--- /dev/null
+From e5c030ba12713f0d1e0bf01a1281afcf66af88cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 01:53:31 +0530
+Subject: ASoC: amd: fix for pcm_read() error
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit 6879e8e759bf9e05eaee85e32ca1a936e6b46da1 ]
+
+Below phython script throwing pcm_read() error.
+
+import subprocess
+
+p = subprocess.Popen(["aplay -t raw -D plughw:1,0 /dev/zero"], shell=True)
+subprocess.call(["arecord -Dhw:1,0 --dump-hw-params"], shell=True)
+subprocess.call(["arecord -Dhw:1,0 -fdat -d1 /dev/null"], shell=True)
+p.kill()
+
+Handling ACP global external interrupt enable register
+causing this issue.
+This register got updated wrongly when there is active
+stream causing interrupts disabled for active stream.
+Refactored code to handle enabling and disabling external interrupts.
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/1619555017-29858-1-git-send-email-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/raven/acp3x-pcm-dma.c | 10 ----------
+ sound/soc/amd/raven/acp3x.h | 1 +
+ sound/soc/amd/raven/pci-acp3x.c | 15 +++++++++++++++
+ 3 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
+index 417cda24030c..2447a1e6e913 100644
+--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
+@@ -237,10 +237,6 @@ static int acp3x_dma_open(struct snd_soc_component *component,
+ return ret;
+ }
+
+- if (!adata->play_stream && !adata->capture_stream &&
+- !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream)
+- rv_writel(1, adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB);
+-
+ i2s_data->acp3x_base = adata->acp3x_base;
+ runtime->private_data = i2s_data;
+ return ret;
+@@ -367,12 +363,6 @@ static int acp3x_dma_close(struct snd_soc_component *component,
+ }
+ }
+
+- /* Disable ACP irq, when the current stream is being closed and
+- * another stream is also not active.
+- */
+- if (!adata->play_stream && !adata->capture_stream &&
+- !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream)
+- rv_writel(0, adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB);
+ return 0;
+ }
+
+diff --git a/sound/soc/amd/raven/acp3x.h b/sound/soc/amd/raven/acp3x.h
+index 03fe93913e12..c3f0c8b7545d 100644
+--- a/sound/soc/amd/raven/acp3x.h
++++ b/sound/soc/amd/raven/acp3x.h
+@@ -77,6 +77,7 @@
+ #define ACP_POWER_OFF_IN_PROGRESS 0x03
+
+ #define ACP3x_ITER_IRER_SAMP_LEN_MASK 0x38
++#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF
+
+ struct acp3x_platform_info {
+ u16 play_i2s_instance;
+diff --git a/sound/soc/amd/raven/pci-acp3x.c b/sound/soc/amd/raven/pci-acp3x.c
+index d3536fd6a124..a013a607b3d4 100644
+--- a/sound/soc/amd/raven/pci-acp3x.c
++++ b/sound/soc/amd/raven/pci-acp3x.c
+@@ -76,6 +76,19 @@ static int acp3x_reset(void __iomem *acp3x_base)
+ return -ETIMEDOUT;
+ }
+
++static void acp3x_enable_interrupts(void __iomem *acp_base)
++{
++ rv_writel(0x01, acp_base + mmACP_EXTERNAL_INTR_ENB);
++}
++
++static void acp3x_disable_interrupts(void __iomem *acp_base)
++{
++ rv_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base +
++ mmACP_EXTERNAL_INTR_STAT);
++ rv_writel(0x00, acp_base + mmACP_EXTERNAL_INTR_CNTL);
++ rv_writel(0x00, acp_base + mmACP_EXTERNAL_INTR_ENB);
++}
++
+ static int acp3x_init(struct acp3x_dev_data *adata)
+ {
+ void __iomem *acp3x_base = adata->acp3x_base;
+@@ -93,6 +106,7 @@ static int acp3x_init(struct acp3x_dev_data *adata)
+ pr_err("ACP3x reset failed\n");
+ return ret;
+ }
++ acp3x_enable_interrupts(acp3x_base);
+ return 0;
+ }
+
+@@ -100,6 +114,7 @@ static int acp3x_deinit(void __iomem *acp3x_base)
+ {
+ int ret;
+
++ acp3x_disable_interrupts(acp3x_base);
+ /* Reset */
+ ret = acp3x_reset(acp3x_base);
+ if (ret) {
+--
+2.30.2
+
--- /dev/null
+From b2ca74273bf7ef397d90432482841a82d4617a63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 May 2021 11:38:44 +0100
+Subject: ASoC: codecs: lpass-rx-macro: add missing MODULE_DEVICE_TABLE
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit d4335d058f8430a0ce2b43dab9531f3a3cf9fe2c ]
+
+Fix module loading by adding missing MODULE_DEVICE_TABLE.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210510103844.1532-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-rx-macro.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c
+index 7878da89d8e0..b7b9c891e2f0 100644
+--- a/sound/soc/codecs/lpass-rx-macro.c
++++ b/sound/soc/codecs/lpass-rx-macro.c
+@@ -3581,6 +3581,7 @@ static const struct of_device_id rx_macro_dt_match[] = {
+ { .compatible = "qcom,sm8250-lpass-rx-macro" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, rx_macro_dt_match);
+
+ static struct platform_driver rx_macro_driver = {
+ .driver = {
+--
+2.30.2
+
--- /dev/null
+From 43ce06f19d7b04d98f115d84a8e3ed8c0ec5eebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 11:15:12 +0800
+Subject: ASoC: codecs: lpass-tx-macro: add missing MODULE_DEVICE_TABLE
+
+From: Bixuan Cui <cuibixuan@huawei.com>
+
+[ Upstream commit 14c0c423746fe7232a093a68809a4bc6233eed60 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20210508031512.53783-1-cuibixuan@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-tx-macro.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c
+index e8c6c738bbaa..5341ca02951c 100644
+--- a/sound/soc/codecs/lpass-tx-macro.c
++++ b/sound/soc/codecs/lpass-tx-macro.c
+@@ -1846,6 +1846,7 @@ static const struct of_device_id tx_macro_dt_match[] = {
+ { .compatible = "qcom,sm8250-lpass-tx-macro" },
+ { }
+ };
++MODULE_DEVICE_TABLE(of, tx_macro_dt_match);
+ static struct platform_driver tx_macro_driver = {
+ .driver = {
+ .name = "tx_macro",
+--
+2.30.2
+
--- /dev/null
+From a2ad4e872459125d1799a8f99d3158788cd879f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 17:01:45 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 28c268d3acdd4cbcd2ac320b85609e77f84e74a7 ]
+
+Add a quirk for the Glavey TM800A550L tablet, this BYTCR tablet has no CHAN
+package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which
+is the default for BYTCR devices.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20210508150146.28403-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 22912cab5e63..f18932b3d31b 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -574,6 +574,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Glavey TM800A550L */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS version */
++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+--
+2.30.2
+
--- /dev/null
+From 1e5c3676c07f902134e45858bed81fcc9c053fa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 17:01:46 +0200
+Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit f0353e1f53f92f7b3da91e6669f5d58ee222ebe8 ]
+
+The Lenovo Miix 3-830 tablet has only 1 speaker, has an internal analog
+mic on IN1 and uses JD2 for jack-detect, add a quirk to automatically
+apply these settings on Lenovo Miix 3-830 tablets.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20210508150146.28403-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index f18932b3d31b..cc24e89a7f8d 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -663,6 +663,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Lenovo Miix 3-830 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Linx Linx7 tablet */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"),
+--
+2.30.2
+
--- /dev/null
+From 07821bb9b4ca53fbaf151a50bdff9d74c4e03862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 15:54:02 +0200
+Subject: ASoC: max98088: fix ni clock divider calculation
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 6c9762a78c325107dc37d20ee21002b841679209 ]
+
+The ni1/ni2 ratio formula [1] uses the pclk which is the prescaled mclk.
+The max98088 datasheet [2] has no such formula but table-12 equals so
+we can assume that it is the same for both devices.
+
+While on it make use of DIV_ROUND_CLOSEST_ULL().
+
+[1] https://datasheets.maximintegrated.com/en/ds/MAX98089.pdf; page 86
+[2] https://datasheets.maximintegrated.com/en/ds/MAX98088.pdf; page 82
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Link: https://lore.kernel.org/r/20210423135402.32105-1-m.felsch@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max98088.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
+index 4be24e7f51c8..f8e49e45ce33 100644
+--- a/sound/soc/codecs/max98088.c
++++ b/sound/soc/codecs/max98088.c
+@@ -41,6 +41,7 @@ struct max98088_priv {
+ enum max98088_type devtype;
+ struct max98088_pdata *pdata;
+ struct clk *mclk;
++ unsigned char mclk_prescaler;
+ unsigned int sysclk;
+ struct max98088_cdata dai[2];
+ int eq_textcnt;
+@@ -998,13 +999,16 @@ static int max98088_dai1_hw_params(struct snd_pcm_substream *substream,
+ /* Configure NI when operating as master */
+ if (snd_soc_component_read(component, M98088_REG_14_DAI1_FORMAT)
+ & M98088_DAI_MAS) {
++ unsigned long pclk;
++
+ if (max98088->sysclk == 0) {
+ dev_err(component->dev, "Invalid system clock frequency\n");
+ return -EINVAL;
+ }
+ ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL)
+ * (unsigned long long int)rate;
+- do_div(ni, (unsigned long long int)max98088->sysclk);
++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler);
++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk);
+ snd_soc_component_write(component, M98088_REG_12_DAI1_CLKCFG_HI,
+ (ni >> 8) & 0x7F);
+ snd_soc_component_write(component, M98088_REG_13_DAI1_CLKCFG_LO,
+@@ -1065,13 +1069,16 @@ static int max98088_dai2_hw_params(struct snd_pcm_substream *substream,
+ /* Configure NI when operating as master */
+ if (snd_soc_component_read(component, M98088_REG_1C_DAI2_FORMAT)
+ & M98088_DAI_MAS) {
++ unsigned long pclk;
++
+ if (max98088->sysclk == 0) {
+ dev_err(component->dev, "Invalid system clock frequency\n");
+ return -EINVAL;
+ }
+ ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL)
+ * (unsigned long long int)rate;
+- do_div(ni, (unsigned long long int)max98088->sysclk);
++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler);
++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk);
+ snd_soc_component_write(component, M98088_REG_1A_DAI2_CLKCFG_HI,
+ (ni >> 8) & 0x7F);
+ snd_soc_component_write(component, M98088_REG_1B_DAI2_CLKCFG_LO,
+@@ -1113,8 +1120,10 @@ static int max98088_dai_set_sysclk(struct snd_soc_dai *dai,
+ */
+ if ((freq >= 10000000) && (freq < 20000000)) {
+ snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x10);
++ max98088->mclk_prescaler = 1;
+ } else if ((freq >= 20000000) && (freq < 30000000)) {
+ snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x20);
++ max98088->mclk_prescaler = 2;
+ } else {
+ dev_err(component->dev, "Invalid master clock frequency\n");
+ return -EINVAL;
+--
+2.30.2
+
--- /dev/null
+From 5dfff3073e6ec3b80ed9fdaf618f1fad7b240289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 11:12:25 +0800
+Subject: ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
+
+From: Zou Wei <zou_wei@huawei.com>
+
+[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ]
+
+This patch adds missing MODULE_DEVICE_TABLE definition which generates
+correct modalias for automatic loading of this driver when it is built
+as an external module.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zou Wei <zou_wei@huawei.com>
+Link: https://lore.kernel.org/r/1620789145-14936-1-git-send-email-zou_wei@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/sti-sas.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
+index ec9933b054ad..423daac9d5a9 100644
+--- a/sound/soc/codecs/sti-sas.c
++++ b/sound/soc/codecs/sti-sas.c
+@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = {
+ },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, sti_sas_dev_match);
+
+ static int sti_sas_driver_probe(struct platform_device *pdev)
+ {
+--
+2.30.2
+
--- /dev/null
+From 1932c55f66b37c22b1c6d68da56f74a3b2799dae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 19:00:12 +0800
+Subject: bnx2x: Fix missing error code in bnx2x_iov_init_one()
+
+From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+
+[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ]
+
+Eliminate the follow smatch warning:
+
+drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227
+bnx2x_iov_init_one() warn: missing error code 'err'.
+
+Reported-by: Abaci Robot <abaci@linux.alibaba.com>
+Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+index 9c2f51f23035..9108b497b3c9 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+@@ -1224,8 +1224,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
+ goto failed;
+
+ /* SR-IOV capability was enabled but there are no VFs*/
+- if (iov->total == 0)
++ if (iov->total == 0) {
++ err = -EINVAL;
+ goto failed;
++ }
+
+ iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param);
+
+--
+2.30.2
+
--- /dev/null
+From 90306b14c3e88b5f3175978539cf7e566a3b7e7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:13:35 +0200
+Subject: bonding: init notify_work earlier to avoid uninitialized use
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ]
+
+If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail,
+then we call kobject_put() on the slave->kobj. This in turn calls
+the release function slave_kobj_release() which will always try to
+cancel_delayed_work_sync(&slave->notify_work), which shouldn't be
+done on an uninitialized work struct.
+
+Always initialize the work struct earlier to avoid problems here.
+
+Syzbot bisected this down to a completely pointless commit, some
+fault injection may have been at work here that caused the alloc
+failure in the first place, which may interact badly with bisect.
+
+Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 74cbbb22470b..fa4bf727a48d 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1526,6 +1526,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
+
+ slave->bond = bond;
+ slave->dev = slave_dev;
++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
+
+ if (bond_kobj_init(slave))
+ return NULL;
+@@ -1538,7 +1539,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond,
+ return NULL;
+ }
+ }
+- INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work);
+
+ return slave;
+ }
+--
+2.30.2
+
--- /dev/null
+From dd89b406366ef3f8011057bdc24831fad63d130e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 13:47:12 +0200
+Subject: bpf: Add deny list of btf ids check for tracing programs
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 35e3815fa8102fab4dee75f3547472c66581125d ]
+
+The recursion check in __bpf_prog_enter and __bpf_prog_exit
+leaves some (not inlined) functions unprotected:
+
+In __bpf_prog_enter:
+ - migrate_disable is called before prog->active is checked
+
+In __bpf_prog_exit:
+ - migrate_enable,rcu_read_unlock_strict are called after
+ prog->active is decreased
+
+When attaching trampoline to them we get panic like:
+
+ traps: PANIC: double fault, error_code: 0x0
+ double fault: 0000 [#1] SMP PTI
+ RIP: 0010:__bpf_prog_enter+0x4/0x50
+ ...
+ Call Trace:
+ <IRQ>
+ bpf_trampoline_6442466513_0+0x18/0x1000
+ migrate_disable+0x5/0x50
+ __bpf_prog_enter+0x9/0x50
+ bpf_trampoline_6442466513_0+0x18/0x1000
+ migrate_disable+0x5/0x50
+ __bpf_prog_enter+0x9/0x50
+ bpf_trampoline_6442466513_0+0x18/0x1000
+ migrate_disable+0x5/0x50
+ __bpf_prog_enter+0x9/0x50
+ bpf_trampoline_6442466513_0+0x18/0x1000
+ migrate_disable+0x5/0x50
+ ...
+
+Fixing this by adding deny list of btf ids for tracing
+programs and checking btf id during program verification.
+Adding above functions to this list.
+
+Suggested-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20210429114712.43783-1-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index b186d852fe3d..9e600767803b 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -12556,6 +12556,17 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
+ return 0;
+ }
+
++BTF_SET_START(btf_id_deny)
++BTF_ID_UNUSED
++#ifdef CONFIG_SMP
++BTF_ID(func, migrate_disable)
++BTF_ID(func, migrate_enable)
++#endif
++#if !defined CONFIG_PREEMPT_RCU && !defined CONFIG_TINY_RCU
++BTF_ID(func, rcu_read_unlock_strict)
++#endif
++BTF_SET_END(btf_id_deny)
++
+ static int check_attach_btf_id(struct bpf_verifier_env *env)
+ {
+ struct bpf_prog *prog = env->prog;
+@@ -12615,6 +12626,9 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
+ ret = bpf_lsm_verify_prog(&env->log, prog);
+ if (ret < 0)
+ return ret;
++ } else if (prog->type == BPF_PROG_TYPE_TRACING &&
++ btf_id_set_contains(&btf_id_deny, btf_id)) {
++ return -EINVAL;
+ }
+
+ key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id);
+--
+2.30.2
+
--- /dev/null
+From b95e0a80aad6679526049c25dc7bf18d5fc30c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 May 2021 15:25:29 +0200
+Subject: bpf: Forbid trampoline attach for functions with variable arguments
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 31379397dcc364a59ce764fabb131b645c43e340 ]
+
+We can't currently allow to attach functions with variable arguments.
+The problem is that we should save all the registers for arguments,
+which is probably doable, but if caller uses more than 6 arguments,
+we need stack data, which will be wrong, because of the extra stack
+frame we do in bpf trampoline, so we could crash.
+
+Also currently there's malformed trampoline code generated for such
+functions at the moment as described in:
+
+ https://lore.kernel.org/bpf/20210429212834.82621-1-jolsa@kernel.org/
+
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20210505132529.401047-1-jolsa@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index b1a76fe046cb..6bd003568fa5 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5126,6 +5126,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
+ m->ret_size = ret;
+
+ for (i = 0; i < nargs; i++) {
++ if (i == nargs - 1 && args[i].type == 0) {
++ bpf_log(log,
++ "The function %s with variable args is unsupported.\n",
++ tname);
++ return -EINVAL;
++ }
+ ret = __get_type_size(btf, args[i].type, &t);
+ if (ret < 0) {
+ bpf_log(log,
+@@ -5133,6 +5139,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
+ tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]);
+ return -EINVAL;
+ }
++ if (ret == 0) {
++ bpf_log(log,
++ "The function %s has malformed void argument.\n",
++ tname);
++ return -EINVAL;
++ }
+ m->arg_size[i] = ret;
+ }
+ m->nr_args = nargs;
+--
+2.30.2
+
--- /dev/null
+From 09178b949179888852883c47c72867889e7057e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 May 2021 08:58:25 +0000
+Subject: bpf, selftests: Adjust few selftest result_unpriv outcomes
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 1bad6fd52be4ce12d207e2820ceb0f29ab31fc53 ]
+
+Given we don't need to simulate the speculative domain for registers with
+immediates anymore since the verifier uses direct imm-based rewrites instead
+of having to mask, we can also lift a few cases that were previously rejected.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/verifier/stack_ptr.c | 2 --
+ tools/testing/selftests/bpf/verifier/value_ptr_arith.c | 8 --------
+ 2 files changed, 10 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/verifier/stack_ptr.c b/tools/testing/selftests/bpf/verifier/stack_ptr.c
+index 07eaa04412ae..8ab94d65f3d5 100644
+--- a/tools/testing/selftests/bpf/verifier/stack_ptr.c
++++ b/tools/testing/selftests/bpf/verifier/stack_ptr.c
+@@ -295,8 +295,6 @@
+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+ BPF_EXIT_INSN(),
+ },
+- .result_unpriv = REJECT,
+- .errstr_unpriv = "invalid write to stack R1 off=0 size=1",
+ .result = ACCEPT,
+ .retval = 42,
+ },
+diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+index e5913fd3b903..7ae2859d495c 100644
+--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
++++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
+@@ -300,8 +300,6 @@
+ },
+ .fixup_map_array_48b = { 3 },
+ .result = ACCEPT,
+- .result_unpriv = REJECT,
+- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .retval = 1,
+ },
+ {
+@@ -371,8 +369,6 @@
+ },
+ .fixup_map_array_48b = { 3 },
+ .result = ACCEPT,
+- .result_unpriv = REJECT,
+- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .retval = 1,
+ },
+ {
+@@ -472,8 +468,6 @@
+ },
+ .fixup_map_array_48b = { 3 },
+ .result = ACCEPT,
+- .result_unpriv = REJECT,
+- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .retval = 1,
+ },
+ {
+@@ -766,8 +760,6 @@
+ },
+ .fixup_map_array_48b = { 3 },
+ .result = ACCEPT,
+- .result_unpriv = REJECT,
+- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+ .retval = 1,
+ },
+ {
+--
+2.30.2
+
--- /dev/null
+From fc4dccf7ba130f233ef4647d7c9d788520880a41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 13:19:46 -0700
+Subject: cgroup: disable controllers at parse time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shakeel Butt <shakeelb@google.com>
+
+[ Upstream commit 45e1ba40837ac2f6f4d4716bddb8d44bd7e4a251 ]
+
+This patch effectively reverts the commit a3e72739b7a7 ("cgroup: fix
+too early usage of static_branch_disable()"). The commit 6041186a3258
+("init: initialize jump labels before command line option parsing") has
+moved the jump_label_init() before parse_args() which has made the
+commit a3e72739b7a7 unnecessary. On the other hand there are
+consequences of disabling the controllers later as there are subsystems
+doing the controller checks for different decisions. One such incident
+is reported [1] regarding the memory controller and its impact on memory
+reclaim code.
+
+[1] https://lore.kernel.org/linux-mm/921e53f3-4b13-aab8-4a9e-e83ff15371e4@nec.com
+
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Reported-by: NOMURA JUNICHI(野村 淳一) <junichi.nomura@nec.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Tested-by: Jun'ichi Nomura <junichi.nomura@nec.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cgroup/cgroup.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index 9153b20e5cc6..2529d1f88330 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -5626,8 +5626,6 @@ int __init cgroup_init_early(void)
+ return 0;
+ }
+
+-static u16 cgroup_disable_mask __initdata;
+-
+ /**
+ * cgroup_init - cgroup initialization
+ *
+@@ -5686,12 +5684,8 @@ int __init cgroup_init(void)
+ * disabled flag and cftype registration needs kmalloc,
+ * both of which aren't available during early_init.
+ */
+- if (cgroup_disable_mask & (1 << ssid)) {
+- static_branch_disable(cgroup_subsys_enabled_key[ssid]);
+- printk(KERN_INFO "Disabling %s control group subsystem\n",
+- ss->name);
++ if (!cgroup_ssid_enabled(ssid))
+ continue;
+- }
+
+ if (cgroup1_ssid_disabled(ssid))
+ printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n",
+@@ -6206,7 +6200,10 @@ static int __init cgroup_disable(char *str)
+ if (strcmp(token, ss->name) &&
+ strcmp(token, ss->legacy_name))
+ continue;
+- cgroup_disable_mask |= 1 << i;
++
++ static_branch_disable(cgroup_subsys_enabled_key[i]);
++ pr_info("Disabling %s control group subsystem\n",
++ ss->name);
+ }
+ }
+ return 1;
+--
+2.30.2
+
--- /dev/null
+From f8a1d41c53d3bf7e11f7a68dc057efcc6a684ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 12:14:21 +0100
+Subject: dm verity: fix require_signatures module_param permissions
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ]
+
+The third parameter of module_param() is permissions for the sysfs node
+but it looks like it is being used as the initial value of the parameter
+here. In fact, false here equates to omitting the file from sysfs and
+does not affect the value of require_signatures.
+
+Making the parameter writable is not simple because going from
+false->true is fine but it should not be possible to remove the
+requirement to verify a signature. But it can be useful to inspect the
+value of this parameter from userspace, so change the permissions to
+make a read-only file in sysfs.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-verity-verify-sig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
+index 29385dc470d5..db61a1f43ae9 100644
+--- a/drivers/md/dm-verity-verify-sig.c
++++ b/drivers/md/dm-verity-verify-sig.c
+@@ -15,7 +15,7 @@
+ #define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s
+
+ static bool require_signatures;
+-module_param(require_signatures, bool, false);
++module_param(require_signatures, bool, 0444);
+ MODULE_PARM_DESC(require_signatures,
+ "Verify the roothash of dm-verity hash tree");
+
+--
+2.30.2
+
--- /dev/null
+From 53b26d41d8f40a640d322f49c30d0cc700a7e105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 09:20:52 +1200
+Subject: i2c: mpc: implement erratum A-004447 workaround
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit drivers/i2c/busses/i2c-mpc.c ]
+
+The P2040/P2041 has an erratum where the normal i2c recovery mechanism
+does not work. Implement the alternative recovery mechanism documented
+in the P2040 Chip Errata Rev Q.
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++-
+ 1 file changed, 78 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
+index 6a0d55e9e8e3..af349661fd76 100644
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -23,6 +23,7 @@
+
+ #include <linux/clk.h>
+ #include <linux/io.h>
++#include <linux/iopoll.h>
+ #include <linux/fsl_devices.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+@@ -49,6 +50,7 @@
+ #define CCR_MTX 0x10
+ #define CCR_TXAK 0x08
+ #define CCR_RSTA 0x04
++#define CCR_RSVD 0x02
+
+ #define CSR_MCF 0x80
+ #define CSR_MAAS 0x40
+@@ -70,6 +72,7 @@ struct mpc_i2c {
+ u8 fdr, dfsrr;
+ #endif
+ struct clk *clk_per;
++ bool has_errata_A004447;
+ };
+
+ struct mpc_i2c_divider {
+@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
+ return 0;
+ }
+
++static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask)
++{
++ void __iomem *addr = i2c->base + MPC_I2C_SR;
++ u8 val;
++
++ return readb_poll_timeout(addr, val, val & mask, 0, 100);
++}
++
++/*
++ * Workaround for Erratum A004447. From the P2040CE Rev Q
++ *
++ * 1. Set up the frequency divider and sampling rate.
++ * 2. I2CCR - a0h
++ * 3. Poll for I2CSR[MBB] to get set.
++ * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to
++ * step 5. If MAL is not set, then go to step 13.
++ * 5. I2CCR - 00h
++ * 6. I2CCR - 22h
++ * 7. I2CCR - a2h
++ * 8. Poll for I2CSR[MBB] to get set.
++ * 9. Issue read to I2CDR.
++ * 10. Poll for I2CSR[MIF] to be set.
++ * 11. I2CCR - 82h
++ * 12. Workaround complete. Skip the next steps.
++ * 13. Issue read to I2CDR.
++ * 14. Poll for I2CSR[MIF] to be set.
++ * 15. I2CCR - 80h
++ */
++static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c)
++{
++ int ret;
++ u32 val;
++
++ writeccr(i2c, CCR_MEN | CCR_MSTA);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
++ return;
++ }
++
++ val = readb(i2c->base + MPC_I2C_SR);
++
++ if (val & CSR_MAL) {
++ writeccr(i2c, 0x00);
++ writeccr(i2c, CCR_MSTA | CCR_RSVD);
++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n");
++ return;
++ }
++ val = readb(i2c->base + MPC_I2C_DR);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
++ return;
++ }
++ writeccr(i2c, CCR_MEN | CCR_RSVD);
++ } else {
++ val = readb(i2c->base + MPC_I2C_DR);
++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF);
++ if (ret) {
++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n");
++ return;
++ }
++ writeccr(i2c, CCR_MEN);
++ }
++}
++
+ #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x)
+ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
+ {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
+@@ -641,7 +713,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap)
+ {
+ struct mpc_i2c *i2c = i2c_get_adapdata(adap);
+
+- mpc_i2c_fixup(i2c);
++ if (i2c->has_errata_A004447)
++ mpc_i2c_fixup_A004447(i2c);
++ else
++ mpc_i2c_fixup(i2c);
+
+ return 0;
+ }
+@@ -745,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op)
+ dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ);
+
+ platform_set_drvdata(op, i2c);
++ if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447"))
++ i2c->has_errata_A004447 = true;
+
+ i2c->adap = mpc_ops;
+ of_address_to_resource(op->dev.of_node, 0, &res);
+--
+2.30.2
+
--- /dev/null
+From fba131d424bc746952c34a922296408a1bb78168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 14:52:03 +1300
+Subject: i2c: mpc: Make use of i2c_recover_bus()
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ]
+
+Move the existing calls of mpc_i2c_fixup() to a recovery function
+registered via bus_recovery_info. This makes it more obvious that
+recovery is supported and allows for a future where recovery is
+triggered by the i2c core.
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
+index d94f05c8b8b7..6a0d55e9e8e3 100644
+--- a/drivers/i2c/busses/i2c-mpc.c
++++ b/drivers/i2c/busses/i2c-mpc.c
+@@ -586,7 +586,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
+ writeb(status & ~CSR_MAL,
+ i2c->base + MPC_I2C_SR);
+- mpc_i2c_fixup(i2c);
++ i2c_recover_bus(&i2c->adap);
+ }
+ return -EIO;
+ }
+@@ -622,7 +622,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) {
+ writeb(status & ~CSR_MAL,
+ i2c->base + MPC_I2C_SR);
+- mpc_i2c_fixup(i2c);
++ i2c_recover_bus(&i2c->adap);
+ }
+ return -EIO;
+ }
+@@ -637,6 +637,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap)
+ | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL;
+ }
+
++static int fsl_i2c_bus_recovery(struct i2c_adapter *adap)
++{
++ struct mpc_i2c *i2c = i2c_get_adapdata(adap);
++
++ mpc_i2c_fixup(i2c);
++
++ return 0;
++}
++
+ static const struct i2c_algorithm mpc_algo = {
+ .master_xfer = mpc_xfer,
+ .functionality = mpc_functionality,
+@@ -648,6 +657,10 @@ static struct i2c_adapter mpc_ops = {
+ .timeout = HZ,
+ };
+
++static struct i2c_bus_recovery_info fsl_i2c_recovery_info = {
++ .recover_bus = fsl_i2c_bus_recovery,
++};
++
+ static const struct of_device_id mpc_i2c_of_match[];
+ static int fsl_i2c_probe(struct platform_device *op)
+ {
+@@ -740,6 +753,7 @@ static int fsl_i2c_probe(struct platform_device *op)
+ i2c_set_adapdata(&i2c->adap, i2c);
+ i2c->adap.dev.parent = &op->dev;
+ i2c->adap.dev.of_node = of_node_get(op->dev.of_node);
++ i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info;
+
+ result = i2c_add_adapter(&i2c->adap);
+ if (result < 0)
+--
+2.30.2
+
--- /dev/null
+From 78a4f0004635415deb29601f324cf68431d363c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 May 2021 07:11:40 +0000
+Subject: isdn: mISDN: netjet: Fix crash in nj_probe:
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ]
+
+'nj_setup' in netjet.c might fail with -EIO and in this case
+'card->irq' is initialized and is bigger than zero. A subsequent call to
+'nj_release' will free the irq that has not been requested.
+
+Fix this bug by deleting the previous assignment to 'card->irq' and just
+keep the assignment before 'request_irq'.
+
+The KASAN's log reveals it:
+
+[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826
+free_irq+0x100/0x480
+[ 3.355112 ] Modules linked in:
+[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
+5.13.0-rc1-00144-g25a1298726e #13
+[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
+rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
+[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480
+[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
+4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5
+ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
+[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
+[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
+0000000000000000
+[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:
+00000000ffffffff
+[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
+0000000000000000
+[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
+0000000000000000
+[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:
+ffff888104dc80a8
+[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000)
+knlGS:0000000000000000
+[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4:
+00000000000006f0
+[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
+0000000000000000
+[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
+0000000000000400
+[ 3.362175 ] Call Trace:
+[ 3.362175 ] nj_release+0x51/0x1e0
+[ 3.362175 ] nj_probe+0x450/0x950
+[ 3.362175 ] ? pci_device_remove+0x110/0x110
+[ 3.362175 ] local_pci_probe+0x45/0xa0
+[ 3.362175 ] pci_device_probe+0x12b/0x1d0
+[ 3.362175 ] really_probe+0x2a9/0x610
+[ 3.362175 ] driver_probe_device+0x90/0x1d0
+[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20
+[ 3.362175 ] device_driver_attach+0x68/0x70
+[ 3.362175 ] __driver_attach+0x124/0x1b0
+[ 3.362175 ] ? device_driver_attach+0x70/0x70
+[ 3.362175 ] bus_for_each_dev+0xbb/0x110
+[ 3.362175 ] ? rdinit_setup+0x45/0x45
+[ 3.362175 ] driver_attach+0x27/0x30
+[ 3.362175 ] bus_add_driver+0x1eb/0x2a0
+[ 3.362175 ] driver_register+0xa9/0x180
+[ 3.362175 ] __pci_register_driver+0x82/0x90
+[ 3.362175 ] ? w6692_init+0x38/0x38
+[ 3.362175 ] nj_init+0x36/0x38
+[ 3.362175 ] do_one_initcall+0x7f/0x3d0
+[ 3.362175 ] ? rdinit_setup+0x45/0x45
+[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80
+[ 3.362175 ] kernel_init_freeable+0x2aa/0x301
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] kernel_init+0x18/0x190
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] ret_from_fork+0x1f/0x30
+[ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ...
+[ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
+5.13.0-rc1-00144-g25a1298726e #13
+[ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
+rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
+[ 3.362175 ] Call Trace:
+[ 3.362175 ] dump_stack+0xba/0xf5
+[ 3.362175 ] ? free_irq+0x100/0x480
+[ 3.362175 ] panic+0x15a/0x3f2
+[ 3.362175 ] ? __warn+0xf2/0x150
+[ 3.362175 ] ? free_irq+0x100/0x480
+[ 3.362175 ] __warn+0x108/0x150
+[ 3.362175 ] ? free_irq+0x100/0x480
+[ 3.362175 ] report_bug+0x119/0x1c0
+[ 3.362175 ] handle_bug+0x3b/0x80
+[ 3.362175 ] exc_invalid_op+0x18/0x70
+[ 3.362175 ] asm_exc_invalid_op+0x12/0x20
+[ 3.362175 ] RIP: 0010:free_irq+0x100/0x480
+[ 3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18
+4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5
+ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80
+[ 3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082
+[ 3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX:
+0000000000000000
+[ 3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI:
+00000000ffffffff
+[ 3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09:
+0000000000000000
+[ 3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12:
+0000000000000000
+[ 3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15:
+ffff888104dc80a8
+[ 3.362175 ] ? vprintk+0x76/0x150
+[ 3.362175 ] ? free_irq+0x100/0x480
+[ 3.362175 ] nj_release+0x51/0x1e0
+[ 3.362175 ] nj_probe+0x450/0x950
+[ 3.362175 ] ? pci_device_remove+0x110/0x110
+[ 3.362175 ] local_pci_probe+0x45/0xa0
+[ 3.362175 ] pci_device_probe+0x12b/0x1d0
+[ 3.362175 ] really_probe+0x2a9/0x610
+[ 3.362175 ] driver_probe_device+0x90/0x1d0
+[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20
+[ 3.362175 ] device_driver_attach+0x68/0x70
+[ 3.362175 ] __driver_attach+0x124/0x1b0
+[ 3.362175 ] ? device_driver_attach+0x70/0x70
+[ 3.362175 ] bus_for_each_dev+0xbb/0x110
+[ 3.362175 ] ? rdinit_setup+0x45/0x45
+[ 3.362175 ] driver_attach+0x27/0x30
+[ 3.362175 ] bus_add_driver+0x1eb/0x2a0
+[ 3.362175 ] driver_register+0xa9/0x180
+[ 3.362175 ] __pci_register_driver+0x82/0x90
+[ 3.362175 ] ? w6692_init+0x38/0x38
+[ 3.362175 ] nj_init+0x36/0x38
+[ 3.362175 ] do_one_initcall+0x7f/0x3d0
+[ 3.362175 ] ? rdinit_setup+0x45/0x45
+[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80
+[ 3.362175 ] kernel_init_freeable+0x2aa/0x301
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] kernel_init+0x18/0x190
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] ? rest_init+0x2c0/0x2c0
+[ 3.362175 ] ret_from_fork+0x1f/0x30
+[ 3.362175 ] Dumping ftrace buffer:
+[ 3.362175 ] (ftrace buffer empty)
+[ 3.362175 ] Kernel Offset: disabled
+[ 3.362175 ] Rebooting in 1 seconds..
+
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/netjet.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
+index ee925b58bbce..2a1ddd47a096 100644
+--- a/drivers/isdn/hardware/mISDN/netjet.c
++++ b/drivers/isdn/hardware/mISDN/netjet.c
+@@ -1100,7 +1100,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ card->typ = NETJET_S_TJ300;
+
+ card->base = pci_resource_start(pdev, 0);
+- card->irq = pdev->irq;
+ pci_set_drvdata(pdev, card);
+ err = setup_instance(card);
+ if (err)
+--
+2.30.2
+
--- /dev/null
+From c5cb3cb90978b0de588295ff0a8e7186ecb7a3e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Mar 2021 17:09:41 -0800
+Subject: Makefile: LTO: have linker check -Wframe-larger-than
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 24845dcb170e16b3100bd49743687648c71387ae ]
+
+-Wframe-larger-than= requires stack frame information, which the
+frontend cannot provide. This diagnostic is emitted late during
+compilation once stack frame size is available.
+
+When building with LTO, the frontend simply lowers C to LLVM IR and does
+not have stack frame information, so it cannot emit this diagnostic.
+When the linker drives LTO, it restarts optimizations and lowers LLVM IR
+to object code. At that point, it has stack frame information but
+doesn't know to check for a specific max stack frame size.
+
+I consider this a bug in LLVM that we need to fix. There are some
+details we're working out related to LTO such as which value to use when
+there are multiple different values specified per TU, or how to
+propagate these to compiler synthesized routines properly, if at all.
+
+Until it's fixed, ensure we don't miss these. At that point we can wrap
+this in a compiler version guard or revert this based on the minimum
+support version of Clang.
+
+The error message is not generated during link:
+ LTO vmlinux.o
+ld.lld: warning: stack size limit exceeded (8224) in foobarbaz
+
+Cc: Sami Tolvanen <samitolvanen@google.com>
+Reported-by: Candle Sun <candlesea@gmail.com>
+Suggested-by: Fangrui Song <maskray@google.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20210312010942.1546679-1-ndesaulniers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/Makefile b/Makefile
+index ebc02c56db03..358a2b103de9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -912,6 +912,11 @@ CC_FLAGS_LTO += -fvisibility=hidden
+
+ # Limit inlining across translation units to reduce binary size
+ KBUILD_LDFLAGS += -mllvm -import-instr-limit=5
++
++# Check for frame size exceeding threshold during prolog/epilog insertion.
++ifneq ($(CONFIG_FRAME_WARN),0)
++KBUILD_LDFLAGS += -plugin-opt=-warn-stack-size=$(CONFIG_FRAME_WARN)
++endif
+ endif
+
+ ifdef CONFIG_LTO
+--
+2.30.2
+
--- /dev/null
+From 57cfc1a7cfbc1a54bb105c137fdf816f01844aec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 May 2021 19:02:01 +0800
+Subject: MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ]
+
+When update the latest mainline kernel with the following three configs,
+the kernel hangs during startup:
+
+(1) CONFIG_FUNCTION_GRAPH_TRACER=y
+(2) CONFIG_PREEMPT_TRACER=y
+(3) CONFIG_FTRACE_STARTUP_TEST=y
+
+When update the latest mainline kernel with the above two configs (1)
+and (2), the kernel starts normally, but it still hangs when execute
+the following command:
+
+echo "function_graph" > /sys/kernel/debug/tracing/current_tracer
+
+Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs
+disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences
+with function_graph tracer at the first glance.
+
+I use ejtag to find out the epc address is related with preempt_enable()
+in the file arch/mips/lib/mips-atomic.c, because function tracing can
+trace the preempt_{enable,disable} calls that are traced, replace them
+with preempt_{enable,disable}_notrace to prevent function tracing from
+going into an infinite loop, and then it can fix the kernel hang issue.
+
+By the way, it seems that this commit is a complement and improvement of
+commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing
+is enabled").
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lib/mips-atomic.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c
+index de03838b343b..a9b72eacfc0b 100644
+--- a/arch/mips/lib/mips-atomic.c
++++ b/arch/mips/lib/mips-atomic.c
+@@ -37,7 +37,7 @@
+ */
+ notrace void arch_local_irq_disable(void)
+ {
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void)
+ : /* no inputs */
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+ }
+ EXPORT_SYMBOL(arch_local_irq_disable);
+
+@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void)
+ {
+ unsigned long flags;
+
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void)
+ : /* no inputs */
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+
+ return flags;
+ }
+@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
+ {
+ unsigned long __tmp1;
+
+- preempt_disable();
++ preempt_disable_notrace();
+
+ __asm__ __volatile__(
+ " .set push \n"
+@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags)
+ : "0" (flags)
+ : "memory");
+
+- preempt_enable();
++ preempt_enable_notrace();
+ }
+ EXPORT_SYMBOL(arch_local_irq_restore);
+
+--
+2.30.2
+
--- /dev/null
+From ebabc7537463d5c73f2a600ea937a7b1fe1a00ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 May 2021 19:07:12 +0530
+Subject: net: appletalk: cops: Fix data race in cops_probe1
+
+From: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
+
+[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ]
+
+In cops_probe1(), there is a write to dev->base_addr after requesting an
+interrupt line and registering the interrupt handler cops_interrupt().
+The handler might be called in parallel to handle an interrupt.
+cops_interrupt() tries to read dev->base_addr leading to a potential
+data race. So write to dev->base_addr before calling request_irq().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Saubhik Mukherjee <saubhik.mukherjee@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/appletalk/cops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c
+index ba8e70a8e312..6b12ce822e51 100644
+--- a/drivers/net/appletalk/cops.c
++++ b/drivers/net/appletalk/cops.c
+@@ -327,6 +327,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
+ break;
+ }
+
++ dev->base_addr = ioaddr;
++
+ /* Reserve any actual interrupt. */
+ if (dev->irq) {
+ retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev);
+@@ -334,8 +336,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr)
+ goto err_out;
+ }
+
+- dev->base_addr = ioaddr;
+-
+ lp = netdev_priv(dev);
+ spin_lock_init(&lp->lock);
+
+--
+2.30.2
+
--- /dev/null
+From 15ffb76f0c36dc19862c6fc823a5555d7964da68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 May 2021 15:29:53 -0500
+Subject: net: dsa: microchip: enable phy errata workaround on 9567
+
+From: George McCollister <george.mccollister@gmail.com>
+
+[ Upstream commit 8c42a49738f16af0061f9ae5c2f5a955f268d9e3 ]
+
+Also enable phy errata workaround on 9567 since has the same errata as
+the 9477 according to the manufacture's documentation.
+
+Signed-off-by: George McCollister <george.mccollister@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz9477.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c
+index 55e5d479acce..854e25f43fa7 100644
+--- a/drivers/net/dsa/microchip/ksz9477.c
++++ b/drivers/net/dsa/microchip/ksz9477.c
+@@ -1530,6 +1530,7 @@ static const struct ksz_chip_data ksz9477_switch_chips[] = {
+ .num_statics = 16,
+ .cpu_ports = 0x7F, /* can be configured as cpu port */
+ .port_cnt = 7, /* total physical port count */
++ .phy_errata_9477 = true,
+ },
+ };
+
+--
+2.30.2
+
--- /dev/null
+From 0c0c69fb3475f86c069afdd89c1f58637e75cf24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 May 2021 17:16:11 +0800
+Subject: net: macb: ensure the device is available before accessing GEMGXL
+ control registers
+
+From: Zong Li <zong.li@sifive.com>
+
+[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ]
+
+If runtime power menagement is enabled, the gigabit ethernet PLL would
+be disabled after macb_probe(). During this period of time, the system
+would hang up if we try to access GEMGXL control registers.
+
+We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of
+sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping
+function called from invalid context"). Add netif_running checking to
+ensure the device is available before accessing GEMGXL device.
+
+Changed in v2:
+ - Use netif_running instead of its own flag
+
+Signed-off-by: Zong Li <zong.li@sifive.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 0f6a6cb7e98d..51b19172d63b 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2837,6 +2837,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp)
+ struct gem_stats *hwstat = &bp->hw_stats.gem;
+ struct net_device_stats *nstat = &bp->dev->stats;
+
++ if (!netif_running(bp->dev))
++ return nstat;
++
+ gem_update_stats(bp);
+
+ nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors +
+--
+2.30.2
+
--- /dev/null
+From 0c3172d31b27385f1cb69347a263369271e41a24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 12:04:13 +0300
+Subject: net: mdiobus: get rid of a BUG_ON()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ]
+
+We spotted a bug recently during a review where a driver was
+unregistering a bus that wasn't registered, which would trigger this
+BUG_ON(). Let's handle that situation more gracefully, and just print
+a warning and return.
+
+Reported-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio_bus.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
+index 823518554079..d3c916821b11 100644
+--- a/drivers/net/phy/mdio_bus.c
++++ b/drivers/net/phy/mdio_bus.c
+@@ -607,7 +607,8 @@ void mdiobus_unregister(struct mii_bus *bus)
+ struct mdio_device *mdiodev;
+ int i;
+
+- BUG_ON(bus->state != MDIOBUS_REGISTERED);
++ if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED))
++ return;
+ bus->state = MDIOBUS_UNREGISTERED;
+
+ for (i = 0; i < PHY_MAX_ADDR; i++) {
+--
+2.30.2
+
--- /dev/null
+From 7ca31b569b02664a7dc8e90a31a3ef95cd50d4ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 11:52:30 +0800
+Subject: net/nfc/rawsock.c: fix a permission check bug
+
+From: Jeimon <jjjinmeng.zhou@gmail.com>
+
+[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ]
+
+The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable().
+
+Signed-off-by: Jeimon <jjjinmeng.zhou@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/nfc/rawsock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
+index 9c7eb8455ba8..5f1d438a0a23 100644
+--- a/net/nfc/rawsock.c
++++ b/net/nfc/rawsock.c
+@@ -329,7 +329,7 @@ static int rawsock_create(struct net *net, struct socket *sock,
+ return -ESOCKTNOSUPPORT;
+
+ if (sock->type == SOCK_RAW) {
+- if (!capable(CAP_NET_RAW))
++ if (!ns_capable(net->user_ns, CAP_NET_RAW))
+ return -EPERM;
+ sock->ops = &rawsock_raw_ops;
+ } else {
+--
+2.30.2
+
--- /dev/null
+From 6ac81a9d6a7174e0fa6c3b1411c3c607bdde7274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 May 2021 12:32:36 +0000
+Subject: net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ]
+
+When calling the 'ql_sem_spinlock', the driver has already acquired the
+spin lock, so the driver should not call 'ssleep' in atomic context.
+
+This bug can be fixed by using 'mdelay' instead of 'ssleep'.
+
+The KASAN's log reveals it:
+
+[ 3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002
+[ 3.238748 ] 2 locks held by swapper/0/1:
+[ 3.239151 ] #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at:
+__device_driver_lock+0x41/0x60
+[ 3.240026 ] #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at:
+ql3xxx_probe+0x2aa/0xea0
+[ 3.240873 ] Modules linked in:
+[ 3.241187 ] irq event stamp: 460854
+[ 3.241541 ] hardirqs last enabled at (460853): [<ffffffff843051bf>]
+_raw_spin_unlock_irqrestore+0x4f/0x70
+[ 3.242245 ] hardirqs last disabled at (460854): [<ffffffff843058ca>]
+_raw_spin_lock_irqsave+0x2a/0x70
+[ 3.242245 ] softirqs last enabled at (446076): [<ffffffff846002e4>]
+__do_softirq+0x2e4/0x4b1
+[ 3.242245 ] softirqs last disabled at (446069): [<ffffffff811ba5e0>]
+irq_exit_rcu+0x100/0x110
+[ 3.242245 ] Preemption disabled at:
+[ 3.242245 ] [<ffffffff828ca5ba>] ql3xxx_probe+0x2aa/0xea0
+[ 3.242245 ] Kernel panic - not syncing: scheduling while atomic
+[ 3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted
+5.13.0-rc1-00145
+-gee7dc339169-dirty #16
+[ 3.242245 ] Call Trace:
+[ 3.242245 ] dump_stack+0xba/0xf5
+[ 3.242245 ] ? ql3xxx_probe+0x1f0/0xea0
+[ 3.242245 ] panic+0x15a/0x3f2
+[ 3.242245 ] ? vprintk+0x76/0x150
+[ 3.242245 ] ? ql3xxx_probe+0x2aa/0xea0
+[ 3.242245 ] __schedule_bug+0xae/0xe0
+[ 3.242245 ] __schedule+0x72e/0xa00
+[ 3.242245 ] schedule+0x43/0xf0
+[ 3.242245 ] schedule_timeout+0x28b/0x500
+[ 3.242245 ] ? del_timer_sync+0xf0/0xf0
+[ 3.242245 ] ? msleep+0x2f/0x70
+[ 3.242245 ] msleep+0x59/0x70
+[ 3.242245 ] ql3xxx_probe+0x307/0xea0
+[ 3.242245 ] ? _raw_spin_unlock_irqrestore+0x3a/0x70
+[ 3.242245 ] ? pci_device_remove+0x110/0x110
+[ 3.242245 ] local_pci_probe+0x45/0xa0
+[ 3.242245 ] pci_device_probe+0x12b/0x1d0
+[ 3.242245 ] really_probe+0x2a9/0x610
+[ 3.242245 ] driver_probe_device+0x90/0x1d0
+[ 3.242245 ] ? mutex_lock_nested+0x1b/0x20
+[ 3.242245 ] device_driver_attach+0x68/0x70
+[ 3.242245 ] __driver_attach+0x124/0x1b0
+[ 3.242245 ] ? device_driver_attach+0x70/0x70
+[ 3.242245 ] bus_for_each_dev+0xbb/0x110
+[ 3.242245 ] ? rdinit_setup+0x45/0x45
+[ 3.242245 ] driver_attach+0x27/0x30
+[ 3.242245 ] bus_add_driver+0x1eb/0x2a0
+[ 3.242245 ] driver_register+0xa9/0x180
+[ 3.242245 ] __pci_register_driver+0x82/0x90
+[ 3.242245 ] ? yellowfin_init+0x25/0x25
+[ 3.242245 ] ql3xxx_driver_init+0x23/0x25
+[ 3.242245 ] do_one_initcall+0x7f/0x3d0
+[ 3.242245 ] ? rdinit_setup+0x45/0x45
+[ 3.242245 ] ? rcu_read_lock_sched_held+0x4f/0x80
+[ 3.242245 ] kernel_init_freeable+0x2aa/0x301
+[ 3.242245 ] ? rest_init+0x2c0/0x2c0
+[ 3.242245 ] kernel_init+0x18/0x190
+[ 3.242245 ] ? rest_init+0x2c0/0x2c0
+[ 3.242245 ] ? rest_init+0x2c0/0x2c0
+[ 3.242245 ] ret_from_fork+0x1f/0x30
+[ 3.242245 ] Dumping ftrace buffer:
+[ 3.242245 ] (ftrace buffer empty)
+[ 3.242245 ] Kernel Offset: disabled
+[ 3.242245 ] Rebooting in 1 seconds.
+
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qla3xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index 214e347097a7..2376b2729633 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -114,7 +114,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev,
+ value = readl(&port_regs->CommonRegs.semaphoreReg);
+ if ((value & (sem_mask >> 16)) == sem_bits)
+ return 0;
+- ssleep(1);
++ mdelay(1000);
+ } while (--seconds);
+ return -1;
+ }
+--
+2.30.2
+
--- /dev/null
+From 3eee3a762d7c082ecb6281cc82901107df4525ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 May 2021 16:38:35 +0200
+Subject: net:sfc: fix non-freed irq in legacy irq mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Íñigo Huguet <ihuguet@redhat.com>
+
+[ Upstream commit 8f03eeb6e0a0a0b8d617ee0a4bce729e47130036 ]
+
+SFC driver can be configured via modparam to work using MSI-X, MSI or
+legacy IRQ interrupts. In the last one, the interrupt was not properly
+released on module remove.
+
+It was not freed because the flag irqs_hooked was not set during
+initialization in the case of using legacy IRQ.
+
+Example of (trimmed) trace during module remove without this fix:
+
+remove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1'
+WARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170
+...trimmed...
+Call Trace:
+ unregister_irq_proc+0xe3/0x100
+ free_desc+0x29/0x70
+ irq_free_descs+0x47/0x70
+ mp_unmap_irq+0x58/0x60
+ acpi_unregister_gsi_ioapic+0x2a/0x40
+ acpi_pci_irq_disable+0x78/0xb0
+ pci_disable_device+0xd1/0x100
+ efx_pci_remove+0xa1/0x1e0 [sfc]
+ pci_device_remove+0x38/0xa0
+ __device_release_driver+0x177/0x230
+ driver_detach+0xcb/0x110
+ bus_remove_driver+0x58/0xd0
+ pci_unregister_driver+0x2a/0xb0
+ efx_exit_module+0x24/0xf40 [sfc]
+ __do_sys_delete_module.constprop.0+0x171/0x280
+ ? exit_to_user_mode_prepare+0x83/0x1d0
+ do_syscall_64+0x3d/0x80
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x7f9f9385800b
+...trimmed...
+
+Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/nic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
+index d1e908846f5d..22fbb0ae77fb 100644
+--- a/drivers/net/ethernet/sfc/nic.c
++++ b/drivers/net/ethernet/sfc/nic.c
+@@ -90,6 +90,7 @@ int efx_nic_init_interrupt(struct efx_nic *efx)
+ efx->pci_dev->irq);
+ goto fail1;
+ }
++ efx->irqs_hooked = true;
+ return 0;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From dd22635845d9040ffd65074f349ecc13a006bd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 May 2021 16:38:09 +0200
+Subject: netlink: disable IRQs for netlink_lock_table()
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ]
+
+Syzbot reports that in mac80211 we have a potential deadlock
+between our "local->stop_queue_reasons_lock" (spinlock) and
+netlink's nl_table_lock (rwlock). This is because there's at
+least one situation in which we might try to send a netlink
+message with this spinlock held while it is also possible to
+take the spinlock from a hardirq context, resulting in the
+following deadlock scenario reported by lockdep:
+
+ CPU0 CPU1
+ ---- ----
+ lock(nl_table_lock);
+ local_irq_disable();
+ lock(&local->queue_stop_reason_lock);
+ lock(nl_table_lock);
+ <Interrupt>
+ lock(&local->queue_stop_reason_lock);
+
+This seems valid, we can take the queue_stop_reason_lock in
+any kind of context ("CPU0"), and call ieee80211_report_ack_skb()
+with the spinlock held and IRQs disabled ("CPU1") in some
+code path (ieee80211_do_stop() via ieee80211_free_txskb()).
+
+Short of disallowing netlink use in scenarios like these
+(which would be rather complex in mac80211's case due to
+the deep callchain), it seems the only fix for this is to
+disable IRQs while nl_table_lock is held to avoid hitting
+this scenario, this disallows the "CPU0" portion of the
+reported deadlock.
+
+Note that the writer side (netlink_table_grab()) already
+disables IRQs for this lock.
+
+Unfortunately though, this seems like a huge hammer, and
+maybe the whole netlink table locking should be reworked.
+
+Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 3a62f97acf39..6133e412b948 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -461,11 +461,13 @@ void netlink_table_ungrab(void)
+ static inline void
+ netlink_lock_table(void)
+ {
++ unsigned long flags;
++
+ /* read_lock() synchronizes us to netlink_table_grab */
+
+- read_lock(&nl_table_lock);
++ read_lock_irqsave(&nl_table_lock, flags);
+ atomic_inc(&nl_table_users);
+- read_unlock(&nl_table_lock);
++ read_unlock_irqrestore(&nl_table_lock, flags);
+ }
+
+ static inline void
+--
+2.30.2
+
--- /dev/null
+From 3ef2d83cab626e566f3b1c922f50e7181b13ce3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 May 2021 10:23:46 +0200
+Subject: nvme-fabrics: decode host pathing error for connect
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 4d9442bf263ac45d495bb7ecf75009e59c0622b2 ]
+
+Add an additional decoding for 'host pathing error' during connect.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/fabrics.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
+index 604ab0e5a2ad..fb02ca2e3096 100644
+--- a/drivers/nvme/host/fabrics.c
++++ b/drivers/nvme/host/fabrics.c
+@@ -336,6 +336,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl,
+ cmd->connect.recfmt);
+ break;
+
++ case NVME_SC_HOST_PATH_ERROR:
++ dev_err(ctrl->device,
++ "Connect command failed: host path error\n");
++ break;
++
+ default:
+ dev_err(ctrl->device,
+ "Connect command failed, error wo/DNR bit: %d\n",
+--
+2.30.2
+
--- /dev/null
+From cbbd65a38d89a2198b0c5b939a71ae9839ad716d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 May 2021 14:51:15 -0700
+Subject: nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 042a3eaad6daeabcfaf163aa44da8ea3cf8b5496 ]
+
+We need to select NVME_CORE.
+
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
+index a44d49d63968..494675aeaaad 100644
+--- a/drivers/nvme/host/Kconfig
++++ b/drivers/nvme/host/Kconfig
+@@ -71,7 +71,8 @@ config NVME_FC
+ config NVME_TCP
+ tristate "NVM Express over Fabrics TCP host driver"
+ depends on INET
+- depends on BLK_DEV_NVME
++ depends on BLOCK
++ select NVME_CORE
+ select NVME_FABRICS
+ select CRYPTO
+ select CRYPTO_CRC32C
+--
+2.30.2
+
--- /dev/null
+From 9642999b4329f72ba9e5a1b917a79f532e6302b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 May 2021 08:49:05 -0700
+Subject: nvmet: fix false keep-alive timeout when a controller is torn down
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit aaeadd7075dc9e184bc7876e9dd7b3bada771df2 ]
+
+Controller teardown flow may take some time in case it has many I/O
+queues, and the host may not send us keep-alive during this period.
+Hence reset the traffic based keep-alive timer so we don't trigger
+a controller teardown as a result of a keep-alive expiration.
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/core.c | 15 +++++++++++----
+ drivers/nvme/target/nvmet.h | 2 +-
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 7d16cb4cd8ac..83921dab8368 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -388,10 +388,10 @@ static void nvmet_keep_alive_timer(struct work_struct *work)
+ {
+ struct nvmet_ctrl *ctrl = container_of(to_delayed_work(work),
+ struct nvmet_ctrl, ka_work);
+- bool cmd_seen = ctrl->cmd_seen;
++ bool reset_tbkas = ctrl->reset_tbkas;
+
+- ctrl->cmd_seen = false;
+- if (cmd_seen) {
++ ctrl->reset_tbkas = false;
++ if (reset_tbkas) {
+ pr_debug("ctrl %d reschedule traffic based keep-alive timer\n",
+ ctrl->cntlid);
+ schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ);
+@@ -804,6 +804,13 @@ void nvmet_sq_destroy(struct nvmet_sq *sq)
+ percpu_ref_exit(&sq->ref);
+
+ if (ctrl) {
++ /*
++ * The teardown flow may take some time, and the host may not
++ * send us keep-alive during this period, hence reset the
++ * traffic based keep-alive timer so we don't trigger a
++ * controller teardown as a result of a keep-alive expiration.
++ */
++ ctrl->reset_tbkas = true;
+ nvmet_ctrl_put(ctrl);
+ sq->ctrl = NULL; /* allows reusing the queue later */
+ }
+@@ -953,7 +960,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
+ }
+
+ if (sq->ctrl)
+- sq->ctrl->cmd_seen = true;
++ sq->ctrl->reset_tbkas = true;
+
+ return true;
+
+diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
+index 5aad34b106dc..43a668dc8bc4 100644
+--- a/drivers/nvme/target/nvmet.h
++++ b/drivers/nvme/target/nvmet.h
+@@ -166,7 +166,7 @@ struct nvmet_ctrl {
+ struct nvmet_subsys *subsys;
+ struct nvmet_sq **sqs;
+
+- bool cmd_seen;
++ bool reset_tbkas;
+
+ struct mutex lock;
+ u64 cap;
+--
+2.30.2
+
--- /dev/null
+From 90b7f49b8c66012273ef54552e002776ce5886f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 09:20:51 +1200
+Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c
+ controllers
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ]
+
+The i2c controllers on the P1010 have an erratum where the documented
+scheme for i2c bus recovery will not work (A-004447). A different
+mechanism is needed which is documented in the P1010 Chip Errata Rev L.
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
+index 1b4aafc1f6a2..9716a0484ecf 100644
+--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
++++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi
+@@ -122,7 +122,15 @@
+ };
+
+ /include/ "pq3-i2c-0.dtsi"
++ i2c@3000 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "pq3-i2c-1.dtsi"
++ i2c@3100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "pq3-duart-0.dtsi"
+ /include/ "pq3-espi-0.dtsi"
+ spi0: spi@7000 {
+--
+2.30.2
+
--- /dev/null
+From 3fb840f68bc60751004dcc00d71112adc4a5be38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 09:20:50 +1200
+Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c
+ controllers
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ]
+
+The i2c controllers on the P2040/P2041 have an erratum where the
+documented scheme for i2c bus recovery will not work (A-004447). A
+different mechanism is needed which is documented in the P2040 Chip
+Errata Rev Q (latest available at the time of writing).
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+index 872e4485dc3f..ddc018d42252 100644
+--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
++++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi
+@@ -371,7 +371,23 @@
+ };
+
+ /include/ "qoriq-i2c-0.dtsi"
++ i2c@118000 {
++ fsl,i2c-erratum-a004447;
++ };
++
++ i2c@118100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "qoriq-i2c-1.dtsi"
++ i2c@119000 {
++ fsl,i2c-erratum-a004447;
++ };
++
++ i2c@119100 {
++ fsl,i2c-erratum-a004447;
++ };
++
+ /include/ "qoriq-duart-0.dtsi"
+ /include/ "qoriq-duart-1.dtsi"
+ /include/ "qoriq-gpio-0.dtsi"
+--
+2.30.2
+
--- /dev/null
+From f311db77e4f3293025cc07864ce2a7f01702bdc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 May 2021 11:08:06 -0700
+Subject: RDS tcp loopback connection can hang
+
+From: Rao Shoaib <rao.shoaib@oracle.com>
+
+[ Upstream commit aced3ce57cd37b5ca332bcacd370d01f5a8c5371 ]
+
+When TCP is used as transport and a program on the
+system connects to RDS port 16385, connection is
+accepted but denied per the rules of RDS. However,
+RDS connections object is left in the list. Next
+loopback connection will select that connection
+object as it is at the head of list. The connection
+attempt will hang as the connection object is set
+to connect over TCP which is not allowed
+
+The issue can be reproduced easily, use rds-ping
+to ping a local IP address. After that use any
+program like ncat to connect to the same IP
+address and port 16385. This will hang so ctrl-c out.
+Now try rds-ping, it will hang.
+
+To fix the issue this patch adds checks to disallow
+the connection object creation and destroys the
+connection object.
+
+Signed-off-by: Rao Shoaib <rao.shoaib@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/connection.c | 23 +++++++++++++++++------
+ net/rds/tcp.c | 4 ++--
+ net/rds/tcp.h | 3 ++-
+ net/rds/tcp_listen.c | 6 ++++++
+ 4 files changed, 27 insertions(+), 9 deletions(-)
+
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index f2fcab182095..a3bc4b54d491 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -240,12 +240,23 @@ static struct rds_connection *__rds_conn_create(struct net *net,
+ if (loop_trans) {
+ rds_trans_put(loop_trans);
+ conn->c_loopback = 1;
+- if (is_outgoing && trans->t_prefer_loopback) {
+- /* "outgoing" connection - and the transport
+- * says it wants the connection handled by the
+- * loopback transport. This is what TCP does.
+- */
+- trans = &rds_loop_transport;
++ if (trans->t_prefer_loopback) {
++ if (likely(is_outgoing)) {
++ /* "outgoing" connection to local address.
++ * Protocol says it wants the connection
++ * handled by the loopback transport.
++ * This is what TCP does.
++ */
++ trans = &rds_loop_transport;
++ } else {
++ /* No transport currently in use
++ * should end up here, but if it
++ * does, reset/destroy the connection.
++ */
++ kmem_cache_free(rds_conn_slab, conn);
++ conn = ERR_PTR(-EOPNOTSUPP);
++ goto out;
++ }
+ }
+ }
+
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index 43db0eca911f..abf19c0e3ba0 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -313,8 +313,8 @@ out:
+ }
+ #endif
+
+-static int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
+- __u32 scope_id)
++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
++ __u32 scope_id)
+ {
+ struct net_device *dev = NULL;
+ #if IS_ENABLED(CONFIG_IPV6)
+diff --git a/net/rds/tcp.h b/net/rds/tcp.h
+index bad9cf49d565..dc8d745d6857 100644
+--- a/net/rds/tcp.h
++++ b/net/rds/tcp.h
+@@ -59,7 +59,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);
+ u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq);
+ extern struct rds_transport rds_tcp_transport;
+ void rds_tcp_accept_work(struct sock *sk);
+-
++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr,
++ __u32 scope_id);
+ /* tcp_connect.c */
+ int rds_tcp_conn_path_connect(struct rds_conn_path *cp);
+ void rds_tcp_conn_path_shutdown(struct rds_conn_path *conn);
+diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
+index 101cf14215a0..09cadd556d1e 100644
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -167,6 +167,12 @@ int rds_tcp_accept_one(struct socket *sock)
+ }
+ #endif
+
++ if (!rds_tcp_laddr_check(sock_net(sock->sk), peer_addr, dev_if)) {
++ /* local address connection is only allowed via loopback */
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ conn = rds_conn_create(sock_net(sock->sk),
+ my_addr, peer_addr,
+ &rds_tcp_transport, 0, GFP_KERNEL, dev_if);
+--
+2.30.2
+
--- /dev/null
+From 6b4ff108777d4477a50bb3c046887393e5cb83cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 May 2021 23:14:16 -0700
+Subject: scsi: bnx2fc: Return failure if io_req is already in ABTS processing
+
+From: Javed Hasan <jhasan@marvell.com>
+
+[ Upstream commit 122c81c563b0c1c6b15ff76a9159af5ee1f21563 ]
+
+Return failure from bnx2fc_eh_abort() if io_req is already in ABTS
+processing.
+
+Link: https://lore.kernel.org/r/20210519061416.19321-1-jhasan@marvell.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Javed Hasan <jhasan@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bnx2fc/bnx2fc_io.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
+index 1a0dc18d6915..ed300a279a38 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
+@@ -1220,6 +1220,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd)
+ was a result from the ABTS request rather than the CLEANUP
+ request */
+ set_bit(BNX2FC_FLAG_IO_CLEANUP, &io_req->req_flags);
++ rc = FAILED;
+ goto done;
+ }
+
+--
+2.30.2
+
--- /dev/null
+From 1d5c43a7cc027423eecb0446fe2c9f9381265701 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 21:05:19 +0800
+Subject: scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 7907a021e4bbfa29cccacd2ba2dade894d9a7d4c ]
+
+irqs allocated with devm_request_irq() should not be freed using
+free_irq(). Doing so causes a dangling pointer and a subsequent double
+free.
+
+Link: https://lore.kernel.org/r/20210519130519.2661938-1-yangyingliang@huawei.com
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Acked-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 4580e081e489..b21246b1ba99 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -4799,14 +4799,14 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba)
+ {
+ int i;
+
+- free_irq(pci_irq_vector(pdev, 1), hisi_hba);
+- free_irq(pci_irq_vector(pdev, 2), hisi_hba);
+- free_irq(pci_irq_vector(pdev, 11), hisi_hba);
++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 1), hisi_hba);
++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 2), hisi_hba);
++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 11), hisi_hba);
+ for (i = 0; i < hisi_hba->cq_nvecs; i++) {
+ struct hisi_sas_cq *cq = &hisi_hba->cq[i];
+ int nr = hisi_sas_intr_conv ? 16 : 16 + i;
+
+- free_irq(pci_irq_vector(pdev, nr), cq);
++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq);
+ }
+ pci_free_irq_vectors(pdev);
+ }
+--
+2.30.2
+
--- /dev/null
+From 6766089faa4f2ceb4e9ee5595bdb4ec3f6dedf16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Apr 2021 23:35:54 +0300
+Subject: scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
+
+From: Dmitry Bogdanov <d.bogdanov@yadro.com>
+
+[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ]
+
+Target de-configuration panics at high CPU load because TPGT and WWPN can
+be removed on separate threads.
+
+TPGT removal requests a reset HBA on a separate thread and waits for reset
+complete (phase1). Due to high CPU load that HBA reset can be delayed for
+some time.
+
+WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has
+already completed and thus tgt.tgt_ops is subsequently cleared. However,
+tgt.tgt_ops is needed to process incoming traffic and therefore this will
+cause one of the following panics:
+
+NIP qlt_reset+0x7c/0x220 [qla2xxx]
+LR qlt_reset+0x68/0x220 [qla2xxx]
+Call Trace:
+0xc000003ffff63a78 (unreliable)
+qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx]
+qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx]
+qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx]
+qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]
+
+or
+
+NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx]
+LR qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx]
+Call Trace:
+qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable)
+qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx]
+qla83xx_msix_atio_q+0x54/0x90 [qla2xxx]
+
+or
+
+NIP qlt_create_sess+0x90/0x4e0 [qla2xxx]
+LR qla24xx_do_nack_work+0xa8/0x180 [qla2xxx]
+Call Trace:
+0xc0000000348fba30 (unreliable)
+qla24xx_do_nack_work+0xa8/0x180 [qla2xxx]
+qla2x00_do_work+0x674/0xbf0 [qla2xxx]
+qla2x00_iocb_work_fn
+
+The patch fixes the issue by serializing qlt_stop_phase1() and
+qlt_stop_phase2() functions to make WWPN removal wait for phase1
+completion.
+
+Link: https://lore.kernel.org/r/20210415203554.27890-1-d.bogdanov@yadro.com
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 480e7d2dcf3e..745d6d98c02e 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1558,10 +1558,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt)
+ return;
+ }
+
++ mutex_lock(&tgt->ha->optrom_mutex);
+ mutex_lock(&vha->vha_tgt.tgt_mutex);
+ tgt->tgt_stop = 0;
+ tgt->tgt_stopped = 1;
+ mutex_unlock(&vha->vha_tgt.tgt_mutex);
++ mutex_unlock(&tgt->ha->optrom_mutex);
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished\n",
+ tgt);
+--
+2.30.2
+
--- /dev/null
+From 6db5e3468779a0fa5aceacb19189320b6154bf55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 May 2021 09:49:32 +0000
+Subject: scsi: vmw_pvscsi: Set correct residual data length
+
+From: Matt Wang <wwentao@vmware.com>
+
+[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ]
+
+Some commands (such as INQUIRY) may return less data than the initiator
+requested. To avoid conducting useless information, set the right residual
+count to make upper layer aware of this.
+
+Before (INQUIRY PAGE 0xB0 with 128B buffer):
+
+$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00
+SCSI Status: Good
+
+Received 128 bytes of data:
+ 00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............
+ 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@....
+ 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... .....
+ 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+
+After:
+
+$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00
+SCSI Status: Good
+
+Received 64 bytes of data:
+00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............
+10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@....
+20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... .....
+30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+
+[mkp: clarified description]
+
+Link: https://lore.kernel.org/r/03C41093-B62E-43A2-913E-CFC92F1C70C3@vmware.com
+Signed-off-by: Matt Wang <wwentao@vmware.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/vmw_pvscsi.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
+index 8a79605d9652..b9969fce6b4d 100644
+--- a/drivers/scsi/vmw_pvscsi.c
++++ b/drivers/scsi/vmw_pvscsi.c
+@@ -585,7 +585,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter,
+ case BTSTAT_SUCCESS:
+ case BTSTAT_LINKED_COMMAND_COMPLETED:
+ case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG:
+- /* If everything went fine, let's move on.. */
++ /*
++ * Commands like INQUIRY may transfer less data than
++ * requested by the initiator via bufflen. Set residual
++ * count to make upper layer aware of the actual amount
++ * of data returned.
++ */
++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen);
+ cmd->result = (DID_OK << 16);
+ break;
+
+--
+2.30.2
+
proc-track-proc-pid-attr-opener-mm_struct.patch
+asoc-max98088-fix-ni-clock-divider-calculation.patch
+asoc-amd-fix-for-pcm_read-error.patch
+spi-fix-spi-device-unregister-flow.patch
+spi-spi-zynq-qspi-fix-stack-violation-bug.patch
+bpf-forbid-trampoline-attach-for-functions-with-vari.patch
+asoc-codecs-lpass-rx-macro-add-missing-module_device.patch
+asoc-codecs-lpass-tx-macro-add-missing-module_device.patch
+net-nfc-rawsock.c-fix-a-permission-check-bug.patch
+usb-cdns3-fix-runtime-pm-imbalance-on-error.patch
+asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch
+asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch
+bpf-add-deny-list-of-btf-ids-check-for-tracing-progr.patch
+vfio-ccw-reset-fsm-state-to-idle-inside-fsm.patch
+vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch
+asoc-sti-sas-add-missing-module_device_table.patch
+spi-sprd-add-missing-module_device_table.patch
+usb-chipidea-udc-assign-interrupt-number-to-usb-gadg.patch
+isdn-misdn-netjet-fix-crash-in-nj_probe.patch
+bonding-init-notify_work-earlier-to-avoid-uninitiali.patch
+netlink-disable-irqs-for-netlink_lock_table.patch
+net-mdiobus-get-rid-of-a-bug_on.patch
+cgroup-disable-controllers-at-parse-time.patch
+wq-handle-vm-suspension-in-stall-detection.patch
+net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch
+rds-tcp-loopback-connection-can-hang.patch
+net-sfc-fix-non-freed-irq-in-legacy-irq-mode.patch
+scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch
+scsi-vmw_pvscsi-set-correct-residual-data-length.patch
+scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch
+scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch
+net-macb-ensure-the-device-is-available-before-acces.patch
+net-appletalk-cops-fix-data-race-in-cops_probe1.patch
+net-dsa-microchip-enable-phy-errata-workaround-on-95.patch
+makefile-lto-have-linker-check-wframe-larger-than.patch
+nvme-fabrics-decode-host-pathing-error-for-connect.patch
+mips-fix-kernel-hang-under-function_graph_tracer-and.patch
+bpf-selftests-adjust-few-selftest-result_unpriv-outc.patch
+dm-verity-fix-require_signatures-module_param-permis.patch
+bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch
+nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch
+nvmet-fix-false-keep-alive-timeout-when-a-controller.patch
+powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch
+powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch
+spi-don-t-have-controller-clean-up-spi-device-before.patch
+spi-cleanup-on-failure-of-initial-setup.patch
+i2c-mpc-make-use-of-i2c_recover_bus.patch
+i2c-mpc-implement-erratum-a-004447-workaround.patch
--- /dev/null
+From 65fe3945104bbaefc0db97cc7673a1cd408a7e46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 May 2021 23:10:56 +0200
+Subject: spi: Cleanup on failure of initial setup
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ]
+
+Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the
+SPI core's behavior if the ->setup() hook returns an error upon adding
+an spi_device: Before, the ->cleanup() hook was invoked to free any
+allocations that were made by ->setup(). With the commit, that's no
+longer the case, so the ->setup() hook is expected to free the
+allocations itself.
+
+I've identified 5 drivers which depend on the old behavior and am fixing
+them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c
+spi-omap2-mcspi.c spi-pxa2xx.c
+
+Importantly, ->setup() is not only invoked on spi_device *addition*:
+It may subsequently be called to *change* SPI parameters. If changing
+these SPI parameters fails, freeing memory allocations would be wrong.
+That should only be done if the spi_device is finally destroyed.
+I am therefore using a bool "initial_setup" in 4 of the affected drivers
+to differentiate between the invocation on *adding* the spi_device and
+any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c
+spi-omap2-mcspi.c
+
+In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device
+addition, not any subsequent calls. It therefore doesn't need the bool.
+
+It's worth noting that 5 other drivers already perform a cleanup if the
+->setup() hook fails. Before c7299fea6769, they caused a double-free
+if ->setup() failed on spi_device addition. Since the commit, they're
+fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c
+spi-st-ssc4.c spi-tegra114.c
+
+(spi-pxa2xx.c also already performs a cleanup, but only in one of
+several error paths.)
+
+Fixes: c7299fea6769 ("spi: Fix spi device unregister flow")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: Saravana Kannan <saravanak@google.com>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> # pxa2xx
+Link: https://lore.kernel.org/r/f76a0599469f265b69c371538794101fa37b5536.1622149321.git.lukas@wunner.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bitbang.c | 18 ++++++++++++++----
+ drivers/spi/spi-fsl-spi.c | 4 ++++
+ drivers/spi/spi-omap-uwire.c | 9 ++++++++-
+ drivers/spi/spi-omap2-mcspi.c | 33 ++++++++++++++++++++-------------
+ drivers/spi/spi-pxa2xx.c | 9 ++++++++-
+ 5 files changed, 54 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c
+index 1a7352abd878..3d8948a17095 100644
+--- a/drivers/spi/spi-bitbang.c
++++ b/drivers/spi/spi-bitbang.c
+@@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi)
+ {
+ struct spi_bitbang_cs *cs = spi->controller_state;
+ struct spi_bitbang *bitbang;
++ bool initial_setup = false;
++ int retval;
+
+ bitbang = spi_master_get_devdata(spi->master);
+
+@@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi)
+ if (!cs)
+ return -ENOMEM;
+ spi->controller_state = cs;
++ initial_setup = true;
+ }
+
+ /* per-word shift register access, in hardware or bitbanging */
+ cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)];
+- if (!cs->txrx_word)
+- return -EINVAL;
++ if (!cs->txrx_word) {
++ retval = -EINVAL;
++ goto err_free;
++ }
+
+ if (bitbang->setup_transfer) {
+- int retval = bitbang->setup_transfer(spi, NULL);
++ retval = bitbang->setup_transfer(spi, NULL);
+ if (retval < 0)
+- return retval;
++ goto err_free;
+ }
+
+ dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs);
+
+ return 0;
++
++err_free:
++ if (initial_setup)
++ kfree(cs);
++ return retval;
+ }
+ EXPORT_SYMBOL_GPL(spi_bitbang_setup);
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index d0e5aa18b7ba..bdf94cc7be1a 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -440,6 +440,7 @@ static int fsl_spi_setup(struct spi_device *spi)
+ {
+ struct mpc8xxx_spi *mpc8xxx_spi;
+ struct fsl_spi_reg __iomem *reg_base;
++ bool initial_setup = false;
+ int retval;
+ u32 hw_mode;
+ struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi);
+@@ -452,6 +453,7 @@ static int fsl_spi_setup(struct spi_device *spi)
+ if (!cs)
+ return -ENOMEM;
+ spi_set_ctldata(spi, cs);
++ initial_setup = true;
+ }
+ mpc8xxx_spi = spi_master_get_devdata(spi->master);
+
+@@ -475,6 +477,8 @@ static int fsl_spi_setup(struct spi_device *spi)
+ retval = fsl_spi_setup_transfer(spi, NULL);
+ if (retval < 0) {
+ cs->hw_mode = hw_mode; /* Restore settings */
++ if (initial_setup)
++ kfree(cs);
+ return retval;
+ }
+
+diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c
+index 71402f71ddd8..df28c6664aba 100644
+--- a/drivers/spi/spi-omap-uwire.c
++++ b/drivers/spi/spi-omap-uwire.c
+@@ -424,15 +424,22 @@ done:
+ static int uwire_setup(struct spi_device *spi)
+ {
+ struct uwire_state *ust = spi->controller_state;
++ bool initial_setup = false;
++ int status;
+
+ if (ust == NULL) {
+ ust = kzalloc(sizeof(*ust), GFP_KERNEL);
+ if (ust == NULL)
+ return -ENOMEM;
+ spi->controller_state = ust;
++ initial_setup = true;
+ }
+
+- return uwire_setup_transfer(spi, NULL);
++ status = uwire_setup_transfer(spi, NULL);
++ if (status && initial_setup)
++ kfree(ust);
++
++ return status;
+ }
+
+ static void uwire_cleanup(struct spi_device *spi)
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index d4c9510af393..3596bbe4b776 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -1032,8 +1032,22 @@ static void omap2_mcspi_release_dma(struct spi_master *master)
+ }
+ }
+
++static void omap2_mcspi_cleanup(struct spi_device *spi)
++{
++ struct omap2_mcspi_cs *cs;
++
++ if (spi->controller_state) {
++ /* Unlink controller state from context save list */
++ cs = spi->controller_state;
++ list_del(&cs->node);
++
++ kfree(cs);
++ }
++}
++
+ static int omap2_mcspi_setup(struct spi_device *spi)
+ {
++ bool initial_setup = false;
+ int ret;
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+ struct omap2_mcspi_regs *ctx = &mcspi->ctx;
+@@ -1051,35 +1065,28 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+ spi->controller_state = cs;
+ /* Link this to context save list */
+ list_add_tail(&cs->node, &ctx->cs);
++ initial_setup = true;
+ }
+
+ ret = pm_runtime_get_sync(mcspi->dev);
+ if (ret < 0) {
+ pm_runtime_put_noidle(mcspi->dev);
++ if (initial_setup)
++ omap2_mcspi_cleanup(spi);
+
+ return ret;
+ }
+
+ ret = omap2_mcspi_setup_transfer(spi, NULL);
++ if (ret && initial_setup)
++ omap2_mcspi_cleanup(spi);
++
+ pm_runtime_mark_last_busy(mcspi->dev);
+ pm_runtime_put_autosuspend(mcspi->dev);
+
+ return ret;
+ }
+
+-static void omap2_mcspi_cleanup(struct spi_device *spi)
+-{
+- struct omap2_mcspi_cs *cs;
+-
+- if (spi->controller_state) {
+- /* Unlink controller state from context save list */
+- cs = spi->controller_state;
+- list_del(&cs->node);
+-
+- kfree(cs);
+- }
+-}
+-
+ static irqreturn_t omap2_mcspi_irq_handler(int irq, void *data)
+ {
+ struct omap2_mcspi *mcspi = data;
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 0cc767283674..825cc5b2ab2f 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1254,6 +1254,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip,
+ chip->gpio_cs_inverted = spi->mode & SPI_CS_HIGH;
+
+ err = gpiod_direction_output(gpiod, !chip->gpio_cs_inverted);
++ if (err)
++ gpiod_put(chip->gpiod_cs);
+ }
+
+ return err;
+@@ -1267,6 +1269,7 @@ static int setup(struct spi_device *spi)
+ struct driver_data *drv_data =
+ spi_controller_get_devdata(spi->controller);
+ uint tx_thres, tx_hi_thres, rx_thres;
++ int err;
+
+ switch (drv_data->ssp_type) {
+ case QUARK_X1000_SSP:
+@@ -1413,7 +1416,11 @@ static int setup(struct spi_device *spi)
+ if (drv_data->ssp_type == CE4100_SSP)
+ return 0;
+
+- return setup_cs(spi, chip, chip_info);
++ err = setup_cs(spi, chip, chip_info);
++ if (err)
++ kfree(chip);
++
++ return err;
+ }
+
+ static void cleanup(struct spi_device *spi)
+--
+2.30.2
+
--- /dev/null
+From 8b3656e1de1db1df091fa1d4f17cb390418dfc58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 May 2021 09:47:34 -0700
+Subject: spi: Don't have controller clean up spi device before driver unbind
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit 27e7db56cf3dffd302bd7ddfacb1d405cf671a2a ]
+
+When a spi device is unregistered and triggers a driver unbind, the
+driver might need to access the spi device. So, don't have the
+controller clean up the spi device before the driver is unbound. Clean
+up the spi device after the driver is unbound.
+
+Fixes: c7299fea6769 ("spi: Fix spi device unregister flow")
+Reported-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20210505164734.175546-1-saravanak@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 125116ab3386..e067c54e87dd 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -717,15 +717,15 @@ void spi_unregister_device(struct spi_device *spi)
+ if (!spi)
+ return;
+
+- spi_cleanup(spi);
+-
+ if (spi->dev.of_node) {
+ of_node_clear_flag(spi->dev.of_node, OF_POPULATED);
+ of_node_put(spi->dev.of_node);
+ }
+ if (ACPI_COMPANION(&spi->dev))
+ acpi_device_clear_enumerated(ACPI_COMPANION(&spi->dev));
+- device_unregister(&spi->dev);
++ device_del(&spi->dev);
++ spi_cleanup(spi);
++ put_device(&spi->dev);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_device);
+
+--
+2.30.2
+
--- /dev/null
+From 9b40419858840f67a21562d01967a48433db2f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Apr 2021 16:56:38 -0700
+Subject: spi: Fix spi device unregister flow
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit c7299fea67696db5bd09d924d1f1080d894f92ef ]
+
+When an SPI device is unregistered, the spi->controller->cleanup() is
+called in the device's release callback. That's wrong for a couple of
+reasons:
+
+1. spi_dev_put() can be called before spi_add_device() is called. And
+ it's spi_add_device() that calls spi_setup(). This will cause clean()
+ to get called without the spi device ever being setup.
+
+2. There's no guarantee that the controller's driver would be present by
+ the time the spi device's release function gets called.
+
+3. It also causes "sleeping in atomic context" stack dump[1] when device
+ link deletion code does a put_device() on the spi device.
+
+Fix these issues by simply moving the cleanup from the device release
+callback to the actual spi_unregister_device() function.
+
+[1] - https://lore.kernel.org/lkml/CAHp75Vc=FCGcUyS0v6fnxme2YJ+qD+Y-hQDQLa2JhWNON9VmsQ@mail.gmail.com/
+
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Link: https://lore.kernel.org/r/20210426235638.1285530-1-saravanak@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 6ae7418f648c..125116ab3386 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -47,10 +47,6 @@ static void spidev_release(struct device *dev)
+ {
+ struct spi_device *spi = to_spi_device(dev);
+
+- /* spi controllers may cleanup for released devices */
+- if (spi->controller->cleanup)
+- spi->controller->cleanup(spi);
+-
+ spi_controller_put(spi->controller);
+ kfree(spi->driver_override);
+ kfree(spi);
+@@ -558,6 +554,12 @@ static int spi_dev_check(struct device *dev, void *data)
+ return 0;
+ }
+
++static void spi_cleanup(struct spi_device *spi)
++{
++ if (spi->controller->cleanup)
++ spi->controller->cleanup(spi);
++}
++
+ /**
+ * spi_add_device - Add spi_device allocated with spi_alloc_device
+ * @spi: spi_device to register
+@@ -622,11 +624,13 @@ int spi_add_device(struct spi_device *spi)
+
+ /* Device may be bound to an active driver when this returns */
+ status = device_add(&spi->dev);
+- if (status < 0)
++ if (status < 0) {
+ dev_err(dev, "can't add %s, status %d\n",
+ dev_name(&spi->dev), status);
+- else
++ spi_cleanup(spi);
++ } else {
+ dev_dbg(dev, "registered child %s\n", dev_name(&spi->dev));
++ }
+
+ done:
+ mutex_unlock(&spi_add_lock);
+@@ -713,6 +717,8 @@ void spi_unregister_device(struct spi_device *spi)
+ if (!spi)
+ return;
+
++ spi_cleanup(spi);
++
+ if (spi->dev.of_node) {
+ of_node_clear_flag(spi->dev.of_node, OF_POPULATED);
+ of_node_put(spi->dev.of_node);
+--
+2.30.2
+
--- /dev/null
+From 683b89c6a499290db5e117f837b22d5809c678d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Apr 2021 23:38:02 -0600
+Subject: spi: spi-zynq-qspi: Fix stack violation bug
+
+From: Karen Dombroski <karen.dombroski@marsbioimaging.com>
+
+[ Upstream commit 6d5ff8e632a4f2389c331e5554cd1c2a9a28c7aa ]
+
+When the number of bytes for the op is greater than one, the read could
+run off the end of the function stack and cause a crash.
+
+This patch restores the behaviour of safely reading out of the original
+opcode location.
+
+Signed-off-by: Karen Dombroski <karen.dombroski@marsbioimaging.com>
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@xilinx.com>
+Link: https://lore.kernel.org/r/20210429053802.17650-3-amit.kumar-mahapatra@xilinx.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynq-qspi.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
+index 5d8a5ee62fa2..2765289028fa 100644
+--- a/drivers/spi/spi-zynq-qspi.c
++++ b/drivers/spi/spi-zynq-qspi.c
+@@ -528,18 +528,17 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
+ struct zynq_qspi *xqspi = spi_controller_get_devdata(mem->spi->master);
+ int err = 0, i;
+ u8 *tmpbuf;
+- u8 opcode = op->cmd.opcode;
+
+ dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n",
+- opcode, op->cmd.buswidth, op->addr.buswidth,
++ op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth,
+ op->dummy.buswidth, op->data.buswidth);
+
+ zynq_qspi_chipselect(mem->spi, true);
+ zynq_qspi_config_op(xqspi, mem->spi);
+
+- if (op->cmd.nbytes) {
++ if (op->cmd.opcode) {
+ reinit_completion(&xqspi->data_completion);
+- xqspi->txbuf = &opcode;
++ xqspi->txbuf = (u8 *)&op->cmd.opcode;
+ xqspi->rxbuf = NULL;
+ xqspi->tx_bytes = op->cmd.nbytes;
+ xqspi->rx_bytes = op->cmd.nbytes;
+--
+2.30.2
+
--- /dev/null
+From 7bfe7c7348166186b61df1eb0532722ced49bce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 17:35:34 +0800
+Subject: spi: sprd: Add missing MODULE_DEVICE_TABLE
+
+From: Chunyan Zhang <chunyan.zhang@unisoc.com>
+
+[ Upstream commit 7907cad7d07e0055789ec0c534452f19dfe1fc80 ]
+
+MODULE_DEVICE_TABLE is used to extract the device information out of the
+driver and builds a table when being compiled. If using this macro,
+kernel can find the driver if available when the device is plugged in,
+and then loads that driver and initializes the device.
+
+Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
+Link: https://lore.kernel.org/r/20210512093534.243040-1-zhang.lyra@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sprd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c
+index b41a75749b49..28e70db9bbba 100644
+--- a/drivers/spi/spi-sprd.c
++++ b/drivers/spi/spi-sprd.c
+@@ -1068,6 +1068,7 @@ static const struct of_device_id sprd_spi_of_match[] = {
+ { .compatible = "sprd,sc9860-spi", },
+ { /* sentinel */ }
+ };
++MODULE_DEVICE_TABLE(of, sprd_spi_of_match);
+
+ static struct platform_driver sprd_spi_driver = {
+ .driver = {
+--
+2.30.2
+
--- /dev/null
+From fb54b8d1c2d6a1e0be4decc93b96a3561404008b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 13:49:07 +0800
+Subject: usb: cdns3: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 07adc0225484fc199e3dc15ec889f75f498c4fca ]
+
+When cdns3_gadget_start() fails, a pairing PM usage counter
+decrement is needed to keep the counter balanced.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Link: https://lore.kernel.org/r/20210412054908.7975-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
+index 582bfeceedb4..a49fc68ec2ef 100644
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -3255,8 +3255,10 @@ static int __cdns3_gadget_init(struct cdns *cdns)
+ pm_runtime_get_sync(cdns->dev);
+
+ ret = cdns3_gadget_start(cdns);
+- if (ret)
++ if (ret) {
++ pm_runtime_put_sync(cdns->dev);
+ return ret;
++ }
+
+ /*
+ * Because interrupt line can be shared with other components in
+--
+2.30.2
+
--- /dev/null
+From c6e5c3a5e5032517f64fd7e6c67367182de9014c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 May 2021 18:59:44 +0800
+Subject: usb: chipidea: udc: assign interrupt number to USB gadget structure
+
+From: Li Jun <jun.li@nxp.com>
+
+[ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ]
+
+Chipidea also need sync interrupt before unbind the udc while
+gadget remove driver, otherwise setup irq handling may happen
+while unbind, see below dump generated from android function
+switch stress test:
+
+[ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED
+[ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED
+[ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED
+[ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server)
+[ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14)
+[ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090
+[ 4703.676454] Mem abort info:
+[ 4703.676458] ESR = 0x96000004
+[ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits
+[ 4703.676464] SET = 0, FnV = 0
+[ 4703.676466] EA = 0, S1PTW = 0
+[ 4703.676468] Data abort info:
+[ 4703.676471] ISV = 0, ISS = 0x00000004
+[ 4703.676473] CM = 0, WnR = 0
+[ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000
+[ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000
+[ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O)
+[ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63
+[ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT)
+[ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--)
+[ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8
+[ 4703.789667] lr : android_setup+0x4c/0x168
+[ 4703.793676] sp : ffff80001256bd80
+[ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8
+[ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000
+[ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140
+[ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490
+[ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000
+[ 4703.823554] x19: 0000000000000080 x18: ffff800012561048
+[ 4703.828867] x17: 0000000000000000 x16: 0000000000000039
+[ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277
+[ 4703.839493] x13: 0000000000003934 x12: 0000000000000000
+[ 4703.844805] x11: 0000000000000000 x10: 0000000000000001
+[ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090
+[ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450
+[ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009
+[ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8
+[ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090
+[ 4703.876681] Call trace:
+[ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8
+[ 4703.883397] android_setup+0x4c/0x168
+[ 4703.887059] udc_irq+0x824/0xa9c
+[ 4703.890287] ci_irq+0x124/0x148
+[ 4703.893429] __handle_irq_event_percpu+0x84/0x268
+[ 4703.898131] handle_irq_event+0x64/0x14c
+[ 4703.902054] handle_fasteoi_irq+0x110/0x210
+[ 4703.906236] __handle_domain_irq+0x8c/0xd4
+[ 4703.910332] gic_handle_irq+0x6c/0x124
+[ 4703.914081] el1_irq+0xdc/0x1c0
+[ 4703.917221] _raw_spin_unlock_irq+0x20/0x54
+[ 4703.921405] finish_task_switch+0x84/0x224
+[ 4703.925502] __schedule+0x4a4/0x734
+[ 4703.928990] schedule+0xa0/0xe8
+[ 4703.932132] do_notify_resume+0x150/0x184
+[ 4703.936140] work_pending+0xc/0x40c
+[ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01)
+[ 4703.945732] ---[ end trace ba5c1875ae49d53c ]---
+[ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt
+[ 4703.957223] SMP: stopping secondary CPUs
+[ 4703.961151] Kernel Offset: disabled
+[ 4703.964638] CPU features: 0x0240002,2000200c
+[ 4703.968905] Memory Limit: none
+[ 4703.971963] Rebooting in 5 seconds..
+
+Tested-by: faqiang.zhu <faqiang.zhu@nxp.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Link: https://lore.kernel.org/r/1620989984-7653-1-git-send-email-jun.li@nxp.com
+Signed-off-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/udc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index c16d900cdaee..393f216b9161 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -2061,6 +2061,7 @@ static int udc_start(struct ci_hdrc *ci)
+ ci->gadget.name = ci->platdata->name;
+ ci->gadget.otg_caps = otg_caps;
+ ci->gadget.sg_supported = 1;
++ ci->gadget.irq = ci->irq;
+
+ if (ci->platdata->flags & CI_HDRC_REQUIRES_ALIGNED_DMA)
+ ci->gadget.quirk_avoids_skb_reserve = 1;
+--
+2.30.2
+
--- /dev/null
+From 137c55d8fd4ef578f607d01f121d026676be0fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 21:56:30 +0200
+Subject: vfio-ccw: Reset FSM state to IDLE inside FSM
+
+From: Eric Farman <farman@linux.ibm.com>
+
+[ Upstream commit 6c02ac4c9211edabe17bda437ac97e578756f31b ]
+
+When an I/O request is made, the fsm_io_request() routine
+moves the FSM state from IDLE to CP_PROCESSING, and then
+fsm_io_helper() moves it to CP_PENDING if the START SUBCHANNEL
+received a cc0. Yet, the error case to go from CP_PROCESSING
+back to IDLE is done after the FSM call returns.
+
+Let's move this up into the FSM proper, to provide some
+better symmetry when unwinding in this case.
+
+Signed-off-by: Eric Farman <farman@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Acked-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Message-Id: <20210511195631.3995081-3-farman@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/vfio_ccw_fsm.c | 1 +
+ drivers/s390/cio/vfio_ccw_ops.c | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c
+index 23e61aa638e4..e435a9cd92da 100644
+--- a/drivers/s390/cio/vfio_ccw_fsm.c
++++ b/drivers/s390/cio/vfio_ccw_fsm.c
+@@ -318,6 +318,7 @@ static void fsm_io_request(struct vfio_ccw_private *private,
+ }
+
+ err_out:
++ private->state = VFIO_CCW_STATE_IDLE;
+ trace_vfio_ccw_fsm_io_request(scsw->cmd.fctl, schid,
+ io_region->ret_code, errstr);
+ }
+diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
+index 767ac41686fe..5971641964c6 100644
+--- a/drivers/s390/cio/vfio_ccw_ops.c
++++ b/drivers/s390/cio/vfio_ccw_ops.c
+@@ -276,8 +276,6 @@ static ssize_t vfio_ccw_mdev_write_io_region(struct vfio_ccw_private *private,
+ }
+
+ vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_IO_REQ);
+- if (region->ret_code != 0)
+- private->state = VFIO_CCW_STATE_IDLE;
+ ret = (region->ret_code != 0) ? region->ret_code : count;
+
+ out_unlock:
+--
+2.30.2
+
--- /dev/null
+From bdb70788e2a041786de47e32571c0c9cdc72ccc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 May 2021 21:56:31 +0200
+Subject: vfio-ccw: Serialize FSM IDLE state with I/O completion
+
+From: Eric Farman <farman@linux.ibm.com>
+
+[ Upstream commit 2af7a834a435460d546f0cf0a8b8e4d259f1d910 ]
+
+Today, the stacked call to vfio_ccw_sch_io_todo() does three things:
+
+ 1) Update a solicited IRB with CP information, and release the CP
+ if the interrupt was the end of a START operation.
+ 2) Copy the IRB data into the io_region, under the protection of
+ the io_mutex
+ 3) Reset the vfio-ccw FSM state to IDLE to acknowledge that
+ vfio-ccw can accept more work.
+
+The trouble is that step 3 is (A) invoked for both solicited and
+unsolicited interrupts, and (B) sitting after the mutex for step 2.
+This second piece becomes a problem if it processes an interrupt
+for a CLEAR SUBCHANNEL while another thread initiates a START,
+thus allowing the CP and FSM states to get out of sync. That is:
+
+ CPU 1 CPU 2
+ fsm_do_clear()
+ fsm_irq()
+ fsm_io_request()
+ vfio_ccw_sch_io_todo()
+ fsm_io_helper()
+
+Since the FSM state and CP should be kept in sync, let's make a
+note when the CP is released, and rely on that as an indication
+that the FSM should also be reset at the end of this routine and
+open up the device for more work.
+
+Signed-off-by: Eric Farman <farman@linux.ibm.com>
+Acked-by: Matthew Rosato <mjrosato@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Message-Id: <20210511195631.3995081-4-farman@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/vfio_ccw_drv.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
+index 8c625b530035..9b61e9b131ad 100644
+--- a/drivers/s390/cio/vfio_ccw_drv.c
++++ b/drivers/s390/cio/vfio_ccw_drv.c
+@@ -86,6 +86,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
+ struct vfio_ccw_private *private;
+ struct irb *irb;
+ bool is_final;
++ bool cp_is_finished = false;
+
+ private = container_of(work, struct vfio_ccw_private, io_work);
+ irb = &private->irb;
+@@ -94,14 +95,21 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
+ (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT));
+ if (scsw_is_solicited(&irb->scsw)) {
+ cp_update_scsw(&private->cp, &irb->scsw);
+- if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING)
++ if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) {
+ cp_free(&private->cp);
++ cp_is_finished = true;
++ }
+ }
+ mutex_lock(&private->io_mutex);
+ memcpy(private->io_region->irb_area, irb, sizeof(*irb));
+ mutex_unlock(&private->io_mutex);
+
+- if (private->mdev && is_final)
++ /*
++ * Reset to IDLE only if processing of a channel program
++ * has finished. Do not overwrite a possible processing
++ * state if the final interrupt was for HSCH or CSCH.
++ */
++ if (private->mdev && cp_is_finished)
+ private->state = VFIO_CCW_STATE_IDLE;
+
+ if (private->io_trigger)
+--
+2.30.2
+
--- /dev/null
+From f7668818020e2d467a27105e6e71b919e89c9c3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 May 2021 19:14:22 +0900
+Subject: wq: handle VM suspension in stall detection
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit 940d71c6462e8151c78f28e4919aa8882ff2054e ]
+
+If VCPU is suspended (VM suspend) in wq_watchdog_timer_fn() then
+once this VCPU resumes it will see the new jiffies value, while it
+may take a while before IRQ detects PVCLOCK_GUEST_STOPPED on this
+VCPU and updates all the watchdogs via pvclock_touch_watchdogs().
+There is a small chance of misreported WQ stalls in the meantime,
+because new jiffies is time_after() old 'ts + thresh'.
+
+wq_watchdog_timer_fn()
+{
+ for_each_pool(pool, pi) {
+ if (time_after(jiffies, ts + thresh)) {
+ pr_emerg("BUG: workqueue lockup - pool");
+ }
+ }
+}
+
+Save jiffies at the beginning of this function and use that value
+for stall detection. If VM gets suspended then we continue using
+"old" jiffies value and old WQ touch timestamps. If IRQ at some
+point restarts the stall detection cycle (pvclock_touch_watchdogs())
+then old jiffies will always be before new 'ts + thresh'.
+
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 79f2319543ce..994eafd25d64 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -50,6 +50,7 @@
+ #include <linux/uaccess.h>
+ #include <linux/sched/isolation.h>
+ #include <linux/nmi.h>
++#include <linux/kvm_para.h>
+
+ #include "workqueue_internal.h"
+
+@@ -5772,6 +5773,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ {
+ unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ;
+ bool lockup_detected = false;
++ unsigned long now = jiffies;
+ struct worker_pool *pool;
+ int pi;
+
+@@ -5786,6 +5788,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ if (list_empty(&pool->worklist))
+ continue;
+
++ /*
++ * If a virtual machine is stopped by the host it can look to
++ * the watchdog like a stall.
++ */
++ kvm_check_and_clear_guest_paused();
++
+ /* get the latest of pool and touched timestamps */
+ if (pool->cpu >= 0)
+ touched = READ_ONCE(per_cpu(wq_watchdog_touched_cpu, pool->cpu));
+@@ -5799,12 +5807,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused)
+ ts = touched;
+
+ /* did we stall? */
+- if (time_after(jiffies, ts + thresh)) {
++ if (time_after(now, ts + thresh)) {
+ lockup_detected = true;
+ pr_emerg("BUG: workqueue lockup - pool");
+ pr_cont_pool_info(pool);
+ pr_cont(" stuck for %us!\n",
+- jiffies_to_msecs(jiffies - pool_ts) / 1000);
++ jiffies_to_msecs(now - pool_ts) / 1000);
+ }
+ }
+
+--
+2.30.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
