--- /dev/null
+From 5651a9cea76596a16a7b38dc6153cda355fe1f7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Aug 2021 14:05:33 -0700
+Subject: ARC: export clear_user_page() for modules
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 6b5ff0405e4190f23780362ea324b250bc495683 ]
+
+0day bot reports a build error:
+ ERROR: modpost: "clear_user_page" [drivers/media/v4l2-core/videobuf-dma-sg.ko] undefined!
+so export it in arch/arc/ to fix the build error.
+
+In most ARCHes, clear_user_page() is a macro. OTOH, in a few
+ARCHes it is a function and needs to be exported.
+PowerPC exported it in 2004. It looks like nds32 and nios2
+still need to have it exported.
+
+Fixes: 4102b53392d63 ("ARC: [mm] Aliasing VIPT dcache support 2/4")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: linux-snps-arc@lists.infradead.org
+Signed-off-by: Vineet Gupta <vgupta@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/mm/cache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index a2fbea3ee07c..102418ac5ff4 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -1123,7 +1123,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page)
+ clear_page(to);
+ clear_bit(PG_dc_clean, &page->flags);
+ }
+-
++EXPORT_SYMBOL(clear_user_page);
+
+ /**********************************************************************
+ * Explicit Cache flush request from user space via syscall
+--
+2.30.2
+
--- /dev/null
+From 33fd649c9f641ca561f368eb742eeb95170253a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Jul 2021 13:36:36 +0200
+Subject: backlight: ktd253: Stabilize backlight
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit daa37361518bf2d1f591bbdaa7c68b2a43d7af48 ]
+
+Remove interrupt disablement during backlight setting. It is
+way to dangerous and makes platforms instable by having it
+miss vblank IRQs leading to the graphics derailing.
+
+The code is using ndelay() which is not available on
+platforms such as ARM and will result in 32 * udelay(1)
+which is substantial.
+
+Add some code to detect if an interrupt occurs during the
+tight loop and in that case just redo it from the top.
+
+Fixes: 5317f37e48b9 ("backlight: Add Kinetic KTD253 backlight driver")
+Cc: Stephan Gerhold <stephan@gerhold.net>
+Reported-by: newbyte@disroot.org
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/ktd253-backlight.c | 75 ++++++++++++++++------
+ 1 file changed, 55 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/video/backlight/ktd253-backlight.c b/drivers/video/backlight/ktd253-backlight.c
+index e3fee3f1f582..9d355fd989d8 100644
+--- a/drivers/video/backlight/ktd253-backlight.c
++++ b/drivers/video/backlight/ktd253-backlight.c
+@@ -25,6 +25,7 @@
+
+ #define KTD253_T_LOW_NS (200 + 10) /* Additional 10ns as safety factor */
+ #define KTD253_T_HIGH_NS (200 + 10) /* Additional 10ns as safety factor */
++#define KTD253_T_OFF_CRIT_NS 100000 /* 100 us, now it doesn't look good */
+ #define KTD253_T_OFF_MS 3
+
+ struct ktd253_backlight {
+@@ -34,13 +35,50 @@ struct ktd253_backlight {
+ u16 ratio;
+ };
+
++static void ktd253_backlight_set_max_ratio(struct ktd253_backlight *ktd253)
++{
++ gpiod_set_value_cansleep(ktd253->gpiod, 1);
++ ndelay(KTD253_T_HIGH_NS);
++ /* We always fall back to this when we power on */
++}
++
++static int ktd253_backlight_stepdown(struct ktd253_backlight *ktd253)
++{
++ /*
++ * These GPIO operations absolutely can NOT sleep so no _cansleep
++ * suffixes, and no using GPIO expanders on slow buses for this!
++ *
++ * The maximum number of cycles of the loop is 32 so the time taken
++ * should nominally be:
++ * (T_LOW_NS + T_HIGH_NS + loop_time) * 32
++ *
++ * Architectures do not always support ndelay() and we will get a few us
++ * instead. If we get to a critical time limit an interrupt has likely
++ * occured in the low part of the loop and we need to restart from the
++ * top so we have the backlight in a known state.
++ */
++ u64 ns;
++
++ ns = ktime_get_ns();
++ gpiod_set_value(ktd253->gpiod, 0);
++ ndelay(KTD253_T_LOW_NS);
++ gpiod_set_value(ktd253->gpiod, 1);
++ ns = ktime_get_ns() - ns;
++ if (ns >= KTD253_T_OFF_CRIT_NS) {
++ dev_err(ktd253->dev, "PCM on backlight took too long (%llu ns)\n", ns);
++ return -EAGAIN;
++ }
++ ndelay(KTD253_T_HIGH_NS);
++ return 0;
++}
++
+ static int ktd253_backlight_update_status(struct backlight_device *bl)
+ {
+ struct ktd253_backlight *ktd253 = bl_get_data(bl);
+ int brightness = backlight_get_brightness(bl);
+ u16 target_ratio;
+ u16 current_ratio = ktd253->ratio;
+- unsigned long flags;
++ int ret;
+
+ dev_dbg(ktd253->dev, "new brightness/ratio: %d/32\n", brightness);
+
+@@ -62,37 +100,34 @@ static int ktd253_backlight_update_status(struct backlight_device *bl)
+ }
+
+ if (current_ratio == 0) {
+- gpiod_set_value_cansleep(ktd253->gpiod, 1);
+- ndelay(KTD253_T_HIGH_NS);
+- /* We always fall back to this when we power on */
++ ktd253_backlight_set_max_ratio(ktd253);
+ current_ratio = KTD253_MAX_RATIO;
+ }
+
+- /*
+- * WARNING:
+- * The loop to set the correct current level is performed
+- * with interrupts disabled as it is timing critical.
+- * The maximum number of cycles of the loop is 32
+- * so the time taken will be (T_LOW_NS + T_HIGH_NS + loop_time) * 32,
+- */
+- local_irq_save(flags);
+ while (current_ratio != target_ratio) {
+ /*
+ * These GPIO operations absolutely can NOT sleep so no
+ * _cansleep suffixes, and no using GPIO expanders on
+ * slow buses for this!
+ */
+- gpiod_set_value(ktd253->gpiod, 0);
+- ndelay(KTD253_T_LOW_NS);
+- gpiod_set_value(ktd253->gpiod, 1);
+- ndelay(KTD253_T_HIGH_NS);
+- /* After 1/32 we loop back to 32/32 */
+- if (current_ratio == KTD253_MIN_RATIO)
++ ret = ktd253_backlight_stepdown(ktd253);
++ if (ret == -EAGAIN) {
++ /*
++ * Something disturbed the backlight setting code when
++ * running so we need to bring the PWM back to a known
++ * state. This shouldn't happen too much.
++ */
++ gpiod_set_value_cansleep(ktd253->gpiod, 0);
++ msleep(KTD253_T_OFF_MS);
++ ktd253_backlight_set_max_ratio(ktd253);
++ current_ratio = KTD253_MAX_RATIO;
++ } else if (current_ratio == KTD253_MIN_RATIO) {
++ /* After 1/32 we loop back to 32/32 */
+ current_ratio = KTD253_MAX_RATIO;
+- else
++ } else {
+ current_ratio--;
++ }
+ }
+- local_irq_restore(flags);
+ ktd253->ratio = current_ratio;
+
+ dev_dbg(ktd253->dev, "new ratio set to %d/32\n", target_ratio);
+--
+2.30.2
+
--- /dev/null
+From c52a52890318fda0a78c891a7254260876b9b5af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 16:13:52 +0200
+Subject: block, bfq: honor already-setup queue merges
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b ]
+
+The function bfq_setup_merge prepares the merging between two
+bfq_queues, say bfqq and new_bfqq. To this goal, it assigns
+bfqq->new_bfqq = new_bfqq. Then, each time some I/O for bfqq arrives,
+the process that generated that I/O is disassociated from bfqq and
+associated with new_bfqq (merging is actually a redirection). In this
+respect, bfq_setup_merge increases new_bfqq->ref in advance, adding
+the number of processes that are expected to be associated with
+new_bfqq.
+
+Unfortunately, the stable-merging mechanism interferes with this
+setup. After bfqq->new_bfqq has been set by bfq_setup_merge, and
+before all the expected processes have been associated with
+bfqq->new_bfqq, bfqq may happen to be stably merged with a different
+queue than the current bfqq->new_bfqq. In this case, bfqq->new_bfqq
+gets changed. So, some of the processes that have been already
+accounted for in the ref counter of the previous new_bfqq will not be
+associated with that queue. This creates an unbalance, because those
+references will never be decremented.
+
+This commit fixes this issue by reestablishing the previous, natural
+behaviour: once bfqq->new_bfqq has been set, it will not be changed
+until all expected redirections have occurred.
+
+Signed-off-by: Davide Zini <davidezini2@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Link: https://lore.kernel.org/r/20210802141352.74353-2-paolo.valente@linaro.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index b8c2ddc01aec..65c200e0ecb5 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2526,6 +2526,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
+ * are likely to increase the throughput.
+ */
+ bfqq->new_bfqq = new_bfqq;
++ /*
++ * The above assignment schedules the following redirections:
++ * each time some I/O for bfqq arrives, the process that
++ * generated that I/O is disassociated from bfqq and
++ * associated with new_bfqq. Here we increases new_bfqq->ref
++ * in advance, adding the number of processes that are
++ * expected to be associated with new_bfqq as they happen to
++ * issue I/O.
++ */
+ new_bfqq->ref += process_refs;
+ return new_bfqq;
+ }
+@@ -2585,6 +2594,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ {
+ struct bfq_queue *in_service_bfqq, *new_bfqq;
+
++ /* if a merge has already been setup, then proceed with that first */
++ if (bfqq->new_bfqq)
++ return bfqq->new_bfqq;
++
+ /*
+ * Do not perform queue merging if the device is non
+ * rotational and performs internal queueing. In fact, such a
+@@ -2639,9 +2652,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
+ if (bfq_too_late_for_merging(bfqq))
+ return NULL;
+
+- if (bfqq->new_bfqq)
+- return bfqq->new_bfqq;
+-
+ if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
+ return NULL;
+
+--
+2.30.2
+
--- /dev/null
+From edc235f1ce447ba8c6bba017b782d20a3b9ceb3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 02:08:20 -0500
+Subject: bnxt_en: Consolidate firmware reset event logging.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 5863b10aa86a5f5f69a25b55a5c15806c834471a ]
+
+Combine the three netdev_warn() calls into a single call, printed at
+the NETIF_MSG_HW log level.
+
+Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 621634d40966..4ee77e1c8de0 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -2082,10 +2082,9 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ goto async_event_process_exit;
+ set_bit(BNXT_RESET_TASK_SILENT_SP_EVENT, &bp->sp_event);
+ break;
+- case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY:
+- if (netif_msg_hw(bp))
+- netdev_warn(bp->dev, "Received RESET_NOTIFY event, data1: 0x%x, data2: 0x%x\n",
+- data1, data2);
++ case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY: {
++ char *fatal_str = "non-fatal";
++
+ if (!bp->fw_health)
+ goto async_event_process_exit;
+
+@@ -2097,14 +2096,18 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ if (!bp->fw_reset_max_dsecs)
+ bp->fw_reset_max_dsecs = BNXT_DFLT_FW_RST_MAX_DSECS;
+ if (EVENT_DATA1_RESET_NOTIFY_FATAL(data1)) {
+- netdev_warn(bp->dev, "Firmware fatal reset event received\n");
++ fatal_str = "fatal";
+ set_bit(BNXT_STATE_FW_FATAL_COND, &bp->state);
+- } else {
+- netdev_warn(bp->dev, "Firmware non-fatal reset event received, max wait time %d msec\n",
++ }
++ if (netif_msg_hw(bp)) {
++ netdev_warn(bp->dev, "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
++ fatal_str, data1, data2,
++ bp->fw_reset_min_dsecs * 100,
+ bp->fw_reset_max_dsecs * 100);
+ }
+ set_bit(BNXT_FW_RESET_NOTIFY_SP_EVENT, &bp->sp_event);
+ break;
++ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_ERROR_RECOVERY: {
+ struct bnxt_fw_health *fw_health = bp->fw_health;
+
+--
+2.30.2
+
--- /dev/null
+From ffbaf9576d8774556b4610c7e303c23b56a0e2bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jan 2021 01:20:24 -0500
+Subject: bnxt_en: Convert to use netif_level() helpers.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 871127e6ab0d6abb904cec81fc022baf6953be1f ]
+
+Use the various netif_level() helpers to simplify the C code. This was
+suggested by Joe Perches.
+
+Cc: Joe Perches <joe@perches.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/1611642024-3166-1-git-send-email-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 34 ++++++++++-------------
+ 1 file changed, 14 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 4ee77e1c8de0..563a169e06ca 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -1305,8 +1305,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
+ } else {
+ tpa_info->hash_type = PKT_HASH_TYPE_NONE;
+ tpa_info->gso_type = 0;
+- if (netif_msg_rx_err(bp))
+- netdev_warn(bp->dev, "TPA packet without valid hash\n");
++ netif_warn(bp, rx_err, bp->dev, "TPA packet without valid hash\n");
+ }
+ tpa_info->flags2 = le32_to_cpu(tpa_start1->rx_tpa_start_cmp_flags2);
+ tpa_info->metadata = le32_to_cpu(tpa_start1->rx_tpa_start_cmp_metadata);
+@@ -2099,12 +2098,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ fatal_str = "fatal";
+ set_bit(BNXT_STATE_FW_FATAL_COND, &bp->state);
+ }
+- if (netif_msg_hw(bp)) {
+- netdev_warn(bp->dev, "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
+- fatal_str, data1, data2,
+- bp->fw_reset_min_dsecs * 100,
+- bp->fw_reset_max_dsecs * 100);
+- }
++ netif_warn(bp, hw, bp->dev,
++ "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
++ fatal_str, data1, data2,
++ bp->fw_reset_min_dsecs * 100,
++ bp->fw_reset_max_dsecs * 100);
+ set_bit(BNXT_FW_RESET_NOTIFY_SP_EVENT, &bp->sp_event);
+ break;
+ }
+@@ -2119,13 +2117,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ if (!fw_health->enabled)
+ break;
+
+- if (netif_msg_drv(bp))
+- netdev_info(bp->dev, "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
+- fw_health->enabled, fw_health->master,
+- bnxt_fw_health_readl(bp,
+- BNXT_FW_RESET_CNT_REG),
+- bnxt_fw_health_readl(bp,
+- BNXT_FW_HEALTH_REG));
++ netif_info(bp, drv, bp->dev,
++ "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
++ fw_health->enabled, fw_health->master,
++ bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG),
++ bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
+ fw_health->tmr_multiplier =
+ DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
+ bp->current_interval * 10);
+@@ -2137,11 +2133,9 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ goto async_event_process_exit;
+ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
+- if (netif_msg_hw(bp)) {
+- netdev_notice(bp->dev,
+- "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
+- data1, data2);
+- }
++ netif_notice(bp, hw, bp->dev,
++ "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
++ data1, data2);
+ goto async_event_process_exit;
+ case ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG: {
+ struct bnxt_rx_ring_info *rxr;
+--
+2.30.2
+
--- /dev/null
+From 80c39a3a67d9688969ab50c50adc048c6f60785d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 14:10:57 -0400
+Subject: bnxt_en: Fix asic.rev in devlink dev info command
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 6fdab8a3ade2adc123bbf5c4fdec3394560b1fb1 ]
+
+The current asic.rev is incomplete and does not include the metal
+revision. Add the metal revision and decode the complete asic
+revision into the more common and readable form (A0, B0, etc).
+
+Fixes: 7154917a12b2 ("bnxt_en: Refactor bnxt_dl_info_get().")
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+index 2bd476a501bd..e2fd625fc6d2 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -452,7 +452,7 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
+ return rc;
+
+ ver_resp = &bp->ver_resp;
+- sprintf(buf, "%X", ver_resp->chip_rev);
++ sprintf(buf, "%c%d", 'A' + ver_resp->chip_rev, ver_resp->chip_metal);
+ rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_FIXED,
+ DEVLINK_INFO_VERSION_GENERIC_ASIC_REV, buf);
+ if (rc)
+--
+2.30.2
+
--- /dev/null
+From 8e611e91e28815870de94d399eb472c084851107 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 14:10:59 -0400
+Subject: bnxt_en: Fix possible unintended driver initiated error recovery
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 1b2b91831983aeac3adcbb469aa8b0dc71453f89 ]
+
+If error recovery is already enabled, bnxt_timer() will periodically
+check the heartbeat register and the reset counter. If we get an
+error recovery async. notification from the firmware (e.g. change in
+primary/secondary role), we will immediately read and update the
+heartbeat register and the reset counter. If the timer for the next
+health check expires soon after this, we may read the heartbeat register
+again in quick succession and find that it hasn't changed. This will
+trigger error recovery unintentionally.
+
+The likelihood is small because we also reset fw_health->tmr_counter
+which will reset the interval for the next health check. But the
+update is not protected and bnxt_timer() can miss the update and
+perform the health check without waiting for the full interval.
+
+Fix it by only reading the heartbeat register and reset counter in
+bnxt_async_event_process() if error recovery is trasitioning to the
+enabled state. Also add proper memory barriers so that when enabling
+for the first time, bnxt_timer() will see the tmr_counter interval and
+perform the health check after the full interval has elapsed.
+
+Fixes: 7e914027f757 ("bnxt_en: Enable health monitoring.")
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 4c1c41495e9f..71656e669755 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -2112,25 +2112,34 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ if (!fw_health)
+ goto async_event_process_exit;
+
+- fw_health->enabled = EVENT_DATA1_RECOVERY_ENABLED(data1);
+- fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
+- if (!fw_health->enabled) {
++ if (!EVENT_DATA1_RECOVERY_ENABLED(data1)) {
++ fw_health->enabled = false;
+ netif_info(bp, drv, bp->dev,
+ "Error recovery info: error recovery[0]\n");
+ break;
+ }
++ fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
+ fw_health->tmr_multiplier =
+ DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
+ bp->current_interval * 10);
+ fw_health->tmr_counter = fw_health->tmr_multiplier;
+- fw_health->last_fw_heartbeat =
+- bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
+- fw_health->last_fw_reset_cnt =
+- bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
++ if (!fw_health->enabled) {
++ fw_health->last_fw_heartbeat =
++ bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
++ fw_health->last_fw_reset_cnt =
++ bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
++ }
+ netif_info(bp, drv, bp->dev,
+ "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n",
+ fw_health->master, fw_health->last_fw_reset_cnt,
+ bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
++ if (!fw_health->enabled) {
++ /* Make sure tmr_counter is set and visible to
++ * bnxt_health_check() before setting enabled to true.
++ */
++ smp_wmb();
++ fw_health->enabled = true;
++ }
+ goto async_event_process_exit;
+ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
+@@ -10738,6 +10747,8 @@ static void bnxt_fw_health_check(struct bnxt *bp)
+ if (!fw_health->enabled || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))
+ return;
+
++ /* Make sure it is enabled before checking the tmr_counter. */
++ smp_rmb();
+ if (fw_health->tmr_counter) {
+ fw_health->tmr_counter--;
+ return;
+--
+2.30.2
+
--- /dev/null
+From 48a6e7fe7040549bce722cc7c37a8134a55da564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 14:10:55 -0400
+Subject: bnxt_en: fix stored FW_PSID version masks
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit 1656db67233e4259281d2ac35b25f712edbbc20b ]
+
+The FW_PSID version components are 8 bits wide, not 4.
+
+Fixes: db28b6c77f40 ("bnxt_en: Fix devlink info's stored fw.psid version format.")
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+index 8b0e916afe6b..2bd476a501bd 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+@@ -474,8 +474,8 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
+ if (BNXT_PF(bp) && !bnxt_hwrm_get_nvm_cfg_ver(bp, &nvm_cfg_ver)) {
+ u32 ver = nvm_cfg_ver.vu32;
+
+- sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xf, (ver >> 8) & 0xf,
+- ver & 0xf);
++ sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xff, (ver >> 8) & 0xff,
++ ver & 0xff);
+ rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_STORED,
+ DEVLINK_INFO_VERSION_GENERIC_FW_PSID,
+ buf);
+--
+2.30.2
+
--- /dev/null
+From b1aebf9a13c7ee0c1f928cbb0a59d5cff76c8c9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Feb 2021 18:05:01 -0500
+Subject: bnxt_en: Improve logging of error recovery settings information.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit f4d95c3c194de04ae7b44f850131321c7ceb9312 ]
+
+We currently only log the error recovery settings if it is enabled.
+In some cases, firmware disables error recovery after it was
+initially enabled. Without logging anything, the user will not be
+aware of this change in setting.
+
+Log it when error recovery is disabled. Also, change the reset count
+value from hexadecimal to decimal.
+
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 563a169e06ca..4c1c41495e9f 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -2114,14 +2114,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
+
+ fw_health->enabled = EVENT_DATA1_RECOVERY_ENABLED(data1);
+ fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
+- if (!fw_health->enabled)
++ if (!fw_health->enabled) {
++ netif_info(bp, drv, bp->dev,
++ "Error recovery info: error recovery[0]\n");
+ break;
+-
+- netif_info(bp, drv, bp->dev,
+- "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
+- fw_health->enabled, fw_health->master,
+- bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG),
+- bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
++ }
+ fw_health->tmr_multiplier =
+ DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
+ bp->current_interval * 10);
+@@ -2130,6 +2127,10 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
+ fw_health->last_fw_reset_cnt =
+ bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
++ netif_info(bp, drv, bp->dev,
++ "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n",
++ fw_health->master, fw_health->last_fw_reset_cnt,
++ bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
+ goto async_event_process_exit;
+ }
+ case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
+--
+2.30.2
+
--- /dev/null
+From 5fd3df6cede412ff2b688544bc6305a0a23ace28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jan 2021 02:08:13 -0500
+Subject: bnxt_en: log firmware debug notifications
+
+From: Edwin Peer <edwin.peer@broadcom.com>
+
+[ Upstream commit a44daa8fcbcf572545c4c1a7908b3fbb38388048 ]
+
+Firmware is capable of generating asynchronous debug notifications.
+The event data is opaque to the driver and is simply logged. Debug
+notifications can be enabled by turning on hardware status messages
+using the ethtool msglvl interface.
+
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 1def6caba349..621634d40966 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -272,6 +272,7 @@ static const u16 bnxt_async_events_arr[] = {
+ ASYNC_EVENT_CMPL_EVENT_ID_PORT_PHY_CFG_CHANGE,
+ ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY,
+ ASYNC_EVENT_CMPL_EVENT_ID_ERROR_RECOVERY,
++ ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION,
+ ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG,
+ };
+
+@@ -2132,6 +2133,13 @@ static int bnxt_async_event_process(struct bnxt *bp,
+ bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
+ goto async_event_process_exit;
+ }
++ case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
++ if (netif_msg_hw(bp)) {
++ netdev_notice(bp->dev,
++ "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
++ data1, data2);
++ }
++ goto async_event_process_exit;
+ case ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG: {
+ struct bnxt_rx_ring_info *rxr;
+ u16 grp_idx;
+--
+2.30.2
+
--- /dev/null
+From 1fd065f2fdb01e469fb17c4b085f092e7de62c46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jun 2021 16:39:45 +0200
+Subject: dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 778cb8e39f6ec252be50fc3850d66f3dcbd5dd5a ]
+
+"PAGESIZE / 512" is the number of ECC chunks.
+"ECC_BYTES" is the number of bytes needed to store a single ECC code.
+"2" is the space reserved by the bad block marker.
+
+"2 + (PAGESIZE / 512) * ECC_BYTES" should of course be lower or equal
+than the total number of OOB bytes, otherwise it won't fit.
+
+Fix the equation by substituting s/>=/<=/.
+
+Suggested-by: Ryan J. Barnett <ryan.barnett@collins.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/linux-mtd/20210610143945.3504781-1-miquel.raynal@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mtd/gpmc-nand.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+index 44919d48d241..c459f169a904 100644
+--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
++++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+@@ -122,7 +122,7 @@ on various other factors also like;
+ so the device should have enough free bytes available its OOB/Spare
+ area to accommodate ECC for entire page. In general following expression
+ helps in determining if given device can accommodate ECC syndrome:
+- "2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE"
++ "2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE"
+ where
+ OOBSIZE number of bytes in OOB/spare area
+ PAGESIZE number of bytes in main-area of device page
+--
+2.30.2
+
--- /dev/null
+From 2d4af09f7d7850bb677f801fe35749bb782a5c86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 14:42:33 +0800
+Subject: ethtool: Fix an error code in cxgb2.c
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 7db8263a12155c7ae4ad97e850f1e499c73765fc ]
+
+When adapter->registered_device_map is NULL, the value of err is
+uncertain, we set err to -EINVAL to avoid ambiguity.
+
+Clean up smatch warning:
+drivers/net/ethernet/chelsio/cxgb/cxgb2.c:1114 init_one() warn: missing
+error code 'err'
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+index 0e4a0f413960..c6db85fe1629 100644
+--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
++++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+@@ -1153,6 +1153,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!adapter->registered_device_map) {
+ pr_err("%s: could not register any net devices\n",
+ pci_name(pdev));
++ err = -EINVAL;
+ goto out_release_adapter_res;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 6ae588a18243804fcc4a42688b7d9f21d37cddae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 15:03:43 -0700
+Subject: fq_codel: reject silly quantum parameters
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ]
+
+syzbot found that forcing a big quantum attribute would crash hosts fast,
+essentially using this:
+
+tc qd replace dev eth0 root fq_codel quantum 4294967295
+
+This is because fq_codel_dequeue() would have to loop
+~2^31 times in :
+
+ if (flow->deficit <= 0) {
+ flow->deficit += q->quantum;
+ list_move_tail(&flow->flowchain, &q->old_flows);
+ goto begin;
+ }
+
+SFQ max quantum is 2^19 (half a megabyte)
+Lets adopt a max quantum of one megabyte for FQ_CODEL.
+
+Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/pkt_sched.h | 2 ++
+ net/sched/sch_fq_codel.c | 12 ++++++++++--
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
+index 9e7c2c607845..69079fbf3ed2 100644
+--- a/include/uapi/linux/pkt_sched.h
++++ b/include/uapi/linux/pkt_sched.h
+@@ -826,6 +826,8 @@ struct tc_codel_xstats {
+
+ /* FQ_CODEL */
+
++#define FQ_CODEL_QUANTUM_MAX (1 << 20)
++
+ enum {
+ TCA_FQ_CODEL_UNSPEC,
+ TCA_FQ_CODEL_TARGET,
+diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
+index bbd5f8753600..99e8db262198 100644
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -369,6 +369,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ {
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+ struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
++ u32 quantum = 0;
+ int err;
+
+ if (!opt)
+@@ -386,6 +387,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ q->flows_cnt > 65536)
+ return -EINVAL;
+ }
++ if (tb[TCA_FQ_CODEL_QUANTUM]) {
++ quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++ if (quantum > FQ_CODEL_QUANTUM_MAX) {
++ NL_SET_ERR_MSG(extack, "Invalid quantum");
++ return -EINVAL;
++ }
++ }
+ sch_tree_lock(sch);
+
+ if (tb[TCA_FQ_CODEL_TARGET]) {
+@@ -412,8 +420,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
+ if (tb[TCA_FQ_CODEL_ECN])
+ q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
+
+- if (tb[TCA_FQ_CODEL_QUANTUM])
+- q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
++ if (quantum)
++ q->quantum = quantum;
+
+ if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])
+ q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));
+--
+2.30.2
+
--- /dev/null
+From 7835cac208a51022bba1d4399215ddaca57de99d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Aug 2021 13:22:58 +0200
+Subject: fuse: fix use after free in fuse_read_interrupt()
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ]
+
+There is a potential race between fuse_read_interrupt() and
+fuse_request_end().
+
+TASK1
+ in fuse_read_interrupt(): delete req->intr_entry (while holding
+ fiq->lock)
+
+TASK2
+ in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
+ wake up TASK3
+
+TASK3
+ request is freed
+
+TASK1
+ in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***
+
+Fix by always grabbing fiq->lock if the request was ever interrupted
+(FR_INTERRUPTED set) thereby serializing with concurrent
+fuse_read_interrupt() calls.
+
+FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
+Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
+cleared in this case.
+
+Reported-by: lijiazi <lijiazi@xiaomi.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 4140d5c3ab5a..f943eea9fe4e 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -288,10 +288,10 @@ void fuse_request_end(struct fuse_req *req)
+
+ /*
+ * test_and_set_bit() implies smp_mb() between bit
+- * changing and below intr_entry check. Pairs with
++ * changing and below FR_INTERRUPTED check. Pairs with
+ * smp_mb() from queue_interrupt().
+ */
+- if (!list_empty(&req->intr_entry)) {
++ if (test_bit(FR_INTERRUPTED, &req->flags)) {
+ spin_lock(&fiq->lock);
+ list_del_init(&req->intr_entry);
+ spin_unlock(&fiq->lock);
+--
+2.30.2
+
--- /dev/null
+From d3901a8c18684cfbe6927a99776907163fe9e36f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 17:38:03 +0200
+Subject: gpio: mpc8xxx: Fix a potential double iounmap call in
+ 'mpc8xxx_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 7d6588931ccd4c09e70a08175cf2e0cf7fc3b869 ]
+
+Commit 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support") has switched to a
+managed version when dealing with 'mpc8xxx_gc->regs'. So the corresponding
+'iounmap()' call in the error handling path and in the remove should be
+removed to avoid a double unmap.
+
+This also allows some simplification in the probe. All the error handling
+paths related to managed resources can be direct returns and a NULL check
+in what remains in the error handling path can be removed.
+
+Fixes: 76c47d1449fc ("gpio: mpc8xxx: Add ACPI support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mpc8xxx.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 5b2a919a6644..a4983c5d1f16 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -329,7 +329,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ mpc8xxx_gc->regs + GPIO_DIR, NULL,
+ BGPIOF_BIG_ENDIAN);
+ if (ret)
+- goto err;
++ return ret;
+ dev_dbg(&pdev->dev, "GPIO registers are LITTLE endian\n");
+ } else {
+ ret = bgpio_init(gc, &pdev->dev, 4,
+@@ -339,7 +339,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ BGPIOF_BIG_ENDIAN
+ | BGPIOF_BIG_ENDIAN_BYTE_ORDER);
+ if (ret)
+- goto err;
++ return ret;
+ dev_dbg(&pdev->dev, "GPIO registers are BIG endian\n");
+ }
+
+@@ -378,7 +378,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ if (ret) {
+ pr_err("%pOF: GPIO chip registration failed with status %d\n",
+ np, ret);
+- goto err;
++ return ret;
+ }
+
+ mpc8xxx_gc->irqn = irq_of_parse_and_map(np, 0);
+@@ -406,9 +406,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+
+ return 0;
+ err:
+- if (mpc8xxx_gc->irq)
+- irq_domain_remove(mpc8xxx_gc->irq);
+- iounmap(mpc8xxx_gc->regs);
++ irq_domain_remove(mpc8xxx_gc->irq);
+ return ret;
+ }
+
+@@ -422,7 +420,6 @@ static int mpc8xxx_remove(struct platform_device *pdev)
+ }
+
+ gpiochip_remove(&mpc8xxx_gc->gc);
+- iounmap(mpc8xxx_gc->regs);
+
+ return 0;
+ }
+--
+2.30.2
+
--- /dev/null
+From 15a634e82ee944e24378c76961a7a3a0c78c48ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 17:37:55 +0200
+Subject: gpio: mpc8xxx: Fix a resources leak in the error handling path of
+ 'mpc8xxx_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 555bda42b0c1a5ffb72d3227c043e8afde778f1f ]
+
+Commit 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
+has introduced a new 'goto err;' at the very end of the function, but has
+not updated the error handling path accordingly.
+
+Add the now missing 'irq_domain_remove()' call which balances a previous
+'irq_domain_create_linear() call.
+
+Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mpc8xxx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index 3c2fa44d9279..5b2a919a6644 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -406,6 +406,8 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+
+ return 0;
+ err:
++ if (mpc8xxx_gc->irq)
++ irq_domain_remove(mpc8xxx_gc->irq);
+ iounmap(mpc8xxx_gc->regs);
+ return ret;
+ }
+--
+2.30.2
+
--- /dev/null
+From 4bf380d5b8dec8d7a31773a69de1b2ba77fd053f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Aug 2021 17:38:13 +0200
+Subject: gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the code
+ and avoid a leak
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 889a1b3f35db6ba5ba6a0c23a3a55594570b6a17 ]
+
+If an error occurs after a 'gpiochip_add_data()' call it must be undone by
+a corresponding 'gpiochip_remove()' as already done in the remove function.
+
+To simplify the code a fix a leak in the error handling path of the probe,
+use the managed version instead (i.e. 'devm_gpiochip_add_data()')
+
+Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-mpc8xxx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index a4983c5d1f16..023b99bf098d 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -374,7 +374,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
+ of_device_is_compatible(np, "fsl,ls1088a-gpio"))
+ gc->write_reg(mpc8xxx_gc->regs + GPIO_IBE, 0xffffffff);
+
+- ret = gpiochip_add_data(gc, mpc8xxx_gc);
++ ret = devm_gpiochip_add_data(&pdev->dev, gc, mpc8xxx_gc);
+ if (ret) {
+ pr_err("%pOF: GPIO chip registration failed with status %d\n",
+ np, ret);
+@@ -419,8 +419,6 @@ static int mpc8xxx_remove(struct platform_device *pdev)
+ irq_domain_remove(mpc8xxx_gc->irq);
+ }
+
+- gpiochip_remove(&mpc8xxx_gc->gc);
+-
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 47a11ef23024c58533abd8255ad72f3e69786483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 11:21:09 -0400
+Subject: ip_gre: validate csum_start only on pull
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit 8a0ed250f911da31a2aef52101bc707846a800ff ]
+
+The GRE tunnel device can pull existing outer headers in ipge_xmit.
+This is a rare path, apparently unique to this device. The below
+commit ensured that pulling does not move skb->data beyond csum_start.
+
+But it has a false positive if ip_summed is not CHECKSUM_PARTIAL and
+thus csum_start is irrelevant.
+
+Refine to exclude this. At the same time simplify and strengthen the
+test.
+
+Simplify, by moving the check next to the offending pull, making it
+more self documenting and removing an unnecessary branch from other
+code paths.
+
+Strengthen, by also ensuring that the transport header is correct and
+therefore the inner headers will be after skb_reset_inner_headers.
+The transport header is set to csum_start in skb_partial_csum_set.
+
+Link: https://lore.kernel.org/netdev/YS+h%2FtqCJJiQei+W@shredder/
+Fixes: 1d011c4803c7 ("ip_gre: add validation for csum_start")
+Reported-by: Ido Schimmel <idosch@idosch.org>
+Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index a0829495b211..a9cc05043fa4 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -468,8 +468,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
+
+ static int gre_handle_offloads(struct sk_buff *skb, bool csum)
+ {
+- if (csum && skb_checksum_start(skb) < skb->data)
+- return -EINVAL;
+ return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
+ }
+
+@@ -627,15 +625,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
+ }
+
+ if (dev->header_ops) {
++ const int pull_len = tunnel->hlen + sizeof(struct iphdr);
++
+ if (skb_cow_head(skb, 0))
+ goto free_skb;
+
+ tnl_params = (const struct iphdr *)skb->data;
+
++ if (pull_len > skb_transport_offset(skb))
++ goto free_skb;
++
+ /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
+ * to gre header.
+ */
+- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
++ skb_pull(skb, pull_len);
+ skb_reset_mac_header(skb);
+ } else {
+ if (skb_cow_head(skb, dev->needed_headroom))
+--
+2.30.2
+
--- /dev/null
+From a5b0f5a6987ccf59a2c1820708d68a3fbea5a16c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 20:21:30 +0000
+Subject: KVM: arm64: Fix read-side race on updates to vcpu reset state
+
+From: Oliver Upton <oupton@google.com>
+
+[ Upstream commit 6654f9dfcb88fea3b9affc180dc3c04333d0f306 ]
+
+KVM correctly serializes writes to a vCPU's reset state, however since
+we do not take the KVM lock on the read side it is entirely possible to
+read state from two different reset requests.
+
+Cure the race for now by taking the KVM lock when reading the
+reset_state structure.
+
+Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself")
+Signed-off-by: Oliver Upton <oupton@google.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210818202133.1106786-2-oupton@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/reset.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
+index 6058a80ec9ec..204c62debf06 100644
+--- a/arch/arm64/kvm/reset.c
++++ b/arch/arm64/kvm/reset.c
+@@ -263,10 +263,16 @@ static bool vcpu_allowed_register_width(struct kvm_vcpu *vcpu)
+ */
+ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ {
++ struct vcpu_reset_state reset_state;
+ int ret;
+ bool loaded;
+ u32 pstate;
+
++ mutex_lock(&vcpu->kvm->lock);
++ reset_state = vcpu->arch.reset_state;
++ WRITE_ONCE(vcpu->arch.reset_state.reset, false);
++ mutex_unlock(&vcpu->kvm->lock);
++
+ /* Reset PMU outside of the non-preemptible section */
+ kvm_pmu_vcpu_reset(vcpu);
+
+@@ -325,8 +331,8 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ * Additional reset state handling that PSCI may have imposed on us.
+ * Must be done after all the sys_reg reset.
+ */
+- if (vcpu->arch.reset_state.reset) {
+- unsigned long target_pc = vcpu->arch.reset_state.pc;
++ if (reset_state.reset) {
++ unsigned long target_pc = reset_state.pc;
+
+ /* Gracefully handle Thumb2 entry point */
+ if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
+@@ -335,13 +341,11 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
+ }
+
+ /* Propagate caller endianness */
+- if (vcpu->arch.reset_state.be)
++ if (reset_state.be)
+ kvm_vcpu_set_be(vcpu);
+
+ *vcpu_pc(vcpu) = target_pc;
+- vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
+-
+- vcpu->arch.reset_state.reset = false;
++ vcpu_set_reg(vcpu, 0, reset_state.r0);
+ }
+
+ /* Reset timer */
+--
+2.30.2
+
--- /dev/null
+From 4868bd1fc77a5d2b5b59ff42b15dda0bcfce6256 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 20:21:31 +0000
+Subject: KVM: arm64: Handle PSCI resets before userspace touches vCPU state
+
+From: Oliver Upton <oupton@google.com>
+
+[ Upstream commit 6826c6849b46aaa91300201213701eb861af4ba0 ]
+
+The CPU_ON PSCI call takes a payload that KVM uses to configure a
+destination vCPU to run. This payload is non-architectural state and not
+exposed through any existing UAPI. Effectively, we have a race between
+CPU_ON and userspace saving/restoring a guest: if the target vCPU isn't
+ran again before the VMM saves its state, the requested PC and context
+ID are lost. When restored, the target vCPU will be runnable and start
+executing at its old PC.
+
+We can avoid this race by making sure the reset payload is serviced
+before userspace can access a vCPU's state.
+
+Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself")
+Signed-off-by: Oliver Upton <oupton@google.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210818202133.1106786-3-oupton@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/arm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
+index 5e5dd99e8cee..5bc978be8043 100644
+--- a/arch/arm64/kvm/arm.c
++++ b/arch/arm64/kvm/arm.c
+@@ -1143,6 +1143,14 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
+ if (copy_from_user(®, argp, sizeof(reg)))
+ break;
+
++ /*
++ * We could owe a reset due to PSCI. Handle the pending reset
++ * here to ensure userspace register accesses are ordered after
++ * the reset.
++ */
++ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
++ kvm_reset_vcpu(vcpu);
++
+ if (ioctl == KVM_SET_ONE_REG)
+ r = kvm_arm_set_reg(vcpu, ®);
+ else
+--
+2.30.2
+
--- /dev/null
+From 95bc7194ef5dcc16563cc418c11e903721ea709a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 16:41:15 +0530
+Subject: KVM: arm64: Restrict IPA size to maximum 48 bits on 4K and 16K page
+ size
+
+From: Anshuman Khandual <anshuman.khandual@arm.com>
+
+[ Upstream commit 5e5df9571c319fb107d7a523cc96fcc99961ee70 ]
+
+Even though ID_AA64MMFR0.PARANGE reports 52 bit PA size support, it cannot
+be enabled as guest IPA size on 4K or 16K page size configurations. Hence
+kvm_ipa_limit must be restricted to 48 bits. This change achieves required
+IPA capping.
+
+Before the commit c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA
+size based on host configuration"), the problem here would have been just
+latent via PHYS_MASK_SHIFT (which earlier in turn capped kvm_ipa_limit),
+which remains capped at 48 bits on 4K and 16K configs.
+
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Alexandru Elisei <alexandru.elisei@arm.com>
+Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: kvmarm@lists.cs.columbia.edu
+Cc: linux-kernel@vger.kernel.org
+Fixes: c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA size based on host configuration")
+Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1628680275-16578-1-git-send-email-anshuman.khandual@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/reset.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
+index b969c2157ad2..6058a80ec9ec 100644
+--- a/arch/arm64/kvm/reset.c
++++ b/arch/arm64/kvm/reset.c
+@@ -366,6 +366,14 @@ int kvm_set_ipa_limit(void)
+ mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
+ parange = cpuid_feature_extract_unsigned_field(mmfr0,
+ ID_AA64MMFR0_PARANGE_SHIFT);
++ /*
++ * IPA size beyond 48 bits could not be supported
++ * on either 4K or 16K page size. Hence let's cap
++ * it to 48 bits, in case it's reported as larger
++ * on the system.
++ */
++ if (PAGE_SIZE != SZ_64K)
++ parange = min(parange, (unsigned int)ID_AA64MMFR0_PARANGE_48);
+
+ /*
+ * Check with ARMv8.5-GTG that our PAGE_SIZE is supported at
+--
+2.30.2
+
--- /dev/null
+From 47f511a877a3dfab1fe3c8e04bba20bbcdec196d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jun 2021 19:12:39 +0200
+Subject: mfd: axp20x: Update AXP288 volatile ranges
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit f949a9ebce7a18005266b859a17f10c891bb13d7 ]
+
+On Cherry Trail devices with an AXP288 PMIC the external SD-card slot
+used the AXP's DLDO2 as card-voltage and either DLDO3 or GPIO1LDO
+(GPIO1 pin in low noise LDO mode) as signal-voltage.
+
+These regulators are turned on/off and in case of the signal-voltage
+also have their output-voltage changed by the _PS0 and _PS3 power-
+management ACPI methods on the MMC-controllers ACPI fwnode as well as
+by the _DSM ACPI method for changing the signal voltage.
+
+The AML code implementing these methods is directly accessing the
+PMIC through ACPI I2C OpRegion accesses, instead of using the special
+PMIC OpRegion handled by drivers/acpi/pmic/intel_pmic_xpower.c .
+
+This means that the contents of the involved PMIC registers can change
+without the change being made through the regmap interface, so regmap
+should not cache the contents of these registers.
+
+Mark the regulator power on/off, the regulator voltage control and the
+GPIO1 control registers as volatile, to avoid regmap caching them.
+
+Specifically this fixes an issue on some models where the i915 driver
+toggles another LDO using the same on/off register on/off through
+MIPI sequences (through intel_soc_pmic_exec_mipi_pmic_seq_element())
+which then writes back a cached on/off register-value where the
+card-voltage is off causing the external sdcard slot to stop working
+when the screen goes blank, or comes back on again.
+
+The regulator register-range now marked volatile also includes the
+buck regulator control registers. This is done on purpose these are
+normally not touched by the AML code, but they are updated directly
+by the SoC's PUNIT which means that they may also change without going
+through regmap.
+
+Note the AXP288 PMIC is only used on Bay- and Cherry-Trail platforms,
+so even though this is an ACPI specific problem there is no need to
+make the new volatile ranges conditional since these platforms always
+use ACPI.
+
+Fixes: dc91c3b6fe66 ("mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile")
+Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges")
+Reported-and-tested-by: Clamshell <clamfly@163.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/axp20x.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
+index aa59496e4376..9db1000944c3 100644
+--- a/drivers/mfd/axp20x.c
++++ b/drivers/mfd/axp20x.c
+@@ -125,12 +125,13 @@ static const struct regmap_range axp288_writeable_ranges[] = {
+
+ static const struct regmap_range axp288_volatile_ranges[] = {
+ regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON),
++ regmap_reg_range(AXP22X_PWR_OUT_CTRL1, AXP22X_ALDO3_V_OUT),
+ regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL),
+ regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT),
+ regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL),
+ regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L),
+ regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL),
+- regmap_reg_range(AXP22X_GPIO_STATE, AXP22X_GPIO_STATE),
++ regmap_reg_range(AXP20X_GPIO1_CTRL, AXP22X_GPIO_STATE),
+ regmap_reg_range(AXP288_RT_BATT_V_H, AXP288_RT_BATT_V_L),
+ regmap_reg_range(AXP20X_FG_RES, AXP288_FG_CC_CAP_REG),
+ };
+--
+2.30.2
+
--- /dev/null
+From 6fd5243d6feb22a74f93e34d89f444f11cf526ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Aug 2021 01:33:13 +0200
+Subject: mfd: db8500-prcmu: Adjust map to reality
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ec343111c056ec3847800302f6dbc57281f833fa ]
+
+These are the actual frequencies reported by the PLL, so let's
+report these. The roundoffs are inappropriate, we should round
+to the frequency that the clock will later report.
+
+Drop some whitespace at the same time.
+
+Cc: phone-devel@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/db8500-prcmu.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index a5983d515db0..8d5f8f07d8a6 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -1622,22 +1622,20 @@ static long round_clock_rate(u8 clock, unsigned long rate)
+ }
+
+ static const unsigned long db8500_armss_freqs[] = {
+- 200000000,
+- 400000000,
+- 800000000,
++ 199680000,
++ 399360000,
++ 798720000,
+ 998400000
+ };
+
+ /* The DB8520 has slightly higher ARMSS max frequency */
+ static const unsigned long db8520_armss_freqs[] = {
+- 200000000,
+- 400000000,
+- 800000000,
++ 199680000,
++ 399360000,
++ 798720000,
+ 1152000000
+ };
+
+-
+-
+ static long round_armss_rate(unsigned long rate)
+ {
+ unsigned long freq = 0;
+--
+2.30.2
+
--- /dev/null
+From d58d2869cc39c205b60c6486d989ce8f03a4d9aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Jul 2021 19:07:54 +0100
+Subject: mfd: Don't use irq_create_mapping() to resolve a mapping
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 9ff80e2de36d0554e3a6da18a171719fe8663c17 ]
+
+Although irq_create_mapping() is able to deal with duplicate
+mappings, it really isn't supposed to be a substitute for
+irq_find_mapping(), and can result in allocations that take place
+in atomic context if the mapping didn't exist.
+
+Fix the handful of MFD drivers that use irq_create_mapping() in
+interrupt context by using irq_find_mapping() instead.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Lee Jones <lee.jones@linaro.org>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/ab8500-core.c | 2 +-
+ drivers/mfd/stmpe.c | 4 ++--
+ drivers/mfd/tc3589x.c | 2 +-
+ drivers/mfd/wm8994-irq.c | 2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index a3bac9da8cbb..4cea63a4cab7 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -493,7 +493,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500,
+ if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F)
+ line += 1;
+
+- handle_nested_irq(irq_create_mapping(ab8500->domain, line));
++ handle_nested_irq(irq_find_mapping(ab8500->domain, line));
+ }
+
+ return 0;
+diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
+index 1aee3b3253fc..508349399f8a 100644
+--- a/drivers/mfd/stmpe.c
++++ b/drivers/mfd/stmpe.c
+@@ -1091,7 +1091,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
+
+ if (variant->id_val == STMPE801_ID ||
+ variant->id_val == STMPE1600_ID) {
+- int base = irq_create_mapping(stmpe->domain, 0);
++ int base = irq_find_mapping(stmpe->domain, 0);
+
+ handle_nested_irq(base);
+ return IRQ_HANDLED;
+@@ -1119,7 +1119,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
+ while (status) {
+ int bit = __ffs(status);
+ int line = bank * 8 + bit;
+- int nestedirq = irq_create_mapping(stmpe->domain, line);
++ int nestedirq = irq_find_mapping(stmpe->domain, line);
+
+ handle_nested_irq(nestedirq);
+ status &= ~(1 << bit);
+diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
+index 7882a37ffc35..5c2d5a6a6da9 100644
+--- a/drivers/mfd/tc3589x.c
++++ b/drivers/mfd/tc3589x.c
+@@ -187,7 +187,7 @@ again:
+
+ while (status) {
+ int bit = __ffs(status);
+- int virq = irq_create_mapping(tc3589x->domain, bit);
++ int virq = irq_find_mapping(tc3589x->domain, bit);
+
+ handle_nested_irq(virq);
+ status &= ~(1 << bit);
+diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c
+index 6c3a619e2628..651a028bc519 100644
+--- a/drivers/mfd/wm8994-irq.c
++++ b/drivers/mfd/wm8994-irq.c
+@@ -154,7 +154,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data)
+ struct wm8994 *wm8994 = data;
+
+ while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio))
+- handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0));
++ handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0));
+
+ return IRQ_HANDLED;
+ }
+--
+2.30.2
+
--- /dev/null
+From 37e81663a1a6b81991423ea921dfa47930179a1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 18:49:44 +0200
+Subject: mfd: lpc_sch: Partially revert "Add support for Intel Quark X1000"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 922e8ce883e59b52786b2c11656d84dc58ef084a ]
+
+The IRQ support for SCH GPIO is not specific to the Intel Quark SoC.
+Moreover the IRQ routing is quite interesting there, so while it's
+needs a special support, the driver haven't it anyway yet.
+
+Due to above remove basically redundant code of IRQ support.
+
+This reverts commit ec689a8a8155ce8b966bd5d7737a3916f5e48be3.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/lpc_sch.c | 32 ++++++--------------------------
+ 1 file changed, 6 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
+index f27eb8dabc1c..428a526cbe86 100644
+--- a/drivers/mfd/lpc_sch.c
++++ b/drivers/mfd/lpc_sch.c
+@@ -26,9 +26,6 @@
+ #define GPIO_IO_SIZE 64
+ #define GPIO_IO_SIZE_CENTERTON 128
+
+-/* Intel Quark X1000 GPIO IRQ Number */
+-#define GPIO_IRQ_QUARK_X1000 9
+-
+ #define WDTBASE 0x84
+ #define WDT_IO_SIZE 64
+
+@@ -43,30 +40,25 @@ struct lpc_sch_info {
+ unsigned int io_size_smbus;
+ unsigned int io_size_gpio;
+ unsigned int io_size_wdt;
+- int irq_gpio;
+ };
+
+ static struct lpc_sch_info sch_chipset_info[] = {
+ [LPC_SCH] = {
+ .io_size_smbus = SMBUS_IO_SIZE,
+ .io_size_gpio = GPIO_IO_SIZE,
+- .irq_gpio = -1,
+ },
+ [LPC_ITC] = {
+ .io_size_smbus = SMBUS_IO_SIZE,
+ .io_size_gpio = GPIO_IO_SIZE,
+ .io_size_wdt = WDT_IO_SIZE,
+- .irq_gpio = -1,
+ },
+ [LPC_CENTERTON] = {
+ .io_size_smbus = SMBUS_IO_SIZE,
+ .io_size_gpio = GPIO_IO_SIZE_CENTERTON,
+ .io_size_wdt = WDT_IO_SIZE,
+- .irq_gpio = -1,
+ },
+ [LPC_QUARK_X1000] = {
+ .io_size_gpio = GPIO_IO_SIZE,
+- .irq_gpio = GPIO_IRQ_QUARK_X1000,
+ .io_size_wdt = WDT_IO_SIZE,
+ },
+ };
+@@ -113,13 +105,13 @@ static int lpc_sch_get_io(struct pci_dev *pdev, int where, const char *name,
+ }
+
+ static int lpc_sch_populate_cell(struct pci_dev *pdev, int where,
+- const char *name, int size, int irq,
+- int id, struct mfd_cell *cell)
++ const char *name, int size, int id,
++ struct mfd_cell *cell)
+ {
+ struct resource *res;
+ int ret;
+
+- res = devm_kcalloc(&pdev->dev, 2, sizeof(*res), GFP_KERNEL);
++ res = devm_kzalloc(&pdev->dev, sizeof(*res), GFP_KERNEL);
+ if (!res)
+ return -ENOMEM;
+
+@@ -135,18 +127,6 @@ static int lpc_sch_populate_cell(struct pci_dev *pdev, int where,
+ cell->ignore_resource_conflicts = true;
+ cell->id = id;
+
+- /* Check if we need to add an IRQ resource */
+- if (irq < 0)
+- return 0;
+-
+- res++;
+-
+- res->start = irq;
+- res->end = irq;
+- res->flags = IORESOURCE_IRQ;
+-
+- cell->num_resources++;
+-
+ return 0;
+ }
+
+@@ -158,7 +138,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ int ret;
+
+ ret = lpc_sch_populate_cell(dev, SMBASE, "isch_smbus",
+- info->io_size_smbus, -1,
++ info->io_size_smbus,
+ id->device, &lpc_sch_cells[cells]);
+ if (ret < 0)
+ return ret;
+@@ -166,7 +146,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ cells++;
+
+ ret = lpc_sch_populate_cell(dev, GPIOBASE, "sch_gpio",
+- info->io_size_gpio, info->irq_gpio,
++ info->io_size_gpio,
+ id->device, &lpc_sch_cells[cells]);
+ if (ret < 0)
+ return ret;
+@@ -174,7 +154,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ cells++;
+
+ ret = lpc_sch_populate_cell(dev, WDTBASE, "ie6xx_wdt",
+- info->io_size_wdt, -1,
++ info->io_size_wdt,
+ id->device, &lpc_sch_cells[cells]);
+ if (ret < 0)
+ return ret;
+--
+2.30.2
+
--- /dev/null
+From 84c84b8493c064cb7f6bc3a9c2d6d134f8e1745b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Sep 2021 17:19:49 -0700
+Subject: mfd: lpc_sch: Rename GPIOBASE to prevent build error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit cdff1eda69326fb46de10c5454212b3efcf4bb41 ]
+
+One MIPS platform (mach-rc32434) defines GPIOBASE. This macro
+conflicts with one of the same name in lpc_sch.c. Rename the latter one
+to prevent the build error.
+
+../drivers/mfd/lpc_sch.c:25: error: "GPIOBASE" redefined [-Werror]
+ 25 | #define GPIOBASE 0x44
+../arch/mips/include/asm/mach-rc32434/rb.h:32: note: this is the location of the previous definition
+ 32 | #define GPIOBASE 0x050000
+
+Cc: Denis Turischev <denis@compulab.co.il>
+Fixes: e82c60ae7d3a ("mfd: Introduce lpc_sch for Intel SCH LPC bridge")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/lpc_sch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
+index 428a526cbe86..9ab9adce06fd 100644
+--- a/drivers/mfd/lpc_sch.c
++++ b/drivers/mfd/lpc_sch.c
+@@ -22,7 +22,7 @@
+ #define SMBASE 0x40
+ #define SMBUS_IO_SIZE 64
+
+-#define GPIOBASE 0x44
++#define GPIO_BASE 0x44
+ #define GPIO_IO_SIZE 64
+ #define GPIO_IO_SIZE_CENTERTON 128
+
+@@ -145,7 +145,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ if (ret == 0)
+ cells++;
+
+- ret = lpc_sch_populate_cell(dev, GPIOBASE, "sch_gpio",
++ ret = lpc_sch_populate_cell(dev, GPIO_BASE, "sch_gpio",
+ info->io_size_gpio,
+ id->device, &lpc_sch_cells[cells]);
+ if (ret < 0)
+--
+2.30.2
+
--- /dev/null
+From 97906d699fbf5a8bc8bf36db466b6632a150920c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Jul 2021 12:00:48 +0200
+Subject: mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
+
+From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+
+[ Upstream commit a946506c48f3bd09363c9d2b0a178e55733bcbb6 ]
+
+The driver was registering IRQ 0 when no IRQ was set. This leads to
+warnings with newer kernels.
+
+Clear the resource flags, so no resource is registered at all in this
+case.
+
+Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
+Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/tqmx86.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
+index ddddf08b6a4c..732013f40e4e 100644
+--- a/drivers/mfd/tqmx86.c
++++ b/drivers/mfd/tqmx86.c
+@@ -209,6 +209,8 @@ static int tqmx86_probe(struct platform_device *pdev)
+
+ /* Assumes the IRQ resource is first. */
+ tqmx_gpio_resources[0].start = gpio_irq;
++ } else {
++ tqmx_gpio_resources[0].flags = 0;
+ }
+
+ ocores_platfom_data.clock_khz = tqmx86_board_id_to_clk_rate(board_id);
+--
+2.30.2
+
--- /dev/null
+From 7b346db2954bc65af7bb30cb79369ded3eae2013 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 19:48:57 +0800
+Subject: mtd: mtdconcat: Check _read, _write callbacks existence before
+ assignment
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit a89d69a44e282be95ae76125dddc79515541efeb ]
+
+Since 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() as wrappers
+around mtd_{read,write}_oob()") don't allow _write|_read and
+_write_oob|_read_oob existing at the same time, we should check the
+existence of callbacks "_read and _write" from subdev's master device
+(We can trust master device since it has been registered) before
+assigning, otherwise following warning occurs while making
+concatenated device:
+
+ WARNING: CPU: 2 PID: 6728 at drivers/mtd/mtdcore.c:595
+ add_mtd_device+0x7f/0x7b0
+
+Fixes: 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() around ...")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-3-chengzhihao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdconcat.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
+index af51eee6b5e8..f685a581df48 100644
+--- a/drivers/mtd/mtdconcat.c
++++ b/drivers/mtd/mtdconcat.c
+@@ -694,6 +694,10 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
+ concat->mtd._block_markbad = concat_block_markbad;
+ if (subdev_master->_panic_write)
+ concat->mtd._panic_write = concat_panic_write;
++ if (subdev_master->_read)
++ concat->mtd._read = concat_read;
++ if (subdev_master->_write)
++ concat->mtd._write = concat_write;
+
+ concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks;
+
+@@ -755,8 +759,6 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
+ concat->mtd.name = name;
+
+ concat->mtd._erase = concat_erase;
+- concat->mtd._read = concat_read;
+- concat->mtd._write = concat_write;
+ concat->mtd._sync = concat_sync;
+ concat->mtd._lock = concat_lock;
+ concat->mtd._unlock = concat_unlock;
+--
+2.30.2
+
--- /dev/null
+From 22a4f4d865ee3153af15ae8c249f761c8a65ac21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Aug 2021 19:48:56 +0800
+Subject: mtd: mtdconcat: Judge callback existence based on the master
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+[ Upstream commit f9e109a209a8e01e16f37e1252304f1eb3908be4 ]
+
+Since commit 46b5889cc2c5("mtd: implement proper partition handling")
+applied, mtd partition device won't hold some callback functions, such
+as _block_isbad, _block_markbad, etc. Besides, function mtd_block_isbad()
+will get mtd device's master mtd device, then invokes master mtd device's
+callback function. So, following process may result mtd_block_isbad()
+always return 0, even though mtd device has bad blocks:
+
+1. Split a mtd device into 3 partitions: PA, PB, PC
+[ Each mtd partition device won't has callback function _block_isbad(). ]
+2. Concatenate PA and PB as a new mtd device PN
+[ mtd_concat_create() finds out each subdev has no callback function
+_block_isbad(), so PN won't be assigned callback function
+concat_block_isbad(). ]
+Then, mtd_block_isbad() checks "!master->_block_isbad" is true, will
+always return 0.
+
+Reproducer:
+// reproduce.c
+static int __init init_diy_module(void)
+{
+ struct mtd_info *mtd[2];
+ struct mtd_info *mtd_combine = NULL;
+
+ mtd[0] = get_mtd_device_nm("NAND simulator partition 0");
+ if (!mtd[0]) {
+ pr_err("cannot find mtd1\n");
+ return -EINVAL;
+ }
+ mtd[1] = get_mtd_device_nm("NAND simulator partition 1");
+ if (!mtd[1]) {
+ pr_err("cannot find mtd2\n");
+ return -EINVAL;
+ }
+
+ put_mtd_device(mtd[0]);
+ put_mtd_device(mtd[1]);
+
+ mtd_combine = mtd_concat_create(mtd, 2, "Combine mtd");
+ if (mtd_combine == NULL) {
+ pr_err("combine failed\n");
+ return -EINVAL;
+ }
+
+ mtd_device_register(mtd_combine, NULL, 0);
+ pr_info("Combine success\n");
+
+ return 0;
+}
+
+1. ID="0x20,0xac,0x00,0x15"
+2. modprobe nandsim id_bytes=$ID parts=50,100 badblocks=100
+3. insmod reproduce.ko
+4. flash_erase /dev/mtd3 0 0
+ libmtd: error!: MEMERASE64 ioctl failed for eraseblock 100 (mtd3)
+ error 5 (Input/output error)
+ // Should be "flash_erase: Skipping bad block at 00c80000"
+
+Fixes: 46b5889cc2c54bac ("mtd: implement proper partition handling")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-2-chengzhihao1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdconcat.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
+index 6e4d0017c0bd..af51eee6b5e8 100644
+--- a/drivers/mtd/mtdconcat.c
++++ b/drivers/mtd/mtdconcat.c
+@@ -641,6 +641,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
+ int i;
+ size_t size;
+ struct mtd_concat *concat;
++ struct mtd_info *subdev_master = NULL;
+ uint32_t max_erasesize, curr_erasesize;
+ int num_erase_region;
+ int max_writebufsize = 0;
+@@ -679,17 +680,19 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
+ concat->mtd.subpage_sft = subdev[0]->subpage_sft;
+ concat->mtd.oobsize = subdev[0]->oobsize;
+ concat->mtd.oobavail = subdev[0]->oobavail;
+- if (subdev[0]->_writev)
++
++ subdev_master = mtd_get_master(subdev[0]);
++ if (subdev_master->_writev)
+ concat->mtd._writev = concat_writev;
+- if (subdev[0]->_read_oob)
++ if (subdev_master->_read_oob)
+ concat->mtd._read_oob = concat_read_oob;
+- if (subdev[0]->_write_oob)
++ if (subdev_master->_write_oob)
+ concat->mtd._write_oob = concat_write_oob;
+- if (subdev[0]->_block_isbad)
++ if (subdev_master->_block_isbad)
+ concat->mtd._block_isbad = concat_block_isbad;
+- if (subdev[0]->_block_markbad)
++ if (subdev_master->_block_markbad)
+ concat->mtd._block_markbad = concat_block_markbad;
+- if (subdev[0]->_panic_write)
++ if (subdev_master->_panic_write)
+ concat->mtd._panic_write = concat_panic_write;
+
+ concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks;
+@@ -721,14 +724,22 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
+ subdev[i]->flags & MTD_WRITEABLE;
+ }
+
++ subdev_master = mtd_get_master(subdev[i]);
+ concat->mtd.size += subdev[i]->size;
+ concat->mtd.ecc_stats.badblocks +=
+ subdev[i]->ecc_stats.badblocks;
+ if (concat->mtd.writesize != subdev[i]->writesize ||
+ concat->mtd.subpage_sft != subdev[i]->subpage_sft ||
+ concat->mtd.oobsize != subdev[i]->oobsize ||
+- !concat->mtd._read_oob != !subdev[i]->_read_oob ||
+- !concat->mtd._write_oob != !subdev[i]->_write_oob) {
++ !concat->mtd._read_oob != !subdev_master->_read_oob ||
++ !concat->mtd._write_oob != !subdev_master->_write_oob) {
++ /*
++ * Check against subdev[i] for data members, because
++ * subdev's attributes may be different from master
++ * mtd device. Check against subdev's master mtd
++ * device for callbacks, because the existence of
++ * subdev's callbacks is decided by master mtd device.
++ */
+ kfree(concat);
+ printk("Incompatible OOB or ECC data on \"%s\"\n",
+ subdev[i]->name);
+--
+2.30.2
+
--- /dev/null
+From 990f021305269902e4e853fd390044cbb8533b01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Aug 2021 09:58:45 +0200
+Subject: mtd: rawnand: cafe: Fix a resource leak in the error handling path of
+ 'cafe_nand_probe()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 6b430c7595e4eb95fae8fb54adc3c3ce002e75ae ]
+
+A successful 'init_rs_non_canonical()' call should be balanced by a
+corresponding 'free_rs()' call in the error handling path of the probe, as
+already done in the remove function.
+
+Update the error handling path accordingly.
+
+Fixes: 8c61b7a7f4d4 ("[MTD] [NAND] Use rslib for CAFÉ ECC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/fd313d3fb787458bcc73189e349f481133a2cdc9.1629532640.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/cafe_nand.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c
+index 2b94f385a1a8..04502d22efc9 100644
+--- a/drivers/mtd/nand/raw/cafe_nand.c
++++ b/drivers/mtd/nand/raw/cafe_nand.c
+@@ -751,7 +751,7 @@ static int cafe_nand_probe(struct pci_dev *pdev,
+ "CAFE NAND", mtd);
+ if (err) {
+ dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq);
+- goto out_ior;
++ goto out_free_rs;
+ }
+
+ /* Disable master reset, enable NAND clock */
+@@ -795,6 +795,8 @@ static int cafe_nand_probe(struct pci_dev *pdev,
+ /* Disable NAND IRQ in global IRQ mask register */
+ cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
+ free_irq(pdev->irq, mtd);
++ out_free_rs:
++ free_rs(cafe->rs);
+ out_ior:
+ pci_iounmap(pdev, cafe->mmio);
+ out_free_mtd:
+--
+2.30.2
+
--- /dev/null
+From aeec40de29f57935f513cc6a47946a2c0dc664bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 10:30:50 +0200
+Subject: net: dsa: b53: Fix calculating number of switch ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit cdb067d31c0fe4cce98b9d15f1f2ef525acaa094 ]
+
+It isn't true that CPU port is always the last one. Switches BCM5301x
+have 9 ports (port 6 being inactive) and they use port 5 as CPU by
+default (depending on design some other may be CPU ports too).
+
+A more reliable way of determining number of ports is to check for the
+last set bit in the "enabled_ports" bitfield.
+
+This fixes b53 internal state, it will allow providing accurate info to
+the DSA and is required to fix BCM5301x support.
+
+Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 52100d4fe5a2..a8e915dd826a 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2556,9 +2556,8 @@ static int b53_switch_init(struct b53_device *dev)
+ dev->cpu_port = 5;
+ }
+
+- /* cpu port is always last */
+- dev->num_ports = dev->cpu_port + 1;
+ dev->enabled_ports |= BIT(dev->cpu_port);
++ dev->num_ports = fls(dev->enabled_ports);
+
+ /* Include non standard CPU port built-in PHYs to be probed */
+ if (is539x(dev) || is531x5(dev)) {
+--
+2.30.2
+
--- /dev/null
+From f2ee3a5cc4cf615df1095faf8d86fd5db9561996 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Sep 2021 19:23:28 +0200
+Subject: net: dsa: b53: Fix IMP port setup on BCM5301x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 63f8428b4077de3664eb0b252393c839b0b293ec ]
+
+Broadcom's b53 switches have one IMP (Inband Management Port) that needs
+to be programmed using its own designed register. IMP port may be
+different than CPU port - especially on devices with multiple CPU ports.
+
+For that reason it's required to explicitly note IMP port index and
+check for it when choosing a register to use.
+
+This commit fixes BCM5301x support. Those switches use CPU port 5 while
+their IMP port is 8. Before this patch b53 was trying to program port 5
+with B53_PORT_OVERRIDE_CTRL instead of B53_GMII_PORT_OVERRIDE_CTRL(5).
+
+It may be possible to also replace "cpu_port" usages with
+dsa_is_cpu_port() but that is out of the scope of thix BCM5301x fix.
+
+Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 27 ++++++++++++++++++++++++---
+ drivers/net/dsa/b53/b53_priv.h | 1 +
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 54558f47b633..d3b37cebcfde 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1083,7 +1083,7 @@ static void b53_force_link(struct b53_device *dev, int port, int link)
+ u8 reg, val, off;
+
+ /* Override the port settings */
+- if (port == dev->cpu_port) {
++ if (port == dev->imp_port) {
+ off = B53_PORT_OVERRIDE_CTRL;
+ val = PORT_OVERRIDE_EN;
+ } else {
+@@ -1107,7 +1107,7 @@ static void b53_force_port_config(struct b53_device *dev, int port,
+ u8 reg, val, off;
+
+ /* Override the port settings */
+- if (port == dev->cpu_port) {
++ if (port == dev->imp_port) {
+ off = B53_PORT_OVERRIDE_CTRL;
+ val = PORT_OVERRIDE_EN;
+ } else {
+@@ -1175,7 +1175,7 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,
+ b53_force_link(dev, port, phydev->link);
+
+ if (is531x5(dev) && phy_interface_is_rgmii(phydev)) {
+- if (port == 8)
++ if (port == dev->imp_port)
+ off = B53_RGMII_CTRL_IMP;
+ else
+ off = B53_RGMII_CTRL_P(port);
+@@ -2238,6 +2238,7 @@ struct b53_chip_data {
+ const char *dev_name;
+ u16 vlans;
+ u16 enabled_ports;
++ u8 imp_port;
+ u8 cpu_port;
+ u8 vta_regs[3];
+ u8 arl_bins;
+@@ -2262,6 +2263,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 2,
+ .arl_buckets = 1024,
++ .imp_port = 5,
+ .cpu_port = B53_CPU_PORT_25,
+ .duplex_reg = B53_DUPLEX_STAT_FE,
+ },
+@@ -2272,6 +2274,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 2,
+ .arl_buckets = 1024,
++ .imp_port = 5,
+ .cpu_port = B53_CPU_PORT_25,
+ .duplex_reg = B53_DUPLEX_STAT_FE,
+ },
+@@ -2282,6 +2285,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2295,6 +2299,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2308,6 +2313,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS_9798,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2321,6 +2327,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x7f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS_9798,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2335,6 +2342,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .arl_bins = 4,
+ .arl_buckets = 1024,
+ .vta_regs = B53_VTA_REGS,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+ .jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+@@ -2347,6 +2355,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0xff,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2360,6 +2369,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1ff,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2373,6 +2383,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0, /* pdata must provide them */
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS_63XX,
+ .duplex_reg = B53_DUPLEX_STAT_63XX,
+@@ -2386,6 +2397,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2399,6 +2411,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1bf,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2412,6 +2425,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1bf,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2425,6 +2439,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2438,6 +2453,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1f,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2451,6 +2467,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1ff,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2464,6 +2481,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x103,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2477,6 +2495,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1ff,
+ .arl_bins = 4,
+ .arl_buckets = 1024,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2490,6 +2509,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ .enabled_ports = 0x1ff,
+ .arl_bins = 4,
+ .arl_buckets = 256,
++ .imp_port = 8,
+ .cpu_port = B53_CPU_PORT,
+ .vta_regs = B53_VTA_REGS,
+ .duplex_reg = B53_DUPLEX_STAT_GE,
+@@ -2515,6 +2535,7 @@ static int b53_switch_init(struct b53_device *dev)
+ dev->vta_regs[1] = chip->vta_regs[1];
+ dev->vta_regs[2] = chip->vta_regs[2];
+ dev->jumbo_pm_reg = chip->jumbo_pm_reg;
++ dev->imp_port = chip->imp_port;
+ dev->cpu_port = chip->cpu_port;
+ dev->num_vlans = chip->vlans;
+ dev->num_arl_bins = chip->arl_bins;
+diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
+index 7c67409bb186..bdb2ade7ad62 100644
+--- a/drivers/net/dsa/b53/b53_priv.h
++++ b/drivers/net/dsa/b53/b53_priv.h
+@@ -122,6 +122,7 @@ struct b53_device {
+
+ /* used ports mask */
+ u16 enabled_ports;
++ unsigned int imp_port;
+ unsigned int cpu_port;
+
+ /* connect specific data */
+--
+2.30.2
+
--- /dev/null
+From c4461f14979c4107d2178b331489eef46780209f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 10:30:51 +0200
+Subject: net: dsa: b53: Set correct number of ports in the DSA struct
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit d12e1c4649883e8ca5e8ff341e1948b3b6313259 ]
+
+Setting DSA_MAX_PORTS caused DSA to call b53 callbacks (e.g.
+b53_disable_port() during dsa_register_switch()) for invalid
+(non-existent) ports. That made b53 modify unrelated registers and is
+one of reasons for a broken BCM5301x support.
+
+This problem exists for years but DSA_MAX_PORTS usage has changed few
+times. It seems the most accurate to reference commit dropping
+dsa_switch_alloc() in the Fixes tag.
+
+Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/b53/b53_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index a8e915dd826a..54558f47b633 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -2559,6 +2559,8 @@ static int b53_switch_init(struct b53_device *dev)
+ dev->enabled_ports |= BIT(dev->cpu_port);
+ dev->num_ports = fls(dev->enabled_ports);
+
++ dev->ds->num_ports = min_t(unsigned int, dev->num_ports, DSA_MAX_PORTS);
++
+ /* Include non standard CPU port built-in PHYs to be probed */
+ if (is539x(dev) || is531x5(dev)) {
+ for (i = 0; i < dev->num_ports; i++) {
+@@ -2603,7 +2605,6 @@ struct b53_device *b53_switch_alloc(struct device *base,
+ return NULL;
+
+ ds->dev = base;
+- ds->num_ports = DSA_MAX_PORTS;
+
+ dev = devm_kzalloc(base, sizeof(*dev), GFP_KERNEL);
+ if (!dev)
+--
+2.30.2
+
--- /dev/null
+From 2f839a4ca35f7d6c1697f5cb4003bdf469975476 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Aug 2021 20:50:50 +0200
+Subject: net: dsa: tag_rtl4_a: Fix egress tags
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 0e90dfa7a8d817db755c7b5d89d77b9c485e4180 ]
+
+I noticed that only port 0 worked on the RTL8366RB since we
+started to use custom tags.
+
+It turns out that the format of egress custom tags is actually
+different from ingress custom tags. While the lower bits just
+contain the port number in ingress tags, egress tags need to
+indicate destination port by setting the bit for the
+corresponding port.
+
+It was working on port 0 because port 0 added 0x00 as port
+number in the lower bits, and if you do this the packet appears
+at all ports, including the intended port. Ooops.
+
+Fix this and all ports work again. Use the define for shifting
+the "type A" into place while we're at it.
+
+Tested on the D-Link DIR-685 by sending traffic to each of
+the ports in turn. It works.
+
+Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags")
+Cc: DENG Qingfang <dqfext@gmail.com>
+Cc: Mauri Sandberg <sandberg@mailfence.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dsa/tag_rtl4_a.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c
+index e9176475bac8..24375ebd684e 100644
+--- a/net/dsa/tag_rtl4_a.c
++++ b/net/dsa/tag_rtl4_a.c
+@@ -54,9 +54,10 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb,
+ p = (__be16 *)tag;
+ *p = htons(RTL4_A_ETHERTYPE);
+
+- out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8);
+- /* The lower bits is the port number */
+- out |= (u8)dp->index;
++ out = (RTL4_A_PROTOCOL_RTL8366RB << RTL4_A_PROTOCOL_SHIFT) | (2 << 8);
++ /* The lower bits indicate the port number */
++ out |= BIT(dp->index);
++
+ p = (__be16 *)(tag + 2);
+ *p = htons(out);
+
+--
+2.30.2
+
--- /dev/null
+From f24426f0b8bca109172d174fd78438d14b77f12f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 16:36:09 +0800
+Subject: net: hso: add failure handler for add_net_device
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit ecdc28defc46af476566fffd9e5cb4495a2f176e ]
+
+If the network devices connected to the system beyond
+HSO_MAX_NET_DEVICES. add_net_device() in hso_create_net_device()
+will be failed for the network_table is full. It will lead to
+business failure which rely on network_table, for example,
+hso_suspend() and hso_resume(). It will also lead to memory leak
+because resource release process can not search the hso_device
+object from network_table in hso_free_interface().
+
+Add failure handler for add_net_device() in hso_create_net_device()
+to solve the above problems.
+
+Fixes: 72dc1c096c70 ("HSO: add option hso driver")
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/hso.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 5b3aff2c279f..f269337c82c5 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2537,13 +2537,17 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+ if (!hso_net->mux_bulk_tx_buf)
+ goto err_free_tx_urb;
+
+- add_net_device(hso_dev);
++ result = add_net_device(hso_dev);
++ if (result) {
++ dev_err(&interface->dev, "Failed to add net device\n");
++ goto err_free_tx_buf;
++ }
+
+ /* registering our net device */
+ result = register_netdev(net);
+ if (result) {
+ dev_err(&interface->dev, "Failed to register device\n");
+- goto err_free_tx_buf;
++ goto err_rmv_ndev;
+ }
+
+ hso_log_port(hso_dev);
+@@ -2552,8 +2556,9 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
+
+ return hso_dev;
+
+-err_free_tx_buf:
++err_rmv_ndev:
+ remove_net_device(hso_dev);
++err_free_tx_buf:
+ kfree(hso_net->mux_bulk_tx_buf);
+ err_free_tx_urb:
+ usb_free_urb(hso_net->mux_bulk_tx_urb);
+--
+2.30.2
+
--- /dev/null
+From eacd3bf0ecf7e9adc1b1e573394e77907b7b4eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 18:56:46 +0800
+Subject: net: phylink: add suspend/resume support
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit f97493657c6372eeefe70faadd214bf31488c44e ]
+
+Joakim Zhang reports that Wake-on-Lan with the stmmac ethernet driver broke
+when moving the incorrect handling of mac link state out of mac_config().
+This reason this breaks is because the stmmac's WoL is handled by the MAC
+rather than the PHY, and phylink doesn't cater for that scenario.
+
+This patch adds the necessary phylink code to handle suspend/resume events
+according to whether the MAC still needs a valid link or not. This is the
+barest minimum for this support.
+
+Reported-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Tested-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phylink.c | 82 +++++++++++++++++++++++++++++++++++++++
+ include/linux/phylink.h | 3 ++
+ 2 files changed, 85 insertions(+)
+
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 6072e87ed6c3..42826ce0e0bf 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -32,6 +32,7 @@
+ enum {
+ PHYLINK_DISABLE_STOPPED,
+ PHYLINK_DISABLE_LINK,
++ PHYLINK_DISABLE_MAC_WOL,
+ };
+
+ /**
+@@ -1251,6 +1252,9 @@ EXPORT_SYMBOL_GPL(phylink_start);
+ * network device driver's &struct net_device_ops ndo_stop() method. The
+ * network device's carrier state should not be changed prior to calling this
+ * function.
++ *
++ * This will synchronously bring down the link if the link is not already
++ * down (in other words, it will trigger a mac_link_down() method call.)
+ */
+ void phylink_stop(struct phylink *pl)
+ {
+@@ -1270,6 +1274,84 @@ void phylink_stop(struct phylink *pl)
+ }
+ EXPORT_SYMBOL_GPL(phylink_stop);
+
++/**
++ * phylink_suspend() - handle a network device suspend event
++ * @pl: a pointer to a &struct phylink returned from phylink_create()
++ * @mac_wol: true if the MAC needs to receive packets for Wake-on-Lan
++ *
++ * Handle a network device suspend event. There are several cases:
++ * - If Wake-on-Lan is not active, we can bring down the link between
++ * the MAC and PHY by calling phylink_stop().
++ * - If Wake-on-Lan is active, and being handled only by the PHY, we
++ * can also bring down the link between the MAC and PHY.
++ * - If Wake-on-Lan is active, but being handled by the MAC, the MAC
++ * still needs to receive packets, so we can not bring the link down.
++ */
++void phylink_suspend(struct phylink *pl, bool mac_wol)
++{
++ ASSERT_RTNL();
++
++ if (mac_wol && (!pl->netdev || pl->netdev->wol_enabled)) {
++ /* Wake-on-Lan enabled, MAC handling */
++ mutex_lock(&pl->state_mutex);
++
++ /* Stop the resolver bringing the link up */
++ __set_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state);
++
++ /* Disable the carrier, to prevent transmit timeouts,
++ * but one would hope all packets have been sent. This
++ * also means phylink_resolve() will do nothing.
++ */
++ netif_carrier_off(pl->netdev);
++
++ /* We do not call mac_link_down() here as we want the
++ * link to remain up to receive the WoL packets.
++ */
++ mutex_unlock(&pl->state_mutex);
++ } else {
++ phylink_stop(pl);
++ }
++}
++EXPORT_SYMBOL_GPL(phylink_suspend);
++
++/**
++ * phylink_resume() - handle a network device resume event
++ * @pl: a pointer to a &struct phylink returned from phylink_create()
++ *
++ * Undo the effects of phylink_suspend(), returning the link to an
++ * operational state.
++ */
++void phylink_resume(struct phylink *pl)
++{
++ ASSERT_RTNL();
++
++ if (test_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state)) {
++ /* Wake-on-Lan enabled, MAC handling */
++
++ /* Call mac_link_down() so we keep the overall state balanced.
++ * Do this under the state_mutex lock for consistency. This
++ * will cause a "Link Down" message to be printed during
++ * resume, which is harmless - the true link state will be
++ * printed when we run a resolve.
++ */
++ mutex_lock(&pl->state_mutex);
++ phylink_link_down(pl);
++ mutex_unlock(&pl->state_mutex);
++
++ /* Re-apply the link parameters so that all the settings get
++ * restored to the MAC.
++ */
++ phylink_mac_initial_config(pl, true);
++
++ /* Re-enable and re-resolve the link parameters */
++ clear_bit(PHYLINK_DISABLE_MAC_WOL, &pl->phylink_disable_state);
++ phylink_run_resolve(pl);
++ } else {
++ phylink_start(pl);
++ }
++}
++EXPORT_SYMBOL_GPL(phylink_resume);
++
+ /**
+ * phylink_ethtool_get_wol() - get the wake on lan parameters for the PHY
+ * @pl: a pointer to a &struct phylink returned from phylink_create()
+diff --git a/include/linux/phylink.h b/include/linux/phylink.h
+index d81a714cfbbd..ff56e3e373f0 100644
+--- a/include/linux/phylink.h
++++ b/include/linux/phylink.h
+@@ -446,6 +446,9 @@ void phylink_mac_change(struct phylink *, bool up);
+ void phylink_start(struct phylink *);
+ void phylink_stop(struct phylink *);
+
++void phylink_suspend(struct phylink *pl, bool mac_wol);
++void phylink_resume(struct phylink *pl);
++
+ void phylink_ethtool_get_wol(struct phylink *, struct ethtool_wolinfo *);
+ int phylink_ethtool_set_wol(struct phylink *, struct ethtool_wolinfo *);
+
+--
+2.30.2
+
--- /dev/null
+From f617525c0c5f4538e4d9212eca59d86ee69d5e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Sep 2021 20:29:40 +0900
+Subject: net: renesas: sh_eth: Fix freeing wrong tx descriptor
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 0341d5e3d1ee2a36dd5a49b5bef2ce4ad1cfa6b4 ]
+
+The cur_tx counter must be incremented after TACT bit of
+txdesc->status was set. However, a CPU is possible to reorder
+instructions and/or memory accesses between cur_tx and
+txdesc->status. And then, if TX interrupt happened at such a
+timing, the sh_eth_tx_free() may free the descriptor wrongly.
+So, add wmb() before cur_tx++.
+Otherwise NETDEV WATCHDOG timeout is possible to happen.
+
+Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 5cab2d3c0023..8927d5997745 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2533,6 +2533,7 @@ static netdev_tx_t sh_eth_start_xmit(struct sk_buff *skb,
+ else
+ txdesc->status |= cpu_to_le32(TD_TACT);
+
++ wmb(); /* cur_tx must be incremented after TACT bit was set */
+ mdp->cur_tx++;
+
+ if (!(sh_eth_read(ndev, EDTRR) & mdp->cd->edtrr_trns))
+--
+2.30.2
+
--- /dev/null
+From a60b03a1603f5348f82e0a27b81577c8d4a2fca7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 12:51:22 +0200
+Subject: net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+[ Upstream commit aabbdc67f3485b5db27ab4eba01e5fbf1ffea62c ]
+
+Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit LN920
+0x1061 composition in order to avoid bind error.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/cdc_mbim.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index eb100eb33de3..77ac5a721e7b 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -653,6 +653,11 @@ static const struct usb_device_id mbim_devs[] = {
+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+ },
+
++ /* Telit LN920 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
++ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
++ },
++
+ /* default entry */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+--
+2.30.2
+
--- /dev/null
+From b41f2d4e19c46114216e1735e9f9c3df0128c402 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Mar 2021 02:42:09 -0600
+Subject: netfilter: Fix fall-through warnings for Clang
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit c2168e6bd7ec50cedb69b3be1ba6146e28893c69 ]
+
+In preparation to enable -Wimplicit-fallthrough for Clang, fix multiple
+warnings by explicitly adding multiple break statements instead of just
+letting the code fall through to the next case.
+
+Link: https://github.com/KSPP/linux/issues/115
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_dccp.c | 1 +
+ net/netfilter/nf_tables_api.c | 1 +
+ net/netfilter/nft_ct.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
+index b3f4a334f9d7..94001eb51ffe 100644
+--- a/net/netfilter/nf_conntrack_proto_dccp.c
++++ b/net/netfilter/nf_conntrack_proto_dccp.c
+@@ -397,6 +397,7 @@ dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
+ msg = "not picking up existing connection ";
+ goto out_invalid;
+ }
++ break;
+ case CT_DCCP_REQUEST:
+ break;
+ case CT_DCCP_INVALID:
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2b5f97e1d40b..c605a3e713e7 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -8394,6 +8394,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
+ data->verdict.chain);
+ if (err < 0)
+ return err;
++ break;
+ default:
+ break;
+ }
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index 70d46e0bbf06..7af822a02ce9 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -528,6 +528,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
+ case NFT_CT_ZONE:
+ if (--nft_ct_pcpu_template_refcnt == 0)
+ nft_ct_tmpl_put_pcpu();
++ break;
+ #endif
+ default:
+ break;
+--
+2.30.2
+
--- /dev/null
+From 84cd098be8591bc7df1f55a5a6e830a00258a7c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 15:59:20 +0300
+Subject: netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit e3245a7b7b34bd2e97f744fd79463add6e9d41f4 ]
+
+Syzbot hit use-after-free in nf_tables_dump_sets. The problem was in
+missing lock protection for nft_ct_pcpu_template_refcnt.
+
+Before commit f102d66b335a ("netfilter: nf_tables: use dedicated
+mutex to guard transactions") all transactions were serialized by global
+mutex, but then global mutex was changed to local per netnamespace
+commit_mutex.
+
+This change causes use-after-free bug, when 2 netnamespaces concurently
+changing nft_ct_pcpu_template_refcnt without proper locking. Fix it by
+adding nft_ct_pcpu_mutex and protect all nft_ct_pcpu_template_refcnt
+changes with it.
+
+Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Reported-and-tested-by: syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_ct.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
+index 7af822a02ce9..7fcb73ac2e6e 100644
+--- a/net/netfilter/nft_ct.c
++++ b/net/netfilter/nft_ct.c
+@@ -41,6 +41,7 @@ struct nft_ct_helper_obj {
+ #ifdef CONFIG_NF_CONNTRACK_ZONES
+ static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
+ static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
++static DEFINE_MUTEX(nft_ct_pcpu_mutex);
+ #endif
+
+ static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
+@@ -526,8 +527,10 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
+ #endif
+ #ifdef CONFIG_NF_CONNTRACK_ZONES
+ case NFT_CT_ZONE:
++ mutex_lock(&nft_ct_pcpu_mutex);
+ if (--nft_ct_pcpu_template_refcnt == 0)
+ nft_ct_tmpl_put_pcpu();
++ mutex_unlock(&nft_ct_pcpu_mutex);
+ break;
+ #endif
+ default:
+@@ -565,9 +568,13 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
+ #endif
+ #ifdef CONFIG_NF_CONNTRACK_ZONES
+ case NFT_CT_ZONE:
+- if (!nft_ct_tmpl_alloc_pcpu())
++ mutex_lock(&nft_ct_pcpu_mutex);
++ if (!nft_ct_tmpl_alloc_pcpu()) {
++ mutex_unlock(&nft_ct_pcpu_mutex);
+ return -ENOMEM;
++ }
+ nft_ct_pcpu_template_refcnt++;
++ mutex_unlock(&nft_ct_pcpu_mutex);
+ len = sizeof(u16);
+ break;
+ #endif
+--
+2.30.2
+
--- /dev/null
+From eadcfb4a01fce3e3cf5d9c85744d64e07c7108bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 15:23:35 +0200
+Subject: netfilter: socket: icmp6: fix use-after-scope
+
+From: Benjamin Hesmans <benjamin.hesmans@tessares.net>
+
+[ Upstream commit 730affed24bffcd1eebd5903171960f5ff9f1f22 ]
+
+Bug reported by KASAN:
+
+BUG: KASAN: use-after-scope in inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
+Call Trace:
+(...)
+inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
+(...)
+nf_sk_lookup_slow_v6 (net/ipv6/netfilter/nf_socket_ipv6.c:91
+net/ipv6/netfilter/nf_socket_ipv6.c:146)
+
+It seems that this bug has already been fixed by Eric Dumazet in the
+past in:
+commit 78296c97ca1f ("netfilter: xt_socket: fix a stack corruption bug")
+
+But a variant of the same issue has been introduced in
+commit d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")
+
+`daddr` and `saddr` potentially hold a reference to ipv6_var that is no
+longer in scope when the call to `nf_socket_get_sock_v6` is made.
+
+Fixes: d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")
+Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Benjamin Hesmans <benjamin.hesmans@tessares.net>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/netfilter/nf_socket_ipv6.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
+index 6fd54744cbc3..aa5bb8789ba0 100644
+--- a/net/ipv6/netfilter/nf_socket_ipv6.c
++++ b/net/ipv6/netfilter/nf_socket_ipv6.c
+@@ -99,7 +99,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
+ {
+ __be16 dport, sport;
+ const struct in6_addr *daddr = NULL, *saddr = NULL;
+- struct ipv6hdr *iph = ipv6_hdr(skb);
++ struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var;
+ struct sk_buff *data_skb = NULL;
+ int doff = 0;
+ int thoff = 0, tproto;
+@@ -129,8 +129,6 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
+ thoff + sizeof(*hp);
+
+ } else if (tproto == IPPROTO_ICMPV6) {
+- struct ipv6hdr ipv6_var;
+-
+ if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
+ &sport, &dport, &ipv6_var))
+ return NULL;
+--
+2.30.2
+
--- /dev/null
+From 19f269990632bf41172afc97afa12643c78f2610 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 13:56:20 +0800
+Subject: NTB: Fix an error code in ntb_msit_probe()
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 319f83ac98d7afaabab84ce5281a819a358b9895 ]
+
+When the value of nm->isr_ctx is false, the value of ret is 0.
+So, we set ret to -ENOMEM to indicate this error.
+
+Clean up smatch warning:
+drivers/ntb/test/ntb_msi_test.c:373 ntb_msit_probe() warn: missing
+error code 'ret'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/test/ntb_msi_test.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ntb/test/ntb_msi_test.c b/drivers/ntb/test/ntb_msi_test.c
+index 7095ecd6223a..4e18e08776c9 100644
+--- a/drivers/ntb/test/ntb_msi_test.c
++++ b/drivers/ntb/test/ntb_msi_test.c
+@@ -369,8 +369,10 @@ static int ntb_msit_probe(struct ntb_client *client, struct ntb_dev *ntb)
+ if (ret)
+ goto remove_dbgfs;
+
+- if (!nm->isr_ctx)
++ if (!nm->isr_ctx) {
++ ret = -ENOMEM;
+ goto remove_dbgfs;
++ }
+
+ ntb_link_enable(ntb, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
+
+--
+2.30.2
+
--- /dev/null
+From 122667db6ddc43394a632c9f5c8a2d15b642db13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jun 2021 16:40:36 +0800
+Subject: NTB: perf: Fix an error code in perf_setup_inbuf()
+
+From: Yang Li <yang.lee@linux.alibaba.com>
+
+[ Upstream commit 0097ae5f7af5684f961a5f803ff7ad3e6f933668 ]
+
+When the function IS_ALIGNED() returns false, the value of ret is 0.
+So, we set ret to -EINVAL to indicate this error.
+
+Clean up smatch warning:
+drivers/ntb/test/ntb_perf.c:602 perf_setup_inbuf() warn: missing error
+code 'ret'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/test/ntb_perf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
+index 89df1350fefd..65e1e5cf1b29 100644
+--- a/drivers/ntb/test/ntb_perf.c
++++ b/drivers/ntb/test/ntb_perf.c
+@@ -598,6 +598,7 @@ static int perf_setup_inbuf(struct perf_peer *peer)
+ return -ENOMEM;
+ }
+ if (!IS_ALIGNED(peer->inbuf_xlat, xlat_align)) {
++ ret = -EINVAL;
+ dev_err(&perf->ntb->dev, "Unaligned inbuf allocated\n");
+ goto err_free_inbuf;
+ }
+--
+2.30.2
+
--- /dev/null
+From 1fc61ea08cdec2c6cec44867ebb394d176d9fa19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 11:08:59 +0530
+Subject: octeontx2-af: Add additional register check to rvu_poll_reg()
+
+From: Smadar Fuks <smadarf@marvell.com>
+
+[ Upstream commit 21274aa1781941884599a97ab59be7f8f36af98c ]
+
+Check one more time before exiting the API with an error.
+Fix API to poll at least twice, in case there are other high priority
+tasks and this API doesn't get CPU cycles for multiple jiffies update.
+
+In addition, increase timeout from usecs_to_jiffies(10000) to
+usecs_to_jiffies(20000), to prevent the case that for CONFIG_100HZ
+timeout will be a single jiffies.
+A single jiffies results actual timeout that can be any time between
+1usec and 10msec. To solve this, a value of usecs_to_jiffies(20000)
+ensures that timeout is 2 jiffies.
+
+Signed-off-by: Smadar Fuks <smadarf@marvell.com>
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index 644d28b0692b..c26652436c53 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -84,7 +84,8 @@ static void rvu_setup_hw_capabilities(struct rvu *rvu)
+ */
+ int rvu_poll_reg(struct rvu *rvu, u64 block, u64 offset, u64 mask, bool zero)
+ {
+- unsigned long timeout = jiffies + usecs_to_jiffies(10000);
++ unsigned long timeout = jiffies + usecs_to_jiffies(20000);
++ bool twice = false;
+ void __iomem *reg;
+ u64 reg_val;
+
+@@ -99,6 +100,15 @@ again:
+ usleep_range(1, 5);
+ goto again;
+ }
++ /* In scenarios where CPU is scheduled out before checking
++ * 'time_before' (above) and gets scheduled in such that
++ * jiffies are beyond timeout value, then check again if HW is
++ * done with the operation in the meantime.
++ */
++ if (!twice) {
++ twice = true;
++ goto again;
++ }
+ return -EBUSY;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 20bffc414b02f9fdc667d4a4d8291b84d0106d88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 17:54:25 +0530
+Subject: PCI: Add ACS quirks for Cavium multi-function devices
+
+From: George Cherian <george.cherian@marvell.com>
+
+[ Upstream commit 32837d8a8f63eb95dcb9cd005524a27f06478832 ]
+
+Some Cavium endpoints are implemented as multi-function devices without ACS
+capability, but they actually don't support peer-to-peer transactions.
+
+Add ACS quirks to declare DMA isolation for the following devices:
+
+ - BGX device found on Octeon-TX (8xxx)
+ - CGX device found on Octeon-TX2 (9xxx)
+ - RPM device found on Octeon-TX3 (10xxx)
+
+Link: https://lore.kernel.org/r/20210810122425.1115156-1-george.cherian@marvell.com
+Signed-off-by: George Cherian <george.cherian@marvell.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f2e95944f681..5d2acebc3e96 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4864,6 +4864,10 @@ static const struct pci_dev_acs_enabled {
+ { 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */
+ /* Cavium ThunderX */
+ { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
++ /* Cavium multi-function devices */
++ { PCI_VENDOR_ID_CAVIUM, 0xA026, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_CAVIUM, 0xA059, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs },
+ /* APM X-Gene */
+ { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
+ /* Ampere Computing */
+--
+2.30.2
+
--- /dev/null
+From 450d6d76b2f0c8ee4da92331b804cbdc0b98c7a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Jul 2021 14:17:47 +0200
+Subject: PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
+
+From: Wasim Khan <wasim.khan@nxp.com>
+
+[ Upstream commit d08c8b855140e9f5240b3ffd1b8b9d435675e281 ]
+
+Root Ports in NXP LX2xx0 and LX2xx2, where each Root Port is a Root Complex
+with unique segment numbers, do provide isolation features to disable peer
+transactions and validate bus numbers in requests, but do not provide an
+actual PCIe ACS capability.
+
+Add ACS quirks for NXP LX2xx0 A/C/E/N and LX2xx2 A/C/E/N platforms.
+
+ LX2xx0A : without security features + CAN-FD
+ LX2160A (0x8d81) - 16 cores
+ LX2120A (0x8da1) - 12 cores
+ LX2080A (0x8d83) - 8 cores
+
+ LX2xx0C : security features + CAN-FD
+ LX2160C (0x8d80) - 16 cores
+ LX2120C (0x8da0) - 12 cores
+ LX2080C (0x8d82) - 8 cores
+
+ LX2xx0E : security features + CAN
+ LX2160E (0x8d90) - 16 cores
+ LX2120E (0x8db0) - 12 cores
+ LX2080E (0x8d92) - 8 cores
+
+ LX2xx0N : without security features + CAN
+ LX2160N (0x8d91) - 16 cores
+ LX2120N (0x8db1) - 12 cores
+ LX2080N (0x8d93) - 8 cores
+
+ LX2xx2A : without security features + CAN-FD
+ LX2162A (0x8d89) - 16 cores
+ LX2122A (0x8da9) - 12 cores
+ LX2082A (0x8d8b) - 8 cores
+
+ LX2xx2C : security features + CAN-FD
+ LX2162C (0x8d88) - 16 cores
+ LX2122C (0x8da8) - 12 cores
+ LX2082C (0x8d8a) - 8 cores
+
+ LX2xx2E : security features + CAN
+ LX2162E (0x8d98) - 16 cores
+ LX2122E (0x8db8) - 12 cores
+ LX2082E (0x8d9a) - 8 cores
+
+ LX2xx2N : without security features + CAN
+ LX2162N (0x8d99) - 16 cores
+ LX2122N (0x8db9) - 12 cores
+ LX2082N (0x8d9b) - 8 cores
+
+[bhelgaas: put PCI_VENDOR_ID_NXP definition next to PCI_VENDOR_ID_FREESCALE
+as a clue that they share the same Device ID namespace]
+Link: https://lore.kernel.org/r/20210729121747.1823086-1-wasim.khan@oss.nxp.com
+Link: https://lore.kernel.org/r/20210803180021.3252886-1-wasim.khan@oss.nxp.com
+Signed-off-by: Wasim Khan <wasim.khan@nxp.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 45 +++++++++++++++++++++++++++++++++++++++++
+ include/linux/pci_ids.h | 3 ++-
+ 2 files changed, 47 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 8dac8dcc02c6..f2e95944f681 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4626,6 +4626,18 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
+ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+ }
+
++/*
++ * Each of these NXP Root Ports is in a Root Complex with a unique segment
++ * number and does provide isolation features to disable peer transactions
++ * and validate bus numbers in requests, but does not provide an ACS
++ * capability.
++ */
++static int pci_quirk_nxp_rp_acs(struct pci_dev *dev, u16 acs_flags)
++{
++ return pci_acs_ctrl_enabled(acs_flags,
++ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
++}
++
+ static int pci_quirk_al_acs(struct pci_dev *dev, u16 acs_flags)
+ {
+ if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT)
+@@ -4872,6 +4884,39 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_ZHAOXIN, 0x3038, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_ZHAOXIN, 0x3104, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs },
++ /* NXP root ports, xx=16, 12, or 08 cores */
++ /* LX2xx0A : without security features + CAN-FD */
++ { PCI_VENDOR_ID_NXP, 0x8d81, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8da1, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d83, pci_quirk_nxp_rp_acs },
++ /* LX2xx0C : security features + CAN-FD */
++ { PCI_VENDOR_ID_NXP, 0x8d80, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8da0, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d82, pci_quirk_nxp_rp_acs },
++ /* LX2xx0E : security features + CAN */
++ { PCI_VENDOR_ID_NXP, 0x8d90, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8db0, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d92, pci_quirk_nxp_rp_acs },
++ /* LX2xx0N : without security features + CAN */
++ { PCI_VENDOR_ID_NXP, 0x8d91, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8db1, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d93, pci_quirk_nxp_rp_acs },
++ /* LX2xx2A : without security features + CAN-FD */
++ { PCI_VENDOR_ID_NXP, 0x8d89, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8da9, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d8b, pci_quirk_nxp_rp_acs },
++ /* LX2xx2C : security features + CAN-FD */
++ { PCI_VENDOR_ID_NXP, 0x8d88, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8da8, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d8a, pci_quirk_nxp_rp_acs },
++ /* LX2xx2E : security features + CAN */
++ { PCI_VENDOR_ID_NXP, 0x8d98, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8db8, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d9a, pci_quirk_nxp_rp_acs },
++ /* LX2xx2N : without security features + CAN */
++ { PCI_VENDOR_ID_NXP, 0x8d99, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8db9, pci_quirk_nxp_rp_acs },
++ { PCI_VENDOR_ID_NXP, 0x8d9b, pci_quirk_nxp_rp_acs },
+ /* Zhaoxin Root/Downstream Ports */
+ { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs },
+ { 0 }
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 1ab1e24bcbce..635a9243cce0 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2476,7 +2476,8 @@
+ #define PCI_VENDOR_ID_TDI 0x192E
+ #define PCI_DEVICE_ID_TDI_EHCI 0x0101
+
+-#define PCI_VENDOR_ID_FREESCALE 0x1957
++#define PCI_VENDOR_ID_FREESCALE 0x1957 /* duplicate: NXP */
++#define PCI_VENDOR_ID_NXP 0x1957 /* duplicate: FREESCALE */
+ #define PCI_DEVICE_ID_MPC8308 0xc006
+ #define PCI_DEVICE_ID_MPC8315E 0x00b4
+ #define PCI_DEVICE_ID_MPC8315 0x00b5
+--
+2.30.2
+
--- /dev/null
+From 5c4403486e7e0c5a4b4511326d110e5d8429219f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:03:33 +0530
+Subject: PCI: cadence: Add quirk flag to set minimum delay in LTSSM
+ Detect.Quiet state
+
+From: Nadeem Athani <nadeem@cadence.com>
+
+[ Upstream commit 09c24094b2e3a15ef3fc44f54a191b3db522fb11 ]
+
+PCIe fails to link up if SERDES lanes not used by PCIe are assigned to
+another protocol. For example, link training fails if lanes 2 and 3 are
+assigned to another protocol while lanes 0 and 1 are used for PCIe to
+form a two lane link. This failure is due to an incorrect tie-off on an
+internal status signal indicating electrical idle.
+
+Status signals going from SERDES to PCIe Controller are tied-off when a
+lane is not assigned to PCIe. Signal indicating electrical idle is
+incorrectly tied-off to a state that indicates non-idle. As a result,
+PCIe sees unused lanes to be out of electrical idle and this causes
+LTSSM to exit Detect.Quiet state without waiting for 12ms timeout to
+occur. If a receiver is not detected on the first receiver detection
+attempt in Detect.Active state, LTSSM goes back to Detect.Quiet and
+again moves forward to Detect.Active state without waiting for 12ms as
+required by PCIe base specification. Since wait time in Detect.Quiet is
+skipped, multiple receiver detect operations are performed back-to-back
+without allowing time for capacitance on the transmit lines to
+discharge. This causes subsequent receiver detection to always fail even
+if a receiver gets connected eventually.
+
+Add a quirk flag "quirk_detect_quiet_flag" to program the minimum
+time the LTSSM should wait on entering Detect.Quiet state here.
+This has to be set for J7200 as it has an incorrect tie-off on unused
+lanes.
+
+Link: https://lore.kernel.org/r/20210811123336.31357-3-kishon@ti.com
+Signed-off-by: Nadeem Athani <nadeem@cadence.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-ep.c | 4 ++++
+ .../pci/controller/cadence/pcie-cadence-host.c | 3 +++
+ drivers/pci/controller/cadence/pcie-cadence.c | 16 ++++++++++++++++
+ drivers/pci/controller/cadence/pcie-cadence.h | 15 +++++++++++++++
+ 4 files changed, 38 insertions(+)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+index 84cc58dc8512..1af14474abcf 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-ep.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c
+@@ -578,6 +578,10 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
+ /* Reserve region 0 for IRQs */
+ set_bit(0, &ep->ob_region_map);
++
++ if (ep->quirk_detect_quiet_flag)
++ cdns_pcie_detect_quiet_min_delay_set(&ep->pcie);
++
+ spin_lock_init(&ep->lock);
+
+ return 0;
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 73dcf8cf98fb..a40ed9e12b4b 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -497,6 +497,9 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
+ return PTR_ERR(rc->cfg_base);
+ rc->cfg_res = res;
+
++ if (rc->quirk_detect_quiet_flag)
++ cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
++
+ ret = cdns_pcie_start_link(pcie);
+ if (ret) {
+ dev_err(dev, "Failed to start link\n");
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 3c3646502d05..52767f26048f 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -7,6 +7,22 @@
+
+ #include "pcie-cadence.h"
+
++void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie)
++{
++ u32 delay = 0x3;
++ u32 ltssm_control_cap;
++
++ /*
++ * Set the LTSSM Detect Quiet state min. delay to 2ms.
++ */
++ ltssm_control_cap = cdns_pcie_readl(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP);
++ ltssm_control_cap = ((ltssm_control_cap &
++ ~CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK) |
++ CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay));
++
++ cdns_pcie_writel(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP, ltssm_control_cap);
++}
++
+ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ u32 r, bool is_io,
+ u64 cpu_addr, u64 pci_addr, size_t size)
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 60981877f65b..e0b59730bffb 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -189,6 +189,14 @@
+ /* AXI link down register */
+ #define CDNS_PCIE_AT_LINKDOWN (CDNS_PCIE_AT_BASE + 0x0824)
+
++/* LTSSM Capabilities register */
++#define CDNS_PCIE_LTSSM_CONTROL_CAP (CDNS_PCIE_LM_BASE + 0x0054)
++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK GENMASK(2, 1)
++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT 1
++#define CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay) \
++ (((delay) << CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT) & \
++ CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK)
++
+ enum cdns_pcie_rp_bar {
+ RP_BAR_UNDEFINED = -1,
+ RP_BAR0,
+@@ -291,6 +299,7 @@ struct cdns_pcie {
+ * @avail_ib_bar: Satus of RP_BAR0, RP_BAR1 and RP_NO_BAR if it's free or
+ * available
+ * @quirk_retrain_flag: Retrain link as quirk for PCIe Gen2
++ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk
+ */
+ struct cdns_pcie_rc {
+ struct cdns_pcie pcie;
+@@ -300,6 +309,7 @@ struct cdns_pcie_rc {
+ u32 device_id;
+ bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB];
+ unsigned int quirk_retrain_flag:1;
++ unsigned int quirk_detect_quiet_flag:1;
+ };
+
+ /**
+@@ -330,6 +340,7 @@ struct cdns_pcie_epf {
+ * registers fields (RMW) accessible by both remote RC and EP to
+ * minimize time between read and write
+ * @epf: Structure to hold info about endpoint function
++ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk
+ */
+ struct cdns_pcie_ep {
+ struct cdns_pcie pcie;
+@@ -344,6 +355,7 @@ struct cdns_pcie_ep {
+ /* protect writing to PCI_STATUS while raising legacy interrupts */
+ spinlock_t lock;
+ struct cdns_pcie_epf *epf;
++ unsigned int quirk_detect_quiet_flag:1;
+ };
+
+
+@@ -504,6 +516,9 @@ static inline int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
+ return 0;
+ }
+ #endif
++
++void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie);
++
+ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ u32 r, bool is_io,
+ u64 cpu_addr, u64 pci_addr, size_t size);
+--
+2.30.2
+
--- /dev/null
+From 03b87df74be4dfbe499737548b52164d551a4471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:03:32 +0530
+Subject: PCI: cadence: Use bitfield for *quirk_retrain_flag* instead of bool
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit f4455748b2126a9ba2bcc9cfb2fbcaa08de29bb2 ]
+
+No functional change. As we are intending to add additional 1-bit
+members in struct j721e_pcie_data/struct cdns_pcie_rc, use bitfields
+instead of bool since it takes less space. As discussed in [1],
+the preference is to use bitfileds instead of bool inside structures.
+
+[1] -> https://lore.kernel.org/linux-fsdevel/CA+55aFzKQ6Pj18TB8p4Yr0M4t+S+BsiHH=BJNmn=76-NcjTj-g@mail.gmail.com/
+
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://lore.kernel.org/r/20210811123336.31357-2-kishon@ti.com
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index d34ca0fda0f6..973b309ac9ba 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -63,7 +63,7 @@ enum j721e_pcie_mode {
+
+ struct j721e_pcie_data {
+ enum j721e_pcie_mode mode;
+- bool quirk_retrain_flag;
++ unsigned int quirk_retrain_flag:1;
+ };
+
+ static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset)
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 6705a5fedfbb..60981877f65b 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -299,7 +299,7 @@ struct cdns_pcie_rc {
+ u32 vendor_id;
+ u32 device_id;
+ bool avail_ib_bar[CDNS_PCIE_RP_MAX_IB];
+- bool quirk_retrain_flag;
++ unsigned int quirk_retrain_flag:1;
+ };
+
+ /**
+--
+2.30.2
+
--- /dev/null
+From 03b8e430bbeee38980f154936b4410b1e5f9cf12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Aug 2021 10:00:04 +0300
+Subject: PCI: Fix pci_dev_str_match_path() alloc while atomic bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7eb6ea4148579b85540a41d57bcec315b8af8ff8 ]
+
+pci_dev_str_match_path() is often called with a spinlock held so the
+allocation has to be atomic. The call tree is:
+
+ pci_specified_resource_alignment() <-- takes spin_lock();
+ pci_dev_str_match()
+ pci_dev_str_match_path()
+
+Fixes: 45db33709ccc ("PCI: Allow specifying devices using a base bus and path of devfns")
+Link: https://lore.kernel.org/r/20210812070004.GC31863@kili
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index eae6a9fdd33d..0d7109018a91 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -265,7 +265,7 @@ static int pci_dev_str_match_path(struct pci_dev *dev, const char *path,
+
+ *endptr = strchrnul(path, ';');
+
+- wpath = kmemdup_nul(path, *endptr - path, GFP_KERNEL);
++ wpath = kmemdup_nul(path, *endptr - path, GFP_ATOMIC);
+ if (!wpath)
+ return -ENOMEM;
+
+--
+2.30.2
+
--- /dev/null
+From d6fa740db2891d48a08fc4103ac2092324f5d2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Aug 2021 11:57:51 -0500
+Subject: PCI: ibmphp: Fix double unmap of io_mem
+
+From: Vishal Aslot <os.vaslot@gmail.com>
+
+[ Upstream commit faa2e05ad0dccf37f995bcfbb8d1980d66c02c11 ]
+
+ebda_rsrc_controller() calls iounmap(io_mem) on the error path. Its caller,
+ibmphp_access_ebda(), also calls iounmap(io_mem) on good and error paths.
+
+Remove the iounmap(io_mem) invocation from ebda_rsrc_controller().
+
+[bhelgaas: remove item from TODO]
+Link: https://lore.kernel.org/r/20210818165751.591185-1-os.vaslot@gmail.com
+Signed-off-by: Vishal Aslot <os.vaslot@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/hotplug/TODO | 3 ---
+ drivers/pci/hotplug/ibmphp_ebda.c | 5 +----
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/drivers/pci/hotplug/TODO b/drivers/pci/hotplug/TODO
+index a32070be5adf..cc6194aa24c1 100644
+--- a/drivers/pci/hotplug/TODO
++++ b/drivers/pci/hotplug/TODO
+@@ -40,9 +40,6 @@ ibmphp:
+
+ * The return value of pci_hp_register() is not checked.
+
+-* iounmap(io_mem) is called in the error path of ebda_rsrc_controller()
+- and once more in the error path of its caller ibmphp_access_ebda().
+-
+ * The various slot data structures are difficult to follow and need to be
+ simplified. A lot of functions are too large and too complex, they need
+ to be broken up into smaller, manageable pieces. Negative examples are
+diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
+index 11a2661dc062..7fb75401ad8a 100644
+--- a/drivers/pci/hotplug/ibmphp_ebda.c
++++ b/drivers/pci/hotplug/ibmphp_ebda.c
+@@ -714,8 +714,7 @@ static int __init ebda_rsrc_controller(void)
+ /* init hpc structure */
+ hpc_ptr = alloc_ebda_hpc(slot_num, bus_num);
+ if (!hpc_ptr) {
+- rc = -ENOMEM;
+- goto error_no_hpc;
++ return -ENOMEM;
+ }
+ hpc_ptr->ctlr_id = ctlr_id;
+ hpc_ptr->ctlr_relative_id = ctlr;
+@@ -910,8 +909,6 @@ error:
+ kfree(tmp_slot);
+ error_no_slot:
+ free_ebda_hpc(hpc_ptr);
+-error_no_hpc:
+- iounmap(io_mem);
+ return rc;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 120c0c172f49add914a62bf7ca7b818e0943ed20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 15:56:56 -0600
+Subject: PCI: iproc: Fix BCMA probe resource handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit aeaea8969b402e0081210cc9144404d13996efed ]
+
+In commit 7ef1c871da16 ("PCI: iproc: Use
+pci_parse_request_of_pci_ranges()"), calling
+devm_request_pci_bus_resources() was dropped from the common iProc
+probe code, but is still needed for BCMA bus probing. Without it, there
+will be lots of warnings like this:
+
+pci 0000:00:00.0: BAR 8: no space for [mem size 0x00c00000]
+pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x00c00000]
+
+Add back calling devm_request_pci_bus_resources() and adding the
+resources to pci_host_bridge.windows for BCMA bus probe.
+
+Link: https://lore.kernel.org/r/20210803215656.3803204-2-robh@kernel.org
+Fixes: 7ef1c871da16 ("PCI: iproc: Use pci_parse_request_of_pci_ranges()")
+Reported-by: Rafał Miłecki <zajec5@gmail.com>
+Tested-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Srinath Mannam <srinath.mannam@broadcom.com>
+Cc: Roman Bacik <roman.bacik@broadcom.com>
+Cc: Bharat Gooty <bharat.gooty@broadcom.com>
+Cc: Abhishek Shah <abhishek.shah@broadcom.com>
+Cc: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Cc: Ray Jui <ray.jui@broadcom.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: BCM Kernel Feedback <bcm-kernel-feedback-list@broadcom.com>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: "Krzysztof Wilczyński" <kw@linux.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc-bcma.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc-bcma.c b/drivers/pci/controller/pcie-iproc-bcma.c
+index 56b8ee7bf330..f918c713afb0 100644
+--- a/drivers/pci/controller/pcie-iproc-bcma.c
++++ b/drivers/pci/controller/pcie-iproc-bcma.c
+@@ -35,7 +35,6 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
+ {
+ struct device *dev = &bdev->dev;
+ struct iproc_pcie *pcie;
+- LIST_HEAD(resources);
+ struct pci_host_bridge *bridge;
+ int ret;
+
+@@ -60,19 +59,16 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
+ pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1;
+ pcie->mem.name = "PCIe MEM space";
+ pcie->mem.flags = IORESOURCE_MEM;
+- pci_add_resource(&resources, &pcie->mem);
++ pci_add_resource(&bridge->windows, &pcie->mem);
++ ret = devm_request_pci_bus_resources(dev, &bridge->windows);
++ if (ret)
++ return ret;
+
+ pcie->map_irq = iproc_pcie_bcma_map_irq;
+
+- ret = iproc_pcie_setup(pcie, &resources);
+- if (ret) {
+- dev_err(dev, "PCIe controller setup failed\n");
+- pci_free_resource_list(&resources);
+- return ret;
+- }
+-
+ bcma_set_drvdata(bdev, pcie);
+- return 0;
++
++ return iproc_pcie_setup(pcie, &bridge->windows);
+ }
+
+ static void iproc_pcie_bcma_remove(struct bcma_device *bdev)
+--
+2.30.2
+
--- /dev/null
+From 90d362c8c238106672d50632f15187e5a6ed2fdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:03:35 +0530
+Subject: PCI: j721e: Add PCIe support for AM64
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit c8a375a8e15ac31293d7fda08008d6da8f5df3db ]
+
+AM64 has the same PCIe IP as in J7200 with certain erratas not
+applicable (quirk_detect_quiet_flag). Add support for "ti,am64-pcie-host"
+compatible and "ti,am64-pcie-ep" compatible that is specific to AM64.
+
+Link: https://lore.kernel.org/r/20210811123336.31357-5-kishon@ti.com
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 2f5a49c77074..8a6d68e13f30 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -298,6 +298,17 @@ static const struct j721e_pcie_data j7200_pcie_ep_data = {
+ .quirk_detect_quiet_flag = true,
+ };
+
++static const struct j721e_pcie_data am64_pcie_rc_data = {
++ .mode = PCI_MODE_RC,
++ .linkdown_irq_regfield = J7200_LINK_DOWN,
++ .byte_access_allowed = true,
++};
++
++static const struct j721e_pcie_data am64_pcie_ep_data = {
++ .mode = PCI_MODE_EP,
++ .linkdown_irq_regfield = J7200_LINK_DOWN,
++};
++
+ static const struct of_device_id of_j721e_pcie_match[] = {
+ {
+ .compatible = "ti,j721e-pcie-host",
+@@ -315,6 +326,14 @@ static const struct of_device_id of_j721e_pcie_match[] = {
+ .compatible = "ti,j7200-pcie-ep",
+ .data = &j7200_pcie_ep_data,
+ },
++ {
++ .compatible = "ti,am64-pcie-host",
++ .data = &am64_pcie_rc_data,
++ },
++ {
++ .compatible = "ti,am64-pcie-ep",
++ .data = &am64_pcie_ep_data,
++ },
+ {},
+ };
+
+--
+2.30.2
+
--- /dev/null
+From fe6de64bfdc506f571cfd218f2d6771a8f92cb4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Aug 2021 18:03:34 +0530
+Subject: PCI: j721e: Add PCIe support for J7200
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit f1de58802f0fff364cf49f5e47d1be744baa434f ]
+
+J7200 has the same PCIe IP as in J721E with minor changes in the
+wrapper. J7200 allows byte access of bridge configuration space
+registers and the register field for LINK_DOWN interrupt is different.
+J7200 also requires "quirk_detect_quiet_flag" to be set. Configure these
+changes as part of driver data applicable only to J7200.
+
+Link: https://lore.kernel.org/r/20210811123336.31357-4-kishon@ti.com
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pci-j721e.c | 40 +++++++++++++++++++---
+ 1 file changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
+index 973b309ac9ba..2f5a49c77074 100644
+--- a/drivers/pci/controller/cadence/pci-j721e.c
++++ b/drivers/pci/controller/cadence/pci-j721e.c
+@@ -25,6 +25,7 @@
+ #define STATUS_REG_SYS_2 0x508
+ #define STATUS_CLR_REG_SYS_2 0x708
+ #define LINK_DOWN BIT(1)
++#define J7200_LINK_DOWN BIT(10)
+
+ #define J721E_PCIE_USER_CMD_STATUS 0x4
+ #define LINK_TRAINING_ENABLE BIT(0)
+@@ -54,6 +55,7 @@ struct j721e_pcie {
+ struct cdns_pcie *cdns_pcie;
+ void __iomem *user_cfg_base;
+ void __iomem *intd_cfg_base;
++ u32 linkdown_irq_regfield;
+ };
+
+ enum j721e_pcie_mode {
+@@ -64,6 +66,9 @@ enum j721e_pcie_mode {
+ struct j721e_pcie_data {
+ enum j721e_pcie_mode mode;
+ unsigned int quirk_retrain_flag:1;
++ unsigned int quirk_detect_quiet_flag:1;
++ u32 linkdown_irq_regfield;
++ unsigned int byte_access_allowed:1;
+ };
+
+ static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset)
+@@ -95,12 +100,12 @@ static irqreturn_t j721e_pcie_link_irq_handler(int irq, void *priv)
+ u32 reg;
+
+ reg = j721e_pcie_intd_readl(pcie, STATUS_REG_SYS_2);
+- if (!(reg & LINK_DOWN))
++ if (!(reg & pcie->linkdown_irq_regfield))
+ return IRQ_NONE;
+
+ dev_err(dev, "LINK DOWN!\n");
+
+- j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, LINK_DOWN);
++ j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, pcie->linkdown_irq_regfield);
+ return IRQ_HANDLED;
+ }
+
+@@ -109,7 +114,7 @@ static void j721e_pcie_config_link_irq(struct j721e_pcie *pcie)
+ u32 reg;
+
+ reg = j721e_pcie_intd_readl(pcie, ENABLE_REG_SYS_2);
+- reg |= LINK_DOWN;
++ reg |= pcie->linkdown_irq_regfield;
+ j721e_pcie_intd_writel(pcie, ENABLE_REG_SYS_2, reg);
+ }
+
+@@ -272,10 +277,25 @@ static struct pci_ops cdns_ti_pcie_host_ops = {
+ static const struct j721e_pcie_data j721e_pcie_rc_data = {
+ .mode = PCI_MODE_RC,
+ .quirk_retrain_flag = true,
++ .byte_access_allowed = false,
++ .linkdown_irq_regfield = LINK_DOWN,
+ };
+
+ static const struct j721e_pcie_data j721e_pcie_ep_data = {
+ .mode = PCI_MODE_EP,
++ .linkdown_irq_regfield = LINK_DOWN,
++};
++
++static const struct j721e_pcie_data j7200_pcie_rc_data = {
++ .mode = PCI_MODE_RC,
++ .quirk_detect_quiet_flag = true,
++ .linkdown_irq_regfield = J7200_LINK_DOWN,
++ .byte_access_allowed = true,
++};
++
++static const struct j721e_pcie_data j7200_pcie_ep_data = {
++ .mode = PCI_MODE_EP,
++ .quirk_detect_quiet_flag = true,
+ };
+
+ static const struct of_device_id of_j721e_pcie_match[] = {
+@@ -287,6 +307,14 @@ static const struct of_device_id of_j721e_pcie_match[] = {
+ .compatible = "ti,j721e-pcie-ep",
+ .data = &j721e_pcie_ep_data,
+ },
++ {
++ .compatible = "ti,j7200-pcie-host",
++ .data = &j7200_pcie_rc_data,
++ },
++ {
++ .compatible = "ti,j7200-pcie-ep",
++ .data = &j7200_pcie_ep_data,
++ },
+ {},
+ };
+
+@@ -319,6 +347,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+
+ pcie->dev = dev;
+ pcie->mode = mode;
++ pcie->linkdown_irq_regfield = data->linkdown_irq_regfield;
+
+ base = devm_platform_ioremap_resource_byname(pdev, "intd_cfg");
+ if (IS_ERR(base))
+@@ -378,9 +407,11 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ goto err_get_sync;
+ }
+
+- bridge->ops = &cdns_ti_pcie_host_ops;
++ if (!data->byte_access_allowed)
++ bridge->ops = &cdns_ti_pcie_host_ops;
+ rc = pci_host_bridge_priv(bridge);
+ rc->quirk_retrain_flag = data->quirk_retrain_flag;
++ rc->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag;
+
+ cdns_pcie = &rc->pcie;
+ cdns_pcie->dev = dev;
+@@ -430,6 +461,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
+ ret = -ENOMEM;
+ goto err_get_sync;
+ }
++ ep->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag;
+
+ cdns_pcie = &ep->pcie;
+ cdns_pcie->dev = dev;
+--
+2.30.2
+
--- /dev/null
+From 42952b952673603666f4a6644602d3b9942f64fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Aug 2021 15:56:55 -0600
+Subject: PCI: of: Don't fail devm_pci_alloc_host_bridge() on missing 'ranges'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit d277f6e88c88729b1d57d40bbfb00d0bfc961972 ]
+
+Commit 669cbc708122 ("PCI: Move DT resource setup into
+devm_pci_alloc_host_bridge()") made devm_pci_alloc_host_bridge() fail on
+any DT resource parsing errors, but Broadcom iProc uses
+devm_pci_alloc_host_bridge() on BCMA bus devices that don't have DT
+resources. In particular, there is no 'ranges' property. Fix iProc by
+making 'ranges' optional.
+
+If 'ranges' is required by a platform, there's going to be more errors
+latter on if it is missing.
+
+Link: https://lore.kernel.org/r/20210803215656.3803204-1-robh@kernel.org
+Fixes: 669cbc708122 ("PCI: Move DT resource setup into devm_pci_alloc_host_bridge()")
+Reported-by: Rafał Miłecki <zajec5@gmail.com>
+Tested-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Srinath Mannam <srinath.mannam@broadcom.com>
+Cc: Roman Bacik <roman.bacik@broadcom.com>
+Cc: Bharat Gooty <bharat.gooty@broadcom.com>
+Cc: Abhishek Shah <abhishek.shah@broadcom.com>
+Cc: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Cc: Ray Jui <ray.jui@broadcom.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: BCM Kernel Feedback <bcm-kernel-feedback-list@broadcom.com>
+Cc: Scott Branden <sbranden@broadcom.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/of.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/of.c b/drivers/pci/of.c
+index ac24cd5439a9..3f6ef2f45e57 100644
+--- a/drivers/pci/of.c
++++ b/drivers/pci/of.c
+@@ -295,7 +295,7 @@ static int devm_of_pci_get_host_bridge_resources(struct device *dev,
+ /* Check for ranges property */
+ err = of_pci_range_parser_init(&parser, dev_node);
+ if (err)
+- goto failed;
++ return 0;
+
+ dev_dbg(dev, "Parsing ranges property...\n");
+ for_each_of_pci_range(&parser, &range) {
+--
+2.30.2
+
--- /dev/null
+From 9541f4240597710351388f1301aad24c53ac9244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Apr 2021 15:24:02 +0800
+Subject: PCI: rcar: Fix runtime PM imbalance in rcar_pcie_ep_probe()
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 1e29cd9983eba1b596bc07f94d81d728007f8a25 ]
+
+pm_runtime_get_sync() will increase the runtime PM counter
+even it returns an error. Thus a pairing decrement is needed
+to prevent refcount leak. Fix this by replacing this API with
+pm_runtime_resume_and_get(), which will not change the runtime
+PM counter on error.
+
+Link: https://lore.kernel.org/r/20210408072402.15069-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-rcar-ep.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c
+index b4a288e24aaf..c91d85b15129 100644
+--- a/drivers/pci/controller/pcie-rcar-ep.c
++++ b/drivers/pci/controller/pcie-rcar-ep.c
+@@ -492,9 +492,9 @@ static int rcar_pcie_ep_probe(struct platform_device *pdev)
+ pcie->dev = dev;
+
+ pm_runtime_enable(dev);
+- err = pm_runtime_get_sync(dev);
++ err = pm_runtime_resume_and_get(dev);
+ if (err < 0) {
+- dev_err(dev, "pm_runtime_get_sync failed\n");
++ dev_err(dev, "pm_runtime_resume_and_get failed\n");
+ goto err_pm_disable;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From fcbd18b35d5a09c96a4b42d019079ef364398277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Aug 2021 18:36:19 +0300
+Subject: PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 817f9916a6e96ae43acdd4e75459ef4f92d96eb1 ]
+
+The CONFIG_PCI=y case got a new parameter long time ago. Sync the stub as
+well.
+
+[bhelgaas: add parameter names]
+Fixes: 725522b5453d ("PCI: add the sysfs driver name to all modules")
+Link: https://lore.kernel.org/r/20210813153619.89574-1-andriy.shevchenko@linux.intel.com
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 22207a79762c..a55097b4d992 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1713,8 +1713,9 @@ static inline void pci_disable_device(struct pci_dev *dev) { }
+ static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; }
+ static inline int pci_assign_resource(struct pci_dev *dev, int i)
+ { return -EBUSY; }
+-static inline int __pci_register_driver(struct pci_driver *drv,
+- struct module *owner)
++static inline int __must_check __pci_register_driver(struct pci_driver *drv,
++ struct module *owner,
++ const char *mod_name)
+ { return 0; }
+ static inline int pci_register_driver(struct pci_driver *drv)
+ { return 0; }
+--
+2.30.2
+
--- /dev/null
+From e945f2e8e7f1e75f5598064d4cbd6eecdadfc25d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 May 2021 19:17:42 +0200
+Subject: PCI: tegra: Fix OF node reference leak
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit eff21f5da308265678e7e59821795e606f3e560f ]
+
+Commit 9e38e690ace3 ("PCI: tegra: Fix OF node reference leak") has fixed
+some node reference leaks in this function but missed some of them.
+
+In fact, having 'port' referenced in the 'rp' structure is not enough to
+prevent the leak, until 'rp' is actually added in the 'pcie->ports' list.
+
+Add the missing 'goto err_node_put' accordingly.
+
+Link: https://lore.kernel.org/r/55b11e9a7fa2987fbc0869d68ae59888954d65e2.1620148539.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-tegra.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 1a2af963599c..b4eb75f25906 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -2160,13 +2160,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ rp->np = port;
+
+ rp->base = devm_pci_remap_cfg_resource(dev, &rp->regs);
+- if (IS_ERR(rp->base))
+- return PTR_ERR(rp->base);
++ if (IS_ERR(rp->base)) {
++ err = PTR_ERR(rp->base);
++ goto err_node_put;
++ }
+
+ label = devm_kasprintf(dev, GFP_KERNEL, "pex-reset-%u", index);
+ if (!label) {
+- dev_err(dev, "failed to create reset GPIO label\n");
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto err_node_put;
+ }
+
+ /*
+@@ -2184,7 +2186,8 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
+ } else {
+ dev_err(dev, "failed to get reset GPIO: %ld\n",
+ PTR_ERR(rp->reset_gpio));
+- return PTR_ERR(rp->reset_gpio);
++ err = PTR_ERR(rp->reset_gpio);
++ goto err_node_put;
+ }
+ }
+
+--
+2.30.2
+
--- /dev/null
+From b373e9d0689e59d46073a7131f33d389517e1ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jun 2021 15:35:21 +0530
+Subject: PCI: tegra194: Fix handling BME_CHGED event
+
+From: Om Prakash Singh <omp@nvidia.com>
+
+[ Upstream commit ceb1412c1c8ca5b28c4252bdb15f2f1f17b4a1b0 ]
+
+In tegra_pcie_ep_hard_irq(), APPL_INTR_STATUS_L0 is stored in val and again
+APPL_INTR_STATUS_L1_0_0 is also stored in val. So when execution reaches
+"if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT)", val is not correct.
+
+Link: https://lore.kernel.org/r/20210623100525.19944-2-omp@nvidia.com
+Signed-off-by: Om Prakash Singh <omp@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 30 +++++++++++-----------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index 506f6a294eac..c2827a8d208f 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -515,19 +515,19 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
+ struct tegra_pcie_dw *pcie = arg;
+ struct dw_pcie_ep *ep = &pcie->pci.ep;
+ int spurious = 1;
+- u32 val, tmp;
++ u32 status_l0, status_l1, link_status;
+
+- val = appl_readl(pcie, APPL_INTR_STATUS_L0);
+- if (val & APPL_INTR_STATUS_L0_LINK_STATE_INT) {
+- val = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0);
+- appl_writel(pcie, val, APPL_INTR_STATUS_L1_0_0);
++ status_l0 = appl_readl(pcie, APPL_INTR_STATUS_L0);
++ if (status_l0 & APPL_INTR_STATUS_L0_LINK_STATE_INT) {
++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0);
++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_0_0);
+
+- if (val & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE)
++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE)
+ pex_ep_event_hot_rst_done(pcie);
+
+- if (val & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) {
+- tmp = appl_readl(pcie, APPL_LINK_STATUS);
+- if (tmp & APPL_LINK_STATUS_RDLH_LINK_UP) {
++ if (status_l1 & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) {
++ link_status = appl_readl(pcie, APPL_LINK_STATUS);
++ if (link_status & APPL_LINK_STATUS_RDLH_LINK_UP) {
+ dev_dbg(pcie->dev, "Link is up with Host\n");
+ dw_pcie_ep_linkup(ep);
+ }
+@@ -536,11 +536,11 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
+ spurious = 0;
+ }
+
+- if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) {
+- val = appl_readl(pcie, APPL_INTR_STATUS_L1_15);
+- appl_writel(pcie, val, APPL_INTR_STATUS_L1_15);
++ if (status_l0 & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) {
++ status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_15);
++ appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_15);
+
+- if (val & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED)
++ if (status_l1 & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED)
+ return IRQ_WAKE_THREAD;
+
+ spurious = 0;
+@@ -548,8 +548,8 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
+
+ if (spurious) {
+ dev_warn(pcie->dev, "Random interrupt (STATUS = 0x%08X)\n",
+- val);
+- appl_writel(pcie, val, APPL_INTR_STATUS_L0);
++ status_l0);
++ appl_writel(pcie, status_l0, APPL_INTR_STATUS_L0);
+ }
+
+ return IRQ_HANDLED;
+--
+2.30.2
+
--- /dev/null
+From e5b06e3bb9eca7f0f31a615d33dcbe0e20602f1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jun 2021 15:35:22 +0530
+Subject: PCI: tegra194: Fix MSI-X programming
+
+From: Om Prakash Singh <omp@nvidia.com>
+
+[ Upstream commit 43537cf7e351264a1f05ed42ad402942bfc9140e ]
+
+Lower order MSI-X address is programmed in MSIX_ADDR_MATCH_HIGH_OFF
+DBI register instead of higher order address. This patch fixes this
+programming mistake.
+
+Link: https://lore.kernel.org/r/20210623100525.19944-3-omp@nvidia.com
+Signed-off-by: Om Prakash Singh <omp@nvidia.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Vidya Sagar <vidyas@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-tegra194.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
+index c2827a8d208f..a5b677ec0769 100644
+--- a/drivers/pci/controller/dwc/pcie-tegra194.c
++++ b/drivers/pci/controller/dwc/pcie-tegra194.c
+@@ -1778,7 +1778,7 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie)
+ val = (ep->msi_mem_phys & MSIX_ADDR_MATCH_LOW_OFF_MASK);
+ val |= MSIX_ADDR_MATCH_LOW_OFF_EN;
+ dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_LOW_OFF, val);
+- val = (lower_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK);
++ val = (upper_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK);
+ dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_HIGH_OFF, val);
+
+ ret = dw_pcie_ep_init_complete(ep);
+--
+2.30.2
+
--- /dev/null
+From ea2d439cc4a9d28390bc167d15c3243da538e27b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Aug 2021 11:50:37 -0300
+Subject: perf bench inject-buildid: Handle writen() errors
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit edf7b4a2d85e37a1ee77156bddaed4aa6af9c5e1 ]
+
+The build on fedora:35 and fedora:rawhide with clang is failing with:
+
+ 49 41.00 fedora:35 : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35)
+ bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable]
+ u64 len = 0;
+ ^
+ 1 error generated.
+ make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2
+ 50 41.11 fedora:rawhide : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35)
+ bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable]
+ u64 len = 0;
+ ^
+ 1 error generated.
+ make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2
+
+That 'len' variable is not used at all, so just make sure all the
+synthesize_RECORD() routines return ssize_t to propagate the writen()
+return, as it may fail, ditch the 'ret' var and bail out if those
+routines fail.
+
+Fixes: 0bf02a0d80427f26 ("perf bench: Add build-id injection benchmark")
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/CAM9d7cgEZNSor+B+7Y2C+QYGme_v5aH0Zn0RLfxoQ+Fy83EHrg@mail.gmail.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/inject-buildid.c | 52 ++++++++++++++++++-------------
+ 1 file changed, 30 insertions(+), 22 deletions(-)
+
+diff --git a/tools/perf/bench/inject-buildid.c b/tools/perf/bench/inject-buildid.c
+index 280227e3ffd7..f4ec01da8da6 100644
+--- a/tools/perf/bench/inject-buildid.c
++++ b/tools/perf/bench/inject-buildid.c
+@@ -133,7 +133,7 @@ static u64 dso_map_addr(struct bench_dso *dso)
+ return 0x400000ULL + dso->ino * 8192ULL;
+ }
+
+-static u32 synthesize_attr(struct bench_data *data)
++static ssize_t synthesize_attr(struct bench_data *data)
+ {
+ union perf_event event;
+
+@@ -151,7 +151,7 @@ static u32 synthesize_attr(struct bench_data *data)
+ return writen(data->input_pipe[1], &event, event.header.size);
+ }
+
+-static u32 synthesize_fork(struct bench_data *data)
++static ssize_t synthesize_fork(struct bench_data *data)
+ {
+ union perf_event event;
+
+@@ -169,8 +169,7 @@ static u32 synthesize_fork(struct bench_data *data)
+ return writen(data->input_pipe[1], &event, event.header.size);
+ }
+
+-static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso,
+- u64 timestamp)
++static ssize_t synthesize_mmap(struct bench_data *data, struct bench_dso *dso, u64 timestamp)
+ {
+ union perf_event event;
+ size_t len = offsetof(struct perf_record_mmap2, filename);
+@@ -198,23 +197,25 @@ static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso,
+
+ if (len > sizeof(event.mmap2)) {
+ /* write mmap2 event first */
+- writen(data->input_pipe[1], &event, len - bench_id_hdr_size);
++ if (writen(data->input_pipe[1], &event, len - bench_id_hdr_size) < 0)
++ return -1;
+ /* zero-fill sample id header */
+ memset(id_hdr_ptr, 0, bench_id_hdr_size);
+ /* put timestamp in the right position */
+ ts_idx = (bench_id_hdr_size / sizeof(u64)) - 2;
+ id_hdr_ptr[ts_idx] = timestamp;
+- writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size);
+- } else {
+- ts_idx = (len / sizeof(u64)) - 2;
+- id_hdr_ptr[ts_idx] = timestamp;
+- writen(data->input_pipe[1], &event, len);
++ if (writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size) < 0)
++ return -1;
++
++ return len;
+ }
+- return len;
++
++ ts_idx = (len / sizeof(u64)) - 2;
++ id_hdr_ptr[ts_idx] = timestamp;
++ return writen(data->input_pipe[1], &event, len);
+ }
+
+-static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso,
+- u64 timestamp)
++static ssize_t synthesize_sample(struct bench_data *data, struct bench_dso *dso, u64 timestamp)
+ {
+ union perf_event event;
+ struct perf_sample sample = {
+@@ -233,7 +234,7 @@ static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso,
+ return writen(data->input_pipe[1], &event, event.header.size);
+ }
+
+-static u32 synthesize_flush(struct bench_data *data)
++static ssize_t synthesize_flush(struct bench_data *data)
+ {
+ struct perf_event_header header = {
+ .size = sizeof(header),
+@@ -348,14 +349,16 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss)
+ int status;
+ unsigned int i, k;
+ struct rusage rusage;
+- u64 len = 0;
+
+ /* this makes the child to run */
+ if (perf_header__write_pipe(data->input_pipe[1]) < 0)
+ return -1;
+
+- len += synthesize_attr(data);
+- len += synthesize_fork(data);
++ if (synthesize_attr(data) < 0)
++ return -1;
++
++ if (synthesize_fork(data) < 0)
++ return -1;
+
+ for (i = 0; i < nr_mmaps; i++) {
+ int idx = rand() % (nr_dsos - 1);
+@@ -363,13 +366,18 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss)
+ u64 timestamp = rand() % 1000000;
+
+ pr_debug2(" [%d] injecting: %s\n", i+1, dso->name);
+- len += synthesize_mmap(data, dso, timestamp);
++ if (synthesize_mmap(data, dso, timestamp) < 0)
++ return -1;
+
+- for (k = 0; k < nr_samples; k++)
+- len += synthesize_sample(data, dso, timestamp + k * 1000);
++ for (k = 0; k < nr_samples; k++) {
++ if (synthesize_sample(data, dso, timestamp + k * 1000) < 0)
++ return -1;
++ }
+
+- if ((i + 1) % 10 == 0)
+- len += synthesize_flush(data);
++ if ((i + 1) % 10 == 0) {
++ if (synthesize_flush(data) < 0)
++ return -1;
++ }
+ }
+
+ /* tihs makes the child to finish */
+--
+2.30.2
+
--- /dev/null
+From 8fcfc84a691ca19930fb19a1e9a14e37a69b7db5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 21:43:40 +0800
+Subject: perf unwind: Do not overwrite
+ FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}
+
+From: Li Huafei <lihuafei1@huawei.com>
+
+[ Upstream commit cdf32b44678c382a31dc183d9a767306915cda7b ]
+
+When setting LIBUNWIND_DIR, we first set
+
+ FEATURE_CHECK_LDFLAGS-libunwind-{aarch64,x86} = -L$(LIBUNWIND_DIR)/lib.
+
+<committer note>
+This happens a bit before, the overwritting, in:
+
+ libunwind_arch_set_flags = $(eval $(libunwind_arch_set_flags_code))
+ define libunwind_arch_set_flags_code
+ FEATURE_CHECK_CFLAGS-libunwind-$(1) = -I$(LIBUNWIND_DIR)/include
+ FEATURE_CHECK_LDFLAGS-libunwind-$(1) = -L$(LIBUNWIND_DIR)/lib
+ endef
+
+ ifdef LIBUNWIND_DIR
+ LIBUNWIND_CFLAGS = -I$(LIBUNWIND_DIR)/include
+ LIBUNWIND_LDFLAGS = -L$(LIBUNWIND_DIR)/lib
+ LIBUNWIND_ARCHS = x86 x86_64 arm aarch64 debug-frame-arm debug-frame-aarch64
+ $(foreach libunwind_arch,$(LIBUNWIND_ARCHS),$(call libunwind_arch_set_flags,$(libunwind_arch)))
+ endif
+
+Look at that 'foreach' on all the LIBUNWIND_ARCHS.
+</>
+
+After commit 5c4d7c82c0dc ("perf unwind: Do not put libunwind-{x86,aarch64}
+in FEATURE_TESTS_BASIC"), FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} is
+overwritten. As a result, the remote libunwind libraries cannot be searched
+from $(LIBUNWIND_DIR)/lib directory during feature check tests. Fix it with
+variable appending.
+
+Before this patch:
+
+ perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64
+ BUILD: Doing 'make -j16' parallel build
+ <SNIP>
+ ...
+ ... libopencsd: [ OFF ]
+ ... libunwind-x86: [ OFF ]
+ ... libunwind-x86_64: [ OFF ]
+ ... libunwind-arm: [ OFF ]
+ ... libunwind-aarch64: [ OFF ]
+ ... libunwind-debug-frame: [ OFF ]
+ ... libunwind-debug-frame-arm: [ OFF ]
+ ... libunwind-debug-frame-aarch64: [ OFF ]
+ ... cxx: [ OFF ]
+ <SNIP>
+
+ perf$ cat ../build/feature/test-libunwind-aarch64.make.output
+ /usr/bin/ld: cannot find -lunwind-aarch64
+ /usr/bin/ld: cannot find -lunwind-aarch64
+ collect2: error: ld returned 1 exit status
+
+After this patch:
+
+ perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64
+ BUILD: Doing 'make -j16' parallel build
+ <SNIP>
+ ... libopencsd: [ OFF ]
+ ... libunwind-x86: [ OFF ]
+ ... libunwind-x86_64: [ OFF ]
+ ... libunwind-arm: [ OFF ]
+ ... libunwind-aarch64: [ on ]
+ ... libunwind-debug-frame: [ OFF ]
+ ... libunwind-debug-frame-arm: [ OFF ]
+ ... libunwind-debug-frame-aarch64: [ OFF ]
+ ... cxx: [ OFF ]
+ <SNIP>
+
+ perf$ cat ../build/feature/test-libunwind-aarch64.make.output
+
+ perf$ ldd ./perf
+ linux-vdso.so.1 (0x00007ffdf07da000)
+ libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f30953dc000)
+ librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f30951d4000)
+ libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f3094e36000)
+ libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3094c32000)
+ libelf.so.1 => /usr/lib/x86_64-linux-gnu/libelf.so.1 (0x00007f3094a18000)
+ libdw.so.1 => /usr/lib/x86_64-linux-gnu/libdw.so.1 (0x00007f30947cc000)
+ libunwind-x86_64.so.8 => /usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8 (0x00007f30945ad000)
+ libunwind.so.8 => /usr/lib/x86_64-linux-gnu/libunwind.so.8 (0x00007f3094392000)
+ liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f309416c000)
+ libunwind-aarch64.so.8 => not found
+ libslang.so.2 => /lib/x86_64-linux-gnu/libslang.so.2 (0x00007f3093c8a000)
+ libpython2.7.so.1.0 => /usr/local/lib/libpython2.7.so.1.0 (0x00007f309386b000)
+ libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f309364e000)
+ libnuma.so.1 => /usr/lib/x86_64-linux-gnu/libnuma.so.1 (0x00007f3093443000)
+ libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3093052000)
+ /lib64/ld-linux-x86-64.so.2 (0x00007f3096097000)
+ libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f3092e42000)
+ libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f3092c3f000)
+
+Fixes: 5c4d7c82c0dceccf ("perf unwind: Do not put libunwind-{x86,aarch64} in FEATURE_TESTS_BASIC")
+Signed-off-by: Li Huafei <lihuafei1@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: He Kuang <hekuang@huawei.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Zhang Jinhao <zhangjinhao2@huawei.com>
+Link: http://lore.kernel.org/lkml/20210823134340.60955-1-lihuafei1@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.config | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index 2abbd75fbf2e..014b959575ca 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -127,10 +127,10 @@ FEATURE_CHECK_LDFLAGS-libunwind = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS)
+ FEATURE_CHECK_CFLAGS-libunwind-debug-frame = $(LIBUNWIND_CFLAGS)
+ FEATURE_CHECK_LDFLAGS-libunwind-debug-frame = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS)
+
+-FEATURE_CHECK_LDFLAGS-libunwind-arm = -lunwind -lunwind-arm
+-FEATURE_CHECK_LDFLAGS-libunwind-aarch64 = -lunwind -lunwind-aarch64
+-FEATURE_CHECK_LDFLAGS-libunwind-x86 = -lunwind -llzma -lunwind-x86
+-FEATURE_CHECK_LDFLAGS-libunwind-x86_64 = -lunwind -llzma -lunwind-x86_64
++FEATURE_CHECK_LDFLAGS-libunwind-arm += -lunwind -lunwind-arm
++FEATURE_CHECK_LDFLAGS-libunwind-aarch64 += -lunwind -lunwind-aarch64
++FEATURE_CHECK_LDFLAGS-libunwind-x86 += -lunwind -llzma -lunwind-x86
++FEATURE_CHECK_LDFLAGS-libunwind-x86_64 += -lunwind -llzma -lunwind-x86_64
+
+ FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto
+
+--
+2.30.2
+
--- /dev/null
+From 5da58f95de08af6392a65a71fab6d863fe91c297 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Sep 2021 15:35:43 +0800
+Subject: qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 9ddbc2a00d7f63fa9748f4278643193dac985f2d ]
+
+Previous commit 68233c583ab4 removes the qlcnic_rom_lock()
+in qlcnic_pinit_from_rom(), but remains its corresponding
+unlock function, which is odd. I'm not very sure whether the
+lock is missing, or the unlock is redundant. This bug is
+suggested by a static analysis tool, please advise.
+
+Fixes: 68233c583ab4 ("qlcnic: updated reset sequence")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+index e6784023bce4..aa7ee43f9252 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+@@ -439,7 +439,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
+ QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1);
+ msleep(20);
+
+- qlcnic_rom_unlock(adapter);
+ /* big hammer don't reset CAM block on reset */
+ QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff);
+
+--
+2.30.2
+
--- /dev/null
+From df544f7c9e56f2f7515a310a919f8abb94e4d7ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 10:15:37 -0700
+Subject: selftests: mptcp: clean tmp files in simult_flows
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+[ Upstream commit bfd862a7e9318dd906844807a713d27cdd1a72b1 ]
+
+'$cin' and '$sin' variables are local to a function: they are then not
+available from the cleanup trap.
+
+Instead, we need to use '$large' and '$small' that are not local and
+defined just before setting the trap.
+
+Without this patch, running this script in a loop might cause a:
+
+ write: No space left on device
+
+issue.
+
+Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests")
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/mptcp/simult_flows.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/mptcp/simult_flows.sh b/tools/testing/selftests/net/mptcp/simult_flows.sh
+index 2f649b431456..8fcb28927818 100755
+--- a/tools/testing/selftests/net/mptcp/simult_flows.sh
++++ b/tools/testing/selftests/net/mptcp/simult_flows.sh
+@@ -21,8 +21,8 @@ usage() {
+
+ cleanup()
+ {
+- rm -f "$cin" "$cout"
+- rm -f "$sin" "$sout"
++ rm -f "$cout" "$sout"
++ rm -f "$large" "$small"
+ rm -f "$capout"
+
+ local netns
+--
+2.30.2
+
net-hns3-disable-mac-in-flr-process.patch
net-hns3-fix-the-timing-issue-of-vf-clearing-interrupt-sources.patch
mm-memory_hotplug-use-unsigned-long-for-pfn-in-zone_for_pfn_range.patch
+dt-bindings-mtd-gpmc-fix-the-ecc-bytes-vs.-oob-bytes.patch
+mfd-db8500-prcmu-adjust-map-to-reality.patch
+pci-add-acs-quirks-for-nxp-lx2xx0-and-lx2xx2-platfor.patch
+fuse-fix-use-after-free-in-fuse_read_interrupt.patch
+pci-tegra194-fix-handling-bme_chged-event.patch
+pci-tegra194-fix-msi-x-programming.patch
+pci-tegra-fix-of-node-reference-leak.patch
+mfd-don-t-use-irq_create_mapping-to-resolve-a-mappin.patch
+pci-rcar-fix-runtime-pm-imbalance-in-rcar_pcie_ep_pr.patch
+tracing-probes-reject-events-which-have-the-same-nam.patch
+pci-cadence-use-bitfield-for-quirk_retrain_flag-inst.patch
+pci-cadence-add-quirk-flag-to-set-minimum-delay-in-l.patch
+pci-j721e-add-pcie-support-for-j7200.patch
+pci-j721e-add-pcie-support-for-am64.patch
+pci-add-acs-quirks-for-cavium-multi-function-devices.patch
+watchdog-start-watchdog-in-watchdog_set_last_hw_keep.patch
+octeontx2-af-add-additional-register-check-to-rvu_po.patch
+set-fc_nlinfo-in-nh_create_ipv4-nh_create_ipv6.patch
+net-usb-cdc_mbim-avoid-altsetting-toggling-for-telit.patch
+block-bfq-honor-already-setup-queue-merges.patch
+pci-ibmphp-fix-double-unmap-of-io_mem.patch
+ethtool-fix-an-error-code-in-cxgb2.c.patch
+ntb-fix-an-error-code-in-ntb_msit_probe.patch
+ntb-perf-fix-an-error-code-in-perf_setup_inbuf.patch
+net-phylink-add-suspend-resume-support.patch
+mfd-axp20x-update-axp288-volatile-ranges.patch
+backlight-ktd253-stabilize-backlight.patch
+pci-of-don-t-fail-devm_pci_alloc_host_bridge-on-miss.patch
+pci-iproc-fix-bcma-probe-resource-handling.patch
+netfilter-fix-fall-through-warnings-for-clang.patch
+netfilter-nft_ct-protect-nft_ct_pcpu_template_refcnt.patch
+kvm-arm64-restrict-ipa-size-to-maximum-48-bits-on-4k.patch
+pci-fix-pci_dev_str_match_path-alloc-while-atomic-bu.patch
+mfd-tqmx86-clear-gpio-irq-resource-when-no-irq-is-se.patch
+tracing-boot-fix-a-hist-trigger-dependency-for-boot-.patch
+mtd-mtdconcat-judge-callback-existence-based-on-the-.patch
+mtd-mtdconcat-check-_read-_write-callbacks-existence.patch
+kvm-arm64-fix-read-side-race-on-updates-to-vcpu-rese.patch
+kvm-arm64-handle-psci-resets-before-userspace-touche.patch
+pci-sync-__pci_register_driver-stub-for-config_pci-n.patch
+mtd-rawnand-cafe-fix-a-resource-leak-in-the-error-ha.patch
+arc-export-clear_user_page-for-modules.patch
+perf-unwind-do-not-overwrite-feature_check_ldflags-l.patch
+perf-bench-inject-buildid-handle-writen-errors.patch
+gpio-mpc8xxx-fix-a-resources-leak-in-the-error-handl.patch
+gpio-mpc8xxx-fix-a-potential-double-iounmap-call-in-.patch
+gpio-mpc8xxx-use-devm_gpiochip_add_data-to-simplify-.patch
+net-dsa-tag_rtl4_a-fix-egress-tags.patch
+selftests-mptcp-clean-tmp-files-in-simult_flows.patch
+net-hso-add-failure-handler-for-add_net_device.patch
+net-dsa-b53-fix-calculating-number-of-switch-ports.patch
+net-dsa-b53-set-correct-number-of-ports-in-the-dsa-s.patch
+netfilter-socket-icmp6-fix-use-after-scope.patch
+fq_codel-reject-silly-quantum-parameters.patch
+qlcnic-remove-redundant-unlock-in-qlcnic_pinit_from_.patch
+ip_gre-validate-csum_start-only-on-pull.patch
+net-dsa-b53-fix-imp-port-setup-on-bcm5301x.patch
+bnxt_en-fix-stored-fw_psid-version-masks.patch
+bnxt_en-fix-asic.rev-in-devlink-dev-info-command.patch
+bnxt_en-log-firmware-debug-notifications.patch
+bnxt_en-consolidate-firmware-reset-event-logging.patch
+bnxt_en-convert-to-use-netif_level-helpers.patch
+bnxt_en-improve-logging-of-error-recovery-settings-i.patch
+bnxt_en-fix-possible-unintended-driver-initiated-err.patch
+mfd-lpc_sch-partially-revert-add-support-for-intel-q.patch
+mfd-lpc_sch-rename-gpiobase-to-prevent-build-error.patch
+net-renesas-sh_eth-fix-freeing-wrong-tx-descriptor.patch
--- /dev/null
+From 313f8150465e24c2ca353901486664245758af87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Sep 2021 05:20:14 +0000
+Subject: Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6
+
+From: Ryoga Saito <contact@proelbtn.com>
+
+[ Upstream commit 9aca491e0dccf8a9d84a5b478e5eee3c6ea7803b ]
+
+This patch fixes kernel NULL pointer dereference when creating nexthop
+which is bound with SRv6 decapsulation. In the creation of nexthop,
+__seg6_end_dt_vrf_build is called. __seg6_end_dt_vrf_build expects
+fc_lninfo in fib6_config is set correctly, but it isn't set in
+nh_create_ipv6, which causes kernel crash.
+
+Here is steps to reproduce kernel crash:
+
+1. modprobe vrf
+2. ip -6 nexthop add encap seg6local action End.DT4 vrftable 1 dev eth0
+
+We got the following message:
+
+[ 901.370336] BUG: kernel NULL pointer dereference, address: 0000000000000ba0
+[ 901.371658] #PF: supervisor read access in kernel mode
+[ 901.372672] #PF: error_code(0x0000) - not-present page
+[ 901.373672] PGD 0 P4D 0
+[ 901.374248] Oops: 0000 [#1] SMP PTI
+[ 901.374944] CPU: 0 PID: 8593 Comm: ip Not tainted 5.14-051400-generic #202108310811-Ubuntu
+[ 901.376404] Hardware name: Red Hat KVM, BIOS 1.11.1-4.module_el8.2.0+320+13f867d7 04/01/2014
+[ 901.377907] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf]
+[ 901.379182] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00
+[ 901.382652] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282
+[ 901.383746] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8
+[ 901.385436] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
+[ 901.386924] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40
+[ 901.388537] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000
+[ 901.389937] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b
+[ 901.391226] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000
+[ 901.392737] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 901.393803] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0
+[ 901.395122] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 901.396496] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 901.397833] PKRU: 55555554
+[ 901.398578] Call Trace:
+[ 901.399144] l3mdev_ifindex_lookup_by_table_id+0x3b/0x70
+[ 901.400179] __seg6_end_dt_vrf_build+0x34/0xd0
+[ 901.401067] seg6_end_dt4_build+0x16/0x20
+[ 901.401904] seg6_local_build_state+0x271/0x430
+[ 901.402797] lwtunnel_build_state+0x81/0x130
+[ 901.403645] fib_nh_common_init+0x82/0x100
+[ 901.404465] ? sock_def_readable+0x4b/0x80
+[ 901.405285] fib6_nh_init+0x115/0x7c0
+[ 901.406033] nh_create_ipv6.isra.0+0xe1/0x140
+[ 901.406932] rtm_new_nexthop+0x3b7/0xeb0
+[ 901.407828] rtnetlink_rcv_msg+0x152/0x3a0
+[ 901.408663] ? rtnl_calcit.isra.0+0x130/0x130
+[ 901.409535] netlink_rcv_skb+0x55/0x100
+[ 901.410319] rtnetlink_rcv+0x15/0x20
+[ 901.411026] netlink_unicast+0x1a8/0x250
+[ 901.411813] netlink_sendmsg+0x238/0x470
+[ 901.412602] ? _copy_from_user+0x2b/0x60
+[ 901.413394] sock_sendmsg+0x65/0x70
+[ 901.414112] ____sys_sendmsg+0x218/0x290
+[ 901.414929] ? copy_msghdr_from_user+0x5c/0x90
+[ 901.415814] ___sys_sendmsg+0x81/0xc0
+[ 901.416559] ? fsnotify_destroy_marks+0x27/0xf0
+[ 901.417447] ? call_rcu+0xa4/0x230
+[ 901.418153] ? kmem_cache_free+0x23f/0x410
+[ 901.418972] ? dentry_free+0x37/0x70
+[ 901.419705] ? mntput_no_expire+0x4c/0x260
+[ 901.420574] __sys_sendmsg+0x62/0xb0
+[ 901.421297] __x64_sys_sendmsg+0x1f/0x30
+[ 901.422057] do_syscall_64+0x5c/0xc0
+[ 901.422756] ? syscall_exit_to_user_mode+0x27/0x50
+[ 901.423675] ? __x64_sys_close+0x12/0x40
+[ 901.424462] ? do_syscall_64+0x69/0xc0
+[ 901.425219] ? irqentry_exit_to_user_mode+0x9/0x20
+[ 901.426149] ? irqentry_exit+0x19/0x30
+[ 901.426901] ? exc_page_fault+0x89/0x160
+[ 901.427709] ? asm_exc_page_fault+0x8/0x30
+[ 901.428536] entry_SYSCALL_64_after_hwframe+0x44/0xae
+[ 901.429514] RIP: 0033:0x7fe493945747
+[ 901.430248] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
+[ 901.433549] RSP: 002b:00007ffe9932cf68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 901.434981] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe493945747
+[ 901.436303] RDX: 0000000000000000 RSI: 00007ffe9932cfe0 RDI: 0000000000000003
+[ 901.437607] RBP: 00000000613053f7 R08: 0000000000000001 R09: 00007ffe9932d07c
+[ 901.438990] R10: 000055f4a903a010 R11: 0000000000000246 R12: 0000000000000001
+[ 901.440340] R13: 0000000000000001 R14: 000055f4a802b163 R15: 000055f4a8042020
+[ 901.441630] Modules linked in: vrf nls_utf8 isofs nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common isst_if_mbox_msr isst_if_common nfit rapl input_leds joydev serio_raw qemu_fw_cfg mac_hid sch_fq_codel drm virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd virtio_net net_failover cryptd psmouse virtio_blk failover i2c_piix4 pata_acpi floppy
+[ 901.450808] CR2: 0000000000000ba0
+[ 901.451514] ---[ end trace c27b934b99ade304 ]---
+[ 901.452403] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf]
+[ 901.453626] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00
+[ 901.456910] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282
+[ 901.457912] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8
+[ 901.459238] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
+[ 901.460552] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40
+[ 901.461882] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000
+[ 901.463208] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b
+[ 901.464529] FS: 00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000
+[ 901.466058] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 901.467189] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0
+[ 901.468515] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 901.469858] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 901.471139] PKRU: 55555554
+
+Signed-off-by: Ryoga Saito <contact@proelbtn.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index f2d313c5900d..1075cc2136ac 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -1303,6 +1303,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh,
+ .fc_gw4 = cfg->gw.ipv4,
+ .fc_gw_family = cfg->gw.ipv4 ? AF_INET : 0,
+ .fc_flags = cfg->nh_flags,
++ .fc_nlinfo = cfg->nlinfo,
+ .fc_encap = cfg->nh_encap,
+ .fc_encap_type = cfg->nh_encap_type,
+ };
+@@ -1341,6 +1342,7 @@ static int nh_create_ipv6(struct net *net, struct nexthop *nh,
+ .fc_ifindex = cfg->nh_ifindex,
+ .fc_gateway = cfg->gw.ipv6,
+ .fc_flags = cfg->nh_flags,
++ .fc_nlinfo = cfg->nlinfo,
+ .fc_encap = cfg->nh_encap,
+ .fc_encap_type = cfg->nh_encap_type,
+ .fc_is_fdb = cfg->nh_fdb,
+--
+2.30.2
+
--- /dev/null
+From 6e72c0bbd2adb6cbef2e7887aee046ab8d59c56c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Aug 2021 11:07:14 +0900
+Subject: tracing/boot: Fix a hist trigger dependency for boot time tracing
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 6fe7c745f2acb73e4cc961d7f91125eef5a8861f ]
+
+Fixes a build error when CONFIG_HIST_TRIGGERS=n with boot-time
+tracing. Since the trigger_process_regex() is defined only
+when CONFIG_HIST_TRIGGERS=y, if it is disabled, the 'actions'
+event option also must be disabled.
+
+Link: https://lkml.kernel.org/r/162856123376.203126.582144262622247352.stgit@devnote2
+
+Fixes: 81a59555ff15 ("tracing/boot: Add per-event settings")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_boot.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/trace/trace_boot.c b/kernel/trace/trace_boot.c
+index a82f03f385f8..0996d59750ff 100644
+--- a/kernel/trace/trace_boot.c
++++ b/kernel/trace/trace_boot.c
+@@ -205,12 +205,15 @@ trace_boot_init_one_event(struct trace_array *tr, struct xbc_node *gnode,
+ pr_err("Failed to apply filter: %s\n", buf);
+ }
+
+- xbc_node_for_each_array_value(enode, "actions", anode, p) {
+- if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf))
+- pr_err("action string is too long: %s\n", p);
+- else if (trigger_process_regex(file, buf) < 0)
+- pr_err("Failed to apply an action: %s\n", buf);
+- }
++ if (IS_ENABLED(CONFIG_HIST_TRIGGERS)) {
++ xbc_node_for_each_array_value(enode, "actions", anode, p) {
++ if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf))
++ pr_err("action string is too long: %s\n", p);
++ else if (trigger_process_regex(file, buf) < 0)
++ pr_err("Failed to apply an action: %s\n", buf);
++ }
++ } else if (xbc_node_find_value(enode, "actions", NULL))
++ pr_err("Failed to apply event actions because CONFIG_HIST_TRIGGERS is not set.\n");
+
+ if (xbc_node_find_value(enode, "enable", NULL)) {
+ if (trace_event_enable_disable(file, 1, 0) < 0)
+--
+2.30.2
+
--- /dev/null
+From b271968c8496039e7e1a2672a867a45f5de5426d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Aug 2021 19:26:02 +0900
+Subject: tracing/probes: Reject events which have the same name of existing
+ one
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 8e242060c6a4947e8ae7d29794af6a581db08841 ]
+
+Since kprobe_events and uprobe_events only check whether the
+other same-type probe event has the same name or not, if the
+user gives the same name of the existing tracepoint event (or
+the other type of probe events), it silently fails to create
+the tracefs entry (but registered.) as below.
+
+/sys/kernel/tracing # ls events/task/task_rename
+enable filter format hist id trigger
+/sys/kernel/tracing # echo p:task/task_rename vfs_read >> kprobe_events
+[ 113.048508] Could not create tracefs 'task_rename' directory
+/sys/kernel/tracing # cat kprobe_events
+p:task/task_rename vfs_read
+
+To fix this issue, check whether the existing events have the
+same name or not in trace_probe_register_event_call(). If exists,
+it rejects to register the new event.
+
+Link: https://lkml.kernel.org/r/162936876189.187130.17558311387542061930.stgit@devnote2
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_kprobe.c | 6 +++++-
+ kernel/trace/trace_probe.c | 25 +++++++++++++++++++++++++
+ kernel/trace/trace_probe.h | 1 +
+ kernel/trace/trace_uprobe.c | 6 +++++-
+ 4 files changed, 36 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 68150b9cbde9..552dbc9d5226 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -647,7 +647,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk)
+ /* Register new event */
+ ret = register_kprobe_event(tk);
+ if (ret) {
+- pr_warn("Failed to register probe event(%d)\n", ret);
++ if (ret == -EEXIST) {
++ trace_probe_log_set_index(0);
++ trace_probe_log_err(0, EVENT_EXIST);
++ } else
++ pr_warn("Failed to register probe event(%d)\n", ret);
+ goto end;
+ }
+
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index d2867ccc6aca..1d31bc4acf7a 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -1029,11 +1029,36 @@ error:
+ return ret;
+ }
+
++static struct trace_event_call *
++find_trace_event_call(const char *system, const char *event_name)
++{
++ struct trace_event_call *tp_event;
++ const char *name;
++
++ list_for_each_entry(tp_event, &ftrace_events, list) {
++ if (!tp_event->class->system ||
++ strcmp(system, tp_event->class->system))
++ continue;
++ name = trace_event_name(tp_event);
++ if (!name || strcmp(event_name, name))
++ continue;
++ return tp_event;
++ }
++
++ return NULL;
++}
++
+ int trace_probe_register_event_call(struct trace_probe *tp)
+ {
+ struct trace_event_call *call = trace_probe_event_call(tp);
+ int ret;
+
++ lockdep_assert_held(&event_mutex);
++
++ if (find_trace_event_call(trace_probe_group_name(tp),
++ trace_probe_name(tp)))
++ return -EEXIST;
++
+ ret = register_trace_event(&call->event);
+ if (!ret)
+ return -ENODEV;
+diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
+index 2f703a20c724..6d41e20c47ce 100644
+--- a/kernel/trace/trace_probe.h
++++ b/kernel/trace/trace_probe.h
+@@ -398,6 +398,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
+ C(NO_EVENT_NAME, "Event name is not specified"), \
+ C(EVENT_TOO_LONG, "Event name is too long"), \
+ C(BAD_EVENT_NAME, "Event name must follow the same rules as C identifiers"), \
++ C(EVENT_EXIST, "Given group/event name is already used by another event"), \
+ C(RETVAL_ON_PROBE, "$retval is not available on probe"), \
+ C(BAD_STACK_NUM, "Invalid stack number"), \
+ C(BAD_ARG_NUM, "Invalid argument number"), \
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 3cf7128e1ad3..0dd6e286e519 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -514,7 +514,11 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
+
+ ret = register_uprobe_event(tu);
+ if (ret) {
+- pr_warn("Failed to register probe event(%d)\n", ret);
++ if (ret == -EEXIST) {
++ trace_probe_log_set_index(0);
++ trace_probe_log_err(0, EVENT_EXIST);
++ } else
++ pr_warn("Failed to register probe event(%d)\n", ret);
+ goto end;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 00db1cf5b7394878b806a54d00669a0ec2370e8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Aug 2021 09:56:25 +0200
+Subject: watchdog: Start watchdog in watchdog_set_last_hw_keepalive only if
+ appropriate
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+[ Upstream commit dbe80cf471f940db3063197b7adb1169f89be9ed ]
+
+We must not pet a running watchdog when handle_boot_enabled is off
+because this will kick off automatic triggering before userland is
+running, defeating the purpose of the handle_boot_enabled control.
+Furthermore, don't ping in case watchdog_set_last_hw_keepalive was
+called incorrectly when the hardware watchdog is actually not running.
+
+Fixed: cef9572e9af3 ("watchdog: add support for adjusting last known HW keepalive time")
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/93d56386-6e37-060b-55ce-84de8cde535f@web.de
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_dev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 2946f3a63110..2ee017442dfc 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -1164,7 +1164,10 @@ int watchdog_set_last_hw_keepalive(struct watchdog_device *wdd,
+
+ wd_data->last_hw_keepalive = ktime_sub(now, ms_to_ktime(last_ping_ms));
+
+- return __watchdog_ping(wdd);
++ if (watchdog_hw_running(wdd) && handle_boot_enabled)
++ return __watchdog_ping(wdd);
++
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(watchdog_set_last_hw_keepalive);
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
