure our last cached state is up-to-date */
++ if (readl(entry->remote_state) & BIT(irq))
++ set_bit(irq, &entry->last_value);
++ else
++ clear_bit(irq, &entry->last_value);
++
+ set_bit(irq, entry->irq_enabled);
+
+ if (entry->subscription) {
+--
+2.30.2
+
--- /dev/null
+From d2d50ca143a43dad8e5ab8e77e3cc8ccaa8d69a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Feb 2021 15:38:55 +0100
+Subject: soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ]
+
+Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
+To fix this, restrict the automatic enabling of ROCKCHIP_GRF to
+ARCH_ROCKCHIP, and ask the user in case of compile-testing.
+
+Fixes: 4c58063d4258f6be ("soc: rockchip: add driver handling grf setup")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210208143855.418374-1-geert+renesas@glider.be
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/rockchip/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig
+index 2c13bf4dd5db..25eb2c1e31bb 100644
+--- a/drivers/soc/rockchip/Kconfig
++++ b/drivers/soc/rockchip/Kconfig
+@@ -6,8 +6,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST
+ #
+
+ config ROCKCHIP_GRF
+- bool
+- default y
++ bool "Rockchip General Register Files support" if COMPILE_TEST
++ default y if ARCH_ROCKCHIP
+ help
+ The General Register Files are a central component providing
+ special additional settings registers for a lot of soc-components.
+--
+2.30.2
+
--- /dev/null
+From 45a4c37b1a21619b17fad711b5bbc25854b1ae8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 22:55:56 +0200
+Subject: spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d68f4c73d729245a47e70eb216fa24bc174ed2e2 ]
+
+'clk_prepare_enable()' is used in the probe, so 'clk_disable_unprepare()'
+should be used in the remove function to be consistent.
+
+Fixes: 499de01c5c0b ("spi: coldfire-qspi: Use clk_prepare_enable and clk_disable_unprepare")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/ee91792ddba61342b0d3284cd4558a2b0016c4e7.1629319838.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-coldfire-qspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
+index 8996115ce736..263ce9047327 100644
+--- a/drivers/spi/spi-coldfire-qspi.c
++++ b/drivers/spi/spi-coldfire-qspi.c
+@@ -444,7 +444,7 @@ static int mcfqspi_remove(struct platform_device *pdev)
+ mcfqspi_wr_qmr(mcfqspi, MCFQSPI_QMR_MSTR);
+
+ mcfqspi_cs_teardown(mcfqspi);
+- clk_disable(mcfqspi->clk);
++ clk_disable_unprepare(mcfqspi->clk);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From bd878e173c3ddc02c68b44618cb1530bdf1e88de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Aug 2021 11:25:56 +0200
+Subject: spi: davinci: invoke chipselect callback
+
+From: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
+
+[ Upstream commit ea4ab99cb58cc9f8d64c0961ff9a059825f304cf ]
+
+Davinci needs to configure chipselect on transfer.
+
+Fixes: 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional")
+Signed-off-by: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Link: https://lore.kernel.org/r/735fb7b0-82aa-5b9b-85e4-53f0c348cc0e@nokia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-davinci.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
+index e114e6fe5ea5..d112c2cac042 100644
+--- a/drivers/spi/spi-davinci.c
++++ b/drivers/spi/spi-davinci.c
+@@ -213,12 +213,6 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
+ * line for the controller
+ */
+ if (spi->cs_gpiod) {
+- /*
+- * FIXME: is this code ever executed? This host does not
+- * set SPI_MASTER_GPIO_SS so this chipselect callback should
+- * not get called from the SPI core when we are using
+- * GPIOs for chip select.
+- */
+ if (value == BITBANG_CS_ACTIVE)
+ gpiod_set_value(spi->cs_gpiod, 1);
+ else
+@@ -945,7 +939,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
+ master->bus_num = pdev->id;
+ master->num_chipselect = pdata->num_chipselect;
+ master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 16);
+- master->flags = SPI_MASTER_MUST_RX;
++ master->flags = SPI_MASTER_MUST_RX | SPI_MASTER_GPIO_SS;
+ master->setup = davinci_spi_setup;
+ master->cleanup = davinci_spi_cleanup;
+ master->can_dma = davinci_spi_can_dma;
+--
+2.30.2
+
--- /dev/null
+From 6289e6dd0e1898ebe135a8889c30d313ea5a4ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:17:26 +0300
+Subject: spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ]
+
+Depending on the DMA driver being used, the struct dma_slave_config may
+need to be initialized to zero for the unused data.
+
+For example, we have three DMA drivers using src_port_window_size and
+dst_port_window_size. If these are left uninitialized, it can cause DMA
+failures.
+
+For spi-fsl-dspi, this is probably not currently an issue but is still
+good to fix though.
+
+Fixes: 90ba37033cb9 ("spi: spi-fsl-dspi: Add DMA support for Vybrid")
+Cc: Sanchayan Maity <maitysanchayan@gmail.com>
+Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://lore.kernel.org/r/20210810081727.19491-1-tony@atomide.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index fb45e6af6638..fd004c9db9dc 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -530,6 +530,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr)
+ goto err_rx_dma_buf;
+ }
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.src_addr = phy_addr + SPI_POPR;
+ cfg.dst_addr = phy_addr + SPI_PUSHR;
+ cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+--
+2.30.2
+
--- /dev/null
+From 29323234673dea4a05f3eda1728b0c59eb2e5237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:17:27 +0300
+Subject: spi: spi-pic32: Fix issue with uninitialized dma_slave_config
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ]
+
+Depending on the DMA driver being used, the struct dma_slave_config may
+need to be initialized to zero for the unused data.
+
+For example, we have three DMA drivers using src_port_window_size and
+dst_port_window_size. If these are left uninitialized, it can cause DMA
+failures.
+
+For spi-pic32, this is probably not currently an issue but is still good to
+fix though.
+
+Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
+Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
+Cc: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210810081727.19491-2-tony@atomide.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pic32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
+index 104bde153efd..5eb7b61bbb4d 100644
+--- a/drivers/spi/spi-pic32.c
++++ b/drivers/spi/spi-pic32.c
+@@ -361,6 +361,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)
+ struct dma_slave_config cfg;
+ int ret;
+
++ memset(&cfg, 0, sizeof(cfg));
+ cfg.device_fc = true;
+ cfg.src_addr = pic32s->dma_base + buf_offset;
+ cfg.dst_addr = pic32s->dma_base + buf_offset;
+--
+2.30.2
+
--- /dev/null
+From f3453f91a1c153d692d28dafbcdd158dba585d61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 08:59:30 +0800
+Subject: spi: spi-zynq-qspi: use wait_for_completion_timeout to make
+ zynq_qspi_exec_mem_op not interruptible
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit 26cfc0dbe43aae60dc03af27077775244f26c167 ]
+
+The function wait_for_completion_interruptible_timeout will return
+-ERESTARTSYS immediately when receiving SIGKILL signal which is sent
+by "jffs2_gcd_mtd" during umounting jffs2. This will break the SPI memory
+operation because the data transmitting may begin before the command or
+address transmitting completes. Use wait_for_completion_timeout to prevent
+the process from being interruptible.
+
+Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Link: https://lore.kernel.org/r/20210826005930.20572-1-quanyang.wang@windriver.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynq-qspi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
+index 9262c6418463..cfa222c9bd5e 100644
+--- a/drivers/spi/spi-zynq-qspi.c
++++ b/drivers/spi/spi-zynq-qspi.c
+@@ -545,7 +545,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
+ zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
+ zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
+ ZYNQ_QSPI_IXR_RXTX_MASK);
+- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
+ msecs_to_jiffies(1000)))
+ err = -ETIMEDOUT;
+ }
+@@ -563,7 +563,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
+ zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
+ zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
+ ZYNQ_QSPI_IXR_RXTX_MASK);
+- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
+ msecs_to_jiffies(1000)))
+ err = -ETIMEDOUT;
+ }
+@@ -579,7 +579,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
+ zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
+ zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
+ ZYNQ_QSPI_IXR_RXTX_MASK);
+- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
+ msecs_to_jiffies(1000)))
+ err = -ETIMEDOUT;
+
+@@ -603,7 +603,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
+ zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
+ zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
+ ZYNQ_QSPI_IXR_RXTX_MASK);
+- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
++ if (!wait_for_completion_timeout(&xqspi->data_completion,
+ msecs_to_jiffies(1000)))
+ err = -ETIMEDOUT;
+ }
+--
+2.30.2
+
--- /dev/null
+From 53227b3a07d2e67eea96837fb14a82c219192881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Aug 2021 17:15:46 +0800
+Subject: spi: sprd: Fix the wrong WDG_LOAD_VAL
+
+From: Chunyan Zhang <chunyan.zhang@unisoc.com>
+
+[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ]
+
+Use 50ms as default timeout value and the time clock is 32768HZ.
+The original value of WDG_LOAD_VAL is not correct, so this patch
+fixes it.
+
+Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system")
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Link: https://lore.kernel.org/r/20210826091549.2138125-2-zhang.lyra@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sprd-adi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
+index ab19068be867..98ef17389952 100644
+--- a/drivers/spi/spi-sprd-adi.c
++++ b/drivers/spi/spi-sprd-adi.c
+@@ -103,7 +103,7 @@
+ #define HWRST_STATUS_WATCHDOG 0xf0
+
+ /* Use default timeout 50 ms that converts to watchdog values */
+-#define WDG_LOAD_VAL ((50 * 1000) / 32768)
++#define WDG_LOAD_VAL ((50 * 32768) / 1000)
+ #define WDG_LOAD_MASK GENMASK(15, 0)
+ #define WDG_UNLOCK_KEY 0xe551
+
+--
+2.30.2
+
--- /dev/null
+From af8b3b331fc6b45ce0179036fa46afb9be13894c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Aug 2021 15:11:24 -0400
+Subject: SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 5c11720767f70d34357d00a15ba5a0ad052c40fe ]
+
+Some paths through svc_process() leave rqst->rq_procinfo set to
+NULL, which triggers a crash if tracing happens to be enabled.
+
+Fixes: 89ff87494c6e ("SUNRPC: Display RPC procedure names instead of proc numbers")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/svc.h | 1 +
+ include/trace/events/sunrpc.h | 8 ++++----
+ net/sunrpc/svc.c | 15 +++++++++++++++
+ 3 files changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
+index e91d51ea028b..65185d1e07ea 100644
+--- a/include/linux/sunrpc/svc.h
++++ b/include/linux/sunrpc/svc.h
+@@ -523,6 +523,7 @@ void svc_wake_up(struct svc_serv *);
+ void svc_reserve(struct svc_rqst *rqstp, int space);
+ struct svc_pool * svc_pool_for_cpu(struct svc_serv *serv, int cpu);
+ char * svc_print_addr(struct svc_rqst *, char *, size_t);
++const char * svc_proc_name(const struct svc_rqst *rqstp);
+ int svc_encode_result_payload(struct svc_rqst *rqstp,
+ unsigned int offset,
+ unsigned int length);
+diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
+index d02e01a27b69..87569dbf2fe7 100644
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -1642,7 +1642,7 @@ TRACE_EVENT(svc_process,
+ __field(u32, vers)
+ __field(u32, proc)
+ __string(service, name)
+- __string(procedure, rqst->rq_procinfo->pc_name)
++ __string(procedure, svc_proc_name(rqst))
+ __string(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)")
+ ),
+@@ -1652,7 +1652,7 @@ TRACE_EVENT(svc_process,
+ __entry->vers = rqst->rq_vers;
+ __entry->proc = rqst->rq_proc;
+ __assign_str(service, name);
+- __assign_str(procedure, rqst->rq_procinfo->pc_name);
++ __assign_str(procedure, svc_proc_name(rqst));
+ __assign_str(addr, rqst->rq_xprt ?
+ rqst->rq_xprt->xpt_remotebuf : "(null)");
+ ),
+@@ -1918,7 +1918,7 @@ TRACE_EVENT(svc_stats_latency,
+ TP_STRUCT__entry(
+ __field(u32, xid)
+ __field(unsigned long, execute)
+- __string(procedure, rqst->rq_procinfo->pc_name)
++ __string(procedure, svc_proc_name(rqst))
+ __string(addr, rqst->rq_xprt->xpt_remotebuf)
+ ),
+
+@@ -1926,7 +1926,7 @@ TRACE_EVENT(svc_stats_latency,
+ __entry->xid = be32_to_cpu(rqst->rq_xid);
+ __entry->execute = ktime_to_us(ktime_sub(ktime_get(),
+ rqst->rq_stime));
+- __assign_str(procedure, rqst->rq_procinfo->pc_name);
++ __assign_str(procedure, svc_proc_name(rqst));
+ __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
+ ),
+
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index 0de918cb3d90..a47e290b0668 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1629,6 +1629,21 @@ u32 svc_max_payload(const struct svc_rqst *rqstp)
+ }
+ EXPORT_SYMBOL_GPL(svc_max_payload);
+
++/**
++ * svc_proc_name - Return RPC procedure name in string form
++ * @rqstp: svc_rqst to operate on
++ *
++ * Return value:
++ * Pointer to a NUL-terminated string
++ */
++const char *svc_proc_name(const struct svc_rqst *rqstp)
++{
++ if (rqstp && rqstp->rq_procinfo)
++ return rqstp->rq_procinfo->pc_name;
++ return "unknown";
++}
++
++
+ /**
+ * svc_encode_result_payload - mark a range of bytes as a result payload
+ * @rqstp: svc_rqst to operate on
+--
+2.30.2
+
--- /dev/null
+From a95131f56008aa9bde5261d153e12e8b7c938c59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jul 2021 13:05:41 -0700
+Subject: tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
+
+From: Martin KaFai Lau <kafai@fb.com>
+
+[ Upstream commit 525e2f9fd0229eb10cb460a9e6d978257f24804e ]
+
+st->bucket stores the current bucket number.
+st->offset stores the offset within this bucket that is the sk to be
+seq_show(). Thus, st->offset only makes sense within the same
+st->bucket.
+
+These two variables are an optimization for the common no-lseek case.
+When resuming the seq_file iteration (i.e. seq_start()),
+tcp_seek_last_pos() tries to continue from the st->offset
+at bucket st->bucket.
+
+However, it is possible that the bucket pointed by st->bucket
+has changed and st->offset may end up skipping the whole st->bucket
+without finding a sk. In this case, tcp_seek_last_pos() currently
+continues to satisfy the offset condition in the next (and incorrect)
+bucket. Instead, regardless of the offset value, the first sk of the
+next bucket should be returned. Thus, "bucket == st->bucket" check is
+added to tcp_seek_last_pos().
+
+The chance of hitting this is small and the issue is a decade old,
+so targeting for the next tree.
+
+Fixes: a8b690f98baf ("tcp: Fix slowness in read /proc/net/tcp")
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20210701200541.1033917-1-kafai@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_ipv4.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 8bb5f7f51dae..7f3c7d57a39d 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2440,6 +2440,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
+ static void *tcp_seek_last_pos(struct seq_file *seq)
+ {
+ struct tcp_iter_state *st = seq->private;
++ int bucket = st->bucket;
+ int offset = st->offset;
+ int orig_num = st->num;
+ void *rc = NULL;
+@@ -2450,7 +2451,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
+ break;
+ st->state = TCP_SEQ_STATE_LISTENING;
+ rc = listening_get_next(seq, NULL);
+- while (offset-- && rc)
++ while (offset-- && rc && bucket == st->bucket)
+ rc = listening_get_next(seq, rc);
+ if (rc)
+ break;
+@@ -2461,7 +2462,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
+ if (st->bucket > tcp_hashinfo.ehash_mask)
+ break;
+ rc = established_get_first(seq);
+- while (offset-- && rc)
++ while (offset-- && rc && bucket == st->bucket)
+ rc = established_get_next(seq, rc);
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 0e2075bc2c055afa21d021bc901cdd351e36f210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 17:20:24 +0100
+Subject: tools: Free BTF objects at various locations
+
+From: Quentin Monnet <quentin@isovalent.com>
+
+[ Upstream commit 369e955b3d1c12f6ec2e51a95911bb80ada55d79 ]
+
+Make sure to call btf__free() (and not simply free(), which does not
+free all pointers stored in the struct) on pointers to struct btf
+objects retrieved at various locations.
+
+These were found while updating the calls to btf__get_from_id().
+
+Fixes: 999d82cbc044 ("tools/bpf: enhance test_btf file testing to test func info")
+Fixes: 254471e57a86 ("tools/bpf: bpftool: add support for func types")
+Fixes: 7b612e291a5a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
+Fixes: d56354dc4909 ("perf tools: Save bpf_prog_info and BTF of new BPF programs")
+Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
+Fixes: fa853c4b839e ("perf stat: Enable counting events for BPF programs")
+Signed-off-by: Quentin Monnet <quentin@isovalent.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210729162028.29512-5-quentin@isovalent.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/prog.c | 5 ++++-
+ tools/perf/util/bpf-event.c | 4 ++--
+ tools/perf/util/bpf_counter.c | 3 ++-
+ tools/testing/selftests/bpf/prog_tests/btf.c | 1 +
+ 4 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index da4846c9856a..a51bf4c69879 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -778,6 +778,8 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
+ kernel_syms_destroy(&dd);
+ }
+
++ btf__free(btf);
++
+ return 0;
+ }
+
+@@ -1897,8 +1899,8 @@ static char *profile_target_name(int tgt_fd)
+ struct bpf_prog_info_linear *info_linear;
+ struct bpf_func_info *func_info;
+ const struct btf_type *t;
++ struct btf *btf = NULL;
+ char *name = NULL;
+- struct btf *btf;
+
+ info_linear = bpf_program__get_prog_info_linear(
+ tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO);
+@@ -1922,6 +1924,7 @@ static char *profile_target_name(int tgt_fd)
+ }
+ name = strdup(btf__name_by_offset(btf, t->name_off));
+ out:
++ btf__free(btf);
+ free(info_linear);
+ return name;
+ }
+diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
+index cdecda1ddd36..17a9844e4fbf 100644
+--- a/tools/perf/util/bpf-event.c
++++ b/tools/perf/util/bpf-event.c
+@@ -296,7 +296,7 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
+
+ out:
+ free(info_linear);
+- free(btf);
++ btf__free(btf);
+ return err ? -1 : 0;
+ }
+
+@@ -486,7 +486,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
+ perf_env__fetch_btf(env, btf_id, btf);
+
+ out:
+- free(btf);
++ btf__free(btf);
+ close(fd);
+ }
+
+diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c
+index 5ed674a2f55e..a14f0098b343 100644
+--- a/tools/perf/util/bpf_counter.c
++++ b/tools/perf/util/bpf_counter.c
+@@ -74,8 +74,8 @@ static char *bpf_target_prog_name(int tgt_fd)
+ struct bpf_prog_info_linear *info_linear;
+ struct bpf_func_info *func_info;
+ const struct btf_type *t;
++ struct btf *btf = NULL;
+ char *name = NULL;
+- struct btf *btf;
+
+ info_linear = bpf_program__get_prog_info_linear(
+ tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO);
+@@ -99,6 +99,7 @@ static char *bpf_target_prog_name(int tgt_fd)
+ }
+ name = strdup(btf__name_by_offset(btf, t->name_off));
+ out:
++ btf__free(btf);
+ free(info_linear);
+ return name;
+ }
+diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
+index 0457ae32b270..5b7dd3227b78 100644
+--- a/tools/testing/selftests/bpf/prog_tests/btf.c
++++ b/tools/testing/selftests/bpf/prog_tests/btf.c
+@@ -4384,6 +4384,7 @@ skip:
+ fprintf(stderr, "OK");
+
+ done:
++ btf__free(btf);
+ free(func_info);
+ bpf_object__close(obj);
+ }
+--
+2.30.2
+
--- /dev/null
+From 53fd463ae3031e1331a3b894de5519736a8f0099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 22:45:48 +0300
+Subject: tpm: ibmvtpm: Avoid error message when process gets signal while
+ waiting
+
+From: Stefan Berger <stefanb@linux.ibm.com>
+
+[ Upstream commit 047d4226b0bca1cda5267dc68bc8291cce5364ac ]
+
+When rngd is run as root then lots of these types of message will appear
+in the kernel log if the TPM has been configured to provide random bytes:
+
+[ 7406.275163] tpm tpm0: tpm_transmit: tpm_recv: error -4
+
+The issue is caused by the following call that is interrupted while
+waiting for the TPM's response.
+
+sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);
+
+Rather than waiting for the response in the low level driver, have it use
+the polling loop in tpm_try_transmit() that uses a command's duration to
+poll until a result has been returned by the TPM, thus ending when the
+timeout has occurred but not responding to signals and ctrl-c anymore. To
+stay in this polling loop extend tpm_ibmvtpm_status() to return
+'true' for as long as the vTPM is indicated as being busy in
+tpm_processing_cmd. Since the loop requires the TPM's timeouts, get them
+now using tpm_get_timeouts() after setting the TPM2 version flag on the
+chip.
+
+To recreat the resolved issue start rngd like this:
+
+sudo rngd -r /dev/hwrng -t
+sudo rngd -r /dev/tpm0 -t
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1981473
+Fixes: 6674ff145eef ("tpm_ibmvtpm: properly handle interrupted packet receptions")
+Cc: Nayna Jain <nayna@linux.ibm.com>
+Cc: George Wilson <gcwilson@linux.ibm.com>
+Reported-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_ibmvtpm.c | 26 +++++++++++++++-----------
+ drivers/char/tpm/tpm_ibmvtpm.h | 2 +-
+ 2 files changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 903604769de9..3af4c07a9342 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -106,17 +106,12 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
+ u16 len;
+- int sig;
+
+ if (!ibmvtpm->rtce_buf) {
+ dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
+ return 0;
+ }
+
+- sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);
+- if (sig)
+- return -EINTR;
+-
+ len = ibmvtpm->res_len;
+
+ if (count < len) {
+@@ -237,7 +232,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ * set the processing flag before the Hcall, since we may get the
+ * result (interrupt) before even being able to check rc.
+ */
+- ibmvtpm->tpm_processing_cmd = true;
++ ibmvtpm->tpm_processing_cmd = 1;
+
+ again:
+ rc = ibmvtpm_send_crq(ibmvtpm->vdev,
+@@ -255,7 +250,7 @@ again:
+ goto again;
+ }
+ dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
+- ibmvtpm->tpm_processing_cmd = false;
++ ibmvtpm->tpm_processing_cmd = 0;
+ }
+
+ spin_unlock(&ibmvtpm->rtce_lock);
+@@ -269,7 +264,9 @@ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip)
+
+ static u8 tpm_ibmvtpm_status(struct tpm_chip *chip)
+ {
+- return 0;
++ struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
++
++ return ibmvtpm->tpm_processing_cmd;
+ }
+
+ /**
+@@ -457,7 +454,7 @@ static const struct tpm_class_ops tpm_ibmvtpm = {
+ .send = tpm_ibmvtpm_send,
+ .cancel = tpm_ibmvtpm_cancel,
+ .status = tpm_ibmvtpm_status,
+- .req_complete_mask = 0,
++ .req_complete_mask = 1,
+ .req_complete_val = 0,
+ .req_canceled = tpm_ibmvtpm_req_canceled,
+ };
+@@ -550,7 +547,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
+ case VTPM_TPM_COMMAND_RES:
+ /* len of the data in rtce buffer */
+ ibmvtpm->res_len = be16_to_cpu(crq->len);
+- ibmvtpm->tpm_processing_cmd = false;
++ ibmvtpm->tpm_processing_cmd = 0;
+ wake_up_interruptible(&ibmvtpm->wq);
+ return;
+ default:
+@@ -688,8 +685,15 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ goto init_irq_cleanup;
+ }
+
+- if (!strcmp(id->compat, "IBM,vtpm20")) {
++
++ if (!strcmp(id->compat, "IBM,vtpm20"))
+ chip->flags |= TPM_CHIP_FLAG_TPM2;
++
++ rc = tpm_get_timeouts(chip);
++ if (rc)
++ goto init_irq_cleanup;
++
++ if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+ rc = tpm2_get_cc_attrs_tbl(chip);
+ if (rc)
+ goto init_irq_cleanup;
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
+index b92aa7d3e93e..51198b137461 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.h
++++ b/drivers/char/tpm/tpm_ibmvtpm.h
+@@ -41,7 +41,7 @@ struct ibmvtpm_dev {
+ wait_queue_head_t wq;
+ u16 res_len;
+ u32 vtpm_version;
+- bool tpm_processing_cmd;
++ u8 tpm_processing_cmd;
+ };
+
+ #define CRQ_RES_BUF_SIZE PAGE_SIZE
+--
+2.30.2
+
--- /dev/null
+From 826edf348ba256f1670db65dcc00af98868e08d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 10:10:33 +0800
+Subject: tty: serial: fsl_lpuart: fix the wrong mapbase value
+
+From: Andy Duan <fugang.duan@nxp.com>
+
+[ Upstream commit d5c38948448abc2bb6b36dbf85a554bf4748885e ]
+
+Register offset needs to be applied on mapbase also.
+dma_tx/rx_request use the physical address of UARTDATA.
+Register offset is currently only applied to membase (the
+corresponding virtual addr) but not on mapbase.
+
+Fixes: 24b1e5f0e83c ("tty: serial: lpuart: add imx7ulp support")
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Adriana Reus <adriana.reus@nxp.com>
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Signed-off-by: Andy Duan <fugang.duan@nxp.com>
+Link: https://lore.kernel.org/r/20210819021033.32606-1-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 0d7ea144a4a6..1ed4e33cc8cf 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -2595,7 +2595,7 @@ static int lpuart_probe(struct platform_device *pdev)
+ return PTR_ERR(sport->port.membase);
+
+ sport->port.membase += sdata->reg_off;
+- sport->port.mapbase = res->start;
++ sport->port.mapbase = res->start + sdata->reg_off;
+ sport->port.dev = &pdev->dev;
+ sport->port.type = PORT_LPUART;
+ sport->devtype = sdata->devtype;
+--
+2.30.2
+
--- /dev/null
+From 26a48551fdcc326f380f21af01361007555699cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 May 2021 11:39:03 +0200
+Subject: udf: Check LVID earlier
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]
+
+We were checking validity of LVID entries only when getting
+implementation use information from LVID in udf_sb_lvidiu(). However if
+the LVID is suitably corrupted, it can cause problems also to code such
+as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity
+of LVID already when loading it from the disk and just disable LVID
+altogether when it is not valid.
+
+Reported-by: syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 2f83c1204e20..1eeb75a1efd2 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -108,16 +108,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
+ return NULL;
+ lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
+ partnum = le32_to_cpu(lvid->numOfPartitions);
+- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
+- offsetof(struct logicalVolIntegrityDesc, impUse)) /
+- (2 * sizeof(uint32_t)) < partnum) {
+- udf_err(sb, "Logical volume integrity descriptor corrupted "
+- "(numOfPartitions = %u)!\n", partnum);
+- return NULL;
+- }
+ /* The offset is to skip freeSpaceTable and sizeTable arrays */
+ offset = partnum * 2 * sizeof(uint32_t);
+- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
++ return (struct logicalVolIntegrityDescImpUse *)
++ (((uint8_t *)(lvid + 1)) + offset);
+ }
+
+ /* UDF filesystem type */
+@@ -1542,6 +1536,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct logicalVolIntegrityDesc *lvid;
+ int indirections = 0;
++ u32 parts, impuselen;
+
+ while (++indirections <= UDF_MAX_LVID_NESTING) {
+ final_bh = NULL;
+@@ -1568,15 +1563,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
+
+ lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;
+ if (lvid->nextIntegrityExt.extLength == 0)
+- return;
++ goto check;
+
+ loc = leea_to_cpu(lvid->nextIntegrityExt);
+ }
+
+ udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n",
+ UDF_MAX_LVID_NESTING);
++out_err:
+ brelse(sbi->s_lvid_bh);
+ sbi->s_lvid_bh = NULL;
++ return;
++check:
++ parts = le32_to_cpu(lvid->numOfPartitions);
++ impuselen = le32_to_cpu(lvid->lengthOfImpUse);
++ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
++ sizeof(struct logicalVolIntegrityDesc) + impuselen +
++ 2 * parts * sizeof(u32) > sb->s_blocksize) {
++ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), "
++ "ignoring.\n", parts, impuselen);
++ goto out_err;
++ }
+ }
+
+ /*
+--
+2.30.2
+
--- /dev/null
+From 0416721a15c7dc3d729aa8fbdee5b271e0b3b469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 18:24:36 +0200
+Subject: udf: Fix iocharset=utf8 mount option
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit b645333443712d2613e4e863f81090d5dc509657 ]
+
+Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset,
+it is required to use utf8 mount option.
+
+Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount
+option.
+
+If UTF-8 as iocharset is used then s_nls_map is set to NULL. So simplify
+code around, remove UDF_FLAG_NLS_MAP and UDF_FLAG_UTF8 flags as to
+distinguish between UTF-8 and non-UTF-8 it is needed just to check if
+s_nls_map set to NULL or not.
+
+Link: https://lore.kernel.org/r/20210808162453.1653-4-pali@kernel.org
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 50 ++++++++++++++++++------------------------------
+ fs/udf/udf_sb.h | 2 --
+ fs/udf/unicode.c | 4 ++--
+ 3 files changed, 21 insertions(+), 35 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 1eeb75a1efd2..b2d7c57d0688 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -343,10 +343,10 @@ static int udf_show_options(struct seq_file *seq, struct dentry *root)
+ seq_printf(seq, ",lastblock=%u", sbi->s_last_block);
+ if (sbi->s_anchor != 0)
+ seq_printf(seq, ",anchor=%u", sbi->s_anchor);
+- if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8))
+- seq_puts(seq, ",utf8");
+- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP) && sbi->s_nls_map)
++ if (sbi->s_nls_map)
+ seq_printf(seq, ",iocharset=%s", sbi->s_nls_map->charset);
++ else
++ seq_puts(seq, ",iocharset=utf8");
+
+ return 0;
+ }
+@@ -552,19 +552,24 @@ static int udf_parse_options(char *options, struct udf_options *uopt,
+ /* Ignored (never implemented properly) */
+ break;
+ case Opt_utf8:
+- uopt->flags |= (1 << UDF_FLAG_UTF8);
++ if (!remount) {
++ unload_nls(uopt->nls_map);
++ uopt->nls_map = NULL;
++ }
+ break;
+ case Opt_iocharset:
+ if (!remount) {
+- if (uopt->nls_map)
+- unload_nls(uopt->nls_map);
+- /*
+- * load_nls() failure is handled later in
+- * udf_fill_super() after all options are
+- * parsed.
+- */
++ unload_nls(uopt->nls_map);
++ uopt->nls_map = NULL;
++ }
++ /* When nls_map is not loaded then UTF-8 is used */
++ if (!remount && strcmp(args[0].from, "utf8") != 0) {
+ uopt->nls_map = load_nls(args[0].from);
+- uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
++ if (!uopt->nls_map) {
++ pr_err("iocharset %s not found\n",
++ args[0].from);
++ return 0;
++ }
+ }
+ break;
+ case Opt_uforget:
+@@ -2146,21 +2151,6 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ if (!udf_parse_options((char *)options, &uopt, false))
+ goto parse_options_failure;
+
+- if (uopt.flags & (1 << UDF_FLAG_UTF8) &&
+- uopt.flags & (1 << UDF_FLAG_NLS_MAP)) {
+- udf_err(sb, "utf8 cannot be combined with iocharset\n");
+- goto parse_options_failure;
+- }
+- if ((uopt.flags & (1 << UDF_FLAG_NLS_MAP)) && !uopt.nls_map) {
+- uopt.nls_map = load_nls_default();
+- if (!uopt.nls_map)
+- uopt.flags &= ~(1 << UDF_FLAG_NLS_MAP);
+- else
+- udf_debug("Using default NLS map\n");
+- }
+- if (!(uopt.flags & (1 << UDF_FLAG_NLS_MAP)))
+- uopt.flags |= (1 << UDF_FLAG_UTF8);
+-
+ fileset.logicalBlockNum = 0xFFFFFFFF;
+ fileset.partitionReferenceNum = 0xFFFF;
+
+@@ -2315,8 +2305,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ error_out:
+ iput(sbi->s_vat_inode);
+ parse_options_failure:
+- if (uopt.nls_map)
+- unload_nls(uopt.nls_map);
++ unload_nls(uopt.nls_map);
+ if (lvid_open)
+ udf_close_lvid(sb);
+ brelse(sbi->s_lvid_bh);
+@@ -2366,8 +2355,7 @@ static void udf_put_super(struct super_block *sb)
+ sbi = UDF_SB(sb);
+
+ iput(sbi->s_vat_inode);
+- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
+- unload_nls(sbi->s_nls_map);
++ unload_nls(sbi->s_nls_map);
+ if (!sb_rdonly(sb))
+ udf_close_lvid(sb);
+ brelse(sbi->s_lvid_bh);
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 758efe557a19..4fa620543d30 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -20,8 +20,6 @@
+ #define UDF_FLAG_UNDELETE 6
+ #define UDF_FLAG_UNHIDE 7
+ #define UDF_FLAG_VARCONV 8
+-#define UDF_FLAG_NLS_MAP 9
+-#define UDF_FLAG_UTF8 10
+ #define UDF_FLAG_UID_FORGET 11 /* save -1 for uid to disk */
+ #define UDF_FLAG_GID_FORGET 12
+ #define UDF_FLAG_UID_SET 13
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 5fcfa96463eb..622569007b53 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -177,7 +177,7 @@ static int udf_name_from_CS0(struct super_block *sb,
+ return 0;
+ }
+
+- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
++ if (UDF_SB(sb)->s_nls_map)
+ conv_f = UDF_SB(sb)->s_nls_map->uni2char;
+ else
+ conv_f = NULL;
+@@ -285,7 +285,7 @@ static int udf_name_to_CS0(struct super_block *sb,
+ if (ocu_max_len <= 0)
+ return 0;
+
+- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
++ if (UDF_SB(sb)->s_nls_map)
+ conv_f = UDF_SB(sb)->s_nls_map->char2uni;
+ else
+ conv_f = NULL;
+--
+2.30.2
+
--- /dev/null
+From 6f88b151146d5610e6a5743789be05a851591bfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Aug 2021 11:33:32 +0200
+Subject: udf_get_extendedattr() had no boundary checks.
+
+From: Stian Skjelstad <stian.skjelstad@gmail.com>
+
+[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
+
+When parsing the ExtendedAttr data, malicous or corrupt attribute length
+could cause kernel hangs and buffer overruns in some special cases.
+
+Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
+Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/misc.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/udf/misc.c b/fs/udf/misc.c
+index eab94527340d..1614d308d0f0 100644
+--- a/fs/udf/misc.c
++++ b/fs/udf/misc.c
+@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
+ else
+ offset = le32_to_cpu(eahd->appAttrLocation);
+
+- while (offset < iinfo->i_lenEAttr) {
++ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
++ uint32_t attrLength;
++
+ gaf = (struct genericFormat *)&ea[offset];
++ attrLength = le32_to_cpu(gaf->attrLength);
++
++ /* Detect undersized elements and buffer overflows */
++ if ((attrLength < sizeof(*gaf)) ||
++ (attrLength > (iinfo->i_lenEAttr - offset)))
++ break;
++
+ if (le32_to_cpu(gaf->attrType) == type &&
+ gaf->attrSubtype == subtype)
+ return gaf;
+ else
+- offset += le32_to_cpu(gaf->attrLength);
++ offset += attrLength;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From b4197d0deb88ba0fe30e7dc3c93b5f299a17fc67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 21:32:49 +0200
+Subject: usb: bdc: Fix a resource leak in the error handling path of
+ 'bdc_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6f15a2a09cecb7a2faba4a75bbd101f6f962294b ]
+
+If an error occurs after a successful 'clk_prepare_enable()' call, it must
+be undone by a corresponding 'clk_disable_unprepare()' call.
+This call is already present in the remove function.
+
+Add this call in the error handling path and reorder the code so that the
+'clk_prepare_enable()' call happens later in the function.
+The goal is to have as much managed resources functions as possible
+before the 'clk_prepare_enable()' call in order to keep the error handling
+path simple.
+
+While at it, remove the now unneeded 'clk' variable.
+
+Fixes: c87dca047849 ("usb: bdc: Add clock enable for new chips with a separate BDC clock")
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/f8a4a6897deb0c8cb2e576580790303550f15fcd.1629314734.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_core.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index 251db57e51fa..fa1a3908ec3b 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -488,27 +488,14 @@ static int bdc_probe(struct platform_device *pdev)
+ int irq;
+ u32 temp;
+ struct device *dev = &pdev->dev;
+- struct clk *clk;
+ int phy_num;
+
+ dev_dbg(dev, "%s()\n", __func__);
+
+- clk = devm_clk_get_optional(dev, "sw_usbd");
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
+-
+- ret = clk_prepare_enable(clk);
+- if (ret) {
+- dev_err(dev, "could not enable clock\n");
+- return ret;
+- }
+-
+ bdc = devm_kzalloc(dev, sizeof(*bdc), GFP_KERNEL);
+ if (!bdc)
+ return -ENOMEM;
+
+- bdc->clk = clk;
+-
+ bdc->regs = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(bdc->regs))
+ return PTR_ERR(bdc->regs);
+@@ -545,10 +532,20 @@ static int bdc_probe(struct platform_device *pdev)
+ }
+ }
+
++ bdc->clk = devm_clk_get_optional(dev, "sw_usbd");
++ if (IS_ERR(bdc->clk))
++ return PTR_ERR(bdc->clk);
++
++ ret = clk_prepare_enable(bdc->clk);
++ if (ret) {
++ dev_err(dev, "could not enable clock\n");
++ return ret;
++ }
++
+ ret = bdc_phy_init(bdc);
+ if (ret) {
+ dev_err(bdc->dev, "BDC phy init failure:%d\n", ret);
+- return ret;
++ goto disable_clk;
+ }
+
+ temp = bdc_readl(bdc->regs, BDC_BDCCAP1);
+@@ -581,6 +578,8 @@ cleanup:
+ bdc_hw_exit(bdc);
+ phycleanup:
+ bdc_phy_exit(bdc);
++disable_clk:
++ clk_disable_unprepare(bdc->clk);
+ return ret;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From d0828ab31e2365d9099154eb115741cb2163960c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 21:32:38 +0200
+Subject: usb: bdc: Fix an error handling path in 'bdc_probe()' when no
+ suitable DMA config is available
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 ]
+
+If no suitable DMA configuration is available, a previous 'bdc_phy_init()'
+call must be undone by a corresponding 'bdc_phy_exit()' call.
+
+Branch to the existing error handling path instead of returning
+directly.
+
+Fixes: cc29d4f67757 ("usb: bdc: Add support for USB phy")
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/0c5910979f39225d5d8fe68c9ab1c147c68ddee1.1629314734.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/bdc/bdc_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
+index 0bef6b3f049b..251db57e51fa 100644
+--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
++++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
+@@ -560,7 +560,8 @@ static int bdc_probe(struct platform_device *pdev)
+ if (ret) {
+ dev_err(dev,
+ "No suitable DMA config available, abort\n");
+- return -ENOTSUPP;
++ ret = -ENOTSUPP;
++ goto phycleanup;
+ }
+ dev_dbg(dev, "Using 32-bit address\n");
+ }
+--
+2.30.2
+
--- /dev/null
+From e140a2a8690480f625d1ec1da60f0133b1348e61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:21:14 +0300
+Subject: usb: dwc3: meson-g12a: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit baa2986bda3f7b2386607587a4185e3dff8f98df ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_threaded_irq()
+(which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
+an original error code. Stop calling devm_request_threaded_irq() with the
+invalid IRQ #s.
+
+Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/96106462-5538-0b2f-f2ab-ee56e4853912@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index ffe301d6ea35..d0f9b7c296b0 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -598,6 +598,8 @@ static int dwc3_meson_g12a_otg_init(struct platform_device *pdev,
+ USB_R5_ID_DIG_IRQ, 0);
+
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+ ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
+ dwc3_meson_g12a_irq_thread,
+ IRQF_ONESHOT, pdev->name, priv);
+--
+2.30.2
+
--- /dev/null
+From 0e22fb1b5ecbdcb9049ebf35dbf80bb3029932e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:23:51 +0300
+Subject: usb: dwc3: qcom: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 175006956740f70ca23394c58f8d7804776741bd ]
+
+In dwc3_qcom_acpi_register_core(), the driver neglects to check the result
+of platform_get_irq()'s call and blithely assigns the negative error codes
+to the allocated child device's IRQ resource and then passing this resource
+to platform_device_add_resources() and later causing dwc3_otg_get_irq() to
+fail anyway. Stop calling platform_device_add_resources() with the invalid
+IRQ #s, so that there's less complexity in the IRQ error checking.
+
+Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/45fec3da-1679-5bfe-5d74-219ca3fb28e7@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index 49e6ca94486d..cfbb96f6627e 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -614,6 +614,10 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev)
+ qcom->acpi_pdata->dwc3_core_base_size;
+
+ irq = platform_get_irq(pdev_irq, 0);
++ if (irq < 0) {
++ ret = irq;
++ goto out;
++ }
+ child_res[1].flags = IORESOURCE_IRQ;
+ child_res[1].start = child_res[1].end = irq;
+
+--
+2.30.2
+
--- /dev/null
+From ed380f8e04cea6d4a219ecf2235ef029b7872659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 20:09:02 +0300
+Subject: usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 ]
+
+ehci_orion_drv_probe() did not account for possible errors of
+clk_prepare_enable() that in particular could cause invocation of
+clk_disable_unprepare() on clocks that were not prepared/enabled yet,
+e.g. in remove or on handling errors of usb_add_hcd() in probe. Though,
+there were several patches fixing different issues with clocks in this
+driver, they did not solve this problem.
+
+Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe()
+to avoid calls of clk_disable_unprepare() without previous successful
+invocation of clk_prepare_enable().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 8c869edaee07 ("ARM: Orion: EHCI: Add support for enabling clocks")
+Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
+Link: https://lore.kernel.org/r/20210825170902.11234-1-novikov@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-orion.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
+index a319b1df3011..3626758b3e2a 100644
+--- a/drivers/usb/host/ehci-orion.c
++++ b/drivers/usb/host/ehci-orion.c
+@@ -264,8 +264,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)
+ * the clock does not exists.
+ */
+ priv->clk = devm_clk_get(&pdev->dev, NULL);
+- if (!IS_ERR(priv->clk))
+- clk_prepare_enable(priv->clk);
++ if (!IS_ERR(priv->clk)) {
++ err = clk_prepare_enable(priv->clk);
++ if (err)
++ goto err_put_hcd;
++ }
+
+ priv->phy = devm_phy_optional_get(&pdev->dev, "usb");
+ if (IS_ERR(priv->phy)) {
+@@ -311,6 +314,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)
+ err_dis_clk:
+ if (!IS_ERR(priv->clk))
+ clk_disable_unprepare(priv->clk);
++err_put_hcd:
+ usb_put_hcd(hcd);
+ err:
+ dev_err(&pdev->dev, "init %s fail, %d\n",
+--
+2.30.2
+
--- /dev/null
+From 5032c5b313da9eb5fd726122171922d3a1477517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 17:12:47 +0300
+Subject: usb: gadget: mv_u3d: request_irq() after initializing UDC
+
+From: Nadezda Lutovinova <lutovinova@ispras.ru>
+
+[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]
+
+If IRQ occurs between calling request_irq() and mv_u3d_eps_init(),
+then null pointer dereference occurs since u3d->eps[] wasn't
+initialized yet but used in mv_u3d_nuke().
+
+The patch puts registration of the interrupt handler after
+initializing of neccesery data.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
+Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c
+index 5486f5a70868..0db97fecf99e 100644
+--- a/drivers/usb/gadget/udc/mv_u3d_core.c
++++ b/drivers/usb/gadget/udc/mv_u3d_core.c
+@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev)
+ goto err_get_irq;
+ }
+ u3d->irq = r->start;
+- if (request_irq(u3d->irq, mv_u3d_irq,
+- IRQF_SHARED, driver_name, u3d)) {
+- u3d->irq = 0;
+- dev_err(&dev->dev, "Request irq %d for u3d failed\n",
+- u3d->irq);
+- retval = -ENODEV;
+- goto err_request_irq;
+- }
+
+ /* initialize gadget structure */
+ u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */
+@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)
+
+ mv_u3d_eps_init(u3d);
+
++ if (request_irq(u3d->irq, mv_u3d_irq,
++ IRQF_SHARED, driver_name, u3d)) {
++ u3d->irq = 0;
++ dev_err(&dev->dev, "Request irq %d for u3d failed\n",
++ u3d->irq);
++ retval = -ENODEV;
++ goto err_request_irq;
++ }
++
+ /* external vbus detection */
+ if (u3d->vbus) {
+ u3d->clock_gating = 1;
+@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev)
+
+ err_unregister:
+ free_irq(u3d->irq, u3d);
+-err_request_irq:
+ err_get_irq:
++err_request_irq:
+ kfree(u3d->status_req);
+ err_alloc_status_req:
+ kfree(u3d->eps);
+--
+2.30.2
+
--- /dev/null
+From c0400145034a068dc3600a52f263e3bb7ed8a83f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:27:28 +0300
+Subject: usb: gadget: udc: at91: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 50855c31573b02963f0aa2aacfd4ea41c31ae0e0 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
+error code. Stop calling devm_request_irq() with the invalid IRQ #s.
+
+Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Link: https://lore.kernel.org/r/6654a224-739a-1a80-12f0-76d920f87b6c@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/at91_udc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c
+index eede5cedacb4..d9ad9adf7348 100644
+--- a/drivers/usb/gadget/udc/at91_udc.c
++++ b/drivers/usb/gadget/udc/at91_udc.c
+@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform_device *pdev)
+ clk_disable(udc->iclk);
+
+ /* request UDC and maybe VBUS irqs */
+- udc->udp_irq = platform_get_irq(pdev, 0);
++ udc->udp_irq = retval = platform_get_irq(pdev, 0);
++ if (retval < 0)
++ goto err_unprepare_iclk;
+ retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0,
+ driver_name, udc);
+ if (retval) {
+--
+2.30.2
+
--- /dev/null
+From ec2f7016902d114847cb32672b4c6995c90704c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 17:52:54 +0200
+Subject: usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit cea45a3bd2dd4d9c35581328f571afd32b3c9f48 ]
+
+soc_device_match() is intended as a last resort, to handle e.g. quirks
+that cannot be handled by matching based on a compatible value.
+
+As the device nodes for the Renesas USB 3.0 Peripheral Controller on
+R-Car E3 and RZ/G2E do have SoC-specific compatible values, the latter
+can and should be used to match against these devices.
+
+This also fixes support for the USB 3.0 Peripheral Controller on the
+R-Car E3e (R8A779M6) SoC, which is a different grading of the R-Car E3
+(R8A77990) SoC, using the same SoC-specific compatible value.
+
+Fixes: 30025efa8b5e75f5 ("usb: gadget: udc: renesas_usb3: add support for r8a77990")
+Fixes: 546970fdab1da5fe ("usb: gadget: udc: renesas_usb3: add support for r8a774c0")
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/760981fb4cd110d7cbfc9dcffa365e7c8b25c6e5.1628696960.git.geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index f1b35a39d1ba..57d417a7c3e0 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2707,10 +2707,15 @@ static const struct renesas_usb3_priv renesas_usb3_priv_r8a77990 = {
+
+ static const struct of_device_id usb3_of_match[] = {
+ {
++ .compatible = "renesas,r8a774c0-usb3-peri",
++ .data = &renesas_usb3_priv_r8a77990,
++ }, {
+ .compatible = "renesas,r8a7795-usb3-peri",
+ .data = &renesas_usb3_priv_gen3,
+- },
+- {
++ }, {
++ .compatible = "renesas,r8a77990-usb3-peri",
++ .data = &renesas_usb3_priv_r8a77990,
++ }, {
+ .compatible = "renesas,rcar-gen3-usb3-peri",
+ .data = &renesas_usb3_priv_gen3,
+ },
+@@ -2719,18 +2724,10 @@ static const struct of_device_id usb3_of_match[] = {
+ MODULE_DEVICE_TABLE(of, usb3_of_match);
+
+ static const struct soc_device_attribute renesas_usb3_quirks_match[] = {
+- {
+- .soc_id = "r8a774c0",
+- .data = &renesas_usb3_priv_r8a77990,
+- },
+ {
+ .soc_id = "r8a7795", .revision = "ES1.*",
+ .data = &renesas_usb3_priv_r8a7795_es1,
+ },
+- {
+- .soc_id = "r8a77990",
+- .data = &renesas_usb3_priv_r8a77990,
+- },
+ { /* sentinel */ },
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 04a44cfccf545291d3afb75564f151027ee7302b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:35:11 +0300
+Subject: usb: gadget: udc: s3c2410: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit ecff88e819e31081d41cd05bb199b9bd10e13e90 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Fixes: 188db4435ac6 ("usb: gadget: s3c: use platform resources")
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/bd69b22c-b484-5a1f-c798-78d4b78405f2@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/s3c2410_udc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
+index b154b62abefa..82c4f3fb2dae 100644
+--- a/drivers/usb/gadget/udc/s3c2410_udc.c
++++ b/drivers/usb/gadget/udc/s3c2410_udc.c
+@@ -1784,6 +1784,10 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
+ s3c2410_udc_reinit(udc);
+
+ irq_usbd = platform_get_irq(pdev, 0);
++ if (irq_usbd < 0) {
++ retval = irq_usbd;
++ goto err_udc_clk;
++ }
+
+ /* irq setup after old hardware state is cleaned up */
+ retval = request_irq(irq_usbd, s3c2410_udc_irq,
+--
+2.30.2
+
--- /dev/null
+From 0a07d294279a88377964804714c07a2b89df02f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 23:30:18 +0300
+Subject: usb: host: ohci-tmio: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 4ac5132e8a4300637a2da8f5d6bc7650db735b8a ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to usb_add_hcd() (which takes
+*unsigned* IRQ #), causing request_irq() that it calls to fail with
+-EINVAL, overriding an original error code. Stop calling usb_add_hcd()
+with the invalid IRQ #s.
+
+Fixes: 78c73414f4f6 ("USB: ohci: add support for tmio-ohci cell")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/402e1a45-a0a4-0e08-566a-7ca1331506b1@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ohci-tmio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
+index 7f857bad9e95..08ec2ab0d95a 100644
+--- a/drivers/usb/host/ohci-tmio.c
++++ b/drivers/usb/host/ohci-tmio.c
+@@ -202,6 +202,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)
+ if (!cell)
+ return -EINVAL;
+
++ if (irq < 0)
++ return irq;
++
+ hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev));
+ if (!hcd) {
+ ret = -ENOMEM;
+--
+2.30.2
+
--- /dev/null
+From 409a7dff88fc2371eed61dba23911f29bcddb6e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:45:15 +0300
+Subject: usb: misc: brcmstb-usb-pinmap: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 711087f342914e831269438ff42cf59bb0142c71 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to devm_request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
+error code. Stop calling devm_request_irq() with the invalid IRQ #s.
+
+Fixes: 517c4c44b323 ("usb: Add driver to allow any GPIO to be used for 7211 USB signals")
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/806d0b1a-365b-93d9-3fc1-922105ca5e61@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/misc/brcmstb-usb-pinmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/misc/brcmstb-usb-pinmap.c b/drivers/usb/misc/brcmstb-usb-pinmap.c
+index 336653091e3b..2b2019c19cde 100644
+--- a/drivers/usb/misc/brcmstb-usb-pinmap.c
++++ b/drivers/usb/misc/brcmstb-usb-pinmap.c
+@@ -293,6 +293,8 @@ static int __init brcmstb_usb_pinmap_probe(struct platform_device *pdev)
+
+ /* Enable interrupt for out pins */
+ irq = platform_get_irq(pdev, 0);
++ if (irq < 0)
++ return irq;
+ err = devm_request_irq(&pdev->dev, irq,
+ brcmstb_usb_pinmap_ovr_isr,
+ IRQF_TRIGGER_RISING,
+--
+2.30.2
+
--- /dev/null
+From 94439e947833eab697cbed586a483fc4d3d53f61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:50:18 +0300
+Subject: usb: phy: fsl-usb: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit ecc2f30dbb25969908115c81ec23650ed982b004 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_irq() (which takes
+*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
+error code. Stop calling request_irq() with the invalid IRQ #s.
+
+Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/b0a86089-8b8b-122e-fd6d-73e8c2304964@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-fsl-usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
+index f34c9437a182..972704262b02 100644
+--- a/drivers/usb/phy/phy-fsl-usb.c
++++ b/drivers/usb/phy/phy-fsl-usb.c
+@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev)
+
+ /* request irq */
+ p_otg->irq = platform_get_irq(pdev, 0);
++ if (p_otg->irq < 0)
++ return p_otg->irq;
+ status = request_irq(p_otg->irq, fsl_otg_isr,
+ IRQF_SHARED, driver_name, p_otg);
+ if (status) {
+--
+2.30.2
+
--- /dev/null
+From 5cfeca7d87badb67288c3ba012ab8f89a1ac3d7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 23:32:38 +0300
+Subject: usb: phy: tahvo: add IRQ check
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 0d45a1373e669880b8beaecc8765f44cb0241e47 ]
+
+The driver neglects to check the result of platform_get_irq()'s call and
+blithely passes the negative error codes to request_threaded_irq() (which
+takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an
+original error code. Stop calling request_threaded_irq() with the invalid
+IRQ #s.
+
+Fixes: 9ba96ae5074c ("usb: omap1: Tahvo USB transceiver driver")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/8280d6a4-8e9a-7cfe-1aa9-db586dc9afdf@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-tahvo.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index baebb1f5a973..a3e043e3e4aa 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -393,7 +393,9 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+
+ dev_set_drvdata(&pdev->dev, tu);
+
+- tu->irq = platform_get_irq(pdev, 0);
++ tu->irq = ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
++ return ret;
+ ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
+ IRQF_ONESHOT,
+ "tahvo-vbus", tu);
+--
+2.30.2
+
--- /dev/null
+From 166c9ca0113486f87df71fdad8d0799987877c1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Aug 2021 23:53:16 +0300
+Subject: usb: phy: twl6030: add IRQ checks
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 0881e22c06e66af0b64773c91c8868ead3d01aa1 ]
+
+The driver neglects to check the result of platform_get_irq()'s calls and
+blithely passes the negative error codes to request_threaded_irq() (which
+takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding
+an original error code. Stop calling request_threaded_irq() with the
+invalid IRQ #s.
+
+Fixes: c33fad0c3748 ("usb: otg: Adding twl6030-usb transceiver driver for OMAP4430")
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/9507f50b-50f1-6dc4-f57c-3ed4e53a1c25@omp.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index 8ba6c5a91557..ab3c38a7d8ac 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -348,6 +348,11 @@ static int twl6030_usb_probe(struct platform_device *pdev)
+ twl->irq2 = platform_get_irq(pdev, 1);
+ twl->linkstat = MUSB_UNKNOWN;
+
++ if (twl->irq1 < 0)
++ return twl->irq1;
++ if (twl->irq2 < 0)
++ return twl->irq2;
++
+ twl->comparator.set_vbus = twl6030_set_vbus;
+ twl->comparator.start_srp = twl6030_start_srp;
+
+--
+2.30.2
+
--- /dev/null
+From 50af5c9532ec2556b068ff88be871bb4e734835a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 17:31:29 -0700
+Subject: x86/mce: Defer processing of early errors
+
+From: Borislav Petkov <bp@alien8.de>
+
+[ Upstream commit 3bff147b187d5dfccfca1ee231b0761a89f1eff5 ]
+
+When a fatal machine check results in a system reset, Linux does not
+clear the error(s) from machine check bank(s) - hardware preserves the
+machine check banks across a warm reset.
+
+During initialization of the kernel after the reboot, Linux reads, logs,
+and clears all machine check banks.
+
+But there is a problem. In:
+
+ 5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver")
+
+the call to mce_register_decode_chain() moved later in the boot
+sequence. This means that /dev/mcelog doesn't see those early error
+logs.
+
+This was partially fixed by:
+
+ cd9c57cad3fe ("x86/MCE: Dump MCE to dmesg if no consumers")
+
+which made sure that the logs were not lost completely by printing
+to the console. But parsing console logs is error prone. Users of
+/dev/mcelog should expect to find any early errors logged to standard
+places.
+
+Add a new flag MCP_QUEUE_LOG to machine_check_poll() to be used in early
+machine check initialization to indicate that any errors found should
+just be queued to genpool. When mcheck_late_init() is called it will
+call mce_schedule_work() to actually log and flush any errors queued in
+the genpool.
+
+ [ Based on an original patch, commit message by and completely
+ productized by Tony Luck. ]
+
+Fixes: 5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver")
+Reported-by: Sumanth Kamatala <skamatala@juniper.net>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20210824003129.GA1642753@agluck-desk2.amr.corp.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/mce.h | 1 +
+ arch/x86/kernel/cpu/mce/core.c | 11 ++++++++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index ddfb3cad8dff..2a8319fad0b7 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -265,6 +265,7 @@ enum mcp_flags {
+ MCP_TIMESTAMP = BIT(0), /* log time stamp */
+ MCP_UC = BIT(1), /* log uncorrected errors */
+ MCP_DONTLOG = BIT(2), /* only clear, don't log */
++ MCP_QUEUE_LOG = BIT(3), /* only queue to genpool */
+ };
+ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b);
+
+diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
+index bf7fe87a7e88..01ff4014b7f6 100644
+--- a/arch/x86/kernel/cpu/mce/core.c
++++ b/arch/x86/kernel/cpu/mce/core.c
+@@ -817,7 +817,10 @@ log_it:
+ if (mca_cfg.dont_log_ce && !mce_usable_address(&m))
+ goto clear_it;
+
+- mce_log(&m);
++ if (flags & MCP_QUEUE_LOG)
++ mce_gen_pool_add(&m);
++ else
++ mce_log(&m);
+
+ clear_it:
+ /*
+@@ -1630,10 +1633,12 @@ static void __mcheck_cpu_init_generic(void)
+ m_fl = MCP_DONTLOG;
+
+ /*
+- * Log the machine checks left over from the previous reset.
++ * Log the machine checks left over from the previous reset. Log them
++ * only, do not start processing them. That will happen in mcheck_late_init()
++ * when all consumers have been registered on the notifier chain.
+ */
+ bitmap_fill(all_banks, MAX_NR_BANKS);
+- machine_check_poll(MCP_UC | m_fl, &all_banks);
++ machine_check_poll(MCP_UC | MCP_QUEUE_LOG | m_fl, &all_banks);
+
+ cr4_set_bits(X86_CR4_MCE);
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
