--- /dev/null
+From 0de6920b67af1a58a76a2d3cd0223b7b84549b84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Sep 2020 16:12:34 +0930
+Subject: ARM: dts: aspeed: s2600wf: Fix VGA memory region location
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ]
+
+The VGA memory region is always from the top of RAM. On this board, that
+is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000.
+
+This was not an issue in practice as the region is "reserved" by the
+vendor's u-boot reducing the amount of available RAM, and the only user
+is the host VGA device poking at RAM over PCIe. That is, nothing from
+the ARM touches it.
+
+It is worth fixing as developers copy existing device trees when
+building their machines, and the XDMA driver does use the memory region
+from the ARM side.
+
+Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine")
+Reported-by: John Wang <wangzhiqiang.bj@bytedance.com>
+Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+index 22dade6393d06..d1dbe3b6ad5a7 100644
+--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts
+@@ -22,9 +22,9 @@
+ #size-cells = <1>;
+ ranges;
+
+- vga_memory: framebuffer@7f000000 {
++ vga_memory: framebuffer@9f000000 {
+ no-map;
+- reg = <0x7f000000 0x01000000>;
++ reg = <0x9f000000 0x01000000>; /* 16M */
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From b0a99ff8b460538be21ac3665ecc8299cb9b25dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 23:28:17 +0100
+Subject: ARM: dts: at91: at91sam9rl: fix ADC triggers
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ]
+
+The triggers for the ADC were taken from at91sam9260 dtsi but are not
+correct.
+
+Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi
+index ad495f5a5790f..cdf016232fb7d 100644
+--- a/arch/arm/boot/dts/at91sam9rl.dtsi
++++ b/arch/arm/boot/dts/at91sam9rl.dtsi
+@@ -277,23 +277,26 @@
+ atmel,adc-use-res = "highres";
+
+ trigger0 {
+- trigger-name = "timer-counter-0";
++ trigger-name = "external-rising";
+ trigger-value = <0x1>;
++ trigger-external;
+ };
++
+ trigger1 {
+- trigger-name = "timer-counter-1";
+- trigger-value = <0x3>;
++ trigger-name = "external-falling";
++ trigger-value = <0x2>;
++ trigger-external;
+ };
+
+ trigger2 {
+- trigger-name = "timer-counter-2";
+- trigger-value = <0x5>;
++ trigger-name = "external-any";
++ trigger-value = <0x3>;
++ trigger-external;
+ };
+
+ trigger3 {
+- trigger-name = "external";
+- trigger-value = <0x13>;
+- trigger-external;
++ trigger-name = "continuous";
++ trigger-value = <0x6>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From f1e38bb5478a5756f5c7c50cb540dab62d446ed2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 11:57:05 +0200
+Subject: ARM: dts: at91: sama5d2: map securam as device
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ]
+
+Due to strobe signal not being propagated from CPU to securam
+the securam needs to be mapped as device or strongly ordered memory
+to work properly. Otherwise, updating to one offset may affect
+the adjacent locations in securam.
+
+Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sama5d2.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
+index b405992eb6016..d57be54f5df9c 100644
+--- a/arch/arm/boot/dts/sama5d2.dtsi
++++ b/arch/arm/boot/dts/sama5d2.dtsi
+@@ -1247,6 +1247,7 @@
+ clocks = <&securam_clk>;
+ #address-cells = <1>;
+ #size-cells = <1>;
++ no-memory-wc;
+ ranges = <0 0xf8044000 0x1420>;
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 6e198a015e759424b9c944516da949e1af7420c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 14:00:19 +0200
+Subject: ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ]
+
+The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
+it the driver probes but VBus is not powered because of wrong pincontrol
+configuration.
+
+Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+index 02c1d2958d780..74440dad43354 100644
+--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+@@ -243,6 +243,11 @@
+ atmel,pins =
+ <AT91_PIOE 9 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PE9, conflicts with A9 */
+ };
++ pinctrl_usb_default: usb_default {
++ atmel,pins =
++ <AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++ AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++ };
+ };
+ };
+ };
+@@ -260,6 +265,8 @@
+ &pioE 3 GPIO_ACTIVE_LOW
+ &pioE 4 GPIO_ACTIVE_LOW
+ >;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_usb_default>;
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 99edcb752ad67bab5cbe01eb9b0b81ce622afc98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 14:00:18 +0200
+Subject: ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ]
+
+The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without
+it the driver probes but VBus is not powered because of wrong pincontrol
+configuration.
+
+Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+index 7d554b9ab27fd..e998d72d8b107 100644
+--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+@@ -170,6 +170,11 @@
+ atmel,pins =
+ <AT91_PIOE 31 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;
+ };
++ pinctrl_usb_default: usb_default {
++ atmel,pins =
++ <AT91_PIOE 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
++ AT91_PIOE 14 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
++ };
+ pinctrl_key_gpio: key_gpio_0 {
+ atmel,pins =
+ <AT91_PIOE 8 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
+@@ -195,6 +200,8 @@
+ &pioE 11 GPIO_ACTIVE_HIGH
+ &pioE 14 GPIO_ACTIVE_HIGH
+ >;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_usb_default>;
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 31554aecdccb914aa3c50f4f2366ea1bc983ef48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Sep 2020 09:17:11 +1200
+Subject: ARM: dts: Remove non-existent i2c1 from 98dx3236
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ]
+
+The switches with integrated CPUs have only got a single i2c controller.
+They incorrectly gained one when they were split from the Armada-XP.
+
+Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+index 3e7d093d7a9a2..966d9a6c40fca 100644
+--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+@@ -266,11 +266,6 @@
+ reg = <0x11000 0x100>;
+ };
+
+-&i2c1 {
+- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c";
+- reg = <0x11100 0x100>;
+-};
+-
+ &mpic {
+ reg = <0x20a00 0x2d0>, <0x21070 0x58>;
+ };
+--
+2.27.0
+
--- /dev/null
+From 574a3a9e87dde7f3a1526fb24f72386aa41c7430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Sep 2020 00:10:16 +0200
+Subject: ARM: p2v: fix handling of LPAE translation in BE mode
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ]
+
+When running in BE mode on LPAE hardware with a PA-to-VA translation
+that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong
+byte of the opcode. So fix that, by rotating the offset in r0 to the
+right by 8 bits, which will put the 8-bit immediate in bits 31:24.
+
+Note that this will also move bit #22 in its correct place when
+applying the rotation to the constant #0x400000.
+
+Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE")
+Acked-by: Nicolas Pitre <nico@fluxnic.net>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/head.S | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
+index 6b1148cafffdb..90add5ded3f1f 100644
+--- a/arch/arm/kernel/head.S
++++ b/arch/arm/kernel/head.S
+@@ -674,12 +674,8 @@ ARM_BE8(rev16 ip, ip)
+ ldrcc r7, [r4], #4 @ use branch for delay slot
+ bcc 1b
+ bx lr
+-#else
+-#ifdef CONFIG_CPU_ENDIAN_BE8
+- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction
+ #else
+ moveq r0, #0x400000 @ set bit 22, mov to mvn instruction
+-#endif
+ b 2f
+ 1: ldr ip, [r7, r3]
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+@@ -688,7 +684,7 @@ ARM_BE8(rev16 ip, ip)
+ tst ip, #0x000f0000 @ check the rotation field
+ orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24
+ biceq ip, ip, #0x00004000 @ clear bit 22
+- orreq ip, ip, r0 @ mask in offset bits 7-0
++ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0
+ #else
+ bic ip, ip, #0x000000ff
+ tst ip, #0xf00 @ check the rotation field
+--
+2.27.0
+
--- /dev/null
+From 1068960a1edb01db13c0e77905bc59cbfc88150d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Oct 2020 19:21:29 +0100
+Subject: ARM: sunxi: Add machine match for the Allwinner V3 SoC
+
+From: Paul Kocialkowski <contact@paulk.fr>
+
+[ Upstream commit ad2091f893bd5dfe2824f0d6819600d120698e9f ]
+
+The Allwinner V3 SoC shares the same base as the V3s but comes with
+extra pins and features available. As a result, it has its dedicated
+compatible string (already used in device trees), which is added here.
+
+Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20201031182137.1879521-2-contact@paulk.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-sunxi/sunxi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c
+index de4b0e932f22e..aa08b8cb01524 100644
+--- a/arch/arm/mach-sunxi/sunxi.c
++++ b/arch/arm/mach-sunxi/sunxi.c
+@@ -66,6 +66,7 @@ static const char * const sun8i_board_dt_compat[] = {
+ "allwinner,sun8i-h2-plus",
+ "allwinner,sun8i-h3",
+ "allwinner,sun8i-r40",
++ "allwinner,sun8i-v3",
+ "allwinner,sun8i-v3s",
+ NULL,
+ };
+--
+2.27.0
+
--- /dev/null
+From 8e7c675f4dfffca861e8fecdad287a34a937386b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 14:39:26 +0100
+Subject: arm64: dts: exynos: Correct psci compatible used on Exynos7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ]
+
+It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead
+we need to use syscon reboot/poweroff drivers, like it's done for other
+Exynos SoCs. This was confirmed by checking vendor source and testing it
+on Samsung Galaxy S6 device based on this SoC.
+
+To be able to use custom restart/poweroff handlers instead of PSCI
+functions, we need to correct psci compatible. This also requires us to
+provide function ids for CPU_ON and CPU_OFF.
+
+Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
+Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 38a07d9763a3f..5c5e57026c275 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -62,8 +62,10 @@
+ };
+
+ psci {
+- compatible = "arm,psci-0.2";
++ compatible = "arm,psci";
+ method = "smc";
++ cpu_off = <0x84000002>;
++ cpu_on = <0xC4000003>;
+ };
+
+ soc: soc {
+--
+2.27.0
+
--- /dev/null
+From bab69a5638c88fe63cce547f3b562a4aceada615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 14:39:25 +0100
+Subject: arm64: dts: exynos: Include common syscon restart/poweroff for
+ Exynos7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ]
+
+Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos
+SoCs, so instead of duplicating code we can just include common dtsi
+file, which already contains definitions of them. After this change,
+poweroff node will be also available, previously this dts file did
+contain only reboot node.
+
+Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7")
+Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+index 31b1a606cb664..38a07d9763a3f 100644
+--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
+@@ -494,13 +494,6 @@
+ pmu_system_controller: system-controller@105c0000 {
+ compatible = "samsung,exynos7-pmu", "syscon";
+ reg = <0x105c0000 0x5000>;
+-
+- reboot: syscon-reboot {
+- compatible = "syscon-reboot";
+- regmap = <&pmu_system_controller>;
+- offset = <0x0400>;
+- mask = <0x1>;
+- };
+ };
+
+ rtc: rtc@10590000 {
+@@ -638,3 +631,4 @@
+ };
+
+ #include "exynos7-pinctrl.dtsi"
++#include "arm/exynos-syscon-restart.dtsi"
+--
+2.27.0
+
--- /dev/null
+From 66e24e31204f6947a5bdfe2e18007557227ff139 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 02:40:01 +0000
+Subject: arm64: dts: meson: fix spi-max-frequency on Khadas VIM2
+
+From: Artem Lapkin <art@khadas.com>
+
+[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ]
+
+The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc
+chip should be 104Mhz not 30MHz.
+
+Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2")
+Signed-off-by: Artem Lapkin <art@khadas.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+index bdf7c6c5983ce..30fa9302a4dc8 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -399,7 +399,7 @@
+ #size-cells = <1>;
+ compatible = "winbond,w25q16", "jedec,spi-nor";
+ reg = <0>;
+- spi-max-frequency = <3000000>;
++ spi-max-frequency = <104000000>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 0ad6f10f6a029bcbe2491f3030f15af8fae98d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 14:48:05 +0800
+Subject: arm64: dts: rockchip: Fix UART pull-ups on rk3328
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ]
+
+For UARTs, the local pull-ups should be on the RX pin, not the TX pin.
+UARTs transmit active-low, so a disconnected RX pin should be pulled
+high instead of left floating to prevent noise being interpreted as
+transmissions.
+
+This gets rid of bogus sysrq events when the UART console is not
+connected.
+
+Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+index 92186edefeb96..6be7c67584ba9 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+@@ -1085,8 +1085,8 @@
+
+ uart0 {
+ uart0_xfer: uart0-xfer {
+- rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>,
+- <1 RK_PB0 1 &pcfg_pull_none>;
++ rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>,
++ <1 RK_PB0 1 &pcfg_pull_up>;
+ };
+
+ uart0_cts: uart0-cts {
+@@ -1104,8 +1104,8 @@
+
+ uart1 {
+ uart1_xfer: uart1-xfer {
+- rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>,
+- <3 RK_PA6 4 &pcfg_pull_none>;
++ rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>,
++ <3 RK_PA6 4 &pcfg_pull_up>;
+ };
+
+ uart1_cts: uart1-cts {
+@@ -1123,15 +1123,15 @@
+
+ uart2-0 {
+ uart2m0_xfer: uart2m0-xfer {
+- rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>,
+- <1 RK_PA1 2 &pcfg_pull_none>;
++ rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>,
++ <1 RK_PA1 2 &pcfg_pull_up>;
+ };
+ };
+
+ uart2-1 {
+ uart2m1_xfer: uart2m1-xfer {
+- rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>,
+- <2 RK_PA1 1 &pcfg_pull_none>;
++ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>,
++ <2 RK_PA1 1 &pcfg_pull_up>;
+ };
+ };
+
+--
+2.27.0
+
--- /dev/null
+From a6c56685da441eb809058a3568291e49155c2a21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 15:33:34 +0800
+Subject: arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ]
+
+The board has a standard USB A female port connected to the USB OTG
+controller's data pins. Set dr_mode in the OTG controller node to
+indicate this usage, instead of having the implementation guess.
+
+Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+index 91061d9cf78bc..5b1ece4a68d67 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts
+@@ -255,6 +255,7 @@
+ };
+
+ &usb20_otg {
++ dr_mode = "host";
+ status = "okay";
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 8ad53c3a6bcc523cd2db364c8de7bf747482605b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 21:09:20 +0800
+Subject: ASoC: arizona: Fix a wrong free in wm8997_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ]
+
+In the normal path, we should not free the arizona,
+we should return immediately. It will be free when
+call remove operation.
+
+Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
+Reported-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Acked-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8997.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
+index df5b36b8fc5a6..bb6a95be87265 100644
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -1180,6 +1180,8 @@ static int wm8997_probe(struct platform_device *pdev)
+ goto err_spk_irqs;
+ }
+
++ return ret;
++
+ err_spk_irqs:
+ arizona_free_spk_irqs(arizona);
+
+--
+2.27.0
+
--- /dev/null
+From fc50708a6cd764a4b566852db3441a7ea578aa7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 22:42:27 +0800
+Subject: ASoC: jz4740-i2s: add missed checks for clk_get()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ]
+
+jz4740_i2s_set_sysclk() does not check the return values of clk_get(),
+while the file dereferences the pointers in clk_put().
+Add the missed checks to fix it.
+
+Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/jz4740/jz4740-i2s.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
+index e099c0505b765..2c6b0ac97c684 100644
+--- a/sound/soc/jz4740/jz4740-i2s.c
++++ b/sound/soc/jz4740/jz4740-i2s.c
+@@ -318,10 +318,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id,
+ switch (clk_id) {
+ case JZ4740_I2S_CLKSRC_EXT:
+ parent = clk_get(NULL, "ext");
++ if (IS_ERR(parent))
++ return PTR_ERR(parent);
+ clk_set_parent(i2s->clk_i2s, parent);
+ break;
+ case JZ4740_I2S_CLKSRC_PLL:
+ parent = clk_get(NULL, "pll half");
++ if (IS_ERR(parent))
++ return PTR_ERR(parent);
+ clk_set_parent(i2s->clk_i2s, parent);
+ ret = clk_set_rate(i2s->clk_i2s, freq);
+ break;
+--
+2.27.0
+
--- /dev/null
+From 65b523e599bb83b64cafa0bff2eb28f4a6f07e5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 18:24:23 +0100
+Subject: ASoC: meson: fix COMPILE_TEST error
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ]
+
+When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the
+clock API. This is usually selected by the platform and the sound drivers
+should not really care about this. However COMPILE_TEST is special and the
+platform required may not have been selected, leading to this type of
+error:
+
+> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent'
+
+Since we need a sane provider of the API with COMPILE_TEST, depends on
+COMMON_CLK.
+
+Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig
+index 8af8bc358a90a..19fd4d583b869 100644
+--- a/sound/soc/meson/Kconfig
++++ b/sound/soc/meson/Kconfig
+@@ -1,5 +1,5 @@
+ menu "ASoC support for Amlogic platforms"
+- depends on ARCH_MESON || COMPILE_TEST
++ depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK)
+
+ config SND_MESON_AXG_FIFO
+ tristate
+--
+2.27.0
+
--- /dev/null
+From 76edd6bc5016ad8aa276bae20582944c41d41f79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 11:01:29 +0100
+Subject: ASoC: pcm: DRAIN support reactivation
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ]
+
+soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel
+v5.4 where explicit switch(cmd) has been introduced which takes into
+account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update
+switch statement to reactive support for it.
+
+As DRAIN is somewhat unique by lacking negative/stop counterpart, bring
+behaviour of dpcm_fe_dai_do_trigger() for said command back to its
+pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group.
+
+Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a0d1ce0edaf9a..af14304645ce8 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2390,6 +2390,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ case SNDRV_PCM_TRIGGER_DRAIN:
+ ret = dpcm_dai_trigger_fe_be(substream, cmd, true);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+@@ -2407,6 +2408,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd)
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
++ case SNDRV_PCM_TRIGGER_DRAIN:
+ ret = dpcm_dai_trigger_fe_be(substream, cmd, false);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+--
+2.27.0
+
--- /dev/null
+From b30812b2a9cb41b2a47d56a09f0d9c6de179c7c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 12:13:26 +0800
+Subject: ASoC: wm8998: Fix PM disable depth imbalance on error
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+
+Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8998.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
+index 61294c787f274..17dc5780ab686 100644
+--- a/sound/soc/codecs/wm8998.c
++++ b/sound/soc/codecs/wm8998.c
+@@ -1378,7 +1378,7 @@ static int wm8998_probe(struct platform_device *pdev)
+
+ ret = arizona_init_spk_irqs(arizona);
+ if (ret < 0)
+- return ret;
++ goto err_pm_disable;
+
+ ret = devm_snd_soc_register_component(&pdev->dev,
+ &soc_component_dev_wm8998,
+@@ -1393,6 +1393,8 @@ static int wm8998_probe(struct platform_device *pdev)
+
+ err_spk_irqs:
+ arizona_free_spk_irqs(arizona);
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
+
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4daf415dc33b0534b9d029e8faae0d0e7980602f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 09:54:09 +0300
+Subject: ASoC: wm_adsp: remove "ctl" from list on error in
+ wm_adsp_create_control()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ]
+
+The error handling frees "ctl" but it's still on the "dsp->ctl_list"
+list so that could result in a use after free. Remove it from the list
+before returning.
+
+Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b114fc7b2a95e..02c557e1f779c 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1379,7 +1379,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+ ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL);
+ if (!ctl_work) {
+ ret = -ENOMEM;
+- goto err_ctl_cache;
++ goto err_list_del;
+ }
+
+ ctl_work->dsp = dsp;
+@@ -1389,7 +1389,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp,
+
+ return 0;
+
+-err_ctl_cache:
++err_list_del:
++ list_del(&ctl->list);
+ kfree(ctl->cache);
+ err_ctl_name:
+ kfree(ctl->name);
+--
+2.27.0
+
--- /dev/null
+From e69749a2067e9d98789dbddd87c98e055df999ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:18 +0200
+Subject: ath10k: Fix an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ]
+
+If 'ath10k_usb_create()' fails, we should release some resources and report
+an error instead of silently continuing.
+
+Fixes: 4db66499df91 ("ath10k: add initial USB support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index c64a03f164c0f..f4e6d84bfb91c 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -1019,6 +1019,8 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+
+ ar_usb = ath10k_usb_priv(ar);
+ ret = ath10k_usb_create(ar, interface);
++ if (ret)
++ goto err;
+ ar_usb->ar = ar;
+
+ ar->dev_id = product_id;
+--
+2.27.0
+
--- /dev/null
+From 970ff3f0cd626943c14b3825a919e579eda4bcc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:17 +0200
+Subject: ath10k: Fix the parsing error in service available event
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ]
+
+The wmi service available event has been
+extended to contain extra 128 bit for new services
+to be indicated by firmware.
+
+Currently the presence of any optional TLVs in
+the wmi service available event leads to a parsing
+error with the below error message:
+ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71
+
+The wmi service available event parsing should
+not return error for the newly added optional TLV.
+Fix this parsing for service available event message.
+
+Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1
+
+Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++-
+ drivers/net/wireless/ath/ath10k/wmi.c | 9 +++++++--
+ drivers/net/wireless/ath/ath10k/wmi.h | 1 +
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 7f435fa29f75e..a6f7bf28a8b2d 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -1157,13 +1157,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len,
+
+ switch (tag) {
+ case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT:
++ arg->service_map_ext_valid = true;
+ arg->service_map_ext_len = *(__le32 *)ptr;
+ arg->service_map_ext = ptr + sizeof(__le32);
+ return 0;
+ default:
+ break;
+ }
+- return -EPROTO;
++
++ return 0;
+ }
+
+ static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar,
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 3f3fbee631c34..41eb57be92220 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -5510,8 +5510,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb)
+ ret);
+ }
+
+- ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
+- __le32_to_cpu(arg.service_map_ext_len));
++ /*
++ * Initialization of "arg.service_map_ext_valid" to ZERO is necessary
++ * for the below logic to work.
++ */
++ if (arg.service_map_ext_valid)
++ ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map,
++ __le32_to_cpu(arg.service_map_ext_len));
+ }
+
+ static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
+index e341cfb3fcc26..6bd63d1cd0395 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.h
++++ b/drivers/net/wireless/ath/ath10k/wmi.h
+@@ -6710,6 +6710,7 @@ struct wmi_svc_rdy_ev_arg {
+ };
+
+ struct wmi_svc_avail_ev_arg {
++ bool service_map_ext_valid;
+ __le32 service_map_ext_len;
+ const __le32 *service_map_ext;
+ };
+--
+2.27.0
+
--- /dev/null
+From 2059260e4ee6cfdb24b33b5d29e1c071a66b7ca4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 17:59:18 +0200
+Subject: ath10k: Release some resources in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ]
+
+Should an error occur after calling 'ath10k_usb_create()', it should be
+undone by a corresponding 'ath10k_usb_destroy()' call
+
+Fixes: 4db66499df91 ("ath10k: add initial USB support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
+index f4e6d84bfb91c..16d5fe6d1e2e4 100644
+--- a/drivers/net/wireless/ath/ath10k/usb.c
++++ b/drivers/net/wireless/ath/ath10k/usb.c
+@@ -1032,7 +1032,7 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+ ret = ath10k_core_register(ar, chip_id);
+ if (ret) {
+ ath10k_warn(ar, "failed to register driver core: %d\n", ret);
+- goto err;
++ goto err_usb_destroy;
+ }
+
+ /* TODO: remove this once USB support is fully implemented */
+@@ -1040,6 +1040,9 @@ static int ath10k_usb_probe(struct usb_interface *interface,
+
+ return 0;
+
++err_usb_destroy:
++ ath10k_usb_destroy(ar);
++
+ err:
+ ath10k_core_destroy(ar);
+
+--
+2.27.0
+
--- /dev/null
+From f830cc7ee1fb0cf69c86500a9a4197dfa035b70a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Sep 2020 19:48:13 +0530
+Subject: Bluetooth: Fix null pointer dereference in hci_event_packet()
+
+From: Anmol Karn <anmol.karan123@gmail.com>
+
+[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ]
+
+AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
+from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
+not be found when accessing after initialization of hcon.
+
+- net/bluetooth/hci_event.c:4945
+The bug seems to get triggered in this line:
+
+bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
+
+Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
+
+Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
+Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
+Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 622898d018f63..b58afd2d5ebf4 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4672,6 +4672,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
+ return;
+ }
+
++ if (!hcon->amp_mgr) {
++ hci_dev_unlock(hdev);
++ return;
++ }
++
+ if (ev->status) {
+ hci_conn_del(hcon);
+ hci_dev_unlock(hdev);
+--
+2.27.0
+
--- /dev/null
+From 9154c1792b68fefe6fe00812efb9403870f23e6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Oct 2020 18:44:47 +0530
+Subject: Bluetooth: hci_h5: fix memory leak in h5_close
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ]
+
+When h5_close() is called, h5 is directly freed when !hu->serdev.
+However, h5->rx_skb is not freed, which causes a memory leak.
+
+Freeing h5->rx_skb and setting it to NULL, fixes this memory leak.
+
+Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices")
+Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
+Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 5a68cd4dd71cb..7ffeb37e8f202 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -257,6 +257,9 @@ static int h5_close(struct hci_uart *hu)
+ skb_queue_purge(&h5->rel);
+ skb_queue_purge(&h5->unrel);
+
++ kfree_skb(h5->rx_skb);
++ h5->rx_skb = NULL;
++
+ if (h5->vnd && h5->vnd->close)
+ h5->vnd->close(h5);
+
+--
+2.27.0
+
--- /dev/null
+From 78085f0087d773085c33aa7b147d38425c6bd1c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 16:02:47 +0800
+Subject: bus: fsl-mc: fix error return code in fsl_mc_object_allocate()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 197f4d6a4a00 ("staging: fsl-mc: fsl-mc object allocator driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1607068967-31991-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+index e906ecfe23dd8..9cb0733a03991 100644
+--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
++++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
+@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev,
+ goto error;
+
+ mc_adev = resource->data;
+- if (!mc_adev)
++ if (!mc_adev) {
++ error = -EINVAL;
+ goto error;
++ }
+
+ *new_mc_adev = mc_adev;
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 2341bbe70e24c253966b94b988a44b63569daa68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 17:30:44 +0200
+Subject: cfg80211: initialize rekey_data
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ]
+
+In case we have old supplicant, the akm field is uninitialized.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index fbc8875502c3e..5f0605275fa39 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11502,7 +11502,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
+ struct net_device *dev = info->user_ptr[1];
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+ struct nlattr *tb[NUM_NL80211_REKEY_DATA];
+- struct cfg80211_gtk_rekey_data rekey_data;
++ struct cfg80211_gtk_rekey_data rekey_data = {};
+ int err;
+
+ if (!info->attrs[NL80211_ATTR_REKEY_DATA])
+--
+2.27.0
+
--- /dev/null
+From 31f8a58c85cd943bb56a79d15ba0b4985396d64a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Dec 2020 20:45:02 -0800
+Subject: checkpatch: fix unescaped left brace
+
+From: Dwaipayan Ray <dwaipayanray1@gmail.com>
+
+[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ]
+
+There is an unescaped left brace in a regex in OPEN_BRACE check. This
+throws a runtime error when checkpatch is run with --fix flag and the
+OPEN_BRACE check is executed.
+
+Fix it by escaping the left brace.
+
+Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com
+Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses")
+Signed-off-by: Dwaipayan Ray <dwaipayanray1@gmail.com>
+Acked-by: Joe Perches <joe@perches.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/checkpatch.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
+index 7eb944cbbaeab..2e31ec1378219 100755
+--- a/scripts/checkpatch.pl
++++ b/scripts/checkpatch.pl
+@@ -4059,7 +4059,7 @@ sub process {
+ $fix) {
+ fix_delete_line($fixlinenr, $rawline);
+ my $fixed_line = $rawline;
+- $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/;
++ $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/;
+ my $line1 = $1;
+ my $line2 = $2;
+ fix_insert_line($fixlinenr, ltrim($line1));
+--
+2.27.0
+
--- /dev/null
+From e683ed6180c3c203688c17e8379bed6170ec8fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 13:28:18 +0100
+Subject: clk: s2mps11: Fix a resource leak in error handling paths in the
+ probe function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ]
+
+Some resource should be released in the error handling path of the probe
+function, as already done in the remove function.
+
+The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add
+missing of_node_put and of_clk_del_provider")
+
+Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-s2mps11.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index 4080d4e78e8e4..f3aaefafba893 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -211,6 +211,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev)
+ return ret;
+
+ err_reg:
++ of_node_put(s2mps11_clks[0].clk_np);
+ while (--i >= 0)
+ clkdev_drop(s2mps11_clks[i].lookup);
+
+--
+2.27.0
+
--- /dev/null
+From b63b90b9b6115846cabb060ea2bad2a893e31a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Dec 2020 21:38:17 +0100
+Subject: clk: sunxi-ng: Make sure divider tables have sentinel
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ]
+
+Two clock divider tables are missing sentinel at the end. Effect of that
+is that clock framework reads past the last entry. Fix that with adding
+sentinel at the end.
+
+Issue was discovered with KASan.
+
+Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 +
+ drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 9ac6c299e0744..19304d6b2c05d 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -381,6 +381,7 @@ static struct clk_div_table ths_div_table[] = {
+ { .val = 1, .div = 2 },
+ { .val = 2, .div = 4 },
+ { .val = 3, .div = 6 },
++ { /* Sentinel */ },
+ };
+ static const char * const ths_parents[] = { "osc24M" };
+ static struct ccu_div ths_clk = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 61e3ba12773ea..d9789378caf55 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -328,6 +328,7 @@ static struct clk_div_table ths_div_table[] = {
+ { .val = 1, .div = 2 },
+ { .val = 2, .div = 4 },
+ { .val = 3, .div = 6 },
++ { /* Sentinel */ },
+ };
+ static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M",
+ 0x074, 0, 2, ths_div_table, BIT(31), 0);
+--
+2.27.0
+
--- /dev/null
+From 2c65c78ef31b8b07956a2ab73abcd19a0ca763f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 01:42:12 +0300
+Subject: clk: tegra: Fix duplicated SE clock entry
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ]
+
+The periph_clks[] array contains duplicated entry for Security Engine
+clock which was meant to be defined for T210, but it wasn't added
+properly. This patch corrects the T210 SE entry and fixes the following
+error message on T114/T124: "Tegra clk 127: register failed with -17".
+
+Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210")
+Tested-by Nicolas Chauvet <kwizart@gmail.com>
+Reported-by Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/tegra/clk-id.h | 1 +
+ drivers/clk/tegra/clk-tegra-periph.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h
+index de466b4446da9..0efcb200dde5a 100644
+--- a/drivers/clk/tegra/clk-id.h
++++ b/drivers/clk/tegra/clk-id.h
+@@ -233,6 +233,7 @@ enum clk_id {
+ tegra_clk_sdmmc4,
+ tegra_clk_sdmmc4_8,
+ tegra_clk_se,
++ tegra_clk_se_10,
+ tegra_clk_soc_therm,
+ tegra_clk_soc_therm_8,
+ tegra_clk_sor0,
+diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c
+index b137c5d34eec4..9d05fb48686db 100644
+--- a/drivers/clk/tegra/clk-tegra-periph.c
++++ b/drivers/clk/tegra/clk-tegra-periph.c
+@@ -650,7 +650,7 @@ static struct tegra_periph_init_data periph_clks[] = {
+ INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8),
+ INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9),
+ INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
+- INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se),
++ INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10),
+ INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8),
+ INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8),
+ INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03),
+--
+2.27.0
+
--- /dev/null
+From 86f7fd118e812e9211085e0b5947e2207ac8cfd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:16:23 +0800
+Subject: clk: ti: Fix memleak in ti_fapll_synth_setup
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ]
+
+If clk_register fails, we should goto free branch
+before function returns to prevent memleak.
+
+Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/fapll.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c
+index 071af44b1ba85..e33ce851837e4 100644
+--- a/drivers/clk/ti/fapll.c
++++ b/drivers/clk/ti/fapll.c
+@@ -497,6 +497,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ {
+ struct clk_init_data *init;
+ struct fapll_synth *synth;
++ struct clk *clk = ERR_PTR(-ENOMEM);
+
+ init = kzalloc(sizeof(*init), GFP_KERNEL);
+ if (!init)
+@@ -519,13 +520,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd,
+ synth->hw.init = init;
+ synth->clk_pll = pll_clk;
+
+- return clk_register(NULL, &synth->hw);
++ clk = clk_register(NULL, &synth->hw);
++ if (IS_ERR(clk)) {
++ pr_err("failed to register clock\n");
++ goto free;
++ }
++
++ return clk;
+
+ free:
+ kfree(synth);
+ kfree(init);
+
+- return ERR_PTR(-ENOMEM);
++ return clk;
+ }
+
+ static void __init ti_fapll_setup(struct device_node *node)
+--
+2.27.0
+
--- /dev/null
+From c4dad02013eaa82cfb825eb7449779afecd3ba19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 15:31:26 +0800
+Subject: clocksource/drivers/arm_arch_timer: Correct fault programming of
+ CNTKCTL_EL1.EVNTI
+
+From: Keqian Zhu <zhukeqian1@huawei.com>
+
+[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ]
+
+ARM virtual counter supports event stream, it can only trigger an event
+when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes,
+so the actual period of event stream is 2^(cntkctl_evnti + 1). For example,
+when the trigger bit is 0, then virtual counter trigger an event for every
+two cycles.
+
+While we're at it, rework the way we compute the trigger bit position
+by making it more obvious that when bits [n:n-1] are both set (with n
+being the most significant bit), we pick bit (n + 1).
+
+Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream")
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index 0445ad7e559e5..e67ab217eef41 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -827,15 +827,24 @@ static void arch_timer_evtstrm_enable(int divider)
+
+ static void arch_timer_configure_evtstream(void)
+ {
+- int evt_stream_div, pos;
++ int evt_stream_div, lsb;
++
++ /*
++ * As the event stream can at most be generated at half the frequency
++ * of the counter, use half the frequency when computing the divider.
++ */
++ evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2;
++
++ /*
++ * Find the closest power of two to the divisor. If the adjacent bit
++ * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1).
++ */
++ lsb = fls(evt_stream_div) - 1;
++ if (lsb > 0 && (evt_stream_div & BIT(lsb - 1)))
++ lsb++;
+
+- /* Find the closest power of two to the divisor */
+- evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ;
+- pos = fls(evt_stream_div);
+- if (pos > 1 && !(evt_stream_div & (1 << (pos - 2))))
+- pos--;
+ /* enable event stream */
+- arch_timer_evtstrm_enable(min(pos, 15));
++ arch_timer_evtstrm_enable(max(0, min(lsb, 15)));
+ }
+
+ static void arch_counter_set_user_access(void)
+--
+2.27.0
+
--- /dev/null
+From 086bc4c9531481bf0e4809925590639c9465da14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Nov 2020 21:51:23 +0800
+Subject: clocksource/drivers/cadence_ttc: Fix memory leak in
+ ttc_setup_clockevent()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ]
+
+If clk_notifier_register() failed, ttc_setup_clockevent() will return
+without freeing 'ttcce', which will leak memory.
+
+Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/cadence_ttc_timer.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
+index 29d51755e18b2..a7eb858a84a0f 100644
+--- a/drivers/clocksource/cadence_ttc_timer.c
++++ b/drivers/clocksource/cadence_ttc_timer.c
+@@ -419,10 +419,8 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ ttcce->ttc.clk = clk;
+
+ err = clk_prepare_enable(ttcce->ttc.clk);
+- if (err) {
+- kfree(ttcce);
+- return err;
+- }
++ if (err)
++ goto out_kfree;
+
+ ttcce->ttc.clk_rate_change_nb.notifier_call =
+ ttc_rate_change_clockevent_cb;
+@@ -432,7 +430,7 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+ &ttcce->ttc.clk_rate_change_nb);
+ if (err) {
+ pr_warn("Unable to register clock notifier.\n");
+- return err;
++ goto out_kfree;
+ }
+
+ ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
+@@ -461,15 +459,17 @@ static int __init ttc_setup_clockevent(struct clk *clk,
+
+ err = request_irq(irq, ttc_clock_event_interrupt,
+ IRQF_TIMER, ttcce->ce.name, ttcce);
+- if (err) {
+- kfree(ttcce);
+- return err;
+- }
++ if (err)
++ goto out_kfree;
+
+ clockevents_config_and_register(&ttcce->ce,
+ ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
+
+ return 0;
++
++out_kfree:
++ kfree(ttcce);
++ return err;
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From f34a1dabf7dc4e40c878bdbf1c5995d3caa320d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:32 +0100
+Subject: cpufreq: highbank: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/highbank-cpufreq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c
+index 1608f7105c9f8..ad743f2f31e78 100644
+--- a/drivers/cpufreq/highbank-cpufreq.c
++++ b/drivers/cpufreq/highbank-cpufreq.c
+@@ -104,6 +104,13 @@ out_put_node:
+ }
+ module_init(hb_cpufreq_driver_init);
+
++static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = {
++ { .compatible = "calxeda,highbank" },
++ { .compatible = "calxeda,ecx-2000" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match);
++
+ MODULE_AUTHOR("Mark Langsdorf <mark.langsdorf@calxeda.com>");
+ MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver");
+ MODULE_LICENSE("GPL");
+--
+2.27.0
+
--- /dev/null
+From dbfa5541e963371e58bb196165d81995ab142c66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:37 +0100
+Subject: cpufreq: loongson1: Add missing MODULE_ALIAS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ]
+
+This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
+driver when it is compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/loongson1-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c
+index be89416e2358f..9d902f67f8716 100644
+--- a/drivers/cpufreq/loongson1-cpufreq.c
++++ b/drivers/cpufreq/loongson1-cpufreq.c
+@@ -217,6 +217,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = {
+
+ module_platform_driver(ls1x_cpufreq_platdrv);
+
++MODULE_ALIAS("platform:ls1x-cpufreq");
+ MODULE_AUTHOR("Kelvin Cheung <keguang.zhang@gmail.com>");
+ MODULE_DESCRIPTION("Loongson1 CPUFreq driver");
+ MODULE_LICENSE("GPL");
+--
+2.27.0
+
--- /dev/null
+From 332ae3fccc8c6b2f0654681bd7bdfcc49d523b52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:33 +0100
+Subject: cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c
+index eb8920d398181..5a81e20f02824 100644
+--- a/drivers/cpufreq/mediatek-cpufreq.c
++++ b/drivers/cpufreq/mediatek-cpufreq.c
+@@ -554,6 +554,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = {
+
+ { }
+ };
++MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines);
+
+ static int __init mtk_cpufreq_driver_init(void)
+ {
+--
+2.27.0
+
--- /dev/null
+From e46969d20f70eea495ac096668af29c6c557b075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:38 +0100
+Subject: cpufreq: scpi: Add missing MODULE_ALIAS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ]
+
+This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq
+driver when it is compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scpi-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index 87a98ec77773a..0338885332a75 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -246,6 +246,7 @@ static struct platform_driver scpi_cpufreq_platdrv = {
+ };
+ module_platform_driver(scpi_cpufreq_platdrv);
+
++MODULE_ALIAS("platform:scpi-cpufreq");
+ MODULE_AUTHOR("Sudeep Holla <sudeep.holla@arm.com>");
+ MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver");
+ MODULE_LICENSE("GPL v2");
+--
+2.27.0
+
--- /dev/null
+From b23f791e90ee7f5b0e5d8bef08522daf8635a2c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 16:11:35 +0100
+Subject: cpufreq: st: Add missing MODULE_DEVICE_TABLE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this cpufreq driver when it is
+compiled as an external module.
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/sti-cpufreq.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
+index 6b5d241c30b70..2d09960afa591 100644
+--- a/drivers/cpufreq/sti-cpufreq.c
++++ b/drivers/cpufreq/sti-cpufreq.c
+@@ -295,6 +295,13 @@ register_cpufreq_dt:
+ }
+ module_init(sti_cpufreq_init);
+
++static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = {
++ { .compatible = "st,stih407" },
++ { .compatible = "st,stih410" },
++ { },
++};
++MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match);
++
+ MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver");
+ MODULE_AUTHOR("Ajitpal Singh <ajitpal.singh@st.com>");
+ MODULE_AUTHOR("Lee Jones <lee.jones@linaro.org>");
+--
+2.27.0
+
--- /dev/null
+From 715fce57fb51aed36ea0ec3ef34563b44cb64483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 13:07:02 -0700
+Subject: crypto: crypto4xx - Replace bitwise OR with logical OR in
+ crypto4xx_build_pd
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ]
+
+Clang warns:
+
+drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has
+lower precedence than '|'; '|' will be evaluated first
+[-Wbitwise-conditional-parentheses]
+ (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^
+drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
+around the '|' expression to silence this warning
+ (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ ^
+ )
+drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses
+around the '?:' expression to evaluate it first
+ (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ ^
+ (
+1 warning generated.
+
+It looks like this should have been a logical OR so that
+PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type
+is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the
+operator so that everything works properly.
+
+Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load")
+Link: https://github.com/ClangBuiltLinux/linux/issues/1198
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index 68d5ea818b6c0..cd00afb5786e8 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -926,7 +926,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req,
+ }
+
+ pd->pd_ctl.w = PD_CTL_HOST_READY |
+- ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) |
++ ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
+ (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ PD_CTL_HASH_FINAL : 0);
+ pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
+--
+2.27.0
+
--- /dev/null
+From dcbca40476d2e87a864d3c5cc2ed38bd380aa205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Oct 2020 17:47:36 +0100
+Subject: crypto: inside-secure - Fix sizeof() mismatch
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ]
+
+An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is
+not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that
+since the size of ** is the same size as * this is not causing any
+issues.
+
+Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
+Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/inside-secure/safexcel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
+index 86c699c14f849..bc6c5cb7de239 100644
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -1066,7 +1066,7 @@ static int safexcel_probe(struct platform_device *pdev)
+
+ priv->ring[i].rdr_req = devm_kcalloc(dev,
+ EIP197_DEFAULT_RING_SIZE,
+- sizeof(priv->ring[i].rdr_req),
++ sizeof(*priv->ring[i].rdr_req),
+ GFP_KERNEL);
+ if (!priv->ring[i].rdr_req) {
+ ret = -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 5f931f7cdbed5fdb6b41e575716a94d3baa43776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 21:17:28 +0800
+Subject: crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ]
+
+The pm_runtime_enable will increase power disable depth.
+Thus a pairing decrement is needed on the error handling
+path to keep it balanced according to context.
+
+Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/omap-aes.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
+index 9019f6b67986b..a5d6e1a0192bc 100644
+--- a/drivers/crypto/omap-aes.c
++++ b/drivers/crypto/omap-aes.c
+@@ -1163,7 +1163,7 @@ static int omap_aes_probe(struct platform_device *pdev)
+ if (err < 0) {
+ dev_err(dev, "%s: failed to get_sync(%d)\n",
+ __func__, err);
+- goto err_res;
++ goto err_pm_disable;
+ }
+
+ omap_aes_dma_stop(dd);
+@@ -1276,6 +1276,7 @@ err_engine:
+ omap_aes_dma_cleanup(dd);
+ err_irq:
+ tasklet_kill(&dd->done_task);
++err_pm_disable:
+ pm_runtime_disable(dev);
+ err_res:
+ dd = NULL;
+--
+2.27.0
+
--- /dev/null
+From 816ea63c8b33b9a063e2de1803f7ddbc6206a26d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 19:27:40 +0800
+Subject: crypto: qat - fix status check in qat_hal_put_rel_rd_xfer()
+
+From: Jack Xu <jack.xu@intel.com>
+
+[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ]
+
+The return value of qat_hal_rd_ae_csr() is always a CSR value and never
+a status and should not be stored in the status variable of
+qat_hal_put_rel_rd_xfer().
+
+This removes the assignment as qat_hal_rd_ae_csr() is not expected to
+fail.
+A more comprehensive handling of the theoretical corner case which could
+result in a fail will be submitted in a separate patch.
+
+Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN")
+Signed-off-by: Jack Xu <jack.xu@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/qat/qat_common/qat_hal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index ff149e176f649..dac130bb807ae 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -1189,7 +1189,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle,
+ unsigned short mask;
+ unsigned short dr_offset = 0x10;
+
+- status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
++ ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES);
+ if (CE_INUSE_CONTEXTS & ctx_enables) {
+ if (ctx & 0x1) {
+ pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx);
+--
+2.27.0
+
--- /dev/null
+From bb4ceff3ea55cc847b2dda26b29bfcd82ca86a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 09:34:55 +0000
+Subject: crypto: talitos - Endianess in current_desc_hdr()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ]
+
+current_desc_hdr() compares the value of the current descriptor
+with the next_desc member of the talitos_desc struct.
+
+While the current descriptor is obtained from in_be32() which
+return CPU ordered bytes, next_desc member is in big endian order.
+
+Convert the current descriptor into big endian before comparing it
+with next_desc.
+
+This fixes a sparse warning.
+
+Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index ea16308fae0a5..7e69d77ea2595 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -492,7 +492,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+
+ iter = tail;
+ while (priv->chan[ch].fifo[iter].dma_desc != cur_desc &&
+- priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) {
++ priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) {
+ iter = (iter + 1) & (priv->fifo_len - 1);
+ if (iter == tail) {
+ dev_err(dev, "couldn't locate current descriptor\n");
+@@ -500,7 +500,7 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ }
+ }
+
+- if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) {
++ if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) {
+ struct talitos_edesc *edesc;
+
+ edesc = container_of(priv->chan[ch].fifo[iter].desc,
+--
+2.27.0
+
--- /dev/null
+From d2c9e332e4e9d5992c0fad3b51f8e4b91690fb3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 09:34:56 +0000
+Subject: crypto: talitos - Fix return type of current_desc_hdr()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ]
+
+current_desc_hdr() returns a u32 but in fact this is a __be32,
+leading to a lot of sparse warnings.
+
+Change the return type to __be32 and ensure it is handled as
+sure by the caller.
+
+Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/talitos.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 7e69d77ea2595..c70a7c4f5b739 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -474,7 +474,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE)
+ /*
+ * locate current (offending) descriptor
+ */
+-static u32 current_desc_hdr(struct device *dev, int ch)
++static __be32 current_desc_hdr(struct device *dev, int ch)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ int tail, iter;
+@@ -515,13 +515,13 @@ static u32 current_desc_hdr(struct device *dev, int ch)
+ /*
+ * user diagnostics; report root cause of error based on execution unit status
+ */
+-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr)
++static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr)
+ {
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ int i;
+
+ if (!desc_hdr)
+- desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF);
++ desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF));
+
+ switch (desc_hdr & DESC_HDR_SEL0_MASK) {
+ case DESC_HDR_SEL0_AFEU:
+--
+2.27.0
+
--- /dev/null
+From 5c69c2f5b3e8f32caf3675e75157a670ad717315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 15:08:42 +0800
+Subject: cw1200: fix missing destroy_workqueue() on error in
+ cw1200_init_common
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ]
+
+Add the missing destroy_workqueue() before return from
+cw1200_init_common in the error handling case.
+
+Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/st/cw1200/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c
+index c1608f0bf6d01..0c5a15e2b8f97 100644
+--- a/drivers/net/wireless/st/cw1200/main.c
++++ b/drivers/net/wireless/st/cw1200/main.c
+@@ -384,6 +384,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ CW1200_LINK_ID_MAX,
+ cw1200_skb_dtor,
+ priv)) {
++ destroy_workqueue(priv->workqueue);
+ ieee80211_free_hw(hw);
+ return NULL;
+ }
+@@ -395,6 +396,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+ for (; i > 0; i--)
+ cw1200_queue_deinit(&priv->tx_queue[i - 1]);
+ cw1200_queue_stats_deinit(&priv->tx_queue_stats);
++ destroy_workqueue(priv->workqueue);
+ ieee80211_free_hw(hw);
+ return NULL;
+ }
+--
+2.27.0
+
--- /dev/null
+From 7e7bd486b923898e82f9855dd71f0e034f2ee148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Nov 2020 18:19:59 +0800
+Subject: dm ioctl: fix error return code in target_message
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index f666778ad2372..439277f48ff8b 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1575,6 +1575,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para
+
+ if (!argc) {
+ DMWARN("Empty message received.");
++ r = -EINVAL;
+ goto out_argv;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 6a56cac43c92999819c586bc4a2273d6a10217cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 09:08:13 +0800
+Subject: dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe()
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ]
+
+Return the corresponding error code when first_msi_entry() returns
+NULL in mv_xor_v2_probe().
+
+Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor_v2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 8dc0aa4d73ab8..462adf7e4e952 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -777,8 +777,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+ goto disable_clk;
+
+ msi_desc = first_msi_entry(&pdev->dev);
+- if (!msi_desc)
++ if (!msi_desc) {
++ ret = -ENODEV;
+ goto free_msi_irqs;
++ }
+ xor_dev->msi_desc = msi_desc;
+
+ ret = devm_request_irq(&pdev->dev, msi_desc->irq,
+--
+2.27.0
+
--- /dev/null
+From 1a621827e8265fbfe9d476d1a71b316667c4f4d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:38 -0800
+Subject: drivers: soc: ti: knav_qmss_queue: Fix error return code in
+ knav_queue_probe
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ]
+
+Fix to return the error code from of_get_child_by_name() instaed of 0
+in knav_queue_probe().
+
+Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_qmss_queue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index ffd7046caa2ca..9f5ce52e6c161 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -1867,9 +1867,10 @@ static int knav_queue_probe(struct platform_device *pdev)
+ if (ret)
+ goto err;
+
+- regions = of_get_child_by_name(node, "descriptor-regions");
++ regions = of_get_child_by_name(node, "descriptor-regions");
+ if (!regions) {
+ dev_err(dev, "descriptor-regions not specified\n");
++ ret = -ENODEV;
+ goto err;
+ }
+ ret = knav_queue_setup_regions(kdev, regions);
+--
+2.27.0
+
--- /dev/null
+From 7c9a300f59db519c4684e90eb9faac370b8e0271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 22:00:32 +0100
+Subject: drm/amdgpu: fix build_coefficients() argument
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ]
+
+gcc -Wextra warns about a function taking an enum argument
+being called with a bool:
+
+drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma':
+drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum <anonymous>' to 'enum dc_transfer_func_predefined' [-Wenum-conversion]
+ 1617 | build_coefficients(&coeff, true);
+
+It appears that a patch was added using the old calling conventions
+after the type was changed, and the value should actually be 0
+(TRANSFER_FUNCTION_SRGB) here instead of 1 (true).
+
+Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index 11ea1a0e629bd..458e82da3c85b 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -1296,7 +1296,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma
+ struct pwl_float_data_ex *rgb = rgb_regamma;
+ const struct hw_x_point *coord_x = coordinates_x;
+
+- build_coefficients(&coeff, true);
++ build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB);
+
+ i = 0;
+ while (i != hw_points_num + 1) {
+--
+2.27.0
+
--- /dev/null
+From 63bf35eb1ba2eb681c97401acf982b61b8e6316b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Oct 2020 12:39:28 -0700
+Subject: drm/gma500: fix double free of gma_connector
+
+From: Tom Rix <trix@redhat.com>
+
+[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ]
+
+clang static analysis reports this problem:
+
+cdv_intel_dp.c:2101:2: warning: Attempt to free released memory
+ kfree(gma_connector);
+ ^~~~~~~~~~~~~~~~~~~~
+
+In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off()
+fails, the handler calls cdv_intel_dp_destroy(connector) which does
+the first free of gma_connector. So adjust the goto label and skip
+the second free.
+
+Fixes: d112a8163f83 ("gma500/cdv: Add eDP support")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+index 05eba6dec5ebf..3e8b804cf7e7e 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
+@@ -2124,7 +2124,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
+ DRM_INFO("failed to retrieve link info, disabling eDP\n");
+ cdv_intel_dp_encoder_destroy(encoder);
+ cdv_intel_dp_destroy(connector);
+- goto err_priv;
++ goto err_connector;
+ } else {
+ DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n",
+ intel_dp->dpcd[0], intel_dp->dpcd[1],
+--
+2.27.0
+
--- /dev/null
+From 4db3565ad15cb0b6dea809d88a46ec49da9cf282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 22:03:30 +0300
+Subject: drm/msm/dsi_pll_10nm: restore VCO rate during restore_state
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ]
+
+PHY disable/enable resets PLL registers to default values. Thus in
+addition to restoring several registers we also need to restore VCO rate
+settings.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+index 21a69b046625a..d15511b521cb7 100644
+--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c
+@@ -554,6 +554,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ struct pll_10nm_cached_state *cached = &pll_10nm->cached_state;
+ void __iomem *phy_base = pll_10nm->phy_cmn_mmio;
+ u32 val;
++ int ret;
+
+ val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE);
+ val &= ~0x3;
+@@ -568,6 +569,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll)
+ val |= cached->pll_mux;
+ pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val);
+
++ ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate);
++ if (ret) {
++ DRM_DEV_ERROR(&pll_10nm->pdev->dev,
++ "restore vco rate failed. ret=%d\n", ret);
++ return ret;
++ }
++
+ DBG("DSI PLL%d", pll_10nm->id);
+
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From bc0e7ca504c1b8caad7c1cdcdb2f942757ab5e95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:10:45 +0800
+Subject: drm/omap: dmm_tiler: fix return error code in omap_dmm_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 723ae803218da993143387bf966042eccefac077 ]
+
+Return -ENOMEM when allocating refill memory failed.
+
+Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+index e884183c018ac..cb5ce73f72694 100644
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -763,6 +763,7 @@ static int omap_dmm_probe(struct platform_device *dev)
+ &omap_dmm->refill_pa, GFP_KERNEL);
+ if (!omap_dmm->refill_va) {
+ dev_err(&dev->dev, "could not allocate refill memory\n");
++ ret = -ENOMEM;
+ goto fail;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From ff2b0059affd421a4fd165bbc6e099d51b0b7773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Aug 2020 09:11:07 +0200
+Subject: drm/tve200: Fix handling of platform_get_irq() error
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ]
+
+platform_get_irq() returns -ERRNO on error. In such case comparison
+to 0 would pass the check.
+
+Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tve200/tve200_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c
+index ac344ddb23bc8..f93384c232066 100644
+--- a/drivers/gpu/drm/tve200/tve200_drv.c
++++ b/drivers/gpu/drm/tve200/tve200_drv.c
+@@ -223,8 +223,8 @@ static int tve200_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
+- ret = -EINVAL;
++ if (irq < 0) {
++ ret = irq;
+ goto clk_disable;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8e3c653b189c74bbf28401db027fbdfed7db76cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Dec 2020 14:36:27 +0100
+Subject: extcon: max77693: Fix modalias string
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ]
+
+The platform device driver name is "max77693-muic", so advertise it
+properly in the modalias string. This fixes automated module loading when
+this driver is compiled as a module.
+
+Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-max77693.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
+index 227651ff9666a..c221a0aec0f37 100644
+--- a/drivers/extcon/extcon-max77693.c
++++ b/drivers/extcon/extcon-max77693.c
+@@ -1275,4 +1275,4 @@ module_platform_driver(max77693_muic_driver);
+ MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver");
+ MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("platform:extcon-max77693");
++MODULE_ALIAS("platform:max77693-muic");
+--
+2.27.0
+
--- /dev/null
+From 2bd4a101745bf2c8bc285ccdf7882bf8836a947b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 13:55:51 +0000
+Subject: genirq/irqdomain: Don't try to free an interrupt that has no mapping
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ]
+
+When an interrupt allocation fails for N interrupts, it is pretty
+common for the error handling code to free the same number of interrupts,
+no matter how many interrupts have actually been allocated.
+
+This may result in the domain freeing code to be unexpectedly called
+for interrupts that have no mapping in that domain. Things end pretty
+badly.
+
+Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure
+that thiss does not follow the hierarchy if no mapping exists for a given
+interrupt.
+
+Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 0a76c44eb6b29..1e42fc2ad4d57 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -1247,8 +1247,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain,
+ unsigned int irq_base,
+ unsigned int nr_irqs)
+ {
+- if (domain->ops->free)
+- domain->ops->free(domain, irq_base, nr_irqs);
++ unsigned int i;
++
++ if (!domain->ops->free)
++ return;
++
++ for (i = 0; i < nr_irqs; i++) {
++ if (irq_domain_get_irq_data(domain, irq_base + i))
++ domain->ops->free(domain, irq_base + i, 1);
++ }
+ }
+
+ int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain,
+--
+2.27.0
+
--- /dev/null
+From 1135ff48f8fda9eccc639784159c3a395638ef52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Nov 2020 18:51:58 +0100
+Subject: HID: i2c-hid: add Vero K147 to descriptor override
+
+From: Julian Sax <jsbc@gmx.de>
+
+commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream.
+
+This device uses the SIPODEV SP1064 touchpad, which does not
+supply descriptors, so it has to be added to the override list.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Julian Sax <jsbc@gmx.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 58a753ef27175..5808eed6d6ba6 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -405,6 +405,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Vero K147",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 5e3a1a95b7c762faa7dc039fa32e790f842d5c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Oct 2020 10:56:43 +0800
+Subject: HSI: omap_ssi: Don't jump to free ID in ssi_add_controller()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ]
+
+In current code, it jumps to ida_simple_remove() when ida_simple_get()
+failes to allocate an ID. Just return to fix it.
+
+Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hsi/controllers/omap_ssi_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c
+index 41a09f506803d..129c5e6bc6547 100644
+--- a/drivers/hsi/controllers/omap_ssi_core.c
++++ b/drivers/hsi/controllers/omap_ssi_core.c
+@@ -389,7 +389,7 @@ static int ssi_add_controller(struct hsi_controller *ssi,
+
+ err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL);
+ if (err < 0)
+- goto out_err;
++ return err;
+ ssi->id = err;
+
+ ssi->owner = THIS_MODULE;
+--
+2.27.0
+
--- /dev/null
+From 77f32a0ad879fef76bb6ba0e36ad41bf515a1193 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 15:33:24 -0800
+Subject: Input: ads7846 - fix integer overflow on Rt calculation
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ]
+
+In some rare cases the 32 bit Rt value will overflow if z2 and x is max,
+z1 is minimal value and x_plate_ohms is relatively high (for example 800
+ohm). This would happen on some screen age with low pressure.
+
+There are two possible fixes:
+- make Rt 64bit
+- reorder calculation to avoid overflow
+
+The second variant seems to be preferable, since 64 bit calculation on
+32 bit system is a bit more expensive.
+
+Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver")
+Co-developed-by: David Jander <david@protonic.nl>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 0fbad337e45a3..7ce0eedaa0e5e 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts)
+ /* compute touch pressure resistance using equation #2 */
+ Rt = z2;
+ Rt -= z1;
+- Rt *= x;
+ Rt *= ts->x_plate_ohms;
++ Rt = DIV_ROUND_CLOSEST(Rt, 16);
++ Rt *= x;
+ Rt /= z1;
+- Rt = (Rt + 2047) >> 12;
++ Rt = DIV_ROUND_CLOSEST(Rt, 256);
+ } else {
+ Rt = 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From 25b00edd6171f8a2f61622ac4475e7b244627061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 11:00:59 -0800
+Subject: Input: ads7846 - fix race that causes missing releases
+
+From: David Jander <david@protonic.nl>
+
+[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ]
+
+If touchscreen is released while busy reading HWMON device, the release
+can be missed. The IRQ thread is not started because no touch is active
+and BTN_TOUCH release event is never sent.
+
+Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon")
+Co-developed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: David Jander <david@protonic.nl>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index a2f45aefce08a..0fbad337e45a3 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -199,6 +199,26 @@ struct ads7846 {
+ #define REF_ON (READ_12BIT_DFR(x, 1, 1))
+ #define REF_OFF (READ_12BIT_DFR(y, 0, 0))
+
++static int get_pendown_state(struct ads7846 *ts)
++{
++ if (ts->get_pendown_state)
++ return ts->get_pendown_state();
++
++ return !gpio_get_value(ts->gpio_pendown);
++}
++
++static void ads7846_report_pen_up(struct ads7846 *ts)
++{
++ struct input_dev *input = ts->input;
++
++ input_report_key(input, BTN_TOUCH, 0);
++ input_report_abs(input, ABS_PRESSURE, 0);
++ input_sync(input);
++
++ ts->pendown = false;
++ dev_vdbg(&ts->spi->dev, "UP\n");
++}
++
+ /* Must be called with ts->lock held */
+ static void ads7846_stop(struct ads7846 *ts)
+ {
+@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts)
+ static void ads7846_restart(struct ads7846 *ts)
+ {
+ if (!ts->disabled && !ts->suspended) {
++ /* Check if pen was released since last stop */
++ if (ts->pendown && !get_pendown_state(ts))
++ ads7846_report_pen_up(ts);
++
+ /* Tell IRQ thread that it may poll the device. */
+ ts->stopped = false;
+ mb();
+@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = {
+
+ /*--------------------------------------------------------------------------*/
+
+-static int get_pendown_state(struct ads7846 *ts)
+-{
+- if (ts->get_pendown_state)
+- return ts->get_pendown_state();
+-
+- return !gpio_get_value(ts->gpio_pendown);
+-}
+-
+ static void null_wait_for_sync(void)
+ {
+ }
+@@ -871,16 +887,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
+ msecs_to_jiffies(TS_POLL_PERIOD));
+ }
+
+- if (ts->pendown && !ts->stopped) {
+- struct input_dev *input = ts->input;
+-
+- input_report_key(input, BTN_TOUCH, 0);
+- input_report_abs(input, ABS_PRESSURE, 0);
+- input_sync(input);
+-
+- ts->pendown = false;
+- dev_vdbg(&ts->spi->dev, "UP\n");
+- }
++ if (ts->pendown && !ts->stopped)
++ ads7846_report_pen_up(ts);
+
+ return IRQ_HANDLED;
+ }
+--
+2.27.0
+
--- /dev/null
+From a85df4b61d892b9df4ca65fcb484247436bfcdcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 17:17:11 -0800
+Subject: Input: ads7846 - fix unaligned access on 7845
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ]
+
+req->sample[1] is not naturally aligned at word boundary, and therefore we
+should use get_unaligned_be16() when accessing it.
+
+Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support")
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/ads7846.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
+index 7ce0eedaa0e5e..b536768234b7c 100644
+--- a/drivers/input/touchscreen/ads7846.c
++++ b/drivers/input/touchscreen/ads7846.c
+@@ -35,6 +35,7 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/module.h>
+ #include <asm/irq.h>
++#include <asm/unaligned.h>
+
+ /*
+ * This code has been heavily tested on a Nokia 770, and lightly
+@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command)
+
+ if (status == 0) {
+ /* BE12 value, then padding */
+- status = be16_to_cpu(*((u16 *)&req->sample[1]));
++ status = get_unaligned_be16(&req->sample[1]);
+ status = status >> 3;
+ status &= 0x0fff;
+ }
+--
+2.27.0
+
--- /dev/null
+From e658d6a183c00a1e93422c9cbb8c79e99cd5b44d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Dec 2020 17:59:53 -0800
+Subject: Input: cros_ec_keyb - send 'scancodes' in addition to key events
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ]
+
+To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE
+and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in
+addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN
+capability, so it is only matter of actually sending the events.
+
+Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com
+Acked-by: Rajat Jain <rajatja@google.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/cros_ec_keyb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c
+index d560011815983..1edf0e8322ccc 100644
+--- a/drivers/input/keyboard/cros_ec_keyb.c
++++ b/drivers/input/keyboard/cros_ec_keyb.c
+@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev,
+ "changed: [r%d c%d]: byte %02x\n",
+ row, col, new_state);
+
++ input_event(idev, EV_MSC, MSC_SCAN, pos);
+ input_report_key(idev, keycodes[pos],
+ new_state);
+ }
+--
+2.27.0
+
--- /dev/null
+From 2e01e669517f1ea4c5e19cc4ebd9bf13a3919187 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Dec 2020 16:17:32 -0800
+Subject: Input: goodix - add upside-down quirk for Teclast X98 Pro tablet
+
+From: Simon Beginn <linux@simonmicro.de>
+
+[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ]
+
+The touchscreen on the Teclast x98 Pro is also mounted upside-down in
+relation to the display orientation.
+
+Signed-off-by: Simon Beginn <linux@simonmicro.de>
+Signed-off-by: Bastien Nocera <hadess@hadess.net>
+Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/goodix.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index b20ba65992735..7e480e2364216 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -136,6 +136,18 @@ static const struct dmi_system_id rotated_screen[] = {
+ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
+ },
+ },
++ {
++ .ident = "Teclast X98 Pro",
++ .matches = {
++ /*
++ * Only match BIOS date, because the manufacturers
++ * BIOS does not report the board name at all
++ * (sometimes)...
++ */
++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
++ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"),
++ },
++ },
+ {
+ .ident = "WinBook TW100",
+ .matches = {
+--
+2.27.0
+
--- /dev/null
+From 122046234dae87d554ce22e617d56b8098714ad5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 16:36:49 -0800
+Subject: Input: omap4-keypad - fix runtime PM error handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ]
+
+In omap4_keypad_probe, the patch fix several bugs.
+
+ 1) pm_runtime_get_sync will increment pm usage counter even it
+ failed. Forgetting to pm_runtime_put_noidle will result in
+ reference leak.
+
+ 2) In err_unmap, forget to disable runtime of device,
+ pm_runtime_enable will increase power disable depth. Thus a
+ pairing decrement is needed on the error handling path to keep
+ it balanced.
+
+ 3) In err_pm_disable, it will call pm_runtime_put_sync twice not
+ one time.
+
+To fix this we factor out code reading revision and disabling touchpad, and
+drop PM reference once we are done talking to the device.
+
+Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets")
+Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++-----------
+ 1 file changed, 53 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index aeeef50cef9bb..adb1ecc969eeb 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -199,12 +199,8 @@ static int omap4_keypad_open(struct input_dev *input)
+ return 0;
+ }
+
+-static void omap4_keypad_close(struct input_dev *input)
++static void omap4_keypad_stop(struct omap4_keypad *keypad_data)
+ {
+- struct omap4_keypad *keypad_data = input_get_drvdata(input);
+-
+- disable_irq(keypad_data->irq);
+-
+ /* Disable interrupts and wake-up events */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE,
+ OMAP4_VAL_IRQDISABLE);
+@@ -213,7 +209,15 @@ static void omap4_keypad_close(struct input_dev *input)
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
++}
++
++static void omap4_keypad_close(struct input_dev *input)
++{
++ struct omap4_keypad *keypad_data;
+
++ keypad_data = input_get_drvdata(input);
++ disable_irq(keypad_data->irq);
++ omap4_keypad_stop(keypad_data);
+ enable_irq(keypad_data->irq);
+
+ pm_runtime_put_sync(input->dev.parent);
+@@ -236,13 +240,37 @@ static int omap4_keypad_parse_dt(struct device *dev,
+ return 0;
+ }
+
++static int omap4_keypad_check_revision(struct device *dev,
++ struct omap4_keypad *keypad_data)
++{
++ unsigned int rev;
++
++ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
++ rev &= 0x03 << 30;
++ rev >>= 30;
++ switch (rev) {
++ case KBD_REVISION_OMAP4:
++ keypad_data->reg_offset = 0x00;
++ keypad_data->irqreg_offset = 0x00;
++ break;
++ case KBD_REVISION_OMAP5:
++ keypad_data->reg_offset = 0x10;
++ keypad_data->irqreg_offset = 0x0c;
++ break;
++ default:
++ dev_err(dev, "Keypad reports unsupported revision %d", rev);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ static int omap4_keypad_probe(struct platform_device *pdev)
+ {
+ struct omap4_keypad *keypad_data;
+ struct input_dev *input_dev;
+ struct resource *res;
+ unsigned int max_keys;
+- int rev;
+ int irq;
+ int error;
+
+@@ -282,41 +310,33 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ goto err_release_mem;
+ }
+
++ pm_runtime_enable(&pdev->dev);
+
+ /*
+ * Enable clocks for the keypad module so that we can read
+ * revision register.
+ */
+- pm_runtime_enable(&pdev->dev);
+ error = pm_runtime_get_sync(&pdev->dev);
+ if (error) {
+ dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+- goto err_unmap;
+- }
+- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
+- rev &= 0x03 << 30;
+- rev >>= 30;
+- switch (rev) {
+- case KBD_REVISION_OMAP4:
+- keypad_data->reg_offset = 0x00;
+- keypad_data->irqreg_offset = 0x00;
+- break;
+- case KBD_REVISION_OMAP5:
+- keypad_data->reg_offset = 0x10;
+- keypad_data->irqreg_offset = 0x0c;
+- break;
+- default:
+- dev_err(&pdev->dev,
+- "Keypad reports unsupported revision %d", rev);
+- error = -EINVAL;
+- goto err_pm_put_sync;
++ pm_runtime_put_noidle(&pdev->dev);
++ } else {
++ error = omap4_keypad_check_revision(&pdev->dev,
++ keypad_data);
++ if (!error) {
++ /* Ensure device does not raise interrupts */
++ omap4_keypad_stop(keypad_data);
++ }
++ pm_runtime_put_sync(&pdev->dev);
+ }
++ if (error)
++ goto err_pm_disable;
+
+ /* input device allocation */
+ keypad_data->input = input_dev = input_allocate_device();
+ if (!input_dev) {
+ error = -ENOMEM;
+- goto err_pm_put_sync;
++ goto err_pm_disable;
+ }
+
+ input_dev->name = pdev->name;
+@@ -362,28 +382,25 @@ static int omap4_keypad_probe(struct platform_device *pdev)
+ goto err_free_keymap;
+ }
+
+- device_init_wakeup(&pdev->dev, true);
+- pm_runtime_put_sync(&pdev->dev);
+-
+ error = input_register_device(keypad_data->input);
+ if (error < 0) {
+ dev_err(&pdev->dev, "failed to register input device\n");
+- goto err_pm_disable;
++ goto err_free_irq;
+ }
+
++ device_init_wakeup(&pdev->dev, true);
+ platform_set_drvdata(pdev, keypad_data);
++
+ return 0;
+
+-err_pm_disable:
+- pm_runtime_disable(&pdev->dev);
++err_free_irq:
+ free_irq(keypad_data->irq, keypad_data);
+ err_free_keymap:
+ kfree(keypad_data->keymap);
+ err_free_input:
+ input_free_device(input_dev);
+-err_pm_put_sync:
+- pm_runtime_put_sync(&pdev->dev);
+-err_unmap:
++err_pm_disable:
++ pm_runtime_disable(&pdev->dev);
+ iounmap(keypad_data->base);
+ err_release_mem:
+ release_mem_region(res->start, resource_size(res));
+--
+2.27.0
+
--- /dev/null
+From afbcbd30aefc1a69bda5af371cc717c770f708ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Nov 2020 13:55:25 +0000
+Subject: irqchip/alpine-msi: Fix freeing of interrupts on allocation error
+ path
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ]
+
+The alpine-msi driver has an interesting allocation error handling,
+where it frees the same interrupts repeatedly. Hilarity follows.
+
+This code is probably never executed, but let's fix it nonetheless.
+
+Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Antoine Tenart <atenart@kernel.org>
+Cc: Tsahee Zidenberg <tsahee@annapurnalabs.com>
+Cc: Antoine Tenart <atenart@kernel.org>
+Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-alpine-msi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
+index 23a3b877f7f1d..ede02dc2bcd0b 100644
+--- a/drivers/irqchip/irq-alpine-msi.c
++++ b/drivers/irqchip/irq-alpine-msi.c
+@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain,
+ return 0;
+
+ err_sgi:
+- while (--i >= 0)
+- irq_domain_free_irqs_parent(domain, virq, i);
++ irq_domain_free_irqs_parent(domain, virq, i - 1);
+ alpine_msix_free_sgi(priv, sgi, nr_irqs);
+ return err;
+ }
+--
+2.27.0
+
--- /dev/null
+From 03de6d71ab9c8051e179c013a5b26c0f1da02590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Dec 2020 03:18:42 +0900
+Subject: kconfig: fix return value of do_error_if()
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ]
+
+$(error-if,...) is expanded to an empty string. Currently, it relies on
+eval_clause() returning xstrdup("") when all attempts for expansion fail,
+but the correct implementation is to make do_error_if() return xstrdup("").
+
+Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions")
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/preprocess.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
+index 5ca2df790d3cf..389814b02d06b 100644
+--- a/scripts/kconfig/preprocess.c
++++ b/scripts/kconfig/preprocess.c
+@@ -111,7 +111,7 @@ static char *do_error_if(int argc, char *argv[])
+ if (!strcmp(argv[0], "y"))
+ pperror("%s", argv[1]);
+
+- return NULL;
++ return xstrdup("");
+ }
+
+ static char *do_filename(int argc, char *argv[])
+--
+2.27.0
+
--- /dev/null
+From a7ceaf800a1476b20adf85f1be02828848211aa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 19:50:56 +0800
+Subject: libnvdimm/label: Return -ENXIO for no slot in __blk_label_update
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ]
+
+Forget to set error code when nd_label_alloc_slot failed, and we
+add it to avoid overwritten error code.
+
+Fixes: 0ba1c634892b ("libnvdimm: write blk label set")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201205115056.2076523-1-zhangqilong3@huawei.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvdimm/label.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 9f1b7e3153f99..df9ca82f459ba 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -880,8 +880,10 @@ static int __blk_label_update(struct nd_region *nd_region,
+ if (is_old_resource(res, old_res_list, old_num_resources))
+ continue; /* carry-over */
+ slot = nd_label_alloc_slot(ndd);
+- if (slot == UINT_MAX)
++ if (slot == UINT_MAX) {
++ rc = -ENXIO;
+ goto abort;
++ }
+ dev_dbg(ndd->dev, "allocated: %d\n", slot);
+
+ nd_label = to_label(ndd, slot);
+--
+2.27.0
+
--- /dev/null
+From 639f757a4a8f429ea742d05aa77ad8f0e2b64962 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 20:16:27 +0000
+Subject: lockd: don't use interval-based rebinding over TCP
+
+From: Calum Mackay <calum.mackay@oracle.com>
+
+[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ]
+
+NLM uses an interval-based rebinding, i.e. it clears the transport's
+binding under certain conditions if more than 60 seconds have elapsed
+since the connection was last bound.
+
+This rebinding is not necessary for an autobind RPC client over a
+connection-oriented protocol like TCP.
+
+It can also cause problems: it is possible for nlm_bind_host() to clear
+XPRT_BOUND whilst a connection worker is in the middle of trying to
+reconnect, after it had already been checked in xprt_connect().
+
+When the connection worker notices that XPRT_BOUND has been cleared
+under it, in xs_tcp_finish_connecting(), that results in:
+
+ xs_tcp_setup_socket: connect returned unhandled error -107
+
+Worse, it's possible that the two can get into lockstep, resulting in
+the same behaviour repeated indefinitely, with the above error every
+300 seconds, without ever recovering, and the connection never being
+established. This has been seen in practice, with a large number of NLM
+client tasks, following a server restart.
+
+The existing callers of nlm_bind_host & nlm_rebind_host should not need
+to force the rebind, for TCP, so restrict the interval-based rebinding
+to UDP only.
+
+For TCP, we will still rebind when needed, e.g. on timeout, and connection
+error (including closure), since connection-related errors on an existing
+connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(),
+already unconditionally clear XPRT_BOUND.
+
+To avoid having to add the fix, and explanation, to both nlm_bind_host()
+and nlm_rebind_host(), remove the duplicate code from the former, and
+have it call the latter.
+
+Drop the dprintk, which adds no value over a trace.
+
+Signed-off-by: Calum Mackay <calum.mackay@oracle.com>
+Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/host.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index f0b5c987d6ae1..3f6ba0cd2bd9c 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -432,12 +432,7 @@ nlm_bind_host(struct nlm_host *host)
+ * RPC rebind is required
+ */
+ if ((clnt = host->h_rpcclnt) != NULL) {
+- if (time_after_eq(jiffies, host->h_nextrebind)) {
+- rpc_force_rebind(clnt);
+- host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+- dprintk("lockd: next rebind in %lu jiffies\n",
+- host->h_nextrebind - jiffies);
+- }
++ nlm_rebind_host(host);
+ } else {
+ unsigned long increment = nlmsvc_timeout;
+ struct rpc_timeout timeparms = {
+@@ -485,13 +480,20 @@ nlm_bind_host(struct nlm_host *host)
+ return clnt;
+ }
+
+-/*
+- * Force a portmap lookup of the remote lockd port
++/**
++ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port
++ * @host: NLM host handle for peer
++ *
++ * This is not needed when using a connection-oriented protocol, such as TCP.
++ * The existing autobind mechanism is sufficient to force a rebind when
++ * required, e.g. on connection state transitions.
+ */
+ void
+ nlm_rebind_host(struct nlm_host *host)
+ {
+- dprintk("lockd: rebind host %s\n", host->h_name);
++ if (host->h_proto != IPPROTO_UDP)
++ return;
++
+ if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) {
+ rpc_force_rebind(host->h_rpcclnt);
+ host->h_nextrebind = jiffies + NLM_HOST_REBIND;
+--
+2.27.0
+
--- /dev/null
+From 67a2349516114087b2b10874b220d10a87a45397 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 23:59:45 -0800
+Subject: lwt: Disable BH too in run_lwt_bpf()
+
+From: Dongdong Wang <wangdongdong.6@bytedance.com>
+
+[ Upstream commit d9054a1ff585ba01029584ab730efc794603d68f ]
+
+The per-cpu bpf_redirect_info is shared among all skb_do_redirect()
+and BPF redirect helpers. Callers on RX path are all in BH context,
+disabling preemption is not sufficient to prevent BH interruption.
+
+In production, we observed strange packet drops because of the race
+condition between LWT xmit and TC ingress, and we verified this issue
+is fixed after we disable BH.
+
+Although this bug was technically introduced from the beginning, that
+is commit 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure"),
+at that time call_rcu() had to be call_rcu_bh() to match the RCU context.
+So this patch may not work well before RCU flavor consolidation has been
+completed around v5.0.
+
+Update the comments above the code too, as call_rcu() is now BH friendly.
+
+Signed-off-by: Dongdong Wang <wangdongdong.6@bytedance.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Reviewed-by: Cong Wang <cong.wang@bytedance.com>
+Link: https://lore.kernel.org/bpf/20201205075946.497763-1-xiyou.wangcong@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/lwt_bpf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
+index a648568c5e8fe..4a5f4fbffd836 100644
+--- a/net/core/lwt_bpf.c
++++ b/net/core/lwt_bpf.c
+@@ -44,12 +44,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
+ {
+ int ret;
+
+- /* Preempt disable is needed to protect per-cpu redirect_info between
+- * BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and
+- * access to maps strictly require a rcu_read_lock() for protection,
+- * mixing with BH RCU lock doesn't work.
++ /* Preempt disable and BH disable are needed to protect per-cpu
++ * redirect_info between BPF prog and skb_do_redirect().
+ */
+ preempt_disable();
++ local_bh_disable();
+ bpf_compute_data_pointers(skb);
+ ret = bpf_prog_run_save_cb(lwt->prog, skb);
+
+@@ -82,6 +81,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
+ break;
+ }
+
++ local_bh_enable();
+ preempt_enable();
+
+ return ret;
+--
+2.27.0
+
--- /dev/null
+From 7a9bcf9db103e9e93a7757640686ad9987dfe12a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Dec 2020 14:54:44 +0200
+Subject: mac80211: don't set set TDLS STA bandwidth wider than possible
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ]
+
+When we set up a TDLS station, we set sta->sta.bandwidth solely based
+on the capabilities, because the "what's the current bandwidth" check
+is bypassed and only applied for other types of stations.
+
+This leads to the unfortunate scenario that the sta->sta.bandwidth is
+160 MHz if both stations support it, but we never actually configure
+this bandwidth unless the AP is already using 160 MHz; even for wider
+bandwidth support we only go up to 80 MHz (at least right now.)
+
+For iwlwifi, this can also lead to firmware asserts, telling us that
+we've configured the TX rates for a higher bandwidth than is actually
+available due to the PHY configuration.
+
+For non-TDLS, we check against the interface's requested bandwidth,
+but we explicitly skip this check for TDLS to cope with the wider BW
+case. Change this to
+ (a) still limit to the TDLS peer's own chandef, which gets factored
+ into the overall PHY configuration we request from the driver,
+ and
+ (b) limit it to when the TDLS peer is authorized, because it's only
+ factored into the channel context in this case.
+
+Fixes: 504871e602d9 ("mac80211: fix bandwidth computation for TDLS peers")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/iwlwifi.20201206145305.fcc7d29c4590.I11f77e9e25ddf871a3c8d5604650c763e2c5887a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/vht.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
+index 4d154efb80c88..d691c2f2e92e7 100644
+--- a/net/mac80211/vht.c
++++ b/net/mac80211/vht.c
+@@ -421,12 +421,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+ * IEEE80211-2016 specification makes higher bandwidth operation
+ * possible on the TDLS link if the peers have wider bandwidth
+ * capability.
++ *
++ * However, in this case, and only if the TDLS peer is authorized,
++ * limit to the tdls_chandef so that the configuration here isn't
++ * wider than what's actually requested on the channel context.
+ */
+ if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+- test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
+- return bw;
+-
+- bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
++ test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) &&
++ test_sta_flag(sta, WLAN_STA_AUTHORIZED) &&
++ sta->tdls_chandef.chan)
++ bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width));
++ else
++ bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+
+ return bw;
+ }
+--
+2.27.0
+
--- /dev/null
+From 1147af0451ad7e48a62cd94a30dca6e7f9104bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Mar 2020 15:23:12 +0100
+Subject: media: max2175: fix max2175_set_csm_mode() error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ]
+
+This is supposed to return negative error codes but the type is bool so
+it returns true instead.
+
+Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/max2175.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c
+index 008a082cb8ad7..dddc5ef50dd4e 100644
+--- a/drivers/media/i2c/max2175.c
++++ b/drivers/media/i2c/max2175.c
+@@ -511,7 +511,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx)
+ }
+ }
+
+-static bool max2175_set_csm_mode(struct max2175 *ctx,
++static int max2175_set_csm_mode(struct max2175 *ctx,
+ enum max2175_csm_mode new_mode)
+ {
+ int ret = max2175_poll_csm_ready(ctx);
+--
+2.27.0
+
--- /dev/null
+From c2852e12fb3a4c2246b7e9ab8e5fd550981b0968 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 14:38:02 +0200
+Subject: media: mtk-vcodec: add missing put_device() call in
+ mtk_vcodec_release_dec_pm()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ]
+
+mtk_vcodec_release_dec_pm() will be called in two places:
+
+a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error.
+b. mtk_vcodec_dec_remove().
+
+In both cases put_device() call is needed, since of_find_device_by_node()
+was called in mtk_vcodec_init_dec_pm() previously.
+
+Thus add put_devices() call in mtk_vcodec_release_dec_pm()
+
+Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+index 79ca03ac449c3..3f64119e8c082 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c
+@@ -103,6 +103,7 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev)
+ void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev)
+ {
+ pm_runtime_disable(dev->pm.dev);
++ put_device(dev->pm.larbvdec);
+ }
+
+ void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm)
+--
+2.27.0
+
--- /dev/null
+From c4cd1847932b4fd9e24c50d7d9893b6ac383e2bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 08:23:40 +0100
+Subject: media: saa7146: fix array overflow in vidioc_s_audio()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ]
+
+The "a->index" value comes from the user via the ioctl. The problem is
+that the shift can wrap resulting in setting "mxb->cur_audinput" to an
+invalid value, which later results in an array overflow.
+
+Fixes: 6680427791c9 ("[media] mxb: fix audio handling")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7146/mxb.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c
+index 6b5582b7c5955..6e25654da2567 100644
+--- a/drivers/media/pci/saa7146/mxb.c
++++ b/drivers/media/pci/saa7146/mxb.c
+@@ -653,16 +653,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio *
+ struct mxb *mxb = (struct mxb *)dev->ext_priv;
+
+ DEB_D("VIDIOC_S_AUDIO %d\n", a->index);
+- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) {
+- if (mxb->cur_audinput != a->index) {
+- mxb->cur_audinput = a->index;
+- tea6420_route(mxb, a->index);
+- if (mxb->cur_audinput == 0)
+- mxb_update_audmode(mxb);
+- }
+- return 0;
++ if (a->index >= 32 ||
++ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index)))
++ return -EINVAL;
++
++ if (mxb->cur_audinput != a->index) {
++ mxb->cur_audinput = a->index;
++ tea6420_route(mxb, a->index);
++ if (mxb->cur_audinput == 0)
++ mxb_update_audmode(mxb);
+ }
+- return -EINVAL;
++ return 0;
+ }
+
+ #ifdef CONFIG_VIDEO_ADV_DEBUG
+--
+2.27.0
+
--- /dev/null
+From bc4ad99ce6638670adc74128521735df9220f5c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Sep 2020 14:56:57 +0200
+Subject: media: siano: fix memory leak of debugfs members in smsdvb_hotplug
+
+From: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+
+[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ]
+
+When dvb_create_media_graph fails, the debugfs kept inside client should
+be released. However, the current implementation does not release them.
+
+Fix this by adding a new goto label to call smsdvb_debugfs_release.
+
+Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
+Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/siano/smsdvb-main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
+index 43cfd1dbda014..afca47b97c2a2 100644
+--- a/drivers/media/common/siano/smsdvb-main.c
++++ b/drivers/media/common/siano/smsdvb-main.c
+@@ -1180,12 +1180,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
+ rc = dvb_create_media_graph(&client->adapter, true);
+ if (rc < 0) {
+ pr_err("dvb_create_media_graph failed %d\n", rc);
+- goto client_error;
++ goto media_graph_error;
+ }
+
+ pr_info("DVB interface registered.\n");
+ return 0;
+
++media_graph_error:
++ smsdvb_debugfs_release(client);
++
+ client_error:
+ dvb_unregister_frontend(&client->frontend);
+
+--
+2.27.0
+
--- /dev/null
+From 2ffe4a82b8410b9947712b734c21b9631a6ba3c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Nov 2020 04:22:01 +0100
+Subject: media: solo6x10: fix missing snd_card_free in error handling case
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ]
+
+Fix to goto snd_error in error handling case when fails
+to do snd_ctl_add, as done elsewhere in this function.
+
+Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c
+index 2ac33b5cc4546..f06e6d35d846c 100644
+--- a/drivers/media/pci/solo6x10/solo6x10-g723.c
++++ b/drivers/media/pci/solo6x10/solo6x10-g723.c
+@@ -410,7 +410,7 @@ int solo_g723_init(struct solo_dev *solo_dev)
+
+ ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev));
+ if (ret < 0)
+- return ret;
++ goto snd_error;
+
+ ret = solo_snd_pcm_init(solo_dev);
+ if (ret < 0)
+--
+2.27.0
+
--- /dev/null
+From 9b3acf21b34fd872d13cd860548da404d02d74dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 23:12:23 +0200
+Subject: media: tm6000: Fix sizeof() mismatches
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ]
+
+The are two instances of sizeof() being used incorrectly. The
+sizeof(void *) is incorrect because urb_buffer is a char ** pointer,
+fix this by using sizeof(*dev->urb_buffer). The sizeof(dma_addr_t *)
+is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t
+and not a dma_addr_t *. This errors did not cause any issues because
+it just so happens the sizes are the same.
+
+Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)")
+
+Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/tm6000/tm6000-video.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
+index 96055de6e8ce2..62f0128419717 100644
+--- a/drivers/media/usb/tm6000/tm6000-video.c
++++ b/drivers/media/usb/tm6000/tm6000-video.c
+@@ -463,11 +463,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev)
+ if (dev->urb_buffer)
+ return 0;
+
+- dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL);
++ dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer),
++ GFP_KERNEL);
+ if (!dev->urb_buffer)
+ return -ENOMEM;
+
+- dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *),
++ dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma),
+ GFP_KERNEL);
+ if (!dev->urb_dma)
+ return -ENOMEM;
+--
+2.27.0
+
--- /dev/null
+From 120bf948ddc42d4866b1c698d51f2114c9339f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:48:46 +0800
+Subject: memstick: fix a double-free bug in memstick_check
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]
+
+kfree(host->card) has been called in put_device so that
+another kfree would raise cause a double-free bug.
+
+Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/core/memstick.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index b1564cacd19e1..20ae8652adf44 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
+ host->card = card;
+ if (device_register(&card->dev)) {
+ put_device(&card->dev);
+- kfree(host->card);
+ host->card = NULL;
+ }
+ } else
+--
+2.27.0
+
--- /dev/null
+From 2f99ba92394e23df2fbb3d13eae84086083905af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 09:47:18 +0800
+Subject: memstick: r592: Fix error return in r592_probe()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ]
+
+Fix to return a error code from the error handling case instead of 0.
+
+Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memstick/host/r592.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
+index 627d6e62fe313..4559593ecd5a9 100644
+--- a/drivers/memstick/host/r592.c
++++ b/drivers/memstick/host/r592.c
+@@ -762,8 +762,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ goto error3;
+
+ dev->mmio = pci_ioremap_bar(pdev, 0);
+- if (!dev->mmio)
++ if (!dev->mmio) {
++ error = -ENOMEM;
+ goto error4;
++ }
+
+ dev->irq = pdev->irq;
+ spin_lock_init(&dev->irq_lock);
+@@ -789,12 +791,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ &dev->dummy_dma_page_physical_address, GFP_KERNEL);
+ r592_stop_dma(dev , 0);
+
+- if (request_irq(dev->irq, &r592_irq, IRQF_SHARED,
+- DRV_NAME, dev))
++ error = request_irq(dev->irq, &r592_irq, IRQF_SHARED,
++ DRV_NAME, dev);
++ if (error)
+ goto error6;
+
+ r592_update_card_detect(dev);
+- if (memstick_add_host(host))
++ error = memstick_add_host(host);
++ if (error)
+ goto error7;
+
+ message("driver successfully loaded");
+--
+2.27.0
+
--- /dev/null
+From acbd28ddf0de4a00beb26710313298efd475c621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 00:34:01 +0300
+Subject: MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA
+
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+
+[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ]
+
+When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results
+in the following Kbuild warning:
+
+WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE
+ Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y
+ Selected by [y]:
+ - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y]
+
+The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without
+depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE
+depends on BCMA_DRIVER_PCI. This can also fail building the kernel.
+
+Honor the kconfig dependency to remove unmet direct dependency warnings
+and avoid any potential build failures.
+
+Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879
+Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig
+index 29471038d817e..c6b99845fb377 100644
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -27,6 +27,7 @@ config BCM47XX_BCMA
+ select BCMA
+ select BCMA_HOST_SOC
+ select BCMA_DRIVER_MIPS
++ select BCMA_DRIVER_PCI if PCI
+ select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ select BCMA_DRIVER_GPIO
+ default y
+--
+2.27.0
+
--- /dev/null
+From ae7c6328f7157fcd33ef9eefc469662ba5643be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Nov 2020 15:48:47 +0800
+Subject: mips: cdmm: fix use-after-free in mips_cdmm_bus_discover
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ]
+
+kfree(dev) has been called inside put_device so anther
+kfree would cause a use-after-free bug/
+
+Fixes: 8286ae03308c ("MIPS: Add CDMM bus support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Acked-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mips_cdmm.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c
+index 1b14256376d24..7c1da45be166e 100644
+--- a/drivers/bus/mips_cdmm.c
++++ b/drivers/bus/mips_cdmm.c
+@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus)
+ dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id);
+ ++id;
+ ret = device_register(&dev->dev);
+- if (ret) {
++ if (ret)
+ put_device(&dev->dev);
+- kfree(dev);
+- }
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 624eb2580bb6ed1a7114f57bbf1ebd100a06f3df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 23:21:09 +0900
+Subject: mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure
+
+From: Tsuchiya Yuto <kitakar@gmail.com>
+
+[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ]
+
+When a PCIe function level reset (FLR) is performed but without fw reset for
+some reasons (e.g., on Microsoft Surface devices, fw reset requires other
+quirks), it fails to reset wifi properly. You can trigger the issue on such
+devices via debugfs entry for reset:
+
+ $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset
+
+and the resulting dmesg log:
+
+ [ 45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request
+ [ 45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3
+ [ 45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex...
+ [ 45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed
+ [ 45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID]
+ [ 53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully
+ [ 75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+ [ 85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15
+ [ 87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+ [ 87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+ [ 99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [ 111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110
+ [ 111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys
+ [...]
+
+When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it
+lacks mwifiex_init_shutdown_fw().
+
+This commit fixes mwifiex_shutdown_sw() by adding the missing
+mwifiex_init_shutdown_fw().
+
+Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support")
+Signed-off-by: Tsuchiya Yuto <kitakar@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index e48b47f425540..ceac611ef0864 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -1474,6 +1474,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter)
+ priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+ mwifiex_deauthenticate(priv, NULL);
+
++ mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN);
++
+ mwifiex_uninit_sw(adapter);
+
+ if (adapter->if_ops.down_dev)
+--
+2.27.0
+
--- /dev/null
+From 0efb315608343d86794d057a70d87bae6a82b7bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 21:21:17 +0100
+Subject: net: allwinner: Fix some resources leak in the error handling path of
+ the probe and in the remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ]
+
+'irq_of_parse_and_map()' should be balanced by a corresponding
+'irq_dispose_mapping()' call. Otherwise, there is some resources leaks.
+
+Add such a call in the error handling path of the probe function and in the
+remove function.
+
+Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
+index c458b81ba63af..d249a4309da2f 100644
+--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
+@@ -847,13 +847,13 @@ static int emac_probe(struct platform_device *pdev)
+ db->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(db->clk)) {
+ ret = PTR_ERR(db->clk);
+- goto out_iounmap;
++ goto out_dispose_mapping;
+ }
+
+ ret = clk_prepare_enable(db->clk);
+ if (ret) {
+ dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret);
+- goto out_iounmap;
++ goto out_dispose_mapping;
+ }
+
+ ret = sunxi_sram_claim(&pdev->dev);
+@@ -910,6 +910,8 @@ out_release_sram:
+ sunxi_sram_release(&pdev->dev);
+ out_clk_disable_unprepare:
+ clk_disable_unprepare(db->clk);
++out_dispose_mapping:
++ irq_dispose_mapping(ndev->irq);
+ out_iounmap:
+ iounmap(db->membase);
+ out:
+@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev)
+ unregister_netdev(ndev);
+ sunxi_sram_release(&pdev->dev);
+ clk_disable_unprepare(db->clk);
++ irq_dispose_mapping(ndev->irq);
+ iounmap(db->membase);
+ free_netdev(ndev);
+
+--
+2.27.0
+
--- /dev/null
+From e66f339042e2e02ed6d829708ac62885976f4d5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 12 Dec 2020 19:20:05 +0100
+Subject: net: bcmgenet: Fix a resource leak in an error handling path in the
+ probe functin
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ]
+
+If the 'register_netdev()' call fails, we must undo a previous
+'bcmgenet_mii_init()' call.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index c7667017c1a3f..c3e824f5e50e8 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -3593,8 +3593,10 @@ static int bcmgenet_probe(struct platform_device *pdev)
+ clk_disable_unprepare(priv->clk);
+
+ err = register_netdev(dev);
+- if (err)
++ if (err) {
++ bcmgenet_mii_exit(dev);
+ goto err;
++ }
+
+ return err;
+
+--
+2.27.0
+
--- /dev/null
+From e1f6b1e1ec895e9de15cb3891d5a804b41ed1974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 20:35:14 +0100
+Subject: net: evaluate net.ipv4.conf.all.proxy_arp_pvlan
+
+From: Vincent Bernat <vincent@bernat.ch>
+
+[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ]
+
+Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a
+per-interface sysctl to tune proxy ARP support for private VLANs.
+While the "all" variant is exposed, it was a noop and never evaluated.
+We use the usual "or" logic for this kind of sysctls.
+
+Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support")
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/inetdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index 11adf828edf58..141abec5cf957 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
+
+ #define IN_DEV_LOG_MARTIANS(in_dev) IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
+ #define IN_DEV_PROXY_ARP(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP)
+-#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN)
++#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN)
+ #define IN_DEV_SHARED_MEDIA(in_dev) IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
+ #define IN_DEV_TX_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
+ #define IN_DEV_SEC_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), \
+--
+2.27.0
+
--- /dev/null
+From 55ac848bc1229c37dfcc45115e2bd14b51a510ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Nov 2020 20:35:13 +0100
+Subject: net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown
+
+From: Vincent Bernat <vincent@bernat.ch>
+
+[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ]
+
+Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl
+ignores a route whose interface is down. It is provided as a
+per-interface sysctl. However, while a "all" variant is exposed, it
+was a noop since it was never evaluated. We use the usual "or" logic
+for this kind of sysctls.
+
+Tested with:
+
+ ip link add type veth # veth0 + veth1
+ ip link add type veth # veth1 + veth2
+ ip link set up dev veth0
+ ip link set up dev veth1 # link-status paired with veth0
+ ip link set up dev veth2
+ ip link set up dev veth3 # link-status paired with veth2
+
+ # First available path
+ ip -4 addr add 203.0.113.${uts#H}/24 dev veth0
+ ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0
+
+ # Second available path
+ ip -4 addr add 192.0.2.${uts#H}/24 dev veth2
+ ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2
+
+ # More specific route through first path
+ ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0
+ ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0
+
+ # Less specific route through second path
+ ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2
+ ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2
+
+ # H1: enable on "all"
+ # H2: enable on "veth0"
+ for v in ipv4 ipv6; do
+ case $uts in
+ H1)
+ sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1
+ ;;
+ H2)
+ sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1
+ ;;
+ esac
+ done
+
+ set -xe
+ # When veth0 is up, best route is through veth0
+ ip -o route get 198.51.100.1 | grep -Fw veth0
+ ip -o route get 2001:db8:3::1 | grep -Fw veth0
+
+ # When veth0 is down, best route should be through veth2 on H1/H2,
+ # but on veth0 on H2
+ ip link set down dev veth1 # down veth0
+ ip route show
+ [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0
+ [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0
+ [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2
+ [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2
+
+Without this patch, the two last lines would fail on H1 (the one using
+the "all" sysctl). With the patch, everything succeeds as expected.
+
+Also document the sysctl in `ip-sysctl.rst`.
+
+Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down")
+Signed-off-by: Vincent Bernat <vincent@bernat.ch>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/networking/ip-sysctl.txt | 3 +++
+ include/linux/inetdevice.h | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 3c617d620b6f8..94d42eb83588b 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -1300,6 +1300,9 @@ igmpv3_unsolicited_report_interval - INTEGER
+ IGMPv3 report retransmit will take place.
+ Default: 1000 (1 seconds)
+
++ignore_routes_with_linkdown - BOOLEAN
++ Ignore routes whose link is down when performing a FIB lookup.
++
+ promote_secondaries - BOOLEAN
+ When a primary IP address is removed from this interface
+ promote a corresponding secondary IP address instead of
+diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
+index a64f21a97369a..11adf828edf58 100644
+--- a/include/linux/inetdevice.h
++++ b/include/linux/inetdevice.h
+@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
+ IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
+
+ #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \
+- IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
++ IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN)
+
+ #define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER)
+ #define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT)
+--
+2.27.0
+
--- /dev/null
+From 53fe35d3b2447320a58cc824feb9b8063f9de2ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Dec 2020 23:09:52 +0100
+Subject: net: korina: fix return value
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ]
+
+The ndo_start_xmit() method must not attempt to free the skb to transmit
+when returning NETDEV_TX_BUSY. Therefore, make sure the
+korina_send_packet() function returns NETDEV_TX_OK when it frees a packet.
+
+Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC")
+Suggested-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/korina.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
+index 993f495e2bf7b..9f804e2aba359 100644
+--- a/drivers/net/ethernet/korina.c
++++ b/drivers/net/ethernet/korina.c
+@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev)
+ dev_kfree_skb_any(skb);
+ spin_unlock_irqrestore(&lp->lock, flags);
+
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 06a8d7e443a0e5eb1e733bf5e5d7d57a4775af7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Oct 2020 14:52:00 +0300
+Subject: net/mlx5: Properly convey driver version to firmware
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ]
+
+mlx5 firmware expects driver version in specific format X.X.X, so
+make it always correct and based on real kernel version aligned with
+the driver.
+
+Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware")
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 5fac00ea62457..a2b25afa24722 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -51,6 +51,7 @@
+ #ifdef CONFIG_RFS_ACCEL
+ #include <linux/cpu_rmap.h>
+ #endif
++#include <linux/version.h>
+ #include <net/devlink.h>
+ #include "mlx5_core.h"
+ #include "fs_core.h"
+@@ -211,7 +212,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev)
+ strncat(string, ",", remaining_size);
+
+ remaining_size = max_t(int, 0, driver_ver_sz - strlen(string));
+- strncat(string, DRIVER_VERSION, remaining_size);
++
++ snprintf(string + strlen(string), remaining_size, "%u.%u.%u",
++ (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff),
++ (u16)(LINUX_VERSION_CODE & 0xffff));
+
+ /*Send the command*/
+ MLX5_SET(set_driver_version_in, in, opcode,
+--
+2.27.0
+
--- /dev/null
+From 96e016d269b9b2a2cdda6e75ee641f1564c70bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 18:58:50 +0900
+Subject: nfc: s3fwrn5: Release the nfc firmware
+
+From: Bongsu Jeon <bongsu.jeon@samsung.com>
+
+[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ]
+
+add the code to release the nfc firmware when the firmware image size is
+wrong.
+
+Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip")
+Signed-off-by: Bongsu Jeon <bongsu.jeon@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/s3fwrn5/firmware.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c
+index b7828fb252f27..b7d5b12035c1a 100644
+--- a/drivers/nfc/s3fwrn5/firmware.c
++++ b/drivers/nfc/s3fwrn5/firmware.c
+@@ -304,8 +304,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info)
+ if (ret < 0)
+ return ret;
+
+- if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE)
++ if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) {
++ release_firmware(fw->fw);
+ return -EINVAL;
++ }
+
+ memcpy(fw->date, fw->fw->data + 0x00, 12);
+ fw->date[12] = '\0';
+--
+2.27.0
+
--- /dev/null
+From b82d99a59ca7a970d8a83c0d9401c4383da27e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 11:24:33 +1100
+Subject: NFS: switch nfsiod to be an UNBOUND workqueue.
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ]
+
+nfsiod is currently a concurrency-managed workqueue (CMWQ).
+This means that workitems scheduled to nfsiod on a given CPU are queued
+behind all other work items queued on any CMWQ on the same CPU. This
+can introduce unexpected latency.
+
+Occaionally nfsiod can even cause excessive latency. If the work item
+to complete a CLOSE request calls the final iput() on an inode, the
+address_space of that inode will be dismantled. This takes time
+proportional to the number of in-memory pages, which on a large host
+working on large files (e.g.. 5TB), can be a large number of pages
+resulting in a noticable number of seconds.
+
+We can avoid these latency problems by switching nfsiod to WQ_UNBOUND.
+This causes each concurrent work item to gets a dedicated thread which
+can be scheduled to an idle CPU.
+
+There is precedent for this as several other filesystems use WQ_UNBOUND
+workqueue for handling various async events.
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index e4cd3a2fe6989..aee66d8f13305 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -2142,7 +2142,7 @@ static int nfsiod_start(void)
+ {
+ struct workqueue_struct *wq;
+ dprintk("RPC: creating workqueue nfsiod\n");
+- wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0);
++ wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0);
+ if (wq == NULL)
+ return -ENOMEM;
+ nfsiod_workqueue = wq;
+--
+2.27.0
+
--- /dev/null
+From 7062fec08cb0a83c42d6400fdf69395452173e8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Dec 2020 07:06:35 -0500
+Subject: nfs_common: need lock during iterate through the list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cheng Lin <cheng.lin130@zte.com.cn>
+
+[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ]
+
+If the elem is deleted during be iterated on it, the iteration
+process will fall into an endless loop.
+
+kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137]
+
+PID: 17137 TASK: ffff8818d93c0000 CPU: 4 COMMAND: "nfsd"
+ [exception RIP: __state_in_grace+76]
+ RIP: ffffffffc00e817c RSP: ffff8818d3aefc98 RFLAGS: 00000246
+ RAX: ffff881dc0c38298 RBX: ffffffff81b03580 RCX: ffff881dc02c9f50
+ RDX: ffff881e3fce8500 RSI: 0000000000000001 RDI: ffffffff81b03580
+ RBP: ffff8818d3aefca0 R8: 0000000000000020 R9: ffff8818d3aefd40
+ R10: ffff88017fc03800 R11: ffff8818e83933c0 R12: ffff8818d3aefd40
+ R13: 0000000000000000 R14: ffff8818e8391068 R15: ffff8818fa6e4000
+ CS: 0010 SS: 0018
+ #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace]
+ #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd]
+ #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd]
+ #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd]
+ #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd]
+ #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc]
+ #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc]
+ #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd]
+ #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1
+ #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607
+
+The troublemake elem:
+crash> lock_manager ffff881dc0c38298
+struct lock_manager {
+ list = {
+ next = 0xffff881dc0c38298,
+ prev = 0xffff881dc0c38298
+ },
+ block_opens = false
+}
+
+Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens")
+Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs_common/grace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c
+index 5be08f02a76bc..4f90c444907f5 100644
+--- a/fs/nfs_common/grace.c
++++ b/fs/nfs_common/grace.c
+@@ -68,10 +68,14 @@ __state_in_grace(struct net *net, bool open)
+ if (!open)
+ return !list_empty(grace_list);
+
++ spin_lock(&grace_lock);
+ list_for_each_entry(lm, grace_list, list) {
+- if (lm->block_opens)
++ if (lm->block_opens) {
++ spin_unlock(&grace_lock);
+ return true;
++ }
+ }
++ spin_unlock(&grace_lock);
+ return false;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 736136a7c5e5d84175d4b030c3411ae19448a7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 15:26:59 +0900
+Subject: nfsd: Fix message level for normal termination
+
+From: kazuo ito <kzpn200@gmail.com>
+
+[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ]
+
+The warning message from nfsd terminating normally
+can confuse system adminstrators or monitoring software.
+
+Though it's not exactly fair to pin-point a commit where it
+originated, the current form in the current place started
+to appear in:
+
+Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP")
+Signed-off-by: kazuo ito <kzpn200@gmail.com>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfssvc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
+index 89cb484f1cfbe..ad38633392a0d 100644
+--- a/fs/nfsd/nfssvc.c
++++ b/fs/nfsd/nfssvc.c
+@@ -417,8 +417,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net)
+ return;
+
+ nfsd_shutdown_net(net);
+- printk(KERN_WARNING "nfsd: last server has exited, flushing export "
+- "cache\n");
++ pr_info("nfsd: last server has exited, flushing export cache\n");
+ nfsd_export_flush(net);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 7af61db24f1871bc99c675414dc3b74cddc8c341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:03:38 -0500
+Subject: NFSv4.2: condition READDIR's mask for security label based on LSM
+ state
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ]
+
+Currently, the client will always ask for security_labels if the server
+returns that it supports that feature regardless of any LSM modules
+(such as Selinux) enforcing security policy. This adds performance
+penalty to the READDIR operation.
+
+Client adjusts superblock's support of the security_label based on
+the server's support but also current client's configuration of the
+LSM modules. Thus, prior to using the default bitmask in READDIR,
+this patch checks the server's capabilities and then instructs
+READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask.
+
+v5: fixing silly mistakes of the rushed v4
+v4: simplifying logic
+v3: changing label's initialization per Ondrej's comment
+v2: dropping selinux hook and using the sb cap.
+
+Suggested-by: Ondrej Mosnacek <omosnace@redhat.com>
+Suggested-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index fe7b42c277ac5..1a395647ae265 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4687,12 +4687,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+ u64 cookie, struct page **pages, unsigned int count, bool plus)
+ {
+ struct inode *dir = d_inode(dentry);
++ struct nfs_server *server = NFS_SERVER(dir);
+ struct nfs4_readdir_arg args = {
+ .fh = NFS_FH(dir),
+ .pages = pages,
+ .pgbase = 0,
+ .count = count,
+- .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask,
+ .plus = plus,
+ };
+ struct nfs4_readdir_res res;
+@@ -4707,9 +4707,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
+ dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__,
+ dentry,
+ (unsigned long long)cookie);
++ if (!(server->caps & NFS_CAP_SECURITY_LABEL))
++ args.bitmask = server->attr_bitmask_nl;
++ else
++ args.bitmask = server->attr_bitmask;
++
+ nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args);
+ res.pgbase = args.pgbase;
+- status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0);
++ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args,
++ &res.seq_res, 0);
+ if (status >= 0) {
+ memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE);
+ status += args.pgbase;
+--
+2.27.0
+
--- /dev/null
+From 7a36ea4d92d2578d8c18b3c720d88873a7b3d41d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Nov 2020 22:22:43 +0100
+Subject: orinoco: Move context allocation after processing the skb
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ]
+
+ezusb_xmit() allocates a context which is leaked if
+orinoco_process_xmit_skb() returns an error.
+
+Move ezusb_alloc_ctx() after the invocation of
+orinoco_process_xmit_skb() because the context is not needed so early.
+ezusb_access_ltv() will cleanup the context in case of an error.
+
+Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index b704e4bce171d..a04d598430228 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1237,13 +1237,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (skb->len < ETH_HLEN)
+ goto drop;
+
+- ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+- if (!ctx)
+- goto busy;
+-
+- memset(ctx->buf, 0, BULK_BUF_SIZE);
+- buf = ctx->buf->data;
+-
+ tx_control = 0;
+
+ err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control,
+@@ -1251,6 +1244,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+ if (err)
+ goto drop;
+
++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
++ if (!ctx)
++ goto drop;
++
++ memset(ctx->buf, 0, BULK_BUF_SIZE);
++ buf = ctx->buf->data;
++
+ {
+ __le16 *tx_cntl = (__le16 *)buf;
+ *tx_cntl = cpu_to_le16(tx_control);
+--
+2.27.0
+
--- /dev/null
+From b5d53fd48a86e80cf6a636ed2be4010dda530a4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 14:51:36 -0600
+Subject: PCI: Bounds-check command-line resource alignment requests
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ]
+
+32-bit BARs are limited to 2GB size (2^31). By extension, I assume 64-bit
+BARs are limited to 2^63 bytes. Limit the alignment requested by the
+"pci=resource_alignment=" command-line parameter to 2^63.
+
+Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 57a87a001b4f4..5103d4b140ee3 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5840,19 +5840,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
+ while (*p) {
+ count = 0;
+ if (sscanf(p, "%d%n", &align_order, &count) == 1 &&
+- p[count] == '@') {
++ p[count] == '@') {
+ p += count + 1;
++ if (align_order > 63) {
++ pr_err("PCI: Invalid requested alignment (order %d)\n",
++ align_order);
++ align_order = PAGE_SHIFT;
++ }
+ } else {
+- align_order = -1;
++ align_order = PAGE_SHIFT;
+ }
+
+ ret = pci_dev_str_match(dev, p, &p);
+ if (ret == 1) {
+ *resize = true;
+- if (align_order == -1)
+- align = PAGE_SIZE;
+- else
+- align = 1 << align_order;
++ align = 1 << align_order;
+ break;
+ } else if (ret < 0) {
+ pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
+--
+2.27.0
+
--- /dev/null
+From 8b4bb18f676a2656e88db670d393cdb2b729079c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Nov 2020 15:48:04 -0600
+Subject: PCI: Fix overflow in command-line resource alignment requests
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ]
+
+The shift of 1 by align_order is evaluated using 32 bit arithmetic and the
+result is assigned to a resource_size_t type variable that is a 64 bit
+unsigned integer on 64 bit platforms. Fix an overflow before widening issue
+by making the 1 a ULL.
+
+Addresses-Coverity: ("Unintentional integer overflow")
+Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 5103d4b140ee3..cd628dd73719b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5854,7 +5854,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev,
+ ret = pci_dev_str_match(dev, p, &p);
+ if (ret == 1) {
+ *resize = true;
+- align = 1 << align_order;
++ align = 1ULL << align_order;
+ break;
+ } else if (ret < 0) {
+ pr_err("PCI: Can't parse resource_alignment parameter: %s\n",
+--
+2.27.0
+
--- /dev/null
+From 9e085bb0b7cc15e3431876c540b8ff150d07e2ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Oct 2020 11:30:52 +0530
+Subject: PCI: iproc: Fix out-of-bound array accesses
+
+From: Bharat Gooty <bharat.gooty@broadcom.com>
+
+[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ]
+
+Declare the full size array for all revisions of PAX register sets
+to avoid potentially out of bound access of the register array
+when they are being initialized in iproc_pcie_rev_init().
+
+Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com
+Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population")
+Signed-off-by: Bharat Gooty <bharat.gooty@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index ec86414216f97..f2d79e0235bc1 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -300,7 +300,7 @@ enum iproc_pcie_reg {
+ };
+
+ /* iProc PCIe PAXB BCMA registers */
+-static const u16 iproc_pcie_reg_paxb_bcma[] = {
++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -311,7 +311,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = {
+ };
+
+ /* iProc PCIe PAXB registers */
+-static const u16 iproc_pcie_reg_paxb[] = {
++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -327,7 +327,7 @@ static const u16 iproc_pcie_reg_paxb[] = {
+ };
+
+ /* iProc PCIe PAXB v2 registers */
+-static const u16 iproc_pcie_reg_paxb_v2[] = {
++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x120,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x124,
+@@ -355,7 +355,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = {
+ };
+
+ /* iProc PCIe PAXC v1 registers */
+-static const u16 iproc_pcie_reg_paxc[] = {
++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_CLK_CTRL] = 0x000,
+ [IPROC_PCIE_CFG_IND_ADDR] = 0x1f0,
+ [IPROC_PCIE_CFG_IND_DATA] = 0x1f4,
+@@ -364,7 +364,7 @@ static const u16 iproc_pcie_reg_paxc[] = {
+ };
+
+ /* iProc PCIe PAXC v2 registers */
+-static const u16 iproc_pcie_reg_paxc_v2[] = {
++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = {
+ [IPROC_PCIE_MSI_GIC_MODE] = 0x050,
+ [IPROC_PCIE_MSI_BASE_ADDR] = 0x074,
+ [IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078,
+--
+2.27.0
+
--- /dev/null
+From 7040ec971fb66ead63828a8f938b8d56e522d647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 17:33:44 +0800
+Subject: =?UTF-8?q?perf=20record:=20Fix=20memory=20leak=20when=20using=20'?=
+ =?UTF-8?q?--user-regs=3D=3F'=20to=20list=20registers?=
+
+From: Zheng Zengkai <zhengzengkai@huawei.com>
+
+[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ]
+
+When using 'perf record's option '-I' or '--user-regs=' along with
+argument '?' to list available register names, memory of variable 'os'
+allocated by strdup() needs to be released before __parse_regs()
+returns, otherwise memory leak will occur.
+
+Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record")
+Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
+Acked-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Li Bin <huawei.libin@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/parse-regs-options.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c
+index e6599e290f467..e5ad120e7f69a 100644
+--- a/tools/perf/util/parse-regs-options.c
++++ b/tools/perf/util/parse-regs-options.c
+@@ -41,7 +41,7 @@ parse_regs(const struct option *opt, const char *str, int unset)
+ }
+ fputc('\n', stderr);
+ /* just printing available regs */
+- return -1;
++ goto error;
+ }
+ for (r = sample_reg_masks; r->name; r++) {
+ if (!strcasecmp(s, r->name))
+--
+2.27.0
+
--- /dev/null
+From 093c9618403a8617ac2ed96cb7f30e11dc9932f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 09:12:19 +0800
+Subject: pinctrl: falcon: add missing put_device() call in
+ pinctrl_falcon_probe()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ]
+
+if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have
+a corresponding put_device(). Thus add put_device() to fix the exception
+handling for this function implementation.
+
+Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c
+index fb73dcbb5ef37..68dcf53aaac34 100644
+--- a/drivers/pinctrl/pinctrl-falcon.c
++++ b/drivers/pinctrl/pinctrl-falcon.c
+@@ -438,24 +438,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev)
+
+ /* load and remap the pad resources of the different banks */
+ for_each_compatible_node(np, NULL, "lantiq,pad-falcon") {
+- struct platform_device *ppdev = of_find_device_by_node(np);
+ const __be32 *bank = of_get_property(np, "lantiq,bank", NULL);
+ struct resource res;
++ struct platform_device *ppdev;
+ u32 avail;
+ int pins;
+
+ if (!of_device_is_available(np))
+ continue;
+
+- if (!ppdev) {
+- dev_err(&pdev->dev, "failed to find pad pdev\n");
+- continue;
+- }
+ if (!bank || *bank >= PORTS)
+ continue;
+ if (of_address_to_resource(np, 0, &res))
+ continue;
++
++ ppdev = of_find_device_by_node(np);
++ if (!ppdev) {
++ dev_err(&pdev->dev, "failed to find pad pdev\n");
++ continue;
++ }
++
+ falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL);
++ put_device(&ppdev->dev);
+ if (IS_ERR(falcon_info.clk[*bank])) {
+ dev_err(&ppdev->dev, "failed to get clock\n");
+ return PTR_ERR(falcon_info.clk[*bank]);
+--
+2.27.0
+
--- /dev/null
+From 13d433100d83c7851eda622dde1221093338ce3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 14:50:32 +0800
+Subject: platform/x86: dell-smbios-base: Fix error return code in
+ dell_smbios_init
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ]
+
+Fix to return the error code -ENODEV when fails to init wmi and
+smm.
+
+Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/dell-smbios-base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c
+index 0537d44d45a6e..9e9fc51557892 100644
+--- a/drivers/platform/x86/dell-smbios-base.c
++++ b/drivers/platform/x86/dell-smbios-base.c
+@@ -597,6 +597,7 @@ static int __init dell_smbios_init(void)
+ if (wmi && smm) {
+ pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n",
+ wmi, smm);
++ ret = -ENODEV;
+ goto fail_create_group;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 39dc1b9932aa8a4913a9058f11041a7bdb19e846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 19:47:44 +0200
+Subject: platform/x86: mlx-platform: Fix item counter assignment for MSN2700,
+ MSN24xx systems
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ]
+
+Fix array names to match assignments for data items and data items
+counter in 'mlxplat_mlxcpld_default_items' structure for:
+ .data = mlxplat_mlxcpld_default_pwr_items_data,
+ .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
+and
+ .data = mlxplat_mlxcpld_default_fan_items_data,
+ .count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
+
+Replace:
+- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for
+ ARRAY_SIZE() calculation.
+- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data'
+ for ARRAY_SIZE() calculation.
+
+Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201207174745.22889-2-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 850c719de68d4..39f2c0428a046 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -333,7 +333,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ .aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF,
+ .reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET,
+ .mask = MLXPLAT_CPLD_PWR_MASK,
+- .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr),
++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data),
+ .inversed = 0,
+ .health = false,
+ },
+@@ -342,7 +342,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = {
+ .aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF,
+ .reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET,
+ .mask = MLXPLAT_CPLD_FAN_MASK,
+- .count = ARRAY_SIZE(mlxplat_mlxcpld_fan),
++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data),
+ .inversed = 1,
+ .health = false,
+ },
+--
+2.27.0
+
--- /dev/null
+From aa746327e15c8f75cc861e9aec124cf8f8f7ef67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 12:10:55 +0200
+Subject: platform/x86: mlx-platform: Remove PSU EEPROM from default platform
+ configuration
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ]
+
+Remove PSU EEPROM configuration for systems class equipped with
+Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100.
+Till now all the systems from this class used few types of power units,
+all equipped with EEPROM device with address space two bytes. Thus, all
+these devices have been handled by EEPROM driver "24c02".
+
+There is a new requirement is to support power unit replacement by "off
+the shelf" device, matching electrical required parameters. Such device
+can be equipped with different EEPROM type, which could be one byte
+address space addressing or even could be not equipped with EEPROM.
+In such case "24c02" will not work.
+
+Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface")
+Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 0c72de95b5ccd..62c749180bb78 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -251,15 +251,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = {
+ .label = "psu1",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(0),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ {
+ .label = "psu2",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(1),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ };
+
+--
+2.27.0
+
--- /dev/null
+From 8cc8af2b363c3b9fbd4ba158291cffdbc87a7a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Nov 2020 12:10:56 +0200
+Subject: platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform
+ configuration
+
+From: Vadim Pasternak <vadimp@nvidia.com>
+
+[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ]
+
+Remove PSU EEPROM configuration for systems class equipped with
+Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now
+all the systems from this class used few types of power units, all
+equipped with EEPROM device with address space two bytes. Thus, all
+these devices have been handled by EEPROM driver "24c02".
+
+There is a new requirement is to support power unit replacement by "off
+the shelf" device, matching electrical required parameters. Such device
+can be equipped with different EEPROM type, which could be one byte
+address space addressing or even could be not equipped with EEPROM.
+In such case "24c02" will not work.
+
+Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type")
+Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
+Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index 62c749180bb78..850c719de68d4 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -420,15 +420,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = {
+ .label = "psu1",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(0),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ {
+ .label = "psu2",
+ .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET,
+ .mask = BIT(1),
+- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1],
+- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR,
++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE,
+ },
+ };
+
+--
+2.27.0
+
--- /dev/null
+From e9667838bdbd314ce3dd0f3603690e6d488f7cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Nov 2020 13:13:12 +0100
+Subject: power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ]
+
+Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling
+for HP Pavilion x2 10") added special handling for HP Pavilion x2 10
+models which use the weird combination of a Type-C connector and the
+non Type-C aware AXP288 PMIC.
+
+This special handling was activated by a DMI match a the product-name
+of "HP Pavilion x2 Detachable". Recently I've learned that there are
+also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC +
+a micro-usb connector where we should not activate the special handling
+for the Type-C connectors.
+
+Extend the matching to also match on the DMI board-name and match on the
+2 boards (one Bay Trail based one Cherry Trail based) of which we are
+certain that they use the AXP288 + Type-C connector combination.
+
+Note the DSDT code from these older (AXP288 + micro-USB) models contains
+some AML code (which never runs under Linux) which reads the micro-USB
+connector id-pin and if it is pulled to ground, which would normally mean
+the port is in host mode!, then it sets the input-current-limit to 3A,
+it seems HP is using the micro-USB port as a charging only connector
+and identifies their own 3A capable charger though this hack which is a
+major violation of the USB specs. Note HP also hardcodes a 2A limit
+when the id-pin is not pulled to ground, which is also in violation
+of the specs.
+
+I've no intention to add support for HP's hack to support 3A charging
+on these older models. By making the DMI matches for the Type-C equipped
+models workaround more tighter, these older models will be treated just
+like any other AXP288 + micro-USB equipped device and the input-current
+limit will follow the BC 1.2 spec (using the defacto standard values
+there where the BC 1.2 spec defines a range).
+
+Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10")
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c
+index 46eb7716c35c8..84106a9836c8f 100644
+--- a/drivers/power/supply/axp288_charger.c
++++ b/drivers/power/supply/axp288_charger.c
+@@ -555,14 +555,15 @@ out:
+
+ /*
+ * The HP Pavilion x2 10 series comes in a number of variants:
+- * Bay Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "815D"
+- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E"
+- * Cherry Trail SoC + TI PMIC, DMI_BOARD_NAME: "827C" or "82F4"
++ * Bay Trail SoC + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021"
++ * Bay Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "815D"
++ * Cherry Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "813E"
++ * Cherry Trail SoC + TI PMIC, Type-C, DMI_BOARD_NAME: "827C" or "82F4"
+ *
+- * The variants with the AXP288 PMIC are all kinds of special:
++ * The variants with the AXP288 + Type-C connector are all kinds of special:
+ *
+- * 1. All variants use a Type-C connector which the AXP288 does not support, so
+- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices,
++ * 1. They use a Type-C connector which the AXP288 does not support, so when
++ * using a Type-C charger it is not recognized. Unlike most AXP288 devices,
+ * this model actually has mostly working ACPI AC / Battery code, the ACPI code
+ * "solves" this by simply setting the input_current_limit to 3A.
+ * There are still some issues with the ACPI code, so we use this native driver,
+@@ -585,12 +586,17 @@ out:
+ */
+ static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = {
+ {
+- /*
+- * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry
+- * Trail model has "HP", so we only match on product_name.
+- */
+ .matches = {
+- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"),
++ },
++ },
++ {
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"),
+ },
+ },
+ {} /* Terminating entry */
+--
+2.27.0
+
--- /dev/null
+From 214c056c2f386f565b7b6282e60ff976a5d2bb0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:33:21 +0800
+Subject: power: supply: bq24190_charger: fix reference leak
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to call pm_runtime_put_noidle will result
+in reference leak in callers(bq24190_sysfs_show,
+bq24190_charger_get_property, bq24190_charger_set_property,
+bq24190_battery_get_property, bq24190_battery_set_property),
+so we should fix it.
+
+Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c
+index b58df04d03b33..863208928cf0b 100644
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -446,8 +446,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev,
+ return -EINVAL;
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v);
+ if (ret)
+@@ -1092,8 +1094,10 @@ static int bq24190_charger_get_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_CHARGE_TYPE:
+@@ -1164,8 +1168,10 @@ static int bq24190_charger_set_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
+@@ -1425,8 +1431,10 @@ static int bq24190_battery_get_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_STATUS:
+@@ -1471,8 +1479,10 @@ static int bq24190_battery_set_property(struct power_supply *psy,
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+ ret = pm_runtime_get_sync(bdi->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(bdi->dev);
+ return ret;
++ }
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
+--
+2.27.0
+
--- /dev/null
+From de66a3e1e95e6f9f8419ea8fa67d096b92d77c95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Oct 2020 18:28:36 +1100
+Subject: powerpc/64: Set up a kernel stack for secondaries before
+ cpu_restore()
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ]
+
+Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore()
+is called before a stack has been set up in r1. This was previously fine
+as the cpu_restore() functions were implemented in assembly and did not
+use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new
+device tree binding for discovering CPU features") used
+__restore_cpu_cpufeatures() as the cpu_restore() function for a
+device-tree features based cputable entry. This is a C function and
+hence uses a stack in r1.
+
+generic_secondary_smp_init() is entered on the secondary cpus via the
+primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware
+thread has its own stack. The OPAL call is ran in the primary's hardware
+thread. During the call, a job is scheduled on a secondary cpu that will
+start executing at the address of generic_secondary_smp_init(). Hence
+the value that will be left in r1 when the secondary cpu enters the
+kernel is part of that secondary cpu's individual OPAL stack. This means
+that __restore_cpu_cpufeatures() will write to that OPAL stack. This is
+not horribly bad as each hardware thread has its own stack and the call
+that enters the kernel from OPAL never returns, but it is still wrong
+and should be corrected.
+
+Create the temp kernel stack before calling cpu_restore().
+
+As noted by mpe, for a kexec boot, the secondary CPUs are released from
+the spin loop at address 0x60 by smp_release_cpus() and then jump to
+generic_secondary_smp_init(). The call to smp_release_cpus() is in
+setup_arch(), and it comes before the call to emergency_stack_init().
+emergency_stack_init() allocates an emergency stack in the PACA for each
+CPU. This address in the PACA is what is used to set up the temp kernel
+stack in generic_secondary_smp_init(). Move releasing the secondary CPUs
+to after the PACAs have been allocated an emergency stack, otherwise the
+PACA stack pointer will contain garbage and hence the temp kernel stack
+created from it will be broken.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_64.S | 8 ++++----
+ arch/powerpc/kernel/setup-common.c | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 389da790c1296..4f7b225d78cff 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -423,6 +423,10 @@ generic_secondary_common_init:
+ /* From now on, r24 is expected to be logical cpuid */
+ mr r24,r5
+
++ /* Create a temp kernel stack for use before relocation is on. */
++ ld r1,PACAEMERGSP(r13)
++ subi r1,r1,STACK_FRAME_OVERHEAD
++
+ /* See if we need to call a cpu state restore handler */
+ LOAD_REG_ADDR(r23, cur_cpu_spec)
+ ld r23,0(r23)
+@@ -451,10 +455,6 @@ generic_secondary_common_init:
+ sync /* order paca.run and cur_cpu_spec */
+ isync /* In case code patching happened */
+
+- /* Create a temp kernel stack for use before relocation is on. */
+- ld r1,PACAEMERGSP(r13)
+- subi r1,r1,STACK_FRAME_OVERHEAD
+-
+ b __secondary_start
+ #endif /* SMP */
+
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 508244bcf19c2..7787a26d47777 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -929,8 +929,6 @@ void __init setup_arch(char **cmdline_p)
+
+ /* On BookE, setup per-core TLB data structures. */
+ setup_tlb_core_data();
+-
+- smp_release_cpus();
+ #endif
+
+ /* Print various info about the machine that has been gathered so far. */
+@@ -964,6 +962,8 @@ void __init setup_arch(char **cmdline_p)
+ exc_lvl_early_init();
+ emergency_stack_init();
+
++ smp_release_cpus();
++
+ initmem_init();
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+--
+2.27.0
+
--- /dev/null
+From 044985dde275ed72c10ae7ad11195daf10759e05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 18:07:12 +0000
+Subject: powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ]
+
+On 8xx, we get the following features:
+
+[ 0.000000] cpu_features = 0x0000000000000100
+[ 0.000000] possible = 0x0000000000000120
+[ 0.000000] always = 0x0000000000000000
+
+This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all
+other configurations, the three lines should be equal.
+
+The problem is due to CPU_FTRS_GENERIC_32 which is taken when
+CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is
+pointless because there is no generic configuration supporting
+all 32 bits but book3s/32.
+
+Remove this pointless generic features definition to unbreak the
+calculation of 'possible' features and 'always' features.
+
+Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 59b35b93eadec..d90093a88e096 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -411,7 +411,6 @@ static inline void cpu_feature_keys_init(void) { }
+ CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \
+ CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \
+ CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT)
+-#define CPU_FTRS_GENERIC_32 (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN)
+
+ /* 64-bit CPUs */
+ #define CPU_FTRS_PPC970 (CPU_FTR_LWSYNC | \
+@@ -509,8 +508,6 @@ enum {
+ CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX |
+ CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 |
+ CPU_FTRS_CLASSIC32 |
+-#else
+- CPU_FTRS_GENERIC_32 |
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ CPU_FTRS_8XX |
+@@ -585,8 +582,6 @@ enum {
+ CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX &
+ CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 &
+ CPU_FTRS_CLASSIC32 &
+-#else
+- CPU_FTRS_GENERIC_32 &
+ #endif
+ #ifdef CONFIG_PPC_8xx
+ CPU_FTRS_8XX &
+--
+2.27.0
+
--- /dev/null
+From de75280c4a9f3e8867a2cc69e1af4d14f3a048da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Dec 2020 19:26:22 +0100
+Subject: powerpc/ps3: use dma_mapping_error()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ]
+
+The DMA address returned by dma_map_single() should be checked with
+dma_mapping_error(). Fix the ps3stor_setup() function accordingly.
+
+Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ps3/ps3stor_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c
+index 8c3f5adf1bc65..2d76183756626 100644
+--- a/drivers/ps3/ps3stor_lib.c
++++ b/drivers/ps3/ps3stor_lib.c
+@@ -201,7 +201,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler)
+ dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf));
+ dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf,
+ dev->bounce_size, DMA_BIDIRECTIONAL);
+- if (!dev->bounce_dma) {
++ if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) {
+ dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n",
+ __func__, __LINE__);
+ error = -ENODEV;
+--
+2.27.0
+
--- /dev/null
+From 242473eaa4b806a8f6541b78e65ddf1cd65e817a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:51:49 -0600
+Subject: powerpc/pseries/hibernation: drop pseries_suspend_begin() from
+ suspend ops
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ]
+
+There are three ways pseries_suspend_begin() can be reached:
+
+1. When "mem" is written to /sys/power/state:
+
+kobj_attr_store()
+-> state_store()
+ -> pm_suspend()
+ -> suspend_devices_and_enter()
+ -> pseries_suspend_begin()
+
+This never works because there is no way to supply a valid stream id
+using this interface, and H_VASI_STATE is called with a stream id of
+zero. So this call path is useless at best.
+
+2. When a stream id is written to /sys/devices/system/power/hibernate.
+pseries_suspend_begin() is polled directly from store_hibernate()
+until the stream is in the "Suspending" state (i.e. the platform is
+ready for the OS to suspend execution):
+
+dev_attr_store()
+-> store_hibernate()
+ -> pseries_suspend_begin()
+
+3. When a stream id is written to /sys/devices/system/power/hibernate
+(continued). After #2, pseries_suspend_begin() is called once again
+from the pm core:
+
+dev_attr_store()
+-> store_hibernate()
+ -> pm_suspend()
+ -> suspend_devices_and_enter()
+ -> pseries_suspend_begin()
+
+This is redundant because the VASI suspend state is already known to
+be Suspending.
+
+The begin() callback of platform_suspend_ops is optional, so we can
+simply remove that assignment with no loss of function.
+
+Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/suspend.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 52a021e1f86bf..fd2c090681aa6 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -223,7 +223,6 @@ static struct bus_type suspend_subsys = {
+
+ static const struct platform_suspend_ops pseries_suspend_ops = {
+ .valid = suspend_valid_only_mem,
+- .begin = pseries_suspend_begin,
+ .prepare_late = pseries_prepare_late,
+ .enter = pseries_suspend_enter,
+ };
+--
+2.27.0
+
--- /dev/null
+From 218bcffab55d58d7c107f656118c24920ce81150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 15:51:56 -0600
+Subject: powerpc/pseries/hibernation: remove redundant cacheinfo update
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ]
+
+Partitions with cache nodes in the device tree can encounter the
+following warning on resume:
+
+CPU 0 already accounted in PowerPC,POWER9@0(Data)
+WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820
+
+These calls to cacheinfo_cpu_offline/online have been redundant since
+commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo
+hierarchy post-migration").
+
+Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/suspend.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index fd2c090681aa6..5414d3295e0a1 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -26,7 +26,6 @@
+ #include <asm/mmu.h>
+ #include <asm/rtas.h>
+ #include <asm/topology.h>
+-#include "../../kernel/cacheinfo.h"
+
+ static u64 stream_id;
+ static struct device suspend_dev;
+@@ -91,9 +90,7 @@ static void pseries_suspend_enable_irqs(void)
+ * Update configuration which can be modified based on device tree
+ * changes during resume.
+ */
+- cacheinfo_cpu_offline(smp_processor_id());
+ post_mobility_fixup();
+- cacheinfo_cpu_online(smp_processor_id());
+ }
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From 9e8ea9d17dd247f48d928f150f8ae2d66071b5b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 19:11:35 +0530
+Subject: pwm: lp3943: Dynamically allocate PWM chip base
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit 1f0f1e80fdd3aa9631f6c22cda4f8550cfcfcc3e ]
+
+When there are other PWM controllers enabled along with pwm-lp3943,
+pwm-lp3942 is failing to probe with -EEXIST error. This is because
+other PWM controllers are probed first and assigned PWM base 0 and
+pwm-lp3943 is requesting for 0 again.
+
+In order to avoid this, assign the chip base with -1, so that it is
+dynamically allocated.
+
+Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver")
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-könig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lp3943.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c
+index 15b40a8bc4fbb..5055ba2c6c940 100644
+--- a/drivers/pwm/pwm-lp3943.c
++++ b/drivers/pwm/pwm-lp3943.c
+@@ -278,6 +278,7 @@ static int lp3943_pwm_probe(struct platform_device *pdev)
+ lp3943_pwm->chip.dev = &pdev->dev;
+ lp3943_pwm->chip.ops = &lp3943_pwm_ops;
+ lp3943_pwm->chip.npwm = LP3943_NUM_PWMS;
++ lp3943_pwm->chip.base = -1;
+
+ platform_set_drvdata(pdev, lp3943_pwm);
+
+--
+2.27.0
+
--- /dev/null
+From b2a183cb5902c5b33013858deefdb9bcc0c382cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 10:13:21 +0200
+Subject: pwm: zx: Add missing cleanup in error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ]
+
+zx_pwm_probe() called clk_prepare_enable() before; this must be undone
+in the error path.
+
+Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-zx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c
+index 5d27c16edfb13..0d4112410b69d 100644
+--- a/drivers/pwm/pwm-zx.c
++++ b/drivers/pwm/pwm-zx.c
+@@ -241,6 +241,7 @@ static int zx_pwm_probe(struct platform_device *pdev)
+ ret = pwmchip_add(&zpc->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret);
++ clk_disable_unprepare(zpc->pclk);
+ return ret;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 65abffb749bb3671b05cf729d859ea07e5a0621d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Dec 2020 11:38:04 +0300
+Subject: qlcnic: Fix error code in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ]
+
+Return -EINVAL if we can't find the correct device. Currently it
+returns success.
+
+Fixes: 13159183ec7a ("qlcnic: 83xx base driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index dbd48012224f2..ed34b7d1a9e11 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -2508,6 +2508,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ qlcnic_sriov_vf_register_map(ahw);
+ break;
+ default:
++ err = -EINVAL;
+ goto err_out_free_hw_res;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 9102d0a60463d98f47a334d6baeefaa3506a6eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Oct 2020 14:49:52 +0300
+Subject: RDMA/bnxt_re: Set queue pair state when being queried
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ]
+
+The API for ib_query_qp requires the driver to set cur_qp_state on return,
+add the missing set.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+index 957da3ffe593c..f8c9caa8aad6d 100644
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1838,6 +1838,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr,
+ goto out;
+ }
+ qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state);
++ qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state);
+ qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0;
+ qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access);
+ qp_attr->pkey_index = qplib_qp->pkey_index;
+--
+2.27.0
+
--- /dev/null
+From 2d2b16364918f156bdec3bc5703489180dbfb213 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 15:20:07 +0200
+Subject: RDMA/cxgb4: Validate the number of CQEs
+
+From: Kamal Heib <kamalheib1@gmail.com>
+
+[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ]
+
+Before create CQ, make sure that the requested number of CQEs is in the
+supported range.
+
+Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
+Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com
+Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
+index 1fd8798d91a73..beba761902449 100644
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -1012,6 +1012,9 @@ struct ib_cq *c4iw_create_cq(struct ib_device *ibdev,
+
+ rhp = to_c4iw_dev(ibdev);
+
++ if (entries < 1 || entries > ibdev->attrs.max_cqe)
++ return -EINVAL;
++
+ if (vector >= rhp->rdev.lldi.nciq)
+ return ERR_PTR(-EINVAL);
+
+--
+2.27.0
+
--- /dev/null
+From f93374dc23c4d2884f81287f41129458d9f23d71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 22:12:30 +0100
+Subject: RDMa/mthca: Work around -Wenum-conversion warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ]
+
+gcc points out a suspicious mixing of enum types in a function that
+converts from MTHCA_OPCODE_* values to IB_WC_* values:
+
+drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one':
+drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum <anonymous>' to 'enum ib_wc_opcode' [-Wenum-conversion]
+ 607 | entry->opcode = MTHCA_OPCODE_INVALID;
+
+Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if
+this is meaningful, but it seems harmless as it deals with an invalid
+input.
+
+Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is
+still bogus, but at least doesn't make compiler warnings.
+
+Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions")
+Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cq.c | 2 +-
+ drivers/infiniband/hw/mthca/mthca_dev.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index a5694dec3f2ee..098653b8157ed 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -609,7 +609,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
+ entry->byte_len = MTHCA_ATOMIC_BYTE_LEN;
+ break;
+ default:
+- entry->opcode = MTHCA_OPCODE_INVALID;
++ entry->opcode = 0xFF;
+ break;
+ }
+ } else {
+diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
+index 220a3e4717a35..e23575861f287 100644
+--- a/drivers/infiniband/hw/mthca/mthca_dev.h
++++ b/drivers/infiniband/hw/mthca/mthca_dev.h
+@@ -105,7 +105,6 @@ enum {
+ MTHCA_OPCODE_ATOMIC_CS = 0x11,
+ MTHCA_OPCODE_ATOMIC_FA = 0x12,
+ MTHCA_OPCODE_BIND_MW = 0x18,
+- MTHCA_OPCODE_INVALID = 0xff
+ };
+
+ enum {
+--
+2.27.0
+
--- /dev/null
+From bce2f9d6ae84c39c7973faa9063b55fd4a99ecad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 12:07:42 -0500
+Subject: RDMA/rxe: Compute PSN windows correctly
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ]
+
+The code which limited the number of unacknowledged PSNs was incorrect.
+The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff.
+The test was computing a 32 bit value which wraps at 32 bits so that
+qp->req.psn can appear smaller than the limit when it is actually larger.
+
+Replace '>' test with psn_compare which is used for other PSN comparisons
+and correctly handles the 24 bit size.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com
+Signed-off-by: Bob Pearson <rpearson@hpe.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_req.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index 1c1eae0ef8c28..63db49144f62b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -664,7 +664,8 @@ next_wqe:
+ }
+
+ if (unlikely(qp_type(qp) == IB_QPT_RC &&
+- qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) {
++ psn_compare(qp->req.psn, (qp->comp.psn +
++ RXE_MAX_UNACKED_PSNS)) > 0)) {
+ qp->req.wait_psn = 1;
+ goto exit;
+ }
+--
+2.27.0
+
--- /dev/null
+From 79e9e7f28e847d60bf7c6f3cfa8c7204901a12fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Nov 2020 09:03:09 +0000
+Subject: samples: bpf: Fix lwt_len_hist reusing previous BPF map
+
+From: Daniel T. Lee <danieltimlee@gmail.com>
+
+[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ]
+
+Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the
+map isn't cleared on test end. This leds to reuse of that map for
+each test, which prevents the results of the test from being accurate.
+
+This commit fixes the problem by removing of pinned map from bpffs.
+Also, this commit add the executable permission to shell script
+files.
+
+Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF")
+Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/lwt_len_hist.sh | 2 ++
+ samples/bpf/test_lwt_bpf.sh | 0
+ 2 files changed, 2 insertions(+)
+ mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh
+ mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh
+
+diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh
+old mode 100644
+new mode 100755
+index 090b96eaf7f76..0eda9754f50b8
+--- a/samples/bpf/lwt_len_hist.sh
++++ b/samples/bpf/lwt_len_hist.sh
+@@ -8,6 +8,8 @@ VETH1=tst_lwt1b
+ TRACE_ROOT=/sys/kernel/debug/tracing
+
+ function cleanup {
++ # To reset saved histogram, remove pinned map
++ rm /sys/fs/bpf/tc/globals/lwt_len_hist_map
+ ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null
+ ip link del $VETH0 2> /dev/null
+ ip link del $VETH1 2> /dev/null
+diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh
+old mode 100644
+new mode 100755
+--
+2.27.0
+
--- /dev/null
+From 6a30f43c0283dbfacad7733a653dd28a3b147fe9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Oct 2020 23:49:42 +0800
+Subject: sched/deadline: Fix sched_dl_global_validate()
+
+From: Peng Liu <iwtbavbm@gmail.com>
+
+[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ]
+
+When change sched_rt_{runtime, period}_us, we validate that the new
+settings should at least accommodate the currently allocated -dl
+bandwidth:
+
+ sched_rt_handler()
+ --> sched_dl_bandwidth_validate()
+ {
+ new_bw = global_rt_runtime()/global_rt_period();
+
+ for_each_possible_cpu(cpu) {
+ dl_b = dl_bw_of(cpu);
+ if (new_bw < dl_b->total_bw) <-------
+ ret = -EBUSY;
+ }
+ }
+
+But under CONFIG_SMP, dl_bw is per root domain , but not per CPU,
+dl_b->total_bw is the allocated bandwidth of the whole root domain.
+Instead, we should compare dl_b->total_bw against "cpus*new_bw",
+where 'cpus' is the number of CPUs of the root domain.
+
+Also, below annotation(in kernel/sched/sched.h) implied implementation
+only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept
+evolving till got merged(v9), but the annotation remains unchanged,
+meaningless and misleading, update it.
+
+* With respect to SMP, the bandwidth is given on a per-CPU basis,
+* meaning that:
+* - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+* - dl_total_bw array contains, in the i-eth element, the currently
+* allocated bandwidth on the i-eth CPU.
+
+[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/
+
+Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks")
+Signed-off-by: Peng Liu <iwtbavbm@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Acked-by: Juri Lelli <juri.lelli@redhat.com>
+Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 5 +++--
+ kernel/sched/sched.h | 42 ++++++++++++++++++-----------------------
+ 2 files changed, 21 insertions(+), 26 deletions(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 8aecfb143859d..aa592dc3cb401 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2464,7 +2464,7 @@ int sched_dl_global_validate(void)
+ u64 period = global_rt_period();
+ u64 new_bw = to_ratio(period, runtime);
+ struct dl_bw *dl_b;
+- int cpu, ret = 0;
++ int cpu, cpus, ret = 0;
+ unsigned long flags;
+
+ /*
+@@ -2479,9 +2479,10 @@ int sched_dl_global_validate(void)
+ for_each_possible_cpu(cpu) {
+ rcu_read_lock_sched();
+ dl_b = dl_bw_of(cpu);
++ cpus = dl_bw_cpus(cpu);
+
+ raw_spin_lock_irqsave(&dl_b->lock, flags);
+- if (new_bw < dl_b->total_bw)
++ if (new_bw * cpus < dl_b->total_bw)
+ ret = -EBUSY;
+ raw_spin_unlock_irqrestore(&dl_b->lock, flags);
+
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 41b7954be68b7..7b7ba91e319bb 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -247,30 +247,6 @@ struct rt_bandwidth {
+
+ void __dl_clear_params(struct task_struct *p);
+
+-/*
+- * To keep the bandwidth of -deadline tasks and groups under control
+- * we need some place where:
+- * - store the maximum -deadline bandwidth of the system (the group);
+- * - cache the fraction of that bandwidth that is currently allocated.
+- *
+- * This is all done in the data structure below. It is similar to the
+- * one used for RT-throttling (rt_bandwidth), with the main difference
+- * that, since here we are only interested in admission control, we
+- * do not decrease any runtime while the group "executes", neither we
+- * need a timer to replenish it.
+- *
+- * With respect to SMP, the bandwidth is given on a per-CPU basis,
+- * meaning that:
+- * - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+- * - dl_total_bw array contains, in the i-eth element, the currently
+- * allocated bandwidth on the i-eth CPU.
+- * Moreover, groups consume bandwidth on each CPU, while tasks only
+- * consume bandwidth on the CPU they're running on.
+- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
+- * that will be shown the next time the proc or cgroup controls will
+- * be red. It on its turn can be changed by writing on its own
+- * control.
+- */
+ struct dl_bandwidth {
+ raw_spinlock_t dl_runtime_lock;
+ u64 dl_runtime;
+@@ -282,6 +258,24 @@ static inline int dl_bandwidth_enabled(void)
+ return sysctl_sched_rt_runtime >= 0;
+ }
+
++/*
++ * To keep the bandwidth of -deadline tasks under control
++ * we need some place where:
++ * - store the maximum -deadline bandwidth of each cpu;
++ * - cache the fraction of bandwidth that is currently allocated in
++ * each root domain;
++ *
++ * This is all done in the data structure below. It is similar to the
++ * one used for RT-throttling (rt_bandwidth), with the main difference
++ * that, since here we are only interested in admission control, we
++ * do not decrease any runtime while the group "executes", neither we
++ * need a timer to replenish it.
++ *
++ * With respect to SMP, bandwidth is given on a per root domain basis,
++ * meaning that:
++ * - bw (< 100%) is the deadline bandwidth of each CPU;
++ * - total_bw is the currently allocated bandwidth in each root domain;
++ */
+ struct dl_bw {
+ raw_spinlock_t lock;
+ u64 bw;
+--
+2.27.0
+
--- /dev/null
+From e6c46d1468e890f6e92a57a8d726980eaed2332c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Oct 2020 16:46:55 +0200
+Subject: sched: Reenable interrupts in do_sched_yield()
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ]
+
+do_sched_yield() invokes schedule() with interrupts disabled which is
+not allowed. This goes back to the pre git era to commit a6efb709806c
+("[PATCH] irqlock patch 2.5.27-H6") in the history tree.
+
+Reenable interrupts and remove the misleading comment which "explains" it.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b166320f7633e..013b1c6cb4ed9 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4984,12 +4984,8 @@ static void do_sched_yield(void)
+ schedstat_inc(rq->yld_count);
+ current->sched_class->yield_task(rq);
+
+- /*
+- * Since we are going to call schedule() anyway, there's
+- * no need to preempt or enable interrupts:
+- */
+ preempt_disable();
+- rq_unlock(rq, &rf);
++ rq_unlock_irq(rq, &rf);
+ sched_preempt_enable_no_resched();
+
+ schedule();
+--
+2.27.0
+
--- /dev/null
+From b417be9e5524ce3376a740546fef2bdb54d9b8ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 18:08:45 +0100
+Subject: scsi: core: Fix VPD LUN ID designator priorities
+
+From: Martin Wilck <mwilck@suse.com>
+
+[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ]
+
+The current implementation of scsi_vpd_lun_id() uses the designator length
+as an implicit measure of priority. This works most of the time, but not
+always. For example, some Hitachi storage arrays return this in VPD 0x83:
+
+VPD INQUIRY: Device Identification page
+ Designation descriptor number 1, descriptor length: 24
+ designator_type: T10 vendor identification, code_set: ASCII
+ associated with the Addressed logical unit
+ vendor id: HITACHI
+ vendor specific: 5030C3502025
+ Designation descriptor number 2, descriptor length: 6
+ designator_type: vendor specific [0x0], code_set: Binary
+ associated with the Target port
+ vendor specific: 08 03
+ Designation descriptor number 3, descriptor length: 20
+ designator_type: NAA, code_set: Binary
+ associated with the Addressed logical unit
+ NAA 6, IEEE Company_id: 0x60e8
+ Vendor Specific Identifier: 0x7c35000
+ Vendor Specific Identifier Extension: 0x30c35000002025
+ [0x60060e8007c350000030c35000002025]
+
+The current code would use the first descriptor because it's longer than
+the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA
+descriptors over T10 vendor ID. Designator length should only be used to
+compare designators of the same type.
+
+This patch addresses the issue by separating designator priority and
+length.
+
+Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com
+Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++-------------
+ 1 file changed, 86 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index c501fb5190a38..fe5ae2b221c19 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -3446,6 +3446,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev)
+ }
+ EXPORT_SYMBOL(sdev_enable_disk_events);
+
++static unsigned char designator_prio(const unsigned char *d)
++{
++ if (d[1] & 0x30)
++ /* not associated with LUN */
++ return 0;
++
++ if (d[3] == 0)
++ /* invalid length */
++ return 0;
++
++ /*
++ * Order of preference for lun descriptor:
++ * - SCSI name string
++ * - NAA IEEE Registered Extended
++ * - EUI-64 based 16-byte
++ * - EUI-64 based 12-byte
++ * - NAA IEEE Registered
++ * - NAA IEEE Extended
++ * - EUI-64 based 8-byte
++ * - SCSI name string (truncated)
++ * - T10 Vendor ID
++ * as longer descriptors reduce the likelyhood
++ * of identification clashes.
++ */
++
++ switch (d[1] & 0xf) {
++ case 8:
++ /* SCSI name string, variable-length UTF-8 */
++ return 9;
++ case 3:
++ switch (d[4] >> 4) {
++ case 6:
++ /* NAA registered extended */
++ return 8;
++ case 5:
++ /* NAA registered */
++ return 5;
++ case 4:
++ /* NAA extended */
++ return 4;
++ case 3:
++ /* NAA locally assigned */
++ return 1;
++ default:
++ break;
++ }
++ break;
++ case 2:
++ switch (d[3]) {
++ case 16:
++ /* EUI64-based, 16 byte */
++ return 7;
++ case 12:
++ /* EUI64-based, 12 byte */
++ return 6;
++ case 8:
++ /* EUI64-based, 8 byte */
++ return 3;
++ default:
++ break;
++ }
++ break;
++ case 1:
++ /* T10 vendor ID */
++ return 1;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ /**
+ * scsi_vpd_lun_id - return a unique device identification
+ * @sdev: SCSI device
+@@ -3462,7 +3534,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events);
+ */
+ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ {
+- u8 cur_id_type = 0xff;
++ u8 cur_id_prio = 0;
+ u8 cur_id_size = 0;
+ const unsigned char *d, *cur_id_str;
+ const struct scsi_vpd *vpd_pg83;
+@@ -3475,20 +3547,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ return -ENXIO;
+ }
+
+- /*
+- * Look for the correct descriptor.
+- * Order of preference for lun descriptor:
+- * - SCSI name string
+- * - NAA IEEE Registered Extended
+- * - EUI-64 based 16-byte
+- * - EUI-64 based 12-byte
+- * - NAA IEEE Registered
+- * - NAA IEEE Extended
+- * - T10 Vendor ID
+- * as longer descriptors reduce the likelyhood
+- * of identification clashes.
+- */
+-
+ /* The id string must be at least 20 bytes + terminating NULL byte */
+ if (id_len < 21) {
+ rcu_read_unlock();
+@@ -3498,8 +3556,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ memset(id, 0, id_len);
+ d = vpd_pg83->data + 4;
+ while (d < vpd_pg83->data + vpd_pg83->len) {
+- /* Skip designators not referring to the LUN */
+- if ((d[1] & 0x30) != 0x00)
++ u8 prio = designator_prio(d);
++
++ if (prio == 0 || cur_id_prio > prio)
+ goto next_desig;
+
+ switch (d[1] & 0xf) {
+@@ -3507,28 +3566,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ /* T10 Vendor ID */
+ if (cur_id_size > d[3])
+ break;
+- /* Prefer anything */
+- if (cur_id_type > 0x01 && cur_id_type != 0xff)
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ if (cur_id_size + 4 > id_len)
+ cur_id_size = id_len - 4;
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ id_size = snprintf(id, id_len, "t10.%*pE",
+ cur_id_size, cur_id_str);
+ break;
+ case 0x2:
+ /* EUI-64 */
+- if (cur_id_size > d[3])
+- break;
+- /* Prefer NAA IEEE Registered Extended */
+- if (cur_id_type == 0x3 &&
+- cur_id_size == d[3])
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ switch (cur_id_size) {
+ case 8:
+ id_size = snprintf(id, id_len,
+@@ -3546,17 +3596,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ cur_id_str);
+ break;
+ default:
+- cur_id_size = 0;
+ break;
+ }
+ break;
+ case 0x3:
+ /* NAA */
+- if (cur_id_size > d[3])
+- break;
++ cur_id_prio = prio;
+ cur_id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ switch (cur_id_size) {
+ case 8:
+ id_size = snprintf(id, id_len,
+@@ -3569,26 +3616,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len)
+ cur_id_str);
+ break;
+ default:
+- cur_id_size = 0;
+ break;
+ }
+ break;
+ case 0x8:
+ /* SCSI name string */
+- if (cur_id_size + 4 > d[3])
++ if (cur_id_size > d[3])
+ break;
+ /* Prefer others for truncated descriptor */
+- if (cur_id_size && d[3] > id_len)
+- break;
++ if (d[3] > id_len) {
++ prio = 2;
++ if (cur_id_prio > prio)
++ break;
++ }
++ cur_id_prio = prio;
+ cur_id_size = id_size = d[3];
+ cur_id_str = d + 4;
+- cur_id_type = d[1] & 0xf;
+ if (cur_id_size >= id_len)
+ cur_id_size = id_len - 1;
+ memcpy(id, cur_id_str, cur_id_size);
+- /* Decrease priority for truncated descriptor */
+- if (cur_id_size != id_size)
+- cur_id_size = 6;
+ break;
+ default:
+ break;
+--
+2.27.0
+
--- /dev/null
+From c81f8a46ebfe06d92b78831ee2b8179be5b76144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Dec 2020 15:47:39 +0800
+Subject: scsi: fnic: Fix error return code in fnic_probe()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ]
+
+Return a negative error code from the error handling case instead of 0 as
+done elsewhere in this function.
+
+Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com
+Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
+index e52599f441707..bc5dbe3bae5c5 100644
+--- a/drivers/scsi/fnic/fnic_main.c
++++ b/drivers/scsi/fnic/fnic_main.c
+@@ -746,6 +746,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ for (i = 0; i < FNIC_IO_LOCKS; i++)
+ spin_lock_init(&fnic->io_req_lock[i]);
+
++ err = -ENOMEM;
+ fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache);
+ if (!fnic->io_req_pool)
+ goto err_out_free_resources;
+--
+2.27.0
+
--- /dev/null
+From 1e91effaf1b8985017d42b2027e73a6ae24206dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Dec 2020 19:55:51 +0800
+Subject: scsi: pm80xx: Fix error return in pm8001_pci_probe()
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ]
+
+The driver did not return an error in the case where
+pm8001_configure_phy_settings() failed.
+
+Use rc to store the return value of pm8001_configure_phy_settings().
+
+Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com
+Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.")
+Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 7a697ca68501e..1d59d7447a1c8 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -1059,7 +1059,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
+
+ pm8001_init_sas_add(pm8001_ha);
+ /* phy setting support for motherboard controller */
+- if (pm8001_configure_phy_settings(pm8001_ha))
++ rc = pm8001_configure_phy_settings(pm8001_ha);
++ if (rc)
+ goto err_out_shost;
+
+ pm8001_post_sas_ha_init(shost, chip);
+--
+2.27.0
+
--- /dev/null
+From 76f6c96d2a37d18c1ea3a558c1807d9cae0734bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 17:15:18 +0800
+Subject: scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ]
+
+Add the missing destroy_workqueue() before return from __qedi_probe in the
+error handling case when fails to create workqueue qedi->offload_thread.
+
+Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com
+Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
+Reviewed-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 763c7628356b1..eaa50328de90c 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -2580,7 +2580,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
+ QEDI_ERR(&qedi->dbg_ctx,
+ "Unable to start offload thread!\n");
+ rc = -ENODEV;
+- goto free_cid_que;
++ goto free_tmf_thread;
+ }
+
+ /* F/w needs 1st task context memory entry for performance */
+@@ -2600,6 +2600,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode)
+
+ return 0;
+
++free_tmf_thread:
++ destroy_workqueue(qedi->tmf_thread);
+ free_cid_que:
+ qedi_release_cid_que(qedi);
+ free_uio:
+--
+2.27.0
+
--- /dev/null
+From 639fe3a96b2bf9a966d77e58d4d833797da79aca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Nov 2020 21:55:31 -0600
+Subject: [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Serge Hallyn <shallyn@cisco.com>
+
+[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ]
+
+Namespaced file capabilities were introduced in 8db6c34f1dbc .
+When userspace reads an xattr for a namespaced capability, a
+virtualized representation of it is returned if the caller is
+in a user namespace owned by the capability's owning rootid.
+The function which performs this virtualization was not hooked
+up if CONFIG_SECURITY=n. Therefore in that case the original
+xattr was shown instead of the virtualized one.
+
+To test this using libcap-bin (*1),
+
+$ v=$(mktemp)
+$ unshare -Ur setcap cap_sys_admin-eip $v
+$ unshare -Ur setcap -v cap_sys_admin-eip $v
+/tmp/tmp.lSiIFRvt8Y: OK
+
+"setcap -v" verifies the values instead of setting them, and
+will check whether the rootid value is set. Therefore, with
+this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will
+fail:
+
+$ v=$(mktemp)
+$ unshare -Ur setcap cap_sys_admin=eip $v
+$ unshare -Ur setcap -v cap_sys_admin=eip $v
+nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []
+
+Fix this bug by calling cap_inode_getsecurity() in
+security_inode_getsecurity() instead of returning
+-EOPNOTSUPP, when CONFIG_SECURITY=n.
+
+*1 - note, if libcap is too old for getcap to have the '-n'
+option, then use verify-caps instead.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
+Cc: Hervé Guillemet <herve@guillemet.org>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Serge Hallyn <shallyn@cisco.com>
+Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
+Signed-off-by: James Morris <jamorris@linux.microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/security.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/security.h b/include/linux/security.h
+index d2240605edc46..454cc963d1457 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -787,7 +787,7 @@ static inline int security_inode_killpriv(struct dentry *dentry)
+
+ static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
+ {
+- return -EOPNOTSUPP;
++ return cap_inode_getsecurity(inode, name, buffer, alloc);
+ }
+
+ static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
+--
+2.27.0
+
--- /dev/null
+From 0512af736845cc50975ce60889647958b146e828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Oct 2020 09:36:30 +0800
+Subject: selinux: fix error initialization in inode_doinit_with_dentry()
+
+From: Tianyue Ren <rentianyue@kylinos.cn>
+
+[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ]
+
+Mark the inode security label as invalid if we cannot find
+a dentry so that we will retry later rather than marking it
+initialized with the unlabeled SID.
+
+Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
+Signed-off-by: Tianyue Ren <rentianyue@kylinos.cn>
+[PM: minor comment tweaks]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 250b725f5754c..02afe52a55d0d 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1618,7 +1618,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * inode_doinit with a dentry, before these inodes could
+ * be used again by userspace.
+ */
+- goto out;
++ isec->initialized = LABEL_INVALID;
++ /*
++ * There is nothing useful to jump to the "out"
++ * label, except a needless spin lock/unlock
++ * cycle.
++ */
++ return 0;
+ }
+
+ len = INITCONTEXTLEN;
+@@ -1733,8 +1739,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * inode_doinit() with a dentry, before these inodes
+ * could be used again by userspace.
+ */
+- if (!dentry)
+- goto out;
++ if (!dentry) {
++ isec->initialized = LABEL_INVALID;
++ /*
++ * There is nothing useful to jump to the "out"
++ * label, except a needless spin lock/unlock
++ * cycle.
++ */
++ return 0;
++ }
+ rc = selinux_genfs_get_sid(dentry, sclass,
+ sbsec->flags, &sid);
+ dput(dentry);
+--
+2.27.0
+
--- /dev/null
+From e82b6c9203436de1de710e7beb78fdc71efaafc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 11:49:38 -0500
+Subject: selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]
+
+A previous fix, commit 83370b31a915 ("selinux: fix error initialization
+in inode_doinit_with_dentry()"), changed how failures were handled
+before a SELinux policy was loaded. Unfortunately that patch was
+potentially problematic for two reasons: it set the isec->initialized
+state without holding a lock, and it didn't set the inode's SELinux
+label to the "default" for the particular filesystem. The later can
+be a problem if/when a later attempt to revalidate the inode fails
+and SELinux reverts to the existing inode label.
+
+This patch should restore the default inode labeling that existed
+before the original fix, without affecting the LABEL_INVALID marking
+such that revalidation will still be attempted in the future.
+
+Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
+Reported-by: Sven Schnelle <svens@linux.ibm.com>
+Tested-by: Sven Schnelle <svens@linux.ibm.com>
+Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 31 +++++++++++++------------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 02afe52a55d0d..08833bbb97aab 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1618,13 +1618,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * inode_doinit with a dentry, before these inodes could
+ * be used again by userspace.
+ */
+- isec->initialized = LABEL_INVALID;
+- /*
+- * There is nothing useful to jump to the "out"
+- * label, except a needless spin lock/unlock
+- * cycle.
+- */
+- return 0;
++ goto out_invalid;
+ }
+
+ len = INITCONTEXTLEN;
+@@ -1739,15 +1733,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ * inode_doinit() with a dentry, before these inodes
+ * could be used again by userspace.
+ */
+- if (!dentry) {
+- isec->initialized = LABEL_INVALID;
+- /*
+- * There is nothing useful to jump to the "out"
+- * label, except a needless spin lock/unlock
+- * cycle.
+- */
+- return 0;
+- }
++ if (!dentry)
++ goto out_invalid;
+ rc = selinux_genfs_get_sid(dentry, sclass,
+ sbsec->flags, &sid);
+ dput(dentry);
+@@ -1760,11 +1747,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
+ out:
+ spin_lock(&isec->lock);
+ if (isec->initialized == LABEL_PENDING) {
+- if (!sid || rc) {
++ if (rc) {
+ isec->initialized = LABEL_INVALID;
+ goto out_unlock;
+ }
+-
+ isec->initialized = LABEL_INITIALIZED;
+ isec->sid = sid;
+ }
+@@ -1772,6 +1758,15 @@ out:
+ out_unlock:
+ spin_unlock(&isec->lock);
+ return rc;
++
++out_invalid:
++ spin_lock(&isec->lock);
++ if (isec->initialized == LABEL_PENDING) {
++ isec->initialized = LABEL_INVALID;
++ isec->sid = sid;
++ }
++ spin_unlock(&isec->lock);
++ return 0;
+ }
+
+ /* Convert a Linux signal to an access vector. */
+--
+2.27.0
+
--- /dev/null
+From 5c8b1843cc226b266c7844cf1afd0dc5ac5e4624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Oct 2020 17:10:58 +0100
+Subject: seq_buf: Avoid type mismatch for seq_buf_init
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ]
+
+Building with W=2 prints a number of warnings for one function that
+has a pointer type mismatch:
+
+linux/seq_buf.h: In function 'seq_buf_init':
+linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign]
+
+Change the type in the function prototype according to the type in
+the structure.
+
+Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org
+
+Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields")
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/seq_buf.h | 2 +-
+ include/linux/trace_seq.h | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h
+index aa5deb041c25d..7cc952282e8be 100644
+--- a/include/linux/seq_buf.h
++++ b/include/linux/seq_buf.h
+@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s)
+ }
+
+ static inline void
+-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size)
++seq_buf_init(struct seq_buf *s, char *buf, unsigned int size)
+ {
+ s->buffer = buf;
+ s->size = size;
+diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
+index 6609b39a72326..6db257466af68 100644
+--- a/include/linux/trace_seq.h
++++ b/include/linux/trace_seq.h
+@@ -12,7 +12,7 @@
+ */
+
+ struct trace_seq {
+- unsigned char buffer[PAGE_SIZE];
++ char buffer[PAGE_SIZE];
+ struct seq_buf seq;
+ int full;
+ };
+@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s)
+ * that is about to be written to and then return the result
+ * of that write.
+ */
+-static inline unsigned char *
++static inline char *
+ trace_seq_buffer_ptr(struct trace_seq *s)
+ {
+ return s->buffer + seq_buf_used(&s->seq);
+--
+2.27.0
+
md-fix-a-warning-caused-by-a-race-between-concurrent-md_ioctl-s.patch
perf-cs-etm-change-tuple-from-traceid-cpu-to-traceid-metadata.patch
perf-cs-etm-move-definition-of-traceid_list-global-variable-from-header-file.patch
+hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-2583
+drm-gma500-fix-double-free-of-gma_connector.patch
+drm-tve200-fix-handling-of-platform_get_irq-error.patch
+soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch
+soc-mediatek-check-if-power-domains-can-be-powered-o.patch
+soc-qcom-geni-more-properly-switch-to-dma-mode.patch
+rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch
+selinux-fix-error-initialization-in-inode_doinit_wit.patch
+arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch
+rdma-rxe-compute-psn-windows-correctly.patch
+x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch
+arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch
+x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch
+sched-deadline-fix-sched_dl_global_validate.patch
+sched-reenable-interrupts-in-do_sched_yield.patch
+crypto-talitos-endianess-in-current_desc_hdr.patch
+crypto-talitos-fix-return-type-of-current_desc_hdr.patch
+crypto-inside-secure-fix-sizeof-mismatch.patch
+drm-amdgpu-fix-build_coefficients-argument.patch
+powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch
+spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch
+drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch
+asoc-pcm-drain-support-reactivation.patch
+selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch
+arm64-dts-exynos-include-common-syscon-restart-power.patch
+arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch
+bluetooth-fix-null-pointer-dereference-in-hci_event_.patch
+bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch
+spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch
+spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch
+spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch
+spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch
+spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch
+mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch
+asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch
+net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch
+net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch
+asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch
+rdma-mthca-work-around-wenum-conversion-warning.patch
+mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch
+crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch
+staging-greybus-codecs-fix-reference-counter-leak-in.patch
+staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch
+media-tm6000-fix-sizeof-mismatches.patch
+media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch
+asoc-meson-fix-compile_test-error.patch
+scsi-core-fix-vpd-lun-id-designator-priorities.patch
+media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch
+video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch
+drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch
+input-ads7846-fix-race-that-causes-missing-releases.patch
+input-ads7846-fix-integer-overflow-on-rt-calculation.patch
+input-ads7846-fix-unaligned-access-on-7845.patch
+usb-max3421-fix-return-error-code-in-max3421_probe.patch
+spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch
+powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch
+crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch
+crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch
+spi-fix-resource-leak-for-drivers-without-.remove-ca.patch
+soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch
+soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch
+drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch
+input-omap4-keypad-fix-runtime-pm-error-handling.patch
+rdma-cxgb4-validate-the-number-of-cqes.patch
+memstick-fix-a-double-free-bug-in-memstick_check.patch
+arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch
+arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch
+orinoco-move-context-allocation-after-processing-the.patch
+cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch
+dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch
+media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch
+platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch
+platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch
+samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch
+mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch
+media-max2175-fix-max2175_set_csm_mode-error-code.patch
+slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch
+hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch
+arm-dts-remove-non-existent-i2c1-from-98dx3236.patch
+arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch
+power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch
+power-supply-bq24190_charger-fix-reference-leak.patch
+genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch
+pci-bounds-check-command-line-resource-alignment-req.patch
+pci-fix-overflow-in-command-line-resource-alignment-.patch
+pci-iproc-fix-out-of-bound-array-accesses.patch
+arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch
+arm-dts-at91-at91sam9rl-fix-adc-triggers.patch
+platform-x86-dell-smbios-base-fix-error-return-code-.patch
+ath10k-fix-the-parsing-error-in-service-available-ev.patch
+ath10k-fix-an-error-handling-path.patch
+ath10k-release-some-resources-in-an-error-handling-p.patch
+nfsv4.2-condition-readdir-s-mask-for-security-label-.patch
+sunrpc-xprt_load_transport-needs-to-support-the-neti.patch
+lockd-don-t-use-interval-based-rebinding-over-tcp.patch
+nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch
+vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch
+media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch
+clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch
+arm-dts-at91-sama5d2-map-securam-as-device.patch
+pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch
+arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch
+memstick-r592-fix-error-return-in-r592_probe.patch
+net-mlx5-properly-convey-driver-version-to-firmware.patch
+asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch
+dm-ioctl-fix-error-return-code-in-target_message.patch
+clocksource-drivers-arm_arch_timer-correct-fault-pro.patch
+cpufreq-highbank-add-missing-module_device_table.patch
+cpufreq-mediatek-add-missing-module_device_table.patch
+cpufreq-st-add-missing-module_device_table.patch
+cpufreq-loongson1-add-missing-module_alias.patch
+cpufreq-scpi-add-missing-module_alias.patch
+scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch
+scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch
+seq_buf-avoid-type-mismatch-for-seq_buf_init.patch
+scsi-fnic-fix-error-return-code-in-fnic_probe.patch
+platform-x86-mlx-platform-fix-item-counter-assignmen.patch
+powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch
+powerpc-pseries-hibernation-remove-redundant-cachein.patch
+usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch
+usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch
+speakup-fix-uninitialized-flush_lock.patch
+nfsd-fix-message-level-for-normal-termination.patch
+nfs_common-need-lock-during-iterate-through-the-list.patch
+x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch
+bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch
+clk-tegra-fix-duplicated-se-clock-entry.patch
+extcon-max77693-fix-modalias-string.patch
+mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch
+asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch
+irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch
+watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch
+watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch
+watchdog-sprd-check-busy-bit-before-new-loading-rath.patch
+watchdog-fix-potential-dereferencing-of-null-pointer.patch
+um-monitor-error-events-in-irq-controller.patch
+um-tty-fix-handling-of-close-in-tty-lines.patch
+um-chan_xterm-fix-fd-leak.patch
+nfc-s3fwrn5-release-the-nfc-firmware.patch
+powerpc-ps3-use-dma_mapping_error.patch
+checkpatch-fix-unescaped-left-brace.patch
+net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch
+net-allwinner-fix-some-resources-leak-in-the-error-h.patch
+net-korina-fix-return-value.patch
+libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch
+watchdog-qcom-avoid-context-switch-in-restart-handle.patch
+watchdog-coh901327-add-common_clk-dependency.patch
+clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch
+pwm-zx-add-missing-cleanup-in-error-path.patch
+pwm-lp3943-dynamically-allocate-pwm-chip-base.patch
+perf-record-fix-memory-leak-when-using-user-regs-to-.patch
+qlcnic-fix-error-code-in-probe.patch
+clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch
+clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch
+kconfig-fix-return-value-of-do_error_if.patch
+arm-sunxi-add-machine-match-for-the-allwinner-v3-soc.patch
+cfg80211-initialize-rekey_data.patch
+security-fix-namespaced-fscaps-when-config_security.patch
+lwt-disable-bh-too-in-run_lwt_bpf.patch
+input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch
+input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch
--- /dev/null
+From e188ee736ff7d9c54d0bd2d30a105a1d17ea10e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Nov 2020 10:24:50 +0000
+Subject: slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ]
+
+Attempting to send a power request during PM operations, when the QMI
+handle isn't initialized results in a NULL pointer dereference. So check
+if the QMI handle has been initialized before attempting to post the
+power requests.
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index 522a87fc573a6..44021620d1013 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1200,6 +1200,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev)
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+
++ if (!ctrl->qmi.handle)
++ return 0;
++
+ if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP)
+ ret = qcom_slim_ngd_power_up(ctrl);
+ if (ret) {
+@@ -1493,6 +1496,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
+ struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
+ int ret = 0;
+
++ if (!ctrl->qmi.handle)
++ return 0;
++
+ ret = qcom_slim_qmi_power_request(ctrl, false);
+ if (ret && ret != -EBUSY)
+ dev_info(ctrl->dev, "slim resource not idle:%d\n", ret);
+--
+2.27.0
+
--- /dev/null
+From 2e4dc2f1a7ff1381a885c38f6821e05ad68deece Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Sep 2020 11:31:35 +0800
+Subject: soc: mediatek: Check if power domains can be powered on at boot time
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ]
+
+In the error case, where a power domain cannot be powered on
+successfully at boot time (in mtk_register_power_domains),
+pm_genpd_init would still be called with is_off=false, and the
+system would later try to disable the power domain again, triggering
+warnings as disabled clocks are disabled again (and other potential
+issues).
+
+Also print a warning splat in that case, as this should never
+happen.
+
+Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-scpsys.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c
+index 5b24bb4bfbf66..ef54f1638d207 100644
+--- a/drivers/soc/mediatek/mtk-scpsys.c
++++ b/drivers/soc/mediatek/mtk-scpsys.c
+@@ -454,6 +454,7 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ for (i = 0; i < num; i++) {
+ struct scp_domain *scpd = &scp->domains[i];
+ struct generic_pm_domain *genpd = &scpd->genpd;
++ bool on;
+
+ /*
+ * Initially turn on all domains to make the domains usable
+@@ -461,9 +462,9 @@ static void mtk_register_power_domains(struct platform_device *pdev,
+ * software. The unused domains will be switched off during
+ * late_init time.
+ */
+- genpd->power_on(genpd);
++ on = !WARN_ON(genpd->power_on(genpd) < 0);
+
+- pm_genpd_init(genpd, NULL, false);
++ pm_genpd_init(genpd, NULL, !on);
+ }
+
+ /*
+--
+2.27.0
+
--- /dev/null
+From 11f9e44081cc36374cd3c738cf8871d4a924a152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Oct 2020 14:25:28 -0700
+Subject: soc: qcom: geni: More properly switch to DMA mode
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ]
+
+On geni-i2c transfers using DMA, it was seen that if you program the
+command (I2C_READ) before calling geni_se_rx_dma_prep() that it could
+cause interrupts to fire. If we get unlucky, these interrupts can
+just keep firing (and not be handled) blocking further progress and
+hanging the system.
+
+In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
+we avoided that by making sure we didn't program the command until
+after geni_se_rx_dma_prep() was called. While that avoided the
+problems, it also turns out to be invalid. At least in the TX case we
+started seeing sporadic corrupted transfers. This is easily seen by
+adding an msleep() between the DMA prep and the writing of the
+command, which makes the problem worse. That means we need to revert
+that commit and find another way to fix the bogus IRQs.
+
+Specifically, after reverting commit 02b9aec59243 ("i2c:
+i2c-qcom-geni: Fix DMA transfer race"), I put some traces in. I found
+that the when the interrupts were firing like crazy:
+- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set.
+- "dma" was set.
+
+Further debugging showed that I could make the problem happen more
+reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd()
+ran up until geni_se_rx_dma_prep() programmed the length.
+
+A rather simple fix is to change geni_se_select_dma_mode() so it's a
+true inverse of geni_se_select_fifo_mode() and disables all the FIFO
+related interrupts. Now the problematic interrupts can't fire and we
+can program things in the correct order without worrying.
+
+As part of this, let's also change the writel_relaxed() in the prepare
+function to a writel() so that our DMA is guaranteed to be prepared
+now that we can't rely on geni_se_setup_m_cmd()'s writel().
+
+NOTE: the only current user of GENI_SE_DMA in mainline is i2c.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c
+index ee89ffb6dde84..7369b061929bb 100644
+--- a/drivers/soc/qcom/qcom-geni-se.c
++++ b/drivers/soc/qcom/qcom-geni-se.c
+@@ -275,6 +275,7 @@ static void geni_se_select_fifo_mode(struct geni_se *se)
+
+ static void geni_se_select_dma_mode(struct geni_se *se)
+ {
++ u32 proto = geni_se_read_proto(se);
+ u32 val;
+
+ writel_relaxed(0, se->base + SE_GSI_EVENT_EN);
+@@ -284,6 +285,18 @@ static void geni_se_select_dma_mode(struct geni_se *se)
+ writel_relaxed(0xffffffff, se->base + SE_DMA_RX_IRQ_CLR);
+ writel_relaxed(0xffffffff, se->base + SE_IRQ_EN);
+
++ val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN);
++ if (proto != GENI_SE_UART) {
++ val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN);
++ val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN);
++ }
++ writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN);
++
++ val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN);
++ if (proto != GENI_SE_UART)
++ val &= ~S_CMD_DONE_EN;
++ writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN);
++
+ val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN);
+ val |= GENI_DMA_MODE_EN;
+ writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN);
+@@ -633,7 +646,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L);
+ writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H);
+ writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR);
+- writel_relaxed(len, se->base + SE_DMA_TX_LEN);
++ writel(len, se->base + SE_DMA_TX_LEN);
+ return 0;
+ }
+ EXPORT_SYMBOL(geni_se_tx_dma_prep);
+@@ -667,7 +680,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len,
+ writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H);
+ /* RX does not have EOT buffer type bit. So just reset RX_ATTR */
+ writel_relaxed(0, se->base + SE_DMA_RX_ATTR);
+- writel_relaxed(len, se->base + SE_DMA_RX_LEN);
++ writel(len, se->base + SE_DMA_RX_LEN);
+ return 0;
+ }
+ EXPORT_SYMBOL(geni_se_rx_dma_prep);
+--
+2.27.0
+
--- /dev/null
+From f84706a4d4a79cde0166c56fa3e82d857f5caf53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Sep 2020 14:31:42 +0300
+Subject: soc: renesas: rmobile-sysc: Fix some leaks in
+ rmobile_init_pm_domains()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ]
+
+This code needs to call iounmap() on one error path.
+
+Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-shmobile/pm-rmobile.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-shmobile/pm-rmobile.c b/arch/arm/mach-shmobile/pm-rmobile.c
+index e348bcfe389da..cb8b02a1abe26 100644
+--- a/arch/arm/mach-shmobile/pm-rmobile.c
++++ b/arch/arm/mach-shmobile/pm-rmobile.c
+@@ -330,6 +330,7 @@ static int __init rmobile_init_pm_domains(void)
+
+ pmd = of_get_child_by_name(np, "pm-domains");
+ if (!pmd) {
++ iounmap(base);
+ pr_warn("%pOF lacks pm-domains node\n", np);
+ continue;
+ }
+--
+2.27.0
+
--- /dev/null
+From 4af642f8fee8ae019b63fb976cd9e1ff6eed41a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:37 -0800
+Subject: soc: ti: Fix reference imbalance in knav_dma_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ]
+
+The patch fix two reference leak.
+
+ 1) pm_runtime_get_sync will increment pm usage counter even it
+ failed. Forgetting to call put operation will result in
+ reference leak.
+
+ 2) The pm_runtime_enable will increase power disable depth. Thus
+ a pairing decrement is needed on the error handling path to
+ keep it balanced.
+
+We fix it by: 1) adding call pm_runtime_put_noidle or
+pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable
+in error handling, to keep usage counter and disable depth balanced.
+
+Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_dma.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
+index 224d7ddeeb767..eb2e87229c1da 100644
+--- a/drivers/soc/ti/knav_dma.c
++++ b/drivers/soc/ti/knav_dma.c
+@@ -759,8 +759,9 @@ static int knav_dma_probe(struct platform_device *pdev)
+ pm_runtime_enable(kdev->dev);
+ ret = pm_runtime_get_sync(kdev->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(kdev->dev);
+ dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret);
+- return ret;
++ goto err_pm_disable;
+ }
+
+ /* Initialise all packet dmas */
+@@ -774,7 +775,8 @@ static int knav_dma_probe(struct platform_device *pdev)
+
+ if (list_empty(&kdev->list)) {
+ dev_err(dev, "no valid dma instance\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto err_put_sync;
+ }
+
+ debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL,
+@@ -782,6 +784,13 @@ static int knav_dma_probe(struct platform_device *pdev)
+
+ device_ready = true;
+ return ret;
++
++err_put_sync:
++ pm_runtime_put_sync(kdev->dev);
++err_pm_disable:
++ pm_runtime_disable(kdev->dev);
++
++ return ret;
+ }
+
+ static int knav_dma_remove(struct platform_device *pdev)
+--
+2.27.0
+
--- /dev/null
+From 6b499bc643904a497522f42876f5c37221fe54d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Nov 2020 19:22:00 -0800
+Subject: soc: ti: knav_qmss: fix reference leak in knav_queue_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in knav_queue_probe, so we should fix it.
+
+Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Signed-off-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/knav_qmss_queue.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index ef36acc0e7088..ffd7046caa2ca 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -1799,6 +1799,7 @@ static int knav_queue_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ dev_err(dev, "Failed to enable QMSS\n");
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 004a1567bb6eed0df514dfc803931c8c66c97ec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 09:22:29 +0800
+Subject: speakup: fix uninitialized flush_lock
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ]
+
+The flush_lock is uninitialized, use DEFINE_SPINLOCK
+to define and initialize flush_lock.
+
+Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/speakup/speakup_dectlk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c
+index a144f28ee1a8a..04de81559c6e3 100644
+--- a/drivers/staging/speakup/speakup_dectlk.c
++++ b/drivers/staging/speakup/speakup_dectlk.c
+@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth);
+ static int in_escape;
+ static int is_flushing;
+
+-static spinlock_t flush_lock;
++static DEFINE_SPINLOCK(flush_lock);
+ static DECLARE_WAIT_QUEUE_HEAD(flush);
+
+ static struct var_t vars[] = {
+--
+2.27.0
+
--- /dev/null
+From b1ef2f2fdb23953907d76bd0e711f9813bfe3ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 15:49:11 +0800
+Subject: spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in
+ bcm63xx_hsspi_resume
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ]
+
+Fix the missing clk_disable_unprepare() before return
+from bcm63xx_hsspi_resume in the error handling case when
+fails to prepare and enable bs->pll_clk.
+
+Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled")
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx-hsspi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c
+index 1669c554ea340..2ad7b3f3666be 100644
+--- a/drivers/spi/spi-bcm63xx-hsspi.c
++++ b/drivers/spi/spi-bcm63xx-hsspi.c
+@@ -487,8 +487,10 @@ static int bcm63xx_hsspi_resume(struct device *dev)
+
+ if (bs->pll_clk) {
+ ret = clk_prepare_enable(bs->pll_clk);
+- if (ret)
++ if (ret) {
++ clk_disable_unprepare(bs->clk);
+ return ret;
++ }
+ }
+
+ spi_master_resume(master);
+--
+2.27.0
+
--- /dev/null
+From d324361d1a27e16d0bb076cd572fb48901473b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Nov 2020 17:16:02 +0100
+Subject: spi: fix resource leak for drivers without .remove callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ]
+
+Consider an spi driver with a .probe but without a .remove callback (e.g.
+rtc-ds1347). The function spi_drv_probe() is called to bind a device and
+so dev_pm_domain_attach() is called. As there is no remove callback
+spi_drv_remove() isn't called at unbind time however and so calling
+dev_pm_domain_detach() is missed and the pm domain keeps active.
+
+To fix this always use both spi_drv_probe() and spi_drv_remove() and
+make them handle the respective callback not being set. This has the
+side effect that for a (hypothetical) driver that has neither .probe nor
+remove the clk and pm domain setup is done.
+
+Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index fbc5444bd9cbd..7dabbc82b6463 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -362,9 +362,11 @@ static int spi_drv_probe(struct device *dev)
+ if (ret)
+ return ret;
+
+- ret = sdrv->probe(spi);
+- if (ret)
+- dev_pm_domain_detach(dev, true);
++ if (sdrv->probe) {
++ ret = sdrv->probe(spi);
++ if (ret)
++ dev_pm_domain_detach(dev, true);
++ }
+
+ return ret;
+ }
+@@ -372,9 +374,10 @@ static int spi_drv_probe(struct device *dev)
+ static int spi_drv_remove(struct device *dev)
+ {
+ const struct spi_driver *sdrv = to_spi_driver(dev->driver);
+- int ret;
++ int ret = 0;
+
+- ret = sdrv->remove(to_spi_device(dev));
++ if (sdrv->remove)
++ ret = sdrv->remove(to_spi_device(dev));
+ dev_pm_domain_detach(dev, true);
+
+ return ret;
+@@ -399,10 +402,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv)
+ {
+ sdrv->driver.owner = owner;
+ sdrv->driver.bus = &spi_bus_type;
+- if (sdrv->probe)
+- sdrv->driver.probe = spi_drv_probe;
+- if (sdrv->remove)
+- sdrv->driver.remove = spi_drv_remove;
++ sdrv->driver.probe = spi_drv_probe;
++ sdrv->driver.remove = spi_drv_remove;
+ if (sdrv->shutdown)
+ sdrv->driver.shutdown = spi_drv_shutdown;
+ return driver_register(&sdrv->driver);
+--
+2.27.0
+
--- /dev/null
+From 71bdf19dbbb9d61829d4668cf37e75694c919696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 22:56:51 +0800
+Subject: spi: img-spfi: fix reference leak in img_spfi_resume
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in img_spfi_resume, so we should fix it.
+
+Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-img-spfi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index e4b31d6e6e33e..25a545c985d4a 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -774,8 +774,10 @@ static int img_spfi_resume(struct device *dev)
+ int ret;
+
+ ret = pm_runtime_get_sync(dev);
+- if (ret)
++ if (ret) {
++ pm_runtime_put_noidle(dev);
+ return ret;
++ }
+ spfi_reset(spfi);
+ pm_runtime_put(dev);
+
+--
+2.27.0
+
--- /dev/null
+From 546415dbf5b9f9301b1a5076706a0181390ea376 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 09:24:21 +0800
+Subject: spi: mxs: fix reference leak in mxs_spi_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in mxs_spi_probe, so we should fix it.
+
+Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mxs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
+index 6ac95a2a21cef..4a7375ecb65ef 100644
+--- a/drivers/spi/spi-mxs.c
++++ b/drivers/spi/spi-mxs.c
+@@ -605,6 +605,7 @@ static int mxs_spi_probe(struct platform_device *pdev)
+
+ ret = pm_runtime_get_sync(ssp->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(ssp->dev);
+ dev_err(ssp->dev, "runtime_get_sync failed\n");
+ goto out_pm_runtime_disable;
+ }
+--
+2.27.0
+
--- /dev/null
+From b4490b5c1dd4f4f4102eadc97f462f2c1d74e4d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:09:47 +0800
+Subject: spi: spi-ti-qspi: fix reference leak in ti_qspi_setup
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in ti_qspi_setup, so we should fix it.
+
+Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-ti-qspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c
+index 95c28abaa0272..73a08724034ba 100644
+--- a/drivers/spi/spi-ti-qspi.c
++++ b/drivers/spi/spi-ti-qspi.c
+@@ -183,6 +183,7 @@ static int ti_qspi_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(qspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(qspi->dev);
+ dev_err(qspi->dev, "pm_runtime_get_sync() failed\n");
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 7f487f5a8d7f45f6d0d41947a9588b92ac0c9835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:06 +0800
+Subject: spi: tegra114: fix reference leak in tegra spi ops
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in two callers(tegra_spi_setup and
+tegra_spi_resume), so we should fix it.
+
+Fixes: f333a331adfac ("spi/tegra114: add spi driver")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 09cfae3abce2d..c510b53e5e3f5 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -827,6 +827,7 @@ static int tegra_spi_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(tspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(tspi->dev);
+ dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+@@ -1252,6 +1253,7 @@ static int tegra_spi_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 7c0bbdec85117dae16a698fce02c70d10f4dbd5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:23 +0800
+Subject: spi: tegra20-sflash: fix reference leak in tegra_sflash_resume
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in tegra_sflash_resume, so we should fix it.
+
+Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-sflash.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
+index 22893a7e0aa0e..749288310c36c 100644
+--- a/drivers/spi/spi-tegra20-sflash.c
++++ b/drivers/spi/spi-tegra20-sflash.c
+@@ -564,6 +564,7 @@ static int tegra_sflash_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 9fa7f8395135c6c628a68bd885da06b246f79c63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Nov 2020 22:13:45 +0800
+Subject: spi: tegra20-slink: fix reference leak in slink ops of tegra20
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ]
+
+pm_runtime_get_sync will increment pm usage counter even it
+failed. Forgetting to pm_runtime_put_noidle will result in
+reference leak in two callers(tegra_slink_setup and
+tegra_slink_resume), so we should fix it.
+
+Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra20-slink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index d1187317bb5d7..c6b80a60951b1 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -761,6 +761,7 @@ static int tegra_slink_setup(struct spi_device *spi)
+
+ ret = pm_runtime_get_sync(tspi->dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(tspi->dev);
+ dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+@@ -1197,6 +1198,7 @@ static int tegra_slink_resume(struct device *dev)
+
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
++ pm_runtime_put_noidle(dev);
+ dev_err(dev, "pm runtime failed, e = %d\n", ret);
+ return ret;
+ }
+--
+2.27.0
+
--- /dev/null
+From 792425f4eb7fee808899ed43fba631b6bdbf85be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Nov 2020 14:49:24 +0800
+Subject: staging: gasket: interrupt: fix the missed eventfd_ctx_put() in
+ gasket_interrupt.c
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ]
+
+gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an
+error path. We check interrupt is valid before calling
+eventfd_ctx_fdget() to fix it.
+
+There is the same issue in gasket_interrupt_clear_eventfd(), Add the
+missed function call to fix it.
+
+Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c
+index 1cfbc120f2284..225460c535d61 100644
+--- a/drivers/staging/gasket/gasket_interrupt.c
++++ b/drivers/staging/gasket/gasket_interrupt.c
+@@ -527,14 +527,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev)
+ int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data,
+ int interrupt, int event_fd)
+ {
+- struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd);
+-
+- if (IS_ERR(ctx))
+- return PTR_ERR(ctx);
++ struct eventfd_ctx *ctx;
+
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ return -EINVAL;
+
++ ctx = eventfd_ctx_fdget(event_fd);
++
++ if (IS_ERR(ctx))
++ return PTR_ERR(ctx);
++
+ interrupt_data->eventfd_ctxs[interrupt] = ctx;
+ return 0;
+ }
+@@ -545,6 +547,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data,
+ if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts)
+ return -EINVAL;
+
+- interrupt_data->eventfd_ctxs[interrupt] = NULL;
++ if (interrupt_data->eventfd_ctxs[interrupt]) {
++ eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]);
++ interrupt_data->eventfd_ctxs[interrupt] = NULL;
++ }
+ return 0;
+ }
+--
+2.27.0
+
--- /dev/null
+From a4668d6f0018399c05e0a8eb7083e31e94f58e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 21:13:46 +0800
+Subject: staging: greybus: codecs: Fix reference counter leak in error
+ handling
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ]
+
+gb_pm_runtime_get_sync has increased the usage counter of the device here.
+Forgetting to call gb_pm_runtime_put_noidle will result in usage counter
+leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We
+fixed it by adding it.
+
+Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/audio_codec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c
+index 35acd55ca5ab7..6cbf69a57dfd9 100644
+--- a/drivers/staging/greybus/audio_codec.c
++++ b/drivers/staging/greybus/audio_codec.c
+@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream,
+ if (ret) {
+ dev_err_ratelimited(dai->dev, "%d: Error during set_config\n",
+ ret);
++ gb_pm_runtime_put_noidle(bundle);
+ mutex_unlock(&codec->lock);
+ return ret;
+ }
+@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream,
+ break;
+ }
+ if (ret) {
++ gb_pm_runtime_put_noidle(bundle);
+ mutex_unlock(&codec->lock);
+ dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n",
+ ret);
+--
+2.27.0
+
--- /dev/null
+From d7f768e1ecc521848bad36505d393eb9075b6902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Nov 2020 16:33:38 -0500
+Subject: SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ]
+
+According to RFC5666, the correct netid for an IPv6 addressed RDMA
+transport is "rdma6", which we've supported as a mount option since
+Linux-4.7. The problem is when we try to load the module "xprtrdma6",
+that will fail, since there is no modulealias of that name.
+
+Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/xprt.h | 1 +
+ net/sunrpc/xprt.c | 65 +++++++++++++++++++++++++--------
+ net/sunrpc/xprtrdma/module.c | 1 +
+ net/sunrpc/xprtrdma/transport.c | 1 +
+ net/sunrpc/xprtsock.c | 4 ++
+ 5 files changed, 56 insertions(+), 16 deletions(-)
+
+diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
+index e7bbd82908b10..69fed13e633b7 100644
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -317,6 +317,7 @@ struct xprt_class {
+ struct rpc_xprt * (*setup)(struct xprt_create *);
+ struct module *owner;
+ char name[32];
++ const char * netid[];
+ };
+
+ /*
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 5e7c13aa66d0d..9c4235ce57894 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -143,31 +143,64 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(xprt_unregister_transport);
+
++static void
++xprt_class_release(const struct xprt_class *t)
++{
++ module_put(t->owner);
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid_locked(const char *netid)
++{
++ const struct xprt_class *t;
++ unsigned int i;
++
++ list_for_each_entry(t, &xprt_list, list) {
++ for (i = 0; t->netid[i][0] != '\0'; i++) {
++ if (strcmp(t->netid[i], netid) != 0)
++ continue;
++ if (!try_module_get(t->owner))
++ continue;
++ return t;
++ }
++ }
++ return NULL;
++}
++
++static const struct xprt_class *
++xprt_class_find_by_netid(const char *netid)
++{
++ const struct xprt_class *t;
++
++ spin_lock(&xprt_list_lock);
++ t = xprt_class_find_by_netid_locked(netid);
++ if (!t) {
++ spin_unlock(&xprt_list_lock);
++ request_module("rpc%s", netid);
++ spin_lock(&xprt_list_lock);
++ t = xprt_class_find_by_netid_locked(netid);
++ }
++ spin_unlock(&xprt_list_lock);
++ return t;
++}
++
+ /**
+ * xprt_load_transport - load a transport implementation
+- * @transport_name: transport to load
++ * @netid: transport to load
+ *
+ * Returns:
+ * 0: transport successfully loaded
+ * -ENOENT: transport module not available
+ */
+-int xprt_load_transport(const char *transport_name)
++int xprt_load_transport(const char *netid)
+ {
+- struct xprt_class *t;
+- int result;
++ const struct xprt_class *t;
+
+- result = 0;
+- spin_lock(&xprt_list_lock);
+- list_for_each_entry(t, &xprt_list, list) {
+- if (strcmp(t->name, transport_name) == 0) {
+- spin_unlock(&xprt_list_lock);
+- goto out;
+- }
+- }
+- spin_unlock(&xprt_list_lock);
+- result = request_module("xprt%s", transport_name);
+-out:
+- return result;
++ t = xprt_class_find_by_netid(netid);
++ if (!t)
++ return -ENOENT;
++ xprt_class_release(t);
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(xprt_load_transport);
+
+diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
+index 620327c01302c..45c5b41ac8dc9 100644
+--- a/net/sunrpc/xprtrdma/module.c
++++ b/net/sunrpc/xprtrdma/module.c
+@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport");
+ MODULE_LICENSE("Dual BSD/GPL");
+ MODULE_ALIAS("svcrdma");
+ MODULE_ALIAS("xprtrdma");
++MODULE_ALIAS("rpcrdma6");
+
+ static void __exit rpc_rdma_cleanup(void)
+ {
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index f56f36b4d742d..fdd14908eacbd 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -854,6 +854,7 @@ static struct xprt_class xprt_rdma = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_RDMA,
+ .setup = xprt_setup_rdma,
++ .netid = { "rdma", "rdma6", "" },
+ };
+
+ void xprt_rdma_cleanup(void)
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 9dc059dea689d..798fbd89ed42f 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -3241,6 +3241,7 @@ static struct xprt_class xs_local_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_LOCAL,
+ .setup = xs_setup_local,
++ .netid = { "" },
+ };
+
+ static struct xprt_class xs_udp_transport = {
+@@ -3249,6 +3250,7 @@ static struct xprt_class xs_udp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_UDP,
+ .setup = xs_setup_udp,
++ .netid = { "udp", "udp6", "" },
+ };
+
+ static struct xprt_class xs_tcp_transport = {
+@@ -3257,6 +3259,7 @@ static struct xprt_class xs_tcp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_TCP,
+ .setup = xs_setup_tcp,
++ .netid = { "tcp", "tcp6", "" },
+ };
+
+ static struct xprt_class xs_bc_tcp_transport = {
+@@ -3265,6 +3268,7 @@ static struct xprt_class xs_bc_tcp_transport = {
+ .owner = THIS_MODULE,
+ .ident = XPRT_TRANSPORT_BC_TCP,
+ .setup = xs_setup_bc_tcp,
++ .netid = { "" },
+ };
+
+ /**
+--
+2.27.0
+
--- /dev/null
+From e8aa358a97af99edce4ba1a8b43b77a025035f8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:40 +0000
+Subject: um: chan_xterm: Fix fd leak
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ]
+
+xterm serial channel was leaking a fd used in setting up the
+port helper
+
+This bug is prehistoric - it predates switching to git. The "fixes"
+header here is really just to mark all the versions we would like this to
+apply to which is "Anything from the Cretaceous period onwards".
+
+No dinosaurs were harmed in fixing this bug.
+
+Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/xterm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
+index 20e30be44795b..e3b422ebce09f 100644
+--- a/arch/um/drivers/xterm.c
++++ b/arch/um/drivers/xterm.c
+@@ -18,6 +18,7 @@
+ struct xterm_chan {
+ int pid;
+ int helper_pid;
++ int chan_fd;
+ char *title;
+ int device;
+ int raw;
+@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts)
+ return NULL;
+ *data = ((struct xterm_chan) { .pid = -1,
+ .helper_pid = -1,
++ .chan_fd = -1,
+ .device = device,
+ .title = opts->xterm_title,
+ .raw = opts->raw } );
+@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d,
+ goto out_kill;
+ }
+
++ data->chan_fd = fd;
+ new = xterm_fd(fd, &data->helper_pid);
+ if (new < 0) {
+ err = new;
+@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d)
+ os_kill_process(data->helper_pid, 0);
+ data->helper_pid = -1;
+
++ if (data->chan_fd != -1)
++ os_close_file(data->chan_fd);
+ os_close_file(fd);
+ }
+
+--
+2.27.0
+
--- /dev/null
+From c1546127056dc5086fc3e955ff6371bbbb6b1470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:38 +0000
+Subject: um: Monitor error events in IRQ controller
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ]
+
+Ensure that file closes, connection closes, etc are propagated
+as interrupts in the interrupt controller.
+
+Fixes: ff6a17989c08 ("Epoll based IRQ controller")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
+index 365823010346a..90ef404622805 100644
+--- a/arch/um/os-Linux/irq.c
++++ b/arch/um/os-Linux/irq.c
+@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events)
+ int os_event_mask(int irq_type)
+ {
+ if (irq_type == IRQ_READ)
+- return EPOLLIN | EPOLLPRI;
++ return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP;
+ if (irq_type == IRQ_WRITE)
+ return EPOLLOUT;
+ return 0;
+--
+2.27.0
+
--- /dev/null
+From 1063a52a2c239579bde45b50d8dc31241bc402d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 17:19:39 +0000
+Subject: um: tty: Fix handling of close in tty lines
+
+From: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+
+[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ]
+
+Fix a logical error in tty reading. We get 0 and errno == EAGAIN
+on the first attempt to read from a closed file descriptor.
+
+Compared to that a true EAGAIN is EAGAIN and -1.
+
+If we check errno for EAGAIN first, before checking the return
+value we miss the fact that the descriptor is closed.
+
+This bug is as old as the driver. It was not showing up with
+the original POLL based IRQ controller, because it was
+producing multiple events. Switching to EPOLL unmasked it.
+
+Fixes: ff6a17989c08 ("Epoll based IRQ controller")
+Signed-off-by: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/chan_user.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
+index 3fd7c3efdb18d..9cffbbb15c569 100644
+--- a/arch/um/drivers/chan_user.c
++++ b/arch/um/drivers/chan_user.c
+@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused)
+ n = read(fd, c_out, sizeof(*c_out));
+ if (n > 0)
+ return n;
+- else if (errno == EAGAIN)
+- return 0;
+ else if (n == 0)
+ return -EIO;
++ else if (errno == EAGAIN)
++ return 0;
+ return -errno;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 1e98f789682a3af0f440472b1292ef9b3145a587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 22:57:19 +0800
+Subject: usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ]
+
+The pm_runtime_enable will decrement the power disable depth. Imbalance
+depth will resulted in enabling runtime PM of device fails later. Thus
+a pairing decrement must be needed on the error handling path to keep it
+balanced.
+
+Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs")
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 7d20296cbe9f9..d31c425d61675 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -222,6 +222,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+
+ err_pm_runtime:
+ pm_runtime_put_sync(dev);
++ pm_runtime_disable(dev);
+
+ err_phy:
+ for (i = 0; i < omap->nports; i++) {
+--
+2.27.0
+
--- /dev/null
+From bbb94a4bc165c296863f500ab288ad75a51b1e40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:15:00 +0800
+Subject: usb/max3421: fix return error code in max3421_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ]
+
+retval may be reassigned to 0 after max3421_of_vbus_en_pin(),
+if allocate memory failed after this, max3421_probe() cann't
+return ENOMEM, fix this by moving assign retval afther max3421_probe().
+
+Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/max3421-hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
+index afa321ab55fcf..c9acc59f4addd 100644
+--- a/drivers/usb/host/max3421-hcd.c
++++ b/drivers/usb/host/max3421-hcd.c
+@@ -1864,7 +1864,7 @@ max3421_probe(struct spi_device *spi)
+ struct max3421_hcd *max3421_hcd;
+ struct usb_hcd *hcd = NULL;
+ struct max3421_hcd_platform_data *pdata = NULL;
+- int retval = -ENOMEM;
++ int retval;
+
+ if (spi_setup(spi) < 0) {
+ dev_err(&spi->dev, "Unable to setup SPI bus");
+@@ -1906,6 +1906,7 @@ max3421_probe(struct spi_device *spi)
+ goto error;
+ }
+
++ retval = -ENOMEM;
+ hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev,
+ dev_name(&spi->dev));
+ if (!hcd) {
+--
+2.27.0
+
--- /dev/null
+From e2c43c13959a19925d46e6965e79294a994393a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Nov 2020 22:58:09 +0800
+Subject: usb: oxu210hp-hcd: Fix memory leak in oxu_create
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ]
+
+usb_create_hcd will alloc memory for hcd, and we should
+call usb_put_hcd to free it when adding fails to prevent
+memory leak.
+
+Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/oxu210hp-hcd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
+index c5e6e8d0b5ef5..10d97261b433f 100644
+--- a/drivers/usb/host/oxu210hp-hcd.c
++++ b/drivers/usb/host/oxu210hp-hcd.c
+@@ -3719,8 +3719,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev,
+ oxu->is_otg = otg;
+
+ ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+- if (ret < 0)
++ if (ret < 0) {
++ usb_put_hcd(hcd);
+ return ERR_PTR(ret);
++ }
+
+ device_wakeup_enable(hcd->self.controller);
+ return hcd;
+--
+2.27.0
+
--- /dev/null
+From 1164cd94283b0eaeeaec14c5dbcc39c86d2359d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Nov 2020 12:34:58 -0400
+Subject: vfio-pci: Use io_remap_pfn_range() for PCI IO memory
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ]
+
+commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set
+pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped
+BAR space into userspace to work correctly on AMD SME systems that default
+to all memory encrypted.
+
+Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it
+should be calling io_remap_pfn_range() otherwise it will not work on SME
+systems.
+
+Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking")
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Acked-by: Peter Xu <peterx@redhat.com>
+Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 58e7336b2748b..5e23e4aa5b0a3 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1380,8 +1380,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf)
+
+ mutex_unlock(&vdev->vma_lock);
+
+- if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+- vma->vm_end - vma->vm_start, vma->vm_page_prot))
++ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
++ vma->vm_end - vma->vm_start, vma->vm_page_prot))
+ ret = VM_FAULT_SIGBUS;
+
+ up_out:
+--
+2.27.0
+
--- /dev/null
+From 8e20672fbac30e1e89c01a45146ec773aef498c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:13:50 +0800
+Subject: video: fbdev: atmel_lcdfb: fix return error code in
+ atmel_lcdfb_of_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ]
+
+If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init()
+can't return -ENOMEM, fix this by putting the error code in loop.
+
+Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/atmel_lcdfb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
+index 4ed55e6bbb840..6d01ae3984c73 100644
+--- a/drivers/video/fbdev/atmel_lcdfb.c
++++ b/drivers/video/fbdev/atmel_lcdfb.c
+@@ -1071,8 +1071,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo)
+ }
+
+ INIT_LIST_HEAD(&pdata->pwr_gpios);
+- ret = -ENOMEM;
+ for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) {
++ ret = -ENOMEM;
+ gpiod = devm_gpiod_get_index(dev, "atmel,power-control",
+ i, GPIOD_ASIS);
+ if (IS_ERR(gpiod))
+--
+2.27.0
+
--- /dev/null
+From 6869f47f746c94cc10583bc473e1d40bf4291d7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Dec 2020 23:33:42 +0100
+Subject: watchdog: coh901327: add COMMON_CLK dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ]
+
+clang produces a build failure in configurations without COMMON_CLK
+when a timeout calculation goes wrong:
+
+arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable':
+coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay'
+
+Add a Kconfig dependency to only do build testing when COMMON_CLK
+is enabled.
+
+Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 9feeb8e82d500..fa7f4c61524d9 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -515,7 +515,7 @@ config SUNXI_WATCHDOG
+
+ config COH901327_WATCHDOG
+ bool "ST-Ericsson COH 901 327 watchdog"
+- depends on ARCH_U300 || (ARM && COMPILE_TEST)
++ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST)
+ default y if MACH_U300
+ select WATCHDOG_CORE
+ help
+--
+2.27.0
+
--- /dev/null
+From f4e5c41f1167e239d4f371082e1c7074791f2357 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 13:05:12 +0000
+Subject: watchdog: Fix potential dereferencing of null pointer
+
+From: Wang Wensheng <wangwensheng4@huawei.com>
+
+[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ]
+
+A reboot notifier, which stops the WDT by calling the stop hook without
+any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.
+
+Howerer we allow the WDT driver to omit the stop hook since commit
+"d0684c8a93549" ("watchdog: Make stop function optional") and provide
+a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
+in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
+control reboot policy"). Together that commits make user potential to
+insert a watchdog driver that don't provide a stop hook but with the
+stop_on_reboot parameter set, then dereferencing of null pointer occurs
+on system reboot.
+
+Check the stop hook before registering the reboot notifier to fix the
+issue.
+
+Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
+Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
+index 8b1f37ffb65ac..5c600a3706505 100644
+--- a/drivers/watchdog/watchdog_core.c
++++ b/drivers/watchdog/watchdog_core.c
+@@ -246,15 +246,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
+ }
+
+ if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
+- wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+-
+- ret = register_reboot_notifier(&wdd->reboot_nb);
+- if (ret) {
+- pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+- wdd->id, ret);
+- watchdog_dev_unregister(wdd);
+- ida_simple_remove(&watchdog_ida, id);
+- return ret;
++ if (!wdd->ops->stop)
++ pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
++ else {
++ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
++
++ ret = register_reboot_notifier(&wdd->reboot_nb);
++ if (ret) {
++ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
++ wdd->id, ret);
++ watchdog_dev_unregister(wdd);
++ ida_simple_remove(&watchdog_ida, id);
++ return ret;
++ }
+ }
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 8b81058af9b0c66c0531c0ed5a602b967a0eb845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Dec 2020 11:30:05 +0530
+Subject: watchdog: qcom: Avoid context switch in restart handler
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ]
+
+The use of msleep() in the restart handler will cause scheduler to
+induce a context switch which is not desirable. This generates below
+warning on SDX55 when WDT is the only available restart source:
+
+[ 39.800188] reboot: Restarting system
+[ 39.804115] ------------[ cut here ]------------
+[ 39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764
+[ 39.812538] Modules linked in:
+[ 39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47
+[ 39.824854] Hardware name: Generic DT based system
+[ 39.833470] [<c0310fbc>] (unwind_backtrace) from [<c030c544>] (show_stack+0x10/0x14)
+[ 39.838154] [<c030c544>] (show_stack) from [<c0c218f0>] (dump_stack+0x8c/0xa0)
+[ 39.846049] [<c0c218f0>] (dump_stack) from [<c0322f80>] (__warn+0xd8/0xf0)
+[ 39.853058] [<c0322f80>] (__warn) from [<c0c1dc08>] (warn_slowpath_fmt+0x64/0xc8)
+[ 39.859925] [<c0c1dc08>] (warn_slowpath_fmt) from [<c038b6f4>] (rcu_note_context_switch+0x190/0x764)
+[ 39.867503] [<c038b6f4>] (rcu_note_context_switch) from [<c0c2aa3c>] (__schedule+0x84/0x640)
+[ 39.876685] [<c0c2aa3c>] (__schedule) from [<c0c2b050>] (schedule+0x58/0x10c)
+[ 39.885095] [<c0c2b050>] (schedule) from [<c0c2eed0>] (schedule_timeout+0x1e8/0x3d4)
+[ 39.892135] [<c0c2eed0>] (schedule_timeout) from [<c039ad40>] (msleep+0x2c/0x38)
+[ 39.899947] [<c039ad40>] (msleep) from [<c0a59d0c>] (qcom_wdt_restart+0xc4/0xcc)
+[ 39.907319] [<c0a59d0c>] (qcom_wdt_restart) from [<c0a58290>] (watchdog_restart_notifier+0x18/0x28)
+[ 39.914715] [<c0a58290>] (watchdog_restart_notifier) from [<c03468e0>] (atomic_notifier_call_chain+0x60/0x84)
+[ 39.923487] [<c03468e0>] (atomic_notifier_call_chain) from [<c030ae64>] (machine_restart+0x78/0x7c)
+[ 39.933551] [<c030ae64>] (machine_restart) from [<c0348048>] (__do_sys_reboot+0xdc/0x1e0)
+[ 39.942397] [<c0348048>] (__do_sys_reboot) from [<c0300060>] (ret_fast_syscall+0x0/0x54)
+[ 39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0)
+[ 39.958855] bfa0: 0001221c bed2fe24 fee1dead 28121969 01234567 00000000
+[ 39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000
+[ 39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580
+[ 39.980124] ---[ end trace 3f578288bad866e4 ]---
+
+Hence, replace msleep() with mdelay() to fix this issue.
+
+Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/qcom-wdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
+index 780971318810d..1a0005a8fadb2 100644
+--- a/drivers/watchdog/qcom-wdt.c
++++ b/drivers/watchdog/qcom-wdt.c
+@@ -121,7 +121,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action,
+ */
+ wmb();
+
+- msleep(150);
++ mdelay(150);
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 38140a9cd68c13127c111cfb3946a0a8bc4972e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Nov 2020 08:25:50 -0800
+Subject: watchdog: sirfsoc: Add missing dependency on HAS_IOMEM
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ]
+
+If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled,
+the build fails with the following error.
+
+drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe':
+sirfsoc_wdt.c:(.text+0x112):
+ undefined reference to `devm_platform_ioremap_resource'
+
+Reported-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
+Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 709d4de11f40f..9feeb8e82d500 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -651,6 +651,7 @@ config MOXART_WDT
+
+ config SIRFSOC_WATCHDOG
+ tristate "SiRFSOC watchdog"
++ depends on HAS_IOMEM
+ depends on ARCH_SIRF || COMPILE_TEST
+ select WATCHDOG_CORE
+ default y
+--
+2.27.0
+
--- /dev/null
+From 3c807cdadb3068701959e4f9f1752a3ad8c4ba7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Nov 2020 11:00:54 +0800
+Subject: watchdog: sprd: check busy bit before new loading rather than after
+ that
+
+From: Lingling Xu <ling_ling.xu@unisoc.com>
+
+[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ]
+
+As the specification described, users must check busy bit before start
+a new loading operation to make sure that the previous loading is done
+and the device is ready to accept a new one.
+
+[ chunyan: Massaged changelog ]
+
+Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
+Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201029023933.24548-3-zhang.lyra@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index ffe0346c5d0eb..86cf93af951b5 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -116,18 +116,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+ u32 tmr_step = timeout * SPRD_WDT_CNT_STEP;
+ u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP;
+
+- sprd_wdt_unlock(wdt->base);
+- writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+- SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
+- writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
+- wdt->base + SPRD_WDT_LOAD_LOW);
+- writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
+- SPRD_WDT_LOW_VALUE_MASK,
+- wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
+- writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
+- wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
+- sprd_wdt_lock(wdt->base);
+-
+ /*
+ * Waiting the load value operation done,
+ * it needs two or three RTC clock cycles.
+@@ -142,6 +130,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout,
+
+ if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT)
+ return -EBUSY;
++
++ sprd_wdt_unlock(wdt->base);
++ writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++ SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH);
++ writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK),
++ wdt->base + SPRD_WDT_LOAD_LOW);
++ writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) &
++ SPRD_WDT_LOW_VALUE_MASK,
++ wdt->base + SPRD_WDT_IRQ_LOAD_HIGH);
++ writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK,
++ wdt->base + SPRD_WDT_IRQ_LOAD_LOW);
++ sprd_wdt_lock(wdt->base);
++
+ return 0;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From 9a86468390299cd93dbce1d281b5911f1ae942db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Oct 2020 10:39:31 +0800
+Subject: watchdog: sprd: remove watchdog disable from resume fail path
+
+From: Lingling Xu <ling_ling.xu@unisoc.com>
+
+[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ]
+
+sprd_wdt_start() would return fail if the loading operation is not completed
+in a certain time, disabling watchdog for that case would probably cause
+the kernel crash when kick watchdog later, that's too bad, so remove the
+watchdog disable operation for the fail case to make sure other parts in
+the kernel can run normally.
+
+[ chunyan: Massaged changelog ]
+
+Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver")
+Signed-off-by: Lingling Xu <ling_ling.xu@unisoc.com>
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20201029023933.24548-2-zhang.lyra@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/sprd_wdt.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
+index b6c65afd36778..ffe0346c5d0eb 100644
+--- a/drivers/watchdog/sprd_wdt.c
++++ b/drivers/watchdog/sprd_wdt.c
+@@ -360,15 +360,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev)
+ if (ret)
+ return ret;
+
+- if (watchdog_active(&wdt->wdd)) {
++ if (watchdog_active(&wdt->wdd))
+ ret = sprd_wdt_start(&wdt->wdd);
+- if (ret) {
+- sprd_wdt_disable(wdt);
+- return ret;
+- }
+- }
+
+- return 0;
++ return ret;
+ }
+
+ static const struct dev_pm_ops sprd_wdt_pm_ops = {
+--
+2.27.0
+
--- /dev/null
+From 365c07e051c92c9038450d205f176713dc88181c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Oct 2020 22:35:01 +0100
+Subject: x86/apic: Fix x2apic enablement without interrupt remapping
+
+From: David Woodhouse <dwmw@amazon.co.uk>
+
+[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ]
+
+Currently, Linux as a hypervisor guest will enable x2apic only if there are
+no CPUs present at boot time with an APIC ID above 255.
+
+Hotplugging a CPU later with a higher APIC ID would result in a CPU which
+cannot be targeted by external interrupts.
+
+Add a filter in x2apic_apic_id_valid() which can be used to prevent such
+CPUs from coming online, and allow x2apic to be enabled even if they are
+present at boot time.
+
+Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM")
+Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/apic.h | 1 +
+ arch/x86/kernel/apic/apic.c | 14 ++++++++------
+ arch/x86/kernel/apic/x2apic_phys.c | 9 +++++++++
+ 3 files changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
+index 3c1e51ead0722..cd2aa72e21239 100644
+--- a/arch/x86/include/asm/apic.h
++++ b/arch/x86/include/asm/apic.h
+@@ -252,6 +252,7 @@ static inline u64 native_x2apic_icr_read(void)
+
+ extern int x2apic_mode;
+ extern int x2apic_phys;
++extern void __init x2apic_set_max_apicid(u32 apicid);
+ extern void __init check_x2apic(void);
+ extern void x2apic_setup(void);
+ static inline int x2apic_enabled(void)
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index e9456a2eef585..ab8187271d470 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1813,20 +1813,22 @@ static __init void try_to_enable_x2apic(int remap_mode)
+ return;
+
+ if (remap_mode != IRQ_REMAP_X2APIC_MODE) {
+- /* IR is required if there is APIC ID > 255 even when running
+- * under KVM
++ /*
++ * Using X2APIC without IR is not architecturally supported
++ * on bare metal but may be supported in guests.
+ */
+- if (max_physical_apicid > 255 ||
+- !x86_init.hyper.x2apic_available()) {
++ if (!x86_init.hyper.x2apic_available()) {
+ pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n");
+ x2apic_disable();
+ return;
+ }
+
+ /*
+- * without IR all CPUs can be addressed by IOAPIC/MSI
+- * only in physical mode
++ * Without IR, all CPUs can be addressed by IOAPIC/MSI only
++ * in physical mode, and CPUs with an APIC ID that cannnot
++ * be addressed must not be brought online.
+ */
++ x2apic_set_max_apicid(255);
+ x2apic_phys = 1;
+ }
+ x2apic_enable();
+diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
+index b5cf9e7b3830c..ed56d2850e96a 100644
+--- a/arch/x86/kernel/apic/x2apic_phys.c
++++ b/arch/x86/kernel/apic/x2apic_phys.c
+@@ -13,6 +13,12 @@
+ int x2apic_phys;
+
+ static struct apic apic_x2apic_phys;
++static u32 x2apic_max_apicid __ro_after_init;
++
++void __init x2apic_set_max_apicid(u32 apicid)
++{
++ x2apic_max_apicid = apicid;
++}
+
+ static int __init set_x2apic_phys_mode(char *arg)
+ {
+@@ -103,6 +109,9 @@ static int x2apic_phys_probe(void)
+ /* Common x2apic functions, also used by x2apic_cluster */
+ int x2apic_apic_id_valid(u32 apicid)
+ {
++ if (x2apic_max_apicid && apicid > x2apic_max_apicid)
++ return 0;
++
+ return 1;
+ }
+
+--
+2.27.0
+
--- /dev/null
+From df99af8b45410656a6592081a9f8a76a9c5a4cf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Oct 2020 23:31:10 +0900
+Subject: x86/kprobes: Restore BTF if the single-stepping is cancelled
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ]
+
+Fix to restore BTF if single-stepping causes a page fault and
+it is cancelled.
+
+Usually the BTF flag was restored when the single stepping is done
+(in resume_execution()). However, if a page fault happens on the
+single stepping instruction, the fault handler is invoked and
+the single stepping is cancelled. Thus, the BTF flag is not
+restored.
+
+Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 07e290244ca94..dfc3ab44bc5d3 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1041,6 +1041,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
+ * So clear it by resetting the current kprobe:
+ */
+ regs->flags &= ~X86_EFLAGS_TF;
++ /*
++ * Since the single step (trap) has been cancelled,
++ * we need to restore BTF here.
++ */
++ restore_btf();
+
+ /*
+ * If the TF flag was set before the kprobe hit,
+--
+2.27.0
+
--- /dev/null
+From 02c5dc0ad7878af975ac65a52106adce3c912d0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Oct 2020 19:06:48 -0400
+Subject: x86/mm/ident_map: Check for errors from ident_pud_init()
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ]
+
+Commit
+
+ ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
+
+added ident_p4d_init() to support 5-level paging, but this function
+doesn't check and return errors from ident_pud_init().
+
+For example, the decompressor stub uses this code to create an identity
+mapping. If it runs out of pages while trying to allocate a PMD
+pagetable, the error will be currently ignored.
+
+Fix this to propagate errors.
+
+ [ bp: Space out statements for better readability. ]
+
+Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support")
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Joerg Roedel <jroedel@suse.de>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/ident_map.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
+index fe7a12599d8eb..968d7005f4a72 100644
+--- a/arch/x86/mm/ident_map.c
++++ b/arch/x86/mm/ident_map.c
+@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+ unsigned long addr, unsigned long end)
+ {
+ unsigned long next;
++ int result;
+
+ for (; addr < end; addr = next) {
+ p4d_t *p4d = p4d_page + p4d_index(addr);
+@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page,
+
+ if (p4d_present(*p4d)) {
+ pud = pud_offset(p4d, 0);
+- ident_pud_init(info, pud, addr, next);
++ result = ident_pud_init(info, pud, addr, next);
++ if (result)
++ return result;
++
+ continue;
+ }
+ pud = (pud_t *)info->alloc_pgt_page(info->context);
+ if (!pud)
+ return -ENOMEM;
+- ident_pud_init(info, pud, addr, next);
++
++ result = ident_pud_init(info, pud, addr, next);
++ if (result)
++ return result;
++
+ set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag));
+ }
+
+--
+2.27.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
